547aacee2f
Adversarial-review findings (own reviewer agent), each verified and pinned: B1: agents.register() returned a wrapper lambda, so the factory composite's yield could not identity-nest it — on OWNER unload the unregistration (and agent/disposed) disposed as a concurrent sibling, firing mid-drain while the final turn was still closing (pre-existing on master; this branch's docs re-assert the order, so it must be true). register() now returns the EXACT cordis effect disposer (the Scope.rawDispose move); the composite nests it and owner unload runs stop/drain -> unregister -> detach -> scope like every other path. Regression test pins turn-end before disposed before detach on owner unload. B2: the structured two-phase commit could promote a stale stage when a later capture call REUSED the orphaned stage's call id with a body that never staged (denied downstream, or invalid args throwing pre-stage). The runtime's pre-execute listener now clears any stale stage unconditionally when a new capture call enters the pipeline — only a call's own body can stage for its commit; the call-id mismatch guard becomes a defensive second layer. Repro test: blocked capture then same-id invalid call. C1: an explicit empty toolFilter config now fails at plugin LOAD (the check is self-contained) instead of killing every delegation at child setup. C2: Scope.dispose/ScopeHost.dispose @returns state the single-shot repeat-call semantics honestly.
dsh-scope
Scoped-context registration primitive. createScope(ctx, key) mints a Cordis context that TAGS everything registered through it with an opaque ScopeKey and OWNS those registrations' lifetime (one backing fiber drives both facts); scopeOf(ctx) reads the tag; scopeTarget(base, key) builds the dispatch carrier that makes an event scope-filtered — listeners registered through a scoped context fire only for their key's subject, while plain plugin listeners keep firing for every subject. The agent loop is the one scope minter today (one scope per live agent, key = the Agent object — the Agent.ctx contract in dsh-agent), but the mechanism is key-agnostic so packages below the agent layer (dsh-session, dsh-system-prompt) depend on it without a dependency cycle.
Public API
createScope(ctx: Context, key: ScopeKey): ScopeMint a scope underctx's fiber. Usable synchronously (effect collection is uid-gated; service resolution falls through to the minting plugin's dependency surface). Throws on a primitive key, or whenctx's fiber is disposing (INACTIVE_EFFECT).Scope.ctxThe tagged context: registrations through it are scope-visible AND scope-lifetime. Derived contexts (anextend, a fiber mounted under it) inherit the tag; nested scopes shadow (nearest tag wins).Scope.rawDisposeThe EXACT Cordis disposer for the backing fiber — a composite (generator) effect yields THIS function to nest the scope's teardown at that yield position (Cordis dedupes nested effects by function identity; yielding a wrapper leaves the scope disposing as a concurrent sibling).Scope.dispose(): Promise<void>Idempotent, always-awaitable teardown of every registration made through the scope.scopeOf(ctx: Context): ScopeKey | undefinedThe tag a context (or any context derived from it) carries;undefined= context-global.scopeTarget(base: T, key?: ScopeKey): Scoped<T>Build the dispatchthisArgfor a scope-filtered event: composesbase's ownContext.filterwith the scope predicate (untagged listener ⇒ admitted; tagged ⇒ admitted iff tag === key;key === undefined⇒ untagged only). Listenerthisstaysbase-shaped.{ global: true }listeners bypass filtering (Cordis semantics).Scoped<T>The compile-time carrier brand: scope-filtered events demand it as theirthistype, so dispatching with a bare subject is a compile error.isScopeCarrier(value)/carrierKeyOf(value)Runtime carrier marks, used by the dev invariants to assert every scope-filtered dispatch carries a carrier keyed to the subject its arguments name.
Design contract
Ownership and visibility derive from ONE fact — which context a registration went through. An explicit { scope } registration parameter could express "visible to X, disposed with Y", which is almost always a bug; the scoped context makes it unrepresentable. Rationale and alternatives: the agent-scoped-registration RFC (docs/rfc/implemented/architecture/2026-07-08-agent-scoped-registration.md, landing with this change set).
Handing out a scoped context hands out the minting plugin's service-resolution capability (resolution walks the minting fiber's dependency chain, not the holder's) — mint scopes from a plugin whose inject surface is what scope holders should reach.