[Bug] One plugin with a pre-e459e32637 typert manifest withdraws every typert definition — web UI unusable (session/control: definition-unavailable)

[wowlegend]

Summary

Since e459e32 ("perf(typert): materialize generated schemas on first use"), typert-loader requires a create() factory on every manifest schema and strict codec, and rejects the previous schema: shape outright. That is expected for a pre-stable format. The problem is the blast radius. One out-of-tree plugin whose ./typert artifact was generated before that commit makes the loader throw, and the throw withdraws every typert definition, including in-tree ones. The web client then shows only "Failed to load plugins", and no session can run: session/control itself is unavailable.

The server log reports this only as dsh: warning: 1 entry did not activate, which reads as non-fatal.

Reproduction

1. Install an out-of-tree plugin whose package exports ./typert, generated by @deepseek-ai/dsh-typert-generator before e459e32. Its manifest codecs carry schema: instead of create:.
2. Start dsh web on 0.1.6-alpha.2 or later. The loader rule is unchanged at 0.1.7-alpha.2 (0010283).

Current behavior

Server log:

dsh: warning: 1 entry did not activate
typert-loader (@deepseek-ai/dsh-typert-loader): AggregateError: typert-loader: 1 typert contributor(s) failed to register:
  - typert-loader: <plugin> invocation "<plugin>#<service>/<method>" parameter codec has no create() factory

Browser console. The endpoints are in-tree, not the failing plugin's:

[session-controller] control stream failed: RemoteError: typert gateway: session/control: its strict definition was withdrawn and SRC fallback is forbidden
[ui-cordis] reading the Cordis inventory failed: Error: gateway/definition-unavailable: typert gateway: dynamicCordisRunner/inventory: its strict definition was withdrawn and SRC fallback is forbidden
[cordis-client-runner] syncing inspect providers failed: Error: gateway/definition-unavailable: typert gateway: dynamicCordisRunner/syncInspectManifest: its strict definition was withdrawn and SRC fallback is forbidden

How it spreads, from reading the source at 0010283:

• packages/typert/loader/src/index.ts:410 registers each valid contributor (registered.set(entryName, ctx.typert.register(manifest))). Only afterwards does :459 throw the AggregateError for the invalid one.
• The throw fails the loader's fiber. Cordis unloads it (vendor/cordis/src/fiber.ts, the INACTIVE / _unload() path), which disposes the registrations it had just made.
• packages/typert/registry/src/service.ts:144 records each committed endpoint in history, and withdraw (:151) does not remove it. So hasSeen stays true with no definition behind it, and the gateway answers its strict definition was withdrawn and SRC fallback is forbidden (packages/api/gateway/src/index.ts:750).

Net effect: one stale third-party artifact disables the typert layer for every in-tree package, while the failing plugin's own endpoints (never committed) still fall through to SRC.

Expected behavior

• An invalid contributor is rejected on its own, and the valid contributors stay registered. The failure then costs one plugin, not the UI.
• The generated manifest carries a format version, so the loader can say "this plugin was generated for an older typert manifest format; rebuild it with dsh-typert-generator ≥ X" instead of a shape error. There is currently no version signal an out-of-tree author can key on.
• Optionally, a one-release deprecation window where schema: manifests load with a warning.

Workaround

Remove the plugin from the profile's dsh.profile.bundles and restart, or rebuild it with @deepseek-ai/dsh-typert-generator@0.1.7-alpha.2. A rebuilt manifest emits create: codecs and loads, and the rest of the UI is unaffected either way.

Environment

macOS arm64, source checkout, dsh web. Observed on 0.1.6-alpha.2 (ddefc45). The loader rule is the same at 0.1.7-alpha.2 (0010283).

Related, but not the same: #6134 (tolerate plugin failures in the loader), #2229 (the fatal screen offers no recovery).