Merge remote-tracking branch 'origin/master' into xtr/react-loop-simplification

# Conflicts:
#	.agents/notes/implemented/architecture/2026-07-19-package-owned-invariant-service.i18n.yaml
#	examples/acp-agent/tests/snapshots/fs-glob-sampling/session.jsonl
#	packages/ui/tui/README.i18n.yaml
#	packages/ui/tui/src/components/dialogs.ts
#	packages/ui/tui/tests/tui.spec.ts

apps/cli/tests/built-bin.e2e.ts

@@ -94,6 +94,8 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
       expect(stdout).toContain('model: deepseek-v4-pro')
       expect(stdout).toContain('cwd: !!js process.cwd()')
       expect(stdout).toContain("name: '@deepseek-ai/dsh-tui'")
+      expect(stdout).not.toMatch(/name: ['"]@deepseek-ai\/dsh-invariants['"]/)
+      expect(stdout).not.toMatch(/name: ['"]@deepseek-ai\/dsh-[^'"]+\/invariant['"]/)
       expect(stdout).toContain([
         '- id: tool-web',
         "  name: '@deepseek-ai/dsh-tool-web'",
@@ -140,6 +142,8 @@ describe.skipIf(!existsSync(dshBin))('dsh BUILT bin (node lib/bin.js, no tsx)',
       expect(code).toBe(0)
       expect(stdout).toContain("name: '@deepseek-ai/dsh-host-webserver'")
       expect(stdout).not.toContain("name: '@deepseek-ai/dsh-tui'")
+      expect(stdout).not.toMatch(/name: ['"]@deepseek-ai\/dsh-invariants['"]/)
+      expect(stdout).not.toMatch(/name: ['"]@deepseek-ai\/dsh-[^'"]+\/invariant['"]/)
     }, 30_000)
   })
 })

apps/cli/tests/shipped-composition.e2e.ts

@@ -52,10 +52,10 @@ const EXPECTED_TUI_TOOLS = [
 ]
 
 /**
- * `glob` and `grep` come from `dsh-tool-fs-search`, which probes `command -v rg`
- * through the mounted bash executor at load and registers neither tool when
- * ripgrep is absent. That is a host dependency, not a composition decision, so the
- * pair is asserted separately — present together or absent together.
+ * `glob` and `grep` come from `dsh-tool-fs-search`, which spawns the PACKAGED
+ * ripgrep binary (`@vscode/ripgrep`) through the subprocess seam, so the pair
+ * is always present on every host — asserted as fixed members, not a host
+ * dependency.
  */
 const RIPGREP_TOOLS = ['glob', 'grep']
 
@@ -123,7 +123,9 @@ describe('shipped dsh composition (real Loader tree in a PTY)', () => {
     expect(output).toContain(COMPOSITION_REPLY_TEXT)
     expect(output).toContain(PERMISSION_SUMMARY)
     expect(observed?.names.filter(name => !RIPGREP_TOOLS.includes(name))).toEqual(EXPECTED_TUI_TOOLS)
-    expect([[], RIPGREP_TOOLS]).toContainEqual(observed?.names.filter(name => RIPGREP_TOOLS.includes(name)))
+    // The packaged ripgrep binary ships with the dependency, so the pair is a
+    // fixed roster member on every host.
+    expect(observed?.names.filter(name => RIPGREP_TOOLS.includes(name))).toEqual(RIPGREP_TOOLS)
     expect(observed?.bashArguments).toHaveProperty('sandbox_permissions')
     expect(observed?.bashArguments).toHaveProperty('justification')
     expect(observed?.permissionEvents).toEqual([