refactor: lay out both halves in FSD and share the /auth contract across them

.agents/skills/dsh-auth-code-review/SKILL.md

@@ -30,7 +30,7 @@ required behavior over style; one substantiated blocker beats a list of nits.
    what this wrap installed: it never restores a snapshot over route tables other plugins own
    (post-wrap routes must survive, disposed routes must not come back; decisions D27).
 4. **Real entry path.** Integration tests mount the real cordis/webserver/storage stack
-   (`src/integration.*.test.ts`). Hand-mounted fakes cannot catch a silent mount-point failure —
+   (`test/integration/integration.*.test.ts`). Hand-mounted fakes cannot catch a silent mount-point failure -
    and silent failure means an unguarded deployment (plan §7).
 5. **Enforcement.** Follow every denial path to the operation that enforces it: 302 vs 401
    selection, upgrade rejection before ws negotiation, no-store headers. Exercise alternate

.agents/skills/dsh-auth-pre-push/SKILL.md

@@ -22,13 +22,13 @@ only checks invalidated by it.
 
 ## Select relevant evidence
 
-- **Guard/gate/session-store behavior:** `npm run test -- src/<module>.test.ts`, or a focused
+- **Guard/gate/session-store behavior:** `npm run test -- src/host/<layer>/<slice>/<segment>/<module>.test.ts`, or a focused
   test name via `-t`.
 - **Coverage for the affected source:**
-  `npm run test -- src/<module>.test.ts --coverage --coverage.include='src/<module>.ts'`.
+  `npm run test -- <path>/<module>.test.ts --coverage --coverage.include='<path>/<module>.ts'`.
   Never lower thresholds or narrow the include to hide an uncovered affected file.
-- **Mount-point behavior:** both integration files (`src/integration.guard.test.ts`,
-  `src/integration.session.test.ts`) — the regression net for the non-contractual seam
+- **Mount-point behavior:** both integration files (`test/integration/integration.guard.test.ts`,
+  `test/integration/integration.session.test.ts`) - the regression net for the non-contractual seam
   (plan §7).
 - **Dependencies or lockfile:** `npm run lock:check`; the install must have used
   `--registry=https://registry.npmjs.org/`.

.github/workflows/ci.yml

@@ -29,6 +29,7 @@ jobs:
       - run: npm run lint
       - run: npm run lint:no-emdash
       - run: npm run slice:check
+      - run: npm run lint:fsd
       - run: npm run decisions:check
       - run: npm run docs:check
 
@@ -65,6 +66,7 @@ jobs:
       - run: npm ci
       - run: npm run build
       - run: npm run bundle:check
+      - run: npm run host:check
       - name: Verify committed lib/ matches a fresh build
         run: git diff --exit-code -- lib
       # dsh installs this package into a profile with `npm install` (devDeps

.rsp/TechDebt.md

@@ -0,0 +1,13 @@
+# Tech Debt
+
+## `host:check` carries a copy of the dsh shell's module table
+
+- **Where:** `scripts/check-host.mjs`, `HOST_MODULES`.
+- **What:** The list of modules the dsh web shell seeds into its module table is copied by hand
+  from dsh `packages/client/web/src/platform.ts` (`PLATFORM_MODULES`). It was checked against dsh
+  commit `b2e3b2a` on 2026-10-16, and `dsh-lingualab` keeps a third copy in its own
+  `scripts/check-host.mjs` and `tsdown.config.ts`.
+- **Why it is debt:** When the host adds or removes a seeded module, nothing here notices. A module
+  the host drops would still pass `host:check` and fail in the browser at runtime.
+- **Way out:** Read the list from an installed dsh package, or from a contract file the host
+  publishes, once one of them ships it. Then delete the copy in this script and in `dsh-lingualab`.

AGENTS.md

@@ -66,8 +66,8 @@ tables).
 
 ## Verifying a change actually works
 
-1. **`npm run verify`** — format check + lint + type-check + coverage tests
-   (80% red line) + `lock:check`. Must pass before committing.
+1. **`npm run verify`** - format check + lint + layering (`slice:check`, `lint:fsd`) +
+   type-check + coverage tests (80% red line) + `lock:check`. Must pass before committing.
 2. **`src/` edits require rebuilding `lib/`** (`npm run build`) and committing
    the regenerated artifact in the same change. `lib/` is generated, never
    hand-edited, and CI fails on drift (`git diff --exit-code -- lib`).
@@ -99,3 +99,14 @@ Versioning is owned by release-please (`.github/workflows/release.yml`):
 
 See `README.md`. Docs live under `docs/` (plan + development conventions);
 build output under `lib/`; CI parity checks under `.github/workflows/`.
+
+Source layout follows Feature-Sliced Design (decision D30, in `docs/decisions/implemented/`):
+the host half lives in `src/host/` with the lower three layers (`shared`, `entities`,
+`features`) and the client half in `src/client/` with `shared`, `entities`, `features` and
+`widgets` (no `app`, `index.tsx` stays at its root); both are checked by Steiger
+(`npm run lint:fsd`). Entry points and wiring sit at the `src/` root. Cross-slice and
+cross-segment imports go through `index.ts`, features never import each other, and the client
+and host halves never import each other (`slice:check`). The `/auth/*` paths both halves share
+live only in `src/protocol/` (D31), reached through `src/host/shared/protocol/` and
+`src/client/shared/api/protocol.ts`; never write a route literal anywhere else. The tree is in
+`docs/specs/development.md` "Structure".

README.md

@@ -484,9 +484,9 @@ is in `docs/deployed/known-limitations.md`.
 
 Built on the engineering conventions of
 [dsh-plugin-framework](https://github.com/TecFancy/dsh-plugin-framework): barrel-only
-cross-slice imports, the `npm run verify` gate chain, and decision records. `verify`
-runs format / lint / no-emdash / slice / lock / decisions / docs / readme-parity /
-type-check / coverage 80% / build / bundle; tests, build and the release flow are
+cross-slice imports (Feature-Sliced Design layers, checked by Steiger), the `npm run verify` gate chain, and decision records. `verify`
+runs format / lint / no-emdash / slice / fsd / lock / decisions / docs / readme-parity /
+type-check / coverage 80% / build / bundle / host contract; tests, build and the release flow are
 documented in `docs/specs/development.md`.
 
 ## License

README.zh.md

@@ -404,9 +404,9 @@ systemd 示例：`deploy/systemd/dsh-auth-proxy.service.example`。
 ## 开发
 
 本仓库遵循 [dsh-plugin-framework](https://github.com/TecFancy/dsh-plugin-framework) 的工程约定：
-跨 slice 只通过 barrel 引用，以 `npm run verify` 作为门禁链，并保留决策记录（ADR）。`verify`
-依次运行 format / lint / no-emdash / slice / lock / decisions / docs / readme-parity / type-check /
-覆盖率 80% / build / bundle；测试、构建和发版流程见 `docs/specs/development_zh.md`。
+跨 slice 只通过 barrel 引用（Feature-Sliced Design 分层，由 Steiger 检查），以 `npm run verify` 作为门禁链，并保留决策记录（ADR）。`verify`
+依次运行 format / lint / no-emdash / slice / fsd / lock / decisions / docs / readme-parity / type-check /
+覆盖率 80% / build / bundle / 宿主契约；测试、构建和发版流程见 `docs/specs/development_zh.md`。
 
 ## 许可证
 

docs/decisions.md

@@ -40,14 +40,17 @@
 → [zh](decisions/implemented/2026-08-30-configurable-logout-order.zh.md) ·
 [en](decisions/implemented/2026-08-30-configurable-logout-order.en.md)（回填自 v0.10.0）
 
-## D5. src 分层 + 跨 slice 只走 barrel
+## D5. src 分层 + 跨 slice 只走 barrel（已归档，被 D30 取代）
 
 `gate/`/`session/` 核心机制层 + `features/{token,password,proxy}` + `shared/` 叶子层，
 跨 slice 唯一 barrel 入口，feature 同层互禁；verify 链新增 slice/bundle/no-emdash/build 门禁。
 **替代方案**：完整 FSD；保持平铺；session 作 feature slice（执行中被边界检查否决，降层）；
 轻量 ADR 制度（被官方实践否决）。**为什么**：层匹配依赖图，机器约束防回潮。
-→ [zh](decisions/implemented/2026-08-30-layered-src-with-barrels.zh.md) ·
-[en](decisions/implemented/2026-08-30-layered-src-with-barrels.en.md)（2026-08-30 实施）
+目录部分已被 D30 取代（`gate/`/`session/`/`http/` 核心机制层改为 FSD 的 `src/host/` 下三层，client 半边也分层）；
+「跨 slice 只走 index.ts」「feature 同层互禁」「client 与 host 互不引用」三条纪律保留，改由 Steiger 与
+`slice:check` 执行。
+→ [zh](decisions/archived/2026-08-30-layered-src-with-barrels.zh.md) ·
+[en](decisions/archived/2026-08-30-layered-src-with-barrels.en.md)（2026-08-30 实施，2026-10-13 归档）
 
 ## D6. TOTP 两段式登录采用无状态挑战 cookie
 
@@ -93,15 +96,17 @@ revokeBySubject / 登录 CSRF token / 限速与防重放持久化，M4 再评估
 → [zh](decisions/implemented/2026-08-30-totp-signed-challenge-cookie.zh.md) ·
 [en](decisions/implemented/2026-08-30-totp-signed-challenge-cookie.en.md)
 
-## D11. 认证 HTTP 端点公共件独立成 http 层
+## D11. 认证 HTTP 端点公共件独立成 http 层（已归档，被 D30 取代）
 
 token/password 重复的端点件（logout/status/兜底/Method 守卫）抽进新核心机制层
 `src/http/`（与 gate、session 并列，经 barrel 引用），`shared` 保持叶子层不变。
 **替代方案**：下沉 `shared`（破坏叶子约束，或得把 cookie 构造当参数注入）；
 塞进 `session`（methodNotAllowed 与会话无关）；保持重复（改一处得记得另一处）。
 **为什么**：去重只有这一条依赖方向干净的落点，slice:check 加白名单即可守护。
-→ [zh](decisions/implemented/2026-09-13-http-endpoint-layer.zh.md) ·
-[en](decisions/implemented/2026-09-13-http-endpoint-layer.en.md)
+`src/http/` 层已被 D30 取代：与会话无关的件进 `src/host/shared/http`，`handleLogout`/`handleStatus`
+进 `src/host/entities/session/api`。
+→ [zh](decisions/archived/2026-09-13-http-endpoint-layer.zh.md) ·
+[en](decisions/archived/2026-09-13-http-endpoint-layer.en.md)（2026-10-13 归档）
 
 ## D12. 宿主要求声明 + storage-domain 转 peer
 
@@ -412,3 +417,31 @@ gate 已放行、但请求是跨站顶层文档导航（`GET` + `Sec-Fetch-Site:
 同源文档发起的导航才算同站，且重试的 `Sec-Fetch-Site` 是 `same-origin`，构造上不循环。
 → [zh](decisions/implemented/2026-10-13-cross-site-navigation-bounce.zh.md) ·
 [en](decisions/implemented/2026-10-13-cross-site-navigation-bounce.en.md)
+
+## D30. host 半边进 `src/host/` 用 FSD 下三层，client 半边用 FSD 分层
+
+两个半边都改用 Feature-Sliced Design 分层并由 Steiger 守护（`npm run lint:fsd` 先后跑 `src/host` 与
+`src/client`）：host 收进 `src/host/{shared,entities,features}`（无 widgets/pages/app，入口与装配留在
+`src/` 根），client 在 `src/client/` 下用 `shared`/`entities`/`features`/`widgets`（`index.tsx` 留在树根，
+无 `pages`、无 `app`），integration 测试搬进 `test/integration/`。`slice:check` 缩成 Steiger 看不到的部分
+（两半边互不导入、根文件只经 index.ts 进 host、导入无法解析即失败、不许有游离文件）。取代 D5 与 D11 的目录部分，
+二者归档。`context.ts` 落在 `shared/api`；client 没有强迫任何改名。
+**替代方案**：保持 D5 只整理测试；只改 client；host 不加 `src/host/` 外壳；host 照搬五层；ESLint
+`no-restricted-paths` 分区代替 Steiger；`handleLogout`/`handleStatus` 留 `shared/http` 靠注入；integration
+测试留在 `src/` 根。**为什么**：与 dsh-lingualab、dsh-plugin-framework 同一套结构，检查换成现成工具，层与依赖图
+重新对齐，并顺带堵住 helper 进包、`lib/` 积累孤儿两个发布漏洞。
+→ [zh](decisions/implemented/2026-10-12-fsd-host-and-client.zh.md) ·
+[en](decisions/implemented/2026-10-12-fsd-host-and-client.en.md)（2026-10-13 实施）
+
+## D31. `/auth/*` 路径与载荷形状收进跨半边契约 `src/protocol/`
+
+路由路径、登录页原因键与由它们拼出的 URL 只在 `src/protocol/index.ts` 定义一次（纯常量与纯函数，不 import
+任何东西），host 经 `src/host/shared/protocol/`、client 经 `src/client/shared/api/protocol.ts` 两个桥进入，
+其余文件不再写路径字面量；`slice:check` 强制只有两个桥能引用它。端点的请求体、响应体、错误体与共用取值集合
+是 `src/protocol/payloads.ts` 里的纯类型，经同样两个桥进入，取代了 client 手写的 `admin-types.ts` 镜像。
+**替代方案**：放进 `host/shared`（client 要开直引例外，误引 barrel 会把 Node 代码打进 bundle）；推广源码文本钉子
+（只能发现、不能消除重复）；两半边直引不设桥（Steiger 看到越树深层 import）；保留载荷镜像靠测试兜（改名照样编译）；
+契约里放 zod schema（契约须零 import，zod 会进 bundle）；契约里再放路由表（与按接线注册的实际集合不符）。
+**为什么**：一份定义直接消除漂移的来源，契约零依赖所以两种构建都能安全包含，桥让 D30 的分层检查不受影响。
+→ [zh](decisions/implemented/2026-10-16-cross-half-protocol.zh.md) ·
+[en](decisions/implemented/2026-10-16-cross-half-protocol.en.md)

docs/decisions/archived/.manifest.json

@@ -1 +1,6 @@
-{}
+{
+  "2026-08-30-layered-src-with-barrels.en.md": "ef4aba4601cd786e2004176b006b1a9d97bf290c93fa52c4444c7b4314c310f3",
+  "2026-08-30-layered-src-with-barrels.zh.md": "6848b5645e07c5d67d0411e4712c0b96fe9427df8d31fd273ad280371c13b1c3",
+  "2026-09-13-http-endpoint-layer.en.md": "b43379c6ed2c93f37e6718b88d57dc340bad83ecede9aead516af64cd71e7886",
+  "2026-09-13-http-endpoint-layer.zh.md": "65d36742ba37897314ec897ce65c0bbbd7b270e5f99653565c4ef207e7a3263e"
+}