# Unbreak the DSH native smoke install against floating cordis peers

## Traceability

- Spec ID: dsh-native-smoke-cordis-peer-floor
- Status: Implemented

## Intent

Restore the two DeepSeek Harness native smoke steps, which fail during `npm
install` before any assertion runs. Both steps pin `@deepseek-ai/cordis`
exactly while leaving the sibling `@deepseek-ai/cordis-plugin-*` peers to float,
so an upstream sibling release that raises its cordis floor breaks the install
on every branch at once.

## Acceptance Scenarios

- AC-1: `npm run test:dsh-native` and
  `npm run test:dsh-configured-assets-native` resolve their unlockfiled owner
  install and reach their existing pass output.
- AC-2: The DSH owner packages stay pinned at `DSH_NATIVE_VERSION`, and the
  existing per-package version assertion still guards them, so the fix does not
  widen what the smoke steps accept.
- AC-3: Each pin records why it must track the highest cordis floor the floating
  sibling peers declare, so the next sibling release is diagnosed as a peer-floor
  bump rather than a smoke-test regression.

## Non-goals

- Adding a lockfile, offline cache, or `--legacy-peer-deps` escape to the smoke
  installs. Resolving against the live registry is the contract these steps
  verify.
- Pinning the whole cordis plugin family. That is the durable fix but changes
  what the smoke steps observe, so it needs its own decision.
- Changing DSH adapter behavior, asset baselines, or session evidence.

## Plan and Tasks

1. Raise the `@deepseek-ai/cordis` pin from `4.0.1` to `4.0.2` in
   `scripts/dsh-skill-discovery/native-smoke.mjs` and
   `scripts/dsh-configured-assets/native-smoke.mjs`.
2. Comment both pins with the peer-floor coupling that makes them fragile.
3. Verify both smoke steps end to end, and verify the failure is causal by
   resolving the same specs at the old and new pin.

## Test and Review Evidence

- Root cause: `@deepseek-ai/cordis-plugin-group@1.0.2` was published
  2026-08-30T13:13:18Z with peer `@deepseek-ai/cordis@^4.0.2`. It reaches the
  smoke install as a floating peer of `@deepseek-ai/dsh-app-boot@0.1.1-rc.2`
  (`^1.0.1`), which conflicts with the exact `4.0.1` pin. The last green `main`
  CI run predates that publish by about nine hours, so the break is upstream
  drift rather than a repository change.
- AC-1: `npm run test:dsh-native` reports `"discovery": "verified"`, and
  `npm run test:dsh-configured-assets-native` reports
  `{"phase":"native-dsh","status":"pass"}` plus
  `{"phase":"better-harness-comparison","status":"pass"}` with exit code 0 on
  local darwin.
- Causality: a dry-run resolve of `@deepseek-ai/cordis@4.0.1` with
  `@deepseek-ai/dsh-app-boot@0.1.1-rc.2` fails `ERESOLVE`; the same resolve at
  `4.0.2` adds 19 packages, selecting cordis 4.0.2 and
  cordis-plugin-group 1.0.2.
- AC-2: `DSH_NATIVE_VERSION` and `DSH_NATIVE_SOURCE_SHA` are unchanged, and the
  smoke output still reports `"dshVersion":"0.1.1-rc.2"` and the pinned source
  SHA.
- Risk: this only moves the floor to today's sibling requirement. Any future
  `cordis-plugin-*` release that raises the floor again will fail the same way,
  on every open branch, before tests run. Treat a sudden repository-wide red at
  the `test:dsh-*` steps as a peer-floor bump first.