# v2.1.5 DVR 2.1.5 is a compatibility, reliability, and release-hardening patch. It moves the fixed stable evidence to DSH `0.1.5-rc.1`, keeps exact preview evidence on `0.1.5-alpha.2`, fixes live Vision-twin reconciliation and wrapped-model switching, and modularizes the oversized Core runtime without changing the public 2.1.x routing model or minimum Host floor. ## DSH 0.1.5 stable / preview compatibility - Supports the current npm stable Host `0.1.5-rc.1` while keeping DSH `0.1.0-rc.8` as the public minimum for DVR 2.1.x. Exact `0.1.5-alpha.2` coverage remains preview verification evidence only, not a blanket preview-support promise. - Admits the exact verified `0.1.5-alpha.1`, `0.1.5-alpha.2`, and `0.1.5-rc.1` Host peers without using a broad semver range that would silently promise compatibility with future untested DSH releases. - Moves the required current Host contract, Node 22/24 release-family contracts, exact source checks, and real Host + Chromium browser gates onto `0.1.5-rc.1`; the exact preview gates move to `0.1.5-alpha.2`. - Pins exact source evidence to immutable upstream commits and verifies the checkout SHA before running attachment normalization, LLM adapter, session/remotes, and Web compatibility contracts on Ubuntu, macOS, and Windows. - Keeps the existing Web `@deepseek-ai/dsh-client-modules` row explicitly waiting for the official `webServer` carrier. Current `0.1.5-rc.1` and `0.1.5-alpha.2` still require this compatibility overlay. - Adds a three-state overlay lifecycle contract plus moving upstream watch: `shim-required` keeps the overlay, `retire-ready` fails and requires deliberate retirement once DSH owns the dependency, and `dangerous-drift` fails closed if the upstream row changes incompatibly. ## Vision-mode and live-provider reliability - Preserves Vision mode when the user switches to another model that has a matching hidden Vision Router wrapper in the same visible source provider. Cross-provider switches or targets without a wrapper still leave Vision mode, and DSH's image-session model guards remain authoritative. - Treats `wrappedProviders` as configuration intent rather than a snapshot of startup topology. Generated `-vision` twins are reconciled against the live provider registry: dormant sources do not materialize twins, newly mounted providers gain them, removed providers withdraw them, and provider/model presentation metadata refreshes atomically. - Reuses the bounded adapter-update coalescer for synchronous registry events so live provider churn converges without duplicate registrations, re-entrant loops, or stale model filters. - Keeps the lower twin-image capability compatibility boundary tolerant of out-of-order registration for older Host shapes while preserving fail-closed ownership checks for Vision Router-owned routes. ## Runtime architecture - Splits the oversized root runtime into `lib/core-primitives.js` and `lib/sharp-runtime.js` while keeping `Config`, `apply`, Host composition, and public exports owned by the existing entry point. - The modularization is behavior-preserving: no settings migration, route rename, tool-schema change, or public API change is introduced. A permanent architecture contract prevents the extracted primitives from drifting back into a monolithic entry file or creating a second runtime owner. ## Security and release hardening - Updates the development `sharp` runtime past the libheif advisory while keeping the shared-Host peer contract at `sharp >=0.35.3 <1`, so the security fix does not raise the public Host floor. - Reworks the trusted PR impact shadow so `pull_request_target` never checks out PR code. The classifier is fetched from the trusted base commit, size-bounded, and verified against its Git blob identity before execution; permissions remain read-only. - Adds deterministic adversarial security fuzzing, dependency review, OpenSSF Scorecard coverage, Private Vulnerability Reporting guidance, and stronger immutable release verification. - Expands audited browser-impact triggers so client preludes, model-visibility boundaries, Web modules, Settings client surfaces, and exact compatibility modules cannot change without the corresponding browser/source gates running. ## Validation - Release-candidate coverage includes Node 22/24, DSH rc.6/rc.7/rc.8 compatibility contracts, current stable `0.1.5-rc.1`, exact preview `0.1.5-alpha.2`, Ubuntu/macOS/Windows exact-source contracts, Windows screenshot runtime, host-sharp on all three desktop OSes, routing parity, native multimodal cold resume, large-image resource stress, deterministic hostile-input fuzz, dependency review, CodeQL, and real Chromium lifecycle gates for both exact stable and preview Hosts. - The moving release-channel canary also resolves npm `latest` and `alpha` independently so a newly published DSH train is detected before the fixed release evidence is deliberately advanced. - No Settings migration is required. Restart DSH Web/Desktop after upgrading so the updated Host and browser compatibility logic is loaded. ## Upgrade Upgrade to 2.1.5 and restart DSH Web/Desktop. Existing Vision Router settings remain compatible.