fix(boot): keep disabled bundles disabled across runs and catch config-override duplicates

reconcileInstalledBundles now enables only the dependencies a run added, so
a bundle the user disabled keeps its state through an unrelated install or
removal. Row registration records the group each row is declared under: a
config override restates a row only under that group, while the same id twice
in one list or under another group is a duplicate — a contained bundle is left
out and a built-in layer fails loud, instead of the Loader rejecting the update
or moving the row at mount.

packages/boot/app-boot/README.i18n.yaml

@@ -2,5 +2,5 @@
 # side as of the last confirmed-consistent state. Both languages carry equal authority;
 # after editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/boot/app-boot/README.md
-README.md: e3ff5b06c095bdee9fdd26505ed2b63d0402a679
-README.zh.md: 62c37b1b35c113228b10bee688ecd8b248b5f26a
+README.md: 7755642ba4afec550c599971375c2149f8ed6cae
+README.zh.md: 3c89f4849e94b4ceedc82015e7386557f6792349

packages/boot/app-boot/README.md

@@ -91,7 +91,7 @@ This section explains how the outcomes above are realized and points at the code
 - **Channel-neutral library.** The package carries no loader hooks and no dev-mode surface; the [`dsh` app](../../../apps/cli/README.md) owns its Node source-launch hook and consumes these helpers for the boot sequence, and built consumers use plain Node package resolution.
 - **Three Loader builtins.** `mountRootInclude` registers `cordis:include`, `cordis:group`, and `cordis:contained-group` as Loader builtins: a group row gives one `isolate` realm to a provider and its consumers together, an agent preset outside this workspace cannot resolve `@deepseek-ai/cordis-plugin-group` by name, and the contained group is where external bundles mount. All load through the ambient module pipeline rather than the included tree's own specifier resolution.
 - **External bundles are groups.** The vendored `EntryGroup.update` is all-or-nothing, so `composeExternalLayer` wraps each `runtime`-stage external layer's inserts in one `cordis:contained-group` under the ids the bundle declares; the group's `create()` records a failed row on the root's `pluginFailures` registry instead of rejecting, a group that updates drops the records of rows it no longer configures and one that unmounts drops them all, and `assertEntriesActivated` exempts recorded rows while still failing a built-in row left pending.
-- **Row ids are owned, not rewritten.** Entry ids are unique per tree and a `create()` that finds an existing id re-parents that entry instead of rejecting, so `composeProfileStack` decides ownership before anything mounts: built-in and boot-staged layers claim first and a duplicate among them fails the boot, a contained bundle that collides is left out whole, a user insert of a taken id is dropped, and every such row is a `conflict` record in `pluginFailures`. Boot, live recomposition, and `--dump-config` compose through the same function.
+- **Row ids are owned, not rewritten.** Entry ids are unique per tree and a `create()` that finds an existing id re-parents that entry instead of rejecting, so `composeProfileStack` decides ownership before anything mounts: built-in and boot-staged layers claim first and a duplicate among them fails the boot, a contained bundle that collides is left out whole, a user insert of a taken id is dropped, and every such row is a `conflict` record in `pluginFailures`. A config override may restate a row under the group that already holds it; the same id twice in one config list, or set under another group, counts as declared twice — the Loader would reject the first at mount and silently move the second — so a built-in layer fails the boot and a contained bundle is left out. Boot, live recomposition, and `--dump-config` compose through the same function.
 - **Fail-loud is boot-scoped.** `installFailLoud` exits on any unhandled rejection because during startup one is a load failure; the launcher uninstalls it once the tree is up and installs `installRuntimeGuards`, which reports a rejection and keeps running and exits on an uncaught exception. Nested fibers (a `ctx.inject()` continuation) that fail under a built-in entry are reported by `warnNestedFiberFailures` as advisory lines.
 - **The probe never runs a package in the host.** `probePackage` reads an installed package's manifest here and imports it in a child process that reports over an IPC channel, so a package that throws, exits, hangs, prints at import, or brings its own copy of cordis costs one child and yields a record with the reason; the child's report and the cached record are validated field by field before either is trusted. It calls a package a `plugin` only when the package declares itself to dsh — a `dsh` section or a dependency on `@deepseek-ai/cordis` — and its main export is plugin-shaped; a bare function export (`lodash`) is a `library`. Records are cached under the profile's `.dsh-plugins/` with a format number, so a record an older probe wrote is probed again rather than trusted.
 - **Profile module fallback.** Bare plugin specifiers resolve through the Loader from the config directory. Plain Node maintains one symlink per package in the installation dependency closure. A packaged executable instead reads each installed export map with Node ESM conditions and writes real proxy packages that re-export virtual module URLs, because an operating-system symlink cannot enter pkg's `/snapshot` tree. Missing exports stay unavailable, malformed maps fail startup, and a cross-process writer lock replaces stale entries without exposing partial proxies. A selected external bundle absent from the installation closure receives a profile-local `.dsh-module-fallback` link; existing pnpm entries win, projected links are excluded from later closure discovery, and cleanup removes only dsh-owned links.

packages/boot/app-boot/README.zh.md

@@ -91,7 +91,7 @@ profile 是同一套 dsh 安装提供不同应用界面的方式：`web`、`head
 - **与渠道无关的库。** 此包不包含 loader 钩子，也不提供开发模式接口；[`dsh` 应用](../../../apps/cli/README.zh.md) 持有自己的 Node 源码启动钩子，并在启动序列中使用这些 helper，构建后的消费方则使用普通 Node 包解析。
 - **三个 Loader builtin。** `mountRootInclude` 把 `cordis:include`、`cordis:group` 与 `cordis:contained-group` 注册为 Loader builtin：group 行能把一个提供方与它的消费方放进同一个 `isolate` realm，位于本工作区之外的 agent preset 无法按名称解析 `@deepseek-ai/cordis-plugin-group`，受控组则是外部组合包挂载的位置。三者都通过宿主的模块管线加载，而非被包含树自身的说明符解析。
 - **外部组合包即组。** vendored 的 `EntryGroup.update` 是整组事务，因此 `composeExternalLayer` 把每个 `runtime` 阶段外部层的插入行按组合包声明的 id 包进一个 `cordis:contained-group`；该组的 `create()` 把失败的行记录到根上的 `pluginFailures` 注册表而不是 reject，组更新时丢掉配置里不再有的行的记录，卸载时全部丢掉，`assertEntriesActivated` 豁免已记录的行，但内置行停在 pending 时仍然失败。
-- **行 id 归属而非改写。** entry id 在整棵树内唯一，而 `create()` 遇到已有 id 时会把那个 entry 挪到自己名下而不是 reject，所以 `composeProfileStack` 在任何行挂载之前先判定归属：内置层与 boot 阶段的层先占有 id，它们之间重复即启动失败；撞名的受控组合包整层排除；用户层插入已被占用的 id 时该行丢弃；每一条被排除的行都是 `pluginFailures` 里的一条 `conflict` 记录。启动、运行时重组与 `--dump-config` 走同一个函数。
+- **行 id 归属而非改写。** entry id 在整棵树内唯一，而 `create()` 遇到已有 id 时会把那个 entry 挪到自己名下而不是 reject，所以 `composeProfileStack` 在任何行挂载之前先判定归属：内置层与 boot 阶段的层先占有 id，它们之间重复即启动失败；撞名的受控组合包整层排除；用户层插入已被占用的 id 时该行丢弃；每一条被排除的行都是 `pluginFailures` 里的一条 `conflict` 记录。config 覆盖可以在已持有某行的组下重述它；同一 config 列表里出现两次、或改放到别的组下，都算声明了两次——前者会在挂载时被 Loader 拒绝，后者会被静默挪走——因此内置层启动失败、受控组合包整层排除。启动、运行时重组与 `--dump-config` 走同一个函数。
 - **fail-loud 只在启动期。** `installFailLoud` 对任何未处理 rejection 退出，因为启动期间它就是加载失败；树起来后 launcher 卸载它并安装 `installRuntimeGuards`：rejection 被报告并继续运行，未捕获异常被报告并退出。内置条目下失败的嵌套 fiber（`ctx.inject()` 的延续）由 `warnNestedFiberFailures` 以提示行报告。
 - **探针从不在宿主内运行包。** `probePackage` 在本进程读取已安装包的 manifest，在子进程里 import 它并经 IPC 通道接收报告，因此抛错、退出、挂起、import 时打印或自带 cordis 副本的包只消耗一个子进程，得到一条带原因的记录；子进程的报告与缓存记录都逐字段校验之后才被信任。只有包向 dsh 声明了自己——有 `dsh` 段或依赖 `@deepseek-ai/cordis`——且主导出是插件形状时才判为 `plugin`；光是导出一个函数（`lodash`）的包是 `library`。记录缓存在 profile 的 `.dsh-plugins/` 下并带格式号，旧版探针写的记录会重新探测而不是被信任。
 - **Profile 模块后备机制。** 裸插件 specifier 由 Loader 从配置目录解析。普通 Node 会为安装依赖闭包中的每个包维护一个符号链接。打包可执行文件无法让操作系统符号链接进入 pkg 的 `/snapshot` 树，因此会按 Node ESM 条件读取已安装包的 export map，并写入重新导出虚拟模块 URL 的真实代理包。缺失 export 保持不可用，错误 export map 会让启动失败，跨进程 writer lock 则会在不暴露部分代理的情况下替换陈旧条目。所选外部 bundle 若不在安装闭包中，则会获得 profile 本地的 `.dsh-module-fallback` 链接；已有 pnpm 条目优先，后续闭包发现会排除投影链接，清理也只删除 dsh 自有链接。

packages/boot/app-boot/src/compose-stack.ts

@@ -93,29 +93,44 @@ function rowIds(row: EntryOptions): string[] {
  * rows it inserts and the rows its config overrides set as a group's
  * children. Built-in and boot-staged layers claim first, in manifest order;
  * an id two of them declare, or one inserts twice, is a defect of the shipped
- * composition and throws, while a config override restating a row the same
- * layer declared is that layer keeping its own child. Contained external
- * layers then claim in manifest order, each rendered once here; one whose id
- * is already owned, or which declares an id twice, is left out whole.
+ * composition and throws, while a config override restating a row under the
+ * group the same layer declared it in is that layer keeping its own child;
+ * the same id twice in one config list, or set under another group, is
+ * declared twice. Contained external layers then claim in manifest order,
+ * each rendered once here; one whose id is already owned, or which declares
+ * an id twice, is left out whole.
  * @param layers - the profile's bundle layers, in manifest order.
  * @returns the owner of every claimed id, the conflicts of each skipped bundle, and the composition of each mounted one.
  * @throws when two built-in or boot-staged layers declare the same id, or one of them declares an id twice.
  */
 export function claimLayerIds(layers: readonly ProfileLayer[]): LayerOwnership {
   const owners = new Map<string, ProfileLayer>()
+  const declaredUnder = new Map<string, string | undefined>()
   for (const layer of layers) {
     if (isContainedLayer(layer)) continue
-    visitPatchRows(layer.patches, (row, source) => {
+    let listed = new Set<string>()
+    let listIndex = -1
+    visitPatchRows(layer.patches, (row, source, place) => {
       if (typeof row.id !== 'string') return
+      if (place.patch !== listIndex) {
+        listIndex = place.patch
+        listed = new Set()
+      }
       const owner = owners.get(row.id)
       if (owner === layer) {
-        if (source === 'insert') throw new Error(`row ${JSON.stringify(row.id)} is declared twice by ${layer.packageName}`)
-        return
-      }
-      if (owner !== undefined) {
+        // Restating a row under the group that already holds it is the layer
+        // keeping its child; inserting it again, listing it twice in one
+        // config, or setting it under another group is declaring it twice.
+        if (source === 'insert' || listed.has(row.id) || declaredUnder.get(row.id) !== place.target) {
+          throw new Error(`row ${JSON.stringify(row.id)} is declared twice by ${layer.packageName}`)
+        }
+      } else if (owner !== undefined) {
         throw new Error(`row ${JSON.stringify(row.id)} is declared by both ${owner.packageName} and ${layer.packageName}`)
+      } else {
+        owners.set(row.id, layer)
+        declaredUnder.set(row.id, place.target)
       }
-      owners.set(row.id, layer)
+      listed.add(row.id)
     })
   }
   const skipped = new Map<string, RowConflict[]>()

packages/boot/app-boot/src/external-bundles.ts

@@ -59,7 +59,11 @@ export interface ComposedExternalLayer {
    * names; a repeated id keeps its first module.
    */
   rows: Map<string, string>
-  /** Ids the layer introduces more than once, in order of repetition; a config override restating a row is not one. */
+  /**
+   * Ids the layer introduces more than once, in order of repetition. A config
+   * override restating a row under the group that already holds it is not
+   * one; the same id twice in one config list, or set under another group, is.
+   */
   duplicates: DuplicateRow[]
   /** Ids outside the bundle that its patch overrides; not containable, reported for visibility. */
   overrides: string[]
@@ -87,7 +91,9 @@ export function isContainedLayer(layer: ProfileLayer): boolean {
  * an override when it addresses a row the bundle did not introduce; the rows
  * it sets as a group's config count as the bundle's own, since they mount
  * as children like inserted ones. Every id, declared or generated, goes
- * through one registration, so a row spelling a wrapper's id is a duplicate.
+ * through one registration, so a row spelling a wrapper's id is a duplicate,
+ * and so is a config row the bundle already declared under another group,
+ * or listed twice: the Loader would move the first and reject the second.
  * Ids are indexed before any patch is emitted, so an insert into a group the
  * bundle introduces later in its list still counts as its own.
  * @param layer - the resolved external layer.
@@ -96,20 +102,40 @@ export function isContainedLayer(layer: ProfileLayer): boolean {
 export function composeExternalLayer(layer: ProfileLayer): ComposedExternalLayer {
   const groupId = bundleGroupId(layer.packageName)
   const rows = new Map<string, string>()
+  const declaredUnder = new Map<string, string | undefined>()
   const duplicates: DuplicateRow[] = []
-  const claim = (rowId: string, moduleName: string): void => {
-    if (rows.has(rowId)) duplicates.push({ rowId, moduleName })
-    else rows.set(rowId, moduleName)
+  const claim = (rowId: string, moduleName: string, target?: string): void => {
+    if (rows.has(rowId)) {
+      duplicates.push({ rowId, moduleName })
+      return
+    }
+    rows.set(rowId, moduleName)
+    declaredUnder.set(rowId, target)
   }
-  visitPatchRows(layer.patches, (row, source) => {
+  let listed = new Set<string>()
+  let listIndex = -1
+  visitPatchRows(layer.patches, (row, source, place) => {
     if (typeof row.id !== 'string') return
-    // A config override restates the children it keeps: the id counts as
-    // the bundle's own without being a repeat.
+    if (place.patch !== listIndex) {
+      listIndex = place.patch
+      listed = new Set()
+    }
+    // A root insert lands in the bundle's group: that is the group it declares under.
+    const target = place.target ?? groupId
     if (source === 'config') {
-      if (!rows.has(row.id)) rows.set(row.id, row.name)
-      return
+      // A config override restates the children it keeps: the same id declared
+      // under the same group before is that row. Twice in one list, or under
+      // another group, it would mount as a rejected duplicate or move the row.
+      if (listed.has(row.id) || (rows.has(row.id) && declaredUnder.get(row.id) !== target)) {
+        duplicates.push({ rowId: row.id, moduleName: row.name })
+      } else if (!rows.has(row.id)) {
+        rows.set(row.id, row.name)
+        declaredUnder.set(row.id, target)
+      }
+    } else {
+      claim(row.id, row.name, target)
     }
-    claim(row.id, row.name)
+    listed.add(row.id)
   })
   claim(groupId, CONTAINED_GROUP_MODULE)
   const wrappers = new Map<string, string>()
@@ -176,7 +202,7 @@ export interface BundleReconciliation {
   removed: string[]
   /** Newly added dependencies that declare no `dsh.bundle` (plain libraries or plugin modules). */
   plain: string[]
-  /** Installed bundles left out of the layer list because `autoEnable` was off. */
+  /** Bundles the run installed and left out of the layer list because `autoEnable` was off. */
   installedOnly: string[]
 }
 
@@ -184,9 +210,11 @@ export interface BundleReconciliation {
  * Reconcile `dsh.profile.bundles` against the installed state after a pnpm
  * run. A dependency that no longer resolves to a bundle leaves the layer
  * list; template bundles (never dependencies) are untouched. A dependency
- * that resolves to a bundle joins the list only when `autoEnable` is set —
- * the CLI's install-and-enable semantics — and is otherwise reported as
- * installed-only, which is the plugin manager's install step.
+ * the run added that resolves to a bundle joins the list only when
+ * `autoEnable` is set — the CLI's install-and-enable semantics — and is
+ * otherwise reported as installed-only, which is the plugin manager's install
+ * step. A bundle installed before the run keeps its place in or out of the
+ * list: one the user disabled stays disabled through an unrelated run.
  * @param binName - the diagnostic prefix used by manifest reads.
  * @param profileDir - the profile directory.
  * @param installAnchor - absolute path of the dsh app's package.json.
@@ -207,16 +235,17 @@ export function reconcileInstalledBundles(
   const bundles = [...after.dsh?.profile?.bundles ?? []]
   const outcome: BundleReconciliation = { enabled: [], removed: [], plain: [], installedOnly: [] }
   for (const packageName of dependencies) {
-    const isBundle = exportsBundlePatch(binName, packageName, installAnchor, profileDir)
-    if (isBundle && !bundles.includes(packageName)) {
-      if (options.autoEnable) {
-        bundles.push(packageName)
-        outcome.enabled.push(packageName)
-      } else {
-        outcome.installedOnly.push(packageName)
-      }
-    } else if (!isBundle && !beforeDeps.has(packageName)) {
+    if (beforeDeps.has(packageName)) continue
+    if (!exportsBundlePatch(binName, packageName, installAnchor, profileDir)) {
       outcome.plain.push(packageName)
+      continue
+    }
+    if (bundles.includes(packageName)) continue
+    if (options.autoEnable) {
+      bundles.push(packageName)
+      outcome.enabled.push(packageName)
+    } else {
+      outcome.installedOnly.push(packageName)
     }
   }
   const dependencySet = new Set(dependencies)

packages/boot/app-boot/src/patch-rows.ts

@@ -11,6 +11,22 @@ import type { PatchOptions } from '@deepseek-ai/cordis-plugin-include'
 /** How a patch introduced a row: inserted it, or set it as a group's `config`. */
 export type PatchRowSource = 'insert' | 'config'
 
+/**
+ * Where a patch introduced a row. `target` is the id of the group the row is
+ * declared under — the patch's target, or the enclosing group row for a nested
+ * one — undefined for a root-level insert, and a private marker for a child of
+ * a group without an id, which no later patch can address. `patch` is the
+ * index of the patch in the list, so the same id twice in one config list can
+ * be told from a restatement across patches.
+ */
+export interface PatchRowPlace {
+  readonly target: string | undefined
+  readonly patch: number
+}
+
+/** The target of rows nested in a group that declares no id: nothing can restate them, so nothing may match it. */
+const ANONYMOUS_GROUP = '\u0000anonymous-group'
+
 /** Whether a config item is a row: a plain object naming a module. */
 function isRowLike(value: unknown): value is EntryOptions {
   return typeof value === 'object' && value !== null && !Array.isArray(value) && typeof (value as { name?: unknown }).name === 'string'
@@ -23,9 +39,17 @@ function isRowLike(value: unknown): value is EntryOptions {
  * @param visit - called once per row.
  */
 export function visitRowTree(row: EntryOptions, visit: (row: EntryOptions) => void): void {
-  visit(row)
+  visitPlacedRows(row, undefined, (entry) => { visit(entry) })
+}
+
+/** The walk behind {@link visitRowTree}, carrying the group each row is declared under. */
+function visitPlacedRows(
+  row: EntryOptions, target: string | undefined, visit: (row: EntryOptions, target: string | undefined) => void,
+): void {
+  visit(row, target)
   if (row.group && Array.isArray(row.config)) {
-    for (const child of row.config as EntryOptions[]) visitRowTree(child, visit)
+    const own = typeof row.id === 'string' ? row.id : ANONYMOUS_GROUP
+    for (const child of row.config as EntryOptions[]) visitPlacedRows(child, own, visit)
   }
 }
 
@@ -35,17 +59,20 @@ export function visitRowTree(row: EntryOptions, visit: (row: EntryOptions) => vo
  * group's `config`, which mount as that group's children the same way an
  * insert's do.
  * @param patches - the patch list.
- * @param visit - called once per row, with how the patch introduced it.
+ * @param visit - called once per row, with how the patch introduced it and where.
  */
-export function visitPatchRows(patches: readonly PatchOptions[], visit: (row: EntryOptions, source: PatchRowSource) => void): void {
-  for (const patch of patches) {
+export function visitPatchRows(
+  patches: readonly PatchOptions[],
+  visit: (row: EntryOptions, source: PatchRowSource, place: PatchRowPlace) => void,
+): void {
+  patches.forEach((patch, index) => {
     if (patch.insert !== undefined) {
-      for (const row of patch.insert) visitRowTree(row, (entry) => { visit(entry, 'insert') })
-      continue
+      for (const row of patch.insert) visitPlacedRows(row, patch.id, (entry, target) => { visit(entry, 'insert', { target, patch: index }) })
+      return
     }
-    if (patch.id === undefined || !Array.isArray(patch.config)) continue
+    if (patch.id === undefined || !Array.isArray(patch.config)) return
     for (const item of patch.config as unknown[]) {
-      if (isRowLike(item)) visitRowTree(item, (entry) => { visit(entry, 'config') })
+      if (isRowLike(item)) visitPlacedRows(item, patch.id, (entry, target) => { visit(entry, 'config', { target, patch: index }) })
     }
-  }
+  })
 }

packages/boot/app-boot/tests/compose-stack.spec.ts

@@ -73,6 +73,39 @@ describe('claimLayerIds', () => {
       { id: 'h', config: [{ id: 'settings', name: 'taking/impostor' }] },
     ])
     expect(() => claimLayerIds([base, taking])).toThrow(/row "settings" is declared by both @deepseek-ai\/dsh-base and taking/)
+    // Setting a row under another group would move it; listing it twice would fail the group's update.
+    const moving = layer('moving', 'builtin', [
+      { insert: [
+        { id: 'g', name: 'cordis:group', group: true, config: [{ id: 'a', name: 'a' }] },
+        { id: 'h', name: 'cordis:group', group: true, config: [] },
+      ] },
+      { id: 'h', config: [{ id: 'a', name: 'a' }] },
+    ])
+    expect(() => claimLayerIds([moving])).toThrow(/row "a" is declared twice by moving/)
+    const twice = layer('twice', 'builtin', [
+      { insert: [{ id: 'g', name: 'cordis:group', group: true, config: [] }] },
+      { id: 'g', config: [{ id: 'a', name: 'a' }, { id: 'a', name: 'a' }] },
+    ])
+    expect(() => claimLayerIds([twice])).toThrow(/row "a" is declared twice by twice/)
+    // A child of a group without an id cannot be restated: no patch can address that group.
+    const anonymous = layer('anonymous', 'builtin', [
+      { insert: [
+        { name: 'cordis:group', group: true, config: [{ id: 'a', name: 'a' }] },
+        { id: 'h', name: 'cordis:group', group: true, config: [] },
+      ] },
+      { id: 'h', config: [{ id: 'a', name: 'a' }] },
+    ])
+    expect(() => claimLayerIds([anonymous])).toThrow(/row "a" is declared twice by anonymous/)
+  })
+
+  it('leaves out a bundle whose config override of its own group lists an id twice', () => {
+    const self = layer('self', 'external', [
+      { insert: [{ id: 'row', name: 'self/row' }] },
+      { id: 'bundle/self', config: [{ id: 'row', name: 'self/row' }, { id: 'row', name: 'self/row-again' }] },
+    ])
+    const { skipped, composed } = claimLayerIds([base, self])
+    expect(skipped.get('self')?.map(conflict => conflict.message)).toEqual(['row "row" is declared twice by self'])
+    expect(composed.has('self')).toBe(false)
   })
 
   it('leaves out a bundle that declares one of its own ids twice and composes each mounted bundle once', () => {

packages/boot/app-boot/tests/external-bundles.spec.ts

@@ -163,6 +163,35 @@ describe('composeExternalLayer', () => {
     expect(composed.rows.get('dup')).toBe('pkg-r/one')
   })
 
+  it('reports a config override that lists one id twice or sets a row under a group other than the one holding it', () => {
+    const composed = composeExternalLayer(layer('pkg-o', [
+      { insert: [
+        { id: 'a', name: 'cordis:group', group: true, config: [{ id: 'shared', name: 'pkg-o/x' }] },
+        { id: 'b', name: 'cordis:group', group: true, config: [] },
+      ] },
+      { id: 'b', config: [{ id: 'shared', name: 'pkg-o/moved' }] },
+      { id: 'a', config: [{ id: 'twice', name: 'pkg-o/one' }, { id: 'twice', name: 'pkg-o/two' }] },
+      // The bundle's own group is a predictable target: a duplicate under it
+      // would fail the group's update before any row is contained.
+      { id: 'bundle/pkg-o', config: [{ id: 'own', name: 'pkg-o/own' }, { id: 'own', name: 'pkg-o/own-again' }] },
+    ]))
+    expect(composed.duplicates).toEqual([
+      { rowId: 'shared', moduleName: 'pkg-o/moved' },
+      { rowId: 'twice', moduleName: 'pkg-o/two' },
+      { rowId: 'own', moduleName: 'pkg-o/own-again' },
+    ])
+    expect(composed.overrides).toEqual([])
+  })
+
+  it('lets a config override restate a row under the built-in group it was inserted into', () => {
+    const composed = composeExternalLayer(layer('pkg-s', [
+      { id: 'tools', insert: [{ id: 'tool', name: 'pkg-s/tool' }] },
+      { id: 'tools', config: [{ id: 'tool', name: 'pkg-s/tool' }] },
+    ]))
+    expect(composed.duplicates).toEqual([])
+    expect(composed.overrides).toEqual(['tools'])
+  })
+
   it('never mutates the layer\'s own patch objects', () => {
     const patches: PatchOptions[] = [{ insert: [{ id: 'row', name: 'pkg-d' }] }, { id: 'row', config: { a: 1 } }]
     const snapshot = structuredClone(patches)
@@ -242,6 +271,28 @@ describe('reconcileInstalledBundles', () => {
     expect(exportsBundlePatch(NAME, 'missing', installAnchor, profileDir)).toBe(false)
   })
 
+  it('leaves a bundle installed before the run where the user left it, in or out of the list', () => {
+    const { profileDir, installAnchor } = stageProfile({ 'ext-bundle': { bundle: true }, 'new-bundle': { bundle: true } })
+    // ext-bundle was installed earlier and is not listed: the user disabled it.
+    const before = { dependencies: { 'ext-bundle': '1.0.0' } }
+    expect(reconcileInstalledBundles(NAME, profileDir, installAnchor, before, { autoEnable: true }))
+      .toEqual({ enabled: ['new-bundle'], removed: [], plain: [], installedOnly: [] })
+    expect(readProfileManifest(NAME, profileDir).dsh?.profile?.bundles).toEqual(['@deepseek-ai/dsh-base', 'new-bundle'])
+    disableBundle(NAME, profileDir, 'new-bundle')
+    expect(reconcileInstalledBundles(NAME, profileDir, installAnchor, readProfileManifest(NAME, profileDir), { autoEnable: true }))
+      .toEqual({ enabled: [], removed: [], plain: [], installedOnly: [] })
+    expect(readProfileManifest(NAME, profileDir).dsh?.profile?.bundles).toEqual(['@deepseek-ai/dsh-base'])
+  })
+
+  it('keeps a listed bundle listed once when the run brings its dependency back', () => {
+    const { profileDir, installAnchor } = stageProfile({ 'ext-bundle': { bundle: true } })
+    enableBundle(NAME, profileDir, installAnchor, 'ext-bundle')
+    // The manifest the run started with had lost the dependency; pnpm added it again.
+    expect(reconcileInstalledBundles(NAME, profileDir, installAnchor, { dependencies: {} }, { autoEnable: true }))
+      .toEqual({ enabled: [], removed: [], plain: [], installedOnly: [] })
+    expect(readProfileManifest(NAME, profileDir).dsh?.profile?.bundles).toEqual(['@deepseek-ai/dsh-base', 'ext-bundle'])
+  })
+
   it('drops a layer whose dependency was removed and keeps template bundles', () => {
     const { profileDir, installAnchor } = stageProfile({ 'ext-bundle': { bundle: true } })
     enableBundle(NAME, profileDir, installAnchor, 'ext-bundle')