[dskvr]

kehto/web #404 (released in #409) closed the four seams kernl had filed upstream (#397–#400). This moves kernl onto them and removes the workarounds.

Changes

• Versions: @kehto/shell ^0.32.0, @kehto/runtime ^0.28.0, @kehto/firewall ^0.7.0, @kehto/acl ^0.20.3, @kehto/services ^0.30.1. @napplet/core 0.38 and @napplet/nap 0.37 follow, because services needs them.
• Port traffic (#399): filterNappletMessage replaces refuseCurrentDispatch and the use of onNappletMessage. Hidden windows' requests are now held and released in order when the window becomes visible. They are dropped only past the hidden queue limit. deferred-overflow revocation removes the frame like every other reason.
• ACL (#398): aclDefaultPolicy: 'restrictive'. Grants add what the user allowed and revoke anything held beyond that. Nothing is granted until the user grants it.
• Firewall hooks (#397, #400): the runtime gets focus (using only focused) and the profile's unfocused multiplier and burst guard, on boot and on every profile change. Runtime refusals reach the guard log with the applet's message removed.
• feat: make Firewall the shared approval authority kehto/web#336: that PR will retire setUnfocusedMultiplier, setBurstGuard, onFirewallEvent and firewallPersistence. All of kernl's uses are in packages/core/src/guard/runtime-rules.ts, and kernl's own decisions feed the guard log independently.
• D-020 records the adoption, what kernl still does in front of kehto and why (size limits, visibility, quarantine, the hello check, the focus firewall), and the migration plan for #336. D-001, D-003 and D-012 are marked superseded in part. Scenarios, docs, site copy and changesets are updated: core minor; guard and messaging patch.

Behaviour changes to review

• Dropped requests get no reply. NAP defines no answer for a dropped request, so the applet times out instead of getting a firewall: error. This is listed as an upstream gap.
• The strict startup burst is tighter: 8 operations in a window's first second, control messages included. The old value was 20 in 3 seconds.
• Profile changes reach open windows: a new profile's rates apply to windows already open.

Checks

pnpm check passes: 901 tests, 100% coverage, docs gate, vocabulary, agent-ready 22/22, slop 100. Playwright 43/43.

Known gaps

• The offline preview's guard never holds a request.
• The README guard screenshot still shows the old behaviour.

🤖 Generated with Claude Code