v3: advance baseline through v1.4.1

.github/workflows/eval-with-entra-id.yml

@@ -1,9 +1,9 @@
 name: eval-with-entra-id
 on:
   push:
-    branches: [main]
+    branches: [main, v3]
   pull_request:
-    branches: [main]
+    branches: [main, v3]
 
 permissions:
   contents: read

.github/workflows/pr-eval-shell-tests.yml

@@ -1,9 +1,9 @@
 name: pr-eval-shell-tests
 on:
   push:
-    branches: [main]
+    branches: [main, v3]
   pull_request:
-    branches: [main]
+    branches: [main, v3]
 
 permissions:
   contents: read

.github/workflows/pr-l1-static-fast.yml

@@ -4,9 +4,9 @@
 name: pr-l1-static-fast
 on:
   pull_request:
-    branches: [main]
+    branches: [main, v3]
   push:
-    branches: [main]
+    branches: [main, v3]
 
 permissions:
   contents: read

README.md

@@ -93,7 +93,7 @@ Other entry points: see [Where to start](#where-to-start) below for a
 table of the doc-friendly example aliases (`personal-dev`,
 `graphics-workstation`, `multi-env`) plus the manual integration path.
 For reconnectable interactive shells, see
-[Use persistent guest shells](./docs/how-to/use-persistent-shells.md).
+[Use persistent shells](./docs/how-to/use-persistent-shells.md).
 For Waybar/terminal launcher integration around those shells, see
 [Configure desktop terminal integration](./docs/how-to/configure-desktop-terminal-integration.md).
 For the staged generic host-user provider contract, see

docs/adr/README.md

@@ -49,3 +49,4 @@ for the broader design narrative, see
 | [0042. d2b clipboard authority and picker split](0042-d2b-clipboard-authority-and-picker-split.md) | Accepted | 2026-06-28 | Splits trusted clipboard authority into d2b-owned `d2b-clipd` plus Wayland bridge virtualization, keeps `d2b-clip-picker` UI-only in a separate GPL repository, and requires a no-patch Niri paste-intent hook for host cross-realm native paste. |
 | [0043. Realm-native control plane](0043-realm-native-control-plane.md) | Accepted | 2026-07-05 | Supersedes ADR 0032 with realm-as-control-plane architecture: one `d2bd` plus broker/socket/state/audit boundary per realm, strict parent/child routing, dynamic relay discovery, realm-qualified VM addresses, and migration from current `home`/`dev`/`work` groups into first-class realms. |
 | [0044. Unsafe-local runtime provider](0044-unsafe-local-runtime-provider.md) | Accepted | 2026-07-09 | Adds an explicit `unsafe-local` provider for host-user/session/network workloads with Wayland-proxy identity rails, first-class desktop launch metadata, and host-local persistent shell UX while preserving the no-isolation security warning. |
+| [0045. Provider and transport framework](0045-provider-and-transport-framework.md) | Proposed | 2026-07-10 | Separates provider authorities from transport and protocol seams, selects Noise-authenticated component sessions with ttrpc/protobuf control services, models controllers as parent-owned workloads, and authorizes direct peer streams over shared transport fabrics without bypassing realm-tree policy. |

docs/completions/d2b.bash

@@ -58,6 +58,9 @@ _d2b() {
             d2b,keys)
                 cmd="d2b__subcmd__keys"
                 ;;
+            d2b,launch)
+                cmd="d2b__subcmd__launch"
+                ;;
             d2b,list)
                 cmd="d2b__subcmd__list"
                 ;;
@@ -238,6 +241,9 @@ _d2b() {
             d2b__subcmd__help,keys)
                 cmd="d2b__subcmd__help__subcmd__keys"
                 ;;
+            d2b__subcmd__help,launch)
+                cmd="d2b__subcmd__help__subcmd__launch"
+                ;;
             d2b__subcmd__help,list)
                 cmd="d2b__subcmd__help__subcmd__list"
                 ;;
@@ -704,7 +710,7 @@ _d2b() {
 
     case "${cmd}" in
         d2b)
-            opts="-h -V --help --version list status usb console audio audit host auth realm shell op vm up down restart build generations switch boot test rollback gc store keys trust rotate-known-host migrate config clipboard help"
+            opts="-h -V --help --version list status launch usb console audio audit host auth realm shell op vm up down restart build generations switch boot test rollback gc store keys trust rotate-known-host migrate config clipboard help"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 1 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -1324,7 +1330,7 @@ _d2b() {
             return 0
             ;;
         d2b__subcmd__help)
-            opts="list status usb console audio audit host auth realm shell op vm up down restart build generations switch boot test rollback gc store keys trust rotate-known-host migrate config clipboard help"
+            opts="list status launch usb console audio audit host auth realm shell op vm up down restart build generations switch boot test rollback gc store keys trust rotate-known-host migrate config clipboard help"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
                 COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
                 return 0
@@ -1841,6 +1847,20 @@ _d2b() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        d2b__subcmd__help__subcmd__launch)
+            opts=""
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         d2b__subcmd__help__subcmd__list)
             opts=""
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 3 ]] ; then
@@ -2799,6 +2819,24 @@ _d2b() {
             COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
             return 0
             ;;
+        d2b__subcmd__launch)
+            opts="-h --item --json --human --help <TARGET>"
+            if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then
+                COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+                return 0
+            fi
+            case "${prev}" in
+                --item)
+                    COMPREPLY=($(compgen -f "${cur}"))
+                    return 0
+                    ;;
+                *)
+                    COMPREPLY=()
+                    ;;
+            esac
+            COMPREPLY=( $(compgen -W "${opts}" -- "${cur}") )
+            return 0
+            ;;
         d2b__subcmd__list)
             opts="-h --json --human --help"
             if [[ ${cur} == -* || ${COMP_CWORD} -eq 2 ]] ; then