DSH Linux on WSL2 Docker Desktop: engine volume paths are not host-visible; configured volumes does not reach Store

Start by reading dsh/packages/host/src/box.js, config.js, init.js, layerfs-client.js, and index.js to trace volume configuration and Store path handling. The report identifies a narrow candidate fix on a local branch, but the WSL2 named-volume route needs an upstream architecture decision. Done means both requested regressions pass: custom volume roots are honored and missing roots fail before volume creation; Docker Desktop WSL2 can use an explicitly mounted named-volume Store through Init, fork, mount, commit, and reopen.

LayerFS x DSH: Linux WSL2 / Docker Desktop Store-path topology is incompatible with current Host route

Version and host (reproduced)

• Reproduced against LayerFS af1eeef109a36e2c187a0a0058c880f4607ca617 (PR #376 included).
• On inspection, upstream main had moved to 5fb68ddc1acc3163e3ac3486133bde014c5fbed3 (9 later commits, none changing config.js, box.js, layerfs-client.js, init.js).
• Ubuntu under WSL2, Docker Desktop Engine 29.7.2 via unix:///var/run/docker.sock.
• Docker API reports DockerRootDir=/var/lib/docker and volume Mountpoint /var/lib/docker/volumes/<name>/_data.
• Ubuntu Host /var/lib/docker/volumes does not exist; DSH web runs as nonroot and must stay nonroot.

Exact distinguishing test (read only; same persisted Store)

docker volume inspect lfs-core-network-20261021b --format '{{.Mountpoint}}'
# /var/lib/docker/volumes/lfs-core-network-20261021b/_data
docker run --rm --pull never --network none \
  -v /var/lib/docker/volumes:/var/lib/docker/volumes:ro \
  -v lfs-core-network-20261021b:/named-store:ro \
  --entrypoint sh layerfs-352-runtime:node24 -c '
    test -f /var/lib/docker/volumes/lfs-core-network-20261021b/_data/global/store.sqlite && echo bind-visible || echo bind-missing
    test -f /named-store/global/store.sqlite && echo volume-visible || echo volume-missing
  '
# bind-missing
# volume-visible

Replace lfs-core-network-20261021b with an existing disposable named volume containing a LayerFS Store, and use any image with sh.

The Core SDK works in a container with the named volume explicitly mounted: project Init, branch fork, Workspace mount/exec/commit/unmount, branch merge and fresh process readback all passed. This issue is DSH Host / Docker Desktop topology, not evidence that LayerFS Core is broken.

Source-level mismatch (separate, narrow fix candidate)

• dsh/packages/host/src/config.js: volumes: config.volumes || VOLUMES.
• dsh/packages/host/src/index.js: the layerfs-host schema omitted volumes.
• dsh/packages/host/src/init.js: hostAccess checks spec.volumes, but suppresses ENOENT, allowing an invisible root past preflight.
• dsh/packages/host/src/layerfs-client.js: STORE_PATH: storePathOf(project.volume) does not bind spec.volumes.
• dsh/packages/host/src/box.js: storePathOf hardcodes /var/lib/docker/volumes; the macOS Store Container callMounts also mounts that path, which resolves empty in this Docker Desktop WSL setup.
• Upstream AGENTS.md currently authorizes the ported Store-worker exception for macOS only; do not silently enable it for Linux without an upstream architecture decision.

A minimal fix candidate for only the config/path/ENOENT defect exists on local branch
fix/wsl-docker-volumes-contract-20261021:
4b8cb8b9ef050ed9ebf063be9afa9579d17ce898 (base af1eeef...).
Changes: add volumes to real plugin config schema, bind it to Linux SDK Store path while retaining existing ported/macOS path, reject missing host root prior to Init, and add positive/negative Host regressions.
Targeted host, sim, runtime, syntax checks and git diff --check: PASS. Full DSH suite is NOT accepted: history tools require a missing sqlite3 binary, and unrelated history fixtures/assertions fail in this local environment.

Suggested upstream direction (separate from narrow fix)

Support a Docker Desktop/remote-engine Store route using Docker named-volume mounts for the client that opens the real Linux SDK Store (as tools/worktree_run.py already does), rather than depending on the Docker API Mountpoint being a Host-readable filesystem path. Reuse existing Host/SDK mechanisms; do not add another authority/controller, run DSH as root, chmod Docker's global volume tree, or weaken production service protections.

Request two independent regressions:

1. With a real Linux-visible custom volume root, layerfs-host.volumes affects the Store path and a missing root refuses before Docker volume creation.
2. Under Docker Desktop WSL2, distinguish engine Mountpoint vs Host namespace; explicitly mounted named-volume Store can Init/fork/mount/commit/reopen, with no production volume writable by the test.

No change has been deployed to live DSH 3081. This report is a candidate/proposal, not an upstream accepted fix.