@khorsheed/dsh-reader 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -0,0 +1,14 @@
+# 变更记录
+
+## 0.3.0（2026-09-30）
+
+- **CORP 拦截图救回**：以 `cross-origin-resource-policy: same-origin` 供图的站点（如 claude.dev）会让浏览器跨域 `<img>` 必挂，只有宿主进程抓取能绕过。新增 `fetchImage` Remote——只重抓已经加载失败的图片（公网地址校验钉在 DNS 答案上、逐跳重定向再校验、限 `image/*` + 8MiB + 15s、32MiB LRU），阅读面板把这些图改指 data: URI。健康图片从不经过代理；旧版宿主下图片维持 broken
+- 加宽 `@deepseek-ai/dsh-*` peer 区间以覆盖宿主 0.2.0
+
+## 0.2.1（2026-09-27）
+
+无功能变更。README 截图整理（删除一张从未存在的引用图，全部图片引用可解析）；随宿主 0.1.7-rc.2 基线发布波重发（全量构建+测试在 rc.2 基线通过）。
+
+## 0.2.0（2026-09-26）
+
+首个公开发布。

package/README.en.md

@@ -1,19 +1,70 @@
 # @khorsheed/dsh-reader
 
-The **inspiration space**: one **page-type tab** in the right sidebar that gathers RSS/Atom subscriptions and pasted article links onto a single wall. Clicking a card reads the body inside dsh (selectable, so it can be quoted); when the host's fetch cap truncated the body, the page says so in one line and offers a button to the original.
+English | [中文](README.md)
 
-> The package name, tab kind and Remote namespace stay `reader` — they are stable identifiers (renaming them would change a deployed loader row and the on-disk state root). "Inspiration" is the name the reader SEES.
+RSS subscriptions and pasted article links on one wall — click a card and read it right inside dsh, select any passage and quote it into the conversation.
+
+Interesting papers and articles pile up as browser tabs, and feeding one to the agent means copy-pasting. This plugin adds a page-type tab to the right sidebar — the inspiration space: feeds refresh on a daily schedule, a pasted link becomes a card, and the body renders as readable text inside dsh (selectable for quoting, translatable on-device by the browser's own model). A body the host could not fetch whole, or a site that refuses bots, says so honestly — the wall never looks fine while being hollow.
+
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/reader-1.png" width="640" alt="the inspiration space wall: a card feed of subscriptions and saved links, with filter, sort, wall translation, refresh, settings and add in the header row and the search field on its own row">
+
+## Features
+
+- **One wall for feeds and links** — RSS/Atom subscriptions and single pasted articles side by side; text search ranked by relevance (exact title → title contains → other fields); the filter (unread / by source / by kind / by tag) shares the search box's local predicates and costs no request; **dedupe is on by default** (three grouping tiers — same entry id, normalized link, folded title plus the same published day — any hit folds), the surviving card carrying a 「N 个重复来源」 badge; the reader's own tags, creatable inline and deletable from the filter popover.
+- **Read the body inside dsh** — the body is extracted as DOM text (exactly what makes passage quoting work): repeated masthead titles are dropped, lazy-loaded images are recovered (`data-src` / `srcset` / `<picture>` / `<noscript>`) and real base64-inline figures are kept, formulas render as native MathML, and arXiv's LaTeXML vector figures survive. A figure the page draws with its own scripts cannot be fetched — its caption stays in the body with one line of explanation. A body the host's fetch cap truncated says 「受限篇幅，内容未完整呈现」 with a 「阅读原文」 button.
+- **On-device translation, no tokens spent** — the browser's own Translator API (Chrome 138+ / Edge 148+, desktop): the model never leaves the device and needs no network. The unit is a SENTENCE — click one sentence to reveal that one sentence's original; three views (translation only / side by side / original only). The detail view and the wall each carry their own globe switch, and the wall decides per FIELD — Chinese is never translated into Chinese. Without that API, with an unavailable pair, or on a body already in Chinese, the globe is simply not rendered.
+- **Translations persist; a reload is free** — the derived sentence pairs are written to the host side (a global sentence memory plus per-entry segment maps; one shared 64 MB budget, LRU, no TTL), so after a reload one click on the globe re-paints the whole article from disk without a single model request.
+- **Fetching runs on the host** — every card carries a state pill (grey = not fetched / blue = fetching / green = full text cached / red = failed); press it and leave the page immediately — the raw page lands on the host's disk first and the browser half extracts it on next open. Full text is **backfilled automatically** (at most 8 entries per refresh, two requests at a time, a failed entry left alone for 6 hours); an entry whose feed publishes full text is cached on its first open with zero requests.
+- **Paste it, it knows what it is** — a feed becomes a subscription, a web page is saved as a single item; an arXiv abs/pdf link is upgraded to the paper's official HTML version; a DOI link is resolved to its arXiv version first (Crossref + arXiv title search behind a two-factor gate); an OpenReview link is saved link-only with the reason on the card; and a URL that cannot be read is still saved, its cause classified (bot wall / login wall / not a web page / cross-site hop / unreachable / HTTP error).
+- **Quote into the conversation** — the body is an app-level selection, so `@khorsheed/dsh-quote`'s overlay menu already covers it; the detail view also carries **Quote** (selection plus a source label, merged into the current conversation draft through the official input machine — read-merged, never overwritten, never sent) and **Send to side chat** (shown only when the composition really has a `sideChat` service).
+- **Subscription page and recently read** — one row per source with in-place name and address editing, per-source refresh, pause/resume and remove, plus the cache policy (body retention, translation budget, clear translation cache) and storage readouts on the same page; **recently read** persists 100 rows, survives a restart, and can reopen an entry that has rolled out of its feed's window.
+- **Leave and carry on** — the open article, the reading position anchored by content (the Nth block, this character of its text), the wall's narrowing and the translation are remembered by the whole page across dsh sessions; the place is also written to `sessionStorage`, so a reloaded page finds the reader where they were.
+
+<img src="https://raw.githubusercontent.com/Khorsheed/dsh-basic/main/docs/screenshots/reader-2.png" width="640" alt="the detail view: the body rendered as DOM text, the globe lit with sentence-aligned translation, clicking one sentence revealing its original">
+
+## Install
 
-Fetching happens on the **host half** through the sanctioned `ctx.web` egress seam; the browser half only parses and renders. The subscription list and the most recent raw payloads are persisted to `$DSH_HOME/state/dsh-reader/state.json` with atomic `node:fs` writes — **not** through `ctx.fs`, which is the policy-fenced sandboxed filesystem (see Compatibility) — and a daily refresh is armed by a plugin-owned `setTimeout`, since no host scheduler service exists to ride.
+```sh
+dsh plugin --profile web add @khorsheed/dsh-reader
+```
 
-## The three surfaces
+Restart the web instance to activate. Uninstall:
+
+```sh
+dsh plugin --profile web remove @khorsheed/dsh-reader
+```
+
+Exactly one directory is written: `$DSH_HOME/state/dsh-reader/` — `state.json` (the subscription list, the latest payloads, the reader's own tags and the recently-read records) and `bodies/` (one file per body over 256 KiB; the global translation memory is its `translation-memory.json`, and a large per-entry segment map gets its own file). Uninstalling leaves the directory behind — delete the whole `dsh-reader/` for a clean removal.
+
+## Compatibility
+
+- npm release line (`@deepseek-ai/dsh@0.1.5-rc.1`): ✅ works, one designed degrade — the `sidebar.right.pane.tab` seat and the `ctx.web.fetch` egress seam are complete on 0.1.5-rc.1; the in-app Sidebar Browser exits (the script-figure notice, a bot-wall card's action) need the `browser` right-Sidebar tab kind from 0.1.6-alpha.2 and fall back to the ordinary external link on a 0.1.5 host. minHost `0.1.5-rc.1`; this package does no preset self-hide (no `pluginInventory` needed).
+- source line (deepseek-harness master): ✅ (verifiedHost: 0.1.5-rc.1)
+
+Note: the host fetch seam truncates a decoded body at 100,000 characters and does so **silently** — that is a deployment-configurable cap (see the patch overlay under 「How it works · the egress seam and storage」), not this package's body budget.
+
+## Known Limitations
+
+- **Subscribe, do not crawl** — adding a subscription fetches the feed itself and never pre-fetches every entry's body (that would blow up storage and amount to running a crawler); full text arrives a slice per refresh via the backfill, or on the spot when you open an entry.
+- **A PDF (or any non-web file) has no body** — the egress seam accepts only `text/html`, `text/*`, `application/json` and `application/xml`, so `application/pdf` is refused before extraction even starts — and extraction is DOM-based, which a PDF does not have. Such a link is a 「仅链接」 card plus 「阅读原文」; this plugin is not a PDF reader.
+- **A cross-site hop is not followed** — the seam reports the target origin only, never the path, so shorteners and institutional proxies are reported as "this address moves to another site" rather than guessed at.
+- **The unread dot is not persisted** — read state is session state; a reload or restart returns every entry to unread.
+- **Translation needs Chrome 138+ / Edge 148+ on desktop** — Safari, Firefox and mobile have no Translator API, so the globe stays hidden there while everything else keeps working. The trade is deliberate: one 50,000-character article through a host LLM costs tens of thousands of tokens, tens of seconds, and a second copy of the article to the model provider; on-device translation is free, seconds, and stays on the machine (page-translation-grade NMT, not LLM-grade).
+- **Oversized articles cannot be fully extracted** — the seam's default 100,000-character cap (measured: an Anthropic research page ~266k, theverge.com ~899k, newyorker.com ~1.97M characters) leaves the detail view showing the truncation notice plus 「阅读原文」; raising the cap is a deployment decision, and the plugin never works around the host's egress policy itself.
+
+## How it works
+
+<details>
+<summary>The surfaces (wall / detail / translation / add / subscriptions / recently read — click to expand)</summary>
+
+> The package name, tab kind and Remote namespace stay `reader` — they are stable identifiers (renaming them would change a deployed loader row and the on-disk state root). "Inspiration" is the name the reader SEES.
 
 | Surface | Contents |
 | --- | --- |
-| The wall | **Content first**: the entry cards own the first screen. **The search field owns its own full-width row**, and the filter, sort and wall-translation controls moved up into the pane's header (with refresh, settings and add) — a field wedged between three buttons is a field the reader cannot see what they typed in on a narrow sidebar; every popover hangs under **the button that opened it** and cannot cover the other one. The filter is a **two-page popover** narrowing the wall four ways — read state (unread), by source, by KIND (a feed or a saved link) and by tag: the root page holds the two read-state rows (unread, and **Hide duplicates**), a by-source drill row that carries the **current value** (so no narrowing is ever hidden) and the three kind rows. **Dedupe is on by default**: an article republished by several feeds folds into one card (three grouping tiers, any hit folds: same entry id — a shared guid shares fetch/read/translation state by design; normalized link — scheme/www/utm-style tracking parameters stripped; folded title plus the same published day; never fuzzy), the surviving card carries a 「N 个重复来源」 badge (hover names the other sources), reading any copy reads the group, the footer notes how many folded, and the backfill never spends a fetch on a hidden copy, and drilling in opens the source page, which owns the panel's height, its own scroll and — past six sources — its own search box, so **however many subscriptions accumulate, the panel's first page stays a fixed handful of rows**. It is the same local predicate as the search box (D14), so filtering costs no round trip, and its value is visible in the search box (`#sourceId` / `#rss` / `#link` / `@tagId`), which is also how it is cleared — and **a field with text in it grows an × at its right edge**, one click away from clearing both the typed term and the filter value. A **text** search is ranked by relevance — exact title, then title contains, then the other fields, with the chosen sort deciding inside each tier (`#sourceId` / `@tagId` selectors are not ranked) — and the footer says how many entries matched (`N matching “X”`), so a narrowed wall can never be mistaken for the whole wall. **The wall translates too**: the globe at the right of the toolbar (its own switch, separate from the detail view's, sharing one translation memory). It decides **per FIELD**: a Chinese title or summary is left exactly as it is, a mixed card has only its English half translated, and Chinese is never translated into Chinese. Only cards that have **entered the viewport** are queued (IntersectionObserver feeds a queue, six cards per pass, grouped by detected language, through the article's own sentinel-batch contract), so scrolling back costs nothing and opening an entry does not re-translate its title. Two views: translation only (**hovering the translated TEXT** swaps just that FIELD back to its original — the title for the title, the summary for the summary; the card's blank space, tile and chevron change nothing) and side by side (each field's original stays under its translation and keeps that FIELD's own typography — a title's original is title-sized, told apart by ink and weight rather than shrunk to caption size). **The text boxes are fixed** — title and summary each reserve two clamped lines — so swapping languages on hover cannot resize a card or shift the grid; only the side-by-side view makes the grid taller, and that is a mode the reader picks. Entry cards are **cards** — a fill, a hairline border, a 12px radius — where hover only lifts the tone (never the geometry) and a keyboard focus draws a ring; unread entries ink their title and keep the **dot** (7px) on the tile's corner — session-only, never persisted — while read entries stay put and go quieter; the feed's own category and the reader's own tag share one pill metric (the reader's tag is outlined, and the row wraps), and tagging opens from the card's `+` into a panel where you tick the vocabulary or **type a name and press Enter to create it** (the native `datalist` is gone, replaced by stylable rows). **Tags are deletable from the filter popover's `By tag` section** (a quiet × at the end of each row removes it from the vocabulary and from every entry, and clears the narrowing when it was the active one) — a vocabulary you can only add to is a one-way door. A freshness line sits at the bottom — "Refreshed 3 h ago · daily 10:00" — so a reader can tell whether the snapshot is worth re-fetching |
-| Detail | Where a card leads. The body renders as DOM text — **that is exactly what makes passage quoting work**, and why this surface never hosts an iframe. The body has **no reading measure**: it fills the width the sidebar is given, and paragraphs and lists share one right edge. Toolbar: back, **translate (globe + view menu)**, copy link, open the original in the browser, and — for a single saved link — **a delete button** (a feed entry gets none: the next refresh would bring it back, and a delete that undoes itself is a lie); the **tag row under the title also carries 「重新抓取」** (the same host action as the card's pill, and asking for a fresh copy drops that entry's translation record — the body is about to be a different DOM). Below the body, the other entries "also from this source". **A figure the page draws with its own scripts cannot be fetched**: such a `<figure>` carries nothing but an empty div and a caption in the served HTML (measured: 84 of them on the transformer-circuits.pub paper), and a fetch runs no scripts — so **the caption stays in the body** (it is text the page published, and it says what the picture shows) while one line above the body says 「这一页有 N 张插图由页面自己的脚本绘制，抓取时拿不到画面（图注保留在正文里）」 with the original-page link (opened in the in-app Sidebar Browser when the host has one; and when a future capture package is mounted, a 「渲染抓取」 action appears here — unprobed, it does not render). **And a capture-rendered page keeps its figures**: script-drawn figures arrive as inline SVG with inlined styles and survive through a safe subset (shapes/text/defs/gradients/clips/symbol reuse; `script`/`foreignObject`/SMIL/events/external references never do, and `url(` may only point at a same-document fragment) — instead of leaving only a caption. **Composite figures keep their structure too**: a capture-rendered composite (a diagram plus property cards built from styled boxes) keeps its div/span containers inside the figure with an allowlisted style set (layout/paint properties; `position:fixed`, over-bound `z-index`, external `url()`s and script tricks all stripped), and every unwrapped block container leaves a word boundary — sibling texts can never concatenate. **A picture whose URL IS in the static markup is recovered, though**: lazy-loading sites keep the real URL in a `data-src`-style attribute, a `srcset`, a `<picture>`'s `<source>`, or the `<noscript>` no-JS fallback (the `src` holds a 1px placeholder), and the extractor resolves the candidates in that order, taking the largest srcset one; **the converse shape is kept too — pages that inline their real figures as base64 data URIs (transformer-circuits.pub style)**: placeholder and picture are split by payload size (a 512-char threshold; a 1px gif is ~70, a real chart runs to the thousands), the small one still counts as absent and yields to the lazy attributes, the large one is kept as-is; every emitted `<img>` carries `referrerpolicy="no-referrer"`, because anti-hotlink CDNs answer 403 otherwise. **Formulas render as native MathML**: an arXiv HTML paper's `<math alttext="…">` passes through a safe presentation subset (`annotation-xml` and any script never do — the former is an HTML-injection vector), and display math scrolls sideways instead of breaking the layout. **LaTeXML's vector figures are kept too**: arXiv HTML embeds them as `<object type="image/svg+xml" data="…">`, which the normalizer rewrites as an `<img>` carrying the original width/height; a non-image object (a PDF, a movie) is still dropped whole|
+| The wall | **Content first**: the entry cards own the first screen. **The search field owns its own full-width row**, and the filter, sort and wall-translation controls moved up into the pane's header (with refresh, settings and add) — a field wedged between three buttons is a field the reader cannot see what they typed in on a narrow sidebar; every popover hangs under **the button that opened it** and cannot cover the other one. The filter is a **two-page popover** narrowing the wall four ways — read state (unread), by source, by KIND (a feed or a saved link) and by tag: the root page holds the two read-state rows (unread, and **Hide duplicates**), a by-source drill row that carries the **current value** (so no narrowing is ever hidden) and the three kind rows. **Dedupe is on by default**: an article republished by several feeds folds into one card (three grouping tiers, any hit folds: same entry id — a shared guid shares fetch/read/translation state by design; normalized link — scheme/www/utm-style tracking parameters stripped; folded title plus the same published day; never fuzzy), the surviving card carries a 「N 个重复来源」 badge (hover names the other sources), reading any copy reads the group, the footer notes how many folded, and the backfill never spends a fetch on a hidden copy, and drilling in opens the source page, which owns the panel's height, its own scroll and — past six sources — its own search box, so **however many subscriptions accumulate, the panel's first page stays a fixed handful of rows**. It is the same local predicate as the search box (D14), so filtering costs no round trip, and its value is visible in the search box (`#sourceId` / `#rss` / `#link` / `@tagId`), which is also how it is cleared — and **a field with text in it grows an × at its right edge**, one click away from clearing both the typed term and the filter value. A **text** search is ranked by relevance — exact title, then title contains, then the other fields, with the chosen sort deciding inside each tier (`#sourceId` / `@tagId` selectors are not ranked) — and the footer says how many entries matched (`N matching “X”`), so a narrowed wall can never be mistaken for the whole wall. **The wall translates too**: the globe at the right of the toolbar (its own switch, separate from the detail view's, sharing one translation memory). It decides **per FIELD**: a Chinese title or summary is left exactly as it is, a mixed card has only its English half translated, and Chinese is never translated into Chinese. Only cards that have **entered the viewport** are queued (IntersectionObserver feeds a queue, six cards per pass, grouped by detected language, through the article's own sentinel-batch contract), so scrolling back costs nothing and opening an entry does not re-translate its title. Two views: translation only (**hovering the translated TEXT** swaps just that FIELD back to its original — the title for the title, the summary for the summary; the card's blank space, tile and chevron change nothing) and side by side (each field's original stays under its translation and keeps that FIELD's own typography — a title's original is title-sized, told apart by ink and weight rather than shrunk to caption size). **The text boxes are fixed** — title and summary each reserve two clamped lines — so swapping languages on hover cannot resize a card or shift the grid; only the side-by-side view makes the grid taller, and that is a mode the reader picks. Entry cards are **cards** — a fill, a hairline border, a 12px radius — where hover only lifts the tone (never the geometry) and a keyboard focus draws a ring; unread entries ink their title and keep the **dot** (7px) on the tile's corner — session-only, never persisted — while read entries stay put and go quieter; the feed's own category and the reader's own tag share one pill metric (the reader's tag is outlined, and the row wraps), and tagging opens from the card's `+` into a panel where you tick the vocabulary or **type a name and press Enter to create it** (the native `datalist` is gone, replaced by stylable rows). **Tags are deletable from the filter popover's `By tag` section** (a quiet × at the end of each row removes it from the vocabulary and from every entry, and clears the narrowing when it was the active one) — a vocabulary you can only add to is a one-way door. A saved link whose body could not be read carries a quiet dashed 「仅链接」 badge, and hover and detail both say why. **A saved link's card upgrades to the article's own title once the body parses** (the body's first h1, else the document title, plus the first substantial paragraph as the excerpt) and keeps it in the host annotation — the card still reads that memory after the body's budget eviction, so a wall of papers is scannable without opening each one. A saved link without `publishedAt` sorts by **its source's added time**, so a freshly added link sits at the top instead of sinking. A freshness line sits at the bottom — "Refreshed 3 h ago · daily 10:00" — so a reader can tell whether the snapshot is worth re-fetching |
+| Detail | Where a card leads. The body renders as DOM text — **that is exactly what makes passage quoting work**, and why this surface never hosts an iframe. The body has **no reading measure**: it fills the width the sidebar is given, and paragraphs and lists share one right edge. Toolbar: back, **translate (globe + view menu)**, copy link, open the original in the browser, and — for a single saved link — **a delete button** (a feed entry gets none: the next refresh would bring it back, and a delete that undoes itself is a lie); the **tag row under the title also carries 「重新抓取」** (the same host action as the card's pill, and asking for a fresh copy drops that entry's translation record — the body is about to be a different DOM). Below the body, the other entries "also from this source". **A figure the page draws with its own scripts cannot be fetched**: such a `<figure>` carries nothing but an empty div and a caption in the served HTML (measured: 84 of them on the transformer-circuits.pub paper), and a fetch runs no scripts — so **the caption stays in the body** (it is text the page published, and it says what the picture shows) while one line above the body says 「这一页有 N 张插图由页面自己的脚本绘制，抓取时拿不到画面（图注保留在正文里）」 with the original-page link (opened in the in-app Sidebar Browser when the host has one; and when a future capture package is mounted, a 「渲染抓取」 action appears here — unprobed, it does not render). **And a capture-rendered page keeps its figures**: script-drawn figures arrive as inline SVG with inlined styles and survive through a safe subset (shapes/text/defs/gradients/clips/symbol reuse; `script`/`foreignObject`/SMIL/events/external references never do, and `url(` may only point at a same-document fragment) — instead of leaving only a caption. **Composite figures keep their structure too**: a capture-rendered composite (a diagram plus property cards built from styled boxes) keeps its div/span containers inside the figure with an allowlisted style set (layout/paint properties; `position:fixed`, over-bound `z-index`, external `url()`s and script tricks all stripped), and every unwrapped block container leaves a word boundary — sibling texts can never concatenate. **A picture whose URL IS in the static markup is recovered, though**: lazy-loading sites keep the real URL in a `data-src`-style attribute, a `srcset`, a `<picture>`'s `<source>`, or the `<noscript>` no-JS fallback (the `src` holds a 1px placeholder), and the extractor resolves the candidates in that order, taking the largest srcset one; **the converse shape is kept too — pages that inline their real figures as base64 data URIs (transformer-circuits.pub style)**: placeholder and picture are split by payload size (a 512-char threshold; a 1px gif is ~70, a real chart runs to the thousands), the small one still counts as absent and yields to the lazy attributes, the large one is kept as-is; every emitted `<img>` carries `referrerpolicy="no-referrer"`, because anti-hotlink CDNs answer 403 otherwise. **There is a second refusal a referrer policy cannot fix**: an origin answering `Cross-Origin-Resource-Policy: same-origin` (measured: every `/media` figure on claude.dev) withholds the pixels from a cross-origin page even though a direct fetch gets a 200 — the pane showed the broken-image icon over the full alt text. Those images are fetched host-side instead (public-address validation with the connection pinned to the validated answers, per-hop re-validation, an 8 MiB cap, and an `image/*` content-type gate — the host's own `ctx.web` seam decodes text only and cannot carry bytes): an `<img>` that already failed is re-pointed at the fetched bytes (a `data:` URI), a healthy image never pays the proxy, and one the host cannot have either stays broken (「阅读原文」 remains the way out). **Formulas render as native MathML**: an arXiv HTML paper's `<math alttext="…">` passes through a safe presentation subset (`annotation-xml` and any script never do — the former is an HTML-injection vector), and display math scrolls sideways instead of breaking the layout. **LaTeXML's vector figures are kept too**: arXiv HTML embeds them as `<object type="image/svg+xml" data="…">`, which the normalizer rewrites as an `<img>` carrying the original width/height; a non-image object (a PDF, a movie) is still dropped whole |
 | Translation (on-device) | The toolbar's **globe** is a switch: lit means this body is showing a translation. Its caret holds three views — **translation only** (the default; a one-time line above the body teaches "click any sentence to see its original, click again to hide it"), **side by side** (every paragraph carries its original underneath, foldable per paragraph), and **original only**. The unit is a SENTENCE: clicking one sentence reveals that ONE sentence's original under its paragraph (hairline plus a highlight), and several can be open at once; when the sentence contains an inline link and was cut into several text runs, the reveal still shows the COMPLETE sentence rather than the fragments, the original line itself is NOT a control (it is text meant to be selected for quoting — clicking it does nothing, and a click that ends a selection is ignored, so quoting never folds the sentence away). The English original is set at BODY size (13.5px, the secondary ink, 1.62 leading, 3px between lines) and is spaced by WHERE its container sits: beside a paragraph it hugs that paragraph (4px above, 14px before the next block), while inside a list item, quote or table cell it sits 5px under the translation instead of being pulled up into it by a negative margin. An EXPANDED sentence keeps one quiet marker — a hairline underline, with no standing fill or bar (that is the "this sentence is bound to the line below" cue). The pairing highlight itself is HOVER-ONLY: pointing at a Chinese sentence lights that sentence (including the fragments a link split it into) together with its one original line, and pointing at the original line does the reverse. Nothing carries a standing colour or bar by default — the earlier always-on marks turned a skimmed article into confetti. All of it runs **in the browser** (the `Translator` API in Chrome 138+ / Edge 148+, desktop): the model never leaves the device and spends no tokens, but **the derived sentence pairs do persist** (below), while the globe record and translator sessions never do. Without that API, with an unavailable pair, or on a body that is already Chinese, the globe is **not rendered at all**. **The translations persist in two tiers** (under `$DSH_HOME/state/dsh-reader`, the same directory, sensitivity class and uninstall story as the cached originals): a global **sentence memory** (`<src>→<tgt>:<sentenceHash>` → source + translation, 50k entries) and a **per-entry segment map** (hash → translation, keyed to the body's hash, so a minor refetch still reuses every unchanged sentence). One shared budget — 64 MB by default, tunable through the same cache-policy verb as the body retention — evicts least-recently-used across both tiers, with **no TTL** (a translation costs a gesture plus per-sentence model work to rebuild, so it must not expire by the clock). The net effect: after a reload the globe still waits for its gesture, and after it the whole article re-paints from disk with the model untouched; both tiers carry a schema version that reads as a miss and evicts lazily, so a browser-model upgrade never passes old translations off as the new model's |
-| Add (dialog) | The header's plus, the empty-state card and the dashed card at the end of the wall all open the same **dialog** (the members tab's invite-dialog idiom: transparent overlay plus centered card, Esc and overlay-click close), because adding is a momentary act and the wall should not be replaced by it. **What comes back decides how it is stored** (D15): a feed becomes a subscription, a web page is saved as a single item. **An arXiv abs/pdf link is upgraded to the paper's official HTML version** (`arxiv.org/html/<id>` — LaTeXML-built semantic markup: real tables, real formulas); when the HTML version does not exist (404) the pasted address falls back to the ordinary path. **A DOI link is resolved to its arXiv version first** (Crossref for the title and authors → an arXiv title search → a two-factor gate of title similarity plus author family-name overlap; no match means the ordinary path, never a guess), and a landed card marks the DOI it came from; **an OpenReview link is saved link-only without a fetch** (measured unreadable server-side: the API sits behind a Cloudflare challenge, the forum is a JS SPA), with the reason and the suggestion on the card (paste the arXiv version if one exists). **A URL that cannot be read is still saved**: the verdict changed from "succeeded / failed" to "saved, plus whether it can be previewed", the reason is classified (bot wall / login wall / not a web page / cross-site hop / unreachable / HTTP error) and the card is marked 「仅链接」 — dropping the URL the reader pasted is worse than a card that can only be opened in a browser. **A saved link’s card upgrades to the article’s own title once the body parses** (the body’s first h1, else the document title, plus the first substantial paragraph as the excerpt) and keeps it in the host annotation — the card still reads that memory after the body’s budget eviction, so a wall of papers is scannable without opening each one |
+| Add (dialog) | The header's plus, the empty-state card and the dashed card at the end of the wall all open the same **dialog** (the members tab's invite-dialog idiom: transparent overlay plus centered card, Esc and overlay-click close), because adding is a momentary act and the wall should not be replaced by it. **What comes back decides how it is stored** (D15): a feed becomes a subscription, a web page is saved as a single item. **An arXiv abs/pdf link is upgraded to the paper's official HTML version** (`arxiv.org/html/<id>` — LaTeXML-built semantic markup: real tables, real formulas); when the HTML version does not exist (404) the pasted address falls back to the ordinary path. **A DOI link is resolved to its arXiv version first** (Crossref for the title and authors → an arXiv title search → a two-factor gate of title similarity plus author family-name overlap; no match means the ordinary path, never a guess), and a landed card marks the DOI it came from; **an OpenReview link is saved link-only without a fetch** (measured unreadable server-side: the API sits behind a Cloudflare challenge, the forum is a JS SPA), with the reason and the suggestion on the card (paste the arXiv version if one exists). **A URL that cannot be read is still saved**: the verdict changed from "succeeded / failed" to "saved, plus whether it can be previewed", the reason is classified (bot wall / login wall / not a web page / cross-site hop / unreachable / HTTP error) and the card is marked 「仅链接」 — dropping the URL the reader pasted is worse than a card that can only be opened in a browser |
 | Subscriptions (page) | The header's settings button opens the **subscription page**: one **compressed settings row** at the top (daily refresh time and article retention side by side, their long explanations moved into hover titles), a **storage row** (the article cache's readout — "N cached · size", the translation cache's readout — "M maps + S sentences · size" — the **translation budget** input in MB, committed on blur/Enter, and a two-step **clear translation cache** button; the readouts are aggregated on the host, the tables never cross the wire) plus two labelled **chip groups** — `By type` (all / feeds / saved links, each with its count) and `Sort` (added / name / last fetch, added-time descending by default) — then one row per source where **both the name and the feed address are editable in place** (a changed address is a different document, so it refetches on save; clearing the name falls back to the feed's own title), plus its kind, item count, last fetch, failure reason (classified, not the seam's raw sentence), per-source refresh, pause/resume, remove, and the **daily refresh time setting**. Those questions are about SOURCES rather than about content, so they do not live on the wall |
 | Recently read (page) | The header's **clock** opens the **recently read page**: the entries you opened, **newest first** (title, source, "how long ago"), where clicking one **reads it again**; a bin in the page bar **clears the whole list**. It records "what was I just reading", so it is **persisted** (`state.json`'s `recent`, **at most 100 rows**; reopening an entry moves it back to the top instead of duplicating it) and survives a reload and a restart — unlike the pane's own memory (the open article, the reading position, the translation), which is shared **across dsh sessions but not across a reload** (it is per page — see above); `recent` is deployment-level and outlives a restart. **A row stores only the entry id, source id, title, URL and time** — never the body — so the page can still reopen an entry that has **rolled out of its feed's window** (as long as the source is still there). An entry whose source was deleted is still listed but cannot be opened, and says so |
 
@@ -23,38 +74,37 @@ Fetching happens on the **host half** through the sanctioned `ctx.web` egress se
 
 **Click semantics (settled as option B)**: a card click opens the detail view. Most reading happens in dsh; when the body is too long or the reader wants the original, the detail view's own button goes to the browser. The trailing chevron is a cue that the card leads somewhere, not a control.
 
-## Quoting
-
-The body is an app-level selection, so `@khorsheed/dsh-quote`'s overlay menu **already covers it** — this package builds no selection menu of its own. The detail view also carries:
+**Quoting**: the body is an app-level selection, so `@khorsheed/dsh-quote`'s overlay menu **already covers it** — this package builds no selection menu of its own. The detail view also carries:
 
 - **Quote**: the selection (the whole entry when there is none) plus a source label, merged into the current conversation draft through the official input machine (the live draft is read and merged, never overwritten, never sent);
 - **Sent to side chat**: shown only when the composition really has a `sideChat` service (the capability handshake decides), hidden otherwise.
 
-`reader` ships its own thin typert Remote (namespace `reader`) with the verbs `capabilities` / `listSources` / `addSource` / `updateSource` / `removeSource` / `refresh` / `getBodies` / `quoteToSideChat`. The host half **never parses** a feed — parsing lives in the browser half, and `getBodies` only hands the raw payload across.
+</details>
 
-## Install
+<details>
+<summary>Internals (architecture, the egress seam, translation, storage — click to expand)</summary>
 
-```sh
-dsh plugin --profile web add @khorsheed/dsh-reader
-# uninstall:
-dsh plugin --profile web remove @khorsheed/dsh-reader
-```
+**Architecture.** Fetching happens on the **host half** through the sanctioned `ctx.web` egress seam; the browser half only parses and renders. The host half provides the `reader` service core (`ctx.provide('reader')`) and mounts its thin Typert Remote face (namespace `reader`); the subscription list and the most recent raw payloads are persisted to `$DSH_HOME/state/dsh-reader/state.json` with atomic `node:fs` writes (not through `ctx.fs` — see below), and the daily refresh is armed by a plugin-owned `setTimeout`, since no host scheduler service exists to ride. The browser half registers the right sidebar in two stages: first its own minted tab type `reader` (implementation id `@khorsheed/dsh-reader`, with a guide card) into the `sidebarRightTabs` registry, then the pane body into the keyed `sidebar.right.pane.tab` seat via `slots.inject`; the zh/en dictionaries register with the plugin, and the Remote is mounted by the client itself via `ctx.remote.$mount`. Feed parsing has to live in the browser — the host has no XML/DOM parser (`globalThis.DOMParser === false`) — so `getBodies` only hands the raw payload across. There is no `static inject`: every optional capability (`fs`, `web`, `sideChat`, the `browser` tab kind, the capture Remote) is probed at the point of use and degrades, never throws.
 
-Restart the host afterwards. Exactly one directory is written: `$DSH_HOME/state/dsh-reader/` — `state.json` (the subscription list, the latest payloads, the reader's own tags and the 「最近阅读」 records) and `bodies/` (one file per body over 256 KiB; the global translation memory is its `translation-memory.json`, and a large per-entry segment map gets its own file). Uninstalling leaves the directory behind — delete the whole `dsh-reader/` for a clean removal.
+**Why state does not go through `ctx.fs`**: `ctx.fs` is the **sandboxed** filesystem — every mutation is fenced by the FILE POLICY OF THE CALLING SESSION, so a workspace-write session is refused a write under `$DSH_HOME/state` (`FS_SANDBOX_DENIED`, observed on the acceptance instance). The fence is right and stays; the mistake was aiming a session-scoped capability at deployment-owned state. This package therefore writes with `node:fs` (atomic temp-file plus rename), the way this repo's other host-state packages do (`packages/lab/src/state.ts`), and degrades to memory-only when the root is unwritable.
 
-## Compatibility
+**The Remote face.** Namespace `reader`, verbs by group: sources — `capabilities` / `listSources` / `addSource` / `updateSource` / `removeSource` / `refresh`; bodies — `getBodies` / `getEntryBody` / `fetchEntryBody` / `storeEntryBody` / `getRawBody` / `entryFetchStates` / `listBackfillCandidates`; translations — `getEntryTranslation` / `getSentenceTranslations` / `rememberSentences` / `clearTranslations`; tags — `entryTags` / `listTags` / `createTag` / `tagEntry` / `renameTag` / `deleteTag` / `pruneTags`; reading records — `recordRead` / `listRecent` / `clearRecent`; cache policy and readouts — `getCachePolicy` / `setCachePolicy` / `getStorageStats`; plus `quoteToSideChat`. The host half **never parses** a feed — parsing lives in the browser half.
+
+**Sources are named by the feed's own title**: the host half cannot parse a feed (it has no XML parser), so a new source starts with a URL-derived label — the `raw.githubusercontent.com/...` you see in the strip. Once the browser half has parsed `<channel><title>`, that real title replaces the display label, so cards read "Anthropic Research"; it falls back to the URL when parsing fails. The `{count} d ago` placeholder the list showed for an errored source was the other face of the same class of bug (an uninterpolated parameter) and is fixed.
+
+**Translation uses the browser's own on-device model, not the host's**: `self.Translator` (Chrome 138+ / Edge 148+, desktop only) translates inside the page's own process, so **the model never leaves the device, spends no tokens and needs no network** (the first use downloads a small language pack per pair, and `Translator.create()` requires user activation — the click on the globe is exactly that). **The derived sentence pairs are written to the host side** (the global sentence memory and the per-entry maps under `$DSH_HOME/state/dsh-reader`, a shared 64 MB budget, LRU, no TTL; derived content of pages the reader read, the same sensitivity class as the cached originals beside them — the privacy invariant was always about the network, not the disk).
+
+**The translation unit is a sentence — not a paragraph, not a text node**: sentences are cut BEFORE the request, so the pairing is true by construction rather than guessed afterwards — a paragraph-level translation comes back as one block, the model merges and splits sentences, and re-aligning the two sides afterwards can show the wrong original. Batches separate sentences with a sentinel and, when the returned part count does not match, that batch is re-sent one unit per request: **granularity is what the fallback gives up, never correctness**. A sentence that crosses an inline element (a link inside it) becomes two units and the link itself is never touched; nothing inside `<pre>`/`<code>` is translated.
+
+**A translator that cannot be built is reported, never faked**: `Translator.availability()` is a HINT, not a promise — on Chrome a pair has been observed answering "available" and then rejecting `create()` with `NotSupportedError` ("Unable to create translator for the given source and target language"; Chromium has the same failure recorded for macOS builds). So the plugin (1) asks the browser's `LanguageDetector` for the source language first — a wrong source is one way a pair cannot be built, and that error names NEITHER language; (2) actually tries the target in both accepted spellings, `zh` then `zh-Hans`; and (3) when every attempt is rejected as unsupported, HIDES the globe and says which pairs it tried while pointing at `chrome://on-device-internals` ("Broker State"). Non-permanent failures (download, quota) keep the globe so the reader can retry, and report the attempted pairs plus the reason.
+
+**Restoring the body is byte-exact**: translation only rewrites text nodes (the originals stay in memory), so "original only" and cancel put back exactly the HTML the host sent. That is also why a translation cannot lose links, images or tables — they are never touched.
+
+**Some sites refuse automatic fetches, and the button says so honestly**: measured, `openai.com` answers **403 to every non-browser request** (with a proxy, without one, and with a browser User-Agent — it returns a bot-challenge page). That is not an extraction failure and no retry fixes it, so for a 401/403 the detail view says "this publisher refuses automatic fetches" instead of "could not extract". **The status code is not the only signal**: an `openreview.net` PDF link was measured answering `302 → /challenge?redirect=…` and then a **200** challenge page — trusting the status code stores that page as the article, which is exactly how "I added it and there is no content" happened. So the decision is a combination: whether the final URL moved, whether the visible text is too short to be a page, and the words a bot or login page leaves behind; any hit means the payload is NOT stored as a body and the link is saved as 「仅链接」. Newsletter platforms and paywalls behave the same way.
+
+**Some feeds publish full text for some posts and only a summary for others**: measured on the OpenAI alignment feed, whose 27 entries run from **155 characters** (a one-line summary) to **62,044** (full text). Nothing is truncated; that is how it is published. **A summary is no longer mistaken for the article**: the feed's `<description>` used to be promoted into `contentHtml`, so the entry looked complete — the backfill skipped it, opening it fetched nothing, and the detail view rendered those 167 characters as the whole paper. Such entries are now flagged `summaryOnly`: opening one fetches the real article on the spot (the detail view says 「这条订阅源只发布了摘要 —— 全文在原文页面上」 while it does, with the original-page link, and the line disappears when the text arrives) and the automatic backfill counts them as text it still owes. **That fetch now happens only while the entry has no cached body**: `summaryOnly` is a property of the FEED entry and is true forever, so this used to re-fetch an already-fetched article on EVERY open — replacing its DOM, and its translation, with the same bytes. The fetch is now gated on the text on screen being the feed's own (`fromFeed`).
 
-- npm release line (`@deepseek-ai/dsh@0.1.5-rc.1`): ✅ complete — the `sidebar.right.pane.tab` seat, the `ctx.web.fetch` egress seam, version-guarded `ctx.fs` writes; no `pluginInventory` needed (this package does no preset self-hide).
-- Source line (deepseek-harness master): ✅ (verifiedHost: 0.1.5-rc.1)
-- **Why state does not go through `ctx.fs`**: `ctx.fs` is this repo's **sandboxed** filesystem — every mutation is fenced by the FILE POLICY OF THE CALLING SESSION, so a workspace-write session is refused a write under `$DSH_HOME/state` (`FS_SANDBOX_DENIED`, observed on the acceptance instance). The fence is right and stays; the mistake was aiming a session-scoped capability at deployment-owned state. This package therefore writes with `node:fs` (atomic temp-file plus rename), the way this repo's other host-state packages do (`packages/lab/src/state.ts`), and degrades to memory-only when the root is unwritable.
-- **Sources are named by the feed's own title**: the host half cannot parse a feed (it has no XML parser), so a new source starts with a URL-derived label — the `raw.githubusercontent.com/...` you see in the strip. Once the browser half has parsed `<channel><title>`, that real title replaces the display label, so cards read "Anthropic Research"; it falls back to the URL when parsing fails. The `{count} d ago` placeholder the list showed for an errored source was the other face of the same class of bug (an uninterpolated parameter) and is fixed.
-- **Translation uses the browser's own on-device model, not the host's**: `self.Translator` (Chrome 138+ / Edge 148+, desktop only) translates inside the page's own process, so **the model never leaves the device, spends no tokens and needs no network** (the first use downloads a small language pack per pair, and `Translator.create()` requires user activation — the click on the globe is exactly that). **The derived sentence pairs are written to the host side** (the global sentence memory and the per-entry maps under `$DSH_HOME/state/dsh-reader`, a shared 64 MB budget, LRU, no TTL; derived content of pages the reader read, the same sensitivity class as the cached originals beside them — the privacy invariant was always about the network, not the disk). The price is availability: Safari, Firefox and mobile have no such API, and the plugin then hides the globe while everything else keeps working. That trade is deliberate: sending one 50,000-character article through a host LLM costs tens of thousands of tokens, tens of seconds, and a second copy of the article to the model provider, while on-device translation is free, seconds and stays on the machine (its quality is page-translation-grade NMT, not LLM-grade).
-- **The translation unit is a sentence — not a paragraph, not a text node**: sentences are cut BEFORE the request, so the pairing is true by construction rather than guessed afterwards — a paragraph-level translation comes back as one block, the model merges and splits sentences, and re-aligning the two sides afterwards can show the wrong original. Batches separate sentences with a sentinel and, when the returned part count does not match, that batch is re-sent one unit per request: **granularity is what the fallback gives up, never correctness**. A sentence that crosses an inline element (a link inside it) becomes two units and the link itself is never touched; nothing inside `<pre>`/`<code>` is translated.
-- **A translator that cannot be built is reported, never faked**: `Translator.availability()` is a HINT, not a promise — on Chrome a pair has been observed answering "available" and then rejecting `create()` with `NotSupportedError` ("Unable to create translator for the given source and target language"; Chromium has the same failure recorded for macOS builds). So the plugin (1) asks the browser's `LanguageDetector` for the source language first — a wrong source is one way a pair cannot be built, and that error names NEITHER language; (2) actually tries the target in both accepted spellings, `zh` then `zh-Hans`; and (3) when every attempt is rejected as unsupported, HIDES the globe and says which pairs it tried while pointing at `chrome://on-device-internals` ("Broker State"). Non-permanent failures (download, quota) keep the globe so the reader can retry, and report the attempted pairs plus the reason.
-- **Restoring the body is byte-exact**: translation only rewrites text nodes (the originals stay in memory), so "original only" and cancel put back exactly the HTML the host sent. That is also why a translation cannot lose links, images or tables — they are never touched.
-- **Some sites refuse automatic fetches, and the button says so honestly**: measured, `openai.com` answers **403 to every non-browser request** (with a proxy, without one, and with a browser User-Agent — it returns a bot-challenge page). That is not an extraction failure and no retry fixes it, so for a 401/403 the detail view says "this publisher refuses automatic fetches" instead of "could not extract". **The status code is not the only signal**: an `openreview.net` PDF link was measured answering `302 → /challenge?redirect=…` and then a **200** challenge page — trusting the status code stores that page as the article, which is exactly how "I added it and there is no content" happened. So the decision is a combination: whether the final URL moved, whether the visible text is too short to be a page, and the words a bot or login page leaves behind; any hit means the payload is NOT stored as a body and the link is saved as 「仅链接」. Newsletter platforms and paywalls behave the same way. It is also why browser-rendered fetching is out of scope here: that needs the browser pane, which is still `planned`.
-- **Some feeds publish full text for some posts and only a summary for others**: measured on the OpenAI alignment feed, whose 27 entries run from **155 characters** (a one-line summary) to **62,044** (full text). Nothing is truncated; that is how it is published. **A summary is no longer mistaken for the article**: the feed's `<description>` used to be promoted into `contentHtml`, so the entry looked complete — the backfill skipped it, opening it fetched nothing, and the detail view rendered those 167 characters as the whole paper. Such entries are now flagged `summaryOnly`: opening one fetches the real article on the spot (the detail view says 「这条订阅源只发布了摘要 —— 全文在原文页面上」 while it does, with the original-page link, and the line disappears when the text arrives) and the automatic backfill counts them as text it still owes. **That fetch now happens only while the entry has no cached body**: `summaryOnly` is a property of the FEED entry and is true forever, so this used to re-fetch an already-fetched article on EVERY open — replacing its DOM, and its translation, with the same bytes. The fetch is now gated on the text on screen being the feed's own (`fromFeed`).
-- **The host hands over at most 100,000 characters per payload, so an oversized feed can only be read in part**: this is the egress seam's default (`web-fetch-http`'s `maxBodyChars`), NOT this package's body budget (256 KB per source, 2 MiB total). The acceptance instance's feed is 646,905 characters; the host supplies the first 100,000, so only the two entries falling inside that prefix are readable. The plugin **cannot** work around it: `ctx.web.fetch` accepts `{ url }` only — no Range, no custom headers, no pagination — and vendoring `fetch` to bypass it would bypass the host's egress policy, which is not an option. Reading such a feed whole needs **no host code change**: the official patch overlay adds config to that row (`--patch <file>`, or the machine-level `$DSH_HOME/cordis.patch.yml` which applies to every profile):
+**The host hands over at most 100,000 characters per payload, so an oversized feed can only be read in part**: this is the egress seam's default (`web-fetch-http`'s `maxBodyChars`), NOT this package's body budget (2 MiB per source, 12 MiB total — see `MAX_BODY_CHARS_PER_SOURCE`). The acceptance instance's feed is 646,905 characters; the host supplies the first 100,000, so only the two entries falling inside that prefix are readable. The plugin **cannot** work around it: `ctx.web.fetch` accepts `{ url }` only — no Range, no custom headers, no pagination — and vendoring `fetch` to bypass it would bypass the host's egress policy, which is not an option. Reading such a feed whole needs **no host code change**: the official patch overlay adds config to that row (`--patch <file>`, or the machine-level `$DSH_HOME/cordis.patch.yml` which applies to every profile):
 
 ```yaml
 - id: web-fetch-http
@@ -62,29 +112,33 @@ Restart the host afterwards. Exactly one directory is written: `$DSH_HOME/state/
     maxBodyChars: 2000000   # default 100000
 ```
 
-Verified with `dsh --profile web --patch <file> --dump-config` (the composed tree carries the value), and then applied on the acceptance instance: the same feed went from "100,000 characters, truncated, 2 entries" to "**646,905 characters, untruncated, 21 complete entries**". **Raised again on 2026-09-19**: research articles are large in their own right — the transformer-circuits.pub emotions paper is a **41.8 MB** HTML document (60 of its figures are inline base64), and the seam's BYTE cap (`maxResponseBytes`) defaults to 5 MB, so the whole fetch fails (`response exceeds the maximum of 5000000 bytes`) with `maxBodyChars` waiting behind it. The acceptance instance's deployment config now raises **both** to 64 MB and the fetch **timeout from its 30 s default to 180 s** (that page takes 19.5 s on a direct connection, so a busy machine used to fail it with `web fetch timed out`; same patch row, `$DSH_HOME/profiles/web/cordis.patch.yml`). The price is machine-wide: peak memory and transfer per fetch go up with it. Note that this package's OWN per-source budget must not sit below the host's cap, or storing the payload re-cuts it — it is 2 MiB per source, 12 MiB total. The boundary that remains is ownership — a plugin patch mounts its OWN row only (the repo forbids one package mounting or editing another's row), so this override is a **deployment configuration** decision, and it raises the cap for **every web fetch on the machine**.
-- **Full text is filled in automatically — there is no button to press**: after each load the host reports which entries still lack text (at most 8 per run; a failed entry is left alone for 6 hours), and the browser half fetches + extracts them into a 24-hour cache (configurable on the subscription page), **two requests at a time**. An entry being filled keeps showing the feed's own text, the footer reports "Filling in 3/8…", and a completed card carries a "Full text" badge (meaning: the card still shows the feed's own summary, and the full text is cached — open it to read). **Do not want to wait for the slice? Open that entry**: if no body is held locally, opening it fetches once right there and says 「正在抓取正文…」 instead of waiting for the backfill's turn.
-  - Why not fetch them all at once: that would crawl every article of every subscription. This takes a slice per refresh and moves forward.
-  - **What arrives is what is shown**: a publisher refusing us (401/403), an unreachable host, and an unreadable page are three different sentences, and the body area always shows the feed's own content plus "read the original" — never a blank page.
-- **A feed the host truncates is salvaged, not discarded**: the egress seam caps a payload by CHARACTER COUNT, and a cap that lands inside a tag makes the whole document malformed — which used to mean **no entries at all**. The parser now keeps every complete `<item>`/`<entry>` (re-wrapping each fragment with the document root's namespace declarations, without which a fragment carrying `content:encoded` is itself malformed), repairs the cut-off block best-effort and flags it **partial** so its arrived text still renders, and the wall shows an "incomplete" line with the original-page link. The shape is pinned by a committed fixture (`tests/fixtures/feed-truncated.xml`).
-  Measured: the acceptance instance's 646 KB feed (of which the host hands over 100,000 characters) now yields **2 cards** — one complete 42 KB body and one partial — where before this fix it yielded **0**.
-- **The default filter is "all", not "today"**: a feed's newest entry is often not from today (the acceptance instance's feed was 8 days old), and a default `today` filter made a freshly subscribed wall look empty — which reads as "the subscribe did not work". There is **no today filter at all** now: the four ways to narrow the wall (unread / by source / by kind / by tag) live in the filter popover, and the button's own pressed state plus the `#sourceId` / `#rss` / `#link` / `@tagId` query it writes into the search box keep "what is hidden" visible.
-- **A body over 256 KiB is stored as its own file**: `state.json` keeps only its metadata (file name and character count) and the markup itself lives in `$DSH_HOME/state/dsh-reader/bodies/<hash>.html`. The article-retention setting (12/24/168 hours or forever) governs both kinds identically, and eviction deletes the file with the metadata. The reason is that `state.json` is read and rewritten as a whole: a paper whose figures are inlined as base64 extracts to tens of megabytes, and inlining those would make every reader operation pay a multi-megabyte round trip.
-- **A repeated title at the top of the body is dropped**: the detail view already renders the entry title, and the article's own HTML often carries it again (measured: TWO `<h1>`s, preceded by the site name and a logo link). Extraction removes top-level headings that repeat the document title, plus the leading masthead and blank lines, so the body starts at real content ("Authors").
-- **The body has no reading measure**: paragraphs and lists fill the width the sidebar is given — no `max-width` (the earlier paragraph-only cap left a ragged band of empty space on the right that read as a broken layout). Want a shorter line? Narrow the sidebar.
-- **The host fetch cap is a known limit**: `ctx.web.fetch` truncates a decoded body at 100,000 characters and does so **silently**. Articles past that cannot be fully extracted (measured: an Anthropic research page ~266k, theverge.com ~899k, newyorker.com ~1.97M characters); a summary page's title, author and description still arrive. The detail view therefore shows 「受限篇幅，内容未完整呈现」 with a 「阅读原文」 button. RSS feeds are mostly safe (measured: HN 11KB, BBC 25KB, 阮一峰 69KB, Simon Willison 83KB — 83KB already sits against the cap).
-- **Degrade matrix**: no `fs` → state is memory-only and lost on restart (the handshake reports `hasFs: false` rather than pretending persistence exists); no `web` → a pasted link is still saved, marked 「仅链接 (unreachable)」 with 「阅读原文」, and no exception is thrown and no URL is lost; no `sideChat` → the side-chat action is hidden; no `quote` → the selection overlay is simply absent, while the entry-level Quote button keeps working. A host below 0.1.6-alpha.2 (no `browser` right-Sidebar tab kind) → the spots that want a real browser (the script-figure notice, the bot-wall card action) offer the ordinary external link instead, without an error.
-- **A cross-origin redirect is followed only when it can be reconstructed**: the host seam refuses one (`WEB_REDIRECT_BLOCKED`) and reports the target **origin only — never the path**. So this service re-enters the seam only for a same-HOST scheme/port change (`http://host/feed` → `https://host/feed`, path and query preserved) and otherwise reports that the address moves to another site instead of following it — fetching the bare origin would return a different page and file it under the reader's URL. The earlier text here claimed "up to 3 hops"; that follow path was dead code, because it looked for the text `WEB_REDIRECT_BLOCKED` in an error MESSAGE that never contains it (the host puts it in `error.code`), so every cross-origin redirect surfaced as the seam's raw sentence. It now reads the code, with a regression test.
-- **Refusals become 「仅链接」 cards**: a fetched page with almost no readable text (under 200 visible characters after script/style are stripped) that also carries bot-wall or login-wall markers is never stored as an article — **a challenge page never becomes a card's body** — and `application/pdf` and friends are refused outright by the egress seam (`WEB_UNSUPPORTED_CONTENT_TYPE`: only html/text/json/xml). Those cards stay on the wall, take tags, copy their link and can be deleted; opening one shows the reason and 「阅读原文」.
-- **A permanent refusal is not retried automatically**: bot walls, login walls, PDFs, HTTP errors and empty pages are recorded as non-retryable (`isRetryablePreviewFailure` lets only `unreachable` through), so the automatic backfill stops knocking; the subscription page's per-source Refresh still retries by hand and clears the record on success. That is what keeps the plugin from tapping a site that will always say no every six hours.
-- **No conditional requests**: the host seam exposes no custom-request-header entry point, so there is no ETag/If-None-Match and every refresh is a full fetch.
-- **Nothing behind a login wall**: there is no credential-injection surface.
+Verified with `dsh --profile web --patch <file> --dump-config` (the composed tree carries the value), and then applied on the acceptance instance: the same feed went from "100,000 characters, truncated, 2 entries" to "**646,905 characters, untruncated, 21 complete entries**". **Raised again on 2026-09-19**: research articles are large in their own right — the transformer-circuits.pub emotions paper is a **41.8 MB** HTML document (60 of its figures are inline base64), and the seam's BYTE cap (`maxResponseBytes`) defaults to 5 MB, so the whole fetch fails (`response exceeds the maximum of 5000000 bytes`) with `maxBodyChars` waiting behind it. The acceptance instance's deployment config now raises **both** to 64 MB and the fetch **timeout from its 30 s default to 180 s** (that page takes 19.5 s on a direct connection, so a busy machine used to fail it with `web fetch timed out`). The price is machine-wide: peak memory and transfer per fetch go up with it. The boundary that remains is ownership — a plugin patch mounts its OWN row only (the repo forbids one package mounting or editing another's row), so this override is a **deployment configuration** decision, and it raises the cap for **every web fetch on the machine**.
 
-## Known Limitations
+**Full text is filled in automatically — there is no button to press**: after each load the host reports which entries still lack text (at most 8 per run; a failed entry is left alone for 6 hours), and the browser half fetches + extracts them into a 24-hour cache (configurable on the subscription page), **two requests at a time**. An entry being filled keeps showing the feed's own text, the footer reports "Filling in 3/8…", and a completed card carries a "Full text" badge (meaning: the card still shows the feed's own summary, and the full text is cached — open it to read). **Do not want to wait for the slice? Open that entry**: if no body is held locally, opening it fetches once right there and says 「正在抓取正文…」 instead of waiting for the backfill's turn.
+
+- Why not fetch them all at once: that would crawl every article of every subscription. This takes a slice per refresh and moves forward.
+- **What arrives is what is shown**: a publisher refusing us (401/403), an unreachable host, and an unreadable page are three different sentences, and the body area always shows the feed's own content plus "read the original" — never a blank page.
+
+**A feed the host truncates is salvaged, not discarded**: the egress seam caps a payload by CHARACTER COUNT, and a cap that lands inside a tag makes the whole document malformed — which used to mean **no entries at all**. The parser now keeps every complete `<item>`/`<entry>` (re-wrapping each fragment with the document root's namespace declarations, without which a fragment carrying `content:encoded` is itself malformed), repairs the cut-off block best-effort and flags it **partial** so its arrived text still renders, and the wall shows an "incomplete" line with the original-page link. The shape is pinned by a committed fixture (`tests/fixtures/feed-truncated.xml`). Measured: the acceptance instance's 646 KB feed (of which the host hands over 100,000 characters) now yields **2 cards** — one complete 42 KB body and one partial — where before this fix it yielded **0**.
+
+**Refusals become 「仅链接」 cards**: a fetched page with almost no readable text (under 200 visible characters after script/style are stripped) that also carries bot-wall or login-wall markers is never stored as an article — **a challenge page never becomes a card's body** — and `application/pdf` and friends are refused outright by the egress seam (`WEB_UNSUPPORTED_CONTENT_TYPE`: only html/text/json/xml). Those cards stay on the wall, take tags, copy their link and can be deleted; opening one shows the reason and 「阅读原文」.
+
+**A permanent refusal is not retried automatically**: bot walls, login walls, PDFs, HTTP errors and empty pages are recorded as non-retryable (`isRetryablePreviewFailure` lets only `unreachable` through), so the automatic backfill stops knocking; the subscription page's per-source Refresh still retries by hand and clears the record on success. That is what keeps the plugin from tapping a site that will always say no every six hours.
+
+**A cross-origin redirect is followed only when it can be reconstructed**: the host seam refuses one (`WEB_REDIRECT_BLOCKED`) and reports the target **origin only — never the path**. So this service re-enters the seam only for a same-HOST scheme/port change (`http://host/feed` → `https://host/feed`, path and query preserved) and otherwise reports that the address moves to another site instead of following it — fetching the bare origin would return a different page and file it under the reader's URL. The decision reads `error.code`, not the error message text (the host puts `WEB_REDIRECT_BLOCKED` on `error.code`), with a regression test.
+
+**No conditional requests**: the host seam exposes no custom-request-header entry point, so there is no ETag/If-None-Match and every refresh is a full fetch. **Nothing behind a login wall**: there is no credential-injection surface.
+
+**A body over 256 KiB is stored as its own file**: `state.json` keeps only its metadata (file name and character count) and the markup itself lives in `$DSH_HOME/state/dsh-reader/bodies/<hash>.html`. The article-retention setting (12/24/168 hours or forever) governs both kinds identically, and eviction deletes the file with the metadata. The reason is that `state.json` is read and rewritten as a whole: a paper whose figures are inlined as base64 extracts to tens of megabytes, and inlining those would make every reader operation pay a multi-megabyte round trip.
+
+**A repeated title at the top of the body is dropped**: the detail view already renders the entry title, and the article's own HTML often carries it again (measured: TWO `<h1>`s, preceded by the site name and a logo link). Extraction removes top-level headings that repeat the document title, plus the leading masthead and blank lines, so the body starts at real content ("Authors").
+
+**The default filter is "all", not "today"**: a feed's newest entry is often not from today (the acceptance instance's feed was 8 days old), and a default `today` filter made a freshly subscribed wall look empty — which reads as "the subscribe did not work". There is **no today filter at all** now: the four ways to narrow the wall (unread / by source / by kind / by tag) live in the filter popover, and the button's own pressed state plus the `#sourceId` / `#rss` / `#link` / `@tagId` query it writes into the search box keep "what is hidden" visible.
+
+**Degrade matrix**: no `fs` → state is memory-only and lost on restart (the handshake reports `hasFs: false` rather than pretending persistence exists); no `web` → a pasted link is still saved, marked 「仅链接 (unreachable)」 with 「阅读原文」, and no exception is thrown and no URL is lost; no `sideChat` → the side-chat action is hidden; no `quote` → the selection overlay is simply absent, while the entry-level Quote button keeps working; no capture package → the 「渲染抓取」 action on the script-figure notice does not render; a host below 0.1.6-alpha.2 (no `browser` right-Sidebar tab kind) → the spots that want a real browser (the script-figure notice, the bot-wall card action) offer the ordinary external link instead, without an error.
+
+</details>
+
+## Development
 
-- **Subscribe, do not crawl**: adding a subscription fetches the feed itself and never pre-fetches every entry's body (that would blow up storage and amount to running a crawler). Opening one entry pays for one fetch.
-- **A PDF (or any non-web file) has no body**: the egress seam accepts only `text/html`, `text/*`, `application/json` and `application/xml`, so `application/pdf` is refused before extraction even starts — and extraction is DOM-based, which a PDF does not have. Such a link is a 「仅链接」 card plus 「阅读原文」; this plugin is not a PDF reader.
-- **A cross-site hop is not followed**: the seam reports the target origin only, so the path cannot be reconstructed. Shorteners and institutional proxies are therefore reported as "this address moves to another site" rather than guessed at.
-- **Read state and bodies are not persisted**: they are session state. Persisting a per-entry read cursor would need a second, write-heavy document, and "what is new since I last looked" is the whole value of this plugin.
-- **XML parsing lives in the browser**: the host has no XML/DOM parser (`globalThis.DOMParser === false`), so feed parsing has to happen client-side.
-- **No browser-pane dependency**: `proposals/active/2026-09-13-browser-pane.md` is still `planned`, and canvas CDP frames cannot host selection quoting.
+Part of the [dsh-plugins](https://github.com/Khorsheed/dsh-plugins) monorepo (`packages/dsh-reader`). Issues and contributions welcome there.

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority; after
 # editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/dsh-reader/README.en.md
-packages/dsh-reader/README.en.md: eb4fd3ca3636e3329283829f1734f6708699aa78
-packages/dsh-reader/README.md: 212a805160058c7cfbdccded74890ca3543f0f0b
+packages/dsh-reader/README.en.md: 8ce556c7a4154e7946365b6104d8a7655e5de25b
+packages/dsh-reader/README.md: b10d1ec3d89de6125f94b53e0b71febdebaccb81