@linxin666/dsh-client-ui-task-board 0.3.24 → 0.4.0

package/src/client/PluginSettingsCard.tsx

@@ -64,6 +64,10 @@ export interface PluginSettingsCardProps<TKey extends string = string> {
    * edits, so the footer would sit there permanently disabled.
    */
   hideFooter?: boolean
+  /** Render children even when the settings namespace is not exposed by the host. */
+  renderChildrenWhenNotExposed?: boolean
+  /** Hide the 'not exposed' warning banner when the settings namespace is not exposed. */
+  hideNotExposedNotice?: boolean
   /** The plugin's controls. */
   children: ReactNode
 }
@@ -126,14 +130,15 @@ export function PluginSettingsCard<TKey extends string = string>(props: PluginSe
   // official settings allowlist omits third-party namespaces): show a card
   // that explains the gap instead of vanishing, so a missing card never
   // reads as a missing plugin.
-  if (!state.exposed) {
+  if (!state.exposed && props.renderChildrenWhenNotExposed !== true) {
+    const showNotice = props.hideNotExposedNotice !== true
     return (
       <li className={cardClass}>
         {header}
         {expanded
           ? (
             <div className={css.body}>
-              <p className={css.notExposed} role="status">{props.t('settings.notExposed')}</p>
+              {showNotice ? <p className={css.notExposed} role="status">{props.t('settings.notExposed')}</p> : null}
             </div>
           )
           : null}

package/src/client/TaskBoardSettingsCard.tsx

@@ -6,7 +6,7 @@
 
 import type { InjectFace, PropsLocale, PropsRuntime } from '@deepseek-ai/dsh-client-ui-slots'
 import type { SnapshotStore } from '@deepseek-ai/dsh-client-store'
-import type { SettingsScope } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { ConfigForm } from '@deepseek-ai/dsh-client-ui-settings/client'
 import { useEffect, useState } from 'react'
 import type { TaskBoardPowerSnapshot } from '../protocol.ts'
 import { PluginSettingsCard, BooleanField } from './PluginSettingsCard.tsx'
@@ -40,13 +40,13 @@ export interface TaskBoardSettingsCardFace extends CardActions {
   }
 }
 
-/** Bridges the `task-board` scope onto the card's staged form. */
+/** Bridges the `task-board` settings form onto the card's staged form. */
 export class TaskBoardSettingsCardController {
   private readonly form: CardForm<TaskBoardSettings>
   private readonly store: SnapshotStore<TaskBoardSettingsCardState>
 
-  /** @param scope - the bound settings scope for the `task-board` namespace. */
-  constructor(scope: SettingsScope<TaskBoardSettings>) {
+  /** @param scope - the bound configuration form for the `task-board` namespace. */
+  constructor(scope: ConfigForm<TaskBoardSettings>) {
     this.form = new CardForm(scope, [
       booleanField('enabled'),
       booleanField('announceToAgent'),
@@ -73,7 +73,7 @@ export class TaskBoardSettingsCardController {
   }
 
   /**
-   * Release the card's scope subscription and bound stores; the slot
+   * Release the card's form subscription and bound stores; the slot
    * disposer calls this on teardown.
    */
   dispose(): void {
@@ -126,6 +126,8 @@ export function TaskBoardSettingsCard(props: TaskBoardSettingsCardProps) {
       descriptionKey="settings.description"
       defaultOpen={false}
       state={state}
+      renderChildrenWhenNotExposed
+      hideNotExposedNotice
       onSave={props.save}
       onDiscard={props.discard}
     >

package/src/client/board.module.css

@@ -50,20 +50,27 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
 
 /* --- sidebar entry row ------------------------------------------------------- */
 
+/* Same geometry as the shell's own panel rows (SidebarRoot .panelRow): 2px
+   inset with a 12px radius, 8px content padding, 36px row, 14/22 type, and the
+   primary ink — so an injected row and an official row line up column for
+   column instead of each carrying its own box. */
 .entry {
   box-sizing: border-box;
   display: flex;
   align-items: center;
   gap: 8px;
-  width: 100%;
-  height: 36px;
-  padding: 0 10px;
+  min-height: 36px;
+  padding: 7px 8px;
+  margin: 0 2px;
   background: transparent;
   border: none;
-  border-radius: 8px;
-  color: var(--dsw-alias-label-secondary);
+  border-radius: 12px;
+  color: var(--dsw-alias-label-primary);
   cursor: pointer;
-  font-size: 13px;
+  font: inherit;
+  font-size: 14px;
+  line-height: 22px;
+  text-align: left;
   white-space: nowrap;
 }
 
@@ -78,19 +85,21 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
   font-weight: 600;
 }
 
+/* Icon box matches the shell's panel glyph exactly (16px), so the glyph column
+   and the label column land on the official rows' x positions. */
 .entryIcon {
   display: inline-flex;
   align-items: center;
   justify-content: center;
-  width: 24px;
-  height: 24px;
+  width: 16px;
+  height: 16px;
   flex: none;
 }
 
 .entryIcon svg {
   display: block;
-  width: 18px;
-  height: 18px;
+  width: 16px;
+  height: 16px;
 }
 
 .entryLabel {
@@ -98,7 +107,9 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
   text-overflow: ellipsis;
 }
 
-/* Collapsed rail: icon-only, centered, matching the shell's 56px rail. */
+/* Collapsed rail: icon-only, centered, matching the shell's 56px rail. The
+   shell asks its own panel rows for an 18px glyph on the rail, so the icon box
+   and the svg step up together with the 12px rail radius. */
 :global([data-dsh-frame][data-sidebar-collapsed]) .entry,
 :global([data-sidebar-collapsed]) .entry {
   justify-content: center;
@@ -106,7 +117,15 @@ html[data-dsh-taskboard-active]:not([data-dsh-ssh-active]) [class*='centerCol']
   width: 36px;
   height: 36px;
   margin: 0 auto 12px;
-  border-radius: 50%;
+  border-radius: 12px;
+}
+
+:global([data-dsh-frame][data-sidebar-collapsed]) .entryIcon,
+:global([data-sidebar-collapsed]) .entryIcon,
+:global([data-dsh-frame][data-sidebar-collapsed]) .entryIcon svg,
+:global([data-sidebar-collapsed]) .entryIcon svg {
+  width: 18px;
+  height: 18px;
 }
 
 :global([data-dsh-frame][data-sidebar-collapsed]) .entryLabel,

package/src/client/index.ts

@@ -12,16 +12,20 @@ import type { Context as ClientContext } from '@deepseek-ai/cordis'
 import type { ClientRemote, SessionId } from '@deepseek-ai/dsh-api-remotes/client'
 import type { ISessions } from '@deepseek-ai/dsh-api-session-controller/client'
 import type { IWorkspaces } from '@deepseek-ai/dsh-api-workspace-controller/client'
-import type { SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { ConfigForm, ConfigForms } from '@deepseek-ai/dsh-client-ui-settings/client'
 import type {} from '@deepseek-ai/dsh-api-remotes/client'
 import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type {} from '@deepseek-ai/dsh-client-ui-slots'
 // Type-only: pulls the locale plugin's Context merge (ctx.locale) and its
 // LocaleNamespaceMap merge table.
 import type {} from '@deepseek-ai/dsh-client-locale/client'
-// Type-only: pulls the settings-surface Context merge (ctx.settingsScope).
+// Type-only: pulls the shared-forms Context merge (ctx.configForms).
 import type {} from '@deepseek-ai/dsh-client-ui-settings/client'
+// Type-only: pulls the workspace plugin's Context merge (ctx.uiWorkspace), the
+// multi-instance navigation face that replaced ISessions.open().
+import type {} from '@deepseek-ai/dsh-client-ui-workspace/client'
 import { BoardController } from '../core/controller.ts'
+import { mainViewSessionId } from './main-session.ts'
 import { LocalStorageTaskStore } from '../core/store.ts'
 import { claimTaskboardApply, releaseTaskboardApply } from './apply-guard.ts'
 import { mountBoard } from './board-mount.tsx'
@@ -35,9 +39,48 @@ import { installPluginCard } from './plugin-card-seat.ts'
 /** Locale namespace this plugin owns. */
 const NS = 'task-board'
 
-/** Settings namespace the settings card edits (the Host plugin registers it). */
+/** Settings namespace this card edits (the family identity of the plugin's own settings form). */
 const TASK_BOARD_NS = 'task-board'
 
+/**
+ * Profile entry id the family aggregate's generated row carries — the
+ * deployment shape nearly every user runs. Under 0.1.7 a settings form is
+ * addressed by profile entry id, so the shared-forms fallback below has to
+ * name it; the family binder resolves the family namespace instead.
+ */
+const AGGREGATE_ENTRY_ID = 'web-ui-task-board'
+
+/**
+ * Profile entry ids this package's two patch rows carry: the aggregate's
+ * generated row and the standalone bundle patch's row (`ui-task-board`), plus
+ * the bare namespace as the last resort for a Host whose descriptor is keyed
+ * by the family namespace itself.
+ */
+const TASK_BOARD_ENTRY_IDS: readonly string[] = [AGGREGATE_ENTRY_ID, 'ui-task-board', TASK_BOARD_NS]
+
+/** Domain-owned description of one settings namespace a family card binds. */
+export interface SettingsFormSpec<T> {
+  /** Settings namespace the card edits. */
+  namespace: string
+  /**
+   * Narrow one wire section; undefined keeps the last accepted value. The
+   * shared form already resolves the namespace's own serialized wire schema,
+   * so a decoder exists only to narrow beyond that schema.
+   */
+  decode?: (section: unknown) => T | undefined
+}
+
+/**
+ * The family settings binder published by dsh-web-settings. Its `bind` resolves
+ * a family namespace to the profile entry id that owns it and hands back the
+ * shared configuration form, so it is the only seat that can reach this card's
+ * form on a Host whose row id is not the namespace.
+ */
+export interface SettingsFormBinder {
+  /** Bind one family settings namespace. */
+  bind<T>(spec: SettingsFormSpec<T>): ConfigForm<T>
+}
+
 declare module '@deepseek-ai/dsh-client-ui-slots' {
   interface LocaleNamespaceMap {
     /** Task-board surface copy. */
@@ -47,9 +90,9 @@ declare module '@deepseek-ai/dsh-client-ui-slots' {
   interface SlotMap {
     /**
      * The child slot the Web UI plugin group declares; this card registers
-     * into the group instead of the top-level `settings.plugin.item` list.
-     * Spelled here with the same shape so this package can register without
-     * depending on the sibling UI package.
+     * into the group's list seat rather than the official
+     * bundle-configuration seat. Spelled here with the same shape so this
+     * package can register without depending on the sibling UI package.
      */
     'web-ui.plugin.item': { kind: 'list'; scope: 'root'; owner: SettingsPluginItemOwnerProps }
   }
@@ -64,11 +107,11 @@ export interface SettingsPluginItemOwnerProps {
 declare module '@deepseek-ai/cordis' {
   interface Context {
     /**
-     * Optional rc.6 compatibility binder provided by dsh-web-settings;
-     * absent when that group plugin is not installed, so callers fall back to
-     * the official settings scope.
+     * Optional family settings binder provided by dsh-web-settings; absent
+     * when that group plugin is not installed, so callers fall back to the
+     * shared configuration forms service.
      */
-    webUiSettings?: { bind<S>(spec: SettingsScopeSpec<S>): SettingsScope<S> }
+    webUiSettings?: SettingsFormBinder
   }
 }
 
@@ -81,7 +124,7 @@ declare module '@deepseek-ai/cordis' {
  * on hosts below that cohort, which serve the same roster through the
  * connection RPC face.
  */
-export const inject = ['slots', 'sessions', 'workspaces', 'connection', 'settingsScope', 'locale', 'remote', 'remote.session']
+export const inject = ['slots', 'sessions', 'workspaces', 'connection', 'configForms', 'locale', 'remote', 'remote.session', 'uiWorkspace']
 
 /** One agent-preset row the mode picker consumes (either face's wire shape). */
 interface PresetRosterRow {
@@ -166,12 +209,11 @@ export function apply(ctx: ClientContext): void {
 
   // Plugin configuration card: one staged form over the `task-board` settings
   // namespace, contributed to whichever plugin-card seat this host declares
-  // (issue #1589).
-  const binder = ctx.get('webUiSettings') ?? ctx.settingsScope
-  const settingsScope = binder.bind<TaskBoardSettings>({ namespace: TASK_BOARD_NS })
-  const settingsCard = new TaskBoardSettingsCardController(settingsScope)
+  // (the family group's list seat, or the official bundle-configuration seat).
+  const settingsForm = bindSettingsForm(ctx)
+  const settingsCard = new TaskBoardSettingsCardController(settingsForm)
   installPluginCard(ctx, {
-    namespace: TASK_BOARD_NS,
+    bundle: '@linxin666/dsh-client-ui-task-board',
     id: 'task-board',
     order: 110,
     locale: NS,
@@ -180,9 +222,9 @@ export function apply(ctx: ClientContext): void {
   })
   ctx.effect(() => () => { settingsCard.dispose() }, 'task-board: settings card')
 
-  // The sidebar entry and board view mount once the settings scope settles;
-  // while the scope is still loading, the composition default is unknown, so
-  // nothing mounts yet. Only an unavailable scope (no settings surface served)
+  // The sidebar entry and board view mount once the settings form settles;
+  // while the form is still loading, the composition default is unknown, so
+  // nothing mounts yet. Only an unavailable form (no settings surface served)
   // falls back to the composition default (enabled).
   let uiDisposer: (() => void) | undefined
   const mountUi = (): void => {
@@ -200,8 +242,12 @@ export function apply(ctx: ClientContext): void {
       store,
       transport: new HttpTaskBoardHostTransport(),
       sessions: {
-        list: sessions.list,
-        open: id => sessions.open(id as never),
+        // The main-view Session comes from the catalog's per-source ownership
+        // counts; navigation belongs to the workspace UI since the
+        // multi-instance Client Session model.
+        current: () => mainViewSessionId(sessions.list.getSnapshot().byId),
+        open: id => ctx.uiWorkspace.openSession(id as never),
+        subscribe: fn => sessions.list.subscribe(fn),
       },
     })
     controller.start()
@@ -331,13 +377,56 @@ export function apply(ctx: ClientContext): void {
     }
   }
   const syncEnabled = (): void => {
-    const snapshot = settingsScope.getSnapshot()
+    const snapshot = settingsForm.getSnapshot()
     const enabled = snapshot.status === 'ready'
       ? snapshot.value?.enabled ?? true
       : snapshot.status === 'unavailable'
     if (enabled) mountUi()
     else uiDisposer?.()
   }
-  settingsScope.subscribe(syncEnabled)
+  settingsForm.subscribe(syncEnabled)
   syncEnabled()
 }
+
+/**
+ * Bind the settings form this card stages over.
+ *
+ * The family binder (`ctx.get('webUiSettings')`, published by dsh-web-settings)
+ * comes first: it is what traces this package's family namespace onto the
+ * profile entry id the Host serves the form under, and it keeps the loopback
+ * bridge as its own fallback. A page without that group falls back to the
+ * shared configuration forms service bound directly at one of this package's
+ * own profile entry ids.
+ * @param ctx - client root context.
+ * @returns the form the settings card reads and writes.
+ */
+export function bindSettingsForm(ctx: ClientContext): ConfigForm<TaskBoardSettings> {
+  const binder = ctx.get('webUiSettings')
+  if (binder !== undefined && typeof binder.bind === 'function') {
+    return binder.bind<TaskBoardSettings>({ namespace: TASK_BOARD_NS })
+  }
+  return ctx.configForms.get<TaskBoardSettings>(servedEntryId(ctx.configForms))
+}
+
+/**
+ * The profile entry id this package's own row carries.
+ *
+ * The shared describe mirror is the only local evidence of which row id this
+ * profile actually serves, but it answers asynchronously: at plugin
+ * activation it usually holds nothing yet. An unanswered mirror therefore
+ * binds the aggregate row id rather than guessing among the candidates —
+ * the form is bound once for the session, so a wrong guess would leave the
+ * card reporting an unserved namespace even after the mirror settles.
+ * @param forms - the shared configuration forms service.
+ * @returns the entry id to bind.
+ */
+function servedEntryId(forms: ConfigForms): string {
+  let served: readonly string[] | undefined
+  try {
+    served = forms.describe().getSnapshot().view?.namespaces.map(view => view.ns)
+  } catch {
+    served = undefined
+  }
+  if (served === undefined) return AGGREGATE_ENTRY_ID
+  return TASK_BOARD_ENTRY_IDS.find(id => served.includes(id)) ?? TASK_BOARD_NS
+}

package/src/client/main-session.ts

@@ -0,0 +1,43 @@
+// Generated by scripts/sync-shared.mjs from shared/client/main-session.ts. Do not edit this copy; edit the shared source and run "node scripts/sync-shared.mjs".
+/**
+ * Main-view Session derivation for the multi-instance Client Session model.
+ *
+ * The Client Session Controller carries no global "current" selection: view
+ * selection belongs to the workspace UI, which owns the main-area reference and
+ * publishes it through the catalog's per-source ownership counts
+ * (`SessionSummary.retainedBy.mainView`). A plugin that needs the Session the
+ * main view shows derives it from that marker instead of the removed
+ * `SessionListState.current` field.
+ *
+ * The marker describes view ownership, not authority. It is the right input for
+ * presentation and for deciding which view a navigation targets; it is not a
+ * business fallback, because source counts never imply visibility or success.
+ * @module dsh-web/shared/main-session
+ */
+
+/** The catalog row subset this helper reads (a `SessionSummary` projection). */
+export interface MainViewOwnedRow<Id extends string = string> {
+  /** Catalog row identity. */
+  readonly id: Id
+  /** Per-source local ownership counts; absent rows are never owned. */
+  readonly retainedBy?: Readonly<Partial<Record<string, number>>> | undefined
+}
+
+/**
+ * Resolve the Session the main view currently shows.
+ *
+ * Reads the catalog's rows rather than a per-id retain-info source: ownership
+ * counts ride the list snapshot, so this neither allocates observers nor opens
+ * history, and a subscription to the list still fires when the selection moves.
+ * @param byId - the session catalog's rows (`SessionListState.byId`), when available.
+ * @returns the main-view session id, or undefined when the main view shows none.
+ */
+export function mainViewSessionId<Id extends string>(
+  byId: Readonly<Record<Id, MainViewOwnedRow<Id> | undefined>> | undefined | null,
+): Id | undefined {
+  if (byId === undefined || byId === null) return undefined
+  for (const row of Object.values<MainViewOwnedRow<Id> | undefined>(byId)) {
+    if (row !== undefined && (row.retainedBy?.mainView ?? 0) > 0) return row.id
+  }
+  return undefined
+}

package/src/client/plugin-card-seat.ts

@@ -7,22 +7,24 @@
  *
  * - `web-ui.plugin.item` — the list seat declared by the dsh-web-settings
  *   group section (this family's own first-level "Web UI plugins" section);
- * - `settings.plugin.item` — the official keyed seat of the harness's
- *   `ui-settings-plugins` tab, keyed by the settings namespace the card edits.
+ * - `plugins.bundle.config` — the official keyed seat of the harness's plugin
+ *   manager page, keyed by the bundle's package name and rendered on that
+ *   bundle's page. alpha.2 removed the `settings.plugin.item` keyed seat of the
+ *   `ui-settings-plugins` tab that this helper used before, so a card keyed by
+ *   its settings namespace has no seat to land in any more.
  *
- * SEAT SELECTION IS NOT A DECLARATION PROBE. The official `ui-settings-plugins`
- * row belongs to the harness bundle and its `configurable` tab always declares
- * `settings.plugin.item` before any external plugin's `apply()` runs, so
- * "is the official seat declared?" answers yes even in the deployment whose
- * whole point is the family group. Choosing on that probe sends every family
- * card to the official Plugins tab and leaves the group's own section
- * permanently empty — the family of reports where the section renders its
- * heading and zero cards.
+ * SEAT SELECTION IS NOT A DECLARATION PROBE. The official plugin surface
+ * belongs to the harness bundle and declares its seats before any external
+ * plugin's `apply()` runs, so "is the official seat declared?" answers yes even
+ * in the deployment whose whole point is the family group. Choosing on that
+ * probe sends every family card to the official page and leaves the group's own
+ * section permanently empty — the family of reports where the section renders
+ * its heading and zero cards.
  *
  * The signal that actually distinguishes the two deployments is whether
  * dsh-web-settings is loaded: it is the package that owns the group section and
  * it publishes the `webUiSettings` service during `apply()`, which every
- * family plugin already reads for its settings scope. Group loaded -> the family
+ * family plugin already reads for its settings form. Group loaded -> the family
  * seat; group absent -> the official seat.
  *
  * The decision is re-evaluated on every `slots/changed` because the group may
@@ -40,8 +42,8 @@
 /** The family list seat key. */
 export const FAMILY_PLUGIN_CARD_SEAT = 'web-ui.plugin.item'
 
-/** The official keyed plugin-card seat key. */
-export const OFFICIAL_PLUGIN_CARD_SEAT = 'settings.plugin.item'
+/** The official keyed plugin-card seat key (the alpha.2 bundle-configuration seat). */
+export const OFFICIAL_PLUGIN_CARD_SEAT = 'plugins.bundle.config'
 
 /** The service dsh-web-settings publishes while it is loaded. */
 export const FAMILY_GROUP_SERVICE = 'webUiSettings'
@@ -61,7 +63,7 @@ export interface PluginCardContext {
   on?(event: string, listener: (...args: never[]) => void): unknown
 }
 
-/** Owner share of a plugin card (both seats supply nothing). */
+/** Owner share of a family list-seat card (that seat supplies nothing). */
 export interface SettingsPluginItemOwnerProps {
   /** Marker field: card owner props are intentionally empty. */
   children?: never
@@ -69,8 +71,13 @@ export interface SettingsPluginItemOwnerProps {
 
 /** One family plugin's card contribution. */
 export interface PluginCardSeat {
-  /** Settings namespace the card edits (the official seat's dispatch key). */
-  namespace: string
+  /**
+   * Npm package name of the bundle this card configures; the official keyed
+   * seat dispatches on it. Every family package ships its own bundle patch, so
+   * a standalone install lists that package as the bundle whose page renders
+   * this card.
+   */
+  bundle: string
   /** Family list-seat entry id. */
   id: string
   /** Family list-seat sort order. */
@@ -159,7 +166,7 @@ export function installPluginCard(ctx: PluginCardContext, seat: PluginCardSeat):
         }
         : {
           name: OFFICIAL_PLUGIN_CARD_SEAT,
-          key: seat.namespace,
+          key: seat.bundle,
           locale: seat.locale,
           ...(seat.inject === undefined ? {} : { inject }),
         }) as never, component) as () => void

package/src/client/settings-form.ts

@@ -8,7 +8,7 @@
  * card-store pattern.
  */
 
-import type { SettingsScope, SettingsScopeSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { ConfigForm, ConfigFormSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
 import type { SnapshotStore } from '@deepseek-ai/dsh-client-store'
 import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 
@@ -114,7 +114,7 @@ interface PlannedWrite {
   judge: (() => boolean) | undefined
 }
 
-/** One durable write inside the save's atomic scope mutation. */
+/** One durable write inside the save's atomic form mutation. */
 export interface BatchedWrite {
   /** Field this entry writes. */
   field: string
@@ -211,34 +211,34 @@ export class CardForm<T> {
   private readonly specs: Map<string, FieldSpec>
   private readonly staged = new Map<string, StagedEdit>()
   private readonly listeners = new Set<() => void>()
-  /** The scope subscription installed in the constructor; released by dispose(). */
-  private readonly disposeScope: () => void
+  /** The form subscription installed in the constructor; released by dispose(). */
+  private readonly disposeForm: () => void
   private disposed = false
   private saving = false
   private failed = false
   private failedReason: string | undefined
 
-  /** @param scope - the bound settings scope for this card's namespace. */
+  /** @param scope - the bound configuration form for this card's namespace. */
   constructor(
-    private readonly scope: SettingsScope<T>,
+    private readonly scope: ConfigForm<T>,
     specs: FieldSpec[],
   ) {
     this.specs = new Map(specs.map(spec => [spec.field, spec]))
-    this.disposeScope = scope.subscribe(() => { this.publish() })
+    this.disposeForm = scope.subscribe(() => { this.publish() })
   }
 
   /**
-   * Release the scope subscription and every bound store listener. The card
+   * Release the form subscription and every bound store listener. The card
    * must call this on teardown; later calls are no-ops.
    */
   dispose(): void {
     if (this.disposed) return
     this.disposed = true
-    this.disposeScope()
+    this.disposeForm()
     this.listeners.clear()
   }
 
-  /** Publish a projection of this form, rebuilt whenever the scope or a draft changes. */
+  /** Publish a projection of this form, rebuilt whenever the form or a draft changes. */
   bind<S>(project: () => S): SnapshotStore<S> {
     const store = createSnapshotStore(project())
     this.listeners.add(() => { store.set(project()) })
@@ -295,19 +295,19 @@ export class CardForm<T> {
   }
 
   /**
-   * Write every staged edit in one atomic scope mutation, then re-seed from
+   * Write every staged edit in one atomic form mutation, then re-seed from
    * what the Host accepted.
    *
    * The whole batch rides one mutate, so cross-field validate hooks
    * (baseURL+model) judge it as a unit: the Host either applies every write
-   * or refuses the batch. The 0.1.2 scope contract never rejects a refused
-   * mutation — the scope recovers with a fresh Host view and resolves — so
-   * resolution alone proves nothing: the outcome is judged by reading the
-   * settled snapshot back, one planned write at a time, and one missed write
-   * fails the whole save. A scope that still rejects on refusal (the dsh-web
-   * bridge scope) reports through the same failure path with its rejection
-   * message. A save that did not land keeps its drafts, so the user can
-   * correct them instead of retyping.
+   * or refuses the batch. The form contract answers a refusal or a skipped
+   * write with `false` (it recovers with a fresh Host view instead of
+   * throwing), so the outcome is judged twice: the answer itself, and then the
+   * settled snapshot read back one planned write at a time. One missed write
+   * fails the whole save. A transport that rejects instead (the dsh-web bridge
+   * controller on a dead connection) reports through the same failure path
+   * with its rejection message. A save that did not land keeps its drafts, so
+   * the user can correct them instead of retyping.
    * @returns settlement after the mutation and the read-back.
    */
   async save(): Promise<void> {
@@ -323,30 +323,33 @@ export class CardForm<T> {
     this.failed = false
     this.failedReason = undefined
     this.publish()
-    // One atomic namespace mutation: the 0.1.2 scope contract takes ordered
-    // path operations, so the whole staged batch is validated, persisted, and
+    // One atomic namespace mutation: the form contract takes ordered path
+    // operations, so the whole staged batch is validated, persisted, and
     // recovered together — either every write lands or none does.
     const ops: Array<{ op: 'set'; path: string[]; value: string | number | boolean } | { op: 'unset'; path: string[] }> = valid.map(item => item.op.op === 'set'
       ? { op: 'set', path: [item.field], value: (item.op as { value: string | number | boolean }).value }
       : { op: 'unset', path: [item.field] })
     let failedReason: string | undefined
+    let accepted = false
     try {
-      await this.scope.mutate(ops)
+      accepted = await this.scope.mutate(ops)
     } catch (error) {
       failedReason = error instanceof Error ? error.message : String(error)
     }
-    // The 0.1.2 scope resolves even a refused mutation (it recovers with a
-    // fresh view instead of throwing), so resolution alone proves nothing:
-    // judge every planned write against the settled snapshot. The mutation is
-    // atomic, so one missed write fails the whole save and keeps the drafts.
-    const landed = failedReason === undefined && valid.every(item => item.judge())
+    // `false` is the contract's refusal/skip answer, and the form still
+    // resolves after a refusal (it recovers with a fresh view), so the answer
+    // alone is not enough: judge every planned write against the settled
+    // snapshot as well. The mutation is atomic, so one missed write fails the
+    // whole save and keeps the drafts.
+    const landed = accepted && failedReason === undefined && valid.every(item => item.judge())
     for (const [field, before] of pending) {
       if (landed && this.staged.get(field) === before) this.staged.delete(field)
     }
     this.saving = false
     this.failed = !landed
-    // A read-back failure carries no server reason: the card surfaces its
-    // generic failure copy; a rejecting scope (the bridge) adds its message.
+    // A refused or unlanded batch carries no server reason: the card surfaces
+    // its generic failure copy; a rejecting transport (the bridge) adds its
+    // message.
     this.failedReason = failedReason
     this.publish()
   }
@@ -381,7 +384,7 @@ export class CardForm<T> {
    */
   private landedSet(field: string, value: unknown): boolean {
     // A redacted secret never appears in any wire view layer: the Host strips
-    // role('secret') fields and reports them through a sidecar the scope
+    // role('secret') fields and reports them through a sidecar the form
     // snapshot does not expose, so there is nothing to compare the draft
     // against. Settling is the only signal the form has; the rest of the
     // batch, when one exists, still carries the atomic verdict by read-back.
@@ -412,7 +415,7 @@ export class CardForm<T> {
     return spec
   }
 
-  private snapshotOf(): SettingsScopeSnapshot<T> {
+  private snapshotOf(): ConfigFormSnapshot<T> {
     return this.scope.getSnapshot()
   }