@linxin666/dsh-client-ui-task-board 0.3.5 → 0.3.9

package/src/client/board/TaskForm.tsx

@@ -0,0 +1,111 @@
+/**
+ * Shared task-modal pieces: the overlay shell (backdrop, form, title, error,
+ * footer) and the title/description/prompt field trio used by both the
+ * NewTaskModal and the EditTaskModal. State stays in the owning modal; these
+ * are controlled components.
+ */
+import type { ReactNode } from 'react'
+import { t } from '../locales.ts'
+import css from '../board.module.css'
+
+/** Modal overlay: closes on backdrop press, submits through the form. */
+export function ModalShell({
+  ariaLabel,
+  title,
+  error,
+  pending,
+  submitLabel,
+  onSubmit,
+  onClose,
+  children,
+}: {
+  ariaLabel: string
+  title: string
+  error: string | undefined
+  pending: boolean
+  submitLabel: string
+  onSubmit: () => void
+  onClose: () => void
+  children: ReactNode
+}) {
+  return (
+    <div className={css.modalBackdrop} onMouseDown={event => { if (event.target === event.currentTarget) onClose() }}>
+      <form
+        className={css.modal}
+        role="dialog"
+        aria-label={ariaLabel}
+        onSubmit={event => { event.preventDefault(); onSubmit() }}
+      >
+        <h2 className={css.modalTitle}>{title}</h2>
+
+        {children}
+
+        {error !== undefined && <p className={css.formError}>{error}</p>}
+
+        <footer className={css.modalFooter}>
+          <button type="button" className={css.ghostButton} onClick={onClose}>
+            {t('new.cancel')}
+          </button>
+          <button type="submit" className={css.primaryButton} disabled={pending}>
+            {submitLabel}
+          </button>
+        </footer>
+      </form>
+    </div>
+  )
+}
+
+/** Title + description + prompt fields shared by the new and edit task forms. */
+export function TaskContentFields({
+  title,
+  description,
+  prompt,
+  onTitleChange,
+  onDescriptionChange,
+  onPromptChange,
+}: {
+  title: string
+  description: string
+  prompt: string
+  /** Receives the new title; the owner also clears its error state. */
+  onTitleChange: (value: string) => void
+  onDescriptionChange: (value: string) => void
+  onPromptChange: (value: string) => void
+}) {
+  return (
+    <>
+      <label className={css.field}>
+        <span className={css.fieldLabel}>{t('new.title')}</span>
+        <input
+          className={css.input}
+          value={title}
+          autoFocus
+          placeholder={t('new.titlePlaceholder')}
+          onChange={event => onTitleChange(event.target.value)}
+        />
+      </label>
+
+      <label className={css.field}>
+        <span className={css.fieldLabel}>{t('new.description')}</span>
+        <textarea
+          className={css.input}
+          rows={3}
+          value={description}
+          placeholder={t('new.descriptionPlaceholder')}
+          onChange={event => onDescriptionChange(event.target.value)}
+        />
+      </label>
+
+      <label className={css.field}>
+        <span className={css.fieldLabel}>{t('new.prompt')}</span>
+        <textarea
+          className={css.input}
+          rows={4}
+          value={prompt}
+          placeholder={t('new.promptPlaceholder')}
+          onChange={event => onPromptChange(event.target.value)}
+        />
+      </label>
+    </>
+  )
+}

package/src/client/board-mount.tsx

@@ -44,7 +44,13 @@ export function mountBoard(controller: BoardController): () => void {
   let container: HTMLDivElement | undefined
 
   const ensure = (): void => {
-    if (container !== undefined) return
+    if (container !== undefined) {
+      if (container.isConnected) return
+      root?.unmount()
+      root = undefined
+      container.remove()
+      container = undefined
+    }
     const column = conversationColumn()
     if (column === undefined) return
     container = document.createElement('div')

package/src/client/host-api.ts

@@ -25,7 +25,7 @@ async function readJson<T>(response: Response): Promise<T> {
 export interface TaskBoardHostTransport {
   bootstrap(legacy: readonly TaskRecord[]): Promise<TaskBoardSnapshot>
   state(): Promise<TaskBoardSnapshot>
-  action(action: TaskBoardAction): Promise<TaskBoardSnapshot>
+  action(action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot>
   subscribe(listener: (event?: TaskBoardEventPayload) => void): () => void
 }
 
@@ -57,12 +57,12 @@ export class HttpTaskBoardHostTransport implements TaskBoardHostTransport {
     return await this.request(`${TASK_BOARD_API_PREFIX}/state`, { cache: 'no-store' })
   }
 
-  async action(action: TaskBoardAction): Promise<TaskBoardSnapshot> {
-    return await this.post(uuid(), action)
+  async action(action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot> {
+    return await this.post(uuid(), action, initiator)
   }
 
-  private async post(requestId: string, action: TaskBoardAction): Promise<TaskBoardSnapshot> {
-    const envelope: TaskBoardActionEnvelope = { requestId, action }
+  private async post(requestId: string, action: TaskBoardAction, initiator?: string): Promise<TaskBoardSnapshot> {
+    const envelope: TaskBoardActionEnvelope = { requestId, action, ...(initiator === undefined || initiator === '' ? {} : { initiator }) }
     return await this.request(`${TASK_BOARD_API_PREFIX}/action`, {
       method: 'POST',
       headers: { 'content-type': 'application/json' },

package/src/client/index.ts

@@ -8,8 +8,13 @@
  * shell fails the whole boot when a plugin apply throws, and an external
  * plugin must not take the GUI down.
  */
-import type { ClientContext, ISessions, IWorkspaces, SessionId, SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-runtime/client'
-import type { ConnectionHandle } from '@deepseek-ai/dsh-client-connection/client'
+import type { Context as ClientContext } from '@deepseek-ai/cordis'
+import type { ClientRemote, SessionId } from '@deepseek-ai/dsh-api-remotes/client'
+import type { ISessions } from '@deepseek-ai/dsh-api-session-controller/client'
+import type { IWorkspaces } from '@deepseek-ai/dsh-api-workspace-controller/client'
+import type { SettingsScope, SettingsScopeSpec } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type {} from '@deepseek-ai/dsh-api-remotes/client'
+import type {} from '@deepseek-ai/dsh-client-ui-renderer/client'
 import type {} from '@deepseek-ai/dsh-client-ui-slots'
 // Type-only: pulls the locale plugin's Context merge (ctx.locale) and its
 // LocaleNamespaceMap merge table.
@@ -67,9 +72,64 @@ declare module '@deepseek-ai/cordis' {
 }
 
 
-/** Required services (fiber inject waiting — the runtime must be up first). */
+/**
+ * Required services (fiber inject waiting — the runtime must be up first).
+ * The generated remote faces are probed at use time instead of injected:
+ * `remote.agentPresets` only registers on 0.1.2-alpha.2 hosts (the
+ * api-remotes contribution), so a hard wait would pend the entry forever
+ * on hosts below that cohort, which serve the same roster through the
+ * connection RPC face.
+ */
 export const inject = ['slots', 'sessions', 'workspaces', 'connection', 'settingsScope', 'locale', 'remote']
 
+/** One agent-preset row the mode picker consumes (either face's wire shape). */
+interface PresetRosterRow {
+  id: string
+  name?: string
+  description?: string
+  /** Why this preset cannot compose a session; absent when it can. */
+  broken?: string
+  isDefault: boolean
+}
+
+/**
+ * Read the agent-preset roster through whichever face the running host
+ * serves: the generated api-remotes face (`remote.agentPresets`,
+ * 0.1.2-alpha.2) or the connection RPC face
+ * (`connection.api.agentPresets`, hosts below that cohort). Answers
+ * undefined when the host serves neither, so the caller leaves the picker
+ * options untouched instead of erroring.
+ */
+async function readPresetRoster(
+  ctx: ClientContext,
+  remote: ClientRemote,
+): Promise<{ ok: boolean; presets: readonly PresetRosterRow[] } | undefined> {
+  // The cordis `remote` proxy throws on a property that was never injected
+  // ("cannot get property X without inject") rather than returning undefined,
+  // so the probe must guard the access — a hard read would abort mounting on
+  // hosts below the 0.1.2-alpha.2 cohort instead of degrading to the legacy
+  // connection RPC face below.
+  let remotes: ClientRemote['agentPresets'] | undefined
+  try {
+    remotes = (remote as Partial<ClientRemote>).agentPresets
+  } catch {
+    remotes = undefined
+  }
+  if (remotes !== undefined) {
+    const response = await remotes.list()
+    if (!response.ok) return { ok: false, presets: [] }
+    return { ok: true, presets: response.value.presets }
+  }
+  const connection = ctx.get('connection') as unknown as {
+    api?: { agentPresets?: { list(request: Record<string, never>): Promise<{ result: { ok: boolean; value?: { presets?: readonly PresetRosterRow[] } } }> } }
+  }
+  const legacy = connection.api?.agentPresets
+  if (legacy === undefined) return undefined
+  const response = await legacy.list({})
+  if (!response.result.ok || response.result.value === undefined) return { ok: false, presets: [] }
+  return { ok: true, presets: response.result.value.presets ?? [] }
+}
+
 /**
  * Mount the task board.
  * @param ctx - client root context (services: sessions, workspaces).
@@ -132,7 +192,7 @@ export function apply(ctx: ClientContext): void {
     // narrow these two client services during a combined package build.
     const sessions = ctx.get('sessions') as unknown as ISessions
     const workspaces = ctx.get('workspaces') as unknown as IWorkspaces
-    const connection = ctx.get('connection') as ConnectionHandle
+    const remote = ctx.get('remote') as unknown as ClientRemote
 
     // Core wiring: real runtime faces into the framework-free services.
     const store = new LocalStorageTaskStore()
@@ -166,10 +226,10 @@ export function apply(ctx: ClientContext): void {
     disposers.push(workspaces.list.subscribe(pushWorkspaceOptions))
     const pushPresetOptions = async (): Promise<void> => {
       try {
-        const response = await connection.api.agentPresets.list({})
-        if (!response.result.ok) return
+        const roster = await readPresetRoster(ctx, remote)
+        if (roster === undefined || !roster.ok) return
         controller.setExecutionOptions({
-          presets: response.result.value.presets.map(preset => ({
+          presets: roster.presets.map(preset => ({
             id: preset.id,
             name: preset.name,
             description: preset.description,

package/src/client/locales.ts

@@ -40,6 +40,24 @@ export const zh = {
   'new.submit': '创建',
   'new.cancel': '取消',
   'new.required': '标题不能为空',
+  'new.freeze': '冻结快照（可选）',
+  'new.freezePlaceholder': '粘贴会话输出的 <<<FREEZE … >>>FREEZE 冻结块，解析为目标/进度/下一步（可选）',
+  'detail.freeze': '冻结快照',
+  'detail.freeze.goal': '目标',
+  'detail.freeze.progress': '进度',
+  'detail.freeze.next': '下一步',
+  'detail.freeze.frozenAt': '冻结于 {time}',
+  'detail.freeze.frozenBy': '来源会话 {session}',
+  'detail.freeze.redacted': '冻结文本命中敏感模式，已自动替换为 [REDACTED]；接手前请人工复核。',
+  'card.frozen': '冻结',
+  'new.handover': '交接包引用（可选）',
+  'new.handoverPlaceholder': '每行一个文档/脚本引用；填写后，上面选择的钉住三元组（工作区/模式/权限）会作为交接包附加到卡片',
+  'detail.handover': '交接包',
+  'detail.handover.bundledAt': '打包于 {time}',
+  'detail.handover.references': '引用',
+  'detail.permissionPending': '权限待确认：本卡有效权限（{permission}）高于会话默认，手动执行与定时调度都会被拒绝，需人工确认后才能运行。',
+  'detail.permissionConfirm': '确认权限绑定',
+  'detail.permissionConfirmed': '已确认权限绑定 · {time}',
   'detail.title': '任务详情',
   'detail.edit': '编辑',
   'detail.close': '关闭',
@@ -58,6 +76,7 @@ export const zh = {
   'detail.viewSession': '查看会话',
   'detail.noSession': '暂无会话',
   'detail.executionStarted': '已启动',
+  'detail.execution.initiator': '发起会话 {session}',
   'detail.executionEnded': '已结束',
   'detail.result.succeeded': '成功',
   'detail.result.failed': '失败',
@@ -119,7 +138,7 @@ export const zh = {
   'settings.off': '关',
   'settings.overridden': '已覆盖',
   'settings.reset': '恢复默认',
-  'settings.notExposed': '当前 DSH 版本未向设置页暴露本插件的配置命名空间，表单不可用。可编辑 ~/.dsh/settings.yaml 直接配置，或为 dsh-host-apiproxy 的 WEB_SETTINGS_NAMESPACES 白名单补充本命名空间后重启。',
+  'settings.notExposed': '当前 DSH 版本未向设置页暴露本插件的配置命名空间，表单不可用。可编辑 ~/.dsh/settings.yaml 直接配置，或将本命名空间加入 Host 设置白名单后重启。',
   'settings.readOnly': '当前部署的设置只读。',
   'settings.expand': '展开设置',
   'settings.collapse': '收起设置',
@@ -166,6 +185,24 @@ export const en: Record<keyof typeof zh, string> = {
   'new.submit': 'Create',
   'new.cancel': 'Cancel',
   'new.required': 'Title is required',
+  'new.freeze': 'Frozen snapshot (optional)',
+  'new.freezePlaceholder': 'Paste a <<<FREEZE ... >>>FREEZE block from a session; it parses into goal/progress/next (optional)',
+  'detail.freeze': 'Frozen snapshot',
+  'detail.freeze.goal': 'Goal',
+  'detail.freeze.progress': 'Progress',
+  'detail.freeze.next': 'Next',
+  'detail.freeze.frozenAt': 'Frozen at {time}',
+  'detail.freeze.frozenBy': 'Source session {session}',
+  'detail.freeze.redacted': 'Sensitive patterns were detected in the frozen text and replaced with [REDACTED]; review manually before resuming.',
+  'card.frozen': 'frozen',
+  'new.handover': 'Handover references (optional)',
+  'new.handoverPlaceholder': 'One doc/script reference per line; when filled, the pinned triplet picked above (workspace/mode/permission) is attached to the card as a handover bundle',
+  'detail.handover': 'Handover bundle',
+  'detail.handover.bundledAt': 'Bundled at {time}',
+  'detail.handover.references': 'References',
+  'detail.permissionPending': 'Permission pending confirmation: this card\'s effective permission ({permission}) is above the session default; manual runs and cron are refused until a human confirms.',
+  'detail.permissionConfirm': 'Confirm permission binding',
+  'detail.permissionConfirmed': 'Permission confirmed · {time}',
   'detail.title': 'Task Detail',
   'detail.edit': 'Edit',
   'detail.close': 'Close',
@@ -184,6 +221,7 @@ export const en: Record<keyof typeof zh, string> = {
   'detail.viewSession': 'View Session',
   'detail.noSession': 'No session',
   'detail.executionStarted': 'Started',
+  'detail.execution.initiator': 'Initiated by session {session}',
   'detail.executionEnded': 'Ended',
   'detail.result.succeeded': 'Succeeded',
   'detail.result.failed': 'Failed',
@@ -245,7 +283,7 @@ export const en: Record<keyof typeof zh, string> = {
   'settings.off': 'Off',
   'settings.overridden': 'Overridden',
   'settings.reset': 'Reset to default',
-  'settings.notExposed': 'This DSH version does not expose this plugin\'s settings namespace to the configuration page, so the form is unavailable. Edit ~/.dsh/settings.yaml directly, or add the namespace to dsh-host-apiproxy\'s WEB_SETTINGS_NAMESPACES allowlist and restart.',
+  'settings.notExposed': 'This DSH version does not expose this plugin\'s settings namespace to the configuration page, so the form is unavailable. Edit ~/.dsh/settings.yaml directly, or add the namespace to the Host settings allowlist and restart.',
   'settings.readOnly': 'This deployment stores settings read-only.',
   'settings.expand': 'Show settings',
   'settings.collapse': 'Hide settings',

package/src/client/settings-form.ts

@@ -8,8 +8,9 @@
  * card-store pattern.
  */
 
-import type { SettingsScope, SettingsScopeSnapshot, SnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
-import { createSnapshotStore } from '@deepseek-ai/dsh-client-runtime/client'
+import type { SettingsScope, SettingsScopeSnapshot } from '@deepseek-ai/dsh-client-ui-settings/client'
+import type { SnapshotStore } from '@deepseek-ai/dsh-client-store'
+import { createSnapshotStore } from '@deepseek-ai/dsh-client-store'
 
 /** The write one field's staged text performs when the card is saved. */
 export type FieldWrite =
@@ -23,9 +24,11 @@ export interface FieldSpec {
   /**
    * Whether the Host treats this field as a secret and redacts its value from
    * the read-back (role('secret') in the section schema). Redacted secrets are
-   * never compared against the draft on save; the field lands when the scope
-   * reports the write succeeded (its secret-set marker under the bridge), so
-   * a successful secret save is not misreported as failed.
+   * never compared against the draft on save: the Host strips them from every
+   * wire view layer, so the settled snapshot carries nothing to read back. A
+   * staged secret set is judged by the mutation settling; the rest of its
+   * batch, when one exists, is still judged by read-back, and the atomic
+   * mutation lands every write or none.
    */
   secret?: boolean
   /** Render a stored value as draft text; the empty string when the section carries none. */
@@ -53,8 +56,8 @@ export interface CardShell {
   available: boolean
   /**
    * Whether the namespace is actually served to this client. False when the
-   * Host deployment does not expose it (e.g. the official apiproxy settings
-   * allowlist omits third-party namespaces): the card renders an explanation
+   * Host deployment does not expose it (e.g. the owning plugin's settings
+   * domain is not mounted): the card renders an explanation
    * instead of its form, so a missing namespace never looks like a missing
    * plugin.
    */
@@ -101,13 +104,17 @@ interface StagedEdit {
 interface PlannedWrite {
   /** Field this entry writes. */
   field: string
-  /** The durable write this entry performs, described for a batched scope. */
+  /** The durable write this entry performs, inside the save's one atomic mutation. */
   op: BatchedWrite
-  /** Perform the write and report whether the Host holds the staged value afterwards. */
-  run: (() => Promise<boolean>) | undefined
+  /**
+   * Read the settled snapshot back and report whether the Host holds this
+   * write's effect. Undefined when the draft is not a value the field
+   * accepts: there is nothing to write, and the entry blocks the save.
+   */
+  judge: (() => boolean) | undefined
 }
 
-/** One durable write a batched settings scope performs. */
+/** One durable write inside the save's atomic scope mutation. */
 export interface BatchedWrite {
   /** Field this entry writes. */
   field: string
@@ -117,36 +124,6 @@ export interface BatchedWrite {
   value?: unknown
 }
 
-/** Per-field outcome of one batched scope write. */
-export interface BatchedFieldResult {
-  /** Field this entry writes. */
-  field: string
-  /** Whether the Host accepted this field's write (per the read-back view). */
-  landed: boolean
-}
-
-/**
- * Result of a batched scope write. The bridge scope posts every planned write
- * in one /mutate so the Host validate hook judges baseURL+model together; a
- * batched refusal fails the whole save rather than per-field.
- */
-export interface BatchResult {
-  /** Whether the whole mutate was accepted. */
-  ok: boolean
-  /** Per-field success, in the request order (always present when ok). */
-  fields: BatchedFieldResult[]
-  /** Host rejection code (mutate refused). */
-  code?: string
-  /** Host rejection message (mutate refused). */
-  message?: string
-}
-
-/** The optional batch surface the bridge scope adds over the SettingsScope contract. */
-interface BatchedSettingsScope {
-  /** Write every operation in one scope mutation, reporting per-field success. */
-  mutate: (writes: BatchedWrite[]) => Promise<BatchResult>
-}
-
 /** Constraints a numeric field's accepted drafts must satisfy, mirroring the host schema. */
 export interface NumberConstraints {
   /** The accepted value must be a whole number. */
@@ -188,8 +165,8 @@ export function textField(field: string): FieldSpec {
 /**
  * A free-text field the Host treats as a secret and redacts from the read-back
  * (role('secret') in the section schema). The card still edits it like text,
- * but a save never compares the redacted value back and relies on the scope
- * reporting the write landed.
+ * but a save never compares the redacted value back: the staged set is judged
+ * by the mutation settling (see {@link FieldSpec.secret}).
  */
 export function secretField(field: string): FieldSpec {
   return { ...textField(field), secret: true }
@@ -277,7 +254,7 @@ export class CardForm<T> {
       exposed: snapshot.status === 'ready',
       writable: snapshot.writable,
       dirty: plan.length > 0,
-      invalid: plan.some(item => item.run === undefined),
+      invalid: plan.some(item => item.judge === undefined),
       saving: this.saving,
       failed: this.failed,
       ...this.failedReason === undefined ? {} : { failedReason: this.failedReason },
@@ -318,21 +295,25 @@ export class CardForm<T> {
   }
 
   /**
-   * Write every staged edit, then re-seed from what the Host accepted.
+   * Write every staged edit in one atomic scope mutation, then re-seed from
+   * what the Host accepted.
    *
-   * When the scope carries the optional batch surface (the dsh-web
-   * bridge scope), every planned write rides one mutation so cross-field
-   * validate hooks (baseURL+model) judge the batch as a unit instead of
-   * deadlocking on per-field writes. Otherwise the per-field loop runs.
-   * A field lands only when the Host reports it held the staged value; a
-   * landed field's draft is dropped, a failed one stays staged for the user.
-   * @returns settlement after every write and the read-back.
+   * The whole batch rides one mutate, so cross-field validate hooks
+   * (baseURL+model) judge it as a unit: the Host either applies every write
+   * or refuses the batch. The 0.1.2 scope contract never rejects a refused
+   * mutation — the scope recovers with a fresh Host view and resolves — so
+   * resolution alone proves nothing: the outcome is judged by reading the
+   * settled snapshot back, one planned write at a time, and one missed write
+   * fails the whole save. A scope that still rejects on refusal (the dsh-web
+   * bridge scope) reports through the same failure path with its rejection
+   * message. A save that did not land keeps its drafts, so the user can
+   * correct them instead of retyping.
+   * @returns settlement after the mutation and the read-back.
    */
   async save(): Promise<void> {
     const plan = this.plan()
-    const valid = plan.filter(item => item.run !== undefined)
+    const valid = plan.filter((item): item is PlannedWrite & { judge: () => boolean } => item.judge !== undefined)
     if (plan.length === 0 || this.saving || valid.length !== plan.length) return
-    const plannedWrites = valid.map(item => item.op)
     // Snapshot the staged entries this save writes, so an edit staged while it
     // is in flight (which replaces the same key) survives: only delete the key
     // when the entry is still the one this save started from.
@@ -342,36 +323,34 @@ export class CardForm<T> {
     this.failed = false
     this.failedReason = undefined
     this.publish()
-    const landed = new Set<string>()
-    const batch = this.batchedScope()
-    if (batch !== undefined) {
-      const result = await batch.mutate(plannedWrites)
-      if (result.ok) {
-        for (const field of result.fields) {
-          if (field.landed) landed.add(field.field)
-        }
-      } else {
-        this.failedReason = result.message
-      }
-    } else {
-      for (const item of valid) {
-        if (await item.run!()) landed.add(item.field)
-      }
+    // One atomic namespace mutation: the 0.1.2 scope contract takes ordered
+    // path operations, so the whole staged batch is validated, persisted, and
+    // recovered together — either every write lands or none does.
+    const ops: Array<{ op: 'set'; path: string[]; value: string | number | boolean } | { op: 'unset'; path: string[] }> = valid.map(item => item.op.op === 'set'
+      ? { op: 'set', path: [item.field], value: (item.op as { value: string | number | boolean }).value }
+      : { op: 'unset', path: [item.field] })
+    let failedReason: string | undefined
+    try {
+      await this.scope.mutate(ops)
+    } catch (error) {
+      failedReason = error instanceof Error ? error.message : String(error)
     }
+    // The 0.1.2 scope resolves even a refused mutation (it recovers with a
+    // fresh view instead of throwing), so resolution alone proves nothing:
+    // judge every planned write against the settled snapshot. The mutation is
+    // atomic, so one missed write fails the whole save and keeps the drafts.
+    const landed = failedReason === undefined && valid.every(item => item.judge())
     for (const [field, before] of pending) {
-      if (landed.has(field) && this.staged.get(field) === before) this.staged.delete(field)
+      if (landed && this.staged.get(field) === before) this.staged.delete(field)
     }
     this.saving = false
-    this.failed = landed.size !== pending.size
+    this.failed = !landed
+    // A read-back failure carries no server reason: the card surfaces its
+    // generic failure copy; a rejecting scope (the bridge) adds its message.
+    this.failedReason = failedReason
     this.publish()
   }
 
-  /** The scope's batch surface when it supports one; undefined conservatively otherwise. */
-  private batchedScope(): BatchedSettingsScope | undefined {
-    const candidate = this.scope as unknown as BatchedSettingsScope | undefined
-    return typeof candidate?.mutate === 'function' ? candidate : undefined
-  }
-
   /**
    * Every staged edit a save would write. An entry whose draft is not a value
    * its field accepts carries no write: the form is still dirty, and the save
@@ -384,33 +363,40 @@ export class CardForm<T> {
     for (const [field, staged] of this.staged) {
       const spec = this.specOf(field)
       if (staged.clear) {
-        if (this.stored(field)) plan.push({ field, op: { field, op: 'unset' }, run: () => this.clear(field) })
+        if (this.stored(field)) plan.push({ field, op: { field, op: 'unset' }, judge: () => this.landedUnset(field) })
         continue
       }
       if (staged.text === spec.format(this.sectionValue(field))) continue
       const write = spec.parse(staged.text)
-      if (write === undefined) plan.push({ field, op: { field, op: 'unset' }, run: undefined })
-      else if (write.kind === 'clear') plan.push({ field, op: { field, op: 'unset' }, run: () => this.clear(field) })
-      else plan.push({ field, op: { field, op: 'set', value: write.value }, run: () => this.store(field, write.value) })
+      if (write === undefined) plan.push({ field, op: { field, op: 'unset' }, judge: undefined })
+      else if (write.kind === 'clear') plan.push({ field, op: { field, op: 'unset' }, judge: () => this.landedUnset(field) })
+      else plan.push({ field, op: { field, op: 'set', value: write.value }, judge: () => this.landedSet(field, write.value) })
     }
     return plan
   }
 
-  private async clear(field: string): Promise<boolean> {
-    await this.scope.unset(field)
-    return !this.stored(field)
-  }
-
-  private async store(field: string, value: unknown): Promise<boolean> {
-    await this.scope.set(field, value)
-    // A redacted secret never appears in the user layer read-back; judging it
-    // by value would misreport a successful secret save as failed. The bridge
-    // reports secret writes through its secret-set markers (batch path); on
-    // the per-field path the scope resolved, so the write is landed.
+  /**
+   * Read-back judgment for a planned set: the user layer must hold the
+   * intended value once the mutation has settled.
+   */
+  private landedSet(field: string, value: unknown): boolean {
+    // A redacted secret never appears in any wire view layer: the Host strips
+    // role('secret') fields and reports them through a sidecar the scope
+    // snapshot does not expose, so there is nothing to compare the draft
+    // against. Settling is the only signal the form has; the rest of the
+    // batch, when one exists, still carries the atomic verdict by read-back.
     if (this.specOf(field).secret) return true
     return this.userLayer()?.[field] === value
   }
 
+  /**
+   * Read-back judgment for a planned unset: the field must be gone from the
+   * user layer once the mutation has settled.
+   */
+  private landedUnset(field: string): boolean {
+    return !this.stored(field)
+  }
+
   private stage(field: string, edit: StagedEdit): void {
     this.staged.set(field, edit)
     this.failed = false