@starwish-ai/xingyuan-dsh 0.5.2 → 0.5.3

package/CHANGELOG.md

@@ -5,6 +5,99 @@ All notable changes to this project are documented in this file.
 The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.5.3] - 2026-08-28
+
+> **Note:** this is a patch release but it carries one breaking change — the `xingyuan`
+> settings namespace is replaced by `xingyuan-pref` (see *Removed*). Consumers of the
+> `./domain` subpath must also adapt to `makeXingyuanStore()` taking a second, required
+> argument. Read *Upgrading from 0.5.2 or earlier* before updating.
+
+**Chat preferences are now always editable.** Settings → XingYuan rendered the
+write-confirmation toggle and the memory-injection limit as permanently disabled until a
+XingYuan session had been opened once since the last dsh start; clicking them did nothing
+and produced no error. Both preferences lived in the preset-layer namespace, which only
+comes into existence when the preset is first mounted, so they now live in a
+bundle-resident namespace registered whenever the bundle row is active.
+
+### Upgrading from 0.5.2 or earlier
+
+The two chat preferences moved from the `xingyuan` block of `$DSH_HOME/settings.yaml` to a
+new `xingyuan-pref` block. **A value you had customised is not carried over** and falls back
+to the default: `confirmWrites` returns to `true` (the safe direction — write actions ask for
+confirmation again) and `memoryInjectLimit` to `40`. Re-apply your choices under
+**Settings → XingYuan → Chat preferences**. The leftover `xingyuan:` block is inert and is
+safe to delete.
+
+### Added
+- **`xingyuan-pref` settings namespace** (`src/pref-settings.ts`), installed by the bundle
+  layer next to the existing `xingyuan-ui` namespace, carrying `confirmWrites` (default
+  `true`) and `memoryInjectLimit` (default `40`, integer `5`–`200`). The schema declares
+  `.step(1)`, so the Host also rejects fractional values that a hand-edited settings
+  document or a direct RPC write could otherwise smuggle in.
+- **Shared preference policy module** (`src/pref-policy.ts`) holding the bounds, defaults
+  and input parser for both halves — the host module depends on
+  `@deepseek-ai/dsh-settings` and must never reach the browser bundle. This also removes
+  the `5`/`200`/`40` literals that were previously repeated in the settings page. Covered
+  by `test/pref-policy.test.ts`.
+- **Write verification**: `scope.set()` resolves rather than rejects on failure (the client
+  controller catches, recovers and returns silently), so `toastError` never fired. The page
+  now compares the snapshot after each write and raises a "did not save" toast when the
+  value did not change. Both controls share one scope — and therefore one write queue — so
+  the comparison is gated on a per-component write sequence number to stay honest under
+  interleaved writes (see below).
+- **Regression lock** (`test/pref-settings.test.ts`): five tests pinning that the bundle
+  layer registers `xingyuan-pref` as soon as the settings service is available, that the
+  read thunk resolves fresh on every call, that the headless path falls back to the schema
+  defaults, and — structurally — that **no namespace bound by the settings page is ever
+  registered from the preset layer**. That last one is the abstract shape of this bug and is
+  what stops it from coming back.
+- **Four-way readiness notice** for the preferences card: loading, remote/temporary
+  connection (`mode === 'memory'`), namespace not registered, and read-only document. The
+  previous code only covered the first two, leaving the rest as silently disabled controls.
+
+### Fixed
+- The two preferences could not be changed before the first XingYuan session of the process
+  — the root cause described above.
+- The write-confirmation toggle rendered as **on** whenever its value was unavailable
+  (`value?.confirmWrites !== false` reads "unknown" as "true"), which is the worst possible
+  default for a safety switch. It now falls back to the schema default explicitly.
+- Namespace-unavailable and read-only states disabled the controls with no explanation.
+- The "did not save" toast could fire on a write that **had** been saved. Both controls share
+  one settings scope, and the client controller fences writes with a generation counter: when
+  a write is superseded by a newer one it only records a pending revision and does **not**
+  fold the result into the snapshot, while the superseded write's `.then` still runs first and
+  sees the stale value. Verification is now skipped for superseded writes, and the number
+  input got the pending guard the toggle already had.
+- Clearing the memory-injection-limit field and blurring reported "enter an integer between 5
+  and 200" while simultaneously refilling the field with the saved value — two contradictory
+  messages at once. An empty field is again treated as abandoning the edit.
+- Tool descriptions for the creation / check-in / cancel-check-in tools asserted that a system
+  confirmation card would appear. Toggle **Confirm write actions** off and the model kept
+  telling users a card had been shown when none was. Tool descriptions are baked in at
+  registration and dsh-tools requires a plain string (no getter), so they are now worded to
+  hold in both states instead of asserting the card. Delete tools are unaffected — deletes
+  always confirm.
+
+### Changed
+- The preset layer no longer registers a settings namespace. It reads preferences through
+  `ctx.xingyuan.prefs()` — a thunk that resolves the current value on every call, so edits
+  still take effect immediately without re-registering tools or prompts. The remaining
+  `Config` fields (`batchWishLimit`, `chartTrendDays`, …) have no settings UI and stay as
+  composition-only entry config, which matches the upstream rule that a namespace should
+  carry only the user-editable subset.
+- **Breaking for `./domain` consumers**: `makeXingyuanStore(domain)` now takes a second,
+  required argument — `makeXingyuanStore(domain, readPrefs)`, where `readPrefs` is a thunk
+  returning the resolved chat preferences. The required-ness is deliberate: every call site
+  (one in production, five in tests) is surfaced by the compiler rather than silently
+  missing the wiring. `XingyuanStore` gained a matching `prefs()` method.
+
+### Removed
+- The preset-layer `xingyuan` settings namespace and the `confirmWrites` /
+  `memoryInjectLimit` fields of the preset `Config`. **A value customised under the old
+  `xingyuan:` section of `$DSH_HOME/settings.yaml` is no longer read and falls back to the
+  default** — `confirmWrites` therefore returns to `true`, the conservative direction. The
+  stale section is left in the document and is harmless.
+
 ## [0.5.2] - 2026-08-27
 
 ### Added

package/lib/client/i18n.js

@@ -230,11 +230,14 @@ const ZH_DICT = {
     'settings.pref.title': '对话偏好',
     'settings.pref.unavailable': '当前连接不支持持久化偏好（远程或临时模式），以下两项不可用。',
     'settings.pref.loading': '偏好加载中…',
+    'settings.pref.notRegistered': '偏好暂不可用（组件未就绪），请稍后重试。',
+    'settings.pref.readOnly': '当前设置文档为只读，无法保存修改。',
     'settings.pref.confirmWrites': '写操作二次确认',
     'settings.pref.confirmWritesHint': '创建愿望/任务、打卡、取消打卡时先弹应用内确认卡（删除始终确认）；关闭后对话中的这类操作将直接执行。',
     'settings.pref.memoryLimit': '记忆注入上限',
     'settings.pref.memoryLimitHint': '每次对话自动注入上下文的记忆条数上限（5-200，默认 40）；失焦后保存。',
     'settings.pref.limitInvalid': '请输入 5-200 的整数',
+    'settings.pref.writeFailed': '保存未生效，请重试。',
     'settings.tabs.title': '标签页显示',
     'settings.tabs.mode.follow': '跟随会话',
     'settings.tabs.mode.show': '始终显示',
@@ -536,11 +539,14 @@ const EN_DICT = {
     'settings.pref.title': 'Chat preferences',
     'settings.pref.unavailable': 'This connection cannot persist preferences (remote or temporary mode); the two options below are disabled.',
     'settings.pref.loading': 'Loading preferences…',
+    'settings.pref.notRegistered': 'Preferences are unavailable right now (component not ready); please retry later.',
+    'settings.pref.readOnly': 'The settings document is read-only; changes cannot be saved.',
     'settings.pref.confirmWrites': 'Confirm write actions',
     'settings.pref.confirmWritesHint': 'Show an in-app confirmation before creating wishes/tasks, checking in or canceling (deletes always confirm). Turn off to execute directly.',
     'settings.pref.memoryLimit': 'Memory injection limit',
     'settings.pref.memoryLimitHint': 'Max memories auto-injected per chat (5-200, default 40); saved on blur.',
     'settings.pref.limitInvalid': 'Enter an integer between 5 and 200',
+    'settings.pref.writeFailed': 'The change did not save; please try again.',
     'settings.tabs.title': 'Tab visibility',
     'settings.tabs.mode.follow': 'Follow session',
     'settings.tabs.mode.show': 'Always show',

package/lib/client/index.js

@@ -79,10 +79,12 @@ export function apply(ctx) {
     // label 用 thunk 跟随当前语言；locale 声明让壳在语言切换时刷新标签行。
     ctx.slots.inject('conversation.view', () => installTabVisibility(ctx));
     // 星愿设置整页（设置 → 星愿）：教练风格/画像（星愿库）+ 二次确认开关与注入上限
-    // （preset 命名空间）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui，未选星愿也可调）
+    // （bundle 常驻命名空间 xingyuan-pref）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui）。
+    // 两个偏好命名空间都挂在常驻层：整页由本文件无条件注册，命名空间若随 preset 懒加载
+    // 缺席，就会出现「整页可见但两项写不进去且静默失败」。
     ctx.slots.inject('settings.section', () => {
-        const scope = ctx.settingsScope.bind({ namespace: 'xingyuan' });
+        const prefscope = ctx.settingsScope.bind({ namespace: 'xingyuan-pref' });
         const uiscope = ctx.settingsScope.bind({ namespace: 'xingyuan-ui' });
-        return ctx.slots.register({ name: 'settings.section', id: 'xingyuan', order: 60, label: () => t('settings.tabLabel'), locale: XY_NS }, () => SettingsSection({ scope, uiscope }));
+        return ctx.slots.register({ name: 'settings.section', id: 'xingyuan', order: 60, label: () => t('settings.tabLabel'), locale: XY_NS }, () => SettingsSection({ scope: prefscope, uiscope }));
     });
 }

package/lib/client/pages/settings.js

@@ -1,10 +1,12 @@
 /** 星愿设置整页（设置 → 星愿）：教练风格/画像（星愿库）+ 二次确认开关与注入上限
- * （preset 命名空间）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui，未选星愿也可调）。 */
+ * （bundle 常驻命名空间 xingyuan-pref）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui，
+ * 未选星愿也可调）。 */
 import { createElement, useEffect, useRef, useState, useSyncExternalStore } from 'react';
 import { getJson, postJson } from '../api.js';
 import { toastError } from '../ui.js';
 import { useXyT, activeLocale } from '../i18n.js';
 import { TAB_IDS } from '../../tab-policy.js';
+import { MEMORY_LIMIT_MAX, MEMORY_LIMIT_MIN, PREF_DEFAULTS, parseMemoryLimit, } from '../../pref-policy.js';
 const COACH_IDS = ['gentle', 'strict', 'humorous'];
 const COACH_KEYS = ['settings.coach.gentle', 'settings.coach.strict', 'settings.coach.humorous'];
 /** 显隐三态（顺序即分段按钮顺序；与 tab-policy 字面量同源）。 */
@@ -28,7 +30,7 @@ export function SettingsSection(props) {
     // 正确订阅：useSyncExternalStore + getSnapshot（scope 契约见 dsh-client-runtime contract/settings-scope）
     const snap = useSyncExternalStore((listener) => scope.subscribe(listener), () => scope.getSnapshot());
     const writable = snap.status === 'ready' && snap.writable;
-    const limit = String(snap.value?.memoryInjectLimit ?? 40);
+    const limit = String(snap.value?.memoryInjectLimit ?? PREF_DEFAULTS.memoryInjectLimit);
     // 界面偏好命名空间（标签页显隐）独立订阅：两个命名空间各自走自己的快照
     const uisnap = useSyncExternalStore((listener) => props.uiscope.subscribe(listener), () => props.uiscope.getSnapshot());
     const uiWritable = uisnap.status === 'ready' && uisnap.writable;
@@ -41,6 +43,9 @@ export function SettingsSection(props) {
     // 记忆注入上限：草稿态编辑（null=显示快照值），失焦才校验提交——避免逐键持久化与非法中间值死锁
     const [limitDraft, setLimitDraft] = useState(null);
     const [limitError, setLimitError] = useState(false);
+    // 记忆注入上限：写入在途的乐观值（与开关的 pendingToggle 同款，用于禁用控件并顶住回显，
+    // 否则提交后到快照回折前会闪回旧值）
+    const [pendingLimit, setPendingLimit] = useState(undefined);
     const [saving, setSaving] = useState(false);
     const [savedMsg, setSavedMsg] = useState('');
     // 二次确认开关：本地乐观值（undefined=跟随远端快照）——写入在途时 UI 立即响应，失败回滚
@@ -51,8 +56,20 @@ export function SettingsSection(props) {
     const savedTimer = useRef(undefined);
     // 档案加载代数守卫：慢响应不得覆盖用户已开始的草稿
     const profileSeqRef = useRef(0);
-    // 开关显示值：乐观本地值优先（写入在途），否则跟随远端快照
-    const confirmWrites = pendingToggle !== undefined ? pendingToggle : snap.value?.confirmWrites !== false;
+    // 偏好写序号：两个控件共用同一个 scope（即同一条写队列）。控制器以 writeGeneration
+    // 做栅栏——一次写被更新的写取代时只记 pendingRevision、不回折快照，而其 .then 又
+    // 先于后继写执行，此时比对快照必然读到旧值。故只有最后结算的那次有权判定成败。
+    const writeSeqRef = useRef(0);
+    // 开关显示值：乐观本地值优先（写入在途），否则远端快照，值缺席回落 schema 默认。
+    // 不可写成 `!== false`——那样「值未知」会被渲染成「已开启」，安全策略类开关尤其不能撒谎。
+    const confirmWrites = pendingToggle ?? snap.value?.confirmWrites ?? PREF_DEFAULTS.confirmWrites;
+    // 偏好区提示：判定顺序不可换——memory 模式下 status 同样是 unavailable，
+    // 先判 mode 才不会把「远程/临时模式」误报成「命名空间未就绪」
+    const prefNoticeKey = snap.status === 'loading' ? 'settings.pref.loading'
+        : snap.mode === 'memory' ? 'settings.pref.unavailable'
+            : snap.status === 'unavailable' ? 'settings.pref.notRegistered'
+                : !snap.writable ? 'settings.pref.readOnly'
+                    : undefined;
     // 标签页显隐显示值：乐观优先，否则远端快照，再兜底 schema 默认
     const tabMode = pendingMode ?? uisnap.value?.tabVisibilityMode ?? 'follow';
     const hiddenTabs = pendingHidden ?? uisnap.value?.hiddenTabs ?? [];
@@ -116,28 +133,59 @@ export function SettingsSection(props) {
         setSaving(true);
         run().catch(toastError).finally(() => setSaving(false));
     };
+    /**
+     * 校验偏好是否真的落盘：scope.set() 失败时是 resolve 而非 reject（内部 catch 后静默
+     * recover），故只能在写入结算后比对快照——值没变即视为未保存，须显式告知用户。
+     *
+     * seq 为发起写时取的号：只有仍是队列里最后一次写才校验，否则快照本就不会回折本次
+     * 的结果（被更新的写取代），比对必然误报。见 writeSeqRef。
+     */
+    const verifyWritten = (seq, field, value) => {
+        if (seq !== writeSeqRef.current)
+            return;
+        if (scope.getSnapshot().value?.[field] !== value)
+            toastError(new Error(t('settings.pref.writeFailed')));
+    };
     const commitLimit = () => {
         const raw = limitDraft;
         setLimitDraft(null);
         setLimitError(false);
-        if (raw === null || !writable || raw.trim() === '')
+        if (raw === null || !writable)
             return;
-        const n = Number(raw);
+        // 空串视为放弃编辑：静默回显保存值。若在此报错，会同时出现「已填回旧值」与
+        // 「请输入 5-200 的整数」两条互相矛盾的信息。
+        if (raw.trim() === '')
+            return;
+        const parsed = parseMemoryLimit(raw);
         // 非法输入就地报错（不再静默回弹）：用户明确知道哪里错、该怎么改
-        if (!Number.isFinite(n) || Math.round(n) !== n) {
+        if (parsed === undefined) {
             setLimitError(true);
             return;
         }
-        const clamped = Math.min(200, Math.max(5, Math.round(n)));
-        if (clamped !== Number(raw)) {
-            // 越界但可夹取：直接按夹取值提交并回显，同时给出行内提示
-            void scope.set('memoryInjectLimit', clamped).then(() => setLimitDraft(String(clamped))).catch(toastError);
+        if (parsed.clamped) {
+            // 越界但可夹取：按夹取值提交并回显，同时给出行内提示
+            const seq = ++writeSeqRef.current;
+            setPendingLimit(parsed.value);
+            void scope.set('memoryInjectLimit', parsed.value)
+                .then(() => {
+                setLimitDraft(String(parsed.value));
+                setPendingLimit(undefined);
+                verifyWritten(seq, 'memoryInjectLimit', parsed.value);
+            })
+                .catch((err) => { setPendingLimit(undefined); toastError(err); });
             setLimitError(true);
             return;
         }
-        if (clamped === snap.value?.memoryInjectLimit)
+        if (parsed.value === snap.value?.memoryInjectLimit)
             return;
-        void scope.set('memoryInjectLimit', clamped).catch(toastError);
+        const seq = ++writeSeqRef.current;
+        setPendingLimit(parsed.value);
+        void scope.set('memoryInjectLimit', parsed.value)
+            .then(() => {
+            setPendingLimit(undefined);
+            verifyWritten(seq, 'memoryInjectLimit', parsed.value);
+        })
+            .catch((err) => { setPendingLimit(undefined); toastError(err); });
     };
     const coachLabel = (id) => {
         const index = COACH_IDS.indexOf(id);
@@ -198,11 +246,11 @@ export function SettingsSection(props) {
         className: 'xy-btn xy-btn-primary', disabled: saving, onClick: saveProfile,
     }, saving ? t('settings.profile.saving') : t('settings.profile.save')), savedMsg !== '' ? createElement('span', { className: 'xy-saved', role: 'status' }, 
     // 勾形装饰对读屏隐藏（语义由文案承担），与卡片完成态同一语法
-    createElement('span', { 'aria-hidden': 'true' }, '✓ '), savedMsg) : null), createElement('p', { className: 'xy-hint' }, t('settings.profile.sharedHint'))), createElement('section', { className: 'xy-panel' }, createElement('h3', { className: 'xy-panel-head' }, t('settings.pref.title')), snap.status === 'unavailable'
-        ? createElement('p', { className: 'xy-hint' }, t('settings.pref.unavailable'))
-        : snap.status === 'loading'
-            ? createElement('p', { className: 'xy-hint' }, t('settings.pref.loading'))
-            : null, createElement('label', { className: 'xy-field' }, createElement('span', { className: 'xy-field-head' }, createElement('input', {
+    createElement('span', { 'aria-hidden': 'true' }, '✓ '), savedMsg) : null), createElement('p', { className: 'xy-hint' }, t('settings.profile.sharedHint'))), createElement('section', { className: 'xy-panel' }, createElement('h3', { className: 'xy-panel-head' }, t('settings.pref.title')), 
+    // 整页 section 没有官方卡片那套「按命名空间自动显隐」的保护，失败呈现归注册方
+    prefNoticeKey !== undefined
+        ? createElement('p', { className: 'xy-hint' }, t(prefNoticeKey))
+        : null, createElement('label', { className: 'xy-field' }, createElement('span', { className: 'xy-field-head' }, createElement('input', {
         type: 'checkbox',
         className: 'xy-toggle',
         name: 'confirmWrites',
@@ -214,19 +262,23 @@ export function SettingsSection(props) {
             // 乐观写：先落 UI 再等持久化；失败回滚到快照口径并 toast
             const next = e.target.checked;
             setPendingToggle(next);
+            const seq = ++writeSeqRef.current;
             void scope.set('confirmWrites', next)
-                .then(() => setPendingToggle(undefined))
+                .then(() => { setPendingToggle(undefined); verifyWritten(seq, 'confirmWrites', next); })
                 .catch((err) => {
                 setPendingToggle(undefined);
                 toastError(err);
             });
         },
     }), t('settings.pref.confirmWrites')), createElement('p', { className: 'xy-hint' }, t('settings.pref.confirmWritesHint'))), createElement('label', { className: 'xy-field' }, createElement('span', { className: 'xy-field-head' }, t('settings.pref.memoryLimit')), createElement('input', {
-        type: 'number', min: 5, max: 200, className: 'xy-input xy-input-num', name: 'memoryInjectLimit', inputMode: 'numeric',
+        type: 'number', min: MEMORY_LIMIT_MIN, max: MEMORY_LIMIT_MAX,
+        className: 'xy-input xy-input-num', name: 'memoryInjectLimit', inputMode: 'numeric',
         'aria-label': t('settings.pref.memoryLimit'),
         'aria-invalid': limitError || undefined,
         ...(limitError ? { 'aria-describedby': 'xy-limit-error' } : {}),
-        value: limitDraft ?? limit, disabled: !writable,
+        // 写入在途时顶住乐观值并禁用（与开关同款），避免闪回旧值与并发写交错
+        value: limitDraft ?? (pendingLimit !== undefined ? String(pendingLimit) : limit),
+        disabled: !writable || pendingLimit !== undefined,
         onChange: (e) => { setLimitDraft(e.target.value); setLimitError(false); },
         onBlur: commitLimit,
         onKeyDown: (e) => {

package/lib/client.js

@@ -226,11 +226,14 @@ const ZH_DICT = {
 	"settings.pref.title": "对话偏好",
 	"settings.pref.unavailable": "当前连接不支持持久化偏好（远程或临时模式），以下两项不可用。",
 	"settings.pref.loading": "偏好加载中…",
+	"settings.pref.notRegistered": "偏好暂不可用（组件未就绪），请稍后重试。",
+	"settings.pref.readOnly": "当前设置文档为只读，无法保存修改。",
 	"settings.pref.confirmWrites": "写操作二次确认",
 	"settings.pref.confirmWritesHint": "创建愿望/任务、打卡、取消打卡时先弹应用内确认卡（删除始终确认）；关闭后对话中的这类操作将直接执行。",
 	"settings.pref.memoryLimit": "记忆注入上限",
 	"settings.pref.memoryLimitHint": "每次对话自动注入上下文的记忆条数上限（5-200，默认 40）；失焦后保存。",
 	"settings.pref.limitInvalid": "请输入 5-200 的整数",
+	"settings.pref.writeFailed": "保存未生效，请重试。",
 	"settings.tabs.title": "标签页显示",
 	"settings.tabs.mode.follow": "跟随会话",
 	"settings.tabs.mode.show": "始终显示",
@@ -522,11 +525,14 @@ const EN_DICT = {
 	"settings.pref.title": "Chat preferences",
 	"settings.pref.unavailable": "This connection cannot persist preferences (remote or temporary mode); the two options below are disabled.",
 	"settings.pref.loading": "Loading preferences…",
+	"settings.pref.notRegistered": "Preferences are unavailable right now (component not ready); please retry later.",
+	"settings.pref.readOnly": "The settings document is read-only; changes cannot be saved.",
 	"settings.pref.confirmWrites": "Confirm write actions",
 	"settings.pref.confirmWritesHint": "Show an in-app confirmation before creating wishes/tasks, checking in or canceling (deletes always confirm). Turn off to execute directly.",
 	"settings.pref.memoryLimit": "Memory injection limit",
 	"settings.pref.memoryLimitHint": "Max memories auto-injected per chat (5-200, default 40); saved on blur.",
 	"settings.pref.limitInvalid": "Enter an integer between 5 and 200",
+	"settings.pref.writeFailed": "The change did not save; please try again.",
 	"settings.tabs.title": "Tab visibility",
 	"settings.tabs.mode.follow": "Follow session",
 	"settings.tabs.mode.show": "Always show",
@@ -3766,10 +3772,52 @@ function installTabVisibility(ctx) {
 	};
 }
 
+//#endregion
+//#region src/pref-policy.ts
+/**
+* 星愿「对话偏好」的纯策略与常量（host/client 两半侧共用 + 测试对拍）。
+*
+* 独立成模块而非并入 pref-settings.ts 的理由：后者依赖 host-only 的
+* `@deepseek-ai/dsh-settings`，绝不可进浏览器包；而设置页需要上下界与默认值
+* 做输入夹取、回显兜底与不可用态兜底。形态对标 tab-policy.ts。
+*
+* 决策口径：
+* - confirmWrites：创建/打卡/取消打卡类写操作是否二次确认，默认开；
+*   删除类始终确认，不受此开关控制（破坏性操作不设开关）。
+* - memoryInjectLimit：记忆注入条数上限，默认 40，合法区间 [5,200] 的整数。
+*   越界输入夹取到区间内并回显；非整数/非数字/空一律拒绝，不静默改值。
+*/
+/** 记忆注入上限的下界（含）。 */
+const MEMORY_LIMIT_MIN = 5;
+/** 记忆注入上限的上界（含）。 */
+const MEMORY_LIMIT_MAX = 200;
+/** 命名空间缺省（与 xingyuan-pref schema 默认值同源，见 src/pref-settings.ts）。 */
+const PREF_DEFAULTS = {
+	confirmWrites: true,
+	memoryInjectLimit: 40
+};
+/**
+* 解析「记忆注入上限」输入：非整数、非数字、空串一律返回 undefined（拒绝）；
+* 越界值夹取到 [MIN,MAX] 且 clamped 置 true（调用方据此给出行内提示并回显）。
+*/
+function parseMemoryLimit(raw) {
+	const trimmed = raw.trim();
+	if (trimmed === "") return void 0;
+	const n = Number(trimmed);
+	if (!Number.isFinite(n)) return void 0;
+	if (Math.round(n) !== n) return void 0;
+	const value = Math.min(200, Math.max(5, Math.round(n)));
+	return {
+		value,
+		clamped: value !== n
+	};
+}
+
 //#endregion
 //#region src/client/pages/settings.ts
 /** 星愿设置整页（设置 → 星愿）：教练风格/画像（星愿库）+ 二次确认开关与注入上限
-* （preset 命名空间）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui，未选星愿也可调）。 */
+* （bundle 常驻命名空间 xingyuan-pref）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui，
+* 未选星愿也可调）。 */
 const COACH_IDS = [
 	"gentle",
 	"strict",
@@ -3809,7 +3857,7 @@ function SettingsSection(props) {
 	const scope = props.scope;
 	const snap = (0, react.useSyncExternalStore)((listener) => scope.subscribe(listener), () => scope.getSnapshot());
 	const writable = snap.status === "ready" && snap.writable;
-	const limit = String(snap.value?.memoryInjectLimit ?? 40);
+	const limit = String(snap.value?.memoryInjectLimit ?? PREF_DEFAULTS.memoryInjectLimit);
 	const uisnap = (0, react.useSyncExternalStore)((listener) => props.uiscope.subscribe(listener), () => props.uiscope.getSnapshot());
 	const uiWritable = uisnap.status === "ready" && uisnap.writable;
 	const [profile, setProfile] = (0, react.useState)(void 0);
@@ -3819,6 +3867,7 @@ function SettingsSection(props) {
 	const [interestsDraft, setInterestsDraft] = (0, react.useState)("");
 	const [limitDraft, setLimitDraft] = (0, react.useState)(null);
 	const [limitError, setLimitError] = (0, react.useState)(false);
+	const [pendingLimit, setPendingLimit] = (0, react.useState)(void 0);
 	const [saving, setSaving] = (0, react.useState)(false);
 	const [savedMsg, setSavedMsg] = (0, react.useState)("");
 	const [pendingToggle, setPendingToggle] = (0, react.useState)(void 0);
@@ -3826,7 +3875,9 @@ function SettingsSection(props) {
 	const [pendingHidden, setPendingHidden] = (0, react.useState)(void 0);
 	const savedTimer = (0, react.useRef)(void 0);
 	const profileSeqRef = (0, react.useRef)(0);
-	const confirmWrites = pendingToggle !== void 0 ? pendingToggle : snap.value?.confirmWrites !== false;
+	const writeSeqRef = (0, react.useRef)(0);
+	const confirmWrites = pendingToggle ?? snap.value?.confirmWrites ?? PREF_DEFAULTS.confirmWrites;
+	const prefNoticeKey = snap.status === "loading" ? "settings.pref.loading" : snap.mode === "memory" ? "settings.pref.unavailable" : snap.status === "unavailable" ? "settings.pref.notRegistered" : !snap.writable ? "settings.pref.readOnly" : void 0;
 	const tabMode = pendingMode ?? uisnap.value?.tabVisibilityMode ?? "follow";
 	const hiddenTabs = pendingHidden ?? uisnap.value?.hiddenTabs ?? [];
 	/** 切换显隐模式：乐观写，失效即回滚（分段按钮视觉与持久化口径一致）。 */
@@ -3876,24 +3927,52 @@ function SettingsSection(props) {
 		setSaving(true);
 		run().catch(toastError).finally(() => setSaving(false));
 	};
+	/**
+	* 校验偏好是否真的落盘：scope.set() 失败时是 resolve 而非 reject（内部 catch 后静默
+	* recover），故只能在写入结算后比对快照——值没变即视为未保存，须显式告知用户。
+	*
+	* seq 为发起写时取的号：只有仍是队列里最后一次写才校验，否则快照本就不会回折本次
+	* 的结果（被更新的写取代），比对必然误报。见 writeSeqRef。
+	*/
+	const verifyWritten = (seq, field, value) => {
+		if (seq !== writeSeqRef.current) return;
+		if (scope.getSnapshot().value?.[field] !== value) toastError(new Error(t("settings.pref.writeFailed")));
+	};
 	const commitLimit = () => {
 		const raw = limitDraft;
 		setLimitDraft(null);
 		setLimitError(false);
-		if (raw === null || !writable || raw.trim() === "") return;
-		const n = Number(raw);
-		if (!Number.isFinite(n) || Math.round(n) !== n) {
+		if (raw === null || !writable) return;
+		if (raw.trim() === "") return;
+		const parsed = parseMemoryLimit(raw);
+		if (parsed === void 0) {
 			setLimitError(true);
 			return;
 		}
-		const clamped = Math.min(200, Math.max(5, Math.round(n)));
-		if (clamped !== Number(raw)) {
-			scope.set("memoryInjectLimit", clamped).then(() => setLimitDraft(String(clamped))).catch(toastError);
+		if (parsed.clamped) {
+			const seq = ++writeSeqRef.current;
+			setPendingLimit(parsed.value);
+			scope.set("memoryInjectLimit", parsed.value).then(() => {
+				setLimitDraft(String(parsed.value));
+				setPendingLimit(void 0);
+				verifyWritten(seq, "memoryInjectLimit", parsed.value);
+			}).catch((err) => {
+				setPendingLimit(void 0);
+				toastError(err);
+			});
 			setLimitError(true);
 			return;
 		}
-		if (clamped === snap.value?.memoryInjectLimit) return;
-		scope.set("memoryInjectLimit", clamped).catch(toastError);
+		if (parsed.value === snap.value?.memoryInjectLimit) return;
+		const seq = ++writeSeqRef.current;
+		setPendingLimit(parsed.value);
+		scope.set("memoryInjectLimit", parsed.value).then(() => {
+			setPendingLimit(void 0);
+			verifyWritten(seq, "memoryInjectLimit", parsed.value);
+		}).catch((err) => {
+			setPendingLimit(void 0);
+			toastError(err);
+		});
 	};
 	const coachLabel = (id) => {
 		const index = COACH_IDS.indexOf(id);
@@ -3966,7 +4045,7 @@ function SettingsSection(props) {
 	}, saving ? t("settings.profile.saving") : t("settings.profile.save")), savedMsg !== "" ? (0, react.createElement)("span", {
 		className: "xy-saved",
 		role: "status"
-	}, (0, react.createElement)("span", { "aria-hidden": "true" }, "✓ "), savedMsg) : null), (0, react.createElement)("p", { className: "xy-hint" }, t("settings.profile.sharedHint"))), (0, react.createElement)("section", { className: "xy-panel" }, (0, react.createElement)("h3", { className: "xy-panel-head" }, t("settings.pref.title")), snap.status === "unavailable" ? (0, react.createElement)("p", { className: "xy-hint" }, t("settings.pref.unavailable")) : snap.status === "loading" ? (0, react.createElement)("p", { className: "xy-hint" }, t("settings.pref.loading")) : null, (0, react.createElement)("label", { className: "xy-field" }, (0, react.createElement)("span", { className: "xy-field-head" }, (0, react.createElement)("input", {
+	}, (0, react.createElement)("span", { "aria-hidden": "true" }, "✓ "), savedMsg) : null), (0, react.createElement)("p", { className: "xy-hint" }, t("settings.profile.sharedHint"))), (0, react.createElement)("section", { className: "xy-panel" }, (0, react.createElement)("h3", { className: "xy-panel-head" }, t("settings.pref.title")), prefNoticeKey !== void 0 ? (0, react.createElement)("p", { className: "xy-hint" }, t(prefNoticeKey)) : null, (0, react.createElement)("label", { className: "xy-field" }, (0, react.createElement)("span", { className: "xy-field-head" }, (0, react.createElement)("input", {
 		type: "checkbox",
 		className: "xy-toggle",
 		name: "confirmWrites",
@@ -3976,7 +4055,11 @@ function SettingsSection(props) {
 			if (!writable) return;
 			const next = e.target.checked;
 			setPendingToggle(next);
-			scope.set("confirmWrites", next).then(() => setPendingToggle(void 0)).catch((err) => {
+			const seq = ++writeSeqRef.current;
+			scope.set("confirmWrites", next).then(() => {
+				setPendingToggle(void 0);
+				verifyWritten(seq, "confirmWrites", next);
+			}).catch((err) => {
 				setPendingToggle(void 0);
 				toastError(err);
 			});
@@ -3991,8 +4074,8 @@ function SettingsSection(props) {
 		"aria-label": t("settings.pref.memoryLimit"),
 		"aria-invalid": limitError || void 0,
 		...limitError ? { "aria-describedby": "xy-limit-error" } : {},
-		value: limitDraft ?? limit,
-		disabled: !writable,
+		value: limitDraft ?? (pendingLimit !== void 0 ? String(pendingLimit) : limit),
+		disabled: !writable || pendingLimit !== void 0,
 		onChange: (e) => {
 			setLimitDraft(e.target.value);
 			setLimitError(false);
@@ -4119,7 +4202,7 @@ function apply(ctx) {
 	]);
 	ctx.slots.inject("conversation.view", () => installTabVisibility(ctx));
 	ctx.slots.inject("settings.section", () => {
-		const scope = ctx.settingsScope.bind({ namespace: "xingyuan" });
+		const prefscope = ctx.settingsScope.bind({ namespace: "xingyuan-pref" });
 		const uiscope = ctx.settingsScope.bind({ namespace: "xingyuan-ui" });
 		return ctx.slots.register({
 			name: "settings.section",
@@ -4128,7 +4211,7 @@ function apply(ctx) {
 			label: () => t("settings.tabLabel"),
 			locale: XY_NS
 		}, () => SettingsSection({
-			scope,
+			scope: prefscope,
 			uiscope
 		}));
 	});

package/lib/domain.js

@@ -89,10 +89,11 @@ export const xingyuanDomainSpec = defineDomain({
     },
 });
 /** 由已打开领域构造服务句柄（bundle 入口组装用）。 */
-export function makeXingyuanStore(domain) {
+export function makeXingyuanStore(domain, readPrefs) {
     return {
         spec: xingyuanDomainSpec,
         domain,
+        prefs: readPrefs,
         newId: () => randomUUID(),
         checkinKey: (taskId, date) => `${taskId}|${date}`,
     };

package/lib/index.js

@@ -1,5 +1,6 @@
 import z from '@deepseek-ai/schemastery';
 import { makeXingyuanStore, xingyuanDomainSpec } from './domain.js';
+import { installPrefSettings } from './pref-settings.js';
 import { registerXingyuanRoutes } from './routes/index.js';
 import { ensurePresetRoot } from './preset-root.js';
 import { repairSessionLogs } from './session-log-repair.js';
@@ -28,6 +29,10 @@ export async function apply(ctx, config) {
     });
     // 界面偏好命名空间（标签页显隐）常驻注册：不依赖 settings 服务存在，服务挂载后自动生效
     installUiSettings(ctx);
+    // 对话偏好命名空间（二次确认 + 记忆注入上限）常驻注册：与界面偏好同款时序。
+    // 返回的读取 thunk 由领域服务持有，preset 层经 ctx.xingyuan.prefs() 读取——
+    // 命名空间必须常驻，否则整页可见而数据随 preset 懒加载缺席，写入静默失败。
+    const readPrefs = installPrefSettings(ctx);
     // preset 发布成功后再开领域；两步就绪后才 provide，注入方（preset 子树）由
     // cordis inject 语义等待本行激活完成
     await ensurePresetRoot();
@@ -37,7 +42,7 @@ export async function apply(ctx, config) {
         return;
     }
     domain = opened;
-    ctx.provide('xingyuan', makeXingyuanStore(opened));
+    ctx.provide('xingyuan', makeXingyuanStore(opened, readPrefs));
     registerXingyuanRoutes(webServer, ctx.xingyuan, config);
     if (config.repairSessionLogs) {
         try {

package/lib/pref-policy.js

@@ -0,0 +1,38 @@
+/**
+ * 星愿「对话偏好」的纯策略与常量（host/client 两半侧共用 + 测试对拍）。
+ *
+ * 独立成模块而非并入 pref-settings.ts 的理由：后者依赖 host-only 的
+ * `@deepseek-ai/dsh-settings`，绝不可进浏览器包；而设置页需要上下界与默认值
+ * 做输入夹取、回显兜底与不可用态兜底。形态对标 tab-policy.ts。
+ *
+ * 决策口径：
+ * - confirmWrites：创建/打卡/取消打卡类写操作是否二次确认，默认开；
+ *   删除类始终确认，不受此开关控制（破坏性操作不设开关）。
+ * - memoryInjectLimit：记忆注入条数上限，默认 40，合法区间 [5,200] 的整数。
+ *   越界输入夹取到区间内并回显；非整数/非数字/空一律拒绝，不静默改值。
+ */
+/** 记忆注入上限的下界（含）。 */
+export const MEMORY_LIMIT_MIN = 5;
+/** 记忆注入上限的上界（含）。 */
+export const MEMORY_LIMIT_MAX = 200;
+/** 命名空间缺省（与 xingyuan-pref schema 默认值同源，见 src/pref-settings.ts）。 */
+export const PREF_DEFAULTS = {
+    confirmWrites: true,
+    memoryInjectLimit: 40,
+};
+/**
+ * 解析「记忆注入上限」输入：非整数、非数字、空串一律返回 undefined（拒绝）；
+ * 越界值夹取到 [MIN,MAX] 且 clamped 置 true（调用方据此给出行内提示并回显）。
+ */
+export function parseMemoryLimit(raw) {
+    const trimmed = raw.trim();
+    if (trimmed === '')
+        return undefined;
+    const n = Number(trimmed);
+    if (!Number.isFinite(n))
+        return undefined;
+    if (Math.round(n) !== n)
+        return undefined;
+    const value = Math.min(MEMORY_LIMIT_MAX, Math.max(MEMORY_LIMIT_MIN, Math.round(n)));
+    return { value, clamped: value !== n };
+}

package/lib/pref-settings.js

@@ -0,0 +1,27 @@
+import z from '@deepseek-ai/schemastery';
+import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
+import { MEMORY_LIMIT_MAX, MEMORY_LIMIT_MIN, PREF_DEFAULTS } from './pref-policy.js';
+/** 对话偏好命名空间（client 半侧 settingsScope 同名配对，勿改）。 */
+export const PREF_NS = settingsNamespace('xingyuan-pref');
+/** 配置 schema（默认值写进 schema；step(1) 让服务端也拒绝小数，防手改文档/RPC 直写）。 */
+export const PrefSettingsSchema = z.object({
+    confirmWrites: z.boolean().default(PREF_DEFAULTS.confirmWrites),
+    memoryInjectLimit: z.number().step(1).min(MEMORY_LIMIT_MIN).max(MEMORY_LIMIT_MAX)
+        .default(PREF_DEFAULTS.memoryInjectLimit),
+});
+/**
+ * bundle 层安装对话偏好命名空间，并返回偏好读取 thunk。
+ *
+ * thunk 每次调用都读「当前解析值」（schema 默认 → base → 用户层），故设置热改后
+ * 下一次读取即生效，无需重建任何注册；settings 服务缺席时返回 PREF_DEFAULTS。
+ */
+export function installPrefSettings(ctx) {
+    // 闭包局部，非模块级单例（AGENTS.md §8：不做任何跨重载的模块级单例状态）
+    let read = () => PREF_DEFAULTS;
+    installSettingsSection(ctx, PREF_NS, PrefSettingsSchema, PREF_DEFAULTS, {
+        setSource: (current) => { read = current; },
+        // 消费方（工具/提示词）每次执行即时读 thunk，无需在此重建任何东西
+        onChange: () => { },
+    });
+    return () => read();
+}

package/lib/preset/side.js

@@ -1,5 +1,4 @@
 import z from '@deepseek-ai/schemastery';
-import { installSettingsSection, settingsNamespace } from '@deepseek-ai/dsh-settings';
 import { registerTools } from './tools.js';
 import { registerPrompts } from './prompts.js';
 /** Cordis 插件名。 */
@@ -8,8 +7,6 @@ export const name = 'xingyuan-preset-side';
 export const inject = ['tools', 'systemPrompt', 'userQuestions', 'xingyuan'];
 /** 配置 schema（默认值写进 schema；加载期校验失败即响亮报错）。 */
 export const Config = z.object({
-    // 5-200 与设置页文案/客户端夹取范围同口径，服务端兜底防越界
-    memoryInjectLimit: z.number().default(40).min(5).max(200),
     batchWishLimit: z.number().default(50),
     batchTaskLimit: z.number().default(100),
     chartTrendDays: z.number().default(14),
@@ -17,29 +14,21 @@ export const Config = z.object({
     chartMaxDays: z.number().default(90),
     chartRankLimit: z.number().default(10),
     chartRankMax: z.number().default(20),
-    confirmWrites: z.boolean().default(true),
 });
-/** 星愿设置命名空间（与浏览器半侧卡片配对）。 */
-export const SETTINGS_NS = settingsNamespace('xingyuan');
 export function apply(ctx, config) {
-    let source = () => config;
-    // 设置卡命名空间：客户端经 settingsScope 写入，onChange 热生效（HMR 安全）
-    installSettingsSection(ctx, SETTINGS_NS, Config, config, {
-        setSource: (current) => { source = current; },
-        onChange: () => { },
-    });
-    const current = () => source();
-    // 以 getter 对象透传：设置卡热改后工具下一次 execute 即读新值（满足 ToolsConfig 形状）
+    // 对话偏好：bundle 层常驻命名空间的读取 thunk，每次调用取当前解析值
+    const prefs = () => ctx.xingyuan.prefs();
+    // 组合层参数进程内不变，直接取 entry config；对话偏好用 getter，保证热改即时生效
     const toolsConfig = {
-        get batchWishLimit() { return current().batchWishLimit; },
-        get batchTaskLimit() { return current().batchTaskLimit; },
-        get chartTrendDays() { return current().chartTrendDays; },
-        get chartDistributionDays() { return current().chartDistributionDays; },
-        get chartMaxDays() { return current().chartMaxDays; },
-        get chartRankLimit() { return current().chartRankLimit; },
-        get chartRankMax() { return current().chartRankMax; },
-        get confirmWrites() { return current().confirmWrites; },
+        batchWishLimit: config.batchWishLimit,
+        batchTaskLimit: config.batchTaskLimit,
+        chartTrendDays: config.chartTrendDays,
+        chartDistributionDays: config.chartDistributionDays,
+        chartMaxDays: config.chartMaxDays,
+        chartRankLimit: config.chartRankLimit,
+        chartRankMax: config.chartRankMax,
+        get confirmWrites() { return prefs().confirmWrites; },
     };
     registerTools(ctx, toolsConfig);
-    registerPrompts(ctx, { get memoryInjectLimit() { return current().memoryInjectLimit; } });
+    registerPrompts(ctx, { get memoryInjectLimit() { return prefs().memoryInjectLimit; } });
 }

package/lib/preset/tools.js

@@ -113,10 +113,20 @@ function requireTask(store, taskId) {
 function wishNameOf(store, task) {
     return task.wishId !== undefined ? store.domain.table('wishes').get(task.wishId)?.title : undefined;
 }
-/** 愿望记录构造已收口至 store.createWish/updateWish（校验同源）；此处保留字段预检以便在确认卡前失败。 */
-const DELETE_NOTE = '删除不可恢复：会弹出系统确认卡片，直接调用等待确认结果即可，无需自行询问用户。';
-const CREATE_NOTE = '会弹出系统确认卡片展示完整创建内容，直接调用等待确认结果即可，无需自行询问用户；用户在确认卡取消则向用户说明并询问要调整的地方。';
-const CANCEL_CHECKIN_NOTE = '会弹出系统确认卡片，直接调用等待确认结果即可，无需自行询问用户。';
+/**
+ * 写操作的模型侧提示文案（拼进工具 description）。
+ *
+ * 两类不可混用：
+ * - `DELETE_NOTE`：删除类**始终**弹确认卡，不受设置开关影响，故可以断言「会弹卡」。
+ * - `CREATE_NOTE` / `CANCEL_CHECKIN_NOTE`：受「写操作二次确认」开关门控（见
+ *   `confirmGate`），而工具描述是注册时烘焙的静态字符串——dsh-tools 校验
+ *   `description` 必须是 string（不支持 getter），改设置也不会重建描述。故这两条
+ *   一律写成「开与关都成立」的措辞：绝不可断言会弹卡，否则关掉开关后模型会向用户
+ *   宣称已弹出确认卡，而实际没有卡片。
+ */
+const DELETE_NOTE = '删除不可恢复：会弹出系统确认卡片，直接调用等待确认结果即可，无需事先询问用户。';
+const CREATE_NOTE = '无需事先询问用户，直接调用即可；结果返回前不要宣称已创建。若系统弹出确认卡片且用户在卡片上取消，则向用户说明并询问要调整的地方。';
+const CANCEL_CHECKIN_NOTE = '无需事先询问用户，直接调用即可；结果返回前不要宣称已取消。';
 /** 分类颜色白名单（schema enum 与展示色共用同一事实源）。 */
 const COLOR_KEY_ENUM = CATEGORY_COLOR_KEYS;
 const COLOR_KEY_NOTE = `可选值：${CATEGORY_COLOR_KEYS.join('/')}（不传则按分类名自动配色）`;
@@ -629,7 +639,8 @@ export function registerTools(ctx, config) {
     ctx.tools.register(defineTool({
         name: 'check_in_task',
         description: '任务打卡。何时使用：用户完成任务并需要记录打卡时使用。支持指定日期打卡（日历补卡/提前勾），不传日期则自动勾选今天（含）起最早未勾选的打卡日——过去的日期不会自动补，补卡请在日历中指定日期。'
-            + '注意：本工具会弹出系统确认卡片，确认后自动执行；今天不是打卡日时自动勾选的是未来日期（提前打卡 = 承诺当天完成），回复时请用「打卡日」等通俗用语并如实告知勾选日期。',
+            // 与 CREATE_NOTE 同口径：是否弹卡受设置门控，描述里不可断言（见 DELETE_NOTE 组注释）
+            + '注意：无需事先询问用户，直接调用即可；今天不是打卡日时自动勾选的是未来日期（提前打卡 = 承诺当天完成），回复时请用「打卡日」等通俗用语并如实告知勾选日期。',
         parameters: {
             taskId: { type: 'string', required: true, description: '任务ID，取列表返回的真实值' },
             checkInDate: { type: 'string', description: '打卡日期，可选。yyyy-MM-dd，必须是任务的打卡日；不传则自动勾选今天（含）起最早未勾选的打卡日' },

package/lib/types/client/i18n.d.ts

@@ -203,11 +203,14 @@ declare const ZH_DICT: {
     readonly 'settings.pref.title': "对话偏好";
     readonly 'settings.pref.unavailable': "当前连接不支持持久化偏好（远程或临时模式），以下两项不可用。";
     readonly 'settings.pref.loading': "偏好加载中…";
+    readonly 'settings.pref.notRegistered': "偏好暂不可用（组件未就绪），请稍后重试。";
+    readonly 'settings.pref.readOnly': "当前设置文档为只读，无法保存修改。";
     readonly 'settings.pref.confirmWrites': "写操作二次确认";
     readonly 'settings.pref.confirmWritesHint': "创建愿望/任务、打卡、取消打卡时先弹应用内确认卡（删除始终确认）；关闭后对话中的这类操作将直接执行。";
     readonly 'settings.pref.memoryLimit': "记忆注入上限";
     readonly 'settings.pref.memoryLimitHint': "每次对话自动注入上下文的记忆条数上限（5-200，默认 40）；失焦后保存。";
     readonly 'settings.pref.limitInvalid': "请输入 5-200 的整数";
+    readonly 'settings.pref.writeFailed': "保存未生效，请重试。";
     readonly 'settings.tabs.title': "标签页显示";
     readonly 'settings.tabs.mode.follow': "跟随会话";
     readonly 'settings.tabs.mode.show': "始终显示";

package/lib/types/client/pages/settings.d.ts

@@ -1,15 +1,18 @@
 /** 星愿设置整页（设置 → 星愿）：教练风格/画像（星愿库）+ 二次确认开关与注入上限
- * （preset 命名空间）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui，未选星愿也可调）。 */
+ * （bundle 常驻命名空间 xingyuan-pref）+ 标签页显隐（bundle 常驻命名空间 xingyuan-ui，
+ * 未选星愿也可调）。 */
 import { type ReactElement } from 'react';
 import { type TabId, type TabVisibilityMode } from '../../tab-policy.js';
-/** 与 dsh-client-runtime 的 SettingsScope 快照对齐的叶子视图（只读字段）。 */
-interface ScopeSnapshotLike {
+/** xingyuan-pref 命名空间快照（对话偏好字段）。 */
+interface PrefScopeSnapshotLike {
     readonly status: 'loading' | 'ready' | 'unavailable';
     readonly value?: {
         readonly confirmWrites?: boolean;
         readonly memoryInjectLimit?: number;
     };
     readonly writable: boolean;
+    /** `host` 与宿主文档同步；`memory` 为远程/临时模式，此时任何写入都不会落盘。 */
+    readonly mode: 'host' | 'memory';
 }
 /** xingyuan-ui 命名空间快照（标签页显隐字段）。 */
 interface UiScopeSnapshotLike {
@@ -30,15 +33,17 @@ export interface UiScopeLike {
 /**
  * settingsScope.bind() 返回的真实形状：getSnapshot()/subscribe()/set()/unset()。
  * 注意 scope 本身没有 .value 字段——值在快照里（此前直接读 scope.value 导致整节渲染崩溃）。
+ * 另：set() 失败是 resolve 而非 reject（内部 catch 后静默 recover），故调用方须事后
+ * 比对快照确认落盘，见下方 verifyWritten。
  */
-export interface SettingsScopeLike {
-    getSnapshot(): ScopeSnapshotLike;
+export interface PrefScopeLike {
+    getSnapshot(): PrefScopeSnapshotLike;
     subscribe(listener: () => void): () => void;
     set(field: string, value: unknown): Promise<void>;
     unset(field: string): Promise<void>;
 }
 export declare function SettingsSection(props: {
-    scope: SettingsScopeLike;
+    scope: PrefScopeLike;
     uiscope: UiScopeLike;
 }): ReactElement;
 export {};

package/lib/types/domain.d.ts

@@ -1,5 +1,6 @@
 import { type Domain, type DomainTableSpec } from '@deepseek-ai/dsh-storage-domain';
 import { z } from 'zod';
+import type { PrefSettings } from './pref-policy.js';
 export declare const DOMAIN_VERSION = 1;
 /** 教练风格。 */
 export declare const COACH_STYLES: readonly ["gentle", "strict", "humorous"];
@@ -98,6 +99,8 @@ export type MemoryRecord = TableValue<(typeof xingyuanDomainSpec.tables)['memori
 export interface XingyuanStore {
     readonly spec: typeof xingyuanDomainSpec;
     readonly domain: Domain<typeof xingyuanDomainSpec>;
+    /** 对话偏好：bundle 层常驻命名空间的解析值（非领域数据），每次调用读当前值。 */
+    prefs(): PrefSettings;
     newId(): string;
     checkinKey(taskId: string, date: string): string;
 }
@@ -108,5 +111,5 @@ declare module '@deepseek-ai/cordis' {
 }
 type TableValue<S extends DomainTableSpec> = S extends DomainTableSpec<string, infer V> ? V : never;
 /** 由已打开领域构造服务句柄（bundle 入口组装用）。 */
-export declare function makeXingyuanStore(domain: Domain<typeof xingyuanDomainSpec>): XingyuanStore;
+export declare function makeXingyuanStore(domain: Domain<typeof xingyuanDomainSpec>, readPrefs: () => PrefSettings): XingyuanStore;
 export {};

package/lib/types/pref-policy.d.ts

@@ -0,0 +1,34 @@
+/**
+ * 星愿「对话偏好」的纯策略与常量（host/client 两半侧共用 + 测试对拍）。
+ *
+ * 独立成模块而非并入 pref-settings.ts 的理由：后者依赖 host-only 的
+ * `@deepseek-ai/dsh-settings`，绝不可进浏览器包；而设置页需要上下界与默认值
+ * 做输入夹取、回显兜底与不可用态兜底。形态对标 tab-policy.ts。
+ *
+ * 决策口径：
+ * - confirmWrites：创建/打卡/取消打卡类写操作是否二次确认，默认开；
+ *   删除类始终确认，不受此开关控制（破坏性操作不设开关）。
+ * - memoryInjectLimit：记忆注入条数上限，默认 40，合法区间 [5,200] 的整数。
+ *   越界输入夹取到区间内并回显；非整数/非数字/空一律拒绝，不静默改值。
+ */
+/** 记忆注入上限的下界（含）。 */
+export declare const MEMORY_LIMIT_MIN = 5;
+/** 记忆注入上限的上界（含）。 */
+export declare const MEMORY_LIMIT_MAX = 200;
+/** 命名空间解析值（schema 默认 → base 层 → 用户层）。 */
+export interface PrefSettings {
+    /** 创建/取消打卡类写操作是否二次确认（删除类始终确认）。 */
+    confirmWrites: boolean;
+    /** 每次对话自动注入上下文的记忆条数上限。 */
+    memoryInjectLimit: number;
+}
+/** 命名空间缺省（与 xingyuan-pref schema 默认值同源，见 src/pref-settings.ts）。 */
+export declare const PREF_DEFAULTS: PrefSettings;
+/**
+ * 解析「记忆注入上限」输入：非整数、非数字、空串一律返回 undefined（拒绝）；
+ * 越界值夹取到 [MIN,MAX] 且 clamped 置 true（调用方据此给出行内提示并回显）。
+ */
+export declare function parseMemoryLimit(raw: string): {
+    value: number;
+    clamped: boolean;
+} | undefined;

package/lib/types/pref-settings.d.ts

@@ -0,0 +1,34 @@
+/**
+ * 星愿 bundle 层「对话偏好」设置命名空间（xingyuan-pref）：
+ * 写操作二次确认（confirmWrites）与记忆注入上限（memoryInjectLimit）。
+ *
+ * 挂在 bundle 常驻层而非 preset 层的理由（本次根因，实测结论）：
+ * 设置整页（settings.section）由 bundle client 层无条件注册、常驻可见；而 preset
+ * 挂载是**按 preset 常驻但懒加载**的（官方 agent-presets：per-preset standing
+ * mount，进程内只挂一次、只随整棵树卸载），首次开星愿会话才建立。于是每次 dsh
+ * 重启后、开过星愿会话之前，整页可见而命名空间不存在：两项均 unavailable，
+ * 写入静默失败（client scope.set() 失败是 resolve 而非 reject），表现为
+ * 「点了弹回原样、没有任何提示」。
+ *
+ * 官方 cookbook 的 settings.plugin.item 卡片按「Host 是否服务该命名空间」自动显隐，
+ * 整页 section 没有这层保护——slots.d.ts 契约把失败呈现的责任明确交给注册方。
+ * 故此处让数据常驻以对齐常驻 UI，而非让 UI 跟随数据（那会让设置页出现
+ * 部分字段时有时无的割裂，且安全策略类设置「有时候找不到」不可接受）。
+ *
+ * installSettingsSection 经 ctx.inject(['settings']) 等待 settings 服务挂载，
+ * 服务缺席（headless 等）时整段不运行，bundle 激活不依赖它。
+ */
+import type { Context } from '@deepseek-ai/cordis';
+import z from '@deepseek-ai/schemastery';
+import { type PrefSettings } from './pref-policy.js';
+/** 对话偏好命名空间（client 半侧 settingsScope 同名配对，勿改）。 */
+export declare const PREF_NS: import("@deepseek-ai/dsh-settings").SettingsNamespace;
+/** 配置 schema（默认值写进 schema；step(1) 让服务端也拒绝小数，防手改文档/RPC 直写）。 */
+export declare const PrefSettingsSchema: z<PrefSettings>;
+/**
+ * bundle 层安装对话偏好命名空间，并返回偏好读取 thunk。
+ *
+ * thunk 每次调用都读「当前解析值」（schema 默认 → base → 用户层），故设置热改后
+ * 下一次读取即生效，无需重建任何注册；settings 服务缺席时返回 PREF_DEFAULTS。
+ */
+export declare function installPrefSettings(ctx: Context): () => PrefSettings;

package/lib/types/preset/side.d.ts

@@ -2,6 +2,11 @@
  * 星愿 preset 侧入口：工具与提示词只注册在 preset 层，不出现在未选择星愿的会话里。
  * 本文件由 presets/xingyuan/agent.cordis.yml 以裸包名子路径装载；发布服务必须留在
  * isolate realm（本插件只向 ctx 注册贡献，不 provide 服务，天然合规）。
+ *
+ * 对话偏好（写操作二次确认 / 记忆注入上限）不在本层提供：设置整页由 bundle client
+ * 层常驻注册，而 preset 挂载按 preset 常驻却懒加载——首次开星愿会话前命名空间缺席，
+ * 整页可见而数据不在，写入静默失败。两项已迁至 bundle 层常驻命名空间 xingyuan-pref
+ * （src/pref-settings.ts），本层经 ctx.xingyuan.prefs() 读取。
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
@@ -10,10 +15,8 @@ import type { XingyuanStore } from '../domain.js';
 export declare const name = "xingyuan-preset-side";
 /** 依赖：宿主组装常驻层提供的注册表与星愿领域。 */
 export declare const inject: string[];
-/** 插件配置。 */
+/** 插件配置：仅组合层可调参数（无 Web 设置界面；用户可编辑偏好见 pref-settings.ts）。 */
 export interface Config {
-    /** 记忆注入上限（条），默认 40。 */
-    memoryInjectLimit: number;
     /** batch_query_user_data 愿望返回上限，默认 50。 */
     batchWishLimit: number;
     /** batch_query_user_data 任务返回上限，默认 100。 */
@@ -28,13 +31,9 @@ export interface Config {
     chartRankLimit: number;
     /** 排行/进度类返回条数上限，默认 20。 */
     chartRankMax: number;
-    /** 创建/取消打卡类写操作二次确认（默认开；删除类始终确认）。 */
-    confirmWrites: boolean;
 }
 /** 配置 schema（默认值写进 schema；加载期校验失败即响亮报错）。 */
 export declare const Config: z<Config>;
-/** 星愿设置命名空间（与浏览器半侧卡片配对）。 */
-export declare const SETTINGS_NS: import("@deepseek-ai/dsh-settings").SettingsNamespace;
 export declare function apply(ctx: Context & {
     xingyuan: XingyuanStore;
 }, config: Config): void;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@starwish-ai/xingyuan-dsh",
-  "version": "0.5.2",
+  "version": "0.5.3",
   "description": "星愿 XingYuan for DeepSeek Harness: 对话创建愿望/任务、机会日打卡、微行动、记忆与图表的 Agent Preset 组合包",
   "type": "module",
   "license": "MIT",