dsh-autorestart 0.8.4 → 0.8.6

package/client.js

@@ -192,8 +192,8 @@
     panelParkedGoal: '会话 {session} · {goal}',
     panelWaiting: '已等待 {duration}',
     panelResume: '重启后本会话会自动继续进度',
-    // The long wait: the restart passed the hard deadline while a conversation
-    // was still running. The capsule is ONE clipped line of 22px: it holds a
+    // The long wait: the restart is still waiting while a conversation runs on.
+    // There is no deadline and nothing expires. The capsule is ONE clipped line: it holds a
     // number and a duration, NEVER a name. Every name goes into the tooltip,
     // where there is room for all of them.
     longWaitPill: ' · 已等 {duration} · {n} 项任务在跑',
@@ -209,6 +209,14 @@
     blockerMore: '…等 {n} 项',
     blockersTitleLine: '占用会话：{blockers}',
     durationSeconds: '{n} 秒',
+    // A CANCELLED QUEUED RESTART, IN PLAIN WORDS (user report, 2026-11-03): the request
+    // waited over two hours, then a host restart cancelled it and the page said nothing.
+    // No internal identifier may reach the screen.
+    'settings.restart.cancelledNote': '上次要的重启没有做成：你在 {at} 请求重启，等了 {waited}，它一直没有执行；这次宿主重启之后，那个请求已经被取消了。想重启的话，再点一次就行。',
+    'restart.waitedSeconds': '几秒',
+    'restart.waitedMinutes': '约 {n} 分钟',
+    'restart.waitedHours': '约 {n} 小时 {m} 分',
+    'restart.waitedHoursExact': '约 {n} 小时',
     durationMinutes: '{n} 分 {m} 秒',
     durationHours: '{n} 小时 {m} 分',
     // The COMPACT duration of the capsule: it can afford "16 分钟", not
@@ -291,9 +299,13 @@
     'settings.restartGrace.value': '{n} 秒',
     'settings.restartGrace.immediate': '不等（立即重启）',
     'settings.backup.label': '重启前备份',
-    'settings.backup.hint': '每次重启前先快照一次当前配置；万一重启后起不来，能自动回退。',
+    'settings.backup.details': '详情',
+    'settings.backup.section': '备份说明及手动备份操作',
+    'settings.backup.hint': '重启前自动存一份，重启后起不来时能退回去。存的是：你的设置（一定）；你自己写的、直接链接到源码目录的插件（连文件一起拷）；从网上下载装的插件（只记下装过哪些、什么版本，不拷文件，真出事时按清单重装）。',
     'settings.backupPlugins.label': '备份包含已安装插件',
     'settings.backupPlugins.hint': '关闭后只备份 DSH 自身状态，不含 profile 里的插件目录。',
+    'settings.restartBanner.title': '这台机器现在还没有重启能力：本插件不会重启，也不会在重启前备份。点一下「帮我配好」，我自动推导并写入；配错了可以撤销。',
+    'settings.restartBanner.fix': '帮我配好',
     'settings.groups.supervisor': '开机自启',
     'settings.supervisor.status': '当前由',
     'settings.supervisor.installed': '插件守护',
@@ -353,6 +365,7 @@
   'settings.autostartKind.systemd-system': 'systemd 系统服务',
   'settings.autostartKind.wsl-systemd': 'WSL 里的 systemd',
   'settings.autostartKind.wsl-no-systemd': 'WSL（没有 systemd）',
+  'settings.autostartKind.linux-no-systemd': 'Linux（没有 systemd）',
   'settings.autostartKind.container': '容器',
   'settings.autostartKind.desktop': '桌面版自带重启',
   'settings.autostartKind.unknown': '认不出',
@@ -368,19 +381,102 @@
     'meta.description': '让 DeepSeek Harness 重启后接着干活：落盘的检查点、启动时重新武装 goal 或给一条续接提示，以及一次等人闲下来的优雅重启。',
     'text.missing': '（这条文案还没写）',
     'settings.backup.list': '现在备份了什么',
-    'settings.backup.count': '当前 {n} 份',
+    // TWO LINES, NOT FIVE (user report, 2026-11-02). One line says how many
+    // copies there are and how much disk they take together; the next one says
+    // the rule that keeps their number bounded. Everything else about the folder
+    // was a restatement of one of those two — or a number written into a
+    // sentence, where it went stale the moment the dropdown changed it.
+    'settings.backup.count': '当前 {n} 份，实际占用 {size}。',
+    // NO "内含：…" LINE (user decision, 2026-11-02): its only job was to point at
+    // the per-plugin recovery while the fold was closed, and that entry is gone —
+    // a note advertising a deleted feature is worse than no note.
+    // MORE THAN ONE PROFILE (2026-11-02): the host cannot tell which profile to
+    // back up, so backups and rollbacks stop. Saying nothing would look like
+    // "everything is fine".
+    'settings.backup.multiProfile': '检测到多个 profile，备份和回滚已暂停：它不知道该备份哪一个。解决办法：启动时指定 DSH_PROFILE，或者只保留一个 profile。',
     'settings.backup.keep': '最多保留 {n} 份，超出自动删最旧的那份。',
+    // THE SECOND SENTENCE THE USER SAW TWICE IS GONE (user report, 2026-11-02):
+    // "最多保留 2 份" said the same thing as the line above, and the long
+    // paragraph about what the folder is for repeated the number a third time.
+    // Two lines say everything the page can promise; the dropdown below changes
+    // the number, so no sentence carries a frozen copy of it.
+    'settings.backup.kindsLocal': '链接安装（自己写的）和本地化过的插件（目录里有 .git）都已完整备份，可以回档。',
+    'settings.backup.kindsThirdParty': '第三方插件由插件作者维护，有异常建议重装',
+    'settings.backup.limitLabel': '保留份数',
+    // THE DISK WARNING SITS NEXT TO THE DROPDOWN (user report, 2026-11-02): it
+    // used to be a line BELOW the control, so the warning arrived after the
+    // choice was made. Same place in the tree, right of the select.
+    'settings.backup.limitHint': '备份会占用磁盘空间，建议尽量选更少的备份数。',
+    'settings.backup.limitAsk': '将删除 {remove} 份最旧的备份，删除后无法恢复。当前 {from} 份 → 保留 {to} 份。',
+    'settings.backup.limitConfirm': '确认删除并改为保留 {to} 份',
+    'settings.backup.limitCancel': '取消',
+    'settings.backup.limitDeleted': '已删除 {removed} 份，现在保留 {kept} 份。',
+    'settings.backup.limitMore': '已选 {requested} 份，实际保留 {kept} 份。',
+    'settings.backup.limitFailed': '没能改成功，份数保持原样。',
     'settings.backup.empty': '还没有备份；每次重启前会自动生成一份。',
     'settings.backup.path': '存放路径',
     'settings.backup.copyPath': '复制路径',
     'settings.backup.copied': '路径已复制',
     'settings.backup.copyFailed': '复制失败，请手动选中上面的路径',
     'settings.backup.time': '备份时间',
-    'settings.backup.size': '备份大小',
+    // THE SIZE OF ONE COPY IS NOT SHOWN, so its label is gone as well (user
+    // decision, 2026-11-02): a row is a time and a button, and the disk a copy
+    // needs is only stated once for the whole folder (`settings.backup.count`).
+    // A key nothing renders is a promise the page does not keep — the same reason
+    // the identity keys went.
     'settings.backup.withPlugins': '（含已装插件）',
     'settings.backup.withoutPlugins': '（不含已装插件）',
-    'settings.groups.report': '报告问题',
-    'settings.groups.rescue': '出事了怎么办',
+    // THE ONE LINE A COPY GETS WHEN IT IS NOT THE ONE (user decision,
+    // 2026-11-02): a copy automatic recovery would never use is still listed,
+    // but as a sentence with its time and its size — never as a card with a
+    // button next to it. Two wordings, because a seed and a restart snapshot are
+    // two different things to promise about.
+    'settings.backup.fallback.seed': '另有一份首装备份（只含设置、未验证，仅在前一份不可用时才用），{time}，{size}',
+    'settings.backup.fallback.other': '另有一份未验证的备份（不会被自动还原，仅在前一份不可用时才用），{time}，{size}',
+    // THE FOLD (user report, 2026-11-02): fifteen copies used to be fifteen
+    // sentences. The first two stay; the rest are behind this one line, and the
+    // line says how many and what they are worth.
+    'settings.backup.othersSummary': '另有 {n} 份重启前自动拍的备份（未验证，不会自动还原）',
+    // THE CERTIFICATE VOCABULARY IS GONE (user decision, 2026-11-02). Two rounds
+    // of deletion ended here: first the rendering stopped grading copies, then the
+    // labels and now the evidence sentences themselves. Nothing draws them any
+    // more — a copy is a time and a button — and a dictionary that still carried
+    // them could be picked up again by a later change without anyone noticing that
+    // it re-introduces a verdict the plugin cannot support.
+    'settings.backup.scopeLabel': '内容范围',
+    'settings.backup.scope.config-only': '只含配置',
+    'settings.backup.scope.config+plugins': '配置 + 已装插件',
+    'settings.backup.scope.config+links': '配置 + 链接插件',
+    'settings.backup.scope.slim': '精简份（配置 + 手装插件）',
+    'settings.backup.scopeMissing': '（没有记录）',
+    'settings.backup.interventionLabel': '这次启动有没有被系统介入',
+    'settings.backup.intervention.true': '有（自动救援动过手）',
+    'settings.backup.intervention.false': '没有',
+    'settings.backup.intervention.unknown': '没有记录',
+    // THE MANUAL ROLLBACK (user decision, 2026-10-30): the user may know better
+    // than "the newest proven copy", so ANY copy can be restored — but only
+    // after a card that says which one, what it replaces, and that a restart
+    // follows.
+    'settings.backup.rollback': '回退到这一份',
+    // THE ONE SENTENCE THE PAGE MAY SAY ABOUT A COPY (user decision, 2026-11-02).
+    //
+    // It hangs on exactly one copy — the one taken at the most recent startup —
+    // and it says only WHAT THAT COPY IS: the state the host last started from.
+    // It does not say the copy is good, because the plugin cannot know that: a
+    // plugin that fails to load is dropped and the host comes up anyway. Which
+    // copy to roll back to is the reader's call, and the sentence ends by saying
+    // so. Verbatim — do not reword.
+    'settings.backup.startupHint': '这是最近一次启动时的状态。DSH 能启动不代表插件都正常——坏掉的插件会被排除，主机照样起来。要回退到哪一份，请自己判断。',
+    'settings.backup.rollbackConfirmTitle': '确定回退到这一份？',
+    'settings.backup.rollbackConfirmBody': '会把 {time} 的那份备份还原到现在——**当前状态会被它覆盖**（覆盖前会先自动存一份当前快照，所以这次回退还能再退回来）。',
+    'settings.backup.rollbackConfirmRestart': '还原完成后会自动重启一次：回退前已自动存了一份可撤回的现场；回退后的这次重启不会再额外备份。重启期间这个页面会断开，回来后接着用。',
+    'settings.backup.rollbackConfirmYes': '确认回退',
+    'settings.backup.rollbackConfirmNo': '取消',
+    'settings.backup.rollbackBusy': '正在回退…',
+    'settings.backup.rollbackDone': '已回退，正在重启…',
+    'settings.backup.rollbackFailed': '回退没成功：{message}',
+    'settings.groups.report': '遇到问题',
+    'settings.groups.rescue': '桌面救援入口',
     'settings.rescue.hint': 'DSH 打不开的时候，用下面这两个脚本救自己（都不用 DSH 跑起来）。',
     'settings.rescue.restoreProfile': '回到上一次好状态',
     'settings.rescue.emergencyDisable': '只把这个插件摘掉',
@@ -390,12 +486,14 @@
     'settings.rescue.copyFailed': '复制失败，请手动选中上面的路径',
     'settings.rescue.reveal': '打开所在文件夹',
     'settings.rescue.which': '怎么选：整个环境坏了（改了配置、装了别的插件、升级崩了）→ 用「回到上一次好状态」；只怀疑这个插件 → 用「只把这个插件摘掉」。',
-    'settings.rescue.warning': '重要：这两个脚本是在 DSH 打不开的时候用的。DSH 正开着的时候用「回到上一次好状态」，会把你现在正在用的配置覆盖掉。',
+    'settings.rescue.warning': '重要：这个桌面入口和上面两个脚本，都只在你打不开 DSH 的时候用；DSH 正常开着的时候不要点它——用「回到上一次好状态」会把你现在正在用的配置覆盖掉。',
     'settings.rescue.rollbackOk': '自动回滚：可用（重启后起不来会自动回到上一个好状态）',
     'settings.rescue.rollbackBlocked': '自动回滚：**不可用** —— 这台电脑不允许创建计划任务。**会丢失：重启后 DSH 起不来时不会自动恢复**；出问题时请双击「出事了怎么办」里的还原脚本。',
     'settings.rescue.rollbackUnknown': '自动回滚：还不知道（这台机器的能力还没检查过）',
     'settings.rescue.watchdogTier': '看门狗的触发方式：{tier}',
     'settings.rescue.watchdogLast': '上一次看门狗的结果：{result}',
+    'settings.rescue.watchdogStrict': '上一次自动救援没有动手：找不到同时满足两个条件的备份——那份备份有过启动记录，而且那次启动没有系统介入过。请手动处理。',
+    'settings.rescue.watchdogRestoredFrom': "上一次自动救援还原的这一份：{dir}",
     'settings.rescue.tierScheduledTask': 'Windows 计划任务',
     'settings.rescue.tierSystemdRun': 'systemd 定时器',
     'settings.rescue.tierDetachedProcess': '自建后台进程',
@@ -403,6 +501,16 @@
     'settings.rescue.shortcut': '在桌面放一个快捷方式',
     'settings.rescue.shortcutDone': '已在桌面',
     'settings.rescue.noDesktop': '这台机器上没有桌面目录，所以放不了快捷方式（脚本的路径在上面，可以手动复制过去）。',
+    'settings.rescue.noDesktopPlatform': '网页版 / 服务器版没有桌面，所以没有这个一键入口；请用上面两个 .sh 脚本。',
+    // PLAN B (user decision, 2026-11-02): a host without a desktop shows the
+    // SAME rescue entry as a copyable command, not a dead-end explanation.
+    'settings.rescue.commandLabel': '救援入口（命令）',
+    'settings.rescue.copyCommand': '复制命令',
+    'settings.rescue.commandHint': '复制这条命令执行，效果和桌面上双击那个入口一样。',
+    'settings.rescue.commandUnavailable': '这台机器上没有找到可用的救援命令。',
+    'settings.rescue.shortcutScope': '它只能把整个环境退回上一次好状态，不能只摘掉某一个插件。',
+    'settings.rescue.shortcutBlocked': '系统策略不允许创建快捷方式（比如组策略或权限限制）。把下面的脚本路径复制出来，手动放到桌面：',
+    'settings.rescue.shortcutWriteFailed': '快捷方式没写成功：{message}。把下面的脚本路径复制出来，手动放到桌面：',
     'settings.rescue.shortcutFailed': '快捷方式没放成：{message}',
     'settings.rescue.revealFailed': '文件夹没打开：{message}',
     'settings.report.label': '遇到问题了？',
@@ -478,6 +586,50 @@
     'announcement.disabled': '按钮目前关闭，可在设置里打开。',
     'announcement.button': '知道了',
     'announcement.error': '没能记下来：{message}',
+    // THE PLUGIN THAT DID NOT LOAD (用户拍板 2026-11-01)：宿主照常起来，只是某个
+    // 插件这次没激活 —— 把这件事搬到前台，并且只给一个动作：只恢复这一个。
+    'pluginFailure.title': "有两件事要你看一下",
+        'watchdog.hint': "后面想改主意，可以到「插件」页里找 dsh-autorestart 的设置。",
+        'pluginFailure.hint': "这些功能已经记下来了，之后可以在「插件」页里再恢复。",
+        'settings.description': "自动重启 DSH、守护插件，出问题能一键恢复。",
+        'settings.restore': "恢复",
+        // THE TWO SENTENCES THAT REPLACED THE PER-PLUGIN THIRD-PARTY LINE (user
+    // correction, 2026-11-02). The old copy said "the backup holds only its name
+    // and version", which reads as "there is something in there" — and there is
+    // nothing: third-party plugins are NOT backed up. Built-in ones are shipped
+    // with DSH, so they need no backup and must not be reinstalled.
+    'settings.thirdParty': "这个插件不是你自己开发的，没法从备份恢复，需要重新安装。",
+        'settings.version': "版本 {version}",
+    'pluginFailure.dismiss': "知道了",
+    'pluginFailure.dismissLabel': "关掉这个提示（这次启动不再显示，下次启动会重新出现）",
+    'pluginFailure.certainTitle': "这些功能这次没起来",
+    'pluginFailure.certainIntro': "上次启动时这些功能还在，这次没有。这是已经发生的事，不是猜测。",
+    'pluginFailure.clueTitle': "这些插件跟备份不一样",
+    'pluginFailure.clueIntro': "这些插件的文件和最近一次备份不同。可能只是升级过，也可能有别的原因，所以这里只列出差异，不下结论。",
+    'pluginFailure.uiBlindSpot': "另外有 {count} 个界面模块这次没出现（它们没有对应到你安装的插件，所以不在这里列出）。",
+    'pluginFailure.restoreAll': "全部恢复（{count} 个）",
+    'pluginFailure.restoreAllDone': "恢复完成：{done} 个成功，{failed} 个没成功。",
+    'pluginFailure.close': "关掉这个提示",
+    'pluginFailure.linkedHint': "这个插件是你自己写在本地、以链接方式安装的，可以直接恢复到备份里的版本。",
+    'pluginFailure.thirdPartyHint': "这个插件是第三方安装的，备份里没有它的文件。要还原就用下面这条命令，它会装回原来的那个版本（不是最新版）：",
+    'pluginFailure.commandLabel': "复制这条命令",
+    'pluginFailure.noVersion': "备份里查不到它的精确版本，只能按插件名重新安装。",
+    'pluginFailure.restore': "只恢复 {plugin}",
+    'pluginFailure.restoring': "正在恢复 {plugin}…",
+    'pluginFailure.restored': "已经把 {plugin} 恢复到备份版本（备份时间 {at}）。",
+    'pluginFailure.failed': "{plugin} 恢复没有完成：{reason}",
+    'pluginFailure.noBackup': "这台机器没有可用备份，只能手动处理。",
+    'watchdog.title': "重启失败时，会自动帮你救回来",
+    'watchdog.explain': "这个插件自带自动救援：重启之后新版本一直起不来时，它会拿一份它自己认为可用的备份帮你恢复（判据是内容指纹一致、且那次启动起来了——这不代表里面的插件都正常），再把程序重新拉起来。它默认就是开着的。",
+    'watchdog.whereOff': "不想要的话，到设置页把「自动救援」的开关关掉就行——关掉之后，新版本起不来就只能手动处理了。",
+    'watchdog.gotIt': "知道了",
+    'watchdog.noticeSaved': "好的，就这一条提示，以后不会再弹了。",
+    'watchdog.warnOff': "关掉之后，万一新版本起不来，就只能手动处理了。",
+    'watchdog.keepOn': "开着（推荐）",
+    'watchdog.turnOff': "不要，我自己处理",
+    'watchdog.savedOn': "已开启：下次重启如果起不来，会自动帮你救回来。",
+    'watchdog.savedOff': "已关闭：下次重启如果起不来，不会自动救。",
+    'watchdog.saveFailed': "没能保存你的选择，设置没有变。请再点一次，或到设置页里改。",
     // THE COPY OF THE COMPOSER ROW. It is one SHORT line and never a sentence:
     // the long stage sentence was clipped away there (user report,
     // 2026-10-29). While the gate waits the pill keeps its own composed line
@@ -497,6 +649,12 @@
     'restart.overlay.size': '{done} / {total}',
     'restart.overlay.sizeDone': '{done}',
     'restart.overlay.restarting': '正在重启…',
+    // THE HONEST CARD (user report, 2026-10-30): a restart that was interrupted
+    // by a new conversation said "正在重启…" for 25 s, which was not true. It now
+    // says what actually happened — and it may stay, because it IS the truth.
+    'restart.overlay.deferred': '有新会话在跑，重启已暂缓',
+    'restart.overlay.deferredNote': '等它结束会自动继续 · 已等 {count} 个会话',
+    'restart.overlay.deferredNoteZero': '等它结束会自动继续',
     'restart.overlay.back': '已回来',
   }
 
@@ -542,8 +700,8 @@
     panelParkedGoal: 'session {session} · {goal}',
     panelWaiting: 'Waiting for {duration}',
     panelResume: 'This session resumes its progress automatically after the restart.',
-    // The long wait: the restart passed the hard deadline while a conversation
-    // was still running. The capsule is ONE clipped line of 22px: it holds a
+    // The long wait: the restart is still waiting while a conversation runs on.
+    // There is no deadline and nothing expires. The capsule is ONE clipped line: it holds a
     // number and a duration, NEVER a name. Every name goes into the tooltip,
     // where there is room for all of them.
     longWaitPill: ' · waiting for {duration} · {n} task(s) running',
@@ -558,6 +716,11 @@
     blockerMore: '… and {n} more',
     blockersTitleLine: 'Blocking sessions: {blockers}',
     durationSeconds: '{n}s',
+    'settings.restart.cancelledNote': 'The restart you asked for did not happen: you requested it at {at}, waited {waited}, and it was never carried out; after the host restarted, that request was cancelled. If you still want it, just ask once more.',
+    'restart.waitedSeconds': 'a few seconds',
+    'restart.waitedMinutes': 'about {n} min',
+    'restart.waitedHours': 'about {n}h {m}m',
+    'restart.waitedHoursExact': 'about {n}h',
     durationMinutes: '{n}m {m}s',
     durationHours: '{n}h {m}m',
     // The COMPACT duration of the capsule: it can afford "16 min", not
@@ -640,11 +803,14 @@
     'settings.restartGrace.value': '{n} seconds',
     'settings.restartGrace.immediate': 'Do not wait (restart right away)',
     'settings.backup.label': 'Backup before a restart',
-    'settings.backup.hint': 'Take a snapshot of the current configuration before every restart, so a host that cannot boot again is rolled back automatically.',
+    'settings.backup.details': 'Details',
+    'settings.backup.section': 'What is backed up, and the manual backup steps',
+    'settings.backup.hint': 'A copy is taken before every restart, so a host that cannot boot again is rolled back. What it holds: your settings (always); plugins you wrote and linked from a source directory (copied file by file); plugins downloaded from the internet (only which ones and which version are recorded — never copied; they are reinstalled from that list).',
     'settings.backupPlugins.label': 'Include the installed plugins in the backup',
     'settings.backupPlugins.hint': 'Off: only the state of DSH itself is backed up — the plugin directory of the profile is left out.',
-    'settings.groups.supervisor': 'Start at login',
-    'settings.supervisor.status': 'Started by',
+    'settings.restartBanner.title': 'This machine has no restart capability right now: this plugin will not restart, and will not take a backup before a restart. Press "Set it up for me" and I derive and write it — and that can be undone.',
+    'settings.restartBanner.fix': 'Set it up for me',
+    'settings.groups.supervisor': 'Start at login',    'settings.supervisor.status': 'Started by',
     'settings.supervisor.installed': 'the supervisor of this plugin',
     'settings.supervisor.external': 'your own way',
     'settings.supervisor.unknown': 'nobody knows',
@@ -702,6 +868,7 @@
   'settings.autostartKind.systemd-system': 'systemd system service',
   'settings.autostartKind.wsl-systemd': 'systemd inside WSL',
   'settings.autostartKind.wsl-no-systemd': 'WSL without systemd',
+  'settings.autostartKind.linux-no-systemd': 'Linux without systemd',
   'settings.autostartKind.container': 'a container',
   'settings.autostartKind.desktop': 'the desktop app itself',
   'settings.autostartKind.unknown': 'cannot tell',
@@ -717,19 +884,77 @@
     'meta.description': 'Keeps agent work alive across a DeepSeek Harness restart: a durable checkpoint, goal re-arm or a continuation message on boot, and an idle-aware graceful restart the agent can request itself.',
     'text.missing': '(this text is missing yet)',
     'settings.backup.list': 'What is backed up right now',
-    'settings.backup.count': '{n} copies right now',
+    'settings.backup.count': '{n} copies right now, using {size}.',
+    'settings.backup.multiProfile': 'More than one profile was found, so backups and rollbacks are paused: it cannot tell which one to back up. Fix it by starting with DSH_PROFILE set, or by keeping a single profile.',
     'settings.backup.keep': 'At most {n} copies are kept; the oldest one is deleted when there are more.',
+    'settings.backup.kindsLocal': 'Both linked plugins (written by hand) and localized ones (their directory has a .git) are in the copy in full, so they can be rolled back.',
+    'settings.backup.kindsThirdParty': 'Third-party plugins are maintained by their authors; if something is wrong, reinstall them.',
+    'settings.backup.limitLabel': 'Copies kept',
+    'settings.backup.limitHint': 'Backups take disk space, so it is best to keep as few copies as possible.',
+    'settings.backup.limitAsk': 'This deletes the {remove} oldest copies and cannot be undone. {from} copies now → {to} kept.',
+    'settings.backup.limitConfirm': 'Delete and keep {to}',
+    'settings.backup.limitCancel': 'Cancel',
+    'settings.backup.limitDeleted': 'Deleted {removed} copies; {kept} are kept now.',
+    'settings.backup.limitMore': 'You picked {requested}; {kept} are kept.',
+    'settings.backup.limitFailed': 'The change did not go through; the copy limit is unchanged.',
     'settings.backup.empty': 'No backup yet; one is written before every restart.',
     'settings.backup.path': 'Where they live',
     'settings.backup.copyPath': 'Copy the path',
     'settings.backup.copied': 'The path is on the clipboard',
     'settings.backup.copyFailed': 'The copy failed — please select the path above by hand',
     'settings.backup.time': 'Backup time',
-    'settings.backup.size': 'Backup size',
+    // THE SIZE OF ONE COPY IS NOT SHOWN, so its label is gone as well (user
+    // decision, 2026-11-02): a row is a time and a button, and the disk a copy
+    // needs is only stated once for the whole folder (`settings.backup.count`).
+    // A key nothing renders is a promise the page does not keep — the same reason
+    // the identity keys went.
     'settings.backup.withPlugins': '(plugins included)',
     'settings.backup.withoutPlugins': '(plugins excluded)',
-    'settings.groups.report': 'Report a problem',
-    'settings.groups.rescue': 'If DSH will not start',
+    // THE ONE LINE A COPY GETS WHEN IT IS NOT THE ONE (user decision,
+    // 2026-11-02): listed, but as a sentence with its time and its size — never
+    // as a card with a button next to it.
+    'settings.backup.fallback.seed': 'There is also a first-install seed copy (settings only, not verified, used only when the copy above is unavailable), {time}, {size}',
+    'settings.backup.fallback.other': 'There is also an unverified copy (never restored automatically, used only when the copy above is unavailable), {time}, {size}',
+    'settings.backup.othersSummary': '{n} more pre-restart snapshots (unverified, never restored automatically)',
+    // THE CERTIFICATE VOCABULARY IS GONE (user decision, 2026-11-02). Two rounds
+    // of deletion ended here: first the rendering stopped grading copies, then the
+    // labels and now the evidence sentences themselves. Nothing draws them any
+    // more — a copy is a time and a button — and a dictionary that still carried
+    // them could be picked up again by a later change without anyone noticing that
+    // it re-introduces a verdict the plugin cannot support.
+    'settings.backup.scopeLabel': 'What it holds',
+    'settings.backup.scope.config-only': 'configuration only',
+    'settings.backup.scope.config+plugins': 'configuration and installed plugins',
+    'settings.backup.scope.config+links': 'configuration and linked plugins',
+    'settings.backup.scope.slim': 'slim copy (configuration and by-hand plugins)',
+    'settings.backup.scopeMissing': '(not recorded)',
+    'settings.backup.interventionLabel': 'Was this boot rescued by the system',
+    'settings.backup.intervention.true': 'yes, the watchdog restored a copy',
+    'settings.backup.intervention.false': 'no, nothing had to step in',
+    'settings.backup.intervention.unknown': 'not recorded',
+    // THE MANUAL ROLLBACK (user decision, 2026-10-30): any copy can be restored
+    // — but only after a card that says which one, what it replaces, and that
+    // a restart follows.
+    'settings.backup.rollback': 'Roll back to this copy',
+    // THE ONE SENTENCE THE PAGE MAY SAY ABOUT A COPY (user decision, 2026-11-02).
+    //
+    // It hangs on exactly one copy — the one taken at the most recent startup —
+    // and it says only WHAT THAT COPY IS: the state the host last started from.
+    // It does not say the copy is good, because the plugin cannot know that: a
+    // plugin that fails to load is dropped and the host comes up anyway. Which
+    // copy to roll back to is the reader's call, and the sentence ends by saying
+    // so. Verbatim — do not reword.
+    'settings.backup.startupHint': 'This is the state at the most recent startup. DSH starting does not mean every plugin is healthy — a broken plugin is excluded and the host still boots. Which copy to roll back to is your call.',
+    'settings.backup.rollbackConfirmTitle': 'Roll back to this copy?',
+    'settings.backup.rollbackConfirmBody': 'The backup from {time} will be restored over the current state — **what you have now is replaced** (a snapshot of it is taken first, so this rollback can be undone).',
+    'settings.backup.rollbackConfirmRestart': 'A restart follows automatically: a restorable copy of what was here before the rollback was already saved; this restart takes no further backup. This page disconnects during the restart and works again afterwards.',
+    'settings.backup.rollbackConfirmYes': 'Roll back',
+    'settings.backup.rollbackConfirmNo': 'Cancel',
+    'settings.backup.rollbackBusy': 'Rolling back…',
+    'settings.backup.rollbackDone': 'Rolled back — restarting…',
+    'settings.backup.rollbackFailed': 'The rollback did not work: {message}',
+    'settings.groups.report': 'Something is wrong',
+    'settings.groups.rescue': 'Desktop rescue',
     'settings.rescue.hint': 'When DSH does not come up, these two scripts rescue it for you (neither of them needs DSH running).',
     'settings.rescue.restoreProfile': 'Back to the last good state',
     'settings.rescue.emergencyDisable': 'Take this plugin out only',
@@ -739,12 +964,14 @@
     'settings.rescue.copyFailed': 'The copy failed — please select the path above by hand',
     'settings.rescue.reveal': 'Open the folder',
     'settings.rescue.which': 'Which one: the whole environment is broken (a changed configuration, another plugin, a bad upgrade) → "Back to the last good state"; only this plugin is suspect → "Take this plugin out only".',
-    'settings.rescue.warning': 'Important: these two scripts are for when DSH does not come up. Using "Back to the last good state" while DSH is running overwrites the configuration you are working with right now.',
+    'settings.rescue.warning': 'Important: this desktop entry and the two scripts above are for when DSH does not come up. Do not click it while DSH is running — "Back to the last good state" overwrites the configuration you are working with right now.',
     'settings.rescue.rollbackOk': 'Automatic rollback: available (a host that does not come up after a restart goes back to the last good state)',
     'settings.rescue.rollbackBlocked': 'Automatic rollback: **not available** — this computer does not allow creating scheduled tasks. **What you lose: DSH will NOT recover by itself when it does not come up after a restart**; when it breaks, double-click the restore script in "If DSH will not start".',
     'settings.rescue.rollbackUnknown': 'Automatic rollback: not known yet (this machine has not been checked)',
     'settings.rescue.watchdogTier': 'How the watchdog is triggered: {tier}',
     'settings.rescue.watchdogLast': 'The last watchdog run: {result}',
+    'settings.rescue.watchdogStrict': 'The last watchdog run did NOT act: no backup satisfies both conditions — it records a startup, and that startup had no system intervention. Please handle it by hand.',
+    'settings.rescue.watchdogRestoredFrom': "The copy the last watchdog run restored: {dir}",
     'settings.rescue.tierScheduledTask': 'a Windows scheduled task',
     'settings.rescue.tierSystemdRun': 'a systemd timer',
     'settings.rescue.tierDetachedProcess': 'a detached background process',
@@ -752,6 +979,14 @@
     'settings.rescue.shortcut': 'Put a shortcut on the desktop',
     'settings.rescue.shortcutDone': 'It is on the desktop',
     'settings.rescue.noDesktop': 'This machine has no desktop directory, so no shortcut can be placed (the paths are above — copy them by hand).',
+    'settings.rescue.noDesktopPlatform': 'The web / server version has no desktop, so there is no one-click entry here; use the two .sh scripts above.',
+    'settings.rescue.commandLabel': 'Rescue entry (command)',
+    'settings.rescue.copyCommand': 'Copy the command',
+    'settings.rescue.commandHint': 'Copy this command and run it — the same effect as double-clicking the desktop entry.',
+    'settings.rescue.commandUnavailable': 'No usable rescue command was found on this machine.',
+    'settings.rescue.shortcutScope': 'It can only put the WHOLE environment back to the last good state — it cannot take one plugin out.',
+    'settings.rescue.shortcutBlocked': 'A system policy does not allow creating the shortcut (a group policy or a permission limit). Copy the script path below and put it on the desktop by hand:',
+    'settings.rescue.shortcutWriteFailed': 'The shortcut was not written: {message}. Copy the script path below and put it on the desktop by hand:',
     'settings.rescue.shortcutFailed': 'The shortcut was not placed: {message}',
     'settings.rescue.revealFailed': 'The folder did not open: {message}',
     'settings.report.label': 'Something wrong?',
@@ -827,6 +1062,46 @@
     'announcement.disabled': 'The button is currently switched off; you can turn it on in the settings.',
     'announcement.button': 'Got it',
     'announcement.error': 'Could not record it: {message}',
+    // THE PLUGIN THAT DID NOT LOAD (user decision 2026-11-01): the host came up,
+    // one plugin simply did not activate this time. Say so, and offer exactly
+    // one action: put THIS one plugin back.
+    'pluginFailure.title': "Two things worth a look",
+        'watchdog.hint': "Changed your mind later? Look for the dsh-autorestart settings on the Plugins page.",
+        'pluginFailure.hint': "These are on record - you can restore them later from the Plugins page.",
+        'settings.description': "Restarts DSH, watches your plugins, and puts back the ones it can.",
+        'settings.restore': "Restore",
+    'settings.thirdParty': "You did not write this plugin yourself, so it cannot be restored from the backup - it has to be reinstalled.",
+        'settings.version': "version {version}",
+    'pluginFailure.dismiss': "Got it",
+    'pluginFailure.dismissLabel': "Hide this for now (it comes back on the next start)",
+    'pluginFailure.certainTitle': "These features did not come up this time",
+    'pluginFailure.certainIntro': "They were there on the previous start and are not here now. That is something that happened, not a guess.",
+    'pluginFailure.clueTitle': "These plugins differ from the backup",
+    'pluginFailure.clueIntro': "The files of these plugins are not what the latest backup holds. They may simply have been upgraded - this block lists a difference, not a conclusion.",
+    'pluginFailure.uiBlindSpot': "Also {count} interface module(s) did not appear this time (they do not map to a plugin you installed, so they are not listed here).",
+    'pluginFailure.restoreAll': "Restore all ({count})",
+    'pluginFailure.restoreAllDone': "Done: {done} restored, {failed} not restored.",
+    'pluginFailure.close': "Dismiss this notice",
+    'pluginFailure.linkedHint': "You wrote this plugin yourself and installed it as a link, so it can be put back from the backup directly.",
+    'pluginFailure.thirdPartyHint': "This plugin was installed from elsewhere and the backup does not hold its files. To put it back, use the command below: it reinstalls the same version (not the latest one):",
+    'pluginFailure.commandLabel': "Copy this command",
+    'pluginFailure.noVersion': "The backup does not record its exact version, so it can only be reinstalled by name.",
+    'pluginFailure.restore': "Restore {plugin} only",
+    'pluginFailure.restoring': "Restoring {plugin}…",
+    'pluginFailure.restored': "{plugin} was put back to the backup version (backup taken {at}).",
+    'pluginFailure.failed': "{plugin} was not restored: {reason}",
+    'pluginFailure.noBackup': "There is no usable backup on this machine; it has to be handled by hand.",
+    'watchdog.title': "If a restart fails, it can rescue you automatically",
+    'watchdog.explain': "This plugin ships with an automatic rescue: when a newly restarted version never comes up, it restores a backup it considers usable (the criterion is that the content fingerprint matched and that boot came up — it does not mean the plugins inside are all fine), then starts the program again. It is on by default.",
+    'watchdog.whereOff': "If you do not want it, turn it off on the settings page — with it off, a new version that does not start has to be handled by hand.",
+    'watchdog.gotIt': "Got it",
+    'watchdog.noticeSaved': "That is the only notice; it will not appear again.",
+    'watchdog.warnOff': "With it off, a new version that does not start has to be handled by hand.",
+    'watchdog.keepOn': "Keep it on (recommended)",
+    'watchdog.turnOff': "No, I will handle it",
+    'watchdog.savedOn': "The watchdog is on: the next restart is protected.",
+    'watchdog.savedOff': "The watchdog is off: the next restart will not roll back on its own.",
+    'watchdog.saveFailed': "Your choice was not saved, so the watchdog setting is unchanged. Please try again, or change it on the settings page.",
     // THE COPY OF THE COMPOSER ROW (see the Chinese block): one short line,
     // never a sentence.
     'restart.stage.snapshotting': 'Backing up…',
@@ -837,6 +1112,9 @@
     'restart.overlay.size': '{done} / {total}',
     'restart.overlay.sizeDone': '{done}',
     'restart.overlay.restarting': 'Restarting…',
+    'restart.overlay.deferred': 'A conversation just started — restart postponed',
+    'restart.overlay.deferredNote': 'It will retry automatically when idle · {count} waiting',
+    'restart.overlay.deferredNoteZero': 'It will retry automatically when idle',
     'restart.overlay.back': 'Back again',
   }
 
@@ -906,20 +1184,49 @@
    * ever sees a key name, in any language.
    *
    * @param {Function|null|undefined} t the Host's translator (may be missing)
-   * @returns {(key: string) => string}
+   * @returns {(key: string, params?: object) => string}
    */
   function makeTranslate(t) {
-    return (key) => {
+    /**
+     * `{name}` ANSWERED FROM `params` (user report, 2026-11-02).
+     *
+     * THE BUG THIS FIXES: this translator took ONE argument, so every call that
+     * passed replacement values had them silently dropped and the page printed
+     * the placeholder itself ("看门狗的触发方式：{tier}"). Three call sites did
+     * exactly that; the ones that substitute by hand were never affected.
+     *
+     * THE RULES, each one a decision:
+     *   - a placeholder with NO value stays as it is: blanking it would delete
+     *     information the sentence was written to carry;
+     *   - the value is inserted as literal text, so `$&` / `$1` are characters
+     *     and not replace patterns (hence split + join, never `replace`);
+     *   - every occurrence is replaced, not only the first;
+     *   - a `null` / `undefined` value counts as "no value", never as the word
+     *     `null` printed on screen.
+     */
+    const fillPlaceholders = (text, params) => {
+      if (typeof text !== 'string' || text === '') return text
+      if (params === null || params === undefined || typeof params !== 'object') return text
+      let out = text
+      for (const [name, value] of Object.entries(params)) {
+        if (value === null || value === undefined) continue
+        const placeholder = '{' + name + '}'
+        if (out.includes(placeholder) !== true) continue
+        out = out.split(placeholder).join(String(value))
+      }
+      return out
+    }
+    return (key, params) => {
       const name = typeof key === 'string' ? key : String(key ?? '')
       if (typeof t === 'function') {
         try {
           const value = t(name)
-          if (typeof value === 'string' && value !== '' && value !== name) return value
+          if (typeof value === 'string' && value !== '' && value !== name) return fillPlaceholders(value, params)
         } catch {
           // A broken translator must not break the surface.
         }
       }
-      return dictionaryText(name, currentLanguage())
+      return fillPlaceholders(dictionaryText(name, currentLanguage()), params)
     }
   }
 
@@ -1105,7 +1412,58 @@
       : fillTemplate(translate('durationHoursMinutesShort'), { n: hours, m: rest })
   }
 
+   /**
+    * A WAIT, SAID THE WAY A PERSON SAYS IT (user report, 2026-11-03).
+    *
+    * Precision is not the point, recognition is: "约 2 小时 21 分" is what makes a
+    * user believe the page looked at THEIR request. Seconds are rounded to words on
+    * purpose — "47 秒" invites a precision nobody needs.
+    */
+   function humanWait(ms, translate) {
+     const t = makeTranslate(translate)
+     const value = Number(ms)
+     if (Number.isFinite(value) !== true || value < 0) return ''
+     if (value < 60_000) return t('restart.waitedSeconds')
+     const totalMinutes = Math.floor(value / 60_000)
+     if (totalMinutes < 60) return fillTemplate(t('restart.waitedMinutes'), { n: totalMinutes })
+     const hours = Math.floor(totalMinutes / 60)
+     const rest = totalMinutes % 60
+     return rest === 0
+       ? fillTemplate(t('restart.waitedHoursExact'), { n: hours })
+       : fillTemplate(t('restart.waitedHours'), { n: hours, m: rest })
+   }
+
+   /** `2026-11-02T23:04:38+08:00` -> `2026-11-02 23:04:38` (the offset is the host's; no Date parsing). */
+   function humanRequestedAt(raw) {
+     const text = typeof raw === 'string' ? raw.trim() : ''
+     if (text.length < 19) return ''
+     return text.slice(0, 10) + ' ' + text.slice(11, 19)
+   }
+
+   /**
+    * THE ONE SENTENCE ABOUT A REQUEST THAT DIED (user decision, 2026-11-03).
+    *
+    * ONLY the newest request is looked at, and only the outcome "the host came back
+    * and settled it" is spoken about. A stale record must not follow the user around,
+    * and a request that simply completed is not news.
+    *
+    * @returns {{ text: string, at: string, waited: string }|null}
+    */
+   function cancelledRestartNote(info, translate) {
+     const request = info && typeof info === 'object' && info.restartRequest && typeof info.restartRequest === 'object'
+       ? info.restartRequest
+       : null
+     if (request === null) return null
+     if (request.state !== 'cancelled' || request.by !== 'boot-recovery') return null
+     const at = humanRequestedAt(request.requestedAtLocal)
+     const waited = humanWait(request.waitedMs, translate)
+     if (at === '' || waited === '') return null
+     const t = makeTranslate(translate)
+     return { text: fillTemplate(t('settings.restart.cancelledNote'), { at, waited }), at, waited }
+   }
+
   /* ------------------------------------------------------------------ *
+
    * The blocker lists: ONE rule for every surface that names them.
    *
    * The defect the real machine showed: the pending-restart bubble grew a
@@ -1653,8 +2011,8 @@
   /**
    * The note of a LONG wait.
    *
-   * The Host says that the pending restart passed the hard deadline while a
-   * conversation was still running. That is not "a little longer" any more, so
+   * The Host says that the pending restart is still waiting while a conversation
+   * runs on (there is no deadline). That is not "a little longer", so
    * the bubble says it out loud: how long the restart has been waiting and who
    * holds it. The note is empty when there is no long wait.
    *
@@ -1916,7 +2274,7 @@
     return root + '?title=' + encodeURIComponent(safeTitle) + '&body=' + encodeURIComponent(safeBody);
   }
 
-  
+
 
   /**
    * Copy a text to the clipboard — with a FALLBACK.
@@ -2090,6 +2448,117 @@
     return Math.round(value) + ' B'
   }
 
+  /**
+   * THE GRADING OF COPIES IS GONE (user decision, 2026-11-02).
+   *
+   * The page used to sort every copy into an identity and let only one of them
+   * carry a verdict — a source plus a criterion ("full-checks" AND
+   * "fingerprint-match") had to agree before a row was allowed to look better
+   * than the others. Two things were wrong with that and the user ruled both
+   * out: the verdict was read as "the plugins in it are fine", which a boot
+   * cannot establish (a plugin that fails to load is dropped and the host comes
+   * up anyway), and on a hosted instance nothing ever qualified, so the good tier
+   * stayed empty while every real copy sat in the demoted row.
+   *
+   * So there is no `isSafeBackup`, no identity key and no per-copy label any
+   * more: a row is a time and a button. What replaces the question is one fact
+   * the page can state honestly — WHICH COPY IS THE STATE THE HOST LAST STARTED
+   * FROM — and that is `startupCopyName` below.
+   */
+
+  /**
+   * The moment a copy says it was taken, read from the copy's OWN record.
+   *
+   * `takenAt` is the take time under the name the Host records it with; `at` is
+   * the number the same manifest has carried for longer. Either may arrive as a
+   * number of milliseconds or as an ISO string. A copy that says neither cannot
+   * answer the question, and gets no sentence at all — silence beats a guess.
+   *
+   * @param {object|null|undefined} item one backup of the state payload
+   * @returns {number|null}
+   */
+  function copyTakeTime(item) {
+    if (!item) return null
+    for (const value of [item.takenAt, item.at]) {
+      if (typeof value === 'number' && Number.isFinite(value)) return value
+      if (typeof value === 'string' && value !== '') {
+        const parsed = Date.parse(value)
+        if (Number.isFinite(parsed)) return parsed
+      }
+    }
+    return null
+  }
+
+  /**
+   * WHICH COPY WAS TAKEN AT THE MOST RECENT STARTUP? (user decision, 2026-11-02)
+   *
+   * The answer is the copy whose own record carries the latest take time: that is
+   * the state the host was started from the last time it came up. It is
+   * deliberately NOT "the first row of the list" — the row order is a rendering
+   * detail, and a page that read its fact from the row order would move the one
+   * sentence onto a different copy the day the order changes (or silently onto
+   * the wrong copy when the list is not sorted).
+   *
+   * Nothing here judges the copy: the sentence this name selects says what the
+   * copy IS, never that it is healthy.
+   *
+   * @param {Array<object>|null|undefined} items the copies as the Host reports them
+   * @returns {string|null} the name of that copy, or null when no copy can say
+   */
+  function startupCopyName(items) {
+    if (!Array.isArray(items)) return null
+    let best = null
+    for (const item of items) {
+      if (!item || typeof item.name !== 'string' || item.name === '') continue
+      const at = copyTakeTime(item)
+      if (at === null) continue
+      if (best === null || at > best.at) best = { name: item.name, at }
+    }
+    return best === null ? null : best.name
+  }
+
+  /**
+   * THE TWO KEY MAPPERS OF THE CERTIFICATE VOCABULARY ARE GONE (user decision,
+   * 2026-11-02). One named the source that "signed" a copy, the other the
+   * criterion that backed it; both existed only to pick a per-copy sentence out
+   * of the dictionary. No row grades a copy any more, so once the list stopped
+   * rendering identities they had no caller left — deleted rather than kept as a
+   * hook a later change could quietly revive. Their dictionary entries went with
+   * them: the whole "who certified it" family is not in this file any more.
+   */
+
+  /** Which dictionary entry describes what a copy holds. */
+  function backupScopeKey(contentScope) {
+    if (contentScope === 'config-only') return 'config-only'
+    if (contentScope === 'config+plugins') return 'config+plugins'
+    if (contentScope === 'config+links') return 'config+links'
+    if (contentScope === 'slim') return 'slim'
+    return ''
+  }
+
+  /**
+   * Whether this boot was rescued by the system, in three answers.
+   *
+   * `null` is NOT "no": the Host says `null` when nobody recorded anything, and
+   * the two must not be merged — "it did not happen" and "we do not know" lead a
+   * reader to different conclusions.
+   */
+  function backupInterventionKey(intervention) {
+    if (intervention === true) return 'true'
+    if (intervention === false) return 'false'
+    return 'unknown'
+  }
+
+  /**
+   * The version a copy was proven with, or an empty string when it carries none.
+   *
+   * @param {object|null|undefined} item one backup of the state payload
+   * @returns {string}
+   */
+  function backupVersionOf(item) {
+    return item && typeof item.version === 'string' && item.version !== '' ? item.version : ''
+  }
+
   /**
    * The local time of one backup, to the minute.
    *
@@ -2192,6 +2661,134 @@
    * @param {Function} [translator]
    * @returns {string}
    */
+  /**
+   * HOW LONG THE "RESTART POSTPONED" CARD STAYS ON SCREEN (milliseconds).
+   *
+   * THE REPORT (user, 2026-10-30): "after the interruption I still have a lot of
+   * work to do — a card hovering for ever is in the way". The postponed card is an
+   * ANNOUNCEMENT, not a progress bar: it says what happened for four seconds and
+   * then folds away, while the capsule keeps saying "pending restart · waiting for
+   * N sessions". A NEW postponement (a new stage timestamp) announces itself again.
+   *
+   * The stages that really are running ('snapshotting', 'restarting') are not
+   * affected: they stay while the work lasts.
+   */
+  const RESTART_DEFERRED_CARD_MS = 4000
+
+  /**
+   * HOW LONG A STAGE MAY GO UNMENTIONED BEFORE THE CARD STOPS TRUSTING IT.
+   *
+   * WHY (user report, 2026-10-29): a restart was postponed (a conversation
+   * became active again) right after the copy, and the card kept saying
+   * "DSH 重启前备份中" for ever — the stage on disk had not been brought back to
+   * 'waiting'. The Host is fixed, but the interface must not be able to hang on
+   * a stale stage either: a stage is evidence only while it keeps being
+   * refreshed.
+   */
+  const RESTART_STAGE_STALE_MS = 15000
+  // While files are being copied the Host refreshes the stage on every progress
+  // tick, so ten silent seconds mean the copy is no longer reporting — either it
+  // is over or nobody is copying any more. A 'restarting' stage has no progress
+  // of its own and only has to stay inside the stale window above.
+  const RESTART_SNAPSHOT_FRESH_MS = 10000
+
+  /**
+   * THE TWO CADENCES OF THE SHARED POLL (milliseconds).
+   *
+   * 2 s is right for a page that merely shows whether a restart is pending: a
+   * pending restart sits there for minutes. While a restart is MOVING, though,
+   * the stage can flip at any moment (a conversation starts, the host postpones
+   * the restart, the card has to change its words) — and 2 s of the wrong word is
+   * exactly what the owner complained about. So the cadence follows the state.
+   */
+  const POLL_MS = 2000
+  const POLL_FAST_MS = 500
+
+  /**
+   * IS A RESTART MOVING RIGHT NOW?
+   *
+   * 'waiting' counts as well: the restart is requested and the gate may open (or
+   * a conversation may appear) at any moment — that is exactly when the card must
+   * change its words within a second.
+   *
+   * @param {object|null} info the state payload of the Host
+   * @returns {boolean}
+   */
+  function isRestartMoving(info) {
+    if (!info || typeof info !== 'object') return false
+    if (info.pendingRestart !== true) return false
+    const stage = info.restartPhase
+    const phase = stage && typeof stage.phase === 'string' ? stage.phase : ''
+    return phase === 'waiting' || phase === 'snapshotting' || phase === 'restarting'
+  }
+
+  /**
+   * The cadence the CURRENT state asks for.
+   *
+   * @param {object|null} info the state payload of the Host
+   * @returns {number} milliseconds
+   */
+  function pollIntervalFor(info) {
+    return isRestartMoving(info) ? POLL_FAST_MS : POLL_MS
+  }
+
+  /**
+   * Is the page on screen? A hidden tab has nobody to tell, so it must not spin
+   * (and it asks once more as soon as it is visible again).
+   *
+   * @returns {boolean}
+   */
+  function isPageVisible() {
+    if (typeof document === 'undefined' || !document) return true
+    if (document.hidden === true) return false
+    if (typeof document.visibilityState === 'string') return document.visibilityState !== 'hidden'
+    return true
+  }
+
+  /**
+   * IS THE RESTART POSTPONED BY A CONVERSATION? (the Host says so in `reason`)
+   *
+   * A postponed restart is a stage of 'waiting' with a reason that starts with
+   * "deferred:" (see the Host's deferRestartStage). That state is NOT an activity,
+   * so it is drawn differently: the card names the interruption and promises the
+   * retry, and the word "正在重启" never appears for it.
+   *
+   * @param {object|null} stage the `restartPhase` of the state route
+   * @returns {boolean}
+   */
+  function isRestartStageDeferred(stage) {
+    if (!stage || typeof stage !== 'object') return false
+    if (stage.phase !== 'waiting') return false
+    return typeof stage.reason === 'string' && stage.reason.indexOf('deferred:') === 0
+  }
+
+  /**
+   * Is the reported stage still something the card may draw?
+   *
+   * The card is an ALARM about something happening right now: 'snapshotting'
+   * (files are being copied) or 'restarting' (the host is going down). A stage
+   * that nobody refreshed for 15 s (10 s for a copy, which refreshes on every
+   * file) describes something that is not happening any more, and drawing it
+   * would leave a card hanging — exactly the bug to avoid. The pill keeps
+   * telling the user the restart is still pending; the card simply stops
+   * claiming progress.
+   *
+   * @param {object|null} stage the `restartPhase` of the state route
+   * @param {number} now
+   * @returns {boolean}
+   */
+  function isRestartStageLive(stage, now) {
+    const phase = stage && typeof stage.phase === 'string' ? stage.phase : ''
+    if (phase !== 'snapshotting' && phase !== 'restarting') return false
+    const at = stage && Number.isFinite(Number(stage.at)) ? Number(stage.at) : null
+    // No timestamp at all: the stage cannot be trusted to describe "now".
+    if (at === null || at <= 0) return false
+    const age = Math.max(0, now - at)
+    if (age > RESTART_STAGE_STALE_MS) return false
+    if (phase === 'restarting') return true
+    return age <= RESTART_SNAPSHOT_FRESH_MS
+  }
+
   function restartOverlayTitle(stage, translator) {
     const phase = stage && typeof stage === 'object' && typeof stage.phase === 'string' ? stage.phase : ''
     if (!isRestartOverlayPhase(phase)) return ''
@@ -2275,6 +2872,19 @@
     // The stage of a restart on the two surfaces that have room for it: the
     // composer row (one short line) and the centred overlay (the detail).
     isRestartOverlayPhase,
+    // Is the reported stage still worth a card? (a stale stage cannot hang it)
+    isRestartStageLive,
+    isRestartStageDeferred,
+    RESTART_DEFERRED_CARD_MS,
+    // The cadence of the shared poll: fast while a restart is moving, and no
+    // polling at all in a hidden tab.
+    isRestartMoving,
+    pollIntervalFor,
+    isPageVisible,
+    POLL_MS,
+    POLL_FAST_MS,
+    RESTART_STAGE_STALE_MS,
+    RESTART_SNAPSHOT_FRESH_MS,
     restartPillStageText,
     restartOverlayTitle,
     // The size with the unit that fits it ("92 KB", "156 MB"): a hosted profile
@@ -2316,6 +2926,12 @@
       const ROUTE_PREFIX = HEALTH_URL.split('?')[0].replace(/\/[^/]*$/, '')
       const DEFAULT_PARK_URL = ROUTE_PREFIX + '/park'
       const DEFAULT_CANCEL_URL = ROUTE_PREFIX + '/cancel'
+      // The route of the MANUAL ROLLBACK (restore ONE copy the user picked).
+      const DEFAULT_ROLLBACK_URL = ROUTE_PREFIX + '/rollback-to'
+      // The route that writes the copy limit (how many backups to keep). It has a
+      // default for the same reason the rollback does: this page must not depend
+      // on an optional field of the state payload to be able to send a write.
+      const DEFAULT_BACKUP_LIMIT_URL = ROUTE_PREFIX + '/backup-limit'
       // The route that persists the one-time install choice.
       const DEFAULT_CHOICE_URL = ROUTE_PREFIX + '/choice'
       // The browser-side record of the one-time install choice. The prompt is
@@ -2329,7 +2945,8 @@
        * the fallback for a Host that is older than the supervisor.
        */
       const DEFAULT_SUPERVISOR_URL = '/__dsh_autorestart/supervisor'
-      const POLL_MS = 2000
+      // The cadence lives with the state it follows (see POLL_MS/POLL_FAST_MS
+      // above): the shared poll speeds up while a restart is moving.
       // The brand accent (blue-purple). The pending-restart marker is a brand
       // signal, not a warning: no warning/yellow token is used here.
       const BRAND = 'var(--dsw-alias-brand-primary, #5b8def)'
@@ -2405,11 +3022,15 @@
         info: null,
         listeners: new Set(),
         timer: null,
+        // The cadence the current timer was armed with (0 = not armed).
+        interval: 0,
         inFlight: false,
         controller: null,
         // When the pending state was FIRST observed, so the details panel can
         // say how long this session has been waiting.
         pendingSince: null,
+        // The visibility listener is bound once, on the first subscriber.
+        visibilityBound: false,
       }
 
       function notifyListeners() {
@@ -2442,8 +3063,63 @@
         }
       }
 
+      /**
+       * (Re-)arm the shared timer with the cadence the state asks for.
+       *
+       * THE CADENCE IS RE-DECIDED AFTER EVERY ANSWER: a restart that starts makes
+       * the next tick 500 ms away, a restart that ends puts it back to 2 s, and a
+       * hidden page is not polled at all (an interval in a background tab only
+       * spends battery — it asks once as soon as it is visible again).
+       *
+       * Re-arming only happens when the cadence really changed, so the ticks stay
+       * evenly spaced and never pile up.
+       */
+      function armPoll() {
+        if (stateStore.listeners.size === 0) return
+        const wanted = isPageVisible() ? pollIntervalFor(stateStore.info) : 0
+        if (wanted === 0) {
+          if (stateStore.timer !== null) {
+            clearInterval(stateStore.timer)
+            stateStore.timer = null
+          }
+          stateStore.interval = 0
+          return
+        }
+        if (stateStore.timer !== null && stateStore.interval === wanted) return
+        if (stateStore.timer !== null) clearInterval(stateStore.timer)
+        stateStore.interval = wanted
+        stateStore.timer = setInterval(() => {
+          pollOnce().then(armPoll)
+        }, wanted)
+      }
+
+      /**
+       * Ask once more as soon as the page is back on screen.
+       *
+       * A hidden tab stops polling; coming back must not wait for the next tick of
+       * a timer that was stopped, so the visibility event polls immediately and
+       * then re-arms the cadence.
+       */
+      function bindVisibility() {
+        if (stateStore.visibilityBound) return
+        if (typeof document === 'undefined' || !document || typeof document.addEventListener !== 'function') return
+        stateStore.visibilityBound = true
+        document.addEventListener('visibilitychange', () => {
+          if (stateStore.listeners.size === 0) return
+          if (!isPageVisible()) {
+            armPoll()
+            return
+          }
+          pollOnce().then(armPoll)
+          armPoll()
+        })
+      }
+
       async function pollOnce() {
+        // ONE REQUEST AT A TIME: a slow answer must never stack up a queue.
         if (stateStore.inFlight) return
+        // Nobody is looking at a hidden tab; the next visible moment asks.
+        if (!isPageVisible()) return
         stateStore.inFlight = true
         try {
           const response = await fetch(HEALTH_URL, {
@@ -2482,8 +3158,9 @@
         stateStore.listeners.add(listener)
         if (stateStore.listeners.size === 1) {
           stateStore.controller = new AbortController()
-          pollOnce()
-          stateStore.timer = setInterval(pollOnce, POLL_MS)
+          bindVisibility()
+          pollOnce().then(armPoll)
+          armPoll()
         }
         return () => {
           stateStore.listeners.delete(listener)
@@ -2492,6 +3169,7 @@
               clearInterval(stateStore.timer)
               stateStore.timer = null
             }
+            stateStore.interval = 0
             if (stateStore.controller) {
               stateStore.controller.abort()
               stateStore.controller = null
@@ -2688,6 +3366,59 @@
         return DEFAULT_CANCEL_URL
       }
 
+      /**
+       * The route that restores ONE backup the user picked (the manual
+       * rollback): the one the Host sent with the state payload, or the derived
+       * default. It never carries a path — only a backup NAME goes in the body.
+       */
+      function rollbackUrlFor(info) {
+        const sent = info && typeof info.rollbackUrl === 'string' ? info.rollbackUrl.trim() : ''
+        if (sent.startsWith('/')) return sent
+        return DEFAULT_ROLLBACK_URL
+      }
+
+      /**
+       * The route that writes the backup copy limit (user decision, 2026-11-02).
+       *
+       * THE BUG THIS FIXES (user report, 2026-11-02: "2 份改 3 份不生效"): the
+       * Host sends `healthUrl` as a FULL URL (`http://127.0.0.1:<port>/…/health`),
+       * and this function only accepted a value starting with `/` — so it fell
+       * through to `''`, and `submitBackupLimit` returned before it ever called
+       * `fetch`. Nothing was sent, nothing was said, and the number did not move.
+       * The sibling of health is the same path with its last segment replaced,
+       * whether the Host spelled it as a path or as an absolute URL; when it
+       * sends neither, the derived default is used — exactly like the rollback
+       * route, which never had this problem.
+       */
+      function backupLimitUrlFor(info) {
+        const sent = info && typeof info.backupLimitUrl === 'string' ? info.backupLimitUrl.trim() : ''
+        if (sent.startsWith('/')) return sent
+        const health = info && typeof info.healthUrl === 'string' ? info.healthUrl.trim() : ''
+        const asSibling = health.replace(/\/[^/?]+(\?.*)?$/, '/backup-limit')
+        // An absolute URL keeps only its path: every write in this client is a
+        // same-origin path, and the page's own origin is the instance it talks to.
+        if (/^https?:\/\//i.test(health)) return asSibling.replace(/^https?:\/\/[^/]+/i, '')
+        if (health.startsWith('/')) return asSibling
+        return DEFAULT_BACKUP_LIMIT_URL
+      }
+
+      /**
+       * The two READ-ONLY sources the failure panel merges (2026-11-01):
+       * what the loaded plugins stopped providing, and how each plugin compares
+       * with the newest backup. Both are plain GET routes.
+       */
+      function pluginWatchUrlFor(info) {
+        const sent = info && typeof info.pluginWatchUrl === 'string' ? info.pluginWatchUrl.trim() : ''
+        if (sent.startsWith('/')) return sent
+        return '/__dsh_autorestart/plugin-watch'
+      }
+
+      function pluginInventoryUrlFor(info) {
+        const sent = info && typeof info.pluginInventoryUrl === 'string' ? info.pluginInventoryUrl.trim() : ''
+        if (sent.startsWith('/')) return sent
+        return '/__dsh_autorestart/plugin-inventory'
+      }
+
       /**
        * Whether the one-time install prompt may be shown.
        *
@@ -3314,8 +4045,8 @@
         // waiting for the quiet window — not for a conversation.
         const gateReason = info && typeof info.reason === 'string' ? info.reason : ''
 
-        // The long wait: the Host says that the restart passed the hard
-        // deadline while a conversation was still running. The capsule shows one
+        // The long wait: the Host says that the restart is still waiting while a
+        // conversation runs on. The capsule shows one
         // more line about it — how long it has been waiting and how many tasks
         // are running.
         const longWait = formatLongWaitNoteParts(info, t)
@@ -3817,13 +4548,58 @@
         // on right now", the state file alone does not.
         const pending = Boolean(info && info.pendingRestart === true)
         // THE ONLY TWO STAGES THAT ARE "SOMETHING IS REALLY HAPPENING": the
-        // snapshot is being written, or the host is on its way out.
-        const running = pending && (phase === 'snapshotting' || phase === 'restarting')
+        // snapshot is being written, or the host is on its way out — AND the
+        // stage must still be fresh. A stage nobody refreshed (the restart was
+        // postponed and the Host did not say so) cannot leave a card on screen
+        // for ever; the pill still says the restart is pending.
+        const running = pending && isRestartStageLive(stage, Date.now())
 
         useEffect(() => {
           if (running) setSawRunning(true)
         }, [running])
 
+        // THE POSTPONED CARD IS AN ANNOUNCEMENT, NOT A PROGRESS BAR (user report,
+        // 2026-10-30): "after the interruption I still have a lot of work to do — a
+        // card hovering for ever is in the way". It says what happened for four
+        // seconds and then folds away; the capsule keeps saying the restart is
+        // pending. A NEW postponement (a new stage timestamp) announces itself
+        // again. Hooks live up here, with the others, because they must run on
+        // every render — including the renders that draw nothing.
+        const deferredKey = pending && isRestartStageDeferred(stage)
+          ? (Number.isFinite(Number(stage.at)) ? Number(stage.at) : 0)
+          : null
+        const [announcedKey, setAnnouncedKey] = useState(null)
+        const [folded, setFolded] = useState(false)
+
+        useEffect(() => {
+          if (deferredKey === null) {
+            if (announcedKey !== null) {
+              setAnnouncedKey(null)
+              setFolded(false)
+            }
+            return undefined
+          }
+          if (announcedKey === deferredKey) return undefined
+          setAnnouncedKey(deferredKey)
+          setFolded(false)
+          return undefined
+        }, [deferredKey, announcedKey])
+
+        // The four seconds of THIS announcement.
+        useEffect(() => {
+          if (announcedKey === null || folded) return undefined
+          const timer = setTimeout(() => setFolded(true), RESTART_DEFERRED_CARD_MS)
+          return () => clearTimeout(timer)
+        }, [announcedKey, folded])
+
+        // A POSTPONED RESTART IS NOT A RUNNING ONE (user report, 2026-10-30): when
+        // the Host says the restart went back to waiting because a conversation
+        // started, the card says exactly that. It is drawn AT ONCE (a fresh
+        // postponement must not wait for a second render) and the hook above
+        // records which postponement has been announced, so its four seconds can
+        // run out; every new stage timestamp resets the clock.
+        const postponed = deferredKey !== null && !folded
+
         // "已回来" is a MOMENT, not a state: 1.5s and then the card is gone.
         useEffect(() => {
           if (phase !== 'back') {
@@ -3834,8 +4610,9 @@
           return () => clearTimeout(timer)
         }, [phase])
 
-        // THE CARD IS ONLY DRAWN WHILE SOMETHING IS REALLY IN PROGRESS.
-        const visible = running || (phase === 'back' && sawRunning && !backGone)
+        // THE CARD IS ONLY DRAWN WHILE SOMETHING IS REALLY IN PROGRESS — or while
+        // the restart is honestly postponed.
+        const visible = running || postponed || (phase === 'back' && sawRunning && !backGone)
         if (!visible) return null
 
         const progress = stage.progress && typeof stage.progress === 'object' ? stage.progress : null
@@ -3845,11 +4622,32 @@
           ? Math.max(0, Math.min(100, Math.round(Number(progress.percent))))
           : null
 
-        const title = restartOverlayTitle(stage, t)
+        // The postponed card wins over everything else: even a stage that still
+        // says 'restarting' in the same render is downgraded here, so the old word
+        // can never survive a single frame once the Host said "deferred".
+        const deferredCount = postponed ? waitingTaskCount(info, info && Array.isArray(info.blockedBy) ? info.blockedBy : []) : 0
+        const title = postponed
+          ? t('restart.overlay.deferred')
+          : restartOverlayTitle(stage, t)
 
         let bar = null
         let detail = null
-        if (phase === 'snapshotting') {
+        if (postponed) {
+          // A second, smaller line: what happens next, and how many conversations
+          // are in the way (the same number the capsule shows).
+          detail = h(
+            'p',
+            { className: 'dsh-autorestart-restart-overlay__size' },
+            h(
+              'span',
+              { 'data-dsh-autorestart-restart-overlay-deferred': 'true' },
+              deferredCount > 0
+                ? fill(t('restart.overlay.deferredNote'), { count: deferredCount })
+                : t('restart.overlay.deferredNoteZero'),
+            ),
+          )
+        }
+        if (!postponed && phase === 'snapshotting') {
           // The numbers are the ones the copy loop really measured; when there is
           // no measurement yet, the card shows no number at all (an invented
           // progress bar is worse than none). The unit fits the size, so a 92 KB
@@ -3894,6 +4692,9 @@
             'aria-live': 'polite',
             'data-dsh-autorestart-restart-overlay': 'true',
             'data-dsh-autorestart-restart-overlay-phase': phase,
+            // WHAT THE CARD SAYS, independent of the Host phase: a postponed
+            // restart is drawn from 'waiting'.
+            'data-dsh-autorestart-restart-overlay-card': postponed ? 'deferred' : phase,
           },
           h(
             'p',
@@ -4906,6 +5707,190 @@
         '  line-height:18px;',
         '  color:var(--dsw-alias-label-secondary);',
         '}',
+        // WHAT a copy is (user decision, 2026-10-30): the identity is the first
+        // thing read on a row, so it sits on its own line and is not muted.
+        '.dsh-autorestart-settings__backup-identity{',
+        '  display:flex;',
+        '  flex-wrap:wrap;',
+        '  gap:8px;',
+        '  align-items:baseline;',
+        '}',
+        '.dsh-autorestart-settings__backup-badge{',
+        '  font-size:13px;',
+        '  line-height:18px;',
+        '  font-weight:600;',
+        '  color:var(--dsw-alias-label-primary);',
+        '}',
+        '.dsh-autorestart-settings__backup-actions{',
+        '  display:flex;',
+        '  flex-wrap:wrap;',
+        '  gap:8px;',
+        '  align-items:baseline;',
+        '}',
+        // EVERY COPY THAT IS NOT THE ONE (user decision, 2026-11-02): one small
+        // line each, clearly quieter than the card above it, with no button.
+        '.dsh-autorestart-settings__backup-other{',
+        '  display:flex;',
+        '  flex-wrap:wrap;',
+        '  gap:6px;',
+        '  margin-top:8px;',
+        '  align-items:baseline;',
+        '}',
+        // THE PER-PLUGIN RECOVERY: a plain list of one row per plugin, the name
+        // in monospace so a package name is recognisable at a glance.
+        '.dsh-autorestart-settings__plugins{',
+        '  display:flex;',
+        '  flex-direction:column;',
+        '  gap:6px;',
+        '  margin:0;',
+        '  padding:0;',
+        '  list-style:none;',
+        '}',
+        '.dsh-autorestart-settings__plugin-row{',
+        '  display:grid;',
+        '  grid-template-columns:1fr auto auto;',
+        '  align-items:center;',
+        '  gap:10px;',
+        '  padding:6px 8px;',
+        '  border-radius:8px;',
+        '  background:var(--dsw-alias-bg-layer-2,rgba(0,0,0,0.04));',
+        '}',
+        '.dsh-autorestart-settings__plugin-name{',
+        '  font-family:monospace;',
+        '  font-size:12px;',
+        '  word-break:break-all;',
+        '}',
+        '.dsh-autorestart-settings__plugin-status{',
+        '  font-size:12px;',
+        '  color:var(--dsw-alias-label-secondary);',
+        '  white-space:nowrap;',
+        '}',
+        '.dsh-autorestart-settings__plugin-hint{',
+        '  grid-column:1 / -1;',
+        '  font-size:11px;',
+        '  line-height:1.4;',
+        '  color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));',
+        '}',
+        // A HOST THAT CANNOT RESTART (user decision, 2026-11-02): a permanent
+        // strip at the top of the page. It borrows the error colour of the host
+        // theme, so it reads as a warning in both light and dark themes.
+        '.dsh-autorestart-settings__banner{',
+        '  display:flex;',
+        '  flex-direction:column;',
+        '  gap:8px;',
+        '  margin:0 0 12px;',
+        '  padding:10px 12px;',
+        '  border:1px solid var(--dsw-alias-state-error-border,var(--dsw-alias-border-l1));',
+        '  border-left:3px solid var(--dsw-alias-state-error-fg,#c62828);',
+        '  border-radius:8px;',
+        '  background:var(--dsw-alias-bg-layer-1);',
+        '}',
+        '.dsh-autorestart-settings__banner-text{',
+        '  color:var(--dsw-alias-label-primary);',
+        '  font-size:13px;',
+        '  line-height:19px;',
+        '}',
+        '.dsh-autorestart-settings__banner-actions{display:flex;flex-wrap:wrap;gap:8px;}',
+        '.dsh-autorestart-settings__banner-note,.dsh-autorestart-settings__card-note{',
+        '  color:var(--dsw-alias-state-error-fg,var(--dsw-alias-label-secondary));',
+        '  font-size:12px;',
+        '  line-height:18px;',
+        '}',
+        // THE ONE-TIME CARD: the same shape as the install prompt, so the user
+        // recognises "a question, then it is gone".
+        '.dsh-autorestart-settings__card{',
+        '  display:flex;',
+        '  flex-direction:column;',
+        '  gap:8px;',
+        '  margin:0 0 12px;',
+        '  padding:14px 16px;',
+        '  border:1px solid var(--dsw-alias-border-l1);',
+        '  border-radius:12px;',
+        '  background:var(--dsw-alias-bg-layer-1);',
+        '  box-shadow:0 8px 24px color-mix(in srgb, var(--dsw-alias-bg-mask-3) 20%, transparent);',
+        '}',
+        '.dsh-autorestart-settings__card-title{',
+        '  margin:0;',
+        '  font-size:14px;',
+        '  font-weight:600;',
+        '  line-height:20px;',
+        '  color:var(--dsw-alias-label-primary);',
+        '}',
+        '.dsh-autorestart-settings__card-actions{display:flex;flex-wrap:wrap;gap:8px;}',
+        // THE LINE UNDER THE FOLD TITLE: small, secondary, never a substitute for
+        // the title itself.
+        '.dsh-autorestart-settings__summary-note{',
+        '  display:block;',
+        '  margin-top:2px;',
+        '  font-size:12px;',
+        '  line-height:16px;',
+        '  font-weight:400;',
+        '  color:var(--dsw-alias-label-tertiary,var(--dsw-alias-label-secondary));',
+        '}',
+        // ONE RESCUE SCRIPT: its name, its real path, and a copy button — the
+        // path is the only thing that helps when the host will not start.
+        '.dsh-autorestart-settings__rescue-path{',
+        '  display:flex;',
+        '  flex-wrap:wrap;',
+        '  gap:8px;',
+        '  align-items:baseline;',
+        '  padding:6px 0;',
+        '}',
+        // THE DESKTOP ENTRY, DRAWN AS IT WILL LOOK (user report, 2026-11-02):
+        // a tile with DSH on it and the file name next to it, so "what am I
+        // looking for on my desktop?" is answered before the button is pressed.
+        '.dsh-autorestart-settings__shortcut{',
+        '  display:flex;',
+        '  align-items:center;',
+        '  gap:8px;',
+        '}',
+        '.dsh-autorestart-settings__shortcut-icon{',
+        '  display:inline-flex;',
+        '  align-items:center;',
+        '  justify-content:center;',
+        '  width:26px;',
+        '  height:26px;',
+        '  flex:none;',
+        '  border-radius:6px;',
+        '  background:var(--dsw-alias-brand-primary,#4d6bfe);',
+        '  color:#fff;',
+        '  font-size:9px;',
+        '  font-weight:700;',
+        '  letter-spacing:.02em;',
+        '}',
+        '.dsh-autorestart-settings__shortcut-name{',
+        '  font-size:12.5px;',
+        '  line-height:18px;',
+        '  color:var(--dsw-alias-label-primary);',
+        '  word-break:break-all;',
+        '}',
+        // THE REAL PICTURE, WHEN THE HOST SENT ONE (2026-11-02): the tile stops
+        // being a stand-in — no brand background, no 26px box — and shows the
+        // bytes the desktop shortcut carries. 16px keeps it on the text baseline.
+        '.dsh-autorestart-settings__shortcut-icon[data-icon-real="true"]{',
+        '  background:transparent;',
+        '  width:16px;',
+        '  height:16px;',
+        '  border-radius:2px;',
+        '}',
+        '.dsh-autorestart-settings__shortcut-icon-img{',
+        '  display:block;',
+        '  width:16px;',
+        '  height:16px;',
+        '  border-radius:2px;',
+        '  image-rendering:auto;',
+        '}',
+        // THE SECOND CONFIRMATION of a manual rollback: a block that stands
+        // apart from the list, because it is a question, not a fact.
+        '.dsh-autorestart-settings__confirm{',
+        '  display:flex;',
+        '  flex-direction:column;',
+        '  gap:6px;',
+        '  padding:10px 12px;',
+        '  border:1px solid var(--dsw-alias-border-l1);',
+        '  border-radius:8px;',
+        '  background:var(--dsw-alias-bg-l1);',
+        '}',
         // The folded "technical details": the command itself stays out of the
         // way until somebody asks for it.
         '.dsh-autorestart-settings__details{',
@@ -5417,9 +6402,110 @@
         // a fresh page starts closed, so nobody leaves technical text open by
         // accident.
         const [detailsOpen, setDetailsOpen] = useState(false)
-        const t = makeTranslate(props && typeof props.t === 'function' ? props.t : translate)
-        // THE RECEIPT OF A SETTINGS CHANGE, on screen right now. It belongs to
-        // THIS panel (it is not a window overlay), so it is read here and
+        // The two folds of the BACKUP group (user decision, 2026-11-02): the long
+        // explanation and the per-copy technical rows are collapsed by default,
+        // while every switch stays visible. Both use the neutral label
+        // `settings.backup.details` (added with the user's approval).
+        const [backupDetailsOpen, setBackupDetailsOpen] = useState(false)
+        const [backupListDetailsOpen, setBackupListDetailsOpen] = useState(false)
+        // THE WHOLE BACKUP BLOCK IS ONE FOLD (user decision, 2026-11-02): the
+        // four switches stay visible, everything that only EXPLAINS the backups
+        // (the count, the rules, the copy cards, the path and the per-plugin
+        // recovery) lives behind `settings.backup.section`. Closed by default —
+        // except on a boot the watchdog had to rescue, where the one copy that
+        // matters must not be hidden (see the fold below).
+        const [backupSectionOpen, setBackupSectionOpen] = useState(false)
+        // The RESCUE script paths on Windows: behind 详情, because the desktop
+        // entry is the main door there (audit finding G1, 2026-11-02). Never
+        // folded on the other platforms and never folded when there is no
+        // desktop entry to press.
+        const [rescuePathsOpen, setRescuePathsOpen] = useState(false)
+        // THE ONE-TIME "this host cannot restart" CARD (user decision,
+        // 2026-11-02). `restartCardPending` is the Host's answer ("read once per
+        // host"), `restartCardDone` only hides it in this session right after
+        // the click, and `restartFixNote` carries the reason of a failed
+        // attempt. Nothing is ever written without the click.
+        const [restartCardPending, setRestartCardPending] = useState(false)
+        const [restartCardDone, setRestartCardDone] = useState(false)
+        const [restartFixNote, setRestartFixNote] = useState('')
+        // The command this page just wrote ('' = none). It hides the strip at
+        // once and shows what is configured NOW, instead of waiting for the next
+        // health poll — the user clicked a button and must see the result.
+        const [restartApplied, setRestartApplied] = useState('')
+        // THE MANUAL ROLLBACK (user decision, 2026-10-30). Asking is a STATE,
+        // not a `window.confirm`: the card has to say WHICH copy, that the
+        // current state is replaced, and that a restart follows. `null` = nobody
+        // is asking, and only a confirmation ever calls the route.
+        // THE COPY LIMIT (user decision, 2026-11-02): the number the user picks,
+        // the confirmation that stands between a smaller number and deleted
+        // copies, and what the route reported back afterwards.
+        const [limitBusy, setLimitBusy] = useState(false)
+        const [limitNote, setLimitNote] = useState('')
+        const [limitAsk, setLimitAsk] = useState(null)
+        // The value the select SHOWS: seeded from the payload, replaced by the
+        // answer, so the number on screen is the number in force right after the
+        // write instead of waiting for the next poll.
+        const [limitValue, setLimitValue] = useState(null)
+
+        /**
+         * WRITE THE COPY LIMIT (user decision, 2026-11-02).
+         *
+         * The route answers with the copies it really deleted and with
+         * `keptWillExceedRequest`, so this reports the truth instead of echoing
+         * the number the user asked for. A refusal carries the Host's `reason`
+         * and is shown as-is — rewriting it would hide which value was refused.
+         */
+        const submitBackupLimit = async (wanted) => {
+          const url = backupLimitUrlFor(info)
+          // A WRITE THAT CANNOT BE ADDRESSED MUST SAY SO (user report,
+          // 2026-11-02): this used to `return` silently, which is exactly how
+          // "2 份改 3 份不生效" looked from the outside — no request, no message,
+          // no change. The default route makes this branch unreachable, and if a
+          // future change makes it reachable again the page says it failed
+          // instead of pretending nothing happened.
+          if (url === '') {
+            setLimitNote(t('settings.backup.limitFailed'))
+            return
+          }
+          setLimitBusy(true)
+          setLimitNote('')
+          try {
+            const response = await fetch(url, {
+              method: 'POST',
+              headers: { 'content-type': 'application/json', accept: 'application/json' },
+              body: JSON.stringify({ maxBackups: wanted }),
+            })
+            const answer = await response.json().catch(() => null)
+            setLimitAsk(null)
+            if (response.ok !== true || answer === null || answer.ok !== true) {
+              setLimitNote(answer && typeof answer.reason === 'string' && answer.reason !== ''
+                ? answer.reason
+                : t('settings.backup.limitFailed'))
+              return
+            }
+            const removed = Array.isArray(answer.removed) ? answer.removed.length : 0
+            const kept = Number.isFinite(Number(answer.kept)) ? Number(answer.kept) : wanted
+            setLimitValue(Number.isFinite(Number(answer.maxBackups)) ? Number(answer.maxBackups) : wanted)
+            // BOTH READINGS MOVE TOGETHER (user report, 2026-11-02): the select
+            // shows the confirmed number at once, and this poll brings the two
+            // lines above it to the same value instead of leaving them saying the
+            // old limit until the next 2 s tick.
+            void pollOnce()
+            setLimitNote(answer.keptWillExceedRequest === true
+              ? fill(t('settings.backup.limitMore'), { requested: String(wanted), kept: String(kept) })
+              : fill(t('settings.backup.limitDeleted'), { removed: String(removed), kept: String(kept) }))
+          } catch {
+            setLimitNote(t('settings.backup.limitFailed'))
+          } finally {
+            setLimitBusy(false)
+          }
+        }
+        const [rollbackAsk, setRollbackAsk] = useState(null)
+        const [rollbackBusy, setRollbackBusy] = useState(false)
+        const [rollbackNote, setRollbackNote] = useState('')
+        const t = makeTranslate(props && typeof props.t === 'function' ? props.t : translate)
+        // THE RECEIPT OF A SETTINGS CHANGE, on screen right now. It belongs to
+        // THIS panel (it is not a window overlay), so it is read here and
         // drawn here.
         const saveNotice = useSaveNotice()
 
@@ -5506,12 +6592,55 @@
         const restartInfo = info && typeof info === 'object' && info.restart && typeof info.restart === 'object'
           ? info.restart
           : { mode: '', command: '', written: false, canRevert: false, previous: null }
+        // CAN THIS HOST RESTART AT ALL? (user report, 2026-11-02)
+        //
+        // A hosted `dsh web` with no `command` restart mode is a host this
+        // plugin cannot restart and will not back up before a restart — i.e. it
+        // does nothing for the user. That used to be silent: the page looked
+        // perfectly healthy. Both halves are required (`mode: 'command'` AND a
+        // command), and the desktop app is never told this: it relaunches
+        // itself.
+        const restartModeValue = typeof restartInfo.mode === 'string' ? restartInfo.mode : ''
+        const restartCommandValue = typeof restartInfo.command === 'string' ? restartInfo.command : ''
+        const restartCapable = restartModeValue === 'command' && restartCommandValue.trim() !== ''
+        // Only a Host that TOLD us about its restart settings can be accused of
+        // having none: an older build (or the very first paint, before the state
+        // arrived) must not produce a red strip.
+        const restartKnown = Boolean(info && typeof info === 'object' && info.restart && typeof info.restart === 'object')
+        const restartMissing = restartKnown && hostIsDesktop !== true && !restartCapable && restartApplied === ''
+        // WHICH PROFILE WOULD BE BACKED UP (2026-11-02): the Host resolves it,
+        // and `dir: null` means "more than one profile matched / none did" — so
+        // backups and rollbacks are paused. The browser cannot look at the disk,
+        // so this is only a DISPLAY of the Host's answer; when the Host does not
+        // send it (older builds), nothing is claimed.
+        const profileInfo = (() => {
+          const source = info && typeof info === 'object' ? info.profile : null
+          if (source && typeof source === 'object') return source
+          if (typeof source === 'string') return { dir: source }
+          const flat = info && typeof info === 'object' ? info.profileDir : null
+          if (flat && typeof flat === 'object') return flat
+          if (typeof flat === 'string') return { dir: flat }
+          const fromRestart = info && typeof info === 'object' && info.lastRestart
+            && typeof info.lastRestart === 'object' && info.lastRestart.snapshot
+            && typeof info.lastRestart.snapshot === 'object'
+            ? info.lastRestart.snapshot.profile
+            : null
+          return fromRestart && typeof fromRestart === 'object' ? fromRestart : null
+        })()
+        const profileUnknown = profileInfo !== null
+          && (profileInfo.dir === null || profileInfo.dir === undefined || String(profileInfo.dir) === '')
         // THE BACKUPS ON DISK: the count, the local time, the size, whether the
         // plugins are in it and where it lives. The Host reads the directory.
         const backupsInfo = info && typeof info === 'object' && info.backups && typeof info.backups === 'object'
           ? info.backups
           : { dir: '', max: 0, count: 0, items: [] }
+        // WHAT HAPPENED TO THE LAST RESTART REQUEST, computed once (2026-11-03).
+        const cancelledRestart = cancelledRestartNote(info, props && typeof props.t === 'function' ? props.t : translate)
         const backupItems = Array.isArray(backupsInfo.items) ? backupsInfo.items : []
+        // WHICH COPY THE ONE SENTENCE BELONGS TO (user decision, 2026-11-02):
+        // resolved ONCE from the copies' own records, so the sentence follows the
+        // copy and not the row it happens to be drawn in.
+        const startupCopy = startupCopyName(backupItems)
         // THE RESCUE KIT: the two scripts and where they are, as the Host
         // resolved them. The browser never guesses a path.
         const rescuePaths = rescuePathsFor(info)
@@ -5520,6 +6649,54 @@
           : {}
         // Where a desktop shortcut could go ('' = there is no desktop here).
         const rescueDesktop = typeof rescueKit.desktopDir === 'string' ? rescueKit.desktopDir.trim() : ''
+        // WHICH PLATFORM the rescue kit was resolved for, so the page can SAY
+        // "there is no desktop on a hosted web / server install" instead of
+        // hiding the whole block (user report, 2026-11-02).
+        const rescuePlatform = typeof rescueKit.platform === 'string' ? rescueKit.platform : ''
+        const rescueIsWindows = rescuePlatform === 'win32'
+        // THE RESCUE ENTRY ON A HOST WITHOUT A DESKTOP (plan B, user decision
+        // 2026-11-02). The desktop build offers a `.lnk` on the desktop; a hosted
+        // web / server host has no desktop, so the same entry is a COPYABLE
+        // COMMAND — the restore script the Host already resolved. '' means the
+        // Host has none, and the page says so instead of inventing a path.
+        const rescueCommand = (() => {
+          const entry = rescuePaths.find((item) => item && item.key === 'restoreProfile')
+          return entry && typeof entry.path === 'string' ? entry.path.trim() : ''
+        })()
+        // The file name of the shortcut on the desktop (a `.lnk` since
+        // 2026-11-02 — the host names it, so page and disk cannot disagree).
+        const rescueShortcutName = typeof rescueKit.shortcutName === 'string' && rescueKit.shortcutName !== ''
+          ? rescueKit.shortcutName
+          : 'DSH 出事了双击这里.lnk'
+        // The icon the shortcut carries: THIS PLUGIN'S OWN `assets/icon.ico`.
+        // It used to be DSH's executable, which put the face of the very program
+        // that was broken on the rescue shortcut. '' = this install ships no icon
+        // of its own: the `.lnk` is still created, it just gets no IconLocation —
+        // never somebody else's face, and nothing is written at runtime.
+        const rescueIconPath = typeof rescueKit.iconPath === 'string' ? rescueKit.iconPath.trim() : ''
+        // THE SAME PICTURE THE DESKTOP CARRIES, DRAWN HERE (user requirement,
+        // 2026-11-02): the row used to show a made-up "DSH" tile, so the page and
+        // the `.lnk` on the desktop could look like two different things. The Host
+        // now sends the icon as a data URI built from THE SAME BYTES as the file
+        // it points `IconLocation` at, and this page renders that string as-is —
+        // no base64 lives in this bundle, so the two copies cannot drift apart.
+        //
+        // ONLY A PNG DATA URI IS ACCEPTED. Anything else (another media type, a
+        // remote URL, a missing field on an older Host) is treated as "no picture"
+        // and the row falls back to its text tile: a wrong `src` would render a
+        // broken-image marker, which is worse than saying nothing.
+        const rescueIconDataUri = (() => {
+          const raw = typeof rescueKit.iconDataUri === 'string' ? rescueKit.iconDataUri.trim() : ''
+          return raw.startsWith('data:image/png;base64,') ? raw : ''
+        })()
+        // ONE SOURCE FOR THE ICON (user decision, 2026-11-02): the desktop `.lnk`
+        // and this tile must come from the SAME host answer, and both must say
+        // the same thing when there is none. The name travels with the path so
+        // the page can prove which file it used — it never invents an icon.
+        const rescueIconName = typeof rescueKit.iconName === 'string' && rescueKit.iconName !== ''
+          ? rescueKit.iconName
+          : (rescueIconPath === '' ? '' : rescueIconPath.split(/[\\/]/).pop())
+        const rescueIconAvailable = rescueKit.iconAvailable === true || rescueIconPath !== ''
         // Whether it is already there (then the button says so).
         const rescueShortcutExists = rescueKit.shortcutExists === true
         // WHAT THIS MACHINE CAN DO: the automatic rollback needs a watchdog,
@@ -5544,6 +6721,18 @@
         const watchdogLast = watchdog.report && typeof watchdog.report === 'object' && typeof watchdog.report.result === 'string'
           ? watchdog.report.result
           : ''
+        // DID THE WATCHDOG ACT, OR DID IT STAND DOWN FOR WANT OF A TRUSTED COPY?
+        // (2026-11-01) `failed` alone is not enough for the user: the strict mode
+        // deliberately does nothing when no copy qualifies, and that has to be
+        // visible here — including WHICH copies were refused — otherwise "it did
+        // not rescue me" and "it had nothing to rescue me with" look the same.
+        const watchdogStrict = Boolean(
+          watchdog.report && typeof watchdog.report === 'object' && watchdog.report.strictMode === true,
+        )
+        const watchdogRestoredFrom = watchdog.report && typeof watchdog.report === 'object'
+          && typeof watchdog.report.restoredFrom === 'string' && watchdog.report.restoredFrom !== ''
+          ? watchdog.report.restoredFrom
+          : ''
         useEffect(() => {
           if (!schedulerNotice) return
           // The user has read it: the Host remembers that and stops asking.
@@ -5555,6 +6744,21 @@
             // The Host will ask again next time — no harm.
           })
         }, [schedulerNotice])
+        // IS THE ONE-TIME "cannot restart" CARD STILL UNREAD? (2026-11-02)
+        //
+        // Same ledger as the feature announcement (same route, same key style,
+        // same "answered once per host" rule) — the card is a reminder, not a
+        // new mechanism.
+        useEffect(() => {
+          if (!restartMissing) return undefined
+          let alive = true
+          void (async () => {
+            const pending = await fetchAnnouncements().catch(() => [])
+            if (!alive) return
+            setRestartCardPending(pending.some((entry) => entry.feature === ANNOUNCED_RESTART))
+          })()
+          return () => { alive = false }
+        }, [restartMissing])
         const supervisorPending = supervisorStatus !== null
           && supervisorStatus.detail !== null
           && typeof supervisorStatus.detail === 'object'
@@ -5633,6 +6837,81 @@
           }
         }
 
+        /**
+         * THE ONE-CLICK REPAIR of a host that cannot restart (user decision,
+         * 2026-11-02 — option A).
+         *
+         * THREE STEPS, and the click is the only reason anything is written:
+         *   1. `dry-run`: the Host derives the command that starts this host
+         *      again and validates it. NOTHING is written;
+         *   2. `apply` with `confirmed: true`: NOW the command is written into
+         *      the profile configuration (the Host refuses without it);
+         *   3. the announcement is marked as read, so the card does not come
+         *      back, and the undo stays available (`revert`).
+         *
+         * A failure is never silent: the Host's own reason is shown in the
+         * user's words, and the manual path (the supervisor group's
+         * "derive / use this command") stays where it is.
+         */
+        const fixRestartCommand = async () => {
+          if (busy) return
+          setBusy(true)
+          setError('')
+          setRestartFixNote('')
+          try {
+            const dryResponse = await fetch(supervisorUrlFor(info), {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ action: 'dry-run' }),
+            })
+            const dryBody = await dryResponse.json().catch(() => null)
+            const plan = dryBody && typeof dryBody === 'object' && dryBody.plan && typeof dryBody.plan === 'object'
+              ? dryBody.plan
+              : null
+            if (!dryResponse.ok || !plan || plan.ok !== true) {
+              const reason = plan && typeof plan.reason === 'string' ? plan.reason.trim() : ''
+              setRestartFixNote(reason === ''
+                ? t('settings.supervisor.noCommand')
+                : t('settings.supervisor.reason.' + reason))
+              return
+            }
+            const applyResponse = await fetch(supervisorUrlFor(info), {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ action: 'apply', confirmed: true }),
+            })
+            const applied = await applyResponse.json().catch(() => null)
+            if (!applyResponse.ok || !applied || typeof applied !== 'object' || applied.ok !== true) {
+              const message = applied && typeof applied === 'object' && applied.error
+                ? String(applied.error)
+                : String(applyResponse.status)
+              setRestartFixNote(fill(t('supervisor.error'), { message }))
+              return
+            }
+            await acknowledgeAnnouncement(ANNOUNCED_RESTART).catch(() => {})
+            setRestartCardPending(false)
+            setRestartCardDone(true)
+            // WHAT IS CONFIGURED NOW, straight from the Host's answer (never
+            // from what we hoped it wrote).
+            const written = applied.writes && typeof applied.writes === 'object'
+              && typeof applied.writes.restartCommand === 'string'
+              ? applied.writes.restartCommand
+              : ''
+            setRestartApplied(written === '' ? t('settings.supervisor.noCommand') : written)
+          } catch (failure) {
+            setRestartFixNote(fill(t('supervisor.error'), { message: describeError(failure) }))
+          } finally {
+            setBusy(false)
+          }
+        }
+
+        /** "Later": the card does not come back (the strip stays). */
+        const dismissRestartCard = () => {
+          setRestartCardPending(false)
+          setRestartCardDone(true)
+          void acknowledgeAnnouncement(ANNOUNCED_RESTART).catch(() => {})
+        }
+
         /**
          * Write one change into the profile configuration.
          *
@@ -5645,6 +6924,46 @@
          *
          * @param {object} changes the keys to write
          */
+        /**
+         * THE MANUAL ROLLBACK (user decision, 2026-10-30).
+         *
+         * It is ONLY ever called from the confirmation card: the button on a row
+         * opens the question, and nothing is posted until the user says yes. The
+         * route takes a backup NAME (never a path) and does the rest on the Host
+         * — save the current state, restore that copy, request a restart.
+         *
+         * @param {{ name?: string, atLocal?: string|null }|null} ask what the user picked
+         */
+        const rollbackTo = async (ask) => {
+          const name = ask && typeof ask.name === 'string' ? ask.name : ''
+          if (name === '' || rollbackBusy === true) return
+          setRollbackBusy(true)
+          setRollbackNote('')
+          try {
+            const response = await fetch(rollbackUrlFor(info), {
+              method: 'POST',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ name }),
+            })
+            const body = await response.json().catch(() => null)
+            if (!response.ok || !body || typeof body !== 'object' || body.ok !== true) {
+              const message = body && typeof body === 'object'
+                ? String(body.error || body.message || response.status)
+                : String(response.status)
+              setRollbackNote(fill(t('settings.backup.rollbackFailed'), { message }))
+              return
+            }
+            // The copy is back and a restart has been requested: the card goes
+            // away, and the panel says what is happening right now.
+            setRollbackAsk(null)
+            setRollbackNote(t('settings.backup.rollbackDone'))
+          } catch (failure) {
+            setRollbackNote(fill(t('settings.backup.rollbackFailed'), { message: describeError(failure) }))
+          } finally {
+            setRollbackBusy(false)
+          }
+        }
+
         const save = async (changes) => {
           if (busy) return
           setBusy(true)
@@ -5757,11 +7076,29 @@
          *
          * ONLY because the user pressed the button: the settings page never
          * writes anything to the desktop by itself.
+         *
+         * THE FAILURE IS CLASSIFIED (2026-11-02): "the shortcut was not placed"
+         * is not enough — a policy that forbids it, a desktop that does not
+         * exist and a write that broke are three different situations, and only
+         * one of them is worth trying again. All three fall back to the manual
+         * way, and the page says so with the real script path.
          */
         const createRescueShortcut = async () => {
           if (busy) return
           setBusy(true)
           setRescueNote('')
+          const manual = typeof rescueKit.restoreProfile === 'string' ? rescueKit.restoreProfile.trim() : ''
+          const failureText = (kind, message) => {
+            const kindKey = kind === 'no-desktop'
+              ? 'settings.rescue.noDesktop'
+              : kind === 'blocked'
+                ? 'settings.rescue.shortcutBlocked'
+                : 'settings.rescue.shortcutWriteFailed'
+            const head = kindKey === 'settings.rescue.shortcutWriteFailed'
+              ? fill(t(kindKey), { message })
+              : t(kindKey)
+            return manual === '' ? head : head + ' ' + manual
+          }
           try {
             const response = await fetch(rescueUrlFor(info), {
               method: 'POST',
@@ -5770,8 +7107,9 @@
             })
             const body = await response.json().catch(() => null)
             if (!response.ok) {
+              const kind = body && typeof body === 'object' && typeof body.errorKind === 'string' ? body.errorKind : ''
               const message = body && typeof body === 'object' && body.error ? body.error : String(response.status)
-              setRescueNote(fill(t('settings.rescue.shortcutFailed'), { message }))
+              setRescueNote(kind === '' ? fill(t('settings.rescue.shortcutFailed'), { message }) : failureText(kind, message))
               return
             }
             setRescueNote(t('settings.rescue.shortcutDone'))
@@ -5812,10 +7150,136 @@
           'div',
           { className: 'dsh-autorestart-settings' },
           // THE RECEIPT: a `sticky` strip at the TOP of this panel. It is a
+            // WHAT HAPPENED TO THE RESTART YOU ASKED FOR (user report, 2026-11-03): it waited
+            // hours, a host restart cancelled it, and the page looked as if nothing had ever
+            // been requested. It comes first, because the next thing the user wants is to ask
+            // again — and that button is right below.
+            cancelledRestart ? h(
+              'div',
+              {
+                className: 'dsh-autorestart-settings__banner',
+                'data-dsh-autorestart-restart': 'cancelled-note',
+                role: 'status',
+              },
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__banner-text', 'data-dsh-autorestart-restart': 'cancelled-text' },
+                cancelledRestart.text,
+              ),
+            ) : null,
           // child of the panel (the DOM ancestor of the message IS the
           // settings section), so it can not float over the conversation area
           // again — and it stays visible while the settings are scrolled.
           saveNoticeBar(t, saveNotice),
+          // ③ THE RESULT OF THE CLICK: the command that is configured NOW. It is
+          // shown where the strip was, so "it worked" is visible without opening
+          // a fold and without waiting for the next poll.
+          restartApplied !== ''
+            ? h(
+                'div',
+                { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-restart-fixed': 'true' },
+                h(
+                  'span',
+                  { className: 'dsh-autorestart-settings__label', 'data-dsh-autorestart-restart-fixed': 'label' },
+                  t('settings.supervisor.command'),
+                ),
+                h(
+                  'code',
+                  { className: 'dsh-autorestart-settings__value', 'data-dsh-autorestart-restart-fixed': 'command' },
+                  restartApplied,
+                ),
+              )
+            : null,
+          // ① A HOST THAT CANNOT RESTART, SAID AT THE TOP OF THE PAGE (user
+          // decision, 2026-11-02 — option A).
+          //
+          // Without a `command` restart mode the plugin does nothing at all, and
+          // that used to look exactly like a healthy install. The strip stays
+          // while it is true, and it carries the ONE action that fixes it. It
+          // never writes anything by itself: the button is the confirmation.
+          restartMissing
+            ? h(
+                'div',
+                {
+                  className: 'dsh-autorestart-settings__banner',
+                  role: 'status',
+                  'data-dsh-autorestart-restart-missing': 'true',
+                },
+                h(
+                  'span',
+                  { className: 'dsh-autorestart-settings__banner-text', 'data-dsh-autorestart-restart-missing': 'text' },
+                  t('settings.restartBanner.title'),
+                ),
+                h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__banner-actions' },
+                  h(
+                    'button',
+                    {
+                      type: 'button',
+                      className: 'dsh-autorestart-settings__button',
+                      disabled: busy,
+                      'data-dsh-autorestart-restart-missing': 'fix',
+                      onClick: () => void fixRestartCommand(),
+                    },
+                    t('settings.restartBanner.fix'),
+                  ),
+                ),
+                restartFixNote === ''
+                  ? null
+                  : h(
+                      'span',
+                      { className: 'dsh-autorestart-settings__banner-note', 'data-dsh-autorestart-restart-missing': 'note' },
+                      restartFixNote,
+                    ),
+              )
+            : null,
+          // ② THE ONE-TIME CARD: same ledger as the feature announcement, so it
+          // is shown once per host and never again after the user answered it.
+          restartMissing && restartCardPending && !restartCardDone
+            ? h(
+                'div',
+                { className: 'dsh-autorestart-settings__card', 'data-dsh-autorestart-restart-card': 'true' },
+                h(
+                  'h3',
+                  { className: 'dsh-autorestart-settings__card-title', 'data-dsh-autorestart-restart-card': 'title' },
+                  t('settings.restartBanner.title'),
+                ),
+                h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__card-actions' },
+                  h(
+                    'button',
+                    {
+                      type: 'button',
+                      className: 'dsh-autorestart-settings__button',
+                      disabled: busy,
+                      'data-dsh-autorestart-restart-card': 'fix',
+                      onClick: () => void fixRestartCommand(),
+                    },
+                    t('settings.restartBanner.fix'),
+                  ),
+                  h(
+                    'button',
+                    {
+                      type: 'button',
+                      className: 'dsh-autorestart-settings__button',
+                      disabled: busy,
+                      'data-dsh-autorestart-restart-card': 'later',
+                      onClick: () => dismissRestartCard(),
+                    },
+                    t('supervisor.later'),
+                  ),
+                ),
+                restartFixNote === ''
+                  ? null
+                  : h(
+                      'span',
+                      { className: 'dsh-autorestart-settings__card-note', 'data-dsh-autorestart-restart-card': 'note' },
+                      restartFixNote,
+                    ),
+              )
+            : null,
           // The panel is split into two titled groups: the RESTART settings
           // come first, the SHUTDOWN settings after them. The two situations
           // are different, so they do not share one flat list.
@@ -5898,7 +7362,26 @@
                   },
                 },
               ),
-              h('span', { className: 'dsh-autorestart-settings__hint' }, t('settings.backup.hint')),
+              // THE EXPLANATION IS FOLDED (user decision, 2026-11-02): the switch
+              // above stays on screen — only the words fold.
+              h(
+                'details',
+                {
+                  className: 'dsh-autorestart-settings__details',
+                  'data-dsh-autorestart-backup': 'details',
+                  onToggle: (event) => {
+                    setBackupDetailsOpen(Boolean(event && event.target ? event.target.open : false))
+                  },
+                },
+                h('summary', { className: 'dsh-autorestart-settings__summary' }, t('settings.backup.details')),
+                backupDetailsOpen
+                  ? h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'content-hint' },
+                    t('settings.backup.hint'),
+                  )
+                  : null,
+              ),
             ),
             h(
               'label',
@@ -5923,28 +7406,188 @@
               ),
               h('span', { className: 'dsh-autorestart-settings__hint' }, t('settings.backupPlugins.hint')),
             ),
-            // WHAT IS BACKED UP RIGHT NOW. The Host reads the directory (the
-            // browser cannot see the disk), so the numbers are real: the count,
-            // the local time of every copy, its size and whether the plugins
-            // are in it.
-            h(
-              'div',
-              { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-backup': 'list' },
+            // MORE THAN ONE PROFILE = NO BACKUPS AT ALL (2026-11-02): the Host
+            // cannot tell which profile to copy, so backups and rollbacks are
+            // paused. That is a fact about the whole block, so it sits ABOVE
+            // the fold — and it is only ever shown when the Host actually said
+            // so (`dir: null`); the browser never guesses.
+            profileUnknown
+              ? h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-backup': 'multi-profile' },
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'multi-profile-text' },
+                    t('settings.backup.multiProfile'),
+                  ),
+                )
+              : null,
+            // WHAT IS BACKED UP RIGHT NOW — one FOLD (user decision, 2026-11-02).
+            //
+            // The words that only EXPLAIN the backups (the count, the rules, the
+            // copy list, the path and the per-plugin recovery) made the page
+            // long enough that the switches were pushed out of sight. They are
+            // all behind `settings.backup.section` now, closed by default — but
+            // NOT closed on a boot the watchdog had to rescue: an intervention
+            // is the one fact that must not be hidden, so the fold opens itself
+            // and says so on its summary.
+            (() => {
+              const anyIntervened = backupItems.some((item) => Boolean(item && item.intervention === true))
+              const sectionOpen = backupSectionOpen || anyIntervened
+              return h(
+                'details',
+                {
+                  className: 'dsh-autorestart-settings__details',
+                  'data-dsh-autorestart-backup': 'section',
+                  ...(sectionOpen ? { open: true } : {}),
+                  onToggle: (event) => {
+                    setBackupSectionOpen(Boolean(event && event.target ? event.target.open : false))
+                  },
+                },
+                h(
+                  'summary',
+                  {
+                    className: 'dsh-autorestart-settings__summary',
+                    'data-dsh-autorestart-backup': 'section-summary',
+                  },
+                  anyIntervened
+                    ? t('settings.backup.section') + ' · ' + t('settings.backup.intervention.true')
+                    : t('settings.backup.section'),
+                ),
+                // THE CONTENT IS ALWAYS IN THE TREE (only `<details>` hides it):
+                // the panel is a few dozen nodes, and rendering them once keeps
+                // the fold from re-mounting the buttons (and their state) every
+                // time somebody opens it.
+                h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-backup': 'list' },
               h(
                 'span',
                 { className: 'dsh-autorestart-settings__label' },
                 t('settings.backup.list'),
               ),
+              // TWO LINES, AND ONLY TWO (user report, 2026-11-02). This block used
+              // to spend five lines on the same three facts — twice on the
+              // retention limit, and once with the number spelled out inside a
+              // sentence, which went stale the moment the dropdown changed it.
+              // Line 1: how many copies there are and what they take on disk.
               h(
                 'span',
                 { className: 'dsh-autorestart-settings__value', 'data-dsh-autorestart-backup': 'count' },
-                fill(t('settings.backup.count'), { n: backupItems.length }),
+                fill(t('settings.backup.count'), {
+                  n: backupItems.length,
+                  size: formatBackupSize(
+                    backupItems.reduce((total, item) => total + (Number(item && item.bytes) || 0), 0),
+                  ),
+                }),
               ),
+              // Line 2: the rule that bounds them, with the limit in force — the
+              // dropdown below is what changes that number.
               h(
                 'span',
                 { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'keep' },
                 fill(t('settings.backup.keep'), { n: backupsInfo.max }),
               ),
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'kinds-local' },
+                t('settings.backup.kindsLocal'),
+              ),
+              h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'kinds-third-party' },
+                t('settings.backup.kindsThirdParty'),
+              ),
+              // THE COPY LIMIT IS EDITABLE HERE (user decision, 2026-11-02): a
+              // dropdown of 1..10, defaulting to the value the Host reports. It
+              // writes through the backup-limit route and the page re-reads the
+              // state, so "the number shown" is always "the number in force".
+              h(
+                'div',
+                { className: 'dsh-autorestart-settings__backup-row', key: 'backup-limit' },
+                h(
+                  'span',
+                  { className: 'dsh-autorestart-settings__backup-label' },
+                  t('settings.backup.limitLabel'),
+                ),
+                h(
+                  'select',
+                  {
+                    className: 'dsh-autorestart-settings__select',
+                    'data-dsh-autorestart-backup': 'limit-select',
+                    'data-dsh-autorestart-setting': 'maxBackups',
+                    value: String(limitValue === null ? backupsInfo.max : limitValue),
+                    disabled: limitBusy,
+                    onChange: (event) => {
+                      const wanted = Number(event.target.value)
+                      if (Number.isFinite(wanted) !== true) return
+                      // SHRINKING IS THE ONLY DANGEROUS DIRECTION: nothing is
+                      // written until the user confirms how many copies die.
+                      if (wanted < backupItems.length) {
+                        setLimitNote('')
+                        setLimitAsk({ wanted, from: backupItems.length, remove: backupItems.length - wanted })
+                        return
+                      }
+                      void submitBackupLimit(wanted)
+                    },
+                  },
+                  [2, 3, 4, 5, 6, 7, 8, 9, 10].map((value) =>
+                    h('option', { key: 'limit-' + value, value: String(value) }, String(value))),
+                ),
+                // THE DISK WARNING SITS TO THE RIGHT OF THE DROPDOWN (user
+                // report, 2026-11-02): as its own line BELOW the control it
+                // arrived after the choice had already been made.
+                h(
+                  'span',
+                  { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'limit-hint' },
+                  t('settings.backup.limitHint'),
+                ),
+              ),
+              limitAsk === null
+                ? null
+                : h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__backup-row', key: 'limit-ask' },
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__backup-label', 'data-dsh-autorestart-backup': 'limit-ask-body' },
+                    fill(t('settings.backup.limitAsk'), {
+                      remove: String(limitAsk.remove),
+                      from: String(limitAsk.from),
+                      to: String(limitAsk.wanted),
+                    }),
+                  ),
+                  h('button', {
+                    type: 'button',
+                    className: 'dsh-autorestart-announcement__cta',
+                    'data-dsh-autorestart-backup': 'limit-confirm',
+                    disabled: limitBusy,
+                    onClick: () => { void submitBackupLimit(limitAsk.wanted) },
+                  }, t('settings.backup.limitConfirm')),
+                  h('button', {
+                    type: 'button',
+                    className: 'dsh-autorestart-announcement__cta',
+                    'data-dsh-autorestart-backup': 'limit-cancel',
+                    // CANCELLING SENDS NOTHING: no route call, no write, no delete.
+                    onClick: () => { setLimitAsk(null); setLimitNote('') },
+                  }, t('settings.backup.limitCancel')),
+                ),
+              limitNote === ''
+                ? null
+                : h(
+                  'span',
+                  { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'limit-note' },
+                  limitNote,
+                ),
+              // THE TWO EXPLAINING PARAGRAPHS ARE GONE (user report, 2026-11-02).
+              //
+              // They said a backup has "one of two identities" and that only a
+              // "safe" copy is ever rolled back — but since 2026-11-02 the list
+              // has no tier at all: every copy is one row with its own rollback
+              // button. Keeping the paragraph made the page contradict itself,
+              // and a user who believes it will not dare press the button on an
+              // older copy. What is left on this page is what is TRUE: the count,
+              // the rules in force (`keep`), the rows themselves, the path.
               backupItems.length === 0
                 ? h(
                     'span',
@@ -5952,53 +7595,144 @@
                     t('settings.backup.empty'),
                   )
                 : null,
+              // ONE ROW PER COPY, AND ONE SENTENCE ON ONE COPY
+              // (user decision, 2026-11-02).
+              //
+              // The page used to split the list into "the good copy" and
+              // "everything else". That split was a promise the plugin cannot
+              // keep: on a hosted instance nothing ever qualified, so the good
+              // tier was empty forever and every real copy sat in the demoted
+              // row. So there is no tier any more, and nothing is read from
+              // `certifiedBy` / `kind` / `certificationEvidence` to draw a row.
+              //
+              // What is left is what can be said without judging: one row per
+              // copy with its time and its own rollback button, plus the single
+              // sentence that describes WHICH copy this is — the state the host
+              // last started from. `startupCopy` is resolved from the copies' own
+              // records (`startupCopyName`), never from the row order: a sentence
+              // that followed the position would walk onto an older copy the day
+              // the Host returns them in another order.
               backupItems.map((item, index) => h(
                 'div',
                 {
                   className: 'dsh-autorestart-settings__backup',
                   'data-dsh-autorestart-backup': 'item',
+                  'data-backup-index': String(index),
                   key: 'backup-' + index,
                 },
-                // WHEN it was taken. No timezone offset: what is shown is
-                // already the local clock of the machine that took the copy.
                 h(
                   'div',
                   { className: 'dsh-autorestart-settings__backup-row' },
                   h(
                     'span',
-                    { className: 'dsh-autorestart-settings__backup-label' },
-                    t('settings.backup.time'),
+                    {
+                      className: 'dsh-autorestart-settings__backup-value',
+                      'data-dsh-autorestart-backup': 'time',
+                    },
+                    formatBackupTime(item && item.atLocal),
                   ),
+                  // ROLL BACK TO THIS COPY. The button only OPENS the question —
+                  // the route is called from the confirmation card and nowhere
+                  // else, so a click alone never restores anything.
                   h(
-                    'span',
-                    { className: 'dsh-autorestart-settings__backup-value', 'data-dsh-autorestart-backup': 'time' },
-                    formatBackupTime(item && item.atLocal),
+                    'button',
+                    {
+                      type: 'button',
+                      className: 'dsh-autorestart-settings__button',
+                      disabled: busy === true || rollbackBusy === true,
+                      'data-dsh-autorestart-backup': 'rollback',
+                      'data-backup-name': item && typeof item.name === 'string' ? item.name : '',
+                      onClick: () => {
+                        setRollbackNote('')
+                        setRollbackAsk({
+                          name: item && typeof item.name === 'string' ? item.name : '',
+                          atLocal: item && typeof item.atLocal === 'string' ? item.atLocal : null,
+                        })
+                      },
+                    },
+                    t('settings.backup.rollback'),
                   ),
                 ),
-                // HOW BIG it is — and whether the plugins are in it, because
-                // that is WHY it is that big: the note belongs to the size.
-                h(
+                // THE ONE SENTENCE, ON THE ONE COPY IT IS TRUE OF — matched by
+                // the copy's own name, never by `index === 0`.
+                startupCopy !== null && item && item.name === startupCopy
+                  ? h(
+                      'div',
+                      {
+                        className: 'dsh-autorestart-settings__backup-note',
+                        'data-dsh-autorestart-backup': 'startup-hint',
+                      },
+                      t('settings.backup.startupHint'),
+                    )
+                  : null,
+              )),
+              // THE SECOND CONFIRMATION OF A MANUAL ROLLBACK (user decision,
+              // 2026-10-30): it names the copy, says that the current state is
+              // replaced (and that it is saved first), and says that a restart
+              // follows. Nothing is posted until the confirm button is pressed.
+              rollbackAsk === null
+                ? null
+                : h(
                   'div',
-                  { className: 'dsh-autorestart-settings__backup-row' },
+                  {
+                    className: 'dsh-autorestart-settings__confirm',
+                    'data-dsh-autorestart-backup': 'rollback-confirm',
+                  },
                   h(
                     'span',
-                    { className: 'dsh-autorestart-settings__backup-label' },
-                    t('settings.backup.size'),
+                    { className: 'dsh-autorestart-settings__label' },
+                    t('settings.backup.rollbackConfirmTitle'),
                   ),
                   h(
                     'span',
-                    { className: 'dsh-autorestart-settings__backup-value', 'data-dsh-autorestart-backup': 'size' },
-                    formatBackupSize(item && item.bytes),
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'rollback-confirm-body' },
+                    fill(t('settings.backup.rollbackConfirmBody'), { time: formatBackupTime(rollbackAsk.atLocal) }),
                   ),
                   h(
                     'span',
-                    { className: 'dsh-autorestart-settings__backup-note', 'data-dsh-autorestart-backup': 'plugins' },
-                    item && item.includePlugins === true
-                      ? t('settings.backup.withPlugins')
-                      : t('settings.backup.withoutPlugins'),
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'rollback-confirm-restart' },
+                    t('settings.backup.rollbackConfirmRestart'),
+                  ),
+                  h(
+                    'div',
+                    { className: 'dsh-autorestart-settings__backup-actions' },
+                    h(
+                      'button',
+                      {
+                        type: 'button',
+                        className: 'dsh-autorestart-settings__button',
+                        disabled: rollbackBusy === true,
+                        'data-dsh-autorestart-backup': 'rollback-confirm-yes',
+                        onClick: () => void rollbackTo(rollbackAsk),
+                      },
+                      rollbackBusy === true
+                        ? t('settings.backup.rollbackBusy')
+                        : t('settings.backup.rollbackConfirmYes'),
+                    ),
+                    h(
+                      'button',
+                      {
+                        type: 'button',
+                        className: 'dsh-autorestart-settings__button',
+                        disabled: rollbackBusy === true,
+                        'data-dsh-autorestart-backup': 'rollback-confirm-no',
+                        onClick: () => {
+                          // Cancel: nothing was posted, nothing is restored.
+                          setRollbackAsk(null)
+                          setRollbackNote('')
+                        },
+                      },
+                      t('settings.backup.rollbackConfirmNo'),
+                    ),
                   ),
                 ),
-              )),
+              rollbackNote === ''
+                ? null
+                : h(
+                  'span',
+                  { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-backup': 'rollback-note' },
+                  rollbackNote,
+                ),
               backupsInfo.dir === ''
                 ? null
                 : h(
@@ -6033,7 +7767,9 @@
                           pathNote,
                         ),
                   ),
-            ),
+              ),
+                )
+              })(),
           ),
           h(
             'div',
@@ -6073,8 +7809,10 @@
             ),
           ),
           // The SUPERVISOR group: who starts this host, and whether the restart
-          // can work at all.
-          h(
+          // can work at all. HIDDEN ON THE DESKTOP APP (user decision, 2026-11-02):
+          // the desktop client relaunches itself, so there is no supervisor to
+          // install and nothing in this group can be acted on.
+          hostIsDesktop === true ? null : h(
             'div',
             {
               className: 'dsh-autorestart-settings__group',
@@ -6371,10 +8109,16 @@
                 )
               : null,
           ),
-          // "IF DSH WILL NOT START": the two rescue scripts, where they are, and
-          // the way to get them onto the desktop. A user whose host is down
-          // cannot open a README — they need the path, and they need to be
-          // able to copy it.
+          // "IF DSH WILL NOT START": the rescue scripts, where they are, and the
+          // way to reach them. A user whose host is down cannot open a README —
+          // they need the path, and they need to be able to copy it.
+          //
+          // BOTH ENDS SHOW IT (user decision, 2026-11-02, plan B): the desktop
+          // build keeps its rescue entry, and the hosted / web page shows the
+          // SAME group with the SAME title and the SAME entries — the only thing
+          // that changes is that a hosted host has no desktop, so the
+          // "double-click this .lnk" row becomes a COPYABLE COMMAND instead of
+          // being explained away with "the web version has no desktop".
           h(
             'div',
             {
@@ -6386,71 +8130,231 @@
               { className: 'dsh-autorestart-settings__group-title' },
               t('settings.groups.rescue'),
             ),
+            // The rescue group says ONE plain thing (user decision, 2026-11-02):
+            // whether the automatic rollback can work here. The script paths,
+            // "which one do I pick" and the overwrite warning are gone — a
+            // worried user needs a status line and a button, not a manual.
+            // THE TWO SCRIPTS THEMSELVES (audit finding G1, 2026-11-02).
+            //
+            // The page used to say "use the two .sh scripts above" while
+            // rendering NOTHING — the worst possible dead end, because the user
+            // reading it is exactly the one whose host will not start. The paths
+            // come from the Host (the browser never guesses them) and each one
+            // has a copy button.
+            //
+            // Where there IS a desktop entry, the paths sit behind 详情 (the
+            // entry is the main door). Where there is NO desktop (a hosted host,
+            // or a desktop app whose desktop directory could not be found) the
+            // paths are the only way, so they are never folded — same shape on
+            // both ends, keyed on "is there a desktop entry here", not on the OS.
+            rescuePaths.length === 0
+              ? null
+              : (() => {
+                const list = h(
+                  'div',
+                  { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-rescue': 'paths' },
+                  h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'paths-hint' },
+                    t('settings.rescue.hint'),
+                  ),
+                  rescuePaths.map((entry) => h(
+                    'div',
+                    { key: 'rescue-path-' + entry.key, className: 'dsh-autorestart-settings__rescue-path' },
+                    h('span', {
+                      className: 'dsh-autorestart-settings__label',
+                      'data-dsh-autorestart-rescue': 'path-label',
+                    }, entry.key === 'restoreProfile' ? t('settings.rescue.restoreProfile') : t('settings.rescue.emergencyDisable')),
+                    h('code', {
+                      className: 'dsh-autorestart-settings__value',
+                      'data-dsh-autorestart-rescue': 'path',
+                      'data-rescue-key': entry.key,
+                    }, entry.path),
+                    h('button', {
+                      type: 'button',
+                      className: 'dsh-autorestart-settings__button',
+                      disabled: busy,
+                      'data-dsh-autorestart-rescue': 'copy-path',
+                      'data-rescue-key': entry.key,
+                      onClick: () => void copyRescuePath(entry.path),
+                    }, t('settings.rescue.copyPath')),
+                  )),
+                )
+                if (rescueDesktop === '') return list
+                const pathsOpen = rescuePathsOpen || rescueDesktop === ''
+                return h(
+                  'details',
+                  {
+                    className: 'dsh-autorestart-settings__details',
+                    'data-dsh-autorestart-rescue': 'paths-details',
+                    ...(pathsOpen ? { open: true } : {}),
+                    onToggle: (event) => setRescuePathsOpen(Boolean(event && event.target ? event.target.open : false)),
+                  },
+                  h(
+                    'summary',
+                    { className: 'dsh-autorestart-settings__summary', 'data-dsh-autorestart-rescue': 'paths-summary' },
+                    t('settings.rescue.path'),
+                  ),
+                  list,
+                )
+              })(),
+            // THE RESCUE ENTRY, SHOWN THE SAME WAY ON BOTH ENDS (plan B, user
+            // decision 2026-11-02). On a machine WITH a desktop this is the
+            // `.lnk` the user is looking for — its icon and its file name, so
+            // "what am I looking for on the desktop?" is answered on screen, and
+            // one button puts it there. On a host WITHOUT a desktop (a hosted web
+            // / server install) the SAME entry is a COPYABLE COMMAND: copy it,
+            // run it, and it does what the double-click would have done. The
+            // group is never removed and never explained away — only the shape of
+            // this one entry changes, and when the Host has no path at all the
+            // page says so instead of inventing one.
             h(
               'div',
-              { className: 'dsh-autorestart-settings__field' },
-              h(
-                'span',
-                { className: 'dsh-autorestart-settings__hint' },
-                t('settings.rescue.hint'),
-              ),
-            ),
-            rescuePaths.map((entry) => h(
-              'div',
-              {
-                className: 'dsh-autorestart-settings__field',
-                'data-dsh-autorestart-rescue': entry.key,
-              },
-              h(
-                'span',
-                { className: 'dsh-autorestart-settings__label' },
-                t(entry.key === 'restoreProfile' ? 'settings.rescue.restoreProfile' : 'settings.rescue.emergencyDisable'),
-              ),
-              h(
-                'code',
-                { className: 'dsh-autorestart-settings__value', 'data-dsh-autorestart-rescue': 'path' },
-                entry.path,
-              ),
-              h(
-                'button',
-                {
-                  type: 'button',
-                  className: 'dsh-autorestart-settings__button',
-                  disabled: busy,
-                  'data-dsh-autorestart-rescue': 'copy-path',
-                  onClick: () => void copyRescuePath(entry.path),
-                },
-                t('settings.rescue.copyPath'),
-              ),
-              h(
-                'button',
-                {
-                  type: 'button',
-                  className: 'dsh-autorestart-settings__button',
-                  disabled: busy,
-                  'data-dsh-autorestart-rescue': 'reveal',
-                  onClick: () => void revealRescueFolder(),
-                },
-                t('settings.rescue.reveal'),
-              ),
-            )),
-            h(
-              'div',
-              { className: 'dsh-autorestart-settings__field' },
+              { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-rescue': 'shortcut-block' },
+              rescueDesktop === ''
+                ? h(
+                    'div',
+                    { className: 'dsh-autorestart-settings__field', 'data-dsh-autorestart-rescue': 'rescue-command' },
+                    h(
+                      'span',
+                      { className: 'dsh-autorestart-settings__label', 'data-dsh-autorestart-rescue': 'command-label' },
+                      t('settings.rescue.commandLabel'),
+                    ),
+                    rescueCommand === ''
+                      ? h(
+                          'span',
+                          {
+                            className: 'dsh-autorestart-settings__hint',
+                            'data-dsh-autorestart-rescue': 'command-unavailable',
+                          },
+                          t('settings.rescue.commandUnavailable'),
+                        )
+                      : [
+                          h(
+                            'code',
+                            {
+                              className: 'dsh-autorestart-settings__value',
+                              'data-dsh-autorestart-rescue': 'command',
+                              key: 'rescue-command-value',
+                            },
+                            rescueCommand,
+                          ),
+                          h(
+                            'button',
+                            {
+                              type: 'button',
+                              className: 'dsh-autorestart-settings__button',
+                              disabled: busy,
+                              'data-dsh-autorestart-rescue': 'copy-command',
+                              key: 'rescue-command-copy',
+                              onClick: () => void copyRescuePath(rescueCommand),
+                            },
+                            t('settings.rescue.copyCommand'),
+                          ),
+                          h(
+                            'span',
+                            {
+                              className: 'dsh-autorestart-settings__hint',
+                              'data-dsh-autorestart-rescue': 'command-hint',
+                              key: 'rescue-command-hint',
+                            },
+                            t('settings.rescue.commandHint'),
+                          ),
+                        ],
+                  )
+                : [
+                    h(
+                      'div',
+                      { className: 'dsh-autorestart-settings__shortcut', key: 'rescue-shortcut-row' },
+                      h(
+                        'span',
+                        {
+                          className: 'dsh-autorestart-settings__shortcut-icon',
+                          'data-dsh-autorestart-rescue': 'shortcut-icon',
+                          // WHICH FILE THIS ICON IS: the same one the `.lnk`
+                          // gets, or nothing at all — never a made-up picture.
+                          'data-icon-source': rescueIconName,
+                          'data-icon-available': rescueIconAvailable ? 'true' : 'false',
+                          // WHETHER THE PICTURE ON SCREEN IS THE REAL ONE
+                          // (2026-11-02): true means the bytes below came from
+                          // the Host, so the tile drops its stand-in background
+                          // and shows the actual image.
+                          'data-icon-real': rescueIconDataUri === '' ? 'false' : 'true',
+                          'aria-hidden': 'true',
+                          title: rescueIconPath,
+                        },
+                        // THE REAL PICTURE, or the text tile when the Host sent
+                        // none. Never both: two icons on one row would look like
+                        // two different shortcuts.
+                        rescueIconDataUri === ''
+                          ? 'DSH'
+                          : h('img', {
+                            className: 'dsh-autorestart-settings__shortcut-icon-img',
+                            'data-dsh-autorestart-rescue': 'rescue-icon',
+                            src: rescueIconDataUri,
+                            alt: rescueShortcutName,
+                            width: 16,
+                            height: 16,
+                            draggable: 'false',
+                          }),
+                      ),
+                      h(
+                        'span',
+                        {
+                          className: 'dsh-autorestart-settings__shortcut-name',
+                          'data-dsh-autorestart-rescue': 'shortcut-name',
+                        },
+                        rescueShortcutName,
+                      ),
+                    ),
+                    // The button lives only where it can work: a Windows machine
+                    // with a desktop.
+                    rescueIsWindows
+                      ? h(
+                          'button',
+                          {
+                            type: 'button',
+                            className: 'dsh-autorestart-settings__button',
+                            disabled: busy,
+                            'data-dsh-autorestart-rescue': 'shortcut',
+                            key: 'rescue-shortcut-button',
+                            onClick: () => void createRescueShortcut(),
+                          },
+                          rescueShortcutExists ? t('settings.rescue.shortcutDone') : t('settings.rescue.shortcut'),
+                        )
+                      : null,
+                  ],
+              rescueNote === ''
+                ? null
+                : h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'note' },
+                    rescueNote,
+                  ),
+              // REMINDER ONE: this is for a host that does NOT start. Using it
+              // while DSH runs overwrites the configuration in use.
               h(
                 'span',
-                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'which' },
-                t('settings.rescue.which'),
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'shortcut-when' },
+                t('settings.rescue.warning'),
               ),
-            ),
-            h(
-              'div',
-              { className: 'dsh-autorestart-settings__field' },
+              // REMINDER TWO: it puts the WHOLE environment back. Taking one
+              // plugin out is a different button, and the wrong one here costs
+              // the user their working configuration.
               h(
                 'span',
-                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'warning' },
-                t('settings.rescue.warning'),
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'shortcut-scope' },
+                t('settings.rescue.shortcutScope'),
               ),
+              // A Windows desktop app whose desktop directory could not be found:
+              // no shortcut can be placed, and the paths above are the way out.
+              rescueIsWindows && rescueDesktop === ''
+                ? h(
+                    'span',
+                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'no-desktop' },
+                    t('settings.rescue.noDesktop'),
+                  )
+                : null,
             ),
             // WHAT THIS MACHINE CAN DO: the automatic rollback (and what is
             // lost when the machine refuses a watchdog).
@@ -6472,6 +8376,18 @@
                 { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'watchdog-last' },
                 t('settings.rescue.watchdogLast', { result: watchdogLast }),
               ),
+              // The strict-mode answer, in the words the user asked for: nothing
+              // was touched because there is nothing trustworthy to put back.
+              watchdogStrict ? h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'watchdog-strict' },
+                t('settings.rescue.watchdogStrict'),
+              ) : null,
+              watchdogRestoredFrom === '' ? null : h(
+                'span',
+                { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'watchdog-restored-from' },
+                t('settings.rescue.watchdogRestoredFrom', { dir: watchdogRestoredFrom }),
+              ),
             ),
             // The notice is shown ONCE: the Host remembers that the user has
             // read it.
@@ -6481,45 +8397,14 @@
                   { className: 'dsh-autorestart-settings__field' },
                   h(
                     'span',
-                    { className: 'dsh-autorestart-settings__label', 'data-dsh-autorestart-rescue': 'rollback-notice' },
-                    t('settings.rescue.rollbackBlocked'),
-                  ),
-                )
-              : null,
-            // The desktop shortcut is a BUTTON, never a side effect: loading
-            // this page writes nothing to the desktop.
-            rescueDesktop === ''
-              ? h(
-                  'div',
-                  { className: 'dsh-autorestart-settings__field' },
-                  h(
-                    'span',
-                    { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'no-desktop' },
-                    t('settings.rescue.noDesktop'),
+                    { className: 'dsh-autorestart-settings__label', 'data-dsh-autorestart-rescue': 'rollback-notice' },
+                    t('settings.rescue.rollbackBlocked'),
                   ),
                 )
-              : h(
-                  'div',
-                  { className: 'dsh-autorestart-settings__field' },
-                  h(
-                    'button',
-                    {
-                      type: 'button',
-                      className: 'dsh-autorestart-settings__button',
-                      disabled: busy,
-                      'data-dsh-autorestart-rescue': 'shortcut',
-                      onClick: () => void createRescueShortcut(),
-                    },
-                    rescueShortcutExists ? t('settings.rescue.shortcutDone') : t('settings.rescue.shortcut'),
-                  ),
-                  rescueNote === ''
-                    ? null
-                    : h(
-                        'span',
-                        { className: 'dsh-autorestart-settings__hint', 'data-dsh-autorestart-rescue': 'note' },
-                        rescueNote,
-                      ),
-                ),
+              : null,
+            // The desktop shortcut is a BUTTON, never a side effect: loading
+            // this page writes nothing to the desktop. That button now lives in
+            // the block above, together with the icon and the two reminders.
           ),
           // "REPORT A PROBLEM": copy the diagnostics and open a pre-filled
           // issue page. The email is the way out when there is no GitHub
@@ -7315,6 +9200,11 @@
       // features, but only this one has a card here.
       const ANNOUNCED_FEATURE = 'sleep'
 
+      // A HOST THAT CANNOT RESTART (2026-11-02): its own one-time card, in the
+      // same announcement ledger as the feature above — same route, same
+      // "answered once per host" rule, no second mechanism.
+      const ANNOUNCED_RESTART = 'restart-command'
+
       /**
        * The announcements the user has not seen yet.
        *
@@ -7564,6 +9454,632 @@
         )
       }
 
+      /**
+       * The single-plugin restore: the button in the plugin-failure panel.
+       *
+       * `POST /plugin-restore` with `{ "plugin": "<name>" }` puts THAT ONE
+       * plugin back from the last known-good backup. The Host answers with
+       * `ok:false` + a reason for "no backup" / "could not copy" — and it says
+       * so with HTTP 200, because that is an answer, not a server error.
+       */
+      const DEFAULT_PLUGIN_RESTORE_URL = ROUTE_PREFIX + '/plugin-restore'
+
+      /**
+       * WHERE "the user said 知道了" IS REMEMBERED.
+       *
+       * One key, holding the FINGERPRINT of the report that was dismissed — not
+       * a boolean. That is the whole point: a boolean would silence a real
+       * failure forever, while a fingerprint only silences the boot that wrote
+       * that report. The next start writes a new report (new `at`) and the panel
+       * comes back by itself.
+       */
+      const PLUGIN_FAILURE_DISMISS_KEY = 'dsh-autorestart.plugin-failure.dismissed'
+
+      async function restorePluginOnce(plugin) {
+        const response = await fetch(DEFAULT_PLUGIN_RESTORE_URL, {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({ plugin }),
+          cache: 'no-store',
+        })
+        if (!response.ok) throw new Error('HTTP ' + response.status)
+        const body = await response.json()
+        if (!body || typeof body !== 'object') throw new Error('the Host sent no answer')
+        return body
+      }
+
+      /**
+       * THE PLUGIN THAT DID NOT LOAD — the popup the user asked for.
+       *
+       * WHY IT EXISTS: the host ALREADY survives a broken plugin (measured: 22 s
+       * on the desktop, 2.0–2.6 s on hosted `dsh web`, profile untouched, no
+       * repeated restarts under the supervisor), so the plugin no longer
+       * restores anything by itself at boot. What was missing was the OTHER
+       * half: the user finding out. This panel says which plugin did not
+       * activate and what error it reported, and offers exactly one action —
+       * "put THIS one plugin back from the last backup".
+       *
+       * It is an ordinary block in the composer dock (the same place as the
+       * install prompt and the announcement): it never covers the interface and
+       * never touches the countdown. It is not dismissible by hiding a problem:
+       * it disappears when the plugin loads again (a new boot with a clean log,
+       * which clears the report).
+       */
+      /**
+       * WHAT THE PANEL MAY SAY, AND NOTHING MORE.
+       *
+       * Two facts, kept apart on purpose:
+       *   - "these functions did not come up this time" - the watch compared this
+       *     boot with the previous one and something is gone. A hard fact.
+       *   - "these plugins differ from the backup" - a lead, not a verdict: the
+       *     files changed, which may simply mean an upgrade.
+       *
+       * It never says a plugin is broken or failed to load: nothing here can know
+       * that. Interface module names are reported as ONE number and never as
+       * plugin names (they are things like \`batches\`, not plugins).
+       */
+
+      /**
+       * ASK ONCE WHETHER THE WATCHDOG STAYS ON.
+       *
+       * The watchdog already works; what was missing is that nobody ever asked.
+       * The wording says what it DOES (put the last working version back when the
+       * new one does not start) and what turning it off COSTS (you fix it by
+       * hand), because the person reading this is not a programmer.
+       *
+       * The decision is made on the host by shouldAskWatchdog() and arrives as
+       * info.watchdogAsk; this panel only renders it.
+       * Hidden unless the host says it is time to ask: never answered, or the
+       * plugin changed version since the answer.
+       */
+      function WatchdogAskPanel() {
+        const info = useSharedInfo(true)
+        const [busy, setBusy] = useState('')
+        const [answered, setAnswered] = useState(null)
+        const t = makeTranslate(translate)
+        ensureAnnouncementStyle()
+
+        // Nothing to ask: no answer yet is not the same as "we should ask".
+        // The host decides, and it only says yes when there is no answer or the
+        // plugin changed version since the last one.
+        if (answered === 'dismissed') return null
+        if (info === null || info === undefined || info.watchdogAsk !== true) return null
+
+        const answer = (keepOn) => {
+          // THE BUTTON NO LONGER ANSWERS A QUESTION, IT ACKNOWLEDGES A NOTICE
+          // (2026-11-01, user decision): the watchdog ships with the plugin, so
+          // "should it stay on?" was a choice the user does not actually have.
+          // The single button records "the user was told" and nothing else.
+          if (busy !== '') return
+          setBusy('notify')
+          void (async () => {
+            // "SAVED" IS A PROMISE, NOT A GUESS. The request is a success only
+            // when the host really answered 2xx: a 400 or a dead connection means
+            // NOTHING was written, and saying "saved" then would leave the user
+            // believing a record that does not exist on disk.
+            let saved = false
+            try {
+              const response = await fetch(choiceUrlFor(info), {
+                method: 'POST',
+                headers: { 'content-type': 'application/json' },
+                body: JSON.stringify({
+                  watchdogNotified: true,
+                  askedForPluginVersion: typeof info.pluginVersion === 'string' ? info.pluginVersion : '',
+                }),
+              })
+              saved = response !== null && response !== undefined && response.ok === true
+            } catch {
+              saved = false
+            }
+            setAnswered(saved === true ? 'notified' : 'failed')
+            setBusy('')
+          })()
+        }
+
+        /**
+         * PUT EVERY BROKEN PLUGIN BACK, one at a time, never in parallel: the host
+         * writes into the profile, and two restores racing on the same tree is not
+         * worth the risk. Each plugin is awaited before the next one starts.
+         */
+        const restoreAll = (entries) => {
+          if (busy !== '') return
+          setBusy('all')
+          setNote('')
+          void (async () => {
+            let done = 0
+            let failed = 0
+            for (const entry of entries) {
+              try {
+                const answer = await restorePluginOnce(entry.name)
+                if (answer && answer.ok === true) done += 1
+                else failed += 1
+              } catch {
+                failed += 1
+              }
+            }
+            setNote(fill(t('pluginFailure.restoreAllDone'), { done: String(done), failed: String(failed) }))
+            setBusy('')
+          })()
+        }
+
+        const rows = []
+        rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'title' }, t('watchdog.title')))
+        rows.push(h('p', { className: 'dsh-autorestart-announcement__line', key: 'explain' }, t('watchdog.explain')))
+        rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'off' }, t('watchdog.whereOff')))
+        if (answered !== null) {
+          rows.push(h('p', {
+            className: 'dsh-autorestart-announcement__note',
+            key: 'saved',
+          }, t(answered === 'failed' ? 'watchdog.saveFailed' : 'watchdog.noticeSaved')))
+        }
+        // ONE BUTTON, BECAUSE THERE IS NO CHOICE TO MAKE: the watchdog ships with
+        // the plugin. Turning it off is a settings-page decision, not a question
+        // asked once at install time.
+        rows.push(h('button', {
+          type: 'button',
+          className: 'dsh-autorestart-announcement__cta',
+          key: 'got-it',
+          disabled: busy !== '',
+          onClick: () => answer(true),
+        }, t('watchdog.gotIt')))
+        rows.push(overlayHint(t('watchdog.hint')))
+        return overlayCard('watchdog-ask', t('watchdog.title'), () => setAnswered('dismissed'), rows)
+      }
+
+      /**
+       * THE FLOATING CARD.
+       *
+       * The panels used to sit in `conversation.input.dock`, which is part of the
+       * layout flow: the message column was pushed up and the text ran straight
+       * into the conversation with no edge of its own. Declaring the frame here
+       * means every panel draws the same card, whatever the page CSS does.
+       */
+      // THE CARD'S OWN PAINT (2026-11-01).
+      //
+      // Hard-coded, OPAQUE colours on purpose. The first version used
+      // `var(--dsh-surface, #fff)`, and when the theme does not define that
+      // variable the card was drawn with no background at all - on the real
+      // machine the text simply sat in the conversation, indistinguishable from
+      // the messages around it.
+      // THE ANCHOR THAT TAKES NO SPACE.
+      //
+      // `position: fixed` does NOT mean "relative to the viewport" when any
+      // ancestor has `transform`, `filter`, `perspective` or `will-change`: the
+      // card then anchors to that ancestor and stays in its layout, which is why
+      // the conversation was pushed up. This wrapper is ZERO-sized and the card
+      // hangs out of it with `position: absolute`, so the flow never sees it, no
+      // matter what the host puts above us.
+      /**
+       * THE CARD, AS A REAL COMPONENT.
+       *
+       * It has to be a component (not a plain helper) because it now MEASURES
+       * itself: the card renders a line with its own computed style, so a single
+       * screenshot says which layer is broken - the inline style not applied, an
+       * ancestor overriding it, or the portal never happening.
+       *
+       * Every painting property is inline and hard-coded: no className, no CSS
+       * variable. Inline wins over every stylesheet rule, so if the card still
+       * comes out unstyled the reason is not CSS specificity.
+       */
+      // A quiet line under the buttons. The panel is the door; the settings page
+      // is where you come back later if you change your mind.
+      function overlayHint(text) {
+        return h('p', {
+          key: 'overlay-hint',
+          'data-dsh-autorestart-hint': '1',
+          style: {
+            margin: '2px 0 0',
+            color: 'var(--dsw-alias-label-tertiary, #888888)',
+            fontSize: '11px',
+            lineHeight: '1.4',
+          },
+        }, text)
+      }
+
+      function OverlayCard(props) {
+        const id = props ? props.id : 'overlay'
+        const title = props ? props.title : ''
+        const onClose = props && typeof props.onClose === 'function' ? props.onClose : () => {}
+        const rows = props && Array.isArray(props.rows) ? props.rows : []
+        // CARD-LEVEL ACTIONS LIVE IN THE HEADER (user report, 2026-11-02): buttons
+        // that apply to the WHOLE card used to sit at the bottom of the list, so
+        // they looked like they belonged to the last item in it. The header owns
+        // them now — title on the left (it truncates), actions on the right.
+        const actions = props && Array.isArray(props.actions) ? props.actions : []
+        const header = h('div', {
+          key: 'overlay-header',
+          'data-dsh-autorestart-overlay-header': id,
+          style: {
+            display: 'flex',
+            alignItems: 'center',
+            justifyContent: 'space-between',
+            gap: '8px',
+            flexWrap: 'nowrap',
+          },
+        },
+        h('strong', {
+          key: 'overlay-title',
+          style: {
+            flex: '1 1 auto',
+            minWidth: '0',
+            overflow: 'hidden',
+            textOverflow: 'ellipsis',
+            whiteSpace: 'nowrap',
+            fontSize: '14px',
+            lineHeight: '1.4',
+            color: 'var(--dsw-alias-label-primary, #111111)',
+          },
+        }, title),
+        h('div', {
+          key: 'overlay-actions',
+          'data-dsh-autorestart-overlay-actions': id,
+          style: {
+            flex: '0 0 auto',
+            display: 'flex',
+            alignItems: 'center',
+            gap: '6px',
+            flexWrap: 'nowrap',
+          },
+        },
+        actions,
+        h('button', {
+          type: 'button',
+          key: 'overlay-close',
+          title: translate('pluginFailure.close'),
+          'aria-label': translate('pluginFailure.close'),
+          onClick: onClose,
+          style: {
+            flex: '0 0 auto',
+            cursor: 'pointer',
+            border: '1px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.22))',
+            borderRadius: '8px',
+            background: 'var(--dsw-alias-bg-layer-1, #ffffff)',
+            color: 'var(--dsw-alias-label-primary, #111111)',
+            fontSize: '16px',
+            lineHeight: '1',
+            padding: '2px 8px',
+          },
+        }, '\u00d7')))
+
+        const body = [header, ...rows]
+
+        const card = h('div', {
+          key: id,
+          'data-dsh-autorestart-overlay': id,
+          style: {
+            position: "fixed",
+            left: '24px',
+            bottom: '24px',
+            width: 'min(560px, calc(100vw - 48px))',
+            maxHeight: 'min(70vh, 640px)',
+            overflowY: 'auto',
+            boxSizing: 'border-box',
+            background: 'var(--dsw-alias-bg-layer-1, #ffffff)',
+            backgroundColor: 'var(--dsw-alias-bg-layer-1, #ffffff)',
+            border: '1px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.22))',
+            borderRadius: '12px',
+            boxShadow: '0 12px 32px rgba(0,0,0,0.18)',
+            padding: '14px 16px',
+            zIndex: 2147483000,
+            color: 'var(--dsw-alias-label-primary, #111111)',
+            font: 'inherit',
+            textAlign: 'left',
+            lineHeight: '1.5',
+            fontSize: '13px',
+          },
+        }, body)
+
+        return card
+      }
+
+      function overlayCard(id, title, onClose, rows) {
+        return h(OverlayCard, { key: 'overlay-' + id, id, title, onClose, rows })
+      }
+
+      const SETTINGS_STYLE = {
+        section: {
+          display: 'flex',
+          flexDirection: 'column',
+          gap: '10px',
+          padding: '14px 16px',
+          background: 'var(--dsw-alias-bg-layer-1, #ffffff)',
+          color: 'var(--dsw-alias-label-primary, #111111)',
+          border: '1px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.18))',
+          borderRadius: '12px',
+          font: 'inherit',
+          textAlign: 'left',
+          lineHeight: '1.5',
+          fontSize: '13px',
+        },
+        description: { color: 'var(--dsw-alias-label-secondary, #666666)', fontSize: '12px' },
+        button: {
+          alignSelf: 'flex-start',
+          cursor: 'pointer',
+          padding: '6px 14px',
+          borderRadius: '8px',
+          border: '1px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.22))',
+          background: 'var(--dsw-alias-bg-layer-2, #f5f5f5)',
+          color: 'var(--dsw-alias-label-primary, #111111)',
+          font: 'inherit',
+          fontSize: '13px',
+        },
+        restoreButton: {
+          cursor: 'pointer',
+          padding: '3px 10px',
+          borderRadius: '6px',
+          border: '1px solid var(--dsw-alias-border-l2, rgba(0,0,0,0.22))',
+          background: 'var(--dsw-alias-bg-layer-2, #f5f5f5)',
+          color: 'var(--dsw-alias-label-primary, #111111)',
+          font: 'inherit',
+          fontSize: '12px',
+        },
+        list: {
+          display: 'flex',
+          flexDirection: 'column',
+          gap: '6px',
+          margin: 0,
+          padding: 0,
+          listStyle: 'none',
+        },
+        row: {
+          display: 'grid',
+          gridTemplateColumns: '1fr auto auto',
+          alignItems: 'center',
+          gap: '10px',
+          padding: '6px 8px',
+          borderRadius: '8px',
+          background: 'var(--dsw-alias-bg-layer-2, #f7f7f7)',
+        },
+        name: { fontFamily: 'monospace', fontSize: '12px', wordBreak: 'break-all' },
+        status: { color: 'var(--dsw-alias-label-secondary, #666666)', fontSize: '12px', whiteSpace: 'nowrap' },
+        hint: {
+          gridColumn: '1 / -1',
+          color: 'var(--dsw-alias-label-tertiary, #888888)',
+          fontSize: '11px',
+          lineHeight: '1.4',
+        },
+        note: { color: 'var(--dsw-alias-state-warn-label, #a15c00)', fontSize: '12px' },
+      }
+
+      /**
+       * THE SETTINGS PAGE (plugins.bundle.config).
+       *
+       * Everything here is on demand: nothing talks to the inventory route until
+       * the user presses the button. "Check now" really re-requests the route -
+       * it does not re-render whatever the last reading was.
+       */
+      function SettingsPanel() {
+        const info = useSharedInfo(true)
+        const t = makeTranslate(translate)
+
+        const items = []
+        items.push(h('strong', { key: 'settings-title' }, 'dsh-autorestart'))
+        items.push(h('p', { key: 'settings-description', style: SETTINGS_STYLE.description }, t('settings.description')))
+
+        return h('section', { 'data-dsh-autorestart-settings': 'dsh-autorestart', style: SETTINGS_STYLE.section }, items)
+      }
+
+      function PluginFailurePanel() {
+        const info = useSharedInfo(true)
+        const [loaded, setLoaded] = useState(null)
+        const [judgedHere, setJudgedHere] = useState(false)
+        const [busy, setBusy] = useState('')
+        const [note, setNote] = useState('')
+        const [dismissed, setDismissed] = useState(() => {
+          try {
+            return window.localStorage.getItem(PLUGIN_FAILURE_DISMISS_KEY) || ''
+          } catch {
+            return ''
+          }
+        })
+        const t = makeTranslate(translate)
+
+        // The pure helpers live in the second module and are reachable through
+        // the global namespace, like `buildPluginFailureModel` above.
+        const helpers = globalThis.__dshAutorestartClient
+        const build = helpers && typeof helpers.buildPluginFailureModel === 'function'
+          ? helpers.buildPluginFailureModel
+          : null
+        const bootIdOf = helpers && typeof helpers.pluginFailureBootId === 'function'
+          ? helpers.pluginFailureBootId
+          : () => ''
+        const judgedKeyOf = helpers && typeof helpers.pluginFailureJudgedKey === 'function'
+          ? helpers.pluginFailureJudgedKey
+          : () => PLUGIN_FAILURE_DISMISS_KEY
+        const fingerprintOf = helpers && typeof helpers.pluginFailureFingerprint === 'function'
+          ? helpers.pluginFailureFingerprint
+          : () => ''
+
+        // WHICH BOOT IS THIS? (user decision, 2026-11-02.) This card reports the
+        // RESULT of a restart, so the boot identity — not the passing time —
+        // decides when it may appear: `bootId` when the Host sends one,
+        // `generation` when it does not (see pluginFailureBootId).
+        const bootId = bootIdOf(info)
+        const judgedKey = judgedKeyOf(bootId)
+
+        /** The record an earlier judgement of a boot left behind, or null. */
+        const judgedRecord = (key) => {
+          try {
+            const stored = window.localStorage.getItem(key)
+            return stored === null || stored === '' ? null : stored
+          } catch {
+            return null
+          }
+        }
+
+        // THE JUDGEMENT IS THE RESTART EVENT, NOT A LIVE READING. Two requests,
+        // once, on the first mount of this boot — no polling, and nothing that
+        // re-runs when the shared payload refreshes. The effect is keyed on the
+        // boot identity alone, so a page refresh inside the same boot does not
+        // judge again, and the next boot does.
+        useEffect(() => {
+          if (judgedRecord(judgedKey) !== null) return undefined
+          let alive = true
+          const get = async (url) => {
+            try {
+              const response = await fetch(url, { headers: { accept: 'application/json' } })
+              if (!response || response.ok !== true) return null
+              return await response.json()
+            } catch {
+              return null
+            }
+          }
+          void (async () => {
+            const watch = await get(pluginWatchUrlFor(info))
+            const inventory = await get(pluginInventoryUrlFor(info))
+            if (alive !== true) return
+            // THE RECORD IS WRITTEN EVEN WHEN THERE IS NOTHING TO REPORT: "this
+            // boot was judged" is the whole point, so a file that changes later
+            // in the same boot cannot make the card appear out of nowhere.
+            const modelNow = build === null ? null : build({ watch, inventory })
+            try {
+              window.localStorage.setItem(judgedKey, JSON.stringify({
+                at: Date.now(),
+                boot: bootId,
+                fingerprint: fingerprintOf(modelNow),
+              }))
+            } catch {}
+            setJudgedHere(true)
+            setLoaded({ watch, inventory })
+          })()
+          return () => { alive = false }
+        }, [judgedKey])
+
+        // AN EARLIER MOUNT OF THIS BOOT ALREADY JUDGED: nothing to show, and
+        // nothing to ask the Host either (the effect above returned early).
+        if (!judgedHere && judgedRecord(judgedKey) !== null) return null
+
+        if (loaded === null || build === null) return null
+        const model = build({ watch: loaded.watch, inventory: loaded.inventory })
+        if (model === null) return null
+
+        // The fingerprint is WHICH report this is (which plugins did not come up),
+        // so dismissing silences this one for the rest of the boot; the boot record
+        // keeps it silent even after a page refresh.
+        const fingerprint = (model.certain || []).map((entry) => entry.name).sort().join(',')
+        if (dismissed !== '' && dismissed === fingerprint) return null
+        ensureAnnouncementStyle()
+
+        const restore = (plugin) => {
+          if (busy !== '') return
+          setBusy(plugin)
+          setNote('')
+          void (async () => {
+            try {
+              const restored = await restorePluginOnce(plugin)
+              setNote(fill(t('pluginFailure.restored'), { plugin, at: '' }))
+              if (restored && restored.ok !== true) setNote(fill(t('pluginFailure.failed'), { plugin, reason: '' }))
+            } catch (failure) {
+              setNote(fill(t('pluginFailure.failed'), { plugin, reason: describeError(failure) }))
+            }
+            setBusy('')
+          })()
+        }
+        // DISMISS IS BOOT-SCOPED TOO (user decision, 2026-11-02): the record for
+        // this boot already exists (it is written at judgement time), so the card
+        // stays away for the rest of the boot — including after a page refresh —
+        // and the next boot judges again. The fingerprint is stored as well so a
+        // single report can be silenced without silencing the boot.
+        // «全部恢复» needs no extra work for the same reason: it acts on the
+        // judgement that this boot already made.
+        const dismiss = () => {
+          setDismissed(fingerprint)
+          try { window.localStorage.setItem(PLUGIN_FAILURE_DISMISS_KEY, fingerprint) } catch {}
+          try {
+            if (judgedRecord(judgedKey) === null) {
+              window.localStorage.setItem(judgedKey, JSON.stringify({ at: Date.now(), boot: bootId, fingerprint }))
+            }
+          } catch {}
+        }
+
+        const rows = []
+        const line = (key, text) => rows.push(h('p', { className: 'dsh-autorestart-announcement__line', key }, text))
+
+        // NO SECOND TITLE LINE (user report, 2026-11-02): the card header already
+        // says «有两件事要你看一下», and repeating it as the first paragraph made
+        // the panel look like it had two headings.
+
+        // WHICH PLUGINS DID NOT COME UP. There is exactly ONE list on this card
+        // now (user decision, 2026-11-02): a plugin that is declared in the
+        // profile and did not load this time. A file that merely differs from the
+        // backup is NOT on this card — it belongs to the settings page, without a
+        // verdict attached to it.
+        const certain = Array.isArray(model.certain) ? model.certain : []
+        if (certain.length > 0) {
+          rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'certain-title' }, t('pluginFailure.certainTitle')))
+          line('certain-intro', t('pluginFailure.certainIntro'))
+          for (const entry of certain) {
+            line('certain:' + entry.name, entry.name)
+            const action = entry.action && typeof entry.action === 'object' ? entry.action : {}
+            if (entry.kind === 'linked') {
+              rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'hint:' + entry.name }, t('pluginFailure.linkedHint')))
+              rows.push(h('button', {
+                type: 'button',
+                className: 'dsh-autorestart-announcement__cta',
+                key: 'cta:' + entry.name,
+                disabled: busy !== '',
+                onClick: () => restore(entry.name),
+              }, busy === entry.name
+                ? fill(t('pluginFailure.restoring'), { plugin: entry.name })
+                : fill(t('pluginFailure.restore'), { plugin: entry.name })))
+            } else {
+              rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'hint:' + entry.name }, t('pluginFailure.thirdPartyHint')))
+              if (typeof action.command === 'string' && action.command !== '') {
+                rows.push(h('p', { className: 'dsh-autorestart-announcement__line', key: 'cmd:' + entry.name }, action.command))
+              } else {
+                rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'nocmd:' + entry.name }, t('pluginFailure.noVersion')))
+              }
+            }
+          }
+        }
+
+        // ONE BUTTON FOR ALL OF THEM. Only plugins we wrote ourselves are in it:
+        // a third-party plugin has no files in the backup, so "restore" cannot be
+        // offered for it - those keep their reinstall hint instead.
+        //
+        // IT BELONGS TO THE CARD, SO IT SITS IN THE HEADER (user report,
+        // 2026-11-02): at the bottom of the list it read like "restore all" applied
+        // to the last plugin only. Same for «知道了».
+        const linkedClues = certain.filter((entry) => entry.kind === 'linked')
+        const actions = []
+        if (linkedClues.length > 1) {
+          actions.push(h('button', {
+            type: 'button',
+            className: 'dsh-autorestart-announcement__cta',
+            'data-dsh-autorestart-plugin-failure': 'restore-all',
+            key: 'restore-all',
+            disabled: busy !== '',
+            onClick: () => restoreAll(linkedClues),
+          }, fill(t('pluginFailure.restoreAll'), { count: String(linkedClues.length) })))
+        }
+
+        // A blind spot is a NUMBER: those module names are not plugin names.
+        const blind = Number(model.uiBlindSpot)
+        if (Number.isFinite(blind) && blind > 0) {
+          rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'blind' },
+            fill(t('pluginFailure.uiBlindSpot'), { count: String(blind) })))
+        }
+        if (note !== '') rows.push(h('p', { className: 'dsh-autorestart-announcement__note', key: 'note' }, note))
+
+        actions.push(h('button', {
+          type: 'button',
+          className: 'dsh-autorestart-announcement__cta',
+          'data-dsh-autorestart-plugin-failure': 'dismiss',
+          key: 'dismiss',
+          title: t('pluginFailure.dismissLabel'),
+          onClick: dismiss,
+        }, t('pluginFailure.dismiss')))
+
+        return h(OverlayCard, {
+          key: 'overlay-plugin-failure',
+          id: 'plugin-failure',
+          title: t('pluginFailure.title'),
+          onClose: dismiss,
+          rows: rows.concat([overlayHint(t('pluginFailure.hint'))]),
+          actions,
+        })
+      }
+
       return {
         inject: ['slots', 'locale'],
         apply(ctx) {
@@ -7586,6 +10102,10 @@
           // same dock (it never covers the interface and never touches the
           // countdown) and disappears for good once the user answered it.
           ctx.slots.inject('conversation.input.dock', () => ctx.slots.register({ name: 'conversation.input.dock', id: 'autorestart-feature-announcement', order: 8, locale: NS }, FeatureAnnouncementPanel))
+          // THE PLUGIN THAT DID NOT LOAD (user decision, 2026-11-01): the boot
+          // pass only REPORTS now, so this panel is where the user finds out
+          // which plugin did not activate — and where the ONE action lives:
+          // "put this one plugin back from the last backup".
           // The graceful-shutdown button: a LIST slot at the foot of the left
           // sidebar, beside the Settings row. The slot is a ROOT slot, so the
           // button is there even when no conversation is open — and the
@@ -7627,6 +10147,20 @@
           // back) in the middle of the interface, so the composer row can stay
           // one short clipped line. It draws NOTHING when no restart is staged.
           ctx.slots.inject('shell.overlay', () => ctx.slots.register({ name: 'shell.overlay', id: 'autorestart-restart-overlay', order: 55, locale: NS }, RestartOverlay))
+          // THESE TWO COME LAST ON PURPOSE: the countdown and the restart notice are
+          // registered above, and the slot service keeps registrations in call order.
+          // The plugin-failure and watchdog cards join them in the same floating layer.
+      // THE DOCK, ON PURPOSE (2026-11-01). These two cards were registered on
+      // `shell.overlay` first, and on the real machine NOTHING rendered at all -
+      // not even the diagnostic skeleton - so that slot never reached this plugin.
+      // `conversation.input.dock` is the slot this plugin has always rendered in.
+      // The card is taken OUT of the layout flow by its own `position: fixed`, so
+      // it floats in the corner instead of pushing the conversation up.
+      ctx.slots.inject('shell.overlay', () => ctx.slots.register({ name: 'shell.overlay', id: 'autorestart-plugin-failure', order: 9, label: () => 'dsh-autorestart', locale: NS }, PluginFailurePanel))
+      ctx.slots.inject('shell.overlay', () => ctx.slots.register({ name: 'shell.overlay', id: 'autorestart-watchdog-ask', order: 8, label: () => 'dsh-autorestart', locale: NS }, WatchdogAskPanel))
+      // THE SETTINGS PAGE lives on its OWN slot, keyed to this package.
+      // Name + key + locale is exactly how dsh-mnemon registers there.
+      ctx.slots.inject('plugins.bundle.config', () => ctx.slots.register({ name: 'plugins.bundle.config', key: 'dsh-autorestart', locale: NS }, SettingsPanel))
           // NOTE: the receipt of a settings change is NOT registered here. It
           // is a `sticky` strip INSIDE the settings panel (see
           // `saveNoticeBar`), because a window overlay put it on top of the
@@ -7643,3 +10177,301 @@
   })
 
 })()
+
+;(function () {
+  // ---------------------------------------------------------------------------
+  // THE PLUGIN-FAILURE MODEL (pure, testable, no React and no fetch)
+  //
+  // Two DIFFERENT facts feed the panel, and they must never be blurred:
+  //
+  //   certain - "these functions did not come up this time". A HARD fact: the last
+  //             reading had them and this one does not.
+  //   clues   - "these plugins differ from the backup". A LEAD, not a verdict. A
+  //             plugin whose files changed may be perfectly fine.
+  //
+  // Neither of them says a plugin is BROKEN or FAILED to load: we have no way to
+  // know that, and claiming it would be a guess dressed up as a finding.
+  //
+  // The three live layers are not equally good at naming a plugin. Measured on the
+  // real host: tools 140 items, packages 29, clientModules only 4 - and those four
+  // are module names (`batches`, `entries`, `release`), NOT plugin names. So
+  // clientModules never produces a list entry; it becomes one number.
+  // ---------------------------------------------------------------------------
+
+  const PLUGIN_FAILURE_THIRD_PARTY = 'third-party'
+  const PLUGIN_FAILURE_LINKED = 'linked'
+
+  /** `codekg_query` -> `codekg`; a name with no separator is returned as it is. */
+  function pluginFailureToolOwner(name) {
+    const text = typeof name === 'string' ? name.trim() : ''
+    if (text === '') return ''
+    const cut = text.indexOf('_')
+    return cut > 0 ? text.slice(0, cut) : text
+  }
+
+  /** `@scope/name#host` -> `@scope/name`; `plain` stays `plain`. */
+  function pluginFailurePackageName(name) {
+    const text = typeof name === 'string' ? name.trim() : ''
+    if (text === '') return ''
+    const cut = text.indexOf('#')
+    return cut > 0 ? text.slice(0, cut) : text
+  }
+
+  /** Entry name out of one layer item, or '' when the shape is not recognised. */
+  function pluginFailureLayerItemName(item) {
+    if (typeof item === 'string') return item.trim()
+    if (item === null || typeof item !== 'object') return ''
+    for (const key of ['name', 'id', 'key', 'label']) {
+      const value = item[key]
+      if (typeof value === 'string' && value.trim() !== '') return value.trim()
+    }
+    return ''
+  }
+
+  /** The items a watch layer reports as gone, whichever shape the host used. */
+  function pluginFailureWatchLayer(watch, layer) {
+    const out = []
+    const push = (item) => {
+      if (typeof item === 'string') { if (item.trim() !== '') out.push(item.trim()); return }
+      if (item === null || typeof item !== 'object') return
+      // `{layer, name}` (listDisappearances) or `{name, ...}`
+      if (item.layer !== undefined && item.layer !== layer) return
+      const name = pluginFailureLayerItemName(item)
+      if (name !== '') out.push(name)
+    }
+    try {
+      if (Array.isArray(watch && watch.disappeared)) {
+        for (const item of watch.disappeared) push(item)
+      }
+      const layers = watch && typeof watch === 'object' ? watch.layers : null
+      const bucket = layers && typeof layers === 'object' ? layers[layer] : null
+      if (bucket && Array.isArray(bucket.removed)) {
+        for (const item of bucket.removed) push(item)
+      }
+    } catch {
+      return []
+    }
+    return out
+  }
+
+  /** The inventory rows, whichever wrapper the route used. */
+  function pluginFailureInventoryRows(inventory) {
+    if (inventory === null || typeof inventory !== 'object') return []
+    if (Array.isArray(inventory.plugins)) return inventory.plugins
+    if (Array.isArray(inventory.items)) return inventory.items
+    if (Array.isArray(inventory.entries)) return inventory.entries
+    return []
+  }
+
+  /** Is this inventory row a plugin the user wrote themselves (a link install)? */
+  function pluginFailureIsLinked(row) {
+    if (row === null || typeof row !== 'object') return false
+    if (row.linked === true) return true
+    if (row.isLink === true) return true
+    for (const key of ['kind', 'installKind', 'source', 'install', 'mode']) {
+      const value = row[key]
+      if (typeof value === 'string' && /^(link|linked|local|dev|development)$/i.test(value.trim())) return true
+    }
+    return false
+  }
+
+  /**
+   * Turn one plugin into the action the panel is allowed to offer.
+   *
+   * A hand-written (link) plugin can be put back from the backup: we hold its
+   * files. A third-party plugin CANNOT - that is the whole point of keeping only
+   * the config - so it gets a hint and a command with the EXACT version, never a
+   * one-click button that would silently install something else.
+   */
+  function pluginFailureActionFor(name, kind, row, profile) {
+    if (kind === PLUGIN_FAILURE_LINKED) {
+      return { type: 'restore', label: name }
+    }
+    const version = row && typeof row === 'object' && typeof row.version === 'string' ? row.version.trim() : ''
+    const profileName = typeof profile === 'string' && profile.trim() !== '' ? profile.trim() : '<profile>'
+    if (version === '') {
+      return {
+        type: 'hint',
+        command: null,
+        note: 'the exact version is unknown, so no install command can be built',
+      }
+    }
+    return {
+      type: 'hint',
+      command: 'dsh plugin --profile ' + profileName + ' add ' + name + '@' + version,
+      note: '',
+    }
+  }
+
+  /**
+   * THE BOOT THIS PAGE BELONGS TO (user decision, 2026-11-02).
+   *
+   * The plugin card reports the RESULT of a restart, so it is judged once per
+   * boot — not monitored. The identity comes from the health payload: `bootId`
+   * when the Host sends one, `generation` when it does not. Several wrappers are
+   * accepted because the payload is flat in some builds and nested in others;
+   * when the Host says nothing at all the identity is '' and the panel falls back
+   * to one judgement per page load (reporting once beats monitoring forever).
+   *
+   * @param {object|null} info the shared health payload
+   * @returns {string} the boot identity, or ''
+   */
+  function pluginFailureBootId(info) {
+    const read = (source, key) => {
+      if (source === null || typeof source !== 'object') return ''
+      const value = source[key]
+      if (typeof value === 'string' && value.trim() !== '') return value.trim()
+      if (typeof value === 'number' && Number.isFinite(value)) return String(value)
+      return ''
+    }
+    const holders = [info]
+    if (info !== null && typeof info === 'object') {
+      for (const key of ['health', 'status', 'instance', 'restart']) {
+        if (info[key] !== null && typeof info[key] === 'object') holders.push(info[key])
+      }
+    }
+    for (const key of ['bootId', 'boot', 'generation']) {
+      for (const holder of holders) {
+        const found = read(holder, key)
+        if (found !== '') return found
+      }
+    }
+    return ''
+  }
+
+  /**
+   * WHERE the "this boot was already judged" record lives: the key carries the
+   * boot identity, so a restart leaves the old record behind and the next boot
+   * starts clean.
+   *
+   * @param {string} bootId the identity from {@link pluginFailureBootId}
+   * @returns {string} the localStorage key
+   */
+  function pluginFailureJudgedKey(bootId) {
+    const id = typeof bootId === 'string' && bootId.trim() !== '' ? bootId.trim() : 'page'
+    return 'dsh-autorestart.plugin-failure.judged.' + id
+  }
+
+  /**
+   * The identity of one judgement: which functions are missing and which plugins
+   * differ. Stored with the boot record so the page can tell "already reported"
+   * from "the same report came back".
+   *
+   * @param {object|null} model a model from {@link buildPluginFailureModel}
+   * @returns {string}
+   */
+  function pluginFailureFingerprint(model) {
+    const names = (list) => (Array.isArray(list) ? list : [])
+      .map((entry) => (entry && typeof entry.name === 'string' ? entry.name : ''))
+      .filter((name) => name !== '')
+      .sort()
+      .join(',')
+    if (model === null || typeof model !== 'object') return ''
+    return names(model.certain)
+  }
+
+  /**
+   * Merge the two data sources into the panel's model.
+   *
+   * @param {{ watch?: object|null, inventory?: object|null, profile?: string }} input
+   * @returns {{ certain: object[], uiBlindSpot: number, watchAt: number|null }|null}
+   */
+  function buildPluginFailureModel(input) {
+    try {
+      const source = input !== null && typeof input === 'object' ? input : {}
+      const watch = source.watch !== null && typeof source.watch === 'object' ? source.watch : null
+      const inventory = source.inventory !== null && typeof source.inventory === 'object' ? source.inventory : null
+      const profile = typeof source.profile === 'string' ? source.profile : ''
+
+      // WHICH PLUGINS DID NOT COME UP (user decision, 2026-11-02).
+      //
+      // The ONLY evidence this card accepts: a plugin PACKAGE that loaded on the
+      // previous start and is not loaded now. That is "it did not come up" — the
+      // whole entry is gone, not just a few of its tools.
+      //
+      // What is deliberately NOT evidence:
+      //   * a file difference from the backup (an upgrade, our own edits) — that is
+      //     normal work, and the settings page shows it without judging it;
+      //   * a FEW capabilities disappearing while the package still loads — an
+      //     upgrade renames a tool; that is not a plugin that failed;
+      //   * a plugin the user removed from the bundles — that already happened.
+      const notInstalled = new Set()
+      const inventoryRows = pluginFailureInventoryRows(inventory)
+      for (const row of inventoryRows) {
+        if (row === null || typeof row !== 'object') continue
+        if (row.status !== 'not-installed') continue
+        const name = typeof row.name === 'string' ? row.name.trim() : ''
+        if (name !== '') notInstalled.add(name)
+      }
+      const inventoryRowFor = (name) => inventoryRows
+        .find((row) => row !== null && typeof row === 'object'
+          && typeof row.name === 'string' && row.name.trim() === name) || null
+
+      const certain = []
+      const byName = new Map()
+      const addNotLoaded = (value, from) => {
+        // `@scope/pkg@1.2.3` is one package with a version: the card names the
+        // PLUGIN, and the version belongs in the command, not in the name.
+        const text = typeof value === 'string' ? value.trim() : ''
+        const at = text.lastIndexOf('@')
+        const name = at > 0 ? text.slice(0, at) : text
+        if (name === '') return
+        if (notInstalled.has(name)) return
+        if (byName.has(name)) return
+        const row = inventoryRowFor(name)
+        const kind = row !== null && pluginFailureIsLinked(row) ? PLUGIN_FAILURE_LINKED : PLUGIN_FAILURE_THIRD_PARTY
+        const entry = {
+          name,
+          source: from,
+          kind,
+          action: pluginFailureActionFor(name, kind, row, profile),
+          lostTools: [],
+        }
+        byName.set(name, entry)
+        certain.push(entry)
+      }
+      for (const raw of pluginFailureWatchLayer(watch, 'packages')) addNotLoaded(pluginFailurePackageName(raw), 'packages')
+
+      // A vanished TOOL is EVIDENCE, never a trigger: it is attached to a package
+      // that already did not come up. A tool that vanished while its package still
+      // loads is an upgrade and stays out of this card.
+      for (const raw of pluginFailureWatchLayer(watch, 'tools')) {
+        const owner = pluginFailureToolOwner(raw)
+        const entry = byName.get(owner)
+        if (entry === undefined) continue
+        const tool = typeof raw === 'string' ? raw.trim() : ''
+        if (tool !== '' && entry.lostTools.includes(tool) === false) entry.lostTools.push(tool)
+      }
+
+      // clientModules CANNOT name a plugin: its items are module names. It is a
+      // blind spot, and it is reported as a number so nobody mistakes `batches`
+      // for a plugin the user should go and look for.
+      const uiBlindSpot = pluginFailureWatchLayer(watch, 'clientModules').length
+
+      // Nothing to say: no shell, no empty panel.
+      if (certain.length === 0) return null
+
+      const watchAt = watch && Number.isFinite(Number(watch.at)) ? Number(watch.at) : null
+      return { certain, uiBlindSpot, watchAt }
+    } catch {
+      // The panel is a convenience; a malformed payload must never break the page.
+      return null
+    }
+  }
+
+  const PLUGIN_FAILURE_EXPORTS = {
+    buildPluginFailureModel,
+    pluginFailureBootId,
+    pluginFailureJudgedKey,
+    pluginFailureFingerprint,
+    pluginFailureToolOwner,
+    pluginFailurePackageName,
+  }
+  if (typeof globalThis !== 'undefined') {
+    globalThis.__dshAutorestartClient = Object.assign(
+      globalThis.__dshAutorestartClient || {},
+      PLUGIN_FAILURE_EXPORTS,
+    )
+  }
+
+})()