dsh-background-by-model 0.10.0 → 0.11.0

package/CHANGELOG.md

@@ -1,6 +1,19 @@
 # Changelog
 
-> The full release history lives here; the **Recent optimizations** section of [README.md](./README.md#recent-optimizations) lists only the two most recent releases (v0.10.0 / v0.9.2).
+> The full release history lives here; the **Recent optimizations** section of [README.md](./README.md#recent-optimizations) lists only the two most recent releases (v0.11.0 / v0.10.0).
+
+## v0.11.0
+
+- **The runtime download source moves to Bilibili's image CDN** — the recommended profile's seven wallpapers and both holiday pictures now come from `i0`/`i1`/`i2.hdslb.com`, three edges falling back to each other (measured: same path, same bytes, identical sha1). The README's three screenshots play no part at runtime and stay where they were.
+- **The recommended profile's rules ship inside the plugin** — seven model rules and their interface numbers moved into `src/profile.ts`, and the button downloads only the seven pictures. It no longer depends on GitHub being reachable, and the `preset.json` manifest, the schema-version gate and the "not a profile" error codes retire with it: what gets installed is always what this build itself writes, and nothing remote chooses what that is.
+- **The request set is a compile-time constant** — slot → BFS path, written out in one table, and `fetchPresetImage` honours only that table: a slot it does not carry answers `bad slot` before any request, so a wrong press cannot become "fetch 64 files because somebody else's document said so". `PRESET_IMAGE_COUNT_MAX` and that whole attack surface go with it.
+- **A BFS path is a content hash, so an address is immutable** — the "a tag can be re-pointed at different bytes" case cannot arise, which also retires "remember to bump `*_ASSETS_REF` along with the art".
+- **The addresses must carry `@3840w.webp`** — the uploads are 2.4–12 MB PNGs (76 MB for the set); that suffix is what serves 250–365 KB 4K WebPs, byte-for-byte what an existing data directory already holds, so nothing is re-downloaded and nothing loses detail on a 4K screen.
+- **The festival cache is keyed by content hash** — `holiday-cache/<tag>/` became `holiday-cache/<first eight of the hash>/`, computed by `holidayArtGeneration` from the URL. New art means a new address, therefore a new directory and a guaranteed re-download, with no version constant to remember; the old tag directories (and 0.7.9's flat layout) are taken by the same `pruneHolidayCache` once the new art lands, whose keep-set is the deduplicated set of "the current generation of each holiday".
+- **`SCHEMA_VERSION` stays 10** — nothing entered or left the config shape: what changed is where these numbers come from, not what they look like, so an older host and an older exported file both still read it.
+- **`check:preset` now pins the built-in profile itself** — rule order and paintability, the slot ↔ URL table agreeing in both directions, the webp transform and content hash in every address, `profileImagePath`'s null whitelist, generations that cannot collide, and the old remote wiring being gone.
+- **`check:node` rewrites the holiday and profile sections** — the three edges asked in order and always for the SAME path, a holiday failing only when every edge does, a retry budget of nine requests (three edges × three rounds) for weather worth waiting out, the old `fetchPresetConfig` method provably gone, the slot whitelist (holiday slots, table-missing slots and malformed names all refused before anything is requested), a stale `holiday-cache/v0.1.0` directory being swept, and `resetStore` still leaving the festival art alone.
+- **`check:scheme` section 3 no longer reaches the network** — it used to fetch the remote `preset.json` and compare schemas; that manifest is gone, so it now pins that the client asks for no head at all, that the slot list comes from the built-in table, and that the addresses carry the webp transform at Bilibili's hosts.
 
 ## v0.10.0
 

package/CHANGELOG.zh.md

@@ -1,6 +1,19 @@
 # 更新日志
 
-> 这里保留完整的历史记录；[README.zh.md](./README.zh.md#近期优化) 的「近期优化」一节只列最近两个版本（v0.10.0 / v0.9.2）。
+> 这里保留完整的历史记录；[README.zh.md](./README.zh.md#近期优化) 的「近期优化」一节只列最近两个版本（v0.11.0 / v0.10.0）。
+
+## v0.11.0
+
+- **运行时下载源换成 B 站图床** —— 推荐配置的七张壁纸与中秋、国庆两张节日画全部改从 `i0/i1/i2.hdslb.com` 取，三个边缘互为回落（实测同样路径、同样字节，sha1 一致）。README 的三张截图不参与运行时，仍留在原来的地方。
+- **推荐配置的规则改成随插件内置** —— 七条模型规则与那套界面数值搬进 `src/profile.ts`，按钮只下载七张图。于是它不再依赖 GitHub 能通，`preset.json` 清单、schema 版本闸与「不是配置」这类错误码一起退休：能被安装的规则永远就是这份构建自己写的那些，远端没有任何东西在选择装什么。
+- **请求清单变成编译期常量** —— 槽位 → BFS 路径写死在一张表里，而 `fetchPresetImage` 只认这张表：表里没有的槽位直接回 `bad slot`，所以一次按错不可能变成「按别人给的清单去取 64 个文件」。`PRESET_IMAGE_COUNT_MAX` 与 65 张图那条攻击面随之消失。
+- **BFS 路径是内容哈希，地址天然不可变** —— 不再有「tag 被重新指向别的字节」这种可能；顺带把「换素材要记得同时改 `*_ASSETS_REF`」这个坑一起消掉了。
+- **地址必须带 `@3840w.webp`** —— 上传的原图是 2.4–12 MB 的 PNG（九张合计 76 MB），这样取才是 250–365 KB 的 4K WebP，并且与现有数据目录里那几份的 sha1 逐字节一致，所以 4K 屏上不掉画质、老用户也不需要重下。
+- **节日画的缓存目录按内容哈希分代** —— `holiday-cache/<tag>/` 变成 `holiday-cache/<哈希前八位>/`，由 `holidayArtGeneration` 从 URL 现算。换图 = 换地址 = 换目录 = 必然重下，没有需要记得去改的版本常量；旧的 tag 目录（以及 0.7.9 的平铺布局）在新图落盘后由同一次 `pruneHolidayCache` 带走，清扫时的保留集是「每个节日当前那一代」的去重集合。
+- **`SCHEMA_VERSION` 保持 10** —— 这次没有字段进出配置形状：变的是这些数值从哪来，不是它们长什么样，所以旧宿主、旧导出文件都照常读。
+- **`check:preset` 改成钉内置配置本身** —— 规则顺序与可画性、槽位 ↔ 地址表的双向一致、每个地址的 webp 变换与内容哈希、`profileImagePath` 的 null 白名单、缓存分代不重复，以及旧的远端接线已经不在。
+- **`check:node` 重写节日与推荐配置两节** —— 三个边缘的依次回落与「同一条路径」、全部边缘失败才失败、「一次坏天气值得再来一轮」的重试预算（3 边缘 × 3 轮 = 9 个请求封顶）、旧 `fetchPresetConfig` 方法确实已不存在、槽位白名单（节假日槽位、表外槽位、非法名都在下载前被拒）、`holiday-cache/v0.1.0` 这类旧目录会被清扫，以及 `resetStore` 仍然不动节日画。
+- **`check:scheme` 第 3 节不再联网** —— 它原本要拉远端 `preset.json` 比 schema，现在清单不存在了，改为钉住「客户端不再请求清单」「槽位清单来自内置表」「地址带 webp 变换且指向 B 站」。
 
 ## v0.10.0
 

package/README.md

@@ -107,7 +107,7 @@ One switch on the Config page and nothing else: on 中秋节 and 国庆节 the w
 
 - **中秋 is 农历八月十五**, resolved from the Chinese calendar in **Asia/Shanghai**, so it moves every year (2024-09-17, 2025-10-06, 2026-09-25 …); **国庆 is October 1–7**; when the two collide, 中秋 wins.
 - **A holiday with no image falls through** to the model rules rather than blanking the wallpaper.
-- **The art is downloaded, not shipped** — one compressed wallpaper per holiday, pinned to a release tag of the project's [assets repository](https://github.com/HarmlessFunny/assets) and cached under `holiday-cache/<tag>/` on the first read of the day. The download is gated on the calendar, so an ordinary day fetches nothing at all and every later boot is answered from disk.
+- **The art is downloaded, not shipped** — one compressed wallpaper per holiday, served by **Bilibili's image CDN** (`i0`/`i1`/`i2.hdslb.com`, three edges falling back to each other) and cached under `holiday-cache/<hash>/` on the first read of the day. The directory is named after the **content hash** in the URL: new art means a new address, therefore a new directory and a guaranteed re-download — there is no version constant to remember to bump. The download is gated on the calendar, so an ordinary day fetches nothing at all and every later boot is answered from disk.
 - **Neither the art nor its palette is swappable** — a holiday slot is read-only, the colors and the full-bleed Fill mode come from the definition, and theme exports carry your rules only.
 
 ### Per-rule and per-image settings
@@ -126,12 +126,15 @@ One switch on the Config page and nothing else: on 中秋节 and 国庆节 the w
 
 ### Recommended profile
 
-One click on the Config tab downloads the author's own configuration — rules, wallpapers and interface settings — from the project's assets repository.
+One click on the Config tab installs the author's own configuration — seven model rules and their interface numbers **ship inside the plugin**, and only the seven wallpapers are downloaded, from **Bilibili's image CDN**.
 
-- **Hosted in the store's own shape** (`preset/preset.json`, `preset/theme-config.json`, one `modelbg-<slot>` file per wallpaper), so it stays editable on GitHub and publishing it is a `cp`.
+- **The rules are no longer a remote file** — they are compiled into the bundle, at the same version as the code that reads them. So this button does not need GitHub to be reachable, and there is no "the remote profile is newer than this build" case left to refuse: what gets installed is always what this build itself writes.
+- **The wallpaper addresses are a constant table** — slot → BFS path, fixed at build time. The request set never comes off the network, so a wrong press cannot turn into "fetch 64 files because somebody else's document said so".
+- **One address, one set of bytes** — a BFS path is a hash of the upload, so a wallpaper URL is immutable in a way a git tag is not.
+- **`@3840w.webp` is load-bearing** — the uploads are 2.4–12 MB PNGs (76 MB for the set); with that suffix they are the 250–365 KB 4K WebPs an existing data directory already holds, byte for byte.
 - **Every interface number in it is what the plugin already ships with**, so on a new install the button adds rules and pictures; on a store you have already tuned it resets those too, because it is a whole configuration and not a patch.
 - **The download comes before the question**, so the confirmation can say what is actually in hand — and the wipe comes after the download, never before it. It is the only card in the panel that **asks before it deletes**.
-- **One missing wallpaper fails the whole attempt and names the slot**, and every file retries on its own, keeping what arrived for the next press.
+- **One missing wallpaper fails the whole attempt and names the slot**, and every file retries on its own (three edges × three rounds), keeping what arrived for the next press.
 
 ### Image storage cleanup
 
@@ -166,7 +169,7 @@ Data directory: `~/.dsh/.dsh-background-by-model-data/` (Windows: `C:\Users\<you
 | `theme-config.json` | The rule list (each rule with its image list, and each image with its own look and rotation settings) plus the global Interface settings, the global switch effect and the holiday overrides |
 | `theme-config.json.bak` | The previous config, as of the last **successful** save. Every save writes a temp file and renames it over the live one, rotating the current good file into `.bak` first; a live file that will not parse is restored from here instead of falling back to the factory defaults. With neither readable, the cleanup card refuses to delete images |
 | `modelbg-<slot>` | One image, stored as raw bytes without a file extension — one file per image, so a rule with three images owns three slots |
-| `holiday-cache/<tag>/<asset>` | Festival art downloaded from the CDN, one file per holiday (`mid-autumn.webp`, `national-day.webp`) inside a directory named after the assets release this build pins (`v0.1.0`). The tag is part of the path so that a build pinning a new tag starts from an empty directory instead of being answered with the previous generation's bytes; the file inside is named after the **asset**, deliberately outside the slot namespace, which is what keeps a holiday slot read-only. Superseded generations are pruned once the new art is on disk. Delete a file here and it is simply re-downloaded the next time that holiday is in force |
+| `holiday-cache/<hash>/<asset>` | Festival art downloaded from Bilibili's image CDN, one file per holiday (`mid-autumn.webp`, `national-day.webp`) inside a directory named after the **first eight characters of that picture's content hash** (`42e22801`, `30e97211` today). The hash is part of the path so that new art lands in a directory nobody has written to — it cannot be answered with the previous generation's bytes, and there is no version constant to keep in step. The file inside is named after the **asset**, deliberately outside the slot namespace, which is what keeps a holiday slot read-only. Superseded generations (including every `holiday-cache/<tag>/` from 0.10 and earlier) are pruned once the new art is on disk. Delete a file here and it is simply re-downloaded the next time that holiday is in force |
 
 ## Installation
 
@@ -228,12 +231,12 @@ After changing anything under `src/`, run `pnpm run bundle` again — the mounte
 - **`check:code-plate`** — the code block's plate: its tokens declared on both `:root` and `body`, the light branch emitting the banner, and each surface reading its own plugin variable.
 - **`check:image-mode`** — the lift onto the image for the layout mode and the three paint effects, and which image a control edits against which the render layer reads.
 - **`check:rules`** — the two decisions behind the tab strip, which live in `src/client/rules-view.ts`, plus the page structure the layout rests on.
-- **`check:preset`** — the recommended profile's retry policy and what a failed attempt holds for the next one, with both halves shown using them.
+- **`check:preset`** — the profile itself (its rules, its slot → URL table and its generation constant) alongside the retry policy and what a failed attempt holds for the next one, with both halves shown using them. The rules are compiled in now, so this is also what catches a rule pointing at a slot the table does not carry — a mistake that would otherwise only show up after a release.
 - **`check:ui`** — both dictionaries carrying the same keys, every `dab-…` class styled, no dead entry, and every `var(--dsw-…)` published by the installed theme.
 - **`check:watchdogs`** — one heartbeat, entries firing on their own due time, paused while the tab is hidden, no timer left by dispose, and no module outside the entry starting its own interval.
-- **`check:scheme`** — the `data-ds-dark-theme` hand-off: the plugin only rewrites the value it wrote, hands the flag back when it drops its tokens, and repaints when the scheme moves.
+- **`check:scheme`** — the `data-ds-dark-theme` hand-off: the plugin only rewrites the value it wrote, hands the flag back when it drops its tokens, and repaints when the scheme moves. It no longer reaches the network: the recommended profile's manifest it used to compare against is compiled in now.
 - **`check:store`** — the two decisions behind the storage cleanup, `referencedSlots` and `orphanSlots`: a picture in use is never an orphan, a stray holiday-slot file always is, and the browser half sends RULE slots rather than the whole config.
-- **`check:node`** — the built node half through its real RPC handler with `DSH_HOME` redirected and `fetch` stubbed: the holiday block, the festival art's caching and pruning, mirror fallback, the per-image color AND effect lifts, the global switch effect, the atomic config write with its backup and its recovery, the store's usage report and cleanup, and the recommended profile end to end.
+- **`check:node`** — the built node half through its real RPC handler with `DSH_HOME` redirected and `fetch` stubbed: the holiday block, the festival art's content-hash cache and its pruning, fallback across the three edges, the per-image color AND effect lifts, the global switch effect, the atomic config write with its backup and its recovery, the store's usage report and cleanup, and the recommended profile's seven pictures end to end (including the old manifest method being gone, the slot whitelist, and the retry budget).
 
 ## FAQ
 
@@ -289,6 +292,16 @@ The effect is **Instant**, or the duration is `0` — an effect and a duration a
 
 > Only the two most recent releases are listed here; older ones live in [CHANGELOG.md](./CHANGELOG.md).
 
+### v0.11.0
+
+- **The download source moves to Bilibili's image CDN** — the recommended profile's seven wallpapers and both holiday pictures now come from `i0`/`i1`/`i2.hdslb.com`, three edges falling back to each other; the three screenshots in this README stay where they are, since they play no part at runtime.
+- **The recommended profile's rules ship inside the plugin** — seven model rules and their interface numbers are compiled into the bundle, and the button downloads only the seven pictures. It no longer needs GitHub to be reachable, and there is no "the remote profile is newer than this build" gate left, nor a `preset.json` manifest — what gets installed is always what this build itself writes.
+- **The request set is a constant table** — slot → BFS path, fixed at build time, and a BFS path is a hash of the upload. So a wallpaper URL is immutable in a way a git tag is not.
+- **The addresses carry `@3840w.webp`** — the uploads are 2.4–12 MB PNGs (76 MB for the set); with that suffix they are the 250–365 KB 4K WebPs whose sha1 matches what is already in a data directory.
+- **The festival cache is keyed by content hash** — `holiday-cache/<tag>/` became `holiday-cache/<first eight of the hash>/`. New art means a new address, therefore a new directory and a guaranteed re-download; the "remember to bump the version too" trap is gone, and the old tag directories are taken by the same sweep once the new art lands.
+- **`SCHEMA_VERSION` stays 10** — nothing entered or left the config shape: what changed is where those numbers come from, not what they look like.
+- **Checks** — `check:preset` now pins the built-in profile itself (rule order, the slot ↔ URL table, the webp transform and content hash in each address, the cache generation); `check:node` rewrites the holiday and profile sections (three-edge fallback and the retry budget, the old `fetchPresetConfig` method being gone, the slot whitelist, tag directories being swept); section 3 of `check:scheme` no longer reaches the network.
+
 ### v0.10.0
 
 - **The config is written atomically, with a `.bak` of the last good file** — a save writes a temp file and renames it over the live one, keeping the previous parseable file as the backup; a corrupt live file is restored from it instead of falling back to the factory defaults and then being overwritten by your next drag.
@@ -298,11 +311,6 @@ The effect is **Instant**, or the duration is `0` — an effect and a duration a
 - **A switch between two different opacity, brightness or blur values animates now** — each layer keeps its own picture's filter, and the wallpaper's opacity rides the transition instead of snapping.
 - **Dragging one of the three sliders no longer repaints everything per frame** — a drag frame writes only that field's property, and one full repaint lands when the gesture ends.
 
-### v0.9.2
-
-- **The Config tab gains an "Image storage" card** — it reports how much is cleanable and how many files that is, then offers the button; only unreferenced files go, the config and the festival art stay, and any file that resists is named.
-- **`check:store`, so there are thirteen checks now** — both READMEs had been claiming ten, having missed `check:watchdogs` and `check:scheme` since v0.8.1; they are listed again alongside the new one.
-
 ## Star History
 [![Star History Chart](https://api.star-history.com/chart?repos=HarmlessFunny/dsh-background-by-model&type=timeline&legend=bottom-right)](https://www.star-history.com/?repos=HarmlessFunny%2Fdsh-background-by-model&type=timeline&legend=bottom-right)
 

package/README.zh.md

@@ -107,7 +107,7 @@
 
 - **中秋是农历八月十五**，按**北京时间**从中国农历解析，所以每年都动（2024-09-17、2025-10-06、2026-09-25 …）；**国庆是 10 月 1–7 日**；两者撞上时中秋优先。
 - **没有图的节日会顺延**给模型规则，而不是把背景刷白。
-- **画是下载的，不随包发布** —— 每个节日一张压缩后的壁纸，钉在项目 [assets 仓库](https://github.com/HarmlessFunny/assets)的一个发行 tag 上，当天第一次读取时缓存到 `holiday-cache/<tag>/`。下载由日历把关，所以平常的日子一个字节都不取，此后的每一次启动都直接读盘。
+- **画是下载的，不随包发布** —— 每个节日一张压缩后的壁纸，从**B 站图床**（`i0/i1/i2.hdslb.com`，三个边缘互为回落）取，当天第一次读取时缓存到 `holiday-cache/<哈希>/`。缓存目录名来自 URL 里那段**内容哈希**：换图就必须换地址，于是换目录、必然重下，没有需要记得去改的版本号。下载由日历把关，所以平常的日子一个字节都不取，此后的每一次启动都直接读盘。
 - **画和它的配色都不可以换** —— 节日槽位只读，颜色与满幅的「填充」都取自定义，主题导出也只带你的规则。
 
 ### 每条规则与每张图各自的设置
@@ -126,12 +126,15 @@
 
 ### 推荐配置
 
-「配置」页点一下就下载作者本人的整套配置 —— 规则、壁纸与界面设置 —— 来自项目的 assets 仓库。
+「配置」页点一下就换上作者本人的整套配置 —— 七条模型规则与那套界面数值**随插件内置**，只有七张壁纸从**B 站图床**下载。
 
-- **托管在数据目录自己的形状里**（`preset/preset.json`、`preset/theme-config.json`，每张壁纸一个 `modelbg-<slot>` 文件），所以它能在 GitHub 上直接编辑，发布它就是一次 `cp`。
+- **规则不再是远端文件** —— 它编译在包里，和读它的代码同一个版本。所以这个按钮不需要 GitHub 能通，也不存在「远端配置比插件新」这种要拦的情况：能被安装的规则，永远是这份构建自己写的那些。
+- **壁纸地址是一张常量表** —— 槽位 → BFS 路径，编译期就定死了。请求清单因此不是从网上下载来的，一次按错也不可能变成「按别人的清单去取 64 个文件」。
+- **一个地址对应一份内容** —— BFS 的路径是上传内容的哈希，所以壁纸地址天然不可变，不像 git tag 那样能被重新指向别的字节。
+- **`@3840w.webp` 是必须的** —— 它们上传的原图是 2.4–12 MB 的 PNG（九张合计 76 MB），加上这个后缀才是 250–365 KB 的 4K WebP，也正是现有数据目录里已经存着的那份字节（sha1 一致）。
 - **里面每一个界面数字都是插件本来就用着的值**，所以在新装上是「加上规则和图片」；而在你已经调过的数据目录上，它把这些也一起重置 —— 它是一整份配置，不是一个补丁。
 - **先下载、后提问**，所以确认框能如实说出手里有什么 —— 而清空在下载**之后**，绝不在之前。它是面板里唯一一张会**先问再删**的卡片。
-- **少一张壁纸就整体失败并报出是哪个槽位**，而且每个文件各自重试，已经下到的部分留给下一次。
+- **少一张壁纸就整体失败并报出是哪个槽位**，而且每个文件各自重试（三个边缘 × 三轮），已经下到的部分留给下一次。
 
 ### 图片存储清理
 
@@ -166,7 +169,7 @@
 | `theme-config.json` | 规则列表（每条规则含图片列表，每张图含自己的外观与轮换设置）+ 全局「界面」设置 + 全局切换效果 + 节日覆盖配置 |
 | `theme-config.json.bak` | 上一份**写成功时**的配置。每次保存都是「先写临时文件、再改名覆盖」，并在覆盖前把当前这份合格的文件留成 `.bak`；主文件读不出来时就从这里恢复，而不是退回出厂默认。读不出且没有备份时，清理卡会拒绝删图 |
 | `modelbg-<slot>` | 一张图片，保存为原始字节、无扩展名 —— 一张图一个文件，所以一条有三张图的规则占三个槽位 |
-| `holiday-cache/<tag>/<asset>` | 从 CDN 下载的节日画，一个节日一个文件（`mid-autumn.webp`、`national-day.webp`），装在一个以**插件所钉的 assets 发行版**命名的目录里（`v0.1.0`）。tag 进了路径，所以钉了新 tag 的构建从一个空目录开始，而不是被告知上一代的字节就是答案；目录里的文件名仍然是**素材名**，刻意放在槽位命名空间之外，这正是节日槽位只读的原因。被取代的旧代会在新图落盘之后被清掉。删掉这里的文件也没关系，下次那个节日生效时会重新下载 |
+| `holiday-cache/<哈希>/<asset>` | 从 B 站图床下载的节日画，一个节日一个文件（`mid-autumn.webp`、`national-day.webp`），装在一个以**该图内容哈希的前八位**命名的目录里（今天是 `42e22801`、`30e97211`）。哈希进了路径，所以换了图就是换了一个空目录，不可能被告知上一代的字节就是答案 —— 也没有需要记得去改的版本常量；目录里的文件名仍然是**素材名**，刻意放在槽位命名空间之外，这正是节日槽位只读的原因。被取代的旧代（包括 0.10 及更早的 `holiday-cache/<tag>/`）会在新图落盘之后被清掉。删掉这里的文件也没关系，下次那个节日生效时会重新下载 |
 
 ## 安装
 
@@ -228,12 +231,12 @@ pnpm test            # 构建 lib/、类型检查、跑十三道检查
 - **`check:code-plate`** —— 代码块底板：token 在 `:root` 与 `body` 上都有声明、浅色分支发出 banner、两块表面各读自己的插件变量。
 - **`check:image-mode`** —— 布局模式与三个壁纸效果放到图片上的那次抬升，以及某个控件编辑的是哪张图、渲染层读的又是哪张图。
 - **`check:rules`** —— 选项卡背后那两个住在 `src/client/rules-view.ts` 的判定，以及布局所依赖的页面结构。
-- **`check:preset`** —— 推荐配置的重试策略与失败那一次给下一次留下什么，并验证两侧真的在用它们。
+- **`check:preset`** —— 推荐配置本身（规则、槽位 ↔ 地址表、那一代常量）与重试策略，以及失败那一次给下一次留下什么，并验证两侧真的在用它们。规则现在编译在包里，所以这里也负责拦住「某条规则指向一个表里没有的槽位」这种只有发布后才会发现的错。
 - **`check:ui`** —— 两本字典键集一致、每个 `dab-…` 类都有样式、没有死键，以及每个 `var(--dsw-…)` 都是已安装主题发布过的 token。
 - **`check:watchdogs`** —— 一条心跳、按各自到期时间触发、隐藏即暂停、dispose 不留定时器，且入口之外没有模块自己起 interval。
 - **`check:scheme`** —— `data-ds-dark-theme` 的交接：插件只改自己写的那个值、清掉 token 时一起交还标记、方案变了会重绘。
 - **`check:store`** —— 存储清理的两个判定：`referencedSlots` 与 `orphanSlots`。钉住「正在用的图不会被当成孤儿」与「节日槽位的文件必须可清」，外加浏览器半边传的是**规则槽位**而不是整份配置。
-- **`check:node`** —— 把构建好的 node 半边通过真实的 RPC 处理器跑一遍（`DSH_HOME` 指向临时目录、`fetch` 换成桩）：节日配置块、节日画的缓存与清理、镜像回落、逐图颜色与逐图效果的抬升、全局切换效果、配置的原子写与备份/恢复、图片存储的用量报告与清理，以及推荐配置的整条链路。
+- **`check:node`** —— 把构建好的 node 半边通过真实的 RPC 处理器跑一遍（`DSH_HOME` 指向临时目录、`fetch` 换成桩）：节日配置块、节日画按内容哈希的缓存与清理、三个边缘的回落、逐图颜色与逐图效果的抬升、全局切换效果、配置的原子写与备份/恢复、图片存储的用量报告与清理，以及推荐配置的七张图（含旧清单方法的消失、槽位白名单、超时与重试预算）。
 
 ## 常见问题
 
@@ -289,6 +292,16 @@ pnpm test            # 构建 lib/、类型检查、跑十三道检查
 
 > 这里只列最近两个版本；更早的版本见 [CHANGELOG.zh.md](./CHANGELOG.zh.md)。
 
+### v0.11.0
+
+- **下载源换成 B 站图床** —— 推荐配置的七张壁纸与中秋、国庆两张节日画，全部改从 `i0/i1/i2.hdslb.com` 取，三个边缘互为回落；README 里那三张截图仍留在原处，它们不参与运行时。
+- **推荐配置的规则改成随插件内置** —— 七条模型规则与那套界面数值编译进包里，按钮只下载七张图。于是它不再需要 GitHub 能通，也不再有「远端配置比插件新」这道闸和 `preset.json` 清单 —— 能被安装的规则永远就是这份构建自己写的那些。
+- **请求清单变成一张常量表** —— 槽位 → BFS 路径编译期定死，而 BFS 路径是上传内容的哈希，所以壁纸地址天然不可变，不像 git tag 那样能被重新指向别的字节。
+- **地址带 `@3840w.webp`** —— 上传的原图是 2.4–12 MB 的 PNG（九张合计 76 MB），加上这个后缀才是 250–365 KB 的 4K WebP，与现有数据目录里那几份字节的 sha1 完全一致。
+- **节日画的缓存目录按内容哈希分代** —— 从 `holiday-cache/<tag>/` 改成 `holiday-cache/<哈希前八位>/`。换图就换地址、换目录、必然重下，那个「记得顺手把版本号也改了」的坑从此不存在；旧的 tag 目录会在新图落盘后由同一次清扫带走。
+- **`SCHEMA_VERSION` 仍是 10** —— 这次没有字段进出配置形状：变的是这些数值从哪来，不是它们长什么样。
+- **门禁** —— `check:preset` 改钉内置配置本身（规则顺序、槽位 ↔ 地址表、地址里的 webp 变换与内容哈希、缓存分代），`check:node` 重写节日与推荐配置两节（三个边缘的回落与重试预算、旧 `fetchPresetConfig` 方法已不存在、槽位白名单、tag 目录被清扫），`check:scheme` 第 3 节不再联网。
+
 ### v0.10.0
 
 - **配置改成原子写，并留一份 `.bak`** —— 保存先写临时文件再改名覆盖，覆盖前把当前能解析的那份留成备份；主文件坏了就从备份恢复，而不是退回出厂默认、再被你下一次拖动覆盖掉。
@@ -298,11 +311,6 @@ pnpm test            # 构建 lib/、类型检查、跑十三道检查
 - **透明度、亮度或模糊不同的两张图之间切换现在有动画了** —— 每个图层记住自己那张图的滤镜，壁纸透明度也跟着过渡走，不再直接切。
 - **拖动这三个滑块不再每帧整块重绘** —— 拖动只写那个字段自己的属性，松手才走一次完整重绘。
 
-### v0.9.2
-
-- **「配置」页多了一张「图片存储」卡片** —— 先报出可清理多少、涉及几个文件，再给你一个清理按钮；只删没有规则引用的文件，配置与节日画都不动，删不掉的文件会点名。
-- **`check:store`，于是现在十三道校验** —— 两份 README 此前一直写着「十道」，`check:watchdogs` 与 `check:scheme` 从 v0.8.1 起就没列进去，这次一并补上。
-
 ## Star History
 
 [![Star History Chart](https://api.star-history.com/chart?repos=HarmlessFunny/dsh-background-by-model&type=timeline&legend=bottom-right)](https://www.star-history.com/?repos=HarmlessFunny%2Fdsh-background-by-model&type=timeline&legend=bottom-right)

package/lib/client.js

@@ -103,12 +103,14 @@ window.__ModuleLoader__.load({
 			id: "mid-autumn",
 			slot: "h-midautumn",
 			asset: "mid-autumn.webp",
+			source: "/bfs/new_dyn/42e22801827aff71267b03c95fcfd7834168597.png@1672w.webp",
 			color: "#384A77",
 			kind: "lunar"
 		}, {
 			id: "national-day",
 			slot: "h-nationalday",
 			asset: "national-day.webp",
+			source: "/bfs/new_dyn/30e97211189f7869dae83b909d2a3cc84168597.png@3456w.webp",
 			color: "#FFF6EB",
 			kind: "gregorian"
 		}];
@@ -1167,17 +1169,13 @@ window.__ModuleLoader__.load({
 			};
 		}
 		/**
-		* The profile's manifest and config, in one answer. Reads nothing, writes nothing.
+		* One of the profile's wallpapers, addressed by the slot the built-in config names.
 		*
 		* Raw rather than `rpcCall` for the same reason `fetchImageUrl` is: the node half
-		* answers this one with a value that CARRIES its own failure, and the `error`
-		* inside it is the only thing worth showing the user — the generic "rpc failed"
-		* log would throw that distinction away.
+		* answers this one with a value that CARRIES its own failure, and the `error` inside
+		* it is the only thing worth showing the user — the generic "rpc failed" log would
+		* throw that distinction away.
 		*/
-		async function fetchPresetConfig() {
-			return unwrapPreset(await rpcRaw("fetchPresetConfig", {}));
-		}
-		/** One of the profile's wallpapers, addressed by the slot the config names. */
 		async function fetchPresetImage(slot) {
 			return unwrapPreset(await rpcRaw("fetchPresetImage", { slot }));
 		}
@@ -4970,7 +4968,7 @@ window.__ModuleLoader__.load({
 			importDone: "已导入配置",
 			importFail: "导入失败，文件格式不正确",
 			recCardTitle: "推荐配置",
-			recCardDesc: "从项目素材库下载作者维护的一整套配置（规则、壁纸与接口设置），一键替换当前的全部内容",
+			recCardDesc: "换上作者维护的一整套配置（规则与界面数值随插件内置，壁纸从图床下载），一键替换当前的全部内容",
 			recAdopt: "采用推荐配置",
 			recBusy: "正在下载",
 			recConfirmTitle: "替换当前的全部配置？",
@@ -4980,12 +4978,9 @@ window.__ModuleLoader__.load({
 			recConfirmOk: "删除并替换",
 			recConfirmCancel: "取消",
 			recDone: "已采用推荐配置",
-			recFailNetwork: "推荐配置下载失败，请检查网络后重试",
-			recFailNotProfile: "素材库返回的内容不是配置，请稍后重试",
-			recFailNewer: "这份推荐配置需要更新的插件版本，未做任何改动",
-			recFailTooMany: "这份推荐配置列出的图片数量超出限制，未做任何改动",
+			recFailNetwork: "壁纸下载失败，请检查网络后重试（已下到的会留到下一次）",
 			recFailTooLarge: "这份推荐配置体积过大，未做任何改动",
-			recFailImage: "这张壁纸没拿到（素材库里缺这个文件）：",
+			recFailImage: "这张壁纸没拿到（图床上这个地址没有回应）：",
 			recFailApply: "未能写入推荐配置，你原来的配置没有被改动",
 			storeCardTitle: "图片存储",
 			storeCardDesc: "因意外导致的孤儿图片这里可以清掉",
@@ -5154,7 +5149,7 @@ window.__ModuleLoader__.load({
 			importDone: "Profile imported",
 			importFail: "Import failed — invalid file",
 			recCardTitle: "Recommended profile",
-			recCardDesc: "Download the author's own full setup — rules, wallpapers and interface settings — and replace everything with it",
+			recCardDesc: "Install the author's own full setup — rules and interface numbers ship with the plugin, wallpapers are downloaded from the image host — replacing everything you have",
 			recAdopt: "Use recommended profile",
 			recBusy: "Downloading",
 			recConfirmTitle: "Replace your entire profile?",
@@ -5164,12 +5159,9 @@ window.__ModuleLoader__.load({
 			recConfirmOk: "Delete and replace",
 			recConfirmCancel: "Cancel",
 			recDone: "Recommended profile applied",
-			recFailNetwork: "Could not download the recommended profile — check your connection and retry",
-			recFailNotProfile: "The asset host answered with something that is not a profile — try again later",
-			recFailNewer: "This profile needs a newer plugin version. Nothing was changed.",
-			recFailTooMany: "The recommended profile names more images than the plugin will fetch. Nothing was changed.",
+			recFailNetwork: "Could not download the wallpapers — check your connection and retry (what arrived is kept for the next try)",
 			recFailTooLarge: "The recommended profile is too large. Nothing was changed.",
-			recFailImage: "Could not fetch this wallpaper — the asset host has no such file:",
+			recFailImage: "Could not fetch this wallpaper — the image host does not answer for that address:",
 			recFailApply: "Could not write the recommended profile — your own is untouched",
 			storeCardTitle: "Image storage",
 			storeCardDesc: "Orphaned image files left behind by an accident can be cleared here",
@@ -5206,41 +5198,6 @@ window.__ModuleLoader__.load({
 		//#endregion
 		//#region src/preset.ts
 		/**
-		* JSON with object keys in a fixed (sorted) order — the same string for the same
-		* value, whatever order the object that carried it happened to build its keys in.
-		*
-		* `JSON.stringify` alone is not an identity for a value that came off the wire and
-		* through a sanitizer: key order is an accident of how the object was assembled,
-		* and a resume that missed on it would silently re-download everything (the safe
-		* direction) while a resume that MATCHED on a value it should not have would be
-		* the unsafe one — so this is deliberately total as well: anything JSON cannot
-		* carry (a function, a `Symbol`, `undefined`) serializes as `null` and an
-		* `undefined` property is skipped, exactly as `JSON.stringify` treats it.
-		*/
-		function canonical(value) {
-			if (Array.isArray(value)) return `[${value.map(canonical).join(",")}]`;
-			if (value !== null && typeof value === "object") return `{${Object.entries(value).filter(([, v]) => v !== void 0).sort(([a], [b]) => a < b ? -1 : a > b ? 1 : 0).map(([k, v]) => `${JSON.stringify(k)}:${canonical(v)}`).join(",")}}`;
-			return JSON.stringify(value) ?? "null";
-		}
-		/**
-		* The identity of one revision of the profile: the manifest's shape version plus
-		* the config, in canonical form.
-		*
-		* The profile is served at ONE version of the assets repository, but a version
-		* reference is only as fixed as the tag behind it: re-point the tag and every
-		* edge that has not been purged keeps answering with the previous bytes of the
-		* same URL. So "the profile" is still not guaranteed to be one fixed thing, and
-		* the bytes a previous attempt is holding are only known to belong to what is
-		* being installed when that config comes back the same. Order-insensitivity is
-		* what lets this be a comparison of VALUES rather than of spellings —
-		* `normalizeConfig` (./schema) rebuilds the config it reads, so pinning the key
-		* to the exact key order the wire happened to use would make the hold useless
-		* the moment anything upstream normalized differently.
-		*/
-		function presetKey(version, config) {
-			return `${version}\n${canonical(config)}`;
-		}
-		/**
 		* The bytes of a failed attempt that may be reused for the revision `key` names.
 		*
 		* A fresh object every time, never the held record itself: the caller fills it in
@@ -5264,6 +5221,145 @@ window.__ModuleLoader__.load({
 		function presetMissing(slots, images) {
 			return slots.filter((slot) => images[slot] === void 0);
 		}
+		/** Every slot the profile installs, in list order — the download set. */
+		const PROFILE_SLOTS = [
+			{
+				slot: "m1",
+				path: "/bfs/new_dyn/e4565384e7e5b2d75756e577f505534b4168597.png"
+			},
+			{
+				slot: "m2",
+				path: "/bfs/new_dyn/aa6e8649701c91e5ac8f43ff28b97a924168597.png"
+			},
+			{
+				slot: "m3",
+				path: "/bfs/new_dyn/5da92b31df5ee2a20b17ec6be353cf5c4168597.png"
+			},
+			{
+				slot: "m4",
+				path: "/bfs/new_dyn/14bb1e53cb2c13ca80bd23e3c1d2a04e4168597.png"
+			},
+			{
+				slot: "m5",
+				path: "/bfs/new_dyn/f51fff40de2d6eaa5a73d177f7bbfa794168597.png"
+			},
+			{
+				slot: "m6",
+				path: "/bfs/new_dyn/cfa71d4e60a2f12aaeec3efe1aa680b34168597.png"
+			},
+			{
+				slot: "m7",
+				path: "/bfs/new_dyn/c09d34b79d9b447d7db98da68b97afc54168597.png"
+			}
+		].map((i) => i.slot);
+		/**
+		* Identity of this generation of the built-in profile.
+		*
+		* Only one thing reads it: what a failed download KEEPS for the next press
+		* (`PresetHeld.key` in ./preset). Editing the rules or the pictures below must bump
+		* it, or a retry could staple a wallpaper from the old set to a config from the new
+		* one — the same reason the remote profile was compared by value rather than
+		* assumed. Nothing else in the plugin persists it.
+		*/
+		const RECOMMENDED_REVISION = "builtin-1";
+		/**
+		* One rule of the profile: the match string, its picture and that picture's color.
+		*
+		* The color is a per-image value (schema 10), and the triple here is the one the
+		* profile has always carried — an HSL accent per model, used to tint the interface
+		* while its wallpaper is on screen.
+		*/
+		function profileRule(id, match, slot, color) {
+			return {
+				id,
+				images: [defaultImage(slot, color, "fill")],
+				match,
+				enabled: true,
+				color: null,
+				rotate: defaultRotation()
+			};
+		}
+		/**
+		* The profile, as a fresh config every call.
+		*
+		* ORDER IS THE FALLBACK: matching runs top→bottom and the first usable rule is what
+		* an unmatched model gets, so `deepseek` leads — the model this plugin was written
+		* for. Everything below the rules is the interface numbers a fresh install already
+		* starts on (`DEFAULT_PART_OPACITIES` and friends), which is what makes installing
+		* the profile "add the rules and the pictures" on a clean store.
+		*
+		* Deliberately NOT taken from `freshThemeConfig()`: that one seeds a single BLANK
+		* rule, and this one must not inherit it.
+		*/
+		function recommendedConfig() {
+			return {
+				rules: [
+					profileRule("r1", "deepseek", "m3", [
+						191.88931210132625,
+						.5046198735613555,
+						.82
+					]),
+					profileRule("r2", "gpt", "m1", [
+						263.5122459614382,
+						.31076923076923096,
+						.82
+					]),
+					profileRule("r3", "claude", "m2", [
+						18.923814597762384,
+						.5486699795381468,
+						.6
+					]),
+					profileRule("r4", "qwen", "m4", [
+						26.25977410947,
+						.6228354978354975,
+						.82
+					]),
+					profileRule("r5", "glm", "m5", [
+						30.15559737458117,
+						.6552284141830319,
+						.7646280172718907
+					]),
+					profileRule("r6", "kimi", "m6", [
+						229.39645097591443,
+						.5752269829617896,
+						.2
+					]),
+					profileRule("r7", "grok", "m7", [
+						217.3791348600509,
+						.7702645947081058,
+						.2
+					])
+				],
+				opacities: { ...DEFAULT_PART_OPACITIES },
+				transition: defaultTransition(),
+				settingsOpacity: 1,
+				chatTextOpacity: DEFAULT_CHAT_TEXT_OPACITY,
+				trajectoryOpacity: DEFAULT_TRAJECTORY_OPACITY,
+				rightbarOpacity: DEFAULT_RIGHTBAR_OPACITY,
+				pageOpacity: 0,
+				autoExtract: true,
+				holidays: {
+					enabled: true,
+					items: defaultHolidayRules()
+				}
+			};
+		}
+		/**
+		* The profile as the document both imports consume — the same shape `exportTheme`
+		* writes, so everything downstream (the wipe, the slot loop) is the hand-picked
+		* file's path.
+		*
+		* `images` is filled by the caller as the downloads land, which is what makes a
+		* partially downloaded profile a resumable one rather than an all-or-nothing press.
+		*/
+		function recommendedThemeFile(images = {}) {
+			return {
+				version: 10,
+				exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
+				config: recommendedConfig(),
+				images
+			};
+		}
 		//#endregion
 		//#region src/client/repaint.ts
 		/**
@@ -7722,19 +7818,15 @@ window.__ModuleLoader__.load({
 		/**
 		* The ways the recommended-profile download can fail, mapped to their copy.
 		*
-		* They are worth telling apart because they ask different things of the user and
-		* of whoever maintains the assets repository: nothing answering is a network to
-		* retry, a mirror that answered with something that is not a profile is not
-		* going to start working on a retry, a profile written for a newer plugin is a
-		* "update this build", and too many images is a profile nobody should install.
-		* A failure that names a SLOT is a fifth case and is rendered separately — that
-		* one is the author's file naming, and only the slot tells them which.
+		* Two cases, because the profile is now only PICTURES: the rules and their numbers
+		* are compiled in, so there is no manifest to be malformed, no shape to be too new
+		* and no config to name too many slots. What is left is the network ("retry") and
+		* the cap on the total ("nobody should install this"). A failure that names a SLOT
+		* is rendered separately — that one is about one BFS address, and the slot is what
+		* says which.
 		*/
 		const REC_ERROR_KEYS = {
 			"download failed": "recFailNetwork",
-			"not a profile": "recFailNotProfile",
-			"newer version": "recFailNewer",
-			"too many images": "recFailTooMany",
 			"too large": "recFailTooLarge"
 		};
 		function ProfilePage({ p, notify }) {
@@ -8418,12 +8510,12 @@ window.__ModuleLoader__.load({
 		/**
 		* Ceiling on what one recommended profile may add up to, across every wallpaper.
 		*
-		* The node half caps each file and the number of files, but it answers one
-		* independent call at a time and never sees a running total — the client is the
-		* only side that does, so the total is bounded here. The real profile is 2.2 MB
-		* of images across seven of them, so this is generous by design: it exists to
-		* stop a config that names sixty-four eight-megabyte slots from turning one
-		* button press into half a gigabyte, not to second-guess the author.
+		* The node half caps ONE file, but it answers one independent call at a time and
+		* never sees a running total — the client is the only side that does, so the total
+		* is bounded here. The real profile is 2.2 MB of images across seven of them, so
+		* this is generous by design: it exists so that a build which grew a wrong URL
+		* (or an edge that served an upload instead of the transform) cannot turn one
+		* button press into half a gigabyte.
 		*/
 		const PRESET_TOTAL_MAX = 33554432;
 		/**
@@ -8434,7 +8526,8 @@ window.__ModuleLoader__.load({
 		* CDN edge was still cold). What is being paid is per-request latency, and the
 		* host speaks HTTP/2 — the bytes are identical either way and the connection is
 		* reused — so overlapping them buys wall-clock time and risks nothing but a
-		* little contention.
+		* little contention. The same holds for the Bilibili edges the pictures come from
+		* now (see `PROFILE_HOSTS` in ../profile).
 		*
 		* Four rather than all seven: a burst that wide competes for the same bandwidth
 		* and makes the per-file timeout harder to reason about, and four already hides
@@ -9060,30 +9153,28 @@ window.__ModuleLoader__.load({
 						}
 					},
 					/**
-					* Fetch the project's recommended profile. Downloads only — applying it is
-					* separate, because the page has to ask before anything is destroyed and the
-					* question should describe what is actually in hand.
+					* Fetch the recommended profile's wallpapers. Downloads only — applying them
+					* is separate, because the page has to ask before anything is destroyed and
+					* the question should describe what is actually in hand.
+					*
+					* The RULES are not fetched at all: they are compiled into the bundle
+					* (./profile), so this is a set of picture transfers and nothing else. That
+					* is why there is no manifest round, no shape gate and no "not a profile"
+					* failure left — nothing remote can decide what this installs.
 					*
-					* The profile is a DIRECTORY, so this is a pool rather than one call: the
-					* config names the slots and each wallpaper is one request, up to
-					* `PRESET_CONCURRENCY` at a time. Each file keeps its own mirror fallback,
-					* retry rounds (the node half's business, ./preset), validation and slot name
-					* in a failure.
+					* Each slot is one request, up to `PRESET_CONCURRENCY` at a time, and each
+					* file keeps its own host fallback, retry rounds (the node half's business,
+					* ./preset), validation and slot name in a failure.
 					*
 					* STRICT: the first wallpaper that cannot be had stops the queue. What had
 					* already arrived is kept for the next press (`presetHeld` below) — the
 					* difference between retrying one file and retrying the lot. Nothing is
-					* touched here, so "the author renamed a file" arrives as an error naming the
-					* file rather than as a profile quietly missing a picture.
+					* touched here, so a wrong URL arrives as an error naming the slot rather
+					* than as a profile quietly missing a picture.
 					*/
 					fetchRecommended: async (onProgress) => {
-						const head = await fetchPresetConfig();
-						if (!head.ok) return {
-							ok: false,
-							error: head.error
-						};
-						const slots = head.slots;
-						const key = presetKey(head.version, head.config);
+						const slots = PROFILE_SLOTS;
+						const key = RECOMMENDED_REVISION;
 						const images = presetResume(presetHeld, key);
 						let bytes = 0;
 						for (const url of Object.values(images)) bytes += url.length;
@@ -9131,12 +9222,7 @@ window.__ModuleLoader__.load({
 						presetHeld = null;
 						return {
 							ok: true,
-							preset: {
-								version: head.version,
-								exportedAt: (/* @__PURE__ */ new Date()).toISOString(),
-								config: head.config,
-								images
-							}
+							preset: recommendedThemeFile(images)
 						};
 					},
 					/** Replace EVERYTHING with a downloaded profile: empty the store, then write it. */

package/lib/index.js

@@ -5,15 +5,31 @@ const HOLIDAYS = [{
 	id: "mid-autumn",
 	slot: "h-midautumn",
 	asset: "mid-autumn.webp",
+	source: "/bfs/new_dyn/42e22801827aff71267b03c95fcfd7834168597.png@1672w.webp",
 	color: "#384A77",
 	kind: "lunar"
 }, {
 	id: "national-day",
 	slot: "h-nationalday",
 	asset: "national-day.webp",
+	source: "/bfs/new_dyn/30e97211189f7869dae83b909d2a3cc84168597.png@3456w.webp",
 	color: "#FFF6EB",
 	kind: "gregorian"
 }];
+/**
+* The generation a holiday's ART belongs to, for the on-disk cache.
+*
+* The BFS path is content-addressed (`bfs/new_dyn/<sha1 of the upload>`), so the
+* first eight characters of that hash are a content identity: change the art, change
+* the directory, and a cache keyed by this cannot answer a new upload with the
+* previous bytes. That is the property the pinned assets release tag used to provide
+* and the reason it is now derivable instead of remembered — there is no version
+* constant to bump, and a forgotten bump is not possible.
+*/
+function holidayArtGeneration(def) {
+	const hash = /new_dyn\/([0-9a-f]+)/.exec(def.source);
+	return hash === null ? "v1" : hash[1].slice(0, 8);
+}
 //#endregion
 //#region src/schema.ts
 /**
@@ -475,20 +491,21 @@ function normalizeConfig(raw) {
 *
 * Three reasons are terminal, and each for its own:
 *
-*   - `missing` — the host says the file is not there. The profile follows a
-*     BRANCH (see `PRESET_ASSET_HOSTS` in ./index), so a renamed or deleted file
-*     has to reach the user as a loud failure NAMING the slot — and it has to
-*     reach them FAST: paying two more rounds for a file that is provably absent
-*     only makes the sentence later, on a button the user is watching.
+*   - `missing` — the host says the file is not there. A BFS path is a hash of an
+*     upload (see `PROFILE_HOSTS` in ./profile), so a 404 is not a flake that might
+*     clear: the picture it names either exists or never will. It has to reach the
+*     user as a loud failure NAMING the slot — and it has to reach them FAST:
+*     paying two more rounds for a file that is provably absent only makes the
+*     sentence later, on a button the user is watching.
 *   - `oversized` — the bytes are the problem, and the next round would serve the
 *     same bytes.
-*   - `timeout` — sixty seconds of silence is not weather. Both mirrors were
-*     already asked inside the SAME round, so a retry round would re-ask two hosts
-*     that each just spent a minute not answering. This is also what keeps the
-*     worst case for one file at three minutes instead of six: a round in which BOTH
-*     mirrors were silent is over immediately (two minutes, exactly what it cost
-*     before there were rounds at all), and only a round that mixed a silent mirror
-*     with a transient one can carry a minute into the next round.
+*   - `timeout` — sixty seconds of silence is not weather. Every host was already
+*     asked inside the SAME round, so a retry round would re-ask hosts that each
+*     just spent a minute not answering. This is also what keeps the worst case for
+*     one file at three minutes instead of nine: a round in which every edge was
+*     silent is over immediately (three minutes, exactly what it cost before there
+*     were rounds at all), and only a round that mixed a silent edge with a
+*     transient one can carry a round's worth of latency into the next one.
 *
 * Everything else is a hiccup: a thrown connection, a 5xx, a 429, a 408, or a 200
 * with no body.
@@ -500,7 +517,7 @@ function presetRetryable(reason) {
 * The delay before the round that follows `failedAttempt` (1-based), in ms.
 *
 * Doubling rather than fixed: the second retry is the one that has to survive a
-* mirror having a bad few hundred milliseconds, and it is still short enough that
+* edge having a bad few hundred milliseconds, and it is still short enough that
 * a user staring at "downloading" does not read it as a hang.
 */
 function presetRetryDelayMs(failedAttempt) {
@@ -542,6 +559,88 @@ function orphanSlots(stored, referenced, kept = []) {
 	return stored.filter((slot) => !live.has(slot));
 }
 //#endregion
+//#region src/profile.ts
+/**
+* Where the pictures are hosted.
+*
+* Three hosts, tried in order, and they are not mirrors of each other by
+* configuration — `i0`/`i1`/`i2.hdslb.com` are separate BFS edges that answer the
+* same path with the same bytes (verified by sha1), which is the same arrangement
+* the festival art already relies on.
+*/
+const PROFILE_HOSTS = [
+	"https://i0.hdslb.com",
+	"https://i1.hdslb.com",
+	"https://i2.hdslb.com"
+];
+/**
+* The BFS transform that turns the uploaded PNG into the file this plugin stores.
+*
+* Load-bearing, and the reason it is spelled out once here:
+*
+*   - the UPLOADED files are 2.4–12 MB PNGs (76 MB for the set). `PRESET_IMAGE_MAX`
+*     is 8 MB and the store keeps full fidelity, so serving them as uploaded would
+*     both refuse the largest ones and put a 76 MB wallpaper collection on disk;
+*   - `@3840w.webp` answers 250–365 KB at 3840×2160, which is what the previous
+*     asset host served and what an existing store already holds — the sha1 of the
+*     bytes is identical, so this is the same picture, not a re-encode;
+*   - the suffix is plain arithmetic rather than a CDN feature that may move: the
+*     path before it is `bfs/new_dyn/<sha1 of the upload>`, i.e. CONTENT-ADDRESSED,
+*     so a URL here can never be re-pointed at different bytes the way a git tag
+*     can.
+*/
+const BFS_SUFFIX = "@3840w.webp";
+/**
+* Slot → BFS path, for the seven wallpapers the profile is made of.
+*
+* The slots are `m1`..`m7` rather than names, because a slot is a FILENAME
+* (`modelbg-<slot>`) and `nextSlot` hands out exactly this namespace. The mapping
+* to a model is the rule list below, never the slot name.
+*/
+const IMAGE_PATHS = [
+	{
+		slot: "m1",
+		path: "/bfs/new_dyn/e4565384e7e5b2d75756e577f505534b4168597.png"
+	},
+	{
+		slot: "m2",
+		path: "/bfs/new_dyn/aa6e8649701c91e5ac8f43ff28b97a924168597.png"
+	},
+	{
+		slot: "m3",
+		path: "/bfs/new_dyn/5da92b31df5ee2a20b17ec6be353cf5c4168597.png"
+	},
+	{
+		slot: "m4",
+		path: "/bfs/new_dyn/14bb1e53cb2c13ca80bd23e3c1d2a04e4168597.png"
+	},
+	{
+		slot: "m5",
+		path: "/bfs/new_dyn/f51fff40de2d6eaa5a73d177f7bbfa794168597.png"
+	},
+	{
+		slot: "m6",
+		path: "/bfs/new_dyn/cfa71d4e60a2f12aaeec3efe1aa680b34168597.png"
+	},
+	{
+		slot: "m7",
+		path: "/bfs/new_dyn/c09d34b79d9b447d7db98da68b97afc54168597.png"
+	}
+];
+IMAGE_PATHS.map((i) => i.slot);
+/**
+* The URL one slot's wallpaper is fetched from, on the first host — `${host}${url}`
+* is how a caller builds the other two.
+*
+* Returns null for a slot this profile does not carry, and that null is the whole
+* whitelist: `fetchPresetImage` (./index) answers `bad slot` for it, so a caller on
+* the public RPC cannot name a file of its own.
+*/
+function profileImagePath(slot) {
+	const entry = IMAGE_PATHS.find((i) => i.slot === slot);
+	return entry === void 0 ? null : `${entry.path}${BFS_SUFFIX}`;
+}
+//#endregion
 //#region src/index.ts
 /**
 * Node half of dsh-background-by-model: file-backed rule persistence.
@@ -593,90 +692,56 @@ const LEGACY_FILES = [
 const WALLPAPER_FETCH_MAX = 26214400;
 const WALLPAPER_FETCH_TIMEOUT = 2e4;
 /**
-* Where the festival art is hosted, and which revision of it this build wants.
+* Where the festival art is hosted.
 *
-* The art is fetched from the `assets` repository the first time a holiday needs it
-* (see `readHolidayAsset`), never shipped in the package.
+* Three edges of Bilibili's image CDN, tried in order. They are not mirrors by
+* configuration — `i0`/`i1`/`i2.hdslb.com` answer the same path with the same bytes
+* (checked by sha1) — which is the same arrangement the recommended profile uses
+* (see `PROFILE_HOSTS` in ./profile).
 *
-* The reference is a **release tag**, never a branch: runtime art has to be
-* immutable, and a branch reference would let a reshuffle of the documentation
-* screenshots silently kill a shipped feature. One tag also means one version of
-* everything the plugin fetches (art, profile, README screenshots). A MOVED tag
-* does not reach jsDelivr's edge on its own, so new art means a new tag, never a
-* force-push of the old one.
+* A path under `bfs/new_dyn/` is CONTENT-ADDRESSED (the tail is a hash of the
+* upload), so nothing here needs a version constant: the art a build names cannot be
+* swapped under it the way a re-pointed git tag could, and `holidayArtGeneration`
+* (./holiday) derives the cache's directory from that same hash.
 */
-const HOLIDAY_ASSETS_REPO = "HarmlessFunny/assets";
-const HOLIDAY_ASSETS_REF = "v0.1.0";
-const HOLIDAY_ASSETS_DIR = "dsh-background-by-model/holiday";
-/**
-* Mirrors, tried in order: jsDelivr is reachable where `raw.githubusercontent.com`
-* is not, and raw is the fallback for a CDN that is blocked or down. Both serve the
-* same version, so a fallback cannot mix revisions.
-*/
-const HOLIDAY_ASSET_HOSTS = [`https://cdn.jsdelivr.net/gh/${HOLIDAY_ASSETS_REPO}@${HOLIDAY_ASSETS_REF}/${HOLIDAY_ASSETS_DIR}`, `https://raw.githubusercontent.com/${HOLIDAY_ASSETS_REPO}/${HOLIDAY_ASSETS_REF}/${HOLIDAY_ASSETS_DIR}`];
+const HOLIDAY_HOSTS = [
+	"https://i0.hdslb.com",
+	"https://i1.hdslb.com",
+	"https://i2.hdslb.com"
+];
 /**
 * Sub-directory of the store holding downloaded festival art: one directory per
-* release of the asset repository, one file per asset inside it.
+* GENERATION of the art (see `holidayArtGeneration`), one file per asset inside it.
 *
 * NOT part of the slot namespace, and must never become part of it: files are named
-* after the ASSET and their parent after the pinned release, never after a slot, so
-* nothing here can be mistaken for a user's `modelbg-<slot>`. That is what lets a
+* after the ASSET and their parent after the art's content hash, never after a slot,
+* so nothing here can be mistaken for a user's `modelbg-<slot>`. That is what lets a
 * holiday slot stay read-only while the art itself is downloaded.
 *
-* The version segment is load-bearing: a cache keyed by asset name alone would
-* answer a NEW generation with the OLD bytes and say nothing about it. With the tag
-* in the path, a build that pins a new tag looks in a directory nobody has written
-* to yet, so the first holiday after an update is a miss. Superseded generations
-* are swept by `pruneHolidayCache`.
+* The generation segment is load-bearing: a cache keyed by asset name alone would
+* answer a NEW upload with the OLD bytes and say nothing about it. With the hash in
+* the path, a build that names new art looks in a directory nobody has written to
+* yet, so the first holiday after an update is a miss. Superseded generations are
+* swept by `pruneHolidayCache`.
 */
 const HOLIDAY_CACHE_DIR = "holiday-cache";
-/** Cap and timeout for one asset download; these files are 228 KB and 500 KB. */
+/** Cap and timeout for one asset download; these files are 207 KB and 446 KB. */
 const HOLIDAY_FETCH_MAX = 8388608;
 const HOLIDAY_FETCH_TIMEOUT = 1e4;
 /**
-* The recommended profile, served from the same assets repository as the festival
-* art — as a DIRECTORY in the store's own shape: a readable `theme-config.json`
-* plus one raw file per slot. Publishing it is a `cp` out of the data directory,
-* not an export step.
-*
-* Nothing lists the images: the request set is DERIVED from the config's own
-* `rules[].images[].slot`, so adding a wallpaper is a rule entry and a file.
-*
-* Referenced by the same release tag as the art (one tag = one version of
-* everything the plugin fetches). The re-pointed-tag case is why `presetKey`
-* exists: an edge that has not been purged can still answer with the previous
-* bytes of the same URL, and a resumed download must not glue two revisions
-* together (see `fetchPresetConfig`). A profile written for a config shape this
-* build cannot read is refused by the `preset.json` gate.
-*/
-const PRESET_ASSETS_REPO = "HarmlessFunny/assets";
-const PRESET_ASSETS_REF = "v0.1.0";
-const PRESET_ASSET_DIR = "dsh-background-by-model/preset";
-/** The shape gate: `{"version": 9}` — see SCHEMA_VERSION in ./schema. */
-const PRESET_MANIFEST = "preset.json";
-const PRESET_CONFIG = "theme-config.json";
-/** Images are named after the slot they fill, exactly as they are on disk. */
-const PRESET_IMAGE_PREFIX = "modelbg-";
-/** Mirrors, tried in order — same reason as the festival art's. */
-const PRESET_ASSET_HOSTS = [`https://cdn.jsdelivr.net/gh/${PRESET_ASSETS_REPO}@${PRESET_ASSETS_REF}/${PRESET_ASSET_DIR}`, `https://raw.githubusercontent.com/${PRESET_ASSETS_REPO}/${PRESET_ASSETS_REF}/${PRESET_ASSET_DIR}`];
-/**
-* Caps for the profile, now per file rather than for one document: a profile is a
-* SET of transfers, and each has a different way of going wrong.
-*
-* The count is the one that matters — the request set is derived from the config,
-* so a hostile config could name a thousand slots and turn one button press into a
-* thousand downloads. `SLOT_RE` bounds each name, `PRESET_IMAGE_COUNT_MAX` bounds
-* how many there are, and the running TOTAL is bounded on the client, which is the
-* only side that sees more than one file.
-*
-* The timeout is set by measurement: a 350 KB wallpaper takes a second or two over
-* jsDelivr, and the fallback mirror is the slower one, so a tight budget would fail
-* exactly in the situation it exists for.
+* Caps for the recommended profile's pictures.
+*
+* A profile is a SET of transfers, and what can go wrong is different per file: the
+* node half bounds ONE download (`PRESET_IMAGE_MAX`) and the client bounds the
+* running TOTAL, because it is the only side that sees more than one file.
+*
+* The count is a constant now rather than something a remote config declares
+* (`PROFILE_SLOTS` in ./profile), so there is nothing left to bound: seven names,
+* each already inside `SLOT_RE`. The timeout is set by measurement — a 250–365 KB
+* wallpaper takes a second or two over the CDN, and the second edge is the slower
+* one, so a tight budget would fail exactly in the situation it exists for.
 */
-const PRESET_MANIFEST_MAX = 65536;
-const PRESET_CONFIG_MAX = 1048576;
 const PRESET_IMAGE_MAX = 8388608;
-const PRESET_IMAGE_COUNT_MAX = 64;
 const PRESET_FETCH_TIMEOUT = 6e4;
 const dataDir = () => dshHomePath(DATA_DIR);
 const configPath = () => dshHomePath(DATA_DIR, CONFIG_FILE);
@@ -684,7 +749,13 @@ const configBackupPath = () => dshHomePath(DATA_DIR, CONFIG_BACKUP);
 const configTempPath = () => dshHomePath(DATA_DIR, `${CONFIG_FILE}${CONFIG_TEMP}`);
 const legacyWallpaperPath = () => dshHomePath(DATA_DIR, LEGACY_WALLPAPER);
 const imagePath = (slot) => dshHomePath(DATA_DIR, `${IMAGE_PREFIX}${slot}`);
-const holidayCachePath = (asset) => dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, HOLIDAY_ASSETS_REF, asset);
+/** The cache directory of one GENERATION of the festival art (see `holidayCachePath`). */
+const holidayGenerationPath = (generation) => dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, generation);
+/** The cached file of one asset: its own generation directory, named by the asset. */
+const holidayCachePath = (asset) => {
+	const def = HOLIDAYS.find((h) => h.asset === asset);
+	return dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, def === void 0 ? "v1" : holidayArtGeneration(def), asset);
+};
 const exists = async (p) => {
 	try {
 		await access(p);
@@ -1021,7 +1092,7 @@ async function writeConfig(config) {
 *
 * The null answer is what a DOWNLOAD is checked against (see `fetchHolidayAsset`):
 * neither a status code nor a `content-type` header survives contact with a
-* misconfigured mirror, so the payload's own magic bytes are the only claim that
+* misconfigured origin, so the payload's own magic bytes are the only claim that
 * cannot lie.
 */
 function imageMimeOrNull(buf) {
@@ -1094,10 +1165,12 @@ async function readHolidayAsset(asset) {
 	holidayInFlight.set(asset, task);
 	return await task;
 }
-/** Try every mirror in turn; the first usable answer is cached and returned. */
+/** Try every host in turn; the first usable answer is cached and returned. */
 async function downloadHolidayAsset(asset) {
-	for (const host of HOLIDAY_ASSET_HOSTS) {
-		const buf = await fetchHolidayAsset(`${host}/${asset}`);
+	const def = HOLIDAYS.find((h) => h.asset === asset);
+	if (def === void 0) return null;
+	for (const host of HOLIDAY_HOSTS) {
+		const buf = await fetchHolidayAsset(`${host}${def.source}`);
 		if (buf === null) continue;
 		await writeHolidayCache(asset, buf);
 		return buf;
@@ -1158,18 +1231,18 @@ async function fetchAsset(url, max, timeout) {
 	}
 }
 /**
-* The status codes worth another round: 5xx is a mirror having a bad moment, 429 one
+* The status codes worth another round: 5xx is a host having a bad moment, 429 one
 * asking to be left alone, 408 one giving up on us. Every other non-2xx means the
-* file is not there (jsDelivr answers 403 outside the repository, 404 for a missing
-* file), and that answer must arrive fast and unchanged.
+* file is not there (404 for a missing path, 403 for a refused one), and that answer
+* must arrive fast and unchanged.
 */
 function fetchFailureForStatus(status) {
 	return status >= 500 || status === 429 || status === 408 ? "server" : "missing";
 }
 /**
-* One festival picture, or null when no mirror served an image.
+* One festival picture, or null when no host served an image.
 *
-* One round, unlike the profile's (`fetchPresetFile`): this is fetched during boot,
+* One round, unlike the profile's (`fetchProfileFile`): this is fetched during boot,
 * before the first wallpaper is painted, and a retry round would delay that paint.
 * The art is cached once it arrives and every later read tries again.
 */
@@ -1178,19 +1251,20 @@ async function fetchHolidayAsset(url) {
 	return !got.ok || imageMimeOrNull(got.buf) === null ? null : got.buf;
 }
 /**
-* One file out of the profile directory, or null when no mirror served it.
+* One of the profile's pictures, or null when no host served it.
 *
-* Every mirror is asked in every round, so a round is "all the hosts there are" and
-* the rounds are the retry (a mirror that answers 502 once and correctly the next
+* Every host is asked in every round, so a round is "all the hosts there are" and
+* the rounds are the retry (a host that answers 502 once and correctly the next
 * time, on the sixth of seven files). A round whose failures were all terminal — the
-* file is gone, or too big — ends the attempts outright, so a renamed file costs two
-* requests and a sentence naming the slot (`presetRetryable`, ./preset).
+* path is gone, or too big — ends the attempts outright, so a wrong URL costs three
+* requests rather than nine and a sentence naming the slot (`presetRetryable`,
+* ./preset).
 */
-async function fetchPresetFile(name, max) {
+async function fetchProfileFile(path, max) {
 	for (let attempt = 1; attempt <= 3; attempt++) {
 		let retryable = false;
-		for (const host of PRESET_ASSET_HOSTS) {
-			const got = await fetchAsset(`${host}/${name}`, max, PRESET_FETCH_TIMEOUT);
+		for (const host of PROFILE_HOSTS) {
+			const got = await fetchAsset(`${host}${path}`, max, PRESET_FETCH_TIMEOUT);
 			if (got.ok) return got.buf;
 			if (presetRetryable(got.reason)) retryable = true;
 		}
@@ -1200,102 +1274,30 @@ async function fetchPresetFile(name, max) {
 	return null;
 }
 /**
-* The profile's shape gate and its configuration, in one answer.
-*
-* Two files in order: the manifest says what SHAPE the config is written for, and a
-* config this build cannot read is refused here — before anything is downloaded in
-* earnest, long before anything is deleted. The config then says what the profile IS.
+* One of the profile's wallpapers, as a data URL ready to be written into a slot.
 *
-* The sanitizer runs on this side on purpose: the download list is DERIVED from
-* `rules[].images[].slot`, so an unsanitized config would let a remote file choose
-* what this process requests. After `normalizeConfig` every slot has passed `SLOT_RE`
-* (`normalizeImage`). Holiday slots are then DROPPED rather than refused: they are
-* named legally in `holidays.items`, have no file at all, and `writeImage` refuses
-* them anyway, so a rule pointing at one is already inert on the client.
+* The same two checks the festival art gets, for the same reason: the bytes must
+* actually be an image (`imageMimeOrNull`, never the `content-type` header — a CDN
+* may label a transform it does not serve), and the slot must be one this build is
+* willing to write. The slot name is re-checked here because this is a public RPC:
+* `profileImagePath` is the whitelist, and a name it does not carry has no URL at
+* all, so a caller cannot ask this process for a file of its own choosing.
 *
 * Nothing is cached to disk, unlike the festival art: that cache exists because the
 * art is fetched on a schedule and must work offline afterwards, while this is a
 * button whose whole point is to fetch what is there NOW.
 */
-async function fetchPresetConfig() {
-	const manifestRaw = await fetchPresetFile(PRESET_MANIFEST, PRESET_MANIFEST_MAX);
-	if (manifestRaw === null) return {
-		ok: false,
-		error: "download failed"
-	};
-	let manifest;
-	try {
-		manifest = JSON.parse(manifestRaw.toString("utf8"));
-	} catch {
-		return {
-			ok: false,
-			error: "not a profile"
-		};
-	}
-	const declared = manifest?.version;
-	if (typeof declared !== "number" || !isFinite(declared)) return {
-		ok: false,
-		error: "not a profile"
-	};
-	if (declared > 10) {
-		console.warn(`dsh-background-by-model: the recommended profile declares schema ${declared}, this build writes 10`);
-		return {
-			ok: false,
-			error: "newer version"
-		};
-	}
-	if (declared < 10) console.warn(`dsh-background-by-model: the recommended profile is written for schema ${declared}; importing it with defaults for the fields it predates`);
-	const configRaw = await fetchPresetFile(PRESET_CONFIG, PRESET_CONFIG_MAX);
-	if (configRaw === null) return {
-		ok: false,
-		error: "download failed"
-	};
-	let raw;
-	try {
-		raw = JSON.parse(configRaw.toString("utf8"));
-	} catch {
-		return {
-			ok: false,
-			error: "not a profile"
-		};
-	}
-	if (raw === null || typeof raw !== "object" || Array.isArray(raw)) return {
-		ok: false,
-		error: "not a profile"
-	};
-	const config = normalizeConfig(raw);
-	const slots = /* @__PURE__ */ new Set();
-	for (const rule of config.rules) for (const image of rule.images) {
-		if (holidayAssetFor(image.slot) !== null) continue;
-		slots.add(image.slot);
-	}
-	if (slots.size > PRESET_IMAGE_COUNT_MAX) return {
-		ok: false,
-		error: "too many images"
-	};
-	return {
-		ok: true,
-		version: declared,
-		config,
-		slots: [...slots]
-	};
-}
-/**
-* One of the profile's wallpapers, as a data URL ready to be written into a slot.
-*
-* The same two checks the festival art gets, for the same reason: the bytes must
-* actually be an image (`imageMimeOrNull`, never the `content-type` header — the
-* mirror serves extensionless files as `application/octet-stream`), and the slot
-* must be one this process is willing to write. The slot name is re-checked here
-* because this is a public RPC: the list this side hands out is not the only
-* thing a caller could ask for.
-*/
 async function fetchPresetImage(slot) {
 	if (!SLOT_RE.test(slot) || holidayAssetFor(slot) !== null) return {
 		ok: false,
 		error: "bad slot"
 	};
-	const buf = await fetchPresetFile(`${PRESET_IMAGE_PREFIX}${slot}`, PRESET_IMAGE_MAX);
+	const path = profileImagePath(slot);
+	if (path === null) return {
+		ok: false,
+		error: "bad slot"
+	};
+	const buf = await fetchProfileFile(path, PRESET_IMAGE_MAX);
 	if (buf === null) return {
 		ok: false,
 		error: "download failed"
@@ -1320,7 +1322,9 @@ async function fetchPresetImage(slot) {
 async function writeHolidayCache(asset, buf) {
 	try {
 		await ensureDir();
-		await mkdir(dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, HOLIDAY_ASSETS_REF), { recursive: true });
+		const def = HOLIDAYS.find((h) => h.asset === asset);
+		if (def === void 0) return;
+		await mkdir(holidayGenerationPath(holidayArtGeneration(def)), { recursive: true });
 		const target = holidayCachePath(asset);
 		const temp = `${target}.tmp`;
 		await writeFile(temp, buf);
@@ -1330,21 +1334,28 @@ async function writeHolidayCache(asset, buf) {
 		console.warn(`dsh-background-by-model: could not cache the "${asset}" holiday art`, e);
 	}
 }
+/** The generation directories this build still reads — one per holiday, deduped. */
+function holidayGenerations() {
+	return [...new Set(HOLIDAYS.map(holidayArtGeneration))];
+}
 /**
-* Drop every generation of the cache except the one this build reads.
+* Drop every generation of the cache except the ones this build reads.
 *
-* Called AFTER a successful download, never before it: a pinned release that turns
-* out to be unreachable must not cost the user the art they already had.
+* Called AFTER a successful download, never before it: a build whose art turns out
+* to be unreachable must not cost the user the art they already had.
 *
-* It walks the cache ROOT and compares GENERATION names, never asset names, so the
-* generation in use cannot be touched. That also makes an upgrade clean up after
-* itself (0.7.9's flat `holiday-cache/<asset>` files are removed here).
+* It walks the cache ROOT and compares GENERATION names, never asset names, so a
+* generation in use cannot be touched. That is also what makes an upgrade clean up
+* after itself twice over: the release-tag directories of every earlier version
+* (`holiday-cache/<tag>/`) and 0.7.9's flat `holiday-cache/<asset>` files are both
+* gone from here, because neither name is a content hash.
 */
 async function pruneHolidayCache() {
 	try {
 		const root = dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR);
+		const keep = new Set(holidayGenerations());
 		for (const entry of await readdir(root)) {
-			if (entry === HOLIDAY_ASSETS_REF) continue;
+			if (keep.has(entry)) continue;
 			await rm(dshHomePath(DATA_DIR, HOLIDAY_CACHE_DIR, entry), {
 				recursive: true,
 				force: true
@@ -1701,10 +1712,6 @@ async function handleRpcMethod(ctx, endpoint, payload) {
 					ok: true,
 					value: await fetchImageUrl(slot, payload?.url ?? null)
 				};
-			case "fetchPresetConfig": return {
-				ok: true,
-				value: await fetchPresetConfig()
-			};
 			case "fetchPresetImage":
 				if (slot === null) return {
 					ok: true,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-background-by-model",
-  "version": "0.10.0",
+  "version": "0.11.0",
   "description": "Appearance plugin for DeepSeek Harness: an ordered list of model rules, each carrying its own wallpapers — every image with its own framing and theme color — plus layout mode, opacity, brightness and blur; the background follows the model you switch to, and a rule can rotate through several images on its own rhythm.",
   "keywords": [
     "deepseek-harness",