dsh-background-by-model 0.7.6 → 0.7.8

package/CHANGELOG.md

@@ -1,6 +1,28 @@
 # Changelog
 
-> The full release history lives here; the two most recent releases (v0.7.6 / v0.7.5) are also listed in [README.md](./README.md#recent-optimizations).
+> The full release history lives here; the **Recent optimizations** section of [README.md](./README.md#recent-optimizations) lists only the two most recent releases (v0.7.8 / v0.7.7).
+
+## v0.7.8
+
+- **A fresh install opens on one blank rule instead of the "no rules yet" screen** — the report was "图一是刚安装上的情况，什么也没有，我希望刚安装上就如图二一样创建一条空白的规则" (image one is a fresh install: nothing there; I want it to create one blank rule, like image two). The cause was two shapes being read as the same thing: with no config file at all `migrateLegacy` answered `rules: []`, and `normalizeConfig` read that empty array as "the user deleted every rule". Only a **missing** `rules` key now means "nothing has ever been configured", and it is answered with one blank rule — id `r1`, the id `nextRuleId` mints for an empty list, so it is rule 1, the fallback and the tab the panel selects, with nothing downstream having to recognise it as seeded. A key that IS there and empty is still the user's own deletion and stays empty: a count cannot make that distinction, and without it the rule grows back on every read. The factory itself moved into `src/schema.ts` (`blankRule`), and the shipped default, `normalizeConfig` and the client's "add rule" now share one shape — the client's `newRule` is gone with it. The seeded rule is deliberately blank rather than half-built: with no picture and no colour of its own, `ruleCanPaint` makes matching skip it until something is filled in, instead of letting an empty background take the fallback away from rule 1.
+
+- **The placeholder was not "too bright": the declaration never applied** — the report was "这个输入框的 placeholder 太亮了，让人以为真的有文字在里面" (this input's placeholder is too bright, it makes you think there really is text in there). `--dsw-alias-label-quaternary` is defined NOWHERE in the harness theme: an undefined custom property drops the declaration at computed-value time, and `color` is inherited, so the placeholder fell back to `inherit` — the input's own `label-primary`, the brightest ink in the panel, inside a box the user had not typed a character into. All three inputs that carry a placeholder (the rule's match string, the image URL, the rotation's custom seconds) now share one rule reading `--dsw-alias-label-caption`: one step weaker, and the same token `PLACEHOLDER_RULE` (`src/client/wallpaper.ts`) already hands the composer, so the plugin says one thing about what "empty" looks like. The dead name was in two more places: `.dab-brand-tag` wrote "quaternary with a fallback", so it has always painted tertiary and dropping the dead name changes no colour; `.dab-pick-n`'s `--dsw-mono` was missing a letter — the plugin's own variable is `--dab-mono`.
+
+- **The recommended profile now retries per file, and a failed attempt hands what it fetched to the next one** — a file used to get exactly two chances (one per mirror), so a single 502, a reset connection or a CDN hiccup on the sixth of seven wallpapers threw away the six good downloads behind it, and the user's only recourse — pressing the button again — started from zero. Every file now gets up to three rounds, waiting 400 ms and then 800 ms between them (`PRESET_ATTEMPTS` / `presetRetryDelayMs` in `src/preset.ts`), and an attempt that fails holds the bytes it did get (`presetHeld`): the next press re-fetches the manifest and the config first (two small files) and reuses those bytes only while the config comes back **the same value** (`presetKey`, a canonical form with object keys sorted — a config the wire rebuilt in another key order must not cost the hold for nothing) — which turns "the sixth file failed" into one file to fetch instead of seven. Three failures are NOT retried, each for its own reason: 404/403 is "the file is not there" (the profile follows a branch, so an author renaming a file has to reach the slot **fast** and loudly rather than after two more rounds), oversized is "the bytes are the problem and the next round serves the same bytes", and a timeout is "sixty seconds of silence is not weather" (both mirrors were already asked inside the same round — and that is what keeps the worst case for one file at three minutes instead of six: a round in which BOTH mirrors were silent is over immediately, at the same two minutes this cost before there were rounds at all, and only a round mixing a silent mirror with a transient one can carry a minute into the next round). **The strictness is unchanged**: the first file that cannot be had still fails the whole attempt and still names the slot — what got cheaper is the retry, not the failure. The counter on the button now describes the **profile** rather than this attempt's transfers, so a resumed attempt opens on 6/7 and finishes on 7/7 (which is also why this change touches **no** interface code). The festival art deliberately does NOT get the rounds: it is fetched during boot, before the first wallpaper is painted, where a round's delay lands straight on the first frame — and it has a cache, with every later read trying again, while a button has no later read of its own.
+
+- **Gates** — `pnpm test` is **ten** checks now (the new `check:preset`). `check:node` gains: a data directory with no config file reads as exactly one rule; that rule is blank (no match string, no colour, no image); it is rule 1, and therefore the fallback; and a rule list written explicitly empty still reads back empty — the shape of the fresh-install rule, and the distinction that keeps it from being seeded back. The assertion after `resetStore` was rewritten to the same meaning, since it used to pin the old behaviour ("an emptied store reads as an empty config"). The retry itself is pinned **by request count**: with both mirrors answering 503 once, the same file is asked again and arrives (three lines in the log — jsDelivr, raw, jsDelivr again); a file the host does not have still costs exactly two requests (one per mirror, no waiting); and a permanently broken mirror costs exactly six (three rounds over two mirrors — the retry has a budget). `check:ui` gains section 6: every `var(--dsw-…)` the UI reads must be a token the installed theme actually publishes — with the theme bundle absent (peer dependencies not installed) the section skips with a notice, because that is a fact about this host and not about this repository; this class of failure reports itself nowhere, the declaration is dropped and the property quietly falls back to an inherited value. The new `check:preset` pins the policy and the wiring on both sides: each of the six failure reasons judged on its own (the three terminal ones are the three that can be decided locally and cheaply, and a timeout is not retried because both mirrors were already asked inside the same round), a wait that grows and stays bounded, a revision key that treats two key orders of one value as one revision while the image list's ORDER counts (it is the rotation), a resume that hands back a copy rather than the held record itself, and the two halves actually using it — the node half looping over the round budget and asking the policy, the client sizing its pool by what is missing rather than by the whole slot list, holding what arrived on failure and clearing it on success, and applying the size cap **before** a file is kept (applied after, the attempt that blows it holds every slot, and the resume then has nothing left to fetch and passes an oversized profile straight through).
+
+## v0.7.7
+
+- **A fresh install starts on the author's own profile, and it needs no network** — the shipped defaults on the Interface tab now ARE the numbers the recommended profile carries (`preset/theme-config.json` in the [assets repository](https://github.com/HarmlessFunny/assets)): main background `0%`, left panel `10%`, right panel `45%`, cards `100%`, code `81%`, inputs `88%` with `60 px` of blur, settings `100%`, conversation text `35%`, trajectory `73%`, every other blur `0`. So the panel is worth looking at before a single byte is fetched, and the profile's one click adds rules and pictures instead of changing the numbers underneath them. Every one of those values used to be chosen per key for **safety** rather than for looks — `bg` at 0.85 so the host surface stayed visible under the wallpaper, `code` fully opaque because "a code block is read, not looked through", `input` blur at 0 because a blur costs a compositor layer — which is why a new install opened on a pale approximation of the host rather than on a configuration anyone would actually run. Two consequences are named rather than discovered later: the main background starts at `0%`, so with no wallpaper yet the window is the host's own canvas (the palette and its ink are unaffected — they come from the theme colour, not from this alpha), and `check:code-plate` now pins the profile's `81%` instead of "defaults to opaque". The constants live in `src/schema.ts` under a note saying they are copied from a live data directory, so changing the profile's numbers means moving them together; the README's Interface section says the same.
+
+- **`rightbarOpacity` keeps its "never owned" state while a fresh install starts owned** — the preview panel's `null` means "follow `opacities.bg`", and that is not a theoretical state: **every** release so far has written it, because a panel the user never dragged is persisted as an explicit `null`. The new sanitizer (`normalizeRightbarOpacity`) therefore reads `null` back as itself and hands the shipped `45%` only to a key that is not there at all. Treating `null` as "missing" would have silently repainted the preview panel of every existing configuration whose panel was following the main background — exactly the kind of silent migration the config shape's versioning exists to prevent. A fresh install starts owned at `45%`; `null` is now reachable only by hand, since the UI has never had a control that goes back to it.
+
+- **The festival switch ships OFF** — a first install paints what the model rules say and nothing else, and the single switch on the Config page is how the feature is asked for. It shipped ON before, on the argument that the point of the feature is that the background changes by itself on the day; that is the right answer for a configuration somebody has already chosen — which is why the recommended profile still turns it **ON** — but not for a plugin that has just been installed and has no wallpaper of its own yet, where the first thing a new user would see on 中秋节 is a festival picture nobody asked for. The sanitizer is now "a real boolean is honoured, anything else takes the shipped default" rather than "only an explicit `false` turns it off": the absent field of a config written before the feature existed, and junk from a hand-edit, both mean OFF. The per-holiday switches inside the block are untouched — they are details of a feature that is already switched on, not the switch itself.
+
+- **The percentage pill in each Interface card is gone** — the number was already on the slider row directly below it, so the card head is the icon and the name again and `.dab-part-badge` goes with it, stylesheet rule included.
+
+- **Gates** — `pnpm test` is still nine checks; the defaults above moved `check:code-plate` (the code plate ships on the profile's `81%`) and `check:node`, whose new assertions are written **by value** so that a constant changed without the profile — or the profile changed without the constants — fails a check instead of drifting out of step: the appearance numbers a config with no file at all comes up with, an explicit `null` preview panel reading back as itself, a number of its own surviving, a hand-edit that is not a number landing on the shipped `45%`, and the festival switch through both booleans and a non-boolean.
 
 ## v0.7.6
 

package/CHANGELOG.zh.md

@@ -1,6 +1,28 @@
 # 更新日志
 
-> 这里保留完整的历史记录；最近两个版本（v0.7.6 / v0.7.5）同时列在 [README.zh.md](./README.zh.md#近期优化) 里。
+> 这里保留完整的历史记录；[README.zh.md](./README.zh.md#近期优化) 的「近期优化」一节只列最近两个版本（v0.7.8 / v0.7.7）。
+
+## v0.7.8
+
+- **新装打开的就是一条空白规则，而不是「还没有规则」那一屏** —— 报告是「图一是刚安装上的情况，什么也没有，我希望刚安装上就如图二一样创建一条空白的规则」。成因是两种形状被读成了同一件事：完全没有配置文件时 `migrateLegacy` 返回的是 `rules: []`，而 `normalizeConfig` 把那个空数组当成「用户把规则删光了」。现在只有「`rules` 这个键根本不在」才意味着「从未配置过」，它换来一条空白规则 —— id 是 `r1`，也就是 `nextRuleId` 给空列表发的那个 id，所以它在面板上就是规则 1、就是兜底、就是默认选中的那张卡，下游没有任何分支需要认得它是被种出来的；而「键在、数组是空的」仍然是用户主动删光的结果，保持为空。按条数判断就没有这条区分，规则会在每次读盘时长回来。规则工厂本身挪进了 `src/schema.ts`（`blankRule`），出厂配置、`normalizeConfig` 和客户端的「新增规则」从此共用同一个形状，客户端的 `newRule` 随之删掉。种出来的那条规则是刻意「空」而不是「半成品」：它没有图、也没有自己的主题色，所以在被填上东西之前 `ruleCanPaint` 会让匹配跳过它，而不是让一个空背景顶掉规则 1 的兜底。
+
+- **placeholder 不是「挑亮了」，是那条声明从来就没生效** —— 报告是「这个输入框的 placeholder 太亮了，让人以为真的有文字在里面」。`--dsw-alias-label-quaternary` 在整个 harness 主题里一个定义都没有：未定义的自定义属性会让这条声明在计算值阶段被丢掉，而 `color` 是继承属性，于是 placeholder 回落到 `inherit` —— 拿到输入框自己的 `label-primary`，也就是面板里最亮的墨色，写在一个用户一个字都没打过的框里。现在三个带 placeholder 的输入（规则匹配串、图片网址、轮换的自定义秒数）共读一条规则、统一用 `--dsw-alias-label-caption`：弱一档，也正是 `PLACEHOLDER_RULE`（`src/client/wallpaper.ts`）早就给输入框用的那个 token，所以插件对「空」这件事只有一个说法。同一个死名字还有两处：`.dab-brand-tag` 写的是「quaternary 加 fallback」，所以它一直画的就是 tertiary，去掉死名字不改变任何颜色；`.dab-pick-n` 的 `--dsw-mono` 则是少了个字母 —— 插件自己的变量是 `--dab-mono`。
+
+- **推荐配置的下载按文件重试，而且失败的那一次会把已经下到的部分留给下一次** —— 此前一个文件只有两次机会（两个镜像各一次），七张壁纸里第六张碰上一次 502、一次连接被重置或者一次 CDN 抽风，前面六张就白下了，而用户唯一的办法 —— 再按一次按钮 —— 是从零开始。现在每个文件最多三轮、轮与轮之间先等 400 ms 再等 800 ms（`src/preset.ts` 的 `PRESET_ATTEMPTS` / `presetRetryDelayMs`），而且失败的那一次会把已经拿到的字节留在那里（`presetHeld`）：下一次按按钮先重新取 manifest 与 config（两个小文件），只有当这份 config 与那些字节来自的那一份**逐值相同**时才复用（`presetKey`，把对象键排序后的规范形式 —— 上游把键顺序重建过一遍不该白白丢掉这些字节），于是「第六张失败」从重下七张变成只重下一张。三种失败**不重试**，每一种都有自己的理由：404/403 是「这个文件不在那儿」（配置跟随的是分支，作者改个文件名就必须**快**而响地报到槽位上，而不是再等两轮）、超限是「字节本身就是问题，下一轮还是这些字节」、超时是「六十秒的沉默不是天气」（两个镜像在同一轮里都已经问过了，而这一条正是把单个文件的最坏情况钉在三分钟而不是六分钟上的东西：两个镜像都不吭声的那一轮当场就结束，也就是原来那两分钟；只有「一个镜像沉默、另一个是瞬态失败」混在一起的那一轮，才会把一分钟带进下一轮）。**严格性一个字没改**：第一个拿不到的文件仍然让整次尝试失败、仍然报出槽位名 —— 变便宜的只是重试，不是失败。按钮上那个计数现在描述的是**整份配置**而不是这一次的传输，所以续传的那一次从 6/7 开始、到 7/7 结束（这也是这次改动**没有**碰界面任何一处的原因）。节日素材刻意**没有**跟着改成多轮：它是在启动时、当天第一次绘制之前抓的，一轮的等待会直接加到首帧上 —— 而它有缓存，此后每一次读取都会再试一次，按钮却没有「此后再读一次」这回事。
+
+- **门禁** —— `pnpm test` 现在是**十道**（新增 `check:preset`）。`check:node` 新增：空数据目录读出来正好一条规则、那条规则是空的（无匹配串、无颜色、无图）、它是规则 1（因此兼任兜底）、显式写空的规则列表读回仍然为空（这几条就是新装那条规则的形状，以及那条不该被种回来的区分）；`resetStore` 之后那条断言改成同一语义 —— 它原来钉的正是旧行为（「读到一个空配置」）。重试本身按**请求数**钉住：两个镜像同时 503 一次时，同一个文件被再问一遍并最终拿到（日志里三行：jsDelivr、raw、又是 jsDelivr）、托管处没有的文件仍然只花两次请求（每镜像一次、不等待）、永久 500 的镜像总共只花六次请求（三轮 × 两个镜像 —— 重试是有预算的）。`check:ui` 新增第 6 节：UI 里每一个 `var(--dsw-…)` 都必须是已安装主题确实发布过的 token —— 读不到主题（peer 依赖不在）时这一节跳过并说明，因为那是关于这台宿主的事实，不是关于这个仓库的；这一类失败本来不会在任何地方报错，声明被丢掉、属性悄悄回落到继承值，只有人眼看出来不对。新的 `check:preset` 钉住策略本身与两侧的接线：六个失败原因各自「值不值得再问一次」（三个终态正是能在本地廉价判定的那三个，而超时之所以不重试是因为同一轮里两个镜像都已经问过）、等待指数增长且有上限、`presetKey` 对同一个值的不同键顺序给出同一个键（而图片列表的顺序**算数**，因为它就是轮换顺序）、续传拿到的是副本而不是那条记录本身、以及两侧真的在用这些判定 —— node 半边循环轮次并按策略决定要不要再来一轮、客户端按「还缺哪些」而不是整个槽位表来铺并发池、失败时把已下到的字节留成 `presetHeld`、成功时清掉、以及体积上限**在文件被收下之前**判定（收下之后再判的话，超限的那一次会把每个槽位都留在手里，下一次续传于是无文件可抓、直接把一份超限的配置放行）。
+
+## v0.7.7
+
+- **新装出来就是作者本人那套外观，而且不用联网** —— 「界面」页的出厂默认值现在**就是**推荐配置里那套数字（[assets 仓库](https://github.com/HarmlessFunny/assets)里的 `preset/theme-config.json`）：主背景 `0%`、左侧栏 `10%`、右侧栏 `45%`、卡片 `100%`、代码块 `81%`、输入框与控件 `88%` 外加 `60 px` 模糊、设置面板 `100%`、对话文本框 `35%`、轨迹页 `73%`、其余模糊全 `0`。于是第一次装上、一个字节都还没下，界面就已经值得看；而推荐配置那一下点击加进来的是规则和图片，不是把底下的数字换掉。这些数字此前**每一个都是按「安全」而不是按「好看」逐项挑的** —— `bg` 取 0.85 是为了让宿主表面在壁纸之下仍然可见，`code` 全不透明是因为「代码块是拿来读的、不是拿来看穿的」，`input` 模糊取 0 是因为一层模糊要付一个合成层的代价 —— 这就是为什么以前新装打开的是一个「宿主的苍白近似」，而不是任何人真会用的配置。两个后果是写明的、不是等着以后被发现的：主背景从 `0%` 起步，所以还没有壁纸时窗口就是宿主自己的画布（配色与墨色不受影响，它们来自主题色而不是这个 alpha）；而 `check:code-plate` 现在钉住的是配置里的 `81%`，不再是「默认不透明」。这些常量住在 `src/schema.ts`，旁边就写着它们是从真实数据目录抄出来的那一份，所以改推荐配置的数字就得把两边一起搬；README 的「界面」一节说的是同一件事。
+
+- **`rightbarOpacity` 保留了它「从未被拥有」的状态，而新装出来是已被拥有的** —— 预览栏的 `null` 意思是「跟随 `opacities.bg`」，而它不是一个理论状态：此前**每一个**版本都写过它 —— 用户从没拖过的那一栏，落盘就是显式的 `null`。所以新的净化器（`normalizeRightbarOpacity`）把 `null` 读回成它自己，只有「这个键根本不在」才拿到出厂的 `45%`。把 `null` 当成「缺失」，会把每一份「预览栏正跟着主背景」的既有配置悄悄重画 —— 而这正是这套配置形状做版本号要防的那种静默迁移。新装从 `45%` 起步、是已被拥有的；`null` 现在只剩下手写可达，因为界面从来就没有一个能回到它的控件。
+
+- **节日开关出厂是关的** —— 第一次装上只画模型规则说的东西，别的什么都不画；「配置」页那一个开关才是「要这个功能」的表达方式。它此前是开的，理由是「这个功能的意义就在于到日子背景自己换」；那个理由对于一份**已经被人选定的**配置是对的 —— 所以推荐配置仍然把它**打开** —— 但对于一个刚装上、自己还没有任何壁纸的插件不对：中秋当天，新用户看到的第一样东西会是一张没人要的节日图。净化规则也从「只有显式的 `false` 才关掉」改成「真正的布尔值算数，其它一律取出厂默认」：功能出现之前写下的配置里那个缺失的字段、以及手改出来的垃圾值，现在都意味着关。块内每个节日各自那个开关没动 —— 那是一个已经打开的功能内部的细节，不是这个开关本身。
+
+- **「界面」页每张卡片上那个百分比胶囊删掉了** —— 那个数字本来就在它正下方的滑块行上，于是卡头又只剩图标和名字，`.dab-part-badge` 连同它的样式规则一起走。
+
+- **门禁** —— `pnpm test` 仍是九道；上面这些默认值动到的是 `check:code-plate`（代码块出厂走配置的 `81%`）与 `check:node`，后者的新断言是**按值**写死的，所以「改了常量没改配置、或改了配置没改常量」会直接让一道校验失败，而不是慢慢漂开：完全没有配置文件时读出来的那套外观数字、显式 `null` 的预览栏读回成它自己、它自己的数字被保留、非数字的手改值落回出厂的 `45%`，以及节日开关两个布尔方向加一个非布尔值。
 
 ## v0.7.6
 

package/README.md

@@ -113,7 +113,7 @@ What a wallpaper **change** looks like. It lives on the **Config** page, it is t
 
 ### Holiday backgrounds
 
-A small one, not a settings block: **one switch on the Config page and nothing else**. It is on out of the box, and on the day the background changes by itself and changes back the next morning.
+A small one, not a settings block: **one switch on the Config page and nothing else**. It ships **off** — turn it on and on the day the background changes by itself and changes back the next morning. (The [recommended profile](#recommended-profile) below turns it on for you.)
 
 - **How it behaves** — On 中秋节 and 国庆节 the wallpaper switches to that holiday's own image, with that holiday's own fixed theme color (中秋 `#384A77`, 国庆 `#FFF6EB`). The next day, the model rules take over again.
 - **Mid-Autumn Festival** — 农历八月十五, the day itself. It moves every year (2024-09-17, 2025-10-06, 2026-09-25, 2027-09-15 …), so it is resolved from the Chinese calendar at runtime, in **Asia/Shanghai** — the lunar day turns over at Beijing midnight, not yours.
@@ -122,7 +122,7 @@ A small one, not a settings block: **one switch on the Config page and nothing e
 - **A holiday with no image falls through** to the model rules rather than blanking the wallpaper.
 - **The art is downloaded, not shipped** — a compressed wallpaper per holiday (228 KB and 500 KB at native resolution, against 8.37 MB of source art), hosted in the project's [assets repository](https://github.com/HarmlessFunny/assets) rather than in the package: they were two thirds of the tarball for a picture that is looked at one day a year. The download is gated on the **calendar**, so a profile that is not on a holiday fetches nothing at all, and the first read on the day caches the file under `holiday-cache/` — every boot after that, and every year after that, is answered from disk and needs no network. The reference is pinned to a **commit**, never a branch, so reshuffling the repository's screenshots cannot break a shipped festival; a `jsDelivr` mirror is tried first and `raw.githubusercontent.com` second, and if both are unreachable the holiday simply does not take over — the model rules keep painting.
 - **Neither the art nor the palette is swappable, by design** — an easter egg that asks to be configured is not an easter egg. A holiday slot is read-only: a file dropped into `modelbg-h-midautumn` / `modelbg-h-nationalday` is ignored by every read, and the plugin refuses to write, fetch into or delete those slots. The download lands in `holiday-cache/`, keyed by asset name and never by slot, so the store still never holds a `modelbg-h-*` file. The theme colors are constants in the holiday definition and are forced on every read — on the holiday **and on its image**, since a theme color lives on the image now — so a hand-edited `color` in `theme-config.json` cannot repaint a festival either. Its layout mode is the definition's **Fill** for the same reason (the art is full-bleed, and a stale `fit` would letterbox it), while the **framing** next to it stays yours. Theme exports therefore carry your rules only.
-- **Turning it off** — the switch on the Config page, or `"holidays": { "enabled": false }` in the same file.
+- **Turning it on** — the switch on the Config page, or `"holidays": { "enabled": true }` in the same file. Only a real `true` counts: the feature is on because a configuration says so, not because nothing has been said. The per-holiday switches inside it (中秋 / 国庆) are a different thing and still default to on — they are details of a feature that is already switched on.
 
 ### Per-rule and per-image settings
 
@@ -135,15 +135,18 @@ A small one, not a settings block: **one switch on the Config page and nothing e
 
 ### Global settings (Interface tab)
 
+- **What a fresh install starts on** — the shipped numbers **are the author's own profile**, i.e. the Interface numbers the [recommended profile](#recommended-profile) carries, so a first run already looks like that without downloading anything: main background `0%`, left panel `10%`, right panel `45%`, cards & panels `100%`, code blocks `81%`, input & controls `88%` with `60 px` of blur, settings panel `100%`, conversation text `35%`, trajectory `73%`, and every other blur `0`. The two are kept in step by hand — the profile is published straight out of a live data directory, so changing its numbers means moving these constants with them. (The two settings this tab does not own are deliberately *not* copied from the profile: the [festival switch](#holiday-backgrounds) ships off, and the [switch duration](#switch-effect-global) keeps the 320 ms cross-fade — the profile uses its 3000 ms maximum.)
 - **Per-part Interface Opacity** — Independent sliders for the main background, left panel, right panel, cards & panels (including the dropdowns and menus around the dialog), the input & controls (composer box, Cordis panel), plus the settings panel and the conversation text box. Independent of the theme color: a rule with no color keeps every one of these sliders live.
 - **Per-part Interface Blur** — Frosted-glass `backdrop-filter` blur (`0–60 px`) for each interface part, including a real backdrop on the composer and Cordis panel via stable host selectors.
 - **Conversation & Trajectory** — The message list is wrapped in a translucent card automatically, and the trajectory page gets whole-page opacity & blur controls, letting the wallpaper shine through the content.
-- **Right Panel** — The column that slides in from the right when you open a file now has a card of its own: its opacity follows **Main background** until you drag it (then this card owns it), and its blur stacks on top of the main-background blur. While closed it takes no space and costs nothing.
+- **Right Panel** — The column that slides in from the right when you open a file now has a card of its own: this card owns its opacity from the first drag, and until then it follows **Main background** — the state a config written while that was the shipped default is in, since a fresh install already owns the panel at the profile's `45%` — and its blur stacks on top of the main-background blur. While closed it takes no space and costs nothing.
 
 ### Recommended profile
 
 The Config tab's first card downloads the author's own configuration — rules, wallpapers and interface settings — from the project's [assets repository](https://github.com/HarmlessFunny/assets) and installs it in one click.
 
+**Every Interface number in it is what the plugin already ships with** — each opacity, blur and tint alpha in `theme-config.json` is the number a fresh install starts on (see [Global settings](#global-settings-interface-tab)) — so on a new install this button adds the rules and the pictures. Two settings it brings that a fresh install does not have are outside that tab: the [festival switch](#holiday-backgrounds), which ships off and this profile turns on, and the [switch duration](#switch-effect-global), which the profile sets to its 3000 ms maximum where the shipped default is the 320 ms cross-fade every earlier release used. On a store whose sliders you have already moved, adopting it resets those too: it is a whole configuration, not a patch.
+
 **It is hosted in the store's own shape**, not as one bundled document:
 
 ```
@@ -159,6 +162,7 @@ It is the only action in the panel that **destroys** something, and it is built
 
 - **You are asked second, not first.** The download happens before the confirmation, so the question can say what is actually in hand — *7 rules · 7 wallpapers · 2.9 MB* — instead of asking about a file that may never arrive. If the download fails, nothing has happened yet.
 - **One missing wallpaper fails the whole thing**, and says which. A profile that quietly arrived without a picture — because a file was renamed where it is hosted — would be exactly the silent failure that pinning the festival art to a commit exists to prevent; naming the file keeps that failure loud, which is what makes a branch reference acceptable here.
+- **Every file retries on its own, and a failed attempt keeps what it fetched.** A file used to get exactly two chances (one per mirror), so with the first few wallpapers down and the next hitting a 502 or a CDN hiccup the whole profile failed and the button started from zero again. Each file now gets up to three rounds (400 ms and then 800 ms apart), while three failures are not retried at all — "the file is not there" (the same answer twice), "the bytes are over the cap" (the same bytes again), and "a full minute of silence" (both mirrors were already asked inside that same round, which is what keeps the worst case at three minutes rather than six). What did arrive is kept for the next press, so that press only fetches what is missing — as long as the config it re-fetches is **the same value** as the one those bytes came from (this profile is served from a branch, and two different pushes must not be glued together). The strictness is unchanged: the first file that cannot be had still fails the whole attempt, and still says which one.
 - **The store is emptied before the profile is written.** `nextSlot` allocates slots as `m1`, `m2`, … — a counter, not a random token — so a downloaded profile and the store it lands in collide on those names as a matter of course. "Replace everything with this" is only true if the everything is genuinely gone, and this is also why there is no undo.
 - **The wipe runs after the download, never before it.** An unreachable CDN must not cost you your configuration on the way to a profile that never arrived — which matters more now that the download is several transfers rather than one.
 - **The festival art is not touched.** `holiday-cache/` is downloaded art that belongs to no slot; it is not part of anybody's configuration, and re-fetching it would be a network round trip for nothing. The config *does* name the two holiday slots (they are part of any config), and they are dropped from the request set rather than asked for: no `modelbg-h-*` file can exist.
@@ -236,7 +240,7 @@ To mount a working copy into a profile instead, add it to the profile's `package
 
 After changing anything under `src/`, run `pnpm run bundle` again — the mounted profile loads `lib/`, so edits do not take effect until the bundle is rebuilt.
 
-`pnpm test` builds, typechecks and runs nine checks (`tsdown && tsc -p tsconfig.json && node scripts/holiday-check.ts && node scripts/rotation-check.ts && node scripts/transition-check.ts && node scripts/repaint-check.ts && node scripts/code-plate-check.ts && node scripts/image-mode-check.ts && node scripts/rules-view-check.ts && node scripts/ui-strings-check.ts && node scripts/node-half-check.mjs`). None of them needs a dependency, a transformer or a browser, and each can be run alone with `pnpm check:holiday` / `pnpm check:rotation` / `pnpm check:transition` / `pnpm check:repaint` / `pnpm check:code-plate` / `pnpm check:image-mode` / `pnpm check:rules` / `pnpm check:ui` / `pnpm check:node`:
+`pnpm test` builds, typechecks and runs ten checks (`tsdown && tsc -p tsconfig.json && node scripts/holiday-check.ts && node scripts/rotation-check.ts && node scripts/transition-check.ts && node scripts/repaint-check.ts && node scripts/code-plate-check.ts && node scripts/image-mode-check.ts && node scripts/rules-view-check.ts && node scripts/preset-check.ts && node scripts/ui-strings-check.ts && node scripts/node-half-check.mjs`). None of them needs a dependency, a transformer or a browser, and each can be run alone with `pnpm check:holiday` / `pnpm check:rotation` / `pnpm check:transition` / `pnpm check:repaint` / `pnpm check:code-plate` / `pnpm check:image-mode` / `pnpm check:rules` / `pnpm check:preset` / `pnpm check:ui` / `pnpm check:node`:
 
 - **`check:holiday`** — the two holiday windows against known dates, the Beijing day boundary (23:59 vs 00:01), leap eighth months across 1900–2100, and the four gates `pickHoliday` applies before a holiday is allowed to take over the background.
 - **`check:rotation`** — the rotation's decisions (`nextIndex` / `isRotating`): no walking off the end of a list, shuffle never repeating the image already on screen (across the whole support of the roll), and "rotating" never claimed for a rule with nothing to rotate.
@@ -245,8 +249,9 @@ After changing anything under `src/`, run `pnpm run bundle` again — the mounte
 - **`check:code-plate`** — the code block's plate: that the surface tokens it reads are declared on **both** `:root` and `body` (a `var()` is substituted where it is *declared*, so a root-level consumer otherwise reads the host's colour and not the palette's), that the light branch emits the banner instead of borrowing the host's near-white, and that each of the two surfaces reads its **own** plugin variable — one shared variable would let the banner's write paint the plate too.
 - **`check:image-mode`** — the 0.7.5 lift of the layout mode onto the image and, more to the point, the **wiring**: which image a control edits and which image the render layer reads. A mis-wired read does not throw, it just makes every picture in a rotation look the same.
 - **`check:rules`** — the two decisions behind the tab strip, which are pure and live in `src/client/rules-view.ts` (which rule the editor shows, and where a deletion lands — its neighbour, never rule 1), plus the page structure the layout rests on: one editor drawn, no stacked per-card container, no per-card open state, a strip that can neither wrap nor grow, and its scrollbar block staying scoped to the plugin's own classes.
-- **`check:ui`** — every `t('…')` key exists in both dictionaries, both dictionaries carry the same key set, every `dab-…` class has a rule in the stylesheet, and no dictionary entry has gone unreferenced.
-- **`check:node`** — the built node half driven through its real RPC handler with `DSH_HOME` redirected to a throwaway directory, and `globalThis.fetch` replaced by a stub — the festival art lives on a CDN now, and this suite must not depend on one being up, nor assert today's bytes of a file it does not own. It covers: the holiday block through the shared sanitizer; nothing fetched merely for loading the plugin or reading the config; the art fetched on demand and cached under `holiday-cache/` keyed by **asset** rather than slot; a second read answered from disk with no second transfer; two simultaneous cold reads sharing one transfer; a dead first mirror falling through to the second with both mirrors pinned to the same commit; every mirror down yielding "no bytes" rather than a throw, with nothing cached from a failed fetch; a mirror answering 200 with a non-image rejected rather than cached; a corrupt cache entry discarded and re-downloaded; a holiday slot refusing writes, deletes and URL fetches while a file dropped into it is ignored and no `modelbg-h-*` file is ever written; an ordinary rule slot still writing, listing and deleting; a hand-edited config unable to redirect a holiday at another rule's image; the per-image color shape — the read-time lift in both directions (an absent key inherits the rule's color, an explicit `null` does not), independent colors through the file, and a `null` written as a key rather than omitted; and the global switch effect — the shipped default for a config that predates it, a chosen effect/easing/unified duration surviving the round trip, hostile values falling back while an absurd duration clamps, a `0` duration kept rather than defaulted, and drift inside `transition` reported instead of silently dropped. The recommended profile is covered end to end from the node half's side: the manifest and the config fetched in that order and sanitized on arrival, the request set DERIVED from the rules with the holiday slots dropped from it, one request per wallpaper with the bytes sniffed rather than trusted from a header, a dead jsDelivr falling through to raw for a single file, and every way it can fail reported as a value rather than a throw — every mirror down, a mirror answering 500, a 200 carrying HTML, a manifest whose version is not a number, a profile written for a newer shape refused before a single wallpaper is asked for, a config that is not JSON, a config that is a JSON array, a config naming more images than the cap, and a mirror announcing an oversized body; plus the strict half (a named wallpaper the host does not have is an error, not a short profile), the two naming refusals that happen before any request at all (a holiday slot, and a slot name that is not a slot), and the reset: the config and every rule image gone, `holiday-cache/` untouched, a read afterwards yielding a fresh config rather than an error, and the profile then writing into the emptied store.
+- **`check:preset`** — the two decisions behind the recommended profile's transfers (`src/preset.ts`: which failures are worth another round, and what a failed attempt leaves for the next one), plus the two halves actually using them. Each of the six failure reasons is judged on its own (the three terminal ones are the three that can be decided locally and cheaply, and a timeout is not retried because both mirrors were already asked inside the same round); the wait grows and stays bounded; two key orders of one value are one revision while the image list's ORDER counts (it is the rotation); and a resume hands back a copy rather than the held record itself. The wiring is pinned with it: the node half looping over the round budget and asking the policy, the client sizing its pool by what is missing rather than by the whole slot list, holding what arrived on failure and clearing it on success, and applying the size cap **before** a file is kept.
+- **`check:ui`** — every `t('…')` key exists in both dictionaries, both dictionaries carry the same key set, every `dab-…` class has a rule in the stylesheet, no dictionary entry has gone unreferenced, and every `var(--dsw-…)` the UI reads is a token the installed theme actually publishes — an undefined custom property drops the declaration and the property quietly falls back to an inherited value, which is how a placeholder once painted in the ink of real text (with the theme bundle absent, that section skips with a notice).
+- **`check:node`** — the built node half driven through its real RPC handler with `DSH_HOME` redirected to a throwaway directory, and `globalThis.fetch` replaced by a stub — the festival art lives on a CDN now, and this suite must not depend on one being up, nor assert today's bytes of a file it does not own. It covers: the holiday block through the shared sanitizer; nothing fetched merely for loading the plugin or reading the config; the art fetched on demand and cached under `holiday-cache/` keyed by **asset** rather than slot; a second read answered from disk with no second transfer; two simultaneous cold reads sharing one transfer; a dead first mirror falling through to the second with both mirrors pinned to the same commit; every mirror down yielding "no bytes" rather than a throw, with nothing cached from a failed fetch; a mirror answering 200 with a non-image rejected rather than cached; a corrupt cache entry discarded and re-downloaded; a holiday slot refusing writes, deletes and URL fetches while a file dropped into it is ignored and no `modelbg-h-*` file is ever written; an ordinary rule slot still writing, listing and deleting; a hand-edited config unable to redirect a holiday at another rule's image; the per-image color shape — the read-time lift in both directions (an absent key inherits the rule's color, an explicit `null` does not), independent colors through the file, and a `null` written as a key rather than omitted; and the global switch effect — the shipped default for a config that predates it, a chosen effect/easing/unified duration surviving the round trip, hostile values falling back while an absurd duration clamps, a `0` duration kept rather than defaulted, and drift inside `transition` reported instead of silently dropped. The recommended profile is covered end to end from the node half's side: the manifest and the config fetched in that order and sanitized on arrival, the request set DERIVED from the rules with the holiday slots dropped from it, one request per wallpaper with the bytes sniffed rather than trusted from a header, a dead jsDelivr falling through to raw for a single file, the same file **asked again** when both mirrors stumble at once and arriving on that third request (three entries in the log), a file the host does not have still costing exactly two requests (one per mirror, no waiting), a permanently broken mirror costing exactly six (three rounds over two mirrors — the retry has a budget), and every way it can fail reported as a value rather than a throw — every mirror down, a mirror answering 500, a 200 carrying HTML, a manifest whose version is not a number, a profile written for a newer shape refused before a single wallpaper is asked for, a config that is not JSON, a config that is a JSON array, a config naming more images than the cap, and a mirror announcing an oversized body; plus the strict half (a named wallpaper the host does not have is an error, not a short profile), the two naming refusals that happen before any request at all (a holiday slot, and a slot name that is not a slot), and the reset: the config and every rule image gone, `holiday-cache/` untouched, a read afterwards yielding the same one blank rule rather than an error, and the profile then writing into the emptied store — with the fresh-install rule itself pinned first: a data directory with no config file reads as exactly one blank rule (`r1`, no match string, no colour, no image), while a rule list written explicitly empty still reads back empty, because those are two different answers.
 
 ## FAQ
 
@@ -297,23 +302,19 @@ Two things can hold it, and both are on the card: the effect is **Instant**, or
 
 ## Recent Optimizations
 
-> Only the two most recent releases are listed here; older ones (v0.7.4 and earlier) live in [CHANGELOG.md](./CHANGELOG.md).
+> Only the two most recent releases are listed here; older ones (v0.7.6 and earlier) live in [CHANGELOG.md](./CHANGELOG.md).
 
-### v0.7.6
+### v0.7.8
 
-- **The rules page turns from a stack of self-growing cards into one tab strip and one editor** — every rule used to be a card that expanded itself, so the page was as tall as the sum of the cards and only got shorter once the user collapsed them by hand. Now every rule is a tab and exactly one editor is mounted, so the height is a function of one card plus the strip, whatever the rule count. The tabs carry what only the card head used to show (the number, a thumbnail of the first image, the match string, and whether the rule is the one in use and whether it rotates); the strip scrolls sideways rather than wrapping, at a fixed 34px with an elided match label, so switching rules cannot reflow the row. **The `+` and the "which rule" menu sit outside the scroller** — inside it, the only control that can add a rule scrolled away from the end of a long list. The match tester moved to the profile page: it answers a question about the configuration as a whole, and on the rules page it pushed the strip a whole card down. The two decisions behind the strip are pure functions now (`src/client/rules-view.ts`), pinned by the new `check:rules`, which also pins the page structure the layout rests on.
-- **The rotation card's controls were reshuffled, at your request** — the Next button and the "On screen 2 / 3" readout moved outside the rotation panel and are **always there**: that readout is the only place on the card that says which picture is showing, and it used to vanish together with the rotation switch. The only test left is `rotateNow`'s own — the active rule has two or more pictures — and below that the button is disabled and the readout is omitted rather than printing "0 / 0". **"Also step on a model switch" joined the order row** (all three answer "when does a picture change"); **"1 hour" is gone** from the dwell-time presets (the custom field still takes 3600 s); **the row of eight fixed preset swatches is deleted** (the wheel, the numeric inputs, Extract from this image, the eyedropper and Follow system theme all stay — the row was a shortcut into the same setter); and **the whole rotation block moved into the second column**, below the theme colour, where in the collapsed single-column card it used to be the tallest block on the card, sitting between the pictures and the colour controls that edit them.
-- **The festival art stops shipping in the package: fetched on the day, cached by asset** — the two holiday wallpapers (228 KB + 500 KB) were two thirds of the entire tarball, for a picture looked at one day a year, with their binary history kept in `.git` forever on top of that. They now live in the project's own [`HarmlessFunny/assets`](https://github.com/HarmlessFunny/assets): the download is gated on the **calendar**, so a profile that is not on a holiday fetches nothing at all, and the first read on the day caches the file under `holiday-cache/` — every boot after that, and every year after that, comes off disk. The reference is **pinned to a commit, never a branch** — runtime art has to be immutable, or a later reshuffle of the documentation screenshots could silently kill a shipped feature on a day nobody is watching — with jsDelivr first and raw second, and with both mirrors unreachable the holiday simply does not take over and the model rules keep painting (the "does this slot actually have bytes" gate was written for exactly that). The cache is keyed by **asset** name and sits deliberately outside the slot namespace, so neither "a holiday slot is read-only" nor "the store never holds a `modelbg-h-*` file" moved an inch; a cache entry is **validated**, and one that is not an image is treated as a miss and re-downloaded. `globalThis.fetch` is replaced by a stub throughout `check:node`, so the suite does not need a CDN to be up.
-- **A recommended profile you can install in one click** — the Config tab gained a third card that downloads the author's own configuration from the same assets repository and writes it in place of yours (see [Recommended profile](#recommended-profile)). **It is hosted in the store's own shape** — a `preset.json` shape gate, a readable `theme-config.json`, and one raw file per slot — which is what makes it editable where it lives: the config is 6.5 KB of JSON you can edit on GitHub, replacing a wallpaper is replacing a file, and publishing it is a `cp` out of the data directory. It was first written as a single theme file with every wallpaper inlined as base64, at 2.9 MB where 99.8% of the bytes were a picture; that is not a thing anyone can hand-edit, and the format was changed for exactly that reason. The plugin fetches the manifest and the config, derives the file list from `rules[].images[].slot` (no second place to keep in sync), and fetches the wallpapers one request each, four at a time — showing `3/7` on the button while it runs — so each file gets its own mirror fallback and its own validation. Applied through the same `applyThemeFile` a hand-picked file goes through, assembled on the client into the shape `exportTheme` writes; it is the only action in the panel that destroys anything, so it is the only one that asks, and the download happens **before** the question so the confirmation can state what is actually in hand (7 rules · 7 wallpapers · 2.9 MB). **The store is emptied first, deliberately:** `nextSlot` hands slots out as `m1`, `m2`, … — a counter, not a random token — so a downloaded profile and the store it lands in collide on those names as a matter of course, and "replace everything with this" is only true if the everything is actually gone; that is also why there is no undo. The wipe runs **after** the download and never before it, because an unreachable CDN must not cost the user their configuration on the way to a profile that never arrived, and a host too old to write this build's config shape is refused before anything is deleted. **One missing wallpaper fails the whole attempt and names the file** — a profile that quietly arrived short a picture is precisely the silent failure that pinning the festival art to a commit exists to prevent, so the loud failure is what makes a branch reference acceptable here; the two holiday slots a config legally names are dropped from the request set rather than asked for, since the store can never hold a `modelbg-h-*` file. `holiday-cache/` is left alone, and nothing about the profile is written to the store or cached to disk — the whole point of the button is to fetch what is there *now*.
-- **The published package drops from 1.1 MB to about 220 kB** — the documentation screenshots (`example_img/`, three webp files, 220 KB) moved into the same assets repository and both READMEs reference them by absolute jsDelivr URL (an absolute URL keeps the images on the npm page unbroken just as well, without putting binaries in the tarball or their history in `.git`); `screenshots.json`, which nothing consumes, is deleted; and `lib/client.js.map` (a 624 KB source map, useless to anyone installing the package) is no longer published, though it stays in the repository. Thirteen files became ten.
+- **A fresh install opens on one blank rule instead of the "no rules yet" screen** — with no config file at all the read used to produce an empty rule list, so the first thing a new user saw was "No rules yet — use 'Add rule' in the tab strip above": the panel telling them to press a control it had not given them. "The `rules` key is not there" (nothing has ever been configured) and "the key is there and the array is empty" (the user deleted every rule) are two different answers now, and only the first is filled in with one blank rule (id `r1`, so it is rule 1, the fallback, and the tab the panel selects); the second stays empty, so deleting the last rule is not undone by the next read. The rule is deliberately blank rather than half-built: with no picture and no theme colour of its own, matching skips it until something is filled in, instead of letting an empty background take the fallback away from rule 1.
+- **The placeholder no longer looks like real text** — its `::placeholder` colour named `--dsw-alias-label-quaternary`, which is defined NOWHERE in this harness's theme: an undefined custom property drops the declaration at computed-value time, and `color` is inherited, so the placeholder fell back to the input's own `label-primary` — the brightest ink in the panel, inside a box nobody had typed in. All three inputs that carry one (the rule's match string, the image URL, the rotation's custom seconds) now read `--dsw-alias-label-caption`, the weak token the plugin already uses for input placeholders; two more dead names went with it (`.dab-pick-n`'s `--dsw-mono` was missing a letter — the plugin's own variable is `--dab-mono` — and `.dab-brand-tag`'s carried a fallback, so dropping it changes no colour).
+- **The recommended profile retries per file, and a failed attempt keeps what it fetched** — a file used to get exactly two chances (one per mirror), so with the first few wallpapers down and the next hitting a 502 or a CDN hiccup the whole profile failed and pressing the button again started from zero. Every file now gets up to three rounds, 400 ms and then 800 ms apart; three failures are not retried — "the file is not there" (the same answer twice), "the bytes are over the cap" (the same bytes again), and "a full minute of silence" (both mirrors were already asked inside that same round, and this is what keeps the worst case at three minutes rather than six) — while everything else gets another round. What did arrive stays in hand, so the next press fetches only what is missing, as long as the config it re-fetches is **the same value** as the one those bytes came from (the profile is served from a branch, and two different pushes must not be glued together). The confirmation, the button's copy and where the progress sits are untouched; **so is the strictness** — the first file that cannot be had still fails the whole attempt and still names the slot.
 
-### v0.7.5
+### v0.7.7
 
-- **The layout mode belongs to the picture, not the rule** — 适应 / 填充 / 拉伸 / 平铺 / 居中 was one value per rule, so a rotation through a landscape photo and a tall phone screenshot could not letterbox one and fill the other. It now lives on `images[].bgMode`, read back from the image being painted, and the chip row under the filmstrip edits the image selected there (disabled, not hidden, while a rule has no picture yet). `SCHEMA_VERSION` moves to **6** because both directions of this move are silent: a schema-5 host would drop a per-image mode on its first write (拉伸 coming back 适应), and a schema-6 read of a schema-5 config lifts the rule-level value onto every one of its images, so no existing wallpaper lands on the default. A holiday's image is 填充 from its definition, like the slot and the colours beside it; the framing stays yours.
-- **The fade only animates what the palette in force writes (a fix)** — "有时候切换背景时（图上为浅色切换为浅色），白色色块会渐变为黑色色块…白色渐变完黑色后立马切到白色", with the white value measured as `237, 243, 254`. That number is the answer: `#edf3fe` = `--dsw-static-deepseek-50`, which is what the host's light scheme paints `--dsw-specific-bubble` with — the user message bubble — and its dark-scheme value is `#2c2c2e`. The fade had registered that name because it asks for the **dark** branch's token list (the superset) and hands the whole thing to the `:root` and `body` scopes, while the light branch writes only 35 of those 80 names: the other 45 (the bubble, the settings dropdown fills, the tip/tooltip/toast surfaces, the code-block header segments, the status colours) still belong to the **host**, and the plugin is what makes the host switch schemes for a moment — it disposes and re-registers its theme on every colour change, and the host's disposer resets the preference to `system`, which on a dark desktop paints the host's dark palette until that call finishes. With the reported 3000 ms switch, one frame of it became a three-second ramp. A scope's token is now emitted only when the palette in force writes it (the registrations still cover all 80 names, so the dark palette is unchanged), and a skin whose colour scheme already holds is not rebuilt at all. Measured on the reported palette: `body`'s transition list goes 80 → 35 names, the bubble and the dropdown fill are out of it, and `--dsw-alias-bg-base`, `--dsw-alias-bg-layer-2` and the code plate stay in.
-- **The code block follows the palette, and its plate has an opacity of its own (a fix)** — "代码块背景有点问题": dark green ink on a near-black plate inside a **light** interface. The host's shiki sheet declares `--shiki-background: var(--dsw-alias-markdown-code-block)` on `:root`, while the token was declared on `body` only, so the root element had nothing to read but the fade registration's `initial-value` — the host's own colour, sampled once. The palette rule is emitted for `:root` too, `:root` joins the fade scopes, the plate and its banner are palette tints again, and a new **`code`** part drives both surfaces, each through its own variable, defaulting to opaque.
-- **Four small ones** — the rotation switch no longer stays "on" when deleting images leaves fewer than two (the panel disables the switch there, so it could not be turned off either; `normalizeRule` enforces the same invariant for imports), "切换时长" is printed once instead of twice, and the profile footer's package name and the brand tile link to the repository, with `check:ui` comparing that one address against `package.json`.
-- **Gates** — `pnpm test` is now **eight** checks: `check:code-plate` and `check:image-mode` join the suite, `check:rotation` gained the switch-and-count invariant, `check:ui` the repository-link agreement, `check:transition` the fade-ownership rule and `check:repaint` the two lines that arm the fade.
+- **A fresh install starts on the author's own profile, with nothing to download** — the shipped Interface numbers are now the ones the [recommended profile](#recommended-profile) carries: main background `0%`, left panel `10%`, right panel `45%`, code plate `81%`, inputs `88%` with `60 px` of blur, conversation text `35%`, trajectory `73%`. The plugin therefore looks right before a byte is fetched, and the profile's one click adds pictures rather than changing the look underneath them. Every one of those numbers used to be picked per key for **safety** rather than for looks — `bg` 0.85 so the host surface stayed visible under it, `code` fully opaque because a code block is read rather than looked through, `input` blur 0 because blur costs a compositor layer — which is why a new install opened on a pale approximation of the host instead of on a configuration anyone would run. The preview panel is the one field that needed care: `null` ("never dragged, so follow the main background") is preserved as itself rather than read as a missing key, because every release so far has **written** it — a panel the user never dragged sits on disk as an explicit `null`, and taking that for "missing" would have repainted the panel in every existing configuration.
+- **The festival switch ships off** — a first run paints what the model rules say and nothing else; the switch on the Config page is how the feature is asked for, and the recommended profile turns it on, which is the difference between a chosen configuration and a fresh one. Only a real boolean counts now: an absent field, or a hand-edit that is not `true`/`false`, takes the shipped default instead of the old "anything but `false` means on".
+- **The percentage pill in each Interface card is gone** — the number was already on the slider row below it, so the card head is the icon and the name again.
 
 ## Star History
 

package/README.zh.md

@@ -113,7 +113,7 @@
 
 ### 节日特殊背景
 
-小小一个，不是一整块设置：**「配置」页上一个开关，别的什么都没有**。它默认就是开的；到了日子背景自己换，第二天早上自己换回。
+小小一个，不是一整块设置：**「配置」页上一个开关，别的什么都没有**。它出厂是**关**的 —— 打开它，到了日子背景自己换，第二天早上自己换回。（下面的[推荐配置](#推荐配置)会替你把它打开。）
 
 - **行为** — 中秋与国庆当天，壁纸换成那个节日自己的图片，并配上该节日固定的主题色（中秋 `#384A77`、国庆 `#FFF6EB`）；第二天交还给模型规则。这份配色同时写在节日条目和它的图片上——主题色现在住在图片里——所以以后节日也能多图轮换、每张带自己的配色。
 - **中秋节** — 农历八月十五当天。它在公历上逐年移动（2024-09-17、2025-10-06、2026-09-25、2027-09-15……），所以是运行时按农历换算的，时区钉在 **Asia/Shanghai** —— 农历日期在北京时间午夜翻页，不是你那边的午夜。
@@ -122,7 +122,7 @@
 - **没有图的节日会回落到模型规则**，而不是把背景刷空。
 - **画是下载来的，不是随包发的** — 每个节日一张压缩过的壁纸（原生分辨率下 228 KB 与 500 KB，原图共 8.37 MB），放在项目自己的 [assets 仓库](https://github.com/HarmlessFunny/assets)里，而不是打进包里 —— 它们占了整个 tarball 的三分之二，而这张画一年只被看一天。下载由**日历**把关：不在节日的配置一点流量都不会有；当天第一次读取会把它缓存到 `holiday-cache/`，此后每一次启动、往后每一年，都直接读磁盘、不再联网。引用钉死在一个 **commit** 上而不是分支，所以你以后整理仓库里的截图不可能弄坏一个已经发出去的节日；先走 `jsDelivr`、失败再走 `raw.githubusercontent.com`，两个都不通时这个节日就是不接管 —— 模型规则继续画，不会白屏。
 - **图片和配色都不可替换，这是刻意的** — 一个要求用户去配置的彩蛋就不是彩蛋了。节日槽位是只读的：往 `modelbg-h-midautumn` / `modelbg-h-nationalday` 里放文件不会被任何一次读取采用，插件也拒绝写入、抓取和删除这两个槽位。下载落进 `holiday-cache/`，按**素材名**而不是槽位命名，所以数据目录里依然永远不会出现 `modelbg-h-*` 文件。主题色是节日定义里的常量、每次读取都强制覆盖——**节日条目和它的图片两处都覆盖**，所以手改 `theme-config.json` 里的 `color` 也换不掉节日配色。布局模式同理固定为定义里的**填充**（这些画本来就是满幅的，一个残留的 `fit` 会给它加黑边），而旁边的**取景**仍然是你自己的。导出的主题文件只包含你自己的规则。
-- **不想要它** — 关掉「配置」页那个开关，或者在同一个文件里写 `"holidays": { "enabled": false }`。
+- **想要它** — 打开「配置」页那个开关，或者在同一个文件里写 `"holidays": { "enabled": true }`。只有真正的 `true` 算数：这个功能是「配置说了要」才开的，不是「没人说话」就默认开。它内部每个节日（中秋 / 国庆）各自那个开关是另一回事，仍然默认开着 —— 那是一个已经打开的功能内部的细节。
 
 ### 规则与图片各自的设置
 
@@ -135,15 +135,18 @@
 
 ### 全局设置（「界面」页）
 
+- **新装出来是什么样** — 出厂那套数字**就是作者本人的配置**，也就是[推荐配置](#推荐配置)「界面」页那套数字，所以第一次装上、什么都没下载，界面就已经是这套样子：主背景 `0%`、左侧栏 `10%`、右侧栏 `45%`、卡片面板 `100%`、代码块 `81%`、输入框与控件 `88%`（外加 `60 px` 模糊）、设置面板 `100%`、对话文本框 `35%`、轨迹页 `73%`，其余模糊都是 `0`。两边靠手工保持一致：配置文件是从真实数据目录直接发出去的，改它的数字就得同步改这些常量。（这一页不管的两项刻意**不**照抄那份配置：[节日开关](#节日特殊背景)出厂关着，[切换时长](#切换效果全局)仍保留 320 ms 的交叉淡入 —— 那份配置用的是它 3000 ms 的上限。）
 - **分部位界面透明度** — 主背景、左侧栏、右侧栏、卡片面板（含对话框周围的选项框/菜单）、输入框与控件（发送框、Cordis 插件面板）、设置面板与对话文本框各自独立滑块。与主题色无关：某条规则没有主题色时这些滑块同样生效。
 - **分部位界面模糊度** — 每个界面部位可独立调整毛玻璃 `backdrop-filter` 模糊（`0–60 px`），并通过宿主的稳定选择器为发送框与 Cordis 面板提供真实背景模糊。
 - **对话与轨迹页** — 消息列表自动包裹为半透明卡片，轨迹页可整页调节透明度与模糊，让壁纸从内容后方透出来。
-- **右侧栏** — 点开文件后从右侧滑出的那一栏有了自己的卡片：透明度默认跟随「主背景」（拖动后本卡片接管），模糊则在主背景模糊之上再叠加；关闭时不占位置、无副作用。
+- **右侧栏** — 点开文件后从右侧滑出的那一栏有了自己的卡片：拖过一次之后这张卡就自己拥有透明度，在那之前它跟随「主背景」—— 那是「出厂值还是 `null` 的年代」写下的配置所处的状态，而新装出来就是自己拥有这一栏的，取配置里的 `45%`；模糊则在主背景模糊之上再叠加，关闭时不占位置、无副作用。
 
 ### 推荐配置
 
 「配置」页的第一张卡会从项目自己的 [assets 仓库](https://github.com/HarmlessFunny/assets)下载作者本人正在用的那套配置 —— 规则、壁纸与接口设置 —— 一键装好。
 
+**它里面「界面」页的每一个数字，就是插件出厂自带的** —— `theme-config.json` 里的每一个透明度、模糊和染色 alpha，都是新装出来时的数字（见上面的「全局设置」）—— 所以在全新的机器上，这个按钮加进去的是规则和图片。它另外带来的两样东西不在这一页上：[节日开关](#节日特殊背景)，出厂关着、这份配置把它打开；以及[切换时长](#切换效果全局)，这份配置取它 3000 ms 的上限，而出厂默认是此前每一个版本都在用的 320 ms 交叉淡入。如果这个数据目录里的滑块已经被你动过，采用配置会把它们一并复位：它是一整份配置，不是一个补丁。
+
 **它托管在数据目录自己的形状里**,而不是打包成一个文档:
 
 ```
@@ -159,6 +162,7 @@ preset/
 
 - **先下载,后询问。** 确认框出现在下载成功之后,所以它能如实说出手里到底有什么 —— *7 条规则 · 7 张壁纸 · 2.9 MB* —— 而不是让你先对「一个可能根本下不来的文件」做决定。下载失败时,什么都还没有发生。
 - **少一张壁纸就整体失败,并且会说是哪一张。** 一份悄悄少了图的配置 —— 因为托管处的某个文件被改了名 —— 正是「节日素材钉死 commit」那条契约要防的静默失效;把文件名报出来,这个失败就仍然是响亮的,而这正是分支引用在这里可以被接受的原因。
+- **每张图都会自己重试,而失败的那一次会把已经下到的部分留给下一次。** 一个文件此前只有两次机会(两个镜像各一次),前面几张都下好了、下一张碰上一次 502 或一次 CDN 抽风,整份配置就失败,再按一次按钮又是从零开始。现在每个文件最多三轮(轮间 400 ms 再 800 ms),而「这个文件不在那儿」「字节本身就超限」「六十秒都没吭声」三种失败不重试 —— 前两种再问也是同一个答案,第三种是因为两个镜像在同一轮里都已经问过了,这一条也正是把最坏情况钉在三分钟而不是六分钟的东西。已经拿到的字节会留到下一次,于是下一次只补缺的那几张;前提是重新取到的配置与那些字节来自的那一份**逐值相同**(这份配置服务在分支上,两次不同的推送不许拼在一起)。严格性没变:第一个拿不到的文件仍然让整次失败、仍然会说是哪一个。
 - **写入之前先清空。** `nextSlot` 分配槽位用的是 `m1`、`m2`…… 一个计数器而不是随机串,所以下载来的配置和它落进去的那个数据目录**必然**在这些名字上撞车。「用它替换一切」只有在那个「一切」真的没了的时候才成立 —— 这也是它没有撤销的原因。
 - **清空发生在下载之后,绝不会在之前。** CDN 不通不该让你在等一个永远没来的推荐配置的路上,先把自己的配置弄丢 —— 现在下载是多次传输而不是一次,这一点更重要。
 - **不碰节日素材。** `holiday-cache/` 是下载来的、不属于任何槽位的画,不是任何人配置的一部分;重下一遍只是白白一次网络往返。而 config **确实**会列出那两个节日槽位(任何一份 config 都有),它们会被从请求清单里剔掉而不是去请求:数据目录里永远不可能存在 `modelbg-h-*` 文件。
@@ -236,7 +240,7 @@ pnpm run typecheck
 
 改完 `src/` 必须重新执行 `pnpm run bundle` 才会生效——挂载的 profile 加载的是 `lib/`。
 
-`pnpm test` 会构建、类型检查并跑九道校验（`tsdown && tsc -p tsconfig.json && node scripts/holiday-check.ts && node scripts/rotation-check.ts && node scripts/transition-check.ts && node scripts/repaint-check.ts && node scripts/code-plate-check.ts && node scripts/image-mode-check.ts && node scripts/rules-view-check.ts && node scripts/ui-strings-check.ts && node scripts/node-half-check.mjs`）。九道都不需要依赖、不需要转译器、也不需要浏览器，也可以单独跑：`pnpm check:holiday` / `pnpm check:rotation` / `pnpm check:transition` / `pnpm check:repaint` / `pnpm check:code-plate` / `pnpm check:image-mode` / `pnpm check:rules` / `pnpm check:ui` / `pnpm check:node`。
+`pnpm test` 会构建、类型检查并跑十道校验（`tsdown && tsc -p tsconfig.json && node scripts/holiday-check.ts && node scripts/rotation-check.ts && node scripts/transition-check.ts && node scripts/repaint-check.ts && node scripts/code-plate-check.ts && node scripts/image-mode-check.ts && node scripts/rules-view-check.ts && node scripts/preset-check.ts && node scripts/ui-strings-check.ts && node scripts/node-half-check.mjs`）。十道都不需要依赖、不需要转译器、也不需要浏览器，也可以单独跑：`pnpm check:holiday` / `pnpm check:rotation` / `pnpm check:transition` / `pnpm check:repaint` / `pnpm check:code-plate` / `pnpm check:image-mode` / `pnpm check:rules` / `pnpm check:preset` / `pnpm check:ui` / `pnpm check:node`。
 
 - **`check:holiday`** — 两个节日窗口对照已知日期、北京时间的跨日边界（23:59 与 00:01）、1900–2100 年间的闰八月，以及 `pickHoliday` 允许节日接管背景之前必须通过的四道闸门。
 - **`check:rotation`** — 轮换的判定（`nextIndex` / `isRotating`）：不会走越界、随机不会重复当前这张（在整个随机取值范围内穷举）、也不会把只有一张图的规则报成「正在轮换」。
@@ -245,8 +249,9 @@ pnpm run typecheck
 - **`check:code-plate`** — 代码块底板：它读的那几个表面 token 必须在 `:root` **和** `body` 上都有声明（`var()` 是在**声明它的地方**就被替换的，只声明在 body 上的 token 被根元素消费时读到的是宿主的颜色而不是调色板的）、浅色分支也要发出 banner 而不是偷借宿主的近白色、以及两块表面各读**自己**的插件变量 —— 共用一个变量会让 banner 的写入把底板也一起画了。
 - **`check:image-mode`** — 0.7.5 把布局模式下放到图片上的那次抬升，以及更要紧的**接线**：某个控件编辑的是哪张图、渲染层读的又是哪张图。接错了不会报错，只会让一轮轮换里的每张图长得一样。
 - **`check:rules`** — 选项卡背后那两个纯判定（在 `src/client/rules-view.ts`：编辑器显示哪条规则、删除之后落在哪——落在邻居上，永远不是规则 1），以及布局所依赖的页面结构：只画一个编辑器、没有旧的堆叠容器、没有逐卡片的展开状态、胶片条既不换行也不长高，以及它的滚动条样式块仍然被限定在插件自己的类上。
-- **`check:ui`** — 每个 `t('…')` 键在中英两本字典里都存在、两本字典键集完全一致、每个 `dab-…` 类在样式表里都有规则，且没有字典条目变成没人引用的死键。
-- **`check:node`** — 把构建好的 node 半边通过它真实的 RPC 处理器跑一遍，`DSH_HOME` 指向临时目录，并把 `globalThis.fetch` 换成桩 —— 节日画现在住在 CDN 上，这套校验不能依赖某个 CDN 是活的，也不该去断言一个不属于自己的文件今天有多少字节。它覆盖：节日配置块穿过共享的 sanitizer；仅仅加载插件或读取配置不会发起任何下载；画是按需下载并缓存到 `holiday-cache/`、按**素材名**而不是槽位命名；第二次读取直接读盘、不再传输；两次并发的冷读取共用一次传输；第一个镜像不通时回落到第二个，且两个镜像钉在同一个 commit 上；所有镜像都不通时答案是「没有字节」而不是抛异常，失败的抓取什么都不缓存；镜像返回 200 但内容不是图片时被拒绝而不是被缓存；损坏的缓存条目被丢弃并重新下载；节日槽位拒绝写入 / 删除 / 抓取而丢进去的文件被忽略、且数据目录里永远不会出现 `modelbg-h-*` 文件；普通规则槽位照常写入和删除；手改过的配置无法把节日指向别的规则的图片。它还覆盖逐图主题色这套形状：读取时抬升的两个方向（缺键继承规则色、显式 `null` 不继承）、颜色经过文件往返后各自独立，以及 `null` 是写出键而不是省略。切换效果同样在覆盖范围内：旧配置拿到的出厂默认、选定的效果 / 缓动 / 统一时长能原样穿过文件往返、非法值回退而夸张时长被夹紧、时长为 `0` 被保留而不是回退成默认，以及 `transition` 内部的字段漂移会被上报而不是悄悄丢掉。推荐配置从 node 半边这一侧被整条覆盖：manifest 与 config 按序下载并当场穿过 sanitizer、请求清单由规则推导且把节日槽位剔掉、一张壁纸一个请求且类型是嗅出来的而不是信 header、jsDelivr 对单个文件死了会回落到 raw，以及它每一种失败都是返回值而不是抛异常 —— 所有镜像都不通、镜像回 500、回 200 但内容是 HTML、manifest 的版本不是数字、写给更新形状的配置在请求第一张壁纸之前就被拒绝、config 不是 JSON、config 是 JSON 数组、config 列出的图片数超限、镜像谎报一个超大的长度；再加上严格的那一半（config 点名而托管处没有的壁纸是一个错误，而不是一份短了的配置）、两次在任何请求之前就发生的拒绝（节日槽位、以及一个根本不是槽位的名字），以及清空那一步：配置和每一张规则图片都没了、`holiday-cache/` 原封不动、清空后再读拿到的是全新配置而不是报错，以及随后能往空目录里写入这份配置。
+- **`check:preset`** — 推荐配置那几次传输背后的两个判定（`src/preset.ts`：哪些失败值得再来一轮、失败的那一次给下一次留下什么），以及两侧**真的在用**它们：六个失败原因逐个判定（三个终态正是能在本地廉价判定的那三个；超时不重试是因为同一轮里两个镜像都已经问过）、等待指数增长且有上限、同一个值的不同键顺序给出同一个「同一份配置」而图片列表的顺序**算数**（它就是轮换顺序）、续传拿到的必须是副本而不是那条记录本身 —— 再加上接线（node 半边循环轮次并按策略决定、客户端按「还缺哪些」而不是整个槽位表铺并发池、失败留字节、成功清掉、体积上限在收下文件之前判）。
+- **`check:ui`** — 每个 `t('…')` 键在中英两本字典里都存在、两本字典键集完全一致、每个 `dab-…` 类在样式表里都有规则、没有字典条目变成没人引用的死键，以及每一个 `var(--dsw-…)` 都必须是已安装主题确实发布过的 token —— 未定义的自定义属性会让声明被丢掉、属性悄悄回落到继承值，placeholder 因此曾经画成正文字的墨色（读不到主题时这一节跳过并说明）。
+- **`check:node`** — 把构建好的 node 半边通过它真实的 RPC 处理器跑一遍，`DSH_HOME` 指向临时目录，并把 `globalThis.fetch` 换成桩 —— 节日画现在住在 CDN 上，这套校验不能依赖某个 CDN 是活的，也不该去断言一个不属于自己的文件今天有多少字节。它覆盖：节日配置块穿过共享的 sanitizer；仅仅加载插件或读取配置不会发起任何下载；画是按需下载并缓存到 `holiday-cache/`、按**素材名**而不是槽位命名；第二次读取直接读盘、不再传输；两次并发的冷读取共用一次传输；第一个镜像不通时回落到第二个，且两个镜像钉在同一个 commit 上；所有镜像都不通时答案是「没有字节」而不是抛异常，失败的抓取什么都不缓存；镜像返回 200 但内容不是图片时被拒绝而不是被缓存；损坏的缓存条目被丢弃并重新下载；节日槽位拒绝写入 / 删除 / 抓取而丢进去的文件被忽略、且数据目录里永远不会出现 `modelbg-h-*` 文件；普通规则槽位照常写入和删除；手改过的配置无法把节日指向别的规则的图片。它还覆盖逐图主题色这套形状：读取时抬升的两个方向（缺键继承规则色、显式 `null` 不继承）、颜色经过文件往返后各自独立，以及 `null` 是写出键而不是省略。切换效果同样在覆盖范围内：旧配置拿到的出厂默认、选定的效果 / 缓动 / 统一时长能原样穿过文件往返、非法值回退而夸张时长被夹紧、时长为 `0` 被保留而不是回退成默认，以及 `transition` 内部的字段漂移会被上报而不是悄悄丢掉。推荐配置从 node 半边这一侧被整条覆盖：manifest 与 config 按序下载并当场穿过 sanitizer、请求清单由规则推导且把节日槽位剔掉、一张壁纸一个请求且类型是嗅出来的而不是信 header、jsDelivr 对单个文件死了会回落到 raw、两个镜像同时抖一下时同一个文件会被**再问一遍**并最终拿到（三个请求，日志里看得见）、托管处没有的文件仍然只花两次请求（每镜像一次、不等待）、永久 500 的镜像总共只花六次请求（三轮 × 两个镜像 —— 重试是有预算的），以及它每一种失败都是返回值而不是抛异常 —— 所有镜像都不通、镜像回 500、回 200 但内容是 HTML、manifest 的版本不是数字、写给更新形状的配置在请求第一张壁纸之前就被拒绝、config 不是 JSON、config 是 JSON 数组、config 列出的图片数超限、镜像谎报一个超大的长度；再加上严格的那一半（config 点名而托管处没有的壁纸是一个错误，而不是一份短了的配置）、两次在任何请求之前就发生的拒绝（节日槽位、以及一个根本不是槽位的名字），以及新装那条规则：空数据目录读出来正好一条空白规则（`r1`、无匹配串、无颜色、无图），而显式写空的规则列表读回仍然为空 —— 这两者是不同的答案；清空那一步：配置和每一张规则图片都没了、`holiday-cache/` 原封不动、清空后再读拿到的是同一条空白规则而不是报错，以及随后能往空目录里写入这份配置。
 
 ## 常见问题
 
@@ -297,23 +302,19 @@ pnpm run typecheck
 
 ## 近期优化
 
-> 这里只列最近两个版本；更早的版本（v0.7.4 及以前）见 [CHANGELOG.zh.md](./CHANGELOG.zh.md)。
+> 这里只列最近两个版本；更早的版本（v0.7.6 及以前）见 [CHANGELOG.zh.md](./CHANGELOG.zh.md)。
 
-### v0.7.6
+### v0.7.8
 
-- **规则页从一摞会自己长大的卡片变成一条选项卡 + 一个编辑器** —— 此前每条规则是一张自展开的卡片，页面高度等于所有卡片之和，只有手动一张张收起才会变短。现在每条规则是一个选项卡、页面上只挂载一个编辑器，所以高度只跟「一张卡片 + 一条选项卡」有关，与规则条数无关。选项卡带上原本只在卡头才有的东西（序号、首图缩略图、匹配串，以及它是不是当前生效的那条、是否在轮换）；条子横向滚动不换行、固定 34px、匹配串省略号截断，所以切换规则不会让整行抖动。**「+」和「切换哪条规则」挪到滚动区之外** —— 放在里面时，长列表里唯一能新增规则的控件会被滚走。匹配测试器搬到「资料」页：它回答的是关于整份配置的问题，而在规则页上它把选项卡整整推下去一张卡片的高度。背后两个判定抽成了纯函数（`src/client/rules-view.ts`），由新的 `check:rules` 钉住，同时钉住布局所依赖的页面结构。
-- **轮换卡片的控件按你的要求重排了一遍** —— 「下一张」和「正在显示第 2 / 3 张」搬到了「轮换这组图」那一行的外侧、**常驻**：那句读数是这张卡片上唯一说明当前是哪张图的地方，此前它会跟着轮换开关一起消失。判据只剩一条 —— 当前生效的规则有两张以上图就可用（`rotateNow` 自己的判据），不足两张时按钮禁用、读数整句省略。**「切换模型时也换一张」挪到顺序那一行**（三者都在回答「什么时候换」）；**「1 小时」从停留时长预设里删掉**（自定义输入照旧接受 3600 秒）；**八个固定预设色板删掉**（滚轮、数值输入、从本图提取、吸管、跟随系统主题都还在，那一排只是同一个 setter 的快捷方式）；**整个轮换块移到第二列、主题色之下** —— 折叠成单列的窄版里它此前是卡片最高的一块，正好夹在图片和编辑图片的颜色控件中间。
-- **节日画不再随包发布：当天按需下载、按素材名缓存** —— 两张节日壁纸（228 KB + 500 KB）此前占了整个 tarball 的三分之二，为的是一张一年只被看一天的画，还要把二进制历史永久留在 `.git` 里。现在它们托管在项目自己的 [`HarmlessFunny/assets`](https://github.com/HarmlessFunny/assets)：下载由**日历**把关，不在节日的配置一点流量都没有；当天第一次读取会把它缓存到 `holiday-cache/`，此后每次启动、往后每一年都直接读磁盘。引用**钉死在 commit 上而不是分支** —— 运行时素材必须不可变，否则以后整理一次文档截图就能让已发布的功能在某个没人盯着的那天静默失效；jsDelivr 主用、raw 兜底，两个都不通时这个节日就是不接管、模型规则继续画（那道「槽位里到底有没有字节」的闸门本来就是为这个写的）。缓存按**素材名**命名、刻意放在槽位命名空间之外，所以「节日槽位只读」「数据目录里永远没有 `modelbg-h-*`」两条不变量一个字没改；缓存条目会被**校验**，不是图片的按未命中处理并重下。`check:node` 里 `globalThis.fetch` 被整体换成桩，测试因此不依赖任何 CDN 是活的。
-- **一键装上「推荐配置」** —— 「配置」页多了第三张卡，从同一个 assets 仓库下载作者本人正在用的那套配置并就地覆盖你的（见[推荐配置](#推荐配置)）。**它托管在数据目录自己的形状里** —— 一个 `preset.json` 形状闸门、一份可读的 `theme-config.json`、加上每个槽位一个原始文件 —— 这正是它「在所在的地方就可编辑」的原因：配置是 6.5 KB 的 JSON，可以直接在 GitHub 上改；换一张壁纸就是替换一个文件；发布它就是从数据目录里 `cp` 一下。它一开始被写成单个主题文件、所有壁纸内联成 base64，2.9 MB 里 99.8% 是图片 —— 那不是任何人能手改的东西，格式就是为这个改的。插件先取 manifest 与 config，从 `rules[].images[].slot` 推出文件清单（没有第二处要同步），再一个文件一个请求地取壁纸（四路并发） —— 过程中按钮上显示 `3/7` —— 于是每个文件都有自己的镜像回退和校验。落地时走的还是本地文件那条 `applyThemeFile`，在客户端组装成 `exportTheme` 写出的形状；它是这个面板里唯一会销毁东西的操作，所以也是唯一会先问一句的，而下载发生在**提问之前**，确认框因此能如实说出手里到底有什么（7 条规则 · 7 张壁纸 · 2.9 MB）。**先清空再写入是刻意的**：`nextSlot` 分配槽位用的是 `m1`、`m2`…… 一个计数器而不是随机串，所以下载来的配置和它落进去的那个数据目录必然在这些名字上撞车，「用它替换一切」只有在那个「一切」真的没了的时候才成立 —— 这也是它没有撤销的原因。清空跑在下载**之后**、绝不在之前，因为 CDN 不通不该让你在等一个永远没来的推荐配置的路上先弄丢自己的配置；而一个旧到写不了这套配置形状的宿主，会在删除任何东西之前就被拒绝。**少一张壁纸就整体失败并报出是哪个文件** —— 一份悄悄少了图的配置，恰恰是「节日素材钉死 commit」那条契约要防的静默失效，所以这个响亮的失败正是分支引用在这里可以被接受的原因；config 合法列出的那两个节日槽位会被从请求清单里剔掉而不是去请求，因为数据目录里永远不可能有 `modelbg-h-*` 文件。`holiday-cache/` 不碰，配置也从不写进数据目录、从不落盘缓存 —— 那个按钮的全部意义就是拿到**此刻**的那一份。
-- **发布包从 1.1 MB 瘦到约 220 kB** —— 文档截图（`example_img/`，三个 webp 共 220 KB）搬去同一个 assets 仓库、两份 README 改用 jsDelivr 绝对地址（绝对地址同样能让 npm 页面上的图不裂，还不用把二进制塞进包和 `.git` 历史）；没有消费方的 `screenshots.json` 删掉；`lib/client.js.map`（624 KB 的源码映射，对装包的人没用）不再发布，仓库里仍然保留。13 个文件 → 10 个。
+- **新装打开的就是一条空白规则，而不是「还没有规则」那一屏** —— 此前完全没有配置文件时读出来的是一份空的规则列表，于是第一次装上看到的是那句「还没有规则，点上面的『新增规则』新建一条」：界面在教用户去点一个它还没给出的控件。现在「`rules` 这个键根本不在」（从未配置过）和「键在、数组是空的」（用户把规则删光了）是两个不同的答案，只有前者会种出一条空白规则（id 是 `r1`，所以它就是规则 1、就是兜底、就是面板默认选中的那张卡），后者保持为空 —— 删掉最后一条规则不会被下一次读盘复活。这条规则刻意是「空」而不是「半成品」：它没有图、也没有自己的主题色，所以在被填上东西之前匹配会跳过它，而不是让一个空背景顶掉规则 1 的兜底。
+- **placeholder 不再看起来像真的文字** —— 那条 `::placeholder` 颜色写的 `--dsw-alias-label-quaternary` 在这个 harness 的主题里**一个定义都没有**：未定义的自定义属性会让声明在计算值阶段被丢掉，而 `color` 是继承属性，于是 placeholder 拿到输入框自己的 `label-primary` —— 面板里最亮的墨色，写在一个用户一个字都没打过的框里。三个带 placeholder 的输入（规则匹配串、图片网址、轮换的自定义秒数）现在统一读 `--dsw-alias-label-caption`，也就是插件早就给输入框用的那个弱一档的 token；同一个死名字还有两处跟着修掉（`.dab-pick-n` 的 `--dsw-mono` 少了个字母，插件自己的变量是 `--dab-mono`；`.dab-brand-tag` 的那个本来就带 fallback，去掉它不改变颜色）。
+- **推荐配置的下载会按文件重试，失败的那一次把已下到的部分留给下一次** —— 此前一个文件只有两次机会（两个镜像各一次），前面几张都下好了、下一张碰上一次 502 或者一次 CDN 抽风，整份配置就失败，而再按一次按钮是从零开始。现在每个文件最多三轮、轮间 400 ms 再 800 ms；三种失败不重试 ——「这个文件不在那儿」（再问也是同一个答案）、「字节本身就超限」（下一轮还是这些字节）、「六十秒都没吭声」（两个镜像在同一轮里都已经问过了，而这一条正是把最坏情况钉在三分钟而不是六分钟的东西），其余失败会再问一轮。失败的那一次把已经拿到的字节留在手里，下一次只补缺的那几张 —— 前提是重新取到的配置与那些字节来自的那一份**逐值相同**（这份配置服务在分支上，两次不同的推送不许拼在一起）。确认框、按钮文案、进度读数的位置一处没动；**严格性也没变**：第一个拿不到的文件仍然让整次失败、仍然报出是哪一个。
 
-### v0.7.5
+### v0.7.7
 
-- **布局模式属于图片，不属于规则** —— 适应 / 填充 / 拉伸 / 平铺 / 居中 此前是每条规则一个值，于是一轮里既有横构图照片又有竖屏截图时，没法让一张留黑边、另一张铺满。现在它存在 `images[].bgMode` 上、从**正在画的那张图**读回，胶片条下面那排胶囊编辑的也是那里选中的图（规则还没有图片时是**禁用**而不是隐藏）。`SCHEMA_VERSION` 因此升到 **6**，因为两个方向都是无声的：schema 5 的宿主会在第一次写入时丢掉逐图模式（设成 拉伸 的图变回 适应），而 schema 6 读老配置时会把规则级的值抬到每一张图上，现成壁纸不会掉到默认值。节日的图按**定义**就是 填充（和它旁边的槽位、颜色同一条规矩），旁边的取景仍然是你自己的。
-- **渐变只作用于当前调色板真正写入的东西（修复）** —— 「有时候切换背景时，白色色块会渐变为黑色色块…白色渐变完黑色后立马切到白色」，白色值量到 `237, 243, 254`。那就是 `#edf3fe` = `--dsw-static-deepseek-50`，也就是宿主浅色方案的 `--dsw-specific-bubble`（你自己的消息气泡；深色方案是 `#2c2c2e`）。渐变之所以注册了这个名字，是因为它要的是**深色**分支的 token 表、又把整张表交给了 `:root`/`body` —— 浅色分支只写这 80 个名字里的 35 个，剩下 45 个（气泡、设置里的下拉框底色、提示与气泡框、代码块右上角小按钮、状态色）仍然归**宿主**；而让宿主短暂换方案的正是插件自己：每次换配色都销毁并重新注册主题，宿主的销毁器把偏好重置为 `system`，在深色桌面上那一瞬间画的就是宿主的深色调色板。配上报告里 3000ms 的切换时长，一帧的错色就成了三秒的渐变。现在只有当前调色板真正写入的 token 才会拿到过渡（注册表仍是全部 80 个，深色调色板完全没变），配色方案没变也不再重建皮肤。实测：`body` 的过渡列表 80 → 35 个名字，气泡与下拉框出局，`--dsw-alias-bg-base` / `-layer-2` / 代码块底板仍在。
-- **代码块跟着调色板走，底板有了自己的透明度（修复）** —— 「代码块背景有点问题」：浅色界面里深绿文字压在近黑底板上。宿主的 shiki 表在 `:root` 上声明 `--shiki-background: var(--dsw-alias-markdown-code-block)`，而该 token 只声明在 `body` 上，于是根元素只能读到过渡注册的 `initial-value` —— 采样一次的宿主颜色。现在调色板规则对 `:root` 一并发出（`:root` 也加入渐变作用域），底板与 banner 重新是调色板的染色，并新增 **`code`** 档位驱动这两块表面、各读自己的变量，默认不透明。
-- **四个小修** —— 删图删到不足两张时轮换开关不再卡在「开」（面板在那里本来就把它禁用了，于是也关不掉；`normalizeRule` 对导入的配置强制同一条不变量）;「切换时长」只印一次；资料页页脚的包名与品牌磁贴现在是指向仓库的链接，`check:ui` 拿那一个地址和 `package.json` 对比。
-- **门禁** —— `pnpm test` 现在是**八道**：`check:code-plate` 与 `check:image-mode` 加入，`check:rotation` 增加开关不变量，`check:ui` 增加链接一致性，`check:transition` 增加渐变归属规则，`check:repaint` 钉住武装渐变的那两行。
+- **新装出来就是作者本人那套外观，而且不用联网** —— 「界面」页出厂那套数字现在就是[推荐配置](#推荐配置)里那套：主背景 `0%`、左侧栏 `10%`、右侧栏 `45%`、代码块 `81%`、输入框与控件 `88%` 外加 `60 px` 模糊、对话文本框 `35%`、轨迹页 `73%`。所以一个字节都还没取，界面就已经是对的，而推荐配置那一下点击加进来的是图片，不是把底下的观感换掉。这些数字此前**每一个都是按「安全」而不是按「好看」逐项挑的** —— `bg` 取 0.85 是为了让宿主表面在壁纸下仍然可见，`code` 全不透明是因为「代码块是拿来读的、不是拿来看穿的」，`input` 模糊取 0 是因为一层模糊要付一个合成层的代价 —— 这就是为什么以前新装打开的是一个「宿主的苍白近似」，而不是任何人真会用的配置。预览栏是唯一需要小心处理的字段：`null`（「从没拖过，跟随主背景」）被读回成它自己、而不是当成缺失的键，因为此前每一个版本都**写过**它 —— 用户没拖过的那一栏在磁盘上就是显式的 `null`，把它当成「缺失」会把每一份既有配置里的那一栏都重画一遍。
+- **节日开关出厂是关的** —— 第一次装上只画模型规则说的东西；「配置」页那个开关才是「要这个功能」的表达，而推荐配置会把它打开 —— 这就是「选定的配置」和「全新的配置」之间的区别。现在只有真正的布尔值算数：缺失的字段、以及手改出来的非 `true`/`false` 值，都落回出厂默认，而不是旧的「只要不是 `false` 就算开」。
+- **「界面」页每张卡片上那个百分比胶囊删掉了** —— 那个数字本来就在它正下方的滑块行上，于是卡头又只剩图标和名字。
 
 ## Star History