dsh-fonttune 0.2.3 → 0.2.4

package/CHANGELOG.en.md

@@ -2,6 +2,28 @@
 
 All notable changes to **dsh-fonttune** are documented here. Chinese version: [CHANGELOG.md](CHANGELOG.md).
 
+## [0.2.4] - 2026-09-23
+
+### Added
+- **One package installs on both host lines**: `0.1.5-rc.1` – `rc.3` (the host's `settings.installSection` plus the client's `settingsScope`) and `0.1.7-alpha.1` – `alpha.2` (the host's `settings.configure({auto:true}, ctx.fiber)` plus the client's `configForms`). The plugin looks at which dialect the running host offers, and **when neither is there it only applies its styles and registers no card** rather than parking the whole package. `package.json` now declares `engines.dsh` as the semver prerelease range `>=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0` (a plain `>=0.1.5-rc.1` never matches `0.1.7-alpha.1`), and `dsh.compatibility.dshReleases` lists the five host lines that were actually exercised.
+- **The card can appear in any of the three seats the two lines declare**, and the host picks which to render: the rc line's `settings.plugin.item` (claimed by settings namespace), the alpha's `plugins.item` (an entry on the Plugins page — `id: fonttune`, label from the dictionary's `card.title`, summary from `card.description`, the whole card only on its detail page, which is **how DSH's own shell / agent-loop / subagent / web-search register themselves**), and `plugins.bundle.config` for an installed profile package (claimed by the npm name `dsh-fonttune`, and rendered on that package's detail page).
+- **Claiming the settings namespace now waits, then matches by signature**: the alpha's `configForms.describe()` is asynchronous, and the old code guessed a candidate by name before it answered, so the guess could land on somebody else's namespace and every write was refused by the host (on a real machine: the card opens, and the first edit reports "The setting was not saved"). With no candidate the scope is now `null` and a pending stand-in (the whole `getSnapshot`/`subscribe`/`set`/`unset` surface) is adopted once the describe view arrives, recognized by a **schema that carries both `uiFollowsDialog` and `stackDialog`** (real log: `served namespaces []` → `matched by served schema: fonttune`).
+- **The host side unwraps volatile references**: on the alpha every field of `ctx.fiber.config` is a cosmokit volatile reference (`{ get(), [Symbol.for("cosmokit.volatile.write")](v) }`, frozen), and reading it as a plain object yields nothing — on a real machine the card's **first render was a column of empty controls and the injected stylesheet was 0 bytes**. `plainConfigValue()` now unwraps it deeply, so `styleRow()` sees an ordinary object (measured: a 973 B rule set with `Georgia` / `520`).
+- **`inject` narrowed to the services both lines have** (`slots` / `locale`): declaring one that a line does not have (say the rc-only `settingsScope`) **parks the whole package** (`pending (waiting for service: …)`) and the web never boots. The settings scope is looked up at runtime with `ctx.get()`, and a missing host layer degrades to browser-local storage.
+- **Both shapes of a write result are understood**: the rc line's `mutate` resolves `undefined` even when it failed, while the alpha's `set`/`unset` resolve a boolean (`false` = the host refused). `followWrite` now reports a synchronous `false`, a thenable resolving `false`, and a rejection in that same note beside the preset row.
+- **`test/host-line-probe.mjs`, a live probe that is independent of the host line.** It asserts only what must hold on every line — the page boots without errors, the plugin owns exactly **one** stylesheet element and it is connected, the settings really reach the document (with `DFP_EXPECT_FAMILY` / `DFP_EXPECT_WEIGHT` set it also asserts the computed values), the configuration card is reachable from the settings sheet and renders (`.dfp-card`, whichever seat that line declares) and a control on it really writes through to the host. It joined the read-only group of `npm run verify:browser`. `DFP_PROBE=1` makes the plugin log its diagnostics (which namespaces are served, which one was claimed, what state the seat is in); `DFP_DUMP=1` makes the probe print the Plugins page grouped as the host renders it.
+
+### Changed
+- **No more `require` of host internals**: the alpha exports `IconPlusOutlineRegular` / `IconPlusOutlineMedium` and not the rc's `IconPlusOutline16`, so the `primitives` require is gone and the plus icon needed here is an inline SVG.
+- **What rc.3 actually changed, measured** (so a later release can decide whether it needs a branch): hashing all 728 js/css files under `lib/` + `dist/` across rc.2 and rc.3 leaves **exactly 2 files different** — `@deepseek-ai/cosmokit/lib/index.js` (13336 → 17160 B, gaining the volatile primitives `createVolatile` / `isVolatile` / `volatileEntries` / `updateVolatile` and `Symbol.for("cosmokit.volatile.write")`) and `dsh-client-ui-sidebar/lib/client.js` (a build stamp only, `0.1.5-rc.2-449af19` → `0.1.5-rc.3-a5380f3`). The internal `@deepseek-ai/*` dependencies moved to `^0.1.5-rc.3`, and `@deepseek-ai/schemastery` / `@deepseek-ai/cordis` went from `^` to exact pins (3.18.2 / 4.0.2). **No typography, theme or settings-API change**, so the rc behaviour needs no branch for rc.3. The rc line's own schemastery 3.18.2 has **no** `.volatile()` (the alpha's 3.18.4 does), so the volatile mark on the root schema has to be **added when supported and skipped when not**.
+- The compatibility table gained 0.2.4, and both READMEs describe how the runtime handles the two dialects.
+
+### Tests
+- `test/run.mjs` (91 checks): the card's slot allow-list gained `plugins.item` / `plugins.bundle.config`, and the case is now "registers the card in every seat a supported host may declare", asserting the three seats plus the `plugins.item` id, label and component shape (summary from `card.description`, the page returning an object).
+- `test/render-card.mjs` (23 checks): rendering resolves its seat as `settings.plugin.item` and falls back to `plugins.item`, so both lines' shapes are exercised.
+- Live (managed instance + headless Edge): `host-line-probe` passes on `0.1.5-rc.2`, `0.1.5-rc.3` and `0.1.7-alpha.2` (insert-style loading), and once more on alpha.2 loaded as a bundle. On the alpha the `codeLigatures: 2` driven from the card lands in `profiles/dfp/cordis.patch.yml`; on the rc line it lands in `settings.yaml`.
+- **CI caught a case the local dialect cannot show**: three schema cases in `test/run.mjs` read fields straight off `schema({…}).sans`. The release CI installs the newest schemastery (3.18.4, which has `.volatile()`), and a resolved field is then a **reference** rather than a value — all three were green locally (3.18.2) and red in CI. The host half now exports `plainConfigValue`, those cases read the config **the way the plugin reads it**, and each dialect's shape is asserted: with the modifier a field is a reference that has to be unwrapped, without it the field is the value. The devDependency moved to `^3.18.4` so local and CI exercise the same dialect (the rc line's unmarked shape is covered live on rc.2 / rc.3 by the probe).
+
 ## [0.2.3] - 2026-09-22
 
 ### Fixed

package/CHANGELOG.md

@@ -2,6 +2,28 @@
 
 **dsh-fonttune** 的重要变更都记录在这里。英文版见 [CHANGELOG.en.md](CHANGELOG.en.md)。
 
+## [0.2.4] - 2026-09-23
+
+### 新增
+- **一个包同时装上两条宿主线**：`0.1.5-rc.1` – `rc.3`（宿主 `settings.installSection` + 客户端 `settingsScope` 那一套）与 `0.1.7-alpha.1` – `alpha.2`（宿主 `settings.configure({auto:true}, ctx.fiber)` + 客户端 `configForms` 那一套）。插件在运行时看宿主到底给了哪一套，**两条都不在就只装样式、不注册卡片**，不会把整包 park 住。`package.json` 的 `engines.dsh` 写成语义化预发布区间 `>=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0`（写 `>=0.1.5-rc.1` 是匹配不到 `0.1.7-alpha.1` 的），`dsh.compatibility.dshReleases` 逐条列出五条实测过的宿主线。
+- **卡片在两条线的三个座位上都能出现**，由宿主自己决定渲染哪一个：rc 的 `settings.plugin.item`（按设置命名空间认领）、alpha 的 `plugins.item`（插件页的插件条目，`id: fonttune`、标签取字典里的 `card.title`、摘要用 `card.description`、详情页才渲染整张卡——**DSH 自己的 shell / agent-loop / subagent / web-search 也是这么登记的**）、以及给已装 profile 包用的 `plugins.bundle.config`（按 npm 包名 `dsh-fonttune` 认领，落在该包的详情页）。
+- **认领命名空间改成「先等、再按签名认」**：alpha 的 `configForms.describe()` 是异步的，以前抢在它应答前按名字猜候选，猜错就会落在别的命名空间上、每次写入都被宿主拒绝（真机表现：卡片能开、一改就报「设置没有保存成功」）。现在候选为空就返回 `null`，并挂一个「待定作用域」占位（`getSnapshot`/`subscribe`/`set`/`unset` 全套），等 describe 的视图到达后按 **schema 里同时含 `uiFollowsDialog` 与 `stackDialog`** 认出自己那一个再接管（真机日志：`served namespaces []` → `matched by served schema: fonttune`）。
+- **宿主侧拆掉 volatile 引用**：alpha 的 `ctx.fiber.config` 里每个字段都是 cosmokit 的 volatile 引用（`{ get(), [Symbol.for("cosmokit.volatile.write")](v) }`，且被冻结），当普通对象读只会拿到空值——真机表现是**卡片第一次渲染是一整排空控件、注入的样式表 0 字节**。现在统一走 `plainConfigValue()` 深拆，`styleRow()` 拿到的是普通对象（实测样式行 973 B、`Georgia` / `520`）。
+- **`inject` 收窄到两条线都有的服务**（`slots` / `locale`）：声明一个某条线上不存在的服务（例如 rc 才有的 `settingsScope`）会把**整包 park 住**（`pending (waiting for service: …)`），Web 直接起不来。设置作用域改为运行时用 `ctx.get()` 免声明查找，找不到就按「没有宿主层」降级。
+- **写设置的结果两种形状都认**：rc 的 `mutate` 即使失败也 resolve `undefined`，alpha 的 `set`/`unset` resolve 布尔（`false` = 宿主拒绝）。`followWrite` 现在把同步 `false`、resolve 成 `false` 的 thenable、以及 rejection 三种都报到预设行右侧那句提示里。
+- **`test/host-line-probe.mjs`：与宿主线无关的真机探针**。只断言两条线都必须成立的事——页面无报错、插件只维护**一份**样式表且已接入文档、设置真的作用到文档（设了 `DFP_EXPECT_FAMILY` / `DFP_EXPECT_WEIGHT` 就顺带断言计算样式）、设置页里能找到并渲染出 `.dfp-card`（哪条线的座位都行）、以及从卡片上改一个值真的写进宿主。已并入 `npm run verify:browser` 的只读组。设 `DFP_PROBE=1` 时插件会往控制台打诊断行（服务了哪些命名空间、认领了哪个、座位当前状态），`DFP_DUMP=1` 时探针额外按分组打印插件页的条目。
+
+### 变更
+- **不再 require 宿主内部原语**：alpha 只导出 `IconPlusOutlineRegular` / `IconPlusOutlineMedium`（没有 rc 的 `IconPlusOutline16`），所以 `primitives` 的 require 整个去掉，用到的加号改成内联 SVG。
+- **实测清楚 rc.3 到底改了什么**（供后续判断要不要为它开分支）：把 rc.2 与 rc.3 的 `lib/` + `dist/` 共 728 个 js/css 逐个哈希比对，**只有 2 个文件不同**——`@deepseek-ai/cosmokit/lib/index.js`（13336 → 17160 B，新增 volatile 原语 `createVolatile` / `isVolatile` / `volatileEntries` / `updateVolatile` 与 `Symbol.for("cosmokit.volatile.write")`）和 `dsh-client-ui-sidebar/lib/client.js`（只差构建戳 `0.1.5-rc.2-449af19` → `0.1.5-rc.3-a5380f3`）；依赖上内部包抬到 `^0.1.5-rc.3`，`@deepseek-ai/schemastery` / `@deepseek-ai/cordis` 从 `^` 改成精确钉版（3.18.2 / 4.0.2）。**排版、主题、设置 API 一处没动**，面向 rc 的行为在 rc.3 上不需要新分支。rc 线自带的 schemastery 3.18.2 **没有** `.volatile()`（alpha 的 3.18.4 才有），所以根 schema 上的 volatile 标记必须**有则加、无则跳**。
+- 兼容表补 0.2.4（中英两份 README 都改了运行时双方言的处理说明）。
+
+### 测试
+- `test/run.mjs`（91 项）：卡片槽位白名单加入 `plugins.item` / `plugins.bundle.config`，那条用例改成「每个受支持宿主可能派发的座位都注册」，断言三个座位与 `plugins.item` 的 id / 标签 / 组件形态（摘要取 `card.description`，页面交出一个对象）。
+- `test/render-card.mjs`（23 项）：渲染取值改为「`settings.plugin.item` 不在就取 `plugins.item`」，两条线的座位各跑一遍。
+- 真机（受管实例 + 无头 Edge）：`0.1.5-rc.2`、`0.1.5-rc.3`、`0.1.7-alpha.2` 各跑一次 `host-line-probe` 通过（插入式装载）；alpha.2 另跑一次 bundle 式装载通过。alpha 上确认从卡片改的 `codeLigatures: 2` 真的写进 `profiles/dfp/cordis.patch.yml`，rc 上确认落在 `settings.yaml`。
+- **CI 抓到一条本地测不出来的用例**：`test/run.mjs` 里三条 schema 用例直接读 `schema({…}).sans` 这类字段。发布 CI 装的是最新的 schemastery（3.18.4，带 `.volatile()`），于是解析出来的字段是**引用**而不是值，三条在本地（3.18.2）全绿、在 CI 全红。现在宿主半把 `plainConfigValue` 导出，这三条按**插件读配置的同一方式**取值，并断言两种方言各自的形态：有修饰符时字段是引用、拆开后才是值；没有修饰符时字段本身就是值。devDependency 同时抬到 `^3.18.4`，让本地与 CI 跑同一个方言（rc 线那套无修饰符的形态由真机探针在 rc.2 / rc.3 上覆盖）。
+
 ## [0.2.3] - 2026-09-22
 
 ### 修复

package/README.en.md

@@ -22,14 +22,25 @@
 
 ## Compatibility
 
+**One package serves both host lines, 0.1.5-rc.x and 0.1.7-alpha.x**, and the install is the same on either: both were verified for "the settings card opens, the stylesheet really reaches the page, and a change made in the card is written through".
+
 | Plugin version | Supported DSH versions |
 | --- | --- |
-| **0.2.3** (latest) | 0.1.5-rc.2 |
+| **0.2.4** (latest) | 0.1.5-rc.1 / rc.2 / rc.3, 0.1.7-alpha.1 / alpha.2 |
+| 0.2.3 | 0.1.5-rc.2 |
 | 0.2.2 | 0.1.5-rc.2 |
 | 0.2.1 | 0.1.5-rc.2 |
 | 0.2.0 | 0.1.5-rc.2 |
 
-`engines.dsh` requires **0.1.5-rc.2** or newer, and the compatibility declaration lists only the **latest release of the 0.1.5 line**: it carries every fix in that line, which makes it the most stable build of the major version, while older builds of the same major version stay compatible per semantic versioning. Earlier or newer DSH versions are untested and not declared. The market entry also states these requirements (`engines.dsh`, `dsh.compatibility.dshReleases` and `peerDependencies` in `package.json`), so the host a version needs can be checked before installing.
+`engines.dsh` is declared as **`>=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0`** (a prerelease needs its own branch: node-semver admits one only when some comparator in the range sits on that version's exact `major.minor.patch` tuple and carries a prerelease tag of its own, so a plain `>=0.1.5-rc.1` never matches `0.1.7-alpha.1`). Every difference between the lines is settled at runtime rather than by version number:
+
+- **The settings service**: up to 0.1.5-rc.x it is `settingsScope.bind({namespace})` (by namespace); from 0.1.7-alpha.x it is `configForms.get(<profile entry id>)` (by entry id, which the installing profile's patch decides — so the plugin claims the form whose served schema names its own fields). Both expose the same `getSnapshot`/`subscribe`/`set`/`unset` face, so one implementation covers them.
+- **The configuration card's seat**: the rc line has a keyed cell under Settings → Plugins → Plugin configuration (`settings.plugin.item`); the alpha line dropped that slot and instead contributes an entry to the Plugins page's official list (`plugins.item`, which is how the built-in settings pages are added there), plus a per-package page for a profile that installed this plugin as a bundle (`plugins.bundle.config`). All three are registered; the one a host never declares is inert.
+- **The host half's config values**: once the alpha marks the schema `.volatile()`, the fields the host half receives are cosmokit volatile references (`{get(),[write]}`) rather than plain values, which left the first-frame stylesheet row empty; the references are unwrapped before use.
+- **`inject` declares only services both lines have** (`slots`, `locale`): declaring one a host does not provide parks the whole package — on the alpha a declared `settingsScope` kept the entire Web UI from booting. The settings service is looked up with `ctx.get(name)` instead.
+- **The alpha's form is addressed by entry id**: while the host's `describe()` view has not arrived, the plugin does not guess a name (a wrong guess means every write is refused) — it stands in with a pending scope, adopts the real form as soon as the view is served, and re-reads immediately.
+
+The market entry also states these requirements (`engines.dsh`, `dsh.compatibility.dshReleases` and `peerDependencies` in `package.json`), so the host a version needs can be checked before installing.
 
 ## Install
 
@@ -73,8 +84,9 @@ Restart DSH once afterwards and open the Web UI; changing settings needs no rest
 - `src/index.mjs` — host half: registers the `dsh-fonttune` settings namespace (schemastery schema with length and range validation) and ships a **stamped** `<style>` into the served index through `webserver/index-inject`, so the first paint already uses the saved values; the browser half then **adopts and keeps that element** (there is only ever one copy of the stylesheet, so rules can be added *and* removed)
 - `src/client.js` — browser half: the settings card, the font picker panel, font enumeration and style injection
 - `build.mjs` — zero-dependency build: inlines the shared core, wraps the bundle in the `window.__ModuleLoader__.load({id, factory})` shell, copies the host half, and enforces that the client bundle only requires shell-held modules
-- `test/run.mjs` — offline checks (hand-built DOM / cordis / settings-surface doubles, the real schemastery schema, CSS generation and injection, sanitizer adversarial cases, dictionary key parity, the picker's grouping rules, the token-refresh power gate); `test/render-card.mjs` renders the card component through a mini React hooks runtime (including forced-open and forced-state renders, covering the 0.1.0 release-blocking crash class), fires **every control's callback** (an unwired handler only fails when someone actually clicks it) and **renders a second time** to cover a hook order that changes with state; `test/artifacts.mjs` proves `lib/` matches the current `src/` byte for byte (`npm run verify` runs all three)
-- Checks that need a real page run through `npm run verify:browser -- "<url-with-token>"` (start a managed instance first: `dsh web --port 0 --no-open` prints the URL). The default group is read-only (`browser-probe` / `ui-walk` / `style-verify`); `--writers` adds the scripts that **write the settings namespace** (`slider-walk` / `split-walk` / `split-verify` / `weight-verify`, each snapshots the user layer first and restores it before exiting), and `--only a,b` picks a subset. Every script's exit code is its verdict; `test/set-user-layer.mjs <url> '<json>'` puts the layer back after an interrupted run
+- `test/run.mjs` — offline checks (hand-built DOM / cordis / settings-surface doubles, the real schemastery schema, CSS generation and injection, sanitizer adversarial cases, dictionary key parity, the picker's grouping rules, the token-refresh power gate); `test/render-card.mjs` renders the card component through a mini React hooks runtime (including forced-open and forced-state renders, covering the 0.1.0 release-blocking crash class), fires **every control's callback** (an unwired handler only fails when someone actually clicks it) and **renders a second time** to cover a hook order that changes with state; `test/artifacts.mjs` proves `lib/` matches the current `src/` byte for byte (`npm run verify` runs all three). The devDependency is the **newest** schemastery (`^3.18.4`) — the alpha's dialect, whose `.volatile()` makes a resolved field a **reference** rather than a value — so these suites read values through the `plainConfigValue` the host half exports, the same path the plugin takes; at runtime the **host's own copy** is used (3.18.2 on rc.2 / rc.3, with no such modifier, a shape the live probe covers)
+- Checks that need a real page run through `npm run verify:browser -- "<url-with-token>"` (start a managed instance first: `dsh web --port 0 --no-open` prints the URL). The default group is read-only (`browser-probe` / `ui-walk` / `host-line-probe` / `style-verify`); `--writers` adds the scripts that **write the settings namespace** (`slider-walk` / `split-walk` / `split-verify` / `weight-verify`, each snapshots the user layer first and restores it before exiting), and `--only a,b` picks a subset. Every script's exit code is its verdict; `test/set-user-layer.mjs <url> '<json>'` puts the layer back after an interrupted run
+- `test/host-line-probe.mjs` is the **host-line-independent** check: it asserts only what must hold on every supported line — the page boots without errors, the plugin owns exactly ONE stylesheet element, the settings really reach the document (`DFP_EXPECT_FAMILY` / `DFP_EXPECT_WEIGHT` also assert the computed values when set), the configuration card is reachable from the settings sheet and renders (`.dfp-card`, whichever seat that line declares), and changing a control there really writes through. Run it first after switching host lines (rc ↔ alpha); set `DFP_PROBE=1` when debugging "the card's writes do not stick on the alpha" — the plugin then logs one `[dfp-probe]` line (which namespaces are served, which one was claimed, and what state the seat is in)
 - `test/weight-verify.mjs` measures all three weight axes (interface / conversation / code) in a live page, including that there is only one stylesheet element and that switching following off drops the followed weight without a reload; `test/split-verify.mjs` measures the conversation and code size axes plus the **retired interface size axis moving nothing**; `test/slider-walk.mjs` and `test/split-walk.mjs` drive the real card (a drag writes nothing, a release does; the simple-mode slots and the whole stack round-trip); the market-entry tooling is `test/market-pr.mjs` (status / update / refresh / reopen / open / about) and the diagnostic `test/market-inspect.mjs` (PR state, comments, CI and branch diff)
 - `docs/` — the 0.2.0 [research](docs/research-0.2.0.md) and [specification](docs/spec-0.2.0.md) records (written during design, with the trade-offs of that moment; where they differ from what shipped, README/CHANGELOG win — see the note at the top of each). **Not part of the npm `files` list, so they are not published**
 - The client bundle may only require modules from the shell's static table (`react`, `react/jsx-runtime`, `react-dom`, `@deepseek-ai/cordis`, `@deepseek-ai/dsh-client-*`…); `dsh.client.inject` declares load order, not require permission

package/README.md

@@ -22,14 +22,25 @@
 
 ## 兼容性
 
+**一份包同时支持 0.1.5-rc.x 与 0.1.7-alpha.x 两条宿主线**，安装方式与宿主线无关：两条线都验证过「设置卡片可用、样式真的作用到页面、卡片上的改动写得进去」。
+
 | 插件版本 | 支持的 DSH 版本 |
 | --- | --- |
-| **0.2.3**（最新） | 0.1.5-rc.2 |
+| **0.2.4**（最新） | 0.1.5-rc.1 / rc.2 / rc.3、0.1.7-alpha.1 / alpha.2 |
+| 0.2.3 | 0.1.5-rc.2 |
 | 0.2.2 | 0.1.5-rc.2 |
 | 0.2.1 | 0.1.5-rc.2 |
 | 0.2.0 | 0.1.5-rc.2 |
 
-`engines.dsh` 下限为 **0.1.5-rc.2**，兼容声明只列 **0.1.5 线的最新版本**：它包含这条线的全部修复，是同一大版本里最稳的一版，而同一大版本内的旧版本按语义化版本约定向上兼容。更早或更新的 DSH 未经验证，不作声明。市场条目同时声明这些兼容信息（`package.json` 的 `engines.dsh`、`dsh.compatibility.dshReleases` 与 `peerDependencies`），安装前可据此判断这一版需要的宿主版本。
+`engines.dsh` 声明为 **`>=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0`**（预发布版本必须显式留分支：node-semver 只在一个范围的某个比较符与该版本落在同一个 `major.minor.patch` 元组、且自身带预发布标签时才放行，写成 `>=0.1.5-rc.1` 匹配不到 `0.1.7-alpha.1`）。两条线的差别**全部在运行时二选一，不看版本号**：
+
+- **设置服务**：0.1.5-rc.x 是 `settingsScope.bind({namespace})`（按命名空间），0.1.7-alpha.x 换成了 `configForms.get(<profile 条目 id>)`（按条目 id，id 由安装方的 profile patch 决定，所以插件靠「宿主服务的那份 schema 里有没有本插件自己的字段」来认领）。两者都是 `getSnapshot/subscribe/set/unset` 同一张脸，插件只写一套。
+- **配置卡片座位**：rc 线是 设置 → 插件 → 插件配置 里的一个 keyed 单元（`settings.plugin.item`）；alpha 线删掉了这个槽位，改成在「插件」页的官方插件列表里贡献一个条目（`plugins.item`，内置那些设置页就是这么挂的），并另外提供「已安装成 bundle 时」的每包页面（`plugins.bundle.config`）。三个座位都注册，宿主不声明的那个是惰性的。
+- **宿主半的配置来源**：alpha 把 schema 标成 `.volatile()` 之后，宿主半拿到的配置字段是 cosmokit 的 volatile 引用（`{get(),[write]}`）而不是普通值，首帧样式行会因此变空；插件先把引用解出来再用。
+- **`inject` 只声明两条线都有的服务**（`slots`、`locale`）：声明一个宿主没有的服务会把整包 park 住——alpha 上声明 `settingsScope` 会让整个 Web 界面起不来。设置服务一律用 `ctx.get(name)` 现查。
+- **alpha 的表单是「条目 id + 描述视图」**：宿主 `describe()` 还没答话时，插件不会去猜一个条目名（猜错的话每次写入都会被告主拒绝），而是先用一个等待态座位顶住，等宿主把视图发出来再接管并立刻重读。
+
+市场条目同时声明这些兼容信息（`package.json` 的 `engines.dsh`、`dsh.compatibility.dshReleases` 与 `peerDependencies`），安装前可据此判断这一版需要的宿主版本。
 
 ## 安装
 
@@ -73,8 +84,9 @@ dsh plugin --profile web add <插件目录路径>
 - `src/index.mjs` —— 宿主半：注册 `dsh-fonttune` 设置命名空间（schemastery schema，含长度与取值范围校验），并通过 `webserver/index-inject` 把一个打过标记的 `<style>` 随首页下发，首帧即是设置里的字体；那个元素随后由浏览器半**认领并接管**（页面里只有这一份样式表，规则可增可删）
 - `src/client.js` —— 浏览器半：设置卡片、选字体面板、字体枚举与样式注入
 - `build.mjs` —— 零依赖构建：内联共享核心、套上 `window.__ModuleLoader__.load({id, factory})` 外壳、拷贝宿主半，并校验客户端 bundle 只 require shell 预注入的模块
-- `test/run.mjs` —— 离线检查（自建 DOM / cordis / 设置面替身、真实 schemastery schema、CSS 生成与注入、消毒对抗用例、双语文案键一致性、选字体面板的分组规则、令牌轮询的省电闸门）；`test/render-card.mjs` 用 mini React hooks 运行时真实渲染卡片组件（含强制展开态与强制状态，覆盖 0.1.0 那类发布阻断崩溃），把**每个控件的回调都点一遍**（未接线的回调只有真点下去才会暴露），并**渲染第二次**覆盖「状态变化后 hook 顺序改变」这一类崩溃；`test/artifacts.mjs` 校验 `lib/` 与当前 `src/` 逐字节一致（`npm run verify` 跑全部三套）
-- 需要真实页面的检查走 `npm run verify:browser -- "<带 token 的地址>"`（先起一个受管实例：`dsh web --port 0 --no-open`，它会打印地址）。默认只跑**只读**的几支（`browser-probe` / `ui-walk` / `style-verify`）；加 `--writers` 再跑会**写设置命名空间**的几支（`slider-walk` / `split-walk` / `split-verify` / `weight-verify`，各自先快照用户层、退出前还原），`--only a,b` 挑子集；每支的退出码就是判定。`test/set-user-layer.mjs <url> '<json>'` 是在被中断的运行之后还原用户层的工具
+- `test/run.mjs` —— 离线检查（自建 DOM / cordis / 设置面替身、真实 schemastery schema、CSS 生成与注入、消毒对抗用例、双语文案键一致性、选字体面板的分组规则、令牌轮询的省电闸门）；`test/render-card.mjs` 用 mini React hooks 运行时真实渲染卡片组件（含强制展开态与强制状态，覆盖 0.1.0 那类发布阻断崩溃），把**每个控件的回调都点一遍**（未接线的回调只有真点下去才会暴露），并**渲染第二次**覆盖「状态变化后 hook 顺序改变」这一类崩溃；`test/artifacts.mjs` 校验 `lib/` 与当前 `src/` 逐字节一致（`npm run verify` 跑全部三套）。devDependency 钉的是**最新的** schemastery（`^3.18.4`），也就是 alpha 那套方言——它带 `.volatile()`，解析出来的字段是**引用**而不是值，所以这几套检查都通过宿主半导出的 `plainConfigValue` 取值（和插件读配置同一条路）；运行时用的是**宿主自带的那份**（rc.2/rc.3 是 3.18.2，没有该修饰符，那条形态由真机探针覆盖）
+- 需要真实页面的检查走 `npm run verify:browser -- "<带 token 的地址>"`（先起一个受管实例：`dsh web --port 0 --no-open`，它会打印地址）。默认只跑**只读**的几支（`browser-probe` / `ui-walk` / `host-line-probe` / `style-verify`）；加 `--writers` 再跑会**写设置命名空间**的几支（`slider-walk` / `split-walk` / `split-verify` / `weight-verify`，各自先快照用户层、退出前还原），`--only a,b` 挑子集；每支的退出码就是判定。`test/set-user-layer.mjs <url> '<json>'` 是在被中断的运行之后还原用户层的工具
+- `test/host-line-probe.mjs` 是**与宿主线无关**的那一支：只断言两条线都必须成立的事——页面无报错、插件只维护**一份**样式表、设置真的作用到文档（`DFP_EXPECT_FAMILY` / `DFP_EXPECT_WEIGHT` 给了就顺带断言计算样式）、设置页里能找到并渲染出 `.dfp-card`（哪条线的座位都行）、以及从卡片上改一个值真的写进去。换宿主线（rc ↔ alpha）后先跑它；调试「alpha 上卡片写不进去」这类问题时设 `DFP_PROBE=1`，插件会往控制台打一行 `[dfp-probe]`（服务了哪些命名空间、认领了哪个、座位当前是什么状态）
 - `test/weight-verify.mjs` 在真实页面里量三条字重轴（界面 / 对话 / 代码）的独立性与「样式表只有一份、不刷新关掉跟随立即回落」；`test/split-verify.mjs` 量对话/代码两条字号轴的独立性，外加**退役的界面字号轴什么都不动**；`test/slider-walk.mjs` 与 `test/split-walk.mjs` 驱动真实卡片（拖动不写、松手才写；简单模式两格与整条栈的往返）；另有市场条目的维护脚本 `test/market-pr.mjs`（status / update / refresh / reopen / open / about）与诊断脚本 `test/market-inspect.mjs`（PR 状态、评论、CI 与分支差异）
 - `docs/` —— 0.2.0 的[背景调研](docs/research-0.2.0.md)与[功能规格](docs/spec-0.2.0.md)（设计阶段的记录，含当时的取舍理由；与最终实现不同的地方以 README/CHANGELOG 为准，两份文件文首都有说明）。**不在 npm `files` 清单内，不随包发布**
 - 客户端模块能 require 的只有 shell 静态表里的模块（`react`、`react/jsx-runtime`、`react-dom`、`@deepseek-ai/cordis`、`@deepseek-ai/dsh-client-*` 等）；`dsh.client.inject` 只是加载顺序声明，不是 require 许可

package/lib/client.js

@@ -2266,7 +2266,6 @@ if (typeof module !== "undefined" && module.exports) module.exports = shared;
 
 var React = require("react");
 var createPortal = require("react-dom").createPortal;
-var primitives = require("@deepseek-ai/dsh-client-ui-primitives");
 
 var h = React.createElement;
 var useCallback = React.useCallback;
@@ -2334,8 +2333,24 @@ var setWestEntry = shared.setWestEntry;
 var setEastEntry = shared.setEastEntry;
 var removeStackEntry = shared.removeStackEntry;
 
-/** Services this bundle waits for before it applies. */
-var inject = ["slots", "locale", "settingsScope"];
+/**
+ * Services this bundle waits for before it applies.
+ *
+ * `settingsScope` is deliberately absent: a host that does not provide a
+ * declared service parks the whole package until it appears, and DSH
+ * 0.1.7-alpha.x replaced that service with `configForms` — a plugin asking for
+ * it never activates there. Both settings dialects are looked up at apply time
+ * with `ctx.get` instead (see `pickSettingsScope`).
+ */
+var inject = ["slots", "locale"];
+
+/**
+ * The settings scope and translator `apply` bound, for the seat that renders
+ * the card without handing it either: the alpha line's bundle page renders the
+ * registered component with its own props, so the card falls back to these.
+ */
+var cardScope = null;
+var cardT = null;
 
 /** The weight DSH uses for body text; choosing it means "leave it alone". */
 var NEUTRAL_WEIGHT = 400;
@@ -2364,6 +2379,80 @@ var CHEVRON_PATH =
 /** Panel height cap, used to decide whether it opens up or down. */
 var PANEL_HEIGHT = 380;
 
+/**
+ * The translator the card falls back to when the host hands it no `t`: the
+ * built-in English table says something useful where the key alone would not.
+ * @param {string} key - dictionary key.
+ * @param {Record<string, string>} [params] - `{name}` substitutions.
+ * @returns {string} the text.
+ */
+function fallbackTranslate(key, params) {
+  return translate("en", key, params);
+}
+
+/**
+ * The settings seat a host without any settings service leaves the card: every
+ * control renders disabled over an empty document, exactly like a read-only
+ * deployment. It keeps the card — and therefore the whole configuration page —
+ * from failing to render on a composition this plugin does not know.
+ */
+var MEMORY_SCOPE = {
+  getSnapshot: function () {
+    return {
+      status: "ready",
+      value: {},
+      base: {},
+      user: {},
+      revision: 0,
+      writable: false,
+      mode: "memory",
+    };
+  },
+  subscribe: function () {
+    return function () {};
+  },
+  set: function () {
+    return Promise.reject(new Error("settings are not available in this deployment"));
+  },
+  unset: function () {
+    return Promise.reject(new Error("settings are not available in this deployment"));
+  },
+};
+
+/* ------------------------------------------------------------------ *
+ * inline icons
+ * ------------------------------------------------------------------ */
+
+/**
+ * The 16px "plus" glyph of the "add a font" button.
+ *
+ * Drawn here rather than taken from `@deepseek-ai/dsh-client-ui-primitives`
+ * because that module's icon names are not stable across the host lines this
+ * plugin supports: up to 0.1.5-rc.x the shell exports `IconPlusOutline16`,
+ * while 0.1.7-alpha.x ships the same artwork as `IconPlusOutlineRegular` /
+ * `IconPlusOutlineMedium` — and requiring a name the shell does not have turns
+ * the whole card into a render error. The path is the shipped one, byte for
+ * byte, so the button looks identical on both.
+ * @returns {object} the svg element.
+ */
+function plusIcon() {
+  return h(
+    "svg",
+    {
+      width: 16,
+      height: 16,
+      viewBox: "0 0 16 16",
+      fill: "none",
+      xmlns: "http://www.w3.org/2000/svg",
+      "aria-hidden": "true",
+    },
+    h("path", {
+      d: "M8.64453 1.5V7.34961H14.5V8.65039H8.64453V14.5H7.34473V8.65039H1.5V7.34961H7.34473V1.5H8.64453Z",
+      fill: "currentColor",
+    })
+  );
+}
+
 /* ------------------------------------------------------------------ *
  * copy
  * ------------------------------------------------------------------ */
@@ -4013,7 +4102,7 @@ function StackPicker(props) {
               setOpen(!open);
             },
           },
-          h(primitives.IconPlusOutline16, null),
+          plusIcon(),
           h("span", null, t("stack.add"))
         )
       )
@@ -4186,6 +4275,24 @@ function firstFamily(stack) {
  * the card
  * ------------------------------------------------------------------ */
 
+/**
+ * The card as DSH 0.1.7-alpha.x's Plugins page renders it.
+ *
+ * That page contributes one entry per plugin (`plugins.item`) and asks that one
+ * component for two different views: a one-line `summary` for the card in the
+ * list, and the `page` body once the entry is opened. The summary is answered
+ * with the card's own description, and every other view is the card itself, so
+ * the same UI serves the rc line's configuration cell and the alpha's plugin
+ * page without a second implementation.
+ * @param {object} props - the view asked for plus the injected face.
+ * @returns {object|string} the card, or the one-line summary.
+ */
+function FontCardPage(props) {
+  var t = typeof props.t === "function" ? props.t : cardT || fallbackTranslate;
+  if (props.view === "summary") return t("card.description");
+  return h(FontCard, { scope: props.scope || cardScope || MEMORY_SCOPE, t: t });
+}
+
 /**
  * Render the plugin's card: the settings section dispatches this component
  * under the namespace key, and the host has to serve that namespace for it to
@@ -4203,8 +4310,11 @@ function firstFamily(stack) {
  * @returns {object} the card element.
  */
 function FontCard(props) {
-  var t = props.t;
-  var scope = props.scope;
+  // The registration hands the card its face on the line that supports
+  // `inject`; the alpha's bundle page renders it with its own props, so the
+  // values `apply` bound are the fallback.
+  var t = typeof props.t === "function" ? props.t : cardT || fallbackTranslate;
+  var scope = props.scope || cardScope || MEMORY_SCOPE;
   var [open, setOpen] = useState(false);
   var [view, setView] = useState(readViewMode);
   var [expanded, setExpanded] = useState(null);
@@ -4306,13 +4416,48 @@ function FontCard(props) {
    * Report a write the settings document refused. A silent failure is the
    * worst outcome here: the control goes back to showing the stored value and
    * the user is left believing the change was saved.
-   * @param {unknown} error - the rejection reason.
+   * @param {unknown} error - the rejection reason, or a boolean refusal.
    */
   var writeFailed = function (error) {
-    var message = error && error.message ? String(error.message) : String(error);
+    var message =
+      error === false || error === undefined
+        ? "the host refused the write"
+        : error && error.message
+          ? String(error.message)
+          : String(error);
     if (message.length > 160) message = message.slice(0, 160) + "…";
     showStatus(t("preset.writeFailed", { message: message }));
   };
+  /**
+   * Follow one queued settings write.
+   *
+   * The two host lines answer differently: up to 0.1.5-rc.x the scope resolves
+   * a promise that rejects on a transport failure, while 0.1.7-alpha.x resolves
+   * `false` for a write the host refused (a stale revision, say). Both are
+   * reported, and a refused write is never left looking saved.
+   * @param {unknown} result - what the scope returned.
+   */
+  var followWrite = function (result) {
+    if (result === false) {
+      writeFailed(result);
+      return;
+    }
+    if (result && typeof result.then === "function") {
+      result.then(function (accepted) {
+        if (accepted === false) writeFailed(accepted);
+      }, function (error) {
+        // The scope reloads the Host state itself; the status row is what
+        // keeps the user from thinking the change stuck.
+        writeFailed(error);
+      });
+      return;
+    }
+    if (result && typeof result.catch === "function") {
+      result.catch(function (error) {
+        writeFailed(error);
+      });
+    }
+  };
   var submit = function (field, value) {
     var result;
     try {
@@ -4321,13 +4466,7 @@ function FontCard(props) {
       writeFailed(error);
       return;
     }
-    if (result && typeof result.catch === "function") {
-      result.catch(function (error) {
-        // The scope reloads the Host state itself; the status row is what
-        // keeps the user from thinking the change stuck.
-        writeFailed(error);
-      });
-    }
+    followWrite(result);
   };
   var clear = function (field) {
     var result;
@@ -4337,11 +4476,7 @@ function FontCard(props) {
       writeFailed(error);
       return;
     }
-    if (result && typeof result.catch === "function") {
-      result.catch(function (error) {
-        writeFailed(error);
-      });
-    }
+    followWrite(result);
   };
   var overridden = function (field) {
     return Object.prototype.hasOwnProperty.call(user, field);
@@ -5282,7 +5417,231 @@ function apply(ctx) {
   var applyCss = createStylesheet(function () {
     return tokens;
   });
-  var scope = ctx.settingsScope.bind({ namespace: NAMESPACE });
+
+  /**
+   * Look a service up without declaring it.
+   *
+   * Declaring a name the running host does not provide parks the whole package
+   * until it appears — on DSH 0.1.7-alpha.x a declared `settingsScope` left the
+   * Web UI waiting on a service that no longer exists. Both routes are tried:
+   * `ctx.get(name)` first, then the service property older lines also expose.
+   * @param {string} name - the service name.
+   * @returns {object|null} the service, or null when this host has none.
+   */
+  var getService = function (name) {
+    try {
+      if (typeof ctx.get === "function") {
+        var found = ctx.get(name);
+        if (found) return found;
+      }
+    } catch (error) {
+      // fall through to the property read
+    }
+    try {
+      return ctx[name] || null;
+    } catch (error) {
+      return null;
+    }
+  };
+
+  /**
+   * Whether one served namespace is THIS plugin's form.
+   *
+   * The alpha keys a form by profile entry id, which the installing profile's
+   * patch decides, so the entry's own fields are what identify us: either the
+   * served schema or the values it carries name them.
+   * @param {object} entry - one namespace from the describe view.
+   * @returns {boolean} true when the entry is this plugin's.
+   */
+  var isOurNamespace = function (entry) {
+    var schema = "";
+    try {
+      schema = JSON.stringify((entry && entry.schema) || {});
+    } catch (error) {
+      schema = "";
+    }
+    if (schema.indexOf(UI_FOLLOWS_FIELD) >= 0 && schema.indexOf(STACK_DIALOG_FIELD) >= 0) {
+      return true;
+    }
+    var values = (entry && (entry.value || entry.user || entry.base)) || {};
+    return (
+      Object.prototype.hasOwnProperty.call(values, UI_FOLLOWS_FIELD) &&
+      Object.prototype.hasOwnProperty.call(values, STACK_DIALOG_FIELD)
+    );
+  };
+
+  /**
+   * The profile entry id the `configForms` dialect addresses settings by.
+   *
+   * Up to 0.1.5-rc.x a namespace is a name the plugin registers; from
+   * 0.1.7-alpha.x the settings service derives a form per composed entry and
+   * keys it by that entry's id — which the installing profile's patch decides,
+   * so nothing here may hard-code it. The served view is the only honest
+   * answer: while it has not arrived this returns null, and the caller waits
+   * for it instead of guessing a name whose form could never be written.
+   * @param {object} forms - the `configForms` service.
+   * @returns {string|null} the entry id, or null while the host has not served it.
+   */
+  var formsNamespace = function (forms) {
+    var view = null;
+    try {
+      view = forms.describe ? forms.describe().getSnapshot().view : null;
+    } catch (error) {
+      view = null;
+    }
+    var served = (view && view.namespaces) || [];
+    if (globalThis.__DFP_PROBE__ === true) {
+      console.log(
+        "[dfp-probe] served namespaces " +
+          JSON.stringify(
+            served.map(function (item) {
+              return item && item.ns;
+            })
+          )
+      );
+    }
+    for (var index = 0; index < served.length; index += 1) {
+      if (isOurNamespace(served[index])) {
+        if (globalThis.__DFP_PROBE__ === true) {
+          console.log("[dfp-probe] matched by served schema: " + String(served[index].ns));
+        }
+        return served[index].ns;
+      }
+    }
+    return null;
+  };
+
+  /**
+   * A scope that adopts the host's scope the moment the host serves it.
+   *
+   * The alpha's `configForms` can be asked for a form before its describe view
+   * has arrived — `get(id)` then answers with a not-ready controller for that
+   * id, and every write through it is refused. This stands in for the scope
+   * until the real one is identifiable, forwards the card's subscription to it
+   * on adoption, and lets the card re-read immediately afterwards.
+   * @returns {object} the pending scope, with an `adopt` seat for the caller.
+   */
+  var createPendingScope = function () {
+    var target = null;
+    var listeners = [];
+    return {
+      getSnapshot: function () {
+        return target === null
+          ? {
+              status: "loading",
+              value: undefined,
+              base: undefined,
+              user: undefined,
+              revision: undefined,
+              writable: false,
+              mode: "pending",
+            }
+          : target.getSnapshot();
+      },
+      subscribe: function (listener) {
+        if (target !== null) return target.subscribe(listener);
+        listeners.push(listener);
+        return function () {
+          var at = listeners.indexOf(listener);
+          if (at >= 0) listeners.splice(at, 1);
+        };
+      },
+      set: function (field, value) {
+        if (target === null) {
+          return Promise.reject(new Error("the settings service is still starting"));
+        }
+        return target.set(field, value);
+      },
+      unset: function (field) {
+        if (target === null) {
+          return Promise.reject(new Error("the settings service is still starting"));
+        }
+        return target.unset(field);
+      },
+      /** Hand over the real scope once it is identifiable; true when taken. */
+      adopt: function (next) {
+        if (target !== null || next === null || next === undefined) return false;
+        target = next;
+        var pending = listeners.slice();
+        listeners.length = 0;
+        for (var index = 0; index < pending.length; index += 1) {
+          target.subscribe(pending[index]);
+          pending[index]();
+        }
+        return true;
+      },
+    };
+  };
+
+  /**
+   * Bind the settings scope in whichever dialect the running host speaks: the
+   * `settingsScope` service up to 0.1.5-rc.x (`bind({namespace})`), the
+   * `configForms` service from 0.1.7-alpha.x (`get(entryId)`). Both expose the
+   * same snapshot/`set`/`unset` face, so one card covers them.
+   * @returns {object|null} the bound scope, or null when neither dialect answered.
+   */
+  var pickSettingsScope = function () {
+    var settingsScope = getService("settingsScope");
+    if (settingsScope && typeof settingsScope.bind === "function") {
+      try {
+        var bound = settingsScope.bind({ namespace: NAMESPACE });
+        if (bound) return bound;
+      } catch (error) {
+        // fall through to the newer dialect
+      }
+    }
+    var forms = getService("configForms");
+    if (forms && typeof forms.get === "function") {
+      var bindAlphaForm = function () {
+        var ns = formsNamespace(forms);
+        if (ns === null) return null;
+        try {
+          var form = forms.get(ns);
+          return form && typeof form.getSnapshot === "function" ? form : null;
+        } catch (error) {
+          return null;
+        }
+      };
+      var immediate = bindAlphaForm();
+      if (immediate !== null) return immediate;
+      var pending = createPendingScope();
+      var mirror = null;
+      try {
+        mirror = typeof forms.describe === "function" ? forms.describe() : null;
+      } catch (error) {
+        mirror = null;
+      }
+      var offMirror = null;
+      var adopt = function () {
+        var form = bindAlphaForm();
+        if (form === null) return;
+        if (!pending.adopt(form)) return;
+        if (typeof offMirror === "function") offMirror();
+      };
+      if (mirror && typeof mirror.subscribe === "function") {
+        offMirror = mirror.subscribe(adopt);
+        if (typeof mirror.ensure === "function") mirror.ensure();
+      }
+      adopt();
+      return pending;
+    }
+    return null;
+  };
+
+  var scope = pickSettingsScope() || MEMORY_SCOPE;
+  if (globalThis.__DFP_PROBE__ === true) {
+    var probeSnapshot = scope.getSnapshot ? scope.getSnapshot() : {};
+    console.log(
+      "[dfp-probe] scope " +
+        JSON.stringify({
+          mode: probeSnapshot.mode,
+          status: probeSnapshot.status,
+          revision: probeSnapshot.revision,
+          writable: probeSnapshot.writable,
+          value: probeSnapshot.value,
+        })
+    );
+  }
   var appliedOverrides = "";
 
   /**
@@ -5436,6 +5795,9 @@ function apply(ctx) {
     }
     return translate(locale, key, params);
   };
+  // The card reads these when a seat renders it without the injected face.
+  cardScope = scope;
+  cardT = t;
   ctx.effect(
     function () {
       return ctx.locale.register(NAMESPACE, DICTS);
@@ -5443,18 +5805,59 @@ function apply(ctx) {
     "dsh-fonttune: dictionaries"
   );
 
-  ctx.slots.inject("settings.plugin.item", function () {
-    return ctx.slots.register(
-      {
-        name: "settings.plugin.item",
-        key: NAMESPACE,
+  /**
+   * Offer the card in one slot seat.
+   *
+   * Which seat a host declares is a line difference, not a preference, and the
+   * three are not alternatives to pick from — each is simply inert where a host
+   * never declares it:
+   *
+   *  * `settings.plugin.item` — up to 0.1.5-rc.x, a keyed cell under
+   *    Settings → Plugins → Plugin configuration (keyed by the namespace);
+   *  * `plugins.item` — 0.1.7-alpha.x's own entry in the Plugins page's
+   *    official list, which is how EVERY plugin page is contributed there (the
+   *    built-in settings pages do the same), and the seat that needs no
+   *    installed package behind it;
+   *  * `plugins.bundle.config` — the alpha's per-package page, keyed by the npm
+   *    package name, for a profile that installed this plugin as a bundle.
+   *
+   * @param {string} seat - the slot name.
+   * @param {object} options - the registration options that seat looks up.
+   * @param {Function} [component] - the component to register; the card itself
+   *   unless a seat hands it props the card does not read.
+   */
+  var offerCard = function (seat, options, component) {
+    ctx.slots.inject(seat, function () {
+      var registration = {
+        name: seat,
+        locale: NAMESPACE,
         inject: function () {
           return { scope: scope, t: t };
         },
+      };
+      for (var field in options) {
+        if (Object.prototype.hasOwnProperty.call(options, field)) {
+          registration[field] = options[field];
+        }
+      }
+      return ctx.slots.register(registration, component === undefined ? FontCard : component);
+    });
+  };
+  if (scope !== MEMORY_SCOPE) {
+    offerCard("settings.plugin.item", { key: NAMESPACE });
+    offerCard("plugins.bundle.config", { key: "dsh-fonttune" });
+    offerCard(
+      "plugins.item",
+      {
+        id: "fonttune",
+        order: 40,
+        label: function () {
+          return t("card.title");
+        },
       },
-      FontCard
+      FontCardPage
     );
-  });
+  }
 }
 
 exports.apply = apply;

package/lib/index.js

@@ -71,6 +71,30 @@ const MAX_STACK = 200;
  */
 const SAFE_FEATURES = /^[a-zA-Z0-9"' ,]*$/;
 
+/**
+ * Mark a schema editable without reloading, where the running schemastery
+ * knows the modifier.
+ *
+ * DSH 0.1.7-alpha.x derives a settings page from one form per composed entry
+ * and only projects the fields under a node marked `.volatile()` — an entry
+ * whose schema has no such node is skipped entirely, so the plugin would have
+ * no configuration page there. The modifier arrived in schemastery 3.18.x for
+ * the alpha line; the 0.1.5-rc.x line ships 3.18.2, where calling it while
+ * this module is imported would throw. Feature-detecting it is therefore the
+ * whole compatibility shim: the rc line keeps the plain schema it has always
+ * used, and the alpha gets the marking it needs.
+ *
+ * Marking the ROOT object makes every field below it live-editable; schemastery
+ * refuses a volatile node nested inside another volatile one, so nothing below
+ * may carry the modifier as well.
+ *
+ * @param {object} schema - the object schema.
+ * @returns {object} the schema, marked when the modifier exists.
+ */
+function volatileWhenSupported(schema) {
+  return typeof schema.volatile === "function" ? schema.volatile() : schema;
+}
+
 /**
  * The durable settings section.
  *
@@ -82,7 +106,7 @@ const SAFE_FEATURES = /^[a-zA-Z0-9"' ,]*$/;
  * value. Installing the plugin therefore changes nothing until the user asks
  * for something.
  */
-export const Config = z.object({
+export const Config = volatileWhenSupported(z.object({
   [SANS_FIELD]: z
     .string()
     .max(MAX_STACK)
@@ -220,13 +244,46 @@ export const Config = z.object({
     .max(shared.MAX_PRESET_NAME)
     .default("")
     .description("Name of the preset the card currently edits (edits auto-save into it)"),
-});
+}));
 
 /**
  * One row of the structured index injection table.
  * @typedef {{kind: "style", text: string} | {kind: "html", placement: "head", html: string}} StyleRow
  */
 
+/**
+ * The cosmokit volatile-reference protocol: a parsed config field may be a
+ * frozen `{ get(), [write](value) }` reference rather than a plain value.
+ *
+ * DSH 0.1.7-alpha.x marks the plugin's whole schema `.volatile()` so a settings
+ * write can land without remounting the entry, and the loader then hands this
+ * plugin a config whose fields ARE those references. Reading them as plain data
+ * (which `normalizeConfig` expects) would see objects where strings belong and
+ * emit nothing, so the references are unwrapped first. On the 0.1.5-rc.x line
+ * no field is a reference and this is a plain deep copy.
+ */
+const VOLATILE_WRITE = Symbol.for("cosmokit.volatile.write");
+
+/**
+ * Replace every volatile reference in a parsed config with its current value.
+ *
+ * Exported because it is half of this plugin's host-line contract: a caller that
+ * wants to read a resolved config — a test, or a later composition — has to go
+ * through it, since on the alpha a parsed field is a reference rather than data.
+ * @param {unknown} value - a parsed config value, or a reference to one.
+ * @returns {unknown} the same shape, references unwrapped.
+ */
+export function plainConfigValue(value) {
+  if (value === null || typeof value !== "object") return value;
+  if (VOLATILE_WRITE in value && typeof value.get === "function") {
+    return plainConfigValue(value.get());
+  }
+  if (Array.isArray(value)) return value.map(plainConfigValue);
+  const out = {};
+  for (const [key, child] of Object.entries(value)) out[key] = plainConfigValue(child);
+  return out;
+}
+
 /**
  * The style row carrying one configuration.
  *
@@ -240,7 +297,7 @@ export const Config = z.object({
  * @returns {StyleRow} the row the web server renders into `<head>`.
  */
 function styleRow(resolved) {
-  const cfg = normalizeConfig(resolved);
+  const cfg = normalizeConfig(plainConfigValue(resolved));
   // 0.2.0 ships the per-theme editor out; light and dark stay one value set
   // (the dark fields remain in the schema, dormant, for a future release).
   cfg[PER_THEME_FIELD] = false;
@@ -258,20 +315,47 @@ function styleRow(resolved) {
 
 /**
  * Register the settings section and keep the index in sync with it.
+ *
+ * TWO HOST DIALECTS. Up to DSH 0.1.5-rc.x the settings service registers a
+ * named section with a schema and reads it back by that name
+ * (`settings.installSection`), and the section name is what the browser half
+ * binds. From 0.1.7-alpha.x the service derives one form per composed entry and
+ * addresses it by the PROFILE ENTRY ID — there is no `installSection` at all,
+ * and an instance announces its page policy with `settings.configure` instead.
+ * Both are pure registrations that the browser half then reads through its own
+ * service, so which one ran does not change anything else here.
+ *
  * @param {object} ctx - host cordis context.
  * @param {unknown} config - the plugin entry's composition config (base layer).
  */
 export function apply(ctx, config) {
   let current = () => config;
   ctx.inject(["settings"], (settingsCtx) => {
-    settingsCtx.settings.installSection(ctx, NAMESPACE, Config, config ?? {}, {
-      setSource: (source) => {
-        current = source;
-      },
-      // The row table is rebuilt on every index render and every worker boot
-      // payload, so each read is already fresh; nothing to invalidate here.
-      onChange: () => {},
-    });
+    const settings = settingsCtx.settings;
+    if (settings && typeof settings.installSection === "function") {
+      settings.installSection(ctx, NAMESPACE, Config, config ?? {}, {
+        setSource: (source) => {
+          current = source;
+        },
+        // The row table is rebuilt on every index render and every worker boot
+        // payload, so each read is already fresh; nothing to invalidate here.
+        onChange: () => {},
+      });
+      return;
+    }
+    if (settings && typeof settings.configure === "function") {
+      // `auto: true` keeps the host's generated page as the fallback wherever
+      // no custom page of ours is reachable.
+      settingsCtx.effect(() => settings.configure({ auto: true }, ctx.fiber));
+      // This dialect has no registered reader: the entry's live, merged value
+      // is the fiber's own resolved config, which is what the settings service
+      // shows a form as well. The browser half adopts and rewrites the served
+      // element on activation either way, so this only decides the first frame.
+      current = () => {
+        const live = ctx.fiber && ctx.fiber.config;
+        return live === undefined || live === null ? config : live;
+      };
+    }
   });
   ctx.on("webserver/index-inject", (table) => {
     table.push(styleRow(current()));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-fonttune",
-  "version": "0.2.3",
+  "version": "0.2.4",
   "description": "Font plugin for the DeepSeek Harness Web GUI: the conversation gets its own font, size, line height and weight, the interface font and weight follow it, code keeps its own axis with ligature control, and whole setups save as presets.",
   "type": "module",
   "main": "lib/index.js",
@@ -19,7 +19,7 @@
     "LICENSE"
   ],
   "engines": {
-    "dsh": ">=0.1.5-rc.2"
+    "dsh": ">=0.1.5-rc.1 <0.1.7-0 || >=0.1.7-alpha.1 <0.2.0-0"
   },
   "dsh": {
     "bundle": {
@@ -30,13 +30,17 @@
     },
     "compatibility": {
       "dshReleases": {
-        "0.1.5-rc.2": "compatible"
+        "0.1.5-rc.1": "compatible",
+        "0.1.5-rc.2": "compatible",
+        "0.1.5-rc.3": "compatible",
+        "0.1.7-alpha.1": "compatible",
+        "0.1.7-alpha.2": "compatible"
       }
     }
   },
   "peerDependencies": {
-    "react": "^18.2.0",
-    "@deepseek-ai/schemastery": "^3.18.0"
+    "@deepseek-ai/schemastery": "^3.18.0",
+    "react": "^18.2.0"
   },
   "peerDependenciesMeta": {
     "@deepseek-ai/schemastery": {
@@ -44,7 +48,7 @@
     }
   },
   "devDependencies": {
-    "@deepseek-ai/schemastery": "^3.18.0"
+    "@deepseek-ai/schemastery": "^3.18.4"
   },
   "scripts": {
     "build": "node build.mjs",