dsh-instruction-memory 1.0.15 → 1.0.17

package/CHANGELOG.md

@@ -7,6 +7,89 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.0.17] — 2026-10-12
+
+### 新增
+
+- **注入预算可视化（F1）**：设置页在「注入字数上限」下方显示用量条与「实际注入 x / y 字符
+  （约 z token，估算）」（token 按 0.6 系数估算，与既有说明同一口径，仅作参考）；被上限略过的
+  **生效中**条目在列表中逐条标注橙色「本轮不注入」（悬停说明原因），极端情况下首条被迫截断时
+  标注红色「已截断」，用量条同时变为警示色并给出条数提示。调高上限或调整优先级保存后标记即时变化。
+- Host 新增导出纯函数 `planInjection(data)`：在**不改变注入文本一个字节**的前提下，返回注入文本、
+  生效上限（clamp 后的 budget）、候选条目数，以及每条 `included`（`{id, chars, truncated}`）
+  / `omitted`（`{id, chars}`）的取舍明细与考虑顺序（先「始终」后「按需」、同档优先级/更新时间降序）；
+  `buildBlock()` 改为它的薄封装。
+- 快照 `injection` 新增 `budget` / `activeCount` / `included` / `omitted` 字段（SSE 帧随之自动携带）。
+  存储格式仍为 v1、**无新增落盘字段**；旧客户端收到新字段自然忽略，新客户端对没有这些字段的旧宿主
+  快照回退到 `data.budgetChars`、不显示条目标记，两侧均不报错。
+
+### 测试
+
+- `smoke-test.mjs` 新增 20+ 条 `planInjection` 断言：空/总开关关闭/非法输入、budget 越界夹取、
+  与 `buildBlock()` 逐字节一致、停用与空条目不参与、「始终」先于「按需」、紧预算下 included/omitted
+  恰好分区全部候选、单条超长首条截断标记、计划本身确定性。
+- `contract-test.mjs` 新增独立验证块：经真实路由在 800 字符上限下断言快照预算、`chars === preview.length`
+  且不超上限、取舍明细恰好覆盖全部生效条目且不含停用条目、预览脚注数量与 omitted 一致、提高上限后
+  全部纳入；并把真实/旧版/垃圾三类快照喂给客户端 reducer 验证接缝。
+- `verify.mjs` 新增客户端 `__budgetMeter` reducer 断言（计划字段优先、旧快照回退、非法项忽略、
+  垃圾输入零值不抛错、percent 封顶 100、0.6 token 估算）及 6 个新 i18n 键的双语存在性；
+  键集与占位符一致性仍由既有用例锁定。
+- `docs/demo.html` 的演示宿主改为实时计算注入计划（与 `planInjection` 同一算法），演示数据
+  默认 800 字符上限以直接展示用量条与「本轮不注入」标记；旧的手工静态预览文本移除。
+
+## [1.0.16] — 2026-10-05
+
+一次定向缺陷修复 + 宿主范围扩展。每项修复都有对应回归断言（`npm test` 五套件全绿：
+lint、host-range、smoke、contract、verify）。
+
+### 安全
+
+- **修复 IPv6 回环被错误 403 的缺陷**：经 `http://[::1]:端口` 打开设置页时，保存 /
+  删除 / 导入 / SSE 实时刷新此前全部不可用。两个成因：① `hostnameOf('::1')`
+  把裸 IPv6 字面量按最后一个冒号截断成 `:`，永远匹配不上回环名单（名单里的
+  `::1` 是死条目）；② WHATWG URL 解析器给出的 `Origin` 主机名**保留方括号**
+  （`[::1]`），而 `Host` 解析去掉方括号（`::1`），同源比较永不相等。现新增
+  IP 规范化比较（8 段零填充展开），同时覆盖 IPv4-mapped 地址的两种拼写
+  （`::ffff:127.0.0.1` 与 URL 规范化后的 `::ffff:7f00:1` 视为同一地址）；
+  DNS 重绑定等真正的跨站请求在 IPv6 上同样被拒。默认 `--host 127.0.0.1` 不受
+  此问题影响。
+- 绑定侧的回环判定同步走规范化比较：宿主绑定到 `::ffff:127.0.0.1` 这类等价
+  地址时，Host 防护不再被错误关闭。
+
+### 缺陷修复
+
+- **跨进程写锁补上持有者令牌（TOCTOU）**：锁文件 `memory.json.lock` 现在写入
+  本次写入的随机令牌，释放时仅当文件仍属自己才删除。此前一个超时 2 秒、"无锁
+  照写"的慢持有者，其 `finally` 可能把新持有者刚接管的锁删掉，静默放跑第三个
+  写者。过期死锁（超 10 秒）的接管策略不变。
+- **SSE 首帧等待 boot 完成**：在宿主首次磁盘读取尚未结束时打开的设置页，不再
+  先收到一帧空存储、再收到真实快照（一次"没有任何指令"的闪烁）。
+- **SSE 写出异常的连接现在完整清理**：广播时 `res.write` 抛错（对端已消失）会
+  注销并结束该响应，而不是只从广播集合删除、留下半注册的流；其他健康流不受
+  影响。
+- **编辑注入字数上限时不再被实时推送打断**：输入框聚焦期间，其他窗口/进程的
+  SSE 快照不再覆盖正在输入的数字；失焦后恢复与已提交值同步。
+- **删除不存在的 id 不再产生空写盘**：不再 bump `rev`、不写文件、不推送回声帧
+  （删除一个已被另一窗口删掉的条目时不再制造无意义的写入）。
+
+### 样式
+
+- 修复错误状态红点的 CSS 变量名笔误：`--dsh-alias-state-error-primary` →
+  `--dsw-alias-state-error-primary`（此前该点不跟随宿主主题，恒取兜底色）；
+  verify 套件新增全文件变量前缀扫描，杜绝同类笔误再发布。
+
+### 兼容性
+
+- **声明范围扩展到 `0.2.1-alpha.1`（2026-10-03 发布）**：新增
+  `>=0.2.1-alpha.0 <0.3.0-0` 枚举段。该版本此前在**宿主门禁**（includePrerelease）
+  与市场判定下可通过、但在 npm/pnpm 的默认 peer 解析下会报 ERESOLVE；现两种
+  模式一致放行。三处声明（peerDependencies / dsh.engines / dsh.compatibility）
+  仍由 host-range 测试钉死逐字节一致。对 npm 上全部 30 个已发布版本穷举：
+  范围内 15 个、两模式零分歧；契约矩阵对最近 10 个版本 12/12 通过。
+  **0.2.1-alpha.1 仅有源码契约层证据，未做真机启动实测。**
+- README 兼容性统计按当前 registry 更新（28/13 → 30/15），cordis 已发布版本
+  数 6 → 7（新增 `4.0.5-alpha.1`，已核验含 `ctx.inject`/`ctx.effect`）。
+
 ## [1.0.15] — 2026-10-03
 
 本轮为一次系统性缺陷清查后的批量修复，每一项都有对应的回归测试（`npm test` 五套件全绿：

package/README.md

@@ -54,6 +54,11 @@ dsh plugin --profile web remove dsh-instruction-memory
   上限单位是**字符**而非 token——按 DeepSeek 官方分词比例约 1 个中文字符 ≈ 0.6 token、
   1 个英文字符 ≈ 0.3 token（不同模型分词有差异，实际用量以模型返回为准），上限 40000
   字符约合 24000 token。
+- **预算用量可视化**：设置页在上限输入框下方显示用量条——「实际注入 x / y 字符（约 z token，
+  估算）」（token 数按 0.6 系数估算，仅作参考）；被上限略过的**生效中**条目会在列表里逐条
+  标注橙色「本轮不注入」（悬停可见原因），极端情况下首条被迫截断时标注红色「已截断」。
+  调高上限或调整优先级后标记实时变化。这些数据只是对注入取舍的**展示**，不改变注入文本本身；
+  存储格式不变，旧宿主/旧客户端对新字段一律忽略，互不影响。
 
 条目全部停用或总开关关闭时，该提示词段落**整个注销**，系统提示词与未安装本插件时逐字节一致。
 
@@ -259,24 +264,28 @@ GUI 与路由本就同主机不同端口），`none`（用户直接导航）放
 同一串范围（三处逐字节一致，由测试锁定）：
 
 ```
->=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0
+>=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0
 ```
 
 **验证范围与证据等级**——三者不可混为一谈，下面每一行都标了它到底证明了什么：
 
 | 等级 | 证明什么 | 覆盖 |
 | --- | --- | --- |
-| ① **真实启动** | 在该宿主版本上真的把 DSH 跑起来：插件装载、注入真的进入**组装后的提示**、插件 HTTP 路由可应答、客户端设置页模块被下发（Windows / Node 22） | `0.1.3-alpha.2` · `0.1.5-alpha.1` · `0.1.5-alpha.2` · `0.1.5-rc.1` · `0.1.5-rc.2` · **`0.2.0-rc.1`** ⁽*⁾ |
-| ② **契约核验** | 抓该版本**真实发布的源码**，逐个核验本插件实际用到的每个符号：`systemPrompt.section()`、`assemble()` 是否求值**函数型** `text`、`FILE_REFERENCE=900` / `TOOL_BASH=1000` 仍在（决定 order 950 是否空档）、重名注册是否抛错、`webServer.register()` / `get host()`、`ctx.inject()` / `ctx.effect()`、`dsh.client.inject` 两包在该版本是否存在且声明了 `dsh.client` | 声明范围接住的**全部 13 个已发布版本**（`0.1.3-alpha.2` → `0.2.0-rc.1`） |
+| ① **真实启动** | 在该宿主版本上真的把 DSH 跑起来：插件装载、注入真的进入**组装后的提示**、插件 HTTP 路由可应答、客户端设置页模块被下发（Windows / Node 22） | `0.1.3-alpha.2` · `0.1.5-alpha.1` · `0.1.5-alpha.2` · `0.1.5-rc.1` · `0.1.5-rc.2` · **`0.2.0-rc.1`** ⁽*⁾ · **`0.2.0-rc.2`** ⁽**⁾ |
+| ② **契约核验** | 抓该版本**真实发布的源码**，逐个核验本插件实际用到的每个符号：`systemPrompt.section()`、`assemble()` 是否求值**函数型** `text`、`FILE_REFERENCE=900` / `TOOL_BASH=1000` 仍在（决定 order 950 是否空档）、重名注册是否抛错、`webServer.register()` / `get host()`、`ctx.inject()` / `ctx.effect()`、`dsh.client.inject` 两包在该版本是否存在且声明了 `dsh.client` | 声明范围接住的**全部 15 个已发布版本**（`0.1.3-alpha.2` → `0.2.1-alpha.1`） |
 | ③ **真实执行** | 把插件**真的挂载**进该版本的 `@deepseek-ai/cordis`，跑装载 / 路由注册 / 卸载共 9 项断言 | cordis `4.0.2` 与 `4.0.4`（各 9/9） |
 
 ⁽*⁾ **`0.2.0-rc.1` 的①档有一条要说明**：插件装载、注入进入组装后的提示、HTTP 路由可应答三项**均已实测**（路由 `HTTP 200`；`injection.registered=true`、`chars=437`、**`pulls=38`**——即 0.2.0-rc.1 的 agent loop 真的求值了 38 次函数型 `text`）。第四项"客户端模块被下发"**没有直接抓取**：首页需要鉴权（`/` 返回 `401`），我无法取到 `window.__DSH_BOOT__`。这一项的支撑是间接但强的两条：① `dsh-client-modules` 在合成阶段对 `dsh.client` 声明做硬校验，不合格会抛 `ClientPackageCompositionError` 直接导致启动失败——宿主正常启动即说明声明通过了 0.2.0-rc.1 的校验；② 本插件用到的三个客户端契约包（`-slots` / `-renderer` / `-settings`）相对升级前真正在跑的 `0.1.7-rc.2` **逐字节未变**。**未做人工视觉确认**（没有打开设置页看）。
 
-此外 `host-range-test.mjs` 的固定矩阵覆盖 `0.1.6-alpha.2`、`0.1.7-rc.2` 与 `0.2.0-rc.1`，并会**读取本机实际安装的宿主版本**做实时断言。
+⁽**⁾ **`0.2.0-rc.2` 的①档**：桌面版 `0.2.0-rc.2`（私有发行版 `dsh-desktop-runtime`，见仓库 `dsh-memory-verification/DSH-VERSION-COMPAT.md` §12）上完成过路由 200 + `registered=true` + 注入段落真实出现在会话提示中的活体实测；网页版宿主 `0.2.0-rc.2` 上对本插件路由的 `state` 探测同样返回 200。同样**未做设置页人工视觉确认**。
 
-**关于 1.0.10 新增的 `ctx.inject`。** 这是新版唯一的硬依赖增量：`inject` 去掉了 `webServer`，设置页路由改为非阻塞的 `ctx.inject(['webServer'], …)` 子 fiber（原因见上）。为此逐个核验了 **cordis 全部 6 个已发布版本**（`4.0.1-rc.1` → `4.0.4`）——**每一个都具备 `ctx.inject`**，因此声明范围内不存在因它而失效的宿主版本。
+此外 `host-range-test.mjs` 的固定矩阵覆盖 `0.1.6-alpha.2`、`0.1.7-rc.2`、`0.2.0-rc.1`、`0.2.0-rc.2` 与 `0.2.1-alpha.1`，并会**读取本机实际安装的宿主版本**做实时断言。
 
-**关于声明范围是否"超范围承诺"。** 已对全部 **28 个**已发布宿主版本穷举核验：范围内 **13 个**版本的 API 面**全部齐备，超范围承诺 0 项**。范围外的 15 个版本（`0.0.1-rc.1` → `0.1.2-rc.1`）API 面**同样齐备**，但它们**从未真实启动验证过**，所以下限维持不动、不向外放宽——不把没验证过的东西写进声明。
+**关于 1.0.10 新增的 `ctx.inject`。** 这是新版唯一的硬依赖增量：`inject` 去掉了 `webServer`，设置页路由改为非阻塞的 `ctx.inject(['webServer'], …)` 子 fiber（原因见上）。为此逐个核验了 **cordis 全部 7 个已发布版本**（`4.0.1-rc.1` → `4.0.5-alpha.1`）——**每一个都具备 `ctx.inject`**（其中 4.0.2 / 4.0.4 另做了真实挂载执行，4.0.5-alpha.1 为源码符号核验），因此声明范围内不存在因它而失效的宿主版本。
+
+**关于声明范围是否"超范围承诺"。** 已对全部 **30 个**已发布宿主版本穷举核验（2026-10-05，npm 官方 registry）：范围内 **15 个**版本的 API 面**全部齐备，超范围承诺 0 项**，且默认与 `includePrerelease` 两种语义在这 15 个版本上零分歧。范围外的 15 个版本（`0.0.1-rc.1` → `0.1.2-rc.1`）API 面**同样齐备**，但它们**从未真实启动验证过**，所以下限维持不动、不向外放宽——不把没验证过的东西写进声明。
+
+**关于 `0.2.1-alpha.1`（2026-10-03 发布，1.0.16 起覆盖）。** 它是前述"未来 minor 预发布版本在默认语义下接不住"的**第一个真实发生案例**：1.0.15 的范围在宿主门禁与市场判定（均用 `includePrerelease`）下放行它，但在 npm/pnpm 默认 peer 解析下拒绝（ERESOLVE）；其耦合面（9 个契约点）经最近 10 版本矩阵核验全部齐备，cordis 为 `4.0.5-alpha.1`。1.0.16 新增 `>=0.2.1-alpha.0 <0.3.0-0` 枚举段后两种语义一致放行。**该版本仅有契约层证据，未做真机启动实测。**
 
 **`0.2.0-rc.1` 的核验口径**（2026-09-29 增补）：基准取 npm 上**真实发布的 `0.1.7-rc.2`**（升级前本机真正在跑的版本），逐文件 SHA256 与 `0.2.0-rc.1` 比对。本插件的 6 个耦合点里 **6 个逐字节未变**（`dsh-system-prompt` 4/4、`dsh-client-ui-slots` 4/4、`-renderer` 12/12、`-settings` 11/11、`dsh-host-webserver` 3/3、`dsh-client-modules` 10/10）；变动的只有 `dsh-agent-loop`（注入通路 `preStep` / `assemble` 逐行等同）与 `dsh-app-boot`（兼容门禁函数逐字节等同）。方法带**阴性对照**：同法比对 `0.1.6-alpha.2` 得到的哈希**不同**，证明这套比对确实能检出变化，而不是恒真。
 
@@ -295,6 +304,10 @@ major.minor.patch 且自身带预发布标签的比较符"。这条规则是**
 ⚠️ **一个必须知道的上限（注意它是"模式相关"的，别当成普适结论）：未声明的未来 minor 的预发布版本，在 npm 的默认语义下无法被任何范围覆盖。**
 `0.1.8-rc.1` 这类版本 tuple 与所有比较符都不同，在 **npm 默认语义**下**永远匹配不到**——与
 `^0.1.0` 无法匹配 `0.1.8-rc.1` 是同一个限制。正式版（`0.1.8`、`0.2.0`、`1.0.0` 等）不受影响。
+这个限制不再只是假设：**`0.2.1-alpha.1`（2026-10-03 发布）就是第一个真实撞上它的版本**，
+1.0.16 已通过新增 `0.2.1` 枚举段闭合；下一个未声明 tuple（如 `0.2.2-rc.1`、`0.3.0-rc.1`）
+仍会重演同一现象，需要发一版加一行——host-range 的实时守卫会在本机升级到该宿主时
+直接让测试失败并给出可直接套用的修复行。
 
 **但在 `includePrerelease: true` 下这条上限不成立。** 实测同一串范围：`0.1.8-rc.1` 在默认语义下 `false`、
 在 `includePrerelease: true` 下 **`true`**（已用 DSH 自带的 semver 7.8.5 验证）。而这个区别是**有后果**的，

package/lib/client.js

@@ -58,6 +58,12 @@ window.__ModuleLoader__.load({
 .im-tag-always { color:var(--dsw-alias-brand-primary,#3b6cff); border-color:currentColor; }
 .im-tag-auto { color:var(--dsw-alias-state-success-primary,#18a058); border-color:currentColor; }
 .im-tag-high { color:var(--dsw-alias-state-warn-primary,#d97706); border-color:currentColor; }
+.im-tag-off { color:var(--dsw-alias-state-warn-primary,#d97706); border-color:currentColor; }
+.im-tag-cut { color:var(--dsw-alias-state-error-primary,#d94838); border-color:currentColor; }
+.im-meter { height:6px; border-radius:999px; overflow:hidden;
+  background:var(--dsw-alias-bg-layer-2,rgba(0,0,0,.08)); }
+.im-meter-fill { height:100%; border-radius:999px; background:var(--dsw-alias-brand-primary,#3b6cff); }
+.im-meter-fill-warn { background:var(--dsw-alias-state-warn-primary,#d97706); }
 .im-empty { padding:26px; border-radius:10px; text-align:center; font-size:12px;
   border:1px dashed var(--dsw-alias-border-l2,rgba(0,0,0,.18)); color:var(--dsw-alias-label-secondary,#8a9099); }
 .im-err { font-size:12px; color:var(--dsw-alias-state-error-primary,#d94838); }
@@ -75,10 +81,11 @@ window.__ModuleLoader__.load({
 .im-dot { width:7px; height:7px; border-radius:50%; flex:none; background:var(--dsw-alias-label-secondary,#8a9099); }
 .im-dot-on { background:var(--dsw-alias-state-success-primary,#18a058); }
 .im-dot-off { background:var(--dsw-alias-state-warn-primary,#d97706); }
-.im-dot-err { background:var(--dsh-alias-state-error-primary,#d94838); }
+.im-dot-err { background:var(--dsw-alias-state-error-primary,#d94838); }
 .im-body-open { max-height:none; }
 .im-more { margin-top:4px; font-size:11.5px; color:var(--dsw-alias-brand-primary,#3b6cff); cursor:pointer; user-select:none; }
 .im-search-meta { margin-top:5px; }
+.im-meter-line { margin-top:5px; }
 .im-undo { display:flex; align-items:center; gap:10px; padding:9px 13px; border-radius:8px; font-size:12px;
   border:1px solid var(--dsw-alias-border-l2,rgba(0,0,0,.14)); background:var(--dsw-alias-bg-layer-2,rgba(0,0,0,.04)); }
 .im-undo button { border:1px solid var(--dsw-alias-brand-primary,#3b6cff); color:var(--dsw-alias-brand-primary,#3b6cff);
@@ -140,6 +147,12 @@ window.__ModuleLoader__.load({
         'budget.unitHint': '单位是字符，不是 token',
         'budget.rangeError': '上限需在 {min} ~ {max} 之间',
         'budget.note': '单位为字符、非 token：按 DeepSeek 分词约 1 个中文字符 ≈ 0.6 token（英文 ≈ 0.3），{max} 字符上限约合 {tokens} token，实际以模型为准。',
+        'budget.used': '实际注入 {used} / {budget} 字符（约 {tokens} token，估算）',
+        'budget.omitted': '有 {count} 条生效指令因超出上限本轮未注入，可调高上限或调整优先级',
+        'tag.omitted': '本轮不注入',
+        'tag.truncated': '已截断',
+        'tag.omittedTitle': '因超出注入字数上限，本条当前不会进入系统提示词',
+        'tag.truncatedTitle': '本条过长，仅开头部分进入系统提示词',
         'rules.label': '生效规则',
         'rules.note': '「始终」无条件生效；「按需」由模型按相关性自动判断。超出上限时按优先级保留，其余暂不注入。',
         'search.placeholder': '搜索指令：标题 / 内容 / 适用场景（共 {count} 条）',
@@ -217,6 +230,12 @@ window.__ModuleLoader__.load({
         'budget.unitHint': 'The unit is characters, not tokens',
         'budget.rangeError': 'The limit must be between {min} and {max}',
         'budget.note': 'Characters, not tokens: with DeepSeek tokenization roughly 1 Chinese character ≈ 0.6 token (English ≈ 0.3), the {max}-character ceiling is about {tokens} tokens; actual usage depends on the model.',
+        'budget.used': '{used} of {budget} characters actually injected (≈{tokens} tokens, estimate)',
+        'budget.omitted': '{count} active entries are not injected this turn because the limit is exceeded; raise the limit or adjust priorities',
+        'tag.omitted': 'Not injected',
+        'tag.truncated': 'Truncated',
+        'tag.omittedTitle': 'This entry currently stays out of the system prompt because the injection size limit is exceeded',
+        'tag.truncatedTitle': 'This entry is too long; only its beginning reaches the system prompt',
         'rules.label': 'How instructions apply',
         'rules.note': '“Always” applies unconditionally; “On demand” lets the model judge by relevance. When the limit is exceeded, higher-priority entries are kept and the rest are skipped.',
         'search.placeholder': 'Search instructions: title / content / scenario ({count} in total)',
@@ -485,6 +504,53 @@ window.__ModuleLoader__.load({
       }
     }
 
+    /**
+     * What the budget input should show after a snapshot arrives.
+     *
+     * A push from another window used to reset budgetText unconditionally
+     * inside absorb(), so editing the injection-size field while any other
+     * panel saved wiped the half-typed number. While the input is focused the
+     * user's draft wins; the committed value re-syncs on blur.
+     */
+    function nextBudgetText(currentText, incoming, focused) {
+      return focused ? currentText : String(incoming)
+    }
+
+    /**
+     * Reduce a snapshot's injection plan to the values the header meter and
+     * the entry badges render. Pinned as a pure export so the fallback math is
+     * testable without React.
+     *
+     * Tolerates an older Host whose snapshot predates the plan fields: the
+     * ceiling then falls back to data.budgetChars and there are simply no
+     * per-entry marks (included/omitted). Garbage input degrades to zeros
+     * instead of throwing mid-render.
+     */
+    function budgetMeter(snapshot) {
+      const inj = snapshot !== null && typeof snapshot === 'object'
+        && snapshot.injection !== null && typeof snapshot.injection === 'object'
+        ? snapshot.injection : {}
+      const data = snapshot !== null && typeof snapshot === 'object'
+        && snapshot.data !== null && typeof snapshot.data === 'object'
+        ? snapshot.data : {}
+      const budget = typeof inj.budget === 'number' && inj.budget > 0
+        ? inj.budget
+        : (typeof data.budgetChars === 'number' && data.budgetChars > 0 ? data.budgetChars : 0)
+      const used = typeof inj.chars === 'number' && inj.chars >= 0 ? inj.chars : 0
+      const countFlagged = (list, wantTruncated) =>
+        Array.isArray(list)
+          ? list.filter((item) => item !== null && typeof item === 'object'
+            && typeof item.id === 'string' && item.id !== ''
+            && (wantTruncated ? item.truncated === true : true)).length
+          : 0
+      const omitted = countFlagged(inj.omitted, false)
+      const truncated = countFlagged(inj.included, true)
+      const percent = budget > 0 ? Math.min(100, Math.round((used / budget) * 100)) : 0
+      // The same rough ratio the budget note quotes; displayed as an ESTIMATE.
+      const tokens = Math.round(used * 0.6)
+      return { budget, used, omitted, truncated, percent, tokens }
+    }
+
     async function callHost(method, args) {
       // A hung host used to pin the panel on 保存中… forever; fail visibly
       // after a generous timeout instead.
@@ -613,10 +679,18 @@ window.__ModuleLoader__.load({
       const [busy, setBusy] = React.useState(false)
       const [draft, setDraft] = React.useState(null)
       const [budgetText, setBudgetText] = React.useState('')
+      // Latest live value of the draft, because the SSE onmessage closure below
+      // is created once and must not read a stale first-render budgetText.
+      const budgetTextRef = React.useRef('')
+      budgetTextRef.current = budgetText
       const [showPreview, setShowPreview] = React.useState(false)
       const [query, setQuery] = React.useState('')
       const [undo, setUndo] = React.useState(null)
       const importInputRef = React.useRef(null)
+      // Whether the budget input is being edited right now. A live SSE push
+      // from another window must not replace the number under the cursor;
+      // the ref (not state) is read inside absorb so no re-render is needed.
+      const budgetFocusedRef = React.useRef(false)
       // The latest snapshot this panel has absorbed. The SSE effect runs once
       // (empty deps), so it cannot read the `view` state of a later render —
       // the ref is how its frames are compared against what is on screen.
@@ -668,7 +742,11 @@ window.__ModuleLoader__.load({
         }
         setView(normalized.snapshot)
         viewRef.current = normalized.snapshot
-        setBudgetText(String(normalized.snapshot.data.budgetChars))
+        // Keep the user's in-progress budget edit when a push arrives while
+        // the input is focused; re-sync only once editing is not active. The
+        // ref is the live draft — absorb may run from the SSE closure created
+        // on the first render.
+        setBudgetText(nextBudgetText(budgetTextRef.current, normalized.snapshot.data.budgetChars, budgetFocusedRef.current))
         if (!normalized.ok && normalized.message) {
           setError(normalized.message)
           setNotice('')
@@ -813,6 +891,23 @@ window.__ModuleLoader__.load({
       const injection = view.injection || { registered: false, chars: 0, error: null }
       const entries = data.entries.slice().sort((a, b) => (b.priority - a.priority) || (b.updatedAt - a.updatedAt))
       const activeCount = entries.filter((e) => e.enabled && e.content !== '').length
+      // Budget usage + per-entry marks straight from the Host's injection plan.
+      // Older hosts simply publish none of these fields: the meter falls back
+      // to data.budgetChars and the maps stay empty.
+      const meter = budgetMeter(view)
+      const omittedById = new Map()
+      const truncatedById = new Map()
+      {
+        const planItems = injection && typeof injection === 'object' ? injection : {}
+        for (const item of Array.isArray(planItems.omitted) ? planItems.omitted : []) {
+          if (item !== null && typeof item === 'object' && typeof item.id === 'string') omittedById.set(item.id, item)
+        }
+        for (const item of Array.isArray(planItems.included) ? planItems.included : []) {
+          if (item !== null && typeof item === 'object' && item.truncated === true && typeof item.id === 'string') {
+            truncatedById.set(item.id, item)
+          }
+        }
+      }
       const keyword = query.trim().toLowerCase()
       const visible = keyword === ''
         ? entries
@@ -858,8 +953,11 @@ window.__ModuleLoader__.load({
               value: budgetText,
               disabled: busy,
               title: t('budget.unitHint'),
+              onFocus: () => { budgetFocusedRef.current = true },
               onChange: (ev) => setBudgetText(ev.target.value),
               onBlur: () => {
+                // Editing is over: later pushes may sync the field again.
+                budgetFocusedRef.current = false
                 const parsed = Number(budgetText)
                 if (!Number.isFinite(parsed) || parsed < limits.minBudget || parsed > limits.maxBudget) {
                   setBudgetText(String(data.budgetChars))
@@ -875,6 +973,19 @@ window.__ModuleLoader__.load({
             h('label', { className: 'im-label' }, t('rules.label')),
             h('div', { className: 'im-meta' },
               t('rules.note')))),
+        (data.enabled === true && activeCount > 0)
+          ? h('div', { key: 'meter' },
+            h('div', { className: 'im-meter' },
+              h('div', {
+                className: 'im-meter-fill' + (meter.omitted > 0 ? ' im-meter-fill-warn' : ''),
+                style: { width: meter.percent + '%' },
+              })),
+            h('div', { className: 'im-meta im-meter-line' },
+              t('budget.used', { used: meter.used, budget: meter.budget, tokens: meter.tokens })),
+            meter.omitted > 0
+              ? h('div', { className: 'im-warn im-meter-line' }, t('budget.omitted', { count: meter.omitted }))
+              : null)
+          : null,
         entries.length > 0 ? h('div', { key: 'search' },
           h('input', {
             className: 'im-input',
@@ -960,6 +1071,17 @@ window.__ModuleLoader__.load({
         ]
         if (entry.priority === 2) tags.push(h('span', { className: 'im-tag im-tag-high', key: 'p' }, t('priority.high')))
         else if (entry.priority === 0) tags.push(h('span', { className: 'im-tag', key: 'p' }, t('priority.low')))
+        // Budget marks from the Host's injection plan. Only active entries can
+        // appear in the plans, so a disabled entry never gets a stale mark.
+        if (omittedById.has(entry.id)) {
+          tags.push(h('span', {
+            className: 'im-tag im-tag-off', key: 'off', title: t('tag.omittedTitle'),
+          }, t('tag.omitted')))
+        } else if (truncatedById.has(entry.id)) {
+          tags.push(h('span', {
+            className: 'im-tag im-tag-cut', key: 'cut', title: t('tag.truncatedTitle'),
+          }, t('tag.truncated')))
+        }
         return h('div', {
           className: 'im-item' + (entry.enabled ? '' : ' im-item-off'),
           key: entry.id,
@@ -1108,6 +1230,8 @@ window.__ModuleLoader__.load({
     exports.__sameSnapshot = sameSnapshot
     exports.__confirmDiscard = confirmDiscard
     exports.__importSizeVerdict = importSizeVerdict
+    exports.__nextBudgetText = nextBudgetText
+    exports.__budgetMeter = budgetMeter
     exports.__strings = STRINGS
     exports.__ns = NS
     exports.__dictionaryT = dictionaryT

package/lib/index.js

@@ -10,8 +10,10 @@
  * plugin's fiber, so unmounting the row removes all of them.
  */
 
-import { copyFile, mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
+import { copyFile, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
 import { watch } from 'node:fs'
+import { randomUUID } from 'node:crypto'
+import { isIP } from 'node:net'
 import { homedir } from 'node:os'
 import { basename, dirname, join } from 'node:path'
 
@@ -326,6 +328,13 @@ const LOOPBACK_HOSTNAMES = new Set(['127.0.0.1', 'localhost', '::1', '::ffff:127
  *
  * `127.0.0.1:8080` -> `127.0.0.1`; `[::1]:8080` -> `::1`; `localhost` -> `localhost`.
  * Exported so the parsing itself can be pinned by tests.
+ *
+ * HTTP requires IPv6 literals in Host to wear brackets, so the bracketed
+ * form is the one real traffic uses; the bare form still has to parse instead
+ * of being chopped at the last colon (the old code turned a bare `::1` into
+ * `:`, which never matched the loopback set). A bare value carrying MORE than
+ * one colon is an IPv6 literal with no port — with at most one colon it is
+ * host:port.
  */
 export function hostnameOf(value) {
   if (typeof value !== 'string') return ''
@@ -333,12 +342,100 @@ export function hostnameOf(value) {
   if (trimmed === '') return ''
   if (trimmed.startsWith('[')) {
     const end = trimmed.indexOf(']')
-    return end === -1 ? trimmed : trimmed.slice(1, end)
+    return end === -1 ? trimmed.slice(1) : trimmed.slice(1, end)
   }
+  // Unbracketed IPv6 literal: the colons are part of the address, not a port.
+  if (trimmed.indexOf(':') !== trimmed.lastIndexOf(':')) return trimmed
   const colon = trimmed.lastIndexOf(':')
   return colon === -1 ? trimmed : trimmed.slice(0, colon)
 }
 
+/**
+ * Normalise a hostname the same way on BOTH sides of the Origin comparison.
+ *
+ * `new URL('http://[::1]:8080').hostname` keeps the brackets (`[::1]`), while
+ * `hostnameOf('[::1]:8080')` strips them (`::1`) — comparing the two raw forms
+ * rejected every same-origin request that reached the GUI over IPv6 loopback.
+ * Strip one surrounding pair of brackets here so both sides spell an IPv6
+ * literal identically.
+ */
+const normalizeHostname = (value) => (
+  typeof value === 'string' && value.startsWith('[') && value.endsWith(']') && value.length >= 2
+    ? value.slice(1, -1)
+    : value
+)
+
+/**
+ * Expand an IPv6 literal to eight lower-cased zero-padded groups, translating a
+ * trailing embedded IPv4 suffix to two hex groups. Returns null for anything
+ * that is not a valid literal.
+ *
+ * Needed because the two sides of the Origin check spell the SAME address
+ * differently: a browser sends Host `[::ffff:127.0.0.1]` while the URL parser
+ * canonicalises Origin to `[::ffff:7f00:1]` — text comparison says these are
+ * different; address comparison must say they are the same.
+ */
+export function canonicalIp(value) {
+  if (typeof value !== 'string') return null
+  let addr = normalizeHostname(value.trim().toLowerCase())
+  const percent = addr.indexOf('%')
+  if (percent !== -1) addr = addr.slice(0, percent)
+  if (isIP(addr) === 4) {
+    return 'v4:' + addr.split('.').map((part) => Number(part)).join('.')
+  }
+  if (isIP(addr) !== 6) return null
+
+  // Translate a trailing dotted-quad (e.g. ::ffff:127.0.0.1) into two groups.
+  const v4 = /(\d{1,3}(?:\.\d{1,3}){3})$/i.exec(addr)
+  if (v4 !== null) {
+    const octets = v4[1].split('.').map((part) => Number(part))
+    if (octets.some((octet) => octet > 255)) return null
+    const prefix = addr.slice(0, v4.index)
+    const hi = (octets[0] << 8 | octets[1]).toString(16)
+    const lo = (octets[2] << 8 | octets[3]).toString(16)
+    // Keep the trailing ':' of the prefix as the separator before the two
+    // translated groups; it may also be the second ':' of a '::' compression,
+    // which must survive (so do not strip a leading colon afterwards).
+    addr = (prefix.endsWith(':') ? prefix : prefix + ':') + hi + ':' + lo
+  }
+
+  const halves = addr.split('::')
+  if (halves.length > 2) return null
+  if (halves.length === 1) {
+    const groups = halves[0].split(':')
+    if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group))) return null
+    return groups.map((group) => parseInt(group, 16).toString(16).padStart(4, '0')).join(':')
+  }
+  const [leftRaw, rightRaw] = halves
+  const left = leftRaw === '' ? [] : leftRaw.split(':')
+  const right = rightRaw === '' ? [] : rightRaw.split(':')
+  const missing = 8 - left.length - right.length
+  if (missing < 0) return null
+  const groups = left.concat(Array(missing).fill('0'), right)
+  if (groups.length !== 8 || groups.some((group) => !/^[0-9a-f]{1,4}$/i.test(group))) return null
+  return groups.map((group) => parseInt(group, 16).toString(16).padStart(4, '0')).join(':')
+}
+
+/** Whether two hostnames are the same endpoint: exact text or same IP literal. */
+const sameHostname = (a, b) => {
+  if (a === b) return true
+  const ca = canonicalIp(a)
+  const cb = canonicalIp(b)
+  return ca !== null && cb !== null && ca === cb
+}
+
+/** Loopback by exact name or by equivalent IP spelling (mapped/hex forms). */
+const isLoopbackName = (name) => {
+  if (LOOPBACK_HOSTNAMES.has(name)) return true
+  const canonical = canonicalIp(name)
+  if (canonical === null) return false
+  for (const known of LOOPBACK_HOSTNAMES) {
+    const knownCanonical = canonicalIp(known)
+    if (knownCanonical !== null && knownCanonical === canonical) return true
+  }
+  return false
+}
+
 /**
  * Why the settings-page route checks `Host`, `Origin` and `Sec-Fetch-Site` at
  * all, when it already refuses any content-type that is not
@@ -380,7 +477,7 @@ export function requestOriginVerdict(headers, guarded) {
   const requestHost = read('host').trim().toLowerCase()
   const requestHostname = hostnameOf(requestHost)
 
-  if (guarded && !LOOPBACK_HOSTNAMES.has(requestHostname)) {
+  if (guarded && !isLoopbackName(requestHostname)) {
     return { ok: false, reason: 'Host 头不是回环地址（可能是 DNS 重绑定攻击）：' + (requestHost === '' ? '(缺失)' : requestHost) }
   }
 
@@ -393,14 +490,19 @@ export function requestOriginVerdict(headers, guarded) {
   if (origin !== '') {
     let originHostname = ''
     try {
-      originHostname = new URL(origin).hostname.toLowerCase()
+      // URL.hostname keeps the brackets on an IPv6 literal; normalizeHostname
+      // takes them off so it can meet the bracket-free Host parsing on equal
+      // terms.
+      originHostname = normalizeHostname(new URL(origin).hostname.toLowerCase())
     } catch {
       originHostname = ''
     }
     // Compare hostnames, not host:port: a proxy may rewrite the port, and the
     // hostname is the part rebinding actually attacks. `Origin: null`
     // (sandboxed iframe, file://) parses to no hostname and is refused.
-    if (originHostname === '' || originHostname !== requestHostname) {
+    // Canonical IP comparison covers the two spellings of one address:
+    // ::1 vs [::1], and ::ffff:127.0.0.1 vs ::ffff:7f00:1.
+    if (originHostname === '' || !sameHostname(originHostname, requestHostname)) {
       return { ok: false, reason: 'Origin 与 Host 不同源：' + origin }
     }
   }
@@ -416,19 +518,41 @@ function formatEntry(entry, tag) {
 }
 
 /**
- * Render the injected block. Deliberately deterministic: identical memory
- * produces byte-identical text on every step, so the prompt prefix stays
- * cacheable across a session.
+ * Build the injection plan: the exact text assembled into the system prompt
+ * PLUS the per-entry decisions behind it, so the settings page can show how
+ * much of the character budget is in use and flag the enabled entries the
+ * current budget leaves out.
+ *
+ * Deliberately deterministic: identical memory produces a byte-identical
+ * plan on every step, so the prompt prefix stays cacheable across a session.
+ *
+ * Returned shape:
+ *   {
+ *     text:        string  — exactly what buildBlock() returns
+ *     budget:      number  — the clamped budgetChars in effect
+ *     activeCount: number  — enabled, non-blank candidates considered
+ *     included:    [{ id, chars, truncated }] — entries that reach the prompt,
+ *                    in consideration order (始终 first, then 按需; within
+ *                    each, priority desc then updatedAt desc); chars is the
+ *                    rendered length of that entry's block (its cut length
+ *                    when truncated)
+ *     omitted:     [{ id, chars }] — active entries the budget could not fit;
+ *                    chars is the full rendered block length they would need
+ *   }
+ *
+ * Disabled or blank entries are candidates for neither list: they are not
+ * competing for the budget at all. When nothing renders, `text` is '' and
+ * `included` is [] even though `budget` still reports the effective ceiling.
  */
-export function buildBlock(data) {
-  if (data === null || typeof data !== 'object' || data.enabled !== true) return ''
+export function planInjection(data) {
+  const budget = clampBudget(data !== null && typeof data === 'object' ? data.budgetChars : undefined)
+  const blank = () => ({ text: '', budget, activeCount: 0, included: [], omitted: [] })
+  if (data === null || typeof data !== 'object' || data.enabled !== true) return blank()
   const active = (Array.isArray(data.entries) ? data.entries : [])
     .filter((entry) => entry.enabled === true && entry.content !== '')
-  if (active.length === 0) return ''
+  if (active.length === 0) return blank()
   active.sort((a, b) => (b.priority - a.priority) || (b.updatedAt - a.updatedAt))
 
-  const budget = clampBudget(data.budgetChars)
-
   // Richest preamble that still leaves room for one real entry plus the
   // worst-case omission footer. A tight budget degrades the preamble instead of
   // silently injecting nothing.
@@ -463,6 +587,8 @@ export function buildBlock(data) {
   }
 
   const blocks = []
+  const included = []
+  const omittedPlan = []
   let used = header.length
   let omitted = 0
 
@@ -474,6 +600,7 @@ export function buildBlock(data) {
     if (used + block.length + 2 + reserve <= budget) {
       used += block.length + 2
       blocks.push(block)
+      included.push({ id: entry.id, chars: block.length, truncated: false })
       return
     }
     // The first entry always gets in, truncated if the budget demands it: a
@@ -491,17 +618,36 @@ export function buildBlock(data) {
         const body = head + note
         blocks.push(body)
         used += body.length + 2
+        included.push({ id: entry.id, chars: body.length, truncated: true })
         return
       }
     }
     omitted += 1
+    omittedPlan.push({ id: entry.id, chars: block.length })
   }
 
   for (const entry of active) if (entry.mode === 'always') consider(entry, '始终')
   for (const entry of active) if (entry.mode !== 'always') consider(entry, '按需')
 
-  if (blocks.length === 0) return ''
-  return header + blocks.join('\n\n') + footerFor(omitted)
+  if (blocks.length === 0) {
+    return { text: '', budget, activeCount: active.length, included: [], omitted: omittedPlan }
+  }
+  return {
+    text: header + blocks.join('\n\n') + footerFor(omitted),
+    budget,
+    activeCount: active.length,
+    included,
+    omitted: omittedPlan,
+  }
+}
+
+/**
+ * Render the injected block text. A thin wrapper over planInjection: the
+ * decision process lives in one place, and callers that only need the text
+ * (the prompt section) keep this byte-stable entry point.
+ */
+export function buildBlock(data) {
+  return planInjection(data).text
 }
 
 /* ------------------------------------------------------------------ *
@@ -623,6 +769,22 @@ export function apply(ctx) {
     }
   }
 
+  /**
+   * The full injection plan (text + per-entry budget decisions) behind the
+   * registered section. The snapshot publishes it so the settings page can
+   * show budget usage and mark the enabled entries that currently do not fit.
+   * A render failure degrades to an empty plan at the effective ceiling
+   * rather than throwing into the route/SSE path.
+   */
+  const sectionPlan = () => {
+    try {
+      return planInjection(state.data)
+    } catch (err) {
+      console.error('[instruction-memory] render failed:', err)
+      return { text: '', budget: clampBudget(state.data.budgetChars), activeCount: 0, included: [], omitted: [] }
+    }
+  }
+
   /**
    * The thunk handed to the harness.
    *
@@ -692,23 +854,25 @@ export function apply(ctx) {
   /* ---------------- external-change watching (SSE) ---------------- */
 
   /**
-   * Live subscribers to the settings page's event stream. Each entry is the
-   * `send(payload)` writer for one open response.
+   * Live subscribers to the settings page's event stream. Each entry maps a
+   * stream's `send(payload)` writer to its own teardown, so a write that fails
+   * (the socket went away) can dispose THAT stream instead of just dropping
+   * it from the broadcast set while its response stays open.
    */
-  const sseClients = new Set()
-  /** Per-connection teardown, so unmounting the plugin can end every stream. */
-  const sseCleanups = new Set()
+  const sseStreams = new Map()
   let storeWatcher = null
   let watchDebounce = null
 
   const pushSnapshot = () => {
-    if (sseClients.size === 0) return
+    if (sseStreams.size === 0) return
     const payload = 'data: ' + JSON.stringify(snapshot()) + '\n\n'
-    for (const send of Array.from(sseClients)) {
+    for (const [send, cleanup] of Array.from(sseStreams)) {
       try {
         send(payload)
       } catch {
-        sseClients.delete(send)
+        // The response is dead: run its full teardown (end + unsubscribe),
+        // not just a set delete that leaves the stream half-registered.
+        cleanup()
       }
     }
   }
@@ -788,15 +952,14 @@ export function apply(ctx) {
   }
 
   const disposeStreams = () => {
-    for (const cleanup of Array.from(sseCleanups)) {
+    for (const cleanup of Array.from(sseStreams.values())) {
       try {
         cleanup()
       } catch {
         // The response is already gone.
       }
     }
-    sseCleanups.clear()
-    sseClients.clear()
+    sseStreams.clear()
   }
 
   /* ---------------- storage ---------------- */
@@ -807,7 +970,8 @@ export function apply(ctx) {
 
   /**
    * Cross-process write lock: a `memory.json.lock` marker created exclusively
-   * (`wx`), held for the duration of one atomic replace, then removed.
+   * (`wx`) holding a random owner token, kept for the duration of one atomic
+   * replace, and removed afterwards ONLY BY ITS OWNER.
    *
    * The in-process diskQueue serialises this plugin's own writes, but two DSH
    * processes sharing a `$DSH_HOME` (e.g. `web` and `tui` profiles running at
@@ -821,19 +985,32 @@ export function apply(ctx) {
    * write proceeds anyway (disclosed in the debug log). A lock older than
    * LOCK_STALE_MS is treated as crashed-holder debris and stolen, so a killed
    * process cannot wedge every later save behind a stale marker.
+   *
+   * The token matters: stealing used to be a plain unlink, and the slow
+   * holder's `finally` then unlinked the lock the NEW owner had just created —
+   * a classic TOCTOU that silently unlocked the third writer. The marker
+   * carries this attempt's UUID, and release deletes it only when the file
+   * still carries that UUID, so a finished holder can never remove a lock it
+   * no longer owns.
+   *
+   * @returns `{ path, token }` while held, or `null` when the wait elapsed
+   * (the save proceeds unlocked by design).
    */
   const acquireStoreLock = async () => {
     const lockPath = storePath + '.lock'
+    const token = randomUUID()
     const deadline = Date.now() + LOCK_WAIT_MS
     for (;;) {
       try {
-        const handle = await open(lockPath, 'wx')
-        await handle.close()
-        return lockPath
+        await writeFile(lockPath, token, { flag: 'wx' })
+        return { path: lockPath, token }
       } catch (err) {
         if (err.code !== 'EEXIST') throw err
         const info = await stat(lockPath).catch(() => null)
         if (info !== null && Date.now() - info.mtimeMs > LOCK_STALE_MS) {
+          // Crashed-holder debris. It may be recreated by a live process
+          // between this unlink and the next wx attempt — that case simply
+          // loops and re-evaluates freshness instead of forcing its way in.
           await unlink(lockPath).catch(() => {})
           continue
         }
@@ -843,6 +1020,21 @@ export function apply(ctx) {
     }
   }
 
+  /**
+   * Release a lock only when THIS attempt still owns it. Reading the marker
+   * back and comparing the token closes the window in which a finished slow
+   * holder deleted a lock the next owner had already taken over.
+   */
+  const releaseStoreLock = async (lock) => {
+    if (lock === null) return
+    try {
+      const owner = await readFile(lock.path, 'utf8').catch(() => null)
+      if (owner === lock.token) await unlink(lock.path).catch(() => {})
+    } catch {
+      // Cleanup must never throw into the save's finally.
+    }
+  }
+
   const writeToDisk = async () => {
     // Atomic replace (write a sibling temp file, then rename) with a rolling
     // one-version backup: a crash mid-write must never leave a truncated
@@ -859,12 +1051,12 @@ export function apply(ctx) {
     // any step leaves the previous store readable at its own path.
     const tmpPath = storePath + '.tmp'
     const bakPath = storePath + '.bak'
-    let lockPath = null
+    let lock = null
     let previousRev = null
     try {
       await mkdir(dirname(storePath), { recursive: true })
-      lockPath = await acquireStoreLock()
-      if (lockPath === null) {
+      lock = await acquireStoreLock()
+      if (lock === null) {
         logDebug('store lock still held by another process; writing anyway (last write wins)')
       }
       // The rev is bumped before serialising so the file on disk and the state
@@ -912,7 +1104,7 @@ export function apply(ctx) {
       state.storageError = '保存失败：' + describeError(err)
       return false
     } finally {
-      if (lockPath !== null) await unlink(lockPath).catch(() => {})
+      await releaseStoreLock(lock)
     }
   }
 
@@ -1104,11 +1296,19 @@ export function apply(ctx) {
   // Load the store, then register the section if anything must be injected.
   // Every entry point awaits this, so a request that arrives before the disk
   // read settles can never overwrite the file with an empty in-memory state.
+  //
+  // `bootSettled` flips only after the read lands. The SSE connect frame is
+  // gated on it: a stream opened in the gap between apply() and the read
+  // finishing must wait, or its first frame would describe the EMPTY boot
+  // state and the panel would flash "no instructions" before the real
+  // snapshot arrived (POST /state already awaited boot; the stream did not).
+  let bootSettled = false
   const boot = readFromDisk()
     .catch((err) => {
       state.storageError = '读取失败：' + describeError(err)
     })
     .then(() => {
+      bootSettled = true
       syncSection()
       // The one always-on line: it answers "is memory mounted, where does it
       // live, and how much is being injected?" without any further digging.
@@ -1147,7 +1347,8 @@ export function apply(ctx) {
   /* ---------------- snapshots ---------------- */
 
   const snapshot = () => {
-    const preview = sectionText()
+    const plan = sectionPlan()
+    const preview = plan.text
     return {
       data: {
         version: 1,
@@ -1170,6 +1371,16 @@ export function apply(ctx) {
         available: true,
         error: state.sectionError,
         chars: preview.length,
+        /**
+         * The budget decision behind `preview`, for the settings page's
+         * usage meter and per-entry marks. `budget` is the effective ceiling;
+         * `included`/`omitted` carry one item per active entry in
+         * consideration order; disabled or blank entries appear in neither.
+         */
+        budget: plan.budget,
+        activeCount: plan.activeCount,
+        included: plan.included.map((item) => ({ id: item.id, chars: item.chars, truncated: item.truncated === true })),
+        omitted: plan.omitted.map((item) => ({ id: item.id, chars: item.chars })),
         /**
          * How many times the harness has pulled this section into a prompt since
          * boot. 0 means "prepared, never assembled" — the distinction the old
@@ -1301,6 +1512,13 @@ export function apply(ctx) {
   const deleteEntry = (id, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
+    // Deleting an id that is not there changes nothing, so it must not touch
+    // disk, bump rev, or push an echo frame — otherwise two panels deleting
+    // the same entry one after another would manufacture a pointless write
+    // (and an external process watching the file would wake for nothing).
+    if (!state.data.entries.some((entry) => entry.id === id)) {
+      return { ok: true, saved: false, message: null, snapshot: snapshot() }
+    }
     const saved = await commit(() => {
       state.data.entries = state.data.entries.filter((entry) => entry.id !== id)
     })
@@ -1487,23 +1705,38 @@ export function apply(ctx) {
     // restarted) instead of hammering the route.
     res.write('retry: 5000\n\n')
     const send = (payload) => { res.write(payload) }
-    sseClients.add(send)
-    // A snapshot on connect, so a late subscriber synchronises immediately
-    // instead of waiting for the next change.
-    send('data: ' + JSON.stringify(snapshot()) + '\n\n')
+    let closed = false
     const cleanup = () => {
-      sseClients.delete(send)
-      sseCleanups.delete(cleanup)
+      closed = true
+      sseStreams.delete(send)
       try {
         res.end()
       } catch {
         // The response is already gone.
       }
     }
-    sseCleanups.add(cleanup)
+    sseStreams.set(send, cleanup)
     req.on('close', cleanup)
     req.on('error', cleanup)
     res.on('error', cleanup)
+    // A snapshot on connect, so a late subscriber synchronises immediately
+    // instead of waiting for the next change. It must wait for boot: a stream
+    // opened while the initial disk read is still in flight would otherwise be
+    // handed the empty boot state as its first frame, flashing "no
+    // instructions" before the loaded store arrives.
+    const sendConnectFrame = () => {
+      if (closed) return
+      try {
+        send('data: ' + JSON.stringify(snapshot()) + '\n\n')
+      } catch {
+        cleanup()
+      }
+    }
+    if (bootSettled) {
+      sendConnectFrame()
+    } else {
+      boot.then(sendConnectFrame, sendConnectFrame)
+    }
   }
 
   const handler = (req, res) => {
@@ -1613,7 +1846,7 @@ export function apply(ctx) {
     // disabled for all non-loopback binds and the trade-off is documented in
     // the README.
     const boundHost = typeof webServer.host === 'string' ? webServer.host.trim().toLowerCase() : ''
-    guardHost = boundHost === '' || LOOPBACK_HOSTNAMES.has(boundHost)
+    guardHost = boundHost === '' || isLoopbackName(boundHost)
     try {
       routeDispose = webServer.register({ kind: 'prefix', path: API_PREFIX, handler })
       logDebug('settings route registered at ' + API_PREFIX + ' (boundHost=' + boundHost + ', hostGuard=' + guardHost + ')')

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.0.15",
+  "version": "1.0.17",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",
@@ -49,7 +49,7 @@
     "node": ">=20"
   },
   "peerDependencies": {
-    "@deepseek-ai/dsh-system-prompt": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0"
+    "@deepseek-ai/dsh-system-prompt": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0"
   },
   "publishConfig": {
     "access": "public"
@@ -72,10 +72,10 @@
       "platform": "web"
     },
     "engines": {
-      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0"
+      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0"
     },
     "compatibility": {
-      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.0-0"
+      "dsh": ">=0.1.3-alpha.2 <0.1.4 || >=0.1.4-0 <0.1.5-0 || >=0.1.5-alpha.1 <0.1.6-0 || >=0.1.6-alpha.0 <0.1.7-0 || >=0.1.7-alpha.0 <0.2.0-0 || >=0.2.1-alpha.0 <0.3.0-0 || >=0.2.0-0"
     }
   }
 }