dsh-instruction-memory 1.1.0 → 1.3.0

package/lib/index.js

@@ -8,14 +8,30 @@
  *
  * Lifecycle: every side effect (prompt section, web route) belongs to this
  * plugin's fiber, so unmounting the row removes all of them.
+ *
+ * Storage format v2 (F13 多情境配置集 / instruction sets): the file holds a
+ * named `sets` list plus one flat `entries`/`profiles` array where every item
+ * carries a `setId`; `activeSetId` names the one set that is injected. A v1
+ * file (no `sets` field) loads transparently — every item is folded into the
+ * single 默认 set — and is rewritten as v2 by the next save. Switching the
+ * active set is ALWAYS an explicit user command; nothing here ever derives a
+ * set from the process cwd (a real incident: a cwd-derived store location made
+ * memory appear to vanish when the user relaunched from another directory).
+ *
+ * Also in v2: timestamped history snapshots (F14) written into a `history/`
+ * subdirectory — deliberately NOT into the watched store directory entry that
+ * `fs.watch` listens on — a JSON Schema shipped for hand editing (F15), a raw
+ * source read/write pair for the settings page (F16), and an optional
+ * user-chosen backup directory (F18).
  */
 
-import { copyFile, mkdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
+import { copyFile, mkdir, readdir, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
 import { watch } from 'node:fs'
 import { randomUUID } from 'node:crypto'
 import { isIP } from 'node:net'
-import { homedir } from 'node:os'
-import { basename, dirname, join } from 'node:path'
+import { homedir, hostname } from 'node:os'
+import { basename, dirname, isAbsolute, join } from 'node:path'
+import { fileURLToPath } from 'node:url'
 
 export const name = 'instruction-memory'
 
@@ -48,6 +64,40 @@ const STORE_FILE_NAME = 'memory.json'
 /** Pre-release location, kept only so existing installs can migrate off it. */
 const LEGACY_FILE_NAME = '.dsh-instruction-memory.json'
 const SECTION_NAME = 'instruction-memory'
+/**
+ * The store format this build writes.
+ *
+ * v2 introduced named instruction sets (F13). The bump is not cosmetic: an
+ * OLDER build of this plugin reads `version` and refuses anything that is not
+ * 1, so a downgrade meets an explicit "unsupported version" refusal with
+ * mutations paused instead of silently loading a v2 file as a v1 one (which
+ * would hide every set name and, on the next save, rewrite the file without
+ * them). v1 files keep loading here — every entry is folded into the single
+ * 默认 set — and the next save writes v2.
+ */
+const FORMAT_VERSION = 2
+const SUPPORTED_VERSIONS = [1, 2]
+/** The id/name of the set a fresh or migrated store gets. Stable on purpose. */
+const DEFAULT_SET_ID = 'st-default'
+const DEFAULT_SET_NAME = '默认'
+const MAX_SETS = 20
+const MAX_SET_NAME = 30
+/** Rolling history snapshots (F14): how many are kept PER writing device. */
+const MAX_HISTORY = 20
+/**
+ * F7: the longest single pause. Doubles as the setTimeout guard — 7 days is
+ * far below the 2^31-1 ms (≈24.8 days) timer ceiling, so the delay never
+ * overflows Node's timer range.
+ */
+const MAX_MUTE_MS = 7 * 24 * 60 * 60 * 1000
+const HISTORY_DIR_NAME = 'history'
+/** Name of the JSON Schema shipped with the package and copied next to the store. */
+const SCHEMA_FILE_NAME = 'memory.schema.json'
+/** The `$schema` value written into every store file (resolves next to it). */
+const SCHEMA_REF = './' + SCHEMA_FILE_NAME
+/** Upper bound for a user-chosen backup directory path. */
+const MAX_BACKUP_DIR = 512
+const BACKUP_FILE_SUFFIX = '.bak'
 /**
  * Placement of the injected instruction block among the system prompt's
  * ordered sections. Sections are concatenated ascending; equal orders fall
@@ -128,7 +178,33 @@ const BATCH_OPS = ['set-enabled', 'set-priority', 'add-tags', 'remove-tags', 'de
  * wrapper.
  */
 export const MAX_BODY_CHARS = (MAX_ENTRIES * (MAX_CONTENT + MAX_TITLE + MAX_WHEN + MAX_TAGS_PER_ENTRY * MAX_TAG_LENGTH + 200)
-  + MAX_PROFILES * (MAX_PROFILE_CONTENT + MAX_PROFILE_NAME + 200)) * 2 + 100_000
+  + MAX_PROFILES * (MAX_PROFILE_CONTENT + MAX_PROFILE_NAME + 200)
+  + MAX_SETS * (MAX_SET_NAME + 200)) * 2 + 100_000
+
+/**
+ * Every numeric ceiling in one object, published on the snapshot and used by
+ * verify.mjs to pin `memory.schema.json` (the hand-edit JSON Schema) to the
+ * code. Two sources of truth that must never drift: a schema advertising a
+ * larger limit than the loader enforces would let a hand edit be silently
+ * truncated while the IDE reported it as valid.
+ */
+export const LIMITS = Object.freeze({
+  formatVersion: FORMAT_VERSION,
+  maxEntries: MAX_ENTRIES,
+  maxTitle: MAX_TITLE,
+  maxContent: MAX_CONTENT,
+  maxWhen: MAX_WHEN,
+  maxTagsPerEntry: MAX_TAGS_PER_ENTRY,
+  maxTagLength: MAX_TAG_LENGTH,
+  maxProfiles: MAX_PROFILES,
+  maxProfileName: MAX_PROFILE_NAME,
+  maxProfileContent: MAX_PROFILE_CONTENT,
+  maxSets: MAX_SETS,
+  maxSetName: MAX_SET_NAME,
+  minBudget: MIN_BUDGET,
+  maxBudget: MAX_BUDGET,
+  maxHistory: MAX_HISTORY,
+})
 
 /** How long a crashed holder's `memory.json.lock` may block writes before it is stolen. */
 const LOCK_STALE_MS = 10_000
@@ -174,6 +250,10 @@ function makeId() {
   return 'im-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 8)
 }
 
+function makeSetId() {
+  return 'st-' + Date.now().toString(36) + '-' + Math.random().toString(36).slice(2, 8)
+}
+
 function priorityLabel(value) {
   if (value === 2) return '高'
   if (value === 0) return '低'
@@ -222,10 +302,40 @@ export function sanitizeEntry(raw) {
     priority: raw.priority === 2 || raw.priority === 0 ? raw.priority : 1,
     enabled: raw.enabled !== false,
     tags: sanitizeTags(raw.tags),
+    /**
+     * Which instruction set (F13) this entry belongs to. Preserved here — NOT
+     * re-derived — because both the loader and the importer need to honour a
+     * declared membership; the interactive save path overwrites it with the
+     * active set instead (an edit can never move an entry between sets).
+     * `normalizeData` guarantees a valid value on everything this plugin
+     * serves, so a blank/absent id on a hand-built object means "unattributed"
+     * (see inScope), not "no set".
+     */
+    setId: typeof raw.setId === 'string' && raw.setId !== '' ? raw.setId.slice(0, 64) : '',
     updatedAt: typeof raw.updatedAt === 'number' && Number.isFinite(raw.updatedAt) ? raw.updatedAt : Date.now(),
   }
 }
 
+/**
+ * Normalise one instruction set (F13).
+ *
+ * Shape: { id, name }. A set carries no content of its own — entries and
+ * user profiles point AT it through `setId` — so "switching the active set"
+ * never moves a byte of user text, which is what makes the operation safe to
+ * perform in one transaction. `id` is stable (it is what every item stores);
+ * `name` is a short single-line label. A blank name is rejected (null): unlike
+ * an entry, a set has nothing else to derive a label from.
+ */
+export function sanitizeSet(raw) {
+  if (raw === null || typeof raw !== 'object') return null
+  const name = singleLine(raw.name, MAX_SET_NAME)
+  if (name === '') return null
+  return {
+    id: typeof raw.id === 'string' && raw.id !== '' ? raw.id.slice(0, 64) : makeSetId(),
+    name,
+  }
+}
+
 /**
  * Normalise one "用户形象" (a fact about the USER, not a role for the model).
  *
@@ -246,10 +356,124 @@ export function sanitizeProfile(raw) {
     name: name === '' ? singleLine(content, 20) : name,
     content,
     enabled: raw.enabled !== false,
+    /** Instruction set membership (F13); see the note in sanitizeEntry. */
+    setId: typeof raw.setId === 'string' && raw.setId !== '' ? raw.setId.slice(0, 64) : '',
     updatedAt: typeof raw.updatedAt === 'number' && Number.isFinite(raw.updatedAt) ? raw.updatedAt : Date.now(),
   }
 }
 
+/**
+ * The scope decision behind everything that renders or lists items: with a
+ * usable `sets` list plus a matching `activeSetId`, only the active set is in
+ * scope; without them the store is the legacy single-set shape and everything
+ * is in scope.
+ *
+ * Exported because THREE places must never disagree — the injection planner,
+ * the snapshot the settings page renders, and the commands that edit — and a
+ * missed filter here is exactly how a 某客户 set would leak into a 个人
+ * conversation. One predicate, used three times.
+ *
+ * The fallback when `activeSetId` names nothing (a hand-edited file): the
+ * FIRST set, which is also what normalizeData adopts. That keeps a pure
+ * consumer (planInjection called directly, as the tests do) in agreement with
+ * the loader instead of inventing a third behaviour.
+ */
+export function activeScope(data) {
+  if (data === null || typeof data !== 'object') return { scoped: false, activeId: '', ids: [] }
+  const sets = (Array.isArray(data.sets) ? data.sets : [])
+    .filter((set) => set !== null && typeof set === 'object' && typeof set.id === 'string' && set.id !== '')
+  if (sets.length === 0) return { scoped: false, activeId: '', ids: [] }
+  const wanted = typeof data.activeSetId === 'string' && data.activeSetId !== '' ? data.activeSetId : ''
+  const activeId = sets.some((set) => set.id === wanted) ? wanted : sets[0].id
+  return { scoped: true, activeId, ids: sets.map((set) => set.id) }
+}
+
+/**
+ * Whether one entry/profile takes part under a scope from activeScope().
+ * An item with no `setId` counts as belonging to the active set, mirroring
+ * the loader's stamping rule — an unattributed item must follow the user's
+ * current context rather than disappear from both the list and the prompt.
+ * The comparison is exact and case-sensitive: set ids are minted here.
+ */
+export function inScope(item, scope) {
+  if (scope === null || typeof scope !== 'object' || scope.scoped !== true) return true
+  const id = item !== null && typeof item === 'object' && typeof item.setId === 'string' ? item.setId : ''
+  return id === '' || id === scope.activeId
+}
+
+/* ------------------------------------------------------------------ *
+ * History snapshot naming (F14) — pure, so the format is pinnable
+ * ------------------------------------------------------------------ */
+
+/**
+ * A filesystem-safe UTC stamp: `20261015T072355123Z`. Fixed width, so plain
+ * lexicographic sorting on a filename is chronological sorting — which is what
+ * lets the history index sort without reading a single file.
+ */
+export function historyStamp(epoch) {
+  const date = new Date(epoch)
+  const pad = (value, width) => String(value).padStart(width, '0')
+  return pad(date.getUTCFullYear(), 4) + pad(date.getUTCMonth() + 1, 2) + pad(date.getUTCDate(), 2)
+    + 'T' + pad(date.getUTCHours(), 2) + pad(date.getUTCMinutes(), 2) + pad(date.getUTCSeconds(), 2)
+    + pad(date.getUTCMilliseconds(), 3) + 'Z'
+}
+
+/** This machine's short tag, used so two devices sharing one backup folder stay distinguishable. */
+export function deviceTag(rawHostname) {
+  const source = typeof rawHostname === 'string' && rawHostname !== '' ? rawHostname : 'unknown'
+  const tag = source.toLowerCase().replace(/[^a-z0-9_]+/g, '_').replace(/^_+|_+$/g, '').slice(0, 16)
+  return tag === '' ? 'unknown' : tag
+}
+
+/**
+ * `20261015T072355123Z-r12-laptop.json` — stamp, revision, writing device.
+ * The revision is IN the name so a snapshot is identifiable in a plain file
+ * listing, and the device tag is sanitised to `[a-z0-9_]` so it can never be
+ * confused with the separators.
+ */
+export function historyFileName(epoch, rev, device) {
+  return historyStamp(epoch) + '-r' + (Number.isFinite(rev) ? rev : 0) + '-' + device + '.json'
+}
+
+/**
+ * What counts as one of OUR snapshots, and what we are therefore allowed to
+ * prune or delete. Anything else in the history directory — a hand-made file,
+ * another tool's backup, a cloud client's conflict copy — fails this pattern
+ * and is left strictly alone.
+ */
+export const HISTORY_FILE_PATTERN = /^\d{8}T\d{9}Z-r\d+-[a-z0-9_]+(?:\.json)$/
+
+/** The device tag inside a snapshot name, or '' when the name is not ours. */
+export function historyDeviceOf(name) {
+  if (typeof name !== 'string') return ''
+  const match = /-r\d+-([a-z0-9_]+)\.json$/.exec(name)
+  return match === null ? '' : match[1]
+}
+
+/** The revision inside a snapshot name, or 0 when the name is not ours. */
+export function historyRevOf(name) {
+  if (typeof name !== 'string') return 0
+  const match = /-r(\d+)-[a-z0-9_]+\.json$/.exec(name)
+  return match === null ? 0 : Number(match[1])
+}
+
+/** The epoch (ms) from a snapshot name's UTC stamp, or 0 when it is not ours. */
+export function historyEpochOf(name) {
+  if (typeof name !== 'string') return 0
+  const match = /^(\d{4})(\d{2})(\d{2})T(\d{2})(\d{2})(\d{2})(\d{3})Z-r/.exec(name)
+  if (match === null) return 0
+  return Date.UTC(
+    Number(match[1]), Number(match[2]) - 1, Number(match[3]),
+    Number(match[4]), Number(match[5]), Number(match[6]), Number(match[7]),
+  )
+}
+
+/** Exported for the settings page: the stamp a manual export file carries. */
+export function exportFileName(epoch) {
+  const stamp = historyStamp(epoch)
+  return 'dsh-instruction-memory-' + stamp.slice(0, 8) + '-' + stamp.slice(9, 15) + 'Z.json'
+}
+
 /**
  * Which fields of a raw entry had to be cut to fit the stored limits.
  *
@@ -282,6 +506,15 @@ export function truncatedProfileFields(raw) {
   return cut
 }
 
+/** Same disclosure, for an instruction set's name. */
+export function truncatedSetFields(raw) {
+  if (raw === null || typeof raw !== 'object') return []
+  const unlimited = Number.MAX_SAFE_INTEGER
+  return typeof raw.name === 'string' && singleLine(raw.name, unlimited) !== singleLine(raw.name, MAX_SET_NAME)
+    ? ['配置集名称']
+    : []
+}
+
 /** JSON.stringify keeps quotes/type visible; the String() tail is for values JSON cannot encode. */
 const describeValue = (value) => {
   const text = JSON.stringify(value)
@@ -300,24 +533,43 @@ const describeValue = (value) => {
  * snapshot (another window, another process) can be refused instead of
  * silently overwriting it. Missing (pre-rev files) reads as 0.
  *
- * A numeric `version` other than 1 sets `rejectedVersion` and leaves the data
- * untouched: a future format's fields cannot be best-effort parsed as v1, and
- * adopting a misread would let the next save rewrite the file in the wrong
- * shape. A MISSING version still loads as v1 — the field has been written as
- * 1 since the first release, so absence is an old/hand-made file, not a
- * foreign format.
+ * Format versions: 1 and 2 both load; anything else numeric sets
+ * `rejectedVersion` and leaves the data untouched — a future format's fields
+ * cannot be best-effort parsed, and adopting a misread would let the next save
+ * rewrite the file in the wrong shape. A MISSING version still loads as v1 —
+ * the field has been written as 1 since the first release, so absence is an
+ * old/hand-made file, not a foreign format.
+ *
+ * v1 → v2 (F13) is fully automatic and never loses an item: with no usable
+ * `sets` list the store gets one 默认 set, and every entry/profile is stamped
+ * with its id. Items already naming a set that does not exist are re-attributed
+ * to the active set and COUNTED (`reattributed`), because that is a hand edit
+ * this loader had to overrule and the user must be told.
  *
  * `optionFixes` lists options the file carried but the loader had to correct
- * (a non-boolean `enabled`, an out-of-range or non-numeric `budgetChars`).
- * Each is a human-readable "field 原值 → 修正值 (原因)" string, surfaced the
- * same way as `dropped`: the next save persists the corrected values, so the
- * user must be told their hand edit did not survive verbatim.
+ * (a non-boolean `enabled`, an out-of-range or non-numeric `budgetChars`, a
+ * non-string/over-long `backupDir`, an `activeSetId` naming no set). Each is a
+ * human-readable "field 原值 → 修正值 (原因)" string, surfaced the same way as
+ * `dropped`: the next save persists the corrected values, so the user must be
+ * told their hand edit did not survive verbatim.
  */
 function normalizeData(raw) {
-  const data = { version: 1, rev: 0, enabled: true, budgetChars: DEFAULT_BUDGET, entries: [], profiles: [] }
-  if (raw === null || typeof raw !== 'object') return { data, dropped: 0, optionFixes: [] }
-  if (typeof raw.version === 'number' && raw.version !== 1) {
-    return { data, dropped: 0, optionFixes: [], rejectedVersion: raw.version }
+  const data = {
+    version: FORMAT_VERSION,
+    rev: 0,
+    enabled: true,
+    disabledUntil: 0,
+    budgetChars: DEFAULT_BUDGET,
+    backupDir: '',
+    activeSetId: DEFAULT_SET_ID,
+    sets: [],
+    entries: [],
+    profiles: [],
+  }
+  const loaded = { data, dropped: 0, droppedProfiles: 0, droppedSets: 0, reattributed: 0, optionFixes: [], formatNote: null }
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) return loaded
+  if (typeof raw.version === 'number' && !SUPPORTED_VERSIONS.includes(raw.version)) {
+    return { data, dropped: 0, droppedProfiles: 0, droppedSets: 0, reattributed: 0, optionFixes: [], rejectedVersion: raw.version }
   }
   if (typeof raw.rev === 'number' && Number.isFinite(raw.rev) && raw.rev >= 0) {
     data.rev = Math.round(raw.rev)
@@ -325,7 +577,7 @@ function normalizeData(raw) {
   // Hand-edited options the loader has to correct are disclosed, not silently
   // adopted: the next save would otherwise rewrite the file with the fixed
   // values and the user would never learn their edit had been ignored.
-  const optionFixes = []
+  const optionFixes = loaded.optionFixes
   if (typeof raw.enabled === 'boolean') {
     data.enabled = raw.enabled
   } else if ('enabled' in raw) {
@@ -340,21 +592,99 @@ function normalizeData(raw) {
     }
     data.budgetChars = clamped
   }
+  // Custom backup location (F18). A path is machine-local data, so anything
+  // unusable is dropped rather than guessed at — with a disclosure, because a
+  // silently ignored path would look like "backups point there" while they do
+  // not.
+  if (typeof raw.backupDir === 'string') {
+    const wanted = raw.backupDir.trim()
+    if (wanted.length > MAX_BACKUP_DIR) {
+      optionFixes.push('backupDir 超过 ' + MAX_BACKUP_DIR + ' 字符上限 → 已清空')
+    } else {
+      data.backupDir = wanted
+    }
+  } else if ('backupDir' in raw && raw.backupDir !== null && raw.backupDir !== '') {
+    optionFixes.push('backupDir ' + describeValue(raw.backupDir) + ' → ""（需要字符串路径）')
+  }
+  // F7 temporary mute. The field is OPTIONAL (the format stays v2): missing
+  // means "not paused" and is adopted silently, exactly like a v1 file without
+  // sets. Present but not a usable instant is reset to 0 with a disclosure,
+  // like every other hand-edited option.
+  if ('disabledUntil' in raw) {
+    const muteValue = raw.disabledUntil
+    if (typeof muteValue === 'number' && Number.isFinite(muteValue) && muteValue >= 0) {
+      data.disabledUntil = Math.round(muteValue)
+    } else {
+      optionFixes.push('disabledUntil ' + describeValue(muteValue) + ' → 0（需要 ≥ 0 的 epoch 毫秒数，0 表示未暂停）')
+    }
+  }
+
+  // Instruction sets (F13). A missing/blank list means a v1 file (or a hand
+  // edit that removed it): synthesise the single 默认 set and record the fact,
+  // so the panel can say what happened instead of appearing to have invented a
+  // set out of nowhere.
+  const rawSets = Array.isArray(raw.sets) ? raw.sets : []
+  const seenSetIds = new Set()
+  let synthesized = false
+  for (const candidate of rawSets) {
+    const set = sanitizeSet(candidate)
+    if (set === null || data.sets.length >= MAX_SETS) {
+      loaded.droppedSets += 1
+      continue
+    }
+    if (seenSetIds.has(set.id)) set.id = makeSetId()
+    seenSetIds.add(set.id)
+    data.sets.push(set)
+  }
+  if (data.sets.length === 0) {
+    data.sets.push({ id: DEFAULT_SET_ID, name: DEFAULT_SET_NAME })
+    synthesized = true
+  }
+  const rawActive = typeof raw.activeSetId === 'string' ? raw.activeSetId.trim() : ''
+  if (rawActive !== '' && data.sets.some((set) => set.id === rawActive)) {
+    data.activeSetId = rawActive
+  } else {
+    data.activeSetId = data.sets[0].id
+    if (rawActive !== '') {
+      optionFixes.push('activeSetId ' + describeValue(raw.activeSetId) + ' → ' + data.activeSetId + '（没有该配置集）')
+    } else if ('activeSetId' in raw && raw.activeSetId !== null) {
+      optionFixes.push('activeSetId ' + describeValue(raw.activeSetId) + ' → ' + data.activeSetId + '（需要配置集 id 字符串）')
+    }
+  }
+  const knownSet = (id) => data.sets.some((set) => set.id === id)
+  // A silent load is the normal path on a current-format file; everything else
+  // is stated outright, because both branches change what the NEXT save writes.
+  const declaredVersion = typeof raw.version === 'number' ? raw.version : null
+  if (synthesized) {
+    loaded.formatNote = '存储文件未包含配置集信息（' + (declaredVersion !== null ? '格式版本 ' + declaredVersion : '未声明格式版本')
+      + '），其中的条目与形象已归入「' + DEFAULT_SET_NAME + '」配置集；下次保存时文件将写为格式版本 ' + FORMAT_VERSION
+  } else if (declaredVersion !== FORMAT_VERSION) {
+    loaded.formatNote = declaredVersion === null
+      ? '存储文件未声明格式版本，已按格式版本 ' + FORMAT_VERSION + ' 载入；下次保存时文件将补写版本号'
+      : '存储文件为旧版格式（版本 ' + declaredVersion + '），已按格式版本 ' + FORMAT_VERSION + ' 载入；下次保存时文件将写为版本 ' + FORMAT_VERSION
+  }
+
   const list = Array.isArray(raw.entries) ? raw.entries : []
   const seen = new Set()
-  let dropped = 0
   for (const candidate of list) {
     const entry = sanitizeEntry(candidate)
     if (entry === null) {
-      dropped += 1
+      loaded.dropped += 1
       continue
     }
     if (data.entries.length >= MAX_ENTRIES) {
-      dropped += 1
+      loaded.dropped += 1
       continue
     }
     if (seen.has(entry.id)) entry.id = makeId()
     seen.add(entry.id)
+    if (entry.setId === '' || !knownSet(entry.setId)) {
+      // A blank setId is simply an unfiled item (v1 file, hand-added entry) and
+      // files silently; a NON-blank id naming a set that does not exist is a
+      // broken reference the loader overrules, and that is counted.
+      if (entry.setId !== '') loaded.reattributed += 1
+      entry.setId = data.activeSetId
+    }
     data.entries.push(entry)
   }
   // User profiles ("用户形象") follow the same tolerant rules: a missing
@@ -363,18 +693,21 @@ function normalizeData(raw) {
   // silently (the next save rewrites the file without them).
   const profileList = Array.isArray(raw.profiles) ? raw.profiles : []
   const seenProfileIds = new Set()
-  let droppedProfiles = 0
   for (const candidate of profileList) {
     const profile = sanitizeProfile(candidate)
     if (profile === null || data.profiles.length >= MAX_PROFILES) {
-      droppedProfiles += 1
+      loaded.droppedProfiles += 1
       continue
     }
     if (seenProfileIds.has(profile.id)) profile.id = makeId()
     seenProfileIds.add(profile.id)
+    if (profile.setId === '' || !knownSet(profile.setId)) {
+      if (profile.setId !== '') loaded.reattributed += 1
+      profile.setId = data.activeSetId
+    }
     data.profiles.push(profile)
   }
-  return { data, dropped, droppedProfiles, optionFixes }
+  return loaded
 }
 
 /**
@@ -388,10 +721,16 @@ function normalizeData(raw) {
  */
 function cloneData(data) {
   return {
-    version: 1,
+    version: FORMAT_VERSION,
     rev: data.rev || 0,
     enabled: data.enabled === true,
+    disabledUntil: typeof data.disabledUntil === 'number' && Number.isFinite(data.disabledUntil) && data.disabledUntil > 0
+      ? data.disabledUntil
+      : 0,
     budgetChars: data.budgetChars,
+    backupDir: typeof data.backupDir === 'string' ? data.backupDir : '',
+    activeSetId: data.activeSetId,
+    sets: (Array.isArray(data.sets) ? data.sets : []).map((set) => ({ ...set })),
     entries: (Array.isArray(data.entries) ? data.entries : []).map((entry) => ({ ...entry })),
     profiles: (Array.isArray(data.profiles) ? data.profiles : []).map((profile) => ({ ...profile })),
   }
@@ -407,6 +746,16 @@ const droppedProfilesMessage = (count) =>
     ? '存储文件中有 ' + count + ' 个用户形象未能载入（名称与内容同时为空或超过 ' + MAX_PROFILES + ' 个上限）；下次保存时它们将从文件中移除'
     : null
 
+const droppedSetsMessage = (count) =>
+  count > 0
+    ? '存储文件中有 ' + count + ' 个配置集未能载入（名称为空或超过 ' + MAX_SETS + ' 个上限）；下次保存时它们将从文件中移除，其条目会归入当前配置集'
+    : null
+
+const reattributedMessage = (count) =>
+  count > 0
+    ? '存储文件中有 ' + count + ' 项（条目或形象）指向不存在的配置集，已归入当前配置集'
+    : null
+
 /**
  * The load-time disclosures for one normalizeData result: dropped entries and
  * corrected hand-edited options, joined with a full-width semicolon.
@@ -415,10 +764,15 @@ const droppedProfilesMessage = (count) =>
  */
 const loadWarnings = (loaded) => {
   const parts = []
+  if (typeof loaded.formatNote === 'string' && loaded.formatNote !== '') parts.push(loaded.formatNote)
   const dropped = droppedEntriesMessage(loaded.dropped)
   if (dropped !== null) parts.push(dropped)
   const droppedProfiles = droppedProfilesMessage(loaded.droppedProfiles || 0)
   if (droppedProfiles !== null) parts.push(droppedProfiles)
+  const droppedSets = droppedSetsMessage(loaded.droppedSets || 0)
+  if (droppedSets !== null) parts.push(droppedSets)
+  const reattributed = reattributedMessage(loaded.reattributed || 0)
+  if (reattributed !== null) parts.push(reattributed)
   if (Array.isArray(loaded.optionFixes) && loaded.optionFixes.length > 0) {
     parts.push('存储文件中的以下选项值无效，已按规则修正：' + loaded.optionFixes.join('；') + '；下次保存时修正值将写入文件')
   }
@@ -813,15 +1167,58 @@ function planEntries(data, budget) {
  *  - a profile-only store (no instructions) still injects, and the master
  *    `enabled` switch suppresses both halves as before.
  */
-export function planInjection(data) {
+/**
+ * F7 temporary mute: a store-level pause with an expiry. `disabledUntil` is an
+ * epoch-ms instant; while it lies in the future (and the master switch is on)
+ * the store is muted. The wall clock is only the DEFAULT: both this and the
+ * render entry points take `now`, so a fixed clock reproduces the same bytes
+ * and tests pin the behaviour without waiting.
+ */
+export function isMuted(data, now = Date.now()) {
+  return data !== null && typeof data === 'object' && data.enabled === true
+    && typeof data.disabledUntil === 'number' && Number.isFinite(data.disabledUntil)
+    && data.disabledUntil > now
+}
+
+/**
+ * The lapsed-mute decision the host timer acts on: a mute whose instant has
+ * passed needs the section re-registered (and a snapshot pushed), but writes
+ * NOTHING — expiry is a state change, not a save; the store file and its rev
+ * stay untouched, and the stale value is simply ignored until the next real
+ * write rewrites the file without it.
+ */
+export function muteExpired(data, now = Date.now()) {
+  return data !== null && typeof data === 'object' && data.enabled === true
+    && typeof data.disabledUntil === 'number' && Number.isFinite(data.disabledUntil)
+    && data.disabledUntil > 0 && data.disabledUntil <= now
+}
+
+export function planInjection(data, now = Date.now()) {
   const budget = clampBudget(data !== null && typeof data === 'object' ? data.budgetChars : undefined)
   const blank = () => ({
     text: '', budget, activeCount: 0, included: [], omitted: [],
     profiles: [], profileChars: 0, entryChars: 0,
   })
   if (data === null || typeof data !== 'object' || data.enabled !== true) return blank()
-  const persona = buildProfilesBlock(data.profiles)
-  const entryPlan = planEntries(data, budget)
+  // F7 temporary mute: while the pause is live the plan is EXACTLY the
+  // enabled:false plan — same fields, same empty text — so the prompt section
+  // disappears and the prompt is byte-identical to a deployment without this
+  // plugin.
+  if (isMuted(data, now)) return blank()
+  /**
+   * The set filter (F13) is applied HERE, at the one place both the rendered
+   * text and the budget decision are produced, so no caller can inject an
+   * inactive set by accident. A store with no `sets` at all is the legacy
+   * single-set shape and is injected whole (see activeScope).
+   */
+  const scope = activeScope(data)
+  const scoped = {
+    ...data,
+    entries: (Array.isArray(data.entries) ? data.entries : []).filter((entry) => inScope(entry, scope)),
+    profiles: (Array.isArray(data.profiles) ? data.profiles : []).filter((profile) => inScope(profile, scope)),
+  }
+  const persona = buildProfilesBlock(scoped.profiles)
+  const entryPlan = planEntries(scoped, budget)
   const parts = []
   if (persona.text !== '') parts.push(persona.text)
   if (entryPlan.text !== '') parts.push(entryPlan.text)
@@ -842,8 +1239,8 @@ export function planInjection(data) {
  * decision process lives in one place, and callers that only need the text
  * (the prompt section) keep this byte-stable entry point.
  */
-export function buildBlock(data) {
-  return planInjection(data).text
+export function buildBlock(data, now = Date.now()) {
+  return planInjection(data, now).text
 }
 
 /* ------------------------------------------------------------------ *
@@ -854,13 +1251,29 @@ export function apply(ctx) {
   const systemPrompt = ctx.systemPrompt
 
   const state = {
-    data: { version: 1, enabled: true, budgetChars: DEFAULT_BUDGET, entries: [], profiles: [] },
+    data: {
+      version: FORMAT_VERSION,
+      rev: 0,
+      enabled: true,
+      budgetChars: DEFAULT_BUDGET,
+      backupDir: '',
+      activeSetId: DEFAULT_SET_ID,
+      sets: [{ id: DEFAULT_SET_ID, name: DEFAULT_SET_NAME }],
+      entries: [],
+      profiles: [],
+    },
     storagePath: null,
     storageDisplay: null,
     storageError: null,
     storageWarning: null,
     /** A failed rolling-backup refresh, shown only when no load warning wins. */
     backupError: null,
+    /**
+     * A failed history snapshot (F14). Non-fatal by design — the store itself
+     * was written — but shown, because "history is being kept" is a promise the
+     * panel makes on this feature's behalf.
+     */
+    historyError: null,
     /** Which branch of the load actually produced the current data (diagnostics). */
     loadedFrom: null,
     savedAt: null,
@@ -876,8 +1289,30 @@ export function apply(ctx) {
     sectionError: null,
     /** Whether a store file is actually present on disk (diagnostics + the panel). */
     storeExists: false,
+    /** How many history snapshots the current directory holds (diagnostics). */
+    historyCount: 0,
+    /**
+     * The address the settings route is actually bound to (F12 security panel).
+     * `''` until a web server publishes; the panel turns it into a warning when
+     * the bind is not loopback.
+     */
+    boundHost: '',
   }
   let sectionDispose = null
+  /**
+   * Which Host values this route accepts. Set when the route is registered,
+   * from the address the web server is actually bound to (see the long note on
+   * requestOriginVerdict). Until then the route does not exist at all, so the
+   * default only matters if something registers it out of band. Declared next
+   * to `state` so the snapshot can publish it at any time without a
+   * temporal-dead-zone hazard (F12 publishes it as `security.hostGuarded`).
+   */
+  let guardHost = true
+  /**
+   * F7: the pending mute-expiry timer, or null. Re-armed by scheduleMuteTimer
+   * (from syncSection) and cleared in the effect cleanup.
+   */
+  let muteTimer = null
 
   /**
    * A first run deliberately writes NOTHING (see readFromDisk step 3). This flag
@@ -958,7 +1393,7 @@ export function apply(ctx) {
 
   const sectionText = () => {
     try {
-      return buildBlock(state.data)
+      return buildBlock(state.data, Date.now())
     } catch (err) {
       console.error('[instruction-memory] render failed:', err)
       return ''
@@ -974,7 +1409,7 @@ export function apply(ctx) {
    */
   const sectionPlan = () => {
     try {
-      return planInjection(state.data)
+      return planInjection(state.data, Date.now())
     } catch (err) {
       console.error('[instruction-memory] render failed:', err)
       return {
@@ -999,6 +1434,37 @@ export function apply(ctx) {
     return sectionText()
   }
 
+  /**
+   * F7: keep one host-side timer pointed at the mute's expiry. Expiry must be
+   * automatic — no user action, no write: when the instant passes, the section
+   * re-registers (or stays dropped) and open panels get a fresh snapshot,
+   * while the store file and its rev stay untouched. syncSection re-arms it
+   * on every state change (boot, commit, external reload), and re-arming
+   * clears the previous timer first, so there is never more than one.
+   */
+  const scheduleMuteTimer = () => {
+    if (muteTimer !== null) {
+      clearTimeout(muteTimer)
+      muteTimer = null
+    }
+    if (!isMuted(state.data)) return
+    const delay = Math.min(state.data.disabledUntil - Date.now(), MAX_MUTE_MS)
+    muteTimer = setTimeout(() => {
+      muteTimer = null
+      // Clock skew or an early fire: if the mute is still live, re-arm instead
+      // of acting; the sync below happens only on a real expiry.
+      if (isMuted(state.data)) {
+        scheduleMuteTimer()
+        return
+      }
+      syncSection()
+      pushSnapshot()
+      logDebug('mute expired: section re-synced without a write')
+    }, Math.max(1, delay))
+    // A 7-day timer must not hold a shutting-down process open.
+    if (typeof muteTimer.unref === 'function') muteTimer.unref()
+  }
+
   /**
    * Keep the registered section exactly in step with the stored data: present
    * when something must be injected, absent otherwise. An empty memory must
@@ -1018,9 +1484,7 @@ export function apply(ctx) {
         state.sectionError = '注入注册失败：' + describeError(err)
         console.error('[instruction-memory] section registration failed:', err)
       }
-      return
-    }
-    if (!wanted) {
+    } else if (!wanted) {
       if (sectionDispose !== null) {
         const dispose = sectionDispose
         sectionDispose = null
@@ -1034,6 +1498,9 @@ export function apply(ctx) {
       state.sectionRegistered = false
       state.sectionError = null
     }
+    // F7: whatever this sync just published, the mute timer must point at
+    // exactly this state (and re-arming clears the previous timer first).
+    scheduleMuteTimer()
   }
 
   ctx.effect(() => () => {
@@ -1046,6 +1513,10 @@ export function apply(ctx) {
         console.error('[instruction-memory] cleanup failed:', err)
       }
     }
+    if (muteTimer !== null) {
+      clearTimeout(muteTimer)
+      muteTimer = null
+    }
     stopWatching()
     disposeStreams()
   })
@@ -1165,7 +1636,50 @@ export function apply(ctx) {
 
   const storePath = resolveStorePath()
 
-  const serialize = () => JSON.stringify(state.data, null, 2) + '\n'
+  /**
+   * The exact object written to memory.json — and the one an export carries.
+   *
+   * `$schema` comes first on purpose: opening the file in an editor then offers
+   * validation and field completion against the copy of memory.schema.json the
+   * host keeps next to the store (see ensureSchemaFile). The loader ignores the
+   * key, so it costs nothing to anyone who never opens the file.
+   */
+  const persistableData = () => ({
+    $schema: SCHEMA_REF,
+    version: FORMAT_VERSION,
+    rev: state.data.rev || 0,
+    enabled: state.data.enabled === true,
+    disabledUntil: typeof state.data.disabledUntil === 'number' && Number.isFinite(state.data.disabledUntil) && state.data.disabledUntil > 0
+      ? state.data.disabledUntil
+      : 0,
+    budgetChars: clampBudget(state.data.budgetChars),
+    backupDir: typeof state.data.backupDir === 'string' ? state.data.backupDir : '',
+    activeSetId: state.data.activeSetId,
+    sets: (Array.isArray(state.data.sets) ? state.data.sets : []).map((set) => ({ ...set })),
+    entries: (Array.isArray(state.data.entries) ? state.data.entries : []).map((entry) => ({ ...entry })),
+    profiles: (Array.isArray(state.data.profiles) ? state.data.profiles : []).map((profile) => ({ ...profile })),
+  })
+
+  const serialize = () => JSON.stringify(persistableData(), null, 2) + '\n'
+
+  /* ---------------- backup location + history snapshots (F14 / F18) ---------------- */
+
+  const backupDirOf = () => (typeof state.data.backupDir === 'string' ? state.data.backupDir : '')
+  /** Where the rolling pre-write copy lives: ALWAYS next to the store (crash recovery). */
+  const localBackupPath = () => storePath + BACKUP_FILE_SUFFIX
+  /** The user-facing copy under a custom backup location, or null (F18). */
+  const customBackupPath = () => (backupDirOf() !== '' ? join(backupDirOf(), basename(storePath) + BACKUP_FILE_SUFFIX) : null)
+  /**
+   * History snapshots live in a `history/` SUBDIRECTORY of the backup location
+   * (default: the store directory). Two reasons for the subdirectory:
+   *   1. the external-change watcher listens on the store directory and must
+   *      never see a snapshot as a change to memory.json — a subdirectory is
+   *      not reported by a non-recursive watch, and the filename filter drops
+   *      anything that is not memory.json anyway;
+   *   2. a custom (e.g. cloud-synced) backup directory stays tidy: one known
+   *      folder holds the history, nothing else is touched.
+   */
+  const historyDirPath = () => join(backupDirOf() !== '' ? backupDirOf() : dirname(storePath), HISTORY_DIR_NAME)
 
   /**
    * Cross-process write lock: a `memory.json.lock` marker created exclusively
@@ -1234,6 +1748,151 @@ export function apply(ctx) {
     }
   }
 
+  /* ---------------- custom backup location (F18) ---------------- */
+
+  /**
+   * Can this directory actually hold backups right now? Setting a path is a
+   * promise ("my backups live there"), so it is verified at the moment it is
+   * set — exists, is a directory, and accepts a write — instead of being
+   * discovered to be wrong by the first save that silently failed to copy.
+   *
+   * @returns null when usable, otherwise a human-readable reason.
+   */
+  const probeBackupDir = async (dir) => {
+    try {
+      const info = await stat(dir)
+      if (!info.isDirectory()) return '该路径不是目录'
+    } catch {
+      return '目录不存在或不可访问'
+    }
+    const probe = join(dir, '.dsh-instruction-memory-probe-' + randomUUID())
+    try {
+      await writeFile(probe, 'probe', 'utf8')
+      await unlink(probe).catch(() => {})
+      return null
+    } catch (err) {
+      return '目录不可写：' + describeError(err)
+    }
+  }
+
+  /* ---------------- history snapshots and the schema copy (both best-effort) ---------------- */
+
+  /** This machine's tag inside snapshot filenames; see deviceTag(). */
+  const DEVICE = deviceTag((() => {
+    try {
+      return hostname()
+    } catch {
+      return ''
+    }
+  })())
+
+  /**
+   * The bytes of the most recent snapshot, so two writes that produce the same
+   * file (a no-op-ish save, a repeat restore) do not each mint a "version".
+   */
+  let lastHistoryText = null
+
+  /**
+   * Enforce the per-device retention limit. Grouping by the device tag inside
+   * the filename is deliberate: two machines sharing one backup folder (the
+   * documented F18 setup) each keep MAX_HISTORY of their OWN snapshots, so one
+   * device can never prune the other's history away. Files that do not match
+   * our naming pattern are never touched.
+   */
+  const pruneHistory = async (dir) => {
+    const names = (await readdir(dir)).filter((name) => HISTORY_FILE_PATTERN.test(name))
+    const byDevice = new Map()
+    for (const name of names) {
+      const key = historyDeviceOf(name)
+      const bucket = byDevice.get(key)
+      if (bucket === undefined) byDevice.set(key, [name])
+      else bucket.push(name)
+    }
+    let removed = 0
+    let kept = 0
+    for (const bucket of byDevice.values()) {
+      // Fixed-width UTC stamp first => lexicographic order is chronological.
+      bucket.sort()
+      const excess = bucket.length - MAX_HISTORY
+      for (let index = 0; index < bucket.length; index += 1) {
+        if (index < excess) {
+          await unlink(join(dir, bucket[index])).catch(() => {})
+          removed += 1
+        } else {
+          kept += 1
+        }
+      }
+    }
+    return { removed, kept }
+  }
+
+  /**
+   * Record the just-written store as a new history snapshot (F14).
+   *
+   * Written AFTER the atomic replace, so a snapshot always equals a state that
+   * really was committed; a failure here is disclosed and never fails the save,
+   * because the store itself is already safely on disk.
+   */
+  const writeHistorySnapshot = async (text) => {
+    if (typeof text !== 'string' || text === '' || text === lastHistoryText) return
+    try {
+      const dir = historyDirPath()
+      await mkdir(dir, { recursive: true })
+      const epoch = Date.now()
+      let written = false
+      // `wx` never overwrites: same-millisecond saves (two rapid bulk actions)
+      // bump the stamp by a millisecond instead of losing one of the two.
+      for (let attempt = 0; attempt < 5 && !written; attempt += 1) {
+        try {
+          await writeFile(join(dir, historyFileName(epoch + attempt, state.data.rev || 0, DEVICE)), text, { encoding: 'utf8', flag: 'wx' })
+          written = true
+        } catch (err) {
+          if (err.code !== 'EEXIST') throw err
+        }
+      }
+      if (!written) throw new Error('快照文件名重复')
+      lastHistoryText = text
+      const { kept } = await pruneHistory(dir)
+      state.historyCount = kept
+      state.historyError = null
+    } catch (err) {
+      state.historyError = '版本历史快照未能写入（' + describeError(err) + '）；本次保存本身已完成'
+    }
+  }
+
+  /**
+   * Keep a copy of the shipped JSON Schema next to the store, so the `$schema`
+   * reference inside memory.json resolves for a hand editor who has no idea
+   * where the package lives. Content-compared: one small read on a save, a
+   * write only when the shipped schema actually changed. Never throws — the
+   * schema is a convenience, not a precondition for holding memory.
+   */
+  const ensureSchemaFile = async () => {
+    try {
+      const source = await readFile(fileURLToPath(new URL('../' + SCHEMA_FILE_NAME, import.meta.url)), 'utf8')
+      const target = join(dirname(storePath), SCHEMA_FILE_NAME)
+      const existing = await readFile(target, 'utf8').catch(() => null)
+      if (existing !== source) await writeFile(target, source, 'utf8')
+    } catch {
+      // Best effort by design.
+    }
+  }
+
+  /**
+   * Recount the snapshot directory for the panel's diagnostics. Best effort:
+   * an unreadable directory simply leaves the count as it was, because the
+   * history list (the actual UI, which reports its own errors) is what the
+   * user acts on.
+   */
+  const refreshHistoryCount = async () => {
+    try {
+      const names = await readdir(historyDirPath())
+      state.historyCount = names.filter((name) => HISTORY_FILE_PATTERN.test(name)).length
+    } catch {
+      // No directory yet (nothing written) — count stays 0.
+    }
+  }
+
   const writeToDisk = async () => {
     // Atomic replace (write a sibling temp file, then rename) with a rolling
     // one-version backup: a crash mid-write must never leave a truncated
@@ -1249,7 +1908,6 @@ export function apply(ctx) {
     // the primary in place until the atomic replace succeeds, so a failure at
     // any step leaves the previous store readable at its own path.
     const tmpPath = storePath + '.tmp'
-    const bakPath = storePath + '.bak'
     let lock = null
     let previousRev = null
     try {
@@ -1264,8 +1922,12 @@ export function apply(ctx) {
       state.data.rev = previousRev + 1
       const text = serialize()
       await writeFile(tmpPath, text, 'utf8')
+      // Both rolling copies stand for the PREVIOUS good version, so both are
+      // taken before the atomic replace, and neither may ever be renamed into
+      // place (see the long note above).
+      let hadPrevious = true
       try {
-        await copyFile(storePath, bakPath)
+        await copyFile(storePath, localBackupPath())
         state.backupError = null
       } catch (err) {
         // ENOENT is simply the very first save: there is no previous version
@@ -1273,9 +1935,23 @@ export function apply(ctx) {
         // happen — non-fatal for this save, because the primary is still intact
         // and the replace below is the real gate, but it must be disclosed
         // rather than swallowed.
+        hadPrevious = err.code !== 'ENOENT'
         state.backupError = err.code === 'ENOENT'
           ? null
-          : '上一版未能保留为 memory.json.bak：' + describeError(err)
+          : '上一版未能保留为 ' + localBackupPath() + '：' + describeError(err)
+      }
+      // The user-facing copy under a custom backup location (F18). The LOCAL
+      // copy above stays the one crash recovery reads, so a failure here
+      // degrades the extra copy only — never the plugin's own safety net.
+      const customBak = customBackupPath()
+      if (customBak !== null && hadPrevious) {
+        try {
+          await copyFile(storePath, customBak)
+        } catch (err) {
+          if (state.backupError === null) {
+            state.backupError = '备份位置未能保留上一版（' + customBak + '）：' + describeError(err)
+          }
+        }
       }
       try {
         await rename(tmpPath, storePath)
@@ -1294,8 +1970,15 @@ export function apply(ctx) {
       // be (re)armed after a first run that had nothing to watch.
       startWatching()
       state.savedAt = Date.now()
+      // Best-effort side files, each guarded inside itself: a failure in either
+      // must never be mistaken for "the save failed" — the save already
+      // committed, and the store is on disk whatever happens next.
+      await writeHistorySnapshot(text)
+      await ensureSchemaFile()
       logDebug('store written: ' + storePath + ' bytes=' + text.length
         + ' entries=' + state.data.entries.length + ' rev=' + state.data.rev
+        + ' sets=' + state.data.sets.length + ' activeSet=' + state.data.activeSetId
+        + ' history=' + state.historyCount
         + (state.backupError === null ? ' backup=refreshed' : ' backup=FAILED'))
       return true
     } catch (err) {
@@ -1335,14 +2018,21 @@ export function apply(ctx) {
     /**
      * A store declaring an unsupported format version: adopt nothing, write
      * nothing, and say why. The one thing that must NEVER happen in this
-     * state is a save — it would rewrite the file as v1 and destroy whatever
-     * the newer format meant (the mutating commands refuse while
-     * versionRejected is set).
+     * state is a save — it would rewrite the file in this build's format and
+     * destroy whatever the newer format meant (the mutating commands refuse
+     * while versionRejected is set).
+     *
+     * This is also the guard that makes a DOWNGRADE safe: a file written by a
+     * newer plugin (e.g. version 2 from an F13-aware build) opened by an older
+     * one is refused here, with the data left untouched, instead of being
+     * half-read and then rewritten without the fields the old build cannot
+     * see.
      */
     const rejectVersion = (version, source) => {
       state.versionRejected = true
       state.rejectedVersion = version
-      state.storageError = '存储文件声明为格式版本 ' + version + '，本插件只支持版本 1；已拒绝载入以防数据损坏，原文件已保留，修改操作已暂停。请升级插件，或手动将文件改回版本 1 后点「重新载入」'
+      state.storageError = '存储文件声明为格式版本 ' + version + '，本插件支持的格式版本为 ' + SUPPORTED_VERSIONS.join(' / ')
+        + '；已拒绝载入以防数据损坏，原文件已保留，修改操作已暂停。请升级插件，或手动将文件改回受支持的版本后点「重新载入」'
       state.loadedFrom = source + ' (unsupported version ' + version + ')'
       state.storeExists = true
     }
@@ -1360,6 +2050,9 @@ export function apply(ctx) {
         state.storageWarning = loadWarnings(loaded)
         state.loadedFrom = 'memory.json'
         state.storeExists = true
+        // A real file is now in memory, so the "materialise on first need"
+        // flag is spent — see ensureStoreMaterialized.
+        needsMaterialize = false
       }
       state.storageError = null
       return false
@@ -1487,6 +2180,35 @@ export function apply(ctx) {
    */
   const ensureStoreMaterialized = async () => {
     if (!needsMaterialize) return false
+    /**
+     * A store may have APPEARED since boot — a hand-copied memory.json, a
+     * backup restored by another tool, a second process. Three cases, and the
+     * difference between the last two is the whole point:
+     *   - nothing there: materialise the empty store (the documented first run);
+     *   - READABLE: adopt it instead of overwriting whatever the user just put
+     *     there (the gap is wide — the panel's first `state` call can come
+     *     minutes after boot);
+     *   - present but UNREADABLE: write nothing at all and let the loader's own
+     *     disclosure say why. Overwriting would destroy the very file a user
+     *     could still repair by hand, and it would report `ok:true` while doing
+     *     it — the silent data loss this plugin must never commit.
+     */
+    let appeared = null
+    let unreadable = false
+    try {
+      appeared = await readStoreFile(storePath)
+    } catch (err) {
+      // ENOENT is the FIRST RUN itself — nothing to adopt, so materialise.
+      // Anything else (EACCES, EISDIR, a parse failure …) means a file IS
+      // there and could not be adopted; readFromDisk() below reports exactly
+      // what it was, and nothing is written.
+      unreadable = !(err !== null && typeof err === 'object' && err.code === 'ENOENT')
+    }
+    if (unreadable || appeared !== null) {
+      const wrote = await readFromDisk()
+      syncSection()
+      return wrote
+    }
     return writeToDisk()
   }
 
@@ -1506,9 +2228,10 @@ export function apply(ctx) {
     .catch((err) => {
       state.storageError = '读取失败：' + describeError(err)
     })
-    .then(() => {
+    .then(async () => {
       bootSettled = true
       syncSection()
+      await refreshHistoryCount()
       // The one always-on line: it answers "is memory mounted, where does it
       // live, and how much is being injected?" without any further digging.
       // 措辞很重要：`section=` 说的是"这个段落已就绪、若被装配会产出多少字符"，
@@ -1519,6 +2242,7 @@ export function apply(ctx) {
         + ' from=' + String(state.loadedFrom)
         + ' onDisk=' + (state.storeExists ? 'yes' : 'no')
         + ' entries=' + state.data.entries.length
+        + ' sets=' + state.data.sets.length + ' activeSet=' + state.data.activeSetId
         + ' enabled=' + (state.data.enabled === true)
         + ' section=' + (chars > 0 ? chars + ' chars (pending assembly)' : 'nothing to inject')
         + ' pulls=' + sectionPulls
@@ -1545,17 +2269,83 @@ export function apply(ctx) {
 
   /* ---------------- snapshots ---------------- */
 
+  /**
+   * The snapshot the settings page renders (and the SSE frames carry).
+   *
+   * `data.entries`/`data.profiles` publish ONLY the active set (F13): the panel
+   * lists and edits exactly what is being injected, so a 某客户 set can never
+   * appear in the 个人 panel — the isolation guarantee the feature exists for.
+   * The set list, with per-set counts and the active flag, travels in `sets`,
+   * and the raw arrays are in `data.sets`/`data.activeSetId` for the switcher.
+   * Anything needing the WHOLE store (export, source mode) goes through
+   * persistableData(), which is also what the file holds.
+   */
   const snapshot = () => {
     const plan = sectionPlan()
     const preview = plan.text
+    const scope = activeScope(state.data)
+    const belongsTo = (item, id) => {
+      const own = item !== null && typeof item === 'object' && typeof item.setId === 'string' && item.setId !== ''
+        ? item.setId
+        : state.data.activeSetId
+      return own === id
+    }
+    const activeEntries = state.data.entries.filter((entry) => inScope(entry, scope))
+    const activeProfiles = state.data.profiles.filter((profile) => inScope(profile, scope))
     return {
       data: {
-        version: 1,
+        version: FORMAT_VERSION,
         rev: state.data.rev || 0,
         enabled: state.data.enabled === true,
+        disabledUntil: typeof state.data.disabledUntil === 'number' && Number.isFinite(state.data.disabledUntil) && state.data.disabledUntil > 0
+          ? state.data.disabledUntil
+          : 0,
         budgetChars: clampBudget(state.data.budgetChars),
-        entries: (Array.isArray(state.data.entries) ? state.data.entries : []).map((entry) => ({ ...entry })),
-        profiles: (Array.isArray(state.data.profiles) ? state.data.profiles : []).map((profile) => ({ ...profile })),
+        backupDir: typeof state.data.backupDir === 'string' ? state.data.backupDir : '',
+        activeSetId: state.data.activeSetId,
+        sets: state.data.sets.map((set) => ({ id: set.id, name: set.name })),
+        entries: activeEntries.map((entry) => ({ ...entry })),
+        profiles: activeProfiles.map((profile) => ({ ...profile })),
+      },
+      /**
+       * Instruction sets (F13): the switcher's data source. `total` counts the
+       * WHOLE store (all sets), which is what the 200-entry cap is measured
+       * against — the panel says "共 N 条" per active set but the cap message
+       * must quote the store-wide number.
+       */
+      sets: {
+        activeId: state.data.activeSetId,
+        scoped: scope.scoped,
+        total: { entries: state.data.entries.length, profiles: state.data.profiles.length },
+        list: state.data.sets.map((set) => ({
+          id: set.id,
+          name: set.name,
+          active: set.id === state.data.activeSetId,
+          entries: state.data.entries.filter((entry) => belongsTo(entry, set.id)).length,
+          profiles: state.data.profiles.filter((profile) => belongsTo(profile, set.id)).length,
+        })),
+      },
+      /**
+       * F12: the one security signal the panel was missing. `hostGuarded` is
+       * the SAME flag the route enforces on every request — false means the
+       * Host allowlist is OFF because the server is bound beyond loopback,
+       * i.e. the page is reachable without authentication from the local
+       * network. `boundHost` says which address produced that decision so the
+       * warning can name it instead of guessing.
+       */
+      security: {
+        hostGuarded: guardHost === true,
+        boundHost: state.boundHost,
+      },
+      /**
+       * F12: load-side diagnostics that used to be log-only. `loadedFrom` says
+       * which branch of the boot load produced the current data (fresh store,
+       * adopted file, recovered .bak, …); `rev` mirrors data.rev so a support
+       * dump pairs it with the storage fields without another round trip.
+       */
+      diagnostics: {
+        loadedFrom: state.loadedFrom,
+        rev: state.data.rev || 0,
       },
       storage: {
         path: state.storageDisplay !== null ? state.storageDisplay : state.storagePath,
@@ -1565,11 +2355,27 @@ export function apply(ctx) {
         migratedFrom: state.migratedFrom,
         /** false until the store file has actually been written (see readFromDisk step 3). */
         onDisk: state.storeExists,
+        /** Backup location (F18): '' means "next to the store file". */
+        backupDir: backupDirOf(),
+        isDefaultBackupDir: backupDirOf() === '',
+        /** Where the rolling pre-write copy actually sits (diagnostics). */
+        backupPath: localBackupPath(),
+        /** Version history (F14). */
+        historyDir: historyDirPath(),
+        historyCount: state.historyCount,
+        historyError: state.historyError,
+        schemaFile: join(dirname(storePath), SCHEMA_FILE_NAME),
       },
       injection: {
         registered: state.sectionRegistered,
         available: true,
         error: state.sectionError,
+        /**
+         * F7: the pause is decided by the HOST clock (isMuted on the live
+         * store) and published as a derived flag; the client only renders a
+         * countdown from data.disabledUntil and never decides by itself.
+         */
+        muted: isMuted(state.data, Date.now()),
         chars: preview.length,
         /**
          * The budget decision behind `preview`, for the settings page's
@@ -1611,6 +2417,10 @@ export function apply(ctx) {
         maxProfiles: MAX_PROFILES,
         maxProfileName: MAX_PROFILE_NAME,
         maxProfileContent: MAX_PROFILE_CONTENT,
+        maxSets: MAX_SETS,
+        maxSetName: MAX_SET_NAME,
+        maxHistory: MAX_HISTORY,
+        maxBackupDir: MAX_BACKUP_DIR,
         maxBodyChars: MAX_BODY_CHARS,
       },
     }
@@ -1649,17 +2459,70 @@ export function apply(ctx) {
 
   /**
    * Refusal while the store on disk declares an unsupported format version:
-   * a save here would rewrite the file as v1 and destroy whatever the newer
-   * format meant. The file stays untouched until the user upgrades the plugin
-   * or restores a v1 file and hits 重新载入.
+   * a save here would rewrite it in this build's format and destroy whatever
+   * the newer format meant. The file stays untouched until the user upgrades
+   * the plugin or restores a supported-version file and hits 重新载入.
    */
   const versionRefusal = () => ({
     ok: false,
     saved: false,
-    message: '存储文件为不支持的格式版本 ' + state.rejectedVersion + '，修改已暂停：现在保存会用版本 1 覆盖它，可能损坏数据。请先升级插件，或手动将文件改回版本 1 后点「重新载入」',
+    message: '存储文件为不支持的格式版本 ' + state.rejectedVersion + '，修改已暂停：现在保存会用版本 ' + FORMAT_VERSION
+      + ' 覆盖它，可能损坏数据。请先升级插件，或手动将文件改回受支持的版本（' + SUPPORTED_VERSIONS.join(' / ') + '）后点「重新载入」',
     snapshot: snapshot(),
   })
 
+  /**
+   * Adopt a whole parsed store — the shared core of 源码模式 (F16) and the
+   * 整体替换 restore (F14). Both hand the user the SAME safety story as every
+   * other entry point: only a v1/v2 store object is accepted (a stray `{}` or
+   * an unrelated JSON file must never be able to wipe the store), the format
+   * version gate applies, and every correction normalizeData makes is
+   * reported.
+   *
+   * `backupDir` is deliberately NOT adopted: the backup location is
+   * machine-local state, so restoring a file — from another machine, or from
+   * before the path existed — must not silently redirect where backups go.
+   */
+  const adoptParsedStore = (parsed) => {
+    const looksLikeStore = parsed !== null && typeof parsed === 'object' && !Array.isArray(parsed)
+      && ['version', 'rev', 'enabled', 'budgetChars', 'backupDir', 'activeSetId', 'sets', 'entries', 'profiles']
+        .some((key) => key in parsed)
+    if (!looksLikeStore) {
+      return {
+        error: '内容不像本插件的存储文件：顶层需要是对象，且至少包含 entries / profiles / sets / version 之一。'
+          + '若要清空记忆，请使用界面上的删除操作，而不是保存一个空对象',
+      }
+    }
+    const loaded = normalizeData(parsed)
+    if (loaded.rejectedVersion !== undefined) return { rejectedVersion: loaded.rejectedVersion }
+    loaded.data.backupDir = backupDirOf()
+    return { loaded }
+  }
+
+  /** Per-field truncation disclosure for an adopted raw store (mirrors import). */
+  const truncationNotes = (parsed) => {
+    const lists = [
+      [parsed.entries, truncatedFields],
+      [parsed.profiles, truncatedProfileFields],
+      [parsed.sets, truncatedSetFields],
+    ]
+    let items = 0
+    const fields = new Set()
+    for (const [list, fieldsOf] of lists) {
+      for (const raw of (Array.isArray(list) ? list : [])) {
+        const cut = fieldsOf(raw)
+        if (cut.length > 0) {
+          items += 1
+          for (const name of cut) fields.add(name)
+        }
+      }
+    }
+    return items > 0 ? '有 ' + items + ' 项超过长度上限，' + [...fields].join('、') + '已被截断' : null
+  }
+
+  const describeStoreShape = (data) =>
+    data.entries.length + ' 条指令 / ' + data.profiles.length + ' 个用户形象 / ' + data.sets.length + ' 个配置集'
+
   /**
    * Apply an in-memory mutation, persist it, and UNDO it when the write fails.
    *
@@ -1707,11 +2570,33 @@ export function apply(ctx) {
     const entry = sanitizeEntry(raw)
     if (entry === null) return { ok: false, saved: false, message: '标题与指令内容不能同时为空', snapshot: snapshot() }
     entry.updatedAt = Date.now()
+    /**
+     * The active set is authoritative for the interactive save path: the panel
+     * edits what is being injected, and an edit must never be able to move an
+     * item into another set (or drag one in). Moving content between sets is a
+     * deliberate act — create the entry where it belongs, or use 复制配置集.
+     */
+    entry.setId = state.data.activeSetId
+    /**
+     * An id that already belongs to ANOTHER set is not this command's to
+     * replace (entries are addressed by id alone): honouring it would move the
+     * other set's entry into this one and overwrite its text — a cross-set
+     * leak in the one direction the whole feature exists to prevent. Mint a
+     * fresh id instead, and say so, because the caller's id silently changed.
+     */
+    const foreignId = state.data.entries.some((candidate) => candidate.id === entry.id
+      && candidate.setId !== state.data.activeSetId)
+    if (foreignId) entry.id = makeId()
     // Resolved before the mutation so a refusal can return a response instead
     // of being swallowed as an early exit inside it.
     const replacesExisting = state.data.entries.some((candidate) => candidate.id === entry.id)
     if (!replacesExisting && state.data.entries.length >= MAX_ENTRIES) {
-      return { ok: false, saved: false, message: '最多保存 ' + MAX_ENTRIES + ' 条指令', snapshot: snapshot() }
+      return {
+        ok: false,
+        saved: false,
+        message: '最多保存 ' + MAX_ENTRIES + ' 条指令（全部配置集合计，当前 ' + state.data.entries.length + ' 条）',
+        snapshot: snapshot(),
+      }
     }
     const cut = truncatedFields(raw)
     const saved = await commit(() => {
@@ -1720,10 +2605,14 @@ export function apply(ctx) {
       if (index >= 0) list[index] = entry
       else list.push(entry)
     })
-    const note = cut.length > 0
-      ? '已保存；' + cut.join('、') + '超过长度上限（标题 ' + MAX_TITLE + ' / 内容 ' + MAX_CONTENT + ' / 适用场景 ' + MAX_WHEN + ' 字符），超出部分已被截断'
-      : null
-    return settle(note, saved)
+    const notes = []
+    if (cut.length > 0) {
+      notes.push(cut.join('、') + '超过长度上限（标题 ' + MAX_TITLE + ' / 内容 ' + MAX_CONTENT + ' / 适用场景 ' + MAX_WHEN + ' 字符），超出部分已被截断')
+    }
+    if (foreignId) {
+      notes.push('提交的 id 属于其他配置集，已改用新 id 在当前配置集新建（其他配置集的内容未被改动）')
+    }
+    return settle(notes.length > 0 ? '已保存；' + notes.join('；') : null, saved)
   })
 
   const deleteEntry = (id, baseRev) => enqueue(async () => {
@@ -1733,7 +2622,13 @@ export function apply(ctx) {
     // disk, bump rev, or push an echo frame — otherwise two panels deleting
     // the same entry one after another would manufacture a pointless write
     // (and an external process watching the file would wake for nothing).
-    if (!state.data.entries.some((entry) => entry.id === id)) {
+    //
+    // Scoped to the ACTIVE set: the panel only ever lists those ids, so an id
+    // from another set is not "an entry that is not there" by accident — it is
+    // a request this command must not honour (deleting across sets from a
+    // settings page that claims to show one set would be a data-loss bug).
+    const scope = activeScope(state.data)
+    if (!state.data.entries.some((entry) => entry.id === id && inScope(entry, scope))) {
       return { ok: true, saved: false, message: null, snapshot: snapshot() }
     }
     const saved = await commit(() => {
@@ -1745,15 +2640,95 @@ export function apply(ctx) {
   const setOptions = (patch, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
+    // The custom backup location (F18) is validated BEFORE anything is queued
+    // into the store: an unusable path must be refused with a reason, not
+    // accepted and then discovered as a failed copy on the next save.
+    if (patch !== null && typeof patch === 'object' && typeof patch.backupDir === 'string') {
+      const wanted = patch.backupDir.trim()
+      if (wanted !== '') {
+        if (wanted.length > MAX_BACKUP_DIR) {
+          return { ok: false, saved: false, message: '备份位置路径过长（上限 ' + MAX_BACKUP_DIR + ' 字符）', snapshot: snapshot() }
+        }
+        if (!isAbsolute(wanted)) {
+          return {
+            ok: false,
+            saved: false,
+            message: '备份位置需要绝对路径（例如 D:\\云盘\\dsh-memory 或 /home/me/cloud/dsh-memory）；留空表示与存储文件同目录',
+            snapshot: snapshot(),
+          }
+        }
+        const problem = await probeBackupDir(wanted)
+        if (problem !== null) {
+          return { ok: false, saved: false, message: '备份位置不可用（' + problem + '）：' + wanted, snapshot: snapshot() }
+        }
+      }
+    }
+    // F7 temporary mute: validated BEFORE the transaction so a bad value is
+    // refused with a reason instead of being silently normalized. 0 means
+    // "resume now"; a past instant means the same thing; anything beyond the
+    // 7-day ceiling is clamped (and disclosed) rather than refused — a pause
+    // is a de-escalation, refusing it would be user-hostile.
+    let muteTarget = null
+    let muteClamped = false
+    if (patch !== null && typeof patch === 'object' && 'disabledUntil' in patch) {
+      const rawMute = patch.disabledUntil
+      if (typeof rawMute !== 'number' || !Number.isFinite(rawMute) || rawMute < 0) {
+        return {
+          ok: false,
+          saved: false,
+          message: 'disabledUntil 需要 0（立即恢复）或未来的 epoch 毫秒数',
+          snapshot: snapshot(),
+        }
+      }
+      let wanted = Math.round(rawMute)
+      if (wanted <= Date.now()) {
+        wanted = 0
+      } else if (wanted > Date.now() + MAX_MUTE_MS) {
+        wanted = Date.now() + MAX_MUTE_MS
+        muteClamped = true
+      }
+      muteTarget = wanted
+    }
+    const muteWasActive = isMuted(state.data)
     const saved = await commit(() => {
       if (patch !== null && typeof patch === 'object') {
-        if (typeof patch.enabled === 'boolean') state.data.enabled = patch.enabled
+        if (typeof patch.enabled === 'boolean') {
+          state.data.enabled = patch.enabled
+          // An explicit switch outranks the timer: flipping the master switch
+          // ends any pause immediately.
+          state.data.disabledUntil = 0
+        }
         if (typeof patch.budgetChars === 'number' && Number.isFinite(patch.budgetChars)) {
           state.data.budgetChars = clampBudget(patch.budgetChars)
         }
+        if (typeof patch.backupDir === 'string') state.data.backupDir = patch.backupDir.trim()
+        if (muteTarget !== null && typeof patch.enabled !== 'boolean') {
+          state.data.disabledUntil = muteTarget
+        }
       }
     })
-    return settle(null, saved)
+    // A changed backup location moves where history snapshots and manual
+    // exports go, so it is reported rather than left to be discovered.
+    const notes = []
+    if (patch !== null && typeof patch === 'object' && typeof patch.backupDir === 'string') {
+      const wanted = patch.backupDir.trim()
+      notes.push(wanted === ''
+        ? '已恢复默认备份位置（版本历史与导出与存储文件同目录）'
+        : '备份位置已更新：' + wanted + '（版本历史与「导出到备份目录」随之改变；存储文件本身不移动）')
+    }
+    if (muteTarget !== null && !(patch !== null && typeof patch === 'object' && typeof patch.enabled === 'boolean')) {
+      if (muteTarget === 0) {
+        if (muteWasActive) notes.push('已恢复注入。')
+      } else {
+        notes.push('已暂停注入至 ' + new Date(muteTarget).toLocaleString()
+          + '（到期自动恢复；暂停期间不注入任何指令或用户形象）'
+          + (muteClamped ? '；暂停时长上限为 7 天，已按上限记录' : ''))
+      }
+    }
+    if (patch !== null && typeof patch === 'object' && typeof patch.enabled === 'boolean' && muteWasActive) {
+      notes.push('总开关已切换，暂停注入状态已一并清除')
+    }
+    return settle(notes.length > 0 ? notes.join('；') : null, saved)
   })
 
   /**
@@ -1787,7 +2762,11 @@ export function apply(ctx) {
     }
 
     const list = state.data.entries
-    const targets = list.filter((entry) => uniqueIds.includes(entry.id))
+    // Scoped to the active set, exactly like the single-entry commands: the
+    // panel's selection can only ever contain active-set ids, so an id from
+    // another set is reported as "not found" rather than acted on.
+    const scope = activeScope(state.data)
+    const targets = list.filter((entry) => uniqueIds.includes(entry.id) && inScope(entry, scope))
     const missing = uniqueIds.length - targets.length
     const missingNote = missing > 0
       ? '（另有 ' + missing + ' 条未找到，可能已被其他窗口或进程修改）'
@@ -1882,6 +2861,13 @@ export function apply(ctx) {
     const profile = sanitizeProfile(raw)
     if (profile === null) return { ok: false, saved: false, message: '形象名称与内容不能同时为空', snapshot: snapshot() }
     profile.updatedAt = Date.now()
+    /** Same rule as entries: the interactive path files into the active set. */
+    profile.setId = state.data.activeSetId
+    // ...and an id owned by another set is re-minted rather than replaced (see
+    // the note in saveEntry — same cross-set hazard, same guard).
+    const foreignProfileId = state.data.profiles.some((candidate) => candidate.id === profile.id
+      && candidate.setId !== state.data.activeSetId)
+    if (foreignProfileId) profile.id = makeId()
     const replacesExisting = state.data.profiles.some((candidate) => candidate.id === profile.id)
     if (!replacesExisting && state.data.profiles.length >= MAX_PROFILES) {
       return { ok: false, saved: false, message: '最多保存 ' + MAX_PROFILES + ' 个用户形象', snapshot: snapshot() }
@@ -1902,8 +2888,10 @@ export function apply(ctx) {
   const deleteProfile = (id, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
-    // Mirror deleteEntry: an absent id changes nothing and must not touch disk.
-    if (!state.data.profiles.some((profile) => profile.id === id)) {
+    // Mirror deleteEntry: an absent id changes nothing and must not touch disk,
+    // and an id belonging to a different set is not this panel's to delete.
+    const scope = activeScope(state.data)
+    if (!state.data.profiles.some((profile) => profile.id === id && inScope(profile, scope))) {
       return { ok: true, saved: false, message: null, snapshot: snapshot() }
     }
     const saved = await commit(() => {
@@ -1912,6 +2900,269 @@ export function apply(ctx) {
     return settle(null, saved)
   })
 
+  /* ---------------- instruction sets (F13) ---------------- */
+
+  /**
+   * Create or rename an instruction set.
+   *
+   * A blank `set.id` is a CREATE (the Host mints the id), the same convention
+   * entry edits use, and a supplied id is a RENAME. Creating does NOT switch:
+   * switching is what changes what gets injected, and it stays a separate,
+   * explicit click (the response says so). Nothing in this file ever derives a
+   * set from the process cwd or from an open folder — see the README note on
+   * the incident that rule comes from.
+   */
+  const saveSet = (raw, baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    const wanted = sanitizeSet(raw)
+    if (wanted === null) {
+      return { ok: false, saved: false, message: '配置集名称不能为空（单行，最多 ' + MAX_SET_NAME + ' 字符）', snapshot: snapshot() }
+    }
+    const index = state.data.sets.findIndex((set) => set.id === wanted.id)
+    if (state.data.sets.some((set, at) => at !== index && set.name === wanted.name)) {
+      return { ok: false, saved: false, message: '已存在同名配置集「' + wanted.name + '」', snapshot: snapshot() }
+    }
+    if (index < 0) {
+      if (state.data.sets.length >= MAX_SETS) {
+        return { ok: false, saved: false, message: '最多创建 ' + MAX_SETS + ' 个配置集', snapshot: snapshot() }
+      }
+      const cut = truncatedSetFields(raw)
+      const saved = await commit(() => {
+        state.data.sets.push({ id: wanted.id, name: wanted.name })
+      })
+      const note = '已创建配置集「' + wanted.name + '」'
+        + (cut.length > 0 ? '；名称超过 ' + MAX_SET_NAME + ' 字符上限，超出部分已被截断' : '')
+        + '；它是空的，点击「切换」后才会注入它'
+      return settle(note, saved)
+    }
+    if (state.data.sets[index].name === wanted.name) {
+      return { ok: true, saved: false, message: '名称未变化', snapshot: snapshot() }
+    }
+    const cut = truncatedSetFields(raw)
+    const saved = await commit(() => {
+      state.data.sets[index].name = wanted.name
+    })
+    return settle('已重命名为「' + wanted.name + '」' + (cut.length > 0 ? '（名称已按长度上限截断）' : ''), saved)
+  })
+
+  /**
+   * Delete a set together with everything filed under it. Refused for the
+   * ACTIVE set: deleting what is currently injected would change the prompt as
+   * a side effect of a management action, so the user switches first and the
+   * deletion becomes a separate, visible step.
+   */
+  const deleteSet = (id, baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    const index = state.data.sets.findIndex((set) => set.id === id)
+    if (index < 0) {
+      return { ok: false, saved: false, message: '没有该配置集（可能已被其他窗口或进程删除）', snapshot: snapshot() }
+    }
+    if (state.data.sets.length <= 1) {
+      return { ok: false, saved: false, message: '至少要保留一个配置集', snapshot: snapshot() }
+    }
+    if (id === state.data.activeSetId) {
+      return { ok: false, saved: false, message: '不能删除当前激活的配置集；请先切换到其他配置集', snapshot: snapshot() }
+    }
+    const doomedEntries = state.data.entries.filter((entry) => entry.setId === id).length
+    const doomedProfiles = state.data.profiles.filter((profile) => profile.setId === id).length
+    const saved = await commit(() => {
+      state.data.sets.splice(index, 1)
+      state.data.entries = state.data.entries.filter((entry) => entry.setId !== id)
+      state.data.profiles = state.data.profiles.filter((profile) => profile.setId !== id)
+    })
+    return settle('已删除配置集，并移除其中的 ' + doomedEntries + ' 条指令、' + doomedProfiles + ' 个用户形象', saved)
+  })
+
+  /**
+   * Make one set the active one — the single command that changes what is
+   * injected. It writes (the choice survives a restart) and therefore bumps
+   * `rev`, so every other open panel follows along.
+   */
+  const setActiveSet = (id, baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    const target = state.data.sets.find((set) => set.id === id)
+    if (target === undefined) {
+      return { ok: false, saved: false, message: '没有该配置集（可能已被其他窗口或进程删除）', snapshot: snapshot() }
+    }
+    if (id === state.data.activeSetId) {
+      return { ok: true, saved: false, message: null, snapshot: snapshot() }
+    }
+    const saved = await commit(() => {
+      state.data.activeSetId = id
+    })
+    return settle('已切换到配置集「' + target.name + '」，注入内容已随之更新', saved)
+  })
+
+  /**
+   * Copy a set (its entries and profiles, with fresh ids) into a new one — the
+   * "start from a template" flow for per-client isolation. The copy is NOT
+   * activated: it is a new, untested configuration until the user switches.
+   */
+  const duplicateSet = (id, name, baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    const source = state.data.sets.find((set) => set.id === id)
+    if (source === undefined) {
+      return { ok: false, saved: false, message: '没有该配置集（可能已被其他窗口或进程删除）', snapshot: snapshot() }
+    }
+    if (state.data.sets.length >= MAX_SETS) {
+      return { ok: false, saved: false, message: '最多 ' + MAX_SETS + ' 个配置集', snapshot: snapshot() }
+    }
+    const wanted = singleLine(typeof name === 'string' ? name : '', MAX_SET_NAME)
+      || singleLine(source.name + ' 副本', MAX_SET_NAME)
+    if (state.data.sets.some((set) => set.name === wanted)) {
+      return { ok: false, saved: false, message: '已存在同名配置集「' + wanted + '」', snapshot: snapshot() }
+    }
+    const sourceEntries = state.data.entries.filter((entry) => entry.setId === id)
+    if (state.data.entries.length + sourceEntries.length > MAX_ENTRIES) {
+      return {
+        ok: false,
+        saved: false,
+        message: '复制后条目总数会超过 ' + MAX_ENTRIES + ' 条上限（当前 ' + state.data.entries.length
+          + ' 条，需复制 ' + sourceEntries.length + ' 条）',
+        snapshot: snapshot(),
+      }
+    }
+    const sourceProfiles = state.data.profiles.filter((profile) => profile.setId === id)
+    if (state.data.profiles.length + sourceProfiles.length > MAX_PROFILES) {
+      return { ok: false, saved: false, message: '复制后用户形象总数会超过 ' + MAX_PROFILES + ' 个上限', snapshot: snapshot() }
+    }
+    const newId = makeSetId()
+    const stamp = Date.now()
+    const entries = sourceEntries.map((entry) => ({ ...entry, id: makeId(), setId: newId, updatedAt: stamp }))
+    const profiles = sourceProfiles.map((profile) => ({ ...profile, id: makeId(), setId: newId, updatedAt: stamp }))
+    const saved = await commit(() => {
+      state.data.sets.push({ id: newId, name: wanted })
+      state.data.entries.push(...entries)
+      state.data.profiles.push(...profiles)
+    })
+    return settle('已复制为「' + wanted + '」（' + entries.length + ' 条指令、' + profiles.length + ' 个用户形象）'
+      + '；点击「切换」后才会注入它', saved)
+  })
+
+  /* ---------------- version history (F14) ---------------- */
+
+  /**
+   * The snapshot index, newest first. Names carry the timestamp, revision and
+   * device, so nothing here needs to read a file to sort; counts are read from
+   * the small ones only, so a maximal store cannot make listing expensive.
+   */
+  const HISTORY_INDEX_MAX_BYTES = 1048576
+  const historyList = () => enqueue(async () => {
+    const dir = historyDirPath()
+    let names = []
+    try {
+      names = (await readdir(dir)).filter((name) => HISTORY_FILE_PATTERN.test(name))
+    } catch (err) {
+      // A missing directory is not an error: nothing has been written yet.
+      if (err === null || err === undefined || err.code !== 'ENOENT') {
+        return { ok: false, saved: false, message: '无法读取版本历史目录：' + describeError(err), snapshot: snapshot(), history: { dir, items: [] } }
+      }
+    }
+    const items = []
+    for (const name of names) {
+      const full = join(dir, name)
+      let info = null
+      try {
+        info = await stat(full)
+      } catch {
+        continue
+      }
+      const item = {
+        name,
+        epoch: historyEpochOf(name),
+        rev: historyRevOf(name),
+        device: historyDeviceOf(name),
+        foreign: historyDeviceOf(name) !== DEVICE,
+        bytes: info.size,
+        entries: null,
+        profiles: null,
+        sets: null,
+      }
+      if (info.size <= HISTORY_INDEX_MAX_BYTES) {
+        try {
+          const parsed = JSON.parse(await readFile(full, 'utf8'))
+          item.entries = Array.isArray(parsed.entries) ? parsed.entries.length : 0
+          item.profiles = Array.isArray(parsed.profiles) ? parsed.profiles.length : 0
+          item.sets = Array.isArray(parsed.sets) ? parsed.sets.length : 1
+        } catch {
+          // An unreadable snapshot still lists; restore will report the detail.
+        }
+      }
+      items.push(item)
+    }
+    items.sort((a, b) => (a.name < b.name ? 1 : a.name > b.name ? -1 : 0))
+    state.historyCount = items.length
+    return { ok: true, saved: false, message: null, snapshot: snapshot(), history: { dir, items } }
+  })
+
+  /**
+   * Roll the store back to one snapshot. The snapshot becomes the new CURRENT
+   * state and is written as a new revision (rev only ever moves forward, so a
+   * client holding an older rev is refused rather than silently reverted) —
+   * and, like every other write, it leaves its own snapshot behind, so the
+   * rollback itself can be undone from the history list.
+   */
+  const historyRestore = (name, baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    if (typeof name !== 'string' || !HISTORY_FILE_PATTERN.test(name)) {
+      return { ok: false, saved: false, message: '历史快照名称无效', snapshot: snapshot() }
+    }
+    let parsed = null
+    try {
+      parsed = JSON.parse(await readFile(join(historyDirPath(), name), 'utf8'))
+    } catch (err) {
+      return { ok: false, saved: false, message: '无法读取该历史快照：' + describeError(err), snapshot: snapshot() }
+    }
+    const adopted = adoptParsedStore(parsed)
+    if (adopted.error !== undefined) {
+      return { ok: false, saved: false, message: '该历史快照不是有效的存储文件：' + adopted.error, snapshot: snapshot() }
+    }
+    if (adopted.rejectedVersion !== undefined) {
+      return {
+        ok: false,
+        saved: false,
+        message: '该历史快照为格式版本 ' + adopted.rejectedVersion + '，本插件支持的格式版本为 ' + SUPPORTED_VERSIONS.join(' / ')
+          + '；已拒绝回滚，当前内容未被修改',
+        snapshot: snapshot(),
+      }
+    }
+    const { loaded } = adopted
+    const notes = []
+    const warnings = loadWarnings(loaded)
+    if (warnings !== null) notes.push(warnings)
+    const saved = await commit(() => {
+      loaded.data.rev = state.data.rev || 0
+      loaded.data.backupDir = backupDirOf()
+      state.data = loaded.data
+    })
+    const when = new Date(historyEpochOf(name)).toLocaleString()
+    const head = '已回滚到 ' + when + ' 的快照（快照 rev ' + historyRevOf(name) + '，本次写为新 rev ' + (state.data.rev || 0) + '）：'
+      + describeStoreShape(state.data)
+    return settle([head, ...notes].join('；'), saved)
+  })
+
+  /**
+   * Delete one snapshot. `saved` stays false: the STORE was not written, which
+   * is exactly what the field means everywhere else.
+   */
+  const historyDelete = (name) => enqueue(async () => {
+    if (typeof name !== 'string' || !HISTORY_FILE_PATTERN.test(name)) {
+      return { ok: false, saved: false, message: '历史快照名称无效', snapshot: snapshot() }
+    }
+    try {
+      await unlink(join(historyDirPath(), name))
+    } catch (err) {
+      return { ok: false, saved: false, message: '删除历史快照失败：' + describeError(err), snapshot: snapshot() }
+    }
+    await refreshHistoryCount()
+    return { ok: true, saved: false, message: '已删除该历史快照', snapshot: snapshot() }
+  })
+
   const reload = () => enqueue(async () => {
     // `saved` is only true when the load itself wrote to disk (the
     // backup-promotion or legacy-migration branch); a plain re-read claiming
@@ -1920,6 +3171,18 @@ export function apply(ctx) {
     syncSection()
     return { ok: state.storageError === null, saved: wrote === true, message: state.storageError, snapshot: snapshot() }
   })
+  /**
+   * An export is a BACKUP, so it carries the whole store — every set, with
+   * each item's `setId` — not just the active one (F13). `version` is the
+   * envelope's own version; `data.version` is the store format inside it.
+   */
+  const exportEnvelope = () => ({
+    app: 'dsh-instruction-memory',
+    version: FORMAT_VERSION,
+    exportedAt: new Date().toISOString(),
+    data: persistableData(),
+  })
+
   const exportData = () => enqueue(async () => ({
     ok: true,
     // An export reads the store and never writes it; a truthful `saved:false`
@@ -1928,10 +3191,135 @@ export function apply(ctx) {
     message: null,
     // A self-describing envelope: re-importable by this plugin, and readable
     // as plain JSON by anything else.
-    export: { app: 'dsh-instruction-memory', version: 1, exportedAt: new Date().toISOString(), data: snapshot().data },
+    export: exportEnvelope(),
     snapshot: snapshot(),
   }))
 
+  /**
+   * Write an export straight into the backup directory (F18) — the "land the
+   * backup in my cloud-synced folder" button. The default directory is the
+   * store directory, so this works before a custom location is configured too.
+   */
+  const exportToDir = () => enqueue(async () => {
+    const dir = backupDirOf() !== '' ? backupDirOf() : dirname(storePath)
+    const target = join(dir, exportFileName(Date.now()))
+    try {
+      await mkdir(dir, { recursive: true })
+      await writeFile(target, JSON.stringify(exportEnvelope(), null, 2) + '\n', 'utf8')
+    } catch (err) {
+      return { ok: false, saved: false, message: '写入备份目录失败：' + describeError(err), snapshot: snapshot() }
+    }
+    return { ok: true, saved: false, message: '已写入 ' + target, snapshot: snapshot() }
+  })
+
+  /**
+   * The raw store text for 源码模式 (F16): exactly the bytes a save would write.
+   * Editing it is therefore equivalent to editing memory.json — but it goes
+   * through the same loader, version gate, disclosures and rev check as every
+   * other write instead of being trusted because it came from the UI.
+   */
+  const readSource = () => enqueue(async () => {
+    /**
+     * While the file on disk declares an unsupported version, the in-memory
+     * state is a placeholder (nothing was adopted), so handing it out as "the
+     * source" would show an EMPTY store and invite the user to save it over
+     * their real file. The documented way out of that state is to fix the file
+     * (or upgrade the plugin) and hit 重新载入 — so say that instead.
+     */
+    if (state.versionRejected) {
+      return {
+        ok: false,
+        saved: false,
+        message: '存储文件为不支持的格式版本 ' + state.rejectedVersion + '，源码模式已暂停：请先用编辑器修改 '
+          + storePath + '（或升级插件）后点「重新载入」',
+        snapshot: snapshot(),
+      }
+    }
+    // Opening source mode is a deliberate user action, so it is also allowed to
+    // materialise a first-run store (same rule as the `state` method).
+    const materialized = await ensureStoreMaterialized()
+    return { ok: true, saved: materialized === true, message: null, source: serialize(), snapshot: snapshot() }
+  })
+
+  /**
+   * The shared core of 源码保存 (F16) and 整体替换恢复 (F14): adopt a whole
+   * parsed store and commit it in one transaction, reporting every correction
+   * the loader had to make. Callers add their own opening line.
+   */
+  const commitAdoptedStore = async (parsed, head) => {
+    const adopted = adoptParsedStore(parsed)
+    if (adopted.error !== undefined) {
+      return { ok: false, saved: false, message: adopted.error, snapshot: snapshot() }
+    }
+    if (adopted.rejectedVersion !== undefined) {
+      return {
+        ok: false,
+        saved: false,
+        message: '内容声明为格式版本 ' + adopted.rejectedVersion + '，本插件支持的格式版本为 ' + SUPPORTED_VERSIONS.join(' / ')
+          + '；已拒绝保存，当前内容未被修改',
+        snapshot: snapshot(),
+      }
+    }
+    const { loaded } = adopted
+    const notes = []
+    const warnings = loadWarnings(loaded)
+    if (warnings !== null) notes.push(warnings)
+    const truncation = truncationNotes(parsed)
+    if (truncation !== null) notes.push(truncation)
+    const saved = await commit(() => {
+      // rev only ever moves forward: a restore is a NEW revision of the store,
+      // so a client holding an older one is refused rather than silently
+      // reverted (and `baseRev` conflict handling stays meaningful).
+      loaded.data.rev = state.data.rev || 0
+      loaded.data.backupDir = backupDirOf()
+      state.data = loaded.data
+    })
+    return settle([head + describeStoreShape(state.data), ...notes].join('；'), saved)
+  }
+
+  const writeSource = (text, baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    if (typeof text !== 'string') {
+      return { ok: false, saved: false, message: '源码必须是 JSON 文本', snapshot: snapshot() }
+    }
+    if (text.length > MAX_BODY_CHARS) {
+      return {
+        ok: false,
+        saved: false,
+        message: '源码过长：' + text.length + ' 字符，上限 ' + MAX_BODY_CHARS + ' 字符',
+        snapshot: snapshot(),
+      }
+    }
+    let parsed = null
+    try {
+      parsed = JSON.parse(text)
+    } catch (err) {
+      return { ok: false, saved: false, message: '源码不是有效的 JSON：' + describeError(err), snapshot: snapshot() }
+    }
+    return commitAdoptedStore(parsed, '已按源码保存：')
+  })
+
+  /**
+   * Replace the whole store from a backup file — the "用备份整体替换" door
+   * (F14). Import merges by design and can never restore an older whole-store
+   * state; this is that missing path, and it is explicit: the panel confirms
+   * first, and nothing is unrecoverable (the replaced content stays in
+   * memory.json.bak and, whenever history is writable, in the version list).
+   */
+  const restoreData = (payload, baseRev) => enqueue(async () => {
+    if (state.versionRejected) return versionRefusal()
+    if (isStaleBaseRev(baseRev)) return conflictResponse()
+    if (payload === null || typeof payload !== 'object') {
+      return { ok: false, saved: false, message: '恢复内容不是有效的 JSON 对象', snapshot: snapshot() }
+    }
+    // Accept our own export envelope as well as a bare store object.
+    const inner = payload.data !== null && typeof payload.data === 'object' && !Array.isArray(payload.data)
+      ? payload.data
+      : payload
+    return commitAdoptedStore(inner, '已用备份整体替换当前记忆：')
+  })
+
   const importData = (payload, baseRev) => enqueue(async () => {
     if (state.versionRejected) return versionRefusal()
     if (isStaleBaseRev(baseRev)) return conflictResponse()
@@ -1945,26 +3333,56 @@ export function apply(ctx) {
       : (Array.isArray(inner.entries) ? inner.entries : null)
     const rawProfiles = Array.isArray(payload.profiles) ? payload.profiles
       : (Array.isArray(inner.profiles) ? inner.profiles : null)
+    // Our own export also carries the set list, which is what lets an import
+    // recreate the sets its items belong to instead of dumping everything into
+    // the active one.
+    const rawSets = Array.isArray(payload.sets) ? payload.sets
+      : (Array.isArray(inner.sets) ? inner.sets : null)
     if ((rawEntries === null || rawEntries.length === 0)
       && (rawProfiles === null || rawProfiles.length === 0)) {
       return { ok: false, saved: false, message: '导入文件中没有找到条目或用户形象', snapshot: snapshot() }
     }
+    /**
+     * Set mapping (F13). An imported item is filed under the set it names when
+     * that set already exists here, or when the payload DECLARES it (our own
+     * export carries the sets array) and there is room to create it. Anything
+     * else lands in the active set, and how many did so is disclosed — the
+     * alternative, dropping items whose set is unknown, would be data loss.
+     */
+    const localSetIds = new Set(state.data.sets.map((set) => set.id))
+    const declaredSets = []
+    const declaredIds = new Set()
+    for (const candidate of (Array.isArray(rawSets) ? rawSets : [])) {
+      const set = sanitizeSet(candidate)
+      if (set === null || localSetIds.has(set.id) || declaredIds.has(set.id)) continue
+      declaredIds.add(set.id)
+      declaredSets.push(set)
+    }
+    const activeId = state.data.activeSetId
     // Merge, never replace: importing must not be able to wipe what is here.
-    // Duplicates (same id, or same title+content) and invalid items are
-    // skipped and counted, not silently dropped.
+    // Duplicates (same id within the same set, or same title+content within the
+    // same set) and invalid items are skipped and counted, not silently
+    // dropped. De-duplicating per set is what makes re-importing idempotent
+    // while still allowing the same instruction to exist in two sets.
     //
     // The whole plan is computed BEFORE the store is touched, so the merge and
     // its counters cannot disagree with what actually gets appended.
     const existing = state.data.entries
-    const seenIds = new Set(existing.map((entry) => entry.id))
-    const seenBodies = new Set(existing.map((entry) => entry.title + '\u0000' + entry.content))
+    const bodyKey = (setId, title, content) => setId + '\u0000' + title + '\u0000' + content
+    const seenIds = new Set(existing.map((entry) => entry.setId + '\u0000' + entry.id))
+    const seenBodies = new Set(existing.map((entry) => bodyKey(entry.setId, entry.title, entry.content)))
     const accepted = []
     const cutFields = new Set()
     let truncatedCount = 0
     let skipped = 0
     for (const candidate of (rawEntries || [])) {
       const entry = sanitizeEntry(candidate)
-      if (entry === null || seenIds.has(entry.id) || seenBodies.has(entry.title + '\u0000' + entry.content)) {
+      if (entry === null) {
+        skipped += 1
+        continue
+      }
+      const wanted = entry.setId !== '' ? entry.setId : activeId
+      if (seenIds.has(wanted + '\u0000' + entry.id) || seenBodies.has(bodyKey(wanted, entry.title, entry.content))) {
         skipped += 1
         continue
       }
@@ -1982,25 +3400,29 @@ export function apply(ctx) {
         for (const field of cut) cutFields.add(field)
       }
       entry.updatedAt = Date.now()
-      accepted.push(entry)
-      seenIds.add(entry.id)
-      seenBodies.add(entry.title + '\u0000' + entry.content)
+      accepted.push({ entry, wanted })
+      seenIds.add(wanted + '\u0000' + entry.id)
+      seenBodies.add(bodyKey(wanted, entry.title, entry.content))
     }
     // Persona profiles merge under the same rules (same id, or same
     // name+content) in the SAME transaction, so a mixed import never lands
     // half-way.
     const existingProfiles = state.data.profiles
-    const seenProfileIds = new Set(existingProfiles.map((profile) => profile.id))
-    const seenProfileBodies = new Set(existingProfiles.map((profile) => profile.name + '\u0000' + profile.content))
+    const seenProfileIds = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.id))
+    const seenProfileBodies = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.name + '\u0000' + profile.content))
     const acceptedProfiles = []
     const cutProfileFields = new Set()
     let truncatedProfileCount = 0
     let skippedProfiles = 0
     for (const candidate of (rawProfiles || [])) {
       const profile = sanitizeProfile(candidate)
-      if (profile === null
-        || seenProfileIds.has(profile.id)
-        || seenProfileBodies.has(profile.name + '\u0000' + profile.content)) {
+      if (profile === null) {
+        skippedProfiles += 1
+        continue
+      }
+      const wanted = profile.setId !== '' ? profile.setId : activeId
+      if (seenProfileIds.has(wanted + '\u0000' + profile.id)
+        || seenProfileBodies.has(wanted + '\u0000' + profile.name + '\u0000' + profile.content)) {
         skippedProfiles += 1
         continue
       }
@@ -2014,25 +3436,121 @@ export function apply(ctx) {
         for (const field of cut) cutProfileFields.add(field)
       }
       profile.updatedAt = Date.now()
-      acceptedProfiles.push(profile)
-      seenProfileIds.add(profile.id)
-      seenProfileBodies.add(profile.name + '\u0000' + profile.content)
+      acceptedProfiles.push({ profile, wanted })
+      seenProfileIds.add(wanted + '\u0000' + profile.id)
+      seenProfileBodies.add(wanted + '\u0000' + profile.name + '\u0000' + profile.content)
+    }
+    // Create only the declared sets that the accepted items actually reference,
+    // in declaration order, while there is room.
+    const wantedIds = []
+    for (const item of [...accepted, ...acceptedProfiles]) {
+      if (!localSetIds.has(item.wanted) && !wantedIds.includes(item.wanted)) wantedIds.push(item.wanted)
+    }
+    const createdSets = []
+    const createdIds = new Set()
+    for (const id of wantedIds) {
+      if (state.data.sets.length + createdSets.length >= MAX_SETS) break
+      const declared = declaredSets.find((set) => set.id === id)
+      if (declared === undefined) continue
+      createdSets.push({ id: declared.id, name: declared.name })
+      createdIds.add(declared.id)
     }
-    if (accepted.length === 0 && acceptedProfiles.length === 0) {
+    let fellBack = 0
+    const finalIdOf = (wanted) => (localSetIds.has(wanted) || createdIds.has(wanted) ? wanted : activeId)
+    /**
+     * Fallback de-duplication (review fix). The plan phase de-duplicated
+     * against the set each item DECLARED, but finalIdOf() may retarget an item
+     * into the active set (its set is unknown here, or the MAX_SETS cap blocked
+     * creating it). Every retargeted item is therefore re-checked against the
+     * set it REALLY lands in — pre-existing content, same-batch items already
+     * staged there, and same-batch items that reached it through the normal
+     * path — before anything is appended. The normal path (set exists or was
+     * created) keeps the plan-phase decision untouched, which is what keeps
+     * re-importing the same export file a no-op.
+     */
+    const stagedEntries = []
+    const stagedProfiles = []
+    let dedupedOnFallback = 0
+    {
+      const finalSeenIds = new Set(existing.map((entry) => entry.setId + '\u0000' + entry.id))
+      const finalSeenBodies = new Set(existing.map((entry) => bodyKey(entry.setId, entry.title, entry.content)))
+      // Items the plan phase accepted under their declared set occupy that
+      // set's id/body space even when the item itself later falls back (a
+      // fallback item's declared set is neither local nor created, so the keys
+      // never collide with these — they only guard the normal path).
+      for (const item of accepted) {
+        finalSeenIds.add(item.wanted + '\u0000' + item.entry.id)
+        finalSeenBodies.add(bodyKey(item.wanted, item.entry.title, item.entry.content))
+      }
+      for (const item of accepted) {
+        const finalId = finalIdOf(item.wanted)
+        if (finalId !== item.wanted) {
+          if (finalSeenBodies.has(bodyKey(finalId, item.entry.title, item.entry.content))) {
+            dedupedOnFallback += 1
+            continue
+          }
+          if (finalSeenIds.has(finalId + '\u0000' + item.entry.id)) {
+            // The body is new to the fallback target but the id is taken
+            // there: re-mint instead of writing a duplicate id into one set.
+            item.entry.id = makeId()
+          }
+          fellBack += 1
+          finalSeenIds.add(finalId + '\u0000' + item.entry.id)
+          finalSeenBodies.add(bodyKey(finalId, item.entry.title, item.entry.content))
+        }
+        item.entry.setId = finalId
+        stagedEntries.push(item.entry)
+      }
+      const finalSeenProfileIds = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.id))
+      const finalSeenProfileBodies = new Set(existingProfiles.map((profile) => profile.setId + '\u0000' + profile.name + '\u0000' + profile.content))
+      for (const item of acceptedProfiles) {
+        finalSeenProfileIds.add(item.wanted + '\u0000' + item.profile.id)
+        finalSeenProfileBodies.add(item.wanted + '\u0000' + item.profile.name + '\u0000' + item.profile.content)
+      }
+      for (const item of acceptedProfiles) {
+        const finalId = finalIdOf(item.wanted)
+        if (finalId !== item.wanted) {
+          if (finalSeenProfileBodies.has(finalId + '\u0000' + item.profile.name + '\u0000' + item.profile.content)) {
+            dedupedOnFallback += 1
+            continue
+          }
+          if (finalSeenProfileIds.has(finalId + '\u0000' + item.profile.id)) {
+            item.profile.id = makeId()
+          }
+          fellBack += 1
+          finalSeenProfileIds.add(finalId + '\u0000' + item.profile.id)
+          finalSeenProfileBodies.add(finalId + '\u0000' + item.profile.name + '\u0000' + item.profile.content)
+        }
+        item.profile.setId = finalId
+        stagedProfiles.push(item.profile)
+      }
+    }
+    if (stagedEntries.length === 0 && stagedProfiles.length === 0) {
       // Nothing was written to disk, so claiming saved:true would be a lie the
       // panel cannot distinguish from a real save.
       return {
         ok: true,
         saved: false,
-        message: '没有新增内容：' + skipped + ' 条条目、' + skippedProfiles + ' 个用户形象已存在或无效',
+        message: '没有新增内容：' + skipped + ' 条条目、' + skippedProfiles + ' 个用户形象已存在或无效'
+          + (dedupedOnFallback > 0 ? '；另有 ' + dedupedOnFallback + ' 项因回退到当前配置集后与已有内容重复被跳过' : ''),
         snapshot: snapshot(),
       }
     }
     const saved = await commit(() => {
-      state.data.entries.push(...accepted)
-      state.data.profiles.push(...acceptedProfiles)
+      state.data.sets.push(...createdSets)
+      for (const entry of stagedEntries) state.data.entries.push(entry)
+      for (const profile of stagedProfiles) state.data.profiles.push(profile)
     })
     const parts = []
+    if (createdSets.length > 0) {
+      parts.push('新建配置集 ' + createdSets.length + ' 个（' + createdSets.map((set) => '「' + set.name + '」').join('、') + '）')
+    }
+    if (fellBack > 0) {
+      parts.push('有 ' + fellBack + ' 项因原配置集不存在或已达 ' + MAX_SETS + ' 个上限，已归入当前配置集')
+    }
+    if (dedupedOnFallback > 0) {
+      parts.push('另有 ' + dedupedOnFallback + ' 项因回退到当前配置集后与已有内容重复被跳过')
+    }
     if (accepted.length > 0) {
       const truncated = truncatedCount > 0
         ? '；其中 ' + truncatedCount + ' 条超过长度上限，' + [...cutFields].join('、') + '已被截断'
@@ -2078,6 +3596,43 @@ export function apply(ctx) {
           args !== null && typeof args === 'object' ? args.baseRev : undefined)
       case 'set-options':
         return setOptions(args, args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'save-set':
+        return saveSet(
+          args !== null && typeof args === 'object' ? args.set : null,
+          args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'delete-set':
+        return deleteSet(
+          args !== null && typeof args === 'object' && typeof args.id === 'string' ? args.id : '',
+          args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'set-active-set':
+        return setActiveSet(
+          args !== null && typeof args === 'object' && typeof args.id === 'string' ? args.id : '',
+          args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'duplicate-set':
+        return duplicateSet(
+          args !== null && typeof args === 'object' && typeof args.id === 'string' ? args.id : '',
+          args !== null && typeof args === 'object' ? args.name : undefined,
+          args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'history-list':
+        return historyList()
+      case 'history-restore':
+        return historyRestore(
+          args !== null && typeof args === 'object' && typeof args.name === 'string' ? args.name : '',
+          args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'history-delete':
+        return historyDelete(args !== null && typeof args === 'object' && typeof args.name === 'string' ? args.name : '')
+      case 'read-source':
+        return readSource()
+      case 'write-source':
+        return writeSource(
+          args !== null && typeof args === 'object' ? args.text : null,
+          args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'restore-data':
+        return restoreData(
+          args !== null && typeof args === 'object' ? args.payload : null,
+          args !== null && typeof args === 'object' ? args.baseRev : undefined)
+      case 'export-to-dir':
+        return exportToDir()
       case 'reload':
         return reload()
       case 'export-data':
@@ -2107,11 +3662,8 @@ export function apply(ctx) {
 
   /* ---------------- same-origin JSON route for the Client half ---------------- */
 
-  // Which Host values this route accepts. Set when the route is registered,
-  // from the address the web server is actually bound to (see the long note on
-  // requestOriginVerdict). Until then the route does not exist at all, so the
-  // default only matters if something registers it out of band.
-  let guardHost = true
+  // `guardHost` is declared next to `state` (F12 publishes it as
+  // `security.hostGuarded`); only `routeDispose` lives here.
 
   let routeDispose = null
 
@@ -2286,6 +3838,9 @@ export function apply(ctx) {
     // the README.
     const boundHost = typeof webServer.host === 'string' ? webServer.host.trim().toLowerCase() : ''
     guardHost = boundHost === '' || isLoopbackName(boundHost)
+    // F12: the settings page can only warn about a non-loopback bind if the
+    // snapshot carries what the route actually saw at registration time.
+    state.boundHost = boundHost
     try {
       routeDispose = webServer.register({ kind: 'prefix', path: API_PREFIX, handler })
       logDebug('settings route registered at ' + API_PREFIX + ' (boundHost=' + boundHost + ', hostGuard=' + guardHost + ')')