dsh-instruction-memory 1.5.0 → 1.5.2

package/CHANGELOG.md

@@ -7,6 +7,92 @@
 > 1.0.13 起由 CI 经 OIDC Trusted Publishing 发布（首个带 provenance 的版本）。
 > 这些历史 tag **不应回填**——npm 上的版本号已被占用。
 
+## [1.5.2] — 2026-11-09
+
+针对 2026-11-09 的代码审查（Host 侧与 Client 侧并行只读审查，逐条复核后落地）。本版**没有新增功能、
+没有格式变更**：存储文件、注入文本与面板行为在正常路径上与 1.5.1 逐字节一致，改的是一条静默失效的
+降级路径、一条失效的乱序保护，以及几处可以量化的重复 I/O 与空转渲染。
+
+### 修复
+
+- **watcher 降级把轮询器一起杀掉了（P0）**：`storeWatcher.on('error')` 的日志写的是「falling back to
+  the 5s poller」，紧接着却调用 `stopWatching()` —— 而该函数同时 `clearInterval(storePoll)`。于是
+  `fs.watch` 一旦报错（被监视目录被删或 rename、Windows 目录句柄失效、inotify 句柄耗尽），**watcher
+  与轮询器双双消失**，外部改动检测彻底静默，直到本进程下一次保存成功才重新装回。期间手改
+  `memory.json`、或另一个 DSH 进程保存，本窗口会一直显示旧数据，而面板没有任何提示。现在错误分支
+  只关闭 watcher 并显式 `startPolling()`（幂等），注释所承诺的降级才真的发生。
+- **SSE 乱序快照保护在推送路径上失效（P1）**：`absorb()` 用渲染作用域的 `view` 判定「到来的快照是否
+  比已在屏上的更旧」，但 SSE effect 的依赖是空数组，它捕获的是**首渲染**那份 `absorb`，其闭包里的
+  `view` 恒为 `null`，`currentRev` 永远是 `undefined` —— 于是注释点名的「SSE 触发刷新与 POST 回包
+  竞争」恰恰是唯一没被保护的那条路径。现在改读 `viewRef.current`（面板一直在维护它）。
+
+### 性能与加固（不改变外部行为）
+
+- **一次保存不再整读同一个文件三次（P1）**：`writeToDisk()` 在跨进程锁内依次 `readDiskRev()`、
+  再一次 `readDiskRev()`、再 `readStoreFile()`，只为拿磁盘 rev（两次结果必然相同，锁在自己手上）
+  与 `.bak` 的形状判定。现在一次读取同时供两处使用，`diskReadError` 保留原有 `ENOENT` / 空文件 /
+  非本插件存储三条分支的语义。极限存储（200 条 × 6000 字 ≈ 3.4 MB）下每次保存少约 10 MB 读取与
+  2 次整文件 `JSON.parse`，并缩短了锁的持有时间。
+- **事件流加上心跳与背压（P2）**：原来的 `send` 丢弃 `res.write()` 的返回值，清理只依赖
+  `close`/`error` 事件。客户端崩溃或休眠（没有 FIN）时条目不会被移除，积满 `MAX_SSE_STREAMS=32`
+  后所有新订阅者都被 503 拒绝，面板实时同步失效直到重启宿主；慢客户端还会让极限 3.4 MB 的全量帧
+  在 socket 缓冲里无界堆积。现在 25 秒共享心跳（`: ping` 注释帧，SSE 客户端按规范忽略）逐个探测，
+  `write()` 返回 `false` 即清理该流；`pushSnapshot` 同样按返回值清理。
+- **暂停倒计时不再空转重渲染整个面板（P2）**：`nowTick` 每秒写一次 state，但全文没有任何地方读取它
+  （剩余时间在渲染时用 `Date.now()` 现算）——每秒重跑并 diff 约 3000 个 vnode，只为让一行文字变化。
+  现在倒计时抽成 `MuteCountdown` 子组件，自带 1s tick，且只在归零时回调一次（SSE 已断、宿主不再推
+  快照时，暂停条也能自行退场）。
+- **列表派生计算记忆化（P2）**：排序、标签索引、筛选、关键词扫描与「按需预演」打分原先全部裸写在
+  渲染体里，每次按键或勾选一条都要重排 200 条并对全部正文重复小写化。现在收进 `deriveListState()`
+  并由 `useStableMemo()` 按（快照, UI 状态）缓存；预演只在展开时才打分（收起后不再扫全库）。
+  `useStableMemo` 建在 `useRef` 上而不是 `useMemo` 上，因为 ui-test 里那套迷你 React 只实现了
+  `useState`/`useEffect`/`useRef` —— 这样测试与生产走同一条代码路径，而不是为了测试加分支。
+
+### 验收
+
+- 全套 7 个套件（lint / host-range / smoke / contract / verify / feedback / ui）与
+  `node check-metadata.mjs` 全绿；`lib/` 13 个文件全部 PARSE 且无宿主包名导入。
+- **未做的验证（明确记录）**：watcher 故障注入没有做成真机测试——`storeWatcher` 是闭包内变量，
+  无法从外部触发 `error`，Windows 上删除被监视目录只会产生 `rename` 事件。第一条的保证来自
+  「`stopWatching()` 现在只剩插件卸载一处调用点」这一结构性证明，不是行为测试。
+
+## [1.5.1] — 2026-11-05
+
+针对 2026-11-05 桌面端 / 网页端复核（架构 / 安全 / 验收三方）的 P1–P3 逐项修复。运行时在
+`0.2.1-rc.5` 与 `0.2.2-rc.1` 上都没有 blocker；这一版修的是**守卫的边界**和**验证工具链本身**。
+
+### 修复
+
+- **写入根（P2）**：`backupDir` 的子树的规则此前只在「设置页」与「导出」两处执行，保存路径
+  （`.bak` 与历史快照）没有——一个手改的、指向 `$DSH_HOME` 之外的 `backupDir`，会在下一次保存时
+  在外目录里留下 `memory.json.bak` 与 `history/*.json`，与 README 的承诺直接矛盾。现在两处写盘
+  路径都过同一条判断，越界值被忽略并在面板披露，备份与快照写回默认位置。
+- **鉴权门对未知形状 fail-open（P3）**：`requestRejection()` 过去只在返回**数字 ≥400** 时拒绝，
+  其余一律当作通过。宿主今天只返回 `undefined | 401 | 403`，所以不可利用；但这是没写进契约的
+  假设。现在 `undefined/null/false` 才算通过，其余（对象、字符串、Error）一律按 401 拒绝并记日志。
+- **版本号类型误导（P3）**：`{"version":"2"}` 会报「声明为格式版本 2，本插件支持的格式版本为 1 / 2」
+  ——自相矛盾。现在按类型区分：非数字版本报「version 字段类型不正确：必须是数字，当前是 "2"」。
+- **拒绝文案泄露绝对路径（P3）**：备份/导出越界的提示里回的是未折叠的 `$DSH_HOME`，现改用
+  与快照一致的 `displayPath()`。
+- **可信主机名不提供认证这件事写进文档与面板（P2）**：README 该节加了醒目说明，快照新增
+  `security.trustedHostCount`；当「非回环绑定 + 无鉴权门 + 配了可信主机名」三者同时成立时，
+  面板显示专门的橙色警告（只放宽主机名校验，不认证任何人）。
+- **`install.mjs` 的优先级写错了（P3）**：注释曾写「profile 由 `$DSH_HOME` 决定」，实际是
+  `$DSH_PROFILE_DIR` > `--profile` > `$DSH_PROFILE` > `web`（`$DSH_HOME` 只决定 profiles 根）。
+  DSH 会把前两个变量导出给子进程，因此"只设了 `DSH_HOME`"的安装会落进**正在运行的 profile**；
+  现在两者不一致时脚本会先打印警告再动手。
+
+### 验收工具链（P1）
+
+- **两条 L3 活体验证脚本在带鉴权门的宿主上已经失效**：`compat-1016-live-check.mjs` 把启动 token
+  只拼在 SSE 的 URL 上、`live-host-smoke.mjs` 完全没有鉴权代码，于是在任何真实宿主上得到
+  **2/20 PASS、18 FAIL** 与「HTTP 401 无法连接」。现在两者都先 `GET /?token=` 换会话 cookie
+  （与 GUI 完全相同的换法），`live-host-smoke.mjs` 新增 `--token <启动 token>`，
+  `compat-1016-live-check.mjs` 的第四个参数即 token。
+- 新增 10 条回归断言：写入根（3 条，含负向对照——把判断退回旧行为时外部目录确实多出
+  `history/` 与 `memory.json.bak`）、版本类型（3 条）、鉴权门形状（4 条：对象/字符串/Error 一律
+  401，`undefined` 仍放行）。全套 7 个套件、lint 13 个文件全绿。
+
 ## [1.5.0] — 2026-11-04
 
 针对 2026-11-04 全面复核（数据安全 / 并发 / 注入 / SMTP / 设置面板）逐项修复。主线是

package/README.md

@@ -66,7 +66,7 @@ profile 的解析顺序是 **`$DSH_PROFILE_DIR` → `--profile <名字>` → `$D
 | `smoke-test.mjs` | 注入渲染逻辑的单元测试（含「只渲染激活配置集」的隔离断言与 cwd 红线） |
 | `host-range-test.mjs` | 宿主版本范围契约测试：固定矩阵 × 两种 semver 判定模式，并把 `peerDependencies`（**被执行的那个**）、`dsh.engines.dsh`、`dsh.compatibility.dsh` 三处声明锁到同一个生成值 |
 | `lint.mjs` | 静态门禁，已并入 `npm test`：`node --check` 解析所有随包发布与本仓库运行的 JS 文件，并断言 `lib/` 里不出现 `@deepseek-ai/*` 的包名导入（插件只该通过宿主传进来的上下文对象接触宿主，按包名 import 会把插件钉死在某个安装位置，在 headless / CI / 检出目录里直接解析失败） |
-| `live-host-smoke.mjs` | 双端冒烟：对**正在运行**的 web / 桌面宿主各测 `state` p50/p95、SSE 首事件、注入注册与字符数，并比对两端快照（除 `injection.pulls` 外须逐字段相同）；`npm run smoke:hosts`，`--require-pulls` 可把「从未经历真实 Agent 回合」判为失败。**刻意不进 `npm test`**——CI 没有桌面端。请求走 Node `http` 直连，绕开 `http_proxy`（否则回环请求也会被代理转发，读数虚高） |
+| `live-host-smoke.mjs` | 双端冒烟（**1.4.8 起宿主有鉴权门，需 `--token <启动 token>` 换会话 cookie**，否则全 401）：对**正在运行**的 web / 桌面宿主各测 `state` p50/p95、SSE 首事件、注入注册与字符数，并比对两端快照（除 `injection.pulls` 外须逐字段相同）；`npm run smoke:hosts`，`--require-pulls` 可把「从未经历真实 Agent 回合」判为失败。**刻意不进 `npm test`**——CI 没有桌面端。请求走 Node `http` 直连，绕开 `http_proxy`（否则回环请求也会被代理转发，读数虚高） |
 | `docs/demo.html` | 离线演示页：桩掉 DSH 外壳、加载真实 Client 半渲染设置页（不随 npm 包发布） |
 | `memory.schema.json` | 手改存储文件用的 JSON Schema（随包发布，并被宿主复制到 `memory.json` 旁边） |
 
@@ -362,6 +362,9 @@ DSH 就会得到第二份空记忆，看起来像"记忆消失"。相对的 `$DS
   把这些设置放在别的盘（比如 Windows 上的 D:）就得显式打开：
   `DSH_INSTRUCTION_MEMORY_ALLOW_EXTERNAL_BACKUP=1`（重启宿主生效）。导出目录受同一条限制；
   手改存储文件把 `backupDir` 指到外面也同样被拒——这条路不能变成创建任意目录的通道。
+  这条规则在**写入时**也执行，不只在校验时：设置页、导出、以及每次保存附带的 `.bak` 与历史
+  快照都走同一个判断（1.5.1 起）。检测到越界的外来 `backupDir` 会被忽略并**在面板上披露**，
+  备份与快照写回默认位置，而不是在外目录里悄悄留下文件。
 - **导出有 2 秒节流**：两次「导出到备份目录」之间要隔 2 秒，否则提示"还需等几秒"。导出写的是
   整份存储（满配约 1.2 M 字符），连点不该变成写放大。
 - 报错文本会折叠路径：自定义备份目录 → `<备份目录>`（云盘路径常带账号名）、记忆目录 →
@@ -638,6 +641,11 @@ DNS 重绑定恰好推翻了它**：`evil.com` 解析到 `127.0.0.1` 之后，
 
 ### 可信主机名（`DSH_INSTRUCTION_MEMORY_TRUSTED_HOSTS`）
 
+> ⚠️ 这一项**只放宽主机名校验，不提供任何身份认证**。在没有宿主 `connection` 服务的 profile
+> 上，如果一个反代把请求转成"合法主机名"，这条路由就是无登录可读写的。面板在该组合
+> （`security.hostGuarded=false`、`security.authFence=false`、`trustedHostCount>0`）下会显示
+> 专门的橙色警告；对外发布请改用隧道，或在代理层自己做认证。
+
 回环绑定下 `Host` 必须是回环名。若你的访问方式让浏览器发出的 `Host` 不是 `127.0.0.1` /
 `localhost` / `[::1]`——`hosts` 里把 `dsh.lan` 指向 127.0.0.1、Tailscale 的 MagicDNS 名、
 或隧道把域名透传进来——可以在启动宿主的环境里显式放行（**仅在没有 `connection` 服务的
@@ -843,7 +851,8 @@ DSH Go（Android 客户端）内置的引擎就是**真实 DSH**，锁定 `@deep
 `HOME` 对引擎无效**，别按字面读 `DshProcess.kt`。
 
 - **兼容性**：`0.2.1-rc.4` 正好是上表①档已实测的版本。2026-10-31 又用同一个 rc.4 在隔离的
-  `DSH_HOME` 上复跑一遍 **21/21**（`compat-1016-live-check.mjs`），注入实测
+  `DSH_HOME` 上复跑一遍 **21/21**（`compat-1016-live-check.mjs`；1.5.1 起该脚本第四个参数给启动
+  token 时会先 `GET /?token=` 换会话 cookie，不再在带鉴权门的宿主上假失败），注入实测
   `chars=292 / budget=4000`、`state` p95 1.09 ms、SSE 首帧 0.71 ms；证据
   `dsh-memory-verification/out/compat-1016-live-rc4-audit.json`。
 - **数据位置**：`/root/.dsh/instruction-memory/memory.json`，在 App 私有目录的 rootfs 内，

package/install.mjs

@@ -5,10 +5,16 @@
  *   node install.mjs --profile superagent     # install into a named profile
  *   node install.mjs --remove                 # roll back completely
  *
- * The profile is resolved in the same order the boot uses:
- * $DSH_PROFILE_DIR (a path), then --profile <name>, then $DSH_PROFILE, then
- * 'web'. A profile that holds no package.json is refused before anything is
- * written, and the profiles that do exist are listed.
+ * The profile is resolved in this order: $DSH_PROFILE_DIR (a path), then
+ * --profile <name>, then $DSH_PROFILE, then 'web' UNDER $DSH_HOME. Note which
+ * variable decides what: $DSH_HOME moves the profiles ROOT, while the name
+ * comes from $DSH_PROFILE_DIR / --profile / $DSH_PROFILE. A DSH that spawned
+ * this shell exports both, so $DSH_PROFILE_DIR wins over the home you just
+ * set — the script warns when the two disagree instead of silently writing
+ * into the live profile.
+ *
+ * A profile that holds no package.json is refused before anything is written,
+ * and the profiles that do exist are listed.
  *
  * Three idempotent steps:
  *   1. make the package resolvable from the profile's node_modules (junction)
@@ -38,6 +44,11 @@ const DSH_HOME = typeof process.env.DSH_HOME === 'string' && process.env.DSH_HOM
 
 // Which profile to install into.
 //
+// $DSH_HOME only moves the profiles ROOT. The NAME comes from the variables
+// below, and DSH exports both to every child process — so a shell that merely
+// sets DSH_HOME to a scratch directory still installs into $DSH_PROFILE_DIR
+// (the live profile). That mismatch is announced rather than silently obeyed.
+//
 // This used to be hardcoded to 'web'. On a machine whose DSH runs the
 // `superagent` profile the script created a junction and a bundle entry inside
 // a profile nothing loads, then printed INSTALLED — the plugin looked installed
@@ -79,6 +90,16 @@ const profileName = profileNameFromArgv()
   ?? 'web'
 const PROF = explicitProfileDir ?? join(PROFILES_ROOT, profileName)
 
+// A DSH that spawned this shell exports BOTH DSH_HOME and DSH_PROFILE_DIR.
+// Setting only DSH_HOME therefore does not redirect the install: the explicit
+// profile directory still wins, and the write lands in the live profile. Say
+// so BEFORE it happens rather than after.
+if (explicitProfileDir !== null && !explicitProfileDir.startsWith(DSH_HOME)) {
+  console.error('warning: DSH_PROFILE_DIR (' + explicitProfileDir + ') is not inside DSH_HOME (' + DSH_HOME + ')')
+  console.error('  the explicit profile directory wins, so this install goes to the profile above,')
+  console.error('  not to the home you may have just set. Unset DSH_PROFILE_DIR to use DSH_HOME.')
+}
+
 /** Profile directories that actually hold a manifest, for the failure message. */
 function visibleProfiles() {
   try {

package/lib/client.js

@@ -419,6 +419,7 @@ window.__ModuleLoader__.load({
         'diag.copyManual': '自动复制不可用；请手动全选复制下方文本。',
         'diag.hostWarn': '安全提示：设置路由当前绑定在非回环地址（{host}），同一网络内的设备可以无鉴权访问此页面，请勿在不可信网络暴露；如需对外发布，请阅读 README 的「经反向代理对外发布」。',
         'diag.hostWarnFence': '安全提示：设置路由当前绑定在非回环地址（{host}），但宿主鉴权门已挂载——访问仍需登录 DSH 后的浏览器会话，未登录请求会被 401/403 拒绝；仍建议只在可信网络暴露。',
+        'diag.hostWarnTrusted': '安全提示：设置路由绑定在非回环地址（{host}），且宿主没有发布鉴权服务；当前唯一放行条件是你配置的 {count} 个可信主机名——那只放宽主机名校验，不提供任何身份认证。请仅在可信网络暴露，或改用隧道方案。',
         'diag.groupStorage': '存储',
         'diag.groupInjection': '注入',
         'diag.groupBackup': '备份与历史',
@@ -706,6 +707,7 @@ window.__ModuleLoader__.load({
         'diag.copyManual': 'Automatic copy is unavailable; select and copy the text below manually.',
         'diag.hostWarn': 'Security notice: the settings route is bound to a non-loopback address ({host}); other devices on the same network can reach this page without authentication. Do not expose it on an untrusted network — for public deployments read “Publishing behind a reverse proxy” in the README.',
         'diag.hostWarnFence': 'Security notice: the settings route is bound to a non-loopback address ({host}), but the host authentication fence is attached — access still requires a signed-in DSH browser session, and unauthenticated requests are refused with 401/403. Keep it on a trusted network anyway.',
+        'diag.hostWarnTrusted': 'Security notice: the settings route is bound to a non-loopback address ({host}) and the host publishes no authentication service; the only thing letting requests in is your {count} trusted hostname(s) — that relaxes a hostname check, it does not authenticate anyone. Keep it on a trusted network or use a tunnel.',
         'diag.groupStorage': 'Storage',
         'diag.groupInjection': 'Injection',
         'diag.groupBackup': 'Backup & history',
@@ -1176,8 +1178,8 @@ window.__ModuleLoader__.load({
       if (snapshot === null || typeof snapshot !== 'object' || Array.isArray(snapshot)) return null
       const data = snapshot.data
       if (data === undefined || data === null || typeof data !== 'object' || Array.isArray(data)) return null
-      // Every consumer reads data.entries and sortEntries() calls .slice() on
-      // it; a non-array threw mid-render instead of surfacing a readable error.
+      // Every consumer reads data.entries and deriveListState() slices it; a
+      // non-array threw mid-render instead of surfacing a readable error.
       if (!Array.isArray(data.entries)) return null
       return {
         snapshot,
@@ -1467,6 +1469,127 @@ window.__ModuleLoader__.load({
       return { terms, results, autoTotal }
     }
 
+    /**
+     * A useMemo equivalent built on useRef.
+     *
+     * This module runs against two React instances: the real one inside the DSH
+     * web shell, and the minimal stand-in ui-test.mjs drives the panel with,
+     * which implements useState / useEffect / useRef only. useMemo is absent
+     * there, so the memo is written against useRef — which both provide — with
+     * the same reference-comparison semantics, rather than a test-only branch
+     * that would leave the shipped path unexercised.
+     *
+     * @param {Array} deps
+     * @param {() => any} compute
+     * @returns {any} the cached value
+     */
+    function useStableMemo(deps, compute) {
+      const box = React.useRef(null)
+      const previous = box.current
+      let fresh = previous === null || previous.deps.length !== deps.length
+      if (!fresh) {
+        for (let i = 0; i < deps.length; i += 1) {
+          if (previous.deps[i] !== deps[i]) {
+            fresh = true
+            break
+          }
+        }
+      }
+      if (fresh) box.current = { deps, value: compute() }
+      return box.current.value
+    }
+
+    /**
+     * Sort, filter and index the entry list ONCE per (snapshot, UI state).
+     *
+     * All of this used to run inline in the panel's render body, so a keystroke
+     * in the search box or a single checkbox toggle re-sorted up to 200 entries
+     * and re-lowered every title/body/scenario to scan for the keyword. None of
+     * it is expensive on its own; the cost was paying it on every unrelated
+     * render. The lower-cased haystack is built per entry, not per keystroke,
+     * and the on-demand preview only scores while its panel is open.
+     *
+     * @param {{entries: Array, sortKey: string, tagFilter: string, modeFilter: string,
+     *   statusFilter: string, query: string, simQuery: string, simOpen: boolean}} input
+     * @returns {{entries: Array, allTags: string[], visible: Array,
+     *   autoEntries: Array, sim: {terms: string[], results: Array, autoTotal: number}}}
+     */
+    function deriveListState(input) {
+      const source = Array.isArray(input.entries) ? input.entries : []
+      const copy = source.slice()
+      if (input.sortKey === 'updated') {
+        copy.sort((a, b) => (b.updatedAt - a.updatedAt) || (b.priority - a.priority))
+      } else if (input.sortKey === 'title') {
+        copy.sort((a, b) =>
+          a.title.localeCompare(b.title, undefined, { sensitivity: 'base' })
+          || (b.priority - a.priority)
+          || (b.updatedAt - a.updatedAt))
+      } else {
+        copy.sort((a, b) => (b.priority - a.priority) || (b.updatedAt - a.updatedAt))
+      }
+      const tagCounts = new Map()
+      const haystack = new Map()
+      for (const entry of source) {
+        const tags = Array.isArray(entry.tags) ? entry.tags : []
+        for (const tag of tags) {
+          if (typeof tag === 'string' && tag !== '') tagCounts.set(tag, (tagCounts.get(tag) || 0) + 1)
+        }
+        haystack.set(entry, [
+          typeof entry.title === 'string' ? entry.title : '',
+          typeof entry.content === 'string' ? entry.content : '',
+          typeof entry.when === 'string' ? entry.when : '',
+          tags.join(' '),
+        ].join(' ').toLowerCase())
+      }
+      const allTags = [...tagCounts.entries()]
+        .sort((a, b) => (b[1] - a[1]) || a[0].localeCompare(b[0], undefined, { sensitivity: 'base' }))
+        .map(([tag]) => tag)
+      // Same predicate order as the inline version: filters first, then the
+      // keyword, so a filtered-out entry never pays for the search.
+      const keyword = typeof input.query === 'string' ? input.query.trim().toLowerCase() : ''
+      const visible = copy.filter((entry) => {
+        if (input.tagFilter !== '' && !(Array.isArray(entry.tags) && entry.tags.includes(input.tagFilter))) return false
+        if (input.modeFilter !== '' && entry.mode !== input.modeFilter) return false
+        if (input.statusFilter === 'enabled' && entry.enabled !== true) return false
+        if (input.statusFilter === 'disabled' && entry.enabled !== false) return false
+        if (keyword === '') return true
+        return (haystack.get(entry) || '').indexOf(keyword) !== -1
+      })
+      // The card visibility check needs the count even while collapsed, so the
+      // candidate list is always built; only scoring is skipped.
+      const autoEntries = source.filter((entry) => entry.mode === 'auto' && entry.enabled !== false)
+      const sim = input.simOpen === true
+        ? relevancePreview(autoEntries, input.simQuery)
+        : { terms: [], results: [], autoTotal: 0 }
+      return { entries: copy, allTags, visible, autoEntries, sim }
+    }
+
+    /**
+     * F7's remaining-time line, with its own 1s clock.
+     *
+     * The tick used to live in the panel's state: it re-rendered (and diffed)
+     * the whole settings tree every second for a value nothing ever read, since
+     * the text is derived from Date.now() at render time. Scoping it here
+     * re-renders one span instead. It also reports expiry, so the pause bar
+     * steps aside even when the SSE stream is already dead and no fresh
+     * snapshot is coming to flip the flag.
+     */
+    function MuteCountdown(props) {
+      const [, force] = React.useState(0)
+      const remaining = Math.max(0, props.until - Date.now())
+      const live = remaining > 0
+      React.useEffect(() => {
+        if (!live) return undefined
+        const tick = setInterval(() => force((n) => n + 1), 1000)
+        return () => clearInterval(tick)
+      }, [live])
+      React.useEffect(() => {
+        if (live) return
+        if (typeof props.onExpired === 'function') props.onExpired()
+      }, [live])
+      return h('span', null, props.format(remaining))
+    }
+
     /* ---------------- F16: source-mode validation ---------------- */
 
     /**
@@ -1886,12 +2009,13 @@ window.__ModuleLoader__.load({
       const [feedbackBusy, setFeedbackBusy] = React.useState(false)
       const [feedbackError, setFeedbackError] = React.useState('')
       const [feedbackSent, setFeedbackSent] = React.useState('')
-      // F7: the pause menu (null-state boolean) and a 1s clock tick that exists
-      // ONLY while a pause is live (its effect cleans up after itself). The
-      // tick drives nothing but the remaining-time text; authority stays with
-      // the host snapshot (injection.muted / data.disabledUntil).
+      // F7: the pause menu (null-state boolean). The countdown that used to
+      // live here as a panel-wide 1s tick now lives in MuteCountdown, so a live
+      // pause re-renders one line instead of the whole settings tree.
       const [pauseMenuOpen, setPauseMenuOpen] = React.useState(false)
-      const [nowTick, setNowTick] = React.useState(Date.now())
+      // Bumped once when the countdown reaches zero: the panel then re-renders
+      // and the pause bar yields to the normal control even without a snapshot.
+      const [, setMuteExpired] = React.useState(0)
       // F18: the backup-location draft (focused-input protection like budget).
       const [backupText, setBackupText] = React.useState('')
       const backupTextRef = React.useRef('')
@@ -1945,14 +2069,33 @@ window.__ModuleLoader__.load({
       const mutedNow = view !== null && view.injection !== null && typeof view.injection === 'object'
         && view.injection.muted === true
       React.useEffect(() => {
-        if (!mutedNow) return undefined
+        if (!mutedNow) return
         // A pause started from ANOTHER window replaces the menu row; the open
         // flag must not resurface when the row returns after expiry.
         setPauseMenuOpen(false)
-        const tick = setInterval(() => setNowTick(Date.now()), 1000)
-        return () => clearInterval(tick)
       }, [mutedNow])
 
+      /**
+       * The whole list derivation (sort, tag index, filter, keyword scan,
+       * on-demand preview), memoised on the snapshot and the UI inputs that
+       * feed it. It sits before the early returns because hooks cannot be
+       * called conditionally — a null view simply derives empty lists.
+       */
+      const derivedList = useStableMemo([view, sortKey, tagFilter, modeFilter, statusFilter, query, simQuery, simOpen],
+        () => deriveListState({
+          entries: view !== null && view.data !== null && typeof view.data === 'object'
+            && Array.isArray(view.data.entries)
+            ? view.data.entries
+            : [],
+          sortKey,
+          tagFilter,
+          modeFilter,
+          statusFilter,
+          query,
+          simQuery,
+          simOpen,
+        }))
+
       /**
        * F16 live validation, debounced: parsing on every keystroke would stall
        * the panel on a multi-megabyte paste, and 250 ms is below the threshold
@@ -1986,7 +2129,13 @@ window.__ModuleLoader__.load({
         && typeof snapshot.data.rev === 'number'
         ? snapshot.data.rev
         : undefined)
-      const revOf = () => revOfFrom(view)
+      // The LIVE snapshot, through the ref — not the render-scoped `view`.
+      // absorb() is also called from the SSE effect, which is registered once
+      // (deps []), so its closure holds the FIRST render's absorb and with it
+      // the first render's `view` (null). Reading `view` here made the
+      // out-of-order guard below accept every pushed snapshot, which is exactly
+      // the SSE-vs-POST race its comment promises to drop.
+      const revOf = () => revOfFrom(viewRef.current)
 
       function absorb(result) {
         const normalized = normalizeResult(result)
@@ -2731,23 +2880,9 @@ window.__ModuleLoader__.load({
         ? view.security
         : { hostGuarded: true, boundHost: '' }
       // List order is display-only and never changes what the Host injects
-      // (the injection order is decided host-side). The default mirrors the
-      // previous fixed order; updated-time and title are the other sorts.
-      const sortEntries = (list) => {
-        const copy = list.slice()
-        if (sortKey === 'updated') {
-          copy.sort((a, b) => (b.updatedAt - a.updatedAt) || (b.priority - a.priority))
-        } else if (sortKey === 'title') {
-          copy.sort((a, b) =>
-            a.title.localeCompare(b.title, undefined, { sensitivity: 'base' })
-            || (b.priority - a.priority)
-            || (b.updatedAt - a.updatedAt))
-        } else {
-          copy.sort((a, b) => (b.priority - a.priority) || (b.updatedAt - a.updatedAt))
-        }
-        return copy
-      }
-      const entries = sortEntries(data.entries)
+      // (the injection order is decided host-side). Sorting, filtering and the
+      // keyword scan all happen once, inside the memoised deriveListState.
+      const entries = derivedList.entries
       const activeCount = data.entries.filter((e) => e.enabled && e.content !== '').length
       // Persona profiles, in stored order (stable injection order). Old hosts
       // simply have no array.
@@ -2760,17 +2895,7 @@ window.__ModuleLoader__.load({
         : profiles.reduce((n, p) => n + (p.enabled === true && p.content ? p.name.length + p.content.length + 5 : 0), 0)
       // Every tag actually in use, most frequent first (then name), for the
       // tag filter row.
-      const allTags = (() => {
-        const counts = new Map()
-        for (const entry of data.entries) {
-          for (const tag of Array.isArray(entry.tags) ? entry.tags : []) {
-            if (typeof tag === 'string' && tag !== '') counts.set(tag, (counts.get(tag) || 0) + 1)
-          }
-        }
-        return [...counts.entries()]
-          .sort((a, b) => (b[1] - a[1]) || a[0].localeCompare(b[0], undefined, { sensitivity: 'base' }))
-          .map(([tag]) => tag)
-      })()
+      const allTags = derivedList.allTags
       // Budget usage + per-entry marks straight from the Host's injection plan.
       // Older hosts simply publish none of these fields: the meter falls back
       // to data.budgetChars and the maps stay empty.
@@ -2807,8 +2932,8 @@ window.__ModuleLoader__.load({
       // F17: the local preview scores the ACTIVE set's on-demand entries.
       // Disabled entries can never be injected, so scoring them as 预演 hits
       // would mislead — they are excluded from the preview entirely.
-      const autoEntries = data.entries.filter((entry) => entry.mode === 'auto' && entry.enabled !== false)
-      const sim = relevancePreview(autoEntries, simQuery)
+      const autoEntries = derivedList.autoEntries
+      const sim = derivedList.sim
       const simById = new Map(sim.results.map((hit) => [hit.id, hit]))
       const omittedById = new Map()
       const truncatedById = new Map()
@@ -2825,22 +2950,8 @@ window.__ModuleLoader__.load({
       }
       const keyword = query.trim().toLowerCase()
       const filtersActive = tagFilter !== '' || modeFilter !== '' || statusFilter !== ''
-      const matchesFilters = (entry) => {
-        if (tagFilter !== '' && !(Array.isArray(entry.tags) && entry.tags.includes(tagFilter))) return false
-        if (modeFilter !== '' && entry.mode !== modeFilter) return false
-        if (statusFilter === 'enabled' && entry.enabled !== true) return false
-        if (statusFilter === 'disabled' && entry.enabled !== false) return false
-        return true
-      }
-      const visible = entries.filter((entry) => {
-        if (!matchesFilters(entry)) return false
-        if (keyword === '') return true
-        const inTags = (Array.isArray(entry.tags) ? entry.tags.join(' ') : '').toLowerCase()
-        return entry.title.toLowerCase().indexOf(keyword) !== -1
-          || entry.content.toLowerCase().indexOf(keyword) !== -1
-          || entry.when.toLowerCase().indexOf(keyword) !== -1
-          || inTags.indexOf(keyword) !== -1
-      })
+      // Filters and keyword were applied in one pass inside deriveListState.
+      const visible = derivedList.visible
 
       const dotClass = injection.error
         ? 'im-dot im-dot-err'
@@ -2990,7 +3101,9 @@ window.__ModuleLoader__.load({
           ? h('div', { className: 'im-hostwarn', key: 'hostwarn' },
             security.authFence === true
               ? t('diag.hostWarnFence', { host: security.boundHost !== '' ? security.boundHost : '?' })
-              : t('diag.hostWarn', { host: security.boundHost !== '' ? security.boundHost : '?' }))
+              : security.trustedHostCount > 0
+                ? t('diag.hostWarnTrusted', { host: security.boundHost !== '' ? security.boundHost : '?', count: security.trustedHostCount })
+                : t('diag.hostWarn', { host: security.boundHost !== '' ? security.boundHost : '?' }))
           : null,
         h('div', { className: 'im-row' },
           h('div', null,
@@ -3009,7 +3122,11 @@ window.__ModuleLoader__.load({
             // 自动恢复，无需用户操作、不写盘。倒计时只是展示，权威在快照。
             muted && muteRemainingMs > 0
               ? h('div', { className: 'im-pause-bar' },
-                h('span', null, t('mute.active', { remaining: muteRemainingText(muteRemainingMs) })),
+                h(MuteCountdown, {
+                  until: disabledUntil,
+                  format: (ms) => t('mute.active', { remaining: muteRemainingText(ms) }),
+                  onExpired: () => setMuteExpired((n) => n + 1),
+                }),
                 h('button', { className: 'im-btn', disabled: busy, onClick: resumePause }, t('mute.resume')))
               : h('div', { className: 'im-pause-row' },
                 h('button', {

package/lib/index.js

@@ -128,6 +128,10 @@ const MAX_MUTE_MS = 7 * 24 * 60 * 60 * 1000
  * duplicated tab left open for weeks) cannot grow the set without bound.
  */
 const MAX_SSE_STREAMS = 32
+/** Idle keep-alive for event streams; well under the usual 60s proxy idle timeout. */
+const SSE_HEARTBEAT_MS = 25 * 1000
+/** An SSE comment line: every spec-compliant client ignores it. */
+const SSE_PING_FRAME = ': ping\n\n'
 const HISTORY_DIR_NAME = 'history'
 /** Name of the JSON Schema shipped with the package and copied next to the store. */
 const SCHEMA_FILE_NAME = 'memory.schema.json'
@@ -2205,6 +2209,43 @@ export function apply(ctx) {
    * pushSnapshot).
    */
   const sseStreams = new Map()
+  /**
+   * Shared heartbeat over every live event stream, started with the first
+   * subscriber and stopped with the last. Two jobs:
+   *
+   *  - intermediaries (and some client stacks) close an idle stream; a comment
+   *    frame every 25s keeps it warm, and SSE clients are required to ignore
+   *    `:` lines, so an older panel sees no difference;
+   *  - it is the only place that can PROVE a subscriber stopped reading.
+   *    `res.write()` returning false means the socket buffer is full. Without
+   *    checking it, a crashed or sleeping client keeps its Map entry, socket and
+   *    file handle until TCP notices — minutes — and enough such zombies hold
+   *    MAX_SSE_STREAMS so that every later subscriber is refused with 503 until
+   *    the host is restarted.
+   */
+  let sseHeartbeat = null
+  const stopHeartbeat = () => {
+    if (sseHeartbeat === null) return
+    clearInterval(sseHeartbeat)
+    sseHeartbeat = null
+  }
+  const ensureHeartbeat = () => {
+    if (sseHeartbeat !== null || disposed) return
+    sseHeartbeat = setInterval(() => {
+      if (disposed || sseStreams.size === 0) {
+        stopHeartbeat()
+        return
+      }
+      for (const [send, entry] of Array.from(sseStreams)) {
+        try {
+          if (send(SSE_PING_FRAME) === false) entry.cleanup()
+        } catch {
+          entry.cleanup()
+        }
+      }
+    }, SSE_HEARTBEAT_MS)
+    if (typeof sseHeartbeat.unref === 'function') sseHeartbeat.unref()
+  }
   let storeWatcher = null
   let watchDebounce = null
   /**
@@ -2227,10 +2268,12 @@ export function apply(ctx) {
     for (const [send, entry] of Array.from(sseStreams)) {
       try {
         if (entry.lite === true) {
-          send(litePayload)
+          // A false return means the socket buffer is full — this subscriber
+          // stopped reading. Drop it now rather than queue frames in memory.
+          if (send(litePayload) === false) entry.cleanup()
         } else {
           if (fullPayload === null) fullPayload = 'data: ' + JSON.stringify(snapshot()) + '\n\n'
-          send(fullPayload)
+          if (send(fullPayload) === false) entry.cleanup()
         }
       } catch {
         // The response is dead: run its full teardown (end + unsubscribe),
@@ -2366,7 +2409,20 @@ export function apply(ctx) {
         // an external edit) but it must not happen silently: the downgrade is
         // invisible otherwise.
         logInfo('store watcher failed, falling back to the 5s poller: ' + describeError(err))
-        stopWatching()
+        // Drop the WATCHER only. stopWatching() also clears the poller, which
+        // is the one mechanism still able to notice an external edit after this
+        // error — calling it here contradicted the log line above and left the
+        // process with NO change detection at all until the next successful
+        // save re-armed both. The poller is idempotent, so re-asserting it is a
+        // no-op when it is already running.
+        const dead = storeWatcher
+        storeWatcher = null
+        try {
+          dead.close()
+        } catch {
+          // The OS side already dropped the handle.
+        }
+        startPolling()
       })
     } catch {
       storeWatcher = null
@@ -2378,6 +2434,7 @@ export function apply(ctx) {
   }
 
   const disposeStreams = () => {
+    stopHeartbeat()
     for (const entry of Array.from(sseStreams.values())) {
       try {
         entry.cleanup()
@@ -2473,8 +2530,36 @@ export function apply(ctx) {
   }
   /** Where the rolling pre-write copy lives: ALWAYS next to the store (crash recovery). */
   const localBackupPath = () => storePath + BACKUP_FILE_SUFFIX
+  /**
+   * The backup directory the WRITE path may use, or '' when the configured one
+   * must be ignored.
+   *
+   * `setOptions` and `exportToDir` each check the subtree rule, but they are
+   * not the only writers: every save also drops a `.bak` and a history
+   * snapshot into this directory. A store hand-edited to point outside
+   * `$DSH_HOME` therefore escaped the fence on the very next save, which
+   * contradicted the promise that every write stays inside the harness home.
+   * The same rule now runs where the writes actually happen; the refusal is
+   * disclosed once per process instead of silently relocated.
+   */
+  let refusedBackupDir = null
+  const effectiveBackupDir = () => {
+    const configured = backupDirOf()
+    if (configured === '') return ''
+    if (allowExternalBackup() || isInsideDshRoot(configured)) return configured
+    if (refusedBackupDir !== configured) {
+      refusedBackupDir = configured
+      state.storageWarning = '备份位置 ' + displayPath(configured) + ' 不在 DSH 主目录内，已忽略（备份与历史快照一律写回默认位置）；'
+        + '要使用其他磁盘请设置 ' + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主'
+      logInfo('ignoring backupDir outside the harness home: ' + configured)
+    }
+    return ''
+  }
   /** The user-facing copy under a custom backup location, or null (F18). */
-  const customBackupPath = () => (backupDirOf() !== '' ? join(backupDirOf(), basename(storePath) + BACKUP_FILE_SUFFIX) : null)
+  const customBackupPath = () => {
+    const dir = effectiveBackupDir()
+    return dir !== '' ? join(dir, basename(storePath) + BACKUP_FILE_SUFFIX) : null
+  }
   /**
    * History snapshots live in a `history/` SUBDIRECTORY of the backup location
    * (default: the store directory). Two reasons for the subdirectory:
@@ -2485,7 +2570,10 @@ export function apply(ctx) {
    *   2. a custom (e.g. cloud-synced) backup directory stays tidy: one known
    *      folder holds the history, nothing else is touched.
    */
-  const historyDirPath = () => join(backupDirOf() !== '' ? backupDirOf() : dirname(storePath), HISTORY_DIR_NAME)
+  const historyDirPath = () => {
+    const dir = effectiveBackupDir()
+    return join(dir !== '' ? dir : dirname(storePath), HISTORY_DIR_NAME)
+  }
 
   /**
    * Cross-process write lock: a `memory.json.lock` marker created exclusively
@@ -2841,7 +2929,19 @@ export function apply(ctx) {
       // monotonic while the CONTENT of their save was dropped without an error
       // — "rev 3" looked healthy and the entry was simply gone. Refuse instead,
       // so the caller retries against the newer store.
-      const diskRevNow = await readDiskRev()
+      //
+      // ONE read serves both this check and the ".bak" shape guard further
+      // down: the previous shape read the same file three times inside the lock
+      // (twice just to obtain the rev) while another DSH process could already
+      // be waiting on that very lock. `diskReadError` preserves the exact
+      // failure the later guard would have raised itself, so its ENOENT / empty
+      // / not-a-store branches keep their current behaviour.
+      let diskReadError = null
+      const diskSnapshot = await readStoreFile(storePath).catch((err) => {
+        diskReadError = err === null || err === undefined ? new Error('unreadable store') : err
+        return undefined
+      })
+      const diskRevNow = diskRevFrom(diskSnapshot)
       if (diskRevNow > (state.data.rev || 0)) {
         state.storageError = '另一个 DSH 进程刚刚保存了记忆（磁盘 rev ' + diskRevNow
           + '，本进程 rev ' + (state.data.rev || 0) + '），本次未写入以免覆盖，请重试'
@@ -2870,8 +2970,9 @@ export function apply(ctx) {
       // ACROSS processes: two windows that loaded rev 5 would otherwise both
       // write rev 6, and anything that watches the rev for change (the lite
       // SSE stream) cannot tell the second save from a repeat of the first.
-      const diskRev = await readDiskRev()
-      previousRev = Math.max(state.data.rev || 0, diskRev)
+      // Same read as the check above: the lock is ours, so the file cannot have
+      // moved in between.
+      previousRev = Math.max(state.data.rev || 0, diskRevNow)
       state.data.rev = previousRev + 1
       const text = serialize()
       // mode 0600: the store holds the user's private instructions and (with a
@@ -2901,7 +3002,11 @@ export function apply(ctx) {
       // discloses it (the .bak may be stale, and the panel says so).
       let hadPrevious = true
       try {
-        const previous = await readStoreFile(storePath)
+        // Reuse the read taken above instead of touching the file a third
+        // time. The captured failure is rethrown so every branch of the catch
+        // below keeps exactly its current meaning.
+        if (diskReadError !== null) throw diskReadError
+        const previous = diskSnapshot
         // "Reads as a store", not merely "reads as JSON" — this is the test the
         // comment above promises. A foreign-but-parseable primary (an array, a
         // scalar, another tool's object) must NOT be copied over the last good
@@ -3027,11 +3132,20 @@ export function apply(ctx) {
    * then silently misses the second save; and (b) deciding whether a save made
    * while another process holds the lock would clobber a newer store.
    */
+  /**
+   * The rev a PARSED store carries, or 0 when it carries none usable. Split out
+   * so a caller that already read the file — writeToDisk does, once, inside the
+   * lock — can derive the same number without a second read. Called at request
+   * time, long after apply() finished defining it.
+   */
+  const diskRevFrom = (parsed) => {
+    const rev = parsed !== null && parsed !== undefined && typeof parsed === 'object' ? parsed.rev : null
+    return typeof rev === 'number' && Number.isFinite(rev) && rev > 0 ? Math.round(rev) : 0
+  }
+
   const readDiskRev = async () => {
     try {
-      const parsed = await readStoreFile(storePath)
-      const rev = parsed !== null && typeof parsed === 'object' ? parsed.rev : null
-      return typeof rev === 'number' && Number.isFinite(rev) && rev > 0 ? Math.round(rev) : 0
+      return diskRevFrom(await readStoreFile(storePath))
     } catch {
       return 0
     }
@@ -3080,7 +3194,13 @@ export function apply(ctx) {
     const rejectVersion = (version, source) => {
       state.versionRejected = true
       state.rejectedVersion = version
-      state.storageError = '存储文件声明为格式版本 ' + version + '，本插件支持的格式版本为 ' + SUPPORTED_VERSIONS.join(' / ')
+      // A string that spells a supported number ("2") produced the absurd
+      // "declared version 2, supported versions 1 / 2". The TYPE is the
+      // problem, so say that instead of comparing it to the list.
+      state.storageError = (typeof version === 'number'
+        ? '存储文件声明为格式版本 ' + version + '，本插件支持的格式版本为 ' + SUPPORTED_VERSIONS.join(' / ')
+        : '存储文件的 version 字段类型不正确：必须是数字，当前是 ' + JSON.stringify(version === undefined ? null : version)
+          + '；本插件支持的格式版本为 ' + SUPPORTED_VERSIONS.join(' / '))
         + '；已拒绝载入以防数据损坏，原文件已保留，修改操作已暂停。请升级插件，或手动将文件改回受支持的版本后点「重新载入」'
       state.loadedFrom = source + ' (unsupported version ' + version + ')'
       state.storeExists = true
@@ -3478,6 +3598,13 @@ export function apply(ctx) {
          * to say which of the two situations it is looking at.
          */
         authFence: connectionGate !== null,
+        /**
+         * How many hostnames DSH_INSTRUCTION_MEMORY_TRUSTED_HOSTS widened the
+         * Host/Origin check to. The list relaxes a HOSTNAME rule; it is not an
+         * identity check, so the panel must be able to say when a widened
+         * allow-list is the only thing standing in front of a fence-less route.
+         */
+        trustedHostCount: trustedHosts.length,
       },
       /**
        * F12: load-side diagnostics that used to be log-only. `loadedFrom` says
@@ -3852,7 +3979,7 @@ export function apply(ctx) {
           return {
             ok: false,
             saved: false,
-            message: '备份位置必须位于 DSH 主目录内（' + dshRootPath() + '）；要使用其他磁盘请设置环境变量 '
+            message: '备份位置必须位于 DSH 主目录内（' + displayPath(dshRootPath()) + '）；要使用其他磁盘请设置环境变量 '
               + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主',
             snapshot: snapshot(),
           }
@@ -4486,7 +4613,7 @@ export function apply(ctx) {
       return {
         ok: false,
         saved: false,
-        message: '导出目录必须位于 DSH 主目录内（' + dshRootPath() + '）；要写入其他磁盘请设置环境变量 '
+        message: '导出目录必须位于 DSH 主目录内（' + displayPath(dshRootPath()) + '）；要写入其他磁盘请设置环境变量 '
           + ALLOW_EXTERNAL_BACKUP_ENV + '=1 后重启宿主',
         snapshot: snapshot(),
       }
@@ -5237,7 +5364,9 @@ export function apply(ctx) {
     // restarted) instead of hammering the route.
     res.write('retry: 5000\n\n')
     const lite = isLiteStreamRequest(req)
-    const send = (payload) => { res.write(payload) }
+    // The write() result is the backpressure signal that pushSnapshot and the
+    // heartbeat act on: false means the peer stopped reading this stream.
+    const send = (payload) => res.write(payload)
     let closed = false
     const cleanup = () => {
       closed = true
@@ -5249,6 +5378,9 @@ export function apply(ctx) {
       }
     }
     sseStreams.set(send, { cleanup, lite })
+    // Start the shared keep-alive lazily: a host with no open panel pays
+    // nothing, and the timer stops itself when the last stream closes.
+    ensureHeartbeat()
     req.on('close', cleanup)
     req.on('error', cleanup)
     res.on('error', cleanup)
@@ -5306,9 +5438,16 @@ export function apply(ctx) {
         logInfo('connection fence threw, refusing the request: ' + describeError(err))
         rejection = 401
       }
-      if (typeof rejection === 'number' && rejection >= 400) {
-        logInfo('route refused an unauthenticated request (' + rejection + ')')
-        res.writeHead(rejection, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
+      // Only the documented "admit" values pass. Anything else — a future
+      // `{status:401}`, an Error, a string — is treated as a refusal, because
+      // an authentication gate that silently opens on an unexpected shape is
+      // not a gate. The numeric status is preserved when it is plausible.
+      const admitted = rejection === undefined || rejection === null || rejection === false
+      if (!admitted) {
+        const status = typeof rejection === 'number' && rejection >= 400 && rejection <= 599 ? rejection : 401
+        logInfo('route refused a request (' + status + ', fence returned '
+          + (typeof rejection === 'number' ? rejection : typeof rejection) + ')')
+        res.writeHead(status, { 'content-type': 'application/json; charset=utf-8', 'cache-control': 'no-store' })
         res.end(JSON.stringify({
           ok: false,
           message: rejection === 403

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-instruction-memory",
-  "version": "1.5.0",
+  "version": "1.5.2",
   "description": "User-only instruction memory for DSH: long-term instructions maintained in the settings UI and auto-injected into every conversation — the model has no write access. 指令记忆：只由用户在设置页维护的长期指令，自动注入此后每轮对话；模型没有任何写入口。",
   "license": "MIT",
   "type": "module",