dsh-llm-fallbacks 0.4.3 → 0.4.4

package/README.md

@@ -7,7 +7,7 @@
 ![node](https://img.shields.io/badge/node-%3E%3D22-339933.svg)
 ![pnpm](https://img.shields.io/badge/pnpm-%3E%3D10-f69220.svg)
 ![dsh tui](https://img.shields.io/badge/dsh%20tui-compatible-4B32C3.svg)
-![dsh](https://img.shields.io/badge/DSH-0.1.2--rc.1-4B32C3.svg)
+![dsh](https://img.shields.io/badge/DSH-0.1.5--rc.1-4B32C3.svg)
 [![dshfind](https://dshfind.com/api/badge/omdsh-dev/dsh-llm-fallbacks?lang=en)](https://dshfind.com/zh/plugins/omdsh-dev/dsh-llm-fallbacks?ref=badge)
 
 Automatic provider/model fallback chains for dsh (DeepSeek Harness): when an agent's LLM requests keep failing — retries exhausted, auth errors, quota exceeded, rate limiting (429) — the plugin switches provider/model along the fallback chain for the current role, and the current step/turn continues on the target model: tasks are not interrupted by model problems.
@@ -31,7 +31,7 @@ Four frozen UTC+8 presets (windows are code constants; preset rows lock `tz` to
 
 GLM Peak and GLM Valley are offered in the card picker only when `zai-coding-cn` is configured.
 
-The first extra row whose window contains the current moment (in `fallbacks.tz`, default Asia/Shanghai) wins; no match → the all-day `rootChain`, whose tail (Default model) must be exactly one official V4 model — `deepseek-official/deepseek-v4-flash` XOR `deepseek-official/deepseek-v4-pro`. Slot rotation is a routing seed, not a failure decision: it applies on the next root request, consumes no cooldown, and is logged as a time-slot switch — failure walks keep fallback switch. Full semantics → [Time-slot presets](#time-slot-presets) and [docs/configuration.md](docs/configuration.md).
+The first extra row whose window contains the current moment (in `fallbacks.tz`, default Asia/Shanghai) wins; no match → the all-day `rootChain`, whose tail (Default model) must be exactly one official model — `deepseek-official/deepseek-flash` or `deepseek-official/deepseek-pro` (XOR). Slot rotation is a routing seed, not a failure decision: it applies on the next root request, consumes no cooldown, and is logged as a time-slot switch — failure walks keep fallback switch. Full semantics → [Time-slot presets](#time-slot-presets) and [docs/configuration.md](docs/configuration.md).
 
 ## Quick start
 
@@ -46,17 +46,16 @@ Same plugin, either front end — the only difference is the `--profile` flag. P
 
 ### Repair existing sessions (versions before 0.2.2)
 
-Versions before 0.2.2 wrote durable `fallbacks/switch` session events that newer dsh releases refuse to load (issue #52 — the apply()-time event-type registration is ineffective because plugin and host resolve different module instances). If existing sessions fail to open after an upgrade, clone this repository and repair the logs (stop dsh first):
+Versions before 0.2.2 wrote durable `fallbacks/switch` session events that newer dsh releases refuse to load (issue #52 — the apply()-time event-type registration is ineffective because plugin and host resolve different module instances). If existing sessions fail to open after an upgrade, clone this repository and run the detector:
 
 ```sh
 git clone https://github.com/omdsh-dev/dsh-llm-fallbacks.git
 cd dsh-llm-fallbacks
 pnpm install
-pnpm repair:fallbacks-switch-logs -- --dry-run            # preview which sessions would change
-pnpm repair:fallbacks-switch-logs -- --apply --backup     # mark legacy events ignorable
+pnpm repair:fallbacks-switch-logs -- --dry-run
 ```
 
-The script scans `~/.dsh/sessions` by default (override with `--root <dir>`), marks legacy `fallbacks/switch` events `ignorable: true` so the host read path accepts the session again, and keeps a `<file>.bak` per repaired log. `--apply` requires `--backup` and must run with dsh stopped. From 0.2.2 on, the plugin stops writing durable switch events, so no new sessions need repair.
+The script scans `~/.dsh/sessions` by default (override with `--root <dir>`). **It cannot repair these logs**: the released session-format migration chain (v0→v1) refuses unknown event types even when marked `ignorable: true`, so a "repaired" log would still be rejected on load. The script therefore fails closed — it only reports which sessions contain `fallbacks/switch` events, never writes or backs up any file, and exits non-zero when it finds any (the legacy `--apply` / `--backup` flags are accepted as no-ops). The durable fix belongs upstream at the migration edges. From 0.2.2 on, the plugin stops writing durable switch events, so no new sessions need attention.
 
 ### Configuration surfaces
 
@@ -77,9 +76,9 @@ Add a `fallbacks:` section to the shared settings document (`$DSH_HOME/settings.
 ```yaml
 fallbacks:
   enabled: true            # feature switch — defaults to off (plugin is a no-op otherwise)
-  rootChain:               # all-day chain: leading entries = fallback walk, last = Default model (official V4)
+  rootChain:               # all-day chain: leading entries = fallback walk, last = Default model (official)
     - anthropic/claude-3-5-sonnet          # walked first
-    - deepseek-official/deepseek-v4-flash  # last resort (Flash or Pro)
+    - deepseek-official/deepseek-flash  # last resort (Flash or Pro)
   timeSlots:               # optional: rotate the effective root chain by wall-clock windows
     - kind: preset         # frozen UTC+8 window; only the chain is editable
       preset: liang-peak   # Monday–Friday 09:00–12:00 and 14:00–18:00
@@ -109,7 +108,7 @@ Build the section up in four steps:
 
 **2. Set the all-day `rootChain`.** Leading entries are the fallback chain, walked first when a request fails; the **last** entry is the Default model.
 
-> **Conformance**: the last entry must be exactly one official V4 model — `deepseek-official/deepseek-v4-flash` XOR `deepseek-official/deepseek-v4-pro`. The settings card and gateway reject any other tail on save; a legacy non-official tail warns at startup and keeps working as a fallback-only walk, but cannot be saved as-is.
+> **Conformance**: the last entry must be exactly one official model — `deepseek-official/deepseek-flash` or `deepseek-official/deepseek-pro` (XOR). The settings card and gateway reject any other tail on save; a legacy non-official tail warns at startup and keeps working as a fallback-only walk, but cannot be saved as-is. The retired `deepseek-v4-flash` / `deepseek-v4-pro` ids are no longer legal tails — a saved V4 tail now warns, goes inert (slot rows + virtual picker), and blocks save until a legal tail is picked. `deepseek-pro` is a legal selector whose model is not yet served by the catalog: the card shows it disabled ("not yet available"), and requests to it fail at the provider until the gateway enables the id. The plugin does not probe catalog availability — a chain containing `deepseek-pro` dispatches to it like any other exact entry, and the override resolves the first exact head of the effective chain, so a chain with a working entry before Pro still routes to that earlier entry.
 
 **3. Add `timeSlots` (optional).** Rows rotate the effective root chain by wall-clock windows. Preset rows use frozen UTC+8 windows (only their chain is editable; while a preset row exists, `tz` locks to `Asia/Shanghai`); custom rows take `start`/`end` (may wrap midnight) and an optional `days` list. The first row whose window contains the current moment wins; no match → the all-day `rootChain`. Rotation is a routing seed — it applies on the next root request and consumes no cooldown (see [Time slots](#time-slots)).
 
@@ -135,7 +134,7 @@ Save the config and restart the session, then type `/fallbacks` — the read-onl
 - **Cooldown and revert**: failed / switched-away models are not re-selected during cooldown; `revertPolicy: cooldown-expiry` returns to the primary model automatically.
 - **Host subagent model policy (dsh 0.1.2)**: when the host `subagent-model-selection` policy is enabled, its allowlist is a hard constraint on every plugin-originated subagent route — an explicit authorized spawn route stays the chain head (role-inject skipped), inheritance inject heads and failure-switch targets are intersected with the effective allowlist, and an empty intersection skips the inject/switch (warn log + read-only card warning; no out-of-allowlist request is ever sent). A present-but-unreadable policy fails closed. Policy off/absent → inject and failure-switch selection exactly as 0.3.5. Override `reasoningEffort` follows the upstream routeChanged rule on every path (same route → keep; route change → drop unless explicit). See [Host subagent model policy](#host-subagent-model-policy-dsh-012).
 - **Half-open recovery (opt-in)**: `recovery: half-open` makes recovery evidence-driven — an expired cooldown leaves the route half-open for one logged probe instead of restoring the preference; consecutive failures escalate the suppression duration (×2 per failure, capped at 1 h); an observed completion closes the circuit and fully restores the preference. `revertPolicy: 'never'` keeps the mechanism inert; state is session-scoped in-memory (a restart resets). YAML-only — the default `timer` keeps every existing behavior byte-identical (see [docs/configuration.md](docs/configuration.md#recovery-mode-recovery-key)).
-- **Visible behavior**: every switch is recorded in an info-level log line (from/to/role/reason) — no silent model switching. The plugin deliberately writes **no** durable `fallbacks/switch` session events (issue #52: the apply()-time event-type registration was proven ineffective, and a session containing the event refused to load after a dsh restart). Sessions written by older plugin versions that contain such events are repaired by `scripts/repair-fallbacks-switch-logs.ts`, which marks legacy events ignorable so affected sessions load again.
+- **Visible behavior**: every switch is recorded in an info-level log line (from/to/role/reason) — no silent model switching. The plugin deliberately writes **no** durable `fallbacks/switch` session events (issue #52: the apply()-time event-type registration was proven ineffective, and a session containing the event refused to load after a dsh restart). Sessions written by older plugin versions that contain such events **cannot** be repaired by an `ignorable` flag — the released session-format migration chain (v0→v1) refuses unknown event types even when marked ignorable — so `scripts/repair-fallbacks-switch-logs.ts` now fails closed and only reports such logs (the durable fix belongs upstream at the migration edges).
 - **Safety valves**: `maxSwitchesPerStep` caps switches per step and `alwaysModeRetryCap` caps always-mode retries — chain loops cannot amplify latency.
 - **No-config no-op**: with no chains configured the plugin behaves exactly like not being installed (`enabled` is off by default — see [Minimal configuration](#minimal-configuration)).
 
@@ -161,9 +160,9 @@ There is **no `rootMode` switch** — no config key, YAML field, settings toggle
 
 Notes:
 
-- **Picker label**: the row's catalog `name` (what the composer trigger shows) is live — `Auto: DeepSeek V4 Flash[Liang Peak]` / `Auto: DeepSeek V4 Flash[all-day]` (catalog display name, not the model id); the id stays `Auto`. Bare `Auto` if the all-day tail is not conforming. Refresh by reopening the picker.
+- **Picker label**: the row's catalog `name` (what the composer trigger shows) is live — `Auto: DeepSeek Flash[Liang Peak]` / `Auto: DeepSeek Flash[all-day]` (catalog display name, not the model id); the id stays `Auto`. Bare `Auto` if the all-day tail is not conforming. Refresh by reopening the picker.
 - **Root only**: the row is about the root agent. Subagent role resolution and injection are unchanged; a subagent session that inherits the selection still routes through the chain head — the virtual row is a thin delegate, never a second routing engine.
-- **Conformance gate on the tail**: a successful override/delegate requires the all-day chain to be **tail-conforming** — its last entry must be exactly one official V4 model (`deepseek-official/deepseek-v4-flash` or `deepseek-official/deepseek-v4-pro`, the card's Default model panel); leading entries (Default fallback chain) are walked first. Disabling the plugin hides the row again (slot-row/chain edits never churn registration).
+- **Conformance gate on the tail**: a successful override/delegate requires the all-day chain to be **tail-conforming** — its last entry must be exactly one official model (`deepseek-official/deepseek-flash` or `deepseek-official/deepseek-pro`, the card's Default model panel); leading entries (Default fallback chain) are walked first. Disabling the plugin hides the row again (slot-row/chain edits never churn registration).
 - **Stale selection**: if the row disappears (plugin disabled) while `FallbacksChain / Auto` is selected, the session keeps showing it as the current model with `routable: false` — pick a real model from the catalog to continue (host-native catalog semantics).
 - **Capabilities follow the head**: the row's model metadata (context window, modalities, reasoning) mirrors the current effective head; retry attribution follows the permissive default — retries/failures are accounted to the real head pair, not to the `FallbacksChain` provider. Full semantics → [docs/configuration.md](docs/configuration.md).
 
@@ -171,11 +170,11 @@ Notes:
 
 Time slots are introduced in the [featured overview](#time-slots) above; this section is the reference. Time-slot rows rotate the **effective root chain** by wall-clock windows — useful for peak/valley pricing without confusing wall-clock rotation with failure fallback. The copy split is strict: slot rotation logs and UI say **time-slot switch**; the failure walk keeps **fallback switch**; the conversation notice Model downgraded stays on the failure path only.
 
-- **Match order**: at every root request, the first extra row whose window contains the current moment (in `fallbacks.tz`, default `Asia/Shanghai` / UTC+8) wins — that row's chain **replaces** the all-day chain. No row matches → the all-day `rootChain` is used. The all-day row is always last and **required**: its last entry must be exactly one official V4 model (Flash XOR Pro; leading Default fallback chain entries are walked first).
+- **Match order**: at every root request, the first extra row whose window contains the current moment (in `fallbacks.tz`, default `Asia/Shanghai` / UTC+8) wins — that row's chain **replaces** the all-day chain. No row matches → the all-day `rootChain` is used. The all-day row is always last and **required**: its last entry must be exactly one official model (Flash / Pro XOR; leading Default fallback chain entries are walked first).
 - **Presets** (frozen, not user-editable): `liang-peak` = Monday–Friday 09:00–12:00 **and** 14:00–18:00; `liang-valley` = every other UTC+8 time; `glm-peak` = Monday–Friday 14:00–18:00; `glm-valley` = every other time. One preset id = one row; the card picker never offers a duplicate.
 - **Custom rows**: `start` / `end` (`HH:mm`, may wrap midnight) + optional `days` (0=Sunday…6=Saturday; omitted/empty = every day) + models.
 - **Next-request apply**: a slot boundary crossing never preempts an in-flight step — the new row takes effect on the next root request. Rotation is mount-only: info log + card/`/fallbacks` status line, no durable switch event.
-- **Settings card**: the Main agent section groups Time slots (extra rows — add preset / add custom / remove / reorder by buttons or **drag**; preset rows show a read-only window summary and edit models only; custom rows carry an editable name; the **timezone picker** lives here and **locks to Asia/Shanghai while any preset row exists**, since preset windows are frozen UTC+8 constants), Default fallback chain (walked first when no slot matches) and Default model (the official V4 Flash | Pro last-resort fallback). Rows are collapsible to name + first model. There is no `timeSlots.enabled` master switch (adding a row is the opt-in) and no `rootMode` control.
+- **Settings card**: the Main agent section groups Time slots (extra rows — add preset / add custom / remove / reorder by buttons or **drag**; preset rows show a read-only window summary and edit models only; custom rows carry an editable name; the **timezone picker** lives here and **locks to Asia/Shanghai while any preset row exists**, since preset windows are frozen UTC+8 constants), Default fallback chain (walked first when no slot matches) and Default model (the official Flash | Pro last-resort fallback). Rows are collapsible to name + first model. There is no `timeSlots.enabled` master switch (adding a row is the opt-in) and no `rootMode` control.
 
 ## Preset roles
 
@@ -202,7 +201,7 @@ fallbacks:
     - CONTEXT_WINDOW_EXCEEDED  # fail over when the request does not fit
   rootChain:
     - anthropic/claude-3-5-sonnet          # walked first
-    - deepseek-official/deepseek-v4-flash  # last resort (Flash or Pro)
+    - deepseek-official/deepseek-flash  # last resort (Flash or Pro)
 ```
 
 **Ordering — the fallback runs before compaction.** With `CONTEXT_WINDOW_EXCEEDED` in `triggerCodes`, this plugin's `agent/request-error` listener handles the rejection **before** the harness's compaction plugin gets to compact: the conversation moves to the fallback model on the first overflow, and the context is never compacted. Leave the code out of `triggerCodes` if you would rather have compaction tried first.

package/README.zh-CN.md

@@ -7,7 +7,7 @@
 ![node](https://img.shields.io/badge/node-%3E%3D22-339933.svg)
 ![pnpm](https://img.shields.io/badge/pnpm-%3E%3D10-f69220.svg)
 ![dsh tui](https://img.shields.io/badge/dsh%20tui-compatible-4B32C3.svg)
-![dsh](https://img.shields.io/badge/DSH-0.1.2--rc.1-4B32C3.svg)
+![dsh](https://img.shields.io/badge/DSH-0.1.5--rc.1-4B32C3.svg)
 [![dshfind](https://dshfind.com/api/badge/omdsh-dev/dsh-llm-fallbacks?lang=zh)](https://dshfind.com/zh/plugins/omdsh-dev/dsh-llm-fallbacks?ref=badge)
 
 dsh（DeepSeek Harness）的自动模型降级插件：当 root agent 或 subagent 的模型请求持续失败（重试耗尽、权限、配额超限、限流 429）时，按角色/模型 fallback 链自动切换 provider/model，当前 step/turn 在目标模型上继续完成——任务不因模型问题中断。
@@ -31,7 +31,7 @@ dsh（DeepSeek Harness）的自动模型降级插件：当 root agent 或 subage
 
 GLM 峰与 GLM 谷仅在已配置 `zai-coding-cn` 时出现在设置卡选择器中。
 
-每个 root 请求时刻，第一条窗口包含当前时刻（按 `fallbacks.tz`，默认 Asia/Shanghai）的额外行生效；无行命中 → 全时段 `rootChain`——其链尾（默认模型）必须是恰好一个官方 V4 模型：`deepseek-official/deepseek-v4-flash` 或 `deepseek-official/deepseek-v4-pro`（二选一）。分时切换是路由种子而非失败决策：在下一个 root 请求生效、不消耗冷却、不计入 `maxSwitchesPerStep`，日志记为**分时切换**；失败降级保持**降级切换**。完整语义 → [分时槽预设（分时切换）](#分时槽预设分时切换) 与 [docs/configuration.md](docs/configuration.md)。
+每个 root 请求时刻，第一条窗口包含当前时刻（按 `fallbacks.tz`，默认 Asia/Shanghai）的额外行生效；无行命中 → 全时段 `rootChain`——其链尾（默认模型）必须是恰好一个官方模型：`deepseek-official/deepseek-flash` 或 `deepseek-official/deepseek-pro`（二选一）。分时切换是路由种子而非失败决策：在下一个 root 请求生效、不消耗冷却、不计入 `maxSwitchesPerStep`，日志记为**分时切换**；失败降级保持**降级切换**。完整语义 → [分时槽预设（分时切换）](#分时槽预设分时切换) 与 [docs/configuration.md](docs/configuration.md)。
 
 ## 快速开始
 
@@ -46,17 +46,16 @@ dsh plugin --profile dsh-tui add dsh-llm-fallbacks  # dsh-tui 终端 profile
 
 ### 修复旧会话（0.2.2 之前的版本）
 
-0.2.2 之前的版本会把 `fallbacks/switch` 事件写入会话持久化日志，而新版 dsh 拒绝加载这类会话（issue #52——apply() 时的注册因插件与宿主解析到不同模块实例而无效）。如果升级后已有会话打不开，clone 本仓库并修复日志（先停 dsh）：
+0.2.2 之前的版本会把 `fallbacks/switch` 事件写入会话持久化日志，而新版 dsh 拒绝加载这类会话（issue #52——apply() 时的注册因插件与宿主解析到不同模块实例而无效）。如果升级后已有会话打不开，clone 本仓库并运行检测器：
 
 ```sh
 git clone https://github.com/omdsh-dev/dsh-llm-fallbacks.git
 cd dsh-llm-fallbacks
 pnpm install
-pnpm repair:fallbacks-switch-logs -- --dry-run            # 预览哪些会话会被改动
-pnpm repair:fallbacks-switch-logs -- --apply --backup     # 给旧事件打 ignorable 标记
+pnpm repair:fallbacks-switch-logs -- --dry-run
 ```
 
-脚本默认扫描 `~/.dsh/sessions`（可用 `--root <dir>` 覆盖），把遗留 `fallbacks/switch` 事件标记为 `ignorable: true`，宿主读路径即可重新接受该会话；每个被修复的日志保留一份 `<file>.bak`。`--apply` 必须搭配 `--backup`，且须在 dsh 停止时运行。从 0.2.2 起插件不再写 durable 切换事件，新会话无需修复。
+脚本默认扫描 `~/.dsh/sessions`（可用 `--root <dir>` 覆盖）。**它无法修复这些日志**：已发布的 session-format 迁移链（v0→v1）即使事件带 `ignorable: true` 也拒绝未知事件类型，因此「修复后」的日志仍会被拒绝加载。脚本因此 fail-closed——只报告哪些会话含 `fallbacks/switch` 事件，绝不写入或备份任何文件，发现即非零退出（遗留的 `--apply` / `--backup` 参数按 no-op 接受）。持久修复应在上游迁移边界完成。从 0.2.2 起插件不再写 durable 切换事件，新会话无需处理。
 
 ### 配置界面
 
@@ -77,9 +76,9 @@ pnpm repair:fallbacks-switch-logs -- --apply --backup     # 给旧事件打 igno
 ```yaml
 fallbacks:
   enabled: true            # 功能开关——默认关闭（否则插件完全 no-op）
-  rootChain:               # 全时段链：前面的条目 = 降级路径，最后一项 = 默认模型（官方 V4）
+  rootChain:               # 全时段链：前面的条目 = 降级路径，最后一项 = 默认模型（官方模型）
     - anthropic/claude-3-5-sonnet          # 先走
-    - deepseek-official/deepseek-v4-flash  # 最后一档（Flash 或 Pro）
+    - deepseek-official/deepseek-flash  # 最后一档（Flash 或 Pro）
   timeSlots:               # 可选：按墙钟窗口轮换生效 root 链
     - kind: preset         # 冻结的 UTC+8 窗口；仅链可编辑
       preset: liang-peak   # 周一至周五 09:00–12:00 与 14:00–18:00
@@ -109,7 +108,7 @@ fallbacks:
 
 **2. 配置全时段 `rootChain`。** 前面的条目是降级链，请求失败时先走；**最后**一项是默认模型。
 
-> **链尾合规**：最后一项必须是恰好一个官方 V4 模型——`deepseek-official/deepseek-v4-flash` 或 `deepseek-official/deepseek-v4-pro`（二选一）。设置卡与 gateway 在保存时拒绝其它尾巴；遗留的非合规尾巴启动时告警并继续按 fallback-only 走原链，但无法原样保存。
+> **链尾合规**：最后一项必须是恰好一个官方模型——`deepseek-official/deepseek-flash` 或 `deepseek-official/deepseek-pro`（二选一）。设置卡与 gateway 在保存时拒绝其它尾巴；遗留的非合规尾巴启动时告警并继续按 fallback-only 走原链，但无法原样保存。已退役的 `deepseek-v4-flash` / `deepseek-v4-pro` 不再是合法链尾——已保存的 V4 尾巴现在会告警、进入惰性（分时行 + 虚拟选择器）、并在选到合法链尾前阻止保存。`deepseek-pro` 是合法选择器但其模型尚未进入目录：设置卡中显示为禁用（「暂不可用」），请求在 gateway 启用该 id 前会在 provider 处失败。插件不探测目录可用性——含 `deepseek-pro` 的链会像其它精确条目一样派发到它；覆盖解析生效链的第一个精确链头，因此 Pro 之前有可用条目的链仍路由到更早的条目。
 
 **3. 添加 `timeSlots`（可选）。** 各行按墙钟窗口轮换生效 root 链。预设行使用冻结的 UTC+8 窗口（仅链可编辑；存在预设行时 `tz` 锁定 `Asia/Shanghai`）；自定义行使用 `start`/`end`（可跨午夜）与可选的 `days` 列表。第一个窗口包含当前时刻的行生效；无行命中 → 全时段 `rootChain`。分时切换是路由种子——在下一个 root 请求生效、不消耗冷却（见 [峰谷无忧](#峰谷无忧)）。
 
@@ -135,7 +134,7 @@ fallbacks:
 - **冷却与回主**：被切离/失败的模型在冷却期内不再入选；`revertPolicy: cooldown-expiry` 冷却到期后自动回主模型。
 - **宿主子代理模型策略（dsh 0.1.2）**：当宿主 `subagent-model-selection` 策略启用时，其允许列表对每个插件发起的 subagent 路由都是硬约束——显式授权的派发路由保持为链头（跳过角色注入），继承注入的链头与失败切换目标都与生效允许列表求交集，交集为空则跳过注入/切换（warn 日志 + 只读卡片警告；绝不发送允许列表之外的请求）。策略存在但不可读时 fail-closed。策略关闭/缺省时，注入与失败切换的选择与 0.3.5 完全一致。覆盖路径上的 `reasoningEffort` 遵循上游 routeChanged 规则（同路由 → 保留；跨路由 → 除非显式指定否则丢弃）。见 [宿主子代理模型策略](#宿主子代理模型策略dsh-012)。
 - **半开恢复（可选）**：`recovery: half-open` 让恢复以证据驱动——冷却到期后路由进入 **half-open**，以一次记录探针（logged probe）放行，而不是直接恢复首选；连续失败使抑制时长按 **×2** 逐次升级、**1 小时**封顶；观察到完成即闭合回路、完全恢复首选。`revertPolicy: 'never'` 使该机制完全失效；状态为会话级内存态（重启即重置）。仅 YAML 配置——默认 `timer` 保持所有既有行为逐字节一致（见 [docs/configuration.md](docs/configuration.md#recovery-mode-recovery-key)）。
-- **行为可见**：每次切换以 info 级日志行（from/to/role/reason）记录——无静默换模型。插件**刻意不写** durable `fallbacks/switch` 会话事件（issue #52——apply() 时的事件类型注册被证伪无效，含该事件的会话在 dsh 重启后拒绝加载）。由旧版插件写入、含此类事件的会话由 `scripts/repair-fallbacks-switch-logs.ts` 修复——旧事件被标记 ignorable 后，受影响会话可重新加载。
+- **行为可见**：每次切换以 info 级日志行（from/to/role/reason）记录——无静默换模型。插件**刻意不写** durable `fallbacks/switch` 会话事件（issue #52——apply() 时的事件类型注册被证伪无效，含该事件的会话在 dsh 重启后拒绝加载）。由旧版插件写入、含此类事件的会话**无法**通过 `ignorable` 标记修复——已发布的 session-format 迁移链（v0→v1）即使事件带 `ignorable` 也拒绝未知事件类型——因此 `scripts/repair-fallbacks-switch-logs.ts` 现在 fail-closed，只报告此类日志（持久修复应在上游迁移边界完成）。
 - **安全阀**：`maxSwitchesPerStep` 限制每 step 切换次数、`alwaysModeRetryCap` 限制 always 模式重试——链循环不会放大延迟。
 - **无配置回归（no-op）**：未配置任何链时行为与未安装插件完全一致——`enabled` 默认关闭（见 [最小配置](#最小配置)）。
 
@@ -161,9 +160,9 @@ fallbacks:
 
 注意：
 
-- **选择器文案**：目录行的 `name`（composer 触发器显示）是动态的——`Auto: DeepSeek V4 Flash[Liang Peak]` / `Auto: DeepSeek V4 Flash[all-day]`（用 catalog 显示名，不是 model id）；id 仍是 `Auto`。all-day 尾巴不合规则只显示 `Auto`。重新打开选择器即可刷新。
+- **选择器文案**：目录行的 `name`（composer 触发器显示）是动态的——`Auto: DeepSeek Flash[Liang Peak]` / `Auto: DeepSeek Flash[all-day]`（用 catalog 显示名，不是 model id）；id 仍是 `Auto`。all-day 尾巴不合规则只显示 `Auto`。重新打开选择器即可刷新。
 - **仅 root**：这一行只关乎 root 代理。subagent 的角色解析与注入不变；继承了该选择的 subagent 会话仍经链头路由——虚拟行只是薄委托，绝不是第二个路由引擎。
-- **链尾合规门槛**：覆盖/委托成功要求 all-day 链**尾巴合规**——最后一项必须是恰好一个官方 V4 模型（`deepseek-official/deepseek-v4-flash` 或 `deepseek-official/deepseek-v4-pro`，即设置卡的「默认模型」面板）；前面的默认降级链先走。禁用插件后该行隐藏（slot/链编辑不会触发注册抖动）。
+- **链尾合规门槛**：覆盖/委托成功要求 all-day 链**尾巴合规**——最后一项必须是恰好一个官方模型（`deepseek-official/deepseek-flash` 或 `deepseek-official/deepseek-pro`，即设置卡的「默认模型」面板）；前面的默认降级链先走。禁用插件后该行隐藏（slot/链编辑不会触发注册抖动）。
 - **过期选择**：行消失（插件禁用）而会话仍选中 `FallbacksChain / Auto` 时，会话继续把它显示为当前模型，但 `routable: false`——从目录选一个真实模型即可继续（宿主原生目录语义）。
 - **能力跟随链头**：该行的模型元数据（上下文窗口、模态、推理）镜像当前生效链头；重试归属保持宽松默认——重试/失败记到被委托的真实链头，而非 `FallbacksChain` provider。完整语义 → [docs/configuration.md](docs/configuration.md)。
 
@@ -171,11 +170,11 @@ fallbacks:
 
 峰谷无忧在[首页专题](#峰谷无忧)中介绍，本节是完整参考。分时槽行按墙钟窗口轮换**生效 root 链**——适合按峰谷切换模型，且不会把墙钟轮换误认为故障降级。文案严格区分：时段轮换的日志与 UI 用**分时切换**；失败降级保持**降级切换**；会话内「模型已降级」提示只出现在失败路径。
 
-- **匹配顺序**：每个 root 请求时刻，第一条窗口包含当前时刻（按 `fallbacks.tz`，默认 `Asia/Shanghai` / UTC+8）的额外行生效——该行的模型链**取代**全时段链；无行命中则用全时段 `rootChain`。全时段行固定最后且**必选**：最后一项必须是恰好一个官方 V4 模型（Flash 或 Pro；前面的降级条目先走）。
+- **匹配顺序**：每个 root 请求时刻，第一条窗口包含当前时刻（按 `fallbacks.tz`，默认 `Asia/Shanghai` / UTC+8）的额外行生效——该行的模型链**取代**全时段链；无行命中则用全时段 `rootChain`。全时段行固定最后且**必选**：最后一项必须是恰好一个官方模型（Flash 或 Pro；前面的降级条目先走）。
 - **预设**（冻结，不可编辑窗口）：`liang-peak` = 周一至周五 09:00–12:00 **与** 14:00–18:00；`liang-valley` = 其它所有 UTC+8 时间；`glm-peak` = 周一至周五 14:00–18:00；`glm-valley` = 其余时间。一个预设 id 对应一行；设置卡的选择器不会重复提供已添加的预设。
 - **自定义行**：`start` / `end`（`HH:mm`，可跨午夜）+ 可选 `days`（0=周日…6=周六；缺省/空 = 每天）+ 模型。
 - **下一请求生效**：时段边界跨越绝不打断进行中的 step——新行在下一个 root 请求生效。轮换仅挂载生效：info 日志 + 设置卡/`/fallbacks` 状态行，无 durable 切换事件。
-- **设置卡**：主代理区块下分三块——**分时槽设置**（额外行：添加预设 / 添加自定义 / 删除 / 按钮或**拖拽**排序；预设行只读展示窗口摘要、仅可编辑模型链；自定义行带可编辑名称；**时区选择器**在此区块内，只要存在预设行就**锁定 Asia/Shanghai**——预设窗口是冻结的 UTC+8 常量）、**默认降级链**（all-day 链，可配置的 provider/model 选择器列表）与**默认模型**（官方 V4 Flash | Pro 二选一链头）。行可折叠为「名称 + 首个模型」。没有 `timeSlots.enabled` 总开关（添加行即开启），也没有 `rootMode` 控件。
+- **设置卡**：主代理区块下分三块——**分时槽设置**（额外行：添加预设 / 添加自定义 / 删除 / 按钮或**拖拽**排序；预设行只读展示窗口摘要、仅可编辑模型链；自定义行带可编辑名称；**时区选择器**在此区块内，只要存在预设行就**锁定 Asia/Shanghai**——预设窗口是冻结的 UTC+8 常量）、**默认降级链**（all-day 链，可配置的 provider/model 选择器列表）与**默认模型**（官方 Flash | Pro 二选一链头）。行可折叠为「名称 + 首个模型」。没有 `timeSlots.enabled` 总开关（添加行即开启），也没有 `rootMode` 控件。
 
 ## 预设角色（Preset roles）
 
@@ -202,7 +201,7 @@ fallbacks:
     - CONTEXT_WINDOW_EXCEEDED  # 请求装不下时降级
   rootChain:
     - anthropic/claude-3-5-sonnet          # 先走
-    - deepseek-official/deepseek-v4-flash  # 兜底（Flash 或 Pro）
+    - deepseek-official/deepseek-flash  # 兜底（Flash 或 Pro）
 ```
 
 **顺序——降级先于压缩。** 只要 `triggerCodes` 含 `CONTEXT_WINDOW_EXCEEDED`，本插件的 `agent/request-error` 监听就会**先于**宿主压缩插件处理该拒绝：首次超限即把会话切到 fallback 模型，上下文完全不会被压缩。若更希望先尝试压缩，就不要把该码列入 `triggerCodes`。

package/dist/client/index.js

@@ -198,6 +198,12 @@ window.__ModuleLoader__.load({
 				raw: trimmed
 			};
 		}
+		/** The two official all-day tail ids (XOR — exactly one legal tail). */
+		const OFFICIAL_ALL_DAY_IDS = ["deepseek-official/deepseek-flash", "deepseek-official/deepseek-pro"];
+		/** Whether `id` is one of the two official all-day tail ids. */
+		function isOfficialAllDayId(id) {
+			return id === "deepseek-official/deepseek-flash" || id === "deepseek-official/deepseek-pro";
+		}
 		/**
 		* Frozen preset windows (UTC+8). `liang-peak` and `glm-peak` are
 		* Monday–Friday only (day mask `[1, 2, 3, 4, 5]`); their valleys are the
@@ -402,17 +408,18 @@ window.__ModuleLoader__.load({
 		}
 		/**
 		* All-day conformance (P6): the all-day chain is conforming when its LAST
-		* entry (the tail — the card's 默认模型 panel) is exactly one official V4
-		* model — Flash XOR Pro. Leading entries (the card's 默认降级链 block) are
-		* the ordered walk before that last-resort fallback. An empty chain or a
-		* chain whose tail is not an official V4 model keeps slot rows inert and
-		* refuses the virtual-row override/delegate; the v0.2.2 failure walk over
-		* the raw chain stays verbatim.
+		* entry (the tail — the card's 默认模型 panel) is exactly one official
+		* model — Flash or Pro (XOR). Leading entries (the card's 默认降级链 block)
+		* are the ordered walk before that last-resort fallback. An empty chain or
+		* a chain whose tail is not an official model (including the retired V4
+		* ids) keeps slot rows inert and refuses the virtual-row
+		* override/delegate; the v0.2.2 failure walk over the raw chain stays
+		* verbatim.
 		*/
 		function isAllDayConforming(chain) {
 			if (chain.length < 1) return false;
 			const tail = chain[chain.length - 1];
-			return tail === "deepseek-official/deepseek-v4-flash" || tail === "deepseek-official/deepseek-v4-pro";
+			return isOfficialAllDayId(tail);
 		}
 		/**
 		* Slot winner + display label (P5): drives 分时切换 detection (per-root-agent
@@ -1468,10 +1475,11 @@ window.__ModuleLoader__.load({
 			"timeSlots.day.fri": "五",
 			"timeSlots.day.sat": "六",
 			"timeSlots.selector.add": "添加选择器",
-			"allDay.hint": "全天链的最后一档兜底：官方 V4 Flash 或 V4 Pro 二选一",
-			"allDay.flash": "官方 V4 Flash（deepseek-official/deepseek-v4-flash）",
-			"allDay.pro": "官方 V4 Pro（deepseek-official/deepseek-v4-pro）",
-			"allDay.nonconforming": "当前默认模型不合法：请选择官方 V4 Flash 或 V4 Pro 后保存",
+			"allDay.hint": "全天链的最后一档兜底：官方 Flash 或 Pro 二选一",
+			"allDay.flash": "官方 Flash（deepseek-official/deepseek-flash）",
+			"allDay.pro": "官方 Pro（deepseek-official/deepseek-pro）",
+			"allDay.proCaveat": "（暂不可用）",
+			"allDay.nonconforming": "当前默认模型不合法：请选择官方 Flash 或 Pro 后保存",
 			"roles.list.label": "角色实体",
 			"roles.list.hint": "先声明角色，规则才能引用",
 			"roles.list.tooltip": "角色 id 须匹配 /^[a-z0-9-]{1,32}$/ 且唯一；\"inherit\" 为保留字，不能用作角色 id。",
@@ -1514,7 +1522,7 @@ window.__ModuleLoader__.load({
 			"validation.ruleRoleUndeclared": "规则引用了未声明的角色 \"{role}\"",
 			"validation.ruleRoleRequired": "规则未选择角色：请选择目标角色，或删除该行",
 			"validation.roleChainRequired": "角色 \"{id}\" 未配置模型：请至少添加一条链选择器（模型配置）",
-			"validation.allDayRequired": "默认模型必须二选一：官方 V4 Flash 或 V4 Pro",
+			"validation.allDayRequired": "默认模型必须二选一：官方 Flash 或 Pro",
 			"validation.slotChainRequired": "分时槽未配置模型：请至少添加一条链选择器",
 			"validation.slotWindow": "分时槽开始/结束时间须为 HH:mm 格式",
 			"validation.slotDays": "星期取值须为 0–6 的整数",
@@ -1663,10 +1671,11 @@ window.__ModuleLoader__.load({
 			"timeSlots.day.fri": "Fri",
 			"timeSlots.day.sat": "Sat",
 			"timeSlots.selector.add": "Add selector",
-			"allDay.hint": "Last-resort fallback of the all-day chain: official V4 Flash or Pro (pick exactly one)",
-			"allDay.flash": "Official V4 Flash (deepseek-official/deepseek-v4-flash)",
-			"allDay.pro": "Official V4 Pro (deepseek-official/deepseek-v4-pro)",
-			"allDay.nonconforming": "The current default model is not valid: pick official V4 Flash or Pro before saving",
+			"allDay.hint": "Last-resort fallback of the all-day chain: official Flash or Pro (pick exactly one)",
+			"allDay.flash": "Official Flash (deepseek-official/deepseek-flash)",
+			"allDay.pro": "Official Pro (deepseek-official/deepseek-pro)",
+			"allDay.proCaveat": " (not yet available)",
+			"allDay.nonconforming": "The current default model is not valid: pick official Flash or Pro before saving",
 			"roles.list.label": "Declared roles",
 			"roles.list.hint": "Declare roles before rules can reference them",
 			"roles.list.tooltip": "Role ids must match /^[a-z0-9-]{1,32}$/ and be unique; \"inherit\" is reserved and cannot be used as a role id.",
@@ -1709,7 +1718,7 @@ window.__ModuleLoader__.load({
 			"validation.ruleRoleUndeclared": "Rule references undeclared role \"{role}\"",
 			"validation.ruleRoleRequired": "Rule has no role selected: pick a target role, or remove the row",
 			"validation.roleChainRequired": "Role \"{id}\" has no model config: add at least one chain entry",
-			"validation.allDayRequired": "The default model must be exactly one official V4 model (V4 Flash or V4 Pro)",
+			"validation.allDayRequired": "The default model must be exactly one official model (Flash or Pro)",
 			"validation.slotChainRequired": "Time-slot row has no models: add at least one chain entry",
 			"validation.slotWindow": "Time-slot start/end must use HH:mm format",
 			"validation.slotDays": "Days must be integers 0–6",
@@ -1973,8 +1982,10 @@ window.__ModuleLoader__.load({
 		* implemented without a store change); on a first mount the latch is false,
 		* so the healthy card starts (and stays) collapsed through its first load.
 		*/
-		const ALL_DAY_FLASH = "deepseek-official/deepseek-v4-flash";
-		const ALL_DAY_PRO = "deepseek-official/deepseek-v4-pro";
+		const ALL_DAY_LABEL_KEYS = ["allDay.flash", "allDay.pro"];
+		/** Optional caveat suffix per option (parallel to OFFICIAL_ALL_DAY_IDS):
+		* Pro's radio is always disabled — its model is not yet in the catalog. */
+		const ALL_DAY_CAVEAT_KEYS = [void 0, "allDay.proCaveat"];
 		const SLOT_PRESET_IDS = [
 			"liang-peak",
 			"liang-valley",
@@ -2027,19 +2038,19 @@ window.__ModuleLoader__.load({
 		/** Strict 24h `HH:mm` — the resolver's HHMM_RE twin (drift-guarded by the gateway reject-on-save). */
 		const HHMM_RE = /^([01]\d|2[0-3]):[0-5]\d$/;
 		/**
-		* The 默认模型 value for a chain: the official V4 id when the chain TAIL
-		* is that model (Flash XOR Pro — leading 默认降级链 entries allowed);
+		* The 默认模型 value for a chain: the official id when the chain TAIL
+		* is that model (Flash or Pro XOR — leading 默认降级链 entries allowed);
 		* `''` for an empty chain or a chain whose last entry is not official
 		* (the panel reads back unselected and save validation blocks the value).
 		*/
 		function allDayModelOf(chain) {
 			const tail = chain.length >= 1 ? chain[chain.length - 1] : void 0;
-			return tail === ALL_DAY_FLASH || tail === ALL_DAY_PRO ? tail : "";
+			return tail !== void 0 && isOfficialAllDayId(tail) ? tail : "";
 		}
 		/**
-		* The 默认降级链 editor row: the leading entries BEFORE the official-V4
-		* tail, or the whole chain while the tail is not official (the draft
-		* rides the accepted value until a 默认模型 pick).
+		* The 默认降级链 editor row: the leading entries BEFORE the official tail
+		* (Flash or Pro), or the whole chain while the tail is not official (the
+		* draft rides the accepted value until a 默认模型 pick).
 		*/
 		function allDayChainRowOf(chain, catalog) {
 			return rootChainToRows(allDayModelOf(chain) === "" ? chain : chain.slice(0, -1), catalog)[0];
@@ -2074,8 +2085,8 @@ window.__ModuleLoader__.load({
 		* (AC-7 re-scope, PM decision 2026-08-17 Option A).
 		*
 		* All-day: rootChain is composed from the 默认降级链 editor's leading
-		* selectors plus the 默认模型 tail (exactly one official V4 — Flash XOR
-		* Pro). While no tail is selected the ACCEPTED chain rides through
+		* selectors plus the 默认模型 tail (exactly one official model — Flash or
+		* Pro XOR). While no tail is selected the ACCEPTED chain rides through
 		* untouched. `timeSlots` is rebuilt from the slot rows every render. `tz`
 		* is a card scalar: preset rows lock it to Asia/Shanghai; custom rows
 		* follow the selected timezone.
@@ -2165,7 +2176,7 @@ window.__ModuleLoader__.load({
 				if ((role.chain ?? []).length === 0 && !seedInfo.has(role.id.trim())) errors.sub.push(t("validation.roleChainRequired", { id: role.id }));
 			}
 			const allDayTail = draft.rootChain.length >= 1 ? draft.rootChain[draft.rootChain.length - 1] : void 0;
-			if (allDayTail !== ALL_DAY_FLASH && allDayTail !== ALL_DAY_PRO) errors.main.push(t("validation.allDayRequired"));
+			if (allDayTail === void 0 || !isOfficialAllDayId(allDayTail)) errors.main.push(t("validation.allDayRequired"));
 			for (const entry of draft.rootChain) try {
 				parseSelector(entry);
 			} catch (error) {
@@ -3448,36 +3459,28 @@ window.__ModuleLoader__.load({
 													className: FallbacksCard_module_css_default.list,
 													children: /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
 														className: FallbacksCard_module_css_default.editorCard,
-														children: [
-															/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-																className: FallbacksCard_module_css_default.optionRow,
-																children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
-																	type: "radio",
-																	name: "fallbacks-all-day",
-																	checked: allDayModel === ALL_DAY_FLASH,
-																	disabled: !writable,
-																	onChange: () => {
-																		setAllDayModel(ALL_DAY_FLASH);
-																	}
-																}), t("allDay.flash")]
-															}),
-															/* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
-																className: FallbacksCard_module_css_default.optionRow,
-																children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
+														children: [OFFICIAL_ALL_DAY_IDS.map((id, index) => /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("label", {
+															className: FallbacksCard_module_css_default.optionRow,
+															children: [
+																/* @__PURE__ */ (0, react_jsx_runtime.jsx)("input", {
 																	type: "radio",
 																	name: "fallbacks-all-day",
-																	checked: allDayModel === ALL_DAY_PRO,
-																	disabled: !writable,
+																	checked: allDayModel === id,
+																	disabled: !writable || id === "deepseek-official/deepseek-pro",
 																	onChange: () => {
-																		setAllDayModel(ALL_DAY_PRO);
+																		setAllDayModel(id);
 																	}
-																}), t("allDay.pro")]
-															}),
-															allDayModel === "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
-																className: FallbacksCard_module_css_default.hint,
-																children: t("allDay.nonconforming")
-															})
-														]
+																}),
+																t(ALL_DAY_LABEL_KEYS[index]),
+																ALL_DAY_CAVEAT_KEYS[index] !== void 0 && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+																	className: FallbacksCard_module_css_default.hint,
+																	children: t(ALL_DAY_CAVEAT_KEYS[index])
+																})
+															]
+														}, id)), allDayModel === "" && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("span", {
+															className: FallbacksCard_module_css_default.hint,
+															children: t("allDay.nonconforming")
+														})]
 													})
 												})
 											]

package/dist/client/locales.d.ts

@@ -102,6 +102,7 @@ export declare const zh: {
     'allDay.hint': string;
     'allDay.flash': string;
     'allDay.pro': string;
+    'allDay.proCaveat': string;
     'allDay.nonconforming': string;
     'roles.list.label': string;
     'roles.list.hint': string;
@@ -299,6 +300,7 @@ export declare const en: {
     'allDay.hint': string;
     'allDay.flash': string;
     'allDay.pro': string;
+    'allDay.proCaveat': string;
     'allDay.nonconforming': string;
     'roles.list.label': string;
     'roles.list.hint': string;

package/dist/events.d.ts

@@ -4,9 +4,11 @@
  * Writing is stopped (issue #52): the plugin no longer appends this event —
  * the apply()-time event-type registration was proven ineffective (module
  * instance mismatch), and a session containing the event refused to load
- * after a dsh restart. The event now exists only in history: old logs are
- * repaired by `scripts/repair-fallbacks-switch-logs.ts`, which marks legacy
- * events ignorable so affected sessions load again.
+ * after a dsh restart. The event now exists only in history: old logs that
+ * contain it cannot be repaired by an `ignorable` flag (the released
+ * session-format chain refuses unknown event types even when marked
+ * ignorable), so `scripts/repair-fallbacks-switch-logs.ts` is a detector
+ * that reports such logs and never writes.
  * The module is type-only — the augmentation is erased at runtime; the
  * plugin's runtime behavior lives in `src/index.ts`.
  *

package/dist/index.js

@@ -34,6 +34,9 @@ function resolveWildcardEntry(failingModel, provider) {
 		raw: `${provider}/${failingModel}`
 	};
 }
+function isOfficialAllDayId(id) {
+	return id === "deepseek-official/deepseek-flash" || id === "deepseek-official/deepseek-pro";
+}
 const PRESETS = {
 	"liang-peak": {
 		windows: [{
@@ -220,7 +223,7 @@ function labelOf(row) {
 function isAllDayConforming(chain) {
 	if (chain.length < 1) return false;
 	const tail = chain[chain.length - 1];
-	return tail === "deepseek-official/deepseek-v4-flash" || tail === "deepseek-official/deepseek-v4-pro";
+	return isOfficialAllDayId(tail);
 }
 function resolveEffectiveChain(config, now, tz) {
 	const state = resolveSlotState(config, now, tz);
@@ -359,7 +362,7 @@ function validateFallbacksConfig(config, logger) {
 		if ((role.chain ?? []).length === 0) logger.warn(`llm-fallbacks: role "${role.id}" has no model config — declare at least one chain entry, or use the built-in "inherit" rule target instead`);
 		if (role.fallback !== void 0 && role.fallback !== "inherit-root" && role.fallback !== "none") logger.warn(`llm-fallbacks: role "${role.id}" has invalid fallback "${String(role.fallback)}" — expected "inherit-root" or "none"`);
 	}
-	if (config.rootChain.length > 0 && !isAllDayConforming(config.rootChain)) logger.warn("llm-fallbacks: rootChain must end with exactly one official V4 model (deepseek-official/deepseek-v4-flash or deepseek-official/deepseek-v4-pro) — time-slot rows and the virtual picker row stay inert until the all-day chain tail conforms");
+	if (config.rootChain.length > 0 && !isAllDayConforming(config.rootChain)) logger.warn("llm-fallbacks: rootChain must end with exactly one official model (deepseek-official/deepseek-flash or deepseek-official/deepseek-pro) — time-slot rows and the virtual picker row stay inert until the all-day chain tail conforms");
 	for (const entry of config.rootChain) try {
 		parseSelector(entry);
 	} catch (error) {
@@ -1160,7 +1163,7 @@ function validateConfigPatch(patch) {
 		}
 		if (key === "rootChain") {
 			const chain = patch[key];
-			if (chain !== null && chain !== void 0 && (!Array.isArray(chain) || !isAllDayConforming(chain))) throw new Error("dsh-llm-fallbacks: rootChain must end with exactly one official V4 model (deepseek-official/deepseek-v4-flash or deepseek-official/deepseek-v4-pro)");
+			if (chain !== null && chain !== void 0 && (!Array.isArray(chain) || !isAllDayConforming(chain))) throw new Error("dsh-llm-fallbacks: rootChain must end with exactly one official model (deepseek-official/deepseek-flash or deepseek-official/deepseek-pro)");
 		}
 	}
 	Config(patch);
@@ -2058,10 +2061,10 @@ function buildFallbacksTuiSection() {
 					zh: "根降级链（JSON）",
 					en: "Root chain (JSON)"
 				},
-				hint: "JSON array of model selectors; the last entry must be an official V4 model.",
+				hint: "JSON array of model selectors; the last entry must be an official model (deepseek-official/deepseek-flash or deepseek-official/deepseek-pro). Pro is a legal tail but not yet available in the catalog — the settings card shows it disabled.",
 				hintDescriptions: {
-					zh: "模型选择器 JSON 数组；末项必须是官方 V4 模型。",
-					en: "JSON array of model selectors; the last entry must be an official V4 model."
+					zh: "模型选择器 JSON 数组；末项必须是官方模型（deepseek-official/deepseek-flash 或 deepseek-official/deepseek-pro）。Pro 是合法链尾但目录暂未提供——设置卡中显示为禁用。",
+					en: "JSON array of model selectors; the last entry must be an official model (deepseek-official/deepseek-flash or deepseek-official/deepseek-pro). Pro is a legal tail but not yet available in the catalog — the settings card shows it disabled."
 				},
 				group: "chain",
 				kind: "text",
@@ -2704,7 +2707,7 @@ function apply(ctx, config = defaultFallbacksConfig) {
 			});
 		}
 		if (config.enabled && seed.provider === "FallbacksChain" && seed.model === "Auto" && agent.session?.header?.origin !== "subagent") {
-			if (!isAllDayConforming(config.rootChain)) logger.warn("llm-fallbacks: FallbacksChain/Auto selected but the all-day rootChain is not conforming (exactly one official V4 model) — no primary override");
+			if (!isAllDayConforming(config.rootChain)) logger.warn("llm-fallbacks: FallbacksChain/Auto selected but the all-day rootChain is not conforming (exactly one official model: deepseek-official/deepseek-flash or deepseek-official/deepseek-pro) — no primary override");
 			else {
 				const head = firstDispatchableExactHead(resolveEffectiveChain(config, new Date(), config.tz ?? "Asia/Shanghai"));
 				if (head === void 0) logger.warn("llm-fallbacks: FallbacksChain/Auto selected but the effective chain has no exact head (empty, wildcard-only, or self-route) — no primary override");

package/dist/time-slots.d.ts

@@ -1,6 +1,6 @@
 /**
  * Time-slot rows for `fallbacks` (plan fallbacks-timeslots Task 1, pins
- * P4–P6): frozen preset windows, the official-V4 all-day conformance
+ * P4–P6): frozen preset windows, the official all-day conformance
  * guard, and the pure `resolveEffectiveChain` / `resolveSlotState`
  * resolver.
  *
@@ -15,9 +15,17 @@
  * @module dsh-llm-fallbacks/time-slots
  */
 import type { FallbacksConfig } from './config.ts';
-/** Official V4 models — the ONLY legal all-day selectors (length 1, XOR). */
-export declare const OFFICIAL_V4_FLASH = "deepseek-official/deepseek-v4-flash";
-export declare const OFFICIAL_V4_PRO = "deepseek-official/deepseek-v4-pro";
+/** Official all-day selectors — the ONLY legal tails (length 1, XOR):
+ * Flash (the current official default, selectable) and Pro (displayed but
+ * disabled — its model is not yet served by the 0.1.5-rc.1 catalog). The
+ * retired V4 ids (`deepseek-v4-flash` / `deepseek-v4-pro`) are no longer
+ * legal tails. */
+export declare const OFFICIAL_FLASH = "deepseek-official/deepseek-flash";
+export declare const OFFICIAL_PRO = "deepseek-official/deepseek-pro";
+/** The two official all-day tail ids (XOR — exactly one legal tail). */
+export declare const OFFICIAL_ALL_DAY_IDS: readonly ["deepseek-official/deepseek-flash", "deepseek-official/deepseek-pro"];
+/** Whether `id` is one of the two official all-day tail ids. */
+export declare function isOfficialAllDayId(id: string): boolean;
 /** The four frozen preset ids (exact strings, spec lock). */
 export declare const PRESET_IDS: readonly ["liang-peak", "liang-valley", "glm-peak", "glm-valley"];
 export type PresetId = (typeof PRESET_IDS)[number];
@@ -65,12 +73,13 @@ export interface PresetDefinition {
 export declare const PRESETS: Record<PresetId, PresetDefinition>;
 /**
  * All-day conformance (P6): the all-day chain is conforming when its LAST
- * entry (the tail — the card's 默认模型 panel) is exactly one official V4
- * model — Flash XOR Pro. Leading entries (the card's 默认降级链 block) are
- * the ordered walk before that last-resort fallback. An empty chain or a
- * chain whose tail is not an official V4 model keeps slot rows inert and
- * refuses the virtual-row override/delegate; the v0.2.2 failure walk over
- * the raw chain stays verbatim.
+ * entry (the tail — the card's 默认模型 panel) is exactly one official
+ * model — Flash or Pro (XOR). Leading entries (the card's 默认降级链 block)
+ * are the ordered walk before that last-resort fallback. An empty chain or
+ * a chain whose tail is not an official model (including the retired V4
+ * ids) keeps slot rows inert and refuses the virtual-row
+ * override/delegate; the v0.2.2 failure walk over the raw chain stays
+ * verbatim.
  */
 export declare function isAllDayConforming(chain: readonly string[]): boolean;
 /**

package/package.json

@@ -5,7 +5,7 @@
     "dsh",
     "dsh-plugin"
   ],
-  "version": "0.4.3",
+  "version": "0.4.4",
   "type": "module",
   "main": "./dist/index.js",
   "types": "./dist/index.d.ts",
@@ -60,45 +60,65 @@
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.2",
-    "@deepseek-ai/dsh-agent": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-api-gateway": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-api-remotes": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-api-session-controller": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-connection": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-locale": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-store": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-chat": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-client-ui-slots": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-commands": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-llm-retry": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-session": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-settings": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-tool-subagent": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-typert-protocol": "^0.1.2-rc.1",
-    "@deepseek-ai/dsh-typert-registry": "^0.1.2-rc.1",
+    "@deepseek-ai/dsh-agent": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-gateway": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-remotes": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-api-session-controller": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-connection": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-locale": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-store": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-chat": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-conversation": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-primitives": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-renderer": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-settings-plugins": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-client-ui-slots": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-commands": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-llm-retry": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-session": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-settings": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-tool-subagent": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-protocol": "^0.1.5-rc.1",
+    "@deepseek-ai/dsh-typert-registry": "^0.1.5-rc.1",
     "@deepseek-ai/schemastery": "^3.18.2",
     "react": "^18.2.0"
   },
   "devDependencies": {
+    "@shikijs/langs": "^4.4.3",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/react": "^16.3.2",
+    "@types/mdast": "^4.0.4",
     "@types/node": "^22.20.0",
     "@types/react": "~18.3.31",
     "@types/react-dom": "~18.3.7",
     "@types/use-sync-external-store": "^1.5.0",
+    "anser": "^2.3.5",
+    "clsx": "^2.1.1",
+    "immer": "^10.2.0",
     "jsdom": "29.1.1",
+    "katex": "^0.16.47",
+    "mdast-util-from-markdown": "^2.0.3",
+    "mdast-util-gfm": "^3.1.0",
+    "mdast-util-math": "^3.0.0",
+    "micromark-core-commonmark": "^2.0.3",
+    "micromark-extension-gfm": "^3.0.0",
+    "micromark-extension-math": "^3.1.0",
+    "micromark-factory-space": "^2.0.1",
+    "micromark-util-character": "^2.1.1",
+    "micromark-util-classify-character": "^2.0.1",
+    "micromark-util-sanitize-uri": "^2.0.1",
+    "micromark-util-symbol": "^2.0.1",
+    "micromark-util-types": "^2.0.2",
     "react": "^18.3.1",
     "react-dom": "^18.3.1",
+    "shiki": "^4.4.3",
     "tsdown": "^0.22.2",
     "tsx": "^4.22.4",
     "typescript": "^5.9.3",
-    "vitest": "^4.1.8"
+    "vitest": "^4.1.8",
+    "zustand": "~4.4.7"
   },
   "repository": {
     "type": "git",

package/scripts/build-client.ts

@@ -48,11 +48,15 @@ const OUT_FILE = 'index.js'
 
 /**
  * Frozen loader module table (dsh mechanism-guide): the plan-documented
- * composition = PLATFORM_MODULES (8 entries in 0.1.2, `web/src/platform.ts:8-15`
- * — the old runtime `./client` exemption became the
- * `@deepseek-ai/dsh-client-store` platform module, so the store VALUE import
- * stays external and resolves from the host loader table) + the
- * PRELOADED_CLIENT_EXTERNALS (empty in 0.1.2, `web/src/platform.ts:16-17`).
+ * composition = PLATFORM_MODULES (9 entries in 0.1.5-rc.1,
+ * `web/src/platform.ts:8-16` — the old runtime `./client` exemption became
+ * the `@deepseek-ai/dsh-client-store` platform module, so the store VALUE
+ * import stays external and resolves from the host loader table) + the
+ * host's PRELOADED_CLIENT_EXTERNALS (empty in `packages/client/web/src/platform.ts`).
+ * The table need not list
+ * every platform module — it lists what this plugin's client half resolves
+ * from the frozen loader table; the rc.1 addition
+ * `@deepseek-ai/dsh-client-ui-dockkit` is not imported by this plugin.
  * rc.8 dropped `dsh-client-web-react` (deleted
  * package — the uSES bridge is vendored in `src/client/use-snapshot.ts`),
  * `dsh-client-ui-attachment` and `dsh-client-schema-form` from the platform

package/scripts/repair-fallbacks-switch-logs.ts

@@ -1,5 +1,5 @@
 /**
- * repair-fallbacks-switch-logs.ts — repair session logs poisoned by the old
+ * repair-fallbacks-switch-logs.ts — detect session logs poisoned by the old
  * plugin's durable `fallbacks/switch` events.
  *
  * Background: until Task 1 of `fallbacks-session-event-stop-write`, the
@@ -8,60 +8,50 @@
  * is outside its baked catalog unless the event carries `ignorable: true`.
  * `Session.append` cannot write `ignorable`, and runtime registration proved
  * ineffective (module-instance mismatch). Session logs written while the old
- * plugin was active therefore fail to load after a dsh restart. This script
- * marks those events `ignorable: true` so the read path accepts them again.
+ * plugin was active therefore fail to load after a dsh restart.
+ *
+ * FAIL-CLOSED (measured against the published 0.1.5-rc.1 packages): the
+ * released session-format migration chain refuses unknown event types even
+ * with `ignorable: true` — the v0→v1 stage's `assertReleasedEventPayload`
+ * throws `format v0 contains unknown historical event type
+ * "fallbacks/switch" ... migration refuses unknown historical events even
+ * when ignorable` before any later edge runs (v1→v2 refuses unknown types
+ * the same way). A log whose `fallbacks/switch` events are marked
+ * `ignorable` therefore still fails to load, so this script NEVER writes a
+ * "repaired" file and never reports a repair: it detects such logs, reports
+ * them, and exits non-zero. The durable fix belongs upstream at the
+ * migration edges, not in this script.
  *
  * Session log format (`~/.dsh/sessions/<namespace>/<session-id>/session.jsonl.zstd`):
  *   - concatenated-zstd-frame container: **first frame MUST decode to
- *     exactly one header line** (rc.7 `assertZstdHeaderFrame`:
- *     `indexOf(10) === length-1`). Subsequent frames hold events.
+ *     exactly one header line** (0.1.5-rc.1 `assertZstdHeaderFrame`:
+ *     `indexOf(10) === length-1` — the framing invariant is unchanged
+ *     since rc.7). Subsequent frames hold events.
  *   - `node:zlib.zstdDecompress` only decodes the FIRST frame, so this
  *     script shells out to the `zstd` CLI (`zstd -d -c` decodes every
- *     concatenated frame). Re-encoding MUST emit frame-1 = header only
- *     + a following frame for the rest — a single-frame rewrite of the
- *     whole log fails host boot (`first frame is not exactly one header line`).
- *
- * IMPORTANT: stop dsh before running with `--apply`. The script replaces a
- * session log via read → transform → atomic rename; a live dsh that appends
- * a new zstd frame between the read and the rename would have that frame
- * lost (read-modify-write race). Report / `--dry-run` runs are safe any
- * time — they never write files.
+ *     concatenated frame).
  *
  * Usage (from the repo root, via tsx — the package.json
  * `repair:fallbacks-switch-logs` script):
  *   pnpm repair:fallbacks-switch-logs -- --dry-run
- *   pnpm repair:fallbacks-switch-logs -- --apply --backup
- *   pnpm repair:fallbacks-switch-logs -- --root /tmp/repair-fixture --dry-run
+ *   pnpm repair:fallbacks-switch-logs -- --root /tmp/repair-fixture
  *
  * Flags:
  *   --root <dir>   session root to walk (default: ~/.dsh/sessions)
- *   --dry-run      report only — never write files
- *   --backup       required with --apply: copy the original to <file>.bak
- *                  before replacing (apply is refused without it)
- *   --apply        actually replace repaired files; requires --backup and a
- *                  stopped dsh; without it (or with --dry-run) the run only
- *                  reports would-change
+ *   --dry-run      report only (the only mode — no write is ever performed)
+ *   --backup       accepted for backward compatibility (no write is ever
+ *                  performed)
+ *   --apply        accepted for backward compatibility (no write is ever
+ *                  performed)
  *
- * Safe by construction: a file is only replaced after its re-encoded form
- * passes `zstd -t`, has a one-line first frame, and carries the original
- * file's permission bits; a file that fails to decompress or re-encode is
- * reported and skipped (never corrupted); the replace is an atomic rename
- * of a temp file in the same directory. Report/dry-run mode performs no
- * filesystem writes at all.
+ * Safe by construction: the script never writes files. A log that fails to
+ * decompress is reported and skipped; a log containing `fallbacks/switch`
+ * events is reported as unrepairable and counts as an error (exit non-zero).
  */
 import { execFileSync } from 'node:child_process'
-import {
-  chmodSync,
-  copyFileSync,
-  existsSync,
-  readdirSync,
-  renameSync,
-  rmSync,
-  statSync,
-  writeFileSync,
-} from 'node:fs'
+import { existsSync, readdirSync } from 'node:fs'
 import { homedir } from 'node:os'
-import { basename, dirname, join } from 'node:path'
+import { join } from 'node:path'
 import { pathToFileURL } from 'node:url'
 
 /** Decoded plaintext cap for one session log (512 MB; logs can be large). */
@@ -83,13 +73,17 @@ export interface MarkFallbacksSwitchIgnorableResult {
  * - every other line (non-switch events, malformed JSON, empty lines, switch
  *   events that already carry `ignorable`) passes through byte-identical;
  * - switch events are re-serialized with `ignorable` appended (insertion
- *   order — the read path only reads `event.ignorable`, so field position is
- *   irrelevant); `seq`/`time`/`data` are preserved verbatim;
+ *   order — the released read path only reads `event.ignorable`, so field
+ *   position is irrelevant); `seq`/`time`/`data` are preserved verbatim;
  * - `changed` counts only lines that were modified.
  *
  * Matching is on the parsed `type` field, never on the raw string — the
  * substring `fallbacks/switch` legitimately appears inside user/message data
  * and must not be treated as an event.
+ *
+ * NOTE: this transform is retained as the pure boundary the regression tests
+ * pin, but its output is REFUSED by the released session-format chain (see
+ * the module docblock) — the CLI never writes it.
  */
 export function markFallbacksSwitchIgnorable(lines: string[]): MarkFallbacksSwitchIgnorableResult {
   const out = new Array<string>(lines.length)
@@ -130,26 +124,54 @@ export function markFallbacksSwitchIgnorable(lines: string[]): MarkFallbacksSwit
   return { lines: out, changed }
 }
 
+/**
+ * Count every parsed `fallbacks/switch` row in a log, regardless of whether
+ * it already carries an `ignorable` field or what its value is. The released
+ * session-format chain refuses the unknown event type even when `ignorable`
+ * is present, so ANY such row makes the log unrepairable — this is the
+ * fail-closed detection, separate from the pure transform's `changed` count
+ * (which only counts rows the transform would modify).
+ *
+ * Detection is valid-JSON-only: an unparseable line (e.g. a truncated row)
+ * is skipped, so a log whose switch row is itself malformed classifies as
+ * `unchanged` — the raw-substring alternative is deliberately rejected
+ * because `fallbacks/switch` legitimately appears inside user data.
+ */
+export function countFallbacksSwitchRows(lines: string[]): number {
+  let count = 0
+  for (const line of lines) {
+    if (line === '') continue
+    let parsed: unknown
+    try {
+      parsed = JSON.parse(line)
+    } catch {
+      continue
+    }
+    if (parsed === null || typeof parsed !== 'object') continue
+    if ((parsed as Record<string, unknown>).type === SWITCH_TYPE) count++
+  }
+  return count
+}
+
 /* ------------------------------------------------------------------ */
 /* CLI                                                                */
 /* ------------------------------------------------------------------ */
 
 interface CliOptions {
   root: string
-  dryRun: boolean
-  backup: boolean
-  apply: boolean
 }
 
 function usage(): string {
   return `usage: tsx scripts/repair-fallbacks-switch-logs.ts [--root DIR] [--dry-run] [--backup] [--apply]
 
   --root DIR    session root to walk (default: ~/.dsh/sessions)
-  --dry-run     report only — never write files
-  --backup      required with --apply: copy the original to <file>.bak before
-                replacing
-  --apply       actually replace repaired files (requires --backup; stop dsh
-                before applying)`
+  --dry-run     report only (the only mode — no write is ever performed)
+  --backup      accepted for backward compatibility (no write is ever performed)
+  --apply       accepted for backward compatibility (no write is ever performed)
+
+The released session-format chain (v0→v1) refuses unknown event types even
+when marked ignorable, so this script fails closed: it only reports logs
+that contain fallbacks/switch events and never writes a "repaired" file.`
 }
 
 function expandHome(p: string): string {
@@ -159,9 +181,6 @@ function expandHome(p: string): string {
 
 export function parseArgs(argv: string[]): CliOptions {
   let root = join(homedir(), '.dsh', 'sessions')
-  let dryRun = false
-  let backup = false
-  let apply = false
   for (let i = 0; i < argv.length; i++) {
     const arg = argv[i]
     // pnpm run <script> -- <args> forwards the separator `--`; skip it.
@@ -173,24 +192,16 @@ export function parseArgs(argv: string[]): CliOptions {
         root = expandHome(argv[i])
         break
       case '--dry-run':
-        dryRun = true
-        break
       case '--backup':
-        backup = true
-        break
       case '--apply':
-        apply = true
+        // Legacy mutation-era flags: accepted as no-ops — the tool never
+        // writes, so no flag controls a write or a precondition.
         break
       default:
         throw new Error(`${usage()}\n\nunknown argument: ${arg}`)
     }
   }
-  if (apply && !backup) {
-    throw new Error(
-      `${usage()}\n\n--apply requires --backup: real modification must keep a .bak copy of every replaced session log (run with --dry-run first to review)`,
-    )
-  }
-  return { root, dryRun, backup, apply }
+  return { root }
 }
 
 /** Resolve the zstd CLI binary; throw a clear error when it is missing. */
@@ -231,37 +242,16 @@ function findSessionLogs(root: string): string[] {
 
 type FileOutcome =
   | { action: 'unchanged'; changed: 0 }
-  | { action: 'would-change'; changed: number }
-  | { action: 'changed'; changed: number }
+  | { action: 'refused'; changed: number; error: string }
   | { action: 'error'; changed: number; error: string }
 
 /**
- * Encode repaired plaintext as concatenated zstd frames that rc.7 will
- * accept: frame 1 = header line + `\n` only; frame 2 = remaining lines.
+ * Decompress one log and classify it: `unchanged` when it carries no
+ * `fallbacks/switch` rows, `refused` when it does (the released chain
+ * rejects the unknown event type even when `ignorable` is present — see the
+ * module docblock), or `error` when it cannot be decompressed. Never writes.
  */
-export function encodeRepairedSessionLog(zstd: string, lines: string[]): Buffer {
-  const header = lines[0] ?? ''
-  const headerPlain = header.endsWith('\n') ? header : `${header}\n`
-  const zstdOut = { input: headerPlain, maxBuffer: MAX_BUFFER }
-  const frame1 = execFileSync(zstd, ['-c'], zstdOut)
-  const rest = lines.slice(1)
-  if (rest.length === 0 || (rest.length === 1 && rest[0] === '')) return frame1
-  const restPlain = rest.join('\n')
-  const frame2 = execFileSync(zstd, ['-c'], {
-    input: restPlain.endsWith('\n') ? restPlain : `${restPlain}\n`,
-    maxBuffer: MAX_BUFFER,
-  })
-  return Buffer.concat([frame1, frame2])
-}
-
-/**
- * Decompress all frames of one log, transform it, and (only when actually
- * applying) atomically replace it with a two-frame re-encode (header frame
- * + events frame) that passed `zstd -t` and carries the original file's
- * permission bits. Report/dry-run returns would-change WITHOUT touching the
- * filesystem.
- */
-export function processFile(zstd: string, file: string, opts: CliOptions): FileOutcome {
+export function processFile(zstd: string, file: string, _opts: CliOptions): FileOutcome {
   let plain: string
   try {
     plain = execFileSync(zstd, ['-d', '-c', file], { encoding: 'utf8', maxBuffer: MAX_BUFFER })
@@ -273,36 +263,20 @@ export function processFile(zstd: string, file: string, opts: CliOptions): FileO
     }
   }
 
-  const { lines, changed } = markFallbacksSwitchIgnorable(plain.split('\n'))
-  if (changed === 0) return { action: 'unchanged', changed: 0 }
+  const switchRows = countFallbacksSwitchRows(plain.split('\n'))
+  if (switchRows === 0) return { action: 'unchanged', changed: 0 }
 
-  // Report / dry-run: nothing to write — return would-change right after the
-  // transform (parseArgs refuses `--apply` without `--backup`, so any run
-  // reaching here without `write` is a report-only invocation).
-  const write = opts.apply && !opts.dryRun
-  if (!write) return { action: 'would-change', changed }
-
-  // Apply: temp files live next to the target so the final rename is atomic
-  // (same filesystem) and the walker never mistakes them for session logs.
-  const dir = dirname(file)
-  const tmpZstd = join(dir, `.${basename(file)}.${process.pid}.zstd.tmp`)
-  const mode = statSync(file).mode & 0o7777
-  try {
-    writeFileSync(tmpZstd, encodeRepairedSessionLog(zstd, lines))
-    execFileSync(zstd, ['-t', tmpZstd], { stdio: 'ignore' })
-    copyFileSync(file, `${file}.bak`)
-    chmodSync(tmpZstd, mode)
-    renameSync(tmpZstd, file)
-  } catch (err) {
-    return {
-      action: 'error',
-      changed,
-      error: `re-encode/validate failed: ${err instanceof Error ? err.message : String(err)}`,
-    }
-  } finally {
-    rmSync(tmpZstd, { force: true })
+  // Fail closed (session format v3 — measured against the published
+  // 0.1.5-rc.1 packages): the released migration chain refuses unknown
+  // event types even with `ignorable: true` (the v0→v1 stage throws before
+  // any later edge runs), so a "repaired" log would still be rejected on
+  // load. Never report it as a repair and never write it.
+  return {
+    action: 'refused',
+    changed: switchRows,
+    error:
+      'fallbacks/switch events cannot be repaired by an ignorable flag: the released session-format v0→v1 migration refuses unknown event types even when ignorable (session format v3)',
   }
-  return { action: 'changed', changed }
 }
 
 export function main(): void {
@@ -319,11 +293,10 @@ export function main(): void {
     return
   }
 
-  const mode = opts.dryRun ? 'dry-run' : opts.apply ? 'apply' : 'report'
   console.log(`root: ${opts.root}`)
-  console.log(`mode: ${mode}${opts.backup ? ' (backup .bak before replace)' : ''}`)
   console.log(`zstd: ${zstd}`)
   console.log(`files: ${files.length}`)
+  console.log('mode: report only — no write is ever performed (the released session-format chain refuses ignorable-marked unknown events)')
 
   let totalFiles = 0
   let totalEvents = 0
@@ -336,15 +309,11 @@ export function main(): void {
         skipped++
         console.log(`  unchanged    ${file}`)
         break
-      case 'would-change':
+      case 'refused':
         totalFiles++
         totalEvents += outcome.changed
-        console.log(`  would-change ${outcome.changed}  ${file}`)
-        break
-      case 'changed':
-        totalFiles++
-        totalEvents += outcome.changed
-        console.log(`  changed      ${outcome.changed}  ${file}`)
+        errors++
+        console.error(`  refused      ${file}: ${outcome.error}`)
         break
       case 'error':
         errors++
@@ -354,8 +323,7 @@ export function main(): void {
   }
 
   console.log(
-    `\nsummary: ${totalFiles} file(s), ${totalEvents} fallbacks/switch event(s) ` +
-      `${mode === 'dry-run' || mode === 'report' ? 'to be marked' : 'marked'}, ` +
+    `\nsummary: ${totalFiles} file(s) refused (${totalEvents} fallbacks/switch event(s) cannot be repaired by an ignorable flag), ` +
       `${skipped} unchanged skipped, ${errors} error(s)`,
   )
   if (errors) process.exitCode = 1