dsh-mobile 0.6.4 → 0.6.6

package/CHANGELOG.md

@@ -2,9 +2,32 @@
 
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
 
+## Unreleased Android changes
+
+- Prefer the system Photo Picker on Android 13+ for supported image requests, with document selection for other requests or an unavailable picker. Preserve multi-selection, MIME filtering and selected URI results without adding storage permission or forcing a vendor gallery.
+- Bind standard file callbacks to the active WebView, Origin and document. Cancel them on navigation or teardown and prevent old results from consuming a newer request. These changes require a future App release; the published Android 0.6.3 APK is unchanged.
+
+## 0.6.6 - 2026-10-14
+
+- Fix captured images not reaching DSH's attachment draft. Supply both files and iterable file items, with compatible drag-and-drop objects for browsers whose constructed objects are incomplete.
+- Improve browser camera and extension file selection: returning to the page no longer discards a pending selection after one second. Handle explicit cancellation, late results, aborted requests and timeouts while preserving the current draft.
+- Add packed DSH regressions for multiple images, decoded previews, cancellation and superseded requests. The Android App remains independently published as 0.6.3; this plugin update does not replace its system file chooser.
+- Thanks @Void-LifeStream for the detailed report in [#205](https://github.com/saya-ch/dsh-mobile/issues/205), and @xhwxt for the document-picker proposal in [#203](https://github.com/saya-ch/dsh-mobile/pull/203).
+
+## 0.6.5 - 2026-10-13
+
+- Make mobile module selection easier to navigate: optional extensions first, collapsed DSH and boot-required groups, name/ID search, loading filters, and exact IDs and dependencies in details. Keep close and save actions outside the scrolling list, show unsaved changes, and confirm before discarding them.
+- Retry failed module reads in place and retain choices after a failed save without replaying writes automatically. Outdated exclusions can be explicitly removed while preserving other choices and required-module protection. [Module guide](docs/CLIENT_MODULES.en.md).
+- Show advanced mobile typography controls only when the active DSH theme consumes their public font variables. Retain unsupported saved values without a version allowlist, computer-wide settings writes or page reloads; body font-size controls remain available on older DSH versions.
+- Improve mobile settings close targets in portrait and landscape. Prevent stale or duplicate notification-settings/computer-switch bridge calls and retain explicit failure retry without changing native navigation or timeout behavior.
+- Read the pinned Windows cpolar ZIP with .NET and its embedded CAB through Unicode Windows APIs, extracting only the executable from a read-only MSI database instead of running `msiexec /a`. Retain ZIP/executable size and SHA-256 checks, rollback and staging cleanup; no installer action, elevation, service, registry or PATH change is requested. Thanks @WalkerJay666 for [#201](https://github.com/saya-ch/dsh-mobile/issues/201).
+- Distinguish cpolar extraction-tool, ZIP, MSI-read, CAB and output-file failures in Chinese, English and Italian, with redacted diagnostic details. Add native Windows extraction and cleanup checks, including paths with spaces and non-ASCII characters.
+- Protect the plugin-owned mobile root layout from broad skin overrides, fixing a populated Trajectory view collapsing to zero height. Missing skin backgrounds, decorations and text contrast still require skin adaptation; optional skins can be excluded on a phone without uninstalling them on the computer. Thanks @fishdivinity for [#202](https://github.com/saya-ch/dsh-mobile/issues/202). [Skin guide](docs/SKIN_COMPATIBILITY.en.md).
+- Update settings, module and skin guides and correct stale App release descriptions. Android App 0.6.3 (build 79) remains the current native release; this plugin-only update does not require a new APK.
+
 ## 0.6.4 - 2026-10-12
 
-- Release 0.6.4 improves the mobile composer, Windows Desktop startup composition and connection/data reliability. The Android App remains independently versioned; its current candidate is 0.6.3 (build 79), while the public App download remains 0.6.2 (build 78).
+- Release 0.6.4 improves the mobile composer, Windows Desktop startup composition and connection/data reliability. The Android App remains independently versioned; Android 0.6.3 (build 79) is published separately at `android-v0.6.3`.
 - Integrate the focused composer overflow fix from [PR #200](https://github.com/saya-ch/dsh-mobile/pull/200): public-slot wrappers around compact non-switch buttons reserve the mobile 44px touch target without resizing switches, dialogs, menus, nested controls or wide layouts. The packed real-slot smoke covers the new geometry and activation cases; optional third-party services remain outside this presentation check. Thanks @abworks-dev.
 - Detect the Windows Desktop profile service as well as its later runtime marker before enabling the in-page directory picker, avoiding competing picker providers during early Windows Desktop boot while retaining the portable picker on macOS/Linux. This covers an early-boot composition risk relevant to [#199](https://github.com/saya-ch/dsh-mobile/issues/199); the reported community Desktop 2.0.17 failure and remote timeout still require acceptance in that environment.
 - Preserve custom Caddy sites during VPS deployment and cleanup. Recognize the complete stock file rather than matching a few default-site lines or a legacy comment; other configurations require an explicit manual merge.
@@ -12,7 +35,7 @@ Notable changes are recorded here. GitHub Releases provide the downloadable pack
 - Stop an owned Funnel process and gateway even when its private state directory becomes invalid, keep the failure retryable, and apply the same durable-before-stop rule to Managed Origin reconnects and disables. Reuse quoted extension-script ETags separately from local content digests and retain them across 304 responses.
 - Honor configured Worker activation budgets through public loading and recovery while retaining cancellation. Match root prefix extension routes correctly without widening other path prefixes.
 - Distinguish task notifications using complete session/question IDs and per-turn tags, including long and non-ASCII identifiers. Reuse the existing maintained SHA-256 dependency in the browser bundle; update the development source-map parser to its patched release.
-- Prepare Android App 0.6.3 (build 79): keep authentic expired-CA records readable for per-device repair while TLS still rejects expiry, share a pairing owner across button/IME/scanned submissions, deduplicate slow device probes without consuming all connection capacity, improve dark primary-button contrast, update English/Chinese/Italian TLS recovery guidance, and exclude encrypted data from cloud backup and device transfer. Formal downloads still point to 0.6.2 (build 78).
+- Android App 0.6.3 (build 79), published separately: keep authentic expired-CA records readable for per-device repair while TLS still rejects expiry, share a pairing owner across button/IME/scanned submissions, deduplicate slow device probes without consuming all connection capacity, improve dark primary-button contrast, update English/Chinese/Italian TLS recovery guidance, and exclude encrypted data from cloud backup and device transfer.
 - Require administrator approval bypass to be disabled before official Caddy component distribution. Reconcile an occupied npm version with the candidate tarball integrity before continuing publication, and require final cleanup receipts for legacy negative browser checks.
 - Explain browser pairing-code input next to the field in Chinese, English and Italian. Recognize Android App keys locally without submitting them as codes, retain entered values, prevent duplicate one-time submissions, and distinguish invalid/expired codes, rate limits, device limits and connection failures. Thanks @sznyhgm for [#96](https://github.com/saya-ch/dsh-mobile/issues/96).
 - Correct authenticated resource ETag syntax, GET/HEAD weak/list/wildcard matching and 304 metadata. Preserve usable upstream validators across streaming gzip and keep encoding variants distinct. Upstream resources without validators and actual WebView cache reuse remain separate checks; this does not establish a complete fix for [#107](https://github.com/saya-ch/dsh-mobile/issues/107).
@@ -21,8 +44,8 @@ Notable changes are recorded here. GitHub Releases provide the downloadable pack
 - Capture redacted module, batch and script-response evidence for browser startup failures, including HTTP-successful scripts that fail during execution or registration. Copy package files in isolated test profiles so another pnpm import cannot change their shared file metadata and trigger a DSH resource revision. Negative checks require the intended fault and completed cleanup; failed evidence capture or persistence cannot count as passing.
 - Release discarded component-download response bodies before returning a rejection or following a validated redirect, and release reader locks after completion or failure. Keep the original validation error when cleanup fails instead of treating it as a retryable transport fault. Pinned sources, size/hash checks and redirect restrictions are unchanged; this does not establish the original cause of [#114](https://github.com/saya-ch/dsh-mobile/issues/114).
 - Close extension response streams when invalid HTTP metadata or a response-header write fails before pipeline ownership. Preserve normal streaming, HEAD and client-disconnection cleanup.
-- Cancel previous Android automatic-recovery ownership when opening LAN, remote or pairing configuration. Late renewal/cookie callbacks and queued retries cannot replace the user's form or take over a newer retry. This native correction requires a future App update; the already published APK is unchanged. Thanks @sznyhgm for [#96](https://github.com/saya-ch/dsh-mobile/issues/96).
-- Plugin and native App releases remain independent. This release does not replace the public Android App download; the 0.6.3 App candidate requires a separate signed Android release.
+- Android App 0.6.3 cancels previous automatic-recovery ownership when opening LAN, remote or pairing configuration. Late renewal/cookie callbacks and queued retries cannot replace the user's form or take over a newer retry. This native correction ships in the separate App release, not through a plugin update. Thanks @sznyhgm for [#96](https://github.com/saya-ch/dsh-mobile/issues/96).
+- Plugin and native App releases remain independent. The signed Android 0.6.3 release is available separately and is not required for plugin-only updates.
 
 ## 0.6.3 - 2026-10-10
 

package/CONTRIBUTORS.md

@@ -1,14 +1,14 @@
 # 贡献者 / Contributors
 
-GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按截至 2026-10-12 的实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
+GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/contributors) 按进入默认分支的提交自动统计，无法手动加入仅提交 issue 或 PR 提案的成员。本页按截至 2026-10-14 的实际参与方式感谢社区成员；仓库维护者与自动依赖更新仍可在 GitHub 历史记录中查看。
 
-GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-10-12. The repository maintainer and automated dependency updates remain visible in GitHub's history.
+GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed, through 2026-10-14. The repository maintainer and automated dependency updates remain visible in GitHub's history.
 
-## 0.6.4 候选贡献 / Contributions to the 0.6.4 candidate
+## 0.6.4 代码贡献 / Code contributions in 0.6.4
 
-[@abworks-dev](https://github.com/abworks-dev) 的 [#200](https://github.com/saya-ch/dsh-mobile/pull/200) 提供窄屏输入栏包装层与按钮点击区域的尺寸修正及回归测试，已纳入本地候选，尚未合并至默认分支或发布。
+[@abworks-dev](https://github.com/abworks-dev) 的 [#200](https://github.com/saya-ch/dsh-mobile/pull/200) 提供窄屏输入栏包装层与按钮点击区域的尺寸修正及回归测试，代码已随 0.6.4 发布；随后以合并提交 [`71754e5`](https://github.com/saya-ch/dsh-mobile/commit/71754e5191d3e9eadfedad16982e144491272f26) 保留原作者提交 [`03604ae`](https://github.com/saya-ch/dsh-mobile/commit/03604ae7623ceb42090ff4c4ed0e84d4aff7144a)。这次历史补全不改变已发布的功能或标签。
 
-[@abworks-dev](https://github.com/abworks-dev)'s [#200](https://github.com/saya-ch/dsh-mobile/pull/200) supplies the narrow-screen composer wrapper sizing fix and regression checks. It is included in the local candidate, not yet merged into the default branch or released.
+[@abworks-dev](https://github.com/abworks-dev)'s [#200](https://github.com/saya-ch/dsh-mobile/pull/200) supplies the narrow-screen composer wrapper sizing fix and regression checks shipped in 0.6.4. The subsequent merge [`71754e5`](https://github.com/saya-ch/dsh-mobile/commit/71754e5191d3e9eadfedad16982e144491272f26) retains the original author commit [`03604ae`](https://github.com/saya-ch/dsh-mobile/commit/03604ae7623ceb42090ff4c4ed0e84d4aff7144a) without changing the released functionality or tags.
 
 ## 0.6.3 代码贡献 / Code contributions in 0.6.3
 
@@ -21,7 +21,7 @@ GitHub's Contributors graph counts commits on the default branch; issue reports
 | 社区成员 / Community member | 已合并 PR / Merged PRs |
 | --- | --- |
 | [@1624318455](https://github.com/1624318455) | [#93](https://github.com/saya-ch/dsh-mobile/pull/93) |
-| [@abworks-dev](https://github.com/abworks-dev) | [#91](https://github.com/saya-ch/dsh-mobile/pull/91), [#98](https://github.com/saya-ch/dsh-mobile/pull/98), [#99](https://github.com/saya-ch/dsh-mobile/pull/99), [#152](https://github.com/saya-ch/dsh-mobile/pull/152), [#184](https://github.com/saya-ch/dsh-mobile/pull/184), [#185](https://github.com/saya-ch/dsh-mobile/pull/185) |
+| [@abworks-dev](https://github.com/abworks-dev) | [#91](https://github.com/saya-ch/dsh-mobile/pull/91), [#98](https://github.com/saya-ch/dsh-mobile/pull/98), [#99](https://github.com/saya-ch/dsh-mobile/pull/99), [#152](https://github.com/saya-ch/dsh-mobile/pull/152), [#184](https://github.com/saya-ch/dsh-mobile/pull/184), [#185](https://github.com/saya-ch/dsh-mobile/pull/185), [#200](https://github.com/saya-ch/dsh-mobile/pull/200) |
 | [@ayiejosh](https://github.com/ayiejosh) | [#109](https://github.com/saya-ch/dsh-mobile/pull/109), [#110](https://github.com/saya-ch/dsh-mobile/pull/110), [#116](https://github.com/saya-ch/dsh-mobile/pull/116), [#117](https://github.com/saya-ch/dsh-mobile/pull/117), [#119](https://github.com/saya-ch/dsh-mobile/pull/119), [#124](https://github.com/saya-ch/dsh-mobile/pull/124), [#125](https://github.com/saya-ch/dsh-mobile/pull/125), [#133](https://github.com/saya-ch/dsh-mobile/pull/133), [#136](https://github.com/saya-ch/dsh-mobile/pull/136) |
 | [@chintoleung](https://github.com/chintoleung) | [#104](https://github.com/saya-ch/dsh-mobile/pull/104), [#147](https://github.com/saya-ch/dsh-mobile/pull/147), [#148](https://github.com/saya-ch/dsh-mobile/pull/148), [#158](https://github.com/saya-ch/dsh-mobile/pull/158), [#161](https://github.com/saya-ch/dsh-mobile/pull/161), [#162](https://github.com/saya-ch/dsh-mobile/pull/162), [#167](https://github.com/saya-ch/dsh-mobile/pull/167) |
 | [@cjxh21](https://github.com/cjxh21) | [#154](https://github.com/saya-ch/dsh-mobile/pull/154), [#155](https://github.com/saya-ch/dsh-mobile/pull/155) |
@@ -58,6 +58,10 @@ GitHub's Contributors graph counts commits on the default branch; issue reports
 
 ## 问题反馈与建议 / Issue reports and ideas
 
+感谢 [@xhwxt](https://github.com/xhwxt) 在 [#203](https://github.com/saya-ch/dsh-mobile/pull/203) 中提出文档选择器改进方案，以及 [@Void-LifeStream](https://github.com/Void-LifeStream) 在 [#205](https://github.com/saya-ch/dsh-mobile/issues/205) 中提供附件选择与回传问题的详细反馈。
+
+Thanks [@xhwxt](https://github.com/xhwxt) for the document-picker proposal in [#203](https://github.com/saya-ch/dsh-mobile/pull/203), and [@Void-LifeStream](https://github.com/Void-LifeStream) for the detailed attachment-selection and delivery report in [#205](https://github.com/saya-ch/dsh-mobile/issues/205).
+
 以下名单包括提出问题、复现缺陷和建议功能的成员；出现在本表不表示提交过代码。 / These members opened repository issues; listing them does not imply code authorship.
 
 | 反馈贡献者 / Issue reporter | 提交的问题 / Issues |
@@ -73,6 +77,7 @@ GitHub's Contributors graph counts commits on the default branch; issue reports
 | [@chintoleung](https://github.com/chintoleung) | [#103](https://github.com/saya-ch/dsh-mobile/issues/103), [#166](https://github.com/saya-ch/dsh-mobile/issues/166), [#189](https://github.com/saya-ch/dsh-mobile/issues/189) |
 | [@chmzs](https://github.com/chmzs) | [#73](https://github.com/saya-ch/dsh-mobile/issues/73) |
 | [@gjzbbs](https://github.com/gjzbbs) | [#123](https://github.com/saya-ch/dsh-mobile/issues/123) |
+| [@fishdivinity](https://github.com/fishdivinity) | [#202](https://github.com/saya-ch/dsh-mobile/issues/202) |
 | [@hairyf](https://github.com/hairyf) | [#114](https://github.com/saya-ch/dsh-mobile/issues/114) |
 | [@helan-1997](https://github.com/helan-1997) | [#168](https://github.com/saya-ch/dsh-mobile/issues/168) |
 | [@hpsks416](https://github.com/hpsks416) | [#132](https://github.com/saya-ch/dsh-mobile/issues/132) |
@@ -100,6 +105,8 @@ GitHub's Contributors graph counts commits on the default branch; issue reports
 | [@sortjiajun](https://github.com/sortjiajun) | [#90](https://github.com/saya-ch/dsh-mobile/issues/90) |
 | [@StrawberryAO](https://github.com/StrawberryAO) | [#39](https://github.com/saya-ch/dsh-mobile/issues/39) |
 | [@Surpass567](https://github.com/Surpass567) | [#80](https://github.com/saya-ch/dsh-mobile/issues/80), [#81](https://github.com/saya-ch/dsh-mobile/issues/81) |
+| [@Void-LifeStream](https://github.com/Void-LifeStream) | [#205](https://github.com/saya-ch/dsh-mobile/issues/205) |
+| [@WalkerJay666](https://github.com/WalkerJay666) | [#201](https://github.com/saya-ch/dsh-mobile/issues/201) |
 | [@up-and-down-0618](https://github.com/up-and-down-0618) | [#115](https://github.com/saya-ch/dsh-mobile/issues/115) |
 | [@taki-ohh](https://github.com/taki-ohh) | [#19](https://github.com/saya-ch/dsh-mobile/issues/19) |
 | [@tianyimc](https://github.com/tianyimc) | [#126](https://github.com/saya-ch/dsh-mobile/issues/126) |

package/README.en.md

@@ -31,14 +31,14 @@
 
 > DSH Mobile is a DeepSeek Harness community plugin; the native app supports Android only.
 >
-> **Current stable release: 0.6.4**. Improve narrow-screen composer hit targets, Windows Desktop startup composition, plugin installation, and connection/data reliability while retaining optional extension Workers. [Changelog](CHANGELOG.md) · [Release downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.4).
+> **Current stable release: 0.6.6**. Fix captured images not reaching the DSH attachment draft, and improve cancellation and late-result handling in browser file selection. [Changelog](CHANGELOG.md) · [Release downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.6).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.2/dsh-mobile-android-v0.6.2.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.2/dsh-mobile-android-v0.6.2.apk"><strong>Download Android app 0.6.2</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.2">Release notes and checksums</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.3/dsh-mobile-android-v0.6.3.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile Android app icon" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.3/dsh-mobile-android-v0.6.3.apk"><strong>Download Android app 0.6.3</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.3">Release notes and checksums</a></sub>
 </p>
 
 DSH Mobile is a DeepSeek Harness plugin that lets a mobile browser or the Android app connect over a protected LAN or an optional Tailscale Funnel, cpolar, cloudflared, self-hosted FRP, or own reverse-proxy remote path. Both routes reach the same sessions, Workspaces, messages, and tools. The computer manages their switches and pairing authorizations separately; the Android app lists paired computers together. The plugin does not modify DeepSeek Harness source.
@@ -268,6 +268,8 @@ DSH Mobile keeps the Workspace, task-management, terminal and file-panel entry p
 
 A third-party plugin must work in DSH Web and use reachable HTTP/WebSocket interfaces. The mobile layer cannot guarantee a phone layout for every plugin or replace a desktop-native window required by that plugin.
 
+A skin tied to stock layout containers may not mount its backgrounds or decorations in the dedicated mobile layout. Mobile page module settings can omit an optional skin on this device without uninstalling the computer plugin; see [skins and mobile layout](docs/SKIN_COMPATIBILITY.en.md) for theme behavior and diagnosis.
+
 ### WebSocket approval
 
 - The gateway allows first-party DSH WebSocket paths by default, including `/sidebar/ws/terminal`. Other paths used by community sidebar plugins are blocked by default and appear in Diagnostics; the `/sidebar/ws/agent-opens` and `/sidebar/ws/agent-terminals` paths in the image are examples that must be reviewed for the actual plugin.
@@ -319,7 +321,7 @@ Selection priority is device choice → computer defaults → plugin configurati
 | Android app | Everyday use | Separate Local and Remote entries at first pairing; LAN discovery, system trust for public remote certificates, and app-pinned CA for the self-signed FRP entry |
 | Mobile browser | Temporary or cross-platform | Open the HTTPS origin shown by Mobile Access; a private LAN certificate may need confirmation, while a public remote certificate should not warn |
 
-The Android app is a thin Kotlin WebView shell and contains no frontend copy; mobile browsers load the same page. For compatibility diagnosis, append `?frontend=stock` to the browser URL to temporarily use the previous desktop-page adaptation.
+The Android app is a thin Kotlin WebView shell and contains no frontend copy; mobile browsers load the same page. Developers can append `?frontend=stock` to an authenticated mobile URL to compare the stock layout. This diagnostic entry bypasses mobile enhancements and module selection; some API operations may be rejected, so it does not replace normal mobile access. See [skins and mobile layout](docs/SKIN_COMPATIBILITY.en.md).
 
 In 0.5.5, the dedicated mobile page synchronously loads the authenticated, same-origin `/mobile-access/compat.js` before the first DSH boot script. This bundled core-js compatibility layer supplies `Iterator` / Iterator helpers to WebViews that lack them, preventing the startup error `Iterator is not defined`. It uses feature detection to preserve or repair native helpers, needs no CDN, and does not weaken CSP. The desktop and `?frontend=stock` pages do not load this gateway script.
 
@@ -393,6 +395,8 @@ On macOS, local network, cloudflared, self-hosted FRP and the own reverse proxy
 | `0.6.2` | Packed legacy-WebView boot, touch scrolling and missing-API/viewport negative controls passed on `0.2.0-rc.2`, with release CI passing. The reporter's physical old devices in #187 were not claimed as accepted |
 | `0.6.3` | `0.2.0-rc.2` and `0.2.1-alpha.2` (packed installation, isolated pairing, mobile boot and WebSocket Workspace reads); additional checks cover the composer, settings and extension Worker timeout, streaming and explicit recovery |
 | `0.6.4` | `0.2.0-rc.2` (packed installation, isolated pairing, mobile boot and WebSocket Workspace reads); additionally 72 real public-slot composer layouts, Windows Desktop directory-picker composition and cross-platform regressions. The reported remote timeout in community Desktop 2.0.17 remains unclaimed as accepted |
+| `0.6.5` | Packed module-management and mobile-settings regressions on `0.2.0-rc.2` and `0.2.1-alpha.2`; additionally Windows cpolar extraction and populated Trajectory layout with published `maid-atelier` 0.1.7. This does not establish acceptance of every third-party skin or reporter device |
+| `0.6.6` | Packed attachment intake and decoded-preview regressions on `0.2.0-rc.2` and `0.2.1-alpha.2`, covering multiple images, cancellation, late results and superseded requests. Android system-picker changes are released independently, not through the npm update |
 
 <details>
 <summary>Historical version checks</summary>
@@ -423,7 +427,7 @@ On macOS, local network, cloudflared, self-hosted FRP and the own reverse proxy
 
 Existing apps (0.3.3 and later) do not need re-pairing. cpolar users should use app 0.3.15 or later because earlier apps may time out before a slow first load over the free route finishes; earlier apps also use a different status-bar strategy. The 0.4.0 app adds the multi-device list, startup behavior, and computer-side revocation status; older apps continue to connect to their saved single device. App 0.1.3 or earlier requires reinstalling and pairing again.
 
-The current stable Android app is 0.6.2 (build 78), adding page zoom and improving system-area handling and encrypted-record reliability. Package identity, signing and the pairing/renewal protocol remain compatible without requiring re-pairing. Plugin and app version numbers do not need to match; connections check protocol and minimum-version requirements. Features with additional native requirements state the app version they need.
+See the [App guide](apps/mobile/README.md) for native release versions and changes. Package identity, signing and the pairing/renewal protocol remain compatible without requiring re-pairing. Plugin and app version numbers do not need to match; connections check protocol and minimum-version requirements. Features with additional native requirements state the app version they need.
 
 GitHub Release APKs use a stable signing certificate, so an older official APK with the same signer can be upgraded in place while retaining pairings. A locally built Debug APK with a different signer cannot be overwritten by the official APK; plan to pair again when switching between them.
 

package/README.md

@@ -31,14 +31,14 @@
 
 > DSH Mobile 是 DeepSeek Harness 社区插件，原生 App 仅支持 Android。
 >
-> **当前正式版本：0.6.4**。改善窄屏输入栏触摸区域、Windows Desktop 启动适配、插件安装与连接数据可靠性，并保留可选扩展 Worker 模式。[更新记录](CHANGELOG.md) · [版本下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.4)。
+> **当前正式版本：0.6.6**。修复拍照图片无法进入 DSH 附件草稿的问题，改善浏览器文件选择的取消与迟到结果处理。[更新记录](CHANGELOG.md) · [版本下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.6.6)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。
 
 <p align="center">
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.2/dsh-mobile-android-v0.6.2.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.2/dsh-mobile-android-v0.6.2.apk"><strong>下载 Android App 0.6.2</strong></a><br>
-  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.2">版本说明与校验文件</a></sub>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.3/dsh-mobile-android-v0.6.3.apk"><img src="https://raw.githubusercontent.com/saya-ch/dsh-mobile/main/assets/brand/app-icon-rounded.svg" alt="DSH Mobile 安卓应用图标" width="72" height="72"></a><br>
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/download/android-v0.6.3/dsh-mobile-android-v0.6.3.apk"><strong>下载 Android App 0.6.3</strong></a><br>
+  <sub><a href="https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.3">版本说明与校验文件</a></sub>
 </p>
 
 DSH Mobile 是一个 DeepSeek Harness 插件，让手机浏览器或 Android App 通过局域网，或可选的 Tailscale Funnel、cpolar、cloudflared、自建 FRP 或自有反向代理远程通道连接电脑，继续使用同一份会话、工作区、消息和工具。电脑端分别启停局域网与远程访问、分别管理配对授权；Android App 统一显示已配对电脑。插件不修改 DeepSeek Harness 源码。
@@ -268,6 +268,8 @@ DSH Mobile 保留工作区、任务管理、终端和文件面板入口，第三
 
 第三方插件需要能在 DSH Web 页面中运行，并使用可达的 HTTP／WebSocket 接口。移动层不保证把所有插件的自定义布局自动改成手机布局，也不能替代插件依赖的桌面原生窗口。
 
+皮肤若依赖原生布局容器，背景或装饰可能无法在专用移动布局中挂载。可在手机的“移动页面模块”中只对本设备不加载可选皮肤，无需卸载电脑插件；背景、配色与排查边界见[皮肤与移动布局](docs/SKIN_COMPATIBILITY.md)。
+
 ### WebSocket 放行
 
 - 网关默认只允许 DSH 内置的第一方 WebSocket 路径，包括 `/sidebar/ws/terminal`。社区侧边栏插件使用的其他路径默认拦截，通常会在诊断页显示为待处理项目；截图中的 `/sidebar/ws/agent-opens` 和 `/sidebar/ws/agent-terminals` 就属于这类需要按实际插件确认的路径。
@@ -319,7 +321,7 @@ excludedClientModules:
 | Android App | 日常使用 | 首次配对时分别提供局域网与远程入口；局域网自动发现，公开远程证书由系统验证，自签 FRP 入口由 App 固定 CA |
 | 手机浏览器 | 临时或跨平台访问 | 打开“移动访问”卡片显示的 HTTPS 地址；局域网私有证书可能需要手动确认，公开远程证书不应出现警告 |
 
-Android App 只是 Kotlin WebView 薄壳，不内置另一份网页；手机浏览器访问的是同一页面。需要排查兼容性时，可在浏览器地址后追加 `?frontend=stock`，临时回到旧的桌面页面适配模式。
+Android App 只是 Kotlin WebView 薄壳，不内置另一份网页；手机浏览器访问的是同一页面。开发者可在已认证移动地址后追加 `?frontend=stock` 对照原生布局；该诊断入口绕过移动增强和模块选择，部分 API 操作可能被拒绝，不能代替正常移动入口。详见[皮肤与移动布局](docs/SKIN_COMPATIBILITY.md)。
 
 0.5.5 的专用移动页面会在 DSH 的第一个启动脚本之前，同步加载经网关鉴权的同源 `/mobile-access/compat.js`，为缺少 `Iterator` / Iterator helpers 的 WebView 提供随插件打包的 core-js 兼容实现，避免启动时出现 `Iterator is not defined`。兼容层按能力检测保留或修正原生 helper，不依赖 CDN，也不会放宽 CSP；桌面页面与 `?frontend=stock` 页面不会加载这个网关脚本。
 
@@ -394,6 +396,8 @@ macOS 上局域网、cloudflared、自建 FRP 与自有反向代理可用；Funn
 | `0.6.2` | `0.2.0-rc.2` 的打包旧 WebView 启动、触屏滚动与缺失 API／视口负对照通过；发布 CI 通过。未将 #187 报告者的实际旧设备写成已验收 |
 | `0.6.3` | `0.2.0-rc.2`、`0.2.1-alpha.2`（打包安装、隔离配对、移动页面与 WebSocket 工作区读取）；另验证输入栏、设置与扩展 Worker 的超时、流式传输和显式恢复 |
 | `0.6.4` | `0.2.0-rc.2`（打包安装、隔离配对、移动页面与 WebSocket 工作区读取）；另验证 72 组真实公共插槽输入栏布局、Windows Desktop 目录选择器组合及跨平台回归。社区 Desktop 2.0.17 的原报告远程超时仍未宣称验收 |
+| `0.6.5` | `0.2.0-rc.2`、`0.2.1-alpha.2` 的打包模块管理与移动设置回归；另验证 Windows cpolar 解包及正式 `maid-atelier` 0.1.7 下有内容轨迹的布局修复。不代表全部第三方皮肤或报告者设备已验收 |
+| `0.6.6` | `0.2.0-rc.2`、`0.2.1-alpha.2` 的打包附件接收与图片预览回归，覆盖多图、取消、迟到结果和旧请求；Android 系统选择器改进独立发布，不包含在 npm 更新中 |
 
 <details>
 <summary>历史版本验证记录</summary>
@@ -424,7 +428,7 @@ macOS 上局域网、cloudflared、自建 FRP 与自有反向代理可用；Funn
 
 现有 App（0.3.3 及更新）无需重新配对；cpolar 用户应使用 0.3.15 或更新 App，较早版本可能在免费线路的慢速首次加载完成前超时；更早的 App 还使用不同的状态栏策略。App 0.4.0 才支持多设备列表、启动行为设置和电脑端撤销状态同步；旧版 App 仍可连接已保存的单台设备。App 0.1.3 及更早版本需卸载重装并重新配对。
 
-Android App 当前正式版为 0.6.2（build 78），新增页面缩放，改善系统区域处理与加密设备记录的可靠性；包名、签名及配对／续期协议保持兼容，已有配对无需重建。插件和 App 的版本号不要求相同；连接按协议及最低版本要求检查，具体原生功能另有要求时会说明所需 App 版本。
+Android App 的版本及原生更新见 [App 使用说明](apps/mobile/README.zh-CN.md)。包名、签名及配对／续期协议保持兼容，已有配对无需重建。插件和 App 的版本号不要求相同；连接按协议及最低版本要求检查，具体原生功能另有要求时会说明所需 App 版本。
 
 GitHub Release 的正式 APK 使用固定签名，可从同一签名的旧正式版原位升级并保留配对。自行构建的 Debug APK 若使用不同签名，不能直接覆盖安装正式版；切换前请准备重新配对。
 

package/apps/mobile/README.md

@@ -6,11 +6,15 @@ DeepSeek Harness is the display name of this lightweight, community-maintained A
 
 Android is the only supported native target. The iOS client remains an unpublished local experiment and is outside the build, release, and support scope.
 
-The current stable app is **0.6.2** (build 78). The app and npm plugin update independently; plugin web UI or connection fixes do not require reinstalling the APK. Install a new signed release APK for native updates or when the app reports that its version is too old. Older official APKs with the same signer retain pairing during in-place upgrades; a differently signed Debug build cannot overwrite the official app.
+The current stable app is **0.6.3** (build 79). The app and npm plugin update independently; plugin web UI or connection fixes do not require reinstalling the APK. Install a new signed release APK for native updates or when the app reports that its version is too old. Older official APKs with the same signer retain pairing during in-place upgrades; a differently signed Debug build cannot overwrite the official app.
 
-## 0.6.3 candidate (unreleased)
+### Attachment changes in development
 
-Build 79 adds per-computer recovery guidance, readable expired-CA records, duplicate-pairing protection and deduplicated status checks that leave capacity for an explicit connection. TLS still refuses expired certificates. It also improves dark-mode primary buttons and explicitly excludes encrypted pairings and WebView sessions from cloud backup and device transfer. The earlier automatic-recovery ownership corrections are included in this candidate. These native changes require a new App; the download above remains the published 0.6.2 APK. See the [0.6.4 release notes](../../CHANGELOG.md#064---2026-10-12) for the independent App candidate status.
+Unreleased App code uses the system Photo Picker on Android 13+ when the webpage requests a single supported image MIME filter. Multiple selection follows the system limit; unavailable pickers, older systems, capture requests and filters that cannot be represented exactly use the document picker instead. Document requests start directly, retain MIME and multiple settings, and do not promise a particular manufacturer's gallery. Standard callbacks are bound to the current WebView, Origin and document; obsolete results cannot complete a newer request. These native changes are not in the published 0.6.3 APK, and need a future signed App update.
+
+## 0.6.3 update
+
+Build 79 adds per-computer recovery guidance, readable expired-CA records, duplicate-pairing protection and deduplicated status checks that leave capacity for an explicit connection. TLS still refuses expired certificates. It also improves dark-mode primary buttons and explicitly excludes encrypted pairings and WebView sessions from cloud backup and device transfer. The earlier automatic-recovery ownership corrections are included. This signed App is published independently from plugin 0.6.4.
 
 ## 0.6.2 update
 
@@ -54,7 +58,7 @@ After the first pairing, the app encrypts its device records, including revocabl
 
 Before pairing, the app reads separate version metadata to distinguish an outdated app, an outdated plugin, and an unsupported protocol. A legacy plugin without that endpoint continues through the original flow. When direct launch is selected, the app attempts the saved connection within a bounded recovery budget and returns to the device list if it cannot reconnect. Automatic retries run only for transient network or provider failures. Native app screens automatically follow the Android system locale in Simplified Chinese, English, or Italian without a separate language switch. Plugin-owned UI inside the WebView follows DSH's selected locale. DSH does not currently expose Italian, but the dictionaries are ready to activate without another plugin change when it does.
 
-If the initial trusted-connection screen remains open for 12 seconds, **View device list** appears without needing a server response. Retry is also available when the screen is bound to a saved computer. From the list, retry a connection, delete just its local record or use **Add computer** with a fresh pairing link; clearing all App data is unnecessary. The correction that prevents old recovery tasks from replacing manual configuration is recorded in the [0.6.4 release notes](../../CHANGELOG.md#064---2026-10-12), but is not part of the stable APK above.
+If the initial trusted-connection screen remains open for 12 seconds, **View device list** appears without needing a server response. Retry is also available when the screen is bound to a saved computer. From the list, retry a connection, delete just its local record or use **Add computer** with a fresh pairing link; clearing all App data is unnecessary. App 0.6.3 also prevents previous recovery tasks from replacing a manually opened connection or pairing form.
 
 When automatic recovery renews a Session, the app keeps the existing DSH page if its interface is still mounted. A page that did not finish starting or whose renderer stopped must be reopened; unsaved in-page state cannot be recovered in that case.
 
@@ -104,15 +108,17 @@ Available actions include `files.pick`, `camera.capture`, `share`, `clipboard.re
 
 For ordinary DSH attachments, the App forwards the webpage's multiple-selection and MIME settings to the system document picker and returns all selected items. Use its Images category or an available photo provider to choose pictures; the visible gallery entries depend on the device and installed providers. This path is independent of the extension `files.pick` action. File-selection acceptance on each physical device remains part of the checks described below.
 
-Task reminders use Host completion events and explicit pending-input cards while the page remains alive. Enable notifications or open system settings from DSH **Settings → General** inside the app. Lock-screen text is generic and tapping opens the app. The unreleased plugin correction distinguishes full session and turn IDs, including long and non-ASCII IDs; the currently published plugin can replace notifications when their tags collide. Completion reminders require SSE and have no offline event replay; Cloudflare Quick Tunnels do not support the stream. See [channel limits](../../docs/CLOUDFLARE_TUNNEL.en.md#quick-tunnel-feature-limits).
+Task reminders use Host completion events and explicit pending-input cards while the page remains alive. Enable notifications or open system settings from DSH **Settings → General** inside the app. Lock-screen text is generic and tapping opens the app. Plugin 0.6.4 distinguishes full session and turn IDs, including long and non-ASCII IDs; earlier versions can replace notifications when their tags collide. Completion reminders require SSE and have no offline event replay; Cloudflare Quick Tunnels do not support the stream. See [channel limits](../../docs/CLOUDFLARE_TUNNEL.en.md#quick-tunnel-feature-limits).
+
+Bridge file/camera actions are serialized with a five-minute deadline. Cancellation, WebView destruction, timeout and stale-session results are cleaned up or rejected. Standard WebView file inputs are a separate path. Since plugin 0.6.6, browser media selection waits for change, explicit cancellation, abort or the deadline rather than treating restored focus as cancellation. Unsupported browser capabilities return `unsupported`.
 
-Only one file-selection or camera interaction runs at a time, with a five-minute deadline. Cancellation, WebView destruction, timeout and stale-session results are cleaned up or rejected. Browsers use corresponding Web APIs and return `unsupported` when unavailable.
+For image attachment diagnosis, compare the native DSH file button and camera action using a small JPEG or PNG and check the unsent draft preview. DSH keeps images in the browser draft before submission, so no new computer-side image object does not establish picker failure. Checking the selected file count/type and the draft preview is sufficient without sending a model request; generic files can use a different storage path. File selection, webpage intake and later submission are separate stages.
 
 From App 0.4.7, its native keyboard adapter uses plain Enter for a new draft line when an inset-backed on-screen keyboard is visible, Android reports no hardware keyboard, and an active session composer is focused. The Send button still submits a multiline draft. Floating keyboards, unknown state and older Apps do not use this native rule; the plugin's touch-browser rule below can still apply. Physical keyboards can use Shift+Enter for a line break.
 
 From 0.6.0, the main composer in touch-primary browsers uses Enter to add a line to a nonempty draft and does nothing for an empty draft. DSH retains menus, composition and modified shortcuts. An external keyboard on a touch-primary browser uses that same rule; a non-touch desktop is unchanged. General settings offers a mobile font size of 12–32px, default 16px, saved for the current address only; editable inputs retain a 16px minimum.
 
-Plugin 0.6.3 adds **More font settings** for body/code fonts, with **Restore defaults**. These are webpage preferences for the current address, not computer-wide settings; they do not require the new APK. Terminal fonts remain controlled by DSH. **Page zoom** is a separate native control described in the 0.6.2 update above.
+Plugin 0.6.3 adds **More font settings**. From plugin 0.6.5, code-size and body/code-family controls appear only when the current DSH theme consumes their public Markdown font variables; unsupported controls are hidden and saved preferences retained. These webpage preferences belong to the current address, not computer-wide settings, and need no new APK. Terminal fonts remain controlled by DSH. **Page zoom** is a separate native control described in the 0.6.2 update above.
 
 DSH records through `getUserMedia` and sends audio to the configured computer-side DSH speech provider for transcription, not browser-native SpeechRecognition or the extension bridge. The app requests microphone permission on first use and grants audio-only capture for the paired HTTPS Origin. Computer components, model and network must be available; permission does not guarantee transcription. Same-origin client plugins share the page's permissions, so grant recording only when you trust them.
 
@@ -129,7 +135,7 @@ Set-Location apps/mobile/android
 ./gradlew.bat :app:lintDebug :app:testDebugUnitTest :app:assembleDebug -x :app:lintAnalyzeDebugUnitTest -x :app:lintAnalyzeDebugAndroidTest
 ```
 
-The debug APK is written to `app/build/outputs/apk/debug/app-debug.apk`. GitHub Releases build a signed release APK with a stable signing key stored only in repository secrets; signing keys and passwords never enter the source tree or build artifacts.
+The debug APK is written to `app/build/outputs/apk/debug/app-debug.apk`. GitHub Releases build a signed release APK with a stable signing key stored only in repository secrets; signing keys and passwords never enter the source tree or build artifacts. The current signed release is [Android 0.6.3](https://github.com/saya-ch/dsh-mobile/releases/tag/android-v0.6.3), with SHA-256 `167b9447cf5b700b811b6b5279e2935b5aca250e5f1a3b59fa7cf13b1af9e497`.
 
 ## Acceptance
 

package/apps/mobile/release.json

@@ -1,5 +1,5 @@
 {
-  "version": "0.6.2",
-  "versionCode": 78,
-  "releaseTag": "android-v0.6.2"
+  "version": "0.6.3",
+  "versionCode": 79,
+  "releaseTag": "android-v0.6.3"
 }

package/docs/CLIENT_MODULES.en.md

@@ -2,7 +2,7 @@
 
 [中文](CLIENT_MODULES.md) · [Back to README](../README.en.md#optional-modules-and-advanced-configuration)
 
-> DSH Mobile plugin 0.6.0 and later provide module management in General settings. Plugin and app version numbers do not need to match.
+> Module management has been available since plugin 0.6.0; the search, grouping and recovery improvements below require plugin 0.6.5 or later. Plugin and App version numbers need not match.
 
 Choose which client components the dedicated mobile page loads. This does not uninstall computer plugins, stop their services, or restrict device permissions. A paired device remains a trusted DSH operator.
 
@@ -15,13 +15,23 @@ Selection precedence is: device override → computer default → the profile's
 
 **Restore defaults** on a phone removes its override and uses the computer default. On the computer, it removes the computer override and uses plugin configuration. Other device overrides are retained.
 
+## Find a module
+
+**Optional extensions** appear first. **DSH optional components (advanced)** and **Required for boot** are collapsed; required entries cannot be disabled. These groups aid browsing, not source verification, and one frontend module is not necessarily a complete plugin.
+
+Search by name or module ID, or filter by **Load / Do not load**. Filtering retains unsaved choices outside the current results. Display names omit common DSH client prefixes and mechanically split package names; **Module details** contains the exact ID and declared dependencies without guessing a third-party plugin's purpose. Loading rules are collapsed until needed.
+
+After a DSH or plugin update, an old exclusion may be missing from the catalog or required for boot. **Outdated selections** lists these entries separately. Explicitly remove an old exclusion and save to retain other choices. They are not cleared automatically, and required modules cannot be disabled.
+
 ## Choose and apply
 
-1. Wait for the catalog to load. A failed read leaves saving disabled; close and reopen to retry.
-2. Checked means loaded; unchecked means omitted next time. Required boot modules cannot be unchecked, and other rows show declared dependencies.
-3. Select **Save for next open**. Saving rejects a retained module that depends on an excluded module and identifies the conflict: keep the dependency, or also exclude its dependent if it is not needed. Unknown module IDs are rejected too.
+1. Wait for the catalog. A failed or timed-out read has a **Reread settings** action; reopening the modal is unnecessary. Rereading replaces unsaved choices and asks for confirmation when changes exist.
+2. Checked means load on the next open; unchecked means omit next time, not unload the current page. Required boot modules cannot be unchecked. Details show declared dependencies.
+3. Review the unsaved-change count and select **Save selection**; saving stays disabled when nothing changed. A retained module depending on an excluded module is rejected with a conflict: keep the dependency or also exclude its unwanted consumer. Other modules are never unchecked automatically.
 4. After a successful save, the current page, conversation, and draft are not reloaded automatically. Manually reopen or refresh the DSH page to apply the selection; saving through this control does not require a DSH restart.
 
+Close, Escape and the App's Back action ask before discarding unsaved changes. A failed save keeps choices. A write timeout means the result is unconfirmed, not rolled back; reread to confirm. Writes are not retried automatically, and closing cannot undo a completed save. Long lists scroll independently while close and footer actions remain reachable.
+
 Computer pages and `?frontend=stock` pages are unaffected. DSH or community-plugin updates can change the catalog and dependencies. When a saved selection prevents the mobile page from starting, the page offers “Load all modules for this device and retry”; it changes this device’s selection only when you click, without changing computer defaults, other devices or pairing authorization. Settings APIs still reject invalid selections and enforce required-module and dependency checks. Module sizes depend on the installation, so no fixed traffic reduction is promised.
 
 ## Data and authorization

package/docs/CLIENT_MODULES.md

@@ -2,7 +2,7 @@
 
 [English](CLIENT_MODULES.en.md) · [返回 README](../README.md#可选模块与高级配置)
 
-> DSH Mobile 插件 0.6.0 起在通用设置中提供模块管理入口；插件与 App 的版本号不必相同。
+> 模块管理入口自插件 0.6.0 起提供；下述搜索、分组及恢复改进需要插件 0.6.5 或更新版本。插件与 App 的版本号不必相同。
 
 用“移动页面模块”选择专用移动页面要加载的客户端组件。它不卸载电脑上的插件，不停止插件服务，也不是设备权限隔离；已配对设备仍是受信任的 DSH 操作者。
 
@@ -15,13 +15,23 @@
 
 手机的“恢复默认”删除自己的覆盖，重新使用电脑默认；电脑的“恢复默认”删除电脑覆盖，重新使用插件配置。其他设备的覆盖保持不变。
 
+## 找到要调整的模块
+
+默认先显示**可选扩展**；**DSH 可选组件（高级）**和**启动必需项**折叠显示。后者不能关闭。分类只帮助浏览，不表示来源认证，也不代表每个前端模块就是一个完整插件。
+
+使用搜索框按名称或模块 ID 查找，或筛选“加载／不加载”。筛选不会丢弃其他条目的未保存选择。显示名称省略通用的 DSH 客户端前缀并机械分词；完整 ID 和声明依赖在“模块详情”中，不猜测第三方插件的用途。加载规则默认折叠，需要时再展开。
+
+DSH 或插件更新后，旧排除项可能已不在目录中，或变为启动必需项。此时会单独显示“失效的旧选择”；点击对应的“移除旧排除”后再保存，保留其他选择。不自动清除，也不允许关闭必需项。
+
 ## 选择与生效
 
-1. 等待目录读取完成；无法读取时不能保存，关闭后重新打开可重试。
-2. 勾选表示加载，取消勾选表示下次不加载。启动必需模块不能取消；其余条目显示已声明的依赖。
-3. 点击“保存，下次打开生效”。若保留模块仍依赖已排除模块，保存会拒绝并说明冲突：保留依赖，或同时排除不再需要的依赖方。不存在的模块也不能保存。
+1. 等待目录读取完成；读取失败或超时可点击“重新读取”，不必关闭弹窗。重新读取会替换未保存选择，存在改动时需先确认。
+2. 勾选表示下次打开时加载，取消勾选表示下次不加载，不表示当前页面中的模块已经卸载。启动必需模块不能取消；可在详情中查看声明依赖。
+3. 查看“未保存”改动数量，点击“保存选择”；没有改动时保存不可用。若保留模块仍依赖已排除模块，保存会拒绝并说明冲突：保留依赖，或同时排除不再需要的依赖方。不会自动连带取消其他模块。
 4. 保存成功后，当前页面、会话和草稿不会被自动刷新。下次手动重新打开或刷新 DSH 页面时应用选择，无需为设置入口的保存重启 DSH。
 
+关闭、Escape 或 App 返回动作触发时，有未保存改动会提示确认。保存失败保留选择；保存超时只表示结果尚未确认，不等于服务器已回滚。可重新读取确认保存结果，不会自动重试写入，关闭弹窗也不能撤销已经完成的保存。长列表独立滚动，关闭和底部操作保持可达。
+
 电脑页面与 `?frontend=stock` 页面不受模块选择影响。DSH 或社区插件更新可能改变模块目录和依赖；已保存的选择阻止移动页面启动时，页面提供“为本设备加载全部模块并重试”，由你点击后恢复本设备的加载选择，不改变电脑默认、其他设备或配对授权。设置接口仍拒绝无效选择，不绕过启动必需或依赖检查。模块大小因安装环境而异，不承诺固定的加载流量节省比例。
 
 ## 数据与授权

package/docs/README.md

@@ -12,6 +12,7 @@
 | 复用已经运行的 frps，不自动修改服务器 | [接入既有 frps](ATTACH_EXISTING_FRPS.md) | [Existing frps](ATTACH_EXISTING_FRPS.en.md) |
 | 复用 Lucky、Nginx 或 Caddy 的公开 HTTPS 入口 | [自有反向代理](SELF_HOSTED_ORIGIN.md) | [Own reverse proxy](SELF_HOSTED_ORIGIN.en.md) |
 | 页面加载慢、实时连接反复重连或长操作超时 | [慢链路与重连](SLOW_CONNECTIONS.md) | [Slow links and reconnection](SLOW_CONNECTIONS.en.md) |
+| 保留电脑皮肤，排查移动页面的背景与可读性 | [皮肤与移动布局](SKIN_COMPATIBILITY.md) | [Skins and mobile layout](SKIN_COMPATIBILITY.en.md) |
 
 在 Android App 中连接公开隧道或自建入口时请选择 **远程访问**。公开受信任证书也可用手机浏览器配对；既有 frps 的自签入口需要 **0.4.6 或更高版本 App** 固定远程 CA。各通道仍要求 DSH Mobile 配对，不能直接暴露普通 DSH 或私有 HTTP 后端。
 

package/docs/SKIN_COMPATIBILITY.en.md

@@ -0,0 +1,25 @@
+# Skins and mobile layout
+
+[简体中文](SKIN_COMPATIBILITY.md) · [Third-party plugins](../README.en.md#third-party-plugin-compatibility)
+
+DSH Mobile uses a dedicated root layout on the authenticated mobile page while retaining DSH conversations, sidebars, settings and public slots. The computer page is unchanged. Components can still consume public theme variables, but backgrounds, characters and sidebar decorations tied to stock CSS-module classes or specific parents may not apply.
+
+## Keep the computer skin, change only the phone
+
+Open **Settings → General → Mobile page modules → Manage** on the phone and find the skin's client module. If optional, deselect it and save. This choice affects only the current paired device: it does not uninstall the computer plugin, change other devices or reload a conversation automatically. Manually reopen or refresh the page to apply it.
+
+If saving reports a dependency conflict, retain the required module or also deselect its unwanted consumers. Bootstrap-required modules cannot be excluded. The phone's Restore defaults action returns to computer defaults, not necessarily to loading every module. See [module management](CLIENT_MODULES.en.md).
+
+## Diagnose a missing background
+
+- Identify the running plugin, App and skin versions; plugin and App versions need not match.
+- Omit the skin only on this device, reopen manually and compare the conversation, composer and sidebar. Recovery points to styles or mounting, not necessarily a network or pairing failure.
+- First compare the normal computer layout. Developers can also open `/?frontend=stock` on the authenticated mobile Origin for layout diagnosis. Gateway authentication and HTTPS checks remain, but mobile enhancements and module selection are bypassed; some API operations may be rejected. It is not a replacement for the normal mobile entry.
+- When stock has a background but mobile does not, inspect the skin's mounting container and fallback for other layouts. WebSocket approval, APK reinstallation or making every container transparent cannot guarantee a fix.
+- A see-through sidebar, unreadable text shadows and an empty trace need separate diagnosis, not a single missing-background explanation. For an empty trace, inspect the first client exception, actual layout dimensions and whether its module loaded. A static screenshot does not distinguish rendering failure, occlusion and connection failure.
+
+For example, the published `maid-atelier` 0.1.7 package mounts its background in the stock `centerCol` container. Its repository's fallback for other layouts does not establish that an installed package contains the same correction. DSH Mobile does not imitate that class or move the skin's nodes. A skin supporting mobile can locate its decoration with the existing `[data-pane="conversation"]` and `[data-pane="sidebar"]` markers, or use DSH public theme variables. The skin must still own sizing, stacking, cleanup and light/dark behavior without obscuring text or hit targets. This guide does not establish full skin acceptance. See [#202](https://github.com/saya-ch/dsh-mobile/issues/202).
+
+An isolated DSH 0.2.0-rc.2 combination with Mobile 0.6.4 and the published npm `maid-atelier` 0.1.7 reproduces the see-through navy sidebar, unreadable dark labels, missing background and a blank populated Trajectory view. The trace data remains present: a broad skin rule changes the mobile root to a column Flex layout and collapses the content region to zero height. Plugin 0.6.5 protects the plugin-owned root's Grid geometry and fixes this blank trace, without changing the skin's palette, shadows or decoration mounting.
+
+This skin binds light sidebar labels to the stock `sidebarCol`, absent from the mobile layout. Missing backgrounds and some text-contrast problems still need skin adaptation; the trace fix does not resolve them. Device-level exclusion restores default mobile presentation while preserving the computer skin. Plugin 0.6.4 and earlier do not contain the layout protection.

package/docs/SKIN_COMPATIBILITY.md

@@ -0,0 +1,25 @@
+# 皮肤与移动布局
+
+[English](SKIN_COMPATIBILITY.en.md) · [第三方插件适配](../README.md#第三方插件适配)
+
+DSH Mobile 在已认证的移动页面中使用专用根布局，继续渲染 DSH 的会话、侧栏、设置和公共插槽；电脑页面不变。皮肤的公共主题变量可继续被组件使用，但依赖原生 CSS 模块类名或特定父节点的背景、人物及侧栏装饰不一定适用。
+
+## 保留电脑皮肤，只调整手机
+
+在手机 **设置 → 通用设置 → 移动页面模块 → 管理** 中找到皮肤对应的客户端模块；若它是可选项，可取消勾选并保存。选择只作用于当前配对设备，不卸载电脑插件、不修改其他设备，也不会自动刷新会话。下次手动重新打开或刷新页面才生效。
+
+保存时若提示依赖冲突，保留所需模块，或同时取消不需要的依赖方；不能排除启动必需模块。手机的“恢复默认”会重新使用电脑默认选择，不表示恢复为“加载全部”。完整规则见[模块管理](CLIENT_MODULES.md)。
+
+## 背景不显示时如何判断
+
+- 先核对正在运行的插件、App 和皮肤版本；插件与 App 版本不必相同。
+- 只在本设备不加载皮肤，手动重新打开后比较会话、输入栏和侧栏。恢复正常说明需要检查双方样式与挂载位置，不表示网络或配对失效。
+- 先与电脑上的原生布局对照。开发者还可在已认证移动 Origin 打开 `/?frontend=stock` 作布局诊断；它保留 Gateway 认证与 HTTPS 检查，但绕过移动增强和模块选择，部分 API 操作可能被拒绝，不能代替正常移动入口。
+- 若原生布局有背景而移动布局没有，检查皮肤背景的挂载容器及其对非原生布局的回退逻辑；单纯放行 WebSocket、重装 APK 或把全部容器设为透明不能保证修复。
+- 侧栏透底、文字阴影难读和轨迹空白应分别排查，不能都归为“少了一张背景图”。轨迹空白时还需检查首个客户端异常、实际布局尺寸和是否加载了相应模块；仅从静态截图不能判断是渲染异常、遮挡还是连接问题。
+
+例如 `maid-atelier` 0.1.7 发布包的背景依赖原生 `centerCol` 容器；皮肤仓库源码中的非原生布局回退不代表已安装包包含相同修正。DSH Mobile 不伪造这个类名或移动皮肤节点。支持移动布局的皮肤可以利用现有 `[data-pane="conversation"]`、`[data-pane="sidebar"]` 标记定位自己的装饰，或使用 DSH 公共主题变量；皮肤仍需自行处理尺寸、层叠、关闭清理和明暗主题，装饰不得遮挡文字或点击区域。本指南不表示整套皮肤已完成兼容验收。参见 [#202](https://github.com/saya-ch/dsh-mobile/issues/202)。
+
+在 DSH 0.2.0-rc.2、Mobile 0.6.4 与正式 npm `maid-atelier` 0.1.7 的隔离组合中，已复现深蓝侧栏透底、深色文字难读、背景缺失和有内容会话的轨迹空白。轨迹数据没有丢失：皮肤的宽泛根布局规则把移动容器改为纵向 Flex，内容区域高度缩为 0。插件 0.6.5 保护自有根容器的 Grid 几何规则，修复该轨迹空白，不改皮肤配色、阴影或装饰挂载。
+
+该皮肤把浅色侧栏文字绑定到原生 `sidebarCol`；移动布局没有该节点。缺失背景及部分文字对比度仍需皮肤适配，不能视为已随轨迹修复解决。按上面的设备模块选择排除皮肤后，移动页面可恢复默认样式，电脑皮肤保持。插件 0.6.4 及更早版本不包含这项布局保护。