dsh-mobile 0.8.4 → 0.8.6

package/CHANGELOG.md

@@ -2,6 +2,35 @@
 
 Notable changes are recorded here. GitHub Releases provide the downloadable packages and generated commit notes.
 
+## 0.8.6 - 2026-11-10
+
+- Forward paired plugin `x-dsh-*` request headers through the mobile Gateway while continuing to strip internal `x-dsh-mobile-*` markers and the DSH account credential header. This restores third-party plugin write routes that validate their own request marker. Thanks @mekswhy for the reproduction in [#375](https://github.com/saya-ch/dsh-mobile/issues/375) and @lnuxe for [#376](https://github.com/saya-ch/dsh-mobile/pull/376).
+- Send a bounded same-origin session route with Android task notifications and keep the full opaque Session ID instead of truncating it, so a tap can open the matching conversation. The page and Gateway half ships here; the native half is prepared as Android App 0.7.3 below and released separately. Thanks @owenzhao for the reproduction in [#371](https://github.com/saya-ch/dsh-mobile/issues/371), and @lnuxe for the implementation in [#374](https://github.com/saya-ch/dsh-mobile/pull/374).
+- Add a background-only task event stream to the paired Gateway, so a native client can receive completion events after Android suspends the page instead of relying on the page stream. Credential renewal, pinned TLS, the persistent notification and the deliberate iroh rejection belong to the App half prepared below; the plugin alone does not deliver a background reminder.
+- Keep the browser push subscription after an explicit web-push Disable so iOS can reuse it safely instead of creating an unusable replacement after a quick unsubscribe/subscribe cycle. Thanks @owenzhao for [#373](https://github.com/saya-ch/dsh-mobile/issues/373).
+- Expose the trusted Host-plugin `mobilePush.notify` service for bounded, category-checked custom web-push title/body text and session targets while retaining opaque click references. Thanks @owenzhao for [#372](https://github.com/saya-ch/dsh-mobile/issues/372).
+- Verify updated Windows firewall rules with a name query followed by property filtering, and retain the elevated child's failure text plus its numeric exit code in the plugin log. This removes the PowerShell parameter-set conflict that made managed LAN setup fail after creating only the TCP rule. Thanks @zustttt for the diagnosis in [#379](https://github.com/saya-ch/dsh-mobile/issues/379).
+- Recover the longer iroh private-directory cause chain by following a generic `tls-prepare` failure with a bounded local-only host probe. This keeps the existing sidecar compatible while classifying the reported Windows ACL failure explicitly. Thanks @fgql for the follow-up reproduction in [#365](https://github.com/saya-ch/dsh-mobile/issues/365).
+- Recognize the wrapper failure on any stderr line instead of requiring the whole buffer to equal it, so a preceding warning or an extra diagnostic no longer hides that cause chain. A failed managed-LAN firewall operation now keeps its own error when the scratch directory cannot be removed, and its detail omits the encoded command and local paths; the firewall diagnostics check the same rule profile as the managed setup before reporting a rule as ready.
+- Plugin-only update. Android 0.7.2 remains the published App; the Android 0.7.3 changes below are prepared in this repository and are released separately.
+
+## 0.8.5 - 2026-11-08
+
+- Update an existing Windows managed-LAN firewall rule in place and verify its resulting scope instead of deleting the previous rules first. Administrator cancellation or a policy rejection now retains the prior rule and records a bounded error in the plugin log. Thanks @lyc0110 for the reproduction in [#364](https://github.com/saya-ch/dsh-mobile/issues/364).
+- Preserve the bounded stderr explanation from the iroh identity probe. An insecure Windows profile ancestry is now surfaced as a specific error, logged by the plugin, and shown with actionable guidance instead of a generic endpoint failure. Private-directory checks remain strict. Thanks @fgql for the diagnosis in [#365](https://github.com/saya-ch/dsh-mobile/issues/365).
+- On macOS, warn when Full Disk Access is missing after a remote channel becomes ready, with a direct System Settings action and a dismiss control. The notice is advisory and never blocks pairing or remote access. Thanks @LunarFeller for the implementation and macOS testing in [#354](https://github.com/saya-ch/dsh-mobile/issues/354) and [#355](https://github.com/saya-ch/dsh-mobile/pull/355).
+- Treat a missing or zero-byte per-module size probe as unmeasured. Such modules keep their original `/plugins` rows instead of being packed into one oversized mobile boot batch when an intercepting proxy returns empty 200 responses. Thanks @chenForbear for the measurements in [#363](https://github.com/saya-ch/dsh-mobile/issues/363).
+- Add a narrow stale-while-revalidate cache for the two parameterless catalog RPCs (`llm/listProviders` and `session/modelCatalog`). Eligible warm requests share one bounded upstream fill, each caller keeps its own RPC ID, and catalog-affecting mutations invalidate the generation; `catalogCache: false` restores the ordinary proxy path. The cache does not patch upstream client internals or restore labels before the catalog is ready. Thanks @chintoleung for [#367](https://github.com/saya-ch/dsh-mobile/pull/367).
+- Resolve an in-app plugin update against the profile that loaded the running module when a Desktop host omits the current-profile service. The install-path fallback remains limited to profiles below `$DSH_HOME/profiles`, so a launcher that omits `--profile` can no longer silently update `web` instead of `desktop`. Thanks @Kizaemon for the detailed reproduction in [#368](https://github.com/saya-ch/dsh-mobile/issues/368).
+- Accept RFC 6598 `100.64.0.0/10` addresses as managed-LAN candidates, including networks whose router or ISP exposes CGNAT-style addressing for the local Ethernet or Wi-Fi segment. The admin Host-header check continues to reject CGNAT to preserve its DNS-rebinding defence. Thanks @Kizaemon for the diagnosis in [#369](https://github.com/saya-ch/dsh-mobile/issues/369).
+- Plugin-only update. Android 0.7.2 remains the published App; no native App change is included.
+
+## Android 0.7.3 - Unreleased
+
+- Make task notification navigation preserve the full bounded opaque Session ID and open the exact conversation after a cold or warm tap. Each notification identifies its tap target by its tag, so two notifications cannot overwrite one another's target even when their request codes collide. Only the built-in `dsh-session` route is accepted. Thanks @owenzhao for the report in [#371](https://github.com/saya-ch/dsh-mobile/issues/371) and @lnuxe for the original implementation in [#374](https://github.com/saya-ch/dsh-mobile/pull/374).
+- Add an explicit, opt-in `dataSync` foreground service for completion alerts after Android suspends the WebView. It renews the paired credential, pins the configured CA, keeps a persistent notification, stops on device removal or revocation, and deliberately rejects iroh pairings until the native transport exposes the same authenticated identity. Notification permission remains a separate Android setting. Thanks @owenzhao for the background-delivery analysis in [#377](https://github.com/saya-ch/dsh-mobile/issues/377).
+- A background-service start that the platform rejects no longer leaves the setting reported as enabled, and the service withdraws the opt-in when Android ends its foreground time budget instead of being killed as unresponsive.
+
 ## 0.8.4 - 2026-11-07
 
 - Resolve query-only and relative upstream redirects against the URL that actually requested them. This fixes mobile `/api/file` image previews receiving the app document after a redirect, while external redirect targets remain unchanged. Thanks @owenzhao for the report in [#361](https://github.com/saya-ch/dsh-mobile/issues/361). Thanks @aaalzk for independently confirming it.

package/CONTRIBUTORS.md

@@ -4,6 +4,18 @@ GitHub 的 [Contributors 图表](https://github.com/saya-ch/dsh-mobile/graphs/co
 
 GitHub's Contributors graph counts commits on the default branch; issue reports and PR proposals cannot be manually added to it. This page credits community members by how they contributed. The repository maintainer and automated dependency updates remain visible in GitHub's history.
 
+## 下一版本贡献 / Contributions for the next release
+
+感谢 [@mekswhy](https://github.com/mekswhy) 在 [#375](https://github.com/saya-ch/dsh-mobile/issues/375) 报告插件请求头被移动网关丢弃，[@lnuxe](https://github.com/lnuxe) 提供 [#376](https://github.com/saya-ch/dsh-mobile/pull/376) 的网关修复与 [#374](https://github.com/saya-ch/dsh-mobile/pull/374) 的通知导航实现；维护者保留原作者提交并补充安全过滤、完整长度校验、并发与真机验收路径。感谢 [@owenzhao](https://github.com/owenzhao) 在 [#371](https://github.com/saya-ch/dsh-mobile/issues/371)、[#372](https://github.com/saya-ch/dsh-mobile/issues/372)、[#373](https://github.com/saya-ch/dsh-mobile/issues/373) 和 [#377](https://github.com/saya-ch/dsh-mobile/issues/377) 提供通知链路场景、复现和边界说明。感谢 [@zustttt](https://github.com/zustttt) 在 [#379](https://github.com/saya-ch/dsh-mobile/issues/379) 定位 Windows 局域网一键配置失败的 PowerShell 参数集冲突。
+
+Thanks [@mekswhy](https://github.com/mekswhy) for reporting the mobile Gateway's dropped plugin request header in [#375](https://github.com/saya-ch/dsh-mobile/issues/375), and [@lnuxe](https://github.com/lnuxe) for the Gateway fix in [#376](https://github.com/saya-ch/dsh-mobile/pull/376) and notification navigation implementation in [#374](https://github.com/saya-ch/dsh-mobile/pull/374). Original commits are retained, with maintainer additions for security filtering, full-length validation, concurrency and device-acceptance paths. Thanks [@owenzhao](https://github.com/owenzhao) for the notification scenarios, reproductions and boundaries in [#371](https://github.com/saya-ch/dsh-mobile/issues/371), [#372](https://github.com/saya-ch/dsh-mobile/issues/372), [#373](https://github.com/saya-ch/dsh-mobile/issues/373) and [#377](https://github.com/saya-ch/dsh-mobile/issues/377). Thanks [@zustttt](https://github.com/zustttt) for diagnosing the PowerShell parameter-set conflict in [#379](https://github.com/saya-ch/dsh-mobile/issues/379).
+
+## 0.8.5 贡献 / Contributions for 0.8.5
+
+感谢 [@lyc0110](https://github.com/lyc0110) 在 [#364](https://github.com/saya-ch/dsh-mobile/issues/364) 报告 Windows 防火墙先删后建的风险，[@fgql](https://github.com/fgql) 在 [#365](https://github.com/saya-ch/dsh-mobile/issues/365) 提供 iroh 私有目录失败的完整诊断，[@LunarFeller](https://github.com/LunarFeller) 在 [#355](https://github.com/saya-ch/dsh-mobile/pull/355) 提供 macOS 完全磁盘访问提示及真机验证，[@chenForbear](https://github.com/chenForbear) 在 [#363](https://github.com/saya-ch/dsh-mobile/issues/363) 提供模块批次测量，[@chintoleung](https://github.com/chintoleung) 提供 [#367](https://github.com/saya-ch/dsh-mobile/pull/367) 的 catalog 缓存，以及 [@Kizaemon](https://github.com/Kizaemon) 在 [#368](https://github.com/saya-ch/dsh-mobile/issues/368) 报告 Desktop 更新配置档错误、在 [#369](https://github.com/saya-ch/dsh-mobile/issues/369) 完成 CGNAT 局域网诊断。
+
+Thanks [@lyc0110](https://github.com/lyc0110) for reporting the Windows firewall replacement risk in [#364](https://github.com/saya-ch/dsh-mobile/issues/364), [@fgql](https://github.com/fgql) for the detailed iroh private-directory diagnosis in [#365](https://github.com/saya-ch/dsh-mobile/issues/365), [@LunarFeller](https://github.com/LunarFeller) for the macOS Full Disk Access notice and device verification in [#355](https://github.com/saya-ch/dsh-mobile/pull/355), [@chenForbear](https://github.com/chenForbear) for the module-batch measurements in [#363](https://github.com/saya-ch/dsh-mobile/issues/363), [@chintoleung](https://github.com/chintoleung) for the catalog cache in [#367](https://github.com/saya-ch/dsh-mobile/pull/367), and [@Kizaemon](https://github.com/Kizaemon) for the Desktop profile-update reproduction in [#368](https://github.com/saya-ch/dsh-mobile/issues/368) and CGNAT LAN diagnosis in [#369](https://github.com/saya-ch/dsh-mobile/issues/369).
+
 ## 0.8.4 贡献 / Contributions for 0.8.4
 
 感谢 [@owenzhao](https://github.com/owenzhao) 在 [#361](https://github.com/saya-ch/dsh-mobile/issues/361) 报告相对重定向导致移动图片预览失败。感谢 [@aaalzk](https://github.com/aaalzk) 独立确认，以及 [@LUgABeEEE](https://github.com/LUgABeEEE) 在 [#362](https://github.com/saya-ch/dsh-mobile/pull/362) 提供折叠栏布局修复。原作者提交保留；维护者修正另记。
@@ -18,13 +30,13 @@ Thanks [@xaxka](https://github.com/xaxka) for the shared-FRP username in [#344](
 
 ## 0.8.2 贡献 / Contributions for 0.8.2
 
-感谢 [@LUgABeEEE](https://github.com/LUgABeEEE) 通过 [#343](https://github.com/saya-ch/dsh-mobile/pull/343) 修正 Android 固定证书的 WebSocket 地址判断。原作者提交保留；维护者补充完整证书决策组合回归。该原生改动归入独立编号的 Android 0.7.2 候选，不由 npm 升级替代。
+感谢 [@LUgABeEEE](https://github.com/LUgABeEEE) 通过 [#343](https://github.com/saya-ch/dsh-mobile/pull/343) 修正 Android 固定证书的 WebSocket 地址判断。原作者提交保留；维护者补充完整证书决策组合回归。该原生改动已随独立编号的 Android 0.7.2 发布，不由 npm 升级替代。
 
-Thanks [@LUgABeEEE](https://github.com/LUgABeEEE) for the Android pinned-WebSocket authority fix in [#343](https://github.com/saya-ch/dsh-mobile/pull/343). Original commits are retained alongside maintainer combined-certificate regressions. This native change belongs to the independently versioned Android 0.7.2 candidate, not an npm-only update.
+Thanks [@LUgABeEEE](https://github.com/LUgABeEEE) for the Android pinned-WebSocket authority fix in [#343](https://github.com/saya-ch/dsh-mobile/pull/343). Original commits are retained alongside maintainer combined-certificate regressions. This native change shipped in the independently versioned Android 0.7.2 release, not an npm-only update.
 
-感谢 [@LunarFeller](https://github.com/LunarFeller) 在 [#341](https://github.com/saya-ch/dsh-mobile/issues/341) 定位 FRP 接入模式的标题与 SSH 字段残留，并通过 [#342](https://github.com/saya-ch/dsh-mobile/pull/342) 提交修复；候选保留原作者提交，并补充浏览器回归。
+感谢 [@LunarFeller](https://github.com/LunarFeller) 在 [#341](https://github.com/saya-ch/dsh-mobile/issues/341) 定位 FRP 接入模式的标题与 SSH 字段残留，并通过 [#342](https://github.com/saya-ch/dsh-mobile/pull/342) 提交修复；发布保留原作者提交，并补充浏览器回归。
 
-Thanks [@LunarFeller](https://github.com/LunarFeller) for diagnosing the FRP attach-mode heading and SSH-field remnants in [#341](https://github.com/saya-ch/dsh-mobile/issues/341) and contributing the fix in [#342](https://github.com/saya-ch/dsh-mobile/pull/342). The candidate preserves the original commit and adds browser regression coverage.
+Thanks [@LunarFeller](https://github.com/LunarFeller) for diagnosing the FRP attach-mode heading and SSH-field remnants in [#341](https://github.com/saya-ch/dsh-mobile/issues/341) and contributing the fix in [#342](https://github.com/saya-ch/dsh-mobile/pull/342). The release preserves the original commit and adds browser regression coverage.
 
 感谢 [@madlogos](https://github.com/madlogos) 在[后续反馈](https://github.com/saya-ch/dsh-mobile/issues/337#issuecomment-6593356950)中指出最小加载后的设置访问与全量恢复问题，推动旧选择重启恢复流程的验收和说明。
 

package/README.en.md

@@ -28,7 +28,7 @@
   <a href="#compatibility">Compatibility</a> ·
   <a href="docs/README.md">Documentation</a> ·
   <a href="#contributors">Contributors</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4">Release notes</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.6">Release notes</a> ·
   <a href="README.md">简体中文</a>
 </p>
 
@@ -36,7 +36,7 @@
 >
 > **Using an iPhone or iPad?** Use Safari or [add DSH Mobile to your Home Screen as a web app (PWA)](<#iphone-and-ipad-home-screen-web-app-pwa>)—no native iOS download needed.
 >
-> **Current stable release: 0.8.4**. Fix mobile images loading the app document after a relative redirect, and keep the folded rail clear of the conversation. Plugin and Android App releases remain independent. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4) · [Full changelog](CHANGELOG.md).
+> **Current stable release: 0.8.6**. Forward paired third-party plugin request headers, keep the browser push subscription after a Disable, and expose bounded custom web-push text to trusted Host plugins; also fix Windows firewall verification, iroh directory diagnostics and the LAN diagnostic scope. Plugin and Android App releases remain independent; the background-reminder App update ships separately as Android 0.7.3. [Plugin release notes and downloads](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.6) · [Full changelog](CHANGELOG.md).
 >
 > **Version policy**: since plugin **0.6.2**, the Android app and plugin use independent version numbers and releases. Their numbers do not need to match, and a plugin update does not imply an app update. [Compatibility notes](#compatibility).
 
@@ -108,7 +108,7 @@ Restart DSH, then search for **dsh-mobile** under **Settings → Plugin Market**
 
 </details>
 
-`setup` automatically selects and remembers the current LAN; Wi-Fi, hotspot, and IP changes normally recover without re-pairing. Use `--address 192.168.x.x` only when automatic selection fails. Settings, certificates, devices, and customization files live under `$DSH_HOME/mobile-access/`.
+`setup` automatically selects and remembers the current LAN from RFC1918 and `100.64.0.0/10` candidates; Wi-Fi, hotspot, and IP changes normally recover without re-pairing. Use `--address 192.168.x.x` to name the actual address only when automatic selection fails. Settings, certificates, devices, and customization files live under `$DSH_HOME/mobile-access/`.
 
 ### Install the Android app
 
@@ -265,8 +265,6 @@ Prefer DSH's built-in file upload for attachments. If an extension must simulate
 
 The 0.6.3 release adds optional [Worker execution](docs/EXTENSION_WORKERS.en.md) for trusted local JavaScript hosts. It is disabled by default, selectable by extension, and recovers explicitly without replaying interrupted actions. It is not a permission sandbox and does not require a matching App version.
 
-<sub>You can even use an extension to connect to SillyTavern running on the same computer, give it a lightweight mobile frontend, and open it from the same app.</sub>
-
 > `host.mjs` has the same privileges as a local program. Create and run only computer-side extensions that you understand and trust.
 
 The examples above, applied:
@@ -447,6 +445,8 @@ On macOS, local network, cloudflared, self-hosted FRP and the own reverse proxy
 
 | DSH Mobile plugin | Verified DeepSeek Harness version |
 | --- | --- |
+| `0.8.6` | On the `0.2.2-rc.1` packed target, forward paired third-party plugin `x-dsh-*` headers, keep the push subscription after a Disable, expose the trusted Host push-text service, and fix Windows firewall verification, iroh directory diagnostics and the LAN diagnostic scope. The Android App remains 0.7.2; background reminders ship with 0.7.3 separately |
+| `0.8.5` | Maintenance and performance update on the `0.2.2-rc.1` packed-DSH target: catalog cache, Desktop update targeting, CGNAT LAN discovery, firewall protection and a macOS permission notice. The Android App remains 0.7.2 |
 | `0.8.4` | Plugin maintenance update. The packed DSH test target remains `0.2.2-rc.1`, alongside existing compatibility checks. The upstream rc.1 npm CLI requires Node.js 24.9 or later |
 | `0.8.3` | Adapted to DSH 0.2.2-rc.1 with landscape, Plugins and Web Push settings layout fixes, shared FRP usernames and iroh pairing improvements |
 | `0.8.2` | The DSH 0.2.2 preview target for this release was `0.2.2-alpha.3`. Fresh `0.2.2-alpha.2` installs can fail to save settings because of an upstream dependency mismatch; see the [independent reproduction](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554). Users still on alpha.2 should upgrade to rc.1 |

package/README.md

@@ -28,7 +28,7 @@
   <a href="#兼容性">兼容性</a> ·
   <a href="docs/README.md">文档</a> ·
   <a href="#贡献者">贡献者</a> ·
-  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4">更新记录</a> ·
+  <a href="https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.6">更新记录</a> ·
   <a href="README.en.md">English</a>
 </p>
 
@@ -36,7 +36,7 @@
 >
 > **使用 iPhone 或 iPad？** 可以用 Safari 访问，或[添加到主屏幕作为 Web App（PWA）使用](<#iphone-与-ipad主屏幕-web-apppwa>)，无需下载原生 iOS App。
 >
-> **当前正式版本：0.8.4**。修复移动端图片在相对重定向后加载成首页的问题，并修正折叠侧栏覆盖会话的布局。插件与 Android App 独立更新。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.4) · [完整更新记录](CHANGELOG.md)。
+> **当前正式版本：0.8.6**。透传已配对第三方插件的请求头，修正网页推送停用后的订阅处理，并向受信 Host 插件开放推送文案接口；同时修复 Windows 防火墙校验、iroh 目录诊断与局域网诊断口径。插件与 Android App 独立更新，带后台提醒的 App 0.7.3 单独发布。[插件更新与下载](https://github.com/saya-ch/dsh-mobile/releases/tag/v0.8.6) · [完整更新记录](CHANGELOG.md)。
 >
 > **版本说明**：自插件 **0.6.2** 起，Android App 与插件独立编号、独立发布，版本号无需一致；插件升级不代表 App 需要同步升级。[兼容说明](#兼容性)。
 
@@ -108,7 +108,7 @@ dsh plugin --profile web add dshmarket
 
 </details>
 
-`setup` 会自动选择并记住当前局域网，切换 Wi-Fi、热点或 IP 后通常自动恢复；仅在自动选择失败时使用 `--address 192.168.x.x`。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
+`setup` 会自动选择并记住当前局域网，候选覆盖 RFC1918 与 `100.64.0.0/10`；切换 Wi-Fi、热点或 IP 后通常自动恢复。仅在自动选择失败时使用 `--address 192.168.x.x` 指定实际地址。设置、证书、设备和自定义文件保存在 `$DSH_HOME/mobile-access/`。
 
 ### 安装 Android App
 
@@ -267,8 +267,6 @@ Funnel 的运行组件把公开监听生命周期绑定到父进程和受限控
 
 0.6.3 新增可选的 [Worker 执行模式](docs/EXTENSION_WORKERS.md)，用于约束可信本地扩展的 JavaScript 阻塞；默认关闭，按扩展选择，故障后显式恢复，不自动重放操作。这不是权限沙箱，也不要求 App 同步版本。
 
-<sub>你甚至可以通过扩展连接电脑上运行的酒馆，并从同一 App 打开它的简易移动前端。</sub>
-
 > `host.mjs` 与本机程序拥有相同权限；仅创建和运行你理解并信任的电脑端扩展。
 
 示例的实际效果：
@@ -449,6 +447,8 @@ macOS 上局域网、cloudflared、自建 FRP 与自有反向代理可用；Funn
 
 | DSH Mobile 插件 | 已验证的 DeepSeek Harness 版本与范围 |
 | --- | --- |
+| `0.8.6` | 在 `0.2.2-rc.1` 打包目标上透传已配对第三方插件的 `x-dsh-*` 请求头、修正网页推送停用语义、向受信 Host 插件开放推送文案接口，并修复 Windows 防火墙校验、iroh 目录诊断与局域网诊断口径。Android App 仍为 0.7.2；带后台提醒的 0.7.3 单独发布 |
+| `0.8.5` | 插件维护与性能更新，继续使用 `0.2.2-rc.1` 的 DSH 打包验证目标；新增目录缓存、Desktop 更新目标修复、CGNAT 局域网识别、防火墙保护与 macOS 权限提示。Android App 仍为 0.7.2 |
 | `0.8.4` | 插件维护更新，继续使用 `0.2.2-rc.1` 的 DSH 打包验证目标，并保留既有版本检查。使用 rc.1 的 npm CLI 时，按上游要求使用 Node.js 24.9 或更新版本 |
 | `0.8.3` | 当时适配 DSH 0.2.2-rc.1，修复横屏、插件页和网页推送设置布局，支持共享 FRP 用户名，并改进 iroh 配对 |
 | `0.8.2` | 当时的 DSH 0.2.2 预览目标是 `0.2.2-alpha.3`。`0.2.2-alpha.2` 全新安装可能因上游依赖组合不一致而无法保存设置；[独立复现](https://github.com/deepseek-ai/deepseek-harness/discussions/11994#discussioncomment-19373554)。仍在使用 alpha.2 的用户建议升级到 rc.1 |

package/apps/mobile/README.md

@@ -184,6 +184,8 @@ The verified stable release is [Android 0.7.2](https://github.com/saya-ch/dsh-mo
 
 - Both public App 0.7.1 APKs passed checksum, manifest, established-signer, notice and alignment checks. The full APK additionally passed ABI and retained JVM TLS/JNI entry checks; compatibility contains no native libraries. There is no new physical-device or public-relay run for 0.7.1. Earlier arm64 development traffic remains historical evidence, not proof that a current connection uses the relay.
 
+- A current-source Debug build was installed beside the official App on TB710FU (Android API 36) and paired to an isolated DSH 0.2.2-rc.1 gateway with a pinned local CA. The DSH page opened, system Back returned to the launcher, the task-notification permission flow opened, and enabling then disabling background reminders started and stopped a `dataSync` foreground service with its persistent notification. This was an isolated Debug package, not the official signer, and did not deliver a real task-completion event through a model run.
+
 - App 0.6.8's public APK passed identity, checksum and established-signer verification. A matching-signer Debug upgrade opened DSH and retained the saved device; controlled slow-link fault injection was interrupted before pairing and is not counted as passed.
 
 - App 0.6.7 Debug builds were checked on PJW110, Android 16 and WebView 153 with isolated DSH 0.2.1-rc.2 over USB-reversed pinned HTTPS. Actual automatic staged adoption retained a same-Session Unicode draft and kept target native zoom/renewal working without another page load. Confirmation cancellation, held-target Back cancellation and late responses, native renewal cancellation, keyboard Back and picker cancellation also passed; QA pairings and mappings were removed afterward. This was not a real Wi-Fi/cellular transition or an installation of the formally signed APK.

package/apps/mobile/README.zh-CN.md

@@ -184,6 +184,8 @@ Set-Location apps/mobile/android
 
 - App 0.7.1 的两份公开 APK 均通过校验值、Manifest、既定正式签名、许可文本和对齐检查；完整版另检查两个 ABI 及保留的 JVM TLS／JNI 入口，兼容版确认没有原生库。本版未新增真机或公网中继回归。较早 arm64 开发构建的链路记录仍属历史证据，不能据此断言当前连接的数据已经过中继。
 
+- 当前源码的 Debug 构建曾与正式 App 并存安装到 TB710FU（Android API 36），通过隔离的 DSH 0.2.2-rc.1 网关和固定本地 CA 配对；DSH 页面成功打开，系统返回键回到桌面，任务通知权限流程可打开，开启和关闭后台提醒分别启动、停止了带常驻通知的 `dataSync` 前台服务。这是隔离 Debug 包，不是正式签名 APK，也没有通过真实模型回合投递一条完成事件。
+
 - App 0.6.8 的公开 APK 已核验身份、校验值和既定正式签名。Debug 包同签名原位升级后可打开 DSH，并保留原设备记录；受控慢链路故障注入在配对前中断，不计为通过。
 
 - App 0.6.7 Debug 构建在 PJW110、Android 16、WebView 153 上，通过 USB 映射和固定 CA 的 HTTPS 连接隔离的 DSH 0.2.1-rc.2。真实自动接管保留同会话 Unicode 草稿，目标原生缩放／续期可用且不额外刷新；还通过确认取消、目标加载中按返回取消与迟到响应、原生续期取消、键盘返回和选择器取消。临时配对与映射已清理；这不是实际 Wi-Fi／蜂窝切网，也不是正式签名 APK 的装机验收。

package/docs/CLIENT_MODULES.en.md

@@ -40,7 +40,7 @@ Close, Escape and the App's Back action ask before discarding unsaved changes. A
 
 Computer pages and `?frontend=stock` pages are unaffected. DSH or community-plugin updates can change the catalog and dependencies. When a saved selection prevents the mobile page from starting, the page offers “Load all modules for this device and retry”; it changes this device’s selection only when you click, without changing computer defaults, other devices or pairing authorization. Settings APIs still reject invalid selections and enforce required-module and dependency checks.
 
-The plugin 0.8.2 candidate marks the installed General settings provider as required for boot, fixing old minimal selections that made the settings entry unavailable. If an old record excludes that provider, reopening the mobile page shows recovery without requiring settings access first. Only selecting Load all saves and retries; a failure retains the old selection for an explicit retry. Pairings need not be deleted. Version 0.8.2 is not released yet; see [CHANGELOG](../CHANGELOG.md) for release status.
+Since plugin 0.8.2, the installed General settings provider has been required for boot, fixing old minimal selections that made the settings entry unavailable. If an old record excludes that provider, reopening the mobile page shows recovery without requiring settings access first. Only selecting Load all saves and retries; a failure retains the old selection for an explicit retry. Pairings need not be deleted.
 
 ## Measure sizes and minimize loading
 

package/docs/CLIENT_MODULES.md

@@ -40,7 +40,7 @@ DSH 或插件更新后，旧排除项可能已不在目录中，或变为启动
 
 电脑页面与 `?frontend=stock` 页面不受模块选择影响。DSH 或社区插件更新可能改变模块目录和依赖；已保存的选择阻止移动页面启动时，页面提供“为本设备加载全部模块并重试”，由你点击后恢复本设备的加载选择，不改变电脑默认、其他设备或配对授权。设置接口仍拒绝无效选择，不绕过启动必需或依赖检查。
 
-插件 0.8.2 候选将已安装的“通用设置”入口组件列为启动必需项，修复旧最小加载选择导致设置入口不可用的问题。旧记录若排除了该组件，重新打开移动页面时会先显示恢复页，无需先进入设置。点击加载全部才会保存并重试；失败时保留原选择，可以明确重试，不需要删除配对。0.8.2 尚未发布，发布状态见 [CHANGELOG](../CHANGELOG.md)。
+自插件 0.8.2 起，已安装的“通用设置”入口组件被列为启动必需项，修复旧最小加载选择导致设置入口不可用的问题。旧记录若排除了该组件，重新打开移动页面时会先显示恢复页，无需先进入设置。点击加载全部才会保存并重试；失败时保留原选择，可以明确重试，不需要删除配对。
 
 ## 体积测量与最小加载
 

package/docs/CONNECTION_DIAGNOSTICS.en.md

@@ -51,6 +51,8 @@ Before leaving the Mac unattended, start DSH the way you normally run it and ope
 
 Before leaving, use an already paired device on the intended remote channel, open **the same folder** in the web directory picker, and confirm that it lists the contents. Gateway health and terminal `ls` do not test DSH's access to the folder. If macOS prompts, address it and retry with the existing pairing; do not reset system permissions or reinstall the plugin.
 
+After a remote channel becomes ready, the Mobile Access panel may also offer Full Disk Access. This is optional guidance for unattended access to protected folders; it does not block pairing or remote access. The button only opens System Settings and the plugin never changes permissions itself.
+
 ## Share the report
 
 Reports retain versions, interface names, masked endpoint suffixes, failure stages, timings, DNS categories and measurement scope. They do not read conversations or include pairing secrets, Tokens, Cookies, complete hostnames/IPs or proxy credentials. Context such as an interface name can still be identifying; review before posting.

package/docs/CONNECTION_DIAGNOSTICS.md

@@ -51,6 +51,8 @@ macOS 可能在电脑上要求 DSH 授权访问「桌面」「文稿」「下载
 
 离开前，用已配对设备走计划使用的远程通道，在网页目录选择器里进入**同一个目录**并确认能列出内容。只检查网关健康或在终端运行 `ls`，不能验证 DSH 有权访问该目录。如果 Mac 弹出提示，处理后用原有配对重试；不用重置系统权限或重装插件。
 
+远程通道就绪后，移动访问面板也可能提示开启「完全磁盘访问」。这是为无人值守访问减少受保护目录授权弹窗的建议，不会阻断配对或远程连接；按钮只打开系统设置，不会由插件修改权限。
+
 ## 分享报告
 
 报告保留版本、接口名称、脱敏端点后缀、失败阶段、耗时、系统 DNS 类别和测量范围。不读取会话正文，不包含配对密钥、Token、Cookie、完整域名、完整 IP 或代理凭据。接口名称等上下文仍可能具有辨识性，公开前应再检查一遍。

package/docs/IROH.en.md

@@ -41,6 +41,7 @@ Before a component release, verify first use with the exact catalog-pinned execu
 | `iroh_companion_missing` | Nothing installed yet: press Install first, or point `DSH_MOBILE_IROH_COMPANION` at a companion absolute path to reuse |
 | `iroh_sidecar_invalid` | An installed file was modified; reinstalling overwrites it in place, or reinstall the companion for a damaged companion copy |
 | `iroh_platform_unsupported` | No sidecar is published for this OS/architecture |
+| `iroh_data_directory_insecure` | A Windows parent directory of the state path grants write or replacement rights to another account. Move `DSH_HOME` to private storage or correct those ACLs; the plugin log retains the sidecar's bounded stderr explanation |
 | `iroh_identity_invalid` / `iroh_identity_failed` | Check private permissions on the state directory and its ancestors and check for damaged identity files, preserving originals. `id` reads an existing identity; first use invokes `tls-prepare`, not copying or deleting an identity |
 | `iroh_start_timeout` | Inspect iroh errors in the DSH log and network connectivity, and verify that the pinned component runs; repeated pairing is not a substitute for process diagnosis |
 | Channel `ready` but no phone connects | Check that the App is the full build, the device supports a packaged ABI and the descriptor is fresh. Computer readiness does not establish phone connectivity; a relay-service connection alone does not establish that data uses the relay |

package/docs/IROH.md

@@ -41,6 +41,7 @@ iroh 身份和证书必须存放在仅当前用户或受信系统账户可写的
 | `iroh_companion_missing` | 还没点安装（或配套不在常规布局旁）；先点安装官方组件，或用 `DSH_MOBILE_IROH_COMPANION` 指向配套绝对路径复用 |
 | `iroh_sidecar_invalid` | 已装文件被改动过；重新点安装即可覆盖修复，配套副本损坏则重装配套 |
 | `iroh_platform_unsupported` | 当前系统/架构没有 sidecar 发布 |
+| `iroh_data_directory_insecure` | Windows 状态目录的某个上级目录允许其他账户写入或替换。请把 `DSH_HOME` 移到私有目录，或修正上级目录 ACL；插件日志会保留 sidecar 的脱敏 stderr 说明 |
 | `iroh_identity_invalid` / `iroh_identity_failed` | 先检查状态目录及父目录是否私有、已有身份是否损坏，保留原文件再排查；`id` 仅检查已有身份，首次创建使用 `tls-prepare`，不是靠复制或删除身份修复 |
 | `iroh_start_timeout` | 查看 DSH 日志中的 iroh 错误及网络连接，确认固定组件可运行；不要反复重新配对来替代进程排查 |
 | 通道 `ready` 但手机连不上 | 检查 App 是否为完整版、设备是否支持打包的 ABI，以及描述符是否有效；电脑就绪不等于手机已连通，连接中继服务也不等于数据一定经过中继 |

package/docs/README.md

@@ -28,7 +28,7 @@
 
 | 功能 | 中文 | English | 使用状态 |
 | --- | --- | --- | --- |
-| 区分电脑、DNS、出口与手机的诊断证据 | [连接诊断](CONNECTION_DIAGNOSTICS.md) | [Connection diagnostics](CONNECTION_DIAGNOSTICS.en.md) | 分层报告为 0.8.2 候选；不代表手机路径已验收 |
+| 区分电脑、DNS、出口与手机的诊断证据 | [连接诊断](CONNECTION_DIAGNOSTICS.md) | [Connection diagnostics](CONNECTION_DIAGNOSTICS.en.md) | 分层报告自 0.8.2 起提供；不代表手机路径已验收 |
 | 核对移动字号、字体与 App 页面缩放 | [显示大小](MOBILE_COMPOSER_TOOLBAR.md#显示大小与可用空间) | [Display size](MOBILE_COMPOSER_TOOLBAR.en.md#display-size-and-available-space) | 字体按主题能力显示；App 缩放与网页字号独立 |
 | 为移动页面选择加载模块 | [模块设置](CLIENT_MODULES.md) | [Module settings](CLIENT_MODULES.en.md) | 电脑默认与设备覆盖分别保存，不自动刷新会话 |
 | 允许受控路由网络访问 LAN Gateway | [额外可信网段](TRUSTED_NETWORKS.md) | [Trusted networks](TRUSTED_NETWORKS.en.md) | 不建立 VPN，不自动扩大防火墙规则 |

package/docs/SLOW_CONNECTIONS.en.md

@@ -138,6 +138,14 @@ The gateway groups upstream application modules into start batches (`/mobile-acc
 
 Resources without upstream validators do not automatically acquire a reliable one. Compare the same complete resource URL during ordinary navigation, reload and app cold start: inspect `200`/`304`, cache hits, `If-None-Match`, encoding and actual transfer volume. Do not clear site data first and treat the result as normal cache behavior. Improved HTTP validation does not guarantee cache reuse in every WebView, and these headers alone do not establish a complete fix for [#107](https://github.com/saya-ch/dsh-mobile/issues/107).
 
+## Model selector on slow links
+
+The gateway keeps a narrow stale-while-revalidate cache for exactly two catalog RPCs: `llm/listProviders` and `session/modelCatalog`. On an eligible warm request it answers from the cache immediately, so the corresponding gateway→DSH round trip and host-side catalog rebuild are skipped; concurrent callers share one upstream fill. A cached entry is served only while younger than 60 seconds since its fill completed; after that the next request waits for a fresh fill. Within that window a stale entry (older than 5 seconds) is still served immediately while one background refresh runs outside the caller's critical path. The catalog response still transfers to the phone on every request — this removes the upstream wait, not the phone↔gateway transfer, and it does not push an update into a page that has already rendered its selector.
+
+Responses served this way carry the live caller's RPC ID, `Cache-Control: no-store`, and an `x-dsh-mobile-catalog: hit | stale | replay | miss-passthrough` marker for diagnostics. Supported gateway-visible changes that affect the catalog (credentials, provider settings, account sign-in state, plugin enablement, and a session's saved default model) invalidate the cache immediately; edits made outside this gateway are bounded by the 60-second ceiling and by the client's own refetch behavior. A response that cannot be safely shared (an error, unexpected headers, an oversized body) is never cached: the phone then performs one ordinary request, which can add a single extra read attempt and its latency on a cold uncacheable response.
+
+Set `catalogCache: false` in the `mobile-access` entry and save, then restart DSH (or reload the plugin) to restore the unchanged proxy path. Immediate label restoration from the saved `modelSelection` projection while the catalog is unresolved remains an upstream limitation: the public label slot does not apply in that state, and this plugin does not patch DSH client internals ([#290](https://github.com/saya-ch/dsh-mobile/issues/290)).
+
 ## Manual compaction and long-running API requests (0.6.0)
 
 Commands such as `/compact` sent from the phone traverse the Mobile gateway's HTTP API. Automatic compaction inside DSH does not traverse that gateway request. Older gateways used the default 30-second `upstreamTimeoutMs` for every proxied request, so manual compaction could return `502 upstream_unavailable` while the model was still producing the summary. [#171](https://github.com/saya-ch/dsh-mobile/issues/171) records this case.

package/docs/SLOW_CONNECTIONS.md

@@ -138,6 +138,14 @@ websocketCompression:
 
 上游未提供校验标识的资源不会因此自动得到一个可靠标识。检查重复下载时，比较同一完整资源 URL 在普通打开、重新加载和 App 冷启动中的 `200`/`304`、缓存命中、`If-None-Match`、编码与实际传输量；不要先清除站点数据再把结果当作正常缓存行为。HTTP 校验语义改善不保证每个 WebView 都会复用缓存，也不能仅凭这些响应头认定 [#107](https://github.com/saya-ch/dsh-mobile/issues/107) 已完全解决。
 
+## 慢速链路上的模型选择器
+
+网关仅对两个目录 RPC（`llm/listProviders` 和 `session/modelCatalog`）保留一个窄范围的 stale-while-revalidate 缓存。符合条件的暖请求会立即由缓存应答，跳过对应的网关→DSH 往返和主机端目录重建；并发请求共享一次上游填充。缓存条目自填充完成起 60 秒内才会被应答，超时后下一个请求会等待新填充；在这段时间内，超过 5 秒的陈旧条目仍会立即应答，同时在调用方关键路径之外执行一次后台刷新。目录响应仍会在每次请求时传输到手机——这里消除的是上游等待，不是手机↔网关的传输，也不会向已经渲染完选择器的页面推送更新。
+
+以这种方式应答的响应携带当前调用方的 RPC ID、`Cache-Control: no-store`，以及用于诊断的 `x-dsh-mobile-catalog: hit | stale | replay | miss-passthrough` 标记。网关可见且会影响目录的改动（凭据、提供方设置、账户登录状态、插件启用状态，以及会话保存的默认模型）会立即使缓存失效；绕过本网关的修改受 60 秒上限和客户端自身重新拉取行为的约束。无法安全共享的响应（错误、异常响应头、超限正文）不会被缓存：手机随后会发起一次普通请求，冷启动且不可缓存的响应因此可能多出一次读取尝试及其延迟。
+
+在 `mobile-access` 条目中设置 `catalogCache: false` 并保存，再重启 DSH（或重新加载插件），即可恢复未改动的代理路径。目录未就绪时立即从已保存的 `modelSelection` 投影恢复标签仍是上游限制：公开的标签插槽不适用于该状态，本插件也不修补 DSH 客户端内部实现（[#290](https://github.com/saya-ch/dsh-mobile/issues/290)）。
+
 ## 手动压缩会话与长时间 API 请求（0.6.0）
 
 手机发出的 `/compact` 等命令要通过移动网关的 HTTP API；DSH 内部触发的自动压缩不经过这次网关请求。旧版网关对所有上游代理请求都使用默认 30 秒的 `upstreamTimeoutMs`，因此模型仍在生成摘要时，手动压缩可能先收到 `502 upstream_unavailable`。[#171](https://github.com/saya-ch/dsh-mobile/issues/171) 记录了这一情况。

package/docs/WEB_PUSH.en.md

@@ -40,7 +40,7 @@ Safari and the installed app may have separate login state. This recovery is for
 
 Push is best effort, not an alarm service. Host sleep/shutdown, disabled origin, phone connectivity, Focus settings and platform scheduling can delay or prevent delivery.
 
-Closing the page does **not** disable saved push consent. Use **Disable** to stop future eligible sends; explicit logout and device revocation have the separate effects listed [below](<#consent-logout-and-revocation>). A notification tap may require login and never answers or approves anything; **Send test** opens the app root, not a conversation.
+Closing the page does **not** disable saved push consent. **Disable** stops future eligible sends but retains the browser subscription, avoiding an unusable replacement after a quick iOS unsubscribe/subscribe cycle; the next explicit Enable reuses the existing subscription. Explicit logout and device revocation have the separate effects listed [below](<#consent-logout-and-revocation>). A notification tap may require login and never answers or approves anything; **Send test** opens the app root, not a conversation.
 
 ## What can notify
 
@@ -64,7 +64,7 @@ Lock-screen text is generic and localized in English, Simplified Chinese or Ital
 | Action/event | Effect |
 | --- | --- |
 | Close the page or let its short login session expire | Saved push consent remains while persistent pairing authorization and the origin remain valid. Opening DSH still requires authentication. |
-| Select Disable | The host durably stops sending first, then the page best-effort unsubscribes only a subscription it owns. A failed browser unsubscribe does not restore host consent. |
+| Select Disable | Durably stop Host sends and revoke the registration while retaining the browser subscription in a non-delivering state for the next explicit Enable. Clear the subscription through browser site-data controls when required. |
 | Explicit Mobile logout | Disable this paired device's push on the current origin before clearing its short session; retain the pairing. A failed disable must not report a completed logout. |
 | Revoke/reset a device or let its persistent credential expire | Purge affected push registrations and queued work, including devices with no open page. |
 | Stop a Gateway/provider or change its origin | Stop that origin's sends. Other origins keep their own consent. Re-enabling on a new origin is explicit. |
@@ -80,6 +80,21 @@ After the public Workspace and Session lists are ready, Mobile rechecks that the
 
 The browser chooses warm versus cold navigation; do not assume unsent drafts or in-flight sends survive every notification navigation. A fresh DSH launch may initially show the most recently active conversation; select the intended session manually when needed. The plugin does not register or unregister a service worker or cache authenticated pages/API data.
 
+## Host-plugin custom text
+
+A trusted computer-side plugin may depend on the `mobilePush` service and submit a Session, title and body for categories the user already enabled:
+
+```ts
+await ctx.mobilePush.notify({
+  sessionId,
+  title: 'Conversation name',
+  body: 'The response is ready',
+  category: 'response',
+})
+```
+
+Titles are limited to 80 characters and bodies to 200; control characters become spaces. The result reports how many recipient deliveries were newly queued. The Host still checks Session existence, pairing authorization, each device's category preference, registration limits, expiry and concurrency. A tap keeps the Gateway-generated opaque reference instead of putting the raw Session ID in the URL. Custom text remains in the private push state until delivery or at most 30 minutes of expiry; do not submit passwords, Tokens or content that must never leave the computer.
+
 ## Limits and delivery failures
 
 - At most **4 registrations per paired device**, **256 registrations and 256 pending deliveries per authorization scope**, and **4 concurrent sends**. Overflow rejects new work rather than deleting another installation or blocking DSH.
@@ -97,6 +112,7 @@ The sender accepts only validated Apple HTTPS push endpoints, rejects redirects
 | No row / unavailable | Check required page-level capability, trusted HTTPS, authenticated dedicated browser context and DSH public services. There is no worker or old-iOS fallback. |
 | Install guidance | Launch the Home Screen icon rather than an ordinary browser tab. |
 | Permission denied | Change the site's notification permission in system/browser settings, return to the app and make a new explicit Enable action. No prompt is forced. |
+| It says granted but the Home Screen app stays silent | iOS records notification permission at site level; a re-added Home Screen app can inherit `granted` without receiving an independent authorization. The settings row shows this site-level state. If Disable/Enable still produces no delivery, remove the Home Screen app, clear the site's data, then add and authorize it again; do not guess or silently recreate the current app's subscription. |
 | Registration failed / stale settings | Refresh/reopen to read current state, then explicitly retry. Do not repeatedly resubmit an old request. |
 | Existing subscription uses another application key | Do not automatically unsubscribe it. After a host key reset, retrying Enable alone will not fix this conflict; identify its owner and arrange deliberate browser-side repair. |
 | Suspended / repair-required | Check host key/configuration and private-file access. Do not delete paired-device state or silently replace VAPID keys. |
@@ -107,12 +123,12 @@ Lost/corrupt VAPID material with existing registrations fails closed. A host adm
 
 ## Independent channels and acceptance
 
-Android's native permission/SSE path and APK/signing remain unchanged. The independently maintained **dsh-ping** channel is not modified or automatically disabled; enabling both can produce separate alerts. Web Push adds no cross-channel deduplication or foreground suppression.
+Android's native permission/SSE path stays independent of iOS Web Push. A newer Android App can explicitly enable background reminders below Task notifications: a foreground service keeps the paired connection available after Android suspends the page. This requires an additional persistent notification and remains subject to foreground-service time limits, battery policy and connectivity; iroh does not participate in this background service yet. The independently maintained **dsh-ping** channel is not modified or automatically disabled; enabling both can produce separate alerts. Web Push adds no cross-channel deduplication or foreground suppression.
 
 For everyday setup, send a test notification first, then check the categories you need. Keep the existing Home Screen installation and pairing data; reopen the page after updating the computer plugin to load its new interface. See [contribution checks](<../CONTRIBUTING.md#select-behavior-checks>) for packed runtime validation and maintenance commands.
 
 ## Verification status
 
-This release accepts the contributor's development testing on **iPhone 17 Pro Max / iOS 27.0.1**, covering six notification categories, background/locked/closed-page delivery, taps, disable/revocation, offline windows and host restarts. The maintainer has not independently repeated Apple-device tests; no corresponding physical iPad or other device/OS record is available.
+Historical Web Push acceptance uses the contributor's development testing on **iPhone 17 Pro Max / iOS 27.0.1**, covering six notification categories, background/locked/closed-page delivery, taps, disable/revocation, offline windows and host restarts. The maintainer has not independently repeated Apple-device tests; no corresponding physical iPad or other device/OS record is available. Reusing a subscription after Disable and custom Host text still require physical iOS verification; Android background reminders have passed Debug-package foreground-service startup, persistent notification and enable/disable checks, but a real task-completion event and the official-signer APK remain unverified.
 
 Automation covers settings, authentication, encrypted payloads, tap ownership, restart and cleanup, not actual Apple delivery. The missing-target fixture uses a never-created session; a genuinely persisted-then-deleted session remains untested because the current public DSH API does not expose the needed delete operation. Push is best effort and does not replace manual confirmation of important tasks.

package/docs/WEB_PUSH.md

@@ -40,7 +40,7 @@ Safari 与已安装 App 可能使用不同登录状态。本恢复步骤仅针
 
 推送是尽力而为，不是警报服务。主机睡眠／关机、Origin 停用、手机网络、专注模式和系统调度均可能延迟或阻止投递。
 
-关闭页面**不会**停用已保存的推送同意。用**停用**阻止后续合格发送；明确退出与撤销设备各有不同效果，见[下表](<#同意状态退出与撤销>)。点击通知可能需要重新登录，绝不会代为回答或批准；**发送测试**的通知打开应用根入口，而不是某个会话。
+关闭页面**不会**停用已保存的推送同意。用**停用**阻止后续合格发送，但会保留浏览器订阅，避免 iOS 在快速退订／重订后得到无法投递的新订阅；下一次明确启用会复用原订阅。明确退出与撤销设备各有不同效果，见[下表](<#同意状态退出与撤销>)。点击通知可能需要重新登录，绝不会代为回答或批准；**发送测试**的通知打开应用根入口，而不是某个会话。
 
 ## 会提醒什么
 
@@ -64,7 +64,7 @@ Safari 与已安装 App 可能使用不同登录状态。本恢复步骤仅针
 | 操作／事件 | 效果 |
 | --- | --- |
 | 关闭页面或短登录会话过期 | 持久配对授权与 Origin 仍有效时保留推送同意；打开 DSH 仍需认证。 |
-| 点击停用 | 先持久保存主机停发，再尽力取消本功能拥有的浏览器订阅；浏览器取消失败不会恢复主机同意。 |
+| 点击停用 | 持久保存主机停发并撤销注册；浏览器订阅保留为不投递状态，供下一次明确启用复用。需要清除订阅时，使用浏览器站点数据管理。 |
 | 明确退出 Mobile | 清除短会话前，先关闭此配对设备在当前 Origin 的推送，保留配对。停用保存失败不能报告退出已完成。 |
 | 撤销／重置设备，或持久凭据过期 | 清理相关注册和队列，包含没有打开页面的休眠设备。 |
 | 停止 Gateway／服务商或更改 Origin | 停止该 Origin 发送；其他 Origin 保留各自同意，新地址须重新明确启用。 |
@@ -80,6 +80,21 @@ Safari 与已安装 App 可能使用不同登录状态。本恢复步骤仅针
 
 冷启动还是复用页面由浏览器决定；不要假定所有通知导航都会保留未发送草稿或进行中的发送。DSH 全新启动时可能先显示最近活跃会话，此时可从会话列表手动选择目标。插件不注册／注销 Service Worker，也不缓存已认证页面或 API 内容。
 
+## Host 插件自定义文案
+
+受信任的电脑端插件可依赖 `mobilePush` 服务，为已启用的网页推送类别提交会话、标题和正文：
+
+```ts
+await ctx.mobilePush.notify({
+  sessionId,
+  title: '会话名称',
+  body: '回复已准备好',
+  category: 'response',
+})
+```
+
+标题最多 80 个字符，正文最多 200 个字符；控制字符会被替换为空格。接口返回本次新排队的接收端数量；服务端仍按会话存在性、配对授权、设备类别开关、注册数量、时效和并发上限检查。通知点击继续使用网关生成的不透明引用，不把原始会话 ID 写入点击 URL。自定义文案会在私有推送状态中保留到发送完成或最长 30 分钟过期；不要放入密码、Token 或不应离开电脑的敏感内容。
+
 ## 数量、时效与失败处理
 
 - 每个配对设备最多 **4 个注册**；每个授权范围最多 **256 个注册和 256 个待投递项**；最多 **4 个并发发送**。满额时拒绝新通知工作，不删除其他安装，也不阻塞 DSH。
@@ -97,6 +112,7 @@ Safari 与已安装 App 可能使用不同登录状态。本恢复步骤仅针
 | 没有入口／不可用 | 检查页面级能力、受信任 HTTPS、已认证的专用浏览器页面及 DSH 公共服务；没有 Worker 或旧 iOS 降级。 |
 | 提示安装 | 从主屏幕图标启动，不在普通标签页开启。 |
 | 权限拒绝 | 在系统／浏览器设置中修改该网站的通知权限，再返回 App 作新的明确启用；不会强制再次弹窗。 |
+| 显示“已允许”但主屏幕 App 不响 | iOS 的通知权限按站点记录；重新添加的主屏幕 App 可能继承 `granted` 而没有独立授权。设置页会显示该站点级状态。若停用／重启用后仍无投递，移除主屏幕 App 并清除该站点数据，再重新添加和授权；不要对当前 App 猜测或静默重建订阅。 |
 | 保存失败／设置已过期 | 刷新或重开读取当前状态，再明确重试，不反复提交旧请求。 |
 | 现有订阅属于其他应用密钥 | 不自动取消它；主机密钥重置后仅重试启用无法解决，先确认归属，再安排明确的浏览器端修复。 |
 | 已暂停／需要修复 | 检查主机密钥、配置和私有文件访问；不要删除配对状态或静默更换 VAPID 密钥。 |
@@ -107,12 +123,12 @@ Safari 与已安装 App 可能使用不同登录状态。本恢复步骤仅针
 
 ## 独立通道与验收
 
-Android 原生权限／SSE 路径、APK 和签名保持不变。独立维护的 **dsh-ping** 不被修改或自动停用；同时开启可能收到不同通道的重复提醒。网页推送不增加跨通道去重，也不因页面在前台而压制通知。
+Android 原生权限／SSE 路径与 iOS 网页推送相互独立。新版 Android App 可在“任务通知”下显式开启后台提醒：它会以前台服务保持配对连接，页面被系统挂起后仍接收任务完成事件。该选项需要额外常驻通知，受 Android 前台服务时限、电池策略和网络影响；iroh 暂不参与该后台服务。独立维护的 **dsh-ping** 不被修改或自动停用；同时开启可能收到不同通道的重复提醒。网页推送不增加跨通道去重，也不因页面在前台而压制通知。
 
 日常使用建议先发送一条测试通知，再检查自己关注的类别。保留现有主屏幕安装和配对数据；更新电脑端插件后重新打开页面即可加载新版界面。打包运行时检查与维护命令见[贡献指南](<../CONTRIBUTING.md#select-behavior-checks>)。
 
 ## 验证状态
 
-本版采信贡献者在 **iPhone 17 Pro Max / iOS 27.0.1** 上的开发实测，覆盖六类提醒、后台／锁屏／关闭页面、通知点击、停用与撤销，以及离线和主机重启。维护者没有独立 Apple 真机复验；iPad 与其他设备／系统组合没有对应真机记录。
+网页推送的历史验收采信贡献者在 **iPhone 17 Pro Max / iOS 27.0.1** 上的开发实测，覆盖六类提醒、后台／锁屏／关闭页面、通知点击、停用与撤销，以及离线和主机重启。维护者没有独立 Apple 真机复验；iPad 与其他设备／系统组合没有对应真机记录。停用后复用订阅和自定义 Host 文案仍需真实 iOS 复验；Android 后台提醒已在隔离 Debug 包上验证前台服务启动、常驻通知和开关停止，真实任务完成事件与正式签名 APK 仍未验收。
 
 自动化检查覆盖设置、鉴权、加密载荷、点击归属、重启与清理，不代表 Apple 实际送达。缺失目标的自动化检查使用未创建的会话；真正“先持久化再删除”的会话受当前 DSH 公共接口限制，尚无同类检查。推送为尽力投递，不能替代重要任务的人工确认。