dsh-session-guard 4.1.11 → 4.1.16

package/CHANGELOG.ja.md

@@ -11,6 +11,35 @@
 - [Changelog на русском](./CHANGELOG.ru.md)
 - [Changelog en español](./CHANGELOG.es.md)
 
+## 4.1.16 — 2026-10-14（マニフェスト整合／欠落していた 4.1.15 の補記）
+
+### 修正
+
+- `dsh.plugin.json` の版数を `package.json` と一致させた。公開済みの 4.1.15 ターボールは
+  まだ 4.1.14 と書かれていた（レジストリから実際にダウンロードして確認）。
+- 動作変更なし。
+- テストの構造ピンが退役済みの歯車入口をまだ要求しており、4.1.15 以来スイートが赤だった。
+  不在を断言する側へ修正した。
+
+## 4.1.15 — 2026-10-08（補記：リリース当時この項が書かれていませんでした）
+
+### 削除
+
+- シェルレベルの `shell.overlay` シート注入を廃止：右下固定の歯車ボタンと浮層レイヤーを除去
+  （`src/client/shell-overlay.tsx` を削除）。設定への入口はホストの設定ページのみを頼る。
+
+## 4.1.14 — 2026-10-08
+
+### 削除
+
+## 4.1.13 — 2026-10-08
+
+### 修正 — ≤0.1.5 でのブリッジ記述子スケルトン（5セルゲートで発覚）
+
+- **≤0.1.5 ホストの describe `value` はフィールドスケルトン**（実測：`{enabled:{},…}`、実値は `base`＋`user` 層）。旧世代で `descriptor.value` をそのまま消費すると `officialProviders` が `{}` になり `?? []` を素通りして `ListRow` の `values.join` が throw、`dsh-family.tab` スロット全体が殉葬していた。`descriptorPlainValue()` がスケルトンを検出して `{...base, ...user}` を再構築。
+- **カード字段消毒（多層防御）**：スロットは一つの描画エラーで全族タブが死ぬため、`ListRow` 入力を `toList()` で無毒化、`拦截方式` セレクトは非 `error` 値を `hold` にフォールバック。
+- 5セルファームゲートで検証：0.1.0/0.1.5 はブリッジ経由、0.1.7 は configForms 経由でシード値 `321123` の読み返しを確認。
+
 ## 4.0.0 — 2026-09-29
 
 ### Changed

package/CHANGELOG.ko.md

@@ -11,6 +11,35 @@
 - [Changelog на русском](./CHANGELOG.ru.md)
 - [Changelog en español](./CHANGELOG.es.md)
 
+## 4.1.16 — 2026-10-14 (매니페스트 정리, 누락된 4.1.15 항목 보충)
+
+### 수정
+
+- `dsh.plugin.json` 버전을 `package.json` 과 일치시켰습니다. 게시된 4.1.15 tarball 은
+  여전히 4.1.14 였습니다 (레지스트리에서 직접 내려받아 확인).
+- 동작 변경 없음.
+- 구조 핀이 이미 폐지된 톱니 진입점을 요구해서 4.1.15 이후 테스트가 빨랬습니다.
+  부존재를 단언하는 쪽으로 고쳤습니다.
+
+## 4.1.15 — 2026-10-08 (보충: 배포 당시에 이 항목이 기록되지 않았습니다)
+
+### 삭제
+
+- 셸 레벨 `shell.overlay` 슬롯 주입 폐지: 오른쪽 아래 고정 톱니 버튼과 부유 레이어 제거
+  (`src/client/shell-overlay.tsx` 삭제). 설정 진입점은 호스트 설정 페이지에만 의존합니다.
+
+## 4.1.14 — 2026-10-08
+
+### 제거
+
+## 4.1.13 — 2026-10-08
+
+### 수정 — ≤0.1.5 브리지 디스크립터 스켈레톤(5셀 게이트 발견)
+
+- **≤0.1.5 호스트의 describe `value`는 필드 스켈레톤**(실측: `{enabled:{},…}`, 실값은 `base`+`user` 레이어). 구세대에서 `descriptor.value`를 그대로 쓰면 `officialProviders`가 `{}`가 되어 `?? []`를 통과하고 `ListRow`의 `values.join`이 throw, `dsh-family.tab` 슬롯 전체가 순직.`descriptorPlainValue()`가 스켈레톤을 감지해 `{...base, ...user}`로 재구성.
+- **카드 필드 소독(다층 방어)**: 슬롯은 렌더 오류 하나로 전체 탭이 죽으므로 `ListRow` 입력을 `toList()`로 무독화, `拦截方式` 셀렉트는 non-`error` 값을 `hold`로 폴백.
+- 5셀 팜 게이트 검증: 0.1.0/0.1.5는 브리지 경유, 0.1.7은 configForms 경유로 시드값 `321123` 재판독 확인.
+
 ## 4.0.0 — 2026-09-29
 
 ### Changed

package/CHANGELOG.md

@@ -11,6 +11,89 @@ All notable changes to `dsh-session-guard` are recorded here. Versions follow se
 - [Changelog на русском](./CHANGELOG.ru.md)
 - [Changelog en español](./CHANGELOG.es.md)
 
+## 4.1.16 — 2026-10-14 (metadata alignment; backfill the missing 4.1.15 entry)
+
+### Fixed
+
+- `dsh.plugin.json` now carries the same version as `package.json`. The published 4.1.15 tarball
+  still said 4.1.14 (verified by downloading it from the registry), so the two manifests disagreed in a released artifact.
+- No behaviour change in this release.
+- Test suite repaired: the structural pin in `tests/settings-bridge.test.mjs` still demanded the
+  retired gear entry, so the suite had been red since 4.1.15; it now asserts the opposite (absence).
+
+## 4.1.15 — 2026-10-08 (backfilled: this entry was never written at release time)
+
+### Removed
+
+- The shell-level `shell.overlay` slot injection: the fixed bottom-right gear button and its
+  positioned floating layer are gone (`src/client/shell-overlay.tsx` deleted). The settings entry
+  now relies on the host settings page alone.
+
+## 4.1.14 — 2026-10-08
+
+### Removed
+
+## 4.1.13 — 2026-10-08
+
+### Fixed — bridge descriptor skeleton on ≤0.1.5 (five-cell gate catch, 2026-10-08)
+
+- **Host describe `value` is a field skeleton on ≤0.1.5** (0.1.0/0.1.5 empirical):
+  the old host generations serialize `descriptor.value` as `{enabled:{},…,officialProviders:{}}`
+  (one empty object per schema field) while the real merged config lives in
+  `descriptor.base` (combined defaults) + `descriptor.user` (user layer).
+  `BridgeDocHandle` consumed `value` verbatim, so `officialProviders` arrived as
+  `{}` — truthy non-array, invisible to `?? []` — and `ListRow`'s
+  `values.join` threw, crashing the whole `dsh-family.tab` slot (guard card +
+  IT card + TL nav all died together). `descriptorPlainValue()` now detects the
+  skeleton (object whose every own value is an empty plain object — impossible
+  for guard's scalar/array config) and rebuilds the effective value as
+  `{...base, ...user}` (shallow merge is exact for guard's flat config).
+- **Card-field sanitization (defense in depth)**: any card render error kills
+  the entire family tab slot on these hosts, so `ListRow` inputs are now
+  sanitized at the call sites (`toList()` — non-arrays become `[]`) and the
+  `拦截方式` select falls back to `hold` for any non-`error` value. A malformed
+  descriptor may degrade one field, never the tab.
+- Verified on the five-cell farm gate: describe replays on 0.1.0/0.1.5 now
+  yield plain merged values; the seeded `stepGateTimeoutMs: 321123` reads back
+  through the bridge on ≤0.1.5 and natively (configForms) on 0.1.7.
+
+## 4.1.12 — 2026-10-08
+
+### Added — settings webServer bridge (M4/T20-b): dual-track card data plane
+
+- **Top-level card registration refactor (prerequisite)**: the three settings
+  faces (`dsh-family.tab`, `plugins.bundle.config`, `settings.plugin.item`,
+  `shell.overlay`) were registered inside the `onScope` callback of the dual
+  scoped-inject waist — on ≤0.1.5 that callback never fires (settingsScope fiber
+  never resolves; 0.1.0/0.1.1 lack both services), so the cards never registered
+  and a bridge would have had no consumer. All registrations now run at apply
+  top level with a `scopeRef` live reference; the callback degrades to a pure
+  data arm (perm-gate `client/index.ts` L166-257 shape).
+- **Server bridge** (`src/settings-bridge.js`): `describe`/`mutate` endpoints at
+  `/api/session-guard/settings/*` (POST-only, `{ok,value|error}` envelope,
+  redacted describe filtered to the plugin ns, ops forwarded to the host
+  settings service with `expectedRevision` optimistic concurrency, 256 KB cap).
+  Registration is fail-open (error log, never blocks plugin load).
+- **Client bridge handle** (`src/client/settings-bridge.ts`): `BridgeDocHandle`
+  implements the same `SettingsScope` face as the native handles
+  (getSnapshot/subscribe/set/unset); describe misses retry within a bounded
+  budget (settings service resolving later than card mount) before landing on
+  `unavailable`. Card faces read `scopeRef.scope ?? bridgeScope()` — native
+  first, bridge fallback (perm-gate T13b dual-track). **Generation split in the
+  data arm (five-cell empirical, 2026-10-08 night)**: on 0.1.2/0.1.5 the
+  `settingsScope` handle is write-alive but read-dead — `set()` persists to
+  settings.yaml while `getSnapshot().value` stays `undefined`, so that arm
+  deliberately leaves `scopeRef` empty and the card falls to the bridge (bridge
+  mutate lands in the same host service; describe heals the read path).
+
+### Corrected — 4.1.11 publication note
+
+- The 4.1.11 entry said "none of 4.1.5-4.1.10 was published to npm"; **4.1.5
+  was published** (npm registry confirms `4.1.5` in versions, and `latest`
+  pointed at it until this release line). 4.1.6-4.1.10 indeed never shipped.
+  The earlier claim came from reading the npmmirror mirror instead of the
+  authoritative registry (registry-pin discipline, B2+).
+
 ## 4.1.11 — 2026-10-08
 
 ### Fixed — family-section takeover rebuilt (4.1.5 → 4.1.11 arc; none of 4.1.5-4.1.10 was published to npm)

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-external/dsh-session-guard",
-  "version": "4.1.11",
+  "version": "4.1.16",
   "main": "./src/index.js",
   "description": "高峰自动会话门：step 级门控 + 周末模式 + 高峰自动暂停 + 官方源二维判定 + 会话级冻结 + 后端自动重试。",
   "engines": {

package/lib/client.js

@@ -429,6 +429,11 @@ window.__ModuleLoader__.load({
 				})]
 			});
 		}
+		/** 卡面字段消毒：宿主 describe 形态异常（≤0.1.5 骨架残留等）时槽崩会殉葬全族
+		* tab——ListRow 的 values 非 nullish 非数组（如 {}）会让 `?? []` 失守，逐卡硬护栏。 */
+		function toList(v) {
+			return Array.isArray(v) ? v.map(String) : [];
+		}
 		/** 插件配置卡片主体：可展开的 <li> + header 按钮 + pill switch 字段体。 */
 		function SessionGuardCard({ scope }) {
 			const snapshot = (0, react.useSyncExternalStore)((listener) => scope.subscribe(listener), () => scope.getSnapshot());
@@ -517,7 +522,7 @@ window.__ModuleLoader__.load({
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ListRow, {
 							label: "追加官方 provider id",
 							description: "精确匹配，优先级最高（逗号分隔）",
-							values: value.officialProviders ?? [],
+							values: toList(value.officialProviders),
 							placeholder: "deepseek-official",
 							disabled: readonly,
 							onCommit: (next) => {
@@ -527,7 +532,7 @@ window.__ModuleLoader__.load({
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(ListRow, {
 							label: "官方端点名单",
 							description: "baseURL 归一化后的 host（逗号分隔）",
-							values: value.officialBaseURLs ?? [],
+							values: toList(value.officialBaseURLs),
 							placeholder: "api.deepseek.com",
 							disabled: readonly,
 							onCommit: (next) => {
@@ -537,7 +542,7 @@ window.__ModuleLoader__.load({
 						/* @__PURE__ */ (0, react_jsx_runtime.jsx)(SelectRow, {
 							label: "拦截方式",
 							description: "挂起等待不报错；或报错并记入延后队列",
-							value: value.deferredMode ?? "hold",
+							value: value.deferredMode === "error" ? "error" : "hold",
 							options: [{
 								value: "hold",
 								label: "挂起等待（退峰自动放行）"
@@ -615,81 +620,220 @@ window.__ModuleLoader__.load({
 			});
 		}
 		//#endregion
-		//#region src/client/shell-overlay.tsx
+		//#region \0@oxc-project+runtime@0.146.0/helpers/esm/typeof.js
+		function _typeof(o) {
+			"@babel/helpers - typeof";
+			return _typeof = "function" == typeof Symbol && "symbol" == typeof Symbol.iterator ? function(o) {
+				return typeof o;
+			} : function(o) {
+				return o && "function" == typeof Symbol && o.constructor === Symbol && o !== Symbol.prototype ? "symbol" : typeof o;
+			}, _typeof(o);
+		}
+		//#endregion
+		//#region \0@oxc-project+runtime@0.146.0/helpers/esm/toPrimitive.js
+		function toPrimitive(t, r) {
+			if ("object" != _typeof(t) || !t) return t;
+			var e = t[Symbol.toPrimitive];
+			if (void 0 !== e) {
+				var i = e.call(t, r || "default");
+				if ("object" != _typeof(i)) return i;
+				throw new TypeError("@@toPrimitive must return a primitive value.");
+			}
+			return ("string" === r ? String : Number)(t);
+		}
+		//#endregion
+		//#region \0@oxc-project+runtime@0.146.0/helpers/esm/toPropertyKey.js
+		function toPropertyKey(t) {
+			var i = toPrimitive(t, "string");
+			return "symbol" == _typeof(i) ? i : i + "";
+		}
+		//#endregion
+		//#region \0@oxc-project+runtime@0.146.0/helpers/esm/defineProperty.js
+		function _defineProperty(e, r, t) {
+			return (r = toPropertyKey(r)) in e ? Object.defineProperty(e, r, {
+				value: t,
+				enumerable: !0,
+				configurable: !0,
+				writable: !0
+			}) : e[r] = t, e;
+		}
+		//#endregion
+		//#region src/client/settings-bridge.ts
 		/**
-		* dsh-session-guard — 无设置页宿主（0.1.0/0.1.1）的兜底配置入口。
+		* BridgeDocHandle — 设置卡双轨数据源的桥轨（M4/T20-b）。
 		*
-		* 壳级 `shell.overlay` 席位渲染：右下角固定齿轮钮，点开固定定位浮层承载
-		* SessionGuardCard（page 形态，默认展开）。配置存储全在 host 侧（settings
-		* 服务），浮层与宿主设置页解耦——壳再老也不影响读写。有设置页的宿主上
-		* 该齿轮与行配置卡/家族 tab 并存，作为全局快捷入口。
+		* ≤0.1.5（settingsScope fiber 永不解 / 0.1.0-0.1.1 无 client 服务）时，
+		* 配置卡经本句柄走自家 webServer 桥（describe/mutate）读写宿主 settings 服务。
+		* 与原生 SettingsScope（scope-face.ts）同构：getSnapshot/subscribe/set/unset。
+		* 读 = POST /api/<ns>/settings/describe；写 = POST …/mutate（ops 转发宿主服务），
+		* 成功即用回填描述符刷新快照并通知订阅者（无本地第二份状态——权威值始终在宿主）。
+		*
+		* 与 perm-gate src/client/bridge-scope.ts（T13b/T20-b 泛化模板）的差异：
+		* ① 快照形状对齐本仓 SettingsScope（status: loading/ready/unavailable + mode）；
+		* ② describe 未就绪（settings-unavailable/ns-not-registered）时有限重试
+		*    （宿主 settings 服务解析晚于卡挂载的窗口），重试耗尽才落 'unavailable'。
 		*/
-		function ShellSettingsEntry(props) {
-			const [open, setOpen] = (0, react.useState)(false);
-			return /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-				style: {
-					position: "fixed",
-					right: 16,
-					bottom: 64,
-					zIndex: 1e4
-				},
-				children: [
-					open && /* @__PURE__ */ (0, react_jsx_runtime.jsx)("div", {
-						onClick: () => setOpen(false),
-						style: {
-							position: "fixed",
-							top: 0,
-							left: 0,
-							right: 0,
-							bottom: 0,
-							background: "rgba(0,0,0,.45)",
-							zIndex: 1e4
-						}
-					}),
-					open && /* @__PURE__ */ (0, react_jsx_runtime.jsxs)("div", {
-						style: {
-							position: "fixed",
-							top: "6vh",
-							left: "50%",
-							transform: "translateX(-50%)",
-							width: "min(760px, 92vw)",
-							maxHeight: "84vh",
-							overflowY: "auto",
-							zIndex: 10001
-						},
-						children: [/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-							type: "button",
-							onClick: () => setOpen(false),
-							style: {
-								position: "sticky",
-								top: 6,
-								float: "right",
-								marginRight: 8,
-								zIndex: 2
-							},
-							children: "✕ 关闭"
-						}), /* @__PURE__ */ (0, react_jsx_runtime.jsx)(SessionGuardCard, { scope: props.scope })]
-					}),
-					/* @__PURE__ */ (0, react_jsx_runtime.jsx)("button", {
-						type: "button",
-						title: "会话守护设置",
-						onClick: () => setOpen((state) => !state),
-						style: {
-							width: 40,
-							height: 40,
-							borderRadius: "50%",
-							border: "1px solid rgba(127,127,127,.4)",
-							background: "rgba(30,30,32,.85)",
-							color: "inherit",
-							cursor: "pointer",
-							fontSize: 16,
-							boxShadow: "0 4px 16px rgba(0,0,0,.35)"
-						},
-						children: "🛡"
-					})
-				]
-			});
+		/** 与 server 侧 settingsBridgeRoutesFor（src/settings-bridge.js）必须逐字符一致。 */
+		function settingsBridgeRoutesFor(ns) {
+			return {
+				describe: `/api/${ns}/settings/describe`,
+				mutate: `/api/${ns}/settings/mutate`
+			};
+		}
+		/**
+		* ≤0.1.5 宿主 describe 的 descriptor.value 是「每字段 → {}」骨架（0.1.0/0.1.5
+		* 实测：value={enabled:{},…,officialProviders:{}}，真值拆在 base（合并默认层）
+		* 与 user（用户层））——直接吞 value 会让卡拿到 officialProviders={}，
+		* `?? []` 不兜底（{} 非 nullish）→ ListRow values.join 崩，整族 tab 槽殉葬。
+		* 判特征：对象且每个自有值都是空 plain 对象（guard 字段是标量/数组，不会全空）。
+		* 命中即以 {...base, ...user} 重组有效值（guard 配置全是顶层标量/数组，浅合并即语义）。
+		*/
+		function isFieldSkeleton(v) {
+			if (v === null || typeof v !== "object" || Array.isArray(v)) return false;
+			const values = Object.values(v);
+			return values.length > 0 && values.every((x) => x !== null && typeof x === "object" && !Array.isArray(x) && Object.keys(x).length === 0);
+		}
+		function plainObject(v) {
+			return v !== null && typeof v === "object" && !Array.isArray(v) ? { ...v } : {};
+		}
+		/** descriptor → 卡面可用 plain 值：正常代际用 value；骨架代际用 base+user 浅合并。 */
+		function descriptorPlainValue(d) {
+			if (!isFieldSkeleton(d.value)) return d.value;
+			return {
+				...plainObject(d.base),
+				...plainObject(d.user)
+			};
 		}
+		/** describe 不可就绪码：宿主 settings 未解析/未注册——值得重试的瞬态。 */
+		const RETRYABLE_CODES = /* @__PURE__ */ new Set(["settings-unavailable", "ns-not-registered"]);
+		const RETRY_DELAY_MS = 1500;
+		const RETRY_MAX = 4;
+		var BridgeDocHandle = class {
+			constructor(ns) {
+				_defineProperty(this, "snapshot", void 0);
+				_defineProperty(this, "listeners", /* @__PURE__ */ new Set());
+				_defineProperty(this, "revision", void 0);
+				_defineProperty(this, "retriesLeft", RETRY_MAX);
+				_defineProperty(this, "inflight", void 0);
+				_defineProperty(this, "ns", void 0);
+				_defineProperty(this, "routes", void 0);
+				this.ns = ns;
+				this.routes = settingsBridgeRoutesFor(ns);
+				this.snapshot = {
+					status: "loading",
+					value: void 0,
+					revision: void 0,
+					writable: true,
+					base: void 0,
+					user: void 0,
+					mode: "bridge"
+				};
+				this.refresh();
+			}
+			getSnapshot() {
+				return this.snapshot;
+			}
+			subscribe(listener) {
+				this.listeners.add(listener);
+				return () => {
+					this.listeners.delete(listener);
+				};
+			}
+			async set(field, value) {
+				return this.mutate([{
+					op: "set",
+					path: [field],
+					value
+				}]);
+			}
+			async unset(field) {
+				return this.mutate([{
+					op: "unset",
+					path: [field]
+				}]);
+			}
+			notify() {
+				for (const l of [...this.listeners]) l();
+			}
+			applyDescriptor(d, writable) {
+				this.revision = typeof d.revision === "number" ? d.revision : void 0;
+				this.snapshot = {
+					status: "ready",
+					value: descriptorPlainValue(d),
+					revision: this.revision,
+					writable,
+					base: void 0,
+					user: void 0,
+					mode: "bridge"
+				};
+			}
+			async request(path, body) {
+				const response = await fetch(path, {
+					method: "POST",
+					headers: { "content-type": "application/json" },
+					body: JSON.stringify(body ?? {})
+				});
+				if (!response.ok) throw new Error(`bridge ${path} HTTP ${response.status}`);
+				return await response.json();
+			}
+			/** describe 拉取；瞬态未就绪码在重试预算内延迟重拉，耗尽才落 unavailable。 */
+			refresh() {
+				if (this.inflight !== void 0) return this.inflight;
+				this.inflight = (async () => {
+					try {
+						const body = await this.request(this.routes.describe);
+						if (body.ok && body.value?.descriptor !== void 0) {
+							this.retriesLeft = RETRY_MAX;
+							this.applyDescriptor(body.value.descriptor, body.value.writable !== false);
+						} else if (body.code !== void 0 && RETRYABLE_CODES.has(body.code) && this.retriesLeft > 0) {
+							this.retriesLeft -= 1;
+							this.inflight = void 0;
+							setTimeout(() => {
+								this.refresh();
+							}, RETRY_DELAY_MS);
+							return;
+						} else this.snapshot = {
+							...this.snapshot,
+							status: "unavailable",
+							writable: false
+						};
+					} catch {
+						if (this.retriesLeft > 0) {
+							this.retriesLeft -= 1;
+							this.inflight = void 0;
+							setTimeout(() => {
+								this.refresh();
+							}, RETRY_DELAY_MS);
+							return;
+						}
+						this.snapshot = {
+							...this.snapshot,
+							status: "unavailable",
+							writable: false
+						};
+					}
+					this.inflight = void 0;
+					this.notify();
+				})();
+				return this.inflight;
+			}
+			async mutate(ops) {
+				const body = await this.request(this.routes.mutate, {
+					ops,
+					expectedRevision: this.revision
+				});
+				if (body.ok && body.value?.descriptor !== void 0) {
+					this.applyDescriptor(body.value.descriptor, this.snapshot.writable);
+					this.notify();
+					return true;
+				}
+				if (body.code === "settings-conflict") {
+					await this.refresh();
+					return false;
+				}
+				throw new Error(`bridge mutate failed: ${body.code ?? "unknown"} ${body.message ?? ""}`);
+			}
+		};
 		//#endregion
 		//#region src/client/family-section.tsx
 		/**
@@ -764,8 +908,9 @@ window.__ModuleLoader__.load({
 		}
 		/**
 		* 双代持久设置腰（移植 input-traffic registerSettingsFaces）：两个 scoped
-		* 子注入各自产出同形 scope 后回调；0.2.0 两代并存时以 configForms 先到为准
-		* （mounted 位防双挂载，ui-slots 同 id 仲裁兜底）。
+		* 子注入各自产出同形 scope 后回调。M4 P0 重构后本函数**只承担数据臂**——
+		* 回调仅写 scopeRef 活引用（0.1.7+ 原生优先，mounted 位防双挂），卡面注册
+		* 已全部提到 apply 顶层（≤0.1.5 回调永不触发，注册不能关在这里）。
 		*/
 		function registerSettingsFaces(ctx, onScope) {
 			let mounted = false;
@@ -780,20 +925,32 @@ window.__ModuleLoader__.load({
 				onScope(sctx.settingsScope.bind({ namespace: "session-guard" }), "settingsScope");
 			});
 		}
-		/** 两张配置卡（family tab + bundle 详情页）挂载；scope 由双代腰产出。 */
-		function mountConfigCards(ctx, scope) {
+		/** scope 活引用（perm-gate client/index.ts L166-257 形态）：回调填、卡面现读。 */
+		const scopeRef = { scope: void 0 };
+		/** 桥轨惰性单例：≤0.1.5（settingsScope 死路 / 0.1.0-0.1.1 无服务）的数据源。 */
+		let bridgeScopeSingleton;
+		function bridgeScope() {
+			if (bridgeScopeSingleton === void 0) bridgeScopeSingleton = new BridgeDocHandle("session-guard");
+			return bridgeScopeSingleton;
+		}
+		/** 卡面现取数据源：原生句柄解到即原生，否则桥兜底（perm-gate 同式）。 */
+		function currentScope() {
+			return scopeRef.scope ?? bridgeScope();
+		}
+		/** 两张配置卡（family tab + bundle 详情页）挂载；数据经 currentScope() 现取。 */
+		function mountConfigCards(ctx) {
 			ctx.slots.inject("dsh-family.tab", () => ctx.slots.register({
 				name: "dsh-family.tab",
 				id: "session-guard",
 				order: 20,
 				label: "会话守护门禁",
 				locale: "session-guard",
-				inject: () => ({ scope })
+				inject: () => ({ scope: currentScope() })
 			}, SessionGuardCard));
 			ctx.slots.inject("plugins.bundle.config", () => ctx.slots.register({
 				name: "plugins.bundle.config",
 				key: "dsh-session-guard",
-				inject: () => ({ scope })
+				inject: () => ({ scope: currentScope() })
 			}, SessionGuardCard));
 		}
 		function apply(ctx) {
@@ -809,22 +966,9 @@ window.__ModuleLoader__.load({
 				order: 40,
 				locale: "session-guard"
 			}, StatusBadge)));
+			safe("config-cards/family-tab", () => mountConfigCards(ctx));
 			registerSettingsFaces(ctx, (scope, generation) => {
-				safe(`config-cards/${generation}`, () => {
-					mountConfigCards(ctx, scope);
-					ctx.slots.inject("settings.plugin.item", () => ctx.slots.register({
-						name: "settings.plugin.item",
-						id: "session-guard",
-						key: "session-guard",
-						order: 60,
-						locale: "session-guard",
-						inject: () => ({ scope })
-					}, SessionGuardCard));
-				});
-				safe("shell.overlay", () => ctx.slots.inject("shell.overlay", () => ctx.slots.register({
-					name: "shell.overlay",
-					id: "session-guard-settings"
-				}, () => ShellSettingsEntry({ scope }))));
+				if (generation === "configForms") scopeRef.scope = scope;
 			});
 			safe("family-section-election", () => {
 				console.log("[dsh-session-guard] election: registering settings.section inject (apply-time)");