dsh-wisp 1.42.0 → 1.48.0

package/verify-wisp.mjs

@@ -29,7 +29,7 @@
    EXIT CODE 0 = both halves match their contract.
    ========================================================================== */
 
-import { readFileSync, statSync, existsSync } from 'node:fs'
+import { readFileSync, statSync, existsSync, readdirSync } from 'node:fs'
 import { fileURLToPath, pathToFileURL } from 'node:url'
 import { dirname, join, resolve } from 'node:path'
 import { verifyAudit } from './tools/audit-log.mjs'
@@ -38,6 +38,16 @@ const here = dirname(fileURLToPath(import.meta.url))
 const pkgPath = join(here, 'package.json')
 const pkg = JSON.parse(readFileSync(pkgPath, 'utf8'))
 
+/* 泳装那八条帧动画素材（v1.47.0）。判据是**磁盘上实际有什么**，不是"应该有什么"：
+   一条都没有（还没生成）与八条都在（生成完了）都是合法状态，**只到一半**不是 ——
+   半套素材在页面上表现为"她有些状态不动"，而那和"没有素材"长得一模一样。
+   投递机制（motion 清单 + 宿主路由 + 客户端 URL 解析）在没有素材时照样成立：
+   它是一条"有文件就发、没有就静默降级"的路。 */
+const MOTION_DIR = join(here, 'assets', 'motion')
+const SHIPPED_SWIM = existsSync(MOTION_DIR)
+  ? readdirSync(MOTION_DIR).filter((f) => /^swim_[a-z]+\.webp$/.test(f)).sort()
+  : []
+
 const hostPath = resolve(here, pkg.main ?? 'lib/index.js')
 const clientRel = pkg.exports?.['./client']?.default
 const clientPath = clientRel ? resolve(here, clientRel) : null
@@ -109,9 +119,12 @@ class FakeBlob {
     if (active) active.blobs.push(this)
   }
 }
-const FakeURL = {
-  createObjectURL() { const url = `blob:dsh-app/verify-${++urlSeq}`; if (active) active.urLs.push(url); return url },
-  revokeObjectURL(url) { if (active) active.revoked.push(url) },
+/* 替身 URL 必须**同时**是那个构造函数：v1.47.0 起客户端的动图源是
+   `new URL('wisp-motion/<文件>', document.baseURI)` —— 只给 createObjectURL 的
+   假 URL 会让这一行当场抛错，而那是"替身不像真页面"，不是插件的问题。 */
+class FakeURL extends URL {
+  static createObjectURL() { const url = `blob:dsh-app/verify-${++urlSeq}`; if (active) active.urLs.push(url); return url }
+  static revokeObjectURL(url) { if (active) active.revoked.push(url) }
 }
 /* The constructor writes the backing field directly: routing its own
    initialisation through the instrumented setter would record a phantom empty
@@ -170,8 +183,23 @@ function createHarness(options = {}) {
       className: '', textContent: '', id: '', value: '',
       listeners: Object.create(null),
       _src: '',
-      focus() { activeEl = el },
-      blur() { if (activeEl === el) activeEl = null },
+      /* focus() / blur() 必须**真的派发事件**：真实 DOM 里 focus 事件是会响的，
+         而插件正靠它把"这一次焦点是谁给的"翻译成画面（键盘 -> 贴剪影的辉光；
+         鼠标 -> 什么都不画）。替身不发事件时，这条产品行为在预检里永远测不出来 ——
+         而它出错的样子正是用户报的"有时会出现素材的矩形边界线"。
+         顺序照真实语义：activeElement 先更新，所以 focus 事件里读到的已经是新元素。 */
+      focus() {
+        if (activeEl === el) return
+        const previous = activeEl
+        activeEl = el
+        if (previous) previous.dispatch('blur', { type: 'blur', target: previous })
+        el.dispatch('focus', { type: 'focus', target: el })
+      },
+      blur() {
+        if (activeEl !== el) return
+        activeEl = null
+        el.dispatch('blur', { type: 'blur', target: el })
+      },
       get firstChild() { return this.children[0] ?? null },
       get src() { return this._src },
       set src(v) { this._src = v; if (this.tagName === 'IMG') harness.srcs.push(v) },
@@ -247,6 +275,25 @@ function createHarness(options = {}) {
         },
       })
     }
+    if (String(tag).toLowerCase() === 'video') {
+      /* <video> 的替身（v1.45.0）。v1.46.1 起产品里**一个 <video> 都不该建**
+         （帧动画换成了动图 <img>），所以这个替身现在是个哨兵：谁把媒体通道加回来，
+         它就会开始记录 play()/pause()，而 3f-ter 里那条"一次都没有"立刻会红。
+         真实浏览器里 play()/pause() 是**方法**、currentTime 是**可写属性**，
+         替身缺了它们，那条断言就只能靠读源码文本 —— 读文本证明不了行为。 */
+      el.currentTime = 0
+      el.paused = true
+      el.play = () => {
+        el.paused = false
+        if (active) active.videoPlays.push(el)
+        return Promise.resolve()
+      }
+      el.pause = () => {
+        el.paused = true
+        if (active) active.videoPauses.push(el)
+      }
+      el.load = () => {}
+    }
     created.push(el)
     return el
   }
@@ -314,6 +361,10 @@ function createHarness(options = {}) {
   const documentShim = {
     body: bodyEl,
     head: headEl,
+    /* 动图源的基准（v1.47.0）：客户端只写 `wisp-motion/<文件>`，其它一律由页面
+       自己的 base 带出来。替身给一个真实的 Web 载体地址，而不是
+       `dsh-app://app/` —— 后者没有 HTTP 服务器，正是"路由不在"的那一档。 */
+    baseURI: options.baseURI ?? 'http://127.0.0.1:19387/',
     get activeElement() { return activeEl },
     /* 真 document 有事件接口，替身也得有 —— 否则"插件是否正确处理文档级 Esc"根本测不到，
        而且少一个方法会让插件在替身里整个起不来（这坑踩过一次）。 */
@@ -438,11 +489,15 @@ function createHarness(options = {}) {
 
   const styleInserts = []
 
+  /* 由**别的包**注册的客户端服务（v1.46.0）：余额那条路要的 remote.account 就是这种。
+     默认空表 —— 一条通道都没有的情形才测得到。 */
+  const extraServices = options.services && typeof options.services === 'object' ? options.services : {}
   const ctx = {
     get: (name) => {
       if (name === 'timer') return timerService
       if (name === 'styles') return { insert: (css) => { styleInserts.push(css); return () => { styleInserts.pop() } } }
       if (name === 'theme') return { getTheme: () => themeSnapshot }
+      if (Object.prototype.hasOwnProperty.call(extraServices, name)) return extraServices[name]
       return undefined
     },
     on: (name, fn) => {
@@ -456,6 +511,9 @@ function createHarness(options = {}) {
   const harness = {
     state, ctx, win, document: documentShim, bodyEl, created, frames, timers, queries,
     srcs: [], urLs: [], revoked: [], blobs: [], styleInserts,
+    /* <video> 的播放记录（v1.45.0）。v1.46.1 起它的用途反过来：断言"这一层一次
+       play()/pause() 都没有" —— 图片路径上不存在媒体通道，也不该有人偷偷搭回来。 */
+    videoPlays: [], videoPauses: [],
     loaded: null,
     timerService,
     get teardown() { return runEffects },
@@ -504,9 +562,13 @@ function createHarness(options = {}) {
       // 默认不给 —— 这样"没有 host 时降级"才测得到；要测检查更新就传 hostCall。
       const hostSeat = typeof options.hostCall === 'function' ? { call: options.hostCall } : undefined
       // eslint-disable-next-line no-new-func
-      /* 追加 sourceURL：new Function 里的代码否则在堆栈里是 anonymous，定位不到行。 */
-      new Function('window', 'document', 'host', ...TRAPPED, src + '\n//# sourceURL=wisp-client-half.js')(
-        win, documentShim, hostSeat, ...TRAPPED.map((name) => traps[name]),
+      /* 追加 sourceURL：new Function 里的代码否则在堆栈里是 anonymous，定位不到行。
+         navigator 必须显式注入：浏览器里裸 navigator === window.navigator，而 **Node 21+
+         也有全局 navigator**（navigator.language = 系统语言）。不注入的话，客户端读到的是
+         Node 的 —— 中文机器上绿、英文 runner 上红（真踩过：Node 22 上 24 项台词池检查全红，
+         Node 20 上因为那个全局还不存在而"恰好"绿）。 */
+      new Function('window', 'document', 'host', 'navigator', ...TRAPPED, src + '\n//# sourceURL=wisp-client-half.js')(
+        win, documentShim, hostSeat, win.navigator ?? {}, ...TRAPPED.map((name) => traps[name]),
       )
     },
     module() {
@@ -541,6 +603,52 @@ if (!existsSync(hostPath)) {
   }
 }
 
+/* ================================ 1c. the host half serves the frame clips == */
+
+head('1c. the host half claims /wisp-motion/ on the platform HTTP carrier (v1.47.0)')
+
+/* 这一节查的是**接线**，不是 handler 本身（handler 在 4b 里被真字节驱动过一遍）。
+   为什么单独查：`ctx.inject(['webServer'], cb)` 是唯一一处"把插件的路由挂到平台载体上"
+   的调用 —— 名字、kind、path 写错了都不会有任何报错，页面上只表现为"她怎么不动了"
+   （静默降级）。用假 ctx 把这条链走一遍，就不必等到重启应用才发现。 */
+{
+  const mod = await import(pathToFileURL(hostPath).href + '?probe=motion-wiring')
+  const registered = []
+  const effects = []
+  let injected = null
+  const webCtx = {
+    webServer: { register: (route) => { registered.push(route); return () => {} } },
+    effect: (fn, label) => { effects.push({ label, dispose: fn() }) },
+  }
+  const ctx = {
+    inject: (deps, cb) => { injected = deps; cb(webCtx) },
+    effect: () => () => {},
+  }
+  let threw = null
+  try { mod.apply(ctx, {}) } catch (error) { threw = error }
+  check(threw === null && Array.isArray(injected) && injected.includes('webServer') && registered.length === 1,
+    'apply() claims its route through ctx.inject([\'webServer\']) — exactly one registration',
+    `inject=${JSON.stringify(injected)} routes=${registered.length}${threw ? ` threw=${threw.message}` : ''}`)
+  check(registered[0]?.kind === 'prefix' && registered[0]?.path === mod.MOTION_PATH
+    && typeof registered[0]?.handler === 'function',
+    'and it is a prefix route at the path the client half asks for, with a real handler',
+    `${String(registered[0]?.kind)} ${String(registered[0]?.path)} handler=${typeof registered[0]?.handler}`)
+  check(effects.length === 1 && /wisp/i.test(String(effects[0]?.label ?? '')),
+    'registered as an OWNED effect, so disabling the package takes the route down with it',
+    String(effects[0]?.label ?? '(no effect)'))
+  /* 载体没有 webServer（Electron 没有 HTTP 服务器）不是加载失败 —— 这条路是**可选**的，
+     少一条路由的画面就是静态立绘。两条都要真的试：一个空的 inject 回调、一个连
+     ctx.inject 都没有的 ctx（更老的宿主）。 */
+  let silent = null
+  let noInject = null
+  try { silent = mod.registerMotionRoute({ inject: (deps, cb) => cb({}) }) } catch (error) { silent = { threw: String(error.message) } }
+  try { noInject = mod.registerMotionRoute({}) } catch (error) { noInject = { threw: String(error.message) } }
+  check(silent?.registered === true && !('threw' in (silent ?? {}))
+    && noInject?.registered === false && typeof noInject?.why === 'string',
+    'and a carrier with no webServer (or no ctx.inject at all) degrades to "no route", never to a load failure',
+    `empty-carrier=${JSON.stringify(silent)} no-inject=${JSON.stringify(noInject)}`)
+}
+
 /* ================================================= 1b. the update handler == */
 
 head('1b. the host half answers checkUpdate through the platform web service')
@@ -551,7 +659,7 @@ head('1b. the host half answers checkUpdate through the platform web service')
 {
   const mod = await import(pathToFileURL(hostPath).href + '?probe=update')
   const { readPublishedVersion, compareVersions, registerHandlers, inject } = mod
-  const { readBalance, accountClientMetadata, normalizeWallets, resolveWebService } = mod
+  const { readBalance, accountClientMetadata, normalizeWallets, resolveWebService, readManagedVersion } = mod
 
   /* web 服务必须声明为**可选**：硬依赖一个没加载的服务会让 fiber 永远 waiting，
      她会直接从界面上消失。这条是安全属性，不是风格偏好。 */
@@ -584,6 +692,22 @@ head('1b. the host half answers checkUpdate through the platform web service')
   const U = { npm: 'https://npm/x', github: 'https://gh/y' }
   const only = (key, outcome) => webWith({ [U[key]]: outcome })
 
+  /* 源可以换：国内镜像 / 私有 registry 只需要把 config.urls 指过去。
+     这一条钉住"换源真的会去问新地址"—— 否则"支持镜像"只是文档里的一句话。 */
+  const asked = []
+  const recorder = {
+    fetch: async (request) => {
+      asked.push(request.url)
+      return { url: request.url, statusCode: 200, body: { kind: 'text', content: '{"version":"1.2.3"}' }, truncated: false }
+    },
+  }
+  const mirrorUrls = { npm: 'https://registry.npmmirror.com/dsh-wisp/latest' }
+  const mirror = await readPublishedVersion(recorder, mirrorUrls, undefined, 50)
+  check(mirror.ok === true && mirror.latest === '1.2.3' && mirror.from === 'npm'
+    && asked.length === 1 && asked[0] === mirrorUrls.npm,
+  'the npm source can be pointed at a mirror through config (only the configured URL is asked)',
+  JSON.stringify({ asked, verdict: mirror }))
+
   const good = await readPublishedVersion(only('npm', { body: '{"name":"dsh-wisp","version":"9.9.9"}' }), U)
   check(good.ok === true && good.latest === '9.9.9' && good.from === 'npm',
     'a 200 with a version field is read correctly', JSON.stringify(good))
@@ -647,18 +771,71 @@ head('1b. the host half answers checkUpdate through the platform web service')
   /* ---- 服务在**调用时**解析，而不是吃启动那一刻的快照 ----
      宿主半包由 bundle patch 插进来，可能比 web 服务先就位；而 optional 依赖在启动时缺席
      并不会事后补上 —— `ctx.web` 会永远是 undefined，检查更新从此永久失效。
-     `ctx.get('web')` 是调用时查表，所以这条竞态修得掉。 */
-  const lateService = { fetch: async () => ({ statusCode: 200, body: { kind: 'text', content: '{"version":"9.9.9"}' } }) }
+     `ctx.get('web')` 是调用时查表，所以这条竞态修得掉。 */  const lateService = { fetch: async () => ({ statusCode: 200, body: { kind: 'text', content: '{"version":"9.9.9"}' } }) }
   const declaredService = { fetch: async () => ({ statusCode: 200, body: { kind: 'text', content: '{"version":"1.0.0"}' } }) }
-  check(resolveWebService({ get: () => lateService, web: declaredService }) === lateService,
+  check(resolveWebService({ get: () => lateService, web: declaredService }).service === lateService,
     'the web service is resolved at CALL time, not from the startup-time property')
-  check(resolveWebService({ get: () => undefined, web: declaredService }) === declaredService,
+  check(resolveWebService({ get: () => undefined, web: declaredService }).service === declaredService,
     'with ctx.get answering nothing, the declared property is still the fallback')
-  check(resolveWebService({ get: () => { throw new Error('restricted ctx') }, web: declaredService }) === declaredService,
+  check(resolveWebService({ get: () => { throw new Error('restricted ctx') }, web: declaredService }).service === declaredService,
     'a throwing ctx.get falls back instead of breaking the check')
-  check(resolveWebService({ web: { notAFetchService: true } }) === undefined
-    && resolveWebService(undefined) === undefined,
-  'a shell with no usable web service reports undefined rather than crashing')
+  /* "有个对象但不是 web 服务"也算 partial：把形状说出来，让 readVersion 去报
+     "有服务但没有 fetch" —— 那比一句"没有通道"更能指认问题在哪一层。 */
+  check(resolveWebService({ web: { notAFetchService: true } }).how === 'partial'
+    && resolveWebService({ web: { notAFetchService: true } }).service !== undefined
+    && resolveWebService(undefined).service === undefined,
+  'a non-service object is passed through as partial so the failure can name its shape')
+
+  /* ---- 拿不到服务时，必须能说清"看见了什么" ------------------------------------
+     真机上出现过"两条路都拿不到、界面只说没有联网通道"，而那句话没法追问。
+     诊断至少要回答：ctx.get 是不是函数、拿到的东西有没有 fetch。 */
+  const blind = resolveWebService({ get: () => ({ search: () => {} }) })
+  check(blind.service !== undefined && blind.how === 'partial' && blind.why.includes('-fetch'),
+    'a service without a callable fetch is reported as partial, with its shape spelled out',
+    JSON.stringify({ how: blind.how, why: blind.why }))
+  const nothing = resolveWebService({})
+  check(nothing.service === undefined && nothing.how === 'none'
+    && nothing.why.includes('ctx.get("web")→undefined') && nothing.why.includes('ctx.web→undefined'),
+  'and a genuinely missing service says which lookups came back undefined', nothing.why)
+  const noGet = resolveWebService(undefined)
+  check(noGet.service === undefined && noGet.how === 'none', 'no ctx at all is reported, not thrown', noGet.why)
+
+  /* ---- 兜底通道：web 拿不到时问插件管理器"这个包是什么版本" ---------------------
+     它走的是应用自己的网络出口（安装前 inspect 本来就要去 registry 问），
+     所以这条路不依赖插件能否拿到 web 服务。 */
+  const managedCtx = {
+    get: (name) => (name === 'pluginManager'
+      ? { inspect: async (spec) => ({ status: 'accepted', name: spec, version: '7.7.7', registry: 'https://mirror.example' }) }
+      : undefined),
+  }
+  const managed = await readManagedVersion(managedCtx, 'dsh-wisp', 500)
+  check(managed.ok === true && managed.version === '7.7.7' && managed.registry === 'https://mirror.example',
+    'the plugin manager can be asked for the published version as a fallback channel',
+    JSON.stringify(managed))
+  const noManager = await readManagedVersion({ get: () => undefined }, 'dsh-wisp', 500)
+  check(noManager.ok === false && noManager.reason === 'no-plugin-manager',
+    'and its absence is a named reason, not an exception', JSON.stringify(noManager))
+  const refused = await readManagedVersion({ get: () => ({ inspect: async () => ({ status: 'refused', reason: 'no such package' }) }) }, 'dsh-wisp', 500)
+  check(refused.ok === false && refused.reason === 'inspect-refused' && refused.detail === 'no such package',
+    'a refusal keeps the manager\'s own words', JSON.stringify(refused))
+
+  /* 端到端：没有 web 服务、但有插件管理器 → 检查更新照样能给出答案，并说明走的哪条通道 */
+  {
+    const handlers = new Map()
+    const originalHarness = globalThis.harness
+    globalThis.harness = { handle: (name, fn) => { handlers.set(name, fn); return () => handlers.delete(name) } }
+    try {
+      registerHandlers(managedCtx, { urls: U })
+      const viaManager = await handlers.get('checkUpdate')({ current: '1.0.0' })
+      check(viaManager.ok === true && viaManager.latest === '7.7.7' && viaManager.from === 'npm'
+        && viaManager.diag && viaManager.diag.via === 'pluginManager',
+      'with no web service but a plugin manager, the check still answers — through the fallback',
+      JSON.stringify(viaManager))
+    } finally {
+      if (originalHarness === undefined) delete globalThis.harness
+      else globalThis.harness = originalHarness
+    }
+  }
 
   /* ---- 每个源一个自己的截止时间 ----
      共用一个信号时，一个卡住的源到点会把另一个**已经拿到结果**的源一起作废，
@@ -910,15 +1087,28 @@ if (clientSrc !== null) {
     /* ------------------------------------------------- 3b. sprite pipeline -- */
     head('3b. sprite pipeline (the broken-image regression)')
 
+    /* v1.47.0：`h.srcs` 里现在**混着两种源** —— 立绘是 `blob:`（data URI 解码出来的
+       object URL），帧动画是宿主路由下的文件 URL。混在一起数，两件事就都说不清了，
+       所以先按来源分开，再各查各的。 */
+    const spriteSrcs = () => h.srcs.filter((s) => typeof s === 'string' && s.startsWith('blob:'))
+    const motionSrcs = () => h.srcs.filter((s) => typeof s === 'string' && s.indexOf('/wisp-motion/') >= 0)
+
     if (h.srcs.length === 0) {
       bad('sprite assigned to an <img>', 'no src was ever set')
-    } else if (h.srcs.every((s) => typeof s === 'string' && s.startsWith('blob:'))) {
-      ok('sprites use blob: object URLs', h.srcs[0])
+    } else if (spriteSrcs().length > 0 && spriteSrcs().every((s) => s.startsWith('blob:'))) {
+      ok('sprites use blob: object URLs', spriteSrcs()[0])
     } else if (h.srcs.some((s) => typeof s === 'string' && s.startsWith('data:'))) {
       bad('sprites must not use data: URIs', 'this shell renders them as a broken image')
     } else {
       bad('sprite URL scheme', JSON.stringify(h.srcs).slice(0, 200))
     }
+    /* 帧动画走的是**另一条**路（v1.47.0）：宿主半包注册的 `/wisp-motion/` 路由，
+       以页面自己的 base 解析。它必须既不是 blob:（那意味着素材又被内联回来了），
+       也不是 data:（这个壳画不出来）。 */
+    check(motionSrcs().length > 0
+      && motionSrcs().every((s) => /^http:\/\/127\.0\.0\.1:19387\/wisp-motion\/[A-Za-z0-9._-]+\.webp$/.test(s)),
+      'the frame-animation source is the host route resolved against the page base — never an inlined blob or data URI (v1.47.0)',
+      `${motionSrcs().length} motion src(s): ${motionSrcs()[0] ?? '(none)'}`)
     check(h.blobs.length > 0, 'base64 decoded into Blob objects', `${h.blobs.length} blob(s)`)
     check(h.blobs.every((b) => b.type.startsWith('image/')), 'blob MIME types are images', h.blobs[0]?.type)
 
@@ -974,7 +1164,7 @@ if (clientSrc !== null) {
     active = keepBt
     api.mood('happy')
     check(root.dataset.mood === 'happy', 'mood() control works')
-    check(h.srcs[h.srcs.length - 1] !== h.srcs[0], 'sprite switches with mood', String(h.srcs[h.srcs.length - 1]))
+    check(spriteSrcs().at(-1) !== spriteSrcs()[0], 'sprite switches with mood', String(spriteSrcs().at(-1)))
 
     // The swap must be a cross-fade: two layers for the length of the fade,
     // then the outgoing one is dropped. A hard `src` swap reads as a glitch.
@@ -1061,9 +1251,9 @@ if (clientSrc !== null) {
     h.state.pending = 'q-1'
     h.advance(1300, 100)
     check(root.dataset.mood === 'attn', 'a pending question switches her to attention', String(root.dataset.mood))
-    check(h.srcs[h.srcs.length - 1] !== h.srcs[0],
+    check(spriteSrcs().at(-1) !== spriteSrcs()[0],
       'the attention state has its own sprite rather than borrowing idle',
-      String(h.srcs[h.srcs.length - 1]).slice(0, 22))
+      String(spriteSrcs().at(-1)).slice(0, 22))
     check(bubbles() > beforeAttn, 'she says something about it',
       layerEl.querySelector('.wisp-say')?.textContent)
 
@@ -2021,13 +2211,13 @@ if (clientSrc !== null) {
     const size0 = ixApi.config.size
     wheel(-100, { ctrlKey: true })
     const sizeUp = ixApi.config.size
-    check(Math.abs(sizeUp - (size0 + 0.25)) < 1e-9, 'ctrl+wheel up makes her a step bigger',
+    check(Math.abs(sizeUp - (size0 + 0.1)) < 1e-9, 'ctrl+wheel up makes her a step bigger',
       String(size0) + ' -> ' + String(sizeUp))
     wheel(100, { ctrlKey: true })
     check(Math.abs(ixApi.config.size - size0) < 1e-9, 'and ctrl+wheel down takes it back',
       String(ixApi.config.size))
     wheel(-100, { metaKey: true })
-    check(Math.abs(ixApi.config.size - (size0 + 0.25)) < 1e-9, '⌘+wheel does the same on macOS',
+    check(Math.abs(ixApi.config.size - (size0 + 0.1)) < 1e-9, '⌘+wheel does the same on macOS',
       String(ixApi.config.size))
     wheel(100, { metaKey: true })
 
@@ -2107,8 +2297,10 @@ if (clientSrc !== null) {
 
     /* 平台事实（源码级查过）：宿主半包跑在 vm 沙箱里，harness 只给
        { defineTool, registerTool, handle }，沙箱里 nodeApiTraps() 挡住 Node API ——
-       插件**既不能联网、也不能写文件**，DSH 的安装器也没有可注入的服务。
-       所以"自己检查并安装更新"做不到；这一节测的是能真正做到的那几件事。 */
+       插件**自己**既不能联网、也不能写文件。但"装"这一步不用她自己做（v1.48.0）：
+       平台把插件管理器做成了客户端可用的 Remote 命名空间（ctx.remote.pluginManager），
+       installBundle 交给它就行 —— 平台自己的「插件」设置页走的是同一条路。
+       这一节测能真正做到的那几件事，安装那一段在下面 3d-quindecies-bis。 */
     const uv = createHarness({ timer: true, composerText: '', clipboard: true })
     const keepUv = active
     active = uv
@@ -2127,9 +2319,12 @@ if (clientSrc !== null) {
     check(typeof update?.whatsNew === 'string' && update.whatsNew.length > 0,
       'the what-is-new note covers the CURRENT version', String(update?.whatsNew))
 
-    /* 能力边界要如实报告，不能让人以为她能自己更新 */
-    check(update.canSelfUpdate === false, 'she does not pretend she can update herself',
-      String(update.canSelfUpdate))
+    /* 能力边界要如实报告 —— 但 v1.48.0 起"能自己更新"这句**成立了一半**：
+       她自己没有网络也没有 Node，可她能**让平台去装**（remote.pluginManager）。
+       所以这里验的是"她说得准"，不是"她说不能"。 */
+    check(update.canSelfUpdate === true && update.install !== undefined,
+      'she no longer claims she cannot install an update — the platform plugin manager can',
+      JSON.stringify({ canSelfUpdate: update.canSelfUpdate, via: update.install?.via }))
     check(typeof update.hint === 'string' && update.hint.includes('dsh-wisp'),
       'but she does say which package to install', String(update.hint))
     check(/沙箱|sandbox/.test(String(update.why)), 'and why — in plain words', String(update.why))
@@ -2198,11 +2393,136 @@ if (clientSrc !== null) {
       active = keepHc
     }
 
+
+    /* ---- 3d-quindecies-bis. 直接装上最新版（v1.48.0）-------------------------
+       客户端半包没有 host 座位，但 installUpdate **不需要它**：平台自己的「插件」设置页
+       走的就是 ctx.remote.pluginManager.installBundle。用假命名空间把几种结果走一遍。 */
+    {
+      const inPool = (pool, text) => (Array.isArray(pool) ? pool : [])
+        .some((line) => String(text).indexOf(String(line).split('{')[0]) === 0)
+      const mkInstaller = (services) => createHarness({ timer: true, composerText: '', services })
+      const runInstall = async (services, version) => {
+        const hx = mkInstaller(services)
+        const keep = active
+        active = hx
+        hx.evaluate(clientSrc)
+        hx.module().default.apply(hx.ctx, { reactions: true, wander: false, celebrate: false })
+        hx.advance(1300, 100)
+        const state = await hx.win.__wisp.installUpdate(version)
+        await new Promise((resolve) => setImmediate(resolve))
+        const line = String(hx.all('wisp-say').at(-1)?.textContent ?? '')
+        const doctor = hx.win.__wisp.doctor().update.install
+        hx.win.__wisp.destroy()
+        active = keep
+        return { state, line, doctor }
+      }
+
+      let asked = null
+      const applied = await runInstall({
+        'remote.pluginManager': {
+          installBundle: (spec) => { asked = spec; return Promise.resolve({ ok: true, value: { changed: true, application: 'applied', stage: 'install', target: spec } }) },
+        },
+      }, '9.9.9')
+      check(asked === 'dsh-wisp@9.9.9', 'the install asks for exactly the version that was offered', String(asked))
+      check(applied.state.state === 'installed' && applied.state.application === 'applied',
+        'a successful install lands in the installed state', JSON.stringify(applied.state))
+      check(inPool(linesInBundle()?.installDone, applied.line)
+        && applied.line.includes('9.9.9') && !applied.line.includes('dsh-wisp@'),
+      'and she says it is installed — the bare version, not the dsh-wisp@ spec', applied.line)
+      check(applied.doctor.via === 'remote.pluginManager' && applied.doctor.state === 'installed',
+        'doctor() reports the channel and the last install result', JSON.stringify(applied.doctor))
+
+      const restart = await runInstall({
+        'remote.pluginManager': {
+          installBundle: (spec) => Promise.resolve({ ok: true, value: { changed: true, application: 'restart-required', stage: 'install', target: spec } }),
+        },
+      }, '9.9.9')
+      check(restart.state.state === 'installed' && restart.state.application === 'restart-required'
+        && inPool(linesInBundle()?.installRestart, restart.line),
+      'when the platform says a restart is required she says exactly that, not "done"',
+      restart.line)
+
+      const refused = await runInstall({
+        'remote.pluginManager': {
+          installBundle: () => Promise.resolve({ ok: false, error: { code: 'no-matching-version' } }),
+        },
+      }, '9.9.9')
+      check(refused.state.state === 'failed' && refused.state.reason === 'no-matching-version'
+        && inPool(linesInBundle()?.installNotPublished, refused.line) && refused.line.includes('9.9.9'),
+      'a registry that does not have that version yet is said in its own words',
+      refused.line)
+
+      const blewUp = await runInstall({
+        'remote.pluginManager': { installBundle: () => { throw new Error('boom') } },
+      }, '9.9.9')
+      check(blewUp.state.state === 'failed' && blewUp.state.reason === 'call-failed'
+        && blewUp.state.detail === 'boom' && inPool(linesInBundle()?.installFailed, blewUp.line),
+      'a throwing install is caught and reported in plain words', JSON.stringify(blewUp.state))
+
+      const noManager = await runInstall({}, '9.9.9')
+      check(noManager.state.state === 'unsupported' && noManager.doctor.via === null
+        && inPool(linesInBundle()?.installUnsupported, noManager.line),
+      'a shell without the plugin manager is its own sentence, never a silent no-op',
+      noManager.line)
+
+      /* 弹窗里的那一步：查到新版 → 「安装 vX」按钮 → 点它真的按那一版去装 */
+      {
+        let clicked = null
+        const dlgHx = createHarness({
+          timer: true, composerText: '',
+          services: { 'remote.pluginManager': { installBundle: (spec) => { clicked = spec; return Promise.resolve({ ok: true, value: { changed: true, application: 'applied', stage: 'install', target: spec } }) } } },
+        })
+        const keepDlgHx = active
+        active = dlgHx
+        dlgHx.win.fetch = (url) => Promise.resolve({
+          ok: true,
+          json: () => Promise.resolve({ version: '9.9.9' }),
+        })
+        dlgHx.evaluate(clientSrc)
+        dlgHx.module().default.apply(dlgHx.ctx, { reactions: false, wander: false, celebrate: false })
+        dlgHx.advance(1300, 100)
+        const dlgApi2 = dlgHx.win.__wisp
+        await dlgApi2.checkForUpdate()
+        await new Promise((resolve) => setImmediate(resolve))
+        dlgApi2.openAbout()
+        const actions = dlgHx.all('wisp-dialog-action').filter((el) => el.removed !== true)
+        const installBtn = actions.find((el) => String(el.textContent).includes('安装 v9.9.9'))
+        check(installBtn !== undefined,
+          'once a newer version is known, the about dialog offers an install button for THAT version',
+          actions.map((el) => el.textContent).join(' | '))
+        if (installBtn !== undefined) installBtn.dispatch('click', { preventDefault() {}, stopPropagation() {} })
+        await new Promise((resolve) => setImmediate(resolve))
+        check(clicked === 'dsh-wisp@9.9.9',
+          'and clicking it installs that very version through the plugin manager', String(clicked))
+        check(dlgApi2.dialog === null, 'the dialog gets out of the way while it installs', String(dlgApi2.dialog))
+        dlgHx.win.__wisp.destroy()
+        active = keepDlgHx
+      }
+
+      /* 英文覆盖层：安装这几句也要有，而且一个汉字都不许有 */
+      const enInstallKeys = ['installChecking', 'installDone', 'installRestart', 'installPending',
+        'installCancelled', 'installNotPublished', 'installFailed', 'installUnsupported']
+      const enInstallBundle = readFileSync(join(here, 'lib', 'client.js'), 'utf8')
+      const enInstallLiteral = enInstallBundle.match(/const LINES_EN = (\{[\s\S]*?\n {4}\})/)
+      let enInstallPools = null
+      try { enInstallPools = enInstallLiteral ? new Function('return ' + enInstallLiteral[1])() : null } catch (error) { enInstallPools = null }
+      const enInstallMissing = enInstallKeys.filter((k) => !Array.isArray(enInstallPools?.[k]) || enInstallPools[k].length === 0)
+      check(enInstallMissing.length === 0, 'every install line has an English pool',
+        enInstallMissing.length ? 'missing ' + enInstallMissing.join(', ') : enInstallKeys.length + ' pools')
+      const enInstallHan = []
+      for (const key of enInstallKeys) {
+        for (const line of (enInstallPools?.[key] ?? [])) if (/[\u4e00-\u9fff]/.test(line)) enInstallHan.push(key + ': ' + line)
+      }
+      check(enInstallHan.length === 0, 'and none of them contains a Han character', enInstallHan.join(' | ') || 'clean')
+    }
+
     /* 失败时也要能追问：doctor() 必须留下**每个源各自的**原因，
        否则"没查成"就是一句没法追的话（这正是用户实际遇到的情形）。 */
     const diagHarness = mkChecker(async () => ({
       ok: false,
       reason: 'no-web-service',
+      /* 宿主现在会一起带回"它看见了什么" —— 失败台词背后的细节靠这一段。 */
+      diag: { via: 'none', how: 'none', why: 'ctx.get("web")→undefined; ctx.web→undefined', manager: 'no-plugin-manager' },
       sources: {
         npm: { ok: false, reason: 'no-web-service' },
         github: { ok: false, reason: 'fetch-failed', detail: 'getaddrinfo ENOTFOUND' },
@@ -2220,6 +2540,19 @@ if (clientSrc !== null) {
       && diagLast.sources.github.detail === 'getaddrinfo ENOTFOUND',
     'a failed check keeps every source reason, so doctor() can say WHY it failed',
     JSON.stringify(diagLast))
+
+    /* 台词是给人读的一句话，技术细节不进嘴；但细节必须看得见 —— 失败时排进弹窗。
+       （真机上出现过台词后面挂一串 ctx.get(...)→undefined 的英文碎片。） */
+    diagHarness.win.__wisp.showUpdate()
+    await new Promise((resolve) => setImmediate(resolve))
+    diagHarness.advance(200, 50)
+    const failSaid = String(diagHarness.all('wisp-say').at(-1)?.textContent ?? '')
+    check(!/[A-Za-z]{3,}/.test(failSaid),
+      'the failure line stays human — no technical fragments in the spoken sentence', failSaid)
+    const diagDialog = diagHarness.all('wisp-dialog-p').map((el) => el.textContent).join('\n')
+    check(diagDialog.includes('看到的东西') && diagDialog.includes('取服务的方式'),
+      'and the dialog spells out what the host actually saw',
+      diagDialog.replace(/\n/g, ' | ').slice(0, 120))
     diagHarness.win.__wisp.destroy()
     active = keepDiag
 
@@ -2258,6 +2591,27 @@ if (clientSrc !== null) {
     check(new Set([noChannelSaid, noHostSaid, networkSaid]).size === 3,
       'the three failure kinds really are three different sentences')
 
+    /* "没接上宿主"和"宿主拿不到服务"是链路上**不同的一环**断了 —— 必须分开说，
+       否则那句话永远说不清断在哪（1.43.3 之前两者共用同一句，真机上就卡在这）。 */
+    const noSeat = createHarness({ timer: true, composerText: '' })   // 默认替身没有 host 座位
+    const keepNoSeat = active
+    active = noSeat
+    noSeat.evaluate(clientSrc)
+    noSeat.module().default.apply(noSeat.ctx, { reactions: false, wander: false, celebrate: false })
+    noSeat.advance(1000, 100)
+    const noSeatRes = await noSeat.win.__wisp.checkForUpdate()
+    noSeat.win.__wisp.showUpdate()
+    await new Promise((resolve) => setImmediate(resolve))
+    noSeat.advance(200, 50)
+    const noSeatSaid = String(noSeat.all('wisp-say').at(-1)?.textContent ?? '')
+    check(noSeatRes.state === 'failed' && noSeatRes.reason === 'fetch-failed',
+      'no host seat at all gets its OWN sentence — the first link in the chain',
+      `${noSeatRes.state} ｜ ${noSeatSaid}`)
+    check(noSeatSaid !== noChannelSaid,
+      'and it is distinguishable from "the host ran but has no web service"', `${noSeatSaid} ≠ ${noChannelSaid}`)
+    noSeat.win.__wisp.destroy()
+    active = keepNoSeat
+
     /* 宿主调用抛错：不能变成未处理的 rejection */
     const thrower = mkChecker('boom')
     const keepThrower = active
@@ -2279,8 +2633,9 @@ if (clientSrc !== null) {
     noHost.module().default.apply(noHost.ctx, { reactions: true, wander: false, celebrate: false })
     noHost.advance(1300, 100)
     const unsupported = await noHost.win.__wisp.checkForUpdate()
-    check(unsupported.state === 'unsupported',
-      'with no host seat she reports that checking is not available', JSON.stringify(unsupported))
+    check(noSeatRes.state === 'failed' && noSeatRes.reason === 'fetch-failed',
+      'with no host seat the CLIENT half falls back to its own fetch (no more unsupported)',
+      JSON.stringify(noSeatRes))
     const stillWorks = noHost.win.__wisp.showUpdate()
     check(stillWorks.version === pkgVersion && stillWorks.checking === true,
       'and the update entry still works without it', JSON.stringify(stillWorks))
@@ -2325,8 +2680,10 @@ if (clientSrc !== null) {
     /* ------------- 3d-sexdecies. she can look up your balance ----------------- */
     head('3d-sexdecies. she can look up your balance, and says which kind of "no" it is')
 
-    /* 余额这条路和检查更新同形：浏览器半包没有网络，宿主半包拿平台自己的
-       `deepseekAccount` 服务（凭据留在平台手里），这边用 host.call 问它。
+    /* 余额有两条通道，读的是**同一个**平台账户服务（凭据留在宿主手里）：
+       ① 客户端 Remote（默认，bundle 形态只有这条真的通）；
+       ② host 座位（动态插件形态才有），这边用 host.call 问宿主半包。
+       本节先测 host 座位那条（假座位），再测 Remote 那条（下面 3d-septendecies）。
        四种"没读到"必须是四句不同的话 —— 全说成"查不到"就是在骗人。 */
     const balanceHarness = (reply) => createHarness({
       timer: true, composerText: '',
@@ -2438,6 +2795,126 @@ if (clientSrc !== null) {
     balThrower.win.__wisp.destroy()
     active = keepBalThrower
 
+    /* ------------- 3d-septendecies. the balance channel that really exists ------
+       平台自己的「账户」设置页走的是 ctx.remote.account.*（Remote，信封 { ok, value }）。
+       bundle 形态的客户端半包没有 host 座位，所以**这才**是真机上那条路 ——
+       1.46.0 之前它根本没被走过，菜单里点一下永远回"这个壳里查不了余额"。 */
+    const runRemote = async (account, hostCall) => {
+      const hx = createHarness({
+        timer: true, composerText: '',
+        ...(hostCall ? { hostCall } : {}),
+        services: { 'remote.account': account },
+      })
+      const keep = active
+      active = hx
+      hx.evaluate(clientSrc)
+      hx.module().default.apply(hx.ctx, { reactions: true, wander: false, celebrate: false })
+      hx.advance(1300, 100)
+      const res = await hx.win.__wisp.checkBalance()
+      const line = await spoken(hx)
+      const doctor = hx.win.__wisp.doctor().balance
+      hx.win.__wisp.destroy()
+      active = keep
+      return { res, line, doctor }
+    }
+
+    let seenClient = null
+    const remoteReady = await runRemote({
+      getBalance: async (client) => {
+        seenClient = client
+        return {
+          ok: true,
+          value: { status: 'ready', value: [{ currency: 'CNY', balance: '110.00' }], bonusWallets: [{ currency: 'CNY', balance: '10.00' }] },
+        }
+      },
+      getState: async () => ({ ok: true, value: { status: 'credential-stored' } }),
+    })
+    check(remoteReady.res.state === 'ready' && remoteReady.res.wallets[0].balance === '110.00'
+      && remoteReady.res.bonusWallets[0].balance === '10.00',
+    'the account Remote is a real channel: a wrapped ready answer lands in the ready state',
+    JSON.stringify(remoteReady.res))
+    check(remoteReady.line.includes('¥110.00') && fromPool(linesInBundle()?.balance, remoteReady.line, '¥110.00')
+      && remoteReady.line.includes('¥10.00'),
+    'and she says the amount, credit part included', remoteReady.line)
+    /* 服务端**没有**任何默认值：不传身份它直接 TypeError。这条因此必须钉住。 */
+    check(seenClient !== null && seenClient.version === pkg.version
+      && typeof seenClient.locale === 'string' && seenClient.locale !== ''
+      && typeof seenClient.timezoneOffsetSeconds === 'number' && Number.isFinite(seenClient.timezoneOffsetSeconds),
+    'the Remote call carries this call\'s own identity (version / locale / UTC offset)',
+    JSON.stringify(seenClient))
+    check(remoteReady.doctor.remoteSeat === true && remoteReady.doctor.via === 'remote',
+      'doctor() reports the Remote seat and which channel this read took',
+      JSON.stringify(remoteReady.doctor))
+
+    /* 两条通道都在 → 走平台原生那条 Remote；host 座位只当兜底 */
+    const bothSeats = await runRemote(
+      {
+        getBalance: async () => ({ ok: true, value: { status: 'ready', value: [{ currency: 'CNY', balance: '110.00' }], bonusWallets: [] } }),
+        getState: async () => ({ ok: true, value: { status: 'credential-stored' } }),
+      },
+      async () => ({ ok: true, status: 'ready', wallets: [{ currency: 'CNY', balance: '999.00' }], bonusWallets: [] }),
+    )
+    check(bothSeats.res.state === 'ready' && bothSeats.res.wallets[0].balance === '110.00'
+      && bothSeats.doctor.via === 'remote' && bothSeats.doctor.hostSeat === true,
+    'with both seats live the platform Remote wins, and the host seat stays declared',
+    JSON.stringify(bothSeats.doctor))
+
+    const remoteSignedOut = await runRemote({
+      getBalance: async () => ({ ok: true, value: null }),
+      getState: async () => ({ ok: true, value: { status: 'signed-out' } }),
+    })
+    check(remoteSignedOut.res.state === 'signed-out'
+      && fromPool(linesInBundle()?.balanceSignedOut, remoteSignedOut.line, ''),
+    'a null balance while signed out is reported as signed out', remoteSignedOut.line)
+
+    const remoteMoved = await runRemote({
+      getBalance: async () => ({ ok: true, value: null }),
+      getState: async () => ({ ok: true, value: { status: 'credential-stored' } }),
+    })
+    check(remoteMoved.res.state === 'unavailable'
+      && fromPool(linesInBundle()?.balanceUnavailable, remoteMoved.line, ''),
+    'a null balance while STILL signed in is "try again", not "log in"', remoteMoved.line)
+
+    const remoteRefused = await runRemote({ getBalance: async () => ({ ok: false, reason: 'disconnected' }) })
+    check(remoteRefused.res.state === 'failed' && remoteRefused.res.reason === 'disconnected'
+      && fromPool(linesInBundle()?.balanceFailed, remoteRefused.line, ''),
+    'a refused envelope is a failure and keeps the reason', JSON.stringify(remoteRefused.res))
+
+    const remoteFailed = await runRemote({
+      getBalance: async () => ({ ok: true, value: { status: 'failed' } }),
+      getState: async () => ({ ok: true, value: { status: 'credential-stored' } }),
+    })
+    check(remoteFailed.res.state === 'failed' && remoteFailed.res.reason === 'service-failed'
+      && !/110\.00/.test(remoteFailed.line),
+    'a platform "failed" inside the envelope never becomes a zero balance', JSON.stringify(remoteFailed.res))
+
+    const remoteThrew = await runRemote({ getBalance: async () => { throw new Error('boom') } })
+    check(remoteThrew.res.state === 'failed' && remoteThrew.res.reason === 'call-failed'
+      && remoteThrew.res.detail === 'boom',
+    'a throwing Remote call is caught and reported', JSON.stringify(remoteThrew.res))
+
+    /* 一个永远不回答的 Remote（连接断了但 promise 不落地）：不许让气泡停在"看一下……"。
+       服务和宿主半包那条路一样不接受 AbortSignal，只能自己竞速 —— 8 秒。 */
+    {
+      const hung = createHarness({
+        timer: true, composerText: '',
+        services: { 'remote.account': { getBalance: () => new Promise(() => {}) } },
+      })
+      const keepHung = active
+      active = hung
+      hung.evaluate(clientSrc)
+      hung.module().default.apply(hung.ctx, { reactions: true, wander: false, celebrate: false })
+      hung.advance(1300, 100)
+      const pending = hung.win.__wisp.checkBalance()
+      hung.advance(9000, 250)
+      const res = await pending
+      check(res.state === 'failed' && res.reason === 'call-failed' && res.detail === 'timeout',
+        'a Remote call that never answers is cut off instead of hanging the bubble',
+        JSON.stringify(res))
+      hung.win.__wisp.destroy()
+      active = keepHung
+    }
+
     /* 英文覆盖层：余额这几句也要有，而且一个汉字都不许有 —— 1.36 的英文是覆盖层，
        新加的池子漏翻就会让英文界面的人看到中文。 */
     const enBundle = readFileSync(join(here, 'lib', 'client.js'), 'utf8')
@@ -2826,7 +3303,515 @@ if (clientSrc !== null) {
       `pointermove=${mo.win.listenerCount('pointermove')} blur=${mo.win.listenerCount('blur')}`)
     active = keepMo
 
+    /* ---------------- 3f-ter. 帧动画（v1.45.0；v1.46.1 起是动图 <img>；v1.46.5 起两条）-- */
+    head('3f-ter. the frame animations: animated WebPs that step aside to freeze')
+
+    /* 这一段测的是"叠加在立绘上的那层动图"，而它有四个**只有行为能证明**的点：
+       与立绘同一格、不吃指针、显示时立绘退场（v1.45.2）、以及"该冻结时它藏起来、
+       画面回到立绘"（v1.46.1：<img> 上的动图停不下来，藏起来是唯一的冻结方式）。
+       单开一个替身：这里要真的睡着（sleepAfterMs 在别的替身里是一小时，
+       而直接 mood('sleep') 更直接，也不会打乱别人的时间轴）。 */
+    const mv = createHarness({ timer: true, composerText: '' })
+    const keepMv = active
+    active = mv
+    mv.evaluate(clientSrc)
+    mv.module().default.apply(mv.ctx, {
+      reactions: false, wander: false, celebrate: false, sleepAfterMs: 3600000,
+    })
+    mv.advance(1200, 100)
+    const mvApi = mv.win.__wisp
+    const mvRoot = mv.find('wisp-root')
+    const mvLean = mv.find('wisp-lean')
+    const mvLive = () => mv.all('wisp-video').find((el) => el.removed !== true) ?? null
+
+    /* 静态立绘"看不看得见"（v1.45.2）在替身里由**两件事**共同决定：
+       ① 根上的 data-frame —— 行为，syncMotion() 写的那个属性；属性不写 = 退场没发生。
+       ② 样式表里把属性翻译成 visibility:hidden 的那条规则 —— 映射；规则没了，
+          属性写了也白写（画面照旧两层）。
+       行内那一份是样式表缺失时的兜底，也是同一件事的第二个落点。
+       替身没有级联引擎，所以这个 helper 把三者合成"浏览器会算出来的值"，
+       而每一条断言仍然把三者**分开点名** —— 合成值对了、其中一条断了，一样要红。 */
+    const mvFrameRule = (String(mv.styleInserts[0] ?? '').match(/\.wisp-root\[data-frame="on"\][^{]*\{[^}]*\}/) ?? [''])[0]
+    const mvVis = (el) => (
+      String(el?.style?.visibility ?? '') === 'hidden'
+      || (mvRoot.dataset.frame === 'on' && mvFrameRule.includes('visibility:hidden'))
+        ? 'hidden'
+        : 'visible'
+    )
+
+    /* ---- idle 也接上了（v1.46.5）：它是**默认**状态，所以动作层从挂载那一刻就在 ----
+       这一段同时证明三件事：素材真的在包里、MOTION_OF 里接上了、syncMotion() 在挂载
+       那一刻真的跑过（在那之前这一层只在进入 sleep 时才建元素）。 */
+    const mvIdle = mvLive()
+    const mvIdleImgs = mvRoot.querySelectorAll('.wisp-img')
+    check(mvIdle !== null && mvIdle.tagName === 'IMG' && mvIdle.dataset.clip === 'idle',
+      'the idle state builds the motion layer at mount — the standing loop is wired in, not merely shipped (v1.46.5)',
+      mvIdle ? `${mvIdle.tagName} clip=${String(mvIdle.dataset.clip)}` : 'no motion layer built while idle')
+    check(mvIdle !== null && mvIdle.style.display !== 'none' && mvIdleImgs.length === 1
+      && mvVis(mvIdleImgs[0]) === 'hidden' && mvRoot.dataset.frame === 'on',
+      'and it owns the picture from the first frame — the sprite is out of the way, never double-exposed (v1.45.2 rules, idle edition)',
+      `display=${mvIdle?.style.display} sprites=${mvIdleImgs.length} sprite=${mvVis(mvIdleImgs[0])} data-frame=${String(mvRoot.dataset.frame)}`)
+    /* idle **不带**尺寸校正（差 1.0~1.6%，小于 2% 那条线）：行内必须是 none。
+       这一条和下面 sleepy 那条 1.186 是**分开点名**的 —— 只查一条的话，"base 那条
+       1.186 落到 idle 头上"（她会被放大 18.6%）这种错会整段漏过去。 */
+    check(mvIdle !== null && mvIdle.style.transform === 'none',
+      'the idle clip carries NO size correction — she fills 97.2% of that frame vs 98.2% of the sprite, under the 2% line (v1.46.5)',
+      `inline transform=${JSON.stringify(mvIdle?.style.transform)}`)
+
+    /* 没有动作素材的状态**连元素都不建**：摆一个永远不动、还要白解 3 MB 的空盒子，
+       代价是真的，收益是零。idle 接上之后，"默认那一档没有素材"在这个包里再也造不出来
+       —— 所以把 MOTION 表里 idle 那一条**删掉**再挂一次：那才是真的"这个状态没有素材"。
+       判据在 syncMotion() 里（查不到 key 就不建元素），不是"素材恰好缺失"。
+       v1.47.0 起表里那条长这样：`"idle": 'idle.webp',` —— 删的是**清单里的一行**，
+       不是一段 base64（投递改了，这一段测试的意图没变）。 */
+    const noIdleSrc = String(clientSrc).replace(/^\s*"idle": '[^']*',$/m, '')
+    const mvNone = createHarness({ timer: true, composerText: '' })
+    active = mvNone
+    mvNone.evaluate(noIdleSrc)
+    mvNone.module().default.apply(mvNone.ctx, {
+      reactions: false, wander: false, celebrate: false, sleepAfterMs: 3600000,
+    })
+    mvNone.advance(1200, 100)
+    const mvNoneRoot = mvNone.find('wisp-root')
+    check(noIdleSrc !== clientSrc
+      && mvNoneRoot.querySelectorAll('.wisp-video').length === 0 && mvNoneRoot.querySelectorAll('video').length === 0,
+      'a mood with no clip does not even build the motion layer — no element, no base64 decode',
+      `${mvNoneRoot.querySelectorAll('.wisp-video').length} motion layer(s) with the clip removed from the table`)
+    /* 没有素材的状态：立绘就是画面里的那个人，而且**没有第二个"她"** —— 动图不建、属性不挂。 */
+    const mvNoneImgs = mvNoneRoot.querySelectorAll('.wisp-img')
+    check(mvNoneImgs.length === 1 && String(mvNoneImgs[0]?.style?.visibility ?? '') !== 'hidden'
+      && mvNoneRoot.dataset.frame === undefined,
+    'with no clip the frame never takes the picture: one visible sprite, no "frame owns it" attribute (v1.45.2)',
+    `sprites=${mvNoneImgs.length} inline=${String(mvNoneImgs[0]?.style?.visibility ?? '') || '(unset)'} data-frame=${String(mvNoneRoot.dataset.frame)}`)
+    const mvNoneApi = mvNone.win.__wisp
+    check(mvNoneApi.doctor().motion.frame.built === false && mvNoneApi.doctor().motion.frame.asset === null,
+      'and doctor() says so: nothing built, no clip for this state',
+      JSON.stringify(mvNoneApi.doctor().motion.frame))
+    mvNoneApi.destroy()
+    active = mv
+
+    /* ---- 换状态 = 换素材源，同一个元素（v1.46.5）----
+       两段素材都进包之后，这条才有内容：一次性实现的陷阱是"只在第一次建元素、
+       之后再也不改 src" —— 那样她睡着以后还在放站着的循环，而画面上看不出错。 */
+    const mvIdleSrc = String(mvIdle.src)
+    mvApi.mood('sleep')
+    mv.advance(400, 100)
+    check(mvLive() === mvIdle && mvIdle.dataset.clip === 'sleepy'
+      && String(mvIdle.src) !== mvIdleSrc && String(mvIdle.src) === 'http://127.0.0.1:19387/wisp-motion/sleepy.webp',
+      'switching state re-points the SAME element at the other clip — the layer is not a one-shot build (v1.46.5)',
+      `reused=${mvLive() === mvIdle} clip=${String(mvIdle.dataset.clip)} srcChanged=${String(mvIdle.src) !== mvIdleSrc} src=${String(mvIdle.src)}`)
+    mvApi.mood('idle')
+    mv.advance(400, 100)
+    check(mvLive() === mvIdle && mvIdle.dataset.clip === 'idle' && String(mvIdle.src) === mvIdleSrc,
+      'and switching back re-points it at the standing loop again — the source follows every transition, not just the first',
+      `reused=${mvLive() === mvIdle} clip=${String(mvIdle.dataset.clip)} srcBack=${String(mvIdle.src) === mvIdleSrc}`)
+    mvApi.mood('sleep')
+    mv.advance(400, 100)
+    check(mvIdle.style.display !== 'none' && mvIdle.dataset.clip === 'sleepy',
+      'and the sleeping loop is what is on screen after the round trip',
+      `display=${mvIdle.style.display || '(default)'} clip=${String(mvIdle.dataset.clip)}`)
+
+    const mvMotion = mvLive()
+    const mvImgs = mvLean.querySelectorAll('.wisp-img')
+    const mvImg = mvImgs[0] ?? null
+    check(mvMotion !== null && mvMotion.tagName === 'IMG',
+      'a mood that HAS a clip builds an <img> overlay — the picture pipeline, not a media pipeline',
+      String(mvMotion?.tagName))
+    /* v1.46.1 的核心：**一个 <video> 都不该存在**。这个壳不还原 VP9 的 alpha，
+       而图片路径的 alpha 是硬的（见 build.mjs 的 motion 段与 WHATS_NEW）。 */
+    check(mvRoot.querySelectorAll('video').length === 0,
+      'and not a single <video> is built anywhere in the tree — the alpha has to come from the image path',
+      `${mvRoot.querySelectorAll('video').length} video element(s)`)
+    check(mvMotion !== null && mvMotion.parentNode === mvLean && mvImgs.length === 1,
+      'it sits in the same layer as the sprite, next to it — so it tilts and squashes with her',
+      `motion in ${String(mvMotion?.parentNode?.className)}, ${mvImgs.length} sprite layer(s)`)
+    /* 与立绘**逐条同款**的行内盒模型：另起一套定位，就会出现"动起来时她跳了一下"
+       —— 那是只有真机上才看得见的错位。 */
+    const inlineBoxOf = (el) => ['position', 'top', 'left', 'width', 'height', 'objectFit', 'objectPosition']
+      .map((k) => String(el?.style?.[k] ?? ''))
+    const spriteBox = inlineBoxOf(mvImg)
+    const motionBox = inlineBoxOf(mvMotion)
+    check(mvImg !== null && motionBox.join('|') === spriteBox.join('|')
+      && motionBox[0] === 'absolute' && motionBox[3] === '100%' && motionBox[5] === 'contain'
+      && motionBox[6] === 'bottom center',
+    'and it is laid out exactly like the sprite it overlays (inset 0 / 100% / contain / bottom center)',
+    `motion[${motionBox.join(',')}] vs sprite[${spriteBox.join(',')}]`)
+
+    check(mvMotion !== null && mvMotion.getAttribute('alt') === '' && mvMotion.getAttribute('aria-hidden') === 'true'
+      && mvMotion.draggable === false,
+    'and it is marked as decoration: empty alt, aria-hidden, not draggable',
+    `alt=${JSON.stringify(mvMotion?.getAttribute('alt'))} aria-hidden=${JSON.stringify(mvMotion?.getAttribute('aria-hidden'))} draggable=${String(mvMotion?.draggable)}`)
+
+    const mvCss = String(mv.styleInserts[0] ?? '')
+    const mvRule = (mvCss.match(/\.wisp-video\{[^}]*\}/) ?? [''])[0]
+    check(mvMotion !== null && mvMotion.style.pointerEvents === 'none' && mvRule.includes('pointer-events:none'),
+      'the motion layer never takes a pointer event — her silhouette hit layer still owns every click',
+      `inline=${mvMotion?.style.pointerEvents} rule=${mvRule.slice(0, 60)}…`)
+    /* 尺寸校正（v1.46.4）：动作层必须带那条 transform —— 少了它，"画面交给她"的那一刻
+       她比立绘**小 15.7%**（实测包围盒：动图 0.8352 个盒高 vs 立绘 0.9883）。
+       两条落点都点名：样式表给正常壳，行内给"样式表没插进来"的壳（精灵图 / 两层盒子 /
+       动图各有前例）。transform-origin 必须是**脚底**（50% 100%）：缩放不挪底边，
+       底边距才收得回来，"她落地"这件事才对得上。
+       这几个数是**推导出来的**，不是抄的：放大倍率 = 0.9883/0.8352 = 1.1834（取 1.186，
+       97 帧之间包围盒自己抖 ±0.2%）；下移量 t 由 0.0883*s - s*t = 0.0117 反解 = 7.84%。
+       详见 client.template.js 里 .wisp-video 上那段推导。 */
+    const mvZoomRule = /transform:scale\(1\.186\)\s*translateY\(7\.84%\)/.test(mvRule)
+    const mvZoomOrigin = /transform-origin:50% 100%/.test(mvRule)
+    check(mvZoomRule && mvZoomOrigin,
+      'the stylesheet scales the motion layer by 1.186 about a bottom-centre origin — her height AND her ground contact match the static sprite (v1.46.4)',
+      mvRule ? `.wisp-video{…} zoom=${mvZoomRule} origin=${mvZoomOrigin}` : 'no .wisp-video rule in the stylesheet')
+    check(mvMotion !== null && mvMotion.style.transform === 'scale(1.186) translateY(7.84%)'
+      && mvMotion.style.transformOrigin === '50% 100%',
+      'and the inline mirror carries the same correction, for shells where the stylesheet never arrives',
+      `inline transform=${mvMotion?.style.transform} origin=${mvMotion?.style.transformOrigin}`)
+    /* v1.46.5：**样式表那一份**也要把 idle 显式排除掉 —— base 那条 1.186 是给 sleepy 的，
+       落到 idle 头上就是放大 18.6%（而页面上只会看起来"她今天有点大"）。行内那份上面
+       单独点了名，这里点样式表那份：两个落点各查各的，缺一个就有一个壳是错的。 */
+    const mvIdleRule = (String(clientSrc).match(/\.wisp-video\[data-clip="idle"\]\{[^}]*\}/) ?? [''])[0]
+    check(/transform:none/.test(mvIdleRule) && !/scale\(/.test(mvIdleRule),
+      'the stylesheet names the idle clip too, so the sleeping 1.186 can never land on it (v1.46.5)',
+      mvIdleRule || 'no .wisp-video[data-clip="idle"] rule in the bundle')
+    /* reduced-motion 那条兜底：媒体查询够不着 JS 的显隐状态，但它至少能让这层不出现在
+       画面上（JS 拿不到 matchMedia 的壳里，冻结就只剩这一道）。 */
+    const mvRmAt = mvCss.indexOf('@media (prefers-reduced-motion:reduce)')
+    /* 媒体查询是第二道闸：JS 拿不到 matchMedia 的壳里，冻结就只剩这一条 —— 它必须
+       仍然能把动作层从画面上拿掉（v1.46.1 之后这层是 <img>，display:none 照旧管用）。 */
+    check(mvRmAt >= 0 && mvCss.slice(mvRmAt).includes('.wisp-video{display:none!important}'),
+      'the reduced-motion block still hides the motion layer in CSS — the JS gate is not the only one',
+      mvRmAt >= 0 ? 'found in the stylesheet insert' : 'no @media (prefers-reduced-motion:reduce) block')
+    /* 动作层**不许有 CSS filter**（v1.45.3 立的规矩，v1.46.1 照旧）：滤镜会给这一层
+       再插一次栅格化，alpha 剪影被重新合成一遍 —— 那正是"她整个人变黑"那次的成因；
+       阴影与调色只属于静态立绘。
+       所以这条断言盯的必须是结构，而不是某一行的字面量：
+       ① 睡眠那档只许改 --wisp-sprite；② 只有 .wisp-img 去读它；③ 动作层一个字都不许碰。 */
+    const sleepGrade = /\[data-mood="sleep"\]\{[^}]*--wisp-sprite\s*:/.test(String(clientSrc))
+    const spriteTakesGrade = /\.wisp-img\{[^}]*filter:var\(--wisp-glow\)\s*var\(--wisp-sprite\)/.test(String(clientSrc))
+    check(!/\.wisp-video\{[^}]*filter\s*:/.test(String(clientSrc))
+      && sleepGrade && spriteTakesGrade
+      && !/\[data-mood="sleep"\]\s*\.wisp-video\{[^}]*--wisp-sprite/.test(String(clientSrc)),
+      'the sleeping colour grade stays on the STATIC sprite only - the motion layer carries no filter at all',
+      (sleepGrade ? '' : 'no [data-mood="sleep"]{--wisp-sprite:…} rule; ')
+        + (spriteTakesGrade ? '' : 'the sprite does not compose var(--wisp-glow) var(--wisp-sprite); '))
+    /* 属性 -> 画面的**映射**：属性在、规则在，退场才真的发生。
+       用 visibility 而不是 display:none —— 盒子留着，布局不动，退场/回场不跳。 */
+    check(mvFrameRule.includes('visibility:hidden') && !mvFrameRule.includes('display:none'),
+      'the stylesheet takes the sprite out through visibility, never display — the box stays, so handing the picture over does not make her jump (v1.45.2)',
+      mvFrameRule || 'no .wisp-root[data-frame="on"] .wisp-img rule in the stylesheet')
+
+    /* 素材字节走哪条路（v1.47.0 换了）：**不再经过 Blob**。动图是宿主半包用
+       `/wisp-motion/` 发出来的文件，客户端只把 URL 指给 <img>；base 取页面自己的
+       （替身给的是真实的 Web 载体地址，见 documentShim.baseURI）。
+       两个方向都要点名：
+         ① 这一层的 src 必须是那条路由下的，**不是** data: URI（这个壳把 data: 当坏图，
+            1.44 那次碎图就是这么来的）；
+         ② 包里**一个** MB 级 clip blob 都不该有 —— 有就说明构建又把素材内联回来了，
+            而那正是这一版要修的那件事（八条泳装 +30 MB ⇒ 单文件 ~45 MB）。 */
+    const mvClipBlobs = mv.blobs.filter((b) => String(b.type) === 'image/webp' && b.size > 1024 * 1024)
+    check(mvMotion !== null && String(mvMotion.src) === 'http://127.0.0.1:19387/wisp-motion/sleepy.webp'
+      && mvClipBlobs.length === 0,
+      'the clip is fetched from the host route the page can resolve — and NOTHING multi-megabyte is inlined or blob-decoded any more (v1.47.0)',
+      `src=${String(mvMotion?.src)} · ${mvClipBlobs.length} MB-scale clip blob(s)`)
+    check(mvMotion !== null && mvMotion.style.display !== 'none',
+      'the animation is on screen at the default level', `display=${mvMotion?.style.display || '(default)'}`)
+    /* 需求的那一格：**动图在画面上的时候立绘必须不在场**（动图那一列由上面那条钉住）。
+       两层同时可见就是重影 —— 动图的透明处挡不住下面那张静帧。 */
+    check(mvMotion.style.display !== 'none'
+      && mvVis(mvImg) === 'hidden' && mvRoot.dataset.frame === 'on'
+      && mvImg.style.visibility === 'hidden' && mvApi.doctor().motion.frame.spriteHidden === true
+      && mvApi.doctor().motion.frame.showing === true,
+    'and while the animation is on screen the static sprite is GONE — two visible layers is a double image, not a fallback (v1.45.2)',
+    `display=${mvMotion.style.display} sprite=${mvVis(mvImg)} inline=${mvImg?.style.visibility || '(unset)'} data-frame=${String(mvRoot.dataset.frame)} doctor=${JSON.stringify(mvApi.doctor().motion.frame.spriteHidden)}`)
+
+    /* ---- 冻结规则之一：静止档 ---- */
+    /* 动图没有"暂停"可以喊（<img> 上没有 pause()，也没有 currentTime 可以写回 0），
+       所以冻结的唯一正确行为是**把它藏起来、把画面交回立绘** —— 下面这几条盯的就是
+       这件事：看不见动图 + 看得见立绘，两者缺一不可。 */
+    mvApi.configure({ motion: 'off' })
+    check(mvMotion.style.display === 'none',
+      'motion: off takes the animation off screen — an animated <img> cannot be paused, so hiding it IS the freeze',
+      `display=${mvMotion.style.display}`)
+    check(mvImg !== null && mvImg.removed !== true
+      && String(mvImg.style.opacity) !== '0' && String(mvImg.style.display) !== 'none',
+    'and the static sprite is what is left on screen — the fallback is the point of freezing',
+    `sprite opacity=${mvImg?.style.opacity || '(default)'} display=${mvImg?.style.display || '(default)'}`)
+    check(mvMotion.style.display === 'none' && mvVis(mvImg) === 'visible'
+      && mvRoot.dataset.frame === undefined && mvImg.style.visibility !== 'hidden'
+      && mvApi.doctor().motion.frame.showing === false && mvApi.doctor().motion.frame.frozen === true,
+    'and it is actually VISIBLE again, not merely present: the freeze hands the picture back to the sprite (v1.45.2)',
+    `motion=${mvMotion.style.display} sprite=${mvVis(mvImg)} inline=${mvImg?.style.visibility || '(unset)'} data-frame=${String(mvRoot.dataset.frame)}`)
+
+    /* ---- 恢复：同一个元素接着动，不重建 ---- */
+    mvApi.configure({ motion: 'full' })
+    check(mvMotion.style.display !== 'none' && mvLive() === mvMotion,
+      'putting the level back shows that same element instead of rebuilding it',
+      `display=${mvMotion.style.display || '(default)'}`)
+    /* 来回切：可见性必须跟着**每一次**切换走。只切一次的实现在这里就露馅了。 */
+    check(mvVis(mvImg) === 'hidden' && mvRoot.dataset.frame === 'on',
+      'and resuming takes the sprite out of the picture again — the switch follows every transition, not just the first one (v1.45.2)',
+      `sprite=${mvVis(mvImg)} data-frame=${String(mvRoot.dataset.frame)}`)
+
+    /* ---- 躲起来（display:none）也不该占着解码器 ---- */
+    mvApi.hide()
+    check(mvMotion.style.display === 'none',
+      'hiding her away takes the animation off screen too — an invisible 1.9 MB loop must not keep decoding',
+      `display=${mvMotion.style.display}`)
+    /* "被躲起来"也是冻结规则的一条：动图退场、画面归立绘 —— 她回来时看到的该是那张立绘。 */
+    check(mvMotion.style.display === 'none'
+      && mvVis(mvImg) === 'visible' && mvRoot.dataset.frame === undefined,
+    'and while she is hidden away the frame gives the picture back as well (v1.45.2)',
+    `motion=${mvMotion.style.display} sprite=${mvVis(mvImg)} data-frame=${String(mvRoot.dataset.frame)}`)
+    mvApi.show()
+    check(mvMotion.style.display !== 'none', 'and calling her back shows it again', `display=${mvMotion.style.display || '(default)'}`)
+    check(mvMotion.style.display !== 'none' && mvVis(mvImg) === 'hidden'
+      && mvRoot.dataset.frame === 'on',
+    'and the animation takes the picture again the moment she is back (v1.45.2)',
+    `motion=${mvMotion.style.display || '(default)'} sprite=${mvVis(mvImg)} data-frame=${String(mvRoot.dataset.frame)}`)
+
+    /* ---- 冻结规则之二：系统要求减少动态效果 ---- */
+    const mvr = createHarness({ timer: true, composerText: '', reducedMotion: true })
+    active = mvr
+    mvr.evaluate(clientSrc)
+    mvr.module().default.apply(mvr.ctx, {
+      reactions: false, wander: false, celebrate: false, sleepAfterMs: 3600000,
+    })
+    mvr.advance(1200, 100)
+    const mvrApi = mvr.win.__wisp
+    mvrApi.mood('sleep')
+    mvr.advance(400, 100)
+    const mvrRoot = mvr.find('wisp-root')
+    const mvrMotion = mvr.all('wisp-video').find((el) => el.removed !== true) ?? null
+    check(mvrMotion !== null && mvrMotion.tagName === 'IMG' && mvrMotion.style.display === 'none',
+      'under prefers-reduced-motion the motion layer never goes on screen (an <img> has no other way to be frozen)',
+      `${String(mvrMotion?.tagName)} display=${mvrMotion?.style.display}`)
+    check(mvrRoot.querySelectorAll('.wisp-img').length === 1 && mvrApi.doctor().motion.frame.frozen === true,
+      'and the static sprite is the whole picture, with doctor() saying why',
+      `sprites=${mvrRoot.querySelectorAll('.wisp-img').length} doctor.frozen=${mvrApi.doctor().motion.frame.frozen}`)
+    check(mvrRoot.dataset.frame === undefined
+      && String(mvrRoot.querySelector('.wisp-img')?.style?.visibility ?? '') !== 'hidden',
+    'and under reduced motion the sprite is visible — the animation never takes the picture (v1.45.2)',
+    `inline=${String(mvrRoot.querySelector('.wisp-img')?.style?.visibility ?? '') || '(unset)'} data-frame=${String(mvrRoot.dataset.frame)}`)
+    mvrApi.destroy()
+    active = mv
+
+    /* ---- 加载失败：静默降级，不冒泡、不留一个空盒子 ---- */
+    let mvErrThrow = null
+    try { mvMotion.dispatch('error', {}) } catch (error) { mvErrThrow = error }
+    check(mvErrThrow === null && mvMotion.style.display === 'none'
+      && mvRoot.querySelectorAll('.wisp-img').length === 1,
+    'a clip that fails to load degrades silently: the motion layer hides, the sprite stays, nothing throws',
+    `threw=${mvErrThrow === null ? 'no' : String(mvErrThrow.message)} display=${mvMotion.style.display}`)
+    /* 失败是**静默**的，所以"兜底真的看得见"必须是个断言：动图这一层退场之后，
+       立绘要回到画面上（visibility 回 visible），而不是留下一个空盒子。 */
+    check(mvMotion.style.display === 'none' && mvVis(mvImg) === 'visible'
+      && mvRoot.dataset.frame === undefined && mvImg.style.visibility !== 'hidden',
+    'and the failed clip hands the picture back: the motion layer is gone and the sprite is visible again, silently (v1.45.2)',
+    `motion=${mvMotion.style.display} sprite=${mvVis(mvImg)} inline=${mvImg?.style.visibility || '(unset)'} data-frame=${String(mvRoot.dataset.frame)}`)
+    check(mvApi.doctor().motion.frame.spriteHidden === false,
+      'and doctor() says the sprite owns the picture again, not just that the motion layer is gone (v1.45.2)',
+      JSON.stringify(mvApi.doctor().motion.frame))
+    check(mvApi.doctor().motion.frame.failed === true,
+      'and doctor() reports the degraded frame animation instead of leaving it a mystery',
+      JSON.stringify(mvApi.doctor().motion.frame))
+    /* 失败之后不再反复重试：重试一个已经坏掉的源只会每 1.2 秒烧一次解码。 */
+    mvApi.mood('idle')
+    mvApi.mood('sleep')
+    mv.advance(200, 100)
+    check(mvMotion.style.display === 'none' && mvLive() === mvMotion,
+      'and it is not re-created or retried on the next nap', `display=${mvMotion.style.display}`)
+    /* 失败是**按素材**记的（v1.46.5）：坏掉的是睡着那一段，站着那段没坏 —— 她醒着的时候
+       照常动。把"失败"做成一个全局开关的实现在这里会露出来（她会从此一辈子不动）。 */
+    mvApi.mood('idle')
+    mv.advance(200, 100)
+    check(mvLive() === mvMotion && mvMotion.dataset.clip === 'idle'
+      && mvMotion.style.display !== 'none' && mvApi.doctor().motion.frame.failed === false,
+      'the failure belongs to the clip, not to the layer: the standing loop still plays after the sleeping one died (v1.46.5)',
+      `clip=${String(mvMotion.dataset.clip)} display=${mvMotion.style.display || '(default)'} doctor.failed=${mvApi.doctor().motion.frame.failed}`)
+    /* 动图这一层**一次 play()/pause() 都不该出现**：那是媒体通道的 API，图片路径上没有它，
+       也不该有人偷偷搭一条回来。替身把每一次 play/pause 记在 harness 上，所以"一次都没有"
+       在这里是能数出来的事实，而不是从源码里读出来的一句话。 */
+    check(mv.videoPlays.length === 0 && mv.videoPauses.length === 0,
+      'the motion layer never calls play()/pause() — the media pipeline is gone, not merely unused',
+      `${mv.videoPlays.length} play(s), ${mv.videoPauses.length} pause(s) across the whole section`)
+    mvApi.destroy()
+    active = keepMv
+
     /* ------------------------------------------------------ 3g. teardown --- */
+    /* ---- 冻结规则之三（v1.47.0）：独立的「帧动画」开关 ----------------------
+       动图是画面里唯一会自己动的东西，所以它有一个**只管画面**的开关。关掉之后
+       画面交给静态立绘，而呼吸 / 一次性动作照旧（幅度档一个字没动）—— 这正是它
+       和「动作幅度 → 静止」的分工。四个冻结来源共用 motionFrozen() 那一处判断。 */
+    {
+      const fv = createHarness({ timer: true, composerText: '' })
+      const keepFv = active
+      active = fv
+      fv.evaluate(clientSrc)
+      fv.module().default.apply(fv.ctx, { reactions: false, wander: false, celebrate: false })
+      fv.advance(1200, 100)
+      const fvApi = fv.win.__wisp
+      const fvRoot = fv.find('wisp-root')
+      const fvMotion = () => fv.all('wisp-video').find((el) => el.removed !== true) ?? null
+      const fvImg = () => fv.all('wisp-img').find((el) => el.removed !== true) ?? null
+
+      check(fvApi.doctor().motion.frame.enabled === true && fvApi.doctor().motion.frame.showing === true,
+        'the frame animation is on by default', JSON.stringify(fvApi.doctor().motion.frame))
+
+      fvApi.configure({ frame: false })
+      const fvOff = fvApi.doctor().motion
+      check(fvOff.frame.enabled === false && fvOff.frame.showing === false
+        && fvOff.frame.frozen === true
+        && fvMotion() !== null && fvMotion().style.display === 'none',
+      'switching the frame animation off takes it off screen at once — no reload needed',
+      'enabled=' + fvOff.frame.enabled + ' showing=' + fvOff.frame.showing + ' display=' + (fvMotion() && fvMotion().style.display))
+      check(mvVis(fvImg()) === 'visible' && fvRoot.dataset.frame === undefined,
+        'and the static sprite is what is left on screen — the same hand-over as any other freeze',
+        'sprite=' + mvVis(fvImg()) + ' data-frame=' + String(fvRoot.dataset.frame))
+      check(fvOff.level === 'full' && fvOff.amp === 1,
+        'while the amplitude level is untouched: this switch only takes the animated frames away',
+        'level=' + fvOff.level + ' amp=' + fvOff.amp)
+
+      fvApi.configure({ frame: true })
+      check(fvApi.doctor().motion.frame.enabled === true && fvApi.doctor().motion.frame.showing === true
+        && mvVis(fvImg()) === 'hidden' && fvRoot.dataset.frame === 'on',
+      'switching it back on resumes the same element and hands it the picture again',
+      'showing=' + fvApi.doctor().motion.frame.showing + ' sprite=' + mvVis(fvImg()) + ' data-frame=' + String(fvRoot.dataset.frame))
+
+      fv.win.__wisp.destroy()
+      active = keepFv
+    }
+
+    /* ---- 3f-quater. 泳装：素材按**皮肤+状态**点（v1.47.0）------------------------
+       这一版最容易错的不是"素材没生成"，而是**接错了**：泳装立绘配通用那段循环
+       （穿着泳装播别的皮肤的动作），或者换了皮肤只换了图、没换动图那一层。
+       两条都在画面上不报错，所以这里逐个状态点一遍，而且查的是"图 + 几何"两样。 */
+    {
+      const sw = createHarness({ timer: true, composerText: '' })
+      const keepSw = active
+      active = sw
+      sw.evaluate(clientSrc)
+      sw.module().default.apply(sw.ctx, { skin: 'swim', reactions: false, wander: false, celebrate: false })
+      sw.advance(1200, 100)
+      const swApi = sw.win.__wisp
+      const swRoot = sw.find('wisp-root')
+      const swMotion = () => sw.all('wisp-video').find((el) => el.removed !== true) ?? null
+      const swSprite = () => sw.all('wisp-img').find((el) => el.removed !== true) ?? null
+      const fitMap = (() => {
+        const src = (/const MOTION_FIT = (\{[^}]*\})/.exec(clientSrc) ?? [])[1]
+        try { return src ? new Function(`return ${src}`)() : {} } catch (error) { return {} }
+      })()
+      check(swApi.skin === 'swim' && swRoot.dataset.mood === 'idle',
+        'a companion can start on the swimsuit skin and land in the idle state',
+        `skin=${String(swApi.skin)} mood=${String(swRoot.dataset.mood)}`)
+
+      /* 素材在不在，决定这一段**查什么**（见文件上方 SHIPPED_SWIM）：
+         八条都在 -> 逐条查"图 + 几何"；
+         一条都没有 -> 查她**静默降级**，而且**不许**退回通用那段循环（穿着泳装播别的
+                       皮肤的动作，比不动更糟）。两条路都是真的断言，没有空过的一档。 */
+      const SWIM = [
+        ['idle', 'swim_idle'], ['attn', 'swim_attn'], ['happy', 'swim_happy'],
+        ['sleep', 'swim_sleepy'], ['alert', 'swim_work'], ['proud', 'swim_proud'],
+        ['eat', 'swim_eat'], ['poked', 'swim_poked'],
+      ]
+      if (SHIPPED_SWIM.length === 8) {
+      const wrongClip = []
+      const wrongSrc = []
+      const wrongFit = []
+      const wrongOwner = []
+      for (const [state, clip] of SWIM) {
+        swApi.mood(state)
+        sw.advance(300, 100)
+        const m = swMotion()
+        if (String(m?.dataset?.clip ?? '') !== clip) wrongClip.push(`${state}→${String(m?.dataset?.clip)}`)
+        const wantSrc = `http://127.0.0.1:19387/wisp-motion/${clip}.webp`
+        if (String(m?.src ?? '') !== wantSrc) wrongSrc.push(`${state}→${String(m?.src)}`)
+        /* 几何跟着**素材**走：MOTION_FIT 里有就用它，没有就是 none（"不校正"是
+           显式规则，不是"忘了写"）—— 换源不换几何就是 v1.46.5 抓到过的那条。 */
+        if (String(m?.style?.transform ?? '') !== (fitMap[clip] ?? 'none')) {
+          wrongFit.push(`${state}: ${String(m?.style?.transform)} vs ${fitMap[clip] ?? 'none'}`)
+        }
+        if (m === null || m.style.display === 'none' || mvVis(swSprite()) !== 'hidden') {
+          wrongOwner.push(`${state}: display=${String(m?.style?.display)} sprite=${mvVis(swSprite())}`)
+        }
+      }
+      check(wrongClip.length === 0,
+        'all eight swimsuit states build THEIR OWN clip — the layer names the clip the skin+state maps to',
+        wrongClip.length ? wrongClip.join(' | ') : SWIM.map(([s, c]) => `${s}=${c}`).join(', '))
+      check(wrongSrc.length === 0,
+        'and each one loads it from the host route, resolved from the page base — no inlined bytes, no stale source',
+        wrongSrc.length ? wrongSrc.join(' | ') : `e.g. ${String(swMotion()?.src)}`)
+      check(wrongFit.length === 0,
+        'and the geometry is chosen PER CLIP — switching the source rewrites the transform with it (v1.46.5 rule, swimsuit edition)',
+        wrongFit.length ? wrongFit.join(' | ') : `fit=${JSON.stringify(fitMap)}`)
+      check(wrongOwner.length === 0,
+        'and while a swimsuit clip plays, the static swimsuit sprite is out of the picture — one of her, never two',
+        wrongOwner.length ? wrongOwner.join(' | ') : `sprite=hidden · data-frame=${String(swRoot.dataset.frame)}`)
+      check(swApi.doctor().motion.frame.asset === 'swim_poked'
+        && String(swApi.doctor().motion.frame.src).endsWith('/wisp-motion/swim_poked.webp'),
+        'and doctor() reports both the clip name and where it came from, so "why is she still" is answerable',
+        JSON.stringify(swApi.doctor().motion.frame))
+
+      /* 没有素材的状态：worried 在这个皮肤上也没有动作段（它有自己的抖动）——
+         这一层必须**藏起来**、立绘回到画面，而不是留一个空盒子。 */
+      swApi.mood('worried')
+      sw.advance(300, 100)
+      check(swMotion() === null || swMotion().style.display === 'none',
+        'a swimsuit state with no clip takes the frame layer off screen and hands the picture back',
+        `display=${String(swMotion()?.style?.display)} sprite=${mvVis(swSprite())}`)
+
+      /* 换皮肤 = 换一整套**动图**（v1.47.0）：只换图不换动图层，是这一版最容易漏的一处。
+         两个方向一起点：泳装 → 通用（回到 idle/sleepy），这也是"图与几何一起换"的证据。 */
+      swApi.mood('sleep')
+      sw.advance(300, 100)
+      const swimSleepTransform = String(swMotion()?.style?.transform ?? '')
+      const beforeSkinClip = String(swMotion()?.dataset?.clip ?? '')
+      swApi.setSkin('deepsea')
+      sw.advance(300, 100)
+      check(String(swMotion()?.dataset?.clip ?? '') === 'sleepy'
+        && String(swMotion()?.src ?? '') === 'http://127.0.0.1:19387/wisp-motion/sleepy.webp'
+        && String(swMotion()?.style?.transform ?? '') === 'scale(1.186) translateY(7.84%)'
+        && swimSleepTransform !== String(swMotion()?.style?.transform ?? ''),
+        'switching the skin re-points the SAME frame layer at that skin’s clip — picture AND geometry change together (v1.47.0)',
+        `${beforeSkinClip} ${swimSleepTransform} → ${String(swMotion()?.dataset?.clip)} ${String(swMotion()?.style?.transform)}`)
+      check(swApi.setSkin('swim') === true && String(swMotion()?.dataset?.clip ?? '') === 'swim_sleepy',
+        'and switching back returns the swimsuit loop, not the shared one',
+        String(swMotion()?.dataset?.clip))
+      } else {
+        /* 素材还没生成（0/8）：泳装那一档**一条动图都不该建**，而且**不许**退回通用
+           那段循环 —— 她是穿着泳装的人，播别的皮肤的动作比不动更糟。这一条查的就是
+           "按皮肤点素材"这件事本身：换一套皮肤，同一个元素该出现/消失。 */
+        const leaked = []
+        const silent = []
+        for (const [state] of SWIM) {
+          swApi.mood(state)
+          sw.advance(300, 100)
+          const m = swMotion()
+          if (m !== null && m.style.display !== 'none') leaked.push(`${state}:${String(m.dataset.clip)}`)
+          if (mvVis(swSprite()) !== 'visible' || swRoot.dataset.frame === 'on') {
+            silent.push(`${state}: sprite=${mvVis(swSprite())} frame=${String(swRoot.dataset.frame)}`)
+          }
+        }
+        check(leaked.length === 0,
+          'with no swimsuit clips shipped, NONE of the eight states plays a clip — the shared loop never leaks onto the swimsuit skin (v1.47.0)',
+          leaked.length ? leaked.join(' | ') : `0/8 clips built across ${SWIM.length} states`)
+        check(silent.length === 0 && swApi.doctor().motion.frame.asset === null,
+          'and the static swimsuit sprite keeps the picture the whole time — the documented silent degradation, not an empty box',
+          silent.length ? silent.join(' | ') : `sprite visible, data-frame=${String(swRoot.dataset.frame)}, doctor.asset=null`)
+        /* 反面：同一套素材在**别的皮肤**上照旧播 —— 上一条若是"动图整个坏了"，
+           这里会红。两件事必须分得开："这个皮肤没有素材"和"帧动画坏了"。 */
+        swApi.mood('sleep')
+        sw.advance(300, 100)
+        const swimSleepQuiet = swMotion() === null || swMotion().style.display === 'none'
+        swApi.setSkin('deepsea')
+        sw.advance(300, 100)
+        check(swimSleepQuiet && String(swMotion()?.dataset?.clip ?? '') === 'sleepy'
+          && String(swMotion()?.src ?? '') === 'http://127.0.0.1:19387/wisp-motion/sleepy.webp',
+          'and switching to a skin WITH clips brings the frame animation straight back — missing swimsuit art is not a broken frame layer',
+          `swim/sleep -> ${swimSleepQuiet ? 'no clip' : String(swMotion()?.dataset?.clip)}; deepsea/sleep -> clip=${String(swMotion()?.dataset?.clip)}`)
+      }
+
+      sw.win.__wisp.destroy()
+      active = keepSw
+    }
+
     head('3g. teardown')
 
     const liveBefore = h.pendingTimers().length
@@ -2864,7 +3849,9 @@ if (clientSrc !== null) {
       'exactly one companion is mounted', `${layers.filter((l) => l.parentNode === h.bodyEl).length} attached`)
     const second = h.win.__wisp
     check(second !== api && typeof second?.destroy === 'function', 'the handle points at the new instance')
-    const freshSrcs = h.srcs.slice(-1)
+    /* v1.47.0：挂载时最后写的一次 src 是**动图**那条路由（idle 有素材），所以这里
+       要看的是立绘那一串 —— 这条断言问的是"新实例有没有拿到被吊销的 blob"。 */
+    const freshSrcs = spriteSrcs().slice(-1)
     check(freshSrcs[0]?.startsWith('blob:') && !h.revoked.includes(freshSrcs[0]),
       'the re-mount is not handed a revoked blob URL', String(freshSrcs[0]))
     const restored = second.position
@@ -3042,7 +4029,7 @@ if (clientSrc !== null) {
     check(collapse('外观'), 'close the skin group again')
     check(expand('行为'), 'the behaviour group opens')   /* 开关都在这一组里 */
     const switchOf = (key) => itemsOf().find((i) => i.dataset && i.dataset.switchKey === key)
-    const switchKeys = ['wander', 'reactions', 'celebrate', 'hungry', 'night']
+    const switchKeys = ['frame', 'wander', 'reactions', 'celebrate', 'hungry', 'night']
     check(switchKeys.every((k) => switchOf(k) !== undefined), 'every behaviour has a switch row',
       switchKeys.map((k) => k + '=' + (switchOf(k) ? '有' : '无')).join(' '))
     const wanderSwitch = switchOf('wander')
@@ -3068,6 +4055,20 @@ if (clientSrc !== null) {
     flipped.dispatch('click', itemEvent())
     check(fifth.config.wander === wanderBefore, 'toggling back restores it', String(fifth.config.wander))
 
+    /* 帧动画那一格（v1.47.0）：点一下 config 翻面，画面**当场**跟着走（不用刷新）。 */
+    const frameSwitch = switchOf('frame')
+    const frameBefore = fifth.config.frame
+    frameSwitch.dispatch('click', itemEvent())
+    check(fifth.config.frame === !frameBefore
+      && fifth.doctor().motion.frame.enabled === (fifth.config.frame !== false)
+      && fifth.doctor().motion.frame.showing === (fifth.config.frame !== false),
+    'the frame-animation switch flips its own config, and the picture follows immediately',
+    frameBefore + ' -> ' + fifth.config.frame + ' / enabled=' + fifth.doctor().motion.frame.enabled)
+    switchOf('frame').dispatch('click', itemEvent())
+    check(fifth.config.frame === frameBefore
+      && fifth.doctor().motion.frame.showing === true,
+    'and toggling it back hands the picture back to the animation', String(fifth.config.frame))
+
     /* ---- 滑块：连续量直接调，键盘也能调，而且不关菜单 ---- */
     const sliderEl = menuOf().querySelector ? menuOf().querySelector('.wisp-slider') : null
     check(sliderEl !== null && sliderEl.getAttribute('role') === 'slider',
@@ -3108,8 +4109,8 @@ if (clientSrc !== null) {
     check(focusSlider(), 'the slider is reachable with the arrow keys',
       h.document.activeElement ? String(h.document.activeElement.className) : '(没有焦点)')
     pressKey('ArrowRight')
-    check(Math.abs(fifth.config.size - (sizeBefore + 0.25)) < 1e-9,
-      'ArrowRight grows her by a quarter step', `${sizeBefore} -> ${fifth.config.size}`)
+    check(Math.abs(fifth.config.size - (sizeBefore + 0.1)) < 1e-9,
+      'ArrowRight grows her by exactly one step', `${sizeBefore} -> ${fifth.config.size}`)
     check(menuOf() !== null && focusedIsSlider(),
       'and it neither closes the menu nor steals focus from the slider',
       menuOf() === null ? '菜单关了' : String(h.document.activeElement && h.document.activeElement.className))
@@ -3276,7 +4277,7 @@ if (clientSrc !== null) {
     check(expand('外观'), 'and the skins group can be opened')
     const skinBefore = fifth.skin
     const posBefore = fifth.position
-    const srcBeforeSkin = h.srcs[h.srcs.length - 1]
+    const srcBeforeSkin = spriteSrcs().at(-1)
     /* 同样不写死名字：挑一套「和当前不同」的皮肤，用它的显示名去点菜单 */
     const targetSkin = fifth.skins.find((id) => id !== skinBefore)
     const targetLabel = fifth.skinLabels.find((s) => s.id === targetSkin).label
@@ -3285,8 +4286,8 @@ if (clientSrc !== null) {
     targetEl.dispatch('click', itemEvent())
     check(fifth.skin === targetSkin, 'choosing a skin switches to it', String(fifth.skin))
     check(fifth.skin !== skinBefore, 'and it is a different skin than before', `${skinBefore} -> ${fifth.skin}`)
-    check(h.srcs[h.srcs.length - 1] !== srcBeforeSkin, 'the sprite is swapped for the new skin',
-      `${String(srcBeforeSkin).slice(0, 22)} -> ${String(h.srcs[h.srcs.length - 1]).slice(0, 22)}`)
+    check(spriteSrcs().at(-1) !== srcBeforeSkin, 'the sprite is swapped for the new skin',
+      `${String(srcBeforeSkin).slice(0, 22)} -> ${String(spriteSrcs().at(-1)).slice(0, 22)}`)
     check(fifth.position.x === posBefore.x && fifth.position.y === posBefore.y,
       'switching skins leaves her where she was', `${fifth.position.x},${fifth.position.y}`)
     check(JSON.parse(h.win.localStorage.getItem('dsh-wisp:skin:v1') || 'null')?.id === targetSkin,
@@ -3307,7 +4308,7 @@ if (clientSrc !== null) {
     }
     h.win.dispatch('keydown', { key: 'ArrowRight', preventDefault() {}, stopPropagation() {} })
     h.win.dispatch('keydown', { key: 'ArrowRight', preventDefault() {}, stopPropagation() {} })
-    check(fifth.element.style.width === '630px' && fifth.element.style.height === '945px',
+    check(fifth.element.style.width === '588px' && fifth.element.style.height === '882px',
       'the slider really resized her (two steps up)', `${fifth.element.style.width}x${fifth.element.style.height}`)
     check(menuOf() !== null, 'and the slider keeps the menu open, unlike an action row')
     h.win.dispatch('keydown', { key: 'Escape', preventDefault() {}, stopPropagation() {} })
@@ -3386,6 +4387,45 @@ if (clientSrc !== null) {
     check(h.document.activeElement?.getAttribute('tabindex') === '0',
       'her body is focusable, which is what makes the menu reachable without a mouse',
       String(h.document.activeElement?.getAttribute('tabindex')))
+    /* ---- 焦点环：不能是浏览器默认那个矩形 ------------------------------------
+       用户报的"有时会出现素材的矩形边界线"就是它：默认焦点环画在 .wisp-body 这个
+       560×840 的盒子上，而盒子里大部分是透明的 —— 屏幕上于是浮着一个套住素材的
+       矩形线框。修法是两半，缺一不可：默认环关掉（样式表 + 行内各一份），键盘焦点
+       改用**贴着剪影**的辉光表达（drop-shadow 跟的是 alpha 剪影，任何尺寸都不是矩形）。 */
+    const ringCss = String(h.styleInserts[0] ?? '')
+    check(/\.wisp-body:focus[^{]*\{[^}]*outline\s*:\s*(none|0)/.test(ringCss),
+      'the browser default focus ring is switched off for her box (it draws a rectangle around the sprite)',
+      (ringCss.match(/[^{}]*\.wisp-body:focus[^{]*\{[^}]*\}/) ?? ['(no such rule)'])[0].slice(0, 96))
+    check(body5.style.outline === 'none',
+      'and the inline mirror says the same, so a shell without the stylesheet does not get the box back',
+      String(body5.style.outline))
+    check(/\[data-focus="key"\]\{[^}]*--wisp-glow\s*:[^}]*drop-shadow\([^)]*var\(--wisp-accent\)/.test(ringCss)
+      && /\.wisp-img\{[^}]*filter:var\(--wisp-glow\)\s*var\(--wisp-sprite\)/.test(ringCss),
+      'keyboard focus stays visible: an accent halo that follows her silhouette instead of a box',
+      (ringCss.match(/\[data-focus="key"\]\{[^}]*\}/) ?? ['(no such rule)'])[0].slice(0, 96))
+    /* Esc 关掉菜单 = 键盘路径：焦点交还给她，指示必须亮（上面刚走完这条路）。 */
+    check(fifth.element.dataset.focus === 'key',
+      'focus handed back by the keyboard lights the halo',
+      String(fifth.element.dataset.focus))
+    /* 鼠标点她也会把焦点交给她（onDown 里的 focusHer）—— 那一下**什么都不该画**，
+       否则就退回用户看到的那条矩形边界线。 */
+    body5.blur()
+    h.win.dispatch('pointerdown', { clientX: 400, clientY: 300 })
+    body5.focus()
+    check(fifth.element.dataset.focus === undefined,
+      'a pointer-driven focus paints nothing at all — no box, no halo',
+      String(fifth.element.dataset.focus))
+    /* 反过来也必须成立：关掉默认环**不能**变成"键盘用户什么都看不见"。 */
+    body5.blur()
+    h.win.dispatch('keydown', { key: 'Tab' })
+    body5.focus()
+    check(fifth.element.dataset.focus === 'key',
+      'and keyboard focus lights it again — switching the default ring off must not blind keyboard users',
+      String(fifth.element.dataset.focus))
+    body5.blur()
+    check(fifth.element.dataset.focus === undefined,
+      'the halo is gone the moment focus leaves her',
+      String(fifth.element.dataset.focus))
 
     /* ---- 键盘入口：声明了 role="menu" 就得有办法用键盘打开它 ---------------- */
     const bodyKey = (key, opts = {}) => body5.dispatch('keydown', Object.assign(
@@ -3708,10 +4748,24 @@ if (clientSrc !== null) {
     check(counts.say <= 1, 'at most one speech bubble exists', `${counts.say}`)
     check(counts.img <= 2, 'at most the two cross-fade layers exist', `${counts.img}`)
 
-    /* 皮肤来回换 120 次，如果 blob URL 每轮都新建，这里会是 120+ —— 缓存命中应该是常数 */
-    check(soak.urLs.length <= 12,
+    /* 皮肤来回换 120 次，如果 blob URL 每轮都新建，这里会是 120+ —— 缓存命中应该是常数。
+       上限 12 -> 13：v1.45.0 起那段帧动画素材也走同一条 Blob 通道，它**只该解一次**
+       （这一轮里她睡着了 60 次）。v1.46.5 再 +1 = 14：idle 也接上了素材（挂载时解一次，
+       120 轮里她醒着 60 次，一次都不该重解）。
+       **v1.47.0 起动图不再走 Blob**（它是宿主路由下的文件 URL），所以这个数只数立绘
+       —— 14 这个上界照旧成立，只是现在有了富余。 */
+    check(soak.urLs.length <= 14,
       'switching skins reuses cached blob URLs instead of minting new ones',
       `${soak.urLs.length} object URLs ever created across ${Array.isArray(api.skins) ? api.skins.length : 0} skins and ${CYCLES} switches`)
+    /* 反过来钉"没有被内联回来"：只要有一份 MB 级的 image/webp blob，就说明构建又把
+       素材塞进单文件了 —— 那正是 1.47.0 要修的那件事（八条泳装 +30 MB ⇒ ~45 MB）。
+       同时要求这一轮里动图的 src **一直是那条路由**：换皮肤、换状态都不许退回 data:。 */
+    const soakClipBlobs = soak.blobs.filter((b) => String(b.type) === 'image/webp' && b.size > 1024 * 1024)
+    const soakMotion = soak.srcs.filter((s) => typeof s === 'string' && s.indexOf('/wisp-motion/') >= 0)
+    check(soakClipBlobs.length === 0 && soakMotion.length > 0
+      && soakMotion.every((s) => /^http:\/\/127\.0\.0\.1:19387\/wisp-motion\/[A-Za-z0-9._-]+\.webp$/.test(s)),
+      'every frame-animation source stays on the host route across the whole soak - nothing multi-megabyte is decoded or inlined (v1.47.0)',
+      `${soakClipBlobs.length} MB-scale clip blob(s); ${soakMotion.length} route src(s)`)
 
     soakApi.destroy()
     check(soak.pendingTimers().length === 0 && soak.revoked.length === soak.urLs.length,
@@ -3790,15 +4844,24 @@ head('3y. dialogs: about her, and the action preview')
 
   const eatCell = cells.find((c) => c.dataset.mood === 'eat')
   eatCell.dispatch('click', { preventDefault() {}, stopPropagation() {} })
-  check(dlgApi.dialog === null, 'clicking an action closes the dialog so you can see her')
+  check(dlgApi.dialog === 'actions',
+    'clicking an action KEEPS the dialog open — you can try several in a row (v1.47.1)',
+    String(dlgApi.dialog))
   check(dlgApi.currentMood === 'eat', 'and she takes that pose', String(dlgApi.currentMood))
   dlg.advance(1500, 100)
   check(dlgApi.currentMood === 'eat',
     'the reaction poll leaves the preview alone while it lasts', String(dlgApi.currentMood))
+
+  /* 连续预览：同一个窗口里再点第二个动作，表情跟着换，窗仍然开着。 */
+  const happyCell = dlg.all('wisp-cell').filter((el) => el.removed !== true).find((c) => c.dataset.mood === 'happy')
+  happyCell.dispatch('click', { preventDefault() {}, stopPropagation() {} })
+  check(dlgApi.dialog === 'actions' && dlgApi.currentMood === 'happy',
+    'a second click previews the next action without reopening anything',
+    'dialog=' + String(dlgApi.dialog) + ' mood=' + String(dlgApi.currentMood))
   dlg.advance(9000, 500)
-  check(dlgApi.currentMood !== 'eat', 'and the preview does not stick forever', String(dlgApi.currentMood))
+  check(dlgApi.currentMood !== 'happy', 'and the preview does not stick forever', String(dlgApi.currentMood))
 
-  dlgApi.openActions()
+  /* 关窗仍有三条路，先验右上角那个 ×（窗还开着，不用重开） */
   const x = dlg.find('wisp-dialog-x')
   check(x !== null, 'the close button is there')
   x.dispatch('click', { preventDefault() {} })
@@ -4187,6 +5250,33 @@ head('3y-3. the focus timer, and going quiet while the page is hidden')
   check(typeof quietApi.today.runs === 'number' && quietApi.today.runs >= 1,
     'the day book is also readable from the api', JSON.stringify(quietApi.today))
 
+  /* ---- 语言判定不能取决于 Node 版本 -------------------------------------------
+     Node 21+ 自带全局 navigator（navigator.language = 系统语言）。harness 若不把它注入到
+     被求值的作用域里，客户端读到的就是 Node 的 —— 于是同一份代码在中文开发机上绿、
+     在英文 runner 上红。这条把 Node 的 navigator 特意伪装成 en-US，再断言她仍然按
+     harness 自己的（没有 language 的）navigator 说中文。 */
+  const nodeNav = Object.getOwnPropertyDescriptor(globalThis, 'navigator')
+  try {
+    Object.defineProperty(globalThis, 'navigator', {
+      value: { language: 'en-US', languages: ['en-US'] }, configurable: true, writable: true,
+    })
+    const nodeNavHarness = createHarness({ timer: true, composerText: '' })
+    const keepNodeNav = active
+    active = nodeNavHarness
+    nodeNavHarness.evaluate(clientSrc)
+    nodeNavHarness.module().default.apply(nodeNavHarness.ctx, { reactions: false, wander: false, celebrate: false })
+    nodeNavHarness.advance(1000, 200)
+    const nodeNavSaid = String(nodeNavHarness.all('wisp-say').at(-1)?.textContent ?? '')
+    check(/[\u4e00-\u9fa5]/.test(nodeNavSaid),
+      'the harness hands the client its OWN navigator — Node 21+ has a global one and would leak its locale',
+      `${nodeNavSaid.slice(0, 40)} ｜ Node navigator=${globalThis.navigator.language}`)
+    nodeNavHarness.win.__wisp.destroy()
+    active = keepNodeNav
+  } finally {
+    if (nodeNav) Object.defineProperty(globalThis, 'navigator', nodeNav)
+    else delete globalThis.navigator
+  }
+
   /* ---- 英文台词：英文环境下她说英文，而且**一个汉字都不该出现** -------------------
      语言是加载时判定的（读 navigator.language），所以这个 harness 要在 evaluate 之前
      把 navigator 摆好。中文是兜底：没翻的条目仍然会说中文，这一条只验"翻译层真的生效"。 */
@@ -4294,6 +5384,257 @@ if (patchPath && existsSync(patchPath)) {
 if (!pkg.dsh?.client?.inject && !pkg.dsh?.client?.shared) ok('no inject/shared declarations')
 else bad('inject/shared declared', 'a local-path install cannot satisfy them')
 
+/* ============================ 4b. 帧动画素材进包了吗 ====================== */
+
+head('4b. the clips ship as FILES — the bundle carries only their names (v1.47.0)')
+
+/* v1.47.0 换了**投递方式**：表里不再有 base64，只有文件名；字节留在
+   assets/motion/ 里，由宿主半包注册的 `/wisp-motion/` 路由发给页面。
+   两个数因此分开盯，各有各的预算：
+
+     ① **内联**：那张清单必须小到可以忽略（几条素材名，几十字节）。它曾经是
+        8015.8 KB（两段 base64，v1.46.5 实测）；八条泳装再内联会到 ~45 MB ——
+        所以这一条的上界是"几百字节"，不是"几 MB"。
+     ② **磁盘**：素材还是跟着包走的，涨了仍然要有人重新量一次。上界按**十条**估
+        （通用 2 + 泳装 8）：1.47.1 八条泳装落盘之后实测 **29800.0 KB / 29.1 MB**
+        （每条 2617.0~3398.2 KB，最大的是通用的 sleepy），所以上界收到 **34000 KB**
+        （33.2 MB，约 +14% 余量）。每次素材换代都要有人重新量一遍再改它，
+        而不是让它自己漂。
+
+   上界写在这里而不是 build.mjs 里：构建负责**报**体积，预检负责**判**体积，
+   一个数写两遍就是下一次漂移的起点。 */
+const MOTION_MANIFEST_BUDGET_BYTES = 2048
+const MOTION_DISK_BUDGET_KB = 34000
+{
+  const kb = (n) => (n / 1024).toFixed(1)
+  if (clientSrc === null) {
+    bad('the motion clips ship with the package', 'lib/client.js is missing')
+  } else {
+    /* 表必须真的能求值：正则匹配到一段文本、而文本是注释里的，是踩过的坑
+       （SPRITES 那次的注释占位符事故）。 */
+    const motionTable = clientSrc.match(/const MOTION = (\{[\s\S]*?\n {4}\})/)
+    let motionValue = null
+    try { motionValue = motionTable ? new Function(`return ${motionTable[1]}`)() : null } catch (error) { motionValue = null }
+    const keys = motionValue && typeof motionValue === 'object' ? Object.keys(motionValue) : []
+    /** 清单里那一条指向的文件名（不是 data URI —— 那是 1.46.5 的老形状）。 */
+    const clipFile = (k) => (typeof motionValue?.[k] === 'string' ? motionValue[k] : null)
+    const clipPath = (k) => (clipFile(k) === null ? null : join(here, 'assets', 'motion', clipFile(k)))
+    /* ① 表里只能是**文件名**：既有形状的检查，也是"没有被内联回来"的第一道。
+       值以 data: 开头 = 构建退回内联了（八条泳装那 ~30 MB 会重新进单文件）。 */
+    const named = keys.filter((k) => clipFile(k) !== null && /^[A-Za-z0-9][A-Za-z0-9._-]*\.webp$/.test(clipFile(k)))
+    const stillInlined = keys.filter((k) => typeof motionValue[k] === 'string' && motionValue[k].startsWith('data:'))
+    check(keys.length > 0 && named.length === keys.length && stillInlined.length === 0,
+      'every MOTION entry is a clip FILE NAME — the bytes are not in the bundle any more (v1.47.0)',
+      keys.length ? `${keys.join(', ')} → ${String(motionValue[keys[0]])}` : 'no MOTION table in the bundle')
+    /* **通用那两段都要在**（v1.46.5）：站着那一段和睡着那一段是两条独立的素材，
+       只进一条（或者 build 的发现规则又把 motion/ 当成皮肤跳过了）在页面上表现为
+       "她某个状态不动"，而那和"没有素材"长得一模一样。
+       v1.47.0 又多了泳装那八条 —— 它们由下面那条"谁在播"的反向检查兜住。 */
+    check(keys.includes('idle') && keys.includes('sleepy'),
+      'BOTH shared loops are still there — the standing one and the sleeping one',
+      keys.length ? keys.join(', ') : 'no clips at all')
+
+    /* ① 内联的那一份必须**小**。这是这一版存在的理由：清单 = 素材名，
+       八条泳装加进来也只多几十字节；换成字节就是 ~30 MB。 */
+    const inlineBytes = Object.entries(motionValue ?? {}).reduce((n, [k, v]) => n + String(k).length + String(v).length + 8, 0)
+    check(inlineBytes > 0 && inlineBytes <= MOTION_MANIFEST_BUDGET_BYTES,
+      `the inlined part is only a NAME LIST — ${MOTION_MANIFEST_BUDGET_BYTES} B budget (a 8015.8 KB base64 table is what it replaced)`,
+      `${inlineBytes} B for ${keys.length} clips`)
+
+    /* ② 磁盘上那八条 + 两条：素材仍然跟着包走，涨了要有第二个人重新量一次。 */
+    const onDiskBytes = keys.reduce((n, k) => {
+      const p = clipPath(k)
+      return n + (p !== null && existsSync(p) ? readFileSync(p).length : 0)
+    }, 0)
+    check(onDiskBytes > 0 && onDiskBytes <= MOTION_DISK_BUDGET_KB * 1024,
+      `and every clip it names really exists under assets/motion/, inside the ${MOTION_DISK_BUDGET_KB} KB disk budget`,
+      `${kb(onDiskBytes)} KB on disk for ${keys.length} clips`)
+
+    /* ---- 边缘平滑度不是"看起来"的事，是**编码参数**的事（v1.46.4）----
+       colorkey 的 blend 是边缘过渡带的半宽：0.02 那条带只有 0.04 的色距宽度，
+       边缘几乎是**一刀切** —— 1 bit 的 alpha 在 560px 的显示尺寸上就是一排台阶
+       （"硬边 = 锯齿"这条规矩钉在这里，也钉在 client.template.js 的 .wisp-video 注释里）。
+       查的是**文档里那条编码命令**：素材怎么来的可复现，这两条才有意义。
+       v1.46.5 把两条素材的过渡都收到 **0.05** —— 这是 **≥ 0.05 那条线的下限**，
+       不是"随手调小"：那段 soft band 是动画体积的**大头**（实测：sleepy 在 q:v 40 下
+       把 blend 归零，3405.7 KB → 1867.8 KB，省掉 45%）。收到下限、再把省下来的余量
+       花在**去幕布色**上，是这一版两段素材能同时进包的原因。
+       全不透明的阈值 sim+blend 保持原样（sleepy 0.24 / idle 0.38）—— 所以"她自己"
+       一个像素都没少（实测不透明占比 17.379% / 27.016%，和上一版逐位相同）。
+       只认那个写着 libwebp_anim 的代码块，免得命中变更日志里的历史参数。 */
+    /* 1.47.0：文档里有**两块**写着 libwebp_anim 的命令（泳装那八条一条配方 + 通用两条
+       的历史命令），所以这里查**每一块**：任何一条 posted 出去的编码命令都不许把 blend
+       压到 0.05 以下。泳装那条的幕布色是**采样**来的（`#<采样色>`），所以匹配要接受占位
+       形式的色值 —— 断言的是数字（similarity / blend），不是那个十六进制。 */
+    const pipelineDoc = existsSync(join(here, 'README.md')) ? readFileSync(join(here, 'README.md'), 'utf8') : ''
+    const pipelines = []
+    for (const m of pipelineDoc.matchAll(/```[a-z]*\n([\s\S]*?)```/g)) {
+      if (m[1].includes('libwebp_anim')) pipelines.push(m[1])
+    }
+    const colorkeys = pipelines
+      .flatMap((p) => [...p.matchAll(/colorkey=#(?:[0-9A-Fa-f]{6}|<[^>\n]+>):([\d.]+):([\d.]+)/g)])
+      .map((m) => ({ sim: m[1], blend: Number(m[2]) }))
+    check(colorkeys.length > 0 && colorkeys.every((k) => k.blend >= 0.05),
+      'every documented keying keeps a SOFT edge — blend >= 0.05, because a hard alpha cut IS the jagged edge (v1.46.4)',
+      colorkeys.length ? colorkeys.map((k) => `sim ${k.sim} blend ${k.blend}`).join(' · ') : 'no colorkey line in the documented motion pipeline')
+    /* 放宽过渡会把幕布的边一起放出来（绿幕：0.078% → 0.119%；品红幕：idle 那 1.09% 的
+       紫边就是这么来的）—— 所以那一步 RGB 去边是**配套的**，不是可选项。绿幕那条是
+       min(G, max(R,B))（和 tools/keyout.mjs 给立绘用的是同一条规则），品红幕那条把
+       "R、B 都比 G 高"的那一份减掉。两条都在文档里。 */
+    check(pipelines.some((p) => /geq=|despill/.test(p)),
+      'and the documented pipeline de-fringes the screen colour in RGB — a soft transition lets the curtain edge back in',
+      pipelines.length
+        ? (pipelines.map((p) => (p.split('\n').find((l) => /geq=|despill/.test(l)) ?? '').trim()).find((l) => l !== '') ?? '(no de-fringe line)').slice(0, 140)
+        : 'no motion pipeline block in README.md')
+
+    /* 投递的另一半：**宿主真的在发**（v1.47.0）。这条路由不在时她只会静默不动，
+       所以"注册了没有"不能靠读源码回答 —— 这里把 handler 拿出来、用真请求打一遍。 */
+    /* 两个半包对**同一条路由**必须说同一个名字：客户端解析 `wisp-motion/<文件>`，
+       宿主在 `/wisp-motion/` 上注册。这两个字符串写在不同文件里、构建也不查它们，
+       于是"改了一处忘了另一处"在页面上只会表现为她不动（静默降级），没有任何报错。
+       顺手把宿主那一半**真的跑一遍**：拿真字节过一遍 handler，状态码 / 内容类型 /
+       内容都必须对 —— 这是这条投递链上唯一会出错的地方。 */
+    const hostMod = await import(pathToFileURL(hostPath).href + '?probe=motion')
+    const clientRoute = (/const MOTION_ROUTE = '([^']+)'/.exec(clientSrc) ?? [])[1] ?? null
+    check(typeof hostMod.MOTION_PATH === 'string' && clientRoute !== null
+      && '/' + clientRoute === hostMod.MOTION_PATH,
+      'the client half and the host half name the SAME route — one string, two files',
+      `client "${String(clientRoute)}" vs host "${String(hostMod.MOTION_PATH)}"`)
+
+    const served = []
+    for (const key of keys) {
+      const file = clipFile(key)
+      const diskPath = clipPath(key)
+      const onDisk = diskPath !== null && existsSync(diskPath) ? readFileSync(diskPath) : null
+      const response = { status: 0, headers: null, body: null }
+      await hostMod.motionHandler(hostMod.defaultReadBytes)({ method: 'GET', url: `${hostMod.MOTION_PATH}${file}` }, {
+        writeHead(status, headers) { response.status = status; response.headers = headers },
+        end(chunk) { response.body = chunk ?? null },
+        destroy() {},
+      })
+      const body = response.body === null || response.body === undefined ? null : Buffer.from(response.body)
+      const identical = onDisk !== null && body !== null && body.length === onDisk.length && body.equals(onDisk)
+      if (response.status !== 200 || String(response.headers?.['content-type']) !== 'image/webp' || !identical) {
+        served.push(`${key}: ${response.status} ${String(response.headers?.['content-type'])} identical=${identical}`)
+      }
+    }
+    check(keys.length > 0 && served.length === 0,
+      'and the host route really serves each clip: 200, image/webp, bytes identical to the file on disk',
+      served.length ? served.join(' | ') : keys.map((k) => `${k} → ${hostMod.MOTION_PATH}${clipFile(k)}`).join(', '))
+    /* 它不是一个文件服务器：只有 assets/motion/ 下那一个名字、只有 GET/HEAD。 */
+    const refused = []
+    for (const [label, url, method, want] of [
+      ['traversal', `${hostMod.MOTION_PATH}../../package.json`, 'GET', 404],
+      ['nested', `${hostMod.MOTION_PATH}a/b.webp`, 'GET', 404],
+      ['non-webp', `${hostMod.MOTION_PATH}idle.png`, 'GET', 404],
+      ['bare prefix', hostMod.MOTION_PATH, 'GET', 404],
+      ['write', `${hostMod.MOTION_PATH}${clipFile(keys[0])}`, 'POST', 405],
+    ]) {
+      const response = { status: 0 }
+      await hostMod.motionHandler(hostMod.defaultReadBytes)({ method, url }, {
+        writeHead(status) { response.status = status }, end() {}, destroy() {},
+      })
+      if (response.status !== want) refused.push(`${label}: ${response.status} (want ${want})`)
+    }
+    check(refused.length === 0,
+      'and it stays a closed list — traversal, nested paths, other extensions and writes are all refused',
+      refused.length ? refused.join(' | ') : 'traversal/nested/non-webp/prefix → 404, POST → 405')
+
+    /* 磁盘上那份文件**真的是动图**（RIFF/WEBP + ANMF 帧块）：MIME 是写死的，
+       素材被换成一张静图时，"她不动了"会和"没有素材"长得一模一样。
+       顺手把**几何**也钉住（v1.46.4）：720x1280 / 97 帧 / 41ms 一帧（24fps）这三条是
+       "这份素材是怎么来的"的一部分 —— 换 q:v、换 colorkey 都可以，动这几条就是另一份
+       素材了；而"她变糊了"和"她掉帧了"在页面上都不会报错，只会有人某天觉得"她今天不太对"。
+       容器结构：VP8X 的画布宽高各 3 字节（存的是值-1），ANMF 的帧时长在块内偏移 12 处，
+       同样 3 字节、单位毫秒。 */
+    const animated = []
+    const geometry = []
+    for (const key of keys) {
+      const file = clipPath(key)
+      if (file === null || !existsSync(file)) continue
+      const onDisk = readFileSync(file)
+      const riff = onDisk.subarray(0, 4).toString('latin1') === 'RIFF' && onDisk.subarray(8, 12).toString('latin1') === 'WEBP'
+      let canvasW = 0
+      let canvasH = 0
+      let frames = 0
+      let firstDur = 0
+      for (let off = 12; off + 8 <= onDisk.length;) {
+        const id = onDisk.subarray(off, off + 4).toString('latin1')
+        const size = onDisk.readUInt32LE(off + 4)
+        if (id === 'VP8X') {
+          canvasW = onDisk.readUIntLE(off + 12, 3) + 1
+          canvasH = onDisk.readUIntLE(off + 15, 3) + 1
+        } else if (id === 'ANMF') {
+          frames += 1
+          if (firstDur === 0) firstDur = onDisk.readUIntLE(off + 20, 3)
+        }
+        off += 8 + size + (size % 2)
+      }
+      if (!riff || frames < 2) animated.push(`${key}: riff=${riff} frames=${frames}`)
+      if (`${canvasW}x${canvasH}` !== '720x1280' || frames !== 97 || Math.round(1000 / firstDur) !== 24) {
+        geometry.push(`${key}: ${canvasW}x${canvasH} / ${frames} frames / ${firstDur}ms`)
+      }
+    }
+    check(animated.length === 0,
+      'and it is an ANIMATED WebP (RIFF/WEBP with a chain of ANMF frames), not a still',
+      animated.length ? animated.join(' | ') : keys.map((k) => `${k}: ${readFileSync(clipPath(k)).toString('latin1').split('ANMF').length - 1} frames`).join(', '))
+    check(geometry.length === 0,
+      'and its geometry did not drift — 720x1280, 97 frames, 41ms each (24 fps): quality and keying may change, the frame budget may not (v1.46.4)',
+      geometry.length ? geometry.join(' | ') : keys.map((k) => `${k}: 720x1280 / 97 frames / 41 ms = 24 fps`).join(', '))
+
+    /* 谁在播哪一段（v1.47.0 起是**按皮肤**点的）。
+       正向：每个 `<皮肤>:<状态>` 指向的素材必须真的在清单里（打错一个字 = 那个状态
+       永远不动，而画面看不出错）。
+       反向：清单里**没有状态会播**的素材是白带的体积（磁盘预算里最贵的就是它）。 */
+    const moodMap = (/const MOTION_OF = (\{[^}]*\})/.exec(clientSrc) ?? [])[1]
+    let wired = null
+    try { wired = moodMap ? new Function(`return ${moodMap}`)() : null } catch (error) { wired = null }
+    const baseMap = (/const MOTION_BASE = (\{[^}]*\})/.exec(clientSrc) ?? [])[1]
+    let base = null
+    try { base = baseMap ? new Function(`return ${baseMap}`)() : null } catch (error) { base = null }
+    const wiredClips = [...Object.values(wired ?? {}), ...Object.values(base ?? {})]
+    /* 孤儿只算**这个包真的带了的**通用素材：没生成的泳装素材在表里写着是**对的**
+       （那正是接线），它在页面上走静默降级，不是坏行为。素材有没有是上面那条的事。 */
+    const orphans = Object.keys(wired ?? {}).filter((m) => !String(wired[m]).startsWith('swim_')
+      && typeof motionValue?.[wired[m]] !== 'string')
+    const badKeys = Object.keys(wired ?? {}).filter((m) => !/^[a-z]+:.+$/.test(m))
+    const unwired = keys.filter((k) => !wiredClips.includes(k))
+    check(wired !== null && base !== null && base.idle === 'idle' && base.sleep === 'sleepy'
+      && orphans.length === 0 && unwired.length === 0 && badKeys.length === 0,
+      'every <skin>:<state> is wired to a clip that is really shipped — and no clip ships that no state can play',
+      wired ? `${JSON.stringify(wired)} · base=${JSON.stringify(base)}${unwired.length ? ` · 没人播：${unwired.join(', ')}` : ''}${orphans.length ? ` · 查不到：${orphans.join(', ')}` : ''}` : 'no MOTION_OF map found')
+    /* 泳装那八条（v1.47.0）。判据是**磁盘上实际带着什么**（见文件上方 SHIPPED_SWIM）：
+       "一条都没生成"与"八条都在"都是合法状态 —— 前者走既有的静默降级（画面回到立绘），
+       半套才是坏的。所以这里查的是**接线与素材一一对上**，两个方向都查：
+         ① 每个泳装状态指向的素材，只要它在包里就必须真的能查到（名字打错一条 = 那个
+            状态永远不动，而画面不会报错）；
+         ② 包里每一条泳装素材都必须有状态会播（没人播 = 白带的体积）。 */
+    const swimKeys = Object.keys(wired ?? {}).filter((k) => k.startsWith('swim:'))
+    const swimClips = swimKeys.map((k) => wired[k])
+    const swimMissing = swimKeys.filter((k) => SHIPPED_SWIM.includes(`${wired[k]}.webp`)
+      && typeof motionValue?.[wired[k]] !== 'string')
+    const swimUnwired = SHIPPED_SWIM.map((f) => f.slice(0, -'.webp'.length))
+      .filter((c) => !Object.values(wired ?? {}).includes(c))
+    check(SHIPPED_SWIM.length === 0 || SHIPPED_SWIM.length === 8,
+      'the eight swimsuit clips ship as a SET — never half of them',
+      SHIPPED_SWIM.length
+        ? `${SHIPPED_SWIM.length} clip(s): ${SHIPPED_SWIM.join(', ')}`
+        : '0/8 generated yet — the swimsuit states fall back to the shared loops, silently by design')
+    check(swimKeys.length === 8 && new Set(swimKeys).size === 8
+      && (SHIPPED_SWIM.length === 0 || new Set(swimClips).size === 8)
+      && swimMissing.length === 0 && swimUnwired.length === 0,
+      'all eight swimsuit states are wired, each to its OWN clip — and every clip that ships has a state to play it (v1.47.0)',
+      `wired ${swimKeys.length}/8 · shipped ${SHIPPED_SWIM.length}/8`
+        + (swimUnwired.length ? ` · 没人播：${swimUnwired.join(', ')}` : '')
+        + (swimMissing.length ? ` · 查不到：${swimMissing.join(', ')}` : ''))
+
+    check(!/['"][^'"]*\.(webm|mp4|mov)['"]/.test(clientSrc),
+      'the bundle references no external video file', 'no .webm/.mp4/.mov string in the bundle')
+    check(!clientSrc.includes('__MOTION_LITERAL__'),
+      'no leftover motion placeholder', 'run `node build.mjs`')
+  }
+}
+
 /* ---- 5. shipping readiness: sprites inlined, attribution present ---- */
 
 head('5. redistribution readiness')
@@ -4319,6 +5660,143 @@ if (existsSync(join(here, 'README.md'))) {
     undeclared.length ? undeclared.join(' | ') : `${mentioned.length} tool(s) referenced, all in files[]`)
 }
 
+/* ---------------------------------------------------------------------------
+   1.43.0：一批修复各自的不变式。
+
+   每条修复背后都有一句"如果再犯就会露出来"的断言 —— 没有它，这些修复会在下一次
+   重构里悄悄退回原样（这批里有三条正是这么来的）。 */
+{
+  const h = createHarness({ timer: true, composerText: '', wanderMs: 150, wanderRange: 200 })
+  const keep = active
+  active = h
+  h.evaluate(clientSrc)
+  h.module().default.apply(h.ctx, { reactions: false, wander: true, celebrate: false })
+  h.advance(1200, 100)
+  const api = h.win.__wisp
+  const root = h.document.querySelector('.wisp-root')
+  const tiltDeg = () => {
+    const n = Number(String(root.style.getPropertyValue('--wisp-tilt') || '0deg').replace('deg', ''))
+    return Number.isFinite(n) ? n : 0
+  }
+
+  /* 脚底光晕在 motion 层、不在 lean 层：歪的是她，不该是地板 */
+  const shineEl = h.document.querySelector('.wisp-shine')
+  const motionEl = h.document.querySelector('.wisp-motion')
+  check(shineEl !== null && motionEl !== null && shineEl.parentNode === motionEl,
+    'the ground glow lives outside the tilt layer',
+    shineEl && shineEl.parentNode ? String(shineEl.parentNode.className) : '(missing)')
+
+  /* 静止档的 z：静止 ≠ 冻成满不透明 */
+  check(clientSrc.includes('.wisp-root[data-motion="off"] .wisp-zzz{opacity:.5}'),
+    'the still level shows a subdued z instead of a frozen opaque one')
+  const rmAt = clientSrc.indexOf('@media (prefers-reduced-motion:reduce)')
+  check(rmAt >= 0 && clientSrc.slice(rmAt, rmAt + 800).includes('.wisp-zzz{animation:none!important;opacity:.5}'),
+    'and reduced motion does the same for it')
+
+  /* 滑块的默认值必须落在步长格点上（否则用户动了就回不到出厂大小） */
+  const wheelStep = Number((/const WHEEL_STEP = ([0-9.]+)/.exec(clientSrc) ?? [])[1])
+  const keyStep = Number((/ev\.shiftKey \? 1 : ([0-9.]+)/.exec(clientSrc) ?? [])[1])
+  const sizeLo = Number((/size: \{ kind: 'num', lo: ([0-9.]+)/.exec(clientSrc) ?? [])[1])
+  const defaultsBlock = clientSrc.match(/const DEFAULTS = \{([\s\S]*?)\n {4}\}/)
+  const defSize = Number((/size:\s*([0-9.]+)/.exec(defaultsBlock ? defaultsBlock[1] : '') ?? [])[1])
+  check(wheelStep > 0 && wheelStep === keyStep, 'the wheel and the slider share exactly one step',
+    `wheel=${wheelStep} key=${keyStep}`)
+  const steps = (defSize - sizeLo) / wheelStep
+  check(Number.isFinite(steps) && Math.abs(steps - Math.round(steps)) < 1e-9,
+    'the DEFAULT size is reachable from lo in whole steps — otherwise a user can never get back to it',
+    `lo=${sizeLo} default=${defSize} step=${wheelStep} → ${steps} steps`)
+
+  /* 鼠标路过会侧身；手指路过不会（而且会把姿势归零）。
+     y 必须取她的**中线**：侧身有"从正上方路过不倾"这一层（level 因子），
+     在脚下 700px 处派发事件本来就该是 0 度 —— 那样测的是另一条规则。 */
+  const nearX = api.position.x + 280
+  const nearY = api.position.y + 420
+  h.win.dispatch('pointermove', { clientX: nearX + 24, clientY: nearY, pointerType: 'mouse' })
+  check(tiltDeg() !== 0, 'a mouse passing by still leans her', `${tiltDeg()}deg`)
+  h.win.dispatch('pointermove', { clientX: nearX + 24, clientY: nearY, pointerType: 'touch' })
+  check(tiltDeg() === 0, 'a finger passing by does not — and clears the pose', `${tiltDeg()}deg`)
+
+  /* 指针离开文档：姿势归零（blur 只覆盖"切走应用"） */
+  h.win.dispatch('pointermove', { clientX: nearX + 24, clientY: nearY, pointerType: 'mouse' })
+  check(tiltDeg() !== 0, 'leaning again before the pointer leaves', `${tiltDeg()}deg`)
+  h.document.dispatch('mouseleave', {})
+  check(tiltDeg() === 0, 'the pose resets when the pointer leaves the document', `${tiltDeg()}deg`)
+
+  /* 撞到边界不再"原地歪"：位置没变就不该有侧倾 */
+  api.move(1360, 300)
+  h.win.dispatch('pointerdown', {
+    clientX: 1360 + 280, clientY: 300 + 700, button: 0, pointerType: 'mouse',
+    preventDefault() {}, stopPropagation() {},
+  })
+  h.win.dispatch('pointermove', { clientX: 1360 + 280 + 60, clientY: 300 + 700, pointerType: 'mouse' })
+  check(api.position.x === 1360, 'a drag into the right edge stays clamped', String(api.position.x))
+  check(tiltDeg() === 0, 'and a clamped drag does not tilt her in place', `${tiltDeg()}deg`)
+  h.win.dispatch('pointerup', {})
+
+  /* 静止档也要停住 JS 溜达 —— CSS 关不掉坐标写入 */
+  api.configure({ motion: 'off', wander: true, wanderMs: 150, wanderRange: 200 })
+  const still = { x: api.position.x, y: api.position.y }
+  h.advance(4000, 100)
+  check(api.position.x === still.x && api.position.y === still.y,
+    'motion: off stops the walk too, not only the animation', `${api.position.x},${api.position.y}`)
+  api.configure({ motion: 'full' })
+  h.advance(6000, 100)
+  check(api.position.x !== still.x || api.position.y !== still.y,
+    'and with motion back on she strolls again', `${api.position.x},${api.position.y}`)
+
+  /* 拨开关之后子面板要留在原地（点开的就该一直开着）。
+     contextmenu 要派给**她的本体**（监听挂在 body 上），派给 window 不会走到那一层。 */
+  h.document.querySelector('.wisp-body').dispatch('contextmenu', {
+    clientX: api.position.x + 280, clientY: api.position.y + 420,
+    preventDefault() {}, stopPropagation() {},
+  })
+  const groupRow = h.all('wisp-menu-item').find((el) => el.dataset && el.dataset.group === '行为')
+  check(groupRow !== undefined, 'the behaviour group row is there to click', String(h.all('wisp-menu-item').length) + ' rows')
+  if (groupRow) {
+    groupRow.dispatch('click', { preventDefault() {}, stopPropagation() {} })
+    h.advance(60, 20)
+    const flyoutBefore = h.all('wisp-submenu').length
+    const aSwitch = h.all('wisp-switch')[0]
+    check(flyoutBefore > 0 && aSwitch !== undefined, 'its flyout is open with switches in it', String(flyoutBefore))
+    if (aSwitch) {
+      aSwitch.dispatch('click', { preventDefault() {}, stopPropagation() {} })
+      h.advance(60, 20)
+      check(h.all('wisp-submenu').length > 0,
+        'toggling a switch keeps the flyout open — the panel vanishing is the most annoying version of this',
+        `${h.all('wisp-submenu').length} panel(s)`)
+    }
+  }
+  api.destroy()
+  active = keep
+}
+
+/* GitHub 上更新、npm 上还是旧版时：提示要改口，并且复制的是仓库地址而不是包名 */
+{
+  const gh = createHarness({
+    timer: true, composerText: '', clipboard: true,
+    hostCall: async () => ({
+      ok: true, latest: '9.9.9', from: 'github',
+      sources: { npm: { ok: true, version: '1.0.0' }, github: { ok: true, version: '9.9.9' } },
+    }),
+  })
+  const keepGh = active
+  active = gh
+  gh.evaluate(clientSrc)
+  gh.module().default.apply(gh.ctx, { reactions: false, wander: false, celebrate: false })
+  gh.advance(1200, 100)
+  gh.win.__wisp.showUpdate()
+  await new Promise((resolve) => setImmediate(resolve))
+  gh.advance(200, 50)
+  check(gh.clipboardWrites[gh.clipboardWrites.length - 1] === 'https://github.com/969246694/dsh-wisp',
+    'when only GitHub has the new version she copies the repo URL, not the package name that installs the old one',
+    JSON.stringify(gh.clipboardWrites))
+  check(String(gh.win.__wisp.doctor().update.hint).includes('npm 上还是旧版'),
+    'and doctor() records which hint she actually used',
+    String(gh.win.__wisp.doctor().update.hint))
+  gh.win.__wisp.destroy()
+  active = keepGh
+}
+
 if (clientSrc !== null) {
   /* ---------------------------------------------------------------------------
      配置键是这套"多端"里最容易漂的一处：它在**三个地方**各出现一次 ——
@@ -4389,10 +5867,25 @@ if (clientSrc !== null) {
   if (clientSrc.includes('__SPRITES__')) bad('no leftover build placeholder', 'run `node build.mjs`')
   else ok('no leftover build placeholder')
 
-  // The bundle must be self-contained: a share carries no asset paths.
-  const refsAssetFile = /['"][^'"]*\.(?:webp|png)['"]/.test(clientSrc)
-  if (!refsAssetFile) ok('bundle references no external image files')
-  else bad('bundle references no external image files', 'a share would break on missing assets')
+  /* 自足性（1.43 立的规矩）：立绘是**内联**的 —— 一个包外路径都不能有，别人装走
+     也能直接画出来。
+     v1.47.0 给这条规矩开了一个**明确的例外**：帧动画素材是按 URL 外置加载的
+     （八条泳装 +30 MB，塞不进单文件），它的文件名就是 MOTION 清单里那几条，
+     由宿主路由发出来。所以这里查的是两件事，而不是笼统的"不许出现 .webp"：
+       ① 包体里出现的 .webp 文件名**只能**是 MOTION 清单里那几条 —— 多一条就意味着
+          有人又写死了一个路径，而那条路径在别人机器上不存在；
+       ② 立绘那一份仍然是 data URI（下面上面那条断言已经逐格查过）。
+     文件**不存在**不算失败：那是"这一段没有素材"，客户端有静默降级。 */
+  const motionBlock = (clientSrc.match(/const MOTION = \{[\s\S]*?\n {4}\}/) ?? [''])[0]
+  const manifestFiles = [...motionBlock.matchAll(/'([A-Za-z0-9._-]+\.webp)'/g)].map((m) => m[1])
+  const namedFiles = [...new Set([...clientSrc.matchAll(/['"]([A-Za-z0-9._-]+\.webp)['"]/g)].map((m) => m[1]))]
+  const strayFiles = namedFiles.filter((f) => !manifestFiles.includes(f))
+  if (manifestFiles.length > 0 && strayFiles.length === 0) {
+    ok('the bundle names no image file outside the MOTION manifest', `${manifestFiles.length} clip name(s): ${manifestFiles.join(', ')}`)
+  } else {
+    bad('the bundle names no image file outside the MOTION manifest',
+      strayFiles.length ? `stray: ${strayFiles.join(', ')}` : 'no MOTION manifest found')
+  }
 
   const stamped = clientSrc.match(/const VERSION = '([^']+)'/)
   if (stamped && stamped[1] === pkg.version) ok('the bundle stamps the package version', stamped[1])
@@ -4440,6 +5933,38 @@ if (existsSync(join(here, 'README.md'))) {
   check(readmeVersion === pkg.version, 'the README header quotes the packaged version',
     `README ${readmeVersion ?? '(没写)'} vs package ${pkg.version}`)
 
+  /* 客户端自己抓的那条路必须真的能成：给它一个可用的 window.fetch，她要报出版本。
+     这就是 1.44.0 的全部要点 —— bundle 客户端半包是普通页面脚本，fetch 可用。 */
+  {
+    const fetched = createHarness({ timer: true, composerText: '' })
+    const keepFetched = active
+    active = fetched
+    fetched.win.fetch = (url) => Promise.resolve({
+      ok: true,
+      json: () => Promise.resolve(String(url).indexOf('raw.githubusercontent') >= 0 ? { version: '1.0.0' } : { version: '9.9.9' }),
+    })
+    fetched.evaluate(clientSrc)
+    fetched.module().default.apply(fetched.ctx, { reactions: false, wander: false, celebrate: false })
+    fetched.advance(1000, 100)
+    const clientRes = await fetched.win.__wisp.checkForUpdate()
+    check(clientRes.state === 'available' && clientRes.latest === '9.9.9' && clientRes.from === 'npm',
+      'with a usable window.fetch the CLIENT half does the whole check itself — no host RPC involved',
+      JSON.stringify(clientRes))
+    fetched.win.__wisp.destroy()
+    active = keepFetched
+  }
+  /* 动作层**绝不许吃 CSS filter**（v1.45.3 立的规矩，v1.46.1 换成动图 <img> 之后照旧）：
+     滤镜会给这一层再插一次栅格化，alpha 剪影被重新合成一遍就是"她整个人变黑"的成因。
+     阴影与调色只属于静态立绘。 */
+  {
+    const css = String(clientSrc)
+    const motionRule = (css.match(/\.wisp-video\{[^}]*\}/g) || []).join(' ')
+    check(motionRule.length > 0 && !/filter\s*:/.test(motionRule),
+      'no CSS filter is applied to the motion layer (a filter re-rasterises the alpha cutout)',
+      motionRule.slice(0, 160))
+    check(!/\[data-mood="[a-z]+"\]\s*\.wisp-video\{[^}]*filter\s*:/.test(css),
+      'and no mood rule re-adds a filter to the motion layer either')
+  }
   const quoted = Number((/当前 \*\*(\d+) 项全 PASS/.exec(readmeText) ?? [])[1])
   const total = checks + 1
   if (quoted === total) {