[ackness]

Summary / 摘要

This PR closes the follow-ups left after the plugin extensibility work, and fixes a desktop crash found by the first packaged-app check on Windows. Each topic arrived as its own merge commit, followed by merges of fixes from a review of the whole set. Review them one merge at a time.

Packaged desktop app crashed at launch

• Problem: every packaged desktop format (Windows ZIP, portable EXE, installer; the same main bundle ships on Linux and macOS) failed before opening a window with "Cannot find module '../data/patch.json'". The desktop main process imported the shared package's root entry, which loads the theme CSS parser; esbuild bundled the parser's code but not the JSON file it requires at runtime. No release is affected: the last release predates the theme packs.
• Fix: the main process imports narrow shared entries (locales, provider keys, the proxy channel) and never loads theme validation. The build, staging and release checks now reject a main or preload bundle that still contains a literal runtime require (including createRequire aliases), so this class of failure stops the release instead of the app.

Full browser suite in CI

• Problem: CI ran only the smoke suite and the community acceptance suite. Full Playwright regressions surfaced only in local runs, and one timing race showed only on CI runners.
• Fix: every source PR, main push and release runs the full browser suite in four shards, one worker each, pinned to two CPUs, with failure artifacts. The required result fails unless every shard passes. A nightly and a manual run add repeated timing-sensitive acceptance specs. Docs-only changes keep the short path.

Operation failure notices on stories

• Problem: when an attached operation (a write service call such as a purchase) failed at commit, the player saw only a passing toast.
• Fix: the story message that carried it keeps a localized footer with the number of operations that did not apply. The count is written atomically with the story, survives recovery, resume, paging, forks and checkpoints, reaches other open tabs, and exposes no operation details. The footer is host markup outside theme scopes, so a theme pack cannot restyle it away.

Parallel delegation

• Problem: the ensemble narrator asked its character actors one at a time even when the turn policy suggested they could speak together.
• Fix: a generic delegate-batch tool dispatches several sub-agent calls at once within the existing budget, depth and concurrency limits. It refuses calls beyond the limit instead of queueing them, returns results in request order, isolates failures so one actor failing costs only its line, propagates cancellation, keeps private targets out of traces and attributes usage per call. The bundled ensemble narrator adopts it.

Fixes from real-model and packaged-app runs

• Narrative Only could not begin bundled adventures: world data inferred a setup receiver even when the composition had no setup step, so the opening waited forever for an excluded feature. Inferred receivers no longer add setup, and an unfinished setup now names the waiting plugin and how to continue or disable it.
• Plugin asset URLs fell through to the app: an unmatched /plugin-assets/... path served the SPA index. It now returns a JSON 404, including after dot-segment normalization.
• Kimi/Moonshot rejected event tools: strict endpoints refuse enum schemas without a type. Model-facing copies of event schemas now carry inferred types; topics that cannot be described safely are omitted with a server warning. Author schemas still validate payloads.
• DeepSeek thinking continuations failed with missing reasoning_content after a text-only answer was repaired or steered. Every assistant step in the current user turn now carries the reasoning field for model families that need it.
• Adding the first provider left Story unbound when the built-in default had no server credentials. Story is now bound too, existing choices are kept, and Settings reports the assigned roles.
• Delegation tools were offered with no reachable target, so models called tools that could only fail. Both delegation tools now list only eligible targets, and Dialogue Narrator falls back to narrator-only play.
• The GPT-6 Chat reasoning rule applied only to the provider named openai: relays, OpenRouter and other providers serving the same model sent a reasoning field the model rejects with tools. The rule now follows the model and protocol.
• Replacements derived from injected own data were unguarded: an agent reading its own data through io.selfData and writing it back could overwrite a newer value. Injected keys now record read baselines from their full stored values, so a stale replacement fails with a conflict while the story still commits.

Smaller fixes

• pnpm validate:plugin prints the collected warnings even when a package has errors, keeping the first error and exit code 1.
• A standalone SillyTavern lorebook imported with exactly one character card resolves {{char}} to that card's name, in either upload order.
• The narrator's and world extractor's longest instruction sentences are split, in both languages, keeping every rule (both plugins bump to 0.0.42).
• Changelog fragments keep working links after release assembly; links already broken in released entries are repaired.

Type of change / 变更类型

• New feature / 新功能 (feat)
• Bug fix / Bug 修复 (fix)
• Refactor / 重构 (refactor)
• Documentation / 文档 (docs)
• Tests / 测试 (test)
• Tooling, CI, release / 工具链、CI、发布 (chore / ci)
• Performance / 性能 (perf)
• Breaking change / 破坏性变更 (BREAKING CHANGE)

Breaking changes / 破坏性变更

• operation.failed event. It now requires messages: { messageId, count }[] naming the story messages that kept a notice. Update server and web clients together.

No database schema change or migration is needed. Existing stories stay unannotated.

Verification / 验证方式

Final run on the merged branch (static gate, every source package, PostgreSQL, full browser suite pinned to two CPUs as in CI):

• pnpm install --frozen-lockfile, pnpm check, pnpm lint, pnpm schemas:generate (no diff), pnpm validate:plugin for every bundled plugin
• Package tests: shared 1187, ai-provider 1159, runtime 3250 (+9 todo), server 3417 (+88 skipped), web 3043, store 1041, plugin-loader 673, tools 254, create 173, settings 136, test-runtime 126, events 78, plugin-handlers-utils 264, context 182, memory 58, approval 49, plugin-test-utils 44, site 47, desktop node --test
• pnpm test:pg against a live PostgreSQL: 539 + 113 passed
• pnpm e2e (full, 2 CPUs): 190 passed; community acceptance: 11 passed; pnpm test:docs, pnpm test:docs:packages, docs site build
• Windows 11 packaged app (ZIP, portable, NSIS installer): launch, first adventure, restart, lifecycle, data relocation, CSP, first-run wizard and uninstall all pass. Linux --dir build boots. Not checked: macOS.
• Real models, scripted pnpm e2e:verify sessions (purchase, presentation cues, ensemble with auto-advance and Stop, notebook and bridge, sub-agent world reads, stale and fresh replacements). After the fixes in this PR: OpenAI (gpt-6-luna), an OpenAI-compatible relay and the same model under a custom provider name pass every scenario with no request errors; adding the first provider binds Story. DeepSeek (deepseek-flash) passes purchase, presentation, ensemble (21 committed turns, no error responses) and the stale-replacement check; its remaining failure is invalid narrator output from the model, which commits nothing. Kimi turns commit with no schema errors; its slow responses hit harness deadlines, so the run was stopped early
• Replay suite re-recorded on the OpenAI lane: 48/48 hits

Gaps: macOS packaged app untested. Real-model runs are samples, not a soak.

Related issue / context / 关联

Follows #476.

Docs sync / 文档同步

• docs/reference/ updated (api, protocol, plugins, tools, extension-points, plugin-extensions, transactions, world-model, ui-panels, theme-packages, world-installation, plugin-installation)
• Guides (plugins/advanced, prompt-style, testing; worlds/import-sillytavern), builtin pages and internals (commands, e2e-testing, desktop-packaging, flow, packages, security); Chinese pages mirrored under docs/en/
• CONTRIBUTING.md, CONTRIBUTING.en.md, .github/PULL_REQUEST_TEMPLATE.md and AGENTS.md updated for the CI and desktop changes
• Changelog fragments: story-operation-failure-notices, parallel-character-contributions, plugin-validation-warnings, lorebook-character-macros, bundled-prompt-clarity, changelog-links, setup-blocked-opening, plugin-asset-routing, moonshot-enum-schema, deepseek-reasoning-passback, first-provider-story-slot, delegate-offer, reasoning-rule-by-model; proposal-read-baselines extended for selfData; the changelog README documents the link convention and released entries' broken links are repaired

🤖 Generated with Claude Code