Align save management, layout publication and cancellation guidance

README.md

@@ -53,7 +53,7 @@ For local use, run `claude --plugin-dir .`, or register the repository with `cod
 | skills | Shared Codex / Claude Code Skills |
 | tools | Repository tooling |
 
-The host provides SDK 0.1.0 with `hostApiMajor` and `protocolVersion` set to 1. Use the declarations for development, but do not bundle SDK files into a component. See the [reference](docs/en/reference/index.md) and [third-party notices](THIRD_PARTY_NOTICES.md).
+The host provides SDK 0.1.2 with `hostApiMajor` and `protocolVersion` set to 1. Use the declarations for development, but do not bundle SDK files into a component. See the [reference](docs/en/reference/index.md) and [third-party notices](THIRD_PARTY_NOTICES.md).
 
 ## Feedback
 

docs/en/guide/data.md

@@ -45,3 +45,5 @@ Here, `signal` belongs to the current operation. Validate the loaded business va
 `SAVE_CONFLICT` requires reloading and a business merge or explicit conflict UI. Do not overwrite using the latest revision blindly or retry forever. A lost response requires a load before another write. Cancellation does not undo a published commit.
 
 KV allows 256 KiB per value and 16 MiB per instance. Saves have separate budgets and keep the previous successful revision. Save at checkpoints and coalesce updates rather than writing every frame. Neither layouts nor package rollback restore persistent progress. See [saves](../reference/contracts/saves.md).
+
+The host component page offers installation-wide Clear after every instance is disabled and the user confirms. Authors initialize empty progress after clearing. The host provides neither save export nor backup import. Author-controlled `saves.restore` only restores the internal previous successful snapshot. Keep list visibility separate from editor selection: resume shared-data refresh when leaving editing without a draft, and preserve input when saving fails.

docs/en/guide/lessons.md

@@ -32,6 +32,8 @@ Do not release a mutation slot as soon as the cancel button is pressed. The unde
 
 Reminder operations retain their slot until the original request ends; compatibility reports have one `reportController`. Sources: reminders contract and worker-canvas/`main.js`. Rapid start/cancel must keep outstanding work bounded. Replaceable reads still need generations and host pending-request limits.
 
+Host queues cap running and queued work per installation and globally. Saturation returns `QUOTA_EXCEEDED`, and cancellation promptly removes queued work. Authors must still coalesce replaceable work and bound retries; repeated cancellation is not a way around backpressure, and an active native call may still be finishing.
+
 ## 6. Worker drawing needs acknowledgements
 
 Stardust gives each state a sequence and sends the next latest state only after the matching applied acknowledgement. The computation canvas uses `presentationInFlight`/`pendingPresentation` and a five-second response deadline. Posting at a fixed interval does not establish backpressure.

docs/en/guide/publishing.md

@@ -21,4 +21,6 @@ New publications start public. Review metadata, preview, tags and actual content
 
 Publish in a layout detail drawer opens the same dialog directly, with a Publish/Update selector. Layout dialogs list included component names and UUIDs instead of a preview image, upload file list, or raw layout JSON. Select and review shareable configuration values in that same dialog: none are selected for a new draft, and saved drafts retain the selection. Sharing choices remain available when updating and use only the configuration snapshot validated by the host when preparing the draft.
 
+The host manages layout work versions on save, overwrite and rename. Before upload it checks the remote version and freezes a higher version; retries after failure or uncertainty keep that version and content. Changing shared configuration after freezing requires a new draft. Importing a layout with an existing identity creates a separate local copy and preserves the original. Layout details show dependency and compatibility checks without an arrangement diagram.
+
 Shared layouts replace one display, require existing dependencies and do not subscribe automatically. Layouts identify dependencies by component UUID, regardless of local, development or Workshop source. Publishing does not require Workshop component references or rebinding. Never include author source paths or grants. Read [Workshop behavior](../reference/modules/workshop.md) and [layouts](../reference/contracts/layout.md).

docs/en/reference/contracts/host-api.md

@@ -1,6 +1,6 @@
 # Host API, authorization and errors
 
-SDK 0.1.1 uses `apiMajor`/`hostApiMajor`=1 and `protocolVersion`=1. The host injects `widgetHost` before business scripts. Wait for ready, use call(method, params, {signal}) and retain unsubscribe functions returned by on. Workers have no direct bridge.
+SDK 0.1.2 uses `apiMajor`/`hostApiMajor`=1 and `protocolVersion`=1. The host injects `widgetHost` before business scripts. Wait for ready, use call(method, params, {signal}) and retain unsubscribe functions returned by on. Workers have no direct bridge.
 
 ## Capabilities and base interfaces
 
@@ -22,6 +22,8 @@ Public failures include `INVALID_ARGUMENT`, `PROTOCOL_UNSUPPORTED`, `METHOD_NOT_
 
 Requests and final delivery validate the original instance/document, cancellation, grants and dependencies. Timeouts, navigation, disablement and revocation invalidate work; cancelling cannot undo already committed side effects. Public errors omit secrets, stack traces and personal paths.
 
+Host request queues are bounded per installation as well as globally, counting both running and queued work. Saturation returns `QUOTA_EXCEEDED`. Cancellation removes queued work promptly; active native operations retain their capacity until they finish safely. `config.set` and `window.setSize` check validity after acquiring the transaction lock and before publishing state. A cancellation that arrives after publication does not undo it.
+
 features indicate host support, not authorization or successful device execution. compatibility separates API existence, actual probes and untested devices. Read [complete method/event declarations and machine budgets](../types.md), [saves](saves.md) and the specific desktop contracts before implementation.
 
 ## Source and related declarations

docs/en/reference/contracts/layout.md

@@ -12,6 +12,8 @@ The current reader and writer use canonical `schemaVersion: 1`. Historical varia
 
 Display IDs are stable internal identities, not connection order or display numbers. Disconnection preserves intent without silently migrating content. Global language/theme/autostart and local display aliases are not shared layout settings.
 
+Layout details show dependencies, compatibility and configuration fallback results without an arrangement diagram. Preflight uses a published snapshot; preparation and final commit revalidate state. Importing a file whose `layoutId` already exists creates a separate local copy with a new UUID, preserving the original record and bindings. New local layouts start at `1.0.0`; overwrite and actual rename advance the work version. Publication negotiates and freezes a version above the remote version; retries retain the same content and version.
+
 ## Source and related declarations
 
 Exact method signatures and complete machine budgets are shared in [SDK declarations](../types.md).

docs/en/reference/contracts/saves.md

@@ -22,6 +22,10 @@ The host serializes atomic publication. Authors reload/merge or present a confli
 
 Use elapsedSince with a business `maxMs` for offline calculation, handling `clockMovedBack` and capped. Local timestamps are not anti-cheat evidence. onClosing provides one bounded normal-shutdown opportunity per document, with no veto; regular checkpoints remain necessary. See [the game recipe](../../recipes/game.md).
 
+## Host save management
+
+The component drawer provides Clear for the entire installation after all its instances are disabled. Confirmation defaults to Cancel. Clearing removes save slots and their recovery copies while retaining configuration, KV, cache and browser data. The host does not provide a save export or backup import action. Author-controlled `saves.restore` still publishes the previous successful slot snapshot as a new revision.
+
 ## Source and related declarations
 
 Exact method signatures and complete machine budgets are shared in [SDK declarations](../types.md).

docs/en/reference/modules/workshop.md

@@ -1,6 +1,8 @@
 # Workshop and publication
 
-A subscription is not the installed runtime directory. The host validates/copies complete content into owned versions. Only reliable service results establish unsubscription; network failure alone never removes content. Removing the last account association disables affected instances and cleans owned data under the host rules. Layout subscriptions are not auto-applied and missing dependencies do not trigger auto-subscription. Development publication validates current matching-identity source into a clean upload copy, initially private, without replacing the running version. Steam availability and actual client acceptance need separate verification.
+A subscription is not the installed runtime directory. The host validates/copies complete content into owned versions. Only reliable service results establish unsubscription; network failure alone never removes content. Removing the last account association disables affected instances and cleans owned data under the host rules. Layout subscriptions are not auto-applied and missing dependencies do not trigger auto-subscription. Development publication validates current matching-identity source into a clean upload copy, initially public, without replacing the running version. Steam availability and actual client acceptance need separate verification.
+
+Layout publication freezes its content and version before upload, advancing beyond the remote version and locally frozen drafts of the same work. Retrying an uncertain or failed upload reuses that frozen content; changing shared configuration requires a new draft. A newer remote version blocks an older frozen draft.
 
 ## Sources and author guidance
 

docs/guide/data.md

@@ -41,3 +41,5 @@ const saved = await widgetHost.call('saves.commit', {
 代码展示调用形状，`signal` 由当前业务任务提供。作者须验证 loaded.current.value 的业务结构；不能直接将不可信 JSON 当作自己的模型。SAVE_CONFLICT 时重读并按业务合并或提示选择，不盲目改成最新修订覆盖，也不无限重试。响应丢失时先 load 确认；取消不撤回已经提交的副作用。
 
 实例 KV 单值 256 KiB、总量 16 MiB；共享存档的独立额度见[存档协议](../reference/contracts/saves.md)。不按每帧保存；按检查点、合并变更和有界退出机会保存。布局和组件包回退不会回退这些持久进度。
+
+宿主组件页提供安装级“清除”，要求全部实例停用并确认；清除后作者按空存档初始化。宿主不提供存档导出或备份导入。作者的 `saves.restore` 仍只恢复内部上一成功快照，不能读取用户备份文件。列表与编辑器应分开维护状态：退出编辑且无草稿时恢复共享数据刷新，保存失败时保留编辑内容。

docs/guide/lessons.md

@@ -32,6 +32,8 @@
 
 提醒工具保持操作槽直到原调用结束；计算画布的兼容报告也只有一个 controller。来源：提醒协议、examples/worker-canvas/main.js 的 reportController。测试连续开始/取消时同时存活操作数仍有上限。对可立即替换的纯读取任务，也要用代次阻止旧结果并遵守宿主在途额度。
 
+宿主队列按安装和全局限制执行及排队总数，满载返回 `QUOTA_EXCEEDED`，取消会及时剔除尚未执行的任务。业务侧仍须合并替换操作并限制重试，不能用连续取消规避背压；已经开始的原生调用可能尚在退出。
+
 ## 6. Worker 绘制需要确认，不只是节流
 
 星河微光为状态消息加 sequence，收到匹配 applied 后才发下一份 latest。计算画布同样有 presentationInFlight/pendingPresentation 和五秒响应期限。仅按固定 interval postMessage 不能保证慢 Worker 不积压。

docs/guide/publishing.md

@@ -21,4 +21,6 @@
 
 布局从布局抽屉的“发布”直接进入同一弹窗，也可切换为更新。布局弹窗以组件名称与 UUID 列表代替预览图、实际上传文件和原始布局 JSON；可分享配置直接在同一弹窗中勾选并核对值，新草稿默认不选，保存后保留选择。更新时同样可调整分享选择，只会使用准备草稿时服务筛选的配置快照。
 
+布局保存、覆盖与重命名由宿主管理作品版本。上传前核对远端并冻结更高版本；失败或结果未知后重试保持同一内容和版本，冻结后改变分享配置须新建草稿。导入同身份布局会创建新的本地副本并保留原布局。布局详情展示依赖与兼容性检查，不显示排布示意图。
+
 布局分享只替换目标显示器，缺依赖不能应用，不自动订阅。布局依赖只按组件 UUID 匹配，不保存组件来源，工坊发布无需填写引用或重绑定；不能包含作者源码路径、授权或秘密。规则见[工坊模块](../reference/modules/workshop.md)和[布局协议](../reference/contracts/layout.md)。

docs/reference/contracts/host-api.md

@@ -2,12 +2,14 @@
 
 # 宿主接口与Capability
 
-当前SDK0.1.0，hostApiMajor/apiMajor=1、protocolVersion=1。类型声明与机器可读字段以sdk唯一来源同步。
+当前SDK0.1.2，hostApiMajor/apiMajor=1、protocolVersion=1。类型声明与机器可读字段以sdk唯一来源同步。
 
 组件自行通过直接联网或通用network接口完成登录、令牌和服务请求；参见[组件登录验证](../modules/github.md)。
 
 ## 参数与关联协议
 
+组件请求使用按安装计额的有界队列，额度包含执行中与排队任务，满载明确返回QUOTA_EXCEEDED。取消、超时和文档失效及时释放尚未执行的任务；已经执行的原生调用仍在安全边界结束，不因取消立即释放其活动额度。配置和尺寸修改在取得事务锁后及状态指针发布前检查有效性；已经提交的状态不由迟到取消回滚。
+
 HTTP头与目标参数规则：HTTP 头必须在明文 `{name,value}` 与秘密 `{name,secretBindingId,prefix?}` 中二选一，明文形式不得携带 prefix。`target.open` 也必须在 `{bindingId}` 与 `{directoryBindingId,relativePath}` 中二选一，不接受混合字段或固定绑定附加 relativePath；捕获票据和执行复用同一选择器检查，非法形式返回 INVALID_ARGUMENT。此处拒绝歧义输入，不扩张已有目标范围或权限。
 
 可回收实例二进制缓存的额度、未命中、取消与授权失效见[缓存协议](cache.md)，与存档分离，不提供本机路径或新增系统读取权限。