Anatomy of a Preset: After 123 Doors, the True Body of Jailbreaking and the step-5 Adaptation

When a preset must migrate from one architecture to another, you first have to know what stands behind each door. On this day, the user’s 123-entry “Mengjing Skier” preset was taken apart door by door, and the purpose of the teardown was to fit step-5 for the ainovel-cli novel-production line.

I. The true body of jailbreaking: one universal body, one specific variant

The preset’s structure is deeper than expected: beyond the prompts array, extensions also hide a model-switching configuration system (the Mengjing Skier settings script) with nine single-select schemes — model thinking formatting (auto-detect), Deepseek official, Deepseek official Need chain-of-thought, Deepseek unofficial, GLM5.3/other models, Gemini3, Gemini4, Hunyuan3, KimiK3. After walking each scheme, the true picture of jailbreaking emerged:

• The meta priority block (the persona-framework set) is the universal jailbreak body enabled by default across all models — no scheme touches it, so it is always on;
• The only model-specific jailbreak among the nine schemes is Gemini4 — Gemini prefills ×2 plus a “no-meta” persona, and it explicitly disables the meta version; this detail corroborates from the side that meta’s potency was always model-specific luck — the author found priority hijacking useless or even counterproductive on Gemini4, switching to prefill self-characterization instead;
• The three DeepSeek schemes, the GLM scheme, Gemini3, and KimiK3 are all pure technical plus stylistic adaptation (thinking tags, model-specific ban words, chain-of-thought) with zero jailbreak components — the assumption that “the preset can jailbreak DeepSeek” has no evidence whatsoever.

One honest correction was also on record: the user asked whether the corresponding jailbreak prompts were added too, and the answer was yes, one line — “subject-matter permission (the creation passage) → one plain-spoken version in voice,” sourced from the preset’s creation block that allows creating any text content (including edge violence and gore; the process will not be refused); at the time the meta priority wrapper and anti-injection declaration were stripped, keeping only “this book allows certain subject matter, described directly without evasion,” recommended into voice.md in plain wording.

II. Why the ST set cannot migrate: the slots do not exist

The user was reluctant to part with that “proven” set of mechanisms, but the architectural fact is cold — the preset’s mechanisms fall into two classes; the portable ones (creation-instruction class) are already in the new setup in plain form; the non-portable ones are ST structural mechanisms, and it is not that they are “excluded” but that this architecture has no counterparts: prefill — the agentcore source was checked, and the subagent config has no prefill entry, so the preset’s most powerful weapon has no socket here at all; the meta priority block — it fights ST’s system/user message layering, while ainovel’s Arbiter calls have no such structure, so a declaration of “override all principles” has no object to override; injection depth likewise. Forcing them into requirement text, the Arbiter sees not chat context but a pile of odd declarations with no referents. One fair concession: the persona framework itself (“you are Mengjing Skier, constructing a one-of-a-kind dreamscape for dreamers”) is plain text and can go into voice.md as framing for the subject-matter declaration — but expectations must be set: it is creative tonality for the Writer, not a switch, and it cannot reach the Arbiter and Architect layers at all. One-line verdict: the door is the front door, the function is style customization; jailbreaking is merely an alley visible after pushing the door open, not a fast lane built by the author; the upstream provider’s filter intercepts outside the pipeline, and nothing written in voice will make the upstream allow one more millimeter.

III. The modular step-5 adaptation: building along the ds route

The ds route happens to be the cleanest of the three model routes — entirely free of jailbreak components, pure technical adaptation: ds scheme = 1 thinking tag + 2 model ban words (+ 3 optional chain-of-thought variant). step-5 is not in the preset’s model list, so three modules along this structure: start with the ready fallback (the GLM5.3/other-models line, positioned as “other models”); observe step-5’s real thinking format to fix the tag (local NewAPI usually normalizes the upstream thinking format — run a few rounds to see what tags the thinking content is wrapped in, and if it does not match, create a new entry the way Deepseek official does); accumulate step-5-specific ban words — every model has its own verbal tics (DeepSeek loves em-dashes and “not… not…” constructions; GLM/Gemini sprout earthy words), and step-5’s tics can only be recorded after a dozen rounds of output. Two layering principles were set as iron law: anything that can be written as a checkable command (word counts, word lists, sentence patterns) sinks into rules, leaving stylistic orientation in voice; and never copy it all at once — the ST preset was tuned through iterative conversational feedback, while ainovel is upgrade batch production where a single run of thousands of characters makes boilerplate risk entirely different; the correct posture is to copy rules first (hardest, zero stylistic risk, commit interception visible the same day), run 5-10 chapters for a /diag and Editor-score baseline, then add voice piece by piece, each validated over a few chapters against scores and AI-flavor metrics, finishing with /simulate for an imitation portrait from original text you like. One more cost reminder: voice segments are resident in the system prompt every request — add more only after compressing the current ~10 modules; do not stuff the whole file in — placeholders, variable chains, and boilerplate are invalid tokens that also dilute the attention of effective instructions.

Real coordinates

• Preset structure: 123 prompt entries + nine single-select model-adaptation schemes in extensions (model thinking formatting auto / Deepseek official / Deepseek official Need chain-of-thought / Deepseek unofficial / GLM5.3 other models / Gemini3 / Gemini4 / Hunyuan3 / KimiK3)
• Jailbreak picture: the meta priority block is universal and default-on across models; the only model-specific jailbreak = Gemini4 (prefills ×2 + no-meta persona, explicitly disabling the meta version — the author found meta hijacking counterproductive on Gemini4); the three DeepSeek schemes + GLM + Gemini3 + KimiK3 have zero jailbreak components (thinking tags + ban words + chain-of-thought)
• Migration boundary: prefill / meta priority / injection depth have no slots in the ainovel architecture (agentcore subagent has no prefill entry; Arbiter calls have no system/user layering); portable creation instructions are already in voice in plain form (the subject-matter-permission line came from the preset’s creation block, stripped of the meta wrapper and anti-injection declaration); the persona framework can enter voice but is creative tonality, not a switch
• step-5 three modules: GLM5.3 fallback start → observe NewAPI-normalized thinking format to fix the tag → accumulate step-5-specific ban words; the ds route = 1 thinking tag + 2 model ban words + 3 optional chain-of-thought variant
• Two iron laws: checkable commands (word counts/word lists/sentence patterns) sink into rules, stylistic orientation stays in voice; incremental adoption — copy rules first (commit interception visible same day) → 5-10 chapters for baseline → voice added piece by piece, each validated → /simulate imitation portrait; voice resident-token cost awareness (~10 modules compressed before adding more; reject placeholders/variable chains/boilerplate)