@1e0zj/dsh-plugin-mall 0.3.1 → 0.3.3

package/src/index.js

@@ -25,7 +25,7 @@ import { tmpdir } from "node:os";
 import { resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { repoInfo, searchPlugins, verifyPlugins, cachedRepoManifest, fetchRawFile, preferNpmSpec, npmPackageInfo, compareVersions, assertSafeToInstall, mapLimit, NETWORK_CONCURRENCY } from "./github.js";
 import { ensureProfile, listInstalled, normalizeSpec, runInstall, runRemove, assertSafeSpec, resolveRegistry, serializeCanonicalProof, persistPluginDisabled } from "./installer.js";
-import { preflightInstall, inspectRemoteCandidate, recoverProfile } from "./guard.js";
+import { preflightInstall, inspectRemoteCandidate, recoverProfile, describeRollbackRebuild } from "./guard.js";
 
 export const name = "@1e0zj/dsh-plugin-mall";
 // `loader` 用来读装配树、并对单个 entry 做热开关（entry.update）。读法照抄
@@ -144,6 +144,13 @@ export function computeProfileFingerprint(profileDir) {
 const compatCache = new Map();
 const COMPAT_TTL = 600000;
 
+// When this plugin instance loaded — for a host process this is effectively the
+// host's start time (the loader mounts plugins at boot). Sent with `jobs` so a
+// remounted client can tell "completed, restart still pending" from "completed
+// and the restart already happened": a finishedAt older than this value means
+// the task's Restart-dsh button has already done its job.
+const pluginLoadedAt = Date.now();
+
 function compatCacheGet(key) {
   const cached = compatCache.get(key);
   if (cached === undefined) return undefined;
@@ -822,6 +829,9 @@ export function createJobTracker({ producerFactory } = {}) {
           record.status = status;
           record.detail = outcome?.detail;
           record.needsApproval = outcome?.needsApproval;
+          // 原因活不过一次重启的失败（被别的未了结事务挡住）：浏览器据此在
+          // 重启后撤掉记录，而不是把一段现在时的描述留在面板上当现状读。
+          record.staleOnRestart = outcome?.staleOnRestart === true;
           record.finishedAt = Date.now();
 
           if (status === "completed") {
@@ -918,6 +928,13 @@ export function createJobTracker({ producerFactory } = {}) {
       const record = records.get(String(jobId));
       if (record === undefined) throw new Error(`unknown install job ${JSON.stringify(String(jobId))}`);
       const isSameSession = record.surface !== "browser" || (record.session !== "" && record.session === session);
+      const delta = typeof record.readOutput === "function"
+        ? record.readOutput()
+        : typeof record.producer?.readOutput === "function" ? record.producer.readOutput() : "";
+      // Accumulate the drained deltas so `list` can restore the full log after a
+      // remount: the polling client drains destructively, so without this the
+      // backend would hold no history at all.
+      record.log = String(record.log ?? "") + delta;
       return {
         snapshot: {
           id: record.id,
@@ -926,6 +943,7 @@ export function createJobTracker({ producerFactory } = {}) {
           status: record.status,
           detail: record.detail,
           needsApproval: record.needsApproval,
+          staleOnRestart: record.staleOnRestart,
           approvalToken: isSameSession ? record.approvalToken : undefined,
           // extras（如预检结论）同样只对同一 session 可见，与 approvalToken 同规格。
           extras: isSameSession ? record.extras : undefined,
@@ -933,12 +951,49 @@ export function createJobTracker({ producerFactory } = {}) {
           startedAt: record.startedAt,
           finishedAt: record.finishedAt,
         },
-        output: typeof record.readOutput === "function"
-          ? record.readOutput()
-          : typeof record.producer?.readOutput === "function" ? record.producer.readOutput() : "",
+        output: delta,
       };
     },
 
+    /**
+     * Every live record as {id, snapshot, output}, oldest first — for a freshly
+     * mounted client to restore its task panel. The install of a plugin whose
+     * bundle patch rewrites cordis.patch.yml replays the assembly tree and
+     * remounts this very UI mid-flight, dropping every React state; the backend
+     * records survive (1h/20-entry prune), so the remounted panel can show the
+     * finished task, its log, and the restart button instead of going blank
+     * with no signal at all (real incident: an update finished, the panel
+     * vanished, and the user learned it worked only by checking versions after
+     * a manual restart). Session visibility mirrors get(); dismissed records
+     * are skipped — "清空" must survive a remount too.
+     */
+    list(session) {
+      const out = [];
+      for (const record of records.values()) {
+        if (record.dismissed === true) continue;
+        const isSameSession = record.surface !== "browser" || (record.session !== "" && record.session === session);
+        out.push({
+          id: record.id,
+          snapshot: {
+            id: record.id,
+            kind: record.kind,
+            label: record.label,
+            status: record.status,
+            detail: record.detail,
+            needsApproval: record.needsApproval,
+            staleOnRestart: record.staleOnRestart,
+            approvalToken: isSameSession ? record.approvalToken : undefined,
+            extras: isSameSession ? record.extras : undefined,
+            spec: record.spec,
+            startedAt: record.startedAt,
+            finishedAt: record.finishedAt,
+          },
+          output: String(record.log ?? ""),
+        });
+      }
+      return out;
+    },
+
     cancel(jobId, session) {
       const record = records.get(String(jobId));
       if (record === undefined) throw new Error(`unknown install job ${JSON.stringify(String(jobId))}`);
@@ -969,6 +1024,9 @@ export function createJobTracker({ producerFactory } = {}) {
       if (record.surface === "browser" && (record.session === "" || record.session !== session)) {
         return false;
       }
+      // Marked, not deleted: `list` (panel restore after a remount) skips these,
+      // so a cleared panel stays cleared across remounts.
+      record.dismissed = true;
       if (record.approvalToken) {
         invalidateApprovalToken(record.approvalToken, record.session || undefined, record.surface);
         record.approvalToken = undefined;
@@ -1482,6 +1540,17 @@ async function rpcDispatch(ctx, endpoint, payload, config, token, tracker) {
         return rpcFail(error);
       }
     }
+    case "jobs": {
+      // Panel restore for a freshly mounted client: an install that rewrites
+      // cordis.patch.yml replays the assembly tree and remounts this UI,
+      // dropping all React state. The task records live here.
+      try {
+        const session = requireBrowserSession(payload?.session);
+        return rpcOk({ jobs: tracker.list(session), hostStartedAt: pluginLoadedAt });
+      } catch (error) {
+        return rpcFail(error);
+      }
+    }
     case "restart": {
       const profile = String(payload?.profile ?? defaultProfile).trim();
       try {
@@ -1572,6 +1641,11 @@ export function apply(ctx, config = {}) {
       console.log(`[dsh-plugin-mall] startup recovery: committed the pending install for profile "${defaultProfile}"`);
     } else if (result.action === "rolled-back") {
       console.warn(`[dsh-plugin-mall] startup recovery: rolled back the pending install for profile "${defaultProfile}" — ${result.reason ?? "profile failed validation"}`);
+      // What the rebuild did, when it did anything. A rollback that relinked a
+      // package used to be silent, so a reconcile that silently no-opped and a
+      // fallback add that saved the profile looked exactly alike afterwards.
+      const rebuild = describeRollbackRebuild(result.rebuild);
+      if (rebuild !== undefined) console.warn(`[dsh-plugin-mall] startup recovery: node_modules rebuild — ${rebuild}`);
     }
   } catch (error) {
     // 恢复失败绝不能拖垮插件加载：报出来，让市场照常可用（用户还能手动
@@ -2291,6 +2365,52 @@ export async function runSelfTests() {
     const snapAfterDismiss = sessionTracker.get(sessionJobId, "session-alpha").snapshot;
     check("dismiss 后 job snapshot 中 approvalToken 为 undefined", snapAfterDismiss.approvalToken === undefined);
 
+    // ── 5b. list（重挂载恢复）：日志累积、dismissed 过滤、session 隔离 ────────
+    // 安装事务改写 cordis.patch.yml 会让 dsh 重放装配树、市场 UI 整体重挂载，
+    // 前端 state 全丢。任务记录在后端活着——list 就是恢复通道：drain 过的
+    // 日志增量必须已在后端累积成全量，「清空」过的条目不得被拉回。
+    {
+      const pendingLines = ["line-a\n", "line-b\n"];
+      const lineProducer = {
+        cancel: () => {},
+        done: Promise.resolve({ status: "completed", detail: "done" }),
+        readOutput: () => pendingLines.shift() ?? "",
+      };
+      const listTracker = createJobTracker({ producerFactory: () => lineProducer });
+      const listJobId = listTracker.start({
+        profile: "web",
+        spec: "log-pkg",
+        profileDir,
+        surface: "browser",
+        session: "session-alpha",
+      });
+      await new Promise((resolvePromise) => setImmediate(resolvePromise));
+      const drain1 = listTracker.get(listJobId, "session-alpha").output;
+      const drain2 = listTracker.get(listJobId, "session-alpha").output;
+      const restoredJob = listTracker.list("session-alpha").find((entry) => entry.id === listJobId);
+      check(
+        "list 恢复全量日志（drain 过的增量在后端累积成完整历史）",
+        drain1 === "line-a\n" && drain2 === "line-b\n"
+          && restoredJob !== undefined
+          && restoredJob.output === "line-a\nline-b\n"
+          && restoredJob.snapshot.status === "completed"
+          && restoredJob.snapshot.spec === "log-pkg",
+        JSON.stringify({ drain1, drain2, restored: restoredJob?.output }),
+      );
+      const crossSessionJob = listTracker.list("session-beta").find((entry) => entry.id === listJobId);
+      check(
+        "list 对异 session 不暴露 approvalToken/extras（与 get 同规格）",
+        crossSessionJob !== undefined
+          && crossSessionJob.snapshot.approvalToken === undefined
+          && crossSessionJob.snapshot.extras === undefined,
+      );
+      listTracker.dismiss(listJobId, "session-alpha");
+      check(
+        "dismiss 后 list 不再返回该条（「清空」跨重挂载存活）",
+        listTracker.list("session-alpha").every((entry) => entry.id !== listJobId),
+      );
+    }
+
     // ── 6. Windows profile names & restart plan ──────────────────────────────
     check("合法 profile 名称识别", isSafeProfileName("web", true) && isSafeProfileName("profile_1", true) && isSafeProfileName("dev-test", true));
     check("Windows 尾随点拒绝", !isSafeProfileName("web.", true) && !isSafeProfileName("test..", true));

package/src/installer.js

@@ -16,7 +16,7 @@ import { createHash } from "node:crypto";
 import { dump, load } from "js-yaml";
 import { DEFAULT_PROFILE_BUNDLES, PROFILE_TEMPLATES, initProfile, resolveProfileDir } from "@deepseek-ai/dsh-app-boot";
 import { describeBuildScripts, npmNameOf } from "./github.js";
-import { commitPendingSnapshot, createProfileSnapshot, markPendingSnapshot, pnpmGuardEnv, pnpmSpawnPlan, rollbackPendingSnapshot } from "./guard.js";
+import { clearPendingApprovalPause, commitPendingSnapshot, createProfileSnapshot, markPendingApprovalPause, markPendingSnapshot, pausedCandidateBeforeState, pendingApprovalPaused, pnpmGuardEnv, pnpmSpawnPlan, readValidatedPendingSnapshot, rollbackPendingSnapshot } from "./guard.js";
 
 // ── spec normalization ──────────────────────────────────────────────────────
 
@@ -188,7 +188,20 @@ export function reconcileBundles(profileDir, beforeDeps = new Set()) {
   return result;
 }
 
-/** List a profile's installed plugins (dependencies with classification + version). */
+/**
+ * List a profile's installed plugins (dependencies with classification +
+ * version).
+ *
+ * An install paused at the build-script approval gate is reported as the
+ * snapshot has it, not as the half-written profile has it: the candidate's
+ * scripts were never approved, dsh has not loaded it, and the next startup
+ * rolls it back, so calling it "installed" tells the user the opposite of what
+ * is true — an update would show the NEW version while the old one is what is
+ * actually running and what a restart restores. A paused fresh install drops
+ * out of the list entirely. Every consumer goes through here (the browser's
+ * installed panel, the `updates` check that decides whether an update button
+ * appears, and the `market_installed` agent tool), so they all agree.
+ */
 export function listInstalled(profile) {
   const dir = resolveProfileDir(profile);
   const manifestPath = join(dir, "package.json");
@@ -209,7 +222,13 @@ export function listInstalled(profile) {
     }
     return { name, version, kind };
   });
-  return { dir, deps };
+  const before = pausedCandidateBeforeState(dir);
+  if (before === undefined) return { dir, deps };
+  if (!before.present) return { dir, deps: deps.filter((dep) => dep.name !== before.name) };
+  return {
+    dir,
+    deps: deps.map((dep) => (dep.name === before.name ? { ...dep, version: before.version ?? "?" } : dep)),
+  };
 }
 
 // ── npm registry resolution ─────────────────────────────────────────────────
@@ -1094,6 +1113,9 @@ export function createJobTracker() {
         // 待批准的构建脚本清单：浏览器侧据此渲染「允许并继续」，没有它就只有
         // 一段文本，用户看不出要批准的到底是什么。
         record.needsApproval = outcome.needsApproval;
+        // 这次失败的原因活不过一次重启（见 failedNow），浏览器据此在重启后
+        // 撤掉记录，而不是把一段现在时的描述当成当前状态留在面板上。
+        record.staleOnRestart = outcome.staleOnRestart === true;
         record.finishedAt = Date.now();
         onSettled?.(outcome);
       });
@@ -1112,6 +1134,7 @@ export function createJobTracker() {
           status: record.status,
           detail: record.detail,
           needsApproval: record.needsApproval,
+          staleOnRestart: record.staleOnRestart,
           spec: record.spec,
           startedAt: record.startedAt,
           finishedAt: record.finishedAt,
@@ -1444,17 +1467,52 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
   // first live pnpm add runs. These are the files that decide what pnpm
   // installs and what dsh loads; the marker is what lets startup/CLI recovery
   // roll the profile back if the plugin proves unloadable.
-  let snapshot;
-  try {
-    snapshot = createProfileSnapshot(profileDir, { spec });
-  } catch (error) {
-    return failedNow(`cannot snapshot profile before installing ${spec}: ${error.message} — refusing to touch the profile`);
-  }
+  //
+  // An existing marker means one of two things. A needsApproval pause from a
+  // previous attempt of THIS SAME install resumes: its snapshot keeps the
+  // rollback target at "before this install first began", and re-snapshotting
+  // now would capture the paused half-installed state as the rollback target.
+  // Anything else (different spec, remove transaction, corrupt marker) is
+  // refused — the recovery path owns it.
+  let existingMarker;
   try {
-    markPendingSnapshot(snapshot, { spec, preflight });
+    existingMarker = readValidatedPendingSnapshot(profileDir);
   } catch (error) {
-    rmSync(snapshot.dir, { recursive: true, force: true });
-    return failedNow(`cannot register the install pending marker for ${spec}: ${error.message} — refusing to touch the profile`);
+    return failedNow(`profile 里有一个读不出来的安装记录，无法判断它是什么，因此拒绝安装 ${spec}（${error.message}）。请先运行 \`dsh-plugin-guard guard recover\` 处理它。`);
+  }
+  if (existingMarker !== undefined) {
+    const previous = existingMarker.metadata?.spec ?? existingMarker.metadata?.packageName ?? "unknown";
+    if (existingMarker.operation !== "install" || existingMarker.metadata?.spec !== spec) {
+      // 拒绝是对的（marker 是一次性事务，不能被覆盖），但用户看不见 marker，
+      // 所以要说清楚挡路的是什么、以及怎么让它让开。暂停在批准闸的那种最
+      // 常见——它正是用户刚点过取消的那次安装。
+      const paused = pendingApprovalPaused(existingMarker) !== undefined;
+      const what = existingMarker.operation === "remove" ? "卸载" : "安装";
+      return failedNow(paused
+        ? `${previous} 的${what}还没做完——它停在「允许安装依赖」那一步等你决定，没有批准就不会真正装上。现在无法安装 ${spec}。重启 dsh 会撤回那次未批准的${what}，之后就能重新操作；也可以运行 \`dsh-plugin-guard guard recover\` 立即撤回。`
+        : `${previous} 的${what}还没了结，现在无法安装 ${spec}。重启 dsh 会自动了结它（装好的提交、没批准的撤回），也可以运行 \`dsh-plugin-guard guard recover\` 手动处理。`,
+      { staleOnRestart: true });
+    }
+    push(`[dsh-plugin-mall] resuming the paused install transaction for ${spec} — its original snapshot stays the rollback target\n`);
+    // 事务复活：清掉暂停标记，否则重试成功后的启动提交会被它拦下错误回滚。
+    try {
+      clearPendingApprovalPause(profileDir);
+    } catch (pauseError) {
+      push(`[dsh-plugin-mall] WARNING: could not clear the approval-pause mark: ${pauseError.message}\n`);
+    }
+  } else {
+    let snapshot;
+    try {
+      snapshot = createProfileSnapshot(profileDir, { spec });
+    } catch (error) {
+      return failedNow(`cannot snapshot profile before installing ${spec}: ${error.message} — refusing to touch the profile`);
+    }
+    try {
+      markPendingSnapshot(snapshot, { spec, preflight });
+    } catch (error) {
+      rmSync(snapshot.dir, { recursive: true, force: true });
+      return failedNow(`cannot register the install pending marker for ${spec}: ${error.message} — refusing to touch the profile`);
+    }
   }
 
   // Neutralize existing allowBuilds before every first pnpm add so strict-dep-builds
@@ -1687,6 +1745,27 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
       }
       if (result.status === "completed") {
         // Keep the marker as-is
+      } else if (Array.isArray(result.needsApproval) && result.needsApproval.length > 0) {
+        // needsApproval is a PAUSE awaiting the user's decision, not a terminal
+        // failure — do not roll back. Rolling back would tear out the candidate
+        // pnpm just installed and rewrite the manifest to the old version, so
+        // the retry's profile fingerprint and preflight report drift with the
+        // changed on-disk state and the approval token's digest check can never
+        // pass (real incident: dsh-better-sidebar 0.12.3 → 0.13.0 update died
+        // exactly here, "invalid approval token: preflight report changed").
+        // The retry's rebuild branch also needs this tree in place. Leave the
+        // on-disk state and the marker for the token retry; an abandoned pause
+        // is settled by startup recovery / `guard recover`, whose rollback
+        // target is still the pre-first-attempt snapshot. The pause is also
+        // marked ON the marker: without the mark a restart that passes the
+        // static validation would commit the never-approved version and drop
+        // the snapshot (both recovery commit points check it).
+        try {
+          markPendingApprovalPause(profileDir);
+        } catch (pauseError) {
+          push(`[dsh-plugin-mall] WARNING: could not mark the pause on the pending marker: ${pauseError.message}\n`);
+        }
+        push("\n[dsh-plugin-mall] install paused for build-script approval — the candidate stays installed with its scripts blocked; approve in the UI to finish, or restart dsh / run `dsh-plugin-guard guard recover` to roll back\n");
       } else {
         try {
           rollbackPendingSnapshot(profileDir);
@@ -1713,10 +1792,21 @@ function runInstallInner({ profile, spec, allowBuildScripts, approvedProof, pref
 // ── the background uninstall job ────────────────────────────────────────────
 
 /** A terminal producer for fast-fail cases (no pnpm spawn needed). */
-function failedNow(detail) {
+/**
+ * @param staleOnRestart - true when this failure's CAUSE cannot outlive a
+ *   restart, so the browser should drop the record instead of keeping it as
+ *   history. Only the "another transaction owns this profile" refusals qualify:
+ *   startup recovery settles that transaction on the way up, so the message
+ *   ("X is still waiting at the approval gate, so Y cannot install") describes a
+ *   situation that is guaranteed gone — and it is written in the present tense,
+ *   so a reader after the restart takes it for the current state. Ordinary
+ *   failures (network, preflight blockers, pnpm errors) may well still apply
+ *   after a restart and keep their diagnostic value, so they stay.
+ */
+function failedNow(detail, { staleOnRestart = false } = {}) {
   return {
     cancel: () => {},
-    done: Promise.resolve({ status: "failed", detail }),
+    done: Promise.resolve({ status: "failed", detail, staleOnRestart }),
     readOutput: () => "",
   };
 }
@@ -1752,7 +1842,11 @@ function runRemoveInner({ profile, packageName, _profileDir, _spawn }, selfHeale
   // hard as a valid one, and is left untouched for the recovery path.
   const markerPath = pendingMarkerPath(profileDir);
   if (existsSync(markerPath)) {
-    return failedNow(`profile "${profile}" has a pending install transaction (${markerPath}) — refusing to remove ${packageName} until it is resolved; restart dsh (startup recovery) or run \`dsh-plugin-guard guard recover\` first`);
+    // 存在性判断（同 markPendingSnapshot）：坏 marker 也照样挡路。所以这里
+    // 只能拿到「有」而拿不到「是什么」，文案相应保持笼统，但仍要给出路。
+    return failedNow(
+      `profile "${profile}" 里有一个还没了结的安装事务，在它了结之前无法卸载 ${packageName}。重启 dsh 会自动了结它（装好的提交、没批准的撤回），也可以运行 \`dsh-plugin-guard guard recover\` 手动处理（事务记录：${markerPath}）。`,
+      { staleOnRestart: true });
   }
   const manifestPath = join(profileDir, "package.json");
   if (!existsSync(manifestPath)) {
@@ -2093,7 +2187,9 @@ async function runTransactionFixtures() {
   }
 
   // 1a. exit 0 + "Ignored build scripts" 且未批准：必须停在批准闸（failed +
-  // needsApproval），携带 proof，绝不 finalize，回滚收掉 marker，且只 spawn 一次。
+  // needsApproval），携带 proof，绝不 finalize，且是暂停不是失败——现场与
+  // marker 原样保留给带 token 的重试（回滚会让重试的 approval token 必死，
+  // 见收尾处的真实事故注释），只 spawn 一次。
   {
     const { profileDir, cleanup } = makeTempProfile("ignored-gate");
     try {
@@ -2118,8 +2214,10 @@ async function runTransactionFixtures() {
         }],
       });
       const outcome = await producer.done;
+      const output = producer.readOutput();
+      const markerBefore = pendingMarkerPath(profileDir);
       check(
-        "退出码 0 + Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize",
+        "退出码 0 + Ignored build scripts（未批准）→ 停在批准闸，返回 proof，不 finalize，暂停保留 marker",
         outcome.status === "failed"
           && Array.isArray(outcome.needsApproval)
           && outcome.needsApproval.some((entry) => entry.name === "node-pty")
@@ -2133,9 +2231,101 @@ async function runTransactionFixtures() {
             && entry.contentHash !== "0".repeat(64)
             && entry.weeklyDownloads === 123)
           && calls.length === 1
-          && !existsSync(pendingMarkerPath(profileDir)),
-        `status=${outcome.status} calls=${calls.length} marker=${existsSync(pendingMarkerPath(profileDir))}`,
+          && existsSync(markerBefore)
+          && /paused for build-script approval/.test(output),
+        `status=${outcome.status} calls=${calls.length} marker=${existsSync(markerBefore)}`,
       );
+      check(
+        "暂停必须落盘到 marker（metadata.paused）——重启后的恢复靠它区分「装完待验证」与「停在批准闸被放弃」",
+        (() => {
+          try {
+            const marker = JSON.parse(readFileSync(markerBefore, "utf8"));
+            return marker?.metadata?.paused?.reason === "paused for build-script approval";
+          } catch { return false; }
+        })(),
+      );
+
+      // 1a-ter. 暂停期间装别的包：拒绝是对的（marker 是一次性事务），但用户
+      // 看不见 marker，所以报错必须点名挡路的是那次「停在允许安装依赖」的
+      // 安装，并给出让它让开的办法。这里 marker 仍带 paused。
+      {
+        const during = scriptedSpawn([{ code: 0, out: "Done\n" }]);
+        const duringOutcome = await runInstall({
+          profile: "p",
+          spec: "other-during-pause",
+          preflight: preflightStub("other-during-pause"),
+          _profileDir: profileDir,
+          _spawn: during.spawnFn,
+          _describe: async () => [],
+        }).done;
+        check(
+          // staleOnRestart：这条报错是现在时写的，而挡路的事务必然被启动恢复
+          // 了结——留到重启之后会被当成当前状态读，所以面板要撤掉它。
+          "暂停期间装别的包 → 拒绝，报错点名「停在允许安装依赖」+ 撤回办法 + 标记重启后失效",
+          duringOutcome.status === "failed"
+            && /停在「允许安装依赖」/.test(duringOutcome.detail ?? "")
+            && /重启 dsh/.test(duringOutcome.detail ?? "")
+            && duringOutcome.staleOnRestart === true
+            && during.calls.length === 0,
+          `status=${duringOutcome.status} detail=${(duringOutcome.detail ?? "").slice(0, 120)}`,
+        );
+      }
+
+      // 1a-bis. 同 spec 重试接管暂停的 marker：不再新建快照（回滚目标仍是
+      // 第一次安装前的现场），继续 spawn pnpm；这次给批准后的成功路径——
+      // completed 后 marker 保留给启动提交，且暂停标记必须已被接管清掉
+      // （否则启动提交会被它拦下错误回滚）。异 spec 则拒绝且不 spawn。
+      {
+        const snapshotRootDir = join(dirname(dirname(profileDir)), "guard", "snapshots");
+        const snapshotsBefore = readdirSync(snapshotRootDir, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
+        const retry = scriptedSpawn([{ code: 0, out: "Done in 1s\n" }]);
+        const retryProducer = runInstall({
+          profile: "p",
+          spec: "some-plugin",
+          preflight: preflightStub("some-plugin"),
+          _profileDir: profileDir,
+          _spawn: retry.spawnFn,
+          _describe: async () => [],
+        });
+        const retryOutcome = await retryProducer.done;
+        const retryOutput = retryProducer.readOutput();
+        const snapshotsAfter = readdirSync(snapshotRootDir, { withFileTypes: true }).filter((e) => e.isDirectory()).length;
+        check(
+          "同 spec 重试接管暂停的 marker → 复用原快照、继续安装并清掉暂停标记",
+          retryOutcome.status === "completed"
+            && retry.calls.length === 1
+            && /resuming the paused install transaction/.test(retryOutput)
+            && snapshotsAfter === snapshotsBefore
+            && existsSync(markerBefore)
+            && (() => {
+              try {
+                const marker = JSON.parse(readFileSync(markerBefore, "utf8"));
+                return marker?.metadata?.paused === undefined;
+              } catch { return false; }
+            })(),
+          `status=${retryOutcome.status} calls=${retry.calls.length} snapshots=${snapshotsBefore}->${snapshotsAfter}`,
+        );
+        const other = scriptedSpawn([{ code: 0, out: "Done\n" }]);
+        const otherOutcome = await runInstall({
+          profile: "p",
+          spec: "another-plugin",
+          preflight: preflightStub("another-plugin"),
+          _profileDir: profileDir,
+          _spawn: other.spawnFn,
+          _describe: async () => [],
+        }).done;
+        check(
+          // 此刻 paused 已被上面的接管清掉，所以报错走的是「未了结」那一支，
+          // 而不是「停在允许安装依赖」那一支。
+          "异 spec 遇既有（已非暂停）marker → 拒绝且不 spawn",
+          otherOutcome.status === "failed"
+            && /还没了结/.test(otherOutcome.detail ?? "")
+            && !/停在「允许安装依赖」/.test(otherOutcome.detail ?? "")
+            && otherOutcome.staleOnRestart === true
+            && other.calls.length === 0,
+          `status=${otherOutcome.status} calls=${other.calls.length}`,
+        );
+      }
       const call = calls[0] ?? { args: [], options: {} };
       check(
         "实装 argv/env：strict-dep-builds + peer 关闭 + cwd/shell 正确",
@@ -2468,6 +2658,8 @@ async function runTransactionFixtures() {
           && installOutcome.status === "failed"
           && removeOutcome.status === "failed"
           && /not a dependency/.test(removeOutcome.detail ?? "")
+          // 普通失败不标记：重启治不好「这个包本来就不在依赖里」。
+          && removeOutcome.staleOnRestart !== true
           && procs.length === 1,
         `procs=${procs.length} install=${installOutcome.status} remove=${removeOutcome.status} ${JSON.stringify(removeOutcome.detail)}`,
       );
@@ -2496,9 +2688,12 @@ async function runTransactionFixtures() {
       const snapshotsDir = join(dirname(marker), "snapshots");
       const leftoverSnapshots = existsSync(snapshotsDir) ? readdirSync(snapshotsDir) : [];
       check(
-        "损坏/既有 pending marker → install 不 spawn、不覆盖证据、不遗留新 snapshot",
+        // 不标 staleOnRestart：损坏的 marker 重启后仍然 fail-closed 留给人工
+        // 检查，不会被启动恢复了结——这条失败的原因活得过重启，面板要留着。
+        "损坏/既有 pending marker → install 不 spawn、不覆盖证据、不遗留新 snapshot，且不标记重启后失效",
         outcome.status === "failed"
-          && /already has a pending install marker/.test(outcome.detail ?? "")
+          && /读不出来的安装记录/.test(outcome.detail ?? "")
+          && outcome.staleOnRestart !== true
           && calls.length === 0
           && readFileSync(marker, "utf8") === corruptBytes
           && leftoverSnapshots.length === 0,
@@ -2521,7 +2716,8 @@ async function runTransactionFixtures() {
       check(
         "pending marker 存在 → remove 拒绝执行且不 spawn pnpm，marker 保留",
         outcome.status === "failed"
-          && /pending install transaction/.test(outcome.detail ?? "")
+          && /还没了结的安装事务/.test(outcome.detail ?? "")
+          && outcome.staleOnRestart === true
           && procs.length === 0
           && existsSync(pendingMarkerPath(profileDir)),
         `status=${outcome.status} procs=${procs.length} ${JSON.stringify(outcome.detail)}`,