@dsh-sup/dsh-core-linux-x64 0.1.6-BETA.5 → 0.1.6-BETA.6

package/core.cjs

@@ -60,11 +60,7 @@ var require_exec = __commonJS({
     function runAsync(bin, args, opts) {
       const o = opts || {};
       return new Promise((resolve) => {
-        execFile(bin, args, Object.assign({}, options(o), { encoding: "utf8" }), (err, stdout, stderr) => {
-          if (!err) {
-            resolve({ ok: true, code: "0", stdout: String(stdout == null ? "" : stdout), stderr: String(stderr == null ? "" : stderr), timedOut: false, error: null });
-            return;
-          }
+        const fail = (err) => {
           if (o.logger && o.logger.warn) {
             try {
               o.logger.warn("[exec] (async) " + bin + " " + (args || []).join(" ").slice(0, 80) + " failed: " + (err && err.message || err));
@@ -75,12 +71,25 @@ var require_exec = __commonJS({
           resolve({
             ok: false,
             code: err.status != null ? String(err.status) : null,
-            stdout: String(stdout == null ? err.stdout || "" : stdout),
-            stderr: String(stderr == null ? err.stderr || "" : stderr),
+            stdout: String(err.stdout || ""),
+            stderr: String(err.stderr || ""),
             timedOut,
             error: err && err.message ? String(err.message) : String(err)
           });
-        });
+        };
+        try {
+          execFile(bin, args, Object.assign({}, options(o), { encoding: "utf8" }), (err, stdout, stderr) => {
+            if (!err) {
+              resolve({ ok: true, code: "0", stdout: String(stdout == null ? "" : stdout), stderr: String(stderr == null ? "" : stderr), timedOut: false, error: null });
+              return;
+            }
+            err.stdout = stdout;
+            err.stderr = stderr;
+            fail(err);
+          });
+        } catch (e) {
+          fail(e);
+        }
       });
     }
     function runOutAsync(bin, args, opts) {
@@ -503,15 +512,21 @@ var require_probe = __commonJS({
       }
       return null;
     }
-    function isAlive(pid) {
-      if (!Number.isInteger(pid) || pid <= 0) return false;
+    function probeAlive(pid) {
+      if (!Number.isInteger(pid) || pid <= 0) return "dead";
       try {
         process.kill(pid, 0);
-        return true;
+        return "alive";
       } catch (e) {
-        return !!e && e.code === "EPERM";
+        const code = e && e.code;
+        if (code === "EPERM") return "alive";
+        if (code === "ESRCH") return "dead";
+        return "unknown";
       }
     }
+    function isAlive(pid) {
+      return probeAlive(pid) === "alive";
+    }
     function isZombie(pid) {
       if (!Number.isInteger(pid) || pid <= 0 || isWindows) return false;
       if (isLinux) {
@@ -611,6 +626,7 @@ var require_probe = __commonJS({
       readCmdline: readCmdline2,
       pgrepList,
       isAlive,
+      probeAlive,
       isZombie
     };
   }
@@ -637,6 +653,7 @@ var require_pidlookup = __commonJS({
       readCmdline: readCmdline2,
       pgrepList,
       isAlive,
+      probeAlive,
       isZombie
     } = require_probe();
     var isLinux = process.platform === "linux";
@@ -659,6 +676,7 @@ var require_pidlookup = __commonJS({
     module2.exports = {
       findListeningPid,
       isAlive,
+      probeAlive,
       isZombie,
       readCmdline: readCmdline2,
       normCmdline,
@@ -929,7 +947,7 @@ var require_version = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function guardVersion() {
-      if (true) return String("0.1.6-BETA.5");
+      if (true) return String("0.1.6-BETA.6");
       try {
         return JSON.parse(fs2.readFileSync(path2.join(__dirname, "..", "..", "package.json"), "utf8")).version || "unknown";
       } catch {
@@ -949,6 +967,8 @@ var require_main_record = __commonJS({
       const reg = () => typeof g.getManagedObjects === "function" ? g.getManagedObjects() : null;
       const logger = () => typeof g.getLogger === "function" ? g.getLogger() : null;
       let fallback = null;
+      const DEFAULTS = { restartCount: 0, backoffLevel: 0, backoffUntil: null, crashWindowStart: null, crashWindowRestarts: 0 };
+      const buffered = /* @__PURE__ */ new Map();
       function entryOf() {
         const m = reg();
         if (!m || typeof m.get !== "function") return null;
@@ -964,8 +984,8 @@ var require_main_record = __commonJS({
             kind: "dsh",
             id: "main",
             name: "\u4E3B\u5B9E\u4F8B",
+            // 不带 guardian（B2-2/B2-3）：目录 entry 形态已无该键，守护开关权威在 dsh-main.json。
             desired: "running",
-            guardian: true,
             ownership: { ports: [], rootPath: null, unit: null, daemonScript: null, processMode: "spawn", meta: null },
             phase: "stopped",
             lastObserved: null,
@@ -994,11 +1014,26 @@ var require_main_record = __commonJS({
         }
       }
       function storeOf() {
-        return entryOf() || fallbackEntryOf();
+        const e = entryOf();
+        if (!e) return fallbackEntryOf();
+        if (buffered.size) flushBuffered(e);
+        return e;
+      }
+      function flushBuffered(e) {
+        let changed = false;
+        for (const [k, v] of buffered) {
+          if (k in DEFAULTS && e[k] === DEFAULTS[k] && e[k] !== v) {
+            e[k] = v;
+            changed = true;
+          }
+        }
+        buffered.clear();
+        if (changed) persistCrashField();
       }
       function fieldOf(name, v, write) {
         const e = storeOf();
         if (write) {
+          if (e === fallback && name in DEFAULTS) buffered.set(name, v);
           if (e[name] !== v) {
             e[name] = v;
             persistCrashField();
@@ -1280,8 +1315,8 @@ var require_fields = __commonJS({
         try {
           if (m && typeof m.setPhase === "function" && record.entryOf() === e) {
             if (e.phase !== ph) m.setPhase("main", ph);
-          } else if (e.phase !== ph) {
-            e.phase = ph;
+          } else {
+            record.fieldOf("phase", ph, true);
           }
         } catch (e2) {
           const l = logger();
@@ -1308,8 +1343,8 @@ var require_fields = __commonJS({
         try {
           if (m && typeof m.update === "function" && record.entryOf() === e) {
             if (e.desired !== want) m.update("main", { desired: want });
-          } else if (e.desired !== want) {
-            e.desired = want;
+          } else {
+            record.fieldOf("desired", want, true);
           }
         } catch (e2) {
           const l = logger();
@@ -1511,6 +1546,7 @@ var require_desired = __commonJS({
       const intents = () => typeof g.getIntents === "function" ? g.getIntents() : null;
       const events = () => typeof g.getEvents === "function" ? g.getEvents() : null;
       const configPath = () => typeof g.getConfigPath === "function" ? g.getConfigPath() : null;
+      const configAliases = () => typeof g.getConfigAliases === "function" ? g.getConfigAliases() || [] : [];
       const logger = () => typeof g.getLogger === "function" ? g.getLogger() : null;
       const setCrashHalted = typeof g.setCrashHalted === "function" ? g.setCrashHalted : () => {
       };
@@ -1592,7 +1628,9 @@ var require_desired = __commonJS({
             }
           }
           Object.assign(cur, patch);
-          delete cur.switcherAutoStart;
+          for (const [from, to] of configAliases()) {
+            if (cur[from] !== void 0 && cur[to] !== void 0) delete cur[from];
+          }
           writeAtomic(p, JSON.stringify(cur, null, 2), { mode: 384 });
           return true;
         } catch (e) {
@@ -1741,6 +1779,7 @@ var require_collaborator = __commonJS({
         getIntents: g.getIntents,
         getEvents: g.getEvents,
         getConfigPath: g.getConfigPath,
+        getConfigAliases: g.getConfigAliases,
         getLogger: logger,
         setCrashHalted: g.setCrashHalted,
         setManualRestart: g.setManualRestart,
@@ -2022,13 +2061,11 @@ var require_specs = __commonJS({
       const daemons = () => typeof g.getDaemons === "function" ? g.getDaemons() : null;
       const logger = () => typeof g.getLogger === "function" ? g.getLogger() : null;
       function mainSpec() {
-        const m = state().readMainMeta();
         return {
           kind: "dsh",
           id: "main",
           name: "\u4E3B\u5B9E\u4F8B",
           desired: state().desired() === "stopped" ? "stopped" : "running",
-          guardian: m.guardian === true,
           ownership: {
             ports: [{ role: "dsh-main", port: Number(config().targetPort || 3080) }],
             rootPath: path2.join(os2.homedir(), ".dsh"),
@@ -2048,8 +2085,6 @@ var require_specs = __commonJS({
           kind: "sandbox-instance",
           id: inst.id,
           name: String(inst.name || inst.id),
-          desired: inst.state && inst.state.desired === "stopped" ? "stopped" : "running",
-          guardian: inst.guardian === true,
           ownership: {
             ports: [{ role: "inst", port: Number(inst.port) }],
             rootPath,
@@ -2063,7 +2098,7 @@ var require_specs = __commonJS({
         if (!m || !spec) return;
         try {
           const existing = m.get(spec.id);
-          if (existing) m.update(spec.id, { desired: spec.desired, guardian: spec.guardian, name: spec.name, ownership: spec.ownership });
+          if (existing) m.update(spec.id, { desired: spec.desired, name: spec.name, ownership: spec.ownership });
           else m.register(spec);
         } catch (e) {
           const l = logger();
@@ -3172,6 +3207,14 @@ var require_store2 = __commonJS({
       }
       return out;
     }
+    function fileStamp(file) {
+      try {
+        const st = fs2.statSync(file);
+        return st.mtimeMs + ":" + st.size;
+      } catch {
+        return "0";
+      }
+    }
     function saveRecords(file, records) {
       try {
         fs2.mkdirSync(path2.dirname(file), { recursive: true });
@@ -3197,7 +3240,7 @@ var require_store2 = __commonJS({
       }
       return out;
     }
-    module2.exports = { loadRecords, saveRecords, extraRecords };
+    module2.exports = { loadRecords, saveRecords, extraRecords, fileStamp };
   }
 });
 
@@ -3440,6 +3483,7 @@ var require_alloc = __commonJS({
         }
         r._allocLock = true;
         this._xrel = await this._acquireXLock();
+        r._syncFromDisk();
       }
       _releaseAlloc() {
         this._registry._allocLock = false;
@@ -3694,6 +3738,14 @@ var require_pool = __commonJS({
       _load() {
         this._records = /* @__PURE__ */ new Map();
         for (const r of store.loadRecords(this._file)) this._records.set(r.port, r);
+        this._diskStamp = store.fileStamp(this._file);
+      }
+      /** 跨进程对时（B2-5）：ports.json 是多进程（守卫 + lan-daemon）共享事实源，各方全量
+       *  read-modify-write，陈旧内存快照会在 _save 时把他人新增整段覆盖丢失、或让分配器抢注
+       *  他进程已登记的端口。指纹（mtime+size）变化即重载——所有写口与冲突判读口的入口。
+       *  不动 _allocLock（复位会击穿本进程在飞分配的互斥）。 */
+      _syncFromDisk() {
+        if (store.fileStamp(this._file) !== this._diskStamp) this._load();
       }
       /** 重新从文件加载（读路径先 reload，以权威文件为准）。 */
       reload() {
@@ -3703,6 +3755,7 @@ var require_pool = __commonJS({
       }
       _save() {
         store.saveRecords(this._file, [...this._records.values()]);
+        this._diskStamp = store.fileStamp(this._file);
       }
       /** 通用记录迁移：owner 命中任一前缀的记录 oldFile 到 newFile，并从旧文件清除。 */
       migrateByOwnerPrefix(oldFile, newFile, prefixes) {
@@ -3711,6 +3764,7 @@ var require_pool = __commonJS({
       /* 登记（固定 / 用户 / 动态） */
       /** 登记固定端口；同端口已被其它固定角色占用则报错；user/动态记录由固定权威覆盖。 */
       register(role, port) {
+        this._syncFromDisk();
         const p = Number(port);
         if (!Number.isInteger(p) || p <= 0 || p > 65535) throw new Error("ports.register: \u975E\u6CD5\u7AEF\u53E3 " + port);
         const existing = this._records.get(p);
@@ -3737,6 +3791,7 @@ var require_pool = __commonJS({
       }
       /** 登记用户配置端口（实例内部端口等）；冲突（固定/保留池/已占）抛错。 */
       registerUser(port, owner) {
+        this._syncFromDisk();
         const p = Number(port);
         if (!Number.isInteger(p) || p <= 0 || p > 65535) throw new Error("ports.registerUser: \u975E\u6CD5\u7AEF\u53E3 " + port);
         if (this._records.has(p)) throw new Error("\u7AEF\u53E3 " + p + " \u5DF2\u88AB [" + this._records.get(p).role + "] \u5360\u7528");
@@ -3748,6 +3803,7 @@ var require_pool = __commonJS({
       }
       /** 按 owner 释放端口（对象删除/关闭时调用）。 */
       unregister(owner) {
+        this._syncFromDisk();
         let removed = false;
         for (const [p, r] of this._records) {
           if (r.owner === owner) {
@@ -3760,6 +3816,7 @@ var require_pool = __commonJS({
       /** 释放端口：不传 ownerId 按端口号；传了则仅当登记 owner 匹配才释放。空值检查必须先于 owner 比较。
        *  @returns {boolean} 是否真的释放了一条记录 */
       release(port, ownerId) {
+        this._syncFromDisk();
         const p = Number(port);
         const rec = this._records.get(p);
         if (!rec) return false;
@@ -3772,6 +3829,7 @@ var require_pool = __commonJS({
       /** 按 role 取端口（固定端口）。同 role 有多条（老版本避让留下的残留记录）时取**最新登记**：
        *  桌面壳读 ports.json 用的是同一判据，两侧不许对「哪个端口是当前的」给出不同答案。 */
       get(role) {
+        this._syncFromDisk();
         let best = null;
         for (const r of this._records.values()) {
           if (r.role !== role) continue;
@@ -3780,12 +3838,15 @@ var require_pool = __commonJS({
         return best ? best.port : null;
       }
       isRegistered(port) {
+        this._syncFromDisk();
         return this._records.has(Number(port));
       }
       recordOf(port) {
+        this._syncFromDisk();
         return this._records.get(Number(port)) || null;
       }
       byOwner(owner) {
+        this._syncFromDisk();
         for (const r of this._records.values()) if (r.owner === owner) return r.port;
         return null;
       }
@@ -3798,6 +3859,7 @@ var require_pool = __commonJS({
       }
       /** 全部端口清单（按端口升序）。 */
       list() {
+        this._syncFromDisk();
         return [...this._records.values()].sort((a, b) => a.port - b.port);
       }
       /** 只读聚合：本注册表 + 同目录下其它注册表文件（去重，本表优先）。
@@ -3822,6 +3884,7 @@ var require_pool = __commonJS({
       }
       /** 显式登记已分配端口（复用持久化端口时调用）。 */
       allocateMark(port, role, owner) {
+        this._syncFromDisk();
         const p = Number(port);
         if (!this._records.has(p)) {
           this._records.set(p, { port: p, role: role || "dynamic", owner: owner || "dynamic", createdAt: Date.now() });
@@ -4016,6 +4079,7 @@ var require_collaborators = __commonJS({
     var { createCtl } = require_collaborator3();
     var { createOrphanScan } = require_collaborator4();
     var { ENTRY_FIELDS, PROC_FIELDS } = require_field_tables();
+    var { aliases: CONFIG_ALIASES } = require_domain_config();
     var THIN_SPEC = {
       ctl: {
         call: "_ctlCall",
@@ -4105,6 +4169,7 @@ var require_collaborators = __commonJS({
       const state = createStateStore({
         getConfig: () => host2.config,
         getConfigPath: () => host2.configPath,
+        getConfigAliases: () => CONFIG_ALIASES,
         getLogger: () => host2.logger,
         getEvents: () => host2.events,
         getManagedObjects: () => host2.managedObjects,
@@ -4150,7 +4215,6 @@ var require_collaborators = __commonJS({
         return host2;
       };
       host2._dshEntry = () => state.dshEntry();
-      host2._mainFallbackEntry = () => state.fallbackEntry();
       host2._persistCrashField = () => state.persistCrashField();
       host2._mStore = () => state.store();
       host2._mField = function(name, v) {
@@ -7817,8 +7881,8 @@ var require_instance_adapter = __commonJS({
           return { ok: running, error: running ? null : "\u6C99\u7BB1\u5B9E\u4F8B\u672A\u8FD0\u884C" };
         },
         /** 目录项 <- 实例域状态对齐（监督拍后调用）：实例已删 -> 注销（防死登记）；存在 -> 经
-         *  sandboxSpec 同步 name/guardian/ownership + phase 落目录词表。desired 走的是实例意图字段的
-         *  投影（不是 phase 推导），所以观测路径写它不会改写任何意图（契约 M-1）。 */
+         *  sandboxSpec 同步 name/guardian/ownership + phase 落目录词表。沙箱不申报 desired
+         *  （运行意图无第二落点，B2-1），观测路径因此不可能改写任何意图。 */
         _syncSandboxRegistryEntry(entry) {
           const d = depsOf(this);
           if (!entry || !d.managedObjects() || !d.instances()) return;
@@ -7851,6 +7915,9 @@ var require_decide = __commonJS({
   "src/app/main/decide.js"(exports2, module2) {
     "use strict";
     var pidlook = require_pidlookup();
+    function startDeadlinePassed(deadline, now) {
+      return !!(deadline && now > deadline);
+    }
     var DEPS = /* @__PURE__ */ new WeakMap();
     function depsOf(host2) {
       let d = DEPS.get(host2);
@@ -7938,7 +8005,7 @@ var require_decide = __commonJS({
             upgradeHold: d.upgradeHold() === true,
             manualRestart: d.manualRestart() === true,
             spawnBlocked: !!(d.mSpawnBlockedUntil() && now < d.mSpawnBlockedUntil()),
-            startDeadlinePassed: !!(d.mStartDeadline() && now > d.mStartDeadline()),
+            startDeadlinePassed: startDeadlinePassed(d.mStartDeadline(), now),
             restartDue: d.mRestartAt() === null || now >= d.mRestartAt(),
             backoffDue: d.mBackoffUntil() === null || now >= d.mBackoffUntil(),
             // `_shouldRun()` 有两个否决位，快照必须建模（crashHalted/sessionHalting），否则影子每拍
@@ -8013,7 +8080,9 @@ var require_decide = __commonJS({
         _decideCrashRestart(reason) {
           return decideCrashRestart(reason);
         }
-      }
+      },
+      // 非 host 方法：纯谓词导出，controller 与本文件快照判据共用（facets 只安装 methods）。
+      startDeadlinePassed
     };
   }
 });
@@ -8064,6 +8133,7 @@ var require_controller = __commonJS({
     "use strict";
     var pidlook = require_pidlookup();
     var monitor = require_monitor();
+    var { startDeadlinePassed } = require_decide();
     var DEPS = /* @__PURE__ */ new WeakMap();
     function depsOf(host2) {
       let d = DEPS.get(host2);
@@ -8168,6 +8238,9 @@ var require_controller = __commonJS({
           mStartDeadline() {
             return host2._mStartDeadline();
           },
+          mSetStartDeadline(v) {
+            return host2._mSetStartDeadline(v);
+          },
           mRestartAt() {
             return host2._mRestartAt();
           },
@@ -8315,7 +8388,9 @@ var require_controller = __commonJS({
               }
               case "STARTING": {
                 if (portUp && healthOk) d.main().enterRunning();
-                else if (Date.now() > d.mStartDeadline()) d.main().beginRestart("start_timeout", { countCrash: true });
+                else if (d.mStartDeadline() === null) {
+                  d.mSetStartDeadline(Date.now() + d.config().startTimeoutMs);
+                } else if (startDeadlinePassed(d.mStartDeadline(), Date.now())) d.main().beginRestart("start_timeout", { countCrash: true });
                 break;
               }
               case "RUNNING": {
@@ -9569,13 +9644,7 @@ var require_process_wait = __commonJS({
     async function waitProcessExit(pid, timeoutMs) {
       const deadline = Date.now() + timeoutMs;
       while (Date.now() < deadline) {
-        let alive = false;
-        try {
-          alive = pidlook.isAlive ? pidlook.isAlive(pid) : true;
-        } catch {
-          alive = false;
-        }
-        if (!alive) return true;
+        if (!pidlook.isAlive(pid)) return true;
         await new Promise((r) => setTimeout(r, 200));
       }
       return false;
@@ -9693,13 +9762,15 @@ var require_process3 = __commonJS({
         } catch {
         }
       }
+      /** 判活（platform/pidlookup.probeAlive 单源）：unknown 不 fail-open——必须有第二条证据
+       *  （ctl 端口属主正是该 pid 且 cmdline 匹配本服务）才认活，否则按死走 reclaim/spawn。
+       *  fail-open 会让已死 daemon 被判活，此后既不接管也不拉起，永不自愈。 */
       _pidAlive(pid) {
         if (!pid) return false;
-        try {
-          return pidlook.isAlive ? !!pidlook.isAlive(pid) : true;
-        } catch {
-          return true;
-        }
+        const st = pidlook.probeAlive(pid);
+        if (st === "alive") return true;
+        if (st === "dead") return false;
+        return this._ctlOwnerPid() === pid;
       }
       /** ctl 端口的监听者是否就是本服务进程（cmdline 匹配）。 */
       _ctlOwnerPid() {
@@ -10205,6 +10276,7 @@ var require_identity = __commonJS({
     "use strict";
     var fs2 = require("node:fs");
     var path2 = require("node:path");
+    var { isAlive } = require_pidlookup();
     function lockPid(p) {
       if (!p) return null;
       try {
@@ -10215,13 +10287,7 @@ var require_identity = __commonJS({
       }
     }
     function pidAlive2(pid) {
-      if (!Number.isInteger(pid) || pid <= 0) return false;
-      try {
-        process.kill(pid, 0);
-        return true;
-      } catch (e) {
-        return !!(e && e.code === "EPERM");
-      }
+      return isAlive(pid);
     }
     function acquireLock2(p, onErr) {
       if (!p) return false;
@@ -10602,7 +10668,7 @@ var require_ports2 = __commonJS({
     "use strict";
     var probe = require_probe2();
     var ports = require_ports().shared;
-    var SIBLING_REGISTRIES = ["ports-lan.json", "ports-router.json"];
+    var SIBLING_REGISTRIES = ["ports-router.json"];
     var DEPS = /* @__PURE__ */ new WeakMap();
     function depsOf(host2) {
       let d = DEPS.get(host2);
@@ -11198,24 +11264,32 @@ var require_lan2 = __commonJS({
         }
       }
       return {
-        /** 远程控制模式唯一写入口（off|lan|wan）。wan 前置闸：必须先有合规访问令牌。 */
+        /** 远程控制模式唯一写入口（off|lan|wan）。mode 必须显式给出——缺省归 'off' 会让
+         *  漏字段的请求静默关闭远程控制。wan 前置闸：必须先有合规访问令牌。 */
         setRemoteMode(id, mode) {
-          const want = mode === "lan" || mode === "wan" ? mode : "off";
+          if (mode !== "off" && mode !== "lan" && mode !== "wan") {
+            return { ok: false, error: "mode \u5FC5\u987B\u663E\u5F0F\u7ED9\u51FA\uFF08off|lan|wan\uFF09" };
+          }
           const target = resolveTarget(id);
           if (!target) return { ok: false, error: "\u5B9E\u4F8B\u4E0D\u5B58\u5728" };
-          if (want === "wan") {
+          if (mode === "wan") {
             const v = validateWanAccess({ remoteToken: target.remoteToken });
             if (!v.ok) return { ok: false, error: v.error };
           }
           if (target.kind === "main") {
-            if (target.mode !== want) applyMainIntent({ remoteMode: want }, { id: "main", name: "\u539F\u751F DSH", mode: want });
+            if (target.mode !== mode) applyMainIntent({ remoteMode: mode }, { id: "main", name: "\u539F\u751F DSH", mode });
             return { ok: true };
           }
-          return g.getInstances().updateInstance(id, { remoteMode: want });
+          return g.getInstances().updateInstance(id, { remoteMode: mode });
         },
-        /** 访问令牌唯一写入口（空串=清除；lan 模式可无令牌，wan 模式的守门由执行边界闸兜住）。 */
+        /** 访问令牌唯一写入口。token 必须是字符串：空串=显式清除；缺字段/非字符串=请求方缺陷，
+         *  拒绝而非当作清除（漏 token 字段清掉访问凭据是事故，不是语义）。lan 模式可无令牌，
+         *  wan 模式的守门由执行边界闸兜住。 */
         setRemoteToken(id, token) {
-          const next = String(token || "");
+          if (typeof token !== "string") {
+            return { ok: false, error: "token \u5FC5\u987B\u663E\u5F0F\u7ED9\u51FA\uFF08\u7A7A\u4E32=\u6E05\u9664\uFF09" };
+          }
+          const next = token;
           if (next && !remoteTokenStrength(next).ok) {
             return { ok: false, error: "\u8FDC\u7A0B\u8BBF\u95EE\u4EE4\u724C\uFF08remoteToken\uFF09\u81F3\u5C11 8 \u4F4D" };
           }
@@ -11299,16 +11373,17 @@ var require_env_catalog = __commonJS({
       const v = ex2.runOut(bin, (Array.isArray(args) ? args : []).concat(["--version"]), { timeoutMs: 3e3 });
       return v ? v.trim() || null : null;
     }
+    function whichVersionAsync(bin, args) {
+      return ex2.runOutAsync(bin, (Array.isArray(args) ? args : []).concat(["--version"]), { timeoutMs: 3e3 }).then((v) => v ? v.trim() || null : null);
+    }
     var _verCache = /* @__PURE__ */ new Map();
     var CACHE_TTL = 1e4;
-    function cachedWhichVersion(bin, args) {
+    function cacheKey(bin, args) {
       const a = Array.isArray(args) ? args : [];
-      const key = bin + "\0" + a.join("\0");
-      const hit = _verCache.get(key);
-      const now = Date.now();
-      if (hit && now - hit.at < CACHE_TTL) return hit.v;
-      const v = whichVersion(bin, a);
-      _verCache.set(key, { at: now, v });
+      return bin + "\0" + a.join("\0");
+    }
+    function cacheSet(key, v) {
+      _verCache.set(key, { at: Date.now(), v });
       if (_verCache.size > 16) {
         let oldest = null;
         for (const [k, e] of _verCache) if (!oldest || e.at < oldest.at) oldest = { k, at: e.at };
@@ -11316,6 +11391,19 @@ var require_env_catalog = __commonJS({
       }
       return v;
     }
+    function cachedWhichVersion(bin, args) {
+      const key = cacheKey(bin, args);
+      const hit = _verCache.get(key);
+      const now = Date.now();
+      if (hit && now - hit.at < CACHE_TTL) return hit.v;
+      return cacheSet(key, whichVersion(bin, args));
+    }
+    function cachedWhichVersionAsync(bin, args) {
+      const key = cacheKey(bin, args);
+      const hit = _verCache.get(key);
+      if (hit && Date.now() - hit.at < CACHE_TTL) return Promise.resolve(hit.v);
+      return whichVersionAsync(bin, args).then((v) => cacheSet(key, v));
+    }
     var MIN_NODE_DEFAULT = "v22.12.0";
     var _runtimeMetaCache = null;
     var _runtimeMetaAt = 0;
@@ -11342,50 +11430,68 @@ var require_env_catalog = __commonJS({
       }
       return true;
     }
-    function probeNode() {
-      const v = cachedWhichVersion("node");
+    function nodeVerdict(v) {
       if (!v) return null;
       const m = /v?(\d+\.\d+\.\d+)/.exec(String(v));
       const ver = m ? m[1] : String(v).trim();
       const min = String(runtimeMeta().minNode || MIN_NODE_DEFAULT);
       return { version: "v" + ver, min, meets: verAtLeast(ver, min) };
     }
+    function probeNode() {
+      return nodeVerdict(cachedWhichVersion("node"));
+    }
+    function probeNodeAsync() {
+      return cachedWhichVersionAsync("node").then(nodeVerdict);
+    }
     function probeNpm() {
       const l = runtime.npmLauncher();
       return cachedWhichVersion(l.program, l.args);
     }
+    function probeNpmAsync() {
+      const l = runtime.npmLauncher();
+      return cachedWhichVersionAsync(l.program, l.args);
+    }
     var SYSTEM_ENTRIES = {
-      node: { label: "Node.js", required: true, probe: probeNode },
-      npm: { label: "npm", required: true, probe: probeNpm },
-      git: { label: "git", required: false, probe: () => cachedWhichVersion("git") }
+      node: { label: "Node.js", required: true, probe: probeNode, probeAsync: probeNodeAsync },
+      npm: { label: "npm", required: true, probe: probeNpm, probeAsync: probeNpmAsync },
+      git: { label: "git", required: false, probe: () => cachedWhichVersion("git"), probeAsync: () => cachedWhichVersionAsync("git") }
     };
+    function entryView(id, e, v) {
+      if (v && typeof v === "object" && typeof v.meets === "boolean") {
+        return {
+          label: e.label,
+          required: e.required,
+          state: v.meets ? "ok" : "outdated",
+          version: v.version,
+          min: v.min,
+          meets: v.meets,
+          detail: v.meets ? v.version : v.version + "\uFF08\u4F4E\u4E8E\u6700\u4F4E\u8981\u6C42 " + v.min + "\uFF09"
+        };
+      }
+      return { label: e.label, required: e.required, state: v ? "ok" : "missing", detail: v };
+    }
     var EnvCatalog = class {
       constructor(config) {
         this.config = config || {};
       }
-      /** 系统二进制条目探测：{ id: { label, required, state, detail } }。state 三态：
-       *  ok = 存在且满足门槛（Node 需 >= 壳投放的 minNode）；outdated = 存在但低于门槛；missing = 不存在。
-       *  兼容：detail 保持字符串，新增字段（version/min/meets）放 detail 之外，不破坏既有契约。 */
+      /** 系统二进制条目探测（同步口径）：{ id: 条目视图 }。仅限启动早期/CLI；HTTP 路径用 probeAsync。 */
       probe() {
         const out = {};
         for (const [id, e] of Object.entries(SYSTEM_ENTRIES)) {
-          const v = e.probe() || null;
-          if (v && typeof v === "object" && typeof v.meets === "boolean") {
-            out[id] = {
-              label: e.label,
-              required: e.required,
-              state: v.meets ? "ok" : "outdated",
-              version: v.version,
-              min: v.min,
-              meets: v.meets,
-              detail: v.meets ? v.version : v.version + "\uFF08\u4F4E\u4E8E\u6700\u4F4E\u8981\u6C42 " + v.min + "\uFF09"
-            };
-          } else {
-            out[id] = { label: e.label, required: e.required, state: v ? "ok" : "missing", detail: v };
-          }
+          out[id] = entryView(id, e, e.probe() || null);
         }
         return out;
       }
+      /** 异步口径：条目并行探测（最坏 3s x N 的串行冻结 -> 全程不阻塞事件循环）。 */
+      async probeAsync() {
+        const entries = Object.entries(SYSTEM_ENTRIES);
+        const vals = await Promise.all(entries.map(([, e]) => e.probeAsync()));
+        const out = {};
+        entries.forEach(([id, e], i) => {
+          out[id] = entryView(id, e, vals[i] || null);
+        });
+        return out;
+      }
       /** 内核更新依赖条目（单写入者契约：安装/重启归桌面壳，守卫只读 corePackageName 查版本状态）。
        *  id 仍为 selfUpdate 以兼容既有 /env/status 消费方。 */
       selfUpdateEntry() {
@@ -11429,20 +11535,22 @@ var require_env = __commonJS({
     var fs2 = require("node:fs");
     var { EnvCatalog } = require_env_catalog();
     var runtimeContract = require_runtime();
-    function envCatalogSummary(that) {
+    async function envCatalogSummary(that) {
       const cat = new EnvCatalog(that.config);
       const extra = {};
       const d = that.dshenvStatus();
       extra.dsh = cat.dshEntry(d.binOk, d.installed, d.bin);
       extra.selfUpdate = cat.selfUpdateEntry();
-      return cat.summary(extra);
+      return cat.summary(extra, await cat.probeAsync());
     }
     module2.exports = {
       methods: {
-        envStatus() {
+        // 异步：全部子进程探测（EnvCatalog/契约回读）走异步口径——本方法挂在 /env/status 上，
+        //   同步 execFileSync 会把守卫事件循环冻结在探测超时上（心跳/自愈停摆，B1-6 收口）。
+        async envStatus() {
           const c = runtimeContract.read() || {};
-          const cat = new EnvCatalog(this.config).probe();
-          const en = this.nativeManager && typeof this.nativeManager.checkEnvironment === "function" ? this.nativeManager.checkEnvironment() : null;
+          const cat = await new EnvCatalog(this.config).probeAsync();
+          const en = this.nativeManager && typeof this.nativeManager.checkEnvironment === "function" ? await this.nativeManager.checkEnvironment() : null;
           return {
             node: { detected: cat.node.detail || null, runtime: c.nodeVersion || null, path: c.nodePath || null },
             // npm 与 node 同构三段：detected = 本机实跑版本；runtime = 壳实跑后投放的版本
@@ -11454,7 +11562,7 @@ var require_env = __commonJS({
             ok: cat.node.state === "ok" && cat.npm.state === "ok",
             npmRoot: en ? en.npmRoot : null,
             // EnvCatalog 声明式视图（面板环境卡用）
-            catalog: envCatalogSummary(this),
+            catalog: await envCatalogSummary(this),
             // 平台能力矩阵：三平台静态档位 x 实际工具探测；前端据此做能力感知呈现与降级提示。
             capabilities: (() => {
               try {
@@ -11680,15 +11788,16 @@ var require_versions = __commonJS({
             return { ok: false, error: e.message };
           }
         },
-        /** 读磁盘上运行位的自报版本：spawn --version，解析版本行。
+        /** 读磁盘上运行位的自报版本：spawn --version，解析版本行（异步：20s 上限的同步 exec
+         *  在 HTTP 路径上会冻结守卫整条事件循环，判据不变）。
          *  条件是 updatable（sea-binary 或 launcher）：launcher 的 bin 入口同样可执行，
          *  若只认 sea-binary 则发布态永远读不到磁盘实况，updatePending 恒 false。
          *  source-shell 不支持：其 --version 报的是开发目录版本，与 npm 安装无关。 */
-        _readBinarySelfVersion() {
+        async _readBinarySelfVersion() {
           const dep = deploy.detect();
           if (!dep.updatable || !dep.runningTarget) return null;
           try {
-            const out = ex2.runOut(dep.runningTarget, ["--version"], { timeoutMs: 2e4 });
+            const out = await ex2.runOutAsync(dep.runningTarget, ["--version"], { timeoutMs: 2e4 });
             const m = /dsh-supervisor v([^\s]+)/.exec(out);
             return m ? m[1] : null;
           } catch {
@@ -11710,18 +11819,18 @@ var require_versions = __commonJS({
           }
           return dir;
         },
-        /** 本地视角（无网络 I/O，同步安全）：commit + 是否配了 upstream。 */
-        guardVersionLocal() {
+        /** 本地视角（无网络 I/O；git 子进程异步执行——同步 spawn 会冻结事件循环，
+         *  消费方含 HTTP 路径，见 exec.js 同步仅限启动早期/CLI 的纪律）。 */
+        async guardVersionLocal() {
           const d = depsOf(this);
           const root = d.vcsRoot();
-          let commit = null;
-          commit = (ex2.runOut("git", ["-C", root, "rev-parse", "--short", "HEAD"]) || "").trim() || null;
+          const [rawCommit, rawUp] = await Promise.all([
+            ex2.runOutAsync("git", ["-C", root, "rev-parse", "--short", "HEAD"]),
+            ex2.runOutAsync("git", ["-C", root, "rev-parse", "--abbrev-ref", "@{u}"])
+          ]);
+          const commit = (rawCommit || "").trim() || null;
           let upstream = "local";
-          try {
-            const up = (ex2.runOut("git", ["-C", root, "rev-parse", "--abbrev-ref", "@{u}"]) || "").trim();
-            if (up) upstream = "git-repo";
-          } catch {
-          }
+          if ((rawUp || "").trim()) upstream = "git-repo";
           return { version: d.guardVersion(), runningVersion: d.guardVersion(), commit, updateAvailable: false, upstream, latest: d.guardVersion() };
         },
         /** 完整版本检查（async）：本地 commit + 远端 fetch 比对。
@@ -11729,20 +11838,17 @@ var require_versions = __commonJS({
          *  fetch 失败/超时只降级为「本地视图」，不抛错。 */
         async guardVersionCheck() {
           const d = depsOf(this);
-          const base = d.guardVersionLocal();
+          const base = await d.guardVersionLocal();
           if (base.upstream !== "git-repo") return base;
           const root = d.vcsRoot();
           const fetchOk = await ex2.runOutAsync("git", ["-C", root, "fetch", "--quiet"], { timeoutMs: 1e4 }) !== null;
           if (!fetchOk) return base;
           let updateAvailable = false;
-          try {
-            const ahead = (ex2.runOut("git", ["-C", root, "rev-list", "--count", "HEAD..@{u}"]) || "").trim();
-            updateAvailable = parseInt(ahead, 10) > 0;
-          } catch {
-          }
+          const ahead = (await ex2.runOutAsync("git", ["-C", root, "rev-list", "--count", "HEAD..@{u}"], { timeoutMs: 1e4 }) || "").trim();
+          updateAvailable = parseInt(ahead, 10) > 0;
           const dep = deploy.detect();
           let diskVersion = null;
-          if (dep.updatable) diskVersion = d.readBinarySelfVersion();
+          if (dep.updatable) diskVersion = await d.readBinarySelfVersion();
           const updatePending = !!(diskVersion && diskVersion !== d.guardVersion());
           return { ...base, diskVersion, updatePending };
         }
@@ -11826,7 +11932,9 @@ var require_access = __commonJS({
             return { ok: false, error: e.message };
           }
         }
-      }
+      },
+      // settings 门面的写口核验件（B2-4）：lan-panel 共用同一「写后读回」口径，不各写各的。
+      verifyPersisted
     };
   }
 });
@@ -11933,9 +12041,8 @@ var require_netinfo = __commonJS({
 var require_lan_panel = __commonJS({
   "src/app/settings/lan-panel.js"(exports2, module2) {
     "use strict";
-    var fs2 = require("node:fs");
     var netInfo = require_netinfo();
-    var { writeAtomic } = require_fs();
+    var { verifyPersisted } = require_access();
     var DEPS = /* @__PURE__ */ new WeakMap();
     function depsOf(host2) {
       let d = DEPS.get(host2);
@@ -11945,6 +12052,7 @@ var require_lan_panel = __commonJS({
           logger: () => host2.logger,
           events: () => host2.events,
           configPath: () => host2.configPath,
+          state: () => host2.state,
           api: () => host2.api,
           lanPanelStatus: () => host2.lanPanelStatus(),
           apiRebind: () => host2._apiRebind()
@@ -11986,14 +12094,9 @@ var require_lan_panel = __commonJS({
             d.config().apiHost = host2;
             let persistError = null;
             if (d.configPath()) {
-              try {
-                const doc = JSON.parse(fs2.readFileSync(d.configPath(), "utf8"));
-                doc.apiHost = host2;
-                writeAtomic(d.configPath(), JSON.stringify(doc, null, 2), { mode: 384 });
-              } catch (e) {
-                persistError = "persist apiHost: " + e.message;
-                d.logger().error(persistError);
-              }
+              d.state().persistConfigPatch({ apiHost: host2 });
+              persistError = verifyPersisted(d.configPath(), { apiHost: host2 });
+              if (persistError) d.logger().error(persistError);
             }
             if (changed && d.api() && typeof d.api().close === "function") d.apiRebind();
             if (d.events()) d.events().append("lan_panel_changed", { enabled: on });
@@ -12611,6 +12714,8 @@ var require_pool2 = __commonJS({
         this._bus = new FollowBus({ logger: this.logger });
         this._schedules = /* @__PURE__ */ new Map();
         this._seq = 0;
+        this._attachGen = /* @__PURE__ */ new Map();
+        this._journalFn = o.journal || capture.captureJournal;
         this._backfillAt = /* @__PURE__ */ new Map();
         this._poolFile = o.poolFile ? path2.resolve(o.poolFile) : null;
         this._loaded = false;
@@ -12635,6 +12740,7 @@ var require_pool2 = __commonJS({
         const unit = s.unit || prev && prev.unit || null;
         const file = s.file || prev && prev.file || null;
         this._sources.set(id, { kind, unit, file, lines: prev && prev.lines || [] });
+        this._attachGen.set(id, (this._attachGen.get(id) || 0) + 1);
         const rec = this._records.get(id);
         if (rec) rec.kind = kind;
         return true;
@@ -12659,9 +12765,16 @@ var require_pool2 = __commonJS({
           return this._commit(id, hit.token, hit.source);
         }
         if (src.unit && kinds.isCaptured(src.kind)) {
-          Promise.resolve().then(() => capture.captureJournal(src.unit, { logger: this.logger })).then((j) => {
+          const gen = this._attachGen.get(id) || 0;
+          const fresh = () => (this._attachGen.get(id) || 0) === gen ? this._sources.get(id) : null;
+          Promise.resolve().then(() => {
+            const cur = fresh();
+            return cur ? this._journalFn(cur.unit, { logger: this.logger }) : null;
+          }).then((j) => {
             if (!j) return;
-            if (src.file) this._persistLine(id, src.file, j.line);
+            const cur = fresh();
+            if (!cur) return;
+            if (cur.file) this._persistLine(id, cur.file, j.line);
             this._commit(id, j.token, j.source);
           }).catch(() => {
           });
@@ -12729,6 +12842,7 @@ var require_pool2 = __commonJS({
         this._backfillAt.delete(id);
         const src = this._sources.get(id);
         if (src && src.lines && src.lines.length) src.lines.length = 0;
+        this._attachGen.set(id, (this._attachGen.get(id) || 0) + 1);
         this._records.delete(id);
         this._persistPool();
         this._bus.emit(id, null, null);
@@ -13659,7 +13773,6 @@ var require_core5 = __commonJS({
       host2._routerFacade = null;
       host2._lc = null;
       host2._dshMainLive = null;
-      host2._fallbackEntry = null;
       host2._lastStateBody = null;
       host2._shadowSeq = 0;
       host2._shadowConsistentBeats = 0;
@@ -17206,10 +17319,11 @@ var require_oauth = __commonJS({
       const d = deps || {};
       const ports = d.ports;
       const openInBrowser = d.openInBrowser;
-      const st = { _ccLogin: null, _ccLoginPromise: null, _ccLoginResolve: null, _ccLoginReject: null };
+      const st = { _ccLogin: null, _ccLoginPromise: null, _ccLoginResolve: null, _ccLoginReject: null, _ccLoginRound: 0 };
       async function commandcodeLoginStart() {
         const STUDIO_BASE = "https://commandcode.ai";
         const state = crypto.randomBytes(32).toString("base64url");
+        const roundId = ++st._ccLoginRound;
         if (st._ccLogin && st._ccLogin.server) {
           const oldState = st._ccLogin.state;
           try {
@@ -17271,6 +17385,11 @@ var require_oauth = __commonJS({
                 if (b.length > 1e4) req.destroy();
               });
               req.on("end", () => {
+                if (st._ccLoginRound !== roundId) {
+                  res.writeHead(410);
+                  res.end(callbackJson({ success: false, error: "Stale login round" }));
+                  return;
+                }
                 try {
                   const j = JSON.parse(b || "{}");
                   if (j && typeof j === "object" && "error" in j) {
@@ -17361,6 +17480,7 @@ var require_oauth = __commonJS({
         });
         st._ccLoginPromise = promise;
         const tmpProfile = openInBrowser(authUrl, () => {
+          if (st._ccLoginRound !== roundId) return;
           if (st._ccLoginReject) {
             const r = st._ccLoginReject;
             st._ccLoginReject = null;
@@ -19247,10 +19367,7 @@ var require_model3 = __commonJS({
         inst.state.lastError = null;
       }
       if (inst.state) inst.state.phase = inst.state.phase || "STOPPED";
-      if (inst.state && inst.state.desired === void 0) {
-        const p = inst.state.phase;
-        inst.state.desired = p === "RUNNING" || p === "STARTING" || p === "INSTALLING" ? "running" : "stopped";
-      }
+      if (inst.state) delete inst.state.desired;
       return inst;
     }
     function createRecord(payload, id) {
@@ -19275,7 +19392,7 @@ var require_model3 = __commonJS({
           protectHome: payload.protectHome === void 0 ? false : !!payload.protectHome
           // 资源配额不接收户输入：启动时由 governor 按机器预算与活跃实例数推导。
         },
-        state: { phase: "STOPPED", desired: "stopped", restartCount: 0, backoffLevel: 0, lastProbeOk: null },
+        state: { phase: "STOPPED", restartCount: 0, backoffLevel: 0, lastProbeOk: null },
         createdAt: (/* @__PURE__ */ new Date()).toISOString()
       };
     }
@@ -19515,6 +19632,7 @@ var require_lifecycle = __commonJS({
     "use strict";
     var fs2 = require("node:fs");
     var monitor = require_monitor();
+    var ports = require_ports().shared;
     var guardian = require_guardian();
     var sandbox = require_sandbox();
     var governor = require_governor();
@@ -19557,7 +19675,7 @@ var require_lifecycle = __commonJS({
           logger.info && logger.info("cleaned stale transient unit: " + unit);
         }
       }
-      function _systemdStart(inst) {
+      function _systemdStart(inst, opts) {
         try {
           const cmdArr = sandbox.effectiveCommand(instancesRoot, deps.dshBin, inst);
           if (!cmdArr || !cmdArr.length) return { ok: false, error: "\u5B9E\u4F8B\u672A\u914D\u7F6E\u542F\u52A8\u547D\u4EE4" };
@@ -19573,6 +19691,15 @@ var require_lifecycle = __commonJS({
             logger.warn && logger.warn("[" + inst.id + "] " + msg);
             return { ok: false, error: msg };
           }
+          const takenBy = ports.recordOf(inst.port);
+          if (takenBy && takenBy.owner !== "inst:" + inst.id) {
+            const msg = "PORT_TAKEN:" + (takenBy.owner || takenBy.role);
+            inst.state.lastError = msg;
+            store.save();
+            if (events) events.append("inst_start_refused", { id: inst.id, name: inst.name, error: msg });
+            logger.warn && logger.warn("[" + inst.id + "] " + msg);
+            return { ok: false, error: msg };
+          }
           if (probe(inst).running) return { ok: false, error: "\u7AEF\u53E3 " + inst.port + " \u5DF2\u88AB\u5360\u7528" };
           const alloc = governor.currentAllocation(store.instances, inst.id, machineFactsNow());
           inst.state.allocation = alloc;
@@ -19592,6 +19719,12 @@ var require_lifecycle = __commonJS({
           inst.state.phase = "STARTING";
           inst.state.startAt = Date.now();
           inst.state.lastError = null;
+          if (opts && opts.manual) {
+            inst.state.restartCount = 0;
+            inst.state.backoffLevel = 0;
+            inst.state.backoffUntil = null;
+            inst.state.lastFailAt = null;
+          }
           store.save();
           if (inst.port && hooks.onInstanceStart) hooks.onInstanceStart(inst);
           if (events) events.append("inst_started", { id: inst.id, port: inst.port });
@@ -19617,10 +19750,6 @@ var require_lifecycle = __commonJS({
               return { ok: false, error: adm.error };
             }
           }
-          if (inst.state.desired !== "running") {
-            inst.state.desired = "running";
-            store.save();
-          }
           store.ensureDirs(inst);
           const dshEntry = sandbox.dshEntry(instancesRoot, inst);
           if (!fs2.existsSync(dshEntry)) {
@@ -19629,10 +19758,9 @@ var require_lifecycle = __commonJS({
             return { ok: true, installing: true };
           }
         }
-        return _systemdStart(inst);
+        return _systemdStart(inst, opts);
       }
-      function stop(id, opts) {
-        const transient = !!(opts && opts.intent === "transient");
+      function stop(id) {
         const inst = store.instances.find((i) => i.id === id);
         if (!inst) return { ok: false, error: "\u5B9E\u4F8B\u4E0D\u5B58\u5728" };
         if (!isSandboxSupported()) return { ok: false, error: "\u5F53\u524D\u5E73\u53F0\u4E0D\u652F\u6301\u6C99\u7BB1\u5B9E\u4F8B\uFF08\u80FD\u529B\u77E9\u9635\u89C1 GET /env/status \u7684 capabilities.sandboxLaunch\uFF1B\u9650\u989D\u6267\u884C\u6863\u4F4D\u89C1 capabilities.sandboxEnforcement\uFF09" };
@@ -19654,7 +19782,6 @@ var require_lifecycle = __commonJS({
         }
         inst.state.phase = "STOPPED";
         inst.state.usage = null;
-        if (!transient) inst.state.desired = "stopped";
         runtime.delete(inst.id);
         store.save();
         if (inst.port && hooks.onInstanceStop) hooks.onInstanceStop(inst);
@@ -19710,15 +19837,17 @@ var require_lifecycle = __commonJS({
           }).catch(() => {
           });
         }
+      }
+      function governSweep() {
         const roster = _sandboxRoster();
-        if (!roster.length) return;
+        if (!roster.length) return { ok: true, entries: 0 };
         let plan;
         try {
           const f = machineFactsNow();
           plan = governor.decide({ totalMemBytes: f.totalMemBytes, cpuCount: f.cpuCount, roster });
         } catch (e) {
-          logger.warn && logger.warn("[" + inst.id + "] govern decide \u5931\u8D25: " + (e && e.message));
-          return;
+          logger.warn && logger.warn("govern decide \u5931\u8D25: " + (e && e.message));
+          return { ok: false, error: e && e.message || String(e) };
         }
         const now = Date.now();
         for (const entry of plan.entries) {
@@ -19743,19 +19872,21 @@ var require_lifecycle = __commonJS({
               }
             }
           }
-          if (!entry.violation || entry.id !== inst.id) continue;
+          if (!entry.violation) continue;
           const v = entry.violation;
           const kindLabel = v.kind === "memory" ? "\u5185\u5B58" : "CPU";
           const reason = "\u8D44\u6E90\u8FDD\u89C4:" + kindLabel + "\u6301\u7EED\u8D85\u9650(\u5B9E\u9645 " + v.actual + "/\u9650\u989D " + v.target + ")";
-          if (events) events.append("inst_resource_violation", { id: inst.id, name: inst.name, kind: v.kind, actual: v.actual, target: v.target });
-          logger.warn && logger.warn("[" + inst.id + "] " + reason);
+          if (events) events.append("inst_resource_violation", { id: target.id, name: target.name, kind: v.kind, actual: v.actual, target: v.target });
+          logger.warn && logger.warn("[" + target.id + "] " + reason);
           try {
-            service.stopUnit("dsh-web@" + inst.id, Object.assign({ timeoutMs: 2e4 }, sandbox.launchCtx(instancesRoot, deps.dshBin, inst)));
+            service.stopUnit("dsh-web@" + target.id, Object.assign({ timeoutMs: 2e4 }, sandbox.launchCtx(instancesRoot, deps.dshBin, target)));
           } catch (e) {
-            logger.warn && logger.warn("[" + inst.id + "] \u8FDD\u89C4\u505C\u5355\u5143\u5F02\u5E38: " + (e && e.message));
+            logger.warn && logger.warn("[" + target.id + "] \u8FDD\u89C4\u505C\u5355\u5143\u5F02\u5E38: " + (e && e.message));
           }
-          stateMachine.restart(stateDeps(), inst, reason);
+          stateMachine.restart(stateDeps(), target, reason);
         }
+        store.save();
+        return { ok: true, entries: plan.entries.length };
       }
       function supervise(id) {
         const inst = store.instances.find((i) => i.id === id);
@@ -19849,7 +19980,7 @@ var require_lifecycle = __commonJS({
         }
         return { ok: true };
       }
-      return { _prepareSystemd, start, stop, probe, probeInstance, supervise };
+      return { _prepareSystemd, start, stop, probe, probeInstance, supervise, governSweep };
     }
     module2.exports = { createLifecycle };
   }
@@ -20158,7 +20289,7 @@ var require_upgrade = __commonJS({
               tasks.stepState(task.id, tasks.get(task.id).steps.indexOf(s), "running");
             }
             try {
-              await lifecycle.stop(id, { intent: "transient" });
+              await lifecycle.stop(id);
             } catch {
             }
             if (task) {
@@ -20206,7 +20337,7 @@ var require_upgrade = __commonJS({
               tasks.log(task.id, "\u81EA\u52A8\u56DE\u6EDA\u5230 " + oldVersion + "\u2026");
             }
             try {
-              const rs = await lifecycle.stop(id, { intent: "transient" });
+              const rs = await lifecycle.stop(id);
               if (rs && rs.ok === false && task) tasks.log(task.id, "\u56DE\u6EDA\u524D\u505C\u6B62\u5931\u8D25\uFF08\u7EE7\u7EED\u56DE\u88C5\u65E7\u7248\uFF09\uFF1A" + (rs.error || ""));
             } catch (e) {
               if (task) tasks.log(task.id, "\u56DE\u6EDA\u524D\u505C\u6B62\u5F02\u5E38\uFF08\u7EE7\u7EED\u56DE\u88C5\u65E7\u7248\uFF09\uFF1A" + (e && e.message || e));
@@ -20493,6 +20624,11 @@ var require_ops2 = __commonJS({
             } catch {
             }
           }
+          try {
+            lifecycle.governSweep();
+          } catch (e) {
+            logger.warn && logger.warn("governSweep: " + (e && e.message));
+          }
         }, intervalMs || 5e3);
       }
       return { list, addInstance, removeInstance, updateInstance, startTimer };
@@ -20785,12 +20921,16 @@ var require_instance = __commonJS({
       startInstance(id, opts) {
         return this._lifecycle.start(id, opts);
       }
-      stopInstance(id, opts) {
-        return this._lifecycle.stop(id, opts);
+      stopInstance(id) {
+        return this._lifecycle.stop(id);
       }
       supervise(id) {
         return this._lifecycle.supervise(id);
       }
+      /** 治理单拍（B2-6e）：心跳拍末由 onBeatDone 调一次，全花名册 decide+下发+违规处置。 */
+      governSweep() {
+        return this._lifecycle.governSweep();
+      }
       probeInstance(id) {
         return this._lifecycle.probeInstance(id);
       }
@@ -21112,8 +21252,6 @@ var require_market = __commonJS({
         this._ts = 0;
         this._inFlight = null;
         this.buildBudgetMs = opts.buildBudgetMs || 24e4;
-        this._deadline = 0;
-        this._truncatedSources = /* @__PURE__ */ new Set();
         this.loadFromDisk();
       }
       loadFromDisk() {
@@ -21160,19 +21298,18 @@ var require_market = __commonJS({
       }
       async buildIndex() {
         const start = Date.now();
-        this._deadline = Date.now() + this.buildBudgetMs;
-        this._truncatedSources = /* @__PURE__ */ new Set();
+        const bctx = { deadline: start + this.buildBudgetMs, truncated: /* @__PURE__ */ new Set() };
         try {
-          return await this._buildIndexInner(start);
+          return await this._buildIndexInner(start, bctx);
         } finally {
-          this._deadline = 0;
+          bctx.deadline = 0;
         }
       }
-      /** 预算是否已耗尽（供各源的批次循环调用）。 */
-      _budgetExhausted() {
-        return this._deadline > 0 && Date.now() >= this._deadline;
+      /** 预算是否已耗尽（供各源的批次循环调用；无 ctx = 单源直调，不设预算）。 */
+      _budgetExhausted(bctx) {
+        return !!bctx && bctx.deadline > 0 && Date.now() >= bctx.deadline;
       }
-      async _buildIndexInner(start) {
+      async _buildIndexInner(start, bctx) {
         const plugins = [];
         const seen = /* @__PURE__ */ new Set();
         const add = (p) => {
@@ -21180,11 +21317,11 @@ var require_market = __commonJS({
           seen.add(p.name);
           plugins.push(p);
         };
-        const npm = await this.indexNpm();
+        const npm = await this.indexNpm(bctx);
         npm.forEach(add);
-        const gh = await this.indexGithub();
+        const gh = await this.indexGithub(bctx);
         gh.forEach(add);
-        const community = await this.indexCommunity();
+        const community = await this.indexCommunity(bctx);
         community.forEach(add);
         for (const p of plugins) {
           p.category = p.category || classify(p);
@@ -21192,7 +21329,7 @@ var require_market = __commonJS({
         }
         plugins.sort((a, b) => (b.stars || 0) - (a.stars || 0));
         const prev = this._cache;
-        const truncated = this._truncatedSources || /* @__PURE__ */ new Set();
+        const truncated = bctx.truncated;
         if (prev && prev.plugins && prev.plugins.length > 0 && truncated.size > 0) {
           const freshNames = new Set(plugins.map((pp) => pp.name));
           const kept = prev.plugins.filter((pp) => truncated.has(pp.source) && !freshNames.has(pp.name));
@@ -21227,8 +21364,8 @@ var require_market = __commonJS({
         this.logger.info && this.logger.info("market index built in " + (Date.now() - start) + "ms: " + plugins.length + " plugins (npm=" + npm.length + ", gh=" + gh.length + ", community=" + community.length + ")");
         return this._cache;
       }
-      /** npm 源：搜 deepseek-harness 受限 dsh，逐个检测 dsh.bundle。 */
-      async indexNpm() {
+      /** npm 源：搜 deepseek-harness 受限 dsh，逐个检测 dsh.bundle。bctx 为本次构建的预算上下文（见 buildIndex）。 */
+      async indexNpm(bctx) {
         const out = [];
         const queries = ["keywords:deepseek-harness", "keywords:dsh-bundle", "keywords:dsh-plugin"];
         const allNames = /* @__PURE__ */ new Set();
@@ -21255,8 +21392,8 @@ var require_market = __commonJS({
         this.logger.info && this.logger.info("npm candidates: " + names.length);
         const batch = 8;
         for (let i = 0; i < names.length; i += batch) {
-          if (this._budgetExhausted()) {
-            this._truncatedSources.add("npm");
+          if (this._budgetExhausted(bctx)) {
+            bctx.truncated.add("npm");
             this.logger.warn && this.logger.warn("market: npm \u6E90\u9884\u7B97\u8017\u5C3D\uFF0C\u5DF2\u5904\u7406 " + i + "/" + names.length + " \u4E2A\u5019\u9009");
             break;
           }
@@ -21286,7 +21423,7 @@ var require_market = __commonJS({
         return fetchLatest(await this._npmOrigin(), name);
       }
       /** GitHub 源：搜 topic:dsh-plugin + deepseek-harness，逐个验证 dsh.bundle。 */
-      async indexGithub() {
+      async indexGithub(bctx) {
         const out = [];
         const topics = ["dsh-plugin", "deepseek-harness"];
         const seen = /* @__PURE__ */ new Set();
@@ -21316,7 +21453,7 @@ var require_market = __commonJS({
         return repoPkg(fullName);
       }
       /** 社区列表：抓 awesome-dsh-plugin README 白名单（官方社区维护的精选）。 */
-      async indexCommunity() {
+      async indexCommunity(bctx) {
         const out = [];
         try {
           const md = await rawGet("awesome-dsh-plugin/awesome-dsh-plugin/main/README.md", false, 3e4);
@@ -21328,8 +21465,8 @@ var require_market = __commonJS({
           }
           const seenName = /* @__PURE__ */ new Set();
           for (let i = 0; i < links.length; i += 8) {
-            if (this._budgetExhausted()) {
-              this._truncatedSources.add("community");
+            if (this._budgetExhausted(bctx)) {
+              bctx.truncated.add("community");
               this.logger.warn && this.logger.warn("market: community \u6E90\u9884\u7B97\u8017\u5C3D\uFF0C\u5DF2\u5904\u7406 " + i + "/" + links.length + " \u4E2A\u5019\u9009");
               break;
             }
@@ -21851,7 +21988,7 @@ var require_restart3 = __commonJS({
           log("\u91CD\u542F\u5B9E\u4F8B\u300C" + (target.name || target.id) + "\u300D\u4F7F\u63D2\u4EF6\u53D8\u66F4\u751F\u6548\u2026");
           if (ctx.events) ctx.events.append("plugin_restart_started", { name: target.name || target.id, target: target.id, kind });
           try {
-            ctx.instances.stopInstance(target.id, { intent: "transient" });
+            ctx.instances.stopInstance(target.id);
           } catch (e) {
             log("\u505C\u6B62\u5B9E\u4F8B\u5931\u8D25: " + e.message);
           }
@@ -22562,10 +22699,6 @@ var require_managed_object = __commonJS({
     function registerKind(kind, meta) {
       _customKinds[kind] = Object.assign({ label: kind, startable: false, guardable: false }, meta || {});
     }
-    var DOMAIN_A_KINDS = /* @__PURE__ */ new Set(["dsh", "sandbox-instance"]);
-    function isDomainA(kind) {
-      return DOMAIN_A_KINDS.has(kind);
-    }
     function createEntry(o) {
       const meta = kindMeta(o.kind);
       if (!meta) throw new Error("\u672A\u77E5\u53D7\u7BA1\u5BF9\u8C61\u7C7B\u578B: " + o.kind + "\uFF08\u5148 registerKind \u58F0\u660E\uFF09");
@@ -22576,8 +22709,9 @@ var require_managed_object = __commonJS({
         name: String(o.name || o.id),
         // desired 两域共用字段名但语义不同：域 A=用户意图；域 B=「当前业务是否需要它」的条件
         desired: o.desired === "stopped" ? "stopped" : "running",
-        // guardian 域 A 专有（见上）；域 B 不物化，旧残留才清得掉
-        ...isDomainA(o.kind) ? { guardian: o.guardian === true } : {},
+        // guardian 开关的权威在域记录本身（dsh-main.json / inst.guardian），消费者全部直读源；
+        //  目录曾在域 A entry 上物化该字段但零读者（B2-2 收口）。createEntry 永不物化 guardian 键
+        //  = 老库残留的天然一次性清理口（load 经本函数重建即消失），无需迁移脚本。
         ownership: normalizeOwnership(o.ownership),
         // 初始 stopped；业务不得直接改，由 heartbeat 调谐循环写入
         phase: "stopped",
@@ -22612,7 +22746,7 @@ var require_managed_object = __commonJS({
         // 域备注（只读参考）
       };
     }
-    module2.exports = { DESIRED, MANAGED_KINDS, kindMeta, registerKind, isDomainA, createEntry, normalizeOwnership };
+    module2.exports = { DESIRED, MANAGED_KINDS, kindMeta, registerKind, createEntry, normalizeOwnership };
   }
 });
 
@@ -22679,6 +22813,13 @@ var require_heartbeat = __commonJS({
           registry._log("warn", "heartbeat " + (ad.supervise ? "supervise" : "observe") + "(" + e.kind + ":" + e.id + "): " + (err && err.message || err));
         }
       }
+      if (typeof registry.onBeatDone === "function") {
+        try {
+          await registry.onBeatDone({ observed, errors });
+        } catch (err) {
+          registry._log("warn", "heartbeat onBeatDone: " + (err && err.message || err));
+        }
+      }
       return { observed, errors };
     }
     module2.exports = { runHeartbeat, withTimeout, ADAPTER_TIMEOUT_TICKS };
@@ -22692,7 +22833,7 @@ var require_registry3 = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     var { writeAtomic } = require_fs();
-    var { DESIRED, MANAGED_KINDS, kindMeta, registerKind: registerManagedKind, isDomainA, createEntry, normalizeOwnership } = require_managed_object();
+    var { DESIRED, MANAGED_KINDS, kindMeta, registerKind: registerManagedKind, createEntry, normalizeOwnership } = require_managed_object();
     var PHASES = ["stopped", "installing", "starting", "running", "draining", "backoff", "failed", "restarting"];
     var { runHeartbeat } = require_heartbeat();
     var ManagedRegistry = class {
@@ -22743,7 +22884,7 @@ var require_registry3 = __commonJS({
         for (const o of arr) {
           try {
             if (!o || !kindMeta(o.kind)) continue;
-            const e = createEntry({ kind: o.kind, id: o.id, name: o.name, desired: o.desired, guardian: isDomainA(o.kind) ? o.guardian : void 0, ownership: o.ownership });
+            const e = createEntry({ kind: o.kind, id: o.id, name: o.name, desired: o.desired, ownership: o.ownership });
             if (PHASES.includes(o.phase)) e.phase = o.phase;
             if (Number.isInteger(o.backoffLevel)) e.backoffLevel = o.backoffLevel;
             if (typeof o.backoffUntil === "number" && o.backoffUntil > Date.now()) e.backoffUntil = o.backoffUntil;
@@ -22770,7 +22911,7 @@ var require_registry3 = __commonJS({
               kind: o.kind,
               id: o.id,
               name: o.name,
-              // desired 两域共用（语义不同，见 createEntry）；guardian 仅域 A 落盘。
+              // desired 两域共用（语义不同，见 createEntry）；guardian 不落盘（B2-2，权威在域记录）。
               desired: o.desired,
               ownership: o.ownership,
               phase: o.phase,
@@ -22782,7 +22923,7 @@ var require_registry3 = __commonJS({
               startedAt: o.startedAt,
               createdAt: o.createdAt,
               updatedAt: o.updatedAt
-            }, isDomainA(o.kind) ? { guardian: o.guardian === true } : {}))
+            }))
           }, null, 2);
           writeAtomic(this.file, body, { mode: 384 });
         } catch (e) {
@@ -22844,8 +22985,8 @@ var require_registry3 = __commonJS({
         this._event("managed_object_registered", { kind: e.kind, id: e.id, name: e.name });
         return e;
       }
-      /** 对象变更申报（desired/guardian/ownership/name）。guardian 是域 A 专有：
-       *  域 B 基础设施既不写入，还主动删键清除早期版本残留（下一次 update 即归一）。 */
+      /** 对象变更申报（desired/ownership/name）。guardian 不接受申报（B2-2）：createEntry 永不
+       *  物化该键，patch 里带 guardian 一律忽略，老库残留由 load 重建时清理。 */
       update(id, patch) {
         const e = this.get(id);
         if (!e) return { ok: false, error: "\u672A\u6CE8\u518C: " + id };
@@ -22854,11 +22995,6 @@ var require_registry3 = __commonJS({
           if (!DESIRED.includes(p.desired)) return { ok: false, error: "\u975E\u6CD5 desired: " + p.desired };
           e.desired = p.desired;
         }
-        if (isDomainA(e.kind)) {
-          if (p.guardian !== void 0) e.guardian = p.guardian === true;
-        } else if ("guardian" in e) {
-          delete e.guardian;
-        }
         if (p.name !== void 0) e.name = String(p.name || e.id);
         if (p.ownership !== void 0) {
           const old = e.ownership.ports;
@@ -23276,20 +23412,23 @@ var require_npm = __commonJS({
       const l = runtimeContract.npmLauncher();
       return { program: l.program, args: l.args };
     }
-    function resolveNpmRoot(host2) {
+    async function resolveNpmRoot(host2) {
       if (host2.npmRoot) return host2.npmRoot;
       const l = npmLaunch(host2);
-      const r = ex2.runOut(l.program, l.args.concat(["root", "-g"]));
+      const r = await ex2.runOutAsync(l.program, l.args.concat(["root", "-g"]));
       return r ? r.trim() : null;
     }
-    function checkEnvironment(host2) {
+    async function checkEnvironment(host2) {
       const errors = [];
-      const nv = ex2.runOut("node", ["--version"]);
-      if (!nv || !nv.trim()) errors.push("node \u672A\u5B89\u88C5\u6216\u4E0D\u53EF\u6267\u884C");
       const l = npmLaunch(host2);
-      const npmv = ex2.runOut(l.program, l.args.concat(["--version"]));
+      const [nv, npmv, npmRoot] = await Promise.all([
+        ex2.runOutAsync("node", ["--version"]),
+        ex2.runOutAsync(l.program, l.args.concat(["--version"])),
+        resolveNpmRoot(host2)
+      ]);
+      if (!nv || !nv.trim()) errors.push("node \u672A\u5B89\u88C5\u6216\u4E0D\u53EF\u6267\u884C");
       if (!npmv || !npmv.trim()) errors.push("npm \u672A\u5B89\u88C5\u6216\u4E0D\u53EF\u6267\u884C");
-      return { ok: errors.length === 0, errors, npmRoot: resolveNpmRoot(host2) };
+      return { ok: errors.length === 0, errors, npmRoot };
     }
     async function latestVersion(host2) {
       if (!host2.dist || !host2.config.packageName) throw new Error("\u5206\u53D1\u670D\u52A1\u672A\u521D\u59CB\u5316\uFF0C\u65E0\u6CD5\u67E5\u8BE2\u6700\u65B0\u7248\u672C");
@@ -23388,13 +23527,14 @@ var require_ops4 = __commonJS({
     }
     async function install(host2, version) {
       if (!policies.isValidVersion(version)) return { ok: false, error: "\u975E\u6CD5\u7248\u672C\u53F7: " + version };
-      const env = host2.checkEnvironment();
-      if (!env.ok) return { ok: false, error: "\u73AF\u5883\u68C0\u67E5\u5931\u8D25: " + env.errors.join("; ") };
       host2.installing = true;
       host2.installLog = [];
-      const task = beginTask(host2, "install", { to: version || null, createdBy: "user" });
-      let target = version;
+      let task = null;
       try {
+        const env = await host2.checkEnvironment();
+        if (!env.ok) return { ok: false, error: "\u73AF\u5883\u68C0\u67E5\u5931\u8D25: " + env.errors.join("; ") };
+        task = beginTask(host2, "install", { to: version || null, createdBy: "user" });
+        let target = version;
         if (!target) {
           target = await host2._latestVersion().catch(() => null);
           if (!target) {
@@ -23417,7 +23557,7 @@ var require_ops4 = __commonJS({
           return { ok: false, error: res.error, output: res.output };
         }
         const isFirstInstall = !host2._manifest();
-        host2._recordManifest(target, isFirstInstall ? host2._claimDataPaths() : void 0);
+        await host2._recordManifest(target, isFirstInstall ? host2._claimDataPaths() : void 0);
         try {
           if (typeof host2._bindNativeDshCommand === "function") host2._bindNativeDshCommand();
         } catch (e) {
@@ -23442,8 +23582,6 @@ var require_ops4 = __commonJS({
       if (host2.uninstalling) return { ok: false, error: "\u5378\u8F7D\u8FDB\u884C\u4E2D\uFF0C\u8BF7\u7A0D\u540E\u518D\u88C5" };
       if (policies.busy(host2)) return { ok: false, error: "\u5347\u7EA7\u8FDB\u884C\u4E2D\uFF0C\u8BF7\u7A0D\u540E\u518D\u88C5\uFF08state=" + host2.upgradeState + "\uFF09" };
       if (!policies.isValidVersion(version)) return { ok: false, error: "\u975E\u6CD5\u7248\u672C\u53F7: " + version };
-      const env = host2.checkEnvironment();
-      if (!env.ok) return { ok: false, error: "\u73AF\u5883\u68C0\u67E5\u5931\u8D25: " + env.errors.join("; ") };
       install(host2, version).then(() => {
       }).catch((e) => {
         host2.installing = null;
@@ -23636,7 +23774,7 @@ var require_upgrade2 = __commonJS({
       if (!res.ok) throw new Error(res.error || "install failed");
       const newV = host2.installedVersion();
       if (newV !== target) throw new Error("\u5B89\u88C5\u540E\u7248\u672C\u6821\u9A8C\u5931\u8D25\uFF1A\u671F\u671B " + target + "\uFF0C\u5B9E\u9645 " + newV);
-      host2._recordManifest(newV || target);
+      await host2._recordManifest(newV || target);
       if (host2.events) host2.events.append("upgrade_installed", { from: oldV, to: target });
       log(host2, "\u5B89\u88C5\u5B8C\u6210\uFF0C\u78C1\u76D8\u7248\u672C " + newV);
       if (task) {
@@ -23706,9 +23844,9 @@ var require_upgrade2 = __commonJS({
     async function rollbackAfterFailedVerify(host2, oldV, task, healthy) {
       log(host2, "\u5065\u5EB7\u9A8C\u8BC1\u5931\u8D25\uFF08" + healthy.reason + "\uFF09");
       if (task) host2.tasks.log(task.id, "\u5065\u5EB7\u9A8C\u8BC1\u5931\u8D25\uFF08" + healthy.reason + "\uFF09");
-      host2.rolledBack = true;
       host2.upgradeState = "rolling_back";
       const rb = await rollbackNative(host2, oldV, task);
+      host2.rolledBack = rb.ok === true;
       host2.upgradeError = rb.ok ? "\u5347\u7EA7\u5931\u8D25\uFF0C\u5DF2\u56DE\u6EDA\u5230 " + oldV : "\u5347\u7EA7\u5931\u8D25\u4E14\u56DE\u6EDA\u5931\u8D25\uFF1A" + (rb.error || "");
       host2.upgradeState = "failed";
       host2.upgradeFinishedAt = (/* @__PURE__ */ new Date()).toISOString();
@@ -23740,7 +23878,7 @@ var require_upgrade2 = __commonJS({
       }
       tlog("\u56DE\u6EDA\u5B8C\u6210\uFF0C\u78C1\u76D8\u7248\u672C " + oldVersion);
       try {
-        host2._recordManifest(oldVersion);
+        await host2._recordManifest(oldVersion);
       } catch (e2) {
         tlog("manifest \u66F4\u65B0\u5931\u8D25: " + e2.message);
       }
@@ -23755,7 +23893,6 @@ var require_upgrade2 = __commonJS({
     }
     async function rollbackAfterFailure(host2) {
       host2.upgradeState = "rolling_back";
-      host2.rolledBack = true;
       if (host2.events) host2.events.append("upgrade_rollback_started", { to: host2.oldVersion });
       log(host2, "\u56DE\u6EDA\u5230 " + host2.oldVersion + "\u2026");
       const registry = await host2._selectRegistry();
@@ -23776,8 +23913,9 @@ var require_upgrade2 = __commonJS({
         return { ok: false };
       }
       log(host2, "\u56DE\u6EDA\u5B8C\u6210\u3002");
+      host2.rolledBack = true;
       try {
-        host2._recordManifest(host2.oldVersion);
+        await host2._recordManifest(host2.oldVersion);
       } catch (e2) {
         log(host2, "manifest \u66F4\u65B0\u5931\u8D25: " + e2.message);
       }
@@ -23927,8 +24065,8 @@ var require_installer = __commonJS({
       _saveManifest(m) {
         return manifest.save(this, m);
       }
-      _recordManifest(version, dataPaths) {
-        return manifest.record(this, version, dataPaths, this.npmRoot || npm.resolveNpmRoot(this));
+      async _recordManifest(version, dataPaths) {
+        return manifest.record(this, version, dataPaths, this.npmRoot || await npm.resolveNpmRoot(this));
       }
       _claimDataPaths() {
         return manifest.claimDataPaths(this);
@@ -24310,6 +24448,7 @@ var require_domains = __commonJS({
           host2.managedObjects.registerAdapter("dsh", { supervise: () => host2._dshSuperviseOnce(), tickEvery: 1 });
           host2.managedObjects.registerAdapter("sandbox-instance", { supervise: (entry) => host2._sandboxSuperviseOnce(entry), tickEvery: 1 });
         }
+        if (host2.managedObjects) host2.managedObjects.onBeatDone = () => host2.instances.governSweep();
       } catch (e) {
         host2.logger && host2.logger.warn && host2.logger.warn("managed registry init: " + (e && e.message));
       }
@@ -24904,7 +25043,7 @@ var require_guard = __commonJS({
         }
       }
       if (req.method === "GET" && pathname === "/guard/version") {
-        return send(200, sup.guardVersionLocal());
+        return Promise.resolve(sup.guardVersionLocal()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "POST" && pathname === "/guard/version/check") {
         req.resume();
@@ -25049,7 +25188,7 @@ var require_guard = __commonJS({
           req.resume();
           return send(403, {});
         }
-        return send(200, sup.envStatus());
+        return Promise.resolve(sup.envStatus()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "GET" && pathname === "/env/node-lts") {
         return sup.nodeLtsStatus().then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
@@ -25704,7 +25843,7 @@ var require_instances = __commonJS({
               const r = sup.instances.updateInstance(j.id, j);
               return send(r && r.ok ? 200 : 400, r);
             }
-            if (act === "start" && j.id) return Promise.resolve(sup.instances.startInstance(j.id)).then((r) => send(r && r.ok ? 200 : 400, r)).catch((e) => send(500, { ok: false, error: e.message }));
+            if (act === "start" && j.id) return Promise.resolve(sup.instances.startInstance(j.id, { manual: true })).then((r) => send(r && r.ok ? 200 : 400, r)).catch((e) => send(500, { ok: false, error: e.message }));
             if (act === "stop" && j.id) {
               const r = sup.instances.stopInstance(j.id);
               return send(r && r.ok ? 200 : 400, r);
@@ -27918,28 +28057,45 @@ function printSelfVersion() {
   const { guardVersion } = require_version();
   console.log("dsh-supervisor v" + guardVersion());
 }
-function apiRequest(method, apiPath) {
+function apiRaw(method, apiPath, body) {
   return new Promise((resolve) => {
     const addr = readApiAddress();
     const req = http.request(
-      { hostname: addr.host, port: addr.port, path: apiPath, method, timeout: 5e3 },
+      {
+        hostname: addr.host,
+        port: addr.port,
+        path: apiPath,
+        method,
+        timeout: 5e3,
+        headers: body ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) } : {}
+      },
       (res) => {
-        let body = "";
-        res.on("data", (d) => body += d);
-        res.on("end", () => {
-          try {
-            resolve(JSON.parse(body));
-          } catch {
-            resolve({ error: "parse error", raw: body });
-          }
-        });
-        res.on("error", () => resolve({ error: "response error" }));
+        let text = "";
+        res.setEncoding("utf8");
+        res.on("data", (d) => text += d);
+        res.on("end", () => resolve({ status: res.statusCode, text }));
+        res.on("error", (e) => resolve({ status: 0, text: "", error: e.message }));
       }
     );
-    req.on("error", () => resolve({ error: "daemon \u672A\u8FD0\u884C\u6216\u8FDE\u63A5\u5931\u8D25" }));
+    req.on("timeout", () => req.destroy(new Error("api-timeout")));
+    req.on(
+      "error",
+      (e) => resolve({ status: 0, text: "", error: e && e.message === "api-timeout" ? "daemon \u54CD\u5E94\u8D85\u65F6\uFF085s\uFF09" : "daemon \u672A\u8FD0\u884C\u6216\u8FDE\u63A5\u5931\u8D25" })
+    );
+    if (body) req.write(body);
     req.end();
   });
 }
+function apiRequest(method, apiPath) {
+  return apiRaw(method, apiPath).then(({ status, text, error }) => {
+    if (error) return { error };
+    try {
+      return JSON.parse(text);
+    } catch {
+      return { error: "parse error", raw: text };
+    }
+  });
+}
 var LOCK_FILE = process.env.DSH_SUPERVISOR_LOCK_FILE || path.join(SUPERVISOR_DIR, "guard.lock");
 var LOCK_OWNER = { pid: process.pid, started: Date.now(), entry: process.argv[1] || "" };
 function readLock() {
@@ -28258,26 +28414,9 @@ function cmdVersion() {
   });
 }
 function cmdSelfUpdate(action) {
-  const addr = readApiAddress();
-  const apiOne = (method, p, body) => new Promise((resolve) => {
-    const req = http.request({ hostname: addr.host, port: addr.port, path: p, method, timeout: 5e3, headers: body ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) } : {} }, (res) => {
-      let b = "";
-      res.on("data", (d) => b += d);
-      res.on("end", () => {
-        try {
-          resolve(JSON.parse(b));
-        } catch {
-          resolve({ error: "parse error", raw: b });
-        }
-      });
-    });
-    req.on("error", () => resolve({ error: "daemon \u672A\u8FD0\u884C\u6216\u8FDE\u63A5\u5931\u8D25" }));
-    if (body) req.write(body);
-    req.end();
-  });
   (async () => {
     if (action === "check" || !action) {
-      const s = await apiOne("GET", "/self-update/status");
+      const s = await apiRequest("GET", "/self-update/status");
       if (s.error) return console.log("\u68C0\u67E5\u5931\u8D25: " + s.error);
       if (s.ok) {
         console.log("\u5B88\u536B\u5F53\u524D\u7248\u672C: " + s.installed);
@@ -28295,31 +28434,13 @@ function cmdSelfUpdate(action) {
   })();
 }
 function cmdUpgrade(requested) {
-  const post = () => new Promise((resolve) => {
-    const addr = readApiAddress();
-    const body = requested ? JSON.stringify({ version: requested }) : void 0;
-    const req = http.request(
-      {
-        hostname: addr.host,
-        port: addr.port,
-        path: "/native/upgrade",
-        method: "POST",
-        timeout: 5e3,
-        headers: body ? { "Content-Type": "application/json", "Content-Length": Buffer.byteLength(body) } : {}
-      },
-      (res) => {
-        let b = "";
-        res.on("data", (d) => b += d);
-        res.on("end", () => resolve({ code: res.statusCode, body: b }));
-      }
-    );
-    req.on("error", () => resolve({ code: 0, body: "" }));
-    if (body) req.write(body);
-    req.end();
-  });
-  post().then(({ code, body }) => {
+  const body = requested ? JSON.stringify({ version: requested }) : void 0;
+  const post = () => apiRaw("POST", "/native/upgrade", body);
+  post().then(({ status, text, error }) => {
+    const code = error ? 0 : status;
+    const outText = error ? "" : text;
     if (code !== 202) {
-      console.log("\u5347\u7EA7\u672A\u88AB\u63A5\u53D7:", body || "HTTP " + code);
+      console.log("\u5347\u7EA7\u672A\u88AB\u63A5\u53D7:", outText || "HTTP " + code);
       process.exit(1);
     }
     console.log("\u5347\u7EA7\u5DF2\u5F00\u59CB\uFF0C\u8DDF\u8E2A\u8FDB\u5EA6\uFF08\u5148\u505C DSH \u2192 \u5B89\u88C5 \u2192 \u81EA\u52A8\u62C9\u8D77\uFF0C\u9700\u6570\u5206\u949F\uFF09\u2026");