@noob-stupid/dsh-plugin-console 0.5.33 → 0.5.34

package/lib/client.js

@@ -208,6 +208,9 @@ window.__ModuleLoader__.load({
 			riskyEnableConfirm: "确认强行启用",
 			riskyEnableCancel: "取消",
 			adoptableDetected: "检测到已适配：当前版本 {version} 已通过源码扫描，点「已适配，立即解锁」即可启用（不会自动开启）",
+			adoptableRescinded: "判据已更新：旧版扫描给出的「不兼容」结论已撤回（当前判据下源码扫描干净，版本不变也算）。点「已适配，立即解锁」即可启用（不会自动开启）",
+			compatRescindedTag: "判据已撤回·可解锁",
+			compatRescindedHint: "这条禁用是旧判据的误报：当前判据重算后不再判「不兼容」。点上方「已适配，立即解锁」即可启用；补丁由你确认后才改。",
 			compatGateLabel: "兼容门",
 			compatGateAutoDisable: "升级时自动禁用不适配插件",
 			compatGateAutoDetect: "打开时自动检测已适配（仅提示）",
@@ -760,6 +763,9 @@ window.__ModuleLoader__.load({
 			riskyEnableConfirm: "Force enable",
 			riskyEnableCancel: "Cancel",
 			adoptableDetected: "Now compatible: version {version} passed the source scan — click \"Adapted - unlock now\" to enable it (never auto-enabled)",
+			adoptableRescinded: "Criteria updated: the older scan's \"incompatible\" verdict has been withdrawn (the current criteria find the source clean even without a version change). Click \"Adapted - unlock now\" to enable it (never auto-enabled)",
+			compatRescindedTag: "Verdict withdrawn - unlockable",
+			compatRescindedHint: "This disable came from a false positive of the older criteria: recomputing with the current criteria no longer says \"incompatible\". Click \"Adapted - unlock now\" above; your patch is only changed after you confirm.",
 			compatGateLabel: "Compat gate",
 			compatGateAutoDisable: "Auto-disable incompatible plugins on upgrade",
 			compatGateAutoDetect: "Detect adapted plugins on open (hint only)",
@@ -1231,9 +1237,12 @@ window.__ModuleLoader__.load({
 		// 补丁与行状态零变化 ⇒ 用户观感"点了没反应"。
 		// 现在只有**真的检测到已适配**（adoptable 是服务端 detectAdoptablePending 给出的对象）才出按钮；
 		// 其余情况不给这个承诺，原因照旧由正文那行（pendingCompatHint + checkNote）如实展示。
+		// 0.5.34 加法：`compatRescinded`（记录里的 fail 是旧判据的误报、已被当前判据撤回）同样给一键解锁入口 ——
+		// 这类行**没有版本变化**，旧判据要求"版本变化"会让用户被永久钉在「待适配」（真机 dshmarket 就是这样）。
+		// 判据本身没放宽：adoptable 仍是服务端算出来的对象（真 fail 的行根本拿不到它）。
 		function canAdaptUnlock(entry) {
 			return entry !== null && entry !== undefined
-				&& entry.pendingCompat === true
+				&& (entry.pendingCompat === true || entry.compatRescinded === true)
 				&& entry.adoptable !== null && entry.adoptable !== undefined
 				&& typeof entry.adoptable === "object";
 		}
@@ -3490,7 +3499,11 @@ window.__ModuleLoader__.load({
 								entry.pendingCompat === true
 									? el("p", { className: styles.status, "data-pending": entry.adoptable ? "false" : "true" },
 										entry.adoptable
-											? t("adoptableDetected").replace("{version}", String(entry.adoptable.version ?? "?")).replace("{prev}", String(compatInfo?.version ?? "?"))
+											? (entry.adoptable.basis === "verdict-rescinded"
+												// 0.5.34：旧判据的误报已被当前判据撤回（真机 dshmarket 现场）——如实说是"判据更新"，
+												// 不能说成"插件已适配"（那会让人以为作者发过新版）
+												? t("adoptableRescinded").replace("{version}", String(entry.adoptable.version ?? "?"))
+												: t("adoptableDetected").replace("{version}", String(entry.adoptable.version ?? "?")).replace("{prev}", String(compatInfo?.version ?? "?")))
 											: t("pendingCompatHint") + (compatInfo && compatInfo.checkNote ? "；已知校验：" + compatInfo.checkNote : ""))
 									: null,
 								meta !== null && meta.version ? el("div", { className: styles.rowTop },
@@ -3607,9 +3620,10 @@ window.__ModuleLoader__.load({
 									type: "button",
 									className: styles.toggle,
 									disabled: !entry.toggleable || busy === entry.entryId || entry.pendingCompat === true,
-									title: entry.pendingCompat === true ? t("pendingCompatHint") : undefined,
+									// 0.5.34：结论已被当前判据撤回的行不再显示「待适配」（旧判据的误报不许当事实展示）
+									title: entry.pendingCompat === true ? (entry.compatRescinded === true ? t("compatRescindedHint") : t("pendingCompatHint")) : undefined,
 									onClick: () => toggle(entry, !entry.enabled),
-								}, busy === entry.entryId ? t("loadingPhase") : (entry.pendingCompat === true ? t("pendingCompatTag") : t(entry.enabled ? "off" : "on"))),
+								}, busy === entry.entryId ? t("loadingPhase") : (entry.pendingCompat === true ? (entry.compatRescinded === true ? t("compatRescindedTag") : t("pendingCompatTag")) : t(entry.enabled ? "off" : "on"))),
 								el("button", {
 									type: "button",
 									className: styles.toggle,

package/lib/server/domain/compat-verdict.js

@@ -0,0 +1,241 @@
+// L1 · domain —— compat-verdict.js（适配门结论的**判据版本戳** + 过期结论的读取代发重算；0.5.34 加法）
+// 分层分组：L1 · domain（边界由 tests/test-architecture-guard.mjs 断言）
+//
+// ── 真机背景（2026-10-01，用户实测）────────────────────────────────────────────────
+// `~/.dsh/plugin-console/compat-pending.json` 里 `dshmarket` 的记录仍是
+//   `check:"fail"` + `checkNote:"源码仍引用 0.1.2 起已删除的 dsh-settings API（…）——实际不兼容…"`
+// —— 那是 **0.5.33 收紧判据之前**的误报结论（真机复核：现在 0 命中）。面板照旧把它当事实展示
+// （「实际不兼容，启用会让整个服务启动崩溃」+「待适配」永久钉住），**持续误导用户**。
+//
+// ── 本模块只做两件事（**不放宽任何判据**）──────────────────────────────────────────
+//   ① 给结论打**判据版本戳**：记录里的 `scanVerdict.version` 标明"这条结论是哪一版判据算的"
+//      （戳来自 settings-api-scan.js 的 `SCAN_CRITERIA_VERSION`，判据改一次就要改它）。
+//   ② **读取代发**：读清单时若记录的戳落后于当前判据 → 用**当前判据只读重算**
+//      · 结论变了 → 回写（`check` / `checkNote` / `scanVerdict`，含 previous + rescinded + 来源证据）
+//      · 结论没变 → **零写盘**（幂等；同一条记录不会每次读都写盘）
+//      · 包解析不到 → 不猜：如实标注"无法复核"（保留旧结论，绝不假装成当前判据的结论）
+//   `fail` 永远不会因为"戳旧"就被改成 `pass` —— 只有**真的用当前判据重算**出非 fail 才算撤回；
+//   真不兼容的（重算仍 fail）一个字都不动。
+//
+// 行数预算：独立模块，留在 600 行架构硬顶内。
+
+import { mkdirSync, readFileSync, statSync, writeFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { dshHome } from '../infra/paths.js'
+import { SCAN_CRITERIA_VERSION } from './settings-api-scan.js'
+
+/**
+ * 进程内重算备忘（纯性能，不影响判据）："结论未变 ⇒ 不写盘"意味着记录上的判据戳**一直是旧的**，
+ * 于是每次 `GET /state`（面板每隔几秒轮询一次）都会对同一批包重跑源码扫描（单包上限 120 文件 / 400KB）。
+ * 键含包路径 + 版本 + package.json 的 mtime：包一变（升级/改源码）就重算，包没变就复用。
+ */
+const VERDICT_MEMO = new Map()
+const MEMO_LIMIT = 200
+
+/** 判据版本戳（当前判据的版本；判据变了就跟着 settings-api-scan.js 一起变）。 */
+const SCANNER_VERSION = SCAN_CRITERIA_VERSION
+
+/** 适配门清单文件（原在 compat.js；0.5.34 搬到本模块，供"读取代发"一处收口）。 */
+const compatPendingFile = () => join(dshHome(), 'plugin-console', 'compat-pending.json')
+
+/**
+ * 「这条禁用记录是我们自己写进去的」判据（纯函数）。
+ * 只有这类记录才允许在**误报被撤回**时给用户一键解锁入口 —— 用户手写的禁用块不在此列。
+ */
+const SELF_INFLICTED_SOURCES = new Set([
+  'preflight-disabled-before-upgrade', // 框架升级前的预扫（dshmarket 就是这条）
+  'boot-quarantine',                   // 启动失败隔离
+  'auto-preflight',                    // 指纹变化自动预检
+])
+function isSelfInflictedSource(source) {
+  return typeof source === 'string' && SELF_INFLICTED_SOURCES.has(source)
+}
+
+/** 记录上的判据戳（缺失 = 旧时代结论：必须重算）。 */
+function stampOf(record) {
+  const s = record?.scanVerdict
+  if (s === null || typeof s !== 'object') return { version: null, decision: null, reason: null, at: null, rescinded: false, evidence: null }
+  return {
+    version: typeof s.version === 'string' ? s.version : null,
+    decision: typeof s.decision === 'string' ? s.decision : null,
+    reason: typeof s.reason === 'string' ? s.reason : null,
+    at: Number.isFinite(s.at) ? s.at : null,
+    rescinded: s.rescinded === true,
+    evidence: typeof s.evidence === 'string' ? s.evidence : null,
+  }
+}
+
+/** 这条记录的结论是不是"旧判据算的"（纯函数）。 */
+function isStaleVerdict(record, version = SCANNER_VERSION) {
+  return stampOf(record).version !== version
+}
+
+/**
+ * 纯判据：给一组记录算出「哪些结论过期、用当前判据重算后是什么」（IO 全由 `recompute` 注入）。
+ * `recompute(record)` → `{ decision, reason }`；解析不到包时返回 `{ unresolved: '原因' }`。
+ * 返回每条的 `{ rowId, status, decision, reason, storedDecision, storedNote, rescinded, evidence }`，
+ * status ∈ fresh（戳已是最新，无需重算）/ updated（结论变了 → 调用方回写）/ unchanged（结论没变 → **零写盘**）
+ *          / unresolved（复核不了 → 如实标注，保留旧结论）。
+ */
+function planVerdictRefresh(records, { version = SCANNER_VERSION, recompute } = {}) {
+  const out = []
+  for (const rec of (Array.isArray(records) ? records : [])) {
+    if (rec === null || typeof rec !== 'object' || typeof rec.rowId !== 'string' || rec.rowId === '') continue
+    const storedDecision = typeof rec.check === 'string' && rec.check !== '' ? rec.check : null
+    const storedNote = typeof rec.checkNote === 'string' ? rec.checkNote : null
+    const stamp = stampOf(rec)
+    if (stamp.version === version) {
+      out.push({ rowId: rec.rowId, status: 'fresh', decision: storedDecision, reason: stamp.reason ?? storedNote, storedDecision, storedNote, rescinded: stamp.rescinded, evidence: stamp.evidence, version })
+      continue
+    }
+    // 没给重算器（或明确要求只读）→ 不猜：标成"过期、未复核"
+    if (typeof recompute !== 'function') {
+      out.push({ rowId: rec.rowId, status: 'stale', decision: storedDecision, reason: storedNote, storedDecision, storedNote, rescinded: false, evidence: null, version: null })
+      continue
+    }
+    let next = null
+    try {
+      next = recompute(rec)
+    } catch (error) {
+      next = { unresolved: String(error?.message ?? error) }
+    }
+    if (next === null || next === undefined) next = { unresolved: '重算没有返回结论' }
+    if (typeof next.unresolved === 'string' && next.unresolved !== '') {
+      out.push({ rowId: rec.rowId, status: 'unresolved', decision: storedDecision, reason: storedNote, storedDecision, storedNote, rescinded: false, evidence: null, version: null, unresolved: next.unresolved })
+      continue
+    }
+    const decision = typeof next.decision === 'string' && next.decision !== '' ? next.decision : 'unknown'
+    const reason = typeof next.reason === 'string' ? next.reason : null
+    out.push({
+      rowId: rec.rowId,
+      status: decision === storedDecision ? 'unchanged' : 'updated',
+      decision,
+      reason,
+      storedDecision,
+      storedNote,
+      // 「旧判据判 fail，当前判据不再 fail」= 误报被撤回（这是唯一允许解除"待适配"的情形）
+      rescinded: storedDecision === 'fail' && decision !== 'fail',
+      evidence: isSelfInflictedSource(rec.source) ? String(rec.source) : null,
+      version,
+    })
+  }
+  return out
+}
+
+/**
+ * 读取代发（IO 版）：把 `planVerdictRefresh` 的结论落到记录上，**结论变了才写盘**（写后读回核实）。
+ * `deps`：`{ resolvePkg, readPkg, check, writeText, readText, now }` —— 全部可注入（离线测试）。
+ * 返回 `{ version, entries, updated, unchanged, unresolved, fresh, wrote, writeError, file }`。
+ */
+function refreshCompatPendingVerdicts({ pending, baseDir, file = null, deps = {} } = {}) {
+  const {
+    resolvePkg, readPkg, check, now = () => Date.now(), stat = statSync,
+    readText = (p) => readFileSync(p, 'utf8'), writeText = (p, data) => writeFileSync(p, data, 'utf8'),
+    memo = VERDICT_MEMO,
+  } = deps
+  const target = file ?? compatPendingFile()
+  const records = Array.isArray(pending?.pending) ? pending.pending : []
+  const fwVer = typeof pending?.frameworkVersion === 'string' ? pending.frameworkVersion : null
+  const recompute = (rec) => {
+    if (typeof rec.moduleName !== 'string' || rec.moduleName === '') return { unresolved: '记录里没有 moduleName（无法定位已装包）' }
+    if (typeof resolvePkg !== 'function' || typeof readPkg !== 'function' || typeof check !== 'function') return { unresolved: '读取代发缺少解析器（内部接线问题）' }
+    let pkgPath = null
+    try { pkgPath = resolvePkg(rec.moduleName, baseDir) } catch (error) { return { unresolved: '解析包失败：' + String(error?.message ?? error) } }
+    if (pkgPath === null || pkgPath === undefined) return { unresolved: `本机解析不到 ${rec.moduleName}` }
+    let pkg = null
+    try { pkg = readPkg(pkgPath) } catch (error) { return { unresolved: '读取包信息失败：' + String(error?.message ?? error) } }
+    if (pkg === null || pkg === undefined) return { unresolved: '读取包信息失败' }
+    const mtimeMs = (() => { try { return stat(pkgPath).mtimeMs } catch { return 0 } })()
+    const key = `${rec.rowId}|${pkgPath}|${pkg.version ?? ''}|${mtimeMs}|${SCANNER_VERSION}`
+    if (memo instanceof Map && memo.has(key)) return memo.get(key)
+    const verdict = check(pkg, fwVer ?? '?', dirname(pkgPath))
+    const out = { decision: verdict?.decision ?? 'unknown', reason: verdict?.reason ?? null }
+    if (memo instanceof Map) {
+      if (memo.size >= MEMO_LIMIT) memo.clear()
+      memo.set(key, out)
+    }
+    return out
+  }
+  const entries = planVerdictRefresh(records, { recompute })
+  const byRow = new Map(entries.map((e) => [e.rowId, e]))
+  const updated = []
+  const at = now()
+  for (const rec of records) {
+    const e = byRow.get(rec?.rowId)
+    if (e === undefined || e.status !== 'updated') continue
+    const previous = { decision: e.storedDecision, note: e.storedNote }
+    rec.check = e.decision
+    rec.checkNote = e.reason
+    rec.scanVerdict = { version: SCANNER_VERSION, decision: e.decision, reason: e.reason, at, previous, rescinded: e.rescinded, evidence: e.evidence }
+    rec.verdictUpdatedAt = at
+    updated.push({ rowId: e.rowId, from: e.storedDecision, to: e.decision, rescinded: e.rescinded, evidence: e.evidence })
+  }
+  const result = {
+    version: SCANNER_VERSION,
+    file: target,
+    entries,
+    updated,
+    unchanged: entries.filter((e) => e.status === 'unchanged').map((e) => e.rowId),
+    unresolved: entries.filter((e) => e.status === 'unresolved').map((e) => ({ rowId: e.rowId, reason: e.unresolved })),
+    fresh: entries.filter((e) => e.status === 'fresh').map((e) => e.rowId),
+    wrote: false,
+    writeError: null,
+  }
+  if (updated.length === 0) return result // ② 结论未变（或无可重算）→ **零写盘**
+  const payload = { ...pending, pending: records, updatedAt: new Date(at).toISOString() }
+  try {
+    mkdirSync(dirname(target), { recursive: true })
+    writeText(target, JSON.stringify(payload, null, 2), 'utf8')
+  } catch (error) {
+    result.writeError = '回写适配门清单失败：' + String(error?.message ?? error)
+    return result
+  }
+  // 读回核实：只有真的落盘且内容一致才算写成功（绝不谎报"已更正"）
+  try {
+    const back = JSON.parse(readText(target))
+    const rec = (back?.pending ?? []).find((p) => p.rowId === updated[0].rowId)
+    const ok = rec !== undefined && rec.check === updated[0].to && stampOf(rec).version === SCANNER_VERSION
+    if (!ok) result.writeError = '回写后读回内容与期望不一致（结论没真正落盘）'
+  } catch (error) {
+    result.writeError = '回写后读回失败：' + String(error?.message ?? error)
+  }
+  result.wrote = result.writeError === null
+  return result
+}
+
+/**
+ * 一条记录对外的"结论视图"（面板/门控摘要用）：当前判据下的结论 + 是否过期 + 是否已撤回。
+ * `entry` = `refreshCompatPendingVerdicts()` 的 `entries` 里对应那条（可省 → 只看记录上的判据戳）。
+ */
+function verdictView(record, entry = null) {
+  const stamp = stampOf(record)
+  const status = entry?.status ?? (stamp.version === SCANNER_VERSION ? 'fresh' : 'stale')
+  const evidence = entry?.evidence ?? stamp.evidence ?? (isSelfInflictedSource(record?.source) ? String(record.source) : null)
+  if (status === 'updated') {
+    return { decision: entry.decision, reason: entry.reason, version: entry.version, stale: false, rescinded: entry.rescinded === true, evidence, unresolved: null, status, previous: { decision: entry.storedDecision, note: entry.storedNote } }
+  }
+  if (status === 'fresh') {
+    return { decision: stamp.decision ?? (typeof record?.check === 'string' ? record.check : null), reason: stamp.reason ?? (typeof record?.checkNote === 'string' ? record.checkNote : null), version: stamp.version, stale: false, rescinded: stamp.rescinded, evidence, unresolved: null, status }
+  }
+  if (status === 'unchanged') {
+    // 结论与旧判据一致（已用当前判据复核过，但**不写盘**）：结论可信，判据戳仍是旧的
+    return { decision: entry.decision, reason: entry.reason, version: entry.version, stale: true, rescinded: false, evidence, unresolved: null, status }
+  }
+  if (status === 'unresolved') {
+    return { decision: entry.decision, reason: entry.reason, version: null, stale: true, rescinded: false, evidence: null, unresolved: entry.unresolved, status }
+  }
+  // 'stale'：本轮没有重算（没给基准/只读）→ 如实标"旧判据、未复核"
+  return { decision: stamp.decision ?? (typeof record?.check === 'string' ? record.check : null), reason: stamp.reason ?? (typeof record?.checkNote === 'string' ? record.checkNote : null), version: stamp.version, stale: true, rescinded: stamp.rescinded, evidence, unresolved: null, status: 'stale' }
+}
+
+export {
+  SCANNER_VERSION,
+  SELF_INFLICTED_SOURCES,
+  compatPendingFile,
+  isSelfInflictedSource,
+  isStaleVerdict,
+  planVerdictRefresh,
+  refreshCompatPendingVerdicts,
+  stampOf,
+  verdictView,
+}

package/lib/server/domain/compat.js

@@ -13,6 +13,8 @@ import { listEntries } from './runtime.js'
 import { fetchJsonUrl } from '../infra/http.js'
 import { dshHome, findPatchPath, pluginRoot, profileDirOf, resolvePackageJson } from '../infra/paths.js'
 import { semverRangeMatch, semverRangeMatchLoose } from '../infra/semver.js'
+// 0.5.34 加法：适配门结论的**判据版本戳** + 过期结论的读取代发重算（见该模块头注释）。
+import { SCANNER_VERSION, compatPendingFile, isSelfInflictedSource, planVerdictRefresh, refreshCompatPendingVerdicts, verdictView } from './compat-verdict.js'
 // 0.5.33 改错：已删除 API 的源码扫描搬进独立 domain 模块（判据收紧为"真的从 dsh-settings 绑定进来"）。
 // 这三个名字继续由本模块导出，对外契约不变。
 import { REMOVED_SETTINGS_SYMBOLS, referencesRemovedSymbol, scanSettingsApiUsage } from './settings-api-scan.js'
@@ -82,8 +84,6 @@ function checkPluginFrameworkCompat(pkg, frameworkVersion, pkgDir = null) {
 // 支持 0.1.x 系列（0.1.0 / 0.1.1 等）；0.2 / 1.0 等破坏性大版本才标记不支持
 const SUPPORTED_WEB_APP_PATTERN = /^0\.1\.\d+/u
 
-const COMPAT_PENDING_FILE = () => join(dshHome(), 'plugin-console', 'compat-pending.json')
-
 /**
  * 启用前冒烟检查（服务永不崩机制）：在独立子进程中动态 import 插件主模块，
  * 捕获 loader 会遇到的 import/resolution 错误（SyntaxError、缺失导出、模块缺失）。
@@ -126,7 +126,49 @@ function probePluginImport(moduleName, profileDir) {
   })
 }
 
-/** 读取框架升级适配门清单（compat-pending.json）；损坏/缺失返回 null。 */
+/** 适配门清单文件（0.5.34 起由 compat-verdict.js 定义，供"读取代发"一处收口）。 */
+const COMPAT_PENDING_FILE = compatPendingFile
+
+/**
+ * 读取框架升级适配门清单（compat-pending.json）；损坏/缺失返回 `{ pending: null, ... }`。
+ *
+ * 0.5.34 加法（**读取代发**）：给 `baseDir`（当前 profile 目录）时，对**判据戳落后**的记录
+ * 用当前判据只读重算：结论变了才回写（幂等：结论不变**零写盘**），解析不到包就如实标注"无法复核"。
+ * 真不兼容的（重算仍 fail）一个字都不动 —— 这条只解决"过期结论仍当事实展示"，不放宽任何判据。
+ * 返回 `{ pending, refresh, verdicts }`：`verdicts` = rowId → 结论视图（面板/门控摘要用）。
+ */
+function readCompatPendingWithVerdicts({ baseDir = null, deps = {} } = {}) {
+  let raw = null
+  try { raw = JSON.parse(readFileSync(COMPAT_PENDING_FILE(), 'utf8')) } catch { return { pending: null, refresh: null, verdicts: new Map() } }
+  if (raw === null || typeof raw !== 'object') return { pending: null, refresh: null, verdicts: new Map() }
+  let refresh = null
+  if (baseDir !== null && baseDir !== undefined && Array.isArray(raw.pending) && raw.pending.length > 0) {
+    try {
+      refresh = refreshCompatPendingVerdicts({
+        pending: raw,
+        baseDir,
+        deps: {
+          resolvePkg: (name, base) => resolvePackageJson(name, base),
+          readPkg: (p) => JSON.parse(readFileSync(p, 'utf8')),
+          check: checkPluginFrameworkCompat,
+          ...deps,
+        },
+      })
+    } catch (error) {
+      // 复核本身出问题也必须如实回报（不静默）：结论按记录原样展示，附上失败原因
+      refresh = { version: SCANNER_VERSION, entries: [], updated: [], unchanged: [], unresolved: [], fresh: [], wrote: false, writeError: '读取代发重算失败：' + String(error?.message ?? error), file: COMPAT_PENDING_FILE() }
+    }
+  }
+  const entries = Array.isArray(refresh?.entries) ? refresh.entries : planVerdictRefresh(raw.pending)
+  const verdicts = new Map()
+  for (const rec of raw.pending) {
+    if (rec === null || typeof rec !== 'object' || typeof rec.rowId !== 'string') continue
+    verdicts.set(rec.rowId, verdictView(rec, entries.find((e) => e.rowId === rec.rowId) ?? null))
+  }
+  return { pending: raw, refresh, verdicts }
+}
+
+/** 读取清单（原契约不变：只读、不做复核）。需要"读取代发"的路径用 readCompatPendingWithVerdicts。 */
 function readCompatPending() {
   try { return JSON.parse(readFileSync(COMPAT_PENDING_FILE(), 'utf8')) } catch { return null }
 }
@@ -283,15 +325,18 @@ async function detectCompat(baseUrl) {
 }
 
 /** 待适配行的「现在是否已适配」检测（只提示，不自动解锁——用户定案：我点才开）。
- * 返回 Map<rowId, {version, check, note}>：仅当版本已变化且源码扫描不再 fail 时才算可解锁。 */
+ * 返回 Map<rowId, {version, check, note, basis}>：可解锁有两种**互不放松**的来路 ——
+ *   ① `version-changed`：插件真的更新过（版本 ≠ 记录版本）且源码扫描不再 fail（原判据，不变）；
+ *   ② `verdict-rescinded`（0.5.34 加法）：记录里的 `fail` 是**旧判据的误报**，当前判据重算后不再 fail。
+ *      真不兼容（重算仍 fail）**一个都不放行**；②也不需要"版本变化"——否则用户会被永久钉在「待适配」。 */
 function detectAdoptablePending(ports) {
   const out = new Map()
-  const pending = readCompatPending()
+  let profileDir = null
+  try { profileDir = dirname(findPatchPath(ports)) } catch { return out }
+  const { pending, verdicts } = readCompatPendingWithVerdicts({ baseDir: profileDir })
   if (pending === null) return out
   const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : null
   if (fwVer === null) return out
-  let profileDir = null
-  try { profileDir = dirname(findPatchPath(ports)) } catch { return out }
   for (const p of (pending.pending ?? []).filter((x) => (x.status ?? 'pending') === 'pending')) {
     try {
       const pkgPath = resolvePackageJson(p.moduleName, profileDir)
@@ -300,9 +345,18 @@ function detectAdoptablePending(ports) {
       const version = typeof pkg.version === 'string' ? pkg.version : null
       const changed = version !== null && version !== p.version
       const check = checkPluginFrameworkCompat(pkg, fwVer, dirname(pkgPath))
-      if (changed && check.decision !== 'fail') {
-        out.set(p.rowId, { version, check: check.decision, note: check.reason ?? null })
-      }
+      if (check.decision === 'fail') continue
+      const view = verdicts.get(p.rowId) ?? null
+      const rescinded = view?.rescinded === true
+      if (!changed && !rescinded) continue
+      out.set(p.rowId, {
+        version,
+        check: check.decision,
+        note: check.reason ?? null,
+        basis: changed ? 'version-changed' : 'verdict-rescinded',
+        previousVerdict: view?.storedDecision ?? null,
+        evidence: view?.evidence ?? null,
+      })
     } catch {}
   }
   return out
@@ -317,8 +371,11 @@ function detectAdoptablePending(ports) {
  *
  * pending —— 当前被拦下/待解锁的行（含原因、来源、是否已通过源码扫描可解锁）
  * adopted —— 曾经被拦、现已适配解锁的行（让用户能核对"到底动过哪些行"）
+ *
+ * 0.5.34 加法：每行多带 `verdict`（当前判据下的结论视图：`stale` / `rescinded` / `unresolved`）——
+ * 旧判据的结论不许再被当成事实展示；**复核不了**（包解析不到）的行在 `note` 上如实标注。
  */
-function gatingSummary(ports, compatPending, ctxEntries = null) {
+function gatingSummary(ports, compatPending, ctxEntries = null, verdicts = null) {
   const rec = compatPending ?? { frameworkVersion: null, upgradeFrom: null, pending: [] }
   const all = Array.isArray(rec.pending) ? rec.pending : []
   let info = new Map()
@@ -329,11 +386,14 @@ function gatingSummary(ports, compatPending, ctxEntries = null) {
   for (const e of Array.isArray(ctxEntries) ? ctxEntries : []) {
     if (typeof e?.rowId === 'string' && e.rowId !== '') byRow.set(e.rowId, e)
   }
+  const byVerdict = verdicts instanceof Map ? verdicts : new Map()
   const row = (p) => {
     const meta = info.get(p.rowId) ?? null
     const entry = byRow.get(p.rowId) ?? null
     const moduleName = p.moduleName ?? meta?.moduleName ?? entry?.moduleName ?? null
     const name = moduleName ?? p.rowId ?? '（未知行）'
+    const verdict = byVerdict.get(p.rowId) ?? verdictView(p)
+    const note = p.checkNote ?? null
     return {
       rowId: p.rowId ?? null,
       name,
@@ -342,12 +402,16 @@ function gatingSummary(ports, compatPending, ctxEntries = null) {
       version: p.version ?? meta?.version ?? entry?.version ?? null,
       status: p.status ?? 'pending',
       check: p.check ?? null,
-      note: p.checkNote ?? null,
+      // 复核不了的行：**如实标注**"旧判据结论、未复核"（不许继续当事实；也不猜新结论）
+      note: verdict.unresolved === null || verdict.unresolved === undefined
+        ? note
+        : `${note ?? ''}（旧判据结论，未能复核：${verdict.unresolved}）`,
       source: p.source ?? null,
       adoptedAt: p.adoptedAt ?? null,
       forcedAt: p.forcedAt ?? null,
       adoptedBy: p.adoptedBy ?? null,
       enabled: entry === null ? null : entry.enabled === true,
+      verdict,
     }
   }
   const isPending = (p) => (p.status ?? 'pending') === 'pending'
@@ -391,9 +455,10 @@ function rowIdModuleMap(ports) {
 /**
  * 框架升级适配门：安装/更新完成后自动校验兼容性，
  * 通过（版本已变化 + 未在声明/依赖层面明确不兼容）则移除补丁禁用块并解锁启用。
+ * 0.5.34：走**读取代发**（`profileDir` 已知）—— 顺手把过期判据的结论复核/回写，避免旧误报继续挂在这里。
  */
 async function maybeAutoAdaptCompat({ profileDir, packageName, syncedNames, patchPath, ports }) {
-  const pending = readCompatPending()
+  const { pending } = readCompatPendingWithVerdicts({ baseDir: profileDir })
   if (!pending || !Array.isArray(pending.pending)) return { ran: false }
   const interested = new Set([packageName, ...(syncedNames ?? [])].filter((n) => n !== null))
   const targets = pending.pending.filter((p) => (p.status ?? 'pending') === 'pending' && interested.has(p.moduleName))
@@ -438,7 +503,7 @@ async function maybeAutoAdaptCompat({ profileDir, packageName, syncedNames, patc
 /** AI 赋能框架适配预检：查 registry 最新版声明 + 兼容门清单，给出权威说明。 */
 async function frameworkCompatReportFor(source, ports, profileDir) {
   const fwVer = currentFrameworkVersion(ports)
-  const pending = readCompatPending()
+  const { pending, verdicts } = readCompatPendingWithVerdicts({ baseDir: profileDir })
   const norm = String(source ?? '').trim()
   const isNpm = norm.startsWith('@') || !norm.includes('/')
   const installed = (() => {
@@ -448,7 +513,10 @@ async function frameworkCompatReportFor(source, ports, profileDir) {
       return JSON.parse(readFileSync(pkgPath, 'utf8')).version ?? null
     } catch { return null }
   })()
-  const pendHits = (pending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending' && p.moduleName === norm)
+  // 命中行带上当前判据的结论视图（`fail` 仍然是 fail；过期/复核不了会如实标注）
+  const pendHits = (pending?.pending ?? [])
+    .filter((p) => (p.status ?? 'pending') === 'pending' && p.moduleName === norm)
+    .map((p) => ({ ...p, verdict: verdicts.get(p.rowId) ?? verdictView(p) }))
   if (!isNpm) {
     return {
       kind: 'repo', frameworkVersion: fwVer, packageName: null, latest: null, check: null,
@@ -487,4 +555,4 @@ async function frameworkCompatReportFor(source, ports, profileDir) {
     summary: parts.length > 0 ? parts.join('；') : `框架 ${fwVer}，无待适配记录`,
   }
 }
-export { gatingSummary, COMPAT_PENDING_FILE, COMPAT_GATE_FILE, COMPAT_ACK_FILE, COMPAT_GATE_DEFAULTS, NOTICE_MODES, DEFAULT_NOTICE_MODE, REMOVED_SETTINGS_SYMBOLS, FIBER_STATE, FIBER_PHASE, SUPPORTED_WEB_APP_PATTERN, referencesRemovedSymbol, scanSettingsApiUsage, isFrameworkOwnedPackage, checkPluginFrameworkCompat, probePluginImport, readCompatPending, writeCompatPending, readCompatGate, writeCompatGate, readCompatAck, writeCompatAck, resolveNoticeState, frameworkCheckPromptText, CONSOLE_VERSION, detectCompat, detectAdoptablePending, rowIdModuleMap, frameworkCompatReportFor, maybeAutoAdaptCompat }
+export { gatingSummary, COMPAT_PENDING_FILE, COMPAT_GATE_FILE, COMPAT_ACK_FILE, COMPAT_GATE_DEFAULTS, NOTICE_MODES, DEFAULT_NOTICE_MODE, REMOVED_SETTINGS_SYMBOLS, FIBER_STATE, FIBER_PHASE, SUPPORTED_WEB_APP_PATTERN, referencesRemovedSymbol, scanSettingsApiUsage, isFrameworkOwnedPackage, checkPluginFrameworkCompat, probePluginImport, readCompatPending, readCompatPendingWithVerdicts, writeCompatPending, verdictView, SCANNER_VERSION, readCompatGate, writeCompatGate, readCompatAck, writeCompatAck, resolveNoticeState, frameworkCheckPromptText, CONSOLE_VERSION, detectCompat, detectAdoptablePending, rowIdModuleMap, frameworkCompatReportFor, maybeAutoAdaptCompat }

package/lib/server/domain/framework-cleanup.js

@@ -5,15 +5,36 @@
 //
 // 三条安全约定（对齐仓库既有纪律）：
 //   ① **一律先改名备份**：顶层旧目录 → `<name>.stale-<ver>-<ts>`，绝不直接删（可回滚）。
-//   ② 重建 junction 只在**目标确实存在**时做：目标从 `dsh` junction 的同级目录推（运行树的真实位置）；
-//      推不到或目标不存在就只改名，并如实记进 `relinkSkipped`（不假装成功）。
+//   ② 改名与重建 junction **原子化**（0.5.34 改错，见下）；重建失败 → 立刻把改名改回去。
 //   ③ 框架备份只删 `fw-tree/<ts>` 目录，**绝不碰** `dsh-package-backup` 与目录下的快照文件。
+//
+// ── 0.5.34 改错（**真机停机事故 2026-10-01**：web 服务进程 exit code=1，起不来）──────────────
+// 现场：框架树顶层 `@deepseek-ai/cordis` 被改名成 `cordis.stale-4.0.4-<ts>`，**但没重建 junction**
+//   ⇒ 启动包 `dsh-app-boot` 的 `import '@deepseek-ai/cordis'` 解析失败 ⇒ 服务进程退出。
+// 真根因（`git blame` 定位到旧 `:77` 改名 / 旧 `:92` 本应重建）：重建链接只在
+//   「`dsh` junction 推得出运行树 **且** 目标存在」时才做，其余分支（`no-running-scope` /
+//   `target-missing`）**只改名不重建**；真机上顶层 `dsh` 是**真实目录**而非 junction
+//   ⇒ `runningScopeDir = null` ⇒ 10 条包全部落进这条"只改名"的支路，且只在 `relinkSkipped` 里
+//   留一行 JSON（面板不留痕、用户看不到），框架就再也起不来了。
+// 现在（四条硬规则，全部有离线测试钉死）：
+//   ① **改名后立刻重建 junction**；重建失败 → **立刻回滚改名**（改回原名）→ 记 `failed` 并写明原因。
+//      `relink:false`（显式关闭重建）不再"只改名"——那种模式正是事故本体，一律不改名并如实记 `relink-off`。
+//   ② 找不到任何可重建目标（多基准候选全不存在）→ **连名字都不动**（先探目标、再改名），记
+//      `relinkSkipped`（带原因 + 试过哪些基准）—— 宁可什么都不做，也不让框架顶层少一个包名。
+//   ③ 整批结束后做一次**框架可解析性验证**（至少 `@deepseek-ai/cordis` + `@deepseek-ai/dsh-app-boot`，
+//      多基准：框架树顶层 + `.pnpm/node_modules`；解析结果必须落在框架树内）→ **验证失败则把本轮所有
+//      改名回滚**（恢复到操作前状态）并返回失败原因。这条就是"防止把服务搞到起不来"的硬闸。
+//   ④ **绝不删除**任何 `.stale-*` 备份；**幂等**：`.stale-*` 不再参与判据（见 framework-residuals.js），
+//      已建好的 junction 与同 stamp 的备份名都会让重复运行零改名、零新建链接。
+// 返回值：`renamed`（**留在原地**的改名，含 target/via）/ `relinked` / `relinkSkipped`（含原因）/
+//   `rolledBack`（含哪些与为什么）/ `verify`（多基准解析验证结果）/ `failed`（可读原因，绝不静默吞）。
 
-import { existsSync, readdirSync, readFileSync, readlinkSync, renameSync, statSync, symlinkSync } from 'node:fs'
-import { dirname, join } from 'node:path'
+import { createRequire } from 'node:module'
+import { existsSync, readdirSync, readFileSync, readlinkSync, realpathSync, renameSync, rmdirSync, statSync, symlinkSync, unlinkSync } from 'node:fs'
+import { basename, dirname, join, resolve, sep } from 'node:path'
 import { removeDirVerifiedAsync } from '../infra/fsx.js'
 import { dshHome, resolvePackageJson } from '../infra/paths.js'
-import { classifyTopLevel, planBackupRetention } from './framework-residuals.js'
+import { FRAMEWORK_BOOT_PACKAGES, classifyTopLevel, planBackupRetention, relinkTargetCandidates } from './framework-residuals.js'
 
 /** 目录体积（失败返回 0；只用于报告「能释放多少」）。 */
 function dirSizeBytes(dir) {
@@ -39,18 +60,142 @@ function isLinkEntry(full, dirent, readLink = readlinkSync) {
   try { readLink(full); return true } catch { return false }
 }
 
+/** 删掉一个**链接**（Windows 的 junction 用 rmdir 拆；符号链接用 unlink 兜底）。绝不删真实目录。 */
+function removeLinkSafe(full, deps = {}) {
+  const { rmdir = rmdirSync, unlink = unlinkSync } = deps
+  const errors = []
+  try { rmdir(full); return { ok: true, via: 'rmdir' } } catch (error) { errors.push(String(error?.message ?? error)) }
+  try { unlink(full); return { ok: true, via: 'unlink' } } catch (error) { errors.push(String(error?.message ?? error)) }
+  return { ok: false, error: errors.join(' / ') }
+}
+
+function errText(error) {
+  return String(error?.message ?? error)
+}
+
+/**
+ * 把「改名 → 重建链接」这一步回滚：先拆掉本轮建的链接（若已建），再把备份名改回原名。
+ * 返回 `{ ok, problem }`；**失败必须带可读原因**（回滚失败是最严重的一类，绝不能假装成功）。
+ */
+function rollbackRename({ full, backupFull, linkAtName = false, deps = {} } = {}) {
+  const { exists = existsSync, rename = renameSync, readLink = readlinkSync, removeLink = removeLinkSafe } = deps
+  const problems = []
+  let occupied = false
+  try { occupied = exists(full) } catch (error) { problems.push('检查原位置失败：' + errText(error)) }
+  if (occupied) {
+    // 原位置此刻只可能是**本轮刚建的链接**（原名一刻前才被改名让出）。
+    // 真实目录一律不动 —— 宁可留下链接并如实报错，也绝不误删用户数据。
+    let linkNow = linkAtName
+    if (!linkNow) { try { readLink(full); linkNow = true } catch { linkNow = false } }
+    if (!linkNow) problems.push('原位置出现了非链接目录，拒绝覆盖')
+    else {
+      const rm = removeLink(full)
+      if (rm?.ok !== true) problems.push('拆除本轮链接失败：' + String(rm?.error ?? '未知'))
+    }
+  }
+  if (problems.length === 0) {
+    try { rename(backupFull, full) } catch (error) { problems.push('改回原名失败：' + errText(error)) }
+  }
+  return { ok: problems.length === 0, problem: problems.join('；') }
+}
+
+/** 解析一条残留该重建到哪个真实目录（多基准；第一个存在的候选胜出），或如实说明为什么不能重建。 */
+function resolveRelinkTarget({ fwRoot, scopeName, name, version, runningScopeDir, deps = {} } = {}) {
+  const { exists = existsSync, readdir = readdirSync } = deps
+  const storeHoistDir = fwRoot === null ? null : join(fwRoot, '.pnpm', 'node_modules')
+  const tried = []
+  for (const candidate of relinkTargetCandidates({ runningScopeDir, storeHoistDir, scopeName, name })) {
+    tried.push({ path: candidate.path, via: candidate.via })
+    let hit = false
+    try { hit = exists(candidate.path) } catch { hit = false }
+    if (hit) return { target: candidate.path, via: candidate.via, tried }
+  }
+  // 兜底：pnpm 虚拟 store 里的实体本体 `<scope>+<name>@<version>*`（版本必须**与刚改名的那份相同**，
+  // 绝不借机换版本；同版本多个 hash 时按目录名排序取第一个，确定性且语义等价）。
+  const storeDir = fwRoot === null ? null : join(fwRoot, '.pnpm')
+  if (storeDir !== null && version !== null && version !== undefined && String(version) !== '') {
+    const prefix = `${scopeName}+${name}@${version}`
+    let dirs = []
+    try { dirs = readdir(storeDir, { withFileTypes: true }).filter((d) => d.isDirectory() && (d.name === prefix || d.name.startsWith(prefix + '_'))).map((d) => d.name).sort() } catch (error) { tried.push({ path: join(storeDir, prefix + '*'), via: 'pnpm-store-entity', error: errText(error) }) }
+    for (const dir of dirs) {
+      const candidate = join(storeDir, dir, 'node_modules', scopeName, name)
+      tried.push({ path: candidate, via: 'pnpm-store-entity' })
+      let hit = false
+      try { hit = exists(candidate) } catch { hit = false }
+      if (hit) return { target: candidate, via: 'pnpm-store-entity', tried }
+    }
+  }
+  return { target: null, via: null, tried }
+}
+
+/**
+ * 框架**可解析性**验证（多基准，只读）：从「框架树顶层」与「`.pnpm/node_modules`」两个基准分别解析
+ * 关键启动包，且要求解析结果**落在框架树内**（否则是从上层别处的同名包，等于框架自己还是解析不到）。
+ * 默认用 `createRequire(base).resolve(name)` 真解析；`deps.resolveFrom` 可注入（离线测试用）。
+ */
+function verifyFrameworkTreeResolvable({ fwRoot, packages = FRAMEWORK_BOOT_PACKAGES, deps = {} } = {}) {
+  const { resolveFrom = (baseFile, name) => createRequire(baseFile).resolve(name), real = realpathSync } = deps
+  const treeRoot = fwRoot === null || fwRoot === undefined ? null : dirname(fwRoot)
+  const bases = treeRoot === null ? [] : [
+    { id: 'framework-top', dir: treeRoot, file: join(treeRoot, 'package.json') },
+    { id: 'pnpm-store', dir: join(fwRoot, '.pnpm', 'node_modules'), file: join(fwRoot, '.pnpm', 'node_modules', 'package.json') },
+  ]
+  const norm = (p) => {
+    try { return real(p) } catch { return resolve(p) }
+  }
+  const inside = (child, parent) => {
+    const c = norm(child)
+    const p = norm(parent)
+    return c === p || c.startsWith(p.endsWith(sep) ? p : p + sep)
+  }
+  const checks = []
+  for (const base of bases) {
+    for (const short of packages) {
+      const name = short.includes('/') ? short : `@deepseek-ai/${short}`
+      try {
+        const resolved = resolveFrom(base.file, name)
+        if (typeof resolved !== 'string' || resolved === '') throw new Error('解析器没有返回路径')
+        if (treeRoot !== null && !inside(resolved, treeRoot)) {
+          checks.push({ base: base.id, name, ok: false, path: resolved, error: `解析到框架树之外（${resolved}）——框架自己仍然解析不到它` })
+          continue
+        }
+        checks.push({ base: base.id, name, ok: true, path: resolved, error: null })
+      } catch (error) {
+        checks.push({ base: base.id, name, ok: false, path: null, error: errText(error) })
+      }
+    }
+  }
+  const bad = checks.filter((c) => c.ok !== true)
+  const ok = bases.length > 0 && bad.length === 0
+  return {
+    ok,
+    phase: 'post',
+    bases: bases.map((b) => ({ id: b.id, dir: b.dir })),
+    packages: packages.map((s) => (s.includes('/') ? s : `@deepseek-ai/${s}`)),
+    checks,
+    error: ok ? null : (bases.length === 0
+      ? '拿不到框架树根（无法验证可解析性）'
+      : `框架可解析性验证失败：${bad.slice(0, 3).map((c) => `${c.name}@${c.base}（${c.error}）`).join('；')}${bad.length > 3 ? ` 等 ${bad.length} 条` : ''}`),
+  }
+}
+
 /**
- * A 档：顶层投影里的旧版本真实目录 → 改名备份（+ 可选重建 junction）。
- * `topScopeDir` = `<frameworkRoot>/node_modules/@deepseek-ai`；`dshLinkPath` = 同目录下的 `dsh`（运行树入口）。
+ * A 档：顶层投影里的旧版本真实目录 → 改名备份（+ **立刻**重建 junction；失败即回滚）。
+ * `topScopeDir` = `<fwRoot>/<scope>`（如 `…/node_modules/@deepseek-ai`）；`dshLinkPath` = 同目录下的 `dsh`。
+ * 可选 `frameworkRoot`（默认 `dirname(topScopeDir)`）、`verifyPackages`（默认启动关键包）。
  */
-async function cleanFrameworkTopLevel({ topScopeDir, dshLinkPath = null, runningVersion = null, relink = true, dryRun = false, stamp = null, deps = {} } = {}) {
+async function cleanFrameworkTopLevel({ topScopeDir, dshLinkPath = null, runningVersion = null, relink = true, dryRun = false, stamp = null, frameworkRoot = null, verifyPackages = null, deps = {} } = {}) {
   const {
     exists = existsSync, readdir = readdirSync, readText = (f) => readFileSync(f, 'utf8'),
     rename = renameSync, link = symlinkSync, readLink = readlinkSync,
+    resolveFrom = (baseFile, name) => createRequire(baseFile).resolve(name),
   } = deps
+  const empty = { renamed: [], relinked: [], relinkSkipped: [], rolledBack: [], failed: [], verify: null }
   if (topScopeDir === null || topScopeDir === undefined || !exists(topScopeDir)) {
-    return { ok: false, error: '框架顶层目录不存在（拿不到 @deepseek-ai/* 的真实位置）', renamed: [], relinked: [], relinkSkipped: [], failed: [] }
+    return { ok: false, error: '框架顶层目录不存在（拿不到 @deepseek-ai/* 的真实位置）', ...empty }
   }
+  const fwRoot = frameworkRoot ?? dirname(topScopeDir)
+  const scopeName = basename(topScopeDir)
   const entries = []
   for (const dirent of readdir(topScopeDir, { withFileTypes: true })) {
     const full = join(topScopeDir, dirent.name)
@@ -72,40 +217,96 @@ async function cleanFrameworkTopLevel({ topScopeDir, dshLinkPath = null, running
   const renamed = []
   const relinked = []
   const relinkSkipped = []
+  const rolledBack = []
   const failed = []
-  for (const item of (dryRun === true ? [] : classified.stale)) {
+  const hints = []
+  if (runningScopeDir === null && dshLinkPath !== null) hints.push('顶层 `' + basename(dshLinkPath) + '` 不是 junction（推不出运行树）——重建链接改用 .pnpm 多基准候选')
+  const io = { exists, rename, readLink }
+
+  for (const item of classified.stale) {
+    if (dryRun === true) break // 只出 planned（函数尾部统一填），一个字节都不动
+    // 显式关闭重建（relink:false）：**一律不改名**。旧行为是"只改名不重建"，那正是 2026-10-01 停机事故本体。
+    if (relink !== true) {
+      relinkSkipped.push({ name: item.name, version: item.version, reason: 'relink-off', detail: '调用方显式关闭重建链接（relink:false）：改名后无法指回真实包体，故不改名（旧行为会只改名 → 框架解析不到包）' })
+      continue
+    }
     const backupName = item.name + '.stale-' + item.version + '-' + ts
+    const backupFull = join(topScopeDir, backupName)
+    const full = join(topScopeDir, item.name)
+    let backupExists = false
+    try { backupExists = exists(backupFull) } catch { backupExists = false }
+    if (backupExists) {
+      // 幂等护栏：同一个 stamp 的备份已经在 → 说明这一条早就改过名了，重复运行不产生新改名。
+      relinkSkipped.push({ name: item.name, version: item.version, reason: 'backup-exists', detail: `备份 ${backupName} 已存在 —— 疑似重复运行，本次不改名、不改链接` })
+      continue
+    }
+    // **先探目标再改名**：找不到可指回的真实包体时连名字都不动（少一个"名字短暂空缺"的窗口）。
+    const resolvedTarget = resolveRelinkTarget({ fwRoot, scopeName, name: item.name, version: item.version, runningScopeDir, deps: { exists, readdir } })
+    if (resolvedTarget.target === null) {
+      relinkSkipped.push({ name: item.name, version: item.version, reason: 'no-target', detail: '多基准候选全不存在，无法重建链接 —— 不改名（判不准就不动）', tried: resolvedTarget.tried })
+      continue
+    }
     try {
-      rename(join(topScopeDir, item.name), join(topScopeDir, backupName))
+      rename(full, backupFull)
     } catch (error) {
-      failed.push({ name: item.name, error: String(error?.message ?? error) })
+      failed.push({ name: item.name, error: '改名备份失败：' + errText(error) })
       continue
     }
-    renamed.push({ name: item.name, version: item.version, backup: backupName, sizeBytes: item.sizeBytes ?? null })
-    if (relink !== true) { relinkSkipped.push({ name: item.name, reason: 'relink-off' }); continue }
-    if (runningScopeDir === null) { relinkSkipped.push({ name: item.name, reason: 'no-running-scope' }); continue }
-    const target = join(runningScopeDir, item.name)
-    let targetExists = false
-    try { targetExists = exists(target) } catch { targetExists = false }
-    if (!targetExists) { relinkSkipped.push({ name: item.name, reason: 'target-missing' }); continue }
     try {
-      link(target, join(topScopeDir, item.name), 'junction')
-      relinked.push({ name: item.name, target })
+      link(resolvedTarget.target, full, 'junction')
     } catch (error) {
-      failed.push({ name: item.name, error: '已改名但重建链接失败：' + String(error?.message ?? error) })
+      const rb = rollbackRename({ full, backupFull, deps: io })
+      const why = `重建链接失败（目标 ${resolvedTarget.target}）：${errText(error)}`
+      if (rb.ok) {
+        rolledBack.push({ name: item.name, version: item.version, backup: backupName, reason: 'relink-failed' })
+        failed.push({ name: item.name, error: `${why}；已把改名回滚（现场未变）` })
+      } else {
+        failed.push({ name: item.name, error: `${why}；**回滚改名也失败**（现场可能不一致）：${rb.problem}` })
+      }
+      continue
     }
+    renamed.push({ name: item.name, version: item.version, backup: backupName, sizeBytes: item.sizeBytes ?? null, target: resolvedTarget.target, via: resolvedTarget.via })
+    relinked.push({ name: item.name, target: resolvedTarget.target, via: resolvedTarget.via })
   }
+
+  // ③ 整批验证（硬闸）：只在**本轮真的改过名**时才具回滚意义；没改过就只如实报告当前状态。
+  const verify = verifyFrameworkTreeResolvable({ fwRoot, packages: verifyPackages ?? FRAMEWORK_BOOT_PACKAGES, deps: { resolveFrom } })
+  verify.phase = dryRun === true ? 'pre' : 'post'
+  if (verify.ok !== true && renamed.length > 0) {
+    const all = [...renamed].reverse()
+    renamed.length = 0
+    relinked.length = 0
+    for (const item of all) {
+      const rb = rollbackRename({ full: join(topScopeDir, item.name), backupFull: join(topScopeDir, item.backup), linkAtName: true, deps: io })
+      if (rb.ok) rolledBack.push({ name: item.name, version: item.version, backup: item.backup, reason: 'verify-failed' })
+      else failed.push({ name: item.name, error: `验证失败后的回滚未完成（现场可能不一致）：${rb.problem}` })
+    }
+    verify.rolledBackAll = true
+    verify.error = `${verify.error} → 已把本轮全部 ${all.length} 条改名回滚（恢复到操作前状态）`
+  } else if (verify.ok !== true) {
+    verify.rolledBackAll = false
+    hints.push('本轮没有改名（dryRun / relink-off）：验证结果只反映**操作前**的现场状态，未触发回滚')
+  }
+  if (relinkSkipped.some((s) => s.reason === 'no-target')) hints.push(`有 ${relinkSkipped.filter((s) => s.reason === 'no-target').length} 条找不到可指回的真实包体：**连名字都没动**（判不准就不动）`)
+  if (rolledBack.length > 0) hints.push(`本轮回滚 ${rolledBack.length} 条（原因见 rolledBack）`)
+  const ok = failed.length === 0 && verify.ok !== false
   return {
-    ok: failed.length === 0,
+    ok,
     renamed,
     relinked,
     relinkSkipped,
+    rolledBack,
     failed,
+    hints,
     staleCount: classified.stale.length,
     sameVersionCount: classified.sameVersion.length,
     missingVersion: classified.missingVersion,
     dryRun,
     planned: classified.stale.map((s) => ({ name: s.name, version: s.version, sizeBytes: s.sizeBytes ?? null })),
+    verify,
+    error: ok ? null : (failed.length > 0
+      ? `有 ${failed.length} 条没能安全落地：${failed.slice(0, 3).map((f) => `${f.name}（${f.error}）`).join('；')}`
+      : String(verify.error ?? '未知失败')),
   }
 }
 
@@ -222,4 +423,4 @@ function readRollbackReferenced({ home = undefined, deps = {} } = {}) {
     return [raw?.checkpointDir, raw?.cliBackupDir].filter((p) => typeof p === 'string' && p !== '')
   } catch { return [] }
 }
-export { cleanFrameworkBackups, cleanFrameworkTopLevel, dirSizeBytes, isLinkEntry, readRollbackReferenced, reportFrameworkEntities, resolveFrameworkLayout }
+export { cleanFrameworkBackups, cleanFrameworkTopLevel, dirSizeBytes, isLinkEntry, readRollbackReferenced, removeLinkSafe, reportFrameworkEntities, resolveFrameworkLayout, verifyFrameworkTreeResolvable }

package/lib/server/domain/framework-residuals.js

@@ -8,15 +8,40 @@
 //      而回滚只需要**回滚点引用的那一条** + **最近 N 条**。
 //
 // 本模块只做纯判据（IO 全由调用方注入），动作在 routes/plugins.js 的 clean-residuals scope 里：
-//   · `classifyTopLevel`      → 哪些顶层真实目录属于"旧版本残留"（同版本/链接一律不动 —— 宁可少动）
+//   · `classifyTopLevel`      → 哪些顶层真实目录属于"旧版本残留"（同版本/链接/备份一律不动 —— 宁可少动）
 //   · `planBackupRetention`   → 保留「回滚点那一条 ∪ 最近 N 条」，其余进删除清单 + 可释放字节
+//   · `relinkTargetCandidates` → 改名之后该把 junction 指回哪里（多基准候选，按优先级）
+//   · `isStaleBackupName`     → 备份目录名判据（幂等：备份绝不能再被当成残留改名）
 //
 // 行数预算：独立模块，留在 600 行架构硬顶内。
 
+import { join } from 'node:path'
+
+/**
+ * `.stale-*` 备份目录名判据（**幂等必需**）。
+ *
+ * 动作层把旧目录改名成 `<name>.stale-<version>-<ts>`；那些备份里**还带着 package.json**
+ * （version = 被备份的那个版本），所以不排除的话：
+ *   第二次运行 → 备份自己又被判成"旧版本残留" → 改成 `<...>.stale-<v>-<ts2>`（越堆越深），
+ *   而且会给这个根本不存在的名字建 junction。旧行为正是如此（真机 `cordis.stale-4.0.4-<ts>` 一眼可见）。
+ * 误判方向是**保守**的：真有一个叫 `foo.stale-bar` 的包时我们只会"不动它"，不做危险动作。
+ */
+const STALE_BACKUP_RE = /\.stale-/u
+function isStaleBackupName(name) {
+  return typeof name === 'string' && STALE_BACKUP_RE.test(name)
+}
+
+/**
+ * 框架**启动关键包**（相对 scope 目录名）：整批改名结束后必须仍能解析，否则全量回滚。
+ * 这两个就是 2026-10-01 停机事故现场：`dsh-app-boot` 顶层 `import '@deepseek-ai/cordis'` 解析不到
+ * ⇒ web 服务进程 exit code=1。判据只认"能解析"这件事，与版本号无关。
+ */
+const FRAMEWORK_BOOT_PACKAGES = ['cordis', 'dsh-app-boot']
+
 /**
  * 顶层条目分类（纯函数）。
  * `entries` 形如 `[{ name, version, isLink, sizeBytes }]`；`isLink` 为真表示已被 junction/符号链接接管。
- * **保守取舍**：同版本保留；缺版本（读不到 package.json）保留并单列 —— 判不准就不动。
+ * **保守取舍**：同版本保留；缺版本（读不到 package.json）保留并单列；`.stale-*` 备份一律不碰 —— 判不准就不动。
  */
 function classifyTopLevel(entries, { runningVersion = null } = {}) {
   const stale = []
@@ -26,6 +51,7 @@ function classifyTopLevel(entries, { runningVersion = null } = {}) {
     if (entry === null || typeof entry !== 'object' || typeof entry.name !== 'string' || entry.name === '') continue
     if (entry.name.startsWith('.')) continue
     if (entry.isLink === true) continue
+    if (isStaleBackupName(entry.name)) continue // 备份（含备份的备份）永不参与判断 —— 见 isStaleBackupName
     const version = entry.version === undefined || entry.version === null ? '' : String(entry.version)
     if (version === '') { missingVersion.push({ name: entry.name, sizeBytes: entry.sizeBytes ?? null }); continue }
     if (runningVersion !== null && version === String(runningVersion)) { sameVersion.push({ name: entry.name, version }); continue }
@@ -34,6 +60,29 @@ function classifyTopLevel(entries, { runningVersion = null } = {}) {
   return { stale, sameVersion, missingVersion }
 }
 
+/**
+ * 改名之后 junction 该指向哪里（纯函数：只**列候选**，存不存在由动作层问 IO）。
+ *
+ * 多基准（真机实证：2026-10-01 事故里 `dsh` 顶层是**真实目录**而不是 junction，
+ * 老判据只从 `dsh` junction 推运行树 → `runningScopeDir = null` → 10 条包全部"只改名、没重建"）：
+ *   ① `runningScopeDir/<name>` —— `dsh` 是 junction 时的运行树同级目录（老语义，保留）
+ *   ② `<fwRoot>/.pnpm/node_modules/<scope>/<name>` —— pnpm store 的 hoisted 投影
+ *      （真机 10 条手工补回的 junction 指的正是这里，逐条读过 Target）
+ *   ③ `<fwRoot>/.pnpm/node_modules/<name>` —— 非作用域名的同款投影（防御性兜底）
+ * 顺序即优先级：先运行树（框架自己正在用的那份），再 store 投影。返回 `[{ path, via }]`。
+ */
+function relinkTargetCandidates({ runningScopeDir = null, storeHoistDir = null, scopeName = null, name = null } = {}) {
+  if (typeof name !== 'string' || name === '') return []
+  const out = []
+  if (typeof runningScopeDir === 'string' && runningScopeDir !== '') out.push({ path: join(runningScopeDir, name), via: 'running-scope' })
+  if (typeof storeHoistDir === 'string' && storeHoistDir !== '') {
+    if (typeof scopeName === 'string' && scopeName !== '') out.push({ path: join(storeHoistDir, scopeName, name), via: 'pnpm-hoist' })
+    out.push({ path: join(storeHoistDir, name), via: 'pnpm-hoist-flat' })
+  }
+  const seen = new Set()
+  return out.filter((c) => (seen.has(c.path) ? false : (seen.add(c.path), true)))
+}
+
 /**
  * 备份保留策略（纯函数）：保留集合 = 「回滚点引用的路径」∪「按 mtime 最近的 N 条」。
  * `keep` 非法/缺失时按 1 处理（最小保留）。返回 `{ kept, remove, freedBytes }`，
@@ -56,4 +105,4 @@ function planBackupRetention(snapshots, { referenced = [], keep = 1 } = {}) {
   return { kept, remove, freedBytes }
 }
 
-export { classifyTopLevel, planBackupRetention }
+export { FRAMEWORK_BOOT_PACKAGES, classifyTopLevel, isStaleBackupName, planBackupRetention, relinkTargetCandidates }

package/lib/server/domain/settings-api-scan.js

@@ -34,6 +34,21 @@ import { join } from 'node:path'
 /** 0.1.2-rc.1 起被官方删除的 dsh-settings API（命中即"实际不兼容"）。 */
 const REMOVED_SETTINGS_SYMBOLS = ['settingsNamespace', 'installSettingsSection']
 
+/**
+ * **判据版本戳**（0.5.34 加法）：判据一变就必须改这个字符串。
+ *
+ * 为什么需要它（真机背景 2026-10-01）：`compat-pending.json` 里的结论是"当时的判据"写下的，
+ * 但面板把它当**事实**一直展示：`dshmarket` 记录里压着
+ * `check:"fail"` + `checkNote:"源码仍引用 0.1.2 起已删除的 dsh-settings API…"` ——
+ * 那是 0.5.33 收紧判据**之前**的误报结论（真机复核：现在 0 命中），
+ * 于是面板持续显示"实际不兼容，启用会让整个服务启动崩溃"，把用户永久钉在「待适配」。
+ * 有了版本戳，"这条结论是哪一版判据算的"就可以被后续读取代发判读 → 过期即重算（见 compat-verdict.js）。
+ *
+ *   v1 = 0.3.35 的「标识符边界 + 排除局部定义」（挡不住注释里的名字与对象键上的名字）
+ *   v2 = 0.5.33 的「真的从 `@deepseek-ai/dsh-settings` 绑定进来」（本文件实现）
+ */
+const SCAN_CRITERIA_VERSION = 'dsh-settings-scan/2'
+
 /** 这些 API 原本来自哪个包（只有真的从它绑定进来的名字才算引用）。 */
 const SETTINGS_MODULE = '@deepseek-ai/dsh-settings'
 
@@ -248,4 +263,4 @@ function scanSettingsApiUsage(pkgDir) {
   return found
 }
 
-export { REMOVED_SETTINGS_SYMBOLS, SETTINGS_MODULE, maskLiterals, settingsApiBindings, settingsApiReferences, referencesRemovedSymbol, scanSettingsApiUsage }
+export { REMOVED_SETTINGS_SYMBOLS, SCAN_CRITERIA_VERSION, SETTINGS_MODULE, maskLiterals, settingsApiBindings, settingsApiReferences, referencesRemovedSymbol, scanSettingsApiUsage }

package/lib/server/routes/plugins.js

@@ -4,7 +4,7 @@
 import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { createRequire } from 'node:module'
-import { checkPluginFrameworkCompat, probePluginImport, readCompatPending, rowIdModuleMap, writeCompatPending } from '../domain/compat.js'
+import { checkPluginFrameworkCompat, probePluginImport, readCompatPendingWithVerdicts, rowIdModuleMap, writeCompatPending } from '../domain/compat.js'
 import { cleanFrameworkBackups, cleanFrameworkTopLevel, readRollbackReferenced, reportFrameworkEntities, resolveFrameworkLayout } from '../domain/framework-cleanup.js'
 import { currentFrameworkVersion } from '../domain/framework.js'
 import { pnpmRemove } from '../domain/install-job.js'
@@ -78,7 +78,8 @@ async function routeToggle(req, res, rc) {
       // 前端弹风险提示确认框；带 confirmRisky:true 才放行）。
       // 注意下面还有一条**硬**门禁：启用前的 import 冒烟检查——那条是事实性崩溃（模块根本加载不了），
       // 不允许覆盖（否则下次启动必崩，与「服务永不崩」冲突）。
-      const compatPending = readCompatPending()
+      // 0.5.34：走**读取代发**（判据戳落后的结论先用当前判据复核/回写）⇒ 判定依据是最新的；软禁闸门本身一个字没放宽
+      const compatPending = readCompatPendingWithVerdicts({ baseDir: dirname(findPatchPath(ctx)) }).pending
       const pend = (compatPending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
       if (pend) {
         if (body.confirmRisky !== true) {
@@ -97,9 +98,9 @@ async function routeToggle(req, res, rc) {
           return
         }
         try {
-          const next = readCompatPending()
-          const rec = (next?.pending ?? []).find((p) => p.rowId === rowId)
-          if (rec) { rec.riskyApprovedAt = Date.now(); writeCompatPending(next) }
+          // 复核（读取代发）已经作用在 compatPending 上，直接用同一份对象写回，避免重复读+重复扫描
+          const rec = (compatPending?.pending ?? []).find((p) => p.rowId === rowId)
+          if (rec) { rec.riskyApprovedAt = Date.now(); writeCompatPending(compatPending) }
         } catch {}
       }
     }
@@ -126,7 +127,7 @@ async function routeToggle(req, res, rc) {
     // 用户实测就是这样（5 行）。check / checkNote / riskyApprovedAt 一律保留供事后查。
     if (enabled) {
       try {
-        const list = readCompatPending()
+        const list = readCompatPendingWithVerdicts({ baseDir: dirname(findPatchPath(ctx)) }).pending
         const meta = rowIdModuleMap(ctx).get(rowId) ?? null
         if (list !== null && markPendingAdopted(list, rowId, 'manual-enable', meta)) {
           list.updatedAt = new Date().toISOString()
@@ -304,14 +305,14 @@ async function routeAdaptUnlock(req, res, rc) {
       sendError(res, 400, 'rowId 无效')
       return
     }
-    const pending = readCompatPending()
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    const { pending, verdicts } = readCompatPendingWithVerdicts({ baseDir: profileDir }) // 0.5.34：读取代发
     const entry = (pending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
     if (entry === undefined) {
       sendError(res, 404, '该行不在适配门待适配清单中（或已解锁）')
       return
     }
-    const patchPath = findPatchPath(ctx)
-    const profileDir = dirname(patchPath)
     let pkg = null
     let pkgDir = null
     let version = null
@@ -327,11 +328,13 @@ async function routeAdaptUnlock(req, res, rc) {
     const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
     const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'unknown', reason: '无法读取包信息' }
     if (check.decision === 'fail') {
-      // 0.5.33 改错 ①-2：文案必须写清「为什么不行 + 出路」——旧文案只有一句"适配校验未通过"，
-      // 用户在界面上根本不知道下一步该做什么（而按钮此前又只在 adoptable 时出现，容易变成对不上的承诺）。
+      // 0.5.33 改错 ①-2：文案必须写清「为什么不行 + 出路」（旧文案只有一句"适配校验未通过"，用户不知道下一步
+      // 该做什么）；0.5.34：真不兼容的行**一个字都不放宽** —— 仍然 409、仍然零改动（补丁与清单逐字节不变）。
       sendError(res, 409, `适配校验未通过：${String(check.reason ?? '适配校验未通过')}。出路：先点「检测更新」把它更新到兼容当前框架 ${fwVer} 的版本（更新完成会自动重跑源码扫描，通过即解锁）；若它已不再需要，可在补丁里删掉/禁用这一行。本次未改动补丁与适配门清单。`)
       return
     }
+    // 可解锁的两种来路（判据都不放松）：① 真的更新过（版本变化）② 旧判据的 fail 已被当前判据撤回
+    const view = verdicts.get(rowId) ?? null, rescinded = view?.rescinded === true, changed = version !== null && version !== entry.version
     await removeDisableBlock(patchPath, rowId)
     entry.status = 'adopted'
     entry.adoptedAt = Date.now()
@@ -339,8 +342,9 @@ async function routeAdaptUnlock(req, res, rc) {
     entry.adoptedFramework = fwVer
     entry.check = check.decision
     entry.checkNote = check.reason ?? null
+    entry.adoptedBasis = changed ? 'version-changed' : (rescinded ? 'verdict-rescinded' : 'scan-pass')
     writeCompatPending(pending)
-    sendJson(res, 200, { ok: true, rowId, adopted: true, check: check.decision, note: check.reason ?? null })
+    sendJson(res, 200, { ok: true, rowId, adopted: true, check: check.decision, note: check.reason ?? null, basis: entry.adoptedBasis, previousVerdict: rescinded ? (view?.previous?.decision ?? 'fail') : null, evidence: rescinded ? (view?.evidence ?? null) : null })
     return
 }
 
@@ -357,7 +361,7 @@ async function routeAdaptUnlockAll(req, res, rc) {
       sendError(res, 400, 'root 无效')
       return
     }
-    const pending = readCompatPending()
+    const pending = readCompatPendingWithVerdicts({ baseDir: dirname(findPatchPath(ctx)) }).pending
     const patchPath = findPatchPath(ctx)
     const profileDir = dirname(patchPath)
     // v0.3.45：匹配规则改成「moduleName 前缀 **或** 属主行集合」——
@@ -525,6 +529,13 @@ async function routeCleanResiduals(req, res, rc) {
     extra.dryRun = dryRun
   }
   const payload = { ok: failed.length === 0, removed, kept, failed, count: removed.length, ...extra }
+    // 0.5.34 加法：框架档的**硬闸**结果必须如实浮到面板层（旧行为：改名了却没重建链接，只在 JSON 里留一行）
+    const fw = extra.framework
+    if (fw && (fw.ok === false || fw.verify?.ok === false)) {
+      const rb = (fw.rolledBack ?? []).length > 0 ? `；已回滚 ${fw.rolledBack.length} 条（${fw.rolledBack.map((r) => `${r.name}:${r.reason}`).join('、')}）` : ''
+      sendJson(res, 200, { ...payload, ok: false, error: `${fw.verify?.ok === false ? `框架可解析性验证未通过（${fw.verify.error ?? '未知'}）` : `有 ${fw.failed.length} 条没能安全落地`}${rb}；详情见 framework 字段。` })
+      return
+    }
     if (failed.length > 0) {
       const detail = failed.slice(0, 3).map((f) => `${f.name}（${f.error ?? '未知原因'}）`).join('；')
       const keptNote = kept.length > 0 ? `；已在用插件 ${kept.length} 个（保留不删）` : ''

package/lib/server/routes/state.js

@@ -3,7 +3,7 @@
 
 import { readFileSync, existsSync } from 'node:fs'
 import { dirname, join } from 'node:path'
-import { detectAdoptablePending, detectCompat, gatingSummary, readCompatGate, readCompatPending } from '../domain/compat.js'
+import { detectAdoptablePending, detectCompat, gatingSummary, readCompatGate, readCompatPendingWithVerdicts } from '../domain/compat.js'
 import { compUiUrl, findComponents } from '../domain/components.js'
 import { currentFrameworkVersion, detectFrameworkUpgrade } from '../domain/framework.js'
 import { peerVetoFor } from '../domain/peer-veto.js'
@@ -48,7 +48,11 @@ async function routeStateGet(req, res, rc) {
     }
     const extraRows = await readExtraBundleRows(dirname(patchPath))
     const profileDir = dirname(patchPath)
-    const compatPending = readCompatPending()
+    // 0.5.34 加法（**读取代发**）：给 profileDir ⇒ 判据戳落后的记录用当前判据只读重算，
+    // 结论变了才回写（幂等：结论不变**零写盘**）。真不兼容的重算仍 fail，一个字都不动。
+    const pendingState = readCompatPendingWithVerdicts({ baseDir: profileDir })
+    const compatPending = pendingState.pending
+    const compatVerdicts = pendingState.verdicts
     const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
     // 兼容门总开关 + 自动检测（只提示不自动开）
     const compatGate = readCompatGate()
@@ -72,6 +76,7 @@ async function routeStateGet(req, res, rc) {
       if (!disabledByPatch && entry.fiberPhase === null && vetoFrameworkVersion !== null) {
         try { veto = peerVetoFor({ moduleName: entry.moduleName, profileDir, frameworkVersion: vetoFrameworkVersion }) } catch { veto = null }
       }
+      const verdict = compatVerdicts.get(entry.rowId) ?? null
       return {
         ...entry,
         userDisabled: disabledByPatch,
@@ -83,7 +88,13 @@ async function routeStateGet(req, res, rc) {
         // v0.3.45：只有"补丁里此刻确实还禁着它"的行才显示【待适配】——
         // 记录与开关脱节时（用户手动启用过 / 补丁块被清掉）不能继续挂着「待适配」误导人
         pendingCompat: compatPendingRows.has(entry.rowId) && disabledByPatch,
+        // 0.5.34 加法：记录的 `fail` 若已被**当前判据**撤回（旧误报），面板据此不再说「待适配」，
+        // 改说「判据已撤回·可解锁」并给一键解锁入口（判据本身一个字都没放宽：真 fail 仍 fail）
+        compatRescinded: compatPendingRows.has(entry.rowId) && verdict?.rescinded === true,
+        // 结论视图：当前判据下的结论 + 是否过期/撤回/复核不了（面板要如实展示，不许把旧结论当事实）
+        compatVerdict: verdict,
         // 自动检测结果（只提示，不自动开）：该待适配行现在是否已适配（插件已更新 + 扫描通过）
+        // 或**旧判据的误报已被撤回**（0.5.34：不再要求"版本变化"，否则用户被永久钉住）
         adoptable: adoptable.get(entry.rowId) ?? null,
         // 框架 peer 预检的本地复算结果（null = 无话可说；只在这类行上下发，不新增常驻面板行）
         veto,
@@ -111,7 +122,7 @@ async function routeStateGet(req, res, rc) {
       const selfPkg = JSON.parse(readFileSync(join(pluginRoot(), 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0, written: patchHeal.written === true, writeError: patchHeal.writeError ?? null, skippedFrameworkOwned: (patchHeal.skipped ?? []).map((s) => s.id ?? null), uncertain: (patchHeal.uncertain ?? []).map((u) => u.id ?? null) }, gating: gatingSummary(ctx, compatPending, entries), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null })) }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0, written: patchHeal.written === true, writeError: patchHeal.writeError ?? null, skippedFrameworkOwned: (patchHeal.skipped ?? []).map((s) => s.id ?? null), uncertain: (patchHeal.uncertain ?? []).map((u) => u.id ?? null) }, gating: gatingSummary(ctx, compatPending, entries, compatVerdicts), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null, verdict: compatVerdicts.get(p.rowId) ?? null })), verdictRefresh: pendingState.refresh === null ? null : { version: pendingState.refresh.version ?? null, updated: pendingState.refresh.updated ?? [], unchanged: pendingState.refresh.unchanged ?? [], unresolved: pendingState.refresh.unresolved ?? [], wrote: pendingState.refresh.wrote === true, writeError: pendingState.refresh.writeError ?? null } }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.33",
+  "version": "0.5.34",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",