@noob-stupid/dsh-plugin-console 0.5.33 → 0.5.35

package/lib/server/domain/settings-api-scan.js

@@ -34,6 +34,21 @@ import { join } from 'node:path'
 /** 0.1.2-rc.1 起被官方删除的 dsh-settings API（命中即"实际不兼容"）。 */
 const REMOVED_SETTINGS_SYMBOLS = ['settingsNamespace', 'installSettingsSection']
 
+/**
+ * **判据版本戳**（0.5.34 加法）：判据一变就必须改这个字符串。
+ *
+ * 为什么需要它（真机背景 2026-10-01）：`compat-pending.json` 里的结论是"当时的判据"写下的，
+ * 但面板把它当**事实**一直展示：`dshmarket` 记录里压着
+ * `check:"fail"` + `checkNote:"源码仍引用 0.1.2 起已删除的 dsh-settings API…"` ——
+ * 那是 0.5.33 收紧判据**之前**的误报结论（真机复核：现在 0 命中），
+ * 于是面板持续显示"实际不兼容，启用会让整个服务启动崩溃"，把用户永久钉在「待适配」。
+ * 有了版本戳，"这条结论是哪一版判据算的"就可以被后续读取代发判读 → 过期即重算（见 compat-verdict.js）。
+ *
+ *   v1 = 0.3.35 的「标识符边界 + 排除局部定义」（挡不住注释里的名字与对象键上的名字）
+ *   v2 = 0.5.33 的「真的从 `@deepseek-ai/dsh-settings` 绑定进来」（本文件实现）
+ */
+const SCAN_CRITERIA_VERSION = 'dsh-settings-scan/2'
+
 /** 这些 API 原本来自哪个包（只有真的从它绑定进来的名字才算引用）。 */
 const SETTINGS_MODULE = '@deepseek-ai/dsh-settings'
 
@@ -248,4 +263,4 @@ function scanSettingsApiUsage(pkgDir) {
   return found
 }
 
-export { REMOVED_SETTINGS_SYMBOLS, SETTINGS_MODULE, maskLiterals, settingsApiBindings, settingsApiReferences, referencesRemovedSymbol, scanSettingsApiUsage }
+export { REMOVED_SETTINGS_SYMBOLS, SCAN_CRITERIA_VERSION, SETTINGS_MODULE, maskLiterals, settingsApiBindings, settingsApiReferences, referencesRemovedSymbol, scanSettingsApiUsage }

package/lib/server/routes/market.js

@@ -6,6 +6,7 @@ import { writeFile } from 'node:fs/promises'
 import { resolve } from 'node:path'
 import { readGithubAuth } from '../domain/install.js'
 import { enrichItems, fetchRepoPackage, fetchSubpackageNames, githubRepoInfo, hasDirectNameHit, normalizePlatformItems, searchNpmPackages, searchSubpackageItems } from '../domain/market.js'
+import { buildPageEnvelope, rankSearchResults } from '../domain/market-search.js'
 import { SKILL_TOPICS, detectSkillRepo, fetchSkillMeta } from '../domain/skills.js'
 import { DEFAULT_SEARCH, gitCloneUrls, orderedRegistries, readGiteeConfig, readSources } from '../domain/sources.js'
 import { GITHUB_API, META_BUDGET_MS, curlJson, fetchJsonUrl, githubJson, looksLikeGitmodules, rawTextWithFallback } from '../infra/http.js'
@@ -13,19 +14,48 @@ import { sendError, sendJson } from '../infra/httpd.js'
 import { marketIndexCacheFile } from '../infra/paths.js'
 import { marketIndexCache, setMarketIndexCache } from '../state.js'
 
+/** 技能检索的 per_page：三 topic 合并去重后不一定还有 20 条，取少了下拉就白丢条目
+ *  （旧行为每 topic 20 条再截前 20 ⇒ 点「加载更多」也翻不出新东西）。 */
+const SKILL_TOPIC_PER_PAGE = 50
+/** 技能池缓存：同一个查询的**同一份合并池**重复切片 ⇒ 翻页幂等（不重不漏）。
+ *  不进 state.js：这是路由层的短命缓存（与静态索引缓存不是一回事）。 */
+const SKILL_POOL_TTL_MS = 300000
+const skillPoolCache = new Map()
+function skillPoolCacheGet(key) {
+  const hit = skillPoolCache.get(key)
+  if (hit === undefined) return null
+  if (Date.now() - hit.at > SKILL_POOL_TTL_MS) { skillPoolCache.delete(key); return null }
+  return hit.items
+}
+function skillPoolCacheSet(key, items) {
+  if (skillPoolCache.size >= 8) skillPoolCache.delete(skillPoolCache.keys().next().value)
+  skillPoolCache.set(key, { at: Date.now(), items })
+}
+
 async function routeSearch(req, res, rc) {
   const DEFAULT_SEARCH = rc.deps.DEFAULT_SEARCH
+  // 网络取数的注入缝（默认就是真通道）：测试要断言"排序/分页/失败路径"时喂固定数据，
+  // 免得把判据与 CI 稳定性绑在网络可用性上（与 routes/index.js 的 deps 同一种风格）。
+  const fetchJson = typeof rc.deps?.fetchJson === 'function' ? rc.deps.fetchJson : fetchJsonUrl
+  const searchRepos = typeof rc.deps?.githubJson === 'function' ? rc.deps.githubJson : githubJson
   const ctx = rc.ctx
   const pathname = rc.pathname
   const method = rc.method
   const body = rc.body
     const raw = typeof body.q === 'string' ? body.q.trim() : ''
     const query = raw === '' ? DEFAULT_SEARCH : raw
-    const page = Math.max(Math.min(Number.parseInt(String(body.page), 10) || 1, 5), 1)
+    // 0.5.35 改错：旧代码把 page **夹到 1..5** —— 第 6 次「加载更多」起原地返回第 5 页，
+    // 用户看到的是"怎么点都不出新条目"（与本次"没有加载更多"同族的第二个截断层）。
+    // 现在只做合法性下限（≥1），真实可翻页性由 buildPageEnvelope 依据数据源的 total 如实回报。
+    const page = Math.max(Number.parseInt(String(body.page), 10) || 1, 1)
     const source = typeof body.source === 'string' && body.source !== '' ? body.source : 'github'
     const all = body.all === true
     const auth = readGithubAuth()
     let items = []
+    // 数据源报的**总命中数**（GitHub search 的 total_count；自定义源没有就留 null —— 绝不编造）
+    let total = null
+    // in:readme 重查那一层有没有被自己的 40 条上限截断（说清楚，别让用户以为"就是没有"）
+    let readmeTruncated = false
     // 给前端的补充说明（如"代码搜索需登录"）——放响应里，前端据此给提示，不改 items 结构
     const extraNotes = {}
     // 增量检索（前端浏览器直连成功时**并行**调用）：只补「npm 包名映射 + in:readme 重查 + 代码搜索子包」，
@@ -36,7 +66,7 @@ async function routeSearch(req, res, rc) {
       if (raw !== '') {
         try { extra.push(...await searchNpmPackages(raw, orderedRegistries(readSources()), 3, auth.token)) } catch {}
         try {
-          const again = await githubJson(
+          const again = await searchRepos(
             `${GITHUB_API}/search/repositories?q=${encodeURIComponent(`${raw} in:name,description,readme${all ? '' : ' topic:dsh-plugin'}`)}&sort=stars&order=desc&per_page=20&page=1`,
             req.signal,
             auth.token,
@@ -48,7 +78,8 @@ async function routeSearch(req, res, rc) {
       sendJson(res, 200, {
         ok: true,
         query: raw,
-        items: extra,
+        // 增量结果同样过**唯一**排序函数：客户端拿到后只需合并，不需要（也不许）自己另排一份
+        items: rankSearchResults(extra, raw),
         extras: true,
         authenticated: auth.loggedIn,
         source: 'github',
@@ -63,11 +94,12 @@ async function routeSearch(req, res, rc) {
       const tasks = [
         (async () => {
           try {
-            const data = await githubJson(
+            const data = await searchRepos(
               `${GITHUB_API}/search/repositories?q=${encodeURIComponent(all ? query : `${query} topic:dsh-plugin`)}&sort=stars&order=desc&per_page=20&page=${page}`,
               req.signal,
               auth.token,
             )
+            if (typeof data?.total_count === 'number') total = data.total_count
             return normalizePlatformItems(data.items ?? [], 'main').map((item) => ({ ...item, source: 'github', sourceName: 'GitHub' }))
           } catch {
             return []
@@ -76,7 +108,7 @@ async function routeSearch(req, res, rc) {
         ...sources.searchSources.filter((s) => s.type === 'custom').map((s) => (async () => {
           try {
             const url = s.url.replace('{q}', encodeURIComponent(query)).replace('{page}', String(page))
-            const data = await fetchJsonUrl(url, 15000, s.headers ?? {})
+            const data = await fetchJson(url, 15000, s.headers ?? {})
             return normalizePlatformItems(data, 'main').map((item) => ({ ...item, source: s.id, sourceName: s.name }))
           } catch {
             return []
@@ -86,40 +118,63 @@ async function routeSearch(req, res, rc) {
       const results = await Promise.all(tasks)
       items = results.flat()
       items = await enrichItems(items)
-      sendJson(res, 200, { ok: true, query, items, authenticated: auth.loggedIn, source: 'all', multi: true })
+      // 多源合并后**只排一次**（唯一排序函数）：跨源条目按同一套名字分层，同层才比 star
+      items = rankSearchResults(items, raw)
+      sendJson(res, 200, {
+        ok: true, query, items, authenticated: auth.loggedIn, source: 'all', multi: true,
+        ...buildPageEnvelope({ shown: items.length, total, page }),
+      })
       return
     }
     if (body.skills === true) {
-      // 技能模式搜索：agent-skills / claude-skills / dsh-skill 三 topic 并行检索后合并去重
-      // （GitHub search 的 OR 语法优先级不可靠，分开查最稳），按 star 排序取前 20。
+      // 技能模式搜索：agent-skills / claude-skills / dsh-skill 三 topic 并行检索后合并去重。
+      // （GitHub search 的 OR 语法优先级不可靠，分开查最稳。）
+      // 0.5.35 改错：旧行为「取前 20 条」把合并池**截断**在 20 —— 客户端点「加载更多」请求下一页，
+      // 服务端仍从**每个 topic 的第 N 页**取 20 条再截前 20，去重后经常一条新的都没有（按钮白点）。
+      // 现在：合并池按唯一排序函数排序 + 去重，然后**照分页口径切片**；并集池按查询缓存，
+      // 同一查询的任何一页都从同一份池里切 ⇒ 翻页幂等（不重不漏）。
       if (source !== 'github') {
         sendError(res, 400, '技能搜索仅支持 GitHub 源')
         return
       }
       const keyword = raw === '' ? '' : `${raw} in:name,description,topics `
-      const tasks = SKILL_TOPICS.map((topic) => (async () => {
-        try {
-          const data = await githubJson(
-            `${GITHUB_API}/search/repositories?q=${encodeURIComponent(`${keyword}topic:${topic}`)}&sort=stars&order=desc&per_page=20&page=${page}`,
-            req.signal,
-            auth.token,
-          )
-          return normalizePlatformItems(data.items ?? [], 'main').map((item) => ({ ...item, source: 'github', skillTopics: [topic] }))
-        } catch {
-          return []
+      const poolKey = `${raw}\u0000${all ? '1' : '0'}`
+      let pool = skillPoolCacheGet(poolKey)
+      if (pool === null) {
+        const tasks = SKILL_TOPICS.map((topic) => (async () => {
+          try {
+            const data = await searchRepos(
+              `${GITHUB_API}/search/repositories?q=${encodeURIComponent(`${keyword}topic:${topic}`)}&sort=stars&order=desc&per_page=${SKILL_TOPIC_PER_PAGE}&page=1`,
+              req.signal,
+              auth.token,
+            )
+            if (typeof data?.total_count === 'number') total = (total ?? 0) + data.total_count
+            return normalizePlatformItems(data.items ?? [], 'main').map((item) => ({ ...item, source: 'github', skillTopics: [topic] }))
+          } catch {
+            return []
+          }
+        })())
+        const merged = (await Promise.all(tasks)).flat()
+        const seen = new Set()
+        const deduped = []
+        for (const item of rankSearchResults(merged, raw)) {
+          if (seen.has(item.fullName)) continue
+          seen.add(item.fullName)
+          deduped.push(item)
         }
-      })())
-      const merged = (await Promise.all(tasks)).flat()
-      const seen = new Set()
-      items = []
-      for (const item of merged.sort((a, b) => b.stars - a.stars)) {
-        if (seen.has(item.fullName)) continue
-        seen.add(item.fullName)
-        items.push(item)
-        if (items.length >= 20) break
+        pool = deduped
+        skillPoolCacheSet(poolKey, pool)
       }
+      const perPage = 20
+      const start = (page - 1) * perPage
+      items = pool.slice(start, start + perPage)
       items = await enrichItems(items)
-      sendJson(res, 200, { ok: true, query, items, authenticated: auth.loggedIn, source: 'github', skills: true })
+      sendJson(res, 200, {
+        ok: true, query, items, authenticated: auth.loggedIn, source: 'github', skills: true,
+        // 技能池的真实总量（三 topic 并集去重后的条数），不是 GitHub 的 total_count 之和
+        // （三个 topic 之间有重叠，直接相加会把"共 N 条"报大）
+        ...buildPageEnvelope({ shown: items.length, total: pool.length, page, perPage }),
+      })
       return
     }
     if (source === 'gitee') {
@@ -140,13 +195,16 @@ async function routeSearch(req, res, rc) {
           // repo 已由 githubRepoInfo 校验；分段编码（只编码中文等非 ASCII，斜杠保留原样——
           // Gitee 服务器不认 %2F 编码的路径分隔，返回 404）
           const [owner, name] = repo.split('/')
-          const data = await fetchJsonUrl(`https://gitee.com/api/v5/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}${tokenQ}`)
+          const data = await fetchJson(`https://gitee.com/api/v5/repos/${encodeURIComponent(owner)}/${encodeURIComponent(name)}${tokenQ}`)
           items = normalizePlatformItems([data], 'master').map((item) => ({ ...item, source: 'gitee' }))
         } catch (error) {
           giteeError = error instanceof Error ? error.message : String(error)
         }
       }
-      sendJson(res, 200, { ok: true, query, items, authenticated: auth.loggedIn, source, giteeNeedsLogin: false, directOnly: true, giteeError })
+      sendJson(res, 200, {
+        ok: true, query, items, authenticated: auth.loggedIn, source, giteeNeedsLogin: false, directOnly: true, giteeError,
+        ...buildPageEnvelope({ shown: items.length, total, page }),
+      })
       return
     } else if (source !== 'github') {
       // 自定义搜索源：URL 模板（{q}/{page} 占位符），返回数组或 {items} 结构；支持配置的请求头
@@ -159,7 +217,7 @@ async function routeSearch(req, res, rc) {
       const url = custom.url
         .replace('{q}', encodeURIComponent(query))
         .replace('{page}', String(page))
-      const data = await fetchJsonUrl(url, 15000, custom.headers ?? {})
+      const data = await fetchJson(url, 15000, custom.headers ?? {})
       items = normalizePlatformItems(data, 'main').map((item) => ({ ...item, source, sourceName: custom.name }))
     } else {
       // npm 包名搜索与 GitHub 仓库搜索**并行**：npm 侧要查 registry 搜索 + packument + 仓库元数据
@@ -167,12 +225,13 @@ async function routeSearch(req, res, rc) {
       const npmPromise = raw !== '' && !body.skills
         ? searchNpmPackages(raw, orderedRegistries(readSources()), 3, auth.token).catch(() => [])
         : Promise.resolve([])
-      const data = await githubJson(
+      const data = await searchRepos(
         `${GITHUB_API}/search/repositories?q=${encodeURIComponent(all ? query : `${query} topic:dsh-plugin`)}&sort=stars&order=desc&per_page=20&page=${page}`,
         req.signal,
         auth.token,
       )
       items = normalizePlatformItems(data.items ?? [], 'main').map((item) => ({ ...item, source: 'github' }))
+      if (typeof data?.total_count === 'number') total = data.total_count
       items = await enrichItems(items)
       // monorepo 子包增强（OpenViking/examples/dsh-memory-plugin 等可按子包名搜到；
       // 代码搜索需登录，未登录时该函数返回空数组，见 domain/market.js 说明）
@@ -188,7 +247,7 @@ async function routeSearch(req, res, rc) {
       // 首屏没有"名字逐词命中"的条目时，用 in:name,description,readme 再查一次（未登录也能用）。
       if (raw !== '' && !body.skills && page === 1 && !hasDirectNameHit(items, raw)) {
         try {
-          const again = await githubJson(
+          const again = await searchRepos(
             `${GITHUB_API}/search/repositories?q=${encodeURIComponent(`${raw} in:name,description,readme${all ? '' : ' topic:dsh-plugin'}`)}&sort=stars&order=desc&per_page=20&page=1`,
             req.signal,
             auth.token,
@@ -196,7 +255,9 @@ async function routeSearch(req, res, rc) {
           for (const it of normalizePlatformItems(again.items ?? [], 'main')) {
             if (items.some((x) => x.fullName === it.fullName)) continue
             items.push({ ...it, source: 'github', viaReadme: true })
-            if (items.length >= 40) break
+            // 截断上限 40 是**既有**的检索面口径（不改"谁被搜出来"）：只影响 in:readme 重查这一路，
+            // 且被截断这件事由下面的 envelope 如实告知（truncated/reason），不再静默。
+            if (items.length >= 40) { readmeTruncated = true; break }
           }
         } catch {}
       }
@@ -217,7 +278,19 @@ async function routeSearch(req, res, rc) {
       if (raw !== '' && !body.skills && !auth.loggedIn) extraNotes.codeSearchSkipped = true
     }
     items = items.filter((item) => item.fullName !== '')
-    sendJson(res, 200, { ok: true, query, items, authenticated: auth.loggedIn, source, ...(extraNotes) })
+    // ★ 唯一一处排序 ★：所有搜索链（github 多路合并 / multi 多源 / custom / gitee）在**这里**统一
+    // 过同一个名字分层函数。上一版各分支自己排/自己截（skills 还截前 20），才会有"点两次结果不同"
+    // 与"高星无关仓库压过逐字命中"。
+    items = rankSearchResults(items, raw)
+    // 分页/截断如实回报：客户端据此决定「加载更多」是否可点、要不要明说"已截断"。
+    const envelope = buildPageEnvelope({ shown: items.length, total, page })
+    sendJson(res, 200, {
+      ok: true, query, items, authenticated: auth.loggedIn, source,
+      ...envelope,
+      // 自己那一层 40 条上限截断了 → 明说（否则用户以为"就是没有"；翻页也解不了这一层）
+      ...(readmeTruncated ? { truncated: true, reason: envelope.reason !== null ? `${envelope.reason}；另：README 重查层已取满 40 条` : 'README 重查层已取满 40 条（可换更精确的关键词缩小范围）' } : {}),
+      ...(extraNotes),
+    })
     return
 }
 

package/lib/server/routes/plugins.js

@@ -4,7 +4,7 @@
 import { readFileSync, existsSync, readdirSync, statSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { createRequire } from 'node:module'
-import { checkPluginFrameworkCompat, probePluginImport, readCompatPending, rowIdModuleMap, writeCompatPending } from '../domain/compat.js'
+import { checkPluginFrameworkCompat, probePluginImport, readCompatPendingWithVerdicts, rowIdModuleMap, writeCompatPending } from '../domain/compat.js'
 import { cleanFrameworkBackups, cleanFrameworkTopLevel, readRollbackReferenced, reportFrameworkEntities, resolveFrameworkLayout } from '../domain/framework-cleanup.js'
 import { currentFrameworkVersion } from '../domain/framework.js'
 import { pnpmRemove } from '../domain/install-job.js'
@@ -78,7 +78,8 @@ async function routeToggle(req, res, rc) {
       // 前端弹风险提示确认框；带 confirmRisky:true 才放行）。
       // 注意下面还有一条**硬**门禁：启用前的 import 冒烟检查——那条是事实性崩溃（模块根本加载不了），
       // 不允许覆盖（否则下次启动必崩，与「服务永不崩」冲突）。
-      const compatPending = readCompatPending()
+      // 0.5.34：走**读取代发**（判据戳落后的结论先用当前判据复核/回写）⇒ 判定依据是最新的；软禁闸门本身一个字没放宽
+      const compatPending = readCompatPendingWithVerdicts({ baseDir: dirname(findPatchPath(ctx)) }).pending
       const pend = (compatPending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
       if (pend) {
         if (body.confirmRisky !== true) {
@@ -97,9 +98,9 @@ async function routeToggle(req, res, rc) {
           return
         }
         try {
-          const next = readCompatPending()
-          const rec = (next?.pending ?? []).find((p) => p.rowId === rowId)
-          if (rec) { rec.riskyApprovedAt = Date.now(); writeCompatPending(next) }
+          // 复核（读取代发）已经作用在 compatPending 上，直接用同一份对象写回，避免重复读+重复扫描
+          const rec = (compatPending?.pending ?? []).find((p) => p.rowId === rowId)
+          if (rec) { rec.riskyApprovedAt = Date.now(); writeCompatPending(compatPending) }
         } catch {}
       }
     }
@@ -126,7 +127,7 @@ async function routeToggle(req, res, rc) {
     // 用户实测就是这样（5 行）。check / checkNote / riskyApprovedAt 一律保留供事后查。
     if (enabled) {
       try {
-        const list = readCompatPending()
+        const list = readCompatPendingWithVerdicts({ baseDir: dirname(findPatchPath(ctx)) }).pending
         const meta = rowIdModuleMap(ctx).get(rowId) ?? null
         if (list !== null && markPendingAdopted(list, rowId, 'manual-enable', meta)) {
           list.updatedAt = new Date().toISOString()
@@ -304,14 +305,14 @@ async function routeAdaptUnlock(req, res, rc) {
       sendError(res, 400, 'rowId 无效')
       return
     }
-    const pending = readCompatPending()
+    const patchPath = findPatchPath(ctx)
+    const profileDir = dirname(patchPath)
+    const { pending, verdicts } = readCompatPendingWithVerdicts({ baseDir: profileDir }) // 0.5.34：读取代发
     const entry = (pending?.pending ?? []).find((p) => p.rowId === rowId && (p.status ?? 'pending') === 'pending')
     if (entry === undefined) {
       sendError(res, 404, '该行不在适配门待适配清单中（或已解锁）')
       return
     }
-    const patchPath = findPatchPath(ctx)
-    const profileDir = dirname(patchPath)
     let pkg = null
     let pkgDir = null
     let version = null
@@ -327,11 +328,13 @@ async function routeAdaptUnlock(req, res, rc) {
     const fwVer = typeof pending.frameworkVersion === 'string' ? pending.frameworkVersion : '?'
     const check = pkg !== null ? checkPluginFrameworkCompat(pkg, fwVer, pkgDir) : { decision: 'unknown', reason: '无法读取包信息' }
     if (check.decision === 'fail') {
-      // 0.5.33 改错 ①-2：文案必须写清「为什么不行 + 出路」——旧文案只有一句"适配校验未通过"，
-      // 用户在界面上根本不知道下一步该做什么（而按钮此前又只在 adoptable 时出现，容易变成对不上的承诺）。
+      // 0.5.33 改错 ①-2：文案必须写清「为什么不行 + 出路」（旧文案只有一句"适配校验未通过"，用户不知道下一步
+      // 该做什么）；0.5.34：真不兼容的行**一个字都不放宽** —— 仍然 409、仍然零改动（补丁与清单逐字节不变）。
       sendError(res, 409, `适配校验未通过：${String(check.reason ?? '适配校验未通过')}。出路：先点「检测更新」把它更新到兼容当前框架 ${fwVer} 的版本（更新完成会自动重跑源码扫描，通过即解锁）；若它已不再需要，可在补丁里删掉/禁用这一行。本次未改动补丁与适配门清单。`)
       return
     }
+    // 可解锁的两种来路（判据都不放松）：① 真的更新过（版本变化）② 旧判据的 fail 已被当前判据撤回
+    const view = verdicts.get(rowId) ?? null, rescinded = view?.rescinded === true, changed = version !== null && version !== entry.version
     await removeDisableBlock(patchPath, rowId)
     entry.status = 'adopted'
     entry.adoptedAt = Date.now()
@@ -339,8 +342,9 @@ async function routeAdaptUnlock(req, res, rc) {
     entry.adoptedFramework = fwVer
     entry.check = check.decision
     entry.checkNote = check.reason ?? null
+    entry.adoptedBasis = changed ? 'version-changed' : (rescinded ? 'verdict-rescinded' : 'scan-pass')
     writeCompatPending(pending)
-    sendJson(res, 200, { ok: true, rowId, adopted: true, check: check.decision, note: check.reason ?? null })
+    sendJson(res, 200, { ok: true, rowId, adopted: true, check: check.decision, note: check.reason ?? null, basis: entry.adoptedBasis, previousVerdict: rescinded ? (view?.previous?.decision ?? 'fail') : null, evidence: rescinded ? (view?.evidence ?? null) : null })
     return
 }
 
@@ -357,7 +361,7 @@ async function routeAdaptUnlockAll(req, res, rc) {
       sendError(res, 400, 'root 无效')
       return
     }
-    const pending = readCompatPending()
+    const pending = readCompatPendingWithVerdicts({ baseDir: dirname(findPatchPath(ctx)) }).pending
     const patchPath = findPatchPath(ctx)
     const profileDir = dirname(patchPath)
     // v0.3.45：匹配规则改成「moduleName 前缀 **或** 属主行集合」——
@@ -525,6 +529,13 @@ async function routeCleanResiduals(req, res, rc) {
     extra.dryRun = dryRun
   }
   const payload = { ok: failed.length === 0, removed, kept, failed, count: removed.length, ...extra }
+    // 0.5.34 加法：框架档的**硬闸**结果必须如实浮到面板层（旧行为：改名了却没重建链接，只在 JSON 里留一行）
+    const fw = extra.framework
+    if (fw && (fw.ok === false || fw.verify?.ok === false)) {
+      const rb = (fw.rolledBack ?? []).length > 0 ? `；已回滚 ${fw.rolledBack.length} 条（${fw.rolledBack.map((r) => `${r.name}:${r.reason}`).join('、')}）` : ''
+      sendJson(res, 200, { ...payload, ok: false, error: `${fw.verify?.ok === false ? `框架可解析性验证未通过（${fw.verify.error ?? '未知'}）` : `有 ${fw.failed.length} 条没能安全落地`}${rb}；详情见 framework 字段。` })
+      return
+    }
     if (failed.length > 0) {
       const detail = failed.slice(0, 3).map((f) => `${f.name}（${f.error ?? '未知原因'}）`).join('；')
       const keptNote = kept.length > 0 ? `；已在用插件 ${kept.length} 个（保留不删）` : ''

package/lib/server/routes/state.js

@@ -3,7 +3,7 @@
 
 import { readFileSync, existsSync } from 'node:fs'
 import { dirname, join } from 'node:path'
-import { detectAdoptablePending, detectCompat, gatingSummary, readCompatGate, readCompatPending } from '../domain/compat.js'
+import { detectAdoptablePending, detectCompat, gatingSummary, readCompatGate, readCompatPendingWithVerdicts } from '../domain/compat.js'
 import { compUiUrl, findComponents } from '../domain/components.js'
 import { currentFrameworkVersion, detectFrameworkUpgrade } from '../domain/framework.js'
 import { peerVetoFor } from '../domain/peer-veto.js'
@@ -48,7 +48,11 @@ async function routeStateGet(req, res, rc) {
     }
     const extraRows = await readExtraBundleRows(dirname(patchPath))
     const profileDir = dirname(patchPath)
-    const compatPending = readCompatPending()
+    // 0.5.34 加法（**读取代发**）：给 profileDir ⇒ 判据戳落后的记录用当前判据只读重算，
+    // 结论变了才回写（幂等：结论不变**零写盘**）。真不兼容的重算仍 fail，一个字都不动。
+    const pendingState = readCompatPendingWithVerdicts({ baseDir: profileDir })
+    const compatPending = pendingState.pending
+    const compatVerdicts = pendingState.verdicts
     const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
     // 兼容门总开关 + 自动检测（只提示不自动开）
     const compatGate = readCompatGate()
@@ -72,6 +76,7 @@ async function routeStateGet(req, res, rc) {
       if (!disabledByPatch && entry.fiberPhase === null && vetoFrameworkVersion !== null) {
         try { veto = peerVetoFor({ moduleName: entry.moduleName, profileDir, frameworkVersion: vetoFrameworkVersion }) } catch { veto = null }
       }
+      const verdict = compatVerdicts.get(entry.rowId) ?? null
       return {
         ...entry,
         userDisabled: disabledByPatch,
@@ -83,7 +88,13 @@ async function routeStateGet(req, res, rc) {
         // v0.3.45：只有"补丁里此刻确实还禁着它"的行才显示【待适配】——
         // 记录与开关脱节时（用户手动启用过 / 补丁块被清掉）不能继续挂着「待适配」误导人
         pendingCompat: compatPendingRows.has(entry.rowId) && disabledByPatch,
+        // 0.5.34 加法：记录的 `fail` 若已被**当前判据**撤回（旧误报），面板据此不再说「待适配」，
+        // 改说「判据已撤回·可解锁」并给一键解锁入口（判据本身一个字都没放宽：真 fail 仍 fail）
+        compatRescinded: compatPendingRows.has(entry.rowId) && verdict?.rescinded === true,
+        // 结论视图：当前判据下的结论 + 是否过期/撤回/复核不了（面板要如实展示，不许把旧结论当事实）
+        compatVerdict: verdict,
         // 自动检测结果（只提示，不自动开）：该待适配行现在是否已适配（插件已更新 + 扫描通过）
+        // 或**旧判据的误报已被撤回**（0.5.34：不再要求"版本变化"，否则用户被永久钉住）
         adoptable: adoptable.get(entry.rowId) ?? null,
         // 框架 peer 预检的本地复算结果（null = 无话可说；只在这类行上下发，不新增常驻面板行）
         veto,
@@ -111,7 +122,7 @@ async function routeStateGet(req, res, rc) {
       const selfPkg = JSON.parse(readFileSync(join(pluginRoot(), 'package.json'), 'utf8'))
       selfVersion = typeof selfPkg.version === 'string' ? selfPkg.version : null
     } catch {}
-    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0, written: patchHeal.written === true, writeError: patchHeal.writeError ?? null, skippedFrameworkOwned: (patchHeal.skipped ?? []).map((s) => s.id ?? null), uncertain: (patchHeal.uncertain ?? []).map((u) => u.id ?? null) }, gating: gatingSummary(ctx, compatPending, entries), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null })) }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    sendJson(res, 200, { ok: true, entries, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0, written: patchHeal.written === true, writeError: patchHeal.writeError ?? null, skippedFrameworkOwned: (patchHeal.skipped ?? []).map((s) => s.id ?? null), uncertain: (patchHeal.uncertain ?? []).map((u) => u.id ?? null) }, gating: gatingSummary(ctx, compatPending, entries, compatVerdicts), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null, verdict: compatVerdicts.get(p.rowId) ?? null })), verdictRefresh: pendingState.refresh === null ? null : { version: pendingState.refresh.version ?? null, updated: pendingState.refresh.updated ?? [], unchanged: pendingState.refresh.unchanged ?? [], unresolved: pendingState.refresh.unresolved ?? [], wrote: pendingState.refresh.wrote === true, writeError: pendingState.refresh.writeError ?? null } }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.33",
+  "version": "0.5.35",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",