@noob-stupid/dsh-plugin-console 0.5.95 → 0.5.98

package/lib/client.js

@@ -387,6 +387,69 @@
 			gateRowFromUpgrade: "来源：框架升级预扫",
 			gateRowAt: " · {t}",
 			gateRowAdoptable: " · 已通过源码扫描，可解锁",
+			// ★ 0.5.98 加法（用户 2026-10-28）：适配门**记录**的如实标注 + 删除入口（两段式）。
+			//   现场：3 条 pending 记录的补丁行早已不存在、moduleName 也是 null —— 面板必须如实说出来。
+			gateRowModule: "模块：",
+			gateRowMissing: "该行已不存在",
+			gateStaleLine: "另有 {n} 条记录的补丁行已不存在（永远等不到适配，可以清掉）",
+			gateForgetRow: "删除记录",
+			gateForgetRowTitle: "只删这条记录：不动插件、不动补丁文件（点一下先确认）",
+			gateForgetStale: "清理无效记录",
+			gateForgetStaleTitle: "只清掉补丁行已不存在的记录：不动插件、不动补丁文件（点一下先确认）",
+			gateForgetArmRow: "将删除记录 {id}（模块：{name}）。",
+			gateForgetArmStale: "将清理 {n} 条失效记录（补丁行已不存在的那几条）。真实待适配与历史记录都不会被删。",
+			gateForgetSafety: "只删 compat-pending.json 里的记录：不动插件、不动补丁文件，写盘前先备份。",
+			gateForgetConfirm: "确认删除",
+			gateForgetCancel: "取消",
+			gateForgetDoneRow: "已删除记录 {id}（插件与补丁一个字都没动）",
+			gateForgetDoneStale: "已清理 {n} 条失效记录（插件与补丁一个字都没动）",
+			gateForgetNone: "没有可删除的记录（文件未改动）",
+			gateForgetFailed: "删除失败：",
+			// ★ 0.5.x 加法（用户 2026-10-18）：「安全启动」在界面上的入口 —— 门控面板里的一个分区。
+			//   用户原话「现在这能力藏得太深，只有命令行能用」；这里只做展示 + 两段式上膛，
+			//   判据与动作白名单全在服务端 POST /plugin-console/safe-boot。
+			safeBootSectionTitle: "安全启动",
+			safeBootToggleTitle: "展开/收起安全启动面板（只有展开那一下才读一次快照列表，收起时零请求）",
+			safeBootSectionHint: "服务还能应答时的出路：回到上次好的补丁状态、或只禁可疑行。服务起不来时用下面的命令行兜底。",
+			safeBootLoading: "正在读取快照列表…",
+			safeBootReload: "重新读取",
+			safeBootListFailed: "读取快照失败：",
+			safeBootEmpty: "还没有快照：",
+			safeBootNotWritten: "本次没有写新快照：",
+			safeBootReasonPatchInvalid: "补丁结构校验没过，快照闸门没放行",
+			safeBootReasonNoPatch: "没有补丁文件，没有可写的材料",
+			safeBootReasonEnvChanged: "环境指纹刚变过，还没确认服务正常",
+			safeBootReasonUnchanged: "内容与最新快照逐字节相同，无需再写一份",
+			safeBootReasonNotYet: "还没到该写的时机（快照只在服务确认正常、且环境指纹未变时才写）",
+			safeBootCount: "快照 {n} 份",
+			safeBootLastGoodId: "最后标记为良好：",
+			safeBootLastGood: "良好（last-good）",
+			safeBootRowAt: "时间",
+			safeBootRowSha: "sha256",
+			safeBootRestore: "恢复上次好的状态",
+			safeBootRestoreTitle: "两段式：第一下只是上膛并写明要恢复到哪份快照，确认后才真发请求",
+			safeBootDisable: "只禁用可疑行",
+			safeBootDisableTitle: "两段式：只给自动预检点名的行追加 disabled: true，不做整树回滚",
+			safeBootMarkGood: "标记当前为好的状态",
+			safeBootMarkGoodTitle: "把最新这份快照标记为良好（永不随保留策略删除）；成功后自动刷新列表",
+			safeBootArmRestore: "要恢复到的快照：",
+			safeBootArmRestoreOverwrite: "会把这个补丁文件整份覆盖成快照内容（不做合并），改前先另存备份：",
+			safeBootArmDisable: "只给这些行追加 disabled: true：",
+			safeBootArmDisableNote: "不删任何行、不做整树回滚，改前先另存备份。",
+			safeBootConfirm: "确认执行",
+			safeBootCancel: "取消（不发任何请求）",
+			safeBootDoneRestore: "已按快照逐字节恢复（改前状态已备份）",
+			safeBootDoneDisable: "已只给点名行追加 disabled: true（其余逐字节未动）：",
+			safeBootDoneMarkGood: "已标记为良好：这份快照不再随保留策略删除：",
+			safeBootDisabledSkipped: "跳过",
+			safeBootNoopRestore: "当前补丁与快照逐字节一致，无需恢复（已备份当前状态）",
+			safeBootNoSuspects: "服务端没点名任何可疑行，一个字节都没改",
+			safeBootSuspectsTitle: "自动预检点名的可疑行：",
+			safeBootSuspectsNone: "自动预检还没点名任何可疑行 —— 所以这里不显示「只禁用可疑行」按钮（点了也没东西可禁）",
+			safeBootNoSnapshotActions: "没有快照可操作：「恢复」与「标记为良好」都要先有快照，所以这两个按钮不显示",
+			safeBootFailed: "操作失败：",
+			safeBootCmdHint: "服务起不来时（命令行兜底，无需服务在跑）：",
+			safeBootBusy: "进行中…",
 			starHint: "喜欢这个插件？去 GitHub 点个 Star",
 			starHintTitle: "在新标签页打开 GitHub 项目",
 			fwFailedButUpgraded: "框架本体其实已经升到 {v} 并已生效——失败的只是脚本最后「重启服务」那一步。可点「重启服务」确认，或必要时回滚。",
@@ -1118,8 +1181,67 @@
 			gateRowReason: "Reason: {reason}",
 			gateRowFromBoot: "Source: boot-failure quarantine",
 			gateRowFromUpgrade: "Source: framework upgrade pre-scan",
+			// ★ 0.5.98 additive: honest labelling of adaptation-gate **records** + a delete entry (two-step).
+			gateRowModule: "Module: ",
+			gateRowMissing: "this row no longer exists",
+			gateStaleLine: "{n} more record(s) point to rows that no longer exist (they can never be adapted — safe to clean up)",
+			gateForgetRow: "Delete record",
+			gateForgetRowTitle: "Deletes this record only: no plugin and no patch file is touched (click once to confirm)",
+			gateForgetStale: "Clean up invalid records",
+			gateForgetStaleTitle: "Only removes records whose patch row no longer exists: no plugin and no patch file is touched (click once to confirm)",
+			gateForgetArmRow: "Record {id} (module: {name}) will be deleted.",
+			gateForgetArmStale: "{n} invalid record(s) (their patch rows no longer exist) will be removed. Real pending rows and history stay untouched.",
+			gateForgetSafety: "Records in compat-pending.json only: no plugin and no patch file is touched, and a backup is written first.",
+			gateForgetConfirm: "Confirm delete",
+			gateForgetCancel: "Cancel",
+			gateForgetDoneRow: "Deleted record {id} (plugins and patch file untouched)",
+			gateForgetDoneStale: "Removed {n} invalid record(s) (plugins and patch file untouched)",
+			gateForgetNone: "Nothing to delete (file unchanged)",
+			gateForgetFailed: "Delete failed: ",
 			gateRowAt: " · {t}",
 			gateRowAdoptable: " · passed the source scan, can be unlocked",
+			safeBootSectionTitle: "Safe boot",
+			safeBootToggleTitle: "Expand/collapse the safe-boot panel (the snapshot list is read once per expand — zero requests while collapsed)",
+			safeBootSectionHint: "Ways out while the service still answers: return to the last good patch state, or disable suspect rows only. When the service cannot start, use the command below.",
+			safeBootLoading: "Reading the snapshot list…",
+			safeBootReload: "Reload",
+			safeBootListFailed: "Could not read snapshots: ",
+			safeBootEmpty: "No snapshot yet: ",
+			safeBootNotWritten: "No new snapshot was written this time: ",
+			safeBootReasonPatchInvalid: "the patch failed the structural check, so the snapshot gate refused to write",
+			safeBootReasonNoPatch: "there is no patch file, so there is nothing to snapshot",
+			safeBootReasonEnvChanged: "the environment fingerprint just changed, the service is not confirmed healthy yet",
+			safeBootReasonUnchanged: "byte-identical to the newest snapshot, no need to write another one",
+			safeBootReasonNotYet: "the moment has not arrived yet (snapshots are written only once the service is confirmed healthy and the environment fingerprint has not changed)",
+			safeBootCount: "Snapshots: {n}",
+			safeBootLastGoodId: "Last marked good: ",
+			safeBootLastGood: "good (last-good)",
+			safeBootRowAt: "at",
+			safeBootRowSha: "sha256",
+			safeBootRestore: "Restore last-good state",
+			safeBootRestoreTitle: "Two steps: the first click only arms it and names the snapshot, the request goes out after you confirm",
+			safeBootDisable: "Disable suspect rows only",
+			safeBootDisableTitle: "Two steps: append disabled: true to the rows named by auto-preflight only, never a whole-tree rollback",
+			safeBootMarkGood: "Mark the current state as good",
+			safeBootMarkGoodTitle: "Mark the newest snapshot as good (never removed by retention); the list refreshes afterwards",
+			safeBootArmRestore: "Snapshot to restore:",
+			safeBootArmRestoreOverwrite: "It overwrites this whole patch file with the snapshot content (no merge); the current state is backed up first:",
+			safeBootArmDisable: "Append disabled: true to these rows only:",
+			safeBootArmDisableNote: "No row is deleted and there is no whole-tree rollback; the current state is backed up first.",
+			safeBootConfirm: "Confirm",
+			safeBootCancel: "Cancel (sends nothing)",
+			safeBootDoneRestore: "Restored byte-for-byte from the snapshot (previous state backed up)",
+			safeBootDoneDisable: "Appended disabled: true to the named rows only (everything else untouched):",
+			safeBootDoneMarkGood: "Marked as good: this snapshot is never removed by retention:",
+			safeBootDisabledSkipped: "skipped",
+			safeBootNoopRestore: "The patch is already byte-identical to the snapshot — nothing to restore (current state was backed up)",
+			safeBootNoSuspects: "The server named no suspect rows, so not a single byte changed",
+			safeBootSuspectsTitle: "Rows named by auto-preflight:",
+			safeBootSuspectsNone: "Auto-preflight has not named any suspect row yet — so the \"disable suspect rows only\" button is not shown (there would be nothing to disable)",
+			safeBootNoSnapshotActions: "Nothing to act on: restore and mark-as-good both need an existing snapshot, so those two buttons are not shown",
+			safeBootFailed: "Action failed: ",
+			safeBootCmdHint: "When the service cannot start (offline fallback, no running server needed):",
+			safeBootBusy: "working…",
 			starHint: "Enjoying this plugin? Star it on GitHub",
 			starHintTitle: "Open the GitHub project in a new tab",
 			fwFailedButUpgraded: "The framework itself is already on {v} and active — only the final \"restart service\" step failed. Use Restart service to confirm, or roll back if needed.",
@@ -5689,12 +5811,378 @@ const RESTART_FAILED_NOTE = "重启请求失败";
 			const gateReady = state !== null && state.status === "ready";
 			const gateAutoDisable = !gateReady || (state.data.compatGate ?? {}).autoDisable !== false;
 			const gateAutoDetect = !gateReady || (state.data.compatGate ?? {}).autoDetect !== false;
-			const gatePendingCount = gateReady ? (state.data.compatPending?.pending ?? []).length : 0;
+			// ★ 0.5.98 改错（用户 2026-10-28 实测）：计数只数**真待适配**的 —— `status=pending`
+			//   **且**该行此刻仍在补丁里。旧口径取 `compatPending.pending.length`，把两种"不是待办"的
+			//   记录算了进去：① 已经 adopted 的历史（服务端本来就滤掉了，但语义上也不该数）；
+			//   ② **行早已不存在的 pending**（真机现场 3 条，moduleName 也是 null）——
+			//   于是面板一直挂着"有 N 行待适配"，而实际一行都没有。
+			//   判据的唯一真源在服务端（domain/compat-pending-records.js#isActionablePending，
+			//   /state 下发 actionableCount / staleCount）；拿不到这两个字段时（老服务端），
+			//   这里按**同一个判据**用 state.data.patch 的既有行清单（disables/forced/inserts，
+			//   就是补丁解析的产物）回退算，**绝不退回数组长度**。
+			const gatePatchRowIds = new Set([
+				...((state !== null && state.data && state.data.patch && Array.isArray(state.data.patch.disables)) ? state.data.patch.disables : []),
+				...((state !== null && state.data && state.data.patch && Array.isArray(state.data.patch.forced)) ? state.data.patch.forced : []),
+				...((state !== null && state.data && state.data.patch && Array.isArray(state.data.patch.inserts)) ? state.data.patch.inserts : []),
+			]);
+			const gatePendingRaw = gateReady ? (state.data.compatPending?.pending ?? []) : [];
+			/** 一条记录"行还在不在"（服务端 rowMissing 优先；老服务端按本地行清单算 —— 同一判据）。 */
+			const gateRowMissing = (r) => (r !== null && r !== undefined && typeof r.rowMissing === "boolean"
+				? r.rowMissing
+				: !(r !== null && r !== undefined && typeof r.rowId === "string" && gatePatchRowIds.has(r.rowId)));
+			/** 一条记录"是不是真待适配"（服务端 actionable 优先；老服务端按同一判据回退）。 */
+			const gateRowActionable = (r) => (r !== null && r !== undefined && typeof r.actionable === "boolean"
+				? r.actionable
+				: ((r?.status ?? "pending") === "pending" && !gateRowMissing(r)));
+			const gateActionableRows = gatePendingRaw.filter((p) => (p?.status ?? "pending") === "pending" && !gateRowMissing(p));
+			const gateStaleRows = gatePendingRaw.filter((p) => (p?.status ?? "pending") === "pending" && gateRowMissing(p));
+			const gatePendingCount = gateReady
+				? (Number.isFinite(state.data.compatPending?.actionableCount) ? state.data.compatPending.actionableCount : gateActionableRows.length)
+				: 0;
+			const gateStaleCount = gateReady
+				? (Number.isFinite(state.data.compatPending?.staleCount) ? state.data.compatPending.staleCount : gateStaleRows.length)
+				: 0;
 			// 门控明细清单（用户 2026-09-24 要求：面板要显示"是哪些插件"，不只是数量）
 			const [gateShowAll, setGateShowAll] = react.useState(false);
 			const [compatNoticeClosed, setCompatNoticeClosed] = react.useState(false);
 			const gateRows = gateReady ? (state.data.gating ?? null) : null;
 			const gateTime = (ms) => (typeof ms === "number" && ms > 0 ? new Date(ms).toLocaleString() : "—");
+			// ★ 0.5.98 加法（用户 2026-10-28 明确要求）：**删记录**的两个入口（单条 / 批量清理失效）。
+			//   三条硬约束：① 只删记录 —— 不动插件、不动补丁文件（服务端只改 compat-pending.json）；
+			//   ② **两段式** —— 第一下只上膛（零请求，并把"要删什么、不影响什么"写清楚），确认后才真发；
+			//   ③ 失败一律把服务端原文摆出来（不静默、不谎报成功）。
+			const [gateForgetArmed, setGateForgetArmed] = react.useState(null); // { kind: "row", rowId, moduleName } | { kind: "stale" }
+			const [gateForgetBusy, setGateForgetBusy] = react.useState(false);
+			const [gateForgetNote, setGateForgetNote] = react.useState(null); // { text, level }
+			/** 两段式的第一段：只上膛，一个请求都不发（换目标 = 换载荷，旧载荷不会跟着发出去）。 */
+			const gateForgetArm = (next) => { setGateForgetNote(null); setGateForgetArmed(next); };
+			/** 唯一出口：真发删除请求（成功后刷新 /state，列表与计数一起变）。 */
+			const gateForgetSend = (armed) => {
+				if (armed === null || gateForgetBusy) return;
+				setGateForgetArmed(null); // 一旦真发请求，上膛状态作废（绝不留"看着像待确认"的残影）
+				setGateForgetBusy(true);
+				setGateForgetNote(null);
+				const body = armed.kind === "stale" ? { action: "forget-stale" } : { action: "forget", rowId: String(armed.rowId) };
+				call("/plugin-console/compat-gate", body).then(
+					(data) => {
+						const removed = Array.isArray(data?.removed) ? data.removed : [];
+						const text = data !== null && data !== undefined && data.changed === false
+							? t("gateForgetNone")
+							: (armed.kind === "stale"
+								? t("gateForgetDoneStale").replace("{n}", String(removed.length))
+								: t("gateForgetDoneRow").replace("{id}", String(armed.rowId)));
+						setGateForgetNote({ text, level: null });
+						refresh(); // 删完必须重拉 /state（计数与列表都跟着变，不留旧数字）
+					},
+					(error) => setGateForgetNote({ text: t("gateForgetFailed") + friendlyGithubError(error).message, level: "error" }),
+				).finally(() => setGateForgetBusy(false));
+			};
+			// ══ 安全启动（门控面板里的一个分区）══════════════════════════════════════════════
+			// 用户 2026-10-18 原话：「现在这能力藏得太深，只有命令行能用」。后端 POST /safe-boot 早就有了
+			// （lib/server/routes/safe-boot.js；动作白名单 list / restore-last-good / disable-suspects /
+			// mark-good），界面上却一个入口都没有 —— 这里补的就是这四个动作的手套。
+			//
+			// 为什么放**门控面板**里（不是 fwPanel、更不是新工具栏按钮）：
+			//   safe-boot 救的正是「门控/兼容判断没拦住、框架被别的通道换坏之后打不开」那种局面 ——
+			//   它和门控是**同一条链**（先拦、拦不住再回退），放在一起，用户出事时只有一个地方要想起。
+			//   用户也明确不许再加工具栏按钮（已经挤），所以它挂在已有门控面板里，排在门控正文之后。
+			//
+			// 三条硬约束（用户定）：① 不许"点了没反应" —— 每个动作要么有成功/失败/进行中反馈，要么这个
+			//   按钮根本不显示；② 危险写动作**两段式** —— 第一下只上膛并写明影响面（改哪份文件、会覆盖什么），
+			//   确认后才真发请求；③ 拿不到的数据如实显示「—」，不编造。
+			// 判据一条都不搬过来：动作白名单、快照挑选、写盘闸门全在服务端 —— 客户端不重算、不预测结果。
+			const [safeBootOpen, setSafeBootOpen] = react.useState(false);
+			const [safeBootData, setSafeBootData] = react.useState(null); // list 的响应（null = 还没读过 / 读取失败）
+			const [safeBootError, setSafeBootError] = react.useState(null); // 读取失败原文（不静默、不留空白）
+			const [safeBootBusy, setSafeBootBusy] = react.useState(null); // 'list' | 动作名 | null（进行中反馈）
+			const [safeBootArmed, setSafeBootArmed] = react.useState(null); // 两段式的"上膛"：{ action, id?, rowIds? }
+			const [safeBootNote, setSafeBootNote] = react.useState(null); // 写动作的结果/失败原文：{ text, level }
+			const safeBootErrText = (error) => {
+				const msg = error !== null && error !== undefined && typeof error.message === "string" ? error.message : String(error ?? "");
+				return msg === "" ? t("safetySwitchFailed") : msg;
+			};
+			const safeBootTime = (ms) => (typeof ms === "number" && ms > 0 ? new Date(ms).toLocaleString() : "—");
+			/** 快照 sha256 只显示前几位（列表里够辨认；完整值在快照文件里）。拿不到就是「—」。 */
+			const safeBootSha = (sha) => (typeof sha === "string" && sha !== "" ? sha.slice(0, 10) : "—");
+			/** 「为什么没写快照」的原因词表 —— 与 lib/server/routes/compat.js#maybeWriteSnapshot 是**同一套字符串**。
+			 *  不认识的 reason 原样显示（不翻译成瞎话，也不吞掉）。 */
+			const SAFE_BOOT_REASON_KEYS = {
+				"patch-not-yaml-valid": "safeBootReasonPatchInvalid", // 结构校验没过（有东西可写，但闸门不放行）
+				"no-patch-file": "safeBootReasonNoPatch",
+				"environment-changed": "safeBootReasonEnvChanged", // 时机未到
+				"unchanged": "safeBootReasonUnchanged", // 时机未到（已有一份一样的）
+				"not-yet": "safeBootReasonNotYet", // 时机未到（这个字符串由本面板推导出来，见下）
+			};
+			const safeBootReasonText = (reason) => {
+				const key = typeof reason === "string" ? SAFE_BOOT_REASON_KEYS[reason] : undefined;
+				if (key !== undefined) return t(key);
+				return typeof reason === "string" && reason !== "" ? reason : "—";
+			};
+			/**
+			 * 「这一次该写快照却没写，是因为什么」——**只在能说出原因时**返回 `{ written: false, reason, problems }`，
+			 * 说不出来就返回 null（面板就不显示这一行，不编一句话凑数）。
+			 *
+			 * 数据来源两条，都不猜：
+			 *   ① 响应里真带 `snapshot.written`（与 compat-status 的 safeBoot.snapshot 同形）→ 原样用它的
+			 *      written/reason；written === true 时返回 null（没东西可抱怨）。
+			 *   ② 没带时，只用 list **确实下发**的事实推导：patch.exists / patch.check（服务端当场跑
+			 *      validatePatchYaml 的结论）/ snapshots。于是两类原因分得清清楚楚：
+			 *        · 结构校验没过  → `patch-not-yaml-valid`（有补丁、但校验结论 ok:false）
+			 *        · 还没到该写的时机 → `not-yet`（补丁没问题，只是根本还没有一份快照；
+			 *          服务端只在「服务确认正常 + 环境指纹未变」时才写 —— 见 compat.js 的那段判据）
+			 *      两个文案完全不同，绝不糊成一句"没有快照"。
+			 */
+			const safeBootGateOf = (data) => {
+				if (data === null || typeof data !== "object") return null;
+				if (data.snapshot !== null && typeof data.snapshot === "object" && typeof data.snapshot.written === "boolean") {
+					if (data.snapshot.written === true) return null;
+					return { written: false, reason: data.snapshot.reason ?? null, problems: Array.isArray(data.snapshot.problems) ? data.snapshot.problems : [] };
+				}
+				const snaps = Array.isArray(data.snapshots) ? data.snapshots : [];
+				const patch = data.patch !== null && typeof data.patch === "object" ? data.patch : null;
+				if (patch === null || patch.exists !== true) return { written: false, reason: "no-patch-file", problems: [] };
+				const check = patch.check !== null && typeof patch.check === "object" ? patch.check : null;
+				if (check !== null && check.ok !== true) return { written: false, reason: "patch-not-yaml-valid", problems: Array.isArray(check.problems) ? check.problems : [] };
+				if (snaps.length === 0) return { written: false, reason: "not-yet", problems: [] };
+				return null;
+			};
+			/** 快照清单（新→旧；只认形状对的条目，坏数据不会把整块渲染拖崩）。 */
+			const safeBootSnapsOf = (data) => (data !== null && typeof data === "object" && Array.isArray(data.snapshots) ? data.snapshots : [])
+				.filter((s) => s !== null && typeof s === "object" && typeof s.id === "string")
+				.sort((a, b) => Number(b.at ?? 0) - Number(a.at ?? 0));
+			/** 自动预检点名的可疑行（服务端 lastPlan.suspects）；没有就是空数组 —— 那就**不显示**这个按钮。 */
+			const safeBootSuspectsOf = (data) => (data !== null && typeof data === "object" && data.lastPlan !== null && typeof data.lastPlan === "object" && Array.isArray(data.lastPlan.suspects)
+				? data.lastPlan.suspects.filter((x) => typeof x === "string" && x !== "")
+				: []);
+			/** 读一次快照列表（**只**在"展开那一下"和写动作之后调用；收起状态零请求）。
+			 *  失败时保留上一次的数据但把错误原文摆出来 —— 一次读取失手不该把已有信息抹掉。 */
+			const safeBootRead = async () => {
+				try {
+					const data = await call("/plugin-console/safe-boot", { action: "list" });
+					if (data === null || typeof data !== "object") { setSafeBootError(t("safeBootListFailed") + "—"); return; }
+					setSafeBootData(data);
+					setSafeBootError(null);
+				} catch (error) {
+					setSafeBootError(t("safeBootListFailed") + safeBootErrText(error));
+				}
+			};
+			/** 写动作结束后的一句结果（服务端说什么就说什么：changed:false / no-suspects / 具体行）。 */
+			const safeBootDoneText = (action, data) => {
+				if (data === null || typeof data !== "object") return t("safeBootFailed") + "—";
+				if (action === "restore-last-good") return data.changed === false ? t("safeBootNoopRestore") : t("safeBootDoneRestore");
+				if (action === "disable-suspects") {
+					if (data.reason === "no-suspects") return t("safeBootNoSuspects");
+					const added = Array.isArray(data.added) ? data.added.filter((x) => typeof x === "string") : [];
+					const skipped = Array.isArray(data.skipped) ? data.skipped : [];
+					if (added.length === 0) return t("safeBootNoSuspects");
+					return t("safeBootDoneDisable") + " " + added.join("、") + (skipped.length === 0 ? "" : " · " + t("safeBootDisabledSkipped") + " " + String(skipped.length));
+				}
+				if (action === "mark-good") {
+					const id = data.snapshot !== null && typeof data.snapshot === "object" && typeof data.snapshot.id === "string" ? data.snapshot.id : null;
+					return t("safeBootDoneMarkGood") + " " + (id ?? "—");
+				}
+				return "—";
+			};
+			/** 真发请求（唯一出口）：list / restore-last-good / disable-suspects / mark-good */
+			const safeBootSend = async (action, extra) => {
+				if (safeBootBusy !== null) return; // 进行中不叠加请求（按钮此刻也是 disabled）
+				setSafeBootBusy(action);
+				setSafeBootNote(null);
+				setSafeBootArmed(null); // 一旦真发请求，上膛状态作废（绝不留一个"看着像待确认"的残影）
+				if (action === "list") setSafeBootError(null);
+				try {
+					const body = { action };
+					// 只放服务端白名单认得的两个载荷字段（id / rowIds）；其余一概不传。
+					if (extra !== null && extra !== undefined) {
+						if (typeof extra.id === "string" && extra.id !== "") body.id = extra.id;
+						if (Array.isArray(extra.rowIds) && extra.rowIds.length > 0) body.rowIds = extra.rowIds.slice();
+					}
+					const data = await call("/plugin-console/safe-boot", body);
+					if (action === "list") {
+						if (data === null || typeof data !== "object") setSafeBootError(t("safeBootListFailed") + "—");
+						else { setSafeBootData(data); setSafeBootError(null); }
+					} else {
+						setSafeBootNote({ text: safeBootDoneText(action, data), level: null });
+						// 写动作之后**重新读一次列表**（mark-good 尤其必须：last-good 标记要随之变化）
+						await safeBootRead();
+					}
+				} catch (error) {
+					// 失败一律把服务端给的原文摆出来（call() 已经把 {ok:false,error} 抛成 Error.message）
+					if (action === "list") setSafeBootError(t("safeBootListFailed") + safeBootErrText(error));
+					else setSafeBootNote({ text: t("safeBootFailed") + safeBootErrText(error), level: "error" });
+				} finally { setSafeBootBusy(null); }
+			};
+			/** 展开/收起：**展开那一下**才读一次 list（收起状态零请求）；收起时把上膛清掉。 */
+			const safeBootToggle = () => {
+				const next = !safeBootOpen;
+				setSafeBootOpen(next);
+				setSafeBootArmed(null);
+				setSafeBootNote(null);
+				if (next) void safeBootSend("list");
+			};
+			/** 两段式的第一段：只上膛，一个请求都不发（换动作 = 换载荷，上一个动作的载荷不会跟着发出去）。 */
+			const safeBootArm = (next) => {
+				setSafeBootNote(null);
+				setSafeBootArmed(next);
+			};
+			const safeBootPanel = () => {
+				const data = safeBootData;
+				const gate = safeBootGateOf(data);
+				const snaps = safeBootSnapsOf(data);
+				const suspects = safeBootSuspectsOf(data);
+				// 恢复目标的选择口径与服务端 domain/safe-boot.js#pickSnapshot 一致（kind=good 优先，其次最新）；
+				// 选好后把 id **显式传下去** —— 面板上写的是哪份，恢复的就是哪份，不可能"说 A 做 B"。
+				const goodOne = snaps.filter((s) => s.kind === "good")[0] ?? null;
+				const restoreTarget = goodOne ?? snaps[0] ?? null;
+				const newest = snaps[0] ?? null;
+				const lastGoodId = data !== null && typeof data === "object" && typeof data.lastGoodId === "string" && data.lastGoodId !== "" ? data.lastGoodId : null;
+				const patchPath = data !== null && typeof data === "object" && typeof data.patchPath === "string" && data.patchPath !== "" ? data.patchPath : null;
+				const commands = data !== null && typeof data === "object" && data.commands !== null && typeof data.commands === "object" ? data.commands : null;
+				// 上膛的那份快照对象（按 id 回查 —— 显示的时间/sha256 与"会恢复的那一份"必然是同一份）
+				const armedSnap = safeBootArmed === null || typeof safeBootArmed.id !== "string" ? null : (snaps.find((s) => s.id === safeBootArmed.id) ?? null);
+				const busy = safeBootBusy !== null;
+				const reasonOf = (x) => (x === null || typeof x !== "object" ? null : x.reason ?? null);
+				return el("div", {
+					"data-safeboot": "true",
+					style: { flexDirection: "column", gap: 6, display: "flex", marginTop: 4, paddingTop: 8, borderTop: "1px solid var(--dsw-alias-border-l2)" },
+				},
+					el("button", {
+						type: "button",
+						className: styles.toggle,
+						"data-safeboot-toggle": "true",
+						"data-open": safeBootOpen ? "true" : "false",
+						"aria-label": "safeBootToggle",
+						"aria-expanded": safeBootOpen ? "true" : "false",
+						title: t("safeBootToggleTitle"),
+						onClick: safeBootToggle,
+					}, (safeBootOpen ? "▾ " : "▸ ") + t("safeBootSectionTitle") + (busy ? " · " + t("safeBootBusy") : "")),
+					safeBootOpen ? el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
+						el("p", { className: styles.status }, t("safeBootSectionHint")),
+						// 进行中：明确说在做什么（"点了没反应"就是这个面板最不能犯的错）
+						busy ? el("p", { className: styles.status, "data-safeboot-busy": "true" }, t("safeBootLoading")) : null,
+						// 读取失败：错误原文 + 一个「重新读取」（有反馈的出口，不是一个哑按钮）
+						safeBootError !== null
+							? el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
+								el("p", { className: styles.message, "data-error": "true", "data-safeboot-error": "true" }, safeBootError),
+								el("button", {
+									type: "button",
+									className: styles.toggle,
+									"aria-label": "safeBootReload",
+									disabled: busy,
+									onClick: () => { void safeBootSend("list"); },
+								}, t("safeBootReload")))
+							: null,
+						data === null ? null : el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
+							// ① 「这次没写快照」+ 原因：结构校验没过 / 时机未到 —— 两句话不一样，原因原文也照抄
+							gate === null
+								? null
+								: el("p", { className: styles.status, "data-safeboot-reason": "true", "data-reason": gate.reason ?? "—" },
+									t("safeBootNotWritten") + " " + safeBootReasonText(reasonOf(gate)) + "（" + (reasonOf(gate) ?? "—") + "）"
+									+ (gate.problems.length === 0 ? "" : " · " + gate.problems.slice(0, 3).join("；"))),
+							// ② 计数 + last-good（拿不到就「—」）；data-count 是这份份数本身（界面上不以它为唯一来源）
+							el("p", { className: styles.status, "data-safeboot-count": "true", "data-count": String(snaps.length) },
+								t("safeBootCount").replace("{n}", String(snaps.length)) + " · " + t("safeBootLastGoodId") + " " + (lastGoodId ?? "—")),
+							// ③ 清单 / 空态（空态必须说原因，不能只说"没有快照"就完了）
+							snaps.length === 0
+								? el("p", { className: styles.status, "data-safeboot-empty": "true" },
+									t("safeBootEmpty") + " " + safeBootReasonText(reasonOf(gate)) + "（" + (reasonOf(gate) ?? "—") + "）")
+								: el("div", { style: { flexDirection: "column", gap: 4, display: "flex" }, "data-safeboot-list": "true" },
+									snaps.map((s) => el("div", {
+										key: "sb-" + String(s.id),
+										className: styles.row,
+										"data-safeboot-row": "true",
+										"data-snapshot-id": String(s.id),
+									},
+										el("div", { className: styles.rowTop },
+											el("code", { className: styles.name, style: { fontSize: 11, whiteSpace: "normal", overflow: "visible", textOverflow: "clip", wordBreak: "break-all" }, title: String(s.id) }, String(s.id)),
+											s.kind === "good" || s.id === lastGoodId
+												? el("span", { className: styles.tag, "data-lastgood": "true" }, t("safeBootLastGood"))
+												: null),
+										el("div", { className: styles.rowTop, style: { gap: 6 } },
+											el("span", { className: styles.status }, t("safeBootRowAt") + " " + safeBootTime(s.at)),
+											" · ",
+											el("span", { className: styles.status, "data-snapshot-sha": "true" }, t("safeBootRowSha") + " " + safeBootSha(s.patchSha256)))))),
+							// ④ 动作：没有可操作对象时**一个按钮都不显示**，并说明为什么（不许出现点了必失败的按钮）
+							snaps.length === 0
+								? el("p", { className: styles.status, "data-safeboot-noaction": "true" }, t("safeBootNoSnapshotActions"))
+								: el("div", { style: { flexDirection: "row", gap: 8, display: "flex", flexWrap: "wrap" } },
+									el("button", {
+										type: "button",
+										className: styles.toggle,
+										"aria-label": "safeBootRestore",
+										"data-armed": safeBootArmed !== null && safeBootArmed.action === "restore-last-good" ? "true" : undefined,
+										disabled: busy || restoreTarget === null,
+										title: t("safeBootRestoreTitle"),
+										onClick: () => safeBootArm({ action: "restore-last-good", id: restoreTarget === null ? null : String(restoreTarget.id) }),
+									}, t("safeBootRestore")),
+									suspects.length === 0
+										? null // 没有点名的行 ⇒ 不显示这个按钮（点了只会得到 no-suspects，属于"点了没反应"）
+										: el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "safeBootDisable",
+											"data-armed": safeBootArmed !== null && safeBootArmed.action === "disable-suspects" ? "true" : undefined,
+											disabled: busy,
+											title: t("safeBootDisableTitle"),
+											onClick: () => safeBootArm({ action: "disable-suspects", rowIds: suspects.slice() }),
+										}, t("safeBootDisable")),
+									el("button", {
+										type: "button",
+										className: styles.toggle,
+										"aria-label": "safeBootMarkGood",
+										disabled: busy,
+										title: t("safeBootMarkGoodTitle"),
+										onClick: () => { void safeBootSend("mark-good", { id: newest === null ? null : String(newest.id) }); },
+									}, t("safeBootMarkGood"))),
+							snaps.length === 0
+								? null
+								: (suspects.length === 0
+									? el("p", { className: styles.status, "data-safeboot-suspects": "none" }, t("safeBootSuspectsNone"))
+									: el("p", { className: styles.status, "data-safeboot-suspects": "true" }, t("safeBootSuspectsTitle") + " " + suspects.join("、"))),
+							// ⑤ 两段式：上膛后把"要改什么、改哪份文件"写清楚，取消 = 零请求
+							safeBootArmed === null
+								? null
+								: el("div", { "data-safeboot-armed": "true", style: { flexDirection: "column", gap: 6, display: "flex", borderLeft: "2px solid var(--dsw-alias-state-warning-primary)", paddingLeft: 8 } },
+									el("p", { className: styles.message, "data-warn": "true", "data-safeboot-armedtext": "true" },
+										safeBootArmed.action === "restore-last-good"
+											? t("safeBootArmRestore") + " " + String(safeBootArmed.id ?? "—") + " · " + t("safeBootRowAt") + " "
+												+ safeBootTime(armedSnap === null ? null : armedSnap.at) + " · sha256 "
+												+ safeBootSha(armedSnap === null ? null : armedSnap.patchSha256)
+											: t("safeBootArmDisable") + " " + (Array.isArray(safeBootArmed.rowIds) ? safeBootArmed.rowIds.join("、") : "—")),
+									safeBootArmed.action === "restore-last-good"
+										? el("p", { className: styles.status }, t("safeBootArmRestoreOverwrite") + " " + (patchPath ?? "—"))
+										: el("p", { className: styles.status }, t("safeBootArmDisableNote")),
+									el("div", { style: { flexDirection: "row", gap: 8, display: "flex" } },
+										el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "safeBootConfirm",
+											disabled: busy,
+											onClick: () => { void safeBootSend(safeBootArmed.action, safeBootArmed); },
+										}, t("safeBootConfirm")),
+										el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "safeBootCancel",
+											onClick: () => { setSafeBootArmed(null); setSafeBootNote(null); },
+										}, t("safeBootCancel")))),
+							// ⑥ 结果反馈（成功/无操作/失败原文，都留在面板上）——
+							//    失败走既有 error 样式；成功用既有 success 色（没有新的 CSS 类，只借颜色令牌）。
+							safeBootNote === null
+								? null
+								: el("p", {
+									className: styles.message,
+									"data-safeboot-note": "true",
+									"data-error": safeBootNote.level === "error" ? "true" : undefined,
+									style: safeBootNote.level === "error" ? undefined : { color: "var(--dsw-alias-state-success-primary)" },
+								}, String(safeBootNote.text ?? "—")),
+							// ⑦ 服务起不来时的命令行兜底（服务端下发的原始命令，不自己拼）
+							commands !== null && typeof commands.list === "string"
+								? el("p", { className: styles.status, "data-safeboot-cmd": "true" }, t("safeBootCmdHint") + " " + commands.list)
+								: null))
+						: null,
+				);
+			};
 			// 「功能包 → 框架」按钮角标：升级进行中 ⟳ / 上次失败 ✕ / 有可用更新 ↑（优先级从高到低）
 			const fwRunning = frameworkStatus !== null
 				&& frameworkStatus.status !== "idle" && frameworkStatus.status !== "done" && frameworkStatus.status !== "failed";
@@ -6318,20 +6806,40 @@ const RESTART_FAILED_NOTE = "重启请求失败";
 										onClick: () => setCompatGate({ autoDetect: !gateAutoDetect }),
 									}, el("div", { className: styles.pcSwitchKnob }))),
 								el("p", { className: styles.message }, t("compatGateHint")),
-								el("p", { className: styles.status, "data-pending": gatePendingCount > 0 ? "true" : undefined },
+								el("p", { className: styles.status, "data-pending": gatePendingCount > 0 ? "true" : undefined, "data-gate-pending": String(gatePendingCount), "data-gate-stale": String(gateStaleCount) },
 									gatePendingCount > 0 ? t("gatePendingInfo").replace("{n}", String(gatePendingCount)) : t("gatePendingNone")),
 																			// 明细清单（2026-09-24 用户要求：面板要能看到是哪些插件，有列表数据）
 							gateRows !== null && gateRows.pendingCount + gateRows.adoptedCount > 0
 								? el("div", { style: { flexDirection: "column", gap: 6, display: "flex" } },
-									el("strong", { className: styles.name }, t("gateListPending").replace("{n}", String(gateRows.pendingCount))),
+									// ★ 0.5.98 改错：这里的数字改成"真待适配"的条数（与服务端 actionableCount 同一判据）。
+									//   下面仍列出**全部** pending 记录（含失效的），失效的逐条标注「该行已不存在」——
+									//   藏着不显示才是骗人，标出来才是如实。
+									el("strong", { className: styles.name }, t("gateListPending").replace("{n}", String(gateRows.pending.filter(gateRowActionable).length))),
 									gateRows.pending.length === 0
 										? el("p", { className: styles.status }, t("gatePendingNone"))
 										: null,
 									(gateShowAll ? gateRows.pending : gateRows.pending.slice(0, 8)).map((r) => el("div", {
 										key: "p-" + String(r.rowId),
 										style: { flexDirection: "column", gap: 2, display: "flex", padding: "4px 0" },
+										"data-gate-row": String(r.rowId),
+										"data-row-missing": gateRowMissing(r) ? "true" : "false",
 									},
 										el("span", { className: styles.name }, (r.enabled === false ? "⛔ " : "• ") + String(r.name) + (r.version ? "  v" + r.version : "")),
+										// ★ 0.5.98 加法：模块名单独一行 —— 记录里没有 moduleName 就如实显示「—」，**绝不编造**。
+										//   行已不在补丁里的，紧跟一个标记；删除入口就在这一行（两段式）。
+										el("span", { className: styles.status, "data-gate-module": "true" },
+											t("gateRowModule") + " " + (typeof r.moduleName === "string" && r.moduleName !== "" ? r.moduleName : "—"),
+											gateRowMissing(r) ? " · " + t("gateRowMissing") : "",
+											el("button", {
+												type: "button",
+												className: styles.toggle,
+												style: { marginLeft: 8, fontSize: 11, padding: "1px 6px" },
+												"aria-label": "gateRowForget",
+												"data-gate-forget-row": String(r.rowId),
+												disabled: gateForgetBusy,
+												title: t("gateForgetRowTitle"),
+												onClick: () => gateForgetArm({ kind: "row", rowId: String(r.rowId), moduleName: typeof r.moduleName === "string" ? r.moduleName : null }),
+											}, t("gateForgetRow"))),
 										el("span", { className: styles.status }, t("gateRowReason").replace("{reason}", String(r.note ?? "—"))),
 										el("span", { className: styles.status },
 											(r.source === "boot-quarantine" ? t("gateRowFromBoot") : t("gateRowFromUpgrade"))
@@ -6341,6 +6849,21 @@ const RESTART_FAILED_NOTE = "重启请求失败";
 										? el("button", { type: "button", className: styles.toggle, onClick: () => setGateShowAll((v) => !v) },
 											gateShowAll ? t("gateListFold") : t("gateListMore").replace("{n}", String(gateRows.pendingCount)))
 										: null,
+									// ★ 0.5.98 加法：失效记录摘要 + 「清理无效记录」（**只在真有可清理的**时才摆按钮 ——
+									//   零失效时连按钮都不出现，绝不摆一个点了必然没反应的按钮）。
+									gateStaleCount > 0
+										? el("div", { "data-gate-stale-block": "true", style: { flexDirection: "column", gap: 4, display: "flex", paddingTop: 4 } },
+											el("p", { className: styles.status, "data-gate-stale-line": "true" },
+												t("gateStaleLine").replace("{n}", String(gateStaleCount))),
+											el("button", {
+												type: "button",
+												className: styles.toggle,
+												"aria-label": "gateForgetStale",
+												disabled: gateForgetBusy,
+												title: t("gateForgetStaleTitle"),
+												onClick: () => gateForgetArm({ kind: "stale" }),
+											}, t("gateForgetStale")))
+										: null,
 									gateRows.adoptedCount > 0
 										? el("div", { style: { flexDirection: "column", gap: 2, display: "flex" } },
 											// ★ 0.5.80：默认折叠，只留一行摘要（点开才列明细）—— 历史不该把当前态挤下去
@@ -6352,10 +6875,57 @@ const RESTART_FAILED_NOTE = "重启请求失败";
 												+ "  ·  " + t("gateListAdopted").replace("{n}", String(gateRows.adoptedCount))),
 											gateHistoryOpen
 												? gateRows.adopted.map((r) => el("span", { key: "a-" + String(r.rowId), className: styles.status },
-													"✓ " + String(r.name) + (r.version ? "  v" + r.version : "") + (r.adoptedAt ? "  · " + gateTime(r.adoptedAt) : "")))
+													"✓ " + String(r.name) + (r.version ? "  v" + r.version : "") + (r.adoptedAt ? "  · " + gateTime(r.adoptedAt) : ""),
+													// ★ 0.5.98：历史记录也能逐条删（同样是两段式）—— 每条记录都有删除入口
+													el("button", {
+														type: "button",
+														className: styles.toggle,
+														style: { marginLeft: 6, fontSize: 11, padding: "1px 6px" },
+														"aria-label": "gateRowForget",
+														"data-gate-forget-row": String(r.rowId),
+														disabled: gateForgetBusy,
+														title: t("gateForgetRowTitle"),
+														onClick: () => gateForgetArm({ kind: "row", rowId: String(r.rowId), moduleName: typeof r.moduleName === "string" ? r.moduleName : null }),
+													}, t("gateForgetRow"))))
 												: null)
 										: null)
-								: null),
+								: null,
+							// ★ 0.5.98 加法：删除的**两段式**确认区 + 结果反馈（都留在面板上，不弹系统对话框）。
+							//   上膛时把"要删什么、不会动什么"写清楚：只删记录，不动插件、不动补丁文件。
+							gateForgetArmed === null
+								? null
+								: el("div", { "data-gate-forget-armed": "true", style: { flexDirection: "column", gap: 6, display: "flex", borderLeft: "2px solid var(--dsw-alias-state-warning-primary)", paddingLeft: 8 } },
+									el("p", { className: styles.message, "data-warn": "true", "data-gate-forget-text": "true" },
+										gateForgetArmed.kind === "stale"
+											? t("gateForgetArmStale").replace("{n}", String(gateStaleCount))
+											: t("gateForgetArmRow").replace("{id}", String(gateForgetArmed.rowId)).replace("{name}", String(gateForgetArmed.moduleName ?? "—"))),
+									el("p", { className: styles.status }, t("gateForgetSafety")),
+									el("div", { style: { flexDirection: "row", gap: 8, display: "flex" } },
+										el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "gateForgetConfirm",
+											disabled: gateForgetBusy,
+											onClick: () => { gateForgetSend(gateForgetArmed); },
+										}, t("gateForgetConfirm")),
+										el("button", {
+											type: "button",
+											className: styles.toggle,
+											"aria-label": "gateForgetCancel",
+											onClick: () => { setGateForgetArmed(null); setGateForgetNote(null); },
+										}, t("gateForgetCancel")))),
+							gateForgetNote === null
+								? null
+								: el("p", {
+									className: styles.message,
+									"data-gate-forget-note": "true",
+									"data-error": gateForgetNote.level === "error" ? "true" : undefined,
+									style: gateForgetNote.level === "error" ? undefined : { color: "var(--dsw-alias-state-success-primary)" },
+								}, String(gateForgetNote.text ?? "—"))),
+							// ★ 0.5.x 加法（用户 2026-10-18）：「安全启动」分区 —— 挂在门控面板里（不新增工具栏按钮）。
+							//   默认收起，展开那一下才读一次快照列表；四个动作见 safeBootPanel（list / restore-last-good /
+							//   disable-suspects / mark-good）。它排在门控正文**之后**，Star 行仍在最后（贴底那条不变）。
+							safeBootPanel(),
 							// 0.5.42 加法（用户点名）：右侧贴底的 Star 提示 —— 只加这一行 UI，
 							// 不动任何开关逻辑/路由/门控语义。它是卡片的最后一个子项（整行，不占左侧内容宽度），
 							// margin-top:auto 让它在卡片有富余高度时贴底；position:sticky;bottom:0 让正文

package/lib/server/domain/compat-pending-records.js

@@ -0,0 +1,255 @@
+// L1 · domain —— compat-pending-records.js（「真待适配」判据的**唯一真源** + 记录删除的写盘纪律）
+// 分层分组：L1 · domain（边界由 tests/test-architecture-guard.mjs 断言）
+//
+// ── 真机背景（2026-10-28，用户实测）────────────────────────────────────────────────
+// `~/.dsh/plugin-console/compat-pending.json` 自 2026-10-04 之后就没再被写过，里面 24 条记录：
+//   · 20 条 `status:"adopted"`（已适配解锁 —— 历史，不是待办）；
+//   · 3 条 `status:"pending"` 且 `moduleName: null`（web-ui-describe-image / web-ui-doctor /
+//     web-ui-better-sidebar）—— **对应的补丁行早已不存在**，永远不可能被适配；
+//   · 全部 `check:"unknown"`。
+// 结果门控面板照旧把它们算成"待适配的行"，用户看到"有 N 行待适配"，其实**一行都没有**。
+//
+// 两处根因，本模块各治一处：
+//   ① **计数口径错**：数的是 `pending` 数组长度，而不是"status=pending 且该行仍在补丁里"。
+//      → `isActionablePending()` / `countPendingRecords()` 是唯一判据，路由与面板都只认它。
+//   ② **记录从不清理**：adopted 与"行已消失"的记录永久留在文件里。
+//      → `planForgetRecord()` / `planForgetStale()` + `applyPendingForget()` 提供删除（只删记录）。
+//
+// ── 三条硬边界（不许放宽）──────────────────────────────────────────────────────────
+//   · 「行是否存在」只取**补丁解析的既有产物**（`readPatchState()` 的 disables / forced / inserts，
+//     见 domain/patch.js）—— 这里不另写一套正则，避免两套判据分叉（本仓已为分叉付过代价）。
+//   · 删除**只动 compat-pending.json**：不动插件、不动补丁、不动 bundles 清单。
+//     「清理无效记录」只清 stale（status=pending 且行已不存在）；真 pending 与 adopted **保留**。
+//   · 写盘：备份 → 原子写（临时文件 + rename）→ **读回核实** → 失败回滚；坏文件**拒绝覆盖**
+//     （那是用户的文件，覆盖等于丢数据），读侧则降级为空结构并如实报原因。
+import { copyFileSync, existsSync, readFileSync, renameSync, unlinkSync, writeFileSync } from 'node:fs'
+import { compatPendingFile } from './compat-verdict.js'
+
+/** 适配门记录里"待办"这一侧的状态字（其它一切状态都算历史）。 */
+const PENDING_STATUS = 'pending'
+
+/**
+ * 当前补丁里**真实存在**的行 id 集合（唯一真源：`readPatchState()` 的解析结果）。
+ * 三个来源都是"这一行在补丁里有位置"的等价证据：
+ *   inserts —— 本控制台插入的启用行；disables / forced —— 针对该行的禁用/强制覆盖块。
+ * @param {{disables?: string[], forced?: string[], inserts?: string[]}|null} patchState
+ * @returns {Set<string>}
+ */
+function liveRowIdsFromPatch(patchState) {
+  const out = new Set()
+  if (patchState === null || typeof patchState !== 'object') return out
+  for (const key of ['disables', 'forced', 'inserts']) {
+    const list = Array.isArray(patchState[key]) ? patchState[key] : []
+    for (const id of list) if (typeof id === 'string' && id !== '') out.add(id)
+  }
+  return out
+}
+
+const statusOf = (record) => (typeof record?.status === 'string' && record.status !== '' ? record.status : PENDING_STATUS)
+
+/**
+ * 「真待适配」判据（**纯函数、唯一真源**）：status 仍是 pending，**且**该行此刻还在补丁里。
+ * 行已不存在 ⇒ 这条记录永远等不到"适配"（它的行都不在了），所以它不是待办。
+ */
+function isActionablePending(record, liveRowIds) {
+  if (record === null || typeof record !== 'object') return false
+  if (statusOf(record) !== PENDING_STATUS) return false
+  if (typeof record.rowId !== 'string' || record.rowId === '') return false
+  return liveRowIds instanceof Set && liveRowIds.has(record.rowId)
+}
+
+/**
+ * 「失效记录」判据：记录写着待适配，但它的补丁行已经不在了（用户眼前那条"删不掉的待适配"）。
+ * 注意：adopted 记录**不算** stale —— 那是历史，用户明确要求保留、只在历史区展示。
+ */
+function isStalePending(record, liveRowIds) {
+  if (record === null || typeof record !== 'object') return false
+  if (statusOf(record) !== PENDING_STATUS) return false
+  if (typeof record.rowId !== 'string' || record.rowId === '') return false
+  return !(liveRowIds instanceof Set) || !liveRowIds.has(record.rowId)
+}
+
+/**
+ * 计数（面板/接口只认这三个数）：真待适配 / 已失效 / 历史已适配。
+ * @returns {{ totalCount: number, actionableCount: number, staleCount: number, adoptedCount: number }}
+ */
+function countPendingRecords(records, liveRowIds) {
+  const list = Array.isArray(records) ? records : []
+  let actionableCount = 0
+  let staleCount = 0
+  let adoptedCount = 0
+  for (const rec of list) {
+    if (rec === null || typeof rec !== 'object') continue
+    if (statusOf(rec) !== PENDING_STATUS) { adoptedCount += 1; continue }
+    if (isActionablePending(rec, liveRowIds)) actionableCount += 1
+    else staleCount += 1
+  }
+  return { totalCount: list.length, actionableCount, staleCount, adoptedCount }
+}
+
+/**
+ * 给门控明细行补两个**只增不改**的字段（面板据此如实标注"该行已不存在"并给删除入口）：
+ *   rowMissing —— 这一行的 rowId 已不在当前补丁里（null/空 rowId 也算 missing：无所指）
+ *   actionable —— 与 `isActionablePending` 同一个判据（pending 且行还在）
+ */
+function annotateGateRows(rows, liveRowIds) {
+  const list = Array.isArray(rows) ? rows : []
+  return list.map((row) => {
+    const hasRow = typeof row?.rowId === 'string' && row.rowId !== '' && liveRowIds instanceof Set && liveRowIds.has(row.rowId)
+    return { ...row, rowMissing: !hasRow, actionable: isActionablePending(row, liveRowIds) }
+  })
+}
+
+/**
+ * 读记录文件（**只读**）。坏文件/空文件按"没有内容"处理，但**把原因如实带出来**：
+ * 调用方（写动作）据此拒绝覆盖，界面据此如实显示"读不出来，所以没有可清理的记录"。
+ * @returns {{ file: string, exists: boolean, corrupt: boolean, raw: object|null, records: object[], error: string|null }}
+ */
+function readPendingRecords(file = compatPendingFile()) {
+  const empty = { file, exists: false, corrupt: false, raw: null, records: [], error: null }
+  if (typeof file !== 'string' || file === '') return { ...empty, corrupt: true, error: '拿不到记录文件路径' }
+  if (!existsSync(file)) return empty
+  let text = null
+  try {
+    text = readFileSync(file, 'utf8')
+  } catch (error) {
+    return { ...empty, exists: true, corrupt: true, error: `读取失败：${String(error?.message ?? error)}` }
+  }
+  // 空文件（含只有空白 / BOM 的）按**没有内容**处理：它不是坏文件 ⇒ 读侧降级为空结构，
+  // 写侧照旧"没有可删的记录"（绝不为了删一条记录就把空文件改写成别的形状）。
+  if (text.replace(/^\uFEFF/u, '').trim() === '') return { ...empty, exists: true, empty: true, raw: null, records: [] }
+  let raw = null
+  try {
+    raw = JSON.parse(text)
+  } catch (error) {
+    return { ...empty, exists: true, corrupt: true, error: `不是合法 JSON：${String(error?.message ?? error)}` }
+  }
+  if (raw === null || typeof raw !== 'object' || Array.isArray(raw)) {
+    return { ...empty, exists: true, corrupt: true, error: '内容不是 JSON 对象' }
+  }
+  const records = (Array.isArray(raw.pending) ? raw.pending : []).filter((r) => r !== null && typeof r === 'object')
+  return { file, exists: true, corrupt: false, raw, records, error: null }
+}
+
+/** 写动作的公共前置校验：坏文件**拒绝覆盖**（保住用户数据），并给出可读原因。 */
+function refuseIfUnsafe(read) {
+  if (read.exists !== true) return { ok: false, status: 404, error: `${read.file} 不存在（没有可删的记录）` }
+  if (read.corrupt === true) {
+    return { ok: false, status: 409, error: `${read.file} 读不出来（${read.error ?? '格式非法'}）；为保住你的数据，本动作已停止（请先手工修好或删掉它）` }
+  }
+  return null
+}
+
+/**
+ * 规划「删掉某一条记录」（**纯函数，不写盘**）。
+ * 不存在的 rowId ⇒ 404 + 明确原因（绝不静默成功）。
+ */
+function planForgetRecord({ read, rowId } = {}) {
+  const base = { ok: false, status: 400, error: null, file: read?.file ?? null, next: null, changed: false, removedRowIds: [], keptRowIds: [] }
+  if (read === null || typeof read !== 'object') return { ...base, error: '内部错误：没有读到记录文件' }
+  const refused = refuseIfUnsafe(read)
+  if (refused !== null) return { ...base, ...refused }
+  if (typeof rowId !== 'string' || rowId === '') return { ...base, error: '缺少 rowId（要删哪一条？）' }
+  const index = read.records.findIndex((r) => r.rowId === rowId)
+  if (index < 0) return { ...base, status: 404, error: `没有 rowId 为 ${rowId} 的记录（文件未改动）` }
+  const kept = read.records.filter((_, i) => i !== index)
+  return {
+    ok: true,
+    status: 200,
+    error: null,
+    file: read.file,
+    next: { ...read.raw, pending: kept },
+    changed: true,
+    removedRowIds: [rowId],
+    keptRowIds: kept.map((r) => r.rowId).filter((id) => typeof id === 'string'),
+  }
+}
+
+/**
+ * 规划「清掉所有失效记录」（**纯函数，不写盘**）：只删 status=pending 且行已不存在的；
+ * 真 pending 与 adopted 一条都不动。没有可清的 ⇒ `changed:false`（**零写盘**，不是错误）。
+ */
+function planForgetStale({ read, liveRowIds } = {}) {
+  const base = { ok: false, status: 400, error: null, file: read?.file ?? null, next: null, changed: false, removedRowIds: [], keptRowIds: [], staleCount: 0 }
+  if (read === null || typeof read !== 'object') return { ...base, error: '内部错误：没有读到记录文件' }
+  const refused = refuseIfUnsafe(read)
+  if (refused !== null) return { ...base, ...refused }
+  const stale = read.records.filter((r) => isStalePending(r, liveRowIds))
+  if (stale.length === 0) {
+    return { ...base, ok: true, status: 200, changed: false, keptRowIds: read.records.map((r) => r.rowId).filter((id) => typeof id === 'string'), staleCount: 0 }
+  }
+  const staleIds = new Set(stale.map((r) => r.rowId))
+  const kept = read.records.filter((r) => !staleIds.has(r.rowId))
+  return {
+    ok: true,
+    status: 200,
+    error: null,
+    file: read.file,
+    next: { ...read.raw, pending: kept },
+    changed: true,
+    removedRowIds: [...staleIds],
+    keptRowIds: kept.map((r) => r.rowId).filter((id) => typeof id === 'string'),
+    staleCount: stale.length,
+  }
+}
+
+/**
+ * 执行写入：备份 → 原子写（临时文件 + rename）→ **读回核实** → 任何一步不过就回滚并如实报错。
+ * `deps` 全是注入缝（写失败 / 读回不符的单测靠它，生产路径不传 ⇒ 真实 fs）。
+ * @returns 计划的字段 + `{ backup, verified, rolledBack }`
+ */
+function applyPendingForget(plan, deps = {}) {
+  if (plan === null || typeof plan !== 'object' || plan.ok !== true || plan.changed !== true) return plan
+  const io = {
+    copy: deps.copyFileSync ?? copyFileSync,
+    write: deps.writeFileSync ?? writeFileSync,
+    rename: deps.renameSync ?? renameSync,
+    remove: deps.unlinkSync ?? unlinkSync,
+    exists: deps.existsSync ?? existsSync,
+    read: deps.readFileSync ?? readFileSync,
+  }
+  const { file, next } = plan
+  const stamp = Date.now()
+  const backup = `${file}.bak-forget-${stamp}`
+  const tmp = `${file}.tmp-forget-${stamp}`
+  const rollback = (extra) => {
+    try { if (io.exists(backup)) io.copy(backup, file) } catch {}
+    try { if (io.exists(tmp)) io.remove(tmp) } catch {}
+    return { ...plan, ...extra, backup, verified: false, rolledBack: io.exists(backup) }
+  }
+  try {
+    if (io.exists(file)) io.copy(file, backup)
+    io.write(tmp, `${JSON.stringify(next, null, 2)}\n`, 'utf8')
+    io.rename(tmp, file)
+  } catch (error) {
+    return rollback({ ok: false, status: 500, error: `写入 ${file} 失败：${String(error?.message ?? error)}（已回滚，文件保持原样）` })
+  }
+  // 读回核实：删掉的那条必须真的不在、保留的每一条必须还在 —— "写了但没生效"是最坏的一种假绿
+  let back = null
+  try {
+    back = JSON.parse(io.read(file, 'utf8'))
+  } catch (error) {
+    return rollback({ ok: false, status: 500, error: `写入后读回失败：${String(error?.message ?? error)}（已回滚）` })
+  }
+  const rows = (Array.isArray(back?.pending) ? back.pending : []).filter((r) => r !== null && typeof r === 'object')
+  const stillThere = plan.removedRowIds.filter((id) => rows.some((r) => r.rowId === id))
+  const lost = plan.keptRowIds.filter((id) => !rows.some((r) => r.rowId === id))
+  if (stillThere.length > 0 || lost.length > 0) {
+    const why = stillThere.length > 0 ? `要删的记录仍在（${stillThere.join('、')}）` : `保留的记录丢了（${lost.slice(0, 5).join('、')}）`
+    return rollback({ ok: false, status: 500, error: `写入后读回内容与期望不一致（${why}），已回滚` })
+  }
+  return { ...plan, backup, verified: true, rolledBack: false }
+}
+
+export {
+  PENDING_STATUS,
+  liveRowIdsFromPatch,
+  isActionablePending,
+  isStalePending,
+  countPendingRecords,
+  annotateGateRows,
+  readPendingRecords,
+  planForgetRecord,
+  planForgetStale,
+  applyPendingForget,
+}

package/lib/server/domain/patch-yaml-check.js

@@ -63,6 +63,16 @@ function blockScalarIndicator(value) {
 function scanValueQuotes(value, initialQuote = null) {
   const text = String(value)
   let quote = initialQuote
+  // 函数头注释 ⑤ 的前提「值不以引号开头 ⇒ 不跨行扫描」原先只写在注释里、代码没实现。
+  // 代价（issue #26）：`- 'D:/x/y.js'` 这类带盘符的序列项里，盘符的冒号被 key:value 正则
+  // 当成分隔符吃掉，value 变成 `/x/y.js'`（首字符不是引号），于是行尾那个 `'` 被当成
+  // 「引号开口」并一直挂到文件末尾 ⇒ 误报「文件末尾仍有未闭合的引号」，
+  // 而 safeBoot 的写盘前闸门正是它 ⇒ 快照/恢复/只禁可疑行全部退化成空转。
+  // 值不以引号开头时，本行的引号不可能跨行开口。
+  if (quote === null) {
+    const first = text.trimStart()[0]
+    if (first !== "'" && first !== '"') return { quote: null }
+  }
   for (let i = 0; i < text.length; i += 1) {
     const ch = text[i]
     if (quote === null) {

package/lib/server/routes/compat.js

@@ -26,6 +26,9 @@ import { DEFAULT_TIMEOUT_MS, autoPreflightView, runAutoPreflight } from '../doma
 import { runAutoPreflightScan } from '../domain/auto-preflight-run.js'
 import { NOTICE_MODES, detectCompat, readCompatAck, readCompatGate, readCompatPending, rowIdModuleMap, writeCompatAck, writeCompatGate, writeCompatPending } from '../domain/compat.js'
 import { compareFingerprint, computeFingerprint, planDesktopHostSwitch, readCompatMode, readFingerprint, readRollbackRecord, stampFingerprint, writeCompatMode } from '../domain/compat-state.js'
+// 0.5.98 加法：适配门**记录**的删除（真待适配判据 + 写盘纪律都在该模块；本路由只映射状态码）
+import { applyPendingForget, countPendingRecords, liveRowIdsFromPatch, planForgetRecord, planForgetStale, readPendingRecords } from '../domain/compat-pending-records.js'
+import { readPatchState } from '../domain/patch.js'
 import { currentFrameworkVersion, detectHostShape } from '../domain/framework.js'
 import { applyDependencyBackfill, planDependencyBackfill } from '../domain/manifest.js'
 import { isProtectedModule } from '../domain/runtime.js'
@@ -39,6 +42,17 @@ import { preflightRoots } from './framework-preflight.js'
 
 const PREFLIGHT_TIMEOUT_ENV = 'DSH_AUTO_PREFLIGHT_TIMEOUT_MS'
 /** 自动预检的预算：到点降级成「未完成，可手动重跑」，状态查询照常返回（env 可调）。 */
+/**
+ * 安全启动的命令行兜底：拼成**可直接复制运行**的绝对路径命令。
+ * 现场问题（2026-10-29）：原先给的是相对路径 `node scripts/safe-boot.mjs --list`，
+ * 只有先 cd 到插件安装目录才成立 —— 而那是 node_modules 里的深层哈希目录，
+ * 服务起不来、界面打不开的时候，用户根本无从找到它。救火命令必须是能直接粘的。
+ */
+function safeBootCommand(args = []) {
+  const script = join(pluginRoot(), 'scripts', 'safe-boot.mjs')
+  return ['node', JSON.stringify(script), ...args].join(' ')
+}
+
 function preflightTimeoutMs() {
   const raw = Number(process.env[PREFLIGHT_TIMEOUT_ENV])
   return Number.isFinite(raw) && raw > 0 ? raw : DEFAULT_TIMEOUT_MS
@@ -218,7 +232,7 @@ function autoDisableNotice(entry = lastAutoDisable, { enabled = null } = {}) {
   if (entry === null || entry === undefined) return null
   if (on !== true && entry.code === 'auto-disabled') return null
   const added = Array.isArray(entry.disabled) ? entry.disabled : []
-  const restore = 'node scripts/safe-boot.mjs --restore-last-good'
+  const restore = safeBootCommand(['--restore-last-good'])
   if (added.length > 0) {
     return {
       at: entry.at ?? null,
@@ -318,7 +332,7 @@ async function routeCompatStatusGet(req, res, rc) {
       onEvidence: readCompatGate().autoDisableOnEvidence === true,
       switch: { file: 'compat-gate.json', key: 'autoDisableOnEvidence', route: '/plugin-console/compat-ack', body: { autoDisableOnEvidence: false } },
       notice: autoDisableNotice(),
-      restore: { route: { path: '/plugin-console/safe-boot', body: { action: 'restore-last-good' } }, command: 'node scripts/safe-boot.mjs --restore-last-good' },
+      restore: { route: { path: '/plugin-console/safe-boot', body: { action: 'restore-last-good' } }, command: safeBootCommand(['--restore-last-good']) },
       logHint: '记录落在 dshHome()/plugin-console/auto-disable.log（追加式 JSONL）',
     },
     // D2 加法字段：安全启动材料（last-known-good 快照 + 恢复入口提示）
@@ -326,7 +340,7 @@ async function routeCompatStatusGet(req, res, rc) {
       snapshot: { written: snapshot.written === true, reason: snapshot.reason ?? null, id: snapshot.snapshot?.id ?? null, at: snapshot.snapshot?.at ?? null, sha256: snapshot.snapshot?.patchSha256 ?? null },
       snapshots: listSnapshots().slice(0, 5),
       lastGoodId: readSafeBootState().lastGoodId,
-      command: { list: 'node scripts/safe-boot.mjs --list', restore: 'node scripts/safe-boot.mjs --restore-last-good', disable: 'node scripts/safe-boot.mjs --disable-suspects' },
+      command: { list: safeBootCommand(['--list']), restore: safeBootCommand(['--restore-last-good']), disable: safeBootCommand(['--disable-suspects']) },
       route: { action: 'restore-last-good | disable-suspects | list | mark-good', path: '/plugin-console/safe-boot' },
     },
   })
@@ -444,4 +458,74 @@ async function routeCompatAck(req, res, rc) {
   const ack = writeCompatAck(version)
   sendJson(res, 200, { ok: true, ack, noticeMode: readCompatGate().noticeMode })
 }
-export { hostShapeOf, maybeSwitchToObserver, maybeWriteSnapshot, preflightTimeoutMs, resetHostSwitchChecked, routeCompatAck, routeCompatMode, routeCompatStamp, routeCompatStatusGet, routeDeclareInstalled, scheduleAutoPreflight }
+/**
+ * POST /plugin-console/compat-gate `{ action: 'forget' | 'forget-stale' }`
+ *   —— 适配门**记录**的删除（0.5.98 加法，用户 2026-10-28 明确要求）。
+ *
+ * 为什么挂在**既有的 /compat-gate** 上而不是新开一条路由：门控面板的所有写入口必须同源
+ * （否则又要登记一份路由清单，两处判据迟早分叉）。body 里没有 `action` 时**逐字**走原来的
+ * 总开关逻辑（既有契约零变化，装配层的分流见 routes/index.js#routeCompatGateAny）。
+ *
+ * 语义（三条硬边界，用户定案）：
+ *   · 只删 **记录**：不动插件、不动补丁文件、不动 bundles 清单；
+ *   · `forget` 删指定 rowId；`forget-stale` 只清「status=pending 且该行已不在补丁里」的失效记录，
+ *     真 pending 与 adopted 一条都不动；没有可清的 ⇒ `changed:false` 且**零写盘**；
+ *   · 删不存在的 rowId ⇒ 404 + 明确原因（绝不静默成功）；坏文件 ⇒ 409 拒绝覆盖（保住用户数据）。
+ *
+ * 写盘纪律全在 domain/compat-pending-records.js：备份 → 原子写（临时文件 + rename）→ 读回核实 → 失败回滚。
+ * 「行是否存在」只取补丁解析的既有产物（domain/patch.js#readPatchState），不另写一套正则。
+ */
+async function routeCompatPendingForget(req, res, rc) {
+  const body = rc.body ?? {}
+  const action = typeof body.action === 'string' ? body.action.trim() : ''
+  if (action !== 'forget' && action !== 'forget-stale') {
+    sendError(res, 400, `未知动作 ${JSON.stringify(body.action)}（可选 forget / forget-stale）`, { ok: false, error: '未知动作', code: 'unknown-action' })
+    return
+  }
+  const read = readPendingRecords()
+  // 判据唯一真源：补丁此刻真实存在的行（与 /state 里 patch.disables/forced/inserts 同源）
+  let liveRowIds = new Set()
+  try {
+    const patchPath = findPatchPath(rc.ctx)
+    liveRowIds = liveRowIdsFromPatch(await readPatchState(patchPath))
+  } catch {
+    // 读不到补丁 ⇒ 只能认定"没有任何行存在"；此时 forget-stale 会把 pending 全判成 stale，
+    // 那等于凭一个读失败删用户记录 —— 所以这条通道**必须停下**（宁可红，也不报假的绿）。
+    sendError(res, 503, '读不到 profile 补丁文件，无法判断哪些记录还指向真实的行；本次删除已停止（文件未改动）', { ok: false, code: 'patch-unreadable' })
+    return
+  }
+  const plan = action === 'forget'
+    ? planForgetRecord({ read, rowId: body.rowId })
+    : planForgetStale({ read, liveRowIds })
+  const result = plan.ok === true && plan.changed === true ? applyPendingForget(plan) : plan
+  const removed = Array.isArray(result.removedRowIds) ? result.removedRowIds : []
+  const removedCount = removed.length
+  const note = result.ok !== true
+    ? null
+    : (action === 'forget'
+      ? `已删除记录 ${String(body.rowId)}（其余记录原样保留；插件与补丁一个字都没动）`
+      : (removedCount > 0
+        ? `已清理 ${removedCount} 条失效记录（真实待适配与历史记录一条没动；插件与补丁一个字都没动）`
+        : '没有可清理的失效记录（文件未改动）'))
+  const payload = {
+    ok: result.ok === true,
+    action,
+    changed: result.changed === true,
+    removed,
+    removedCount,
+    keptCount: Array.isArray(result.keptRowIds) ? result.keptRowIds.length : 0,
+    // 删完之后按**同一判据**重算一遍（面板据此重绘；不复用旧计数，避免"删了但数字没动"）
+    counts: (() => {
+      try { return countPendingRecords(readPendingRecords().records, liveRowIds) } catch { return null }
+    })(),
+    file: read.file,
+    backup: result.backup ?? null,
+    verified: result.verified === true,
+    error: result.error ?? null,
+    note,
+  }
+  if (result.ok === true) sendJson(res, 200, payload)
+  else sendError(res, result.status ?? 400, result.error ?? '删除记录失败', payload)
+}
+
+export { hostShapeOf, maybeSwitchToObserver, maybeWriteSnapshot, preflightTimeoutMs, resetHostSwitchChecked, routeCompatAck, routeCompatMode, routeCompatPendingForget, routeCompatStamp, routeCompatStatusGet, routeDeclareInstalled, scheduleAutoPreflight }

package/lib/server/routes/index.js

@@ -16,7 +16,7 @@ import { readBody, sendError } from '../infra/httpd.js'
 import { routeAiConsent, routeAiEmpowerCancel, routeAiEmpowerList, routeAiEmpowerPlan, routeAiEmpowerRun, routeAiEmpowerStatus } from './ai.js'
 import { routeRunSuggested } from './actions.js'
 import { routeComponentAutostart, routeComponentStart, routeComponentStatus, routeComponentStop, routeComponents, routeRepoClone, routeRepoLandConfig, routeRepoList, routeRepoOpen, routeRepoRemove } from './components.js'
-import { routeCompatAck, routeCompatMode, routeCompatStamp, routeCompatStatusGet, routeDeclareInstalled } from './compat.js'
+import { routeCompatAck, routeCompatMode, routeCompatPendingForget, routeCompatStamp, routeCompatStatusGet, routeDeclareInstalled } from './compat.js'
 import { routeSafeBoot } from './safe-boot.js'
 // issue #22 ②③ 加法：用户备注 / 用户徽章 / 用户自建分组（独立文件，与插件列表完全解耦）
 import { routeAnnotationsGet, routeAnnotationsPost } from './annotations.js'
@@ -81,6 +81,23 @@ function routeDeps() {
   return { runInstallJob, runSuiteInstallJob, webPort, readExtraBundleRows, detectAdoptablePending, listEntries, detectCompat, detectFrameworkUpgrade, DEFAULT_SEARCH, aiEmpowerExecute, aiEmpowerPlan, backupProfileSnapshot, currentFrameworkVersion, frameworkCompatReportFor, isProtectedModule, pnpmRemove, preflightDisableIncompatible, rowIdModuleMap, fetchJson: fetchJsonUrl }
 }
 
+/**
+ * `/compat-gate` 的**只增不改**分流（0.5.98 加法）。
+ *
+ * 为什么分流装在这一层：门控面板的写入口必须挂在**既有的 /compat-gate** 上（不新开路由，
+ * 否则又要登记一份清单）；而那条路由的 handler（routes/framework.js#routeCompatGate）所在文件
+ * 已顶格 600/600 行（tests/test-architecture-guard.mjs 的硬门槛），**一个字都不能加**。
+ * 于是"分流"留在装配层，"动作实现"落在 routes/compat.js（适配门记录那一族）。
+ *
+ * 契约：body 里没有 `action`（或不是非空字符串）⇒ **逐字**走原来的总开关逻辑，
+ * 既有请求/响应一字不变；带 `action` 才进删除记录那一族（forget / forget-stale）。
+ */
+async function routeCompatGateAny(req, res, rc) {
+  const action = typeof rc.body?.action === 'string' ? rc.body.action : ''
+  if (action !== '') return routeCompatPendingForget(req, res, rc)
+  return routeCompatGate(req, res, rc)
+}
+
 async function handle(ctx, req, res) {
   const url = new URL(req.url ?? '/', 'http://x')
   const pathname = url.pathname
@@ -126,7 +143,7 @@ const ROUTES = [
   { methods: ['POST'], path: `${ROUTE_PREFIX}/skill-toggle`, handler: routeSkillToggle },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/install`, handler: routeInstall },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/install-status`, handler: routeInstallStatus },  { methods: ['POST'], path: `${ROUTE_PREFIX}/framework-check`, handler: routeFrameworkCheck },
-  { methods: ['POST'], path: `${ROUTE_PREFIX}/compat-gate`, handler: routeCompatGate },
+  { methods: ['POST'], path: `${ROUTE_PREFIX}/compat-gate`, handler: routeCompatGateAny },
   { methods: ['POST'], path: `${ROUTE_PREFIX}/check-update`, handler: routeCheckUpdate },
   // issue #22 ① 加法：批量检测（已安装列表的「一键检测全部更新」）。
   // ★ 与 /check-update 共用同一个探针（probePackageUpdate），判据不分叉；并发上限在 domain/update-batch.js。

package/lib/server/routes/state.js

@@ -12,6 +12,8 @@ import { bundleVetoList } from '../domain/bundle-veto.js'
 import { buildLinkInventory } from '../domain/link-inventory.js'
 import { buildInstallHealth } from '../domain/install-health.js'
 import { applyExemption } from '../domain/compat-exempt.js'
+// 0.5.98 加法：适配门记录的「真待适配」计数（唯一真源，见 domain/compat-pending-records.js）
+import { annotateGateRows, countPendingRecords, liveRowIdsFromPatch } from '../domain/compat-pending-records.js'
 import { addDevRoot, readDevRoots, removeDevRoot } from '../domain/dev-roots.js'
 import { applyPinDevDir, planPinDevDir } from '../domain/pin-dev-dir.js'
 import { reconcileLockfile } from '../domain/selfupdate.js'
@@ -68,6 +70,13 @@ async function routeStateGet(req, res, rc) {
     const compatPending = pendingState.pending
     const compatVerdicts = pendingState.verdicts
     const compatPendingRows = new Set((compatPending?.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => p.rowId))
+    // ★ 0.5.98 加法（用户 2026-10-28 实测）：**「真待适配」的唯一口径**。
+    //   现场：compat-pending.json 里 20 条 adopted + 3 条 pending 且 moduleName 为 null（补丁行早已不存在），
+    //   面板把 `pending` 数组长度当"待适配"，用户看到"有 N 行待适配"，其实一行都没有。
+    //   判据只认 domain/compat-pending-records.js#isActionablePending（status=pending 且该行仍在补丁里）；
+    //   「行是否存在」取的是**补丁解析的既有产物**（上面 patch 的 disables/forced/inserts），不另写正则。
+    const patchRowIds = liveRowIdsFromPatch(patch)
+    const pendingCounts = countPendingRecords(compatPending?.pending ?? [], patchRowIds)
     // 兼容门总开关 + 自动检测（只提示不自动开）
     const compatGate = readCompatGate()
     const adoptable = compatGate.autoDetect ? detectAdoptablePending(ctx) : new Map()
@@ -264,7 +273,14 @@ async function routeStateGet(req, res, rc) {
     } catch (error) {
       lockAutofix = { error: error instanceof Error ? error.message : String(error), scheduled: false }
     }
-    sendJson(res, 200, { ok: true, entries: allEntries, skippedBundles, host, health, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, lockAutofix, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0, written: patchHeal.written === true, writeError: patchHeal.writeError ?? null, skippedFrameworkOwned: (patchHeal.skipped ?? []).map((s) => s.id ?? null), uncertain: (patchHeal.uncertain ?? []).map((u) => u.id ?? null) }, gating: gatingSummary(ctx, compatPending, entries, compatVerdicts), compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null, verdict: compatVerdicts.get(p.rowId) ?? null })), verdictRefresh: pendingState.refresh === null ? null : { version: pendingState.refresh.version ?? null, updated: pendingState.refresh.updated ?? [], unchanged: pendingState.refresh.unchanged ?? [], unresolved: pendingState.refresh.unresolved ?? [], wrote: pendingState.refresh.wrote === true, writeError: pendingState.refresh.writeError ?? null } }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
+    // ★ 0.5.98 加法：门控明细行补两个**只增不改**的字段 —— `rowMissing`（这一行的 rowId 已不在
+    //   当前补丁里）与 `actionable`（与计数同一个判据）。面板据此如实标注「该行已不存在」并给删除入口；
+    //   既有字段（pendingCount / rows 的全部旧字段）一个不少、语义不变。
+    const gatingOut = (() => {
+      const g = gatingSummary(ctx, compatPending, entries, compatVerdicts)
+      return { ...g, pending: annotateGateRows(g.pending, patchRowIds), adopted: annotateGateRows(g.adopted, patchRowIds) }
+    })()
+    sendJson(res, 200, { ok: true, entries: allEntries, skippedBundles, host, health, patchPath, compat, installJobs: jobs, recentFailures, pendingRestart, github: { loggedIn: auth.loggedIn, login: auth.login }, patch: { disables: patch.disables, forced: patch.forced, inserts: patch.inserts }, framework, lockAutofix, patchHeal: patchHeal === null ? null : { healed: patchHeal.healed ?? [], autoDisabled: patchHeal.autoDisabled ?? [], healedAt: patchHeal.healedAt ?? 0, written: patchHeal.written === true, writeError: patchHeal.writeError ?? null, skippedFrameworkOwned: (patchHeal.skipped ?? []).map((s) => s.id ?? null), uncertain: (patchHeal.uncertain ?? []).map((u) => u.id ?? null) }, gating: gatingOut, compatPending: compatPending === null ? null : { frameworkVersion: compatPending.frameworkVersion ?? null, upgradeFrom: compatPending.upgradeFrom ?? null, pending: (compatPending.pending ?? []).filter((p) => (p.status ?? 'pending') === 'pending').map((p) => ({ rowId: p.rowId, moduleName: p.moduleName, version: p.version ?? null, checkNote: p.checkNote ?? null, check: p.check ?? null, riskyApprovedAt: p.riskyApprovedAt ?? null, adoptable: adoptable.get(p.rowId) ?? null, verdict: compatVerdicts.get(p.rowId) ?? null })), verdictRefresh: pendingState.refresh === null ? null : { version: pendingState.refresh.version ?? null, updated: pendingState.refresh.updated ?? [], unchanged: pendingState.refresh.unchanged ?? [], unresolved: pendingState.refresh.unresolved ?? [], wrote: pendingState.refresh.wrote === true, writeError: pendingState.refresh.writeError ?? null }, actionableCount: pendingCounts.actionableCount, staleCount: pendingCounts.staleCount }, compatGate, rollback: rollbackRec, selfVersion, components: findComponents().map((c) => ({ id: c.id, name: c.name, kind: c.kind ?? 'server', pid: c.pid ?? null, port: c.port ?? null, healthUrl: c.healthUrl ?? null, uiUrl: compUiUrl(c), autoStart: c.autoStart === true })) })
     return
 }
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@noob-stupid/dsh-plugin-console",
-  "version": "0.5.95",
+  "version": "0.5.98",
   "description": "DSH 框架升级安全与插件升级门控：一键升级、失败自动回滚、升级后回滚上版、旧插件不适配自动禁用；内置多源插件市场为发现层，插件源全部可自定义，可指向公司内网私有源 / 私有索引 / 本地 Git 仓库，纯内网离线可用 | Framework upgrade safety & plugin version gating for DSH, with a customizable multi-source plugin market: point every source at internal mirrors or a local file:// repo for intranet-only, offline installs.",
   "repository": {
     "type": "git",