@oj-module/cli 0.2.66 → 0.2.68

package/templates/src/oj-market/web/publish/pages/model.ts

@@ -0,0 +1,52 @@
+// 「发布管理」页的纯逻辑（无 React、无 IO）——状态颜色、可撤销判定、给用户的命令行。
+// 抽出来的唯一理由：这三件事是页面里最该被钉死的口径，且都必须能脱离 antd 断言。
+
+export type CredentialStatus = "active" | "used" | "revoked" | "expired";
+
+/** 状态 → antd Tag 颜色。Record 全量约束：新增状态时这里编译期就缺键。 */
+const STATUS_COLOR: Record<CredentialStatus, string> = {
+	active: "processing",
+	used: "success",
+	revoked: "default",
+	expired: "warning",
+};
+
+export function statusColor(status: CredentialStatus): string {
+	return STATUS_COLOR[status];
+}
+
+/**
+ * 能否撤销：只有「待兑换」可以。
+ *
+ * 兑换只下发 key_id，公钥是发布方本机生成的——站点手里没有那把钥匙，也就没有「撤回」可言；
+ * 撤回一条已兑换的凭证只会制造「以为撤了其实没撤」的错觉（后端的 400 文案就是这个意思，
+ * 真要停用只能到宿主信任库移除对应公钥）。按钮仍要渲染（禁用态），不用隐藏：
+ * 隐藏会让用户以为页面没做完。
+ */
+export function canRevoke(status: string): boolean {
+	return status === "active";
+}
+
+/**
+ * 复制给用户的一行命令。
+ *
+ * 只带凭证，不带 `--site`：站点地址由 CLI 从本机配置或上次发布记录里取，
+ * 页面拼一个 origin 反而在反代/多域名部署下更容易错。
+ */
+export function buildKeygenCommand(token: string): string {
+	return `ojm keygen --credential ${token}`;
+}
+
+/**
+ * 统一信封错误 → 人话。后端 fail(status, message) 的文案本身就是给用户看的，
+ * 故优先取 `msg`（ContractApiError），其次 Error.message。
+ *
+ * 与 system/pages/errors.ts 的 errMsg 同构但不互相 import：那是系统管理根内部模块，
+ * 让「发布管理」依赖它会把两个根的加载顺序绑在一起（多根聚合下互不依赖是硬约定）。
+ */
+export function errorText(e: unknown): string {
+	const msg = (e as { msg?: unknown } | null)?.msg;
+	if (typeof msg === "string" && msg !== "")
+		return msg;
+	return e instanceof Error ? e.message : String(e);
+}

package/templates/src/oj-market/web/publish/pages/token-modal.tsx

@@ -0,0 +1,82 @@
+import { Alert, Button, Input, Modal, Space, Typography } from "antd";
+import { useState } from "react";
+import { useTranslation } from "react-i18next";
+
+import { buildKeygenCommand } from "./model";
+
+/** 申请成功的返回值：明文只在这一刻存在 */
+export interface IssuedCredential {
+	token: string
+	key_id: string
+	product: string
+	token_hint?: string
+	expires_at: number
+}
+
+/** 复制到剪贴板：非 https / 无权限时静默失败（输入框里的文本本来就能手动选中） */
+async function copy(text: string): Promise<void> {
+	try {
+		await navigator.clipboard.writeText(text);
+	}
+	catch {
+		// 不打断流程：用户可直接在只读输入框里选中复制
+	}
+}
+
+/**
+ * 一次性明文弹窗。
+ *
+ * 三条不可退让的约束：
+ *   · 不渲染 = 没有。`issued` 为 null 时整个 Modal 不挂载，关闭后 DOM 里不再有明文
+ *     （服务端只存 sha256，关掉就真的找不回来——所以文案必须先说清楚）。
+ *   · 不可点遮罩/ESC 关闭：误触的代价是重新申请一张凭证。
+ *   · 凭证与命令都是只读输入框 + 复制按钮：64 位 hex 手抄必错。
+ */
+export function TokenModal({ issued, onClose }: { issued: IssuedCredential | null, onClose: () => void }) {
+	const { t } = useTranslation();
+	const [copied, setCopied] = useState<string | null>(null);
+	if (!issued)
+		return null;
+	const command = buildKeygenCommand(issued.token);
+	const copyRow = (testId: string, value: string) => (
+		<Space.Compact style={{ width: "100%", marginBottom: 16 }}>
+			<Input readOnly value={value} data-testid={testId} />
+			<Button
+				onClick={() => {
+					void copy(value);
+					setCopied(testId);
+				}}
+			>
+				{copied === testId ? t("publish:issued.copied") : t("publish:issued.copy")}
+			</Button>
+		</Space.Compact>
+	);
+
+	return (
+		<Modal
+			open
+			closable={false}
+			maskClosable={false}
+			keyboard={false}
+			title={t("publish:issued.title")}
+			footer={<Button type="primary" onClick={onClose}>{t("publish:issued.done")}</Button>}
+		>
+			<div data-testid="publish-issued">
+				<Alert type="warning" showIcon message={t("publish:issued.warning")} style={{ marginBottom: 16 }} />
+				<Typography.Paragraph>
+					<Typography.Text type="secondary">{t("publish:issued.identity")}</Typography.Text>
+					<br />
+					<Typography.Text copyable={{ text: issued.key_id }} code>{issued.key_id}</Typography.Text>
+				</Typography.Paragraph>
+				<Typography.Paragraph style={{ marginBottom: 4 }}>
+					<Typography.Text type="secondary">{t("publish:issued.token")}</Typography.Text>
+				</Typography.Paragraph>
+				{copyRow("publish-token", issued.token)}
+				<Typography.Paragraph style={{ marginBottom: 4 }}>
+					<Typography.Text type="secondary">{t("publish:issued.command")}</Typography.Text>
+				</Typography.Paragraph>
+				{copyRow("publish-command", command)}
+			</div>
+		</Modal>
+	);
+}

package/templates/src/oj-market/web/publish/routes.ts

@@ -0,0 +1,41 @@
+import type { AppRouteRecordRaw, ModuleContext } from "@oj-module/runtime";
+
+import { HistoryOutlined, KeyOutlined } from "@ant-design/icons";
+
+import { createElement, lazy } from "react";
+
+import { createPublishClient } from "./__client";
+
+const PublishPage = lazy(() => import("./pages"));
+const ReleaseHistoryPage = lazy(() => import("./pages/history"));
+
+/**
+ * 「方案市场」下的两个子页（单模单根：菜单只有 `/oj-market` 一个根）。
+ *
+ * 路径是**相对父路由**声明的：`publish` → `/oj-market/publish`，`history` → `/oj-market/history`。
+ * 发布管理不挂 handle.roles：申请发布凭证是普通登录用户的能力，超管多出来的只是
+ * 「看到所有租户的凭证」，由后端按角色决定返回范围，前端不重复判权。
+ */
+export const routes: AppRouteRecordRaw[] = [
+	{
+		path: "publish",
+		Component: PublishPage,
+		handle: {
+			title: "publish:menu.publish",
+			icon: createElement(KeyOutlined),
+		},
+	},
+	{
+		path: "history",
+		Component: ReleaseHistoryPage,
+		handle: {
+			title: "publish:menu.history",
+			icon: createElement(HistoryOutlined),
+		},
+	},
+];
+
+/** 构造即接线：登记契约前缀 /publish + 绑定 scoped request，页面直接 import 的函数才有通道 */
+export function onInit(ctx: ModuleContext): void {
+	createPublishClient(ctx);
+}

package/templates/src/oj-market/web/types.ts

@@ -61,6 +61,12 @@ export interface IndexRow {
 	upgradable: boolean
 	/** 最新版许可（SPDX 简化式，来自分片条目的 manifest.license；未声明 → null） */
 	license?: string | null
+	/** 发布者（分片条目 archive.signature.key_id，经验签的签名身份；与后端 trust_state/key_id 同用 snake_case） */
+	publisher_key?: string | null
+	/** 方案简介（manifest.summary，C2-04 单行 1..200；索引未带该字段 → undefined/null） */
+	summary?: string | null
+	/** 方案详细描述（manifest.description，C2-05 ≤2000；索引未带该字段 → undefined/null） */
+	description?: string | null
 }
 
 /** 安装输入（POST /_platform/market/install） */
@@ -97,3 +103,27 @@ export interface UninstallImpact {
 	affectedRoles: number
 	affectedUsers: number
 }
+
+/** 发布历史一行（`market_release`；来源是签名索引，追加式记录） */
+export interface ReleaseRow {
+	id: number
+	product: string
+	version: string
+	key_id: string | null
+	sha256: string | null
+	size: number | null
+	published_at: number
+	/** file = 分发包 Last-Modified；index = 索引生成时间兜底 */
+	published_at_source: "file" | "index"
+	yanked: number
+}
+
+/** 发布历史分页结果 */
+export interface ReleasePage {
+	list: ReleaseRow[]
+	total: number
+	page: number
+	size: number
+	/** 本次同步索引失败的人话（页面照常显示已入库历史） */
+	syncError: string | null
+}

package/templates/tests/lifecycle/compensate.spec.ts

@@ -0,0 +1,207 @@
+// BDD：安装补偿清单（P0 §3.5）。锁后失败把站点恢复到「装前代」——旧代继续服务、任务 partial+可重试。
+// 直接驱动 compensate()（不重跑整个状态机），配真实内存库夹具（installDb）+ 真实临时文件系统 +
+// stub reload 面，覆盖：完整回滚、幂等、部分失败仍尽力回滚、匿名面不随失败放大（验收 4）。
+//
+// 资产回滚原语：removeAnonymousPaths（text-edit）/ revertLock（lock）/ removeModulesJsonEntry
+// （deploy-web）/ revertRegistrations（uninstall，复用卸载事务）。各原语幂等（缺则 no-op），
+// 故补偿可安全被重试端点反复调用。
+
+import * as fsp from "node:fs/promises";
+import { tmpdir } from "node:os";
+import { join } from "node:path";
+import { afterEach, beforeEach, describe, expect, it } from "vitest";
+import { atomicWriteText } from "../../src/app/api/_platform/_lifecycle/atomic";
+import { compensate } from "../../src/app/api/_platform/_lifecycle/compensate";
+import { parseLock, writeLock } from "../../src/app/api/_platform/_lifecycle/lock";
+import { appendAnonymousPaths, removeAnonymousPaths } from "../../src/app/api/_platform/_lifecycle/text-edit";
+import { installDb } from "../fixture";
+
+const g = globalThis as any;
+
+const BASE_CONFIG = "mounts: []\nserver:\n  reload_api: true\nvars:\n  other: 1\nauth:\n  anonymous_paths:\n    - /auth/login\n    - /system/login-methods\n";
+
+function nodeFsFace() {
+	return {
+		writeFile: (p: string, d: any) => fsp.writeFile(p, d),
+		readFile: (p: string) => fsp.readFile(p),
+		mkdir: (p: string, o: any) => fsp.mkdir(p, o),
+		remove: (p: string, o: any) => fsp.rm(p, o),
+		rename: (o: string, n: string) => fsp.rename(o, n),
+		copyFile: (s: string, d: string) => fsp.copyFile(s, d),
+		readdir: (p: string) => fsp.readdir(p),
+	};
+}
+
+let root: string;
+let configPath: string;
+let previewPath: string;
+let sharedRoot: string;
+let lockPath: string;
+let modulesJsonPath: string;
+let dbo: any;
+let reloadCalls: number;
+let reloadThrow: boolean;
+
+const LOCK_BEFORE: Record<string, string> = { existing: "1.0.0" };
+
+/** 把站点摆成「demo-solution 已锁后落位」状态，返回本次新增的匿名路径（= 补偿的输入 deferredAnonymous） */
+async function seedInstalled(anonPaths: string[]): Promise<string[]> {
+	const added = appendAnonymousPaths(BASE_CONFIG, anonPaths);
+	await atomicWriteText(configPath, added.content);
+	await atomicWriteText(previewPath, added.content);
+	// 锁：装前快照 + 本次模块条目
+	await writeLock(lockPath, { ...LOCK_BEFORE, "demo-solution": "0.1.0" });
+	// modules.json：含本次模块条目
+	await atomicWriteText(modulesJsonPath, `${JSON.stringify([{ name: "demo-solution", entry: "modules/demo-solution/0.1.0/entry.js", enabled: true }], null, 2)}\n`);
+	// DB：路由/角色/权限各一行为 demo-solution（registering 段已落位）
+	await g.db.table("sys_solution_route").insert({ path: "/demo-solution", module: "demo-solution", category: "main" }).run();
+	await g.db.table("sys_role").insert({ name: "demo-solution.admin", module: "demo-solution" }).run();
+	await g.db.table("sys_permission").insert({ code: "demo-solution.view", module: "demo-solution" }).run();
+	return added.added;
+}
+
+function countAnon(cfg: string): number {
+	const lines = cfg.split("\n");
+	const idx = lines.findIndex(l => /^\s*anonymous_paths\s*:/.test(l));
+	if (idx === -1)
+		return 0;
+	let n = 0;
+	for (let i = idx + 1; i < lines.length; i++) {
+		const line = lines[i]!;
+		if (line.trim() === "" || /^\s*#/.test(line))
+			continue;
+		if (!line.replace(/#.*$/, "").trim().startsWith("- "))
+			break;
+		n++;
+	}
+	return n;
+}
+
+beforeEach(async () => {
+	root = await fsp.mkdtemp(join(tmpdir(), "ojm-compensate-"));
+	configPath = join(root, "config.yaml");
+	previewPath = join(root, ".ojm-preview.yaml");
+	sharedRoot = join(root, "modules");
+	lockPath = join(sharedRoot, "manifests.yaml");
+	modulesJsonPath = join(root, "dist", "modules.json");
+	await fsp.mkdir(sharedRoot, { recursive: true });
+	await fsp.mkdir(join(root, "dist"), { recursive: true });
+	g.fs = nodeFsFace();
+	g.yaml = { parse: async (t: string) => JSON.parse(t) };
+	g.http = {};
+	dbo = installDb();
+	reloadCalls = 0;
+	reloadThrow = false;
+});
+
+afterEach(async () => {
+	g.fs = undefined;
+	g.http = undefined;
+	g.db = undefined;
+	await fsp.rm(root, { recursive: true, force: true });
+});
+
+function makeInput(deferredAnonymous: string[]): any {
+	return {
+		name: "demo-solution",
+		version: "0.1.0",
+		configPath,
+		deferredAnonymous,
+		sharedRoot,
+		modulesJsonPath,
+		lockBefore: LOCK_BEFORE,
+		lockExisted: true,
+		reload: {
+			reloadConfig: async () => {
+				reloadCalls++;
+				if (reloadThrow)
+					throw new Error("reload 模拟失败");
+				return { generation: 2, unchanged: false, applied: ["vars"], restart_pending: [], kept_listener: [] };
+			},
+		},
+	};
+}
+
+describe("compensate 完整回滚到装前代", () => {
+	it("锁/config匿名/modules.json/DB 全部回退，旧代仍服务（reload 已调用）", async () => {
+		const added = await seedInstalled(["demo-solution/ping", "demo-solution/health"]);
+		const r = await compensate(makeInput(added));
+
+		expect(r.allOk).toBe(true);
+		expect(r.steps.map(s => s.step)).toEqual(["config.anonymous", "lock", "modules.json", "db.registrations", "reload"]);
+
+		// 锁回到装前快照（无 demo-solution）
+		expect(parseLock(await fsp.readFile(lockPath, "utf8"))).toEqual(LOCK_BEFORE);
+		// config：新增匿名条目被精确移除，基线两条保留；seq 不被回滚（单调无害）
+		const cfg = await fsp.readFile(configPath, "utf8");
+		expect(cfg).toContain("- /auth/login");
+		expect(cfg).toContain("- /system/login-methods");
+		expect(cfg).not.toContain("demo-solution/ping");
+		expect(cfg).not.toContain("demo-solution/health");
+		expect(countAnon(cfg)).toBe(2);
+		// preview 派生同样被清理
+		const prev = await fsp.readFile(previewPath, "utf8");
+		expect(prev).not.toContain("demo-solution/ping");
+		// modules.json 无 demo-solution 条目
+		const list = JSON.parse(await fsp.readFile(modulesJsonPath, "utf8")) as unknown[];
+		expect(list.some((e: any) => e.name === "demo-solution")).toBe(false);
+		// DB 注册被级联清掉
+		expect(dbo.prepare("SELECT * FROM sys_solution_route WHERE module='demo-solution'").all()).toHaveLength(0);
+		expect(dbo.prepare("SELECT * FROM sys_role WHERE module='demo-solution'").all()).toHaveLength(0);
+		expect(dbo.prepare("SELECT * FROM sys_permission WHERE module='demo-solution'").all()).toHaveLength(0);
+		// reload 被调用一次（活动代回到装前态）
+		expect(reloadCalls).toBe(1);
+	});
+});
+
+describe("compensate 幂等（可重试）", () => {
+	it("连续两次补偿：第二次全 no-op，终态不变，reload 仍各调用一次", async () => {
+		const added = await seedInstalled(["demo-solution/ping"]);
+		const first = await compensate(makeInput(added));
+		const second = await compensate(makeInput(added));
+		expect(first.allOk).toBe(true);
+		expect(second.allOk).toBe(true);
+		expect(parseLock(await fsp.readFile(lockPath, "utf8"))).toEqual(LOCK_BEFORE);
+		expect(countAnon(await fsp.readFile(configPath, "utf8"))).toBe(2);
+		const list = JSON.parse(await fsp.readFile(modulesJsonPath, "utf8")) as unknown[];
+		expect(list.some((e: any) => e.name === "demo-solution")).toBe(false);
+		expect(dbo.prepare("SELECT * FROM sys_solution_route WHERE module='demo-solution'").all()).toHaveLength(0);
+		expect(reloadCalls).toBe(2); // 两次各触发一次 reload（幂等但不跳过 reload）
+	});
+});
+
+describe("compensate 部分失败仍尽力回滚", () => {
+	it("reload 步抛错 → 该步标记失败、其余四步仍生效、allOk=false", async () => {
+		const added = await seedInstalled(["demo-solution/ping"]);
+		reloadThrow = true;
+		const r = await compensate(makeInput(added));
+
+		expect(r.allOk).toBe(false);
+		const reloadStep = r.steps.find(s => s.step === "reload")!;
+		expect(reloadStep.ok).toBe(false);
+		// 其余步成功
+		for (const s of r.steps.filter(s => s.step !== "reload")) {
+			expect(s.ok).toBe(true);
+		}
+		// 即便 reload 失败，已落位资产仍被回退
+		expect(parseLock(await fsp.readFile(lockPath, "utf8"))).toEqual(LOCK_BEFORE);
+		expect(countAnon(await fsp.readFile(configPath, "utf8"))).toBe(2);
+		expect(dbo.prepare("SELECT * FROM sys_solution_route WHERE module='demo-solution'").all()).toHaveLength(0);
+	});
+});
+
+describe("compensate 匿名面不随失败放大（验收 4）", () => {
+	it("同一方案连续两次失败安装：config 匿名条目数不增长", async () => {
+		// 第一次失败：装前基线 2 条，新增 1 条后补偿
+		const added = await seedInstalled(["demo-solution/ping"]);
+		await compensate(makeInput(added));
+		const afterFirst = await fsp.readFile(configPath, "utf8");
+		expect(countAnon(afterFirst)).toBe(2); // 回到基线
+
+		// 第二次失败：再次以同样 deferredAnonymous 补偿（模拟又失败一次）
+		await compensate(makeInput(added));
+		const afterSecond = await fsp.readFile(configPath, "utf8");
+		expect(countAnon(afterSecond)).toBe(2); // 不增长
+		expect(removeAnonymousPaths(afterSecond, added).removed).toEqual([]); // 已无残留可删
+	});
+});

package/templates/tests/lifecycle/deploy-smoke.spec.ts

@@ -1,7 +1,7 @@
 // BDD：部署/热更/冒烟三步（P1-9，十阶段 stage 8~10）。
 // deploy-web = staging/web 产物树真复制到站点 modules 目录 + modules.json 读-改-原子写 upsert
 // （D13：读者永不见半截 JSON；R30：entry/css 路径 POSIX 分隔符序列化；同名整体替换、他条目原样保留）；
-// reload = 注入 reloadConfig 面（platform 特权 API），unchanged = 改写未生效判失败（R18 终态断言），
+// reload = 注入 reloadConfig 面（platform 特权 API），unchanged = 安装幂等成功 / 卸载恒严格（R18 修订——加载靠锁 diff 触发，不再依赖 vars 哨兵），
 // expected 段键（缺省 ["vars"]，B-11 reload 触发面）须逐一 ∈ applied；
 // smoke = 探活（health 2xx / 缺省首个非匿名路由连通即可）+ integrity（部署落位后重算 sha384 vs
 // modules.json 条目，R10 包内容口径；缺失 fail-closed）+ 注册一致性（升级态「包含非相等」：
@@ -19,7 +19,7 @@ import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { afterEach, beforeEach, describe, expect, it } from "vitest";
 import { deployWeb, posixPath, upsertModulesJson } from "../../src/app/api/_platform/_lifecycle/steps/deploy-web";
-import { reloadAndAssert } from "../../src/app/api/_platform/_lifecycle/steps/reload";
+import { assertReloadApplied, reloadAndAssert } from "../../src/app/api/_platform/_lifecycle/steps/reload";
 import { probeUrlOf, smoke } from "../../src/app/api/_platform/_lifecycle/steps/smoke";
 
 const g = globalThis as any;
@@ -260,31 +260,42 @@ describe("deployWeb（stage=deploying：staging/web 树 → 站点 modules 目
 	});
 });
 
-describe("reloadAndAssert（stage=reloading：R18 unchanged=失败）", () => {
+describe("reloadAndAssert（stage=reloading：R18 修订——安装 unchanged=幂等成功且默认不强制模块符号；卸载 unchanged/缺 -name@ver=严格失败；force+unchanged=失败）", () => {
 	function rlCtx(result?: ReloadResult, throws = false): ReloadContext {
 		const face: ReloadFace = {
 			reloadConfig: throws
 				? async () => {
 					throw new Error("server.reloadConfig: reload in progress (busy)");
 				}
-				: async () => result ?? { generation: 8, unchanged: false, applied: ["vars"], restart_pending: [], kept_listener: [] },
+				: async () => result ?? { generation: 8, unchanged: false, applied: ["+demo-solution@0.1.0"], restart_pending: [], kept_listener: [] },
 		};
 		return { manifest: solManifest(), name: "demo-solution", version: "0.1.0", state: stateStore(), reload: face };
 	}
 
-	it("成功：applied 含 vars（缺省 expected）→ ok=true，message 含 generation", async () => {
+	it("成功：applied 含 +name@ver（api 模块装配）→ ok=true，message 含 generation", async () => {
 		const r = await reloadAndAssert(rlCtx());
 		expect(r.stage).toBe("reloading");
 		expect(r.ok).toBe(true);
 		expect(r.message).toContain("8");
 	});
 
-	it("unchanged → ok=false（R18：幂等回显 = config 改写未生效）", async () => {
+	it("unchanged → ok=true（R18 修订：安装幂等成功 = 已是最新装配，不再视为失败）", async () => {
 		const r = await reloadAndAssert(rlCtx({ generation: 7, unchanged: true, applied: [] }));
+		expect(r.ok).toBe(true);
+	});
+
+	it("force + unchanged → ok=false（--force 要求强制重装配却无变更可重做）", async () => {
+		const r = await reloadAndAssert({ ...rlCtx({ generation: 7, unchanged: true, applied: [] }), force: true });
 		expect(r.ok).toBe(false);
 		expect(r.message).toContain("unchanged");
 	});
 
+	it("卸载 unchanged → ok=false（锁未摘除 = 卸载空转，恒严格）", async () => {
+		const r = assertReloadApplied({ generation: 7, unchanged: true, applied: [] }, { hasApi: true, kind: "uninstall", name: "demo-solution", version: "0.1.0" });
+		expect(r.ok).toBe(false);
+		expect(r.message).toContain("卸载空转");
+	});
+
 	it("face 抛错（并发 busy）→ ok=false retryable=true", async () => {
 		const r = await reloadAndAssert(rlCtx(undefined, true));
 		expect(r.ok).toBe(false);
@@ -292,10 +303,15 @@ describe("reloadAndAssert（stage=reloading：R18 unchanged=失败）", () => {
 		expect(r.message).toContain("busy");
 	});
 
-	it("expected 段键未生效：applied 缺 vars → ok=false（R18 以实际生效值断言）", async () => {
-		const r = await reloadAndAssert({ ...rlCtx({ generation: 8, unchanged: false, applied: ["mounts"], restart_pending: [], kept_listener: [] }), expected: ["mounts", "vars"] });
+	it("安装不再强制 +name@ver（R18 修订：applied 空属正常幂等态，挂载真通交由 smoke 段行为化校验）", async () => {
+		const r = await reloadAndAssert(rlCtx({ generation: 8, unchanged: false, applied: ["mounts"], restart_pending: [], kept_listener: [] }));
+		expect(r.ok).toBe(true);
+	});
+
+	it("卸载缺 -name@ver → ok=false（卸载须显式拆装，锁未摘除即空转回归拦截点）", async () => {
+		const r = assertReloadApplied({ generation: 8, unchanged: false, applied: ["mounts"], restart_pending: [] }, { hasApi: true, kind: "uninstall", name: "demo-solution", version: "0.1.0" });
 		expect(r.ok).toBe(false);
-		expect(r.message).toContain("vars");
+		expect(r.message).toContain("demo-solution@0.1.0");
 	});
 
 	it("返回形状违约（applied 非数组）→ ok=false retryable=false", async () => {
@@ -337,15 +353,13 @@ describe("smoke 探活（D14/Q-A：health 不强制）", () => {
 		expect(r.message).toContain("不计入失败");
 	});
 
-	it("health 401 与否声明 anonymous 无关（统一 deferred，不放宽真失败靠非 401）", async () => {
-		// 旧语义按 deferredAnonymous 白名单区分是否 deferred；该字段从未被调用方赋值（死代码），
-		// 且设计明确「health 不强制、无凭证预期 401」，故改为 health 401 一律 deferred。
-		// 真失败仍由非 401（如 500，见下条）兜底，不靠 anonymous 白名单。
+	it("health 401 与是否声明 anonymous 无关（统一 deferred，真失败靠非 401 兜底）", async () => {
+		// 设计明确「health 不强制、无凭证预期 401」，故 health 401 一律 deferred，
+		// 真失败仍由非 401（如 500，见下条）兜底。
 		await seedDeployed();
 		const r = await smoke(smCtx({
 			manifest: solManifest({ health: "/demo-solution/ping" }),
 			fetch: async () => ({ ok: false, status: 401 }),
-			deferredAnonymous: ["/demo-solution/other"],
 		}));
 		expect(r.ok).toBe(true);
 		expect(r.message).toContain("restart_pending");
@@ -394,6 +408,16 @@ describe("smoke 探活（D14/Q-A：health 不强制）", () => {
 		}));
 		expect(r.ok).toBe(true);
 	});
+
+	it("无 health：首个非匿名路由 404 → 探活失败（P0 §3.5：首个路由 404/连通失败 = 冒烟失败，避免假成功）", async () => {
+		await seedDeployed();
+		const r = await smoke(smCtx({
+			fetch: async () => ({ ok: false, status: 404 }),
+		}));
+		expect(r.ok).toBe(false);
+		expect(r.message).toContain("探活");
+		expect(r.message).toContain("404");
+	});
 });
 
 describe("smoke integrity（R10：部署落位后重算 sha384 vs modules.json）", () => {

package/templates/tests/lifecycle/installer.spec.ts

@@ -156,7 +156,7 @@ function makeReq(overrides: Partial<InstallRequest> = {}): InstallRequest {
 		configPath: join(root, "config.yaml"),
 		fetch: async () => ({ ok: true, status: 200, arrayBuffer: async () => ARCHIVE.slice().buffer }),
 		exec: bundleExec(),
-		reload: { reloadConfig: async () => ({ generation: 1, unchanged: false, applied: ["vars"], restart_pending: [], kept_listener: [] }) },
+		reload: { reloadConfig: async () => ({ generation: 1, unchanged: false, applied: [`+demo-solution@${version}`], restart_pending: [], kept_listener: [] }) },
 		sha256Hex: d => createHash("sha256").update(d).digest("hex"),
 		verifyEd25519: nodeVerifyEd25519,
 		trustPath,
@@ -181,8 +181,8 @@ beforeEach(async () => {
 	modulesJsonPath = join(root, "dist", "modules.json");
 	dbPath = join(root, "db.sqlite");
 	await fsp.writeFile(dbPath, new TextEncoder().encode("sqlite-header\n"));
-	// 站点 config.yaml 夹具（reloading 段 vars.ojm_install_seq 自增消费面；模板 config.yaml 随发形态）
-	await fsp.writeFile(join(root, "config.yaml"), "mounts: []\nserver:\n  reload_api: true\nvars:\n  ojm_install_seq: 0\nauth:\n  anonymous_paths:\n    - /auth/login\n");
+	// 站点 config.yaml 夹具（reloading 段仅做 anonymous_paths 接线；模板 config.yaml 随发形态）
+	await fsp.writeFile(join(root, "config.yaml"), "mounts: []\nserver:\n  reload_api: true\nvars:\n  other: 1\nauth:\n  anonymous_paths:\n    - /auth/login\n");
 	g.fs = nodeFsFace();
 	g.yaml = { parse: async (t: string) => JSON.parse(t) };
 	g.http = {};
@@ -226,9 +226,8 @@ describe("runInstall 全绿路径（步骤 stub，register/smoke/audit 走真实
 		await fsp.access(join(versionDir, "routes.js"));
 		await fsp.access(join(versionDir, "migrations", "0001__init.sql"));
 		await expect(fsp.access(join(versionDir, "web"))).rejects.toThrow();
-		// reloading 段触发变更已落盘：vars.ojm_install_seq 自增（B-11，PRD E5 口径）
+		// reloading 段仅做 anonymous_paths 接线（幂等追加；不再依赖 vars 哨兵触发 reload）
 		const cfg = new TextDecoder().decode(await fsp.readFile(join(root, "config.yaml")));
-		expect(cfg).toContain("ojm_install_seq: 1");
 		// C2-26 anonymous 运行时接线（P2-15③）：方案匿名端点补进 auth.anonymous_paths（幂等追加）
 		expect(cfg).toContain("- /demo-solution/ping");
 		// web 产物落位 + modules.json 条目（R10 integrity 为包内容重算值）
@@ -260,10 +259,10 @@ describe("runInstall 全绿路径（步骤 stub，register/smoke/audit 走真实
 		expect(await getTask(taskDir, "nope")).toBeNull();
 	});
 
-	it("preview 形态：派生 .ojm-preview.yaml 存在时两份 config 一起自增（否则 reload 恒 unchanged）", async () => {
+	it("preview 形态：派生 .ojm-preview.yaml 存在时两份 config 一起接线（否则 reload 恒 unchanged）", async () => {
 		// ojm preview 派生出来的那份才是服务端在读的 config（spa 挂载 + platform.root 改写）
 		const derived = join(root, ".ojm-preview.yaml");
-		await fsp.writeFile(derived, "mounts: []\nserver:\n  reload_api: true\nvars:\n  ojm_install_seq: 0\nauth:\n  anonymous_paths:\n    - /auth/login\n");
+		await fsp.writeFile(derived, "mounts: []\nserver:\n  reload_api: true\nvars:\n  other: 1\nauth:\n  anonymous_paths:\n    - /auth/login\n");
 
 		const t = await runInstall(makeReq());
 		expect(t.status).toBe("done");
@@ -271,10 +270,8 @@ describe("runInstall 全绿路径（步骤 stub，register/smoke/audit 走真实
 		const source = new TextDecoder().decode(await fsp.readFile(join(root, "config.yaml")));
 		const preview = new TextDecoder().decode(await fsp.readFile(derived));
 		// 源 config 仍是真相（preview 重启后按它重建派生文件）
-		expect(source).toContain("ojm_install_seq: 1");
 		expect(source).toContain("- /demo-solution/ping");
 		// 派生文件也要变：reloadConfig 按它的文档 sha 判 unchanged
-		expect(preview).toContain("ojm_install_seq: 1");
 		expect(preview).toContain("- /demo-solution/ping");
 	});
 
@@ -1313,3 +1310,25 @@ describe("冒烟探活必须自报租户头（企微代开发多租户 v3 Phase
 		expect(t.stage).toBe("smoke");
 	});
 });
+
+describe("Phase 3：无守护 partial 判定（P0 §3.6 / 验收 15）", () => {
+	it("热更返回待重启段非空 → 装完标 partial + restartRequired（不判 done，避免假成功）", async () => {
+		// 无守护形态（P4 supervisor 未实施）：匿名接线等 restart_pending 段需宿主重启才完全生效，
+		// 不应报 done 误导。reload 返回 restart_pending 非空即标 partial + restartRequired。
+		const t = await runInstall(makeReq({
+			reload: { reloadConfig: async () => ({ generation: 1, unchanged: false, applied: ["+demo-solution@0.1.0"], restart_pending: ["auth"], kept_listener: [] }) },
+		}));
+		expect(t.status).toBe("partial");
+		expect(t.restartRequired).toBe(true);
+		expect(t.message).toContain("待重启段");
+		expect(t.message).toContain("重启");
+		// 安装产物已落位（非失败语义②补偿）：锁/版本目录仍在，任务非 failed
+		expect(t.stage).not.toBe("failed");
+	});
+
+	it("热更待重启段为空 → 正常 done（restartRequired 不置位）", async () => {
+		const t = await runInstall(makeReq());
+		expect(t.status).toBe("done");
+		expect(t.restartRequired).toBeUndefined();
+	});
+});