@oj-module/cli 0.2.8 → 0.2.14

package/templates/api/src/notification/_shared/notify.ts

@@ -69,12 +69,17 @@ function splitId(id: string): [scope: "u" | "b", raw: string] {
 function mapItem(r: Row): NoticeItem {
 	const scope = String(r.scope);
 	const isBroadcast = scope === "broadcast";
+	// UNION 结果列名取首分支（userQ）=> 位置 4 名为 is_read。按人项此处即存储整数列；
+	// 广播项此处实际承载回执 read_time（非空即已读，与原始 SQL 的 (read_time IS NOT NULL AND <> '') 等价）。
+	const isRead = isBroadcast
+		? (r.is_read != null && String(r.is_read) !== "")
+		: Number(r.is_read) === 1;
 	return {
 		id: (isBroadcast ? "b:" : "u:") + String(r.id),
 		scope: isBroadcast ? "broadcast" : "user",
 		avatar: String(r.avatar ?? ""),
 		date: String(r.date ?? ""),
-		isRead: Number(r.is_read) === 1,
+		isRead,
 		message: String(r.message ?? ""),
 		title: String(r.title ?? ""),
 		link: r.link == null ? undefined : String(r.link),
@@ -112,17 +117,17 @@ export async function pushBroadcastNotice(input: PushBroadcastInput): Promise<st
 }
 
 /**
- * 删除通知。按人项校验归属：非本人返回 false；广播项仅删本人回执（幂等，返回 true）。
+ * 删除通知。按人项校验归属：非本人返回 false；广播项是共享行，物理删除会影响
+ * 其他收件人——落「对我隐藏」标记（幂等，返回 true），列表查询过滤 hidden 命中项。
  * 返回是否成功操作到目标（调用方据 false 判 403）。
  */
 export async function delNotice(id: string, userId: string | number): Promise<boolean> {
 	const [scope, raw] = splitId(id);
 	const uid = Number(userId);
 	if (scope === "b") {
-		await db.table("notifications_broadcast_read")
-			.where({ field: "broadcast_id", op: "eq", value: Number(raw) })
-			.where({ field: "user_id", op: "eq", value: uid })
-			.delete()
+		await db.table("notifications_broadcast_hidden")
+			.insert({ broadcast_id: Number(raw), user_id: uid, create_time: nowStr() })
+			.orIgnore()
 			.run();
 		return true;
 	}
@@ -142,18 +147,43 @@ export async function noticesFor(
 	const limit = opts.limit ?? 50;
 	const offset = opts.offset ?? 0;
 	const uid = Number(userId);
-	const rows = await db.query(
-		`SELECT id, avatar, date, is_read, message, title, link, category, 'user' as scope
-		   FROM notifications WHERE user_id = ?
-		 UNION ALL
-		 SELECT b.id, b.avatar, b.date, (r.read_time IS NOT NULL AND r.read_time <> '') as is_read,
-		        b.message, b.title, b.link, b.category, 'broadcast' as scope
-		   FROM notifications_broadcast b
-		   LEFT JOIN notifications_broadcast_read r ON r.broadcast_id = b.id AND r.user_id = ?
-		 ORDER BY date DESC
-		 LIMIT ? OFFSET ?`,
-		[uid, uid, limit, offset],
-	);
+	// 构造器（v0.1.81）：UNION ALL 合并「按人」与「广播(LEFT JOIN 回执)」；lit 打固定 scope 标记列，
+	// 顶层 orderBy/limit/offset 跨方言一致。
+	// 注意：UNION 结果列名取首分支(userQ)，故两分支位置对齐即可——广播第 4 列取回执 read_time，
+	// 经 union 落到 is_read 列名下，是否「已读」由 mapItem 据非空推导（与原始 SQL 同源）。
+	const userQ = db.table("notifications").select([
+		"id",
+		"avatar",
+		"date",
+		"is_read",
+		"message",
+		"title",
+		"link",
+		"category",
+		{ lit: "user", as: "scope" },
+	]).where({ field: "user_id", op: "eq", value: uid });
+	const broadcastQ = db.table("notifications_broadcast").as("b").join("notifications_broadcast_read", [
+		{ left: "b.id", right: "r.broadcast_id" },
+		{ left: "r.user_id", op: "eq", value: uid },
+	], "left", "r").join("notifications_broadcast_hidden", [
+		{ left: "b.id", right: "h.broadcast_id" },
+		{ left: "h.user_id", op: "eq", value: uid },
+	], "left", "h").where({ field: "h.id", op: "isnull" }).select([
+		"b.id",
+		"b.avatar",
+		"b.date",
+		"r.read_time",
+		"b.message",
+		"b.title",
+		"b.link",
+		"b.category",
+		{ lit: "broadcast", as: "scope" },
+	]);
+	const rows = await userQ.union(broadcastQ, "all")
+		.orderBy([{ field: "date", dir: "desc" }])
+		.limit(limit)
+		.offset(offset)
+		.all();
 	return rows.map(mapItem);
 }
 
@@ -166,11 +196,11 @@ export async function markRead(id: string, userId: string | number): Promise<boo
 	const uid = Number(userId);
 	const now = nowStr();
 	if (scope === "b") {
-		// 保留 db.exec：INSERT OR IGNORE 构造器无等价（引擎按方言改写 IGNORE）
-		await db.exec(
-			"INSERT OR IGNORE INTO notifications_broadcast_read (broadcast_id, user_id, read_time) VALUES (?, ?, ?)",
-			[Number(raw), uid, now],
-		);
+		// 构造器（v0.1.81）：orIgnore 幂等写入（sqlite/pg → ON CONFLICT DO NOTHING；mysql → ON DUPLICATE KEY UPDATE pk=pk）。
+		await db.table("notifications_broadcast_read")
+			.insert({ broadcast_id: Number(raw), user_id: uid, read_time: now })
+			.orIgnore()
+			.run();
 		return true;
 	}
 	const n = await db.table("notifications")
@@ -186,16 +216,24 @@ export async function markAllRead(userId: string | number): Promise<void> {
 	const uid = Number(userId);
 	const now = nowStr();
 	await db.table("notifications").where({ field: "user_id", op: "eq", value: uid }).update({ is_read: 1 }).run();
-	// 保留 db.exec：INSERT OR IGNORE ... SELECT 构造器无法表达
+	// 保留 db.exec：INSERT OR IGNORE ... SELECT 在 sqlite 上构造器无法表达——
+	// oj 0.1.81 的 orIgnore 仅跟随 VALUES 的 upsert 子句，不与 fromSelect(SELECT 源) 组合
+	// （实测：code 500 "orIgnore with fromSelect is not supported on sqlite"）。原 SQL 三方言通用
+	// （sqlite OR IGNORE / pg ON CONFLICT DO NOTHING / mysql ON DUPLICATE KEY），退回裸 SQL。
 	await db.exec(
 		"INSERT OR IGNORE INTO notifications_broadcast_read (broadcast_id, user_id, read_time) SELECT id, ?, ? FROM notifications_broadcast",
 		[uid, now],
 	);
 }
 
-/** 清空：删按人项 + 删本人广播回执（列表消失） */
+/** 清空：删按人项 + 广播逐条落「对我隐藏」标记（共享行不可物理删，他人不受影响） */
 export async function clearNotices(userId: string | number): Promise<void> {
 	const uid = Number(userId);
 	await db.table("notifications").where({ field: "user_id", op: "eq", value: uid }).delete().run();
-	await db.table("notifications_broadcast_read").where({ field: "user_id", op: "eq", value: uid }).delete().run();
+	// 保留 db.exec：INSERT OR IGNORE ... SELECT 同 markAllRead（构造器 orIgnore 不与
+	// fromSelect 组合，实测 500），原 SQL 三方言通用。
+	await db.exec(
+		"INSERT OR IGNORE INTO notifications_broadcast_hidden (broadcast_id, user_id, create_time) SELECT id, ?, ? FROM notifications_broadcast",
+		[uid, nowStr()],
+	);
 }

package/templates/api/src/notification/api.ts

@@ -72,7 +72,7 @@ const notifications = {
 		},
 	},
 	// POST /api/notification/notifications/clear —— 清空通知（按当前用户）。
-	// 删按人项 + 删本人广播回执（列表消失）。
+	// 删按人项 + 广播逐条落「对我隐藏」标记（共享行不可物理删，他人不受影响）。
 	"clear": {
 		async post() {
 			const uid = http.user?.id;

package/templates/api/src/notification/manifest.yaml

@@ -5,3 +5,4 @@ tables:
   - notifications
   - notifications_broadcast
   - notifications_broadcast_read
+  - notifications_broadcast_hidden

package/templates/api/src/notification/migrations/0004__notifications_broadcast_hidden.sql

@@ -0,0 +1,12 @@
+-- 广播隐藏标记表（按人）：清空/单条删除广播项时落标记——广播本体是共享行，
+-- 任何人不得物理删除（会影响其他收件人），只能「对我隐藏」。
+-- 清空 = 按人项物理删 + 广播逐条落 hidden 标记；列表查询过滤 hidden 命中项。
+-- 三方言可移植：建表 + 索引均为标准 DDL。
+CREATE TABLE IF NOT EXISTS notifications_broadcast_hidden (
+  id INTEGER PRIMARY KEY AUTOINCREMENT,
+  broadcast_id INTEGER NOT NULL,
+  user_id INTEGER NOT NULL,
+  create_time TEXT NOT NULL DEFAULT ''
+);
+
+CREATE INDEX IF NOT EXISTS idx_broadcast_hidden ON notifications_broadcast_hidden (user_id, broadcast_id);

package/templates/api/src/notification/schema.yaml

@@ -31,3 +31,10 @@ tables:
       broadcast_id: {type: integer, null: false}
       user_id: {type: integer, null: false}
       read_time: {type: text, null: false}
+  notifications_broadcast_hidden:
+    pk: id
+    columns:
+      id: {type: integer, autoincrement: true}
+      broadcast_id: {type: integer, null: false}
+      user_id: {type: integer, null: false}
+      create_time: {type: text, null: false}

package/templates/api/src/notification/seed.sql

@@ -1,6 +1,7 @@
 -- notification 模块种子（按人真实通知）。user_id=1（admin），link/category 幂等可空/默认。
+-- avatar 给真实 URL：铃铛按 avatar 渲染头像，空串会破图（空串仅作为运行时兜底，不作为种子值）。
 -- 按分号朴素切分（S006）：语句内不得含分号字面量。
-INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (1, 1, '', '2026-09-01 09:12', 0, '脚手架已就绪，用 admin / 123456 登录开始', '欢迎', NULL, 'notice');
-INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (2, 1, '', '2026-09-02 14:30', 0, '通知铃支持单条已读、全部已读与清空；广播经 push-broadcast 入 b: 命名空间', '通知铃', NULL, 'notice');
-INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (3, 1, '', '2026-09-03 18:45', 1, '契约改动后重跑 ojm api 生成前端 client 与文档', '契约', NULL, 'notice');
-INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (4, 1, '', '2026-09-04 08:00', 0, '编辑 api/src 下的 api.ts 保存即热更；handler 组支持四层嵌套（oj v0.1.64）', '开发提示', NULL, 'notice');
+INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (1, 1, 'https://avatar.vercel.sh/seed-welcome.svg?text=W', '2026-09-01 09:12', 0, '脚手架已就绪，用 admin / 123456 登录开始', '欢迎', NULL, 'notice');
+INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (2, 1, 'https://avatar.vercel.sh/seed-bell.svg?text=B', '2026-09-02 14:30', 0, '通知铃支持单条已读、全部已读与清空；广播经 push-broadcast 入 b: 命名空间', '通知铃', NULL, 'notice');
+INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (3, 1, 'https://avatar.vercel.sh/seed-contract.svg?text=C', '2026-09-03 18:45', 1, '契约改动后重跑 ojm api 生成前端 client 与文档', '契约', NULL, 'notice');
+INSERT OR IGNORE INTO notifications (id, user_id, avatar, date, is_read, message, title, link, category) VALUES (4, 1, 'https://avatar.vercel.sh/seed-dev.svg?text=D', '2026-09-04 08:00', 0, '编辑 api/src 下的 api.ts 保存即热更；handler 组支持四层嵌套（oj v0.1.64）', '开发提示', NULL, 'notice');

package/templates/api/src/personal-center/profile/api.ts

@@ -0,0 +1,63 @@
+// POST /api/personal-center/profile —— 保存「我的资料」（个人中心表单入库端点）。
+// 只允许改本人行（http.user.id 权威，不接受 body 传 id）；username 全局唯一，
+// 重名 400；avatar 走 upload 端点（multipart），不在此通道。
+const handler = {
+	async post() {
+		const uid = http.user?.id;
+		if (!uid) {
+			json.fail(401, "unauthorized");
+			return;
+		}
+		const b = (http.body ?? {}) as {
+			username?: unknown
+			email?: unknown
+			phoneNumber?: unknown
+			description?: unknown
+		};
+		const patch: Record<string, string> = {};
+		if (b.username != null && String(b.username).trim() !== "") {
+			const username = String(b.username).trim();
+			const dup = await db.table("users").select(["id"]).where({ field: "username", op: "eq", value: username }).all();
+			if (dup.some(r => Number(r.id) !== Number(uid))) {
+				json.fail(400, "username already taken");
+				return;
+			}
+			patch.username = username;
+		}
+		if (b.email != null)
+			patch.email = String(b.email);
+		if (b.phoneNumber != null)
+			patch.phone_number = String(b.phoneNumber);
+		if (b.description != null)
+			patch.description = String(b.description);
+		if (Object.keys(patch).length === 0) {
+			json.fail(400, "nothing to update");
+			return;
+		}
+		try {
+			await db.table("users").update(patch).where({ field: "id", op: "eq", value: Number(uid) }).run();
+			json.ok(null);
+		}
+		catch (e) {
+			json.fail(500, String(e));
+		}
+	},
+};
+
+// 入参：四字段均可选（部分保存允许），类型即字符串。
+handler.post.schema = {
+	body: {
+		type: "object",
+		properties: {
+			username: { type: "string" },
+			email: { type: "string" },
+			phoneNumber: { type: "string" },
+			description: { type: "string" },
+		},
+	},
+};
+
+// 出参：无业务载荷（前端保存后经 user-info 重拉刷新 store）。
+handler.post.response = { type: "null" };
+
+export default handler;

package/templates/api/src/web/user-info/api.ts

@@ -10,7 +10,7 @@ export default {
 			return;
 		}
 		try {
-			const rows = await db.table("users").select(["id", "username", "display_name", "avatar_base64", "email", "must_change"]).where({ field: "id", op: "eq", value: Number(uid) }).all();
+			const rows = await db.table("users").select(["id", "username", "display_name", "avatar_base64", "email", "phone_number", "description", "must_change"]).where({ field: "id", op: "eq", value: Number(uid) }).all();
 			const row = rows[0];
 			if (!row) {
 				json.fail(404, "user not found");
@@ -23,6 +23,8 @@ export default {
 				username: String(row.username),
 				displayName: row.display_name == null ? "" : String(row.display_name),
 				email: String(row.email ?? ""),
+				phoneNumber: row.phone_number == null ? "" : String(row.phone_number),
+				description: row.description == null ? "" : String(row.description),
 				roles: roleRows.map(r => r.role_name),
 				mustChange: Number(row.must_change) === 1,
 				permissions: [],

package/templates/api/tests/fixture.ts

@@ -1,6 +1,14 @@
 // 后端 BDD 夹具：node:sqlite 内存库 + **真实迁移文件**建表，装到 globalThis.db——
 // 与 oj 运行时注入的全局同名同面（query/exec/tx/dialect），service 代码不改一行即可被测。
 // 夹具直接读 api/src/<模块>/migrations/*.sql，与迁移不可能漂移（沿用 oj-wiki 先例）。
+//
+// **构造器边界（架构定论，勿在此夹具里补 table()）**：db.table()/listTables() 等构造器是
+// oj 二进制内的纯 Rust 实现，无 JS 模块可导出，Node 侧垫不出来——本夹具刻意只给
+// {query, exec, tx, dialect}。两层测试的分工因此定型：
+//   · L2（本目录 *.spec.ts）：构造器面用**记录型假 builder**（记 where/orderBy/limit 调用
+//     序列做编排断言）；真 SQL 执行断言走 db.query 直查。
+//   · L1（同目录 *.test.ts，`oj test` 收集）：真 v8 + 真构造器闭环，守 SQL 渲染/过滤/转义
+//     的真执行面（样板见 tests/l1-builder.test.ts；方法论见 devkit oj-test-guide.md）。
 import { createRequire } from "node:module";
 
 const req = createRequire(import.meta.url);
@@ -13,22 +21,6 @@ const SRC = join(dirname(fileURLToPath(import.meta.url)), "..", "src");
 
 export const ADMIN = 1;
 
-/**
- * market_history 同构 DDL：表真源 = 市场方案包自带迁移（oj-market 0002__market_history），
- * 不属平台迁移（installDb 不回放）——需要断言留痕的用例显式执行；守卫语义（表不存在静默跳过）
- * 另有专项用例钉住。
- */
-export const MARKET_HISTORY_DDL = `CREATE TABLE market_history (
-	id INTEGER PRIMARY KEY AUTOINCREMENT,
-	solution TEXT NOT NULL,
-	version TEXT NOT NULL,
-	action TEXT NOT NULL,
-	status TEXT NOT NULL,
-	operator TEXT,
-	message TEXT,
-	created_at INTEGER NOT NULL
-)`;
-
 /** 建内存库 + 注入全局；返回 DatabaseSync 供用例直插数据/断言。 */
 export function installDb(): any {
 	const dbo = new DatabaseSync(":memory:");

package/templates/api/tests/l1-builder.test.ts

@@ -0,0 +1,91 @@
+// L1 回归（`oj test` 收集，*.test.ts；与 vitest 的 *.spec.ts 互不干扰）。
+//
+// 为什么有这类文件：SQL 构造器是 oj 二进制内的纯 Rust 实现，vitest 夹具够不着真
+// builder（架构定论：无 JS 模块可导、不写运行时垫片）——模板 tests/*.spec.ts 只能做
+// L2 记录型断言。**真执行面**（SQL 渲染 / 真过滤 / 真转义）在这里经 oj test 闭环：
+// 真 v8 + 真路由/鉴权 + 真迁移/seed + 真 db + 真构造器（方法论见 devkit oj-test-guide.md）。
+//
+// 覆盖 0.1.81/0.1.82 构造器迁移的关键行为：
+//   ① settings 真构造器（IN + LIMIT）——vitest 侧同源码 5 个用例红海的对照面；
+//   ② demo/todos：whereIf 真跳过（无 keyword 不过滤）+ contains 真渲染（%kw% + 元字符转义）；
+//   ③ notification：join ON 值条件 + UNION ALL + 字面量列 {lit,as} 的真渲染（场景 41 同款）。
+//
+// 登录账号：fixtures 的 l1tester（src/_platform/fixtures/l1-test-user.sql，仅 oj test 灌入）。
+// 不用 seed 的 admin：其 must_change=1（判权端点恒 403）且初始口令 123456 会随用户
+// 首登改密漂移——L1 绑 admin 曾实测 401。l1tester 为 additive 专用账号（must_change=0）。
+//
+// 运行：cd packages/cli/templates/api && ~/.local/share/oj/oj test -c config.yaml -d src -t tests
+
+const L1_USER = { username: "l1tester", password: "l1test1234" };
+const asL1 = async () => ({ Authorization: `Bearer ${await client.login(L1_USER.username, L1_USER.password)}` });
+
+describe("l1：0.1.81/0.1.82 构造器迁移真执行面", () => {
+	it("匿名 login-methods：真构造器（IN + LIMIT 渲染）返回 200 + 方法数组", async () => {
+		const r = await client.get("/system/login-methods");
+		expect(r.status).toBe(200);
+		const body = JSON.parse(r.body);
+		expect(body.code).toBe(0);
+		expect(Array.isArray(body.data.methods)).toBeTruthy();
+		expect(body.data.methods).toContain("local");
+	});
+
+	it("demo/todos 无 keyword：whereIf 真跳过（不发射条件），全量 4 条", async () => {
+		const h = await asL1();
+		const r = await client.get("/demo/todos", { headers: h });
+		expect(r.status).toBe(200);
+		const body = JSON.parse(r.body);
+		expect(body.data.total).toBe(4);
+		expect(body.data.list.length).toBe(4); // L1 expect 无 toHaveLength（契约见 api-manual §9）
+	});
+
+	it("demo/todos keyword=契约：contains 真渲染（%kw%）精确命中 1 条", async () => {
+		const h = await asL1();
+		const r = await client.get(`/demo/todos?keyword=${encodeURIComponent("契约")}`, { headers: h });
+		expect(r.status).toBe(200);
+		const body = JSON.parse(r.body);
+		expect(body.data.total).toBe(1);
+		expect(String(body.data.list[0].title)).toContain("契约");
+	});
+
+	it("demo/todos keyword=%：LIKE 元字符经引擎转义不泛化（0 命中且不炸）", async () => {
+		const h = await asL1();
+		const r = await client.get(`/demo/todos?keyword=${encodeURIComponent("%")}`, { headers: h });
+		expect(r.status).toBe(200);
+		expect(JSON.parse(r.body).data.total).toBe(0);
+	});
+
+	it("notification 列表：join ON 值条件 + UNION + 字面量 scope 列真渲染，按人/广播分流", async () => {
+		const h = await asL1();
+		// 自给自足（oj-test-guide §6 纪律：按自己推的行精确断言，不依赖 seed 的 user_id=1）：
+		// 先清空本人视图，再经真 push 端点各发一条按人 + 一条广播，回来过 list 断言。
+		const clear = await client.post("/notification/notifications/clear", { headers: h });
+		expect(clear.status).toBe(200);
+
+		const pushUser = await client.post("/notification/push", {
+			headers: h,
+			body: JSON.stringify({ title: "L1 按人通知", message: "join ON 值条件 + UNION 真渲染" }),
+		});
+		expect(pushUser.status).toBe(200);
+		const userId = String(JSON.parse(pushUser.body).data.id);
+		expect(userId.startsWith("u:")).toBeTruthy(); // 命名空间 id：按人
+
+		const pushBcast = await client.post("/notification/push-broadcast", {
+			headers: h,
+			body: JSON.stringify({ title: "L1 广播通知", message: "LEFT JOIN 回执 + 字面量 scope 列" }),
+		});
+		expect(pushBcast.status).toBe(200);
+		const bcastId = String(JSON.parse(pushBcast.body).data.id);
+		expect(bcastId.startsWith("b:")).toBeTruthy(); // 命名空间 id：广播
+
+		const r = await client.get("/notification/notifications", { headers: h });
+		expect(r.status).toBe(200);
+		const list = JSON.parse(r.body).data as Array<Record<string, unknown>>;
+		expect(Array.isArray(list)).toBeTruthy();
+		const byId = new Map(list.map(n => [String(n.id), n]));
+		// {lit:"user",as:"scope"} / {lit:"broadcast",...} 经 UNION 落到首列名——两条各带正确作用域
+		expect(byId.get(userId)?.scope).toBe("user");
+		expect(byId.get(bcastId)?.scope).toBe("broadcast");
+		expect(String(byId.get(userId)?.title)).toBe("L1 按人通知");
+		expect(String(byId.get(bcastId)?.title)).toBe("L1 广播通知");
+	});
+});

package/templates/api/tests/lifecycle/installer.spec.ts

@@ -28,7 +28,7 @@ import { acquireTaskLock, commitLockEntry, parseLock, readLock, serializeLock, w
 import { createStateStore } from "../../src/_platform/_lifecycle/state";
 import { getTask, readTasks, redact, sweepTimedOut, writeTask } from "../../src/_platform/_lifecycle/tasks";
 import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
-import { installDb, MARKET_HISTORY_DDL } from "../fixture";
+import { installDb } from "../fixture";
 
 const g = globalThis as any;
 
@@ -979,7 +979,6 @@ describe("market_history 留痕（P1-15a 缺口 A）：install/enable/disable/un
 	}
 
 	it("runInstall 终态（done）落 install 历史（守卫式：随主流程写，失败不阻断）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		const t = await runInstall(makeReq());
 		expect(t.status).toBe("done");
 		const hist = rows("SELECT solution, version, action, status, operator, message FROM market_history");
@@ -989,7 +988,6 @@ describe("market_history 留痕（P1-15a 缺口 A）：install/enable/disable/un
 	});
 
 	it("setEnabled 落 disable/enable 历史（status=success，message 与返回人话一致）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		await seedHistory();
 		const off = await setEnabled({ name: "demo-solution", enabled: false, sharedRoot, lockPath, state, modulesJsonPath });
 		const on = await setEnabled({ name: "demo-solution", enabled: true, sharedRoot, lockPath, state, modulesJsonPath });
@@ -1185,7 +1183,6 @@ describe("P1-16 接线：reconcile 不一致自动修复（重跑 setEnabled）+
 	});
 
 	it("operator 通道：runInstall / setEnabled 的 operator 落 market_history（缺省 null 语义不变）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		await writeLock(lockPath, { "demo-solution": "0.1.0", "auth": "0.1.0" });
 		await state.write({ solutions: { "demo-solution": { version: "0.1.0", enabled: true, installedAt: 1000 } } });
 		await fsp.mkdir(join(sharedRoot, "demo-solution-0.1.0"), { recursive: true });

package/templates/api/tests/lifecycle/market-api.spec.ts

@@ -28,7 +28,7 @@ import { getTask, writeTask } from "../../src/_platform/_lifecycle/tasks";
 import { createTrustStore } from "../../src/_platform/_lifecycle/trust";
 import { invalidateAllUsers } from "../../src/_platform/_shared/service/infra/access";
 import { createMarketApi, marketEnv, parseVersionsJson, versionsJsonPathOf } from "../../src/_platform/market/api";
-import { installDb, MARKET_HISTORY_DDL } from "../fixture";
+import { installDb } from "../fixture";
 
 function hexToBytes(hex: string): Uint8Array {
 	const out = new Uint8Array(hex.length / 2);
@@ -680,7 +680,6 @@ describe("GET index（CDN bundles.yaml no-cache 拉取 + 本地 state 对比）"
 	});
 
 	it("operator 回落 history 行（P2-11：最近一次 install 动作的 operator；表缺失/无行 → null 不炸）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		dbo.prepare("insert into market_history (solution, version, action, status, operator, message, created_at) values (?, ?, ?, ?, ?, ?, ?)")
 			.run("demo-solution", "0.1.0", "install", "done", "alice", "", 1700000000);
 		const api = createMarketApi(makeEnv());
@@ -917,7 +916,6 @@ describe("P1-16 接线：marketEnv 生产口径 / exec opts 转发 / operator
 	});
 
 	it("operator 通道：install/enable 端点按 http.user.id 反查 username 落 market_history（uninstall 同款反查）", async () => {
-		dbo.exec(MARKET_HISTORY_DDL);
 		// 预置「已装」最小形态（enable 用例同款：单条目禁用会触发空锁拒启，S1-1.2）
 		await writeLock(join(sharedRoot, "manifests.yaml"), { "demo-solution": "0.1.0", "other": "1.0.0" });
 		const state = await createStateStore(join(sharedRoot, ".solutions", "state.yaml"));

package/templates/api/tests/lifecycle/steps-fs.spec.ts

@@ -514,7 +514,7 @@ describe("checkModuleManifest（C2-31 安装期复核纯函数：C2 manifest ↔
 	const c2 = { name: "demo-solution", version: "0.1.0", summary: "演示方案 Demo — émoji 🎉" };
 	const native = { name: "demo-solution", desc: "演示方案 Demo — émoji 🎉", version: "0.1.0" };
 
-	it("合法：desc === summary（多字节逐字相等）、name/version 三方一致、七键之内 → ok", () => {
+	it("合法：name/version 三方一致、desc 非空、七键之内 → ok", () => {
 		expect(checkModuleManifest(c2, native, "demo-solution", "0.1.0")).toEqual({ ok: true });
 	});
 
@@ -535,10 +535,9 @@ describe("checkModuleManifest（C2-31 安装期复核纯函数：C2 manifest ↔
 		expect(r.ok).toBe(false);
 	});
 
-	it("desc !== summary → 拒（构建期映射被篡改/上游不一致）", () => {
+	it("desc !== summary → 放行（等值要求已于 2026-10-21 移除：desc 只是模块描述，非安全边界）", () => {
 		const r = checkModuleManifest(c2, { ...native, desc: "另一个描述" }, "demo-solution", "0.1.0");
-		expect(r.ok).toBe(false);
-		expect(!r.ok && r.message).toContain("desc");
+		expect(r.ok).toBe(true);
 	});
 
 	it("name 或 version 与包身份不一致 → 拒", () => {
@@ -613,11 +612,9 @@ describe("extract C2-31 安装期复核（B-11：api 段声明与包内原生清
 		expect(r.message).toContain("C2-31");
 	});
 
-	it("包内原生清单 desc !== summary → C2-31 拒（映射被篡改）", async () => {
+	it("包内原生清单 desc !== summary → 放行（等值校验已移除）", async () => {
 		await seedBundle({ nativeManifest: { name: "demo-solution", desc: "另一个描述", version: "0.1.0" } });
 		const r = await extract(exCtx({ manifest: c2Manifest(), exec: realTarExec() }));
-		expect(r.ok).toBe(false);
-		expect(r.retryable).toBe(false);
-		expect(r.message).toContain("C2-31");
+		expect(r.ok).toBe(true);
 	});
 });