@sidady/dsh-steward 0.9.14 → 0.9.16

package/smoke.mjs

@@ -6,7 +6,7 @@
  * probes the fail-soft path (unreadable directories) and the real machine
  * (best-effort) to confirm the parser works on actual crash logs.
  */
-import { collectReport, parseBootFailure } from './lib/report.js';
+import { collectReport, parseBootFailure, dutyBriefing, analyzeUpgrades, collectFreeLaneHealth } from './lib/report.js';
 import path from 'node:path';
 import fs from 'node:fs';
 import { fileURLToPath } from 'node:url';
@@ -1329,8 +1329,9 @@ check('the cause survives into finding data for the panel', !!liveCrash && liveC
   const clientLines = clientSrc.split("\n");
   // 审计/趋势里存的是 UTC ISO；切片或把 T 换成空格都会原样把 UTC 贴给用户
   // （东八区差 8 小时）。本地化必须走 localStamp，不能用字符串处理假装。
-  const TQ = String.fromCharCode(39);
-  const naive = clientLines.filter((l) => l.includes(".replace(") && l.includes(TQ + "T" + TQ + ", " + TQ + " " + TQ));
+  const TQ = String.fromCharCode(39), TDQ = String.fromCharCode(34);
+  const swap = (q) => q + "T" + q + ", " + q + " " + q;
+  const naive = clientLines.filter((l) => l.includes(".replace(") && (l.includes(swap(TQ)) || l.includes(swap(TDQ))));
   check("no render path formats a timestamp by swapping the ISO T", naive.length === 0, naive.map((l) => l.trim().slice(0, 70)).join(" | "));
   check("the local-time formatter exists", clientSrc.includes("function localStamp("));
   const uses = (clientSrc.match(/localStamp\(/g) || []).length;
@@ -1427,6 +1428,293 @@ check('the cause survives into finding data for the panel', !!liveCrash && liveC
       && /wiring\.via\[keys\.join\(','\)\] = 'one-shot'/.test(idxSrc));
 }
 
+
+// — v0.9.15: 职能缺口补齐（P0 修真 bug / P1 误报反馈 / P2 趋势与直达）—
+{
+  const clientSrc = fs.readFileSync(path.join(here, "lib", "client.js"), "utf8");
+  const indexSrc = fs.readFileSync(path.join(here, "lib", "index.js"), "utf8");
+  const actionsSrc = fs.readFileSync(path.join(here, "lib", "actions.js"), "utf8");
+  const reportSrc = fs.readFileSync(path.join(here, "lib", "report.js"), "utf8");
+  const clientLines = clientSrc.split(String.fromCharCode(10));
+
+  // P0-a: 保存时间的本地化不许再用「把 T 换成空格」的写法，两种引号都查。
+  const SQ = String.fromCharCode(39), DQ = String.fromCharCode(34);
+  const swaps = [SQ, DQ].map((q) => q + "T" + q + ", " + q + " " + q);
+  const naive = clientLines.filter((l) => l.includes(".replace(") && swaps.some((s) => l.includes(s)));
+  check("P0-a no ISO-T swap survives in either quote style", naive.length === 0, naive.map((l) => l.trim().slice(0, 60)).join(" | "));
+  const savedLine = clientLines.find((l) => l.includes("setSaved(") && l.includes("res.savedAt"));
+  check("P0-a the saved-at display calls localStamp", !!savedLine && savedLine.includes("localStamp("));
+
+  // P0-b: autoScanMinutes 必须是活设置，不是写死的 10 分钟。
+  check("P0-b the client reads autoScanMinutes from the report payload", clientSrc.includes("cache.autoScanMinutes"));
+  check("P0-b the hardcoded 10-minute threshold is gone", !clientSrc.includes("10 * 60 * 1000"));
+  check("P0-b the host sends autoScanMinutes from settings", indexSrc.includes("autoScanMinutes: settingValue(currentSettings(), " + SQ + "ui.autoScanMinutes" + SQ + ")"));
+
+  // P1: 误报反馈是一个有数据文件、可 plan/execute、能影响评分、可撤销的真动作。
+  check("P1 feedback has its own data file", indexSrc.includes("feedback: path.join(dataDir(), " + SQ + "feedback.json" + SQ + ")"));
+  check("P1 plan handles feedback and unfeedback", actionsSrc.includes("kind === " + SQ + "feedback" + SQ + " || kind === " + SQ + "unfeedback" + SQ));
+  check("P1 execute persists the feedback list", actionsSrc.includes("writeJson(deps.feedbackFile, list)"));
+  check("P1 report marks falsePositive from options.feedback", reportSrc.includes("f.falsePositive = feedbackIds.has(f.id)"));
+  check("P1 a false positive loses the actionable bonus", reportSrc.includes("&& !f.falsePositive && !gateBlocked"));
+  check("P1 the score states the false-positive penalty", reportSrc.includes("用户标记判错 -40"));
+  check("P1 the panel offers a 判错 button", clientSrc.includes("这条判错了"));
+
+  // P2-a: 趋势结论由服务端算好人话，恢复/连续恶化会主动说。
+  check("P2-a summarizeTrend is exported from report.js", reportSrc.includes("export function summarizeTrend("));
+  check("P2-a collectReport returns a trendVerdict", reportSrc.includes("trendVerdict,"));
+  check("P2-a the text report states the trend", indexSrc.includes("趋势: ${report.trendVerdict.text}"));
+  check("P2-a toasts fire on recovery",
+    clientSrc.includes("tv.state === " + SQ + "recovered" + SQ + " ||") && clientSrc.includes("pushToast({ kind: " + SQ + "trend" + SQ));
+  check("P2-a ToastCard can paint an ok tone", clientSrc.includes("t.severity === " + SQ + "ok" + SQ + " ? C.ok"));
+  check("P2-a AuditTab prints the trend verdict", clientSrc.includes("趋势结论 · "));
+
+  // P2-b: 不假造直达动作；运行期自检结果要给用户看见。
+  check("P2-b the phantom model-default shortcut is gone", !clientSrc.includes("" + SQ + "model-health" + SQ + ": " + SQ + "model-default" + SQ) && clientSrc.includes("" + SQ + "backup-freshness" + SQ + ": " + SQ + "backup" + SQ));
+  check("P2-b the host sends wiring with the report", indexSrc.includes("wiring: { ...wiring }"));
+  check("P2-b the panel shows the wiring outcome", clientSrc.includes("接口已挂上"));
+}
+
+{
+  // ---- v0.9.16: L0 当班环（只读、可观测、绝不自动执行） ----
+  const dutyIndex = fs.readFileSync(path.join(here, 'lib', 'index.js'), 'utf8');
+  const dutyClient = fs.readFileSync(path.join(here, 'lib', 'client.js'), 'utf8');
+  const dutyReport = fs.readFileSync(path.join(here, 'lib', 'report.js'), 'utf8');
+
+  const mkDutyReport = (findings, level, text) => ({
+    summary: { level: level || 'warning', counts: { critical: 0, warning: 2, info: 3, muted: 0 } },
+    trendVerdict: text ? { state: 'stable', text } : null,
+    findings: findings || [],
+  });
+  const dOk = { id: 'a', severity: 'warning', recommendation: '去动作中心看看 A', muted: false, falsePositive: false };
+  const dMuted = { id: 'b', severity: 'info', recommendation: '这条被静音', muted: true, falsePositive: false };
+  const dFalse = { id: 'c', severity: 'critical', recommendation: '这条被判错', muted: false, falsePositive: true };
+  const dB = dutyBriefing(mkDutyReport([dOk, dMuted, dFalse]), { at: '2026-11-12T22:00:00.000Z', trigger: 'boot' });
+  check('dutyBriefing is pure: at + trigger pass through unchanged', dB.at === '2026-11-12T22:00:00.000Z' && dB.trigger === 'boot', JSON.stringify({ at: dB.at, trigger: dB.trigger }));
+  check('dutyBriefing records state=observe-only and executed=0', dB.state === 'observe-only' && dB.executed === 0);
+  check('dutyBriefing excludes muted and false-positive findings', dB.suggestions.length === 1 && dB.suggestions[0].id === 'a', JSON.stringify(dB.suggestions));
+  check('dutyBriefing writes a human "seen" line', typeof dB.seen === 'string' && dB.seen.indexOf('3 条发现') >= 0 && dB.seen.indexOf('1 条仍在报') >= 0, dB.seen);
+  check('dutyBriefing explains WHY nothing was executed', typeof dB.action === 'string' && dB.action.indexOf('未执行任何动作') >= 0 && dB.action.indexOf('1 条处置建议') >= 0, dB.action);
+  check('dutyBriefing prefers the server-computed trend verdict', dutyBriefing(mkDutyReport([], 'warning', '连续 2 次体检都在变差')).verdict.indexOf('连续 2 次') >= 0);
+  const dSame1 = dutyBriefing(mkDutyReport([], 'ok'), { at: '2026-11-12T22:00:00.000Z', trigger: 'scheduled' });
+  const dSame2 = dutyBriefing(mkDutyReport([], 'ok'), { at: '2026-11-12T22:00:00.000Z', trigger: 'scheduled' });
+  check('dutyBriefing is deterministic for identical input', JSON.stringify(dSame1) === JSON.stringify(dSame2));
+  const manyF = Array.from({ length: 9 }, (_, i) => ({ id: 'f' + i, severity: 'info', recommendation: '建议' + i }));
+  check('dutyBriefing caps the prepared suggestions at 6', dutyBriefing(mkDutyReport(manyF)).suggestions.length === 6);
+
+  // 服务端：周期当班 + 重入/去抖 + 三处返回体带 duty + 绝不自动执行
+  check('L0 duty loop is driven by setInterval', dutyIndex.indexOf('setInterval(dutyTick') >= 0);
+  // 裸定时器在 fiber 被 HMR 换掉 / 停用插件时不会停，每重载一次多一个永不停止的当班环。
+  // 钉死它挂在 ctx.effect 上并且 dispose 里 clearInterval。
+  // 用正则钉「完整 label」：indexOf 会被 'L0 duty-DISABLED' 之类前缀命中而永远绿（v0.9.15 的教训）。
+  const dutyEffectLabel = /'dsh-steward: L0 duty'/.exec(dutyIndex);
+  const dutyEffectAt = dutyEffectLabel ? dutyEffectLabel.index : -1;
+  const dutyEffectBlock = dutyEffectAt >= 0 ? dutyIndex.slice(dutyIndex.lastIndexOf('ctx.effect(', dutyEffectAt), dutyEffectAt) : '';
+  check('the duty timer is owned by a ctx.effect with a clearInterval dispose',
+    dutyEffectAt >= 0
+      && dutyEffectBlock.indexOf('setInterval(dutyTick') >= 0
+      && dutyEffectBlock.indexOf('return () =>') >= 0
+      && dutyEffectBlock.indexOf('clearInterval(dutyTimer)') >= 0,
+    dutyEffectBlock.slice(0, 140));
+  check('the duty interval follows ui.autoScanMinutes', dutyIndex.indexOf("settingValue(currentSettings(), 'ui.autoScanMinutes')") >= 0 && dutyIndex.indexOf('dutyIntervalMs') >= 0);
+  check('the duty loop has a re-entry guard', dutyIndex.indexOf('if (dutyRunning) return null') >= 0);
+  check('the duty loop has a debounce', dutyIndex.indexOf('Date.now() - dutyLastAt < 1000') >= 0);
+  const rdStart = dutyIndex.indexOf('async function runDuty(');
+  const rdEnd = dutyIndex.indexOf('const hub = createActionHub(', rdStart);
+  const rdBody = rdStart >= 0 && rdEnd > rdStart ? dutyIndex.slice(rdStart, rdEnd) : '';
+  check('runDuty reuses the read-only report and never calls plan/execute', rdBody.indexOf("await run('report', {})") >= 0 && rdBody.indexOf('hub.plan(') < 0 && rdBody.indexOf('hub.execute(') < 0, rdBody.slice(0, 160));
+  check('the duty ledger is persisted to duty.jsonl', dutyIndex.indexOf("duty: path.join(dataDir(), 'duty.jsonl')") >= 0 && dutyIndex.indexOf('io.appendJsonl(files.duty, briefing)') >= 0);
+  // readDutyLog 的 split 参数必须真的是「换行符」。写成 '\\n'（双反斜杠）会永远读不出
+  // 分班记录，而静态判据只看得见「有 split」。这里把源码里的字面量求值，钉死它等于一个换行符。
+  const dutySplitLine = dutyIndex.split('\n').find((l) => l.indexOf('raw.split(') >= 0 && l.indexOf('DUTY_LOG_CAP') >= 0) || '';
+  const dsi = dutySplitLine.indexOf('raw.split(') + 'raw.split('.length;
+  const dsArg = dutySplitLine.slice(dsi);
+  const dsQuote = dsArg[0];
+  const dsEnd = dsQuote ? dsArg.indexOf(dsQuote, 1) : -1;
+  const dsExpr = dsEnd > 0 ? dsArg.slice(0, dsEnd + 1) : '';
+  let dsVal = null;
+  try { dsVal = Function('return ' + dsExpr)(); } catch { /* 求值失败就让它红 */ }
+  check('readDutyLog splits on a real newline (runtime-evaluated), not a literal backslash-n', dsVal === '\n' && dsVal.length === 1, JSON.stringify({ dsExpr, len: dsVal && dsVal.length }));
+  check('ping / report / audit all expose duty', (dutyIndex.match(/duty: await dutySnapshot\(\)/g) || []).length === 3);
+  check('the boot checkup goes through runDuty (not a bare report)', dutyIndex.indexOf("runDuty('boot')") >= 0);
+
+  // 面板：当班状态 + 当班台账（服务端算好人话、客户端只渲染）
+  check('the panel shows the duty status line', dutyClient.indexOf('当班 · ') >= 0 && dutyClient.indexOf('cache.duty') >= 0);
+  check('the audit tab shows the duty ledger', dutyClient.indexOf('当班台账 · ') >= 0 && dutyClient.indexOf('data.duty.suggestions') >= 0);
+  check('the panel caches duty from report responses', (dutyClient.match(/cache\.duty = data\.duty/g) || []).length >= 2);
+  check('the duty briefing is computed in report.js, not in client.js', dutyReport.indexOf('export function dutyBriefing(') >= 0 && dutyClient.indexOf('function dutyBriefing(') < 0);
+
+  // 版本与文档
+  check('v0.9.16 version is consistent', JSON.parse(fs.readFileSync(path.join(here, 'package.json'), 'utf8')).version === '0.9.16');
+  check('README documents the L0 duty loop', fs.readFileSync(path.join(here, 'README.md'), 'utf8').indexOf('v0.9.16（L0 当班环') >= 0);
+}
+
+{
+  // ---- 白色按钮回归：primary 按钮必须反相，绝不能被调用方的 tone 顶掉 ----
+  // C.text 与 C.solid 都映射到 --dsw-alias-label-primary，深色主题下解析成白色；
+  // 一旦 color 用了 tone，primary 就变成白底白字 = 看不见字的纯白矩形。
+  const wbClient = fs.readFileSync(path.join(here, 'lib', 'client.js'), 'utf8');
+  check('Btn forces the inverted foreground for primary buttons',
+    wbClient.indexOf('color: props.primary && !props.disabled ? C.on : (props.tone || C.text)') >= 0);
+  check('the old tone-wins colour expression is gone',
+    wbClient.indexOf('color: props.tone || (props.primary') < 0);
+  check('no primary button call site passes a tone',
+    (wbClient.match(/primary:\s*true\s*,\s*tone:/g) || []).length === 0);
+  check('the finding go-to-action button stays a plain primary button',
+    wbClient.indexOf('h(Btn, { onClick: props.onGo, primary: true }') >= 0);
+}
+
+{
+  // — v0.9.16（未发布）：升级利弊分析 (m13463) + 免费通道运行期健康 (m13398) —
+  const AU = analyzeUpgrades;
+  const PKG_HI = { 'dsh-x': { latest: '2.0.0', versions: ['1.0.0', '2.0.0'], engines: { dsh: '^0.3.0' } } };
+  const hi = AU([{ name: 'dsh-x', installed: '1.0.0', latest: '2.0.0' }], PKG_HI, '0.2.2-rc.1');
+  check('upgrade advice: a host-version mismatch is high risk', hi.rows[0].risk === 'high', JSON.stringify(hi.rows[0]));
+  check('upgrade advice: high risk names the boot consequence', hi.rows[0].reasons.join(' ').includes('起不来'), JSON.stringify(hi.rows[0].reasons));
+  const md = AU([{ name: 'dsh-y', installed: '1.0.0', latest: '2.0.0-beta.1' }], { 'dsh-y': { latest: '2.0.0-beta.1', versions: ['1.0.0', '2.0.0-beta.1'] } }, '0.2.2-rc.1');
+  check('upgrade advice: a prerelease target is medium risk', md.rows[0].risk === 'medium', JSON.stringify(md.rows[0]));
+  const sk = AU([{ name: 'dsh-z', installed: '1.0.0', latest: '9.0.0' }], { 'dsh-z': { latest: '9.0.0', versions: ['1.0.0', '2.0.0', '3.0.0', '4.0.0', '5.0.0', '6.0.0', '9.0.0'] } }, '0.2.2-rc.1');
+  check('upgrade advice: skipping >=5 releases is medium risk', sk.rows[0].risk === 'medium' && sk.rows[0].skipped >= 5, JSON.stringify(sk.rows[0]));
+  const lo = AU([{ name: 'dsh-w', installed: '1.0.0', latest: '1.0.1' }], { 'dsh-w': { latest: '1.0.1', versions: ['1.0.0', '1.0.1'] } }, null);
+  check('upgrade advice: a plain small step is low risk', lo.rows[0].risk === 'low', JSON.stringify(lo.rows[0]));
+  check('upgrade advice: text states benefits without inventing a changelog', hi.text.includes('优点') && hi.text.includes('不编造具体修复内容'), hi.text);
+  check('upgrade advice: text states the boot risk', hi.text.includes('boot'), hi.text);
+  check('upgrade advice: recommendation is read-only, no auto-upgrade', hi.recommendation.includes('不代升级') && hi.recommendation.includes('逐个'), hi.recommendation);
+  check('upgrade advice: toast words are written by the server', hi.toastTitle.includes('风险') && hi.toastBody.includes('优点'), hi.toastTitle);
+  const hi2 = AU([{ name: 'dsh-x', installed: '1.0.0', latest: '2.0.0' }], PKG_HI, '0.2.2-rc.1');
+  check('upgrade advice: fingerprint is a stable 8-hex digest', /^[0-9a-f]{8}$/.test(hi.fingerprint) && hi.fingerprint === hi2.fingerprint, hi.fingerprint);
+  const fpA = AU([{ name: 'a', installed: '1.0.0', latest: '2.0.0' }, { name: 'b', installed: '1.0.0', latest: '3.0.0' }], {}, '0.2.2-rc.1');
+  const fpB = AU([{ name: 'b', installed: '1.0.0', latest: '3.0.0' }, { name: 'a', installed: '1.0.0', latest: '2.0.0' }], {}, '0.2.2-rc.1');
+  check('upgrade advice: fingerprint is order-independent', fpA.fingerprint === fpB.fingerprint, fpA.fingerprint + ' vs ' + fpB.fingerprint);
+  const emp = AU([], {}, null);
+  check('upgrade advice: no outdated items yields count 0 but a fingerprint', emp.outdatedCount === 0 && /^[0-9a-f]{8}$/.test(emp.fingerprint), emp.fingerprint);
+  const AVAIL = JSON.stringify({ version: 1, at: 0, results: {
+    'model-a': { state: 'available', detail: 'OpenCode free inference requires a local Bun executable', at: '2026-11-13T12:00:00Z', stale: true },
+    'model-b': { state: 'unknown', detail: 'upstream request failed', at: '2026-11-13T13:00:00Z', stale: true },
+    'model-c': { state: 'available', at: '2026-11-13T14:00:00Z', stale: true },
+  } });
+  const flIo = { readDir: () => [], stat: () => ({ __error: 'x' }), readText: (f) => (f.endsWith('availability.json') ? AVAIL : { __error: 'no' }) };
+  const fl = collectFreeLaneHealth({ dshHome: 'H' }, flIo);
+  check('free lane: contradictory available-but-failing is caught', fl.available && fl.contradictory.length === 1 && fl.contradictory[0].name === 'model-a', JSON.stringify(fl));
+  check('free lane: both detail-bearing models are collected as failing', fl.failing.length === 2, JSON.stringify(fl.failing));
+  check('free lane: allStale is true when every entry is stale', fl.allStale === true && fl.checked === 3, JSON.stringify(fl));
+  check('free lane: newestAt is the max probe timestamp', fl.newestAt === '2026-11-13T14:00:00Z', String(fl.newestAt));
+  const flMiss = collectFreeLaneHealth({ dshHome: 'H' }, { readText: () => ({ __error: 'ENOENT' }) });
+  check('free lane: a missing private ledger is a silent, observable skip', flMiss.available === false && flMiss.failing.length === 0, JSON.stringify(flMiss));
+  function flDataIo(availText) {
+    const base = dataIo();
+    return { readDir: base.readDir, stat: base.stat,
+      readText(file) { return file.endsWith('availability.json') ? availText : base.readText(file); } };
+  }
+  const flReport = collectReport({
+    now: new Date('2026-11-09T13:00:00Z'), bootedAt: new Date('2026-11-09T00:00:00Z'),
+    env: { APPDATA: 'C:\\\\Users\\\\demo\\\\AppData\\\\Roaming', DSH_HOME: 'C:\\\\Users\\\\demo\\\\.dsh' },
+    platform: 'win32', profileDirs: ['C:\\\\p'], io: flDataIo(AVAIL),
+  });
+  check('free lane: report surfaces a read-only info finding', flReport.findings.some((f) => f.id === 'free-lane-health'), JSON.stringify(flReport.errors));
+  check('free lane: an optional signal adds NO coverage source', flReport.coverage.sourcesTotal === 7, JSON.stringify(flReport.coverage));
+  check('free lane: reading the private ledger adds no collection error', !flReport.errors.some((e) => String(e.step || '').includes('free-lane')), JSON.stringify(flReport.errors));
+  check('free lane: report body exposes freeLane for observability', !!(flReport.freeLane && flReport.freeLane.available === true), JSON.stringify(flReport.freeLane));
+  check('free lane: with no ledger the report shows a skip, not a finding', !!(dataReport.freeLane && dataReport.freeLane.available === false) && !dataReport.findings.some((f) => f.id === 'free-lane-health'), JSON.stringify(dataReport.freeLane));
+  check('upgrade advice: report.updates.advice is present with a count', !!(flReport.updates && flReport.updates.advice && flReport.updates.advice.outdatedCount === 2), JSON.stringify(flReport.updates && flReport.updates.advice));
+  const pu = flReport.findings.find((f) => f.id === 'plugin-updates');
+  check('upgrade advice: plugin-updates detail carries the analysis', !!(pu && pu.detail.includes('优点') && pu.detail.includes('不编造')), pu && pu.detail);
+  check('upgrade advice: plugin-updates recommendation came from advice', !!(pu && pu.recommendation.includes('不代升级')), pu && pu.recommendation);
+  const vbClient = fs.readFileSync(path.join(here, 'lib', 'client.js'), 'utf8');
+  check('upgrade toast: client reads report.updates.advice', vbClient.includes('report.updates.advice') && vbClient.includes("'version-' + ua.fingerprint"));
+  check('upgrade toast: the version toast is gated and de-duplicated', vbClient.includes("toastConfig.mode !== 'off'") && vbClient.includes('!toastedIds.has(vkey)'));
+  const vbReport = fs.readFileSync(path.join(here, 'lib', 'report.js'), 'utf8');
+  check('upgrade advice: collectUpdates takes hostVersion and returns advice', vbReport.includes('export function collectUpdates(paths, io, errors, hostVersion)') && vbReport.includes('analyzeUpgrades(outdated, packages, hostVersion)'));
+  check('free lane: reads only the one private ledger, no error/coverage key', vbReport.includes("'our-free-model', 'availability.json'") && !vbReport.includes("step: 'free-lane'"));
+}
+
+// — v0.9.16（未发布）右侧栏 tab 正文修复：静态 + 运行期判据 —
+{
+  const rightSrc = fs.readFileSync(path.join(here, 'lib', 'client.js'), 'utf8');
+
+  check('right tab body is registered at the top level of mountRight',
+    rightSrc.includes("rightDisposers.push(ctx.slots.inject('sidebar.right.pane.tab'") &&
+    !rightSrc.includes('const disposers = [];'));
+  check('mountRight has an idempotent guard (rightMounted)',
+    rightSrc.includes('if (rightMounted) return;'));
+  check('toast overlay is registered via its own ctx.effect, not the entry disposer list',
+    rightSrc.includes("'dsh-steward: toast overlay'") &&
+    !rightSrc.includes("currentDisposers.push(ctx.slots.inject('shell.overlay'"));
+  check('scoped ctx effect owns the right tab type lifecycle',
+    rightSrc.includes('c.effect(() => {') && rightSrc.includes("'dsh-steward: right tab type'"));
+  check('ui.entry keeps its three values and per-value mount decisions',
+    rightSrc.includes("entry !== 'right'") && rightSrc.includes("entry !== 'left'") &&
+    rightSrc.includes("v === 'left' || v === 'right' || v === 'both'"));
+}
+
+// 运行期：把真正的 apply() body 抠出来，用假 Cordis ctx 跑一遍「both → settings=right」重挂，
+// 数一数右侧正文槽位到底被注册/拆掉了几次。静态判据看不出的二次重挂竞态，这里能看出来。
+await (async () => {
+  let R = { error: null, bodyCount: -1, bodyLive: false, toastCount: -1, toastLive: false, leftLive: -1 };
+  try {
+    const src = fs.readFileSync(path.join(here, 'lib', 'client.js'), 'utf8');
+    const head = '      apply(ctx) {';
+    const tail = '      },' + String.fromCharCode(10) + '    };' + String.fromCharCode(10) + '  },' + String.fromCharCode(10) + '});';
+    const hs = src.indexOf(head);
+    const ts = src.lastIndexOf(tail);
+    if (hs < 0 || ts <= hs) throw new Error('apply body anchors not found');
+    const bodyText = src.slice(hs + head.length, ts);
+
+    const regs = [];
+    const live = new Set();
+    const slots = {
+      inject: (name, factory) => {
+        const reg = factory();
+        return () => { live.delete(reg); };
+      },
+      register: (opts) => {
+        const reg = { slot: opts && opts.name, key: opts && (opts.key || opts.id) };
+        regs.push(reg);
+        live.add(reg);
+        return reg;
+      },
+    };
+    const scoped = {
+      slots,
+      sidebarRightTabs: { register: () => () => {} },
+      effect: (fn) => { fn(); return () => {}; },
+      get: () => undefined,
+    };
+    const ctx = {
+      slots,
+      effect: (fn) => { fn(); return () => {}; },
+      inject: (deps, cb) => { cb(scoped); return () => {}; },
+      get: () => undefined,
+    };
+    const call = () => Promise.resolve({ settings: { ui: { entry: 'right' } } });
+    const prelude = 'var ENTRY_APPLIER = null; var PANEL_NAVIGATOR = null; var PANEL_ACK = null;' + String.fromCharCode(10);
+    const run = new Function(
+      'ctx', 'PANEL_ID', 'Panel', 'PanelIcon', 'h', 'ToastHost', 'call',
+      prelude + bodyText
+    );
+    run(ctx, 'dsh-steward', function () {}, function () {}, function () {}, function () {}, call);
+    await new Promise((resolve) => setTimeout(resolve, 0));
+
+    const bodies = regs.filter((r) => r.slot === 'sidebar.right.pane.tab' && r.key === 'dsh-steward');
+    const toasts = regs.filter((r) => r.slot === 'shell.overlay');
+    const left = regs.filter((r) => r.slot === 'sidebar.panellist' || r.slot === 'main');
+    R.bodyCount = bodies.length;
+    R.bodyLive = bodies.length === 1 && live.has(bodies[0]);
+    R.toastCount = toasts.length;
+    R.toastLive = toasts.length === 1 && live.has(toasts[0]);
+    R.leftLive = left.filter((r) => live.has(r)).length;
+  } catch (e) {
+    R.error = String(e);
+  }
+  const why = R.error || JSON.stringify(R);
+  check('runtime: exactly one right-tab body registration survives a settings-driven remount',
+    !R.error && R.bodyCount === 1, why);
+  check('runtime: the right-tab body stays live after the remount',
+    !R.error && R.bodyLive === true, why);
+  check('runtime: the toast overlay stays live after the remount',
+    !R.error && R.toastLive === true, why);
+  check('runtime: ui.entry=right drops the left/main entries',
+    !R.error && R.leftLive === 0, why);
+})();
 console.log('');
 console.log(`RESULT: ${pass} passed, ${fail} failed`);
 process.exit(fail === 0 ? 0 : 1);