dsh-config-manager 0.2.3 → 0.3.0

package/lib/sync/sync-engine.js

@@ -22,6 +22,7 @@ import path from 'node:path';
 import { createAdapters } from '../adapters/index.js';
 import { defaultSecretScanner } from '../core/exporter.js';
 import { Importer } from '../core/importer.js';
+import { DEFAULT_ROLLBACK_ON_ERROR } from '../core/import-defaults.js';
 // issue #91：只读预览与基线 hash 的口径判定（本地源插件在预览里不会被 npm pack）
 import { isLocalPluginSpec } from '../core/local-plugin-pack.js';
 import { isFileSection, SECTION_FILE_PREFIXES, SECTION_JSON_PATHS } from '../schema/config.js';
@@ -34,7 +35,7 @@ import { createSnapshotFs, joinFs } from './fs.js';
 import { writeSnapshotToDir } from './layout.js';
 import { credentialsMapFromYaml, decryptCredentialsPayload, decryptSectionsPayload, encryptCredentialsPayload, encryptSectionsPayload, } from './snapshot-crypto.js';
 import { OPT_IN_SYNC_SECTIONS } from './sync-selection.js';
-import { nextSessionTombstones, sessionUnitIdsOfSection, stripTombstonedUnits } from './session-tombstones.js';
+import { listRemoteSnapshotIndex, planSessionBookkeeping, remoteTombstonesOf, stripTombstonedSessionsInPlace, } from './session-tombstones.js';
 import { DEFAULT_RETENTION_POLICY, selectPruneCandidatesByPolicy } from './retention-policy.js';
 import { hashSection, loadSyncState, resolveDeviceIdentity, saveSyncState } from './sync-state.js';
 import { isEncryptedSections, PROBE_UNSUPPORTED_CODE, SyncTransportError } from './transport.js';
@@ -42,8 +43,9 @@ import { msgOf, zhMsg } from '../core/messages.js';
 import { engineMsg } from './messages.js';
 import { DEFAULT_ANCESTOR_KEEP, pruneAncestors, tryLoadAncestor, writeAncestor, writeEncryptedAncestor } from './ancestor.js';
 import { merge as mergeSections } from './merge.js';
+import { previewTextOf } from './merge-preview-text.js';
+import { gcSkipWarning, readGcSkipCode, reportGcSkipOnce } from './gc-skip.js';
 import { classifyMergePlan } from './risk.js';
-import { redact } from '../security/redaction.js';
 import { registerMessageCatalog } from '../core/engine-locale.js';
 import { createSnapshot, selectPruneCandidates } from '../core/backup.js';
 import { rollback } from '../core/rollback.js';
@@ -58,6 +60,7 @@ import { FileSnapshotStore } from '../core/backup.js';
 const zh = {
     'sync.pushRemoteAdvanced': '远端最新快照 {remote} 与本地基线 {base} 不一致：本次推送未执行（远端未写入、基线未改动）。请先同步远端改动；确认要用本机覆盖远端时，再显式选择强制推送。',
     'sync.pushAdvanceCheckFailed': '无法确认远端是否已被其它设备推进（{reason}）：本次推送按原样继续',
+    'sync.sessionTombstonesInherited': '已从远端快照继承 {count} 条会话删除墓碑：删除继续跨设备传播（本机数据不动）',
     'sync.applyMergeResolutionsNoImporter': 'applyMergeResolutions: SyncEngine 缺少 importer（需在 options 中注入）',
     'sync.mergePendingConflicts': '仍有 {count} 个分区未裁决（{sections}）：已裁决的部分已写入本机，但基线不推进，冲突下一轮会重新出现',
     'sync.baselineRexportFailed': '写回成功但重新导出本机分区失败（{sections}）：无法证明基线与本机一致，本次**不记基线**（远端指针保持原值，下一轮重新合并收敛）',
@@ -65,47 +68,12 @@ const zh = {
 const en = {
     'sync.pushRemoteAdvanced': 'The newest remote snapshot {remote} differs from the local baseline {base}: this push did not run (nothing written remotely, baseline untouched). Sync the remote changes first, or explicitly force the push if this machine should overwrite the remote.',
     'sync.pushAdvanceCheckFailed': 'Cannot tell whether another device advanced the remote ({reason}): this push continues as-is',
+    'sync.sessionTombstonesInherited': 'Inherited {count} session deletion tombstone(s) from the remote snapshot: deletions keep propagating across devices (local data untouched)',
     'sync.applyMergeResolutionsNoImporter': 'applyMergeResolutions: SyncEngine is missing the importer (must be injected via options)',
     'sync.mergePendingConflicts': '{count} section(s) still have no decision ({sections}): the decided parts were written locally, but the baseline is not advanced, so the conflicts will reappear next round',
     'sync.baselineRexportFailed': 'The write succeeded but re-exporting the local section(s) failed ({sections}): the baseline cannot be proven to match this machine, so no baseline was recorded (the remote pointer keeps its old value and the next merge converges again)',
 };
 registerMessageCatalog({ id: 'sync-engine-merge', zh, en });
-/**
- * 单侧预览文本上限（2 KiB **字符**预算）：超出截断并追加省略号。
- *
- * 顺序恒为「先 redact 再截断」：反过来会把跨边界的敏感值切成半个形状，让脱敏匹配不到它
- * （等于把秘密截一半发出去）。redact 之后的剩余文本已不含秘密形状，截断才安全。
- */
-const MERGE_PREVIEW_TEXT_LIMIT = 2048;
-/** 严格 UTF-8 解码器：非法字节序列直接抛错（用于区分文本与二进制文件冲突）。 */
-const STRICT_UTF8 = new TextDecoder('utf-8', { fatal: true });
-/** 把任意冲突侧值转成**可读字符串**；二进制只回传形状与字节数，绝不回传原始值对象。 */
-function previewTextOf(value) {
-    if (value === undefined)
-        return '';
-    if (typeof value === 'string')
-        return finalizePreviewText(value);
-    if (value instanceof Uint8Array) {
-        try {
-            return finalizePreviewText(STRICT_UTF8.decode(value));
-        }
-        catch {
-            // 二进制内容解码只会得到乱码（同样误导用户）→ 只回传形状；JSON 是数据形态，不是文案
-            return JSON.stringify({ binary: true, bytes: value.length });
-        }
-    }
-    try {
-        return finalizePreviewText(JSON.stringify(value) ?? '');
-    }
-    catch {
-        return finalizePreviewText(String(value));
-    }
-}
-/** 预览文本统一出口：先 redact（敏感值绝不回传浏览器），再截断到 2 KiB。 */
-function finalizePreviewText(text) {
-    const masked = redact(text);
-    return masked.length > MERGE_PREVIEW_TEXT_LIMIT ? `${masked.slice(0, MERGE_PREVIEW_TEXT_LIMIT)}…` : masked;
-}
 /** plan 的单个分区结果 → 预览视图（三侧都只回传可读文本，绝不回传原始值）。 */
 function mergePreviewSectionView(result) {
     const conflicts = result.conflicts.map((c) => ({
@@ -519,10 +487,13 @@ export class SyncEngine {
         if (encrypt && (opts.password === undefined || opts.password === '')) {
             throw new Error(this.msg('sync.encryptRequiresPassword'));
         }
+        // SYN-02：本轮只列一次远端 index（推进检测 + 继承会话删除墓碑共用；墓碑累积在最新快照里）
+        const remoteIndex = await listRemoteSnapshotIndex(this.transport);
+        const remoteTombstones = remoteIndex.reason === undefined ? remoteTombstonesOf(remoteIndex.metas) : [];
         // 远端推进检测：不一致 = 远端被别的设备推过（或本机基线已被裁剪）。
         // 此时推上去会覆盖/架空别人的改动 → 直接返回冲突（**不抛错**、不 upload、不记基线、不改 sync-state）。
         if (opts.force !== true) {
-            const check = await this.remoteAdvancedCheck();
+            const check = await this.remoteAdvancedCheck(remoteIndex);
             if (check.reason !== undefined) {
                 // 读不到远端列表 ⇒ 无法判定。按原样继续（上传本身会再暴露通道问题），但如实说明。
                 warnings.push(this.msg('sync.pushAdvanceCheckFailed', { reason: check.reason }));
@@ -575,11 +546,15 @@ export class SyncEngine {
         const credentials = includeSecrets
             ? await this.buildCredentialsPayload(opts.password, warnings)
             : undefined;
-        // P1-5：会话删除墓碑（上一次推过、本机已不存在的会话 = 用户删掉了）
-        const bookkeeping = await this.computeSessionBookkeeping(targets, plainSections);
+        // P1-5 + SYN-02：本机墓碑（上次推过、本机已删）叠加上远端继承的墓碑 ——
+        // 不继承的话「A 删 → B 推」会漏掉墓碑，C 带旧快照就能把已删会话复活（删除只在本机传播）。
+        const bookkeeping = await this.computeSessionBookkeeping(targets, plainSections, remoteTombstones);
         if (bookkeeping.deletedNow.length > 0) {
             warnings.push(this.msg('sync.sessionDeletionsRecorded', { count: String(bookkeeping.deletedNow.length) }));
         }
+        if (bookkeeping.inherited > 0) {
+            warnings.push(this.msg('sync.sessionTombstonesInherited', { count: String(bookkeeping.inherited) }));
+        }
         // ⑥ 设备身份（cloud-sync 借鉴项 ⑥）：首次生成后持久化在 sync-state.json（已有则纯读），
         // 随 manifest 上行 → 别的设备在历史列表里能看到「这份快照是哪台机器推的」。
         const device = await resolveDeviceIdentity(this.stateDir, os.hostname(), this.fsx, this.msg);
@@ -747,50 +722,33 @@ export class SyncEngine {
      * `tracked=false` 的三种情形一律**不动既有记录**：没推 sessions / 适配器不支持全量枚举 /
      * 本机枚举失败或为空。用「读不到」覆盖成「全删了」会一次性标错几百条墓碑，绝不猜。
      */
-    async computeSessionBookkeeping(targets, plainSections) {
+    async computeSessionBookkeeping(targets, plainSections, remoteTombstones = []) {
         const sessions = targets.find((a) => a.id === 'sessions');
         if (sessions === undefined || sessions.listAllUnitIds === undefined) {
-            return { tracked: false, sessionUnits: [], tombstones: [], deletedNow: [] };
+            return { tracked: false, sessionUnits: [], tombstones: [], deletedNow: [], inherited: 0 };
         }
         let localUnits;
         try {
             localUnits = await sessions.listAllUnitIds(this.ctx);
         }
         catch {
-            return { tracked: false, sessionUnits: [], tombstones: [], deletedNow: [] };
+            return { tracked: false, sessionUnits: [], tombstones: [], deletedNow: [], inherited: 0 };
         }
         if (localUnits.length === 0) {
-            return { tracked: false, sessionUnits: [], tombstones: [], deletedNow: [] };
+            return { tracked: false, sessionUnits: [], tombstones: [], deletedNow: [], inherited: 0 };
         }
         const state = await loadSyncState(this.stateDir, this.fsx, this.msg);
-        const { tombstones, deletedNow } = nextSessionTombstones({
-            previousUnits: state.sessionUnits ?? [],
-            localUnits,
-            previousTombstones: state.deletedSessions ?? [],
-        });
         return {
             tracked: true,
-            sessionUnits: sessionUnitIdsOfSection(plainSections['sessions']),
-            tombstones,
-            deletedNow,
+            ...planSessionBookkeeping({
+                previousUnits: state.sessionUnits ?? [],
+                previousTombstones: state.deletedSessions ?? [],
+                localUnits,
+                exportedSessions: plainSections['sessions'],
+                remoteTombstones,
+            }),
         };
     }
-    /**
-     * P1-5：按远端墓碑剔除**将要导入**的会话（旧快照不得复活已删除的对话）。
-     * 只动载荷，不动本机已有数据 —— 墓碑不代用户删除本机文件（那是不可回滚的用户动作）。
-     * @returns 被剔除的会话单元 id（调用方据此出可见报告，绝不静默）
-     */
-    stripTombstonedSessions(snapshot) {
-        const tombstones = snapshot.manifest.deletedSessions ?? [];
-        if (tombstones.length === 0 || isEncryptedSections(snapshot.sections))
-            return [];
-        const plain = snapshot.sections;
-        const stripped = stripTombstonedUnits(plain['sessions'], tombstones);
-        if (stripped.removed.length === 0)
-            return [];
-        plain['sessions'] = stripped.section;
-        return stripped.removed;
-    }
     /**
      * 裁剪远端快照：调用 transport.list() 获取全部快照（按 createdAt 升序），
      * 按 retentionPolicyProvider() 给出的 GFS 策略（最近 N / 每月一份 / 每年一份）
@@ -822,6 +780,10 @@ export class SyncEngine {
         const doomed = selectPruneCandidatesByPolicy(metas.map((m) => ({ id: m.id, createdAt: m.createdAt })), policy, selectPruneCandidates);
         // 刚 push 的快照永不进删除集（防御性：策略三层全关时也保住它）
         const keep = new Set([pushedId]);
+        // SYN-04b：本轮 GC 是否已放弃 —— 每次 transport.delete() 内部会重跑一轮 blob GC，
+        // 而放弃码是「本轮」的结论；同一次 push 里删 N 个快照会设置 N 次同一个原因，
+        // 逐条报会把「一样的事实」刷 N 遍，所以本轮只报一次。
+        const gcReported = { done: false };
         for (const m of metas) {
             if (doomed.includes(m.id) && !keep.has(m.id)) {
                 try {
@@ -831,6 +793,7 @@ export class SyncEngine {
                     const reason = err instanceof Error ? err.message : String(err);
                     warnings.push(this.msg('sync.pruneDeleteFailed', { id: m.id, reason }));
                 }
+                reportGcSkipOnce(this.transport, this.msg, warnings, gcReported);
             }
         }
     }
@@ -852,19 +815,17 @@ export class SyncEngine {
      *  - 其余：远端最新快照 id !== lastSnapshotId ⇒ 远端被推进（或本机基线已被裁剪）→ 拦。
      *    两种情况都**无法安全断言「远端没变」**，保守拒绝并给出 force 出口。
      *  - list() 抛错 → 返回 reason（调用方按原样继续并告警），绝不把「读不到」当成「没变」。
+     *  - SYN-02：index 可由 push() 传入（同一轮只列一次远端），缺省自己 list（其它调用点行为不变）。
      */
-    async remoteAdvancedCheck() {
+    async remoteAdvancedCheck(index) {
         const state = await loadSyncState(this.stateDir, this.fsx, this.msg);
         const base = state.lastSnapshotId;
         if (base === '')
             return { blocked: false, base, latest: '' };
-        let metas;
-        try {
-            metas = await this.transport.list();
-        }
-        catch (err) {
-            return { blocked: false, base, latest: '', reason: err instanceof Error ? err.message : String(err) };
-        }
+        const listed = index ?? await listRemoteSnapshotIndex(this.transport);
+        if (listed.reason !== undefined)
+            return { blocked: false, base, latest: '', reason: listed.reason };
+        const metas = listed.metas;
         if (metas.length === 0)
             return { blocked: false, base, latest: '' };
         const latest = metas[metas.length - 1].id; // list 按 createdAt 升序 → 最新在末
@@ -888,7 +849,7 @@ export class SyncEngine {
         // 加密快照 → 用密码解密回明文（无密码明确报错）；普通快照 → containsSecrets 拒绝
         await this.prepareSnapshot(snapshot, opts.password);
         // P1-5：按远端墓碑剔除已删除的会话（旧快照不复活）
-        const tombstoned = this.stripTombstonedSessions(snapshot);
+        const tombstoned = stripTombstonedSessionsInPlace(snapshot);
         // issue #38：快照携带凭据载荷 → 解密出 ref→值（仅内存），供计划项与后续 apply 使用
         const credentials = await this.decryptSnapshotCredentials(snapshot, opts.password);
         const portableIds = this.pullSectionIds();
@@ -951,7 +912,7 @@ export class SyncEngine {
         await this.prepareSnapshot(snapshot, opts.password);
         // audit-sync sync-F6：剔除结果必须**可见**（与 pull/preview 同一口径）。
         // 此前返回值丢弃了它 —— 产物里少了哪些会话，调用方与用户都无从得知（绝不静默少带）。
-        const tombstonedSessions = this.stripTombstonedSessions(snapshot).length;
+        const tombstonedSessions = stripTombstonedSessionsInPlace(snapshot).length;
         const portableIds = this.pullSectionIds();
         const zipPath = await this.snapshotToZip(snapshot, portableIds);
         // snapshotToZip 产出在临时目录；搬到调用方指定目录（同盘 rename，跨盘退化为复制）
@@ -978,9 +939,26 @@ export class SyncEngine {
      *  - **与保留策略裁剪共用同一条 `transport.delete`**（两条通道的删除语义只有一份实现），
      *    区别只在「谁点名」：这里是用户显式指定的 id，pruneRemoteSnapshots 由 RetentionPolicy 挑；
      *  - **不存在视为成功**（SyncTransport 契约），所以重复点删除 / 已被裁剪掉都不会报错。
+     *
+     * F3：通道侧的 blob GC 可能「放弃本轮」（SYN-04：引用快照 404 / 读不出 ⇒ 证明不了没人引用）。
+     * 放弃不是删除失败，但**必须可见**（否则孤儿 blob 无人知晓地一直堆）⇒ 放弃码用与 push 报告
+     * 同一条 `gcSkipWarning` 渲染进返回体的 warnings。
      */
     async deleteSnapshot(id) {
         await this.transport.delete(id);
+        // transport.delete 内部是 await 完 gcBlobStore 才返回的（两条通道同型），所以此时取到的是
+        // **本次删除那一轮**的放弃码，而不是上一轮的残留。
+        const code = this.lastGcSkipCode();
+        return code === null ? { warnings: [] } : { warnings: [gcSkipWarning(this.msg, code)] };
+    }
+    /**
+     * SYN-04b：通道最近一轮 GC 的放弃码（无则 null）。
+     *
+     * 保留为 public 只读出口（不删）：属本类已发布的可见 API，路由/诊断不跑删除流程也能读到通道能力；
+     * 引擎内已由 deleteSnapshot 消费（放弃码 → warnings），不再是死方法。读不到（通道没这能力）= null。
+     */
+    lastGcSkipCode() {
+        return readGcSkipCode(this.transport);
     }
     /** 列出远端已有快照（按 createdAt 升序）—— 供「选择历史快照」下拉。 */
     async listSnapshots() {
@@ -1083,7 +1061,7 @@ export class SyncEngine {
         // 加密快照 → 用密码解密回明文（无密码明确报错）；普通快照 → containsSecrets 拒绝
         await this.prepareSnapshot(snapshot, opts.password);
         // P1-5：按远端墓碑剔除已删除的会话（旧快照不复活；一键同步复用本 plan）
-        const tombstoned = this.stripTombstonedSessions(snapshot);
+        const tombstoned = stripTombstonedSessionsInPlace(snapshot);
         // issue #38：凭据载荷解密（仅内存；由调用方登记进同步会话，apply-items 时写回本机）
         const credentials = await this.decryptSnapshotCredentials(snapshot, opts.password);
         const portableIds = this.pullSectionIds();
@@ -1128,7 +1106,7 @@ export class SyncEngine {
         // issue #107：记下远端快照是否加密 —— applyMergePlan 据此决定祖先副本也落密文
         this.lastMergedRemoteEncrypted = remote.manifest.encrypted === true;
         // P1-5：按远端墓碑剔除已删除的会话（三方合并的 remote 侧同样不许复活）
-        this.stripTombstonedSessions(remote);
+        stripTombstonedSessionsInPlace(remote);
         // 本次合并的远端基准（P0-7）：紧随其后的 applyMergePlan() 用它写基线远端指针
         this.lastMergedRemoteSnapshotId = targetId;
         // issue #45：把远端快照的 sourceHome 与用户映射一并备忘 —— applyMergePlan 重建临时 ZIP 时
@@ -1571,12 +1549,12 @@ export class SyncEngine {
                     warnings: [this.msg('sync.preApplySnapshotFailed', { err: backupErr instanceof Error ? backupErr.message : String(backupErr) })],
                 };
             }
-            // 3) 真正执行：Importer.executeImportPlan（rollbackOnError=true → 任一失败整体回滚）
+            // 3) 真正执行：Importer.executeImportPlan（rollbackOnError 取单一缺省 → 任一失败整体回滚）
             // 自动同步路径没有密码（凭据载荷无法解密），因此恒不注入 decryptedCredentials；
             // 加密快照本就不会进入自动同步（无密码无法 prepareSnapshot）。
             const result = await this.importer.executeImportPlan(zipPath, plan, {
                 confirm: true,
-                rollbackOnError: true,
+                rollbackOnError: DEFAULT_ROLLBACK_ON_ERROR,
                 secretInputs: undefined,
                 decryptedCredentials: undefined,
                 // 审计 P0-23：把 journal 绑定面透传给引擎（自动同步路径由 autosync-scheduler 提供），
@@ -1680,10 +1658,10 @@ export class SyncEngine {
                 result: null,
             };
         }
-        // 真正执行：Importer.executeImportPlan（confirm:true + rollbackOnError:true → 任一失败整体回滚）
+        // 真正执行：Importer.executeImportPlan（confirm:true + rollbackOnError 取单一缺省 → 任一失败整体回滚）
         const result = await this.importer.executeImportPlan(zipPath, subPlan, {
             confirm: true,
-            rollbackOnError: true,
+            rollbackOnError: DEFAULT_ROLLBACK_ON_ERROR,
             secretInputs: undefined,
             // issue #38：快照凭据载荷解出的 ref→值（仅内存）→ credentials adapter 写回本机
             decryptedCredentials: opts.credentials,

package/lib/sync/webdav/webdav-transport.d.ts

@@ -1,3 +1,4 @@
+import type { GcSkipCode } from '../gc-skip.ts';
 import '../messages.ts';
 import type { MsgFunc } from '../../core/messages.ts';
 import { SyncTransportError } from '../transport.ts';
@@ -50,6 +51,10 @@ export declare class WebDavTransportError extends SyncTransportError {
 export declare class WebDavTransport implements SyncTransport {
     readonly type = "webdav";
     private readonly o;
+    /** 最近一轮 blob GC 的放弃码（`null` = 跑完或未触发；SYN-04）。 */
+    private gcSkip;
+    /** 最近一轮 blob GC 是否因「无法证明引用集完整」而整体放弃（`null` = 正常跑完），供上层给用户提示。 */
+    get lastGcSkip(): GcSkipCode | null;
     constructor(options: WebDavTransportOptions);
     /**
      * 最近一次 list() 里读不出来的远端快照（issue #59；index.json 损坏时带上原因）。
@@ -108,7 +113,12 @@ export declare class WebDavTransport implements SyncTransport {
     private rehydrate;
     /**
      * blob 仓 GC（P1-4）：逐份读取**仍存在**的快照 JSON，收集被引用的哈希，删除无人引用且
-     * 超过保护窗口的 blob。读坏任一份快照 → 本轮直接放弃（宁可留垃圾，不可删在用的）。
+     * 超过保护窗口的 blob。读不坏任何一份快照 → 正常回收；否则本轮整体放弃（宁可留垃圾，不可删在用的）。
+     *
+     * SYN-04（P1）：**404 也放弃本轮**。旧实现把「索引有条目但快照文件 404」当作「文件不存在 ⇒ 不可能
+     * 引用任何 blob」直接 continue，于是引用集只剩「读得出来的那几份」，仍被该快照（假 404 / 孤儿条目）
+     * 使用的 blob 就被判成无人引用而删除 —— 不可恢复。拿不到内容就无法证明「没人引用」，与「读不出来」
+     * 是同一件事 ⇒ 一律放弃并记码（sync-N1 同族口径）。
      */
     private gcBlobStore;
     private validateOptions;

package/lib/sync/webdav/webdav-transport.js

@@ -28,6 +28,7 @@
 import { requestOnce } from '../../utils/proxy.js';
 import { zhMsg } from '../../core/messages.js';
 import { composeMsg } from '../s3/messages.js';
+import { GC_SKIP_REFERENCE_MISSING, GC_SKIP_REFERENCE_UNREADABLE, GC_SKIP_SNAPSHOT_UNPARSABLE } from '../gc-skip.js';
 // t6：「英文界面零中文」——注册同步域追加目录（this.o.msg 缺省 = zhMsg，其查找链会查注册目录；
 // sync.webdav.blobHashInvalid 这类新键必须能解析，绝不露裸键名）。
 import '../messages.js';
@@ -224,6 +225,12 @@ function sameOrigin(a, b) {
 export class WebDavTransport {
     type = 'webdav';
     o;
+    /** 最近一轮 blob GC 的放弃码（`null` = 跑完或未触发；SYN-04）。 */
+    gcSkip = null;
+    /** 最近一轮 blob GC 是否因「无法证明引用集完整」而整体放弃（`null` = 正常跑完），供上层给用户提示。 */
+    get lastGcSkip() {
+        return this.gcSkip;
+    }
     constructor(options) {
         this.o = {
             baseUrl: '',
@@ -582,26 +589,35 @@ export class WebDavTransport {
     }
     /**
      * blob 仓 GC（P1-4）：逐份读取**仍存在**的快照 JSON，收集被引用的哈希，删除无人引用且
-     * 超过保护窗口的 blob。读坏任一份快照 → 本轮直接放弃（宁可留垃圾，不可删在用的）。
+     * 超过保护窗口的 blob。读不坏任何一份快照 → 正常回收；否则本轮整体放弃（宁可留垃圾，不可删在用的）。
+     *
+     * SYN-04（P1）：**404 也放弃本轮**。旧实现把「索引有条目但快照文件 404」当作「文件不存在 ⇒ 不可能
+     * 引用任何 blob」直接 continue，于是引用集只剩「读得出来的那几份」，仍被该快照（假 404 / 孤儿条目）
+     * 使用的 blob 就被判成无人引用而删除 —— 不可恢复。拿不到内容就无法证明「没人引用」，与「读不出来」
+     * 是同一件事 ⇒ 一律放弃并记码（sync-N1 同族口径）。
      */
     async gcBlobStore(pwd, remaining) {
+        this.gcSkip = null;
         const index = await this.readBlobIndex(pwd);
         if (Object.keys(index).length === 0)
             return;
         const referenced = new Set();
         for (const meta of remaining) {
             const res = await this.send('GET', this.snapshotUrl(meta.id), pwd);
-            // 索引有条目但快照文件 404 ⇒ 该文件不存在，不可能引用任何 blob（安全跳过）。
-            // 其它失败 ⇒ **读不出来 ≠ 没引用**，本轮直接放弃（与「宁可留垃圾，不可删在用的」同口径；sync-N1 同族）。
-            if (res.status === 404)
-                continue;
-            if (!res.ok)
+            if (res.status === 404) {
+                this.gcSkip = GC_SKIP_REFERENCE_MISSING;
                 return;
+            }
+            if (!res.ok) {
+                this.gcSkip = GC_SKIP_REFERENCE_UNREADABLE;
+                return;
+            }
             let snap;
             try {
                 snap = deserializeSnapshot(await res.text());
             }
             catch {
+                this.gcSkip = GC_SKIP_SNAPSHOT_UNPARSABLE;
                 return;
             }
             const plain = snap.sections;

package/lib/ui/i18n.js

@@ -524,14 +524,14 @@ export const uiEn = {
     'report.backupCreated': 'Backup Created',
     'report.importComplete': 'Import Complete',
     'report.importFailed': 'Import Failed',
-    'report.tombstonedSkipped': '{count} item(s) skipped by deletion records',
+    'report.tombstonedSkipped': '{count} {count, plural, item|items} skipped by deletion records',
     'report.included': 'Included:',
     'report.excluded': 'Excluded:',
     'report.security': 'Security:',
     'report.apiKeysExcluded': 'API Keys excluded:',
     'report.containsSecrets': 'Contains secrets:',
     'report.encrypted': 'Encrypted:',
-    'report.redacted': '{count} sensitive field(s) redacted',
+    'report.redacted': '{count} sensitive {count, plural, field|fields} redacted',
     'report.file': 'File:',
     'report.yes': 'yes',
     'report.yesEncrypted': 'yes (encrypted)',
@@ -549,12 +549,12 @@ export const uiEn = {
     'report.other': 'Other',
     'report.fullText': 'Full text report (with per-item reasons)',
     'report.secrets': 'Secrets:',
-    'report.credentialsNeedEntry': '{count} credential(s) need to be entered',
+    'report.credentialsNeedEntry': '{count} {count, plural, credential needs|credentials need} to be entered',
     'report.restartPluginsMcp': 'Plugin / MCP changes take effect after restarting DSH',
     'report.rollbackFull': 'Rollback: fully restored the pre-import configuration.',
     'report.rollbackPartial': 'Rollback partially completed.',
     'report.rollbackManual': 'These items may require manual recovery:',
-    'report.restored': 'Restored: {count} item(s)',
+    'report.restored': 'Restored: {count} {count, plural, item|items}',
     'report.includedCount': '{count} included',
     'report.excludedCount': '{count} excluded',
     'report.badgeEncrypted': 'encrypted',
@@ -565,18 +565,18 @@ export const uiEn = {
     'report.includedSections': 'Included sections',
     'report.excludedSections': 'Excluded sections',
     'report.warnings': 'Warnings',
-    'report.unit.namespaces': 'namespace(s)',
-    'report.unit.files': 'file(s)',
-    'report.unit.servers': 'server(s)',
-    'report.unit.providers': 'provider(s)',
-    'report.unit.plugins': 'plugin(s)',
-    'report.unit.patchLines': 'patch line(s)',
-    'report.unit.patchFiles': 'patch file(s)',
-    'report.unit.localTarballs': 'local package(s)',
-    'report.unit.prompts': 'prompt(s)',
-    'report.unit.workspaces': 'workspace(s)',
-    'report.unit.credentials': 'credential status item(s)',
-    'report.unit.notes': 'note(s)',
+    'report.unit.namespaces': '{n, plural, namespace|namespaces}',
+    'report.unit.files': '{n, plural, file|files}',
+    'report.unit.servers': '{n, plural, server|servers}',
+    'report.unit.providers': '{n, plural, provider|providers}',
+    'report.unit.plugins': '{n, plural, plugin|plugins}',
+    'report.unit.patchLines': '{n, plural, patch line|patch lines}',
+    'report.unit.patchFiles': '{n, plural, patch file|patch files}',
+    'report.unit.localTarballs': '{n, plural, local package|local packages}',
+    'report.unit.prompts': '{n, plural, prompt|prompts}',
+    'report.unit.workspaces': '{n, plural, workspace|workspaces}',
+    'report.unit.credentials': '{n, plural, credential status item|credential status items}',
+    'report.unit.notes': '{n, plural, note|notes}',
     'error.notMounted': 'config-manager service is not mounted (plugin not loaded): make sure dsh-config-manager is installed in the profile and restart DSH',
     'error.apiPathMissed': 'API path not matched (HTTP {status}): the request prefix is {base} but that path did not return JSON — if you serve DSH under a reverse-proxy sub-path, check that this prefix is proxied (issue #108)',
     'error.httpInvalidJson': 'HTTP {status}: invalid JSON response',
@@ -667,16 +667,16 @@ export const uiEn = {
     'sync.pushFailed': 'Push failed',
     'sync.pushOk': 'Push succeeded (snapshot {id})',
     'sync.conflictUnresolved': 'Conflict item {id} must be resolved first (keep current / use imported)',
-    'sync.pushPreviewHeadline': 'Will push {total} section(s) ({changed} changed)',
+    'sync.pushPreviewHeadline': 'Will push {total} {total, plural, section|sections} ({changed} changed)',
     'sync.pushPreviewEncrypted': 'Encrypted snapshot: the payload is encrypted as a whole; per-section changes vs the baseline cannot be compared.',
     'sync.pushPreviewCredentials': 'This push includes real credential values (encrypted with the payload; the remote only ever sees ciphertext).',
     'sync.pullFailed': 'Pull failed',
-    'sync.pullOk': 'Remote snapshot {id} diff preview: {count} change(s)',
+    'sync.pullOk': 'Remote snapshot {id} diff preview: {count} {count, plural, change|changes}',
     'sync.pullEmpty': 'Remote snapshot matches local (no changes)',
     'sync.previewHint': 'Read-only diff preview above; nothing is imported. One-click import is not supported in this version — use the Import wizard to apply a downloaded backup if needed.',
     'sync.syncing': 'Syncing…',
-    'sync.importDone': 'Imported {n} section(s)',
-    'sync.importPartial': 'Partly successful: {n} item(s) did not take effect (the rest were written; nothing rolled back)',
+    'sync.importDone': 'Imported {n} {n, plural, section|sections}',
+    'sync.importPartial': 'Partly successful: {n} {n, plural, item did|items did} not take effect (the rest were written; nothing rolled back)',
     'sync.importFailed': 'Import failed (rolled back)',
     'sync.autosyncNever': 'Never run',
     'sync.autosyncLastRun': 'Last run: {time}',
@@ -684,7 +684,7 @@ export const uiEn = {
     'sync.autosyncSkipped': 'Skipped',
     'sync.autosyncFailed': 'Failed',
     'sync.autosyncPartial': 'Partial',
-    'sync.autosyncFailCount': '{n} consecutive failure(s)',
+    'sync.autosyncFailCount': '{n} consecutive {n, plural, failure|failures}',
     'sync.duration.min': '{n} min',
     'sync.duration.hour': '{n} hr',
     'sync.duration.day': '{n} day',
@@ -703,7 +703,7 @@ export const uiEn = {
     'sync.github.pollError': 'GitHub OAuth error: {detail}',
     'sync.github.unknownError': 'Unknown error',
     'market.statusUnconfigured': 'No markets added (enter a public Git repository URL)',
-    'market.statusConfigured': '{count} market(s) added',
+    'market.statusConfigured': '{count} {count, plural, market|markets} added',
     'market.supplyUnofficial': 'From the public network, not officially reviewed',
     'market.supplySource': 'Source repo: {url}',
     'market.supplyDownloadedAt': 'Downloaded at: {time}',
@@ -735,18 +735,18 @@ export const uiEn = {
     'consult.title': 'Migration Pre-flight Consultation',
     'consult.healthScore': 'Health score {score}',
     'consult.dryRun': 'Read-only analysis',
-    'consult.blockers': '{count} hard blocker(s) (cannot import safely until resolved)',
-    'consult.attention': '{count} item(s) need attention',
+    'consult.blockers': '{count} hard {count, plural, blocker|blockers} (cannot import safely until resolved)',
+    'consult.attention': '{count} {count, plural, item needs|items need} attention',
     'consult.reasons': 'Recommendation basis',
     'consult.willApply': 'Will apply',
-    'consult.sections': '{count} section(s)',
-    'consult.items': '{count} item(s)',
-    'consult.conflicts': '{count} conflict(s)',
-    'consult.risks': '{count} risk(s)',
+    'consult.sections': '{count} {count, plural, section|sections}',
+    'consult.items': '{count} {count, plural, item|items}',
+    'consult.conflicts': '{count} {count, plural, conflict|conflicts}',
+    'consult.risks': '{count} {count, plural, risk|risks}',
     'consult.dimensions': 'Score dimensions',
     'consult.loading': 'Generating consultation report…',
     'diskUsage.title': 'Disk Usage',
-    'diskUsage.files': '{count} file(s)',
+    'diskUsage.files': '{count} {count, plural, file|files}',
     'diskUsage.refresh': 'Re-scan',
     'diskUsage.loading': 'Measuring disk usage…',
     'diskUsage.unreadable': 'not measured',
@@ -780,9 +780,9 @@ export const uiEn = {
     'diskUsage.area.vault': 'Sensitive file mirror',
     'diskUsage.area.vaultDesc': 'Mirror for the local editor write channel (enabled on demand)',
     'diskUsage.retention.none': 'Retention disabled (never auto-removed)',
-    'diskUsage.retention.days': '{count} day(s)',
-    'diskUsage.retention.hours': '{count} hour(s)',
-    'diskUsage.retention.minutes': '{count} minute(s)',
+    'diskUsage.retention.days': '{count} {count, plural, day|days}',
+    'diskUsage.retention.hours': '{count} {count, plural, hour|hours}',
+    'diskUsage.retention.minutes': '{count} {count, plural, minute|minutes}',
     'diskUsage.backupRetention': 'Scheduled backups keep the latest {count}; exports are auto-removed after {days} days.',
     'diskUsage.clean.title': 'Reclaim space',
     'diskUsage.clean.hint': 'Only regenerable caches and staging are cleaned; snapshots and sync data are never removed here.',
@@ -792,10 +792,10 @@ export const uiEn = {
     'diskUsage.clean.tmpMarketDesc': 'Clears regardless of retention — all of it regenerates (avoid while an import is in flight).',
     'diskUsage.clean.expiredExports': 'Reclaim expired backups',
     'diskUsage.clean.expiredExportsDesc': 'Only exports past their retention window (scheduled backups are excluded).',
-    'diskUsage.clean.done': 'Freed {size}, removed {count} item(s)',
+    'diskUsage.clean.done': 'Freed {size}, removed {count} {count, plural, item|items}',
     'diskUsage.clean.nothing': 'Nothing to reclaim',
     'diskUsage.clean.nothingAbsent': 'Nothing to clean (the target directories are missing or already empty)',
-    'diskUsage.clean.failed': 'Cleanup finished with {count} failure(s) (skipped)',
+    'diskUsage.clean.failed': 'Cleanup finished with {count} {count, plural, failure|failures} (skipped)',
     'diskUsage.clean.confirmTitle': 'Clean disk usage',
     'diskUsage.clean.confirmMessage': 'This deletes regenerable caches/staging plus expired backup files; snapshots and sync data are untouched. It cannot be undone, but everything removed can be regenerated.',
     'diskUsage.clean.confirm': 'Clean',
@@ -900,7 +900,7 @@ export const uiEn = {
     'foreign.found.no': 'Not detected',
     'foreign.paths': 'Matched paths: {paths}',
     'foreign.pathsNone': 'No truth-table path matched',
-    'foreign.credentialRefs': '{count} credential(s) to enter manually: {refs}',
+    'foreign.credentialRefs': '{count} {count, plural, credential|credentials} to enter manually: {refs}',
     'foreign.skip.unsupported-hooks': 'settings hooks: DSH has no equivalent, not migrated',
     'foreign.skip.unsupported-commands': 'Slash commands: not the same thing as DSH prompts, not migrated this round',
     'foreign.skip.credentials-not-migrated': 'Credential fields: only the names are recorded; the values are never read or migrated',
@@ -980,6 +980,17 @@ export const uiEn = {
     'run.progressLost': 'The task finished or exceeded its retention window; progress cannot be recovered',
     'run.restoreProgressLost': 'The restore task finished or exceeded its retention window; progress cannot be recovered',
 };
+/**
+ * 单复数段：`{count, plural, one-form|other-form}`（ICU 的极小子集，2026-11-01）。
+ *
+ * 为什么要它：英文旧写法把复数塞进括号 —— `{count} item(s)`、`{count} copy(ies)`。
+ * 界面读不出来：用户看到 "3 item(s)" 会先怀疑渲染漏了，单数时也照样写 "1 item(s)"。
+ * 真复数得按数量选形式，而模板是死字符串，只能把两种形式都放进值里、由插值层挑一个。
+ *
+ * 规则：`Number(v)` 的绝对值 === 1 取 one，其余（含 0、小数、非数字）取 other —— 英语常规
+ * （"0 items"）。中文值不写这段（中文没有单复数），同一键的中文照旧。
+ */
+const PLURAL_SEGMENT = /\{(\w+),\s*plural,\s*([^{}|]*)\|([^{}]*)\}/g;
 /** 构造 翻译函数（zh 源 / en 镜像；缺 key 回退）。 */
 export function makeUiT(lang) {
     const dict = lang === 'en' ? uiEn : uiZh;
@@ -989,7 +1000,16 @@ export function makeUiT(lang) {
         const template = dict[key] ?? fallback?.[key] ?? key;
         if (params === undefined)
             return template;
-        return String(template).replace(/\{(\w+)\}/g, (match, k) => params[k] === undefined ? match : String(params[k]));
+        return String(template)
+            .replace(PLURAL_SEGMENT, (match, k, one, other) => {
+            const value = params[k];
+            if (value === undefined)
+                return match;
+            const n = Number(value);
+            const form = Number.isFinite(n) && Math.abs(n) === 1 ? one : other;
+            return form.trim();
+        })
+            .replace(/\{(\w+)\}/g, (match, k) => params[k] === undefined ? match : String(params[k]));
     };
 }
 /**

package/lib/ui/import-wizard.d.ts

@@ -20,7 +20,7 @@ import { type FlowPhase } from './flow.ts';
 export interface ImportWizardOptions {
     port: ImportPort;
     onProgress?: ProgressListener;
-    /** 默认回滚策略（场景 E：true=整体回滚；UI 可在执行前覆盖） */
+    /** 默认回滚策略（场景 E：true=整体回滚；UI 可在执行前覆盖；缺省取 `DEFAULT_ROLLBACK_ON_ERROR`） */
     defaultRollbackOnError?: boolean;
     /**
      * 渲染层翻译器（UiT）。缺省 = **活**翻译器 `liveUiT`（随 DSH 语言变化）——

package/lib/ui/import-wizard.js

@@ -3,6 +3,7 @@ import { EXECUTING_STAGE, IMPORT_STAGES, ProgressTracker } from './progress.js';
 import { formatActionableError, toActionableError } from './errors.js';
 import { liveUiT } from './i18n.js';
 import { nextFlowPhase } from './flow.js';
+import { DEFAULT_ROLLBACK_ON_ERROR } from '../core/import-defaults.js';
 /**
  * 凭据补录：把**单个 ref 的输入**合并进当前提交集合（UI-06）。
  *
@@ -179,7 +180,7 @@ export class ImportWizard {
         this.port = opts.port;
         this.onProgress = opts.onProgress;
         this.tracker = new ProgressTracker(IMPORT_STAGES, this.onProgress);
-        this.rollbackOnError = opts.defaultRollbackOnError ?? true;
+        this.rollbackOnError = opts.defaultRollbackOnError ?? DEFAULT_ROLLBACK_ON_ERROR;
         this.t = opts.t ?? liveUiT;
     }
     /** 当前状态快照（React 绑定 / 测试断言用） */