dsh-m 0.10.0 → 0.10.2

package/CHANGELOG.md

@@ -8,6 +8,18 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.10.2 修复：D3 自升级 post-write 伪失败账实改判 + 静默自升级（0.10.0→0.10.1 dogfood 实证轮）
+
+- **需求（2026-10-18 凌晨，首次 D3 真机 dogfood——0.10.0→0.10.1 自升级事件）**：自升级报失败（`application=failed、error=already-installed`）但三面账（manifest/node_modules/lock）均已写入 0.10.1——宿主对自身 bundle 换装存在 **post-write 伪失败**：installBundle 写穿后 manifest 含该名，宿主完成路径自触守卫（自指操作伪影；守卫源码 `specPackageName` 对 tarball URL 同样可解析包名）。另：0.10.1 引入的自升级确认框破坏既有「点击即升级」体验（主人裁决撤除）。
+- **方案**：① **D3 终态失败一律账实复读改判**——实读 listInstalled：目标版已写入 = 升级事实成立，按成功改判（needsRestart=true 提示重启激活，output 留改判痕）；未到目标 = 真失败原语义；profileDir 自 host-api/两处缝透传。② **静默自升级**——确认框整体撤除（受控态/Modal/文案键/SSR 钉），角标点击直接升级，结局由成功/失败横幅如实报告。ADR-0022 增补决议 7（spike 推断修正 + 改判 + UX 裁决入册）。
+- **验证**：typecheck 零错误；全量测试（新增 2 钉 T-D1 改判成功/T-D2 真失败双形态，静默结构钉替换确认框钉；18 例既有失败 028 本机环境清单零新增）；真机事件本身即第一份 dogfood 数据：0.10.1 经「重启激活」到位，重启后守卫锚点干净。
+
+### 0.10.1 修复：0.10.0 真机 E2E 实证缺陷三连——enable 竞速重试普适化 + 回装失败账实复读 + 守卫命中一律两步化
+
+- **需求（2026-10-17，0.10.0 装机当日 E2E 实证，真机 skip-auth@0.4.1 与卸载→重装两个事件）**：①插件树重载窗口的 enable 阶段激活竞速（`pending (waiting for service: webRuntime)`）会让两步升级的第二腿、兜底回装腿与 D3 自升级通道直接终态失败——0.9.94 时代的「enable 失败自动重试一次（重试即愈）」本地增强只覆盖了首腿；②回装腿报失败 ≠ 真缺席——pnpm 可能已写入账面（激活阶段失败），此时建议「手动重装旧版」会误导用户降级；③卸载后同会话重装：宿主活跃态/manifest 字面仍视其在装（守卫命中），而 previousVersion 探测口径为「未安装」，0.10.0 的 previousVersion 前置门使守卫命中原样透传 already-installed。
+- **方案**：① enable 竞速自动重试普适化——首腿、两步第二腿、兜底回装腿、D3 通道同享受限单次重试（`installOnceRetryingEnable`，退避与豁免形态不变）；② 宣称缺席前实读账面（listInstalled）——已写入 → 「请重启 Desktop 完成激活」（details.installedVersion 如实透出），真缺席 → 重装指引，两条路径零误导性降级建议；③ install 路径守卫命中一律两步化（remove+add 即官方语义，去掉 previousVersion 前置门），无旧版可回装时失败走同款账实复读。附带：check-release 门禁行分割容忍 CRLF（本机工作树双语顶条恒找不到的修复）。
+- **验证**：typecheck 零错误；全量 1595 例（新增 8 钉：T-A1/A2/A3 enable 竞速三腿 + T-B1/B2 账实复读两形态 + T-C1/C2/C3 无旧版守卫两步化三态；18 例既有失败为 028 本机环境清单零新增）；真机恢复实录：skip-auth 0.4.1 经「重启激活」恢复（零重装），重启后守卫锚点干净。
+
 ### 0.10.0 特性+修复：宿主 0.2.1 already-installed 适配——第三方两步升级 + 兜底回装降级恢复 + 自升级专用通道（D3）
 
 - **需求（2026-10-17，主人）**：新版 DSH（0.2.1-rc.1/rc.2）中 dsh-m 无法升级与自升级任何包。根因定谳：宿主 `installBundle()` 新增 already-installed 安装守卫——spec 解析出的包名已在 profile manifest 就先于 pnpm 拒绝，官方升级语义改为「先卸载再安装」；tarball/git 形态 spec 包名在 pnpm 前不可知、不受守卫约束（真机 spike 实证：URL 覆盖安装已装 dsh-m 成功、激活形态 restart-required）。影响面：产品内 desktop 升级/自升级全断；卸载、开关、全新安装、web 路径无恙。跳过 0.9.95+ 直接发 0.10.0。
@@ -667,6 +679,18 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Fixes in 0.10.2 — account-reality reconciliation for D3 self-upgrade post-write pseudo-failure + silent self-upgrade (first D3 dogfood round)
+
+- **Need (2026-10-18 early morning, first real-machine D3 dogfood — the 0.10.0→0.10.1 self-upgrade event)**: the self-upgrade reported failure (`application=failed、error=already-installed`) while all three ledgers (manifest/node_modules/lock) had already been written to 0.10.1 — the host has a **post-write pseudo-failure** for its own bundle swap: installBundle writes through, the manifest then contains the name, and the host's completion path trips its own guard (self-referential artifact; the guard's `specPackageName` resolves package names from tarball URLs too). Separately: the 0.10.1 self-upgrade confirmation dialog broke the existing "click to upgrade" experience (owner ordered its removal).
+- **Approach**: ① **reconcile on any D3 terminal failure** — re-read listInstalled: if the target version is already written, the upgrade factually happened and the result is re-judged as success (needsRestart=true prompting the activating restart, with the reconciliation noted in output); if the target is absent, the genuine-failure semantics stand; profileDir is threaded from host-api and both seams. ② **silent self-upgrade** — the confirmation dialog is removed wholesale (controlled state / modal / copy keys / SSR pin); the chip click upgrades directly and outcomes are still reported truthfully via banners. ADR-0022 decision 7 records the spike-inference correction, the reconciliation, and the UX ruling.
+- **Verification**: typecheck clean; full suite (2 new pins T-D1 reconciled-success / T-D2 genuine-failure, silent structure pins replacing the confirmation pins; 18 pre-existing failures are the 028 machine-environment set, zero new); the real-machine event itself is the first dogfood datum: 0.10.1 landed via "restart to activate", guard journal anchors clean after restart.
+
+### Fixes in 0.10.1 — three defects proven by same-day real-machine E2E of 0.10.0: enable-race retry universalized + account-reality re-read on rollback failure + guard hit always two-steps
+
+- **Need (2026-10-17, proven during the same-day real-machine E2E of 0.10.0 — the skip-auth@0.4.1 upgrade event and the uninstall→reinstall event)**: ① the enable-stage activation race during plugin-tree reload windows (`pending (waiting for service: webRuntime)`) made the two-step upgrade's second leg, the rollback reinstall leg, and the D3 self-upgrade channel fail terminally — the 0.9.94-era "retry enable failures once (retry heals)" local enhancement covered only the first leg; ② a failed reinstall leg ≠ true absence — pnpm may have already written the package (activation failed afterwards), where advising "manually reinstall the old version" would mislead the user into a downgrade; ③ uninstall followed by a same-session reinstall: the host's live state / literal manifest still considers the package installed (guard fires) while the previousVersion probe reports "not installed", so 0.10.0's previousVersion precondition let the raw already-installed error surface.
+- **Approach**: ① universalize the enable-race auto-retry — the first leg, the two-step second leg, the rollback reinstall leg, and the D3 channel all share the limited single retry (`installOnceRetryingEnable`; backoff and exempted failure shapes unchanged); ② re-read the ledger (listInstalled) before claiming absence — if written → "restart Desktop to finish activation" (with `details.installedVersion` surfaced truthfully), if truly absent → reinstall guidance; neither path suggests a misleading downgrade; ③ on the install path a guard hit always two-steps (remove+add is the official semantics; the previousVersion precondition is removed), and a failure without an old version to roll back to goes through the same ledger re-read. Incidental: the check-release gate now splits lines CRLF-tolerantly (fixing the bilingual top-entry false negative on CRLF working trees).
+- **Verification**: typecheck clean; full suite 1595 tests (8 new pins: T-A1/A2/A3 enable-race on three legs + T-B1/B2 both ledger-re-read shapes + T-C1/C2/C3 three states of guard-hit two-step without an old version; 18 pre-existing failures are the 028 machine-environment set, zero new); real-machine recovery record: skip-auth 0.4.1 recovered via "restart to activate" (zero reinstall), guard journal anchors clean after restart.
+
 ### Feature + fix in 0.10.0 — host 0.2.1 already-installed adaptation: third-party two-step upgrade + rollback-reinstall degraded restore + dedicated self-upgrade channel (D3)
 
 - **Need (2026-10-17, the owner)**: on the new DSH (0.2.1-rc.1/rc.2) dsh-m could no longer upgrade or self-upgrade any package. Root cause: the host's `installBundle()` gained an already-installed guard — when the package name resolved from a registry spec already exists in the profile manifest it is rejected before pnpm runs, and the official upgrade semantics became "uninstall first, then install"; tarball/git specs are exempt because their package name is unknowable before pnpm (verified on a real machine: installing a tarball URL over the installed dsh-m succeeded, activation shape restart-required). Scope: in-product desktop upgrade/self-upgrade fully broken; uninstall, toggle, fresh install, and the web path unaffected. Version 0.9.95+ skipped straight to 0.10.0.

package/lib/client.js

@@ -2351,9 +2351,6 @@ var ZH = {
   "op.degraded": "\u5347\u7EA7\u5931\u8D25\uFF1A\u65B0\u7248\u5B89\u88C5\u672A\u6210\u529F\uFF0C\u5DF2\u81EA\u52A8\u6062\u590D\u65E7\u7248 {restoredTo}\u2014\u2014\u63D2\u4EF6\u5F53\u524D\u53EF\u7528\uFF0C\u53EF\u7A0D\u540E\u91CD\u8BD5\u3002",
   "notify.selfupgraded": "dsh-m \u5DF2\u5347\u7EA7\uFF08v{from} \u2192 v{to}\uFF09",
   "notify.selfupgraded.failed": "dsh-m \u5347\u7EA7\u5931\u8D25\uFF1A{err}",
-  "selfupgrade.confirm": "\u5C06\u901A\u8FC7 tarball \u76F4\u88C5\u901A\u9053\u628A dsh-m \u5347\u7EA7\u5230 {version}\uFF1A\u4E0D\u7ECF\u8FC7\u5378\u8F7D\uFF0C\u5931\u8D25\u65F6\u5F53\u524D\u7248\u672C\u4E0D\u53D7\u5F71\u54CD\uFF1B\u5B8C\u6210\u540E\u9700\u91CD\u542F Desktop \u751F\u6548\u3002",
-  "selfupgrade.confirm.noversion": "\u5C06\u901A\u8FC7 tarball \u76F4\u88C5\u901A\u9053\u5347\u7EA7 dsh-m\uFF1A\u4E0D\u7ECF\u8FC7\u5378\u8F7D\uFF0C\u5931\u8D25\u65F6\u5F53\u524D\u7248\u672C\u4E0D\u53D7\u5F71\u54CD\uFF1B\u5B8C\u6210\u540E\u9700\u91CD\u542F Desktop \u751F\u6548\u3002",
-  "selfupgrade.go": "\u5347\u7EA7",
   "failed.install": "\u5B89\u88C5\u5931\u8D25\uFF1A{err}",
   "failed.uninstall": "\u5378\u8F7D\u5931\u8D25\uFF1A{err}",
   "failed.upgrade": "\u5347\u7EA7\u5931\u8D25\uFF1A{err}",
@@ -2655,9 +2652,6 @@ var EN = {
   "op.degraded": "Upgrade failed: the new version did not install \u2014 rolled back to {restoredTo}. The plugin still works; you can retry later.",
   "notify.selfupgraded": "dsh-m upgraded (v{from} \u2192 v{to})",
   "notify.selfupgraded.failed": "dsh-m upgrade failed: {err}",
-  "selfupgrade.confirm": "Upgrade dsh-m to {version} via the tarball direct-install channel: no uninstall involved, the current version stays intact on failure; a Desktop restart is needed afterwards.",
-  "selfupgrade.confirm.noversion": "Upgrade dsh-m via the tarball direct-install channel: no uninstall involved, the current version stays intact on failure; a Desktop restart is needed afterwards.",
-  "selfupgrade.go": "Upgrade",
   "failed.install": "Install failed: {err}",
   "failed.uninstall": "Uninstall failed: {err}",
   "failed.upgrade": "Upgrade failed: {err}",
@@ -5191,12 +5185,11 @@ var TABS = [
   ["installed", "tab.installed", "installed"],
   ["settings", "tab.settings", null]
 ];
-function DshmVersionChip({ version, notify, initialCheck, ops, initialConfirm }) {
+function DshmVersionChip({ version, notify, initialCheck, ops }) {
   const [check, setCheck] = useState(
     () => initialCheck !== void 0 ? initialCheck : typeof window !== "undefined" && window.localStorage ? readSelfCheckCache2(window.localStorage, { version }) : null
   );
   const [busy, setBusy] = useState(false);
-  const [confirming, setConfirming] = useState(initialConfirm === true);
   useEffect(() => {
     if (initialCheck !== void 0) return;
     let live = true;
@@ -5214,11 +5207,10 @@ function DshmVersionChip({ version, notify, initialCheck, ops, initialConfirm })
   }, [initialCheck]);
   const doUpgrade = async () => {
     if (busy) return;
-    setConfirming(true);
+    return performUpgrade();
   };
   const performUpgrade = async () => {
     if (busy) return;
-    setConfirming(false);
     setBusy(true);
     try {
       const res = await (ops ? ops.runOp("upgrade", "dsh-m", async () => {
@@ -5247,36 +5239,6 @@ function DshmVersionChip({ version, notify, initialCheck, ops, initialConfirm })
   };
   const state = deriveChipState2(check, version);
   if (state.kind === "outdated") {
-    if (confirming) {
-      return h(
-        "div",
-        { className: "dshm-compat-overlay", ...backdropCloseHandlers2(() => setConfirming(false)) },
-        h(
-          "div",
-          { className: "dshm-compat-dialog", onClick: (e) => e.stopPropagation() },
-          h("div", { className: "dshm-compat-title" }, lookup("selfupdate.available", { v: state.latest || "?" })),
-          h(
-            "div",
-            { className: "dshm-compat-body" },
-            state.latest ? lookup("selfupgrade.confirm", { version: `v${state.latest}` }) : lookup("selfupgrade.confirm.noversion")
-          ),
-          h(
-            "div",
-            { className: "dshm-actions" },
-            h(
-              "button",
-              { className: "dshm-btn", onClick: () => setConfirming(false) },
-              lookup("common.later")
-            ),
-            h(
-              "button",
-              { className: "dshm-btn primary", onClick: performUpgrade, disabled: busy },
-              lookup("selfupgrade.go")
-            )
-          )
-        )
-      );
-    }
     return h(
       "button",
       {

package/lib/core/host-api.js

@@ -302,14 +302,16 @@ export function createApiDispatcher(ctx) {
                 }
                 case 'self-upgrade': {
                     assertWriteAllowed(profile, 'self-upgrade');
-                    // 0.10.0 D3 自升级专用通道（desktop）：tarball 直覆盖。desktopInstall 的 registry spec 在
-                    // 0.2.1 宿主必撞 already-installed 守卫，而 remove+add 对调用者自身是破坏性路径（R6：自升级
-                    // 绝不落入通用两步——改道唯一执行点在 core 缝，此处调 D3 入口即语义同源）；tarball spec
-                    // 不受守卫约束（spike 实证）。恒 panel 语义零外部日志（ADR-0018），intent 预写/收口在 core 层。
+                    // 0.10.0 D3 自升级专用通道（desktop）：tarball 直装。0.10.2 实证修订：0.2.1 守卫经
+                    // specPackageName 对 tarball URL 同样解析包名（自升级写穿后宿主完成路径自触守卫 = post-write
+                    // 伪失败），由 D3 的账实复读改判兜住；通道分治不变——remove+registry-spec 通用两步仍不达自升级。
+                    // 恒 panel 语义零外部日志（ADR-0018），intent 预写/收口在 core 层。
                     if (profile.kind !== 'web') {
                         const managed = await d.desktopSelfUpgradeViaTarball(ctx.pkg.name, ctx.pkg.version, {
                             timeoutMs: cfg().timeoutMs,
                             signal,
+                            // 0.10.2：账实复读（post-write 伪失败改判）需要 profile 目录
+                            profileDir: profile.dir,
                         }, {
                             getService: d.getService,
                             ensureService: d.ensureService,

package/lib/core/profile-ops.js

@@ -194,7 +194,7 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     // 0.10.0 R6（install 臂）：dsh-m 已装态下的 install 调用实为升级（守卫必拦）→ 改道 D3；
     // 全新安装（未装）走既有单步——守卫不触发，R1「新装路径不动」。
     if (pkg === SELF_PKG && previousVersion !== undefined) {
-        return desktopSelfUpgradeViaTarballLocked(pkg, previousVersion, { timeoutMs, signal: opts.signal }, {
+        return desktopSelfUpgradeViaTarballLocked(pkg, previousVersion, { timeoutMs, signal: opts.signal, profileDir: opts.profileDir }, {
             getService: () => service,
             npmLatest: deps.npmLatest,
             npmTarballUrl: deps.npmTarballUrl,
@@ -340,6 +340,18 @@ async function runManagedInstall(service, ctx, deps = {}) {
         enabled: true,
         ...(ctx.approvedBuilds && ctx.approvedBuilds.length > 0 ? { approvedBuilds: ctx.approvedBuilds } : {}),
     }));
+    // enable 阶段竞速自动重试（2026-10-02 本地增强的普适化，0.10.1 E2E 实证扩面）：
+    // 高频装卸/插件树重载窗口下 enable 阶段与应用侧竞速（实机实证「重试即愈」，skip-auth@0.4.1 事件二度实证）——
+    // 首腿、两步第二腿、兜底回装腿同享受限单次重试；cancelled / build-blocked / release-age 等其他失败形态不重试。
+    const installOnceRetryingEnable = async (spec) => {
+        const first = await installOnce(spec);
+        if (first.stage === 'enable' && (first.application === 'failed' || first.error)) {
+            if (enableRetryDelayMs > 0)
+                await sleepMs(enableRetryDelayMs);
+            return installOnce(spec);
+        }
+        return first;
+    };
     /** 失败映射（既有语义不变：cancelled / build-blocked 审批 / release-age 等待 / enable / 通用）。 */
     const mapFailure = async (change) => {
         if (change.application === 'cancelled') {
@@ -395,14 +407,8 @@ async function runManagedInstall(service, ctx, deps = {}) {
         }
         return { change, bundleName };
     };
-    let change = await installOnce();
-    // 本地增强：enable 阶段失败自动重试一次（受限单次 + 短退避；与高频装卸/插件树重载的竞速重试即愈；
-    // cancelled / build-blocked / release-age 等其他失败形态不重试）
-    if (change.stage === 'enable' && (change.application === 'failed' || change.error)) {
-        if (enableRetryDelayMs > 0)
-            await sleepMs(enableRetryDelayMs);
-        change = await installOnce();
-    }
+    let change = await installOnceRetryingEnable(ctx.spec);
+    // （enable 阶段竞速自动重试已普适化进 installOnceRetryingEnable——首腿/两步第二腿/兜底回装腿/D3 同享）
     // ADR-0009 挂点3：双码失败 → 治理 → changed 则重试该命令一次（每次调用至多一次；
     // cancelled / build-blocked 不治理不重试）。仍败走既有 mapFailure（含账实分裂复读）；
     // 挂点3 已落盘的合并以短语并入失败 message 与成功 output（留痕契约含挂点3）。
@@ -419,49 +425,96 @@ async function runManagedInstall(service, ctx, deps = {}) {
     // （removeBundle 旧版 → 重试安装同一 spec，至多一次、无循环）；第二腿终态失败 → 兜底回装旧版
     // （remove 后旧名已不在 manifest，守卫不适用）：回装成功 = 降级恢复结局（degraded，R4）；
     // cancelled / build-blocked 语义优先（不冒充降级）；回装失败 = 缺席硬错误（rollback-failed）。
-    // 无 previousVersion 不两步化——R3 兜底网的存在前提（无旧版即无回装能力）。
+    // 0.10.1（E2E 实证 ③）：去掉 previousVersion 前置门——卸载后同会话重装时，宿主活跃态/manifest
+    // 字面仍视其在装（守卫命中），而探测口径为「未安装」；守卫命中即 remove+add（官方语义），
+    // 无旧版可回装时失败走账实复读给恢复指引。
     let twoStepNote;
-    if (isAlreadyInstalledGuard(change) && ctx.previousVersion && typeof service.removeBundle === 'function') {
+    if (isAlreadyInstalledGuard(change) && typeof service.removeBundle === 'function') {
         twoStepNote = 'already-installed → two-step';
         const removeChange = changeOf(await service.removeBundle(ctx.pkg));
         if (isTerminalFailure(removeChange)) {
             // remove 腿失败短路（不回装）：旧版尚未移除，状态以官方插件页为准
             throw new DesktopOpsError('remove-failed', `两步升级第一步（卸载旧版）失败（${ctx.pkg}；application=${removeChange.application ?? 'failed'}${removeChange.error?.code ? `、error=${removeChange.error.code}` : ''}）：未执行升级，请到官方 Desktop 插件页确认 ${ctx.pkg} 状态`);
         }
-        change = await installOnce();
+        change = await installOnceRetryingEnable(ctx.spec);
         if (isTerminalFailure(change)) {
             const pendingAdd = pendingOf(change);
             const addDiagnostic = `${change.error?.diagnostic ?? ''}${change.error?.code ? `\n${change.error.code}` : ''}`.trim();
             const addCancelled = change.application === 'cancelled';
             const addBuildBlocked = change.packageResult?.kind === 'build-blocked' && pendingAdd.length > 0;
-            // 兜底回装旧版（R3）：回装腿失败（含其自身 build-blocked）= 缺席硬错误，降级失败真相优先
-            const rollbackChange = await installOnce(`${ctx.pkg}@${ctx.previousVersion}`);
-            const pendingRollback = pendingOf(rollbackChange);
-            if (isTerminalFailure(rollbackChange) || (rollbackChange.packageResult?.kind === 'build-blocked' && pendingRollback.length > 0)) {
-                throw new DesktopOpsError('rollback-failed', `升级失败且自动回装旧版也失败（${ctx.pkg}@${ctx.previousVersion}）：插件当前可能缺席，请在官方 Desktop 插件页手动重装 ${ctx.pkg}@${ctx.previousVersion}${addDiagnostic !== '' ? `；升级失败原因：${addDiagnostic}` : ''}`, {
-                    pkg: ctx.pkg,
-                    previousVersion: ctx.previousVersion,
-                    ...(addDiagnostic !== '' ? { addDiagnostic } : {}),
-                    ...(pendingRollback.length > 0 ? { pendingBuilds: pendingRollback } : {}),
-                });
+            if (ctx.previousVersion) {
+                // 兜底回装旧版（R3）：回装腿失败（含其自身 build-blocked）= 缺席硬错误，降级失败真相优先
+                const rollbackChange = await installOnceRetryingEnable(`${ctx.pkg}@${ctx.previousVersion}`);
+                const pendingRollback = pendingOf(rollbackChange);
+                if (isTerminalFailure(rollbackChange) || (rollbackChange.packageResult?.kind === 'build-blocked' && pendingRollback.length > 0)) {
+                    // 0.10.1（E2E 实证，skip-auth@0.4.1 事件）：回装腿失败 ≠ 一定缺席——pnpm 可能已写入账面
+                    // （激活阶段失败）。宣称缺席前实读账面，按实况分派恢复指引（账实相符优先，零误导性降级建议）。
+                    let installedVersion;
+                    if (ctx.profileDir && ctx.listInstalled) {
+                        try {
+                            const row = (await ctx.listInstalled(ctx.profileDir)).items.find((it) => it.pkg === ctx.pkg);
+                            installedVersion = row?.version;
+                        }
+                        catch {
+                            // 复读失败按未知处理：保留既有缺席文案（含「可能」字样，不断言）
+                        }
+                    }
+                    const message = installedVersion !== undefined
+                        ? `升级失败且自动回装未完成，但账面显示 ${ctx.pkg}@${installedVersion} 已写入（激活阶段可能未完成）：请重启 Desktop 完成激活；如重启后仍异常，请在官方 Desktop 插件页手动处理${addDiagnostic !== '' ? `；升级失败原因：${addDiagnostic}` : ''}`
+                        : `升级失败且自动回装旧版也失败（${ctx.pkg}@${ctx.previousVersion}）：插件当前可能缺席，请在官方 Desktop 插件页手动重装 ${ctx.pkg}@${ctx.previousVersion}${addDiagnostic !== '' ? `；升级失败原因：${addDiagnostic}` : ''}`;
+                    throw new DesktopOpsError('rollback-failed', message, {
+                        pkg: ctx.pkg,
+                        previousVersion: ctx.previousVersion,
+                        ...(addDiagnostic !== '' ? { addDiagnostic } : {}),
+                        ...(pendingRollback.length > 0 ? { pendingBuilds: pendingRollback } : {}),
+                        ...(installedVersion !== undefined ? { installedVersion } : {}),
+                    });
+                }
+                const verifiedRollback = await verifyAndBundle(rollbackChange);
+                if (addBuildBlocked) {
+                    // build-blocked 语义优先：旧版已兜住，仍抛审批请求（不冒充降级成功）
+                    throw new DesktopBuildApprovalNeeded(pendingAdd);
+                }
+                if (addCancelled) {
+                    // 取消不冒充降级成功：已恢复旧版、未做升级
+                    throw new DesktopOpsError('install-refused', `升级已被取消（${ctx.pkg}）：已恢复旧版 ${ctx.previousVersion}，未做升级`);
+                }
+                // 降级恢复（R4）：成功形态 + degraded 标记；跳过挂点2 登记——实际在装的是旧版，登记新版本会是假账
+                return {
+                    ...verifiedRollback,
+                    ...(governRetryNote !== undefined ? { governRetryNote } : {}),
+                    degraded: true,
+                    restoredTo: ctx.previousVersion,
+                    twoStepNote,
+                };
             }
-            const verifiedRollback = await verifyAndBundle(rollbackChange);
+            // 0.10.1（E2E 实证 ③）：无 previousVersion——remove 已按官方语义执行、无旧版可回装。
+            // build-blocked / cancelled 语义照旧；其余按账实复读给恢复指引（缺席硬错误族）。
             if (addBuildBlocked) {
-                // build-blocked 语义优先：旧版已兜住，仍抛审批请求（不冒充降级成功）
                 throw new DesktopBuildApprovalNeeded(pendingAdd);
             }
             if (addCancelled) {
-                // 取消不冒充降级成功：已恢复旧版、未做升级
-                throw new DesktopOpsError('install-refused', `升级已被取消（${ctx.pkg}）：已恢复旧版 ${ctx.previousVersion}，未做升级`);
+                throw new DesktopOpsError('install-refused', `安装已被取消（${ctx.pkg}）：未安装`);
+            }
+            let installedVersion;
+            if (ctx.profileDir && ctx.listInstalled) {
+                try {
+                    const row = (await ctx.listInstalled(ctx.profileDir)).items.find((it) => it.pkg === ctx.pkg);
+                    installedVersion = row?.version;
+                }
+                catch {
+                    // 复读失败按未知处理：缺席文案含「可能」字样，不断言
+                }
             }
-            // 降级恢复（R4）：成功形态 + degraded 标记；跳过挂点2 登记——实际在装的是旧版，登记新版本会是假账
-            return {
-                ...verifiedRollback,
-                ...(governRetryNote !== undefined ? { governRetryNote } : {}),
-                degraded: true,
-                restoredTo: ctx.previousVersion,
-                twoStepNote,
-            };
+            const message = installedVersion !== undefined
+                ? `安装未完成，但账面显示 ${ctx.pkg}@${installedVersion} 已写入（激活阶段可能未完成）：请重启 Desktop 完成激活；如重启后仍异常，请在官方 Desktop 插件页手动处理${addDiagnostic !== '' ? `；失败原因：${addDiagnostic}` : ''}`
+                : `安装失败且无法自动恢复（${ctx.pkg}）：插件当前可能缺席，请在官方 Desktop 插件页手动重装${addDiagnostic !== '' ? `；失败原因：${addDiagnostic}` : ''}`;
+            throw new DesktopOpsError('rollback-failed', message, {
+                pkg: ctx.pkg,
+                ...(addDiagnostic !== '' ? { addDiagnostic } : {}),
+                ...(pendingAdd.length > 0 ? { pendingBuilds: pendingAdd } : {}),
+                ...(installedVersion !== undefined ? { installedVersion } : {}),
+            });
         }
     }
     if (change.application === 'failed' || change.application === 'cancelled' || change.error) {
@@ -610,8 +663,42 @@ async function desktopSelfUpgradeViaTarballLocked(pkgName, currentVersion, opts,
     });
     const resolveIntent = deps.resolveUpgradeIntent ?? defaultResolveUpgradeIntent;
     try {
-        const change = changeOf(await service.installBundle(spec, { enabled: true }));
+        let change = changeOf(await service.installBundle(spec, { enabled: true }));
+        // 0.10.1：enable 阶段竞速自动重试（与 runManagedInstall 各腿同款；skip-auth@0.4.1 真机事件实证竞速窗口真实）
+        if (change.stage === 'enable' && (change.application === 'failed' || change.error)) {
+            if (enableRetryDelayMs > 0)
+                await sleepMs(enableRetryDelayMs);
+            change = changeOf(await service.installBundle(spec, { enabled: true }));
+        }
         if (isTerminalFailure(change)) {
+            // 0.10.2（D3 dogfood 实证，0.10.0→0.10.1 真机事件）：宿主对自身 bundle 换装存在 post-write 伪失败——
+            // installBundle 已写穿三面账（manifest/node_modules/lock 均为目标版）却回传 failed/already-installed
+            // （自指操作伪影：写完后 manifest 含该名，宿主完成路径自触守卫）。终态失败一律实读账面：
+            // 目标版已写入 = 升级事实成立，按成功改判（needsRestart=true，重启激活）；否则真失败（原语义）。
+            let installedVersion;
+            if (opts.profileDir && deps.listInstalled) {
+                try {
+                    const row = (await deps.listInstalled(opts.profileDir)).items.find((it) => it.pkg === pkgName);
+                    installedVersion = row?.version;
+                }
+                catch {
+                    // 复读失败按真失败处理
+                }
+            }
+            if (installedVersion === latest.version) {
+                await resolveIntent({ ok: true, installedVersion: latest.version });
+                return {
+                    id: pkgName,
+                    pkg: pkgName,
+                    spec,
+                    version: latest.version,
+                    buildApprovals: Array.isArray(change.approvedBuilds) ? change.approvedBuilds : [],
+                    fallbackAllBuilds: false,
+                    needsRestart: true,
+                    output: `official pluginManager (self-upgrade via tarball): application=${change.application ?? 'failed'}、error=${change.error?.code ?? 'terminal-failure'} 经账实复读改判成功——目标版 ${latest.version} 已写入（宿主自升级 post-write 伪失败），重启 Desktop 激活`,
+                    via: 'desktop-manager',
+                };
+            }
             const pending = pendingOf(change);
             if (change.application === 'cancelled') {
                 throw new DesktopOpsError('install-refused', `自升级已被取消（${pkgName}）：当前版本 ${currentVersion} 不受影响`);
@@ -670,7 +757,7 @@ async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
         const selfTarget = items.find((it) => it.pkg === pkg);
         if (!selfTarget)
             throw new DesktopOpsError('install-refused', `desktop profile 未安装该插件: ${pkg}（升级目标必须是已装插件）`);
-        return desktopSelfUpgradeViaTarballLocked(pkg, selfTarget.version, { timeoutMs, signal: opts.signal }, {
+        return desktopSelfUpgradeViaTarballLocked(pkg, selfTarget.version, { timeoutMs, signal: opts.signal, profileDir: opts.profileDir }, {
             getService: () => service,
             npmLatest: deps.npmLatest,
             npmTarballUrl: deps.npmTarballUrl,

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.10.0",
+  "version": "0.10.2",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",
@@ -46,6 +46,7 @@
     "build": "node scripts/build.mjs",
     "typecheck": "tsc -p tsconfig.json --noEmit",
     "test": "node --test tests/*.test.mjs",
+    "check-release": "node scripts/check-release.mjs",
     "pretest": "npm run build",
     "prepare": "npm run build",
     "capture:readme": "node scripts/capture-readme.mjs"