dsh-m 0.9.22 → 0.9.24

package/CHANGELOG.md

@@ -8,6 +8,20 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.24 变更：排除条目代管——供应链等待期从「提前拒绝」到「治理 + 登记」（ADR-0009）
+
+- **问题（实机 2026-10-03 实证）**：0.9.19 的委派前预检把「目标版本未满 24h 等待期」预测成"官方管理器必拦"并提前拒绝——同目标 dsh-market 却能装上（copilot-auth@1.2.4 发布 8 分钟、quota-watch@0.1.21 两例）。pnpm 11.7 默认非严格策略对显式点名的新版本本来就放行并自动登记排除条目，预检的墙并不存在。
+- **三挂点代管**：① 委派前治理——desktop profile 排除块的坏形态（pnpm 自追加的死规则）合并为"每包一条、版本并集复合"；② 装机成功后登记——等待期内目标并入排除块（scoped 精确单条 / 非 scoped 目标+上一版双选择器）；③ 双码失败（`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` / `ERR_PNPM_NO_MATURE_MATCHING_VERSION`）→ 治理 → 至多重试一次，仍败走既有失败翻译与账实分裂复读。web ladder 同套三挂点。
+- **边界与安全**：红线收窄出唯一例外（desktop 仅此块、仅委派前后挂点、原子写、解析失败即弃、留痕不落全文）；治理/登记全程持官方同款锁并 fail-open——任何失败不阻塞委派，pnpm 仍是最终执行者；显式设置 age 或 strict 的 profile 仍前置拒绝并给可重试时刻；机理按"首条规则生效"口径改判（know-how 020 §2.4 形态论退役）。
+- **文档**：决策全文 `docs/adr/0009-release-age-exclude-governance.md`（含 9 项评估过不做的栅栏附录与观察预案）；GLOSSARY 新词「首条规则/排除条目/治理/登记/等待期」。
+
+### 0.9.23 变更：已装页两段加载——列表秒开 + 更新提示就地补 ⬆（ADR-0008）
+
+- **问题（实机 2026-10-03 实证）**：更新探测焊在已装列表接口里且带 60min 内存 TTL——发版后重开面板吃到陈旧缓存，升级提示迟迟不出现（quota-watch 新版发布 17 分钟后面板仍无提示，dshmarket 同刻已见）。
+- **两段并行（零新增按钮）**：第一段 `installed {probe:false}` 立即返回已装列表（registry 匹配与开关相位不受影响）；第二段新方法 `installedUpdates`（`probeMode: 'only'`，**TTL=0 每次挂载真实探测**）完成后把 ⬆ 徽标 / tab 红点 / 「全部升级 (N)」就地补上；探测失败仍逐项走「检查未完成」，不冒充「没得更新」。
+- **边界与副作用（ADR-0008 如实留痕）**：范围仅已装页——市场浏览页探测、`dshm_list`/`dshm_outdated` 工具、CLI 行为不变（缺省 `probeMode: 'full'`）；ttl=0 会先删 host namespace 共享缓存条目再重探，浏览页/工具的 TTL 内命中被刷新为更新值（数据只更新鲜、代码路径与自身 TTL 制度不变），GitHub 被动预算消耗速率上升（上限 25/req、50/h 滚动不变），超限走 latestError 优雅降级。
+- **文档**：决策全文 `docs/adr/0008-installed-two-phase-probe.md`；DESIGN「已装页/缓存语义」补句；GLOSSARY 新词「两段加载」。
+
 ### 0.9.22 变更：升级生效判定——tarball 差异三态分类 + 三端重启提示分流（ADR-0007）
 
 - **问题（0.9.21 实证）**：`@iasiv5/dsh-skins` 1.2.3→1.3.0 升级后未重启即已生效（客户端 bundle rev 热更），三端仍无条件提示「需要重启」——警报疲劳会侵蚀提示的权威性，重启本身也有真实成本（web 服务瞬断 / desktop 手动重开）。
@@ -242,6 +256,20 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Changed in 0.9.24 — release-age exclusion governance: from pre-flight refusal to govern + register (ADR-0009)
+
+- **Problem (observed live 2026-10-03)**: the 0.9.19 pre-flight precheck predicted "the official manager will block a target inside the 24h release-age window" and refused up front — while dsh-market installed the very same targets (copilot-auth@1.2.4 published 8 minutes prior; quota-watch@0.1.21). pnpm 11.7's default non-strict policy admits explicitly named fresh releases and auto-registers their exclusion entries; the wall the precheck predicted did not exist.
+- **Three governance hooks**: (1) pre-delegation govern — merge malformed exclusion shapes (pnpm's auto-appended dead rules) into "one rule per package, version union"; (2) post-success register — fold in-window targets into the exclusion block (scoped exact / non-scoped target+previous composite); (3) on dual-code failure (`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` / `ERR_PNPM_NO_MATURE_MATCHING_VERSION`) → govern → retry the command at most once, then fall through to the existing failure translation. The web ladder gets the same three hooks.
+- **Boundary & safety**: the red line narrows by exactly one exception (desktop: this block only, delegation hooks only, atomic write, parse-failure bail-out, tracing without file dumps); govern/register hold the official same lock and fail open — any failure never blocks delegation, pnpm stays the final enforcer; profiles that explicitly set `minimumReleaseAge` or `minimumReleaseAgeStrict` still get refused up front with a retry time; the mechanism verdict follows "first rule wins" (know-how 020 §2.4 form-theory retired).
+- **Docs**: full decision record in `docs/adr/0009-release-age-exclude-governance.md` (with a fence appendix of 9 evaluated-and-skipped items and the observation contingency); GLOSSARY terms "First Rule / Release-Age Exclusion / Govern / Register / Release Age".
+
+### Changed in 0.9.23 — two-phase Installed tab: instant list + update hints filled in place (ADR-0008)
+
+- **Problem (observed live 2026-10-03)**: update probes were welded into the installed-list endpoint behind a 60-min in-memory TTL — after publishing a release, reopening the panel served the stale cache and update hints lagged (quota-watch's new version stayed invisible 17 minutes after publish while dsh-market already showed it).
+- **Two parallel phases (zero new buttons)**: phase 1 `installed {probe:false}` returns the installed list immediately (registry matching and toggle phase untouched); phase 2 is a new `installedUpdates` method (`probeMode: 'only'`, **TTL=0 — a real probe on every panel mount**) that fills in ⬆ badges / the tab dot / "Upgrade all (N)" in place; failed checks still surface per item as "check incomplete" instead of pretending "up to date".
+- **Scope & side effects (documented in ADR-0008)**: installed tab only — browse-page probes, `dshm_list`/`dshm_outdated` tools and CLI are unchanged (default `probeMode: 'full'`); ttl=0 evicts shared host-namespace cache entries before re-probing, so browse/tools TTL hits receive fresher write-backs (data only gets fresher; code paths and their own TTL regimes unchanged); GitHub passive budget consumption rate rises (limits unchanged: 25/req, 50/h rolling) with graceful `latestError` degradation.
+- **Docs**: full decision record in `docs/adr/0008-installed-two-phase-probe.md`; DESIGN notes on the installed page / cache semantics; GLOSSARY term "Two-phase Load".
+
 ### Changed in 0.9.22 — upgrade activation classification (tarball diff, three states) + three-surface restart-hint split (ADR-0007)
 
 - **Problem (observed in 0.9.21)**: after upgrading `@iasiv5/dsh-skins` 1.2.3→1.3.0 the plugin was already live without a restart (client bundle rev hot-reload), yet all three surfaces still said "restart required" — the noise trains users to ignore the hint, and restarts have real costs (web service blip / manual desktop reopen).

package/docs/DESIGN.md

@@ -21,7 +21,7 @@
 - **严格 v1 schema**：顶层只允许 `version/plugins`，条目只允许 `id/name/description/category/tags/source/npm/github/homepage/icon`；未知字段、非法 ID/npm/GitHub/URL、重复 ID/tag、字段超限、`plugins` 超过 1,000 条均拒绝整份清单（不截断、不部分加载）；超过 200 条提示性能边界。
 - **缓存模型**：cache 按 namespace 分目录（Host 与 Agent tools 用 `host/`，独立 CLI 用 `cli/`，互不删除），按带算法版本的 cacheKey 分文件（`CacheFile v2`：原子临时文件 + fsync + rename，0700/0600，symlink 拒写，同 key 进程内写锁）。**候选验证只写候选 cache，绝不 prune 旧源**；settings 写入成功后才 `commitActiveSource`：先原子写 accepted-source metadata（`host/active-source.json`，仅 Host），再清理非当前 custom cache；metadata 失败不 prune、prune 失败保留旧 cache，均只降级为 warning，不撤销已生效的配置。切换后只保留默认缓存与当前 custom 缓存。
 - **统一安全 HTTP**：所有 JSON/text/HEAD 请求共享同一 primitive——手动重定向（每跳校验协议、最多 3 跳、循环检测、signal 传播、返回最终 URL）+ 响应大小上限 + 超时。
-- **秒开缓存语义（0.9.14 SWR）**：`loadRegistry` 与社区获取链的 TTL 过期不再同步等网络——磁盘缓存存在即**先回 stale**（registry `source='default-cache'`、社区 `status='stale'` 既有契约；stale 状态由设置页社区卡承接，市场页不提示临时缓存状态——0.9.15 修订），后台**单飞**刷新写回 cache（同 key 进行中复用；不接调用者 signal，后台自愈不被请求 abort 腰斩；`force`/candidate/显式下载三路径不经 SWR）。默认双线路**粘性**：`loadDefaultChain` 读 cache 记录的上次成功 `source` 排序线路（稳定排序，cache 缺失 = 原序，force 同样生效）。社区 bg 自愈是 force flight——**不走同版本短路**（`if (!opts.force)` 守卫），每 TTL 至多全量重拉一次正文（同步路径的短路优化保留）。页条目 latest 探测缓存为 `latest-cache.ts` 的**纯内存 Map + TTL**（0.9.20 ADR-0006，推翻 0.9.14 的「磁盘信封 write-through + 懒 seed、跨服务重启存活」——2026-10-03 事故实证发版窗口内重启/重开面板全吃陈旧值，重启即失效回归为特性；install/upgrade/uninstall 成功点由 market.ts 按 itemId 定向作废该条目全部 registryKey 变体，只失效不回写；0.9.14 遗留 `<cacheRoot>/latest/<ns>.json` 惰性文件由探测段一次性 best-effort 清扫，`latest/` 在 nsDir 之外、不受 `pruneCaches` 清扫的不变量不变）。客户端默认首页响应存 localStorage（10min TTL、双 zone 分键、读侧再过 normalize 收敛）——面板打开先渲染快照后 background 换新。
+- **秒开缓存语义（0.9.14 SWR）**：`loadRegistry` 与社区获取链的 TTL 过期不再同步等网络——磁盘缓存存在即**先回 stale**（registry `source='default-cache'`、社区 `status='stale'` 既有契约；stale 状态由设置页社区卡承接，市场页不提示临时缓存状态——0.9.15 修订），后台**单飞**刷新写回 cache（同 key 进行中复用；不接调用者 signal，后台自愈不被请求 abort 腰斩；`force`/candidate/显式下载三路径不经 SWR）。默认双线路**粘性**：`loadDefaultChain` 读 cache 记录的上次成功 `source` 排序线路（稳定排序，cache 缺失 = 原序，force 同样生效）。社区 bg 自愈是 force flight——**不走同版本短路**（`if (!opts.force)` 守卫），每 TTL 至多全量重拉一次正文（同步路径的短路优化保留）。页条目 latest 探测缓存为 `latest-cache.ts` 的**纯内存 Map + TTL**（0.9.20 ADR-0006，推翻 0.9.14 的「磁盘信封 write-through + 懒 seed、跨服务重启存活」——2026-10-03 事故实证发版窗口内重启/重开面板全吃陈旧值，重启即失效回归为特性；install/upgrade/uninstall 成功点由 market.ts 按 itemId 定向作废该条目全部 registryKey 变体，只失效不回写；0.9.14 遗留 `<cacheRoot>/latest/<ns>.json` 惰性文件由探测段一次性 best-effort 清扫，`latest/` 在 nsDir 之外、不受 `pruneCaches` 清扫的不变量不变）。客户端默认首页响应存 localStorage（10min TTL、双 zone 分键、读侧再过 normalize 收敛）——面板打开先渲染快照后 background 换新。已装面板第二段探测为 TTL=0 例外（ADR-0008）。
 - **live 语义**：registry 地址是 live 设置，应用成功即时生效（无需重启）；只有**首次部署新 Host 代码**需要一次用户确认后的 DSH Web 重启。`timeoutMs`/`cacheTtlMin` 亦为 live 读取；agent 框架注册时的静态工具 deadline 不承诺热更新。
 
 ### 2.2 Schema（v1 定稿，严格校验）
@@ -152,6 +152,8 @@ npm 安装 / GitHub 安装 / 升级 / 自升级 / 卸载是**同一个事务模
 
 与 `application`（Profile 变更事务词汇）的边界：`activation` 只是「新版本如何生效」的操作建议，不是事务状态——事务四态（applied/restart-required/overridden/failed）描述**变更本身**，`activation` 描述**生效方式**；两者不互相推导（GLOSSARY Avoid 行同源）。
 
+排除条目治理与登记（desktop 红线例外的唯一记载处为 ADR）：见 [ADR-0009](./adr/0009-release-age-exclude-governance.md)。
+
 ## 4. GUI（旗舰，v1 必须做好）
 
 0.4.0 增补：已装卡右上 `dshm-switch` 开关（受 `toggleable` 控制，锁因 title 提示）；sub 行相位点 `● active · v1.0.8 · npm`（相位点只映射 phase 五值，「已停用」归 Switch，两输入源各管各的）；开关结果通知按 `applied` 分流（live → 绿 toast「即时生效」；restart-required → 沿用重启横幅 + 一键重启）；安装遇兼容拦截（409 + issue）弹「仍要安装」确认（红字风险 + peers 清单 → `forceIncompatible` 重发）。
@@ -162,7 +164,7 @@ npm 安装 / GitHub 安装 / 升级 / 自升级 / 卸载是**同一个事务模
 3 个视图，**中文优先**，跟随 DSH Web 深色主题（0.7.0：卡片展开式详情已由 Modal 取代）：
 
 1. **市场页**（默认）：**分区制**（0.7.0 §2.6）——社区/精选/收藏三分区，各分区独立分类/搜索/排序/分页状态；搜索/分类/排序为**服务端处理**（Host 强制 `withLatest=true`、limit clamp 1..96 缺省 24，探测仅当前页）；`MarketPanel` 是市场/已装数据唯一 owner（请求 generation + AbortController 丢弃旧响应）；安装/卸载/升级完成后通过统一协调器同时刷新市场与已装快照，不要求关闭并重新打开面板；页码窗口化分页（24/48/96）+ 默认/自定义/缓存/不可用短提示（不含本地路径；0.5.0 的「超过 200 条性能提示」随分区退役）；详情 Modal 保留 README markdown 预览与 npm/GitHub 官方外链。
-2. **已装页**：profile 实际安装列表，标注来源（市场/非市场/未知）；registry 不可用时仍列出已装并标记；「可升级 → x.y.z」徽标 +「升级」；「卸载」。
+2. **已装页**：profile 实际安装列表，标注来源（市场/非市场/未知）；registry 不可用时仍列出已装并标记；「可升级 → x.y.z」徽标 +「升级」；「卸载」。两段加载（ADR-0008）：列表不等待探测（`probe:false`），更新提示由 `installedUpdates`（TTL=0）就地补上。
 3. **设置页**：registry 地址草稿 +「校验并应用」（先校验候选再写 settings，失败不落盘）/「恢复默认」/「下载默认 registry.json」（不改当前配置）/「检查条目可达性」（probe 统计 + 最多 100 条 issue，只读不改配置）；同时展示配置地址、当前生效配置、生效来源与 configStatus（含 rejected/回滚原因与维护性 warnings）；完整本地路径仅在此页显示。registry 配置为 **live 生效，不出现安装类重启横幅**；安装/卸载/升级仍保留重启横幅。
 
 技术：`src/client.js` 经 **esbuild** 打包为 `lib/client.js`；`window.__ModuleLoader__.load({ id: "dsh-m", factory })` 注册；**React 从 module loader require**（零额外运行时依赖）；manifest 注入 `@deepseek-ai/dsh-client-runtime`、`@deepseek-ai/dsh-client-ui-slots`、`@deepseek-ai/dsh-client-ui-settings`。

package/lib/client.js

@@ -689,10 +689,11 @@ var view_refresh_exports = {};
 __export(view_refresh_exports, {
   refreshAfterMutation: () => refreshAfterMutation
 });
-async function refreshAfterMutation({ marketReload, installedReload }) {
+async function refreshAfterMutation({ marketReload, installedReload, updatesReload }) {
   await Promise.all([
     marketReload(false),
-    installedReload()
+    installedReload(),
+    updatesReload()
   ]);
 }
 var init_view_refresh = __esm({
@@ -701,6 +702,53 @@ var init_view_refresh = __esm({
   }
 });
 
+// src/client/installed-updates.js
+var installed_updates_exports = {};
+__export(installed_updates_exports, {
+  applyInstalledUpdates: () => applyInstalledUpdates,
+  installedUpdateStats: () => installedUpdateStats
+});
+function applyInstalledUpdates(items, updates) {
+  if (!Array.isArray(items)) return [];
+  const byPkg = /* @__PURE__ */ new Map();
+  if (Array.isArray(updates)) {
+    for (const u of updates) {
+      if (!u || typeof u !== "object" || typeof u.pkg !== "string" || u.pkg === "") continue;
+      byPkg.set(u.pkg, u);
+    }
+  }
+  return items.map((it) => {
+    if (!it || typeof it !== "object") return it;
+    const u = byPkg.get(it.pkg);
+    if (!u) return it;
+    return {
+      ...it,
+      latestVersion: u.latestVersion ?? void 0,
+      latestTag: u.latestTag ?? void 0,
+      latestSha: u.latestSha ?? void 0,
+      outdated: u.outdated === true,
+      latestError: u.latestError ?? void 0,
+      latestErrorCode: u.latestErrorCode ?? void 0
+    };
+  });
+}
+function installedUpdateStats(items) {
+  const arr = Array.isArray(items) ? items : [];
+  let outdatedCount = 0;
+  let incompleteCount = 0;
+  for (const it of arr) {
+    if (!it || typeof it !== "object") continue;
+    if (it.outdated === true) outdatedCount += 1;
+    if (typeof it.latestError === "string" && it.latestError !== "") incompleteCount += 1;
+  }
+  return { outdatedCount, incompleteCount };
+}
+var init_installed_updates = __esm({
+  "src/client/installed-updates.js"() {
+    "use strict";
+  }
+});
+
 // src/client/operations.js
 var operations_exports = {};
 __export(operations_exports, {
@@ -1169,6 +1217,7 @@ var { toggleViewModel: toggleViewModel2, toggleNoticeKeys: toggleNoticeKeys2 } =
 var { pickPayload: pickPayload2, parseToolArgs: parseToolArgs2 } = (init_tool_view(), __toCommonJS(tool_view_exports));
 var { RESTART_POLL_MS: RESTART_POLL_MS2, RESTART_DEADLINE_MS: RESTART_DEADLINE_MS2, nextRestartWait: nextRestartWait2, isAmbiguousRestartRequestError: isAmbiguousRestartRequestError2 } = (init_restart_wait(), __toCommonJS(restart_wait_exports));
 var { refreshAfterMutation: refreshAfterMutation2 } = (init_view_refresh(), __toCommonJS(view_refresh_exports));
+var { applyInstalledUpdates: applyInstalledUpdates2, installedUpdateStats: installedUpdateStats2 } = (init_installed_updates(), __toCommonJS(installed_updates_exports));
 var { createOperationsStore: createOperationsStore2, restoreRecords: restoreRecords2, createOpsPump: createOpsPump2, opAppliesTo: opAppliesTo2, TERMINAL_CLEARABLE: TERMINAL_CLEARABLE2, upgradeNotify: upgradeNotify2 } = (init_operations(), __toCommonJS(operations_exports));
 var { createFavoritesStore: createFavoritesStore2, partitionStale: partitionStale2 } = (init_favorites(), __toCommonJS(favorites_exports));
 var { readSelfCheckCache: readSelfCheckCache2, writeSelfCheckCache: writeSelfCheckCache2, clearSelfCheckCache: clearSelfCheckCache2, deriveChipState: deriveChipState2 } = (init_self_check(), __toCommonJS(self_check_exports));
@@ -2924,8 +2973,9 @@ function ReadmeBlock({ pkg }) {
     state.truncated ? h("div", { className: "dshm-md-note" }, lookup("readme.truncated")) : null
   );
 }
-function InstalledTab({ notify, installed, onMutation, ops }) {
+function InstalledTab({ notify, installed, updates, onMutation, ops }) {
   const { loading, data, error, reload } = installed;
+  const updateRows = updates && updates.data && Array.isArray(updates.data.updates) ? updates.data.updates : [];
   const [openPkg, setOpenPkg] = useState(null);
   const [readmePkg, setReadmePkg] = useState(null);
   const activeMutateTarget = (ops.records.find((r) => r.kind !== "install" && (r.status === "running" || r.status === "queued" || r.status === "input")) || {}).target || null;
@@ -3004,7 +3054,7 @@ function InstalledTab({ notify, installed, onMutation, ops }) {
   };
   if (loading && !data) return h("div", { className: "dshm-empty" }, lookup("installed.loading"), Spin());
   if (error) return h("div", { className: "dshm-err" }, lookup("failed.read", { err: error }));
-  const items = data && data.items || [];
+  const items = applyInstalledUpdates2(data && data.items || [], updateRows);
   if (!items.length) return h("div", { className: "dshm-empty" }, `${lookup("installed.empty")} (${data.profileDir})`);
   return h(
     React.Fragment,
@@ -3626,7 +3676,8 @@ function MarketPanel({ onClose }) {
   const marketCommunity = useMarketData("community");
   const marketPrimary = useMarketData("primary");
   const markets = { community: marketCommunity, primary: marketPrimary };
-  const installed = useAsync(() => api("installed"), []);
+  const installed = useAsync(() => api("installed", { probe: false }), []);
+  const updates = useAsync(() => api("installedUpdates"), []);
   const [opRecords, setOpRecords] = useState(() => opsStore.list().map((r) => ({ ...r })));
   const syncOps = useCallback(() => setOpRecords(opsStore.list().map((r) => ({ ...r }))), []);
   const runOp = useCallback(
@@ -3683,14 +3734,14 @@ function MarketPanel({ onClose }) {
     [marketCommunity.reload, marketPrimary.reload]
   );
   const refreshViews = useCallback(
-    () => refreshAfterMutation2({ marketReload: marketReloadAll, installedReload: installed.reload }),
-    [marketReloadAll, installed.reload]
+    () => refreshAfterMutation2({ marketReload: marketReloadAll, installedReload: installed.reload, updatesReload: updates.reload }),
+    [marketReloadAll, installed.reload, updates.reload]
   );
   const onRegistryChanged = refreshViews;
   const stillApplies = useCallback(async (r) => {
     let fresh = null;
     try {
-      fresh = await api("installed");
+      fresh = await api("installed", { probe: false });
     } catch {
       fresh = null;
     }
@@ -3737,7 +3788,8 @@ function MarketPanel({ onClose }) {
     market: marketCommunity.data ? marketCommunity.data.total : null,
     installed: installed.data ? installed.data.items.length : null
   };
-  const outdatedCount = installed.data && Array.isArray(installed.data.items) ? installed.data.items.filter((x) => x && x.outdated).length : 0;
+  const mergedItems = installed.data && Array.isArray(installed.data.items) ? applyInstalledUpdates2(installed.data.items, updates.data && Array.isArray(updates.data.updates) ? updates.data.updates : []) : null;
+  const outdatedCount = installedUpdateStats2(mergedItems || []).outdatedCount;
   const [banner, setBanner] = useState(null);
   const [toast, setToast] = useState(null);
   useEffect(() => {
@@ -3817,7 +3869,7 @@ function MarketPanel({ onClose }) {
         "div",
         { className: "dshm-body" },
         tab === "market" ? h(MarketTab, { notify, markets, onMutation: refreshViews, ops, favorites, profileKind: profile?.kind ?? null }) : null,
-        tab === "installed" ? h(InstalledTab, { notify, installed, onMutation: refreshViews, ops }) : null,
+        tab === "installed" ? h(InstalledTab, { notify, installed, updates, onMutation: refreshViews, ops }) : null,
         tab === "settings" ? h(SettingsTab, { notify, onRegistryChanged }) : null,
         h(OperationsPanel, {
           records: opRecords,

package/lib/core/dsh-cli.js

@@ -11,6 +11,9 @@ import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { installTimeoutMs, WEB_PROFILE, webProfileDir } from './env.js';
 import { createProgressTracker } from './progress.js';
 import { applyPreciseBuilds, readPendingBuilds } from './build-approval.js';
+import { governExcludeBlock, parseNpmSpec, registerExclusion } from './exclude-governance.js';
+import { listInstalledPlugins } from './installed.js';
+const DUAL_CODE_RE = /ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION|ERR_PNPM_NO_MATURE_MATCHING_VERSION/;
 /** pnpm patchedDependencies 条目键与目标包匹配：`pkg` 或 `pkg@任意版本/区间`。 */
 function matchesPatchedKey(key, pkg) {
     return key === pkg || key.startsWith(`${pkg}@`);
@@ -579,54 +582,118 @@ export function makeAddViaLadder(deps) {
     const resolveBuilds = deps.resolveBuilds ?? writePreciseBuilds;
     const opts = (signal) => (signal !== undefined ? { signal } : undefined);
     return async (source, profileDir, signal) => {
-        const retryAfterPrepare = async () => {
-            // Y2（终审复审）：放行写入本身失败也必须转换为结果，维持「永不 throw」契约
-            let decision;
+        // ADR-0009 挂点1：委派前治理（fail-open）——已落盘的编辑以短语进 output（成功/失败都带）
+        let governNote = '';
+        try {
+            const gov = await (deps.govern ?? governExcludeBlock)(profileDir);
+            if (gov.changed && gov.mergedNames?.length)
+                governNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+        }
+        catch {
+            // fail-open：治理失败不阻塞
+        }
+        // 登记原料：npm 精确 spec + 上一版本（本地读，失败 → undefined）
+        const spec = parseNpmSpec(source);
+        let previousVersion;
+        if (spec) {
             try {
-                decision = resolveBuilds(profileDir);
+                previousVersion = deps.installedVersion
+                    ? await deps.installedVersion(profileDir, spec.pkg)
+                    : (await listInstalledPlugins(profileDir)).items.find((it) => it.pkg === spec.pkg)?.version;
             }
-            catch (err) {
-                const text = errText(err);
-                return { class: 'hard-fail', output: truncateOutput(text) };
+            catch {
+                previousVersion = undefined;
             }
+        }
+        let registerNote = '';
+        const safeRegister = async () => {
+            if (!spec)
+                return;
             try {
-                const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-                return { class: 'ok', output: truncateOutput(output), buildApprovals: decision.approvals, fallbackAllBuilds: decision.fallbackAll };
+                const reg = await (deps.register ?? registerExclusion)(profileDir, { ...spec, previousVersion });
+                if (reg.applied && reg.form)
+                    registerNote = `；排除条目已登记 ${spec.pkg}@${spec.version}（${reg.form}）`;
             }
-            catch (retryErr) {
-                return { ...classifyPnpmError(errText(retryErr)), output: truncateOutput(errText(retryErr)) };
+            catch {
+                // fail-open：登记失败不影响成功态
             }
         };
-        try {
-            const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-            return { class: 'ok', output: truncateOutput(output), buildApprovals: [], fallbackAllBuilds: false };
-        }
-        catch (err) {
-            const text = errText(err);
-            if (text.includes(PNPM_OUTCOME_CODES.PUBLIC_HOIST_PATTERN_DIFF)) {
+        const okOutcome = async (output, buildApprovals = [], fallbackAllBuilds = false) => {
+            await safeRegister();
+            return { class: 'ok', output: truncateOutput(output + governNote + governRetryNote + registerNote), buildApprovals, fallbackAllBuilds };
+        };
+        const failOutcome = (text) => ({ ...classifyPnpmError(text), output: truncateOutput(text + governNote + governRetryNote) });
+        // ADR-0009 挂点3：阶梯内每次真实 pnpm 命令统一包装——双码失败 → 治理 → changed 则
+        // 重试该命令一次（布尔全局保证每次 ladder 调用至多一次；四个失败出口共用）。
+        // 挂点3 已落盘的合并以短语并入 output（留痕契约含挂点3，与 hook1 短语去重）。
+        let governedRetryUsed = false;
+        let governRetryNote = '';
+        const attemptAdd = async (args) => {
+            try {
+                return { ok: true, output: await run(WEB_PROFILE, args, opts(signal)) };
+            }
+            catch (err) {
+                const text = errText(err);
+                if (governedRetryUsed || !DUAL_CODE_RE.test(text))
+                    return { ok: false, text };
+                governedRetryUsed = true;
                 try {
-                    await run(WEB_PROFILE, ['install', '--no-frozen-lockfile'], opts(signal));
+                    const gov = await (deps.govern ?? governExcludeBlock)(profileDir);
+                    if (!gov.changed)
+                        return { ok: false, text };
+                    if (gov.mergedNames?.length) {
+                        const note = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+                        if (!governNote.includes(note))
+                            governRetryNote = note;
+                    }
                 }
-                catch (rebuildErr) {
-                    const rebuildText = errText(rebuildErr);
-                    return { ...classifyPnpmError(rebuildText), output: truncateOutput(rebuildText) };
+                catch {
+                    return { ok: false, text };
                 }
                 try {
-                    const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-                    return { class: 'ok', output: truncateOutput(output), buildApprovals: [], fallbackAllBuilds: false };
+                    return { ok: true, output: await run(WEB_PROFILE, args, opts(signal)) };
                 }
                 catch (retryErr) {
-                    const retryText = errText(retryErr);
-                    if (isPrepareBlocked(retryText))
-                        return retryAfterPrepare();
-                    return { ...classifyPnpmError(retryText), output: truncateOutput(retryText) };
+                    return { ok: false, text: errText(retryErr) };
                 }
             }
-            if (!isPrepareBlocked(text)) {
-                return { ...classifyPnpmError(text), output: truncateOutput(text) };
+        };
+        const retryAfterPrepare = async () => {
+            // Y2（终审复审）：放行写入本身失败也必须转换为结果，维持「永不 throw」契约
+            let decision;
+            try {
+                decision = resolveBuilds(profileDir);
+            }
+            catch (err) {
+                const text = errText(err);
+                return { class: 'hard-fail', output: truncateOutput(text + governNote + governRetryNote) };
             }
-            return retryAfterPrepare();
+            const retried = await attemptAdd(['add', source]);
+            if (retried.ok)
+                return okOutcome(retried.output, decision.approvals, decision.fallbackAll);
+            return { ...classifyPnpmError(retried.text), output: truncateOutput(retried.text + governNote + governRetryNote) };
+        };
+        const first = await attemptAdd(['add', source]);
+        if (first.ok)
+            return okOutcome(first.output);
+        const text = first.text;
+        if (text.includes(PNPM_OUTCOME_CODES.PUBLIC_HOIST_PATTERN_DIFF)) {
+            // 重建 install 自身也过锁文件校验：双码治理+重试同样适用（attemptAdd 包装）
+            const rebuild = await attemptAdd(['install', '--no-frozen-lockfile']);
+            if (!rebuild.ok)
+                return failOutcome(rebuild.text);
+            const second = await attemptAdd(['add', source]);
+            if (second.ok)
+                return okOutcome(second.output);
+            const retryText = second.text;
+            if (isPrepareBlocked(retryText))
+                return retryAfterPrepare();
+            return failOutcome(retryText);
+        }
+        if (!isPrepareBlocked(text)) {
+            return failOutcome(text);
         }
+        return retryAfterPrepare();
     };
 }
 function errText(err) {

package/lib/core/exclude-governance.js

@@ -0,0 +1,264 @@
+/**
+ * 排除条目代管（ADR-0009）：pnpm-workspace.yaml `minimumReleaseAgeExclude` 块的
+ * 纯文本变换（解析 / 治理合并 / 登记）与落盘封装（原子写 + 官方同款锁 + fail-open）。
+ *
+ * 规范形态：每包一条、版本并集复合（`name@a || b`）；包名级保持裸名；scoped 名在
+ * YAML 中必须单引号包裹（`@` 不能作 plain scalar 开头）。治理只修不建；登记可为
+ * 无块的文件创建块；解析失败（含 `#` 注释行）一律弃写——pnpm 仍是最终执行者。
+ *
+ * 机理（首条规则生效）：pnpm evaluateVersionPolicy 每包名只认第一条排除规则，
+ * 同名后续规则死亡（dshmarket #732 实证）——同名合并即消除死规则。
+ * 语义对照（只读参考）：.dsh-research/dsh-market-clone/src/profile.ts:1310-1385（merge）。
+ */
+import { readFile as readFileFs } from 'node:fs/promises';
+import { join } from 'node:path';
+import { writeFileAtomic, withFileLock } from '@deepseek-ai/dsh-atomic-write';
+import { isExactVersion } from './versions.js';
+import { cachedPackumentTimes, DEFAULT_MINIMUM_RELEASE_AGE_MIN, readWorkspacePolicy } from './release-age.js';
+/** 块形态（`minimumReleaseAgeExclude:` + 块内 `- <条目>` 行）；行内数组等其它形态不在此列。 */
+const BLOCK_RE = /^minimumReleaseAgeExclude:[ \t]*\r?\n((?:[ \t]+-[^\r\n]*\r?\n?)*)/m;
+/** 任意形态的键存在性（含行内）；登记据此避免产生重复键。 */
+const KEY_ANY_FORM_RE = /^[ \t]*minimumReleaseAgeExclude[ \t]*:/m;
+const WS_FILE = 'pnpm-workspace.yaml';
+function splitEntry(raw) {
+    let text = raw.trim();
+    if (text.length >= 2 && ((text.startsWith("'") && text.endsWith("'")) || (text.startsWith('"') && text.endsWith('"')))) {
+        text = text.slice(1, -1);
+    }
+    const at = text.startsWith('@') ? text.indexOf('@', 1) : text.indexOf('@');
+    if (at === -1)
+        return text === '' ? null : { name: text, selectors: null };
+    const name = text.slice(0, at);
+    const selector = text.slice(at + 1).trim();
+    if (name === '' || selector === '')
+        return null;
+    return { name, selectors: selector.split('||').map((s) => s.trim()) };
+}
+/** 解析排除块：absent = 键缺失；unparseable = 块内含 `#` 或无法精确读取的条目（调用方弃写）。 */
+export function parseExcludeBlock(yaml) {
+    const block = BLOCK_RE.exec(yaml);
+    if (block === null)
+        return { kind: 'absent' };
+    const eol = /\r\n/.test(yaml) ? '\r\n' : '\n';
+    const indentMatch = /^([ \t]+)-/.exec(block[1]);
+    const indent = indentMatch === null ? '  ' : indentMatch[1];
+    const entries = [];
+    const rawLines = [];
+    for (const line of block[1].split(/\r?\n/)) {
+        if (line.trim() === '')
+            continue;
+        const m = /^[ \t]+-[ \t]*(.*?)[ \t]*$/.exec(line);
+        if (m === null || m[1].includes('#'))
+            return { kind: 'unparseable' };
+        const split = splitEntry(m[1]);
+        if (split === null)
+            return { kind: 'unparseable' };
+        entries.push({ name: split.name, selectors: split.selectors, quoted: /^['"]/.test(m[1]), raw: line });
+        rawLines.push(line);
+    }
+    return { kind: 'ok', entries, rawLines, eol, indent };
+}
+/** 规范行渲染：单选择器 `name@v`、多选择器 `name@a || b`、包名级裸名；scoped 名加单引号。 */
+function renderEntryLine(name, selectors, indent) {
+    const text = selectors === null || selectors.length === 0
+        ? name
+        : selectors.length === 1
+            ? `${name}@${selectors[0]}`
+            : `${name}@${selectors.join(' || ')}`;
+    return `${indent}- ${text.startsWith('@') ? `'${text.replaceAll("'", "''")}'` : text}`;
+}
+/**
+ * 治理：同名规则合并为规范形态（每包一条、版本并集、原首现顺序）；只修不建；
+ * 块缺失 → changed=false；解析失败 → null（弃写）。changed 的判定逐名比较
+ * 「合并后渲染行 vs 原始行」，只有实际被改写的名字进入 mergedNames。
+ */
+export function mergeExcludeRules(yaml) {
+    const parse = parseExcludeBlock(yaml);
+    if (parse.kind === 'absent')
+        return { yaml, changed: false, mergedNames: [], blockAbsent: true };
+    if (parse.kind === 'unparseable')
+        return null;
+    const { entries, rawLines, eol, indent } = parse;
+    const groups = new Map();
+    const order = [];
+    entries.forEach((e, i) => {
+        let g = groups.get(e.name);
+        if (g === undefined) {
+            g = { selectors: [], seen: new Set(), firstRaw: rawLines[i], count: 0 };
+            groups.set(e.name, g);
+            order.push(e.name);
+        }
+        g.count += 1;
+        if (e.selectors === null) {
+            // 包名级吞掉同名一切版本段
+            g.selectors = null;
+            g.seen.clear();
+        }
+        else if (g.selectors !== null) {
+            for (const s of e.selectors) {
+                if (!g.seen.has(s)) {
+                    g.seen.add(s);
+                    g.selectors.push(s);
+                }
+            }
+        }
+    });
+    const mergedNames = order.filter((name) => {
+        const g = groups.get(name);
+        if (g === undefined)
+            return false;
+        return g.count > 1 || renderEntryLine(name, g.selectors, indent) !== g.firstRaw;
+    });
+    if (mergedNames.length === 0)
+        return { yaml, changed: false, mergedNames: [], blockAbsent: false };
+    const lines = order.map((name) => {
+        const g = groups.get(name);
+        return renderEntryLine(name, g?.selectors ?? null, indent);
+    });
+    const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+    return { yaml: yaml.replace(BLOCK_RE, () => blockText), changed: true, mergedNames, blockAbsent: false };
+}
+function newRuleLine(target, indent) {
+    if (target.pkg.startsWith('@'))
+        return { line: renderEntryLine(target.pkg, [target.version], indent), form: 'created-scoped-exact' };
+    if (target.previousVersion !== undefined && target.previousVersion !== target.version) {
+        return { line: renderEntryLine(target.pkg, [target.version, target.previousVersion], indent), form: 'created-composite' };
+    }
+    return { line: renderEntryLine(target.pkg, [target.version], indent), form: 'created-exact' };
+}
+/**
+ * 登记：把目标精确版本并入该包**首条**规则（首条规则生效口径）；无既有规则时按
+ * scoped → 精确单条、非 scoped + 异版 previousVersion → 双选择器复合、其余 → 精确单条
+ * 新建；块缺失的文件在尾部创建块（键以行内等其它形式存在 → null，避免重复键）。
+ * 目标已被覆盖（包名级 / 选择器含该版本）→ noop。
+ */
+export function registerExclusionInYaml(yaml, target) {
+    const parse = parseExcludeBlock(yaml);
+    if (parse.kind === 'unparseable')
+        return null;
+    if (parse.kind === 'absent') {
+        if (KEY_ANY_FORM_RE.test(yaml))
+            return null;
+        const eol = /\r\n/.test(yaml) ? '\r\n' : '\n';
+        const { line, form } = newRuleLine(target, '  ');
+        const base = yaml === '' || yaml.endsWith(eol) ? yaml : yaml + eol;
+        return { yaml: `${base}minimumReleaseAgeExclude:${eol}${line}${eol}`, changed: true, form };
+    }
+    const { entries, rawLines, eol, indent } = parse;
+    const lines = [...rawLines];
+    const idx = entries.findIndex((e) => e.name === target.pkg);
+    if (idx >= 0) {
+        const e = entries[idx];
+        if (e.selectors === null)
+            return { yaml, changed: false, form: 'noop' };
+        if (e.selectors.includes(target.version))
+            return { yaml, changed: false, form: 'noop' };
+        lines[idx] = renderEntryLine(target.pkg, [...e.selectors, target.version], indent);
+        const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+        return { yaml: yaml.replace(BLOCK_RE, () => blockText), changed: true, form: 'merged' };
+    }
+    const { line, form } = newRuleLine(target, indent);
+    lines.push(line);
+    const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+    return { yaml: yaml.replace(BLOCK_RE, () => blockText), changed: true, form };
+}
+export function parseNpmSpec(spec) {
+    let text = spec.trim();
+    if (text.length >= 2 && ((text.startsWith("'") && text.endsWith("'")) || (text.startsWith('"') && text.endsWith('"')))) {
+        text = text.slice(1, -1);
+    }
+    if (text === '' || text.includes(':'))
+        return null;
+    const at = text.startsWith('@') ? text.indexOf('@', 1) : text.indexOf('@');
+    if (at <= 0)
+        return null;
+    const pkg = text.slice(0, at);
+    const version = text.slice(at + 1);
+    if (pkg === '' || version === '' || !isExactVersion(version))
+        return null;
+    return { pkg, version };
+}
+/**
+ * 委派前治理：读-改-写全程持官方同款锁（`withFileLock(<profile>/package.json)`，
+ * toggle 同先例），changed 才原子写。fail-open：任何失败返回结构化 reason，不抛——
+ * pnpm 是最终执行者。锁只串行持锁写者，不防不持锁的 pnpm 追加（残余风险见 ADR-0009）。
+ */
+export async function governExcludeBlock(profileDir, deps = {}) {
+    if (!profileDir)
+        return { ok: true, changed: false, reason: 'no-dir' };
+    const doRead = deps.readFile ?? ((path) => readFileFs(path, 'utf8'));
+    const doWrite = deps.writeFile ??
+        (async (path, text) => {
+            await writeFileAtomic(path, text, { mode: 0o600 });
+        });
+    const file = join(profileDir, WS_FILE);
+    try {
+        return await withFileLock(join(profileDir, 'package.json'), async () => {
+            let yaml;
+            try {
+                yaml = await doRead(file);
+            }
+            catch {
+                return { ok: false, changed: false, reason: 'no-file' };
+            }
+            if (!KEY_ANY_FORM_RE.test(yaml))
+                return { ok: true, changed: false, reason: 'no-block' };
+            const merged = mergeExcludeRules(yaml);
+            if (merged === null)
+                return { ok: false, changed: false, reason: 'unparseable' };
+            if (!merged.changed)
+                return { ok: true, changed: false, reason: 'clean' };
+            await doWrite(file, merged.yaml);
+            return { ok: true, changed: true, mergedNames: merged.mergedNames };
+        });
+    }
+    catch {
+        return { ok: false, changed: false, reason: 'write-failed' };
+    }
+}
+/**
+ * 成功后登记：仅对发布时刻可判「窗口内」（显式 age 值优先，缺省 1440 分钟）的目标
+ * 触发；时刻不可得一律不登记（不发明）。本地检查（文件缺席 → no-file）先于 registry
+ * 探测——缺省绑定下无块文件零网络。与治理同锁同 fail-open 纪律。
+ */
+export async function registerExclusion(profileDir, target, deps = {}) {
+    if (!profileDir)
+        return { applied: false, reason: 'no-dir' };
+    const doRead = deps.readFile ?? ((path) => readFileFs(path, 'utf8'));
+    const doWrite = deps.writeFile ??
+        (async (path, text) => {
+            await writeFileAtomic(path, text, { mode: 0o600 });
+        });
+    const file = join(profileDir, WS_FILE);
+    try {
+        return await withFileLock(join(profileDir, 'package.json'), async () => {
+            // 本地检查先行：文件缺席直接 no-file（不发 registry 探测——缺省绑定下测试离线可跑）
+            let yaml;
+            try {
+                yaml = await doRead(file);
+            }
+            catch {
+                return { applied: false, reason: 'no-file' };
+            }
+            const times = await (deps.packumentTimes ?? cachedPackumentTimes)(target.pkg, 12_000);
+            const now = deps.nowMs ?? Date.now();
+            const publishedAt = times ? Date.parse(times[target.version] ?? '') : NaN;
+            if (!Number.isFinite(publishedAt))
+                return { applied: false, reason: 'not-young' };
+            const policy = await readWorkspacePolicy(profileDir);
+            const windowMin = policy?.minimumReleaseAgeMin ?? DEFAULT_MINIMUM_RELEASE_AGE_MIN;
+            if (now >= publishedAt + windowMin * 60_000)
+                return { applied: false, reason: 'not-young' };
+            const next = registerExclusionInYaml(yaml, target);
+            if (next === null)
+                return { applied: false, reason: 'unparseable' };
+            if (!next.changed)
+                return { applied: false, reason: 'up-to-date', form: next.form };
+            await doWrite(file, next.yaml);
+            return { applied: true, form: next.form };
+        });
+    }
+    catch {
+        return { applied: false, reason: 'write-failed' };
+    }
+}

package/lib/core/host-api.js

@@ -385,15 +385,43 @@ export function createApiDispatcher(ctx) {
                     // 0.9.5 双 profile 读路径接线（实机回归 2026-10-01）：desktop 下已装列表此前
                     // 漏传 profile → 落回 webProfileDir，已装页恒显「web profile 尚未安装任何插件」。
                     // 与 tools.ts dshm_list 同款接线（profile.dir 单一事实源）。
+                    // 两段加载（ADR-0008）：body.probe === false → 跳过探测段（面板第一段快列表）；
+                    // 缺省 'full'——工具/CLI/旧客户端行为不变。
                     const result = await d.listInstalledWithMeta(cfg(), {
                         namespace: 'host',
                         profileDir: profile.dir,
                         profile: profile.name,
+                        probeMode: body.probe === false ? 'none' : 'full',
                         signal,
                     });
                     payload = { ...result };
                     break;
                 }
+                case 'installedUpdates': {
+                    // 两段加载（ADR-0008）第二段：probeMode 'only' → ttlMin=0 永远新鲜（先删共享缓存条目再重探）。
+                    // 响应只保留更新字段且含全部已装项（latestError 项也在——client 的「检查未完成」依赖它），
+                    // 不携带 items/others 全量负载。
+                    await ctx.controller.ensureReady();
+                    const result = await d.listInstalledWithMeta(cfg(), {
+                        namespace: 'host',
+                        profileDir: profile.dir,
+                        profile: profile.name,
+                        probeMode: 'only',
+                        signal,
+                    });
+                    payload = {
+                        updates: result.items.map((it) => ({
+                            pkg: it.pkg,
+                            latestVersion: it.latestVersion ?? null,
+                            latestTag: it.latestTag ?? null,
+                            latestSha: it.latestSha ?? null,
+                            outdated: it.outdated,
+                            latestError: it.latestError ?? null,
+                            latestErrorCode: it.latestErrorCode ?? null,
+                        })),
+                    };
+                    break;
+                }
                 case 'readme': {
                     const target = strArg(body, 'pkg');
                     if (!target)

package/lib/core/market.js

@@ -637,9 +637,14 @@ export async function listInstalledWithMeta(cfg = {}, opts = {}, deps = {}) {
     }
     const registryState = stateOf(loaded);
     matchInstalled(items, community.merged);
-    // 0.9.20：latest 缓存纯内存（ADR-0006）——探测段前仅一次性清扫 0.9.14 遗留磁盘信封
-    await ensureLatestCacheSwept({ namespace, profile: opts.profile });
-    await probeLatest(items, { merged: community.merged, registryAddress: loaded.configuredAddress, ttlMin: Math.max(0, cfg.cacheTtlMin ?? 60) }, d, { namespace, signal, githubBudget, remaining, timeoutMs: cfg.timeoutMs ?? 20_000 });
+    // 两段加载（ADR-0008）：probeMode 控制探测段——缺省 'full' 行为不变；'none' 面板快列表跳过探测；
+    // 'only' 面板第二段 ttlMin=0 永远新鲜（readLatestCache(key,0) 先删共享条目再重探：host ns 下浏览页/
+    // 工具的 TTL 命中被刷新为更新值，预算消耗速率上升、上限不变，超限走 latestError 降级）。
+    if ((opts.probeMode ?? 'full') !== 'none') {
+        // 0.9.20：latest 缓存纯内存（ADR-0006）——探测段前仅一次性清扫 0.9.14 遗留磁盘信封
+        await ensureLatestCacheSwept({ namespace, profile: opts.profile });
+        await probeLatest(items, { merged: community.merged, registryAddress: loaded.configuredAddress, ttlMin: opts.probeMode === 'only' ? 0 : Math.max(0, cfg.cacheTtlMin ?? 60) }, d, { namespace, signal, githubBudget, remaining, timeoutMs: cfg.timeoutMs ?? 20_000 });
+    }
     return { items, others: installed.others, profileDir: installed.profileDir, registryState, community: community.summary };
 }
 /** matching（主+社区合并条目）：命中主条目或社区条目都写 registryId；社区命中再标 community。 */

package/lib/core/profile-ops.js

@@ -31,6 +31,7 @@ import { npmLatest as defaultNpmLatest, githubLatestTag as defaultGithubLatestTa
 import { classifyUpgradeActivation } from './activation.js';
 import { togglePlugin, ToggleError } from './toggle.js';
 import { describeReleaseAgeFailure, releaseAgePrecheck } from './release-age.js';
+import { governExcludeBlock, registerExclusion } from './exclude-governance.js';
 // 0.9.19：等待期失败翻译移入 release-age.ts（describeReleaseAgeFailure）——全量违规解析 +
 // 目标/旁包分述。0.9.10 版只取第一条违规并把旁包名字当成本次目标、给「改用 DSH Web」的
 // 失配指引（本机 quota-watch 0.1.15 事件实证：被拦的是旁包 dsh-m@0.9.18，文案却让用户等
@@ -121,9 +122,23 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     else {
         throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 安装`);
     }
-    // 0.9.19：供应链等待期预检——pnpm 11 锁文件校验会拦死整次安装，且失败前目标已写入
-    // node_modules（账实分裂）；目标太新或锁内「独立精确排除条目」未满期 → 委派前结构化拒绝。
-    if (entry.source === 'npm' && version !== undefined) {
+    // ADR-0009：委派前治理（排除块规范形态，fail-open）+ 供应链等待期预检收敛——默认策略
+    // 放行并附陈述（官方管理器对显式点名的新版本直接安装并自动登记）；显式设置 age 或
+    // strict 开启才拒绝。治理已落盘的编辑在成功 output 与失败 message 双路留痕。
+    let governanceNote = '';
+    let releaseAgeNotice = '';
+    let governedMergedNames;
+    if (entry.source === 'npm' && version !== undefined && opts.profileDir) {
+        try {
+            const gov = await (deps.governExclude ?? governExcludeBlock)(opts.profileDir);
+            if (gov.changed && gov.mergedNames?.length) {
+                governanceNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+                governedMergedNames = gov.mergedNames;
+            }
+        }
+        catch {
+            // fail-open：治理失败不阻塞委派（pnpm 仍是最终执行者）
+        }
         const gate = await releaseAgePrecheck({
             pkg,
             version,
@@ -132,20 +147,35 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
             signal: opts.signal,
             deps: { packumentTimes: deps.packumentTimes, workspacePolicy: deps.workspacePolicy },
         });
-        if (gate.blocked)
-            throw new DesktopOpsError('release-age-wait', gate.message, { blockers: gate.blockers });
+        if (gate.blocked) {
+            throw new DesktopOpsError('release-age-wait', gate.message + governanceNote, { blockers: gate.blockers, ...(governedMergedNames !== undefined ? { governanceMerged: governedMergedNames } : {}) });
+        }
+        if (gate.notice)
+            releaseAgeNotice = `；${gate.notice}`;
     }
     let change;
     let bundleName;
+    let registerNote;
+    let managed;
     try {
-        ({ change, bundleName } = await runManagedInstall(service, { pkg, spec, version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }));
+        managed = await runManagedInstall(service, { pkg, spec, version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }, { governExclude: deps.governExclude, registerExclude: deps.registerExclude, packumentTimes: deps.packumentTimes });
+        change = managed.change;
+        bundleName = managed.bundleName;
+        registerNote = managed.registerNote;
     }
     catch (err) {
         if (err instanceof DesktopBuildApprovalNeeded) {
-            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message };
+            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message + governanceNote };
+        }
+        if (err instanceof Error) {
+            if (governanceNote !== '' && !err.message.includes(governanceNote))
+                err.message += governanceNote;
+            if (managed?.governRetryNote !== undefined && !err.message.includes(managed.governRetryNote))
+                err.message += managed.governRetryNote;
         }
         throw err;
     }
+    const retryNote = managed.governRetryNote !== undefined && !governanceNote.includes(managed.governRetryNote) ? managed.governRetryNote : '';
     return {
         id: entry.id,
         pkg,
@@ -158,7 +188,7 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
         ...(compat !== null ? { compat } : {}),
         ...(compatSkipped ? { compatSkipped } : {}),
         needsRestart: true,
-        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
+        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}${governanceNote}${retryNote}${releaseAgeNotice}${registerNote ?? ''}`,
         via: 'desktop-manager',
         ...(change.application === 'overridden' ? { overridden: true } : {}),
     };
@@ -208,7 +238,17 @@ function enableStageFailureMessage(pkg, change) {
     }
     return `安装后启用阶段失败（${pkg}；application=failed、stage=enable${change.error?.code ? `、error=${change.error.code}` : ''}）：${writtenText}，请在官方 Desktop 插件页查看状态或重试`;
 }
-async function runManagedInstall(service, ctx) {
+const DUAL_CODE_RE = /ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION|ERR_PNPM_NO_MATURE_MATCHING_VERSION/;
+/** 可治理的失败形态：cancelled / build-blocked 不治理不重试（与 mapFailure 分类一致）。 */
+function isGovableFailure(change) {
+    if (change.application === 'cancelled')
+        return false;
+    const pending = Array.isArray(change.pendingBuilds) ? change.pendingBuilds.filter((n) => typeof n === 'string') : [];
+    if (change.packageResult?.kind === 'build-blocked' && pending.length > 0)
+        return false;
+    return change.application === 'failed' || change.error !== undefined;
+}
+async function runManagedInstall(service, ctx, deps = {}) {
     const installOnce = async () => changeOf(await service.installBundle(ctx.spec, {
         enabled: true,
         ...(ctx.approvedBuilds && ctx.approvedBuilds.length > 0 ? { approvedBuilds: ctx.approvedBuilds } : {}),
@@ -276,9 +316,46 @@ async function runManagedInstall(service, ctx) {
             await sleepMs(enableRetryDelayMs);
         change = await installOnce();
     }
-    if (change.application === 'failed' || change.application === 'cancelled' || change.error)
-        await mapFailure(change);
-    return verifyAndBundle(change);
+    // ADR-0009 挂点3：双码失败 → 治理 → changed 则重试该命令一次（每次调用至多一次；
+    // cancelled / build-blocked 不治理不重试）。仍败走既有 mapFailure（含账实分裂复读）；
+    // 挂点3 已落盘的合并以短语并入失败 message 与成功 output（留痕契约含挂点3）。
+    let governRetryNote;
+    if (isGovableFailure(change) && DUAL_CODE_RE.test(`${change.error?.diagnostic ?? ''}\n${change.error?.code ?? ''}`)) {
+        const gov = await (deps.governExclude ?? governExcludeBlock)(ctx.profileDir ?? '');
+        if (gov.changed) {
+            if (gov.mergedNames?.length)
+                governRetryNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+            change = await installOnce();
+        }
+    }
+    if (change.application === 'failed' || change.application === 'cancelled' || change.error) {
+        try {
+            await mapFailure(change);
+        }
+        catch (err) {
+            if (err instanceof Error && governRetryNote !== undefined && !err.message.includes(governRetryNote))
+                err.message += governRetryNote;
+            throw err;
+        }
+    }
+    const verified = await verifyAndBundle(change);
+    // ADR-0009 挂点2：成功后登记（仅 npm 源窗口内目标；fail-open，applied 短语由调用方并入 output）
+    let registerNote;
+    if (ctx.profileDir && ctx.version) {
+        try {
+            const reg = await (deps.registerExclude ?? registerExclusion)(ctx.profileDir, {
+                pkg: ctx.pkg,
+                version: ctx.version,
+                ...(ctx.previousVersion !== undefined ? { previousVersion: ctx.previousVersion } : {}),
+            }, deps.packumentTimes ? { packumentTimes: deps.packumentTimes } : {});
+            if (reg.applied && reg.form)
+                registerNote = `；排除条目已登记 ${ctx.pkg}@${ctx.version}（${reg.form}）`;
+        }
+        catch {
+            // fail-open：登记失败不影响安装/升级成功态
+        }
+    }
+    return { ...verified, ...(registerNote !== undefined || governRetryNote !== undefined ? { registerNote, governRetryNote } : {}) };
 }
 /**
  * Desktop 卸载（0.9.8，dsh-market 同策略）：removeBundle 委派 + ChangeResult 判定 +
@@ -383,8 +460,21 @@ async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
     else {
         throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 升级`);
     }
-    // 0.9.19：供应链等待期预检（同 desktopInstallLocked；0:15 quota-watch 事件即此形态实证）
-    if (entry.source === 'npm' && version !== undefined) {
+    // ADR-0009：委派前治理 + 预检收敛（同 desktopInstallLocked；0:15 quota-watch 事件为治理前的旧形态实证）
+    let governanceNote = '';
+    let releaseAgeNotice = '';
+    let governedMergedNames;
+    if (entry.source === 'npm' && version !== undefined && opts.profileDir) {
+        try {
+            const gov = await (deps.governExclude ?? governExcludeBlock)(opts.profileDir);
+            if (gov.changed && gov.mergedNames?.length) {
+                governanceNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+                governedMergedNames = gov.mergedNames;
+            }
+        }
+        catch {
+            // fail-open：治理失败不阻塞委派
+        }
         const gate = await releaseAgePrecheck({
             pkg,
             version,
@@ -393,20 +483,35 @@ async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
             signal: opts.signal,
             deps: { packumentTimes: deps.packumentTimes, workspacePolicy: deps.workspacePolicy },
         });
-        if (gate.blocked)
-            throw new DesktopOpsError('release-age-wait', gate.message, { blockers: gate.blockers });
+        if (gate.blocked) {
+            throw new DesktopOpsError('release-age-wait', gate.message + governanceNote, { blockers: gate.blockers, ...(governedMergedNames !== undefined ? { governanceMerged: governedMergedNames } : {}) });
+        }
+        if (gate.notice)
+            releaseAgeNotice = `；${gate.notice}`;
     }
     let change;
     let bundleName;
+    let registerNote;
+    let managed;
     try {
-        ({ change, bundleName } = await runManagedInstall(service, { pkg, spec, version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }));
+        managed = await runManagedInstall(service, { pkg, spec, version, previousVersion: target.version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }, { governExclude: deps.governExclude, registerExclude: deps.registerExclude, packumentTimes: deps.packumentTimes });
+        change = managed.change;
+        bundleName = managed.bundleName;
+        registerNote = managed.registerNote;
     }
     catch (err) {
         if (err instanceof DesktopBuildApprovalNeeded) {
-            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message };
+            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message + governanceNote };
+        }
+        if (err instanceof Error) {
+            if (governanceNote !== '' && !err.message.includes(governanceNote))
+                err.message += governanceNote;
+            if (managed?.governRetryNote !== undefined && !err.message.includes(managed.governRetryNote))
+                err.message += managed.governRetryNote;
         }
         throw err;
     }
+    const retryNote = managed.governRetryNote !== undefined && !governanceNote.includes(managed.governRetryNote) ? managed.governRetryNote : '';
     // 0.9.22 生效判定：npm 源升级在成功点分类；任何异常 fail-open 到 unknown，绝不影响升级成功态
     let activation;
     let needsRestart = true;
@@ -432,7 +537,7 @@ async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
         ...(compat !== null ? { compat } : {}),
         ...(compatSkipped ? { compatSkipped } : {}),
         needsRestart,
-        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
+        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}${governanceNote}${retryNote}${releaseAgeNotice}${registerNote ?? ''}`,
         via: 'desktop-manager',
         ...(change.application === 'overridden' ? { overridden: true } : {}),
         fromVersion: target.version,

package/lib/core/registry.js

@@ -825,3 +825,14 @@ export async function loadDefaultRegistry(cfg = {}, opts = {}) {
     }
     return loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: true });
 }
+/**
+ * verified 污染检测（know-how 022）：`verified` 只记 **DSH 运行时**装机实测版本；
+ * 历史上反复出现把**插件自身版本号**误填进 verified 的事故（实证：dsh-quota-watch
+ * 条目曾出现 "0.1.0"——那是 quota-watch 的插件版本，不是任何 DSH 运行时版本）。
+ * 把条目 verified 与该插件自身 npm 已发布版本求交集，非空即高度可疑（warn 不 fail：
+ * 极小概率某代 DSH 与插件版本字面重合，人工复核后放行）。
+ */
+export function verifiedPollution(verified, publishedVersions) {
+    const own = new Set(publishedVersions);
+    return (verified ?? []).filter((v) => own.has(v));
+}

package/lib/core/release-age.js

@@ -1,35 +1,34 @@
 /**
- * Desktop 供应链等待期（minimumReleaseAge）预检与失败翻译（0.9.19）。
+ * 供应链等待期（minimumReleaseAge）预检与失败翻译（0.9.19 立基，0.9.x 按治理语义收敛，ADR-0009）。
  *
- * pnpm 11.7 实机实证（2026-10-03，本机 desktop profile，官方管理器操作日志
- * operation-hNjgaN / operation-l5fXEd）：
- * 1. 显式安装「太新」目标：非严格模式放行，pnpm 自动向 pnpm-workspace.yaml 的
- *    `minimumReleaseAgeExclude` 追加一条「独立精确条目」（`pkg@ver` 形态）；
- * 2. 但后续任何包操作的锁文件级供应链校验（`Verifying lockfile against
- *    supply-chain policies (N entries)`）不认可 pnpm 自己追加的这种条目——
- *    任何一条未满期的 `pkg@ver` 都会拦死整个安装，且与本次目标无关（旁包能拦住
- *    所有升级，0.9.18 拦住 quota-watch 0.1.15 升级即实证）；
+ * 实证基准（2026-10-03，本机 desktop profile，pnpm 11.7.0，官方管理器操作日志
+ * operation-zsc4ei / operation-L8oq1z / operation-l5fXEd）：
+ * 1. 默认策略（未显式设置 age、未开 strict = 非严格）下，显式点名的「太新」目标
+ *    直接放行安装，pnpm 自动向 pnpm-workspace.yaml 的 `minimumReleaseAgeExclude`
+ *    追加 `pkg@ver` 条目（"Added 1 entry …"）；
+ * 2. pnpm 的 evaluateVersionPolicy **每包名只认第一条排除规则**，同名后续规则死亡
+ *    （dshmarket #732 实证，首条规则生效机理）——死规则会让等待期内全部包操作被
+ *    锁文件级校验拦死（0:15 quota-watch 连坐实录）；
  * 3. 校验失败前目标包可能已写入 node_modules，官方管理器只回滚 manifest/lockfile
- *    →「账实分裂」：界面实装新版 active，账本仍旧版，下次包操作静默回退。
+ *    →「账实分裂」，下次包操作静默回退。
  *
- * 对策（零文件级红线不破：只读 profile 文件，绝不写）：
- * ① 委派前预检（releaseAgePrecheck）：目标版本或锁内「不被校验认可的独立精确
- *    排除条目」任一未满等待期 → 结构化拒绝，不委派官方管理器；
+ * 职责（ADR-0009）：
+ * ① 委派前预检（releaseAgePrecheck）：仅「显式设置 age 或 strict 开启」时对窗口内
+ *    目标拒绝（附可重试时刻）；默认策略放行并返回陈述性 notice。锁内坏形态由
+ *    exclude-governance 的治理挂点处理，本模块不再预拒绝（0.9.19 ②腿退役）。
  * ② 失败翻译（describeReleaseAgeFailure）：解析全部违规条目，按「本次目标 vs
- *    锁内旁包」分别给出发布时刻与可重试时刻——不再把旁包名字冒充成本次目标被拦。
+ *    旁包」分述发布时刻与可重试时刻。
+ * ③ cachedPackumentTimes：预检与登记共用的带缓存 packument 探测。
  *
- * fail-open 纪律：发布时刻不可得 / 策略文件不可读 / profileDir 缺席 / 命中有效排除
- * 条目（包名级、`||` 复合、scoped 独立精确）→ 一律放行；pnpm 仍是最终执行者。
+ * fail-open 纪律：发布时刻不可得 / 策略文件不可读 / profileDir 缺席 / 命中任一
+ * 排除规则（首条规则口径）→ 一律放行；pnpm 仍是最终执行者。
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isMap, isScalar, isSeq, parseDocument } from 'yaml';
 import { fetchJsonLimited } from './httpx.js';
-import { isExactVersion } from './versions.js';
 /** pnpm 11.7 实机测得的策略窗口：24h（operation-l5fXEd 的 cutoff = 检查时刻 − 1440min）。 */
 export const DEFAULT_MINIMUM_RELEASE_AGE_MIN = 1440;
-/** 锁内「独立精确排除条目」旁包探测上限（防清单失控；超出部分放弃预判，交 pnpm 兜底）。 */
-export const MAX_EXCLUDE_PROBES = 8;
 function scalarNumber(value) {
     if (typeof value === 'number' && Number.isFinite(value))
         return value;
@@ -43,7 +42,7 @@ function scalarNumber(value) {
  * 调用方按默认窗口 + 无排除处理，绝不抛。
  */
 export function parseWorkspacePolicy(text) {
-    const empty = { minimumReleaseAgeMin: null, excludes: [] };
+    const empty = { explicitAge: false, minimumReleaseAgeMin: null, strict: false, excludes: [] };
     let document;
     try {
         document = parseDocument(text);
@@ -62,10 +61,17 @@ export function parseWorkspacePolicy(text) {
             }
         }
     }
-    // yaml 库的 Map.get() 对标量返回已解包的原始值（number/string），对集合返回节点——两种形态都兜住
+    // yaml 库的 Map.get() 对标量返回已解包的原始值（number/string/boolean），对集合返回节点——两种形态都兜住
     const rawAge = document.contents.get('minimumReleaseAge');
     const age = isScalar(rawAge) ? scalarNumber(rawAge.value) : scalarNumber(rawAge);
-    return { minimumReleaseAgeMin: age !== null && age > 0 ? age : null, excludes };
+    const rawStrict = document.contents.get('minimumReleaseAgeStrict');
+    const strict = rawStrict === true || (isScalar(rawStrict) && rawStrict.value === true);
+    return {
+        explicitAge: rawAge !== undefined && rawAge !== null,
+        minimumReleaseAgeMin: age !== null && age > 0 ? age : null,
+        strict,
+        excludes,
+    };
 }
 export function excludeMatch(selector, pkg, version) {
     const s = selector.trim();
@@ -73,7 +79,7 @@ export function excludeMatch(selector, pkg, version) {
         return 'no';
     if (s.includes('||')) {
         for (const part of s.split('||')) {
-            if (excludeMatch(part.trim(), pkg, version) !== 'no')
+            if (excludeMatch(part.trim(), pkg, version) === 'effective')
                 return 'effective';
         }
         return 'no';
@@ -83,30 +89,7 @@ export function excludeMatch(selector, pkg, version) {
         // 包名级（dshmarket）或裸版本号段（只应出现在复合条目内，顶层出现视为包名比较）
         return s === pkg || s === version ? 'effective' : 'no';
     }
-    const namePart = s.slice(0, at);
-    const verPart = s.slice(at + 1);
-    if (namePart !== pkg)
-        return 'no';
-    if (verPart === version) {
-        return pkg.startsWith('@') ? 'effective' : 'unreliable-unscoped-exact';
-    }
-    return 'no';
-}
-/** 从独立精确条目提取 (pkg, version)；复合/包名级/版本段非精确 semver → null。 */
-export function splitExactSelector(selector) {
-    const s = selector.trim();
-    if (s === '' || s.includes('||'))
-        return null;
-    const at = s.lastIndexOf('@');
-    if (at <= 0)
-        return null;
-    const pkg = s.slice(0, at);
-    const version = s.slice(at + 1);
-    if (!isExactVersion(version))
-        return null;
-    if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))
-        return null;
-    return { pkg, version, reliable: pkg.startsWith('@') };
+    return s.slice(0, at) === pkg && s.slice(at + 1) === version ? 'effective' : 'no';
 }
 const VIOLATION_RE = /(\S+@\S+) was published at ([^,]+), within the minimumReleaseAge cutoff \(([^)]+)\)/g;
 /** 解析 pnpm 诊断里的全部等待期违规条目（0.9.10 只取第一条是「报错报错包」的根因之一）。 */
@@ -196,72 +179,65 @@ export async function readWorkspacePolicy(profileDir) {
 }
 const packumentCache = new Map();
 const PACKUMENT_CACHE_TTL_MS = 5 * 60_000;
+/**
+ * 带进程内缓存的 packument time 探测（TTL 5min）：预检与登记（exclude-governance）
+ * 共用——同一操作里预检刚拉过的 packument 不二次拉取（8MiB 级全量）。
+ */
+export async function cachedPackumentTimes(pkg, timeoutMs = 12_000, signal) {
+    const hit = packumentCache.get(pkg);
+    if (hit && Date.now() - hit.at < PACKUMENT_CACHE_TTL_MS)
+        return hit.times;
+    const times = await npmPackumentTimes(pkg, timeoutMs, signal);
+    packumentCache.set(pkg, { at: Date.now(), times });
+    return times;
+}
 /** 测试钩子：清空 packument 进程内缓存。 */
 export function _resetReleaseAgeCachesForTests() {
     packumentCache.clear();
 }
 /**
- * 委派前预检：目标版本与锁内「不被校验认可的独立精确排除条目」逐个对发布时刻，
- * 任一未满等待期 → 结构化拒绝（blocked + 多行理由）。零写操作；不确定一律放行。
+ * 委派前预检（ADR-0009 收敛语义）：仅当策略显式设置 age 或开启 strict 时，对窗口内
+ * 且未被任一排除规则覆盖（首条规则口径）的目标结构化拒绝（附可重试时刻）；默认
+ * 策略（非严格）放行并返回陈述性 notice——官方管理器对显式点名的新版本会直接
+ * 安装并自动登记，锁内坏形态由 exclude-governance 的治理挂点处理。零写操作；
+ * fail-open：发布时刻不可得 / profileDir 缺席 / 命中排除规则 → 放行。
  */
 export async function releaseAgePrecheck(input) {
-    // profileDir 缺席 = 读不到操作员排除条目 → 不预判（避免误拦操作员显式 pin 的安装）
+    // profileDir 缺席 = 读不到操作员排除条目与策略 → 不预判
     if (!input.profileDir)
         return { blocked: false };
     const now = input.nowMs ?? Date.now();
     const policy = input.deps?.workspacePolicy
         ? await input.deps.workspacePolicy(input.profileDir)
         : await readWorkspacePolicy(input.profileDir);
-    const policyMin = policy?.minimumReleaseAgeMin ?? DEFAULT_MINIMUM_RELEASE_AGE_MIN;
+    const explicit = policy?.explicitAge ?? false;
+    const strict = policy?.strict ?? false;
+    const policyMin = explicit && policy?.minimumReleaseAgeMin != null ? policy.minimumReleaseAgeMin : DEFAULT_MINIMUM_RELEASE_AGE_MIN;
     const probe = async (pkg) => {
-        const hit = packumentCache.get(pkg);
-        if (hit && Date.now() - hit.at < PACKUMENT_CACHE_TTL_MS)
-            return hit.times;
-        const times = await (input.deps?.packumentTimes ?? npmPackumentTimes)(pkg, Math.min(input.timeoutMs ?? 20_000, 12_000), input.signal);
-        packumentCache.set(pkg, { at: Date.now(), times });
-        return times;
+        if (input.deps?.packumentTimes)
+            return input.deps.packumentTimes(pkg, Math.min(input.timeoutMs ?? 20_000, 12_000), input.signal);
+        return cachedPackumentTimes(pkg, 12_000, input.signal);
     };
-    const blockers = [];
-    // ① 本次目标版本的发布时刻（有效排除条目覆盖 → 放行）
     const times = await probe(input.pkg);
     const publishedAt = times ? Date.parse(times[input.version] ?? '') : NaN;
-    if (Number.isFinite(publishedAt)) {
-        const exempt = (policy?.excludes ?? []).some((sel) => excludeMatch(sel, input.pkg, input.version) === 'effective');
-        if (!exempt) {
-            const deadline = publishedAt + policyMin * 60_000;
-            if (now < deadline) {
-                blockers.push({ entry: `${input.pkg}@${input.version}`, role: 'target', publishedAt, deadline });
-            }
-        }
-    }
-    // ② 锁内「不被校验认可的独立精确排除条目」（非 scoped）——任何一条未满期都会拦死整次安装
-    const seen = new Set([`${input.pkg}@${input.version}`]);
-    const candidates = (policy?.excludes ?? [])
-        .map((sel) => splitExactSelector(sel))
-        .filter((x) => x !== null && !x.reliable);
-    for (const ex of candidates.slice(0, MAX_EXCLUDE_PROBES)) {
-        const entry = `${ex.pkg}@${ex.version}`;
-        if (seen.has(entry))
-            continue;
-        seen.add(entry);
-        const t2 = await probe(ex.pkg);
-        const pub = t2 ? Date.parse(t2[ex.version] ?? '') : NaN;
-        if (!Number.isFinite(pub))
-            continue;
-        const deadline = pub + policyMin * 60_000;
-        if (now < deadline) {
-            blockers.push({ entry, role: 'lockfile-exclude', publishedAt: pub, deadline });
-        }
-    }
-    if (blockers.length === 0)
+    if (!Number.isFinite(publishedAt))
         return { blocked: false };
-    const lines = ['官方管理器的供应链策略（minimumReleaseAge）将拦截本次安装，已提前拒绝（未触碰 profile 文件）：'];
-    for (const b of blockers) {
-        lines.push(b.role === 'target'
-            ? `· 目标 ${b.entry}：发布于 ${fmtLocal(b.publishedAt)}，预计 ${fmtLocal(b.deadline)} 后满等待期`
-            : `· 锁内排除条目 ${b.entry}：发布于 ${fmtLocal(b.publishedAt)}，预计 ${fmtLocal(b.deadline)} 后满等待期（pnpm 自动追加的独立精确条目不被锁文件校验认可，等待期内任何官方包操作都会被拦）`);
+    const exempt = (policy?.excludes ?? []).some((sel) => excludeMatch(sel, input.pkg, input.version) === 'effective');
+    const deadline = publishedAt + policyMin * 60_000;
+    if (exempt || now >= deadline)
+        return { blocked: false };
+    if (!explicit && !strict) {
+        return {
+            blocked: false,
+            notice: `目标 ${input.pkg}@${input.version} 发布于 ${fmtLocal(publishedAt)}（等待期内）：官方管理器将按显式点名安装，装好后 dsh-m 会登记豁免条目`,
+        };
     }
-    const maxDeadline = Math.max(...blockers.map((b) => b.deadline));
-    lines.push(`预计 ${fmtLocal(maxDeadline)} 后可重试；等待期内也可由操作员修正 pnpm-workspace.yaml 的排除条目形态（包名级/复合）解除拦截`);
-    return { blocked: true, message: lines.join('\n'), blockers };
+    const lines = ['官方管理器的供应链策略（minimumReleaseAge）将拦截本次安装，已提前拒绝（未触碰 profile 文件）：'];
+    lines.push(`· 目标 ${input.pkg}@${input.version}：发布于 ${fmtLocal(publishedAt)}，预计 ${fmtLocal(deadline)} 后满等待期`);
+    lines.push(`预计 ${fmtLocal(deadline)} 后可重试；等待期内也可由操作员修正 pnpm-workspace.yaml 的排除条目形态（包名级/复合）解除拦截`);
+    return {
+        blocked: true,
+        message: lines.join('\n'),
+        blockers: [{ entry: `${input.pkg}@${input.version}`, role: 'target', publishedAt, deadline }],
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.22",
+  "version": "0.9.24",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",

package/registry.json

@@ -99,10 +99,10 @@
     {
       "id": "dsh-copilot-auth",
       "name": "DSH Copilot Auth",
-      "description": "为内置 Copilot 提供方补登录/注销设置页与开箱路由；模型目录兜底不覆盖定制。适配 0.1.7-rc.2 与 0.2.0-rc.1，旧版用 1.1.x。",
+      "description": "内置 Copilot 登录注销页与开箱路由；目录兜底不覆盖定制，桌面版不支持目录刷新。已适配 0.1.7-rc.2 与 0.2.0-rc.1/rc.2。",
       "category": "self-dev",
       "tags": ["Copilot", "认证", "模型接入", "工具"],
-      "verified": ["0.1.7-rc.2", "0.2.0-rc.1"],
+      "verified": ["0.1.7-rc.2", "0.2.0-rc.1", "0.2.0-rc.2"],
       "source": "npm",
       "npm": "@inventec/dsh-copilot-auth",
       "github": "iasiv5/dsh-copilot-auth",
@@ -114,7 +114,7 @@
       "description": "GLM 与 Copilot 额度悬浮球：胶囊、详情面板与侧栏卡片，宿主解析凭据，适配 web 与 desktop。",
       "category": "self-dev",
       "tags": ["配额", "悬浮球", "GLM", "Copilot"],
-      "verified": ["0.1.7-rc.2", "0.1.0"],
+      "verified": ["0.1.7-rc.2", "0.2.0-rc.2"],
       "source": "npm",
       "npm": "@iasiv5/dsh-quota-watch",
       "github": "iasiv5/dsh-quota-watch",