dsh-m 0.9.23 → 0.9.24

package/CHANGELOG.md

@@ -8,6 +8,13 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.24 变更：排除条目代管——供应链等待期从「提前拒绝」到「治理 + 登记」（ADR-0009）
+
+- **问题（实机 2026-10-03 实证）**：0.9.19 的委派前预检把「目标版本未满 24h 等待期」预测成"官方管理器必拦"并提前拒绝——同目标 dsh-market 却能装上（copilot-auth@1.2.4 发布 8 分钟、quota-watch@0.1.21 两例）。pnpm 11.7 默认非严格策略对显式点名的新版本本来就放行并自动登记排除条目，预检的墙并不存在。
+- **三挂点代管**：① 委派前治理——desktop profile 排除块的坏形态（pnpm 自追加的死规则）合并为"每包一条、版本并集复合"；② 装机成功后登记——等待期内目标并入排除块（scoped 精确单条 / 非 scoped 目标+上一版双选择器）；③ 双码失败（`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` / `ERR_PNPM_NO_MATURE_MATCHING_VERSION`）→ 治理 → 至多重试一次，仍败走既有失败翻译与账实分裂复读。web ladder 同套三挂点。
+- **边界与安全**：红线收窄出唯一例外（desktop 仅此块、仅委派前后挂点、原子写、解析失败即弃、留痕不落全文）；治理/登记全程持官方同款锁并 fail-open——任何失败不阻塞委派，pnpm 仍是最终执行者；显式设置 age 或 strict 的 profile 仍前置拒绝并给可重试时刻；机理按"首条规则生效"口径改判（know-how 020 §2.4 形态论退役）。
+- **文档**：决策全文 `docs/adr/0009-release-age-exclude-governance.md`（含 9 项评估过不做的栅栏附录与观察预案）；GLOSSARY 新词「首条规则/排除条目/治理/登记/等待期」。
+
 ### 0.9.23 变更：已装页两段加载——列表秒开 + 更新提示就地补 ⬆（ADR-0008）
 
 - **问题（实机 2026-10-03 实证）**：更新探测焊在已装列表接口里且带 60min 内存 TTL——发版后重开面板吃到陈旧缓存，升级提示迟迟不出现（quota-watch 新版发布 17 分钟后面板仍无提示，dshmarket 同刻已见）。
@@ -249,6 +256,13 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Changed in 0.9.24 — release-age exclusion governance: from pre-flight refusal to govern + register (ADR-0009)
+
+- **Problem (observed live 2026-10-03)**: the 0.9.19 pre-flight precheck predicted "the official manager will block a target inside the 24h release-age window" and refused up front — while dsh-market installed the very same targets (copilot-auth@1.2.4 published 8 minutes prior; quota-watch@0.1.21). pnpm 11.7's default non-strict policy admits explicitly named fresh releases and auto-registers their exclusion entries; the wall the precheck predicted did not exist.
+- **Three governance hooks**: (1) pre-delegation govern — merge malformed exclusion shapes (pnpm's auto-appended dead rules) into "one rule per package, version union"; (2) post-success register — fold in-window targets into the exclusion block (scoped exact / non-scoped target+previous composite); (3) on dual-code failure (`ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION` / `ERR_PNPM_NO_MATURE_MATCHING_VERSION`) → govern → retry the command at most once, then fall through to the existing failure translation. The web ladder gets the same three hooks.
+- **Boundary & safety**: the red line narrows by exactly one exception (desktop: this block only, delegation hooks only, atomic write, parse-failure bail-out, tracing without file dumps); govern/register hold the official same lock and fail open — any failure never blocks delegation, pnpm stays the final enforcer; profiles that explicitly set `minimumReleaseAge` or `minimumReleaseAgeStrict` still get refused up front with a retry time; the mechanism verdict follows "first rule wins" (know-how 020 §2.4 form-theory retired).
+- **Docs**: full decision record in `docs/adr/0009-release-age-exclude-governance.md` (with a fence appendix of 9 evaluated-and-skipped items and the observation contingency); GLOSSARY terms "First Rule / Release-Age Exclusion / Govern / Register / Release Age".
+
 ### Changed in 0.9.23 — two-phase Installed tab: instant list + update hints filled in place (ADR-0008)
 
 - **Problem (observed live 2026-10-03)**: update probes were welded into the installed-list endpoint behind a 60-min in-memory TTL — after publishing a release, reopening the panel served the stale cache and update hints lagged (quota-watch's new version stayed invisible 17 minutes after publish while dsh-market already showed it).

package/docs/DESIGN.md

@@ -152,6 +152,8 @@ npm 安装 / GitHub 安装 / 升级 / 自升级 / 卸载是**同一个事务模
 
 与 `application`（Profile 变更事务词汇）的边界：`activation` 只是「新版本如何生效」的操作建议，不是事务状态——事务四态（applied/restart-required/overridden/failed）描述**变更本身**，`activation` 描述**生效方式**；两者不互相推导（GLOSSARY Avoid 行同源）。
 
+排除条目治理与登记（desktop 红线例外的唯一记载处为 ADR）：见 [ADR-0009](./adr/0009-release-age-exclude-governance.md)。
+
 ## 4. GUI（旗舰，v1 必须做好）
 
 0.4.0 增补：已装卡右上 `dshm-switch` 开关（受 `toggleable` 控制，锁因 title 提示）；sub 行相位点 `● active · v1.0.8 · npm`（相位点只映射 phase 五值，「已停用」归 Switch，两输入源各管各的）；开关结果通知按 `applied` 分流（live → 绿 toast「即时生效」；restart-required → 沿用重启横幅 + 一键重启）；安装遇兼容拦截（409 + issue）弹「仍要安装」确认（红字风险 + peers 清单 → `forceIncompatible` 重发）。

package/lib/core/dsh-cli.js

@@ -11,6 +11,9 @@ import { dirname, isAbsolute, join, resolve } from 'node:path';
 import { installTimeoutMs, WEB_PROFILE, webProfileDir } from './env.js';
 import { createProgressTracker } from './progress.js';
 import { applyPreciseBuilds, readPendingBuilds } from './build-approval.js';
+import { governExcludeBlock, parseNpmSpec, registerExclusion } from './exclude-governance.js';
+import { listInstalledPlugins } from './installed.js';
+const DUAL_CODE_RE = /ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION|ERR_PNPM_NO_MATURE_MATCHING_VERSION/;
 /** pnpm patchedDependencies 条目键与目标包匹配：`pkg` 或 `pkg@任意版本/区间`。 */
 function matchesPatchedKey(key, pkg) {
     return key === pkg || key.startsWith(`${pkg}@`);
@@ -579,54 +582,118 @@ export function makeAddViaLadder(deps) {
     const resolveBuilds = deps.resolveBuilds ?? writePreciseBuilds;
     const opts = (signal) => (signal !== undefined ? { signal } : undefined);
     return async (source, profileDir, signal) => {
-        const retryAfterPrepare = async () => {
-            // Y2（终审复审）：放行写入本身失败也必须转换为结果，维持「永不 throw」契约
-            let decision;
+        // ADR-0009 挂点1：委派前治理（fail-open）——已落盘的编辑以短语进 output（成功/失败都带）
+        let governNote = '';
+        try {
+            const gov = await (deps.govern ?? governExcludeBlock)(profileDir);
+            if (gov.changed && gov.mergedNames?.length)
+                governNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+        }
+        catch {
+            // fail-open：治理失败不阻塞
+        }
+        // 登记原料：npm 精确 spec + 上一版本（本地读，失败 → undefined）
+        const spec = parseNpmSpec(source);
+        let previousVersion;
+        if (spec) {
             try {
-                decision = resolveBuilds(profileDir);
+                previousVersion = deps.installedVersion
+                    ? await deps.installedVersion(profileDir, spec.pkg)
+                    : (await listInstalledPlugins(profileDir)).items.find((it) => it.pkg === spec.pkg)?.version;
             }
-            catch (err) {
-                const text = errText(err);
-                return { class: 'hard-fail', output: truncateOutput(text) };
+            catch {
+                previousVersion = undefined;
             }
+        }
+        let registerNote = '';
+        const safeRegister = async () => {
+            if (!spec)
+                return;
             try {
-                const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-                return { class: 'ok', output: truncateOutput(output), buildApprovals: decision.approvals, fallbackAllBuilds: decision.fallbackAll };
+                const reg = await (deps.register ?? registerExclusion)(profileDir, { ...spec, previousVersion });
+                if (reg.applied && reg.form)
+                    registerNote = `；排除条目已登记 ${spec.pkg}@${spec.version}（${reg.form}）`;
             }
-            catch (retryErr) {
-                return { ...classifyPnpmError(errText(retryErr)), output: truncateOutput(errText(retryErr)) };
+            catch {
+                // fail-open：登记失败不影响成功态
             }
         };
-        try {
-            const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-            return { class: 'ok', output: truncateOutput(output), buildApprovals: [], fallbackAllBuilds: false };
-        }
-        catch (err) {
-            const text = errText(err);
-            if (text.includes(PNPM_OUTCOME_CODES.PUBLIC_HOIST_PATTERN_DIFF)) {
+        const okOutcome = async (output, buildApprovals = [], fallbackAllBuilds = false) => {
+            await safeRegister();
+            return { class: 'ok', output: truncateOutput(output + governNote + governRetryNote + registerNote), buildApprovals, fallbackAllBuilds };
+        };
+        const failOutcome = (text) => ({ ...classifyPnpmError(text), output: truncateOutput(text + governNote + governRetryNote) });
+        // ADR-0009 挂点3：阶梯内每次真实 pnpm 命令统一包装——双码失败 → 治理 → changed 则
+        // 重试该命令一次（布尔全局保证每次 ladder 调用至多一次；四个失败出口共用）。
+        // 挂点3 已落盘的合并以短语并入 output（留痕契约含挂点3，与 hook1 短语去重）。
+        let governedRetryUsed = false;
+        let governRetryNote = '';
+        const attemptAdd = async (args) => {
+            try {
+                return { ok: true, output: await run(WEB_PROFILE, args, opts(signal)) };
+            }
+            catch (err) {
+                const text = errText(err);
+                if (governedRetryUsed || !DUAL_CODE_RE.test(text))
+                    return { ok: false, text };
+                governedRetryUsed = true;
                 try {
-                    await run(WEB_PROFILE, ['install', '--no-frozen-lockfile'], opts(signal));
+                    const gov = await (deps.govern ?? governExcludeBlock)(profileDir);
+                    if (!gov.changed)
+                        return { ok: false, text };
+                    if (gov.mergedNames?.length) {
+                        const note = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+                        if (!governNote.includes(note))
+                            governRetryNote = note;
+                    }
                 }
-                catch (rebuildErr) {
-                    const rebuildText = errText(rebuildErr);
-                    return { ...classifyPnpmError(rebuildText), output: truncateOutput(rebuildText) };
+                catch {
+                    return { ok: false, text };
                 }
                 try {
-                    const output = await run(WEB_PROFILE, ['add', source], opts(signal));
-                    return { class: 'ok', output: truncateOutput(output), buildApprovals: [], fallbackAllBuilds: false };
+                    return { ok: true, output: await run(WEB_PROFILE, args, opts(signal)) };
                 }
                 catch (retryErr) {
-                    const retryText = errText(retryErr);
-                    if (isPrepareBlocked(retryText))
-                        return retryAfterPrepare();
-                    return { ...classifyPnpmError(retryText), output: truncateOutput(retryText) };
+                    return { ok: false, text: errText(retryErr) };
                 }
             }
-            if (!isPrepareBlocked(text)) {
-                return { ...classifyPnpmError(text), output: truncateOutput(text) };
+        };
+        const retryAfterPrepare = async () => {
+            // Y2（终审复审）：放行写入本身失败也必须转换为结果，维持「永不 throw」契约
+            let decision;
+            try {
+                decision = resolveBuilds(profileDir);
+            }
+            catch (err) {
+                const text = errText(err);
+                return { class: 'hard-fail', output: truncateOutput(text + governNote + governRetryNote) };
             }
-            return retryAfterPrepare();
+            const retried = await attemptAdd(['add', source]);
+            if (retried.ok)
+                return okOutcome(retried.output, decision.approvals, decision.fallbackAll);
+            return { ...classifyPnpmError(retried.text), output: truncateOutput(retried.text + governNote + governRetryNote) };
+        };
+        const first = await attemptAdd(['add', source]);
+        if (first.ok)
+            return okOutcome(first.output);
+        const text = first.text;
+        if (text.includes(PNPM_OUTCOME_CODES.PUBLIC_HOIST_PATTERN_DIFF)) {
+            // 重建 install 自身也过锁文件校验：双码治理+重试同样适用（attemptAdd 包装）
+            const rebuild = await attemptAdd(['install', '--no-frozen-lockfile']);
+            if (!rebuild.ok)
+                return failOutcome(rebuild.text);
+            const second = await attemptAdd(['add', source]);
+            if (second.ok)
+                return okOutcome(second.output);
+            const retryText = second.text;
+            if (isPrepareBlocked(retryText))
+                return retryAfterPrepare();
+            return failOutcome(retryText);
+        }
+        if (!isPrepareBlocked(text)) {
+            return failOutcome(text);
         }
+        return retryAfterPrepare();
     };
 }
 function errText(err) {

package/lib/core/exclude-governance.js

@@ -0,0 +1,264 @@
+/**
+ * 排除条目代管（ADR-0009）：pnpm-workspace.yaml `minimumReleaseAgeExclude` 块的
+ * 纯文本变换（解析 / 治理合并 / 登记）与落盘封装（原子写 + 官方同款锁 + fail-open）。
+ *
+ * 规范形态：每包一条、版本并集复合（`name@a || b`）；包名级保持裸名；scoped 名在
+ * YAML 中必须单引号包裹（`@` 不能作 plain scalar 开头）。治理只修不建；登记可为
+ * 无块的文件创建块；解析失败（含 `#` 注释行）一律弃写——pnpm 仍是最终执行者。
+ *
+ * 机理（首条规则生效）：pnpm evaluateVersionPolicy 每包名只认第一条排除规则，
+ * 同名后续规则死亡（dshmarket #732 实证）——同名合并即消除死规则。
+ * 语义对照（只读参考）：.dsh-research/dsh-market-clone/src/profile.ts:1310-1385（merge）。
+ */
+import { readFile as readFileFs } from 'node:fs/promises';
+import { join } from 'node:path';
+import { writeFileAtomic, withFileLock } from '@deepseek-ai/dsh-atomic-write';
+import { isExactVersion } from './versions.js';
+import { cachedPackumentTimes, DEFAULT_MINIMUM_RELEASE_AGE_MIN, readWorkspacePolicy } from './release-age.js';
+/** 块形态（`minimumReleaseAgeExclude:` + 块内 `- <条目>` 行）；行内数组等其它形态不在此列。 */
+const BLOCK_RE = /^minimumReleaseAgeExclude:[ \t]*\r?\n((?:[ \t]+-[^\r\n]*\r?\n?)*)/m;
+/** 任意形态的键存在性（含行内）；登记据此避免产生重复键。 */
+const KEY_ANY_FORM_RE = /^[ \t]*minimumReleaseAgeExclude[ \t]*:/m;
+const WS_FILE = 'pnpm-workspace.yaml';
+function splitEntry(raw) {
+    let text = raw.trim();
+    if (text.length >= 2 && ((text.startsWith("'") && text.endsWith("'")) || (text.startsWith('"') && text.endsWith('"')))) {
+        text = text.slice(1, -1);
+    }
+    const at = text.startsWith('@') ? text.indexOf('@', 1) : text.indexOf('@');
+    if (at === -1)
+        return text === '' ? null : { name: text, selectors: null };
+    const name = text.slice(0, at);
+    const selector = text.slice(at + 1).trim();
+    if (name === '' || selector === '')
+        return null;
+    return { name, selectors: selector.split('||').map((s) => s.trim()) };
+}
+/** 解析排除块：absent = 键缺失；unparseable = 块内含 `#` 或无法精确读取的条目（调用方弃写）。 */
+export function parseExcludeBlock(yaml) {
+    const block = BLOCK_RE.exec(yaml);
+    if (block === null)
+        return { kind: 'absent' };
+    const eol = /\r\n/.test(yaml) ? '\r\n' : '\n';
+    const indentMatch = /^([ \t]+)-/.exec(block[1]);
+    const indent = indentMatch === null ? '  ' : indentMatch[1];
+    const entries = [];
+    const rawLines = [];
+    for (const line of block[1].split(/\r?\n/)) {
+        if (line.trim() === '')
+            continue;
+        const m = /^[ \t]+-[ \t]*(.*?)[ \t]*$/.exec(line);
+        if (m === null || m[1].includes('#'))
+            return { kind: 'unparseable' };
+        const split = splitEntry(m[1]);
+        if (split === null)
+            return { kind: 'unparseable' };
+        entries.push({ name: split.name, selectors: split.selectors, quoted: /^['"]/.test(m[1]), raw: line });
+        rawLines.push(line);
+    }
+    return { kind: 'ok', entries, rawLines, eol, indent };
+}
+/** 规范行渲染：单选择器 `name@v`、多选择器 `name@a || b`、包名级裸名；scoped 名加单引号。 */
+function renderEntryLine(name, selectors, indent) {
+    const text = selectors === null || selectors.length === 0
+        ? name
+        : selectors.length === 1
+            ? `${name}@${selectors[0]}`
+            : `${name}@${selectors.join(' || ')}`;
+    return `${indent}- ${text.startsWith('@') ? `'${text.replaceAll("'", "''")}'` : text}`;
+}
+/**
+ * 治理：同名规则合并为规范形态（每包一条、版本并集、原首现顺序）；只修不建；
+ * 块缺失 → changed=false；解析失败 → null（弃写）。changed 的判定逐名比较
+ * 「合并后渲染行 vs 原始行」，只有实际被改写的名字进入 mergedNames。
+ */
+export function mergeExcludeRules(yaml) {
+    const parse = parseExcludeBlock(yaml);
+    if (parse.kind === 'absent')
+        return { yaml, changed: false, mergedNames: [], blockAbsent: true };
+    if (parse.kind === 'unparseable')
+        return null;
+    const { entries, rawLines, eol, indent } = parse;
+    const groups = new Map();
+    const order = [];
+    entries.forEach((e, i) => {
+        let g = groups.get(e.name);
+        if (g === undefined) {
+            g = { selectors: [], seen: new Set(), firstRaw: rawLines[i], count: 0 };
+            groups.set(e.name, g);
+            order.push(e.name);
+        }
+        g.count += 1;
+        if (e.selectors === null) {
+            // 包名级吞掉同名一切版本段
+            g.selectors = null;
+            g.seen.clear();
+        }
+        else if (g.selectors !== null) {
+            for (const s of e.selectors) {
+                if (!g.seen.has(s)) {
+                    g.seen.add(s);
+                    g.selectors.push(s);
+                }
+            }
+        }
+    });
+    const mergedNames = order.filter((name) => {
+        const g = groups.get(name);
+        if (g === undefined)
+            return false;
+        return g.count > 1 || renderEntryLine(name, g.selectors, indent) !== g.firstRaw;
+    });
+    if (mergedNames.length === 0)
+        return { yaml, changed: false, mergedNames: [], blockAbsent: false };
+    const lines = order.map((name) => {
+        const g = groups.get(name);
+        return renderEntryLine(name, g?.selectors ?? null, indent);
+    });
+    const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+    return { yaml: yaml.replace(BLOCK_RE, () => blockText), changed: true, mergedNames, blockAbsent: false };
+}
+function newRuleLine(target, indent) {
+    if (target.pkg.startsWith('@'))
+        return { line: renderEntryLine(target.pkg, [target.version], indent), form: 'created-scoped-exact' };
+    if (target.previousVersion !== undefined && target.previousVersion !== target.version) {
+        return { line: renderEntryLine(target.pkg, [target.version, target.previousVersion], indent), form: 'created-composite' };
+    }
+    return { line: renderEntryLine(target.pkg, [target.version], indent), form: 'created-exact' };
+}
+/**
+ * 登记：把目标精确版本并入该包**首条**规则（首条规则生效口径）；无既有规则时按
+ * scoped → 精确单条、非 scoped + 异版 previousVersion → 双选择器复合、其余 → 精确单条
+ * 新建；块缺失的文件在尾部创建块（键以行内等其它形式存在 → null，避免重复键）。
+ * 目标已被覆盖（包名级 / 选择器含该版本）→ noop。
+ */
+export function registerExclusionInYaml(yaml, target) {
+    const parse = parseExcludeBlock(yaml);
+    if (parse.kind === 'unparseable')
+        return null;
+    if (parse.kind === 'absent') {
+        if (KEY_ANY_FORM_RE.test(yaml))
+            return null;
+        const eol = /\r\n/.test(yaml) ? '\r\n' : '\n';
+        const { line, form } = newRuleLine(target, '  ');
+        const base = yaml === '' || yaml.endsWith(eol) ? yaml : yaml + eol;
+        return { yaml: `${base}minimumReleaseAgeExclude:${eol}${line}${eol}`, changed: true, form };
+    }
+    const { entries, rawLines, eol, indent } = parse;
+    const lines = [...rawLines];
+    const idx = entries.findIndex((e) => e.name === target.pkg);
+    if (idx >= 0) {
+        const e = entries[idx];
+        if (e.selectors === null)
+            return { yaml, changed: false, form: 'noop' };
+        if (e.selectors.includes(target.version))
+            return { yaml, changed: false, form: 'noop' };
+        lines[idx] = renderEntryLine(target.pkg, [...e.selectors, target.version], indent);
+        const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+        return { yaml: yaml.replace(BLOCK_RE, () => blockText), changed: true, form: 'merged' };
+    }
+    const { line, form } = newRuleLine(target, indent);
+    lines.push(line);
+    const blockText = `minimumReleaseAgeExclude:${eol}${lines.join(eol)}${eol}`;
+    return { yaml: yaml.replace(BLOCK_RE, () => blockText), changed: true, form };
+}
+export function parseNpmSpec(spec) {
+    let text = spec.trim();
+    if (text.length >= 2 && ((text.startsWith("'") && text.endsWith("'")) || (text.startsWith('"') && text.endsWith('"')))) {
+        text = text.slice(1, -1);
+    }
+    if (text === '' || text.includes(':'))
+        return null;
+    const at = text.startsWith('@') ? text.indexOf('@', 1) : text.indexOf('@');
+    if (at <= 0)
+        return null;
+    const pkg = text.slice(0, at);
+    const version = text.slice(at + 1);
+    if (pkg === '' || version === '' || !isExactVersion(version))
+        return null;
+    return { pkg, version };
+}
+/**
+ * 委派前治理：读-改-写全程持官方同款锁（`withFileLock(<profile>/package.json)`，
+ * toggle 同先例），changed 才原子写。fail-open：任何失败返回结构化 reason，不抛——
+ * pnpm 是最终执行者。锁只串行持锁写者，不防不持锁的 pnpm 追加（残余风险见 ADR-0009）。
+ */
+export async function governExcludeBlock(profileDir, deps = {}) {
+    if (!profileDir)
+        return { ok: true, changed: false, reason: 'no-dir' };
+    const doRead = deps.readFile ?? ((path) => readFileFs(path, 'utf8'));
+    const doWrite = deps.writeFile ??
+        (async (path, text) => {
+            await writeFileAtomic(path, text, { mode: 0o600 });
+        });
+    const file = join(profileDir, WS_FILE);
+    try {
+        return await withFileLock(join(profileDir, 'package.json'), async () => {
+            let yaml;
+            try {
+                yaml = await doRead(file);
+            }
+            catch {
+                return { ok: false, changed: false, reason: 'no-file' };
+            }
+            if (!KEY_ANY_FORM_RE.test(yaml))
+                return { ok: true, changed: false, reason: 'no-block' };
+            const merged = mergeExcludeRules(yaml);
+            if (merged === null)
+                return { ok: false, changed: false, reason: 'unparseable' };
+            if (!merged.changed)
+                return { ok: true, changed: false, reason: 'clean' };
+            await doWrite(file, merged.yaml);
+            return { ok: true, changed: true, mergedNames: merged.mergedNames };
+        });
+    }
+    catch {
+        return { ok: false, changed: false, reason: 'write-failed' };
+    }
+}
+/**
+ * 成功后登记：仅对发布时刻可判「窗口内」（显式 age 值优先，缺省 1440 分钟）的目标
+ * 触发；时刻不可得一律不登记（不发明）。本地检查（文件缺席 → no-file）先于 registry
+ * 探测——缺省绑定下无块文件零网络。与治理同锁同 fail-open 纪律。
+ */
+export async function registerExclusion(profileDir, target, deps = {}) {
+    if (!profileDir)
+        return { applied: false, reason: 'no-dir' };
+    const doRead = deps.readFile ?? ((path) => readFileFs(path, 'utf8'));
+    const doWrite = deps.writeFile ??
+        (async (path, text) => {
+            await writeFileAtomic(path, text, { mode: 0o600 });
+        });
+    const file = join(profileDir, WS_FILE);
+    try {
+        return await withFileLock(join(profileDir, 'package.json'), async () => {
+            // 本地检查先行：文件缺席直接 no-file（不发 registry 探测——缺省绑定下测试离线可跑）
+            let yaml;
+            try {
+                yaml = await doRead(file);
+            }
+            catch {
+                return { applied: false, reason: 'no-file' };
+            }
+            const times = await (deps.packumentTimes ?? cachedPackumentTimes)(target.pkg, 12_000);
+            const now = deps.nowMs ?? Date.now();
+            const publishedAt = times ? Date.parse(times[target.version] ?? '') : NaN;
+            if (!Number.isFinite(publishedAt))
+                return { applied: false, reason: 'not-young' };
+            const policy = await readWorkspacePolicy(profileDir);
+            const windowMin = policy?.minimumReleaseAgeMin ?? DEFAULT_MINIMUM_RELEASE_AGE_MIN;
+            if (now >= publishedAt + windowMin * 60_000)
+                return { applied: false, reason: 'not-young' };
+            const next = registerExclusionInYaml(yaml, target);
+            if (next === null)
+                return { applied: false, reason: 'unparseable' };
+            if (!next.changed)
+                return { applied: false, reason: 'up-to-date', form: next.form };
+            await doWrite(file, next.yaml);
+            return { applied: true, form: next.form };
+        });
+    }
+    catch {
+        return { applied: false, reason: 'write-failed' };
+    }
+}

package/lib/core/profile-ops.js

@@ -31,6 +31,7 @@ import { npmLatest as defaultNpmLatest, githubLatestTag as defaultGithubLatestTa
 import { classifyUpgradeActivation } from './activation.js';
 import { togglePlugin, ToggleError } from './toggle.js';
 import { describeReleaseAgeFailure, releaseAgePrecheck } from './release-age.js';
+import { governExcludeBlock, registerExclusion } from './exclude-governance.js';
 // 0.9.19：等待期失败翻译移入 release-age.ts（describeReleaseAgeFailure）——全量违规解析 +
 // 目标/旁包分述。0.9.10 版只取第一条违规并把旁包名字当成本次目标、给「改用 DSH Web」的
 // 失配指引（本机 quota-watch 0.1.15 事件实证：被拦的是旁包 dsh-m@0.9.18，文案却让用户等
@@ -121,9 +122,23 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     else {
         throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 安装`);
     }
-    // 0.9.19：供应链等待期预检——pnpm 11 锁文件校验会拦死整次安装，且失败前目标已写入
-    // node_modules（账实分裂）；目标太新或锁内「独立精确排除条目」未满期 → 委派前结构化拒绝。
-    if (entry.source === 'npm' && version !== undefined) {
+    // ADR-0009：委派前治理（排除块规范形态，fail-open）+ 供应链等待期预检收敛——默认策略
+    // 放行并附陈述（官方管理器对显式点名的新版本直接安装并自动登记）；显式设置 age 或
+    // strict 开启才拒绝。治理已落盘的编辑在成功 output 与失败 message 双路留痕。
+    let governanceNote = '';
+    let releaseAgeNotice = '';
+    let governedMergedNames;
+    if (entry.source === 'npm' && version !== undefined && opts.profileDir) {
+        try {
+            const gov = await (deps.governExclude ?? governExcludeBlock)(opts.profileDir);
+            if (gov.changed && gov.mergedNames?.length) {
+                governanceNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+                governedMergedNames = gov.mergedNames;
+            }
+        }
+        catch {
+            // fail-open：治理失败不阻塞委派（pnpm 仍是最终执行者）
+        }
         const gate = await releaseAgePrecheck({
             pkg,
             version,
@@ -132,20 +147,35 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
             signal: opts.signal,
             deps: { packumentTimes: deps.packumentTimes, workspacePolicy: deps.workspacePolicy },
         });
-        if (gate.blocked)
-            throw new DesktopOpsError('release-age-wait', gate.message, { blockers: gate.blockers });
+        if (gate.blocked) {
+            throw new DesktopOpsError('release-age-wait', gate.message + governanceNote, { blockers: gate.blockers, ...(governedMergedNames !== undefined ? { governanceMerged: governedMergedNames } : {}) });
+        }
+        if (gate.notice)
+            releaseAgeNotice = `；${gate.notice}`;
     }
     let change;
     let bundleName;
+    let registerNote;
+    let managed;
     try {
-        ({ change, bundleName } = await runManagedInstall(service, { pkg, spec, version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }));
+        managed = await runManagedInstall(service, { pkg, spec, version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }, { governExclude: deps.governExclude, registerExclude: deps.registerExclude, packumentTimes: deps.packumentTimes });
+        change = managed.change;
+        bundleName = managed.bundleName;
+        registerNote = managed.registerNote;
     }
     catch (err) {
         if (err instanceof DesktopBuildApprovalNeeded) {
-            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message };
+            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message + governanceNote };
+        }
+        if (err instanceof Error) {
+            if (governanceNote !== '' && !err.message.includes(governanceNote))
+                err.message += governanceNote;
+            if (managed?.governRetryNote !== undefined && !err.message.includes(managed.governRetryNote))
+                err.message += managed.governRetryNote;
         }
         throw err;
     }
+    const retryNote = managed.governRetryNote !== undefined && !governanceNote.includes(managed.governRetryNote) ? managed.governRetryNote : '';
     return {
         id: entry.id,
         pkg,
@@ -158,7 +188,7 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
         ...(compat !== null ? { compat } : {}),
         ...(compatSkipped ? { compatSkipped } : {}),
         needsRestart: true,
-        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
+        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}${governanceNote}${retryNote}${releaseAgeNotice}${registerNote ?? ''}`,
         via: 'desktop-manager',
         ...(change.application === 'overridden' ? { overridden: true } : {}),
     };
@@ -208,7 +238,17 @@ function enableStageFailureMessage(pkg, change) {
     }
     return `安装后启用阶段失败（${pkg}；application=failed、stage=enable${change.error?.code ? `、error=${change.error.code}` : ''}）：${writtenText}，请在官方 Desktop 插件页查看状态或重试`;
 }
-async function runManagedInstall(service, ctx) {
+const DUAL_CODE_RE = /ERR_PNPM_MINIMUM_RELEASE_AGE_VIOLATION|ERR_PNPM_NO_MATURE_MATCHING_VERSION/;
+/** 可治理的失败形态：cancelled / build-blocked 不治理不重试（与 mapFailure 分类一致）。 */
+function isGovableFailure(change) {
+    if (change.application === 'cancelled')
+        return false;
+    const pending = Array.isArray(change.pendingBuilds) ? change.pendingBuilds.filter((n) => typeof n === 'string') : [];
+    if (change.packageResult?.kind === 'build-blocked' && pending.length > 0)
+        return false;
+    return change.application === 'failed' || change.error !== undefined;
+}
+async function runManagedInstall(service, ctx, deps = {}) {
     const installOnce = async () => changeOf(await service.installBundle(ctx.spec, {
         enabled: true,
         ...(ctx.approvedBuilds && ctx.approvedBuilds.length > 0 ? { approvedBuilds: ctx.approvedBuilds } : {}),
@@ -276,9 +316,46 @@ async function runManagedInstall(service, ctx) {
             await sleepMs(enableRetryDelayMs);
         change = await installOnce();
     }
-    if (change.application === 'failed' || change.application === 'cancelled' || change.error)
-        await mapFailure(change);
-    return verifyAndBundle(change);
+    // ADR-0009 挂点3：双码失败 → 治理 → changed 则重试该命令一次（每次调用至多一次；
+    // cancelled / build-blocked 不治理不重试）。仍败走既有 mapFailure（含账实分裂复读）；
+    // 挂点3 已落盘的合并以短语并入失败 message 与成功 output（留痕契约含挂点3）。
+    let governRetryNote;
+    if (isGovableFailure(change) && DUAL_CODE_RE.test(`${change.error?.diagnostic ?? ''}\n${change.error?.code ?? ''}`)) {
+        const gov = await (deps.governExclude ?? governExcludeBlock)(ctx.profileDir ?? '');
+        if (gov.changed) {
+            if (gov.mergedNames?.length)
+                governRetryNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+            change = await installOnce();
+        }
+    }
+    if (change.application === 'failed' || change.application === 'cancelled' || change.error) {
+        try {
+            await mapFailure(change);
+        }
+        catch (err) {
+            if (err instanceof Error && governRetryNote !== undefined && !err.message.includes(governRetryNote))
+                err.message += governRetryNote;
+            throw err;
+        }
+    }
+    const verified = await verifyAndBundle(change);
+    // ADR-0009 挂点2：成功后登记（仅 npm 源窗口内目标；fail-open，applied 短语由调用方并入 output）
+    let registerNote;
+    if (ctx.profileDir && ctx.version) {
+        try {
+            const reg = await (deps.registerExclude ?? registerExclusion)(ctx.profileDir, {
+                pkg: ctx.pkg,
+                version: ctx.version,
+                ...(ctx.previousVersion !== undefined ? { previousVersion: ctx.previousVersion } : {}),
+            }, deps.packumentTimes ? { packumentTimes: deps.packumentTimes } : {});
+            if (reg.applied && reg.form)
+                registerNote = `；排除条目已登记 ${ctx.pkg}@${ctx.version}（${reg.form}）`;
+        }
+        catch {
+            // fail-open：登记失败不影响安装/升级成功态
+        }
+    }
+    return { ...verified, ...(registerNote !== undefined || governRetryNote !== undefined ? { registerNote, governRetryNote } : {}) };
 }
 /**
  * Desktop 卸载（0.9.8，dsh-market 同策略）：removeBundle 委派 + ChangeResult 判定 +
@@ -383,8 +460,21 @@ async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
     else {
         throw new DesktopOpsError('install-refused', `收录条目 ${entry.id} 缺少 npm/github 来源，无法在 desktop 升级`);
     }
-    // 0.9.19：供应链等待期预检（同 desktopInstallLocked；0:15 quota-watch 事件即此形态实证）
-    if (entry.source === 'npm' && version !== undefined) {
+    // ADR-0009：委派前治理 + 预检收敛（同 desktopInstallLocked；0:15 quota-watch 事件为治理前的旧形态实证）
+    let governanceNote = '';
+    let releaseAgeNotice = '';
+    let governedMergedNames;
+    if (entry.source === 'npm' && version !== undefined && opts.profileDir) {
+        try {
+            const gov = await (deps.governExclude ?? governExcludeBlock)(opts.profileDir);
+            if (gov.changed && gov.mergedNames?.length) {
+                governanceNote = `；排除条目治理：合并 ${gov.mergedNames.join('、')}`;
+                governedMergedNames = gov.mergedNames;
+            }
+        }
+        catch {
+            // fail-open：治理失败不阻塞委派
+        }
         const gate = await releaseAgePrecheck({
             pkg,
             version,
@@ -393,20 +483,35 @@ async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
             signal: opts.signal,
             deps: { packumentTimes: deps.packumentTimes, workspacePolicy: deps.workspacePolicy },
         });
-        if (gate.blocked)
-            throw new DesktopOpsError('release-age-wait', gate.message, { blockers: gate.blockers });
+        if (gate.blocked) {
+            throw new DesktopOpsError('release-age-wait', gate.message + governanceNote, { blockers: gate.blockers, ...(governedMergedNames !== undefined ? { governanceMerged: governedMergedNames } : {}) });
+        }
+        if (gate.notice)
+            releaseAgeNotice = `；${gate.notice}`;
     }
     let change;
     let bundleName;
+    let registerNote;
+    let managed;
     try {
-        ({ change, bundleName } = await runManagedInstall(service, { pkg, spec, version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }));
+        managed = await runManagedInstall(service, { pkg, spec, version, previousVersion: target.version, profileDir: opts.profileDir, approvedBuilds: opts.approvedBuilds, listInstalled: deps.listInstalled }, { governExclude: deps.governExclude, registerExclude: deps.registerExclude, packumentTimes: deps.packumentTimes });
+        change = managed.change;
+        bundleName = managed.bundleName;
+        registerNote = managed.registerNote;
     }
     catch (err) {
         if (err instanceof DesktopBuildApprovalNeeded) {
-            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message };
+            return { ok: false, needsBuildApproval: true, id: entry.id, pkg, spec, pendingBuilds: err.pendingBuilds, message: err.message + governanceNote };
+        }
+        if (err instanceof Error) {
+            if (governanceNote !== '' && !err.message.includes(governanceNote))
+                err.message += governanceNote;
+            if (managed?.governRetryNote !== undefined && !err.message.includes(managed.governRetryNote))
+                err.message += managed.governRetryNote;
         }
         throw err;
     }
+    const retryNote = managed.governRetryNote !== undefined && !governanceNote.includes(managed.governRetryNote) ? managed.governRetryNote : '';
     // 0.9.22 生效判定：npm 源升级在成功点分类；任何异常 fail-open 到 unknown，绝不影响升级成功态
     let activation;
     let needsRestart = true;
@@ -432,7 +537,7 @@ async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
         ...(compat !== null ? { compat } : {}),
         ...(compatSkipped ? { compatSkipped } : {}),
         needsRestart,
-        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}`,
+        output: `official pluginManager: application=${change.application ?? 'applied'}, bundle=${bundleName}${change.changed === false ? ', changed=false' : ''}${governanceNote}${retryNote}${releaseAgeNotice}${registerNote ?? ''}`,
         via: 'desktop-manager',
         ...(change.application === 'overridden' ? { overridden: true } : {}),
         fromVersion: target.version,

package/lib/core/registry.js

@@ -825,3 +825,14 @@ export async function loadDefaultRegistry(cfg = {}, opts = {}) {
     }
     return loadDefaultChain(cfg, opts, { namespace, profile, includeBundled: true });
 }
+/**
+ * verified 污染检测（know-how 022）：`verified` 只记 **DSH 运行时**装机实测版本；
+ * 历史上反复出现把**插件自身版本号**误填进 verified 的事故（实证：dsh-quota-watch
+ * 条目曾出现 "0.1.0"——那是 quota-watch 的插件版本，不是任何 DSH 运行时版本）。
+ * 把条目 verified 与该插件自身 npm 已发布版本求交集，非空即高度可疑（warn 不 fail：
+ * 极小概率某代 DSH 与插件版本字面重合，人工复核后放行）。
+ */
+export function verifiedPollution(verified, publishedVersions) {
+    const own = new Set(publishedVersions);
+    return (verified ?? []).filter((v) => own.has(v));
+}

package/lib/core/release-age.js

@@ -1,35 +1,34 @@
 /**
- * Desktop 供应链等待期（minimumReleaseAge）预检与失败翻译（0.9.19）。
+ * 供应链等待期（minimumReleaseAge）预检与失败翻译（0.9.19 立基，0.9.x 按治理语义收敛，ADR-0009）。
  *
- * pnpm 11.7 实机实证（2026-10-03，本机 desktop profile，官方管理器操作日志
- * operation-hNjgaN / operation-l5fXEd）：
- * 1. 显式安装「太新」目标：非严格模式放行，pnpm 自动向 pnpm-workspace.yaml 的
- *    `minimumReleaseAgeExclude` 追加一条「独立精确条目」（`pkg@ver` 形态）；
- * 2. 但后续任何包操作的锁文件级供应链校验（`Verifying lockfile against
- *    supply-chain policies (N entries)`）不认可 pnpm 自己追加的这种条目——
- *    任何一条未满期的 `pkg@ver` 都会拦死整个安装，且与本次目标无关（旁包能拦住
- *    所有升级，0.9.18 拦住 quota-watch 0.1.15 升级即实证）；
+ * 实证基准（2026-10-03，本机 desktop profile，pnpm 11.7.0，官方管理器操作日志
+ * operation-zsc4ei / operation-L8oq1z / operation-l5fXEd）：
+ * 1. 默认策略（未显式设置 age、未开 strict = 非严格）下，显式点名的「太新」目标
+ *    直接放行安装，pnpm 自动向 pnpm-workspace.yaml 的 `minimumReleaseAgeExclude`
+ *    追加 `pkg@ver` 条目（"Added 1 entry …"）；
+ * 2. pnpm 的 evaluateVersionPolicy **每包名只认第一条排除规则**，同名后续规则死亡
+ *    （dshmarket #732 实证，首条规则生效机理）——死规则会让等待期内全部包操作被
+ *    锁文件级校验拦死（0:15 quota-watch 连坐实录）；
  * 3. 校验失败前目标包可能已写入 node_modules，官方管理器只回滚 manifest/lockfile
- *    →「账实分裂」：界面实装新版 active，账本仍旧版，下次包操作静默回退。
+ *    →「账实分裂」，下次包操作静默回退。
  *
- * 对策（零文件级红线不破：只读 profile 文件，绝不写）：
- * ① 委派前预检（releaseAgePrecheck）：目标版本或锁内「不被校验认可的独立精确
- *    排除条目」任一未满等待期 → 结构化拒绝，不委派官方管理器；
+ * 职责（ADR-0009）：
+ * ① 委派前预检（releaseAgePrecheck）：仅「显式设置 age 或 strict 开启」时对窗口内
+ *    目标拒绝（附可重试时刻）；默认策略放行并返回陈述性 notice。锁内坏形态由
+ *    exclude-governance 的治理挂点处理，本模块不再预拒绝（0.9.19 ②腿退役）。
  * ② 失败翻译（describeReleaseAgeFailure）：解析全部违规条目，按「本次目标 vs
- *    锁内旁包」分别给出发布时刻与可重试时刻——不再把旁包名字冒充成本次目标被拦。
+ *    旁包」分述发布时刻与可重试时刻。
+ * ③ cachedPackumentTimes：预检与登记共用的带缓存 packument 探测。
  *
- * fail-open 纪律：发布时刻不可得 / 策略文件不可读 / profileDir 缺席 / 命中有效排除
- * 条目（包名级、`||` 复合、scoped 独立精确）→ 一律放行；pnpm 仍是最终执行者。
+ * fail-open 纪律：发布时刻不可得 / 策略文件不可读 / profileDir 缺席 / 命中任一
+ * 排除规则（首条规则口径）→ 一律放行；pnpm 仍是最终执行者。
  */
 import { readFile } from 'node:fs/promises';
 import { join } from 'node:path';
 import { isMap, isScalar, isSeq, parseDocument } from 'yaml';
 import { fetchJsonLimited } from './httpx.js';
-import { isExactVersion } from './versions.js';
 /** pnpm 11.7 实机测得的策略窗口：24h（operation-l5fXEd 的 cutoff = 检查时刻 − 1440min）。 */
 export const DEFAULT_MINIMUM_RELEASE_AGE_MIN = 1440;
-/** 锁内「独立精确排除条目」旁包探测上限（防清单失控；超出部分放弃预判，交 pnpm 兜底）。 */
-export const MAX_EXCLUDE_PROBES = 8;
 function scalarNumber(value) {
     if (typeof value === 'number' && Number.isFinite(value))
         return value;
@@ -43,7 +42,7 @@ function scalarNumber(value) {
  * 调用方按默认窗口 + 无排除处理，绝不抛。
  */
 export function parseWorkspacePolicy(text) {
-    const empty = { minimumReleaseAgeMin: null, excludes: [] };
+    const empty = { explicitAge: false, minimumReleaseAgeMin: null, strict: false, excludes: [] };
     let document;
     try {
         document = parseDocument(text);
@@ -62,10 +61,17 @@ export function parseWorkspacePolicy(text) {
             }
         }
     }
-    // yaml 库的 Map.get() 对标量返回已解包的原始值（number/string），对集合返回节点——两种形态都兜住
+    // yaml 库的 Map.get() 对标量返回已解包的原始值（number/string/boolean），对集合返回节点——两种形态都兜住
     const rawAge = document.contents.get('minimumReleaseAge');
     const age = isScalar(rawAge) ? scalarNumber(rawAge.value) : scalarNumber(rawAge);
-    return { minimumReleaseAgeMin: age !== null && age > 0 ? age : null, excludes };
+    const rawStrict = document.contents.get('minimumReleaseAgeStrict');
+    const strict = rawStrict === true || (isScalar(rawStrict) && rawStrict.value === true);
+    return {
+        explicitAge: rawAge !== undefined && rawAge !== null,
+        minimumReleaseAgeMin: age !== null && age > 0 ? age : null,
+        strict,
+        excludes,
+    };
 }
 export function excludeMatch(selector, pkg, version) {
     const s = selector.trim();
@@ -73,7 +79,7 @@ export function excludeMatch(selector, pkg, version) {
         return 'no';
     if (s.includes('||')) {
         for (const part of s.split('||')) {
-            if (excludeMatch(part.trim(), pkg, version) !== 'no')
+            if (excludeMatch(part.trim(), pkg, version) === 'effective')
                 return 'effective';
         }
         return 'no';
@@ -83,30 +89,7 @@ export function excludeMatch(selector, pkg, version) {
         // 包名级（dshmarket）或裸版本号段（只应出现在复合条目内，顶层出现视为包名比较）
         return s === pkg || s === version ? 'effective' : 'no';
     }
-    const namePart = s.slice(0, at);
-    const verPart = s.slice(at + 1);
-    if (namePart !== pkg)
-        return 'no';
-    if (verPart === version) {
-        return pkg.startsWith('@') ? 'effective' : 'unreliable-unscoped-exact';
-    }
-    return 'no';
-}
-/** 从独立精确条目提取 (pkg, version)；复合/包名级/版本段非精确 semver → null。 */
-export function splitExactSelector(selector) {
-    const s = selector.trim();
-    if (s === '' || s.includes('||'))
-        return null;
-    const at = s.lastIndexOf('@');
-    if (at <= 0)
-        return null;
-    const pkg = s.slice(0, at);
-    const version = s.slice(at + 1);
-    if (!isExactVersion(version))
-        return null;
-    if (!/^@?[A-Za-z0-9-._~]+(\/[A-Za-z0-9-._~]+)?$/.test(pkg))
-        return null;
-    return { pkg, version, reliable: pkg.startsWith('@') };
+    return s.slice(0, at) === pkg && s.slice(at + 1) === version ? 'effective' : 'no';
 }
 const VIOLATION_RE = /(\S+@\S+) was published at ([^,]+), within the minimumReleaseAge cutoff \(([^)]+)\)/g;
 /** 解析 pnpm 诊断里的全部等待期违规条目（0.9.10 只取第一条是「报错报错包」的根因之一）。 */
@@ -196,72 +179,65 @@ export async function readWorkspacePolicy(profileDir) {
 }
 const packumentCache = new Map();
 const PACKUMENT_CACHE_TTL_MS = 5 * 60_000;
+/**
+ * 带进程内缓存的 packument time 探测（TTL 5min）：预检与登记（exclude-governance）
+ * 共用——同一操作里预检刚拉过的 packument 不二次拉取（8MiB 级全量）。
+ */
+export async function cachedPackumentTimes(pkg, timeoutMs = 12_000, signal) {
+    const hit = packumentCache.get(pkg);
+    if (hit && Date.now() - hit.at < PACKUMENT_CACHE_TTL_MS)
+        return hit.times;
+    const times = await npmPackumentTimes(pkg, timeoutMs, signal);
+    packumentCache.set(pkg, { at: Date.now(), times });
+    return times;
+}
 /** 测试钩子：清空 packument 进程内缓存。 */
 export function _resetReleaseAgeCachesForTests() {
     packumentCache.clear();
 }
 /**
- * 委派前预检：目标版本与锁内「不被校验认可的独立精确排除条目」逐个对发布时刻，
- * 任一未满等待期 → 结构化拒绝（blocked + 多行理由）。零写操作；不确定一律放行。
+ * 委派前预检（ADR-0009 收敛语义）：仅当策略显式设置 age 或开启 strict 时，对窗口内
+ * 且未被任一排除规则覆盖（首条规则口径）的目标结构化拒绝（附可重试时刻）；默认
+ * 策略（非严格）放行并返回陈述性 notice——官方管理器对显式点名的新版本会直接
+ * 安装并自动登记，锁内坏形态由 exclude-governance 的治理挂点处理。零写操作；
+ * fail-open：发布时刻不可得 / profileDir 缺席 / 命中排除规则 → 放行。
  */
 export async function releaseAgePrecheck(input) {
-    // profileDir 缺席 = 读不到操作员排除条目 → 不预判（避免误拦操作员显式 pin 的安装）
+    // profileDir 缺席 = 读不到操作员排除条目与策略 → 不预判
     if (!input.profileDir)
         return { blocked: false };
     const now = input.nowMs ?? Date.now();
     const policy = input.deps?.workspacePolicy
         ? await input.deps.workspacePolicy(input.profileDir)
         : await readWorkspacePolicy(input.profileDir);
-    const policyMin = policy?.minimumReleaseAgeMin ?? DEFAULT_MINIMUM_RELEASE_AGE_MIN;
+    const explicit = policy?.explicitAge ?? false;
+    const strict = policy?.strict ?? false;
+    const policyMin = explicit && policy?.minimumReleaseAgeMin != null ? policy.minimumReleaseAgeMin : DEFAULT_MINIMUM_RELEASE_AGE_MIN;
     const probe = async (pkg) => {
-        const hit = packumentCache.get(pkg);
-        if (hit && Date.now() - hit.at < PACKUMENT_CACHE_TTL_MS)
-            return hit.times;
-        const times = await (input.deps?.packumentTimes ?? npmPackumentTimes)(pkg, Math.min(input.timeoutMs ?? 20_000, 12_000), input.signal);
-        packumentCache.set(pkg, { at: Date.now(), times });
-        return times;
+        if (input.deps?.packumentTimes)
+            return input.deps.packumentTimes(pkg, Math.min(input.timeoutMs ?? 20_000, 12_000), input.signal);
+        return cachedPackumentTimes(pkg, 12_000, input.signal);
     };
-    const blockers = [];
-    // ① 本次目标版本的发布时刻（有效排除条目覆盖 → 放行）
     const times = await probe(input.pkg);
     const publishedAt = times ? Date.parse(times[input.version] ?? '') : NaN;
-    if (Number.isFinite(publishedAt)) {
-        const exempt = (policy?.excludes ?? []).some((sel) => excludeMatch(sel, input.pkg, input.version) === 'effective');
-        if (!exempt) {
-            const deadline = publishedAt + policyMin * 60_000;
-            if (now < deadline) {
-                blockers.push({ entry: `${input.pkg}@${input.version}`, role: 'target', publishedAt, deadline });
-            }
-        }
-    }
-    // ② 锁内「不被校验认可的独立精确排除条目」（非 scoped）——任何一条未满期都会拦死整次安装
-    const seen = new Set([`${input.pkg}@${input.version}`]);
-    const candidates = (policy?.excludes ?? [])
-        .map((sel) => splitExactSelector(sel))
-        .filter((x) => x !== null && !x.reliable);
-    for (const ex of candidates.slice(0, MAX_EXCLUDE_PROBES)) {
-        const entry = `${ex.pkg}@${ex.version}`;
-        if (seen.has(entry))
-            continue;
-        seen.add(entry);
-        const t2 = await probe(ex.pkg);
-        const pub = t2 ? Date.parse(t2[ex.version] ?? '') : NaN;
-        if (!Number.isFinite(pub))
-            continue;
-        const deadline = pub + policyMin * 60_000;
-        if (now < deadline) {
-            blockers.push({ entry, role: 'lockfile-exclude', publishedAt: pub, deadline });
-        }
-    }
-    if (blockers.length === 0)
+    if (!Number.isFinite(publishedAt))
         return { blocked: false };
-    const lines = ['官方管理器的供应链策略（minimumReleaseAge）将拦截本次安装，已提前拒绝（未触碰 profile 文件）：'];
-    for (const b of blockers) {
-        lines.push(b.role === 'target'
-            ? `· 目标 ${b.entry}：发布于 ${fmtLocal(b.publishedAt)}，预计 ${fmtLocal(b.deadline)} 后满等待期`
-            : `· 锁内排除条目 ${b.entry}：发布于 ${fmtLocal(b.publishedAt)}，预计 ${fmtLocal(b.deadline)} 后满等待期（pnpm 自动追加的独立精确条目不被锁文件校验认可，等待期内任何官方包操作都会被拦）`);
+    const exempt = (policy?.excludes ?? []).some((sel) => excludeMatch(sel, input.pkg, input.version) === 'effective');
+    const deadline = publishedAt + policyMin * 60_000;
+    if (exempt || now >= deadline)
+        return { blocked: false };
+    if (!explicit && !strict) {
+        return {
+            blocked: false,
+            notice: `目标 ${input.pkg}@${input.version} 发布于 ${fmtLocal(publishedAt)}（等待期内）：官方管理器将按显式点名安装，装好后 dsh-m 会登记豁免条目`,
+        };
     }
-    const maxDeadline = Math.max(...blockers.map((b) => b.deadline));
-    lines.push(`预计 ${fmtLocal(maxDeadline)} 后可重试；等待期内也可由操作员修正 pnpm-workspace.yaml 的排除条目形态（包名级/复合）解除拦截`);
-    return { blocked: true, message: lines.join('\n'), blockers };
+    const lines = ['官方管理器的供应链策略（minimumReleaseAge）将拦截本次安装，已提前拒绝（未触碰 profile 文件）：'];
+    lines.push(`· 目标 ${input.pkg}@${input.version}：发布于 ${fmtLocal(publishedAt)}，预计 ${fmtLocal(deadline)} 后满等待期`);
+    lines.push(`预计 ${fmtLocal(deadline)} 后可重试；等待期内也可由操作员修正 pnpm-workspace.yaml 的排除条目形态（包名级/复合）解除拦截`);
+    return {
+        blocked: true,
+        message: lines.join('\n'),
+        blockers: [{ entry: `${input.pkg}@${input.version}`, role: 'target', publishedAt, deadline }],
+    };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.23",
+  "version": "0.9.24",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",

package/registry.json

@@ -99,10 +99,10 @@
     {
       "id": "dsh-copilot-auth",
       "name": "DSH Copilot Auth",
-      "description": "为内置 Copilot 提供方补登录/注销设置页与开箱路由；模型目录兜底不覆盖定制。适配 0.1.7-rc.2 与 0.2.0-rc.1，旧版用 1.1.x。",
+      "description": "内置 Copilot 登录注销页与开箱路由；目录兜底不覆盖定制，桌面版不支持目录刷新。已适配 0.1.7-rc.2 与 0.2.0-rc.1/rc.2。",
       "category": "self-dev",
       "tags": ["Copilot", "认证", "模型接入", "工具"],
-      "verified": ["0.1.7-rc.2", "0.2.0-rc.1"],
+      "verified": ["0.1.7-rc.2", "0.2.0-rc.1", "0.2.0-rc.2"],
       "source": "npm",
       "npm": "@inventec/dsh-copilot-auth",
       "github": "iasiv5/dsh-copilot-auth",
@@ -114,7 +114,7 @@
       "description": "GLM 与 Copilot 额度悬浮球：胶囊、详情面板与侧栏卡片，宿主解析凭据，适配 web 与 desktop。",
       "category": "self-dev",
       "tags": ["配额", "悬浮球", "GLM", "Copilot"],
-      "verified": ["0.1.7-rc.2", "0.1.0"],
+      "verified": ["0.1.7-rc.2", "0.2.0-rc.2"],
       "source": "npm",
       "npm": "@iasiv5/dsh-quota-watch",
       "github": "iasiv5/dsh-quota-watch",