dsh-m 0.9.78 → 0.9.80

package/CHANGELOG.md

@@ -8,6 +8,20 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.80 修复：已装页开关抖动根治 + 社区开关定位恒定 + 「已实测」徽章退役（三项 UX 修复，client-only）
+
+- **① 已装页开关抖动根治（主人实拍：点开关整页抖、开关原地失踪、鼠标不再命中）**：CDP 实测每次点击开关发生 47px×2 卡片栅格位移 + 0.6–1.3s 命中丢失窗口（原点落到上方卡片 `.dshm-links` 外链行，误触即开浏览器标签）。根因三件：`ProgressLine`（install 专用 pnpm 进度条）对 toggle 也挂载（35px 行 + body 12px gap，插入/拔出即位移）；toast/重启横幅是面板 column flex 的流内子元素（出现/消失压缩 body 39px×2）；开关视觉翻转要等 5 个刷新请求落地（1.5–2.3s「点了没反应」真空期，且期间开关 `locked` 灰态）。修复：新增 `progressTarget`（仅 install/upgrade/self-upgrade 挂进度条；`activeMutateTarget` 语义不动，仍管逐行禁用）；toast/横幅包进 `.dshm-banner-stack`（absolute 底部浮层，pointer-events 穿透）；`pendingToggles` 乐观翻转（点击 42ms 即变，`finally` 摘除＝成功收敛/失败回滚）；toggle 只重取已装视图（installed+market×2+updates+external-operations → installed×1，`view-refresh.js` 未动、单测原样）；`.dshm-switch::before` 热区 34×19 → 46×31（视觉不变）。CDP 回测四断言全过：位移 0、命中零丢失、翻转 42ms、body 底缘 0 位移。
+- **② 社区目录开关钉进标题行（主人实拍：开/关后开关位置高低不同）**：开关行原是卡片 body 末行，关态 5 行元信息消失即被上提约 5 行高。移入 `.dshm-section-title` 右侧（flex 现成 + 开关自带 `margin-left:auto`；与已装卡片右上角开关同一交互语言），CDP 实测 ON/OFF 两态开关 y 恒等（135.2px，漂移 0.0）；冗余「社区目录开关」行退役，语义并入开关 tooltip。
+- **③ 「已实测」徽章退役（B 方案：byline 灰字承接）**：verified 仅覆盖精选 4/21 条且全为作者自家插件——徽章实为署名代理、区分度趋零，真载荷（实测过的 DSH 运行时清单）藏在 hover tooltip 里触屏不可达；按「卡片徽章只放例外信号（弃用/自用/可升级）」原则退役。市场卡/收藏快照卡/弹窗头三处渲染退役；市场卡 tag 行尾新增灰字 `实测 ≤{最新复验版本}`（tooltip 全量清单）；详情弹窗「实测版本」行保留为唯一权威呈现；`badge.verified` 键按 0.9.76「版本无关徽章退役」先例退役；registry 数据、snapshotOf 透传与安装期 peer 兼容弹窗零触碰。
+- **验证**：1425 项测试全绿（0.9.79 基线 1423 + 退役断言 2；U12 收藏卡契约随 ③ 改写为新契约）、typecheck 零错误；三项均 client-only，刷新页面即生效；①② 经 CDP 全程量化回测（位移/命中/翻转延迟/几何恒定）。
+
+### 0.9.79 功能：外部操作记录——非面板通道（CLI / Agent 工具）变更直落审计日志进面板「已结束」（ADR-0018）
+
+- **问题（审计面脱节实证）**：全局操作记录的口径 = 面板发起——quota-watch 0.1.28 经 `dshm_upgrade`（Agent 工具）升级装机成功后，面板「已结束」列表零记录，操作审计面与真实系统状态脱节。CLI 与 Agent 工具是独立进程，写不进浏览器 localStorage 的操作泵。
+- **方案（ADR-0018：机器本地直落日志，与操作泵分离）**：新增 `$DSH_HOME/dshm/external-operations.json`（`DSHM_EXTERNAL_JOURNAL_FILE` 可覆盖；机器本地、不跨机同步）——九个公共变更入口增 `channel` 参数（`'panel'|'cli'|'host-tool'`，缺省 `'external'` 兜底），非面板通道的操作终态后直落一条记录：**成功与失败都记**、滚动 200 条、tmp+rename 原子写、损坏文件改名隔离、append 任何失败被钩子吞掉（至多 stderr 一行，绝不反噬操作终态，R1-1）；reason 截断 ≤300。desktop 口径（R1-2）：desktopToggle 透传 togglePlugin（唯一嵌套对，单笔事务一条记录）；desktopInstall/Uninstall/Upgrade 自记（call-graph audit 证实不经已插桩入口）；服务缺席拒绝自记 `desktop-toggle` failed。
+- **面板消费（内存 overlay 并读，不写 localStorage）**：host-api 新增 `external-operations`（list）与 `external-operations-clear` 两 method（鉴权沿既有宿主信任检查）；「已结束」列表 = 本地操作泵（localStorage，现状不动）+ 外部记录 overlay（服务端为唯一事实源，persist 路径零触碰——防服务端淘汰后被本地副本复活，R1-3）；渠道徽标 **Agent 工具** / **命令行** / 兜底**外部**（Q2b/R1-4）；失败记录点亮红点（Q4）；外部行不渲染单条 ✕（R2-3）；「清除已结束」连带清除服务端日志 + overlay 同步清空；fetch 时机 = 面板初始化 + 每次操作完成后 + 打开操作记录卡（不轮询，R1-6）；「已结束」计数改用合并后全量，最近 50 条渲染截断照旧（R1-7）。
+- **验证**：1423 项测试全绿（0.9.78 基线 1389 + 新增 34：journal 存储 8（滚动/损坏容错/panel 拒绝/无凭据/路径上抛/截断）、通道插桩 8（panel 零记录/cli、host-tool 各一条/嵌套单条/失败 failed/append 注入抛错不反噬）、host-api 4（list/clear/鉴权/注入位）、client 模型+视图 14（overlay 升序并读/persist 纯净/幂等/徽标/✕ 出口/计数/接线锚））、typecheck 零错误；测试全程零触碰真实 `~/.dsh`（10 个既有测试文件补 journal 隔离，另新增 1 个通道插桩测试文件，沿用 cacheRoot 纪律）。实施计划经独立评审 Agent 三轮评审收敛；npm 发版与 dsh-m 自升级另行经用户确认。
+
 ### 0.9.78 性能：收藏 stale 检查零网络 + 市场页零增量提交守卫（钢人 C3）
 
 - **问题（钢人报告 C3 节）**：收藏 stale 判定只需要「id 还在不在目录」的成员布尔，却穿透富 market interface 的探测段——每次收藏区访问/切换（800ms debounce 合并后）仍是 N 条收藏 × full 查询，含每命中条 npm/github latest **网络扇出**且产物全部丢弃；叠加 toggle 后 refreshViews 四连响应无条件 `setData`——数据层精心维持的引用稳定性一次 setState 即蒸发。
@@ -565,6 +579,20 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Fixes in 0.9.80 — installed-tab toggle jitter eliminated + community switch pinned to its title row + 已实测 badge retired (three UX fixes, client-only)
+
+- **① Installed-tab toggle jitter eliminated (user report: clicking the switch shook the whole page, the switch vanished in place, and the cursor no longer hit it)**: CDP measurement showed a 47px×2 card-grid shift per click plus a 0.6–1.3s hit-test loss window (the cursor's fixed point landed on the card above's `.dshm-links` external-links row — a mis-click opens a browser tab). Three root causes: `ProgressLine` (the install-only pnpm progress bar) mounted for toggles too (35px row + 12px body gap — inserting/unmounting it is the shift itself); the toast/restart banners were in-flow flex children of the panel column (mount/dismiss compressed the body by 39px×2); the switch visually flipped only after five refresh requests landed (a 1.5–2.3s "nothing happened" dead window, with the switch greyed to `locked`). Fixes: a new `progressTarget` gates ProgressLine to install/upgrade/self-upgrade (`activeMutateTarget` semantics untouched — it still drives per-row disabling); toasts/banners are wrapped in `.dshm-banner-stack` (absolute bottom overlay, pointer-events pass-through); optimistic `pendingToggles` flips the switch in 42ms (cleared in `finally` — converges on success, reverts to server state on failure); toggle refreshes the installed view only (installed+market×2+updates+external-operations → installed×1; `view-refresh.js` untouched, its unit tests unchanged); `.dshm-switch::before` grows the hit area 34×19 → 46×31 (visuals unchanged). CDP re-probe passes all four assertions: zero drift, zero hit-loss, 42ms flip, stable body bottom edge.
+- **② Community catalog switch pinned to its section title row (user report: the switch sat at different heights when on vs off)**: the switch row used to be the last child of the card body — toggling off dropped five metadata rows and yanked the switch up ~5 row heights. It now lives at the right edge of `.dshm-section-title` (flex already in place + the switch's own `margin-left:auto`; same interaction language as the installed-page card switches). CDP-measured identical Y in both states (135.2px, 0.0 drift); the redundant "社区目录开关" row is retired into the switch tooltip.
+- **③ 已实测 (verified) badge retired (plan B: byline gray text)**: verified covers only 4/21 curated entries — all the author's own plugins — making the badge an authorship proxy with near-zero discriminating power, while its real payload (the tested DSH runtime list) lived in a hover-only tooltip. Per the "card badges only carry exceptions (deprecated / internal / outdated)" principle it is retired from the market card, the favorite snapshot card, and the modal header; the market card tag line gains a low-emphasis `verified ≤{latest re-verified runtime}` suffix (full list on hover); the detail modal's "Verified runtimes" row remains the single authoritative presentation; the `badge.verified` i18n key is retired following the 0.9.76 version-independent-badge precedent. registry data, snapshotOf passthrough, and the install-time peer-compat dialog are untouched.
+- **Verification**: 1425 tests green (0.9.79 baseline 1423 + 2 retirement assertions; the U12 favorites-card contract rewritten for ③), typecheck clean; all three fixes are client-only — a page refresh applies them; ① and ② were quantified end-to-end with CDP probes (drift / hit-testing / flip latency / geometry stability).
+
+### Feature in 0.9.79 — external operation records: non-panel channels (CLI / agent tools) land terminal-state audit entries into the panel's Ended list (ADR-0018)
+
+- **Problem (audit-surface disconnect, real incident)**: the global operation records only covered panel-initiated changes — the quota-watch 0.1.28 upgrade via `dshm_upgrade` (an agent tool) installed successfully yet left zero rows in the panel's Ended list. CLI and agent tools are separate processes and cannot write the browser-localStorage operations pump.
+- **Solution (ADR-0018: machine-local direct-write journal, decoupled from the pump)**: a new `$DSH_HOME/dshm/external-operations.json` (overridable via `DSHM_EXTERNAL_JOURNAL_FILE`; machine-local, never synced across machines) — the nine public mutation entries gain a `channel` parameter (`'panel'|'cli'|'host-tool'`, defaulting to `'external'` as the audit-safe fallback). Non-panel operations append one terminal-state record after completion: **both success and failure are recorded**, rolling cap of 200, tmp+rename atomic writes, corrupted files quarantined by rename, and any append failure swallowed by the hook (at most one stderr line — it never back-fires onto the operation result, R1-1); `reason` truncated to 300 chars. Desktop accounting (R1-2): desktopToggle passes through to togglePlugin (the only nested pair — one transaction, one record); desktopInstall/Uninstall/Upgrade self-record (call-graph audit confirms they bypass instrumented entries); the service-absent structured refusal self-records `desktop-toggle` failed.
+- **Panel consumption (in-memory overlay, never localStorage)**: host-api gains `external-operations` (list) and `external-operations-clear` methods (auth rides the existing host trust check); the Ended list = local operations pump (localStorage, untouched) + external-records overlay (the server side is the single source of truth, persist path untouched — prevents local resurrection after server-side eviction, R1-3); channel badges **Agent tool** / **CLI** / fallback **External** (Q2b/R1-4); failed external entries light the red dot (Q4); external rows render no per-row ✕ (R2-3); Clear ended also clears the server journal plus the overlay; fetch timing = panel init + after each operation + opening the operations card (no polling, R1-6); the Ended count now uses the merged total while the last-50 render cap stays (R1-7).
+- **Verification**: 1423 tests green (0.9.78 baseline 1389 + 34 added: journal storage 8 (rolling / corruption quarantine / panel rejection / no-credentials / path error propagation / truncation), channel wiring 8 (panel zero-record / cli and host-tool one each / nested single record / failure recorded as failed / injected append failure never back-fires), host-api 4 (list / clear / auth / override slots), client model+view 14 (overlay ascending merge / persist purity / idempotence / badge / ✕ exit / count / wiring anchors)), typecheck clean; tests never touch the real `~/.dsh` (10 existing test files gained journal isolation, plus 1 new channel-wiring test file, following the cacheRoot discipline). The implementation plan was closed over three independent review rounds; npm publish and dsh-m self-upgrade remain subject to separate user confirmation.
+
 ### Performance in 0.9.78 — favorites stale checks go cache-only: zero-network favorites access + zero-increment commit guard (steelman C3)
 
 - **Problem (steelman report, card C3)**: the favorites stale verdict only needs a "is this id still in the catalog" membership boolean, yet it pierces the rich market interface's probe segment - every favorites visit/toggle (after the 800ms debounce merge) still fires N favorites × full queries including a per-hit npm/github latest **network fan-out** whose products are entirely discarded. On top of that, the unconditional `setData` after refreshViews' four-in-a-row responses (the post-toggle norm) evaporates the reference stability the data layer carefully maintains.

package/lib/cli.js

@@ -337,6 +337,7 @@ async function runCliDispatch(argv, deps, io) {
                     version,
                     forceIncompatible: flags.force === true,
                     namespace: 'cli',
+                    channel: 'cli',
                 });
             }
             catch (e) {
@@ -361,6 +362,7 @@ async function runCliDispatch(argv, deps, io) {
                 res = await d.upgradePlugin(target, cfg, {
                     forceIncompatible: flags.force === true,
                     namespace: 'cli',
+                    channel: 'cli',
                 });
             }
             catch (e) {
@@ -386,7 +388,7 @@ async function runCliDispatch(argv, deps, io) {
             if (onFlag === offFlag)
                 throw new Error('开关命令需要恰好一个 --on 或 --off');
             requireYes(flags, '切换插件运行状态');
-            const res = await d.togglePlugin(target, onFlag);
+            const res = await d.togglePlugin(target, onFlag, { channel: 'cli' });
             out(`✅ 已${onFlag ? '启用' : '停用'} ${res.pkg}（profile 文件已更新）`);
             if (res.applied === 'live')
                 out('本次进程内已即时生效；重启后状态保持。');
@@ -397,7 +399,7 @@ async function runCliDispatch(argv, deps, io) {
         case 'uninstall': {
             const target = needFlag(flags, 'pkg');
             requireYes(flags, '卸载');
-            const res = await d.uninstallPlugin(target, cfg, { namespace: 'cli' });
+            const res = await d.uninstallPlugin(target, cfg, { namespace: 'cli', channel: 'cli' });
             out(`✅ 已卸载 ${res.pkg}${res.liveDisabled ? '（运行中的界面已先下线）' : ''}`);
             if (res.leftovers.length)
                 out(`ℹ️  疑似残留数据（未删除）：${res.leftovers.join('、')}`);

package/lib/client.js

@@ -1344,10 +1344,28 @@ __export(operations_exports, {
   createOperationsStore: () => createOperationsStore,
   createOpsPump: () => createOpsPump,
   drainRestored: () => drainRestored,
+  externalToRecord: () => externalToRecord,
   opAppliesTo: () => opAppliesTo,
   restoreRecords: () => restoreRecords,
   upgradeNotify: () => upgradeNotify
 });
+function externalToRecord(er) {
+  if (!er || typeof er !== "object") return null;
+  const meta = {};
+  if (typeof er.fromVersion === "string" && er.fromVersion !== "") meta.from = er.fromVersion;
+  if (typeof er.toVersion === "string" && er.toVersion !== "") meta.to = er.toVersion;
+  return {
+    id: typeof er.id === "string" && er.id !== "" ? er.id : `ext-${er.at ?? "unknown"}`,
+    kind: er.kind,
+    target: typeof er.target === "string" ? er.target : "",
+    status: er.result === "failed" ? "failed" : "done",
+    createdAt: Number.isFinite(er.at) ? er.at : 0,
+    updatedAt: Number.isFinite(er.at) ? er.at : 0,
+    channel: typeof er.channel === "string" && er.channel !== "" ? er.channel : "external",
+    ...er.reason ? { error: String(er.reason) } : {},
+    ...Object.keys(meta).length > 0 ? { meta } : {}
+  };
+}
 function upgradeNotify(activation) {
   if (activation === "client-only") return { needsRestart: false, suffixKey: "notify.upgraded.clientonly" };
   if (activation === "unknown") return { needsRestart: true, suffixKey: "notify.upgraded.activationUnknown" };
@@ -1385,6 +1403,7 @@ function createOperationsStore(storage) {
   const s = storageOf(storage);
   let records = safeParse(s.read());
   let persistDegraded = false;
+  let externalOverlay = [];
   const persist = () => {
     if (persistDegraded) return;
     try {
@@ -1398,6 +1417,28 @@ function createOperationsStore(storage) {
     list() {
       return records.map((r) => ({ ...r }));
     },
+    /** 外部记录 overlay（内存）：id 幂等合并（后到值覆盖），返回合并视图。 */
+    setExternal(next) {
+      const incoming = (Array.isArray(next) ? next : []).filter((r) => r && typeof r === "object" && typeof r.id === "string");
+      const byId = new Map(externalOverlay.map((r) => [r.id, r]));
+      for (const r of incoming) byId.set(r.id, { ...byId.get(r.id) || {}, ...r });
+      externalOverlay = [...byId.values()];
+      return this.listMerged();
+    },
+    /** 清空外部 overlay（「清除已结束」联动 external-operations-clear 成功后调用）。 */
+    clearExternal() {
+      externalOverlay = [];
+      return this.listMerged();
+    },
+    /** @returns {OperationRecord[]} 外部 overlay 当前快照（原始形态，浅拷贝）。 */
+    externalList() {
+      return externalOverlay.map((r) => ({ ...r }));
+    },
+    /** 本地 + 外部合并视图：外部映射为渲染记录后与本地按 createdAt 升序（groupOpsByDay 假定升序输入）。 */
+    listMerged() {
+      const external = externalOverlay.map(externalToRecord).filter(Boolean);
+      return [...records.map((r) => ({ ...r })), ...external].sort((a, b) => (a.createdAt ?? 0) - (b.createdAt ?? 0));
+    },
     get persistDegraded() {
       return persistDegraded;
     },
@@ -1616,6 +1657,8 @@ var init_operations = __esm({
 // src/client/operations-view.js
 var operations_view_exports = {};
 __export(operations_view_exports, {
+  canRemoveRow: () => canRemoveRow,
+  channelLabelKey: () => channelLabelKey,
   fmtOpClock: () => fmtOpClock,
   fmtOpDuration: () => fmtOpDuration,
   fmtOpFull: () => fmtOpFull,
@@ -1686,9 +1729,19 @@ function opRowVm(r) {
     durText: durMs === null ? "" : fmtOpDuration(durMs),
     dir: isToggle && typeof meta.on === "boolean" ? meta.on ? "on" : "off" : null,
     version,
-    target: typeof rec.target === "string" ? rec.target : ""
+    target: typeof rec.target === "string" ? rec.target : "",
+    // 外部记录渠道标记（0.9.79 ADR-0018）：非空 = 渠道徽标渲染 + 无单条 ✕ 出口
+    channel: typeof rec.channel === "string" && rec.channel !== "" ? rec.channel : null
   };
 }
+function canRemoveRow(r) {
+  if (!r || typeof r !== "object") return false;
+  if (r.channel) return false;
+  return r.status === "input" || r.status === "failed" || r.status === "superseded";
+}
+function channelLabelKey(channel) {
+  return `op.channel.${channel === "host-tool" || channel === "cli" ? channel : "external"}`;
+}
 var init_operations_view = __esm({
   "src/client/operations-view.js"() {
     "use strict";
@@ -1902,7 +1955,7 @@ var { RESTART_POLL_MS: RESTART_POLL_MS2, RESTART_DEADLINE_MS: RESTART_DEADLINE_M
 var { refreshAfterMutation: refreshAfterMutation2 } = (init_view_refresh(), __toCommonJS(view_refresh_exports));
 var { applyInstalledUpdates: applyInstalledUpdates2, installedUpdateStats: installedUpdateStats2 } = (init_installed_updates(), __toCommonJS(installed_updates_exports));
 var { createOperationsStore: createOperationsStore2, restoreRecords: restoreRecords2, createOpsPump: createOpsPump2, opAppliesTo: opAppliesTo2, TERMINAL_CLEARABLE: TERMINAL_CLEARABLE2, upgradeNotify: upgradeNotify2, REGISTRY_DEFAULT_TARGET: REGISTRY_DEFAULT_TARGET2 } = (init_operations(), __toCommonJS(operations_exports));
-var { groupOpsByDay: groupOpsByDay2, opRowVm: opRowVm2, opUpgradeMeta: opUpgradeMeta2 } = (init_operations_view(), __toCommonJS(operations_view_exports));
+var { groupOpsByDay: groupOpsByDay2, opRowVm: opRowVm2, opUpgradeMeta: opUpgradeMeta2, canRemoveRow: canRemoveRow2, channelLabelKey: channelLabelKey2 } = (init_operations_view(), __toCommonJS(operations_view_exports));
 var { createFavoritesStore: createFavoritesStore2, partitionStale: partitionStale2 } = (init_favorites(), __toCommonJS(favorites_exports));
 var { readSelfCheckCache: readSelfCheckCache2, writeSelfCheckCache: writeSelfCheckCache2, clearSelfCheckCache: clearSelfCheckCache2, deriveChipState: deriveChipState2 } = (init_self_check(), __toCommonJS(self_check_exports));
 var { shouldShowInstallCmd: shouldShowInstallCmd2 } = (init_install_cmd(), __toCommonJS(install_cmd_exports));
@@ -1922,8 +1975,8 @@ var ZH = {
   "zone.favorites": "\u6536\u85CF",
   "badge.deprecated": "\u5DF2\u5F03\u7528",
   "sub.snapshot": "v{v}\uFF08\u76EE\u5F55\u5FEB\u7167\uFF09",
-  "badge.verified": "\u5DF2\u5B9E\u6D4B",
   "badge.internal": "\u4F5C\u8005\u81EA\u7528",
+  "byline.verified": "\u5B9E\u6D4B \u2264{v}",
   "modal.category": "\u5206\u7C7B",
   "modal.added": "\u6536\u5F55\u65E5\u671F",
   "modal.dlwindow": "\u4E0B\u8F7D\u91CF\uFF0830 \u5929\u7A97\u53E3\uFF09",
@@ -1951,6 +2004,14 @@ var ZH = {
   "op.kind.toggle": "\u5F00\u5173",
   "op.kind.community-toggle": "\u793E\u533A\u76EE\u5F55\u5F00\u5173",
   "op.kind.registry-url": "\u6E05\u5355\u6E90\u53D8\u66F4",
+  "op.kind.self-upgrade": "\u81EA\u5347\u7EA7",
+  "op.kind.desktop-install": "\u684C\u9762\u5B89\u88C5",
+  "op.kind.desktop-uninstall": "\u684C\u9762\u5378\u8F7D",
+  "op.kind.desktop-upgrade": "\u684C\u9762\u5347\u7EA7",
+  "op.kind.desktop-toggle": "\u684C\u9762\u5F00\u5173",
+  "op.channel.host-tool": "Agent \u5DE5\u5177",
+  "op.channel.cli": "\u547D\u4EE4\u884C",
+  "op.channel.external": "\u5916\u90E8",
   "op.state.on": "\u5F00",
   "op.state.off": "\u5173",
   "op.status.queued": "\u6392\u961F\u4E2D",
@@ -2213,8 +2274,8 @@ var EN = {
   "zone.favorites": "Favorites",
   "badge.deprecated": "Deprecated",
   "sub.snapshot": "v{v} (catalog snapshot)",
-  "badge.verified": "Verified",
   "badge.internal": "Author's own",
+  "byline.verified": "verified \u2264{v}",
   "modal.category": "Category",
   "modal.added": "Added",
   "modal.dlwindow": "Downloads (30-day window)",
@@ -2242,6 +2303,14 @@ var EN = {
   "op.kind.toggle": "Toggle",
   "op.kind.community-toggle": "Community catalog toggle",
   "op.kind.registry-url": "Registry source change",
+  "op.kind.self-upgrade": "Self-upgrade",
+  "op.kind.desktop-install": "Desktop install",
+  "op.kind.desktop-uninstall": "Desktop uninstall",
+  "op.kind.desktop-upgrade": "Desktop upgrade",
+  "op.kind.desktop-toggle": "Desktop toggle",
+  "op.channel.host-tool": "Agent tool",
+  "op.channel.cli": "CLI",
+  "op.channel.external": "External",
   "op.state.on": "On",
   "op.state.off": "Off",
   "op.status.queued": "Queued",
@@ -2509,7 +2578,7 @@ function communityLabels(data) {
 }
 var CSS = `
 .dshm-overlay{position:fixed;inset:0;z-index:2147483000;background:var(--dsw-alias-bg-mask-3,rgba(15,23,42,.48));display:flex;align-items:center;justify-content:center;padding:max(24px,var(--dsh-windows-titlebar-height,0px)) 16px 24px;box-sizing:border-box}
-.dshm-panel{width:min(920px,100%);height:min(680px,86vh);display:flex;flex-direction:column;background:var(--dsw-alias-bg-elevated,var(--dsw-alias-bg-base,#fff));background:color-mix(in srgb,var(--dsw-alias-bg-base,#fff) 86%,transparent);backdrop-filter:blur(14px) saturate(1.3);-webkit-backdrop-filter:blur(14px) saturate(1.3);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:14px;box-shadow:0 18px 48px rgba(2,6,23,.25);overflow:hidden;font-family:inherit;color:var(--dsw-alias-label-primary,inherit)}
+.dshm-panel{position:relative;width:min(920px,100%);height:min(680px,86vh);display:flex;flex-direction:column;background:var(--dsw-alias-bg-elevated,var(--dsw-alias-bg-base,#fff));background:color-mix(in srgb,var(--dsw-alias-bg-base,#fff) 86%,transparent);backdrop-filter:blur(14px) saturate(1.3);-webkit-backdrop-filter:blur(14px) saturate(1.3);border:1px solid var(--dsw-alias-border-l2,#e5e7eb);border-radius:14px;box-shadow:0 18px 48px rgba(2,6,23,.25);overflow:hidden;font-family:inherit;color:var(--dsw-alias-label-primary,inherit)}
 /* 0.9.70 \u8FD8\u539F\u6001\u62D6\u62FD\uFF1A.abs = \u6709\u4F4D\u7F6E\u8BB0\u5FC6\u65F6\u7684\u7EDD\u5BF9\u5B9A\u4F4D\u5F62\u6001\uFF08overlay \u4E3A inset:0 fixed\uFF0C
    \u7EDD\u5BF9\u5B9A\u4F4D\u5750\u6807\u5373\u89C6\u53E3\u5750\u6807\uFF09\uFF1B\u65E0\u8BB0\u5F55\u65F6\u9762\u677F\u4ECD\u8D70 overlay flex \u5C45\u4E2D\uFF0C\u6E32\u67D3\u8DEF\u5F84\u4E0E\u65E7\u7248\u9010\u5B57\u8282\u4E00\u81F4\u3002
    \u62D6\u62FD\u89C2\u611F\u4E0D\u53D8\u91CF\uFF080.9.70 \u4FEE\u8BA2\uFF0CADR-0017 v2\uFF09\uFF1A\u62D6\u62FD\u6001\u4E0E\u9759\u6B62\u6001\u540C\u73BB\u7483\u540C blur\uFF0C\u5916\u89C2\u9010\u50CF\u7D20\u4E00\u81F4
@@ -2733,6 +2802,8 @@ var CSS = `
 .dsvm-opdir{font-size:11px;line-height:16px;padding:0 6px;border-radius:8px;border:1px solid currentColor}
 .dsvm-opdir.on{color:#15803d}
 .dsvm-opdir.off{color:var(--dsw-alias-label-secondary,#4b5563)}
+/* 0.9.79 \u5916\u90E8\u8BB0\u5F55\u6E20\u9053\u5FBD\u6807\uFF08Agent \u5DE5\u5177/\u547D\u4EE4\u884C/\u5916\u90E8\uFF09\uFF1A\u4E2D\u6027\u63CF\u8FB9\u80F6\u56CA\uFF0C\u4E0E\u65B9\u5411\u5FBD\u7AE0\u540C\u5F62\u4E0D\u540C\u8272 */
+.dsvm-opchan{font-size:11px;line-height:16px;padding:0 6px;border-radius:8px;border:1px solid currentColor;color:var(--dsw-alias-label-caption,#9ca3af)}
 .dsvm-opver{font-size:11px;color:var(--dsw-alias-label-secondary,#4b5563);font-variant-numeric:tabular-nums;overflow-wrap:anywhere}
 .dsvm-favbtn{appearance:none;border:0;background:transparent;color:var(--dsw-alias-label-caption,#9ca3af);font-size:15px;line-height:1;cursor:pointer;padding:0 2px;margin-left:auto}
 .dsvm-favbtn:hover{color:var(--dsw-alias-state-business-primary,#4d6bfe)}
@@ -2760,6 +2831,8 @@ button.dshm-badge:hover{filter:brightness(.95)}
 .dshm-sub{display:flex;align-items:center;gap:8px;font-size:11px;color:var(--dsw-alias-label-caption,#6b7280)}
 .dshm-detail{margin-top:8px;border-top:1px dashed var(--dsw-alias-border-l2,#e5e7eb);padding-top:8px;display:flex;flex-direction:column;gap:6px;font-size:12px;color:var(--dsw-alias-label-secondary,#4b5563)}
 .dshm-actions{display:flex;gap:6px;flex-wrap:wrap;margin-top:4px}
+.dshm-banner-stack{position:absolute;left:0;right:0;bottom:0;z-index:30;display:flex;flex-direction:column;pointer-events:none}
+.dshm-banner-stack .dshm-banner{pointer-events:auto}
 .dshm-banner{display:flex;align-items:center;gap:10px;padding:10px 14px;border-top:1px solid var(--dsw-alias-border-l2,#e5e7eb);background:var(--dsw-alias-state-warn-tertiary,#fffbeb);color:var(--dsw-alias-state-warn-primary,#b45309);font-size:12px}
 .dshm-banner.err{background:rgba(239,68,68,.13);color:var(--dsw-alias-state-error-primary,#b91c1c)}
 /* 0.9.72 \u540C\u6B3E\u6EDA\u8F6E\u6CBB\u7406\uFF08\u89C1 dshm-ops-scroll \u6CE8\uFF09\uFF1A\u6A2A\u5E45\u6587\u672C\u4E0D\u6EE1 140px \u65F6\u4E0D\u5F97\u541E\u6EDA\u8F6E */
@@ -2857,6 +2930,9 @@ button.dshm-dshchip:disabled{cursor:default;opacity:.75}
 .dshm-dot.idle{color:#9ca3af}
 .dshm-dot.busy{color:#f59e0b}
 .dshm-switch{position:relative;display:inline-flex;align-items:center;width:34px;height:19px;border-radius:10px;background:var(--dsw-alias-fill-secondary,#d1d5db);cursor:pointer;transition:background .15s;flex:none;margin-left:auto}
+/* \u70ED\u533A\u6269\u5C55\uFF082026-10-13 UX \u4FEE\u590D\uFF09\uFF1A\u89C6\u89C9 34\xD719 \u4E0D\u53D8\uFF0C\u53EF\u70B9\u9762\u79EF\u7ECF\u4F2A\u5143\u7D20\u6269\u5230 46\xD731\u2014\u2014
+   \u5C0F\u76EE\u6807 + \u6574\u5361\u5927\u76EE\u6807\u76F8\u90BB\u7684\u8BEF\u89E6\u534A\u5F84\u6536\u655B\uFF1B\u5F00\u5173\u8DDD\u5361\u8FB9 12px\uFF0C-6px \u5916\u6EA2\u4E0D\u8D8A\u51FA\u81EA\u8EAB\u5361\u7247 */
+.dshm-switch::before{content:"";position:absolute;inset:-6px;border-radius:14px}
 .dshm-switch input{display:none}
 .dshm-switch.on{background:#22c55e}
 .dshm-switch.locked{opacity:.45;cursor:not-allowed}
@@ -3675,7 +3751,6 @@ function DetailModal({ it, labels, busy, onClose, onInstall, onUpgrade, upgradeB
         h(Icon, { entry: it }),
         h("span", { className: "dshm-name" }, it.name),
         it.deprecated === true ? h("span", { className: "dshm-badge warn" }, lookup("badge.deprecated")) : null,
-        it.community !== true && Array.isArray(it.verified) && it.verified.length ? h("span", { className: "dshm-badge", title: it.verified.join("\u3001") }, lookup("badge.verified")) : null,
         it.audience === "internal" ? h("span", { className: "dshm-badge" }, lookup("badge.internal")) : null,
         it.installed ? h("span", { className: "dshm-badge" }, lookup("badge.installed")) : null,
         it.community === true ? h("span", { className: "dshm-badge info" }, lookup("badge.community")) : null,
@@ -3772,6 +3847,7 @@ var ZONE_TABS = [
   { id: "primary", labelKey: "zone.primary" },
   { id: "favorites", labelKey: "zone.favorites" }
 ];
+var verifiedByline = (it) => it.community !== true && Array.isArray(it.verified) && it.verified.length ? { text: lookup("byline.verified", { v: it.verified[it.verified.length - 1] }), title: it.verified.join("\u3001") } : null;
 function MarketTab({ notify, markets, onMutation, ops, favorites, profileKind, onOpenOps }) {
   const [zone, setZone] = useState("community");
   const market = zone === "favorites" ? null : markets[zone];
@@ -4072,7 +4148,6 @@ function MarketTab({ notify, markets, onMutation, ops, favorites, profileKind, o
         lookup("op.status.running")
       ) : null,
       it.deprecated === true ? h("span", { className: "dshm-badge warn", key: "dep" }, lookup("badge.deprecated")) : null,
-      it.community !== true && Array.isArray(it.verified) && it.verified.length ? h("span", { className: "dshm-badge", key: "v", title: it.verified.join("\u3001") }, lookup("badge.verified")) : null,
       it.audience === "internal" ? h("span", { className: "dshm-badge dshm-badge-internal", key: "internal" }, lookup("badge.internal")) : null,
       it.outdated ? h("span", { className: "dshm-badge warn", key: "u" }, lookup("badge.update")) : null,
       it.installed ? h("span", { className: "dshm-badge", key: "i" }, lookup("badge.installed")) : null,
@@ -4084,7 +4159,10 @@ function MarketTab({ notify, markets, onMutation, ops, favorites, profileKind, o
       it.owner ? { text: `by ${it.owner}` } : null,
       typeof it.downloads === "number" ? { text: `${compactCount(it.downloads)} \u2193`, title: String(it.downloads) } : null,
       typeof it.stars === "number" ? { text: `${compactCount(it.stars)} \u2605`, title: String(it.stars) } : null
-    ].filter(Boolean) : (it.tags || []).map((t) => ({ text: `#${t}` })),
+    ].filter(Boolean) : [
+      ...(it.tags || []).map((t) => ({ text: `#${t}` })),
+      verifiedByline(it)
+    ].filter(Boolean),
     desc: browserLang() === "en" && typeof it.descriptionEn === "string" && it.descriptionEn !== "" ? it.descriptionEn : it.description,
     clampLines: it.community === true ? 5 : 2,
     sub: [
@@ -4254,8 +4332,11 @@ function InstalledTab({ notify, installed, updates, onMutation, ops }) {
   const updateRows = updates && updates.data && Array.isArray(updates.data.updates) ? updates.data.updates : [];
   const [openPkg, setOpenPkg] = useState(null);
   const [readmePkg, setReadmePkg] = useState(null);
+  const [pendingToggles, setPendingToggles] = useState({});
   const activeMutateTarget = (ops.records.find((r) => r.kind !== "install" && (r.status === "running" || r.status === "queued" || r.status === "input")) || {}).target || null;
+  const progressTarget = (ops.records.find((r) => (r.kind === "install" || r.kind === "upgrade" || r.kind === "self-upgrade") && (r.status === "running" || r.status === "queued" || r.status === "input")) || {}).target || null;
   const doToggle = async (it, enabled) => {
+    setPendingToggles((m) => ({ ...m, [it.pkg]: enabled }));
     const call = () => api("set-enabled", { pkg: it.pkg, enabled });
     try {
       let res;
@@ -4269,13 +4350,19 @@ function InstalledTab({ notify, installed, updates, onMutation, ops }) {
       const note = toggleNoticeKeys2(res);
       const extra = res.warnings && res.warnings.length ? `\uFF08${res.warnings.join("\uFF1B")}\uFF09` : "";
       notify({ kind: "ok", needsRestart: note.needsRestart, text: lookup(note.textKey, note.params) + extra });
-      await (onMutation ? onMutation() : reload());
+      await reload();
     } catch (e) {
       if (e && e.opSuperseded) {
         notify({ kind: "ok", text: lookup("op.superseded.note", { target: it.pkg }) });
       } else {
         notify({ kind: "err", text: lookup("toggle.failed", { err: e && e.message || e }) });
       }
+    } finally {
+      setPendingToggles((m) => {
+        if (!(it.pkg in m)) return m;
+        const { [it.pkg]: _drop, ...rest } = m;
+        return rest;
+      });
     }
   };
   const doUninstall = async (it) => {
@@ -4356,13 +4443,15 @@ function InstalledTab({ notify, installed, updates, onMutation, ops }) {
         lookup("installed.upgradeAll", { n: items.filter((x) => x && x.outdated).length })
       )
     ) : null,
-    activeMutateTarget ? h(ProgressLine, { key: "prog" }) : null,
+    progressTarget ? h(ProgressLine, { key: "prog" }) : null,
     h(
       "div",
       { className: "dshm-cards" },
       items.map((it) => {
         const vm = installedViewModel2(it);
-        const tvm = toggleViewModel2(it);
+        const pendingOn = pendingToggles[it.pkg];
+        const tvm0 = toggleViewModel2(it);
+        const tvm = pendingOn === void 0 ? tvm0 : { ...tvm0, switchOn: pendingOn, ...pendingOn === false ? { phaseDotClass: "", phaseLabelKey: null } : {} };
         return Card({
           key: it.pkg,
           icon: h(Icon, { entry: { name: it.name, github: vm.githubRepo, icon: null } }),
@@ -4379,7 +4468,7 @@ function InstalledTab({ notify, installed, updates, onMutation, ops }) {
           desc: it.description || "\uFF08\u65E0\u63CF\u8FF0\uFF09",
           sub: [
             h(PhaseDot, { key: "dot", vm: tvm }),
-            vm.phaseKey ? lookup(vm.phaseKey) : lookup(vm.enabledLabelKey),
+            pendingOn === void 0 ? vm.phaseKey ? lookup(vm.phaseKey) : lookup(vm.enabledLabelKey) : lookup(pendingOn ? "toggle.state.on" : "toggle.state.off"),
             `v${it.version || "?"}`,
             vm.sourceLabelKey ? lookup(vm.sourceLabelKey) : it.source,
             vm.latestIssue ? lookup("installed.check.incomplete") : null
@@ -4557,17 +4646,10 @@ function SettingsTab({ notify, onRegistryChanged, onForceMarket, opsRecords, onO
     }),
     h("span", { className: "dshm-switch-slider" })
   );
-  const communitySwitchRow = h(
-    "div",
-    { className: "dshm-kvline-row" },
-    h("span", { className: "rl" }, lookup("settings.community.toggle")),
-    communitySwitch
-  );
   const communityBody = communityOn === false ? h(
     React.Fragment,
     null,
-    h("div", { className: "dshm-hint" }, lookup("settings.community.off")),
-    communitySwitchRow
+    h("div", { className: "dshm-hint" }, lookup("settings.community.off"))
   ) : h(
     "div",
     { className: "dshm-kvlines" },
@@ -4580,17 +4662,16 @@ function SettingsTab({ notify, onRegistryChanged, onForceMarket, opsRecords, onO
     kvlineRow("settings.community.version", communityLive ? communitySummary.version || "\u2014" : "\u2014"),
     kvlineRow("settings.community.route", communityLive ? communitySummary.route || "\u2014" : "\u2014"),
     kvlineRow("settings.community.count", communityLive ? lookup("settings.community.count.v", { n: communitySummary.acceptedCount ?? 0, up: communitySummary.upstreamCount ?? "\u2014" }) : "\u2014"),
-    kvlineRow("settings.community.displaced", communityLive ? lookup("settings.community.displaced.v", { n: communitySummary.displaced ?? 0 }) : "\u2014"),
-    communitySwitchRow
+    kvlineRow("settings.community.displaced", communityLive ? lookup("settings.community.displaced.v", { n: communitySummary.displaced ?? 0 }) : "\u2014")
   );
   return h(
     "div",
     { className: "dshm-settings-grid" },
-    // ① 社区清单（awesome-dsh-plugin）：左卡；清爽列表 + 发丝分隔线，开关为列表末行
+    // ① 社区清单（awesome-dsh-plugin）：左卡；开关在标题行右侧（位置恒定，2026-10-13 方案A）
     h(
       "div",
       { className: "dshm-section" },
-      h("div", { className: "dshm-section-title" }, lookup("settings.community")),
+      h("div", { className: "dshm-section-title" }, lookup("settings.community"), communitySwitch),
       communityBody,
       communitySummary && Array.isArray(communitySummary.errors) && communitySummary.errors.length && communityOn !== false ? h("div", { className: "dshm-err" }, communitySummary.errors.join("\uFF1B")) : null
     ),
@@ -4794,10 +4875,10 @@ function FavoriteZone({ favorites, onOpen }) {
           name: s.name,
           badges: [
             s.deprecated === true ? h("span", { className: "dshm-badge warn", key: "dep" }, lookup("badge.deprecated")) : null,
-            // 0.9.45 U12（R7 收窄）：无 owner = 精选条目——补「精选」身份徽标；verified 质量徽标恢复；
+            // 0.9.45 U12（R7 收窄）：无 owner = 精选条目——补「精选」身份徽标；
+            // verified 徽标已移除（2026-10-13 B 方案：卡面只留例外信号，实测信息在详情弹窗「实测版本」行）；
             // 受众/解耦徽标不进收藏区（DESIGN §2.7 裁决⑤「已装视图与收藏页不打标」），快照仅存字段
             s.owner ? h("span", { className: "dshm-badge info", key: "c" }, lookup("badge.community")) : h("span", { className: "dshm-badge", key: "cz" }, lookup("zone.primary")),
-            Array.isArray(s.verified) && s.verified.length && s.community !== true ? h("span", { className: "dshm-badge", key: "v", title: s.verified.join("\u3001") }, lookup("badge.verified")) : null,
             h("span", { className: "dshm-badge info", key: "s" }, s.source === "npm" ? "npm" : "github"),
             isStale ? h("span", { className: "dshm-badge warn", key: "st" }, lookup("favorites.stalebadge")) : null
           ],
@@ -4860,7 +4941,8 @@ function useScrollableContain(dep) {
 }
 function OperationsCard({ records, onClearFinished, onRemove }) {
   const active = records.filter((r) => r.status === "queued" || r.status === "running" || r.status === "input");
-  const finished = records.filter((r) => active.indexOf(r) < 0).slice(-50);
+  const finishedAll = records.filter((r) => active.indexOf(r) < 0);
+  const finished = finishedAll.slice(-50);
   const clearable = records.some((r) => TERMINAL_CLEARABLE2.has(r.status));
   const [scrollRef, scrollCls] = useScrollableContain(finished.length);
   const dayGroups = useMemo(() => groupOpsByDay2(finished), [records]);
@@ -4873,6 +4955,7 @@ function OperationsCard({ records, onClearFinished, onRemove }) {
       vm.clock ? h("span", { className: "dsvm-optime", title: vm.full }, vm.clock) : null,
       h("span", { className: "dsvm-opstatus" }, lookup("op.status." + r.status)),
       h("span", { className: "dsvm-opkind" }, lookup("op.kind." + r.kind)),
+      vm.channel ? h("span", { className: "dsvm-opchan", title: lookup(channelLabelKey2(vm.channel)) }, lookup(channelLabelKey2(vm.channel))) : null,
       vm.dir ? h("span", { className: `dsvm-opdir ${vm.dir}` }, lookup(vm.dir === "on" ? "op.state.on" : "op.state.off")) : null,
       h("span", { className: "dsvm-optarget", title: tip || void 0 }, vm.target),
       vm.version ? h("span", { className: "dsvm-opver", title: tip || void 0 }, vm.version) : null,
@@ -4880,8 +4963,10 @@ function OperationsCard({ records, onClearFinished, onRemove }) {
       r.status === "running" ? Spin() : null,
       r.error ? h("span", { className: "dsvm-opnote" }, r.error) : null,
       r.warning ? h("span", { className: "dsvm-opnote" }, r.warning) : null,
-      // 单条移除（终审·新伤2）：input/failed/superseded 行给出口（对话区来源的 input 不再永挂）
-      (r.status === "input" || r.status === "failed" || r.status === "superseded") && onRemove ? h("button", { className: "dshm-xbtn", title: lookup("op.remove"), onClick: () => onRemove(r.id) }, h(XIcon)) : null
+      // 单条移除（终审·新伤2 → 0.9.79 R3-1/R2-3）：出口判定下沉 canRemoveRow——
+      // 本地 input/failed/superseded 保留 ✕；外部记录（channel 非空）不给单条 ✕（防按 id 复活），
+      // 移除出口仅「清除已结束」。
+      canRemoveRow2(r) && onRemove ? h("button", { className: "dshm-xbtn", title: lookup("op.remove"), onClick: () => onRemove(r.id) }, h(XIcon)) : null
     );
   };
   return h(
@@ -4893,7 +4978,7 @@ function OperationsCard({ records, onClearFinished, onRemove }) {
     finished.length ? h(
       "div",
       { className: "dsvm-ops-caption", style: { marginTop: active.length ? "7px" : "0" } },
-      lookup("settings.ops.group.done.n", { n: finished.length })
+      lookup("settings.ops.group.done.n", { n: finishedAll.length })
     ) : null,
     finished.length ? h(
       "div",
@@ -5211,8 +5296,24 @@ function MarketPanel({ onClose }) {
   const markets = { community: marketCommunity, primary: marketPrimary };
   const installed = useAsync(() => api("installed", { probe: false }), []);
   const updates = useAsync(() => api("installedUpdates"), []);
-  const [opRecords, setOpRecords] = useState(() => opsStore.list().map((r) => ({ ...r })));
-  const syncOps = useCallback(() => setOpRecords(opsStore.list().map((r) => ({ ...r }))), []);
+  const [opRecords, setOpRecords] = useState(() => opsStore.listMerged().map((r) => ({ ...r })));
+  const syncOps = useCallback(() => setOpRecords(opsStore.listMerged().map((r) => ({ ...r }))), []);
+  const fetchExternalOps = useCallback(async () => {
+    try {
+      const r = await api("external-operations");
+      if (r && Array.isArray(r.records)) {
+        opsStore.setExternal(r.records);
+        syncOps();
+      }
+    } catch {
+    }
+  }, [syncOps]);
+  useEffect(() => {
+    void fetchExternalOps();
+  }, [fetchExternalOps]);
+  useEffect(() => {
+    if (tab === "settings") void fetchExternalOps();
+  }, [tab, fetchExternalOps]);
   const openOps = useCallback(() => {
     setTab("settings");
     if (typeof document !== "undefined") {
@@ -5227,9 +5328,13 @@ function MarketPanel({ onClose }) {
     (kind, target, exec, meta = {}, reuseId) => (
       // session:true = 活会话标记（终审·新伤1）：重挂载的 restore 跳过（泵仍拥有）；persist 时剥离。
       // 入队与 waiters/原始错误保真都在 createOpsPump（评审 P4：实现与测试同源）。
-      opsPump.enqueue({ ...reuseId ? { id: reuseId } : {}, kind, target, status: "queued", meta: { ...meta, session: true } }, exec)
+      // 0.9.79（R1-6）：操作终态后连带拉取一次外部记录——他终端（CLI/Agent 工具）的并发变更
+      // 尽快可见；拉取失败静默。
+      opsPump.enqueue({ ...reuseId ? { id: reuseId } : {}, kind, target, status: "queued", meta: { ...meta, session: true } }, exec).finally(() => {
+        void fetchExternalOps();
+      })
     ),
-    []
+    [fetchExternalOps]
   );
   const disposeOp = useCallback((id, note) => {
     opsStore.upsert({ id, status: "superseded", error: note });
@@ -5443,7 +5548,10 @@ function MarketPanel({ onClose }) {
           opsRecords: opRecords,
           onOpsClearFinished: () => {
             opsStore.clearFinished();
+            opsStore.clearExternal();
             syncOps();
+            void api("external-operations-clear").catch(() => {
+            });
           },
           onOpsRemove: (id) => {
             opsStore.remove(id);
@@ -5452,12 +5560,19 @@ function MarketPanel({ onClose }) {
         }) : null
         // 操作记录已整体搬迁至设置 tab 末位通宽卡（0.9.x 布局重构·第二批）：底部不再常驻
       ),
-      toast ? h(
+      // toast/横幅 overlay 化（2026-10-13 UX 修复）：原先是面板 column flex 的流内子元素，
+      // 出现/消失会压缩 body(flex:1) 造成二次抖动；现挂 absolute 底部浮层（.dshm-banner-stack），
+      // 零布局参与。stack 用 pointer-events:none 放行下层点击，banner 自身恢复 auto。
+      toast || banner ? h(
         "div",
-        { className: toast.kind === "err" ? "dshm-banner err" : "dshm-banner" },
-        h("span", { className: `dshm-banner-text${toastScrollCls}`, ref: toastTextRef }, toast.text)
-      ) : null,
-      banner ? h(RestartBanner, { note: banner.text, onDone: () => setBanner(null), desktop: banner.desktop === true, onRestarted: reloadPing }) : null
+        { className: "dshm-banner-stack" },
+        toast ? h(
+          "div",
+          { className: toast.kind === "err" ? "dshm-banner err" : "dshm-banner" },
+          h("span", { className: `dshm-banner-text${toastScrollCls}`, ref: toastTextRef }, toast.text)
+        ) : null,
+        banner ? h(RestartBanner, { note: banner.text, onDone: () => setBanner(null), desktop: banner.desktop === true, onRestarted: reloadPing }) : null
+      ) : null
     )
   );
 }

package/lib/core/external-journal.js

@@ -0,0 +1,137 @@
+/**
+ * 机器本地的外部操作日志（0.9.79，ADR-0018）：外部通道（dshm CLI / Agent 工具）发起的
+ * Profile 变更以终态直落记录进入本文件——不入操作泵、永不 queued/running、不参与恢复重放、
+ * 宿主重启后原样保留；记录机器本地、不跨机同步；不含凭据与原始命令输出。
+ *
+ * - 存储文件：`$DSH_HOME/dshm/external-operations.json`（`DSHM_EXTERNAL_JOURNAL_FILE` 可整文件
+ *   覆盖供测试；与 dshm/cache 同基址、不带 profile 维度、不被缓存清理波及）。
+ * - append：mkdir recursive 先行（R2-4：全新机器上 `dshm/` 目录可能尚不存在，首条审计记录
+ *   恰是最有价值的一条，不能静默丢失）→ tmp+rename 原子替换（community.ts 同款惯例）→
+ *   滚动保留最新 200 条。channel='panel' 拒绝（防御性不变量：面板通道不走外部日志，
+ *   面板调用点应在钩子层被跳过）。错误一律上抛——吞错是上层钩子的职责（R1-1）。
+ * - list：按 `at` 降序（新→旧）；文件缺失 = 空列表；损坏文件不抛——改名
+ *   `<file>.corrupt-<ts>` 隔离留证后从空开始（best-effort，隔离失败同样不抛）。
+ * - clear：写空数组，文件保留（面板「清除已结束」联动出口）。
+ */
+import { mkdir, readFile, rename, writeFile } from 'node:fs/promises';
+import { dirname, join } from 'node:path';
+import { dshHome } from './env.js';
+const MAX_RECORDS = 200;
+const REASON_MAX = 300;
+/** 日志文件路径：env 整文件覆盖优先（测试隔离），缺省 $DSH_HOME/dshm/external-operations.json。 */
+export function journalFile() {
+    return process.env.DSHM_EXTERNAL_JOURNAL_FILE || join(dshHome(), 'dshm', 'external-operations.json');
+}
+/** 显式字段白名单重组（超集字段一律不落盘——「记录不含凭据」的形状级保证）；reason 截断 ≤300。 */
+function normalizeRecord(record) {
+    const reason = typeof record.reason === 'string' ? record.reason.slice(0, REASON_MAX) : undefined;
+    return {
+        id: record.id,
+        at: record.at,
+        channel: record.channel,
+        kind: record.kind,
+        target: record.target,
+        ...(record.fromVersion !== undefined ? { fromVersion: record.fromVersion } : {}),
+        ...(record.toVersion !== undefined ? { toVersion: record.toVersion } : {}),
+        result: record.result,
+        ...(reason !== undefined && reason !== '' ? { reason } : {}),
+    };
+}
+async function atomicWrite(path, text) {
+    const tmp = `${path}.tmp-${process.pid}-${Date.now()}`;
+    await writeFile(tmp, text);
+    await rename(tmp, path);
+}
+/** 读全量记录（插入序 = 时间升序）；损坏 → 隔离改名后按空处理；文件缺失 → []。 */
+async function readAll(file) {
+    let text;
+    try {
+        text = await readFile(file, 'utf8');
+    }
+    catch (err) {
+        if (err.code === 'ENOENT')
+            return [];
+        throw err;
+    }
+    try {
+        const parsed = JSON.parse(text);
+        return Array.isArray(parsed) ? parsed.filter((r) => r && typeof r === 'object') : [];
+    }
+    catch {
+        // 损坏容错：整文件改名隔离留证（best-effort），从空开始；不抛——读路径永不炸
+        const quarantined = `${file}.corrupt-${Date.now()}`;
+        try {
+            await rename(file, quarantined);
+        }
+        catch {
+            try {
+                // 同毫秒重入等极小概率命名冲突：换一个带随机尾缀的名字再试一次；仍败则放弃隔离
+                const fallback = `${file}.corrupt-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`;
+                await rename(file, fallback);
+            }
+            catch {
+                /* 放弃隔离：按空继续 */
+            }
+        }
+        return [];
+    }
+}
+/**
+ * 追加一条终态记录（成功与失败都记）。channel='panel' 抛错（防御性不变量）；
+ * 不可创建路径/磁盘错误等存储失败原样上抛，由上层钩子吞（R1-1：绝不反噬操作终态）。
+ */
+export async function appendExternalOperation(record) {
+    if (record.channel === 'panel') {
+        throw new Error('panel 通道不入外部操作日志（防御性不变量：面板调用点应在钩子层跳过 append）');
+    }
+    const file = journalFile();
+    await mkdir(dirname(file), { recursive: true });
+    const records = await readAll(file);
+    records.push(normalizeRecord(record));
+    const kept = records.slice(-MAX_RECORDS);
+    await atomicWrite(file, `${JSON.stringify(kept, null, 2)}\n`);
+}
+/** 全量外部记录，按 `at` 降序（新→旧）。 */
+export async function listExternalOperations() {
+    const records = await readAll(journalFile());
+    return records
+        .slice()
+        .sort((a, b) => (b.at ?? 0) - (a.at ?? 0))
+        .map((r) => ({ ...r }));
+}
+/** 清空外部记录：文件保留（空数组），面板「清除已结束」联动出口。 */
+export async function clearExternalOperations() {
+    const file = journalFile();
+    await mkdir(dirname(file), { recursive: true });
+    await atomicWrite(file, '[]\n');
+}
+/**
+ * 九个公共变更入口共用的终态直落钩子（0.9.79，ADR-0018）：
+ * - channel 缺省 'external'（审计上漏报更糟，未知调用方落兜底而非丢弃）；
+ * - channel='panel' 在钩子层**跳过**（面板通道零记录；append 侧的 panel 抛错仅为防御性不变量）；
+ * - append 任何失败被吞（至多 stderr 一行）——**绝不反噬操作终态与返回值**（R1-1）；
+ * - reason 截断 ≤300 字符（R1-8）。
+ * 调用时机 = 操作终态之后（成功与失败都记）。
+ */
+export async function journalExternalOperation(channel, record, result, deps = {}) {
+    const ch = channel ?? 'external';
+    if (ch === 'panel')
+        return;
+    try {
+        const reason = typeof deps.reason === 'string' ? deps.reason.slice(0, REASON_MAX) : undefined;
+        await (deps.appendExternalOperation ?? appendExternalOperation)({
+            id: `ext-${Date.now()}-${Math.random().toString(36).slice(2, 8)}`,
+            at: Date.now(),
+            channel: ch,
+            kind: record.kind,
+            target: record.target,
+            ...(record.fromVersion !== undefined ? { fromVersion: record.fromVersion } : {}),
+            ...(record.toVersion !== undefined ? { toVersion: record.toVersion } : {}),
+            result,
+            ...(reason !== undefined && reason !== '' ? { reason } : {}),
+        });
+    }
+    catch (err) {
+        console.error(`[dsh-m] 外部操作记录落盘失败（不影响操作结果）: ${err instanceof Error ? err.message : String(err)}`);
+    }
+}

package/lib/core/host-api.js

@@ -12,6 +12,7 @@ import { resolveDshVersion, readLauncherPackageVersion } from './dsh-version.js'
 import { runDoctor } from './doctor.js';
 import { listInstalledWithMeta, listMarket, installFromRegistry, selfUpgrade, uninstallPlugin, upgradePlugin, InstallGuardError, } from './market.js';
 import { runProfileTransaction, TransactionError } from './profile-transaction.js';
+import { listExternalOperations, clearExternalOperations } from './external-journal.js';
 import { readInstalledPluginReadme } from './installed.js';
 import { loadPrimaryScreenshots } from './primary-screenshots.js';
 import { isNewerVersion, npmLatest, npmPackumentReadme } from './versions.js';
@@ -231,6 +232,8 @@ export function createApiDispatcher(ctx) {
         desktopUninstall: ctx.deps?.desktopUninstall ?? desktopUninstall,
         desktopUpgrade: ctx.deps?.desktopUpgrade ?? desktopUpgradeFromRegistry,
         ensureService: ctx.deps?.ensureService,
+        listExternalOperations: ctx.deps?.listExternalOperations ?? listExternalOperations,
+        clearExternalOperations: ctx.deps?.clearExternalOperations ?? clearExternalOperations,
     };
     const cfg = () => ctx.controller.config;
     // 0.9.0：宿主信任检查委派（含 ping 与未知 method，fail-closed）；
@@ -284,6 +287,7 @@ export function createApiDispatcher(ctx) {
                             profile: profile.name,
                             profileDir: profile.dir,
                             signal,
+                            channel: 'panel', // 0.9.79：面板自升级零外部记录（漏标 = 落 external，违反面板零记录不变量）
                         }, { getService: d.getService, ensureService: d.ensureService });
                         if ('needsBuildApproval' in managed) {
                             // build-blocked（自升级罕见）：结构化透出，不冒充成功
@@ -300,7 +304,7 @@ export function createApiDispatcher(ctx) {
                         break;
                     }
                     // M2 Task 3：self-upgrade 收编 market.selfUpgrade（统一 mutation session + 守卫，直调事务旁路封死）
-                    const result = await d.selfUpgrade(ctx.pkg.name, ctx.pkg.version, cfg(), { signal });
+                    const result = await d.selfUpgrade(ctx.pkg.name, ctx.pkg.version, cfg(), { signal, channel: 'panel' });
                     payload = {
                         pkg: result.pkg,
                         version: result.version,
@@ -502,6 +506,7 @@ export function createApiDispatcher(ctx) {
                                 profile: profile.name,
                                 profileDir: profile.dir,
                                 signal,
+                                channel: 'panel',
                             }, { getService: d.getService, ensureService: d.ensureService })) };
                         break;
                     }
@@ -511,6 +516,7 @@ export function createApiDispatcher(ctx) {
                         forceIncompatible: boolArg(body.forceIncompatible),
                         namespace: 'host',
                         signal,
+                        channel: 'panel',
                     });
                     payload = { ...result };
                     break;
@@ -522,10 +528,10 @@ export function createApiDispatcher(ctx) {
                     assertWriteAllowed(profile, 'uninstall');
                     // 0.9.8：desktop → 官方管理器 removeBundle（dsh-market 同策略；此前结构化拒绝）
                     if (profile.kind !== 'web') {
-                        payload = { ...(await d.desktopUninstall(target, { getService: d.getService, ensureService: d.ensureService, profileDir: profile.dir })) };
+                        payload = { ...(await d.desktopUninstall(target, { getService: d.getService, ensureService: d.ensureService, profileDir: profile.dir, channel: 'panel' })) };
                         break;
                     }
-                    const result = await d.uninstallPlugin(target, cfg(), { namespace: 'host', signal });
+                    const result = await d.uninstallPlugin(target, cfg(), { namespace: 'host', signal, channel: 'panel' });
                     payload = { ...result };
                     break;
                 }
@@ -538,10 +544,10 @@ export function createApiDispatcher(ctx) {
                     // 0.9.0：desktop → 官方管理器委派（服务缺席结构化拒绝，禁 fallback 文件写）
                     if (profile.kind !== 'web') {
                         assertWriteAllowed(profile, 'set-enabled');
-                        payload = { ...(await d.desktopToggle(target, body.enabled, { getService: d.getService, profileDir: profile.dir })) };
+                        payload = { ...(await d.desktopToggle(target, body.enabled, { getService: d.getService, profileDir: profile.dir, channel: 'panel' })) };
                         break;
                     }
-                    const result = await d.toggle(target, body.enabled, { getService: d.getService });
+                    const result = await d.toggle(target, body.enabled, { getService: d.getService, channel: 'panel' });
                     payload = { ...result };
                     break;
                 }
@@ -558,6 +564,7 @@ export function createApiDispatcher(ctx) {
                                 profile: profile.name,
                                 profileDir: profile.dir,
                                 signal,
+                                channel: 'panel',
                             }, { getService: d.getService, ensureService: d.ensureService })) };
                         break;
                     }
@@ -565,10 +572,23 @@ export function createApiDispatcher(ctx) {
                         forceIncompatible: boolArg(body.forceIncompatible),
                         namespace: 'host',
                         signal,
+                        channel: 'panel',
                     });
                     payload = { ...result };
                     break;
                 }
+                case 'external-operations': {
+                    // 0.9.79 外部操作记录（ADR-0018）：面板「已结束」overlay 数据源；鉴权走方法分发前的
+                    // 既有宿主信任检查（零新增特例）
+                    const records = await d.listExternalOperations();
+                    payload = { records };
+                    break;
+                }
+                case 'external-operations-clear': {
+                    await d.clearExternalOperations();
+                    payload = {};
+                    break;
+                }
                 case 'restart': {
                     // 0.9.0：Desktop 不触发旧 helper（Electron 生命周期归官方；杀子进程=红线）
                     assertWriteAllowed(profile, 'restart');

package/lib/core/market.js

@@ -30,6 +30,7 @@ import { classifyUpgradeActivation } from './activation.js';
 import { HttpError } from './httpx.js';
 import { ensureLatestCacheSwept, invalidateLatestCache, latestCacheKey, latestItemId, peekLatestCache, readLatestCache, writeLatestCache } from './latest-cache.js';
 import { verifyInstalledAdditions } from './install-guard.js';
+import { journalExternalOperation } from './external-journal.js';
 import { fetchTextLimited } from './httpx.js';
 import { githubLatestTag as defaultGithubLatestTag, isNewerVersion, npmLatest as defaultNpmLatest, npmVersion, } from './versions.js';
 /** profile package.json 的 dsh.profile.bundles 数组（读不到 → []；Task 13）。 */
@@ -672,8 +673,17 @@ export async function resolveRegistryEntry(id, cfg = {}, opts = {}, deps) {
     throw new Error(`registry 中没有该条目: ${id}`);
 }
 export async function installFromRegistry(id, cfg = {}, opts = {}, deps) {
-    const entry = await resolveRegistryEntry(id, cfg, opts, deps);
-    return installEntry(entry, cfg, opts, deps);
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，成功与失败都记；append 失败被钩子吞（R1-1）
+    try {
+        const entry = await resolveRegistryEntry(id, cfg, opts, deps);
+        const result = await installEntry(entry, cfg, opts, deps);
+        await journalExternalOperation(opts.channel, { kind: 'install', target: id, ...(result.version ? { toVersion: result.version } : {}) }, 'ok', { appendExternalOperation: deps?.appendExternalOperation });
+        return result;
+    }
+    catch (err) {
+        await journalExternalOperation(opts.channel, { kind: 'install', target: id }, 'failed', { reason: errText(err), appendExternalOperation: deps?.appendExternalOperation });
+        throw err;
+    }
 }
 // ---------- M2 Task 3：统一 mutation session + 装后守卫 + 补偿接线 ----------
 let sessionTail = Promise.resolve();
@@ -1196,7 +1206,23 @@ async function installEntryLocked(entry, cfg = {}, opts = {}, deps) {
 }
 /** 卸载：validate（严格读取）→ live-disable → 摘补丁 → pnpm remove → verify gone（DESIGN.md §3：删包不删数据）。 */
 export function uninstallPlugin(pkg, cfg = {}, opts = {}, deps = {}) {
-    return withMutationSession(() => uninstallPluginLocked(pkg, cfg, opts, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，session 区间内保持单写者
+    return withMutationSession(async () => {
+        try {
+            const result = await uninstallPluginLocked(pkg, cfg, opts, deps);
+            await journalExternalOperation(opts.channel, { kind: 'uninstall', target: pkg }, 'ok', {
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        catch (err) {
+            await journalExternalOperation(opts.channel, { kind: 'uninstall', target: pkg }, 'failed', {
+                reason: errText(err),
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            throw err;
+        }
+    });
 }
 async function uninstallPluginLocked(pkg, _cfg = {}, opts = {}, deps = {}) {
     // 保护门（Task 12，grilling Q3）：dsh-m 自身与官方宿主命脉拒绝卸载（升级不受影响）
@@ -1221,7 +1247,26 @@ async function uninstallPluginLocked(pkg, _cfg = {}, opts = {}, deps = {}) {
 }
 /** 升级 = 按最新重新安装（npm 拉最新精确版；github 重新锁 HEAD）。 */
 export function upgradePlugin(pkg, cfg = {}, opts = {}, deps) {
-    return withMutationSession(() => upgradePluginLocked(pkg, cfg, opts, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，session 区间内保持单写者
+    return withMutationSession(async () => {
+        try {
+            const result = await upgradePluginLocked(pkg, cfg, opts, deps);
+            await journalExternalOperation(opts.channel, {
+                kind: 'upgrade',
+                target: pkg,
+                ...(result.fromVersion ? { fromVersion: result.fromVersion } : {}),
+                ...(result.version ? { toVersion: result.version } : {}),
+            }, 'ok', { appendExternalOperation: deps?.appendExternalOperation });
+            return result;
+        }
+        catch (err) {
+            await journalExternalOperation(opts.channel, { kind: 'upgrade', target: pkg }, 'failed', {
+                reason: errText(err),
+                appendExternalOperation: deps?.appendExternalOperation,
+            });
+            throw err;
+        }
+    });
 }
 async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
     const loaded = await (deps?.loadRegistry ?? defaultLoadRegistry)(cfg, { namespace: opts.namespace ?? 'host', profile: opts.profile });
@@ -1278,29 +1323,42 @@ async function upgradePluginLocked(pkg, cfg = {}, opts = {}, deps) {
  * （owner--name 等），主清单 miss 时按同一 id 查社区目录。社区清单未启用/不可用/加载
  * 异常/未命中 → undefined，由调用方统一报「registry 中没有该条目」。
  */
-/** 自升级（0.5.0 收编：host-api 直调事务的旁路封死）：npmLatest + integrity fail-closed + installEntryLocked（session/守卫经 installEntry）。 */
+/** 自升级（0.5.0 收编：host-api 直调事务的旁路封死）：npmLatest + integrity fail-closed；函数体直调事务（call-graph audit：不经 installEntry，无嵌套双记）。 */
 export async function selfUpgrade(pkgName, currentVersion, cfg = {}, opts = {}, deps) {
     return withMutationSession(async () => {
-        const timeoutMs = cfg.timeoutMs ?? 20_000;
-        const latest = await (deps?.npmLatest ?? defaultNpmLatest)(pkgName, timeoutMs, opts.signal);
-        if (!latest.integrity) {
-            throw new Error(`npm metadata 缺少 dist integrity：${pkgName}@${latest.version}，拒绝升级`);
+        try {
+            const timeoutMs = cfg.timeoutMs ?? 20_000;
+            const latest = await (deps?.npmLatest ?? defaultNpmLatest)(pkgName, timeoutMs, opts.signal);
+            if (!latest.integrity) {
+                throw new Error(`npm metadata 缺少 dist integrity：${pkgName}@${latest.version}，拒绝升级`);
+            }
+            const result = await runProfileTransaction({ kind: 'install-npm', pkg: pkgName, version: latest.version, integrity: latest.integrity, signal: opts.signal }, { ...(deps?.transaction ?? {}), warmPackument: deps?.transaction?.warmPackument ?? makeNpmWarmPackument(timeoutMs) });
+            if (!result.ok)
+                throw new TransactionError(result);
+            const payload = {
+                id: pkgName,
+                pkg: result.pkg ?? pkgName,
+                spec: result.spec ?? `${pkgName}@${latest.version}`,
+                version: result.version ?? latest.version,
+                buildApprovals: result.buildApprovals ?? [],
+                fallbackAllBuilds: result.fallbackAllBuilds === true,
+                ...(result.bundleWarning ? { bundleWarning: result.bundleWarning } : {}),
+                needsRestart: true,
+                output: result.output,
+                healActions: result.healActions,
+            };
+            await journalExternalOperation(opts.channel, {
+                kind: 'self-upgrade',
+                target: pkgName,
+                ...(currentVersion ? { fromVersion: currentVersion } : {}),
+                ...(payload.version ? { toVersion: payload.version } : {}),
+            }, 'ok', { appendExternalOperation: deps?.appendExternalOperation });
+            return payload;
+        }
+        catch (err) {
+            await journalExternalOperation(opts.channel, { kind: 'self-upgrade', target: pkgName, ...(currentVersion ? { fromVersion: currentVersion } : {}) }, 'failed', { reason: errText(err), appendExternalOperation: deps?.appendExternalOperation });
+            throw err;
         }
-        const result = await runProfileTransaction({ kind: 'install-npm', pkg: pkgName, version: latest.version, integrity: latest.integrity, signal: opts.signal }, { ...(deps?.transaction ?? {}), warmPackument: deps?.transaction?.warmPackument ?? makeNpmWarmPackument(timeoutMs) });
-        if (!result.ok)
-            throw new TransactionError(result);
-        return {
-            id: pkgName,
-            pkg: result.pkg ?? pkgName,
-            spec: result.spec ?? `${pkgName}@${latest.version}`,
-            version: result.version ?? latest.version,
-            buildApprovals: result.buildApprovals ?? [],
-            fallbackAllBuilds: result.fallbackAllBuilds === true,
-            ...(result.bundleWarning ? { bundleWarning: result.bundleWarning } : {}),
-            needsRestart: true,
-            output: result.output,
-            healActions: result.healActions,
-        };
     });
 }
 /** 疑似残留路径（存在才列出）：删包不删数据，只报告。 */

package/lib/core/profile-ops.js

@@ -33,6 +33,7 @@ import { classifyUpgradeActivation } from './activation.js';
 import { togglePlugin, ToggleError } from './toggle.js';
 import { describeReleaseAgeFailure, releaseAgePrecheck } from './release-age.js';
 import { governExcludeBlock, registerExclusion } from './exclude-governance.js';
+import { journalExternalOperation } from './external-journal.js';
 /** desktop 升级社区兜底的等待上限（对齐 market.ts DEFAULT_DEADLINE_MS 量级；仅本路径使用）。 */
 const DEFAULT_COMMUNITY_DEADLINE_MS = 60_000;
 // 0.9.19：等待期失败翻译移入 release-age.ts（describeReleaseAgeFailure）——全量违规解析 +
@@ -77,7 +78,27 @@ function changeOf(raw) {
  * 全程 within mutation session（与 web 五入口同一 FIFO）。
  */
 export async function desktopInstallFromRegistry(id, cfg = {}, opts = {}, deps = {}) {
-    return withMutationSession(() => desktopInstallLocked(id, cfg, opts, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：自记（call-graph audit：内部走 resolveEntry + service.installBundle，
+    // 不经 market.ts 已插桩入口）；成功/失败/needsBuildApproval（结构化未遂）都记；append 失败被钩子吞
+    try {
+        const result = await withMutationSession(() => desktopInstallLocked(id, cfg, opts, deps));
+        if ('needsBuildApproval' in result) {
+            await journalExternalOperation(opts.channel, { kind: 'desktop-install', target: id }, 'failed', {
+                reason: result.message,
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        await journalExternalOperation(opts.channel, { kind: 'desktop-install', target: id, ...(result.version ? { toVersion: result.version } : {}) }, 'ok', { appendExternalOperation: deps.appendExternalOperation });
+        return result;
+    }
+    catch (err) {
+        await journalExternalOperation(opts.channel, { kind: 'desktop-install', target: id }, 'failed', {
+            reason: err instanceof Error ? err.message : String(err),
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw err;
+    }
 }
 async function desktopInstallLocked(id, cfg, opts, deps) {
     const service = await resolveManager(deps);
@@ -197,15 +218,27 @@ async function desktopInstallLocked(id, cfg, opts, deps) {
     };
 }
 /**
- * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写）；
- * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码）。
+ * Desktop 开关：服务缺席 → 结构化拒绝（ToggleError/unaddressable，禁 fallback 文件写；
+ * 该拒绝发生在透传前，由本入口自记 desktop-toggle failed——类型契约中该 kind 的唯一可达路径）；
+ * 服务在用 → 既有 togglePlugin 委派路径（installed 校验按 profileDir，与 web 委派同代码；
+ * channel/钩子透传，单笔事务只产生一条 toggle 记录，不双记——R1-2）。
  */
 export async function desktopToggle(pkg, enabled, deps = {}) {
     const service = await resolveManager(deps);
     if (!service) {
-        throw new ToggleError('unaddressable', '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作');
+        const message = '官方 pluginManager 服务不可用：desktop profile 的开关必须走官方管理器（dsh-m 不做文件级 fallback）；请在官方 Desktop 插件页操作';
+        await journalExternalOperation(deps.channel, { kind: 'desktop-toggle', target: pkg }, 'failed', {
+            reason: message,
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw new ToggleError('unaddressable', message);
     }
-    return togglePlugin(pkg, enabled, { getService: () => service, profileDir: deps.profileDir });
+    return togglePlugin(pkg, enabled, {
+        getService: () => service,
+        profileDir: deps.profileDir,
+        channel: deps.channel,
+        appendExternalOperation: deps.appendExternalOperation,
+    });
 }
 /**
  * 管理器安装共享核心（0.9.8）：installBundle + ChangeResult 判定 + listBundles 复读。
@@ -363,40 +396,78 @@ async function runManagedInstall(service, ctx, deps = {}) {
 /**
  * Desktop 卸载（0.9.8，dsh-market 同策略）：removeBundle 委派 + ChangeResult 判定 +
  * listBundles 复读（可用时必须不见目标在装）。服务缺席 → 结构化拒绝，零 CLI、零文件级 fallback。
+ * 0.9.79：自记外部操作（call-graph audit：内部直接 service.removeBundle，不经 market.ts 插桩入口）。
  */
 export async function desktopUninstall(pkg, deps = {}) {
-    const service = await resolveManager(deps);
-    if (!service || typeof service.removeBundle !== 'function') {
-        throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 的卸载必须由官方管理器执行）；拒绝卸载（fail-closed）');
-    }
-    const raw = await service.removeBundle(pkg);
-    const change = changeOf(raw);
-    if (change.application === 'failed' || change.error) {
-        throw new DesktopOpsError('remove-failed', `官方管理器卸载失败（${pkg}；application=${change.application ?? 'failed'}${change.error?.code ? `、error=${change.error.code}` : ''}${change.error?.diagnostic ? `：${change.error.diagnostic}` : ''}）`);
-    }
-    if (typeof service.listBundles === 'function') {
-        const bundles = await service.listBundles();
-        const found = (bundles ?? []).find((b) => b && b.name === (change.bundle ?? pkg));
-        if (found && found.installed === true) {
-            throw new DesktopOpsError('verify-failed', `卸载复读失败（${pkg}）：官方结果为 ${change.application ?? 'unknown'} 但 listBundles 仍见目标在装——不冒充卸载成功`);
+    try {
+        const service = await resolveManager(deps);
+        if (!service || typeof service.removeBundle !== 'function') {
+            throw new DesktopOpsError('no-manager', '官方 pluginManager 服务不可用（desktop profile 的卸载必须由官方管理器执行）；拒绝卸载（fail-closed）');
+        }
+        const raw = await service.removeBundle(pkg);
+        const change = changeOf(raw);
+        if (change.application === 'failed' || change.error) {
+            throw new DesktopOpsError('remove-failed', `官方管理器卸载失败（${pkg}；application=${change.application ?? 'failed'}${change.error?.code ? `、error=${change.error.code}` : ''}${change.error?.diagnostic ? `：${change.error.diagnostic}` : ''}）`);
+        }
+        if (typeof service.listBundles === 'function') {
+            const bundles = await service.listBundles();
+            const found = (bundles ?? []).find((b) => b && b.name === (change.bundle ?? pkg));
+            if (found && found.installed === true) {
+                throw new DesktopOpsError('verify-failed', `卸载复读失败（${pkg}）：官方结果为 ${change.application ?? 'unknown'} 但 listBundles 仍见目标在装——不冒充卸载成功`);
+            }
         }
+        await journalExternalOperation(deps.channel, { kind: 'desktop-uninstall', target: pkg }, 'ok', {
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        return {
+            pkg,
+            liveDisabled: false,
+            needsRestart: change.application === 'restart-required',
+            leftovers: [],
+            via: 'desktop-manager',
+            output: `official pluginManager: application=${change.application ?? 'applied'}`,
+        };
+    }
+    catch (err) {
+        await journalExternalOperation(deps.channel, { kind: 'desktop-uninstall', target: pkg }, 'failed', {
+            reason: err instanceof Error ? err.message : String(err),
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw err;
     }
-    return {
-        pkg,
-        liveDisabled: false,
-        needsRestart: change.application === 'restart-required',
-        leftovers: [],
-        via: 'desktop-manager',
-        output: `official pluginManager: application=${change.application ?? 'applied'}`,
-    };
 }
 /**
  * Desktop 升级（0.9.8，dsh-market 同策略——本机 0.9.3→0.9.4/0.9.5 即此路径实证）：
  * 覆盖安装 = installBundle(latest 精确 spec)。收录匹配（主清单 → 社区目录）与
  * upgradePluginLocked 同语义；非 dsh-m 收录的插件结构化拒绝（官方插件页负责）。
+ * 0.9.79：自记外部操作（call-graph audit：内部走 loadRegistry/mergedOutcome + service.installBundle，
+ * 不经 market.ts 已插桩入口）；needsBuildApproval（结构化未遂）记 failed。
  */
 export async function desktopUpgradeFromRegistry(pkg, cfg = {}, opts = {}, deps = {}) {
-    return withMutationSession(() => desktopUpgradeLocked(pkg, cfg, opts, deps));
+    try {
+        const result = await withMutationSession(() => desktopUpgradeLocked(pkg, cfg, opts, deps));
+        if ('needsBuildApproval' in result) {
+            await journalExternalOperation(opts.channel, { kind: 'desktop-upgrade', target: pkg }, 'failed', {
+                reason: result.message,
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        await journalExternalOperation(opts.channel, {
+            kind: 'desktop-upgrade',
+            target: pkg,
+            ...(result.fromVersion ? { fromVersion: result.fromVersion } : {}),
+            ...(result.version ? { toVersion: result.version } : {}),
+        }, 'ok', { appendExternalOperation: deps.appendExternalOperation });
+        return result;
+    }
+    catch (err) {
+        await journalExternalOperation(opts.channel, { kind: 'desktop-upgrade', target: pkg }, 'failed', {
+            reason: err instanceof Error ? err.message : String(err),
+            appendExternalOperation: deps.appendExternalOperation,
+        });
+        throw err;
+    }
 }
 async function desktopUpgradeLocked(pkg, cfg, opts, deps) {
     const service = await resolveManager(deps);

package/lib/core/toggle.js

@@ -24,6 +24,7 @@ import { isSingleRowPlugin, planRowOverride } from './patch-yaml.js';
 import { PROTECTED_MODULES } from './enablement.js';
 import { withMutationSession } from './market.js';
 import { setLivePluginDisabled, loaderHost } from './live-plugin.js';
+import { journalExternalOperation } from './external-journal.js';
 import { webProfileDir } from './env.js';
 export class ToggleError extends Error {
     code;
@@ -55,7 +56,23 @@ async function readPatchText(io, path) {
 }
 export function togglePlugin(pkg, enabled, deps = {}) {
     // M2 Task 3：toggle 纳入统一 mutation session（本体单点获取；自身 file lock 在 session 内层）
-    return withMutationSession(() => togglePluginLocked(pkg, enabled, deps));
+    // 0.9.79 外部操作直落（ADR-0018）：终态后挂钩，成功与失败都记；append 失败被钩子吞（R1-1）
+    return withMutationSession(async () => {
+        try {
+            const result = await togglePluginLocked(pkg, enabled, deps);
+            await journalExternalOperation(deps.channel, { kind: 'toggle', target: pkg }, 'ok', {
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            return result;
+        }
+        catch (err) {
+            await journalExternalOperation(deps.channel, { kind: 'toggle', target: pkg }, 'failed', {
+                reason: err instanceof Error ? err.message : String(err),
+                appendExternalOperation: deps.appendExternalOperation,
+            });
+            throw err;
+        }
+    });
 }
 async function togglePluginLocked(pkg, enabled, deps = {}) {
     const key = String(pkg || '').trim();

package/lib/tools.js

@@ -257,10 +257,10 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             if (profile.kind !== 'web') {
                 assertWriteAllowed(profile, 'install');
                 // 0.9.8：补传服务解析 deps（此前漏传 → desktop 安装恒 no-manager，实机 2026-10-01）
-                return cloneJson(await m.desktopInstall(id, cfg, { version, forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir }, { getService: getService, ensureService: ensureService }));
+                return cloneJson(await m.desktopInstall(id, cfg, { version, forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir, channel: 'host-tool' }, { getService: getService, ensureService: ensureService }));
             }
             try {
-                return cloneJson(await m.installFromRegistry(id, cfg, { version, forceIncompatible: force, namespace: 'host' }));
+                return cloneJson(await m.installFromRegistry(id, cfg, { version, forceIncompatible: force, namespace: 'host', channel: 'host-tool' }));
             }
             catch (err) {
                 if (err instanceof InstallGuardError) {
@@ -303,9 +303,9 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             // 0.9.0：desktop → 官方管理器委派（服务缺席结构化拒绝）；web → 既有委派/降级
             if (profile.kind !== 'web') {
                 assertWriteAllowed(profile, 'set-enabled');
-                return cloneJson(await m.desktopToggle(target, args.enabled, { getService: getService, ensureService: ensureService, profileDir: profile.dir }));
+                return cloneJson(await m.desktopToggle(target, args.enabled, { getService: getService, ensureService: ensureService, profileDir: profile.dir, channel: 'host-tool' }));
             }
-            return cloneJson(await toggle(target, args.enabled, { getService: getService }));
+            return cloneJson(await toggle(target, args.enabled, { getService: getService, channel: 'host-tool' }));
         },
     }));
     ctx.tools.register(defineTool({
@@ -333,9 +333,9 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             assertWriteAllowed(profile, 'uninstall');
             // 0.9.8：desktop → 官方管理器 removeBundle（dsh-market 同策略；此前该工具在 desktop 走 web 事务必然错位）
             if (profile.kind !== 'web') {
-                return cloneJson(await m.desktopUninstall(target, { getService: getService, ensureService: ensureService, profileDir: profile.dir }));
+                return cloneJson(await m.desktopUninstall(target, { getService: getService, ensureService: ensureService, profileDir: profile.dir, channel: 'host-tool' }));
             }
-            return cloneJson(await m.uninstallPlugin(target, cfg, { namespace: 'host' }));
+            return cloneJson(await m.uninstallPlugin(target, cfg, { namespace: 'host', channel: 'host-tool' }));
         },
     }));
     ctx.tools.register(defineTool({
@@ -420,10 +420,10 @@ export function registerTools(ctx, cfg, deps = {}, profile = resolveActiveProfil
             assertWriteAllowed(profile, 'upgrade');
             // 0.9.8：desktop → 官方管理器覆盖安装（dsh-market 同策略；此前该工具在 desktop 走 web 事务必然错位）
             if (profile.kind !== 'web') {
-                return cloneJson(await m.desktopUpgrade(target, cfg, { forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir }, { getService: getService, ensureService: ensureService }));
+                return cloneJson(await m.desktopUpgrade(target, cfg, { forceIncompatible: force, namespace: 'host', profile: profile.name, profileDir: profile.dir, channel: 'host-tool' }, { getService: getService, ensureService: ensureService }));
             }
             try {
-                return cloneJson(await m.upgradePlugin(target, cfg, { forceIncompatible: force, namespace: 'host' }));
+                return cloneJson(await m.upgradePlugin(target, cfg, { forceIncompatible: force, namespace: 'host', channel: 'host-tool' }));
             }
             catch (err) {
                 if (err instanceof InstallGuardError) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.78",
+  "version": "0.9.80",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",