dsh-m 0.9.86 → 0.9.87

package/CHANGELOG.md

@@ -8,6 +8,12 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## 中文
 
+### 0.9.87 性能：热路径四连——已装枚举并行化 + patchRows 按需采集 + 收藏 stale 批量化 + 设置页社区 summary 接入 L2
+
+- **问题（2026-10-15 架构走查 + 独立复核）**：市场查询热路径上仍有三处重复支付——① `listInstalledPlugins` 逐依赖**串行**双文件读（package.json + cordis.patch.yml），每次查询/翻页/每次防抖搜索提交都全量重跑（14 依赖实测 ~11ms，占暖缓存查询近半预算）；② 收藏分区 stale 检测对**每个收藏发一整条 market 查询**（≤8 并发扇出）：回答一个布尔值却付全管线（枚举+社区+4445 条评分+排序+分页），20 收藏 ≈ 3 批 × 全管线；且旧路径存在 curatedFirst 挤出边界误判——primary 域同词命中 ≥8 条时 id-exact 社区条目被前置挤出前 8，**误判 stale**；③ 设置页 registry 方法背后的 `getCommunitySummary` 走无 memo 的全量 adapt+merge（~4400 条，每次打开 ~10-50ms CPU），而同身份的 L2 物化代（ADR-0016）近在咫尺。
+- **方案（热路径四连）**：① 枚举并行化——每依赖分类独立无跨依赖状态，`Promise.all` 保序折叠（输出仍按依赖键字典序），新增可选 `{ patchRows: false }`：市场热路径不再付每插件 ~0.55ms 的 YAML CST 解析（patchRows 仅 enablement/toggle 消费，已装页路径保持缺省采集；退出时**省略字段**而非伪造 `readable:false`）；② 批量 id 存在性——core 新增 `existingMarketIds`（三不原则：不枚举已装/不探测 latest/不分页；merged 域原始 id Set 判定，与旧搜索扇出除 curatedFirst 边界外逐点一致，该边界上属**修复**）、host 新 method `market-ids-exist`（ids ≤500 校验 400）、客户端单发批量 + 失败保守全 stale；③ `getCommunitySummary` 改道 `mergedOutcome`（同身份免 adapt+merge，「summary 永不入代」保持；registry 传 `snap.loaded` 整体，namespace/profile 显式缺省与改道前缓存路径逐字节同路——保 parity 优先于共享代的自觉取舍）；④ `toMarketItem` 逐页线性扫描改每查询一次已装索引（byPkg/byName/byGithub 三域 first-wins + min-ord，与 `matchInstalledByEntry` 逐点等价，随机 fuzz 640 条零不一致），`GITHUB_SPEC_RE` 导出为单一事实源。
+- **验证**：1472 项测试全绿（净增 7 例：枚举排序钉住/patchRows 退出对照/FP5 匹配等价四路径/existingMarketIds 四例含 L2 命中钉与 curatedFirst 边界钉/host method 正常+400/C3 源串锚迁移）、typecheck 零错误；实测（保守口径）：枚举市场路径 10.55ms → 2.08ms（5.1×）、`listMarket` cache-only 端到端中位 ~28ms → 5-7ms、`existingMarketIds`(20 id) 2.52ms/次；两份实施计划均经独立评审 Agent 多轮对齐（FP1/FP5 两轮零保留通过；FP2/FP3+发版两轮 7+1 条意见全闭环）。
+
 ### 0.9.86 性能：packument 访问器——registry 元数据属主模块，登记网络腿出锁（钢人 C2 / ADR-0019）
 
 - **问题（钢人报告 C2 节）**：「registry 元数据」没有 owning module——登记（Register）只为读一个发布时戳，却在官方文件锁内发起 8MiB 级全量 packument 网络取（npmjs 首腿 5s 超时 + 生效源备腿至 12s），镜像机器装机的白等直接计入关键路径；B3 预热再经无缓存通道把同一全量取付第二次；三 adapter 各自取、各自缓存（或没有）。
@@ -609,6 +615,12 @@ The full release history of dsh-m, maintained bilingually: **Chinese first, Engl
 
 ## English
 
+### Performance in 0.9.87 — hot-path quartet: parallel installed enumeration, on-demand patchRows, batched favorites stale check, settings community summary via L2
+
+- **Problem (2026-10-15 architecture walk + independent audit)**: three recurring costs remained on the market-query hot path - (1) `listInstalledPlugins` read each dependency's two files (package.json + cordis.patch.yml) **strictly serially**, re-running in full on every query / page turn / debounced search commit (~11ms for 14 deps, nearly half the warm-cache query budget); (2) the favorites stale check fired **one full market query per favorite** (fan-out of 8): a single boolean answer paid the entire pipeline (enumeration + community + scoring 4,445 entries + sort + paging), 20 favorites ≈ 3 batches × full pipeline; the old path also had a curatedFirst squeeze-out false-stale edge - with ≥8 primary same-token hits the id-exact community entry got pushed past the page-8 window; (3) the settings-page registry method's `getCommunitySummary` ran an unmemoized full adapt+merge (~4,400 entries, ~10-50ms CPU per open) while the same-identity L2 materialized generation (ADR-0016) sat one function away.
+- **Fix (hot-path quartet)**: (1) parallel enumeration - per-dependency classification is independent, `Promise.all` folds in key order (output stays sorted by dependency key); new opt-out `{ patchRows: false }` spares the market path the ~0.55ms/plugin YAML CST parse (patchRows is only consumed by enablement/toggle, which keep the default; opting out **omits the field** instead of faking `readable:false`); (2) batch id-existence - new core `existingMarketIds` (three no's: no installed enumeration / no latest probing / no paging; raw-id Set membership over the merged domain, pointwise identical to the old search fan-out except the curatedFirst edge, where it is a **fix**), new host method `market-ids-exist` (ids ≤500, 400 on malformed), client sends one batch call and falls back to all-stale on error; (3) `getCommunitySummary` now routes through `mergedOutcome` (same identity skips adapt+merge; "summary never enters the generation" preserved; receives the whole `snap.loaded`, explicit namespace/profile defaults byte-identical to the pre-change cache paths - a deliberate parity-over-generation-sharing trade-off); (4) `toMarketItem`'s per-page linear scan became a once-per-query installed index (byPkg/byName/byGithub first-wins + min-ord, pointwise equal to `matchInstalledByEntry`, zero mismatches over a 640-entry random fuzz), with `GITHUB_SPEC_RE` exported as the single source of truth.
+- **Verification**: 1,472 tests green (+7: enumeration ordering pin / patchRows opt-out contrast / FP5 four-path match equivalence / four existingMarketIds cases incl. L2-hit and curatedFirst-edge pins / host method ok+400 / migrated C3 source anchor), typecheck clean; measured (conservative baseline): market-path enumeration 10.55ms → 2.08ms (5.1×), `listMarket` cache-only end-to-end median ~28ms → 5-7ms, `existingMarketIds` (20 ids) 2.52ms/call; both implementation plans aligned over multiple independent review rounds (FP1/FP5 two rounds, zero reservations; FP2/FP3+release two rounds, 7+1 findings all closed).
+
 ### Performance in 0.9.86 — packument accessor: registry metadata gets an owning module, register's network leg leaves the lock (steelman C2 / ADR-0019)
 
 - **Problem (steelman report, card C2)**: "registry metadata" had no owning module - Register fetched an 8MiB-scale full packument INSIDE the official file lock just to read one publish timestamp (npmjs first leg 5s timeout + effective-source leg up to 12s), putting mirror machines' white-wait directly on the install critical path; the B3 prewarm paid the same full fetch a second time through an uncached channel; three adapters each fetched, interpreted and cached (or not) independently.

package/lib/client.js

@@ -4901,15 +4901,14 @@ function FavoriteZone({ favorites, onOpen }) {
     if (!list.length) return;
     const timer = setTimeout(() => {
       void (async () => {
-        const lookupLive = async (fav) => {
-          try {
-            const res = await api("market", { query: fav.id, source: "all", limit: 8, probeMode: "cache-only" });
-            const items = res && Array.isArray(res.items) ? res.items : [];
-            return items.some((x) => x && x.id === fav.id);
-          } catch {
-            return false;
-          }
-        };
+        let present = /* @__PURE__ */ new Set();
+        try {
+          const res = await api("market-ids-exist", { ids: list.map((f) => f.id) });
+          if (res && Array.isArray(res.present)) present = new Set(res.present);
+        } catch {
+          present = /* @__PURE__ */ new Set();
+        }
+        const lookupLive = async (fav) => present.has(fav.id);
         const { stale } = await partitionStale2(list, lookupLive);
         if (live) setCheck({ staleIds: stale.map((f) => f.id) });
       })();

package/lib/core/community.js

@@ -8,10 +8,10 @@
  */
 import { mkdir, readFile, rm, rename, writeFile } from 'node:fs/promises';
 import { isAbsolute, join, relative } from 'node:path';
-import { cacheRoot } from './env.js';
+import { cacheRoot, WEB_PROFILE } from './env.js';
 import { decodeUtf8Fatal, fetchBytesLimited, describeFetchFailure } from './httpx.js';
 import { isExactVersion, npmLatest } from './versions.js';
-import { communityOutcome } from './merged-market.js';
+import { mergedOutcome } from './merged-market.js';
 export const COMMUNITY_NPM_PACKAGE = 'dsh-plugin-catalog';
 export const MAX_COMMUNITY_BYTES = 32 * 1024 * 1024;
 export const MAX_COMMUNITY_ENTRIES = 30_000;
@@ -448,16 +448,29 @@ export async function fetchCommunityCatalog(cfg = {}, opts = {}) {
     }
 }
 /**
- * 单一深接口（计划 Task 6）：fetch → adapt → merge 计数 → CommunityRegistrySummary。
- * - primaryEntries 直接取本次 registry snapshot 的 primary plugins（displaced 与本次响应同代，
+ * 单一深接口（计划 Task 6）：fetch → mergedOutcome（L2 代存储）→ CommunityRegistrySummary。
+ * - 0.9.87 FP3：改道 mergedOutcome——同身份（registry 代 + 目录 version）命中即免全量
+ *   adapt+merge（每次设置页打开 ~10-50ms CPU），summary 仍由当次 state 现算（「summary
+ *   永不入代」不变量保持）；失败/deadline/unavailable/disabled 形态透传不落代；
+ * - registry 直接取本次 registry snapshot 的 LoadedRegistry（displaced 与本次响应同代，
  *   不重复加载主清单；内部禁止调用 loadRegistry——单一来源约束）；
+ * - namespace/profile 显式透传：缺省 'host'/WEB_PROFILE，与改道前 fetchCommunityCatalog/
+ *   awesomeDir 的隐式默认逐字节同路（缓存目录恒 web 段——**自觉取舍**：保 parity 优先于
+ *   与 market 臂共享 L2 代，desktop host 下各建各代是接受的成本，勿当「漏传」修复）；
  * - 3s 是本 waiter 的等待上限（waiter-scoped race）：到点未 materialize → unavailable +
  *   「社区目录状态获取超时」errors，调用方主响应照常；共享 flight 按 30s hard cap 继续；
  * - 数据源 cache-first：fetchCommunityCatalog 的版本缓存 + TTL 保证 registry 刷新无重复网络压力。
  */
-export async function getCommunitySummary(primaryEntries, cfg = {}, opts) {
-    const task = fetchCommunityCatalog(cfg, { signal: opts.signal, force: opts.force });
-    const outcome = await communityOutcome(task, opts.deadlineAt, primaryEntries);
+export async function getCommunitySummary(registry, cfg = {}, opts) {
+    const task = fetchCommunityCatalog(cfg, { namespace: opts.namespace, signal: opts.signal, force: opts.force, profile: opts.profile });
+    const outcome = await mergedOutcome({
+        namespace: opts.namespace ?? 'host',
+        profile: opts.profile ?? WEB_PROFILE,
+        cfg,
+        registry,
+        communityTask: task,
+        deadlineAt: opts.deadlineAt,
+    });
     return outcome.summary;
 }
 // 0.9.14 SWR：过期触发即登记的后台自愈 flight（waiter 隔离；flight 本体走 fetchCommunityCatalog

package/lib/core/host-api.js

@@ -10,7 +10,7 @@
 import { BOOT_ID, publicInstallStatus } from './dsh-cli.js';
 import { resolveDshVersion, readLauncherPackageVersion } from './dsh-version.js';
 import { runDoctor } from './doctor.js';
-import { listInstalledWithMeta, listMarket, installFromRegistry, selfUpgrade, uninstallPlugin, upgradePlugin, InstallGuardError, } from './market.js';
+import { listInstalledWithMeta, listMarket, existingMarketIds, installFromRegistry, selfUpgrade, uninstallPlugin, upgradePlugin, InstallGuardError, } from './market.js';
 import { runProfileTransaction, TransactionError } from './profile-transaction.js';
 import { listExternalOperations, clearExternalOperations, removeExternalOperation } from './external-journal.js';
 import { readInstalledPluginReadme } from './installed.js';
@@ -212,6 +212,7 @@ export function createApiDispatcher(ctx) {
     const d = {
         listMarket: ctx.deps?.listMarket ?? listMarket,
         listInstalledWithMeta: ctx.deps?.listInstalledWithMeta ?? listInstalledWithMeta,
+        existingMarketIds: ctx.deps?.existingMarketIds ?? existingMarketIds,
         installFromRegistry: ctx.deps?.installFromRegistry ?? installFromRegistry,
         uninstallPlugin: ctx.deps?.uninstallPlugin ?? uninstallPlugin,
         upgradePlugin: ctx.deps?.upgradePlugin ?? upgradePlugin,
@@ -323,10 +324,14 @@ export function createApiDispatcher(ctx) {
                     // 0.9.11：不再透传 force——「强制刷新」语义是精选清单（registry 链），社区目录走自己的
                     // TTL/共享 flight；此前 force 连坐会在弱网下把社区卡打成 3s 超时的「不可用」占位
                     // （Windows 实机 2026-10-01：点强制刷新 → 社区卡「获取超时」，flight 后台自愈前一直报错）。
-                    const community = await d.getCommunitySummary(snap.loaded.registry.plugins, cfg(), {
+                    // 0.9.87 FP3：getCommunitySummary 改道 mergedOutcome（L2）——registry 传 snap.loaded
+                    // 整体（身份键需要 configuredAddress/fetchedAt）；namespace 'host' + profile 缺省
+                    // （WEB_PROFILE）与改道前缓存路径逐字节同路。
+                    const community = await d.getCommunitySummary(snap.loaded, cfg(), {
                         force: false,
                         signal,
                         deadlineAt: Date.now() + 3_000,
+                        namespace: 'host',
                     });
                     payload = { plugins: snap.loaded.registry.plugins, registryState: snap.loaded, community };
                     break;
@@ -421,6 +426,22 @@ export function createApiDispatcher(ctx) {
                     payload = { ...result };
                     break;
                 }
+                case 'market-ids-exist': {
+                    // 0.9.87 FP2：收藏 stale 检测批量化——一次批量 id 存在性查询取代逐收藏完整 market 扇出。
+                    // 校验：非空字符串数组 ≤500（trim 后透传）；违例 400（与 source/sort/probeMode 同款不静默吞）。
+                    const rawIds = body.ids;
+                    if (!Array.isArray(rawIds) || rawIds.length > 500 || rawIds.some((v) => typeof v !== 'string' || v.trim() === '')) {
+                        throw new ApiProtocolError(400, '非法 ids: 需非空字符串数组（≤500）');
+                    }
+                    const ids = rawIds.map((v) => v.trim());
+                    const result = await d.existingMarketIds(ids, cfg(), {
+                        namespace: 'host',
+                        profile: profile.name,
+                        signal,
+                    });
+                    payload = { present: result.present };
+                    break;
+                }
                 case 'installed': {
                     await ctx.controller.ensureReady();
                     // 0.9.5 双 profile 读路径接线（实机回归 2026-10-01）：desktop 下已装列表此前

package/lib/core/installed.js

@@ -146,41 +146,42 @@ function sanitizePkgJson(raw, fallbackName) {
         githubRepo: githubRepoFromRepository(raw.repository),
     };
 }
-/** 枚举 web profile 已安装插件（只读）。complete:false 时 items/others 为 partial 结果（已确认部分保留）。 */
-export async function listInstalledPlugins(profileDir = webProfileDir()) {
-    const root = resolve(profileDir);
-    const result = await readProfileDepsResult(root);
-    let complete = result.complete;
-    const deps = result.deps;
-    const items = [];
-    let others = 0;
-    for (const pkg of Object.keys(deps).sort()) {
-        const spec = deps[pkg];
-        const dir = resolvePluginDir(root, pkg, spec);
-        if (!dir) {
-            // 依赖键不安全、目录无法解析 → 无法判断（不冒充非 DSH）
-            complete = false;
-            continue;
-        }
-        const rawResult = await readPkgJsonResult(dir);
-        if (!rawResult.ok) {
-            // package.json 缺失/不可读/坏 JSON/根非对象 → 无法判断
-            complete = false;
-            continue;
-        }
-        const raw = rawResult.value;
-        if (!('dsh' in raw)) {
-            // 确认非 DSH 依赖
-            others += 1;
-            continue;
-        }
-        const info = sanitizePkgJson(raw, pkg);
-        // 包内补丁层行枚举（开关粒度判定原料）：缺失 → readable:false（按多行 → Bundle 级处理）
-        const patchText = await readTextLimited(join(dir, 'cordis.patch.yml'), PATCH_MAX_BYTES);
-        const patchRows = patchText
-            ? readBundlePatchRows(patchText.text)
-            : { inserts: [], configRows: 0, readable: false };
-        items.push({
+async function classifyDep(root, pkg, spec, wantPatch) {
+    const dir = resolvePluginDir(root, pkg, spec);
+    if (!dir)
+        return 'unknown';
+    const rawResult = await readPkgJsonResult(dir);
+    if (!rawResult.ok)
+        return 'unknown';
+    const raw = rawResult.value;
+    if (!('dsh' in raw))
+        return 'other';
+    const info = sanitizePkgJson(raw, pkg);
+    // 包内补丁层行枚举（开关粒度判定原料）：缺失 → readable:false（按多行 → Bundle 级处理）。
+    // wantPatch=false（市场查询热路径）省略 patchRows 字段——不伪造 readable:false（那是
+    // 「多行插件」的语义谎报）；消费方（enablement/toggle，listInstalledWithMeta 路径）全程 ?. 链。
+    if (!wantPatch) {
+        return {
+            item: {
+                pkg,
+                name: info.name,
+                version: info.version,
+                description: info.description,
+                homepage: info.homepage,
+                spec,
+                source: parseSpecSource(spec),
+                dsh: true,
+                path: dir,
+                githubRepo: info.githubRepo,
+            },
+        };
+    }
+    const patchText = await readTextLimited(join(dir, 'cordis.patch.yml'), PATCH_MAX_BYTES);
+    const patchRows = patchText
+        ? readBundlePatchRows(patchText.text)
+        : { inserts: [], configRows: 0, readable: false };
+    return {
+        item: {
             pkg,
             name: info.name,
             version: info.version,
@@ -190,9 +191,39 @@ export async function listInstalledPlugins(profileDir = webProfileDir()) {
             source: parseSpecSource(spec),
             dsh: true,
             path: dir,
-            githubRepo: githubRepoFromRepository(raw.repository),
+            githubRepo: info.githubRepo,
             patchRows,
-        });
+        },
+    };
+}
+/**
+ * 枚举 web profile 已安装插件（只读）。complete:false 时 items/others 为 partial 结果（已确认部分保留）。
+ * opts.patchRows=false：跳过每插件的 cordis.patch.yml 读取与 YAML 解析（热路径省 ~0.55ms/插件），
+ * 产出的 item 不带 patchRows 字段——仅供不需要开关粒度原料的调用方（市场查询）使用。
+ */
+export async function listInstalledPlugins(profileDir = webProfileDir(), opts) {
+    const root = resolve(profileDir);
+    const result = await readProfileDepsResult(root);
+    let complete = result.complete;
+    const deps = result.deps;
+    const wantPatch = opts?.patchRows !== false;
+    // 每依赖文件读并发执行（原串行 for-await 是热路径上每次市场查询都重复支付的一半预算，
+    // 14 依赖实测 IO 串行 ~11ms → 并行 ~2.5ms）；Promise.all 保序，输出仍按依赖键字典序。
+    const keys = Object.keys(deps).sort();
+    const classified = await Promise.all(keys.map((pkg) => classifyDep(root, pkg, deps[pkg], wantPatch)));
+    const items = [];
+    let others = 0;
+    for (const c of classified) {
+        if (c === 'unknown') {
+            // 依赖键不安全、目录无法解析、package.json 缺失/不可读/坏 JSON → 无法判断（不冒充非 DSH）
+            complete = false;
+        }
+        else if (c === 'other') {
+            others += 1;
+        }
+        else {
+            items.push(c.item);
+        }
     }
     return { items, others, complete, profileDir: root };
 }

package/lib/core/market.js

@@ -22,7 +22,7 @@ import { fetchCommunityCatalog as defaultFetchCommunityCatalog, } from './commun
 // 0.9.68（ADR-0016）：合并层迁入 merged-market.ts（communityOutcome/mergeRegistries/communitySummary/
 // deadlineRace/matchInstalledByEntry/isCommunityEntry/COMMUNITY_CATEGORY_LABELS）——market↔community
 // import 环自此断开；re-export 保既有消费方（tools.ts 的类型、profile-ops 的 matchInstalledByEntry）零改动。
-import { communityOutcome, communityTimeoutSummary, withFallbackLookups, deadlineRace, isCommunityEntry, matchInstalledByEntry, mergedOutcome, } from './merged-market.js';
+import { communityOutcome, communityTimeoutSummary, withFallbackLookups, deadlineRace, isCommunityEntry, matchInstalledByEntry, mergedOutcome, GITHUB_SPEC_RE, } from './merged-market.js';
 export { communityOutcome, matchInstalledByEntry } from './merged-market.js';
 import { normalizeSearchText, relevanceScore, tokenizeSearchText } from './search-relevance.js';
 import { GithubBudgetExhaustedError, createGithubRequestBudget, isExactVersion } from './versions.js';
@@ -229,9 +229,52 @@ function sortEntries(entries, sort) {
         return (aa < ab ? -1 : aa > ab ? 1 : 0) * dirMul || nameCmp(a, b);
     });
 }
+function buildInstalledIndex(installedItems) {
+    const byPkg = new Map();
+    const byName = new Map();
+    const byGithub = new Map();
+    installedItems.forEach((inst, ord) => {
+        const slot = { inst, ord };
+        if (!byPkg.has(inst.pkg))
+            byPkg.set(inst.pkg, slot);
+        if (!byName.has(inst.name))
+            byName.set(inst.name, slot);
+        if (inst.source === 'github') {
+            const m = GITHUB_SPEC_RE.exec(inst.spec);
+            if (m && !byGithub.has(m[1]))
+                byGithub.set(m[1], slot);
+        }
+    });
+    return { byPkg, byName, byGithub };
+}
+/** 三候选（byPkg[npm] / byName[npm] / byGithub[github]，truthiness 守卫与旧谓词一致）取 ord 最小者胜。 */
+function lookupInstalledByIndex(index, entry) {
+    const candidates = [];
+    if (entry.npm) {
+        const byPkg = index.byPkg.get(entry.npm);
+        if (byPkg)
+            candidates.push(byPkg);
+        const byName = index.byName.get(entry.npm);
+        if (byName)
+            candidates.push(byName);
+    }
+    if (entry.github) {
+        const byRepo = index.byGithub.get(entry.github);
+        if (byRepo)
+            candidates.push(byRepo);
+    }
+    if (candidates.length === 0)
+        return undefined;
+    let best = candidates[0];
+    for (let i = 1; i < candidates.length; i++) {
+        if (candidates[i].ord < best.ord)
+            best = candidates[i];
+    }
+    return best.inst;
+}
 /** 合并条目 → MarketItem：社区条目带 community 标记与旁路字段。 */
-function toMarketItem(entry, installedItems) {
-    const inst = matchInstalledByEntry(entry, installedItems);
+function toMarketItem(entry, installedIndex) {
+    const inst = lookupInstalledByIndex(installedIndex, entry);
     const item = { ...entry, installed: Boolean(inst), outdated: false };
     if (inst) {
         item.installedPkg = inst.pkg;
@@ -289,7 +332,7 @@ export async function listMarket(cfg = {}, opts = {}, deps = {}) {
     const signal = opts.signal;
     const remaining = () => deadlineAt - Date.now();
     const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs, profile: opts.profile });
-    const installedTask = d.listInstalledPlugins(opts.profileDir).catch(() => null);
+    const installedTask = d.listInstalledPlugins(opts.profileDir, { patchRows: false }).catch(() => null);
     // 社区 flight 并发启动（source=primary 零调用；0.7.0 Task 7：primaryOnly 字段已删除）；共享 loader 不接收调用者 deadline——
     // listMarket 作为 waiter 在 communityOutcome 内 race 自己的剩余 deadline/signal（v10 契约）
     const communityTask = source === 'primary' ? null : d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force, profile: opts.profile });
@@ -393,7 +436,9 @@ export async function listMarket(cfg = {}, opts = {}, deps = {}) {
     let offset = normalizeOffset(opts.offset);
     if (total > 0 && offset >= total)
         offset = Math.floor((total - 1) / limit) * limit;
-    const items = ordered.slice(offset, offset + limit).map((entry) => toMarketItem(entry, installedItems));
+    // 0.9.68（ADR-0016 决策 5 同款思路，FP5 2026-10-15）：已装索引每查询建一次，页内条目 O(1) 查表
+    const installedIndex = buildInstalledIndex(installedItems);
+    const items = ordered.slice(offset, offset + limit).map((entry) => toMarketItem(entry, installedIndex));
     let latestComplete = true;
     let latestTimedOut = false;
     if (withLatest && items.length > 0) {
@@ -494,6 +539,64 @@ export async function listMarket(cfg = {}, opts = {}, deps = {}) {
         community: community.summary,
     };
 }
+/**
+ * 批量 id 存在性（收藏 stale 检测专用，FP2）：一次装载 registry+社区、经物化合并市场（L2，
+ * 同身份与 listMarket 共享代）对 **merged 域**（主清单 + 存活社区条目，不含 displaced——与
+ * 今日 source:'all' 搜索域一致）建原始 id Set，按输入序过滤返回。
+ *
+ * 三不原则（与 listMarket 的接口差异，也是性能来源）：不枚举已装、不探测 latest、不分页。
+ *
+ * 语义对照（旧路径 = 逐收藏 `market {query:id, source:'all', limit:8, probeMode:'cache-only'}`
+ * + items.some(id)）：除一处自觉差异外逐点一致——**curatedFirst 挤出边界**：旧搜索页路径在
+ * primary 域同字段全词命中 ≥limit 条时会把 id-exact 的社区条目挤出前 8（误判 stale），本接口
+ * 的 Set 判定在该边界判 live（=「已从目录消失」的正确语义），属修复而非回归，勿改回搜索页行为。
+ *
+ * 失败语义：registry 装载 reject → 原样抛出（host-api 统一 500 → 客户端 catch 空 Set 全 stale，
+ * 与今日 market 同路径等价）；deadline 逃逸 → `{ present: [] }`（同今日超时空页 → 全 stale）；
+ * 社区 unavailable/disabled → merged=primary-only → 社区收藏判 stale（同今日）。
+ */
+export async function existingMarketIds(ids, cfg = {}, opts = {}, deps) {
+    const list = Array.isArray(ids) ? ids : [];
+    if (list.length === 0)
+        return { present: [] };
+    const d = {
+        loadRegistry: deps?.loadRegistry ?? defaultLoadRegistry,
+        fetchCommunityCatalog: deps?.fetchCommunityCatalog ?? defaultFetchCommunityCatalog,
+    };
+    const deadlineMs = typeof opts.deadlineMs === 'number' && Number.isFinite(opts.deadlineMs) && opts.deadlineMs > 0
+        ? opts.deadlineMs
+        : DEFAULT_DEADLINE_MS;
+    const deadlineAt = Date.now() + deadlineMs;
+    const namespace = opts.namespace ?? 'host';
+    const signal = opts.signal;
+    const registryTask = d.loadRegistry(cfg, { namespace, signal, force: opts.force, deadlineMs, profile: opts.profile });
+    const communityTask = d.fetchCommunityCatalog(cfg, { namespace, signal, force: opts.force, profile: opts.profile });
+    let loaded;
+    try {
+        loaded = await deadlineRace(registryTask, deadlineAt - Date.now());
+    }
+    catch (err) {
+        void communityTask.catch(() => undefined);
+        throw err;
+    }
+    if (loaded === 'deadline') {
+        void communityTask.catch(() => undefined);
+        return { present: [] };
+    }
+    const community = await mergedOutcome({
+        namespace,
+        profile: opts.profile ?? WEB_PROFILE,
+        cfg,
+        registry: loaded,
+        communityTask,
+        deadlineAt,
+    });
+    const knownIds = new Set(community.merged.map((entry) => entry.id));
+    const present = list
+        .map((id) => (typeof id === 'string' ? id.trim() : ''))
+        .filter((id) => id !== '' && knownIds.has(id));
+    return { present };
+}
 // ---------- 已装列表 ----------
 export async function listInstalledWithMeta(cfg = {}, opts = {}, deps = {}) {
     const d = { ...marketDeps(), ...deps };

package/lib/core/merged-market.js

@@ -54,7 +54,7 @@ export function matchInstalledByEntry(entry, installed) {
         if (entry.npm && it.name === entry.npm)
             return true;
         if (entry.github && it.source === 'github') {
-            const m = /^github:([^#]+)/.exec(it.spec);
+            const m = GITHUB_SPEC_RE.exec(it.spec);
             if (m && m[1] === entry.github)
                 return true;
         }
@@ -158,7 +158,8 @@ function buildMatchIndex(domain) {
     });
     return { byNpm, byGithub, byId };
 }
-const GITHUB_SPEC_RE = /^github:([^#]+)/;
+/** github spec 的 owner/repo 提取（matchInstalledByEntry 与 market.ts 已装索引共用单一事实源；2026-10-15 导出）。 */
+export const GITHUB_SPEC_RE = /^github:([^#]+)/;
 /** 三候选（npm[pkg] / npm[name] / github[spec]（仅 source==='github'））取域序最前者胜——与 matchInstalledByEntry 逐点等价。 */
 function lookupInIndex(index, installed) {
     const candidates = [];

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-m",
-  "version": "0.9.86",
+  "version": "0.9.87",
   "description": "可自定义收录清单的 DSH 插件市场：收录、安装、卸载、升级一站完成，附 agent 工具与 dshm CLI。",
   "license": "MIT",
   "type": "module",