dsh-unlag 1.7.11 → 1.8.1

package/README.md

@@ -32,15 +32,15 @@ dsh plugin install dsh-unlag
 
 ## 不会丢什么
 
-- 轮次、子代理、终端进程：在宿主侧，一路继续。
+- 轮次、子代理、终端进程：照常继续。
 - 排队消息、输入草稿、附件：重建前先提交焦点里的内容；有人没存完就拦下，不硬刷。
-- 有未保存改动、开着弹窗、或下个页面要用的模块读不全：拦下并提示，宁可不刷。
+- 有未保存改动、开着弹窗、或下个页面要用的模块读不全：拦下并提示，提示里写明卡在哪一项，宁可不刷。
+- 旧页面记着的启动清单分组变了（装过／卸过插件）：按插件逐个补齐再交给新页面，不会因为清单 404 把 App 带走。
 - 从不自己重启或退出 App。
 
 管不到（它会拦下并说明，不会硬来）：
 
-- 改动落在宿主侧的插件：新增原生能力、改服务声明、改权限。
-- 更新时正被某个任务使用的插件：那个任务可能随之结束。
+- 改动替插件加原生能力、改服务声明或权限：这类改动不在一次点击的范围里。
 - 独立进程和进程级的东西：宠物窗口自己的配置、DSH 自身升级、原生依赖变化。
 
 ## 排错
@@ -51,8 +51,5 @@ dsh plugin install dsh-unlag
 ## 测试
 
 ```sh
-node test/button.test.mjs
-node test/bundle-shim.test.mjs
-node test/client-guard.test.mjs
-node test/safety.test.mjs
+node --test test/*.test.mjs
 ```

package/client.js

@@ -6,8 +6,33 @@ window.__ModuleLoader__.load({
 
     const zh = /^zh/i.test(navigator.language || '');
     const COPY = zh
-      ? { label: '解除卡顿', hint: '卡顿时用：换掉插件代码并重建界面；运行中的任务、排队的消息保留', blocked: '暂时无法重建界面，稍后再试', unsaved: '有未保存的改动，先保存再重试', dialog: '先关闭打开的窗口再重载', queued: '已排队：任务跑完自动重载', failed: '插件更新没完成，稍后再按一次' } // ui-copy-ignore
-      : { label: 'Unlag', hint: 'For a sluggish interface: replaces plugin code and rebuilds the page; running turns and queued messages are kept', blocked: 'Cannot rebuild the page right now; try again', unsaved: 'Unsaved changes; save them, then retry', dialog: 'Close the open window first', queued: 'Queued; it reloads once the turn ends', failed: 'The plugin update did not finish; press again later' };
+      ? { label: '解除卡顿', hint: '卡顿时用：换掉插件代码并重建界面；运行中的任务、排队的消息保留', blocked: '暂时无法重建界面，稍后再试', unsaved: '有未保存的改动，先保存再重试', dialog: '先关闭打开的窗口再重载', queued: '更新已排队，稍后再按一次', applying: '还在应用这次更新，稍后再按一次', restart: '这次改动要重新打开应用才会生效', failed: '插件更新没完成，稍后再按一次' } // ui-copy-ignore
+      : { label: 'Unlag', hint: 'For a sluggish interface: replaces plugin code and rebuilds the page; running turns and queued messages are kept', blocked: 'Cannot rebuild the page right now; try again', unsaved: 'Unsaved changes; save them, then retry', dialog: 'Close the open window first', queued: 'Update queued; press again shortly', applying: 'Still applying this update; press again shortly', restart: 'This change needs the app reopened before it can apply', failed: 'The plugin update did not finish; press again later' };
+
+    /**
+     * Why the interface was left as it is, in words a person can act on. The checks below record
+     * the first reason they refuse for, so a press that stops can say what it saw instead of
+     * repeating one generic sentence.
+     */
+    const REASONS = zh
+      ? { list: '读不到启动信息', row: '启动信息不完整', src: '启动脚本没有地址', graph: '已装插件清单读不到', plugin: '有插件已不在运行', script: '启动脚本读不到', empty: '启动脚本是空的', covers: '启动脚本缺插件', parse: '启动脚本内容不完整' }
+      : { list: 'startup info is unavailable', row: 'startup info is incomplete', src: 'a startup script has no address', graph: 'the plugin list cannot be read', plugin: 'a plugin is no longer running', script: 'a startup script cannot be read', empty: 'a startup script is empty', covers: 'a startup script misses a plugin', parse: 'a startup script is incomplete' };
+
+    /** The last reason a readiness check refused for, or null after a check that passed. */
+    let holdReason = null;
+
+    /** Record why a rebuild is held and answer false for the check that asked. */
+    function held(reason) {
+      holdReason = reason;
+      return false;
+    }
+
+    /** The notice for one copy key, naming the reason when a readiness check stopped the press. */
+    function noticeFor(key) {
+      if (key !== 'blocked' || holdReason === null) return COPY[key];
+      const why = REASONS[holdReason] ?? REASONS.list;
+      return zh ? `暂时无法重建：${why}。稍后再点一次。` : `Cannot rebuild yet: ${why}. Press again shortly.`;
+    }
 
     // Desktop shell only: the macOS and Windows desktop build owns the page and the running
     // app, so this is where the button belongs. A browser tab can reload freely on its own.
@@ -87,7 +112,10 @@ window.__ModuleLoader__.load({
     function reloadVerdict(data) {
       if (data === null || typeof data !== 'object') return 'failed';
       const status = typeof data.status === 'string' ? data.status : 'failed';
-      if (Array.isArray(data.pending) && data.pending.length > 0) return 'queued';
+      // A plugin that did not start makes the set unusable for a rebuild, whatever the status says.
+      if (Array.isArray(data.failedEntries) && data.failedEntries.length > 0) return 'failed';
+      // `pending` is not a queued update: the changed modules need a restart to load at all.
+      if (Array.isArray(data.pending) && data.pending.length > 0) return 'restart';
       if (typeof data.restartReason === 'string' && data.restartReason !== '') return 'failed';
       return status;
     }
@@ -101,10 +129,10 @@ window.__ModuleLoader__.load({
 
     /** Read every bundle the next boot would load and prove each listed plugin is inside. */
     async function bundlesCoverStartup(graph) {
-      if (graph === null || typeof graph !== 'object') return false;
+      if (graph === null || typeof graph !== 'object') return held('graph');
       const entries = Array.isArray(graph.entries) ? graph.entries : [];
       const batches = Array.isArray(graph.batches) ? graph.batches : [];
-      if (entries.length === 0 || batches.length === 0) return false;
+      if (entries.length === 0 || batches.length === 0) return held('graph');
       const covered = new Set();
       const sources = [];
       for (const batch of batches) {
@@ -112,29 +140,30 @@ window.__ModuleLoader__.load({
         if (url === '') continue;
         const listed = Array.isArray(batch.entries) && batch.entries.every((id) => typeof id === 'string') ? batch.entries : [];
         const ids = listed.length > 0 ? listed : bundledIds(url);
-        if (ids.length === 0) return false;
+        if (ids.length === 0) return held('row');
         for (const id of ids) covered.add(id);
         sources.push({ url: new URL(url, location.href), ids });
       }
-      if (sources.length === 0) return false;
+      if (sources.length === 0) return held('graph');
       for (const entry of entries) {
         const id = typeof entry === 'string' ? entry : entry?.id;
-        if (typeof id !== 'string' || !covered.has(id)) return false;
+        if (typeof id !== 'string' || !covered.has(id)) return held('covers');
       }
       for (const source of sources) {
         try {
           const response = await fetch(source.url.toString(), { cache: 'no-store', credentials: 'same-origin' });
-          if (!response.ok) return false;
+          if (!response.ok) return held('script');
           const body = await response.text();
-          if (body.length === 0) return false;
+          if (body.length === 0) return held('empty');
           for (const id of source.ids) {
-            if (!body.includes(id)) return false;
+            if (!body.includes(id)) return held(source.ids.length === 1 ? 'plugin' : 'covers');
           }
-          if (!parsesAsClassicScript(body)) return false;
+          if (!parsesAsClassicScript(body)) return held('parse');
         } catch {
-          return false;
+          return held('script');
         }
       }
+      holdReason = null;
       return true;
     }
 
@@ -149,8 +178,44 @@ window.__ModuleLoader__.load({
      * @param body - the served script.
      * @returns true when the body parses, or when this page cannot compile one at all.
      */
+    /** The source with comments and string contents blanked out, so a keyword scan sees code only. */
+    function codeOnly(source) {
+      let out = '';
+      let index = 0;
+      while (index < source.length) {
+        const here = source[index];
+        const next = source[index + 1];
+        if (here === '/' && next === '*') {
+          const end = source.indexOf('*/', index + 2);
+          index = end < 0 ? source.length : end + 2;
+          out += ' ';
+          continue;
+        }
+        if (here === '/' && next === '/') {
+          const end = source.indexOf('\n', index + 2);
+          index = end < 0 ? source.length : end;
+          continue;
+        }
+        if (here === '"' || here === "'" || here === '`') {
+          index += 1;
+          while (index < source.length && source[index] !== here) {
+            if (source[index] === '\\') index += 1;
+            index += 1;
+          }
+          index += 1;
+          out += '""';
+          continue;
+        }
+        out += here;
+        index += 1;
+      }
+      return out;
+    }
+
     function parsesAsClassicScript(body) {
       try {
+        // A top-level return parses in a function body but not as a classic script.
+        if (/(?:^|[;{}])\s*return\b/u.test(codeOnly(body))) return false;
         new Function(body); // eslint-disable-line no-new-func
         return true;
       } catch (error) {
@@ -197,9 +262,15 @@ window.__ModuleLoader__.load({
       let frozen = null;
       for (const row of rows) {
         if (row === null || typeof row !== 'object') continue;
-        if (typeof row.kind !== 'string' || !STARTUP_ROW_KINDS.has(row.kind)) return false;
-        if (row.kind === 'script-src' && (typeof row.src !== 'string' || row.src === '')) return false;
-        if (typeof row.src === 'string' && row.src !== '') scripts.push(row.src);
+        if (typeof row.kind !== 'string' || !STARTUP_ROW_KINDS.has(row.kind)) return held('row');
+        // Only the rows a document runs as scripts have to load as classic scripts. Style and
+        // markup rows carry their own text and their address is not a script at all, so reading
+        // them back would refuse a sound list over a false alarm.
+        const runs = row.kind === 'script-src' || row.kind === 'script-preload';
+        if (runs && (typeof row.src !== 'string' || row.src === '')) return held('src');
+        if (runs) scripts.push(row.src);
+        // Inline rows carry their own text and are not fetched; the queue script among them ends
+        // in a nested return that a flat scan would misread, so their text is left to the document.
         if (row.kind !== 'global' || row.name !== '__DSH_BOOT__') continue; // ui-copy-ignore
         let value = row.value;
         if (typeof value === 'string') {
@@ -211,14 +282,23 @@ window.__ModuleLoader__.load({
         }
         if (value !== null && typeof value === 'object') frozen = value;
       }
-      if (scripts.length === 0) return false;
-      const live = await hostBootGraph();
-      if (live !== null && frozen !== null) {
-        const liveIds = new Set((Array.isArray(live.entries) ? live.entries : []).map((entry) => (typeof entry === 'string' ? entry : entry?.id)));
+      if (scripts.length === 0) return held('list');
+      // The graph is read twice: one answer taken while the app re-composes says nothing about
+      // the next boot, and holding the page is the safe answer when it cannot be read at all.
+      let live = await hostBootGraph();
+      if (live === null && frozen !== null) {
+        await new Promise((resolve) => setTimeout(resolve, 300)); // ui-copy-ignore
+        live = await hostBootGraph();
+      }
+      if (frozen !== null) {
+        // The frozen list decides what this document boots. Without the current plugin list there
+        // is nothing to prove every plugin in it still exists, so the page is not rebuilt.
+        if (live === null) return held('graph');
         const kept = Array.isArray(frozen.entries) ? frozen.entries : [];
+        const liveIds = new Set((Array.isArray(live.entries) ? live.entries : []).map((entry) => (typeof entry === 'string' ? entry : entry?.id)));
         for (const entry of kept) {
           const id = typeof entry === 'string' ? entry : entry?.id;
-          if (typeof id === 'string' && id !== '' && !liveIds.has(id)) return false;
+          if (typeof id === 'string' && id !== '' && !liveIds.has(id)) return held('plugin');
         }
       }
       for (const src of scripts) {
@@ -226,21 +306,23 @@ window.__ModuleLoader__.load({
         try {
           target = new URL(src, location.href).toString();
         } catch {
-          return false;
+          return held('src');
         }
         try {
           const response = await fetch(target, { cache: 'no-store', credentials: 'same-origin' });
-          if (!response.ok) return false;
+          if (!response.ok) return held('script');
           const body = await response.text();
-          if (body.length === 0) return false;
-          for (const id of bundledIds(target)) {
-            if (!body.includes(id)) return false;
+          if (body.length === 0) return held('empty');
+          const ids = bundledIds(target);
+          for (const id of ids) {
+            if (!body.includes(id)) return held(ids.length === 1 ? 'plugin' : 'covers');
           }
-          if (!parsesAsClassicScript(body)) return false;
+          if (!parsesAsClassicScript(body)) return held('parse');
         } catch {
-          return false;
+          return held('script');
         }
       }
+      holdReason = null;
       return true;
     }
 
@@ -320,18 +402,25 @@ window.__ModuleLoader__.load({
      * @returns true when every listed plugin's module is present in the served bundles.
      */
     async function startupLooksServable() {
-      for (let attempt = 0; attempt < 2; attempt += 1) {
+      holdReason = null;
+      // Two repeats: the app re-composes its bundles while it starts and after a plugin swap, and
+      // a list read in the middle of that can answer for a generation that is already gone.
+      for (let attempt = 0; attempt < 3; attempt += 1) {
         const saved = await desktopStartupPayload();
         // The desktop shell replays one startup list for every document. If it is running but its
         // copy cannot be read, nothing here proves a new document would boot, so the page stays.
-        if (saved === null && desktopShellPresent()) return false;
-        const servable =
-          saved === null
-            ? await bundlesCoverStartup((await servedBootGraph()) ?? window.__DSH_BOOT__)
-            : await frozenStartupLooksServable(saved);
-        if (servable) return true;
-        if (attempt === 0) await new Promise((resolve) => setTimeout(resolve, 300)); // ui-copy-ignore
+        if (saved === null && desktopShellPresent()) {
+          held('list');
+        } else {
+          const servable =
+            saved === null
+              ? await bundlesCoverStartup((await servedBootGraph()) ?? window.__DSH_BOOT__)
+              : await frozenStartupLooksServable(saved);
+          if (servable) return true;
+        }
+        if (attempt < 2) await new Promise((resolve) => setTimeout(resolve, 300 + attempt * 300)); // ui-copy-ignore
       }
+      if (holdReason === null) held('list');
       return false;
     }
 
@@ -464,7 +553,7 @@ window.__ModuleLoader__.load({
         setNotice(null);
         const stop = (key) => {
           setPending(false);
-          setNotice(COPY[key]);
+          setNotice(noticeFor(key));
         };
         const settings = await readSettings();
         const replace = settings === null ? false : settings.plugins;
@@ -480,7 +569,16 @@ window.__ModuleLoader__.load({
         if (replace) {
           const status = await replacePlugins();
           if (status !== 'done' && status !== 'off') {
-            const key = status === 'queued' ? 'queued' : status === 'unavailable' ? 'blocked' : 'failed';
+            const key =
+              status === 'queued'
+                ? 'queued'
+                : status === 'applying'
+                  ? 'applying'
+                  : status === 'restart'
+                    ? 'restart'
+                    : status === 'unavailable'
+                      ? 'blocked'
+                      : 'failed';
             report('plugin-held', key);
             return stop(key);
           }
@@ -492,7 +590,8 @@ window.__ModuleLoader__.load({
         window.sessionStorage.setItem(STAMP_KEY, String(Date.now()));
         const reason = await prepareInterface();
         if (reason !== null) {
-          report('held', reason);
+          // The log keeps the exact check that refused, so a held press can be explained later.
+          report('held', reason === 'blocked' && holdReason !== null ? `blocked:${holdReason}` : reason);
           return stop(reason);
         }
         report('rebuild');
@@ -533,6 +632,7 @@ window.__ModuleLoader__.load({
     const PROBE = {
       prepareInterface,
       startupLooksServable,
+      startupHoldReason: () => holdReason,
       frozenStartupLooksServable,
       desktopStartupPayload,
       desktopShellPresent,

package/index.js

@@ -1,5 +1,5 @@
 import { AsyncLocalStorage } from 'node:async_hooks'
-import { appendFileSync, existsSync, readFileSync, statSync, watch, writeFileSync } from 'node:fs'
+import { appendFileSync, existsSync, readFileSync, statSync, watch } from 'node:fs'
 import { homedir } from 'node:os'
 import { join, resolve } from 'node:path'
 
@@ -30,12 +30,6 @@ export const inject = ['webServer']
 /** A transaction that has not finished in this long is stuck; the press reports it instead of hanging. */
 const RELOAD_TIMEOUT_MS = 20_000
 
-/**
- * A saved file reaches the app through the reload service's transaction context. If a later version
- * of the app stops exposing that context, the queue cannot be entered from a save; the profile's
- * patch file is used instead, because the loader watches it and re-imports the modules that changed.
- */
-const PROFILE_MARKER = '# dsh-unlag: apply saved plugin code'
 
 const LOG_PATH = join(homedir(), '.dsh', 'unlag-reload.log')
 /** Tests point this at a scratch file, so a test run leaves the live log readable. */
@@ -167,54 +161,6 @@ function transactionContext(service) {
   return null
 }
 
-/** The patch file of the profile this plugin runs in, when the loader exposes the profile. */
-function profilePatch(ctx) {
-  try {
-    const dir = ctx.get('profileContext')?.dir
-    if (typeof dir !== 'string' || dir === '') return null
-    const file = join(dir, 'cordis.patch.yml')
-    return existsSync(file) ? file : null
-  } catch {
-    return null
-  }
-}
-
-/** Drop the marker line again without touching anything else the file holds. */
-function clearProfileMarker(file) {
-  try {
-    const text = readFileSync(file, 'utf8')
-    if (!text.includes(PROFILE_MARKER)) return
-    const withoutBlankLine = text.replace(`\n\n${PROFILE_MARKER}\n`, '\n')
-    writeFileSync(file, withoutBlankLine.replace(`\n${PROFILE_MARKER}\n`, '').replace(PROFILE_MARKER, ''))
-  } catch (error) {
-    log(`a reload marker is still in the profile: ${error?.message ?? error}`)
-  }
-}
-
-/**
- * Last resort when a save cannot be queued: one comment line in the profile's patch file makes the
- * loader re-import the modules that changed, the same outcome a queued reload gives. The line is
- * taken back out as soon as the loader has read it, and a line a crash leaves behind is removed at
- * the next start, so the profile is left as the user wrote it.
- * @returns whether the profile was asked, so the caller can say why the save did not apply.
- */
-function markProfileForReload(ctx) {
-  const file = profilePatch(ctx)
-  if (file === null) return false
-  try {
-    const text = readFileSync(file, 'utf8')
-    if (text.includes(PROFILE_MARKER)) return false
-    appendFileSync(file, `\n${PROFILE_MARKER}\n`)
-  } catch (error) {
-    log(`the profile could not be asked for a reload: ${error?.message ?? error}`)
-    return false
-  }
-  log('the saved plugin code is applied by a profile reload instead')
-  const timer = setTimeout(() => clearProfileMarker(file), 3000)
-  timer.unref?.()
-  return true
-}
-
 function pluginReloader(ctx, config) {
   /** HMR can start after this half, so ask per use instead of once at load. */
   const hmrService = () => {
@@ -223,15 +169,14 @@ function pluginReloader(ctx, config) {
     return hmr
   }
   const available = () => hmrService() !== null
-  /** A marker line this plugin left in the profile is not the user's; take it back out at start. */
-  const leftover = profilePatch(ctx)
-  if (leftover !== null) clearProfileMarker(leftover)
   /** Opt-in: wait for a quiet moment instead of swapping at once. Off by default. */
   const idleOnly = config?.idleOnly === true
   const debounce = Number.isFinite(config?.debounce) ? config.debounce : 300
 
   let timer = null
   let running = false
+  /** The queue request this plugin is still waiting on, so a timeout is not reported as a cancel. */
+  let work = null
   let again = false
   let deferrals = 0
   let lastRun = 0
@@ -274,30 +219,53 @@ function pluginReloader(ctx, config) {
         const timer = setTimeout(() => reject(new Error('the plugin update did not finish in time')), limit)
         timer.unref?.()
       })
+    /**
+     * The queue request itself keeps running after this plugin stops waiting for it. It is tracked
+     * so a timeout is reported as still applying, never as a failed update that later fires anyway.
+     */
+    const tracked = (request) => {
+      work = request
+      const settle = () => {
+        if (work === request) work = null
+      }
+      request.then(settle, settle)
+      return request
+    }
     let result = null
     for (let attempt = 0; ; attempt += 1) {
       try {
-        result = await Promise.race([ask(hmr), abandoned()])
+        result = await Promise.race([tracked(ask(hmr)), abandoned()])
         break
       } catch (error) {
         const message = String(error?.message ?? error)
-        if (message.includes('nested') === false) throw error
-        if (attempt >= 9) {
-          /** No context to leave means a save cannot be queued at all: hand the file to the loader. */
-          if (context === null) markProfileForReload(ctx)
+        if (message.includes('nested')) {
+          if (attempt >= 9) throw error
+          const step = Number(process.env.DSH_UNLAG_RETRY_MS ?? '') || 250
+          await new Promise((resolve) => setTimeout(resolve, step * (attempt + 1)))
+          continue
+        }
+        if (message.includes('did not finish in time')) {
+          error.stillRunning = work !== null
           throw error
         }
-        const step = Number(process.env.DSH_UNLAG_RETRY_MS ?? '') || 250
-        await new Promise((resolve) => setTimeout(resolve, step * (attempt + 1)))
+        throw error
       }
     }
     const warnings = Array.isArray(result?.warnings) ? result.warnings : []
     const pending = Array.isArray(result?.pending) ? result.pending : []
     const restartReason = typeof result?.restartReason === 'string' ? result.restartReason : null
+    /**
+     * A reconciliation that returns without throwing can still have left a plugin unloaded: the app
+     * reports that as a warning. A set with an entry that did not start is not a set the page can be
+     * rebuilt against, so the press is reported as failed and names what did not start.
+     */
+    const failedEntries = warnings
+      .map((warning) => (typeof warning === 'string' ? warning : String(warning?.message ?? '')))
+      .filter((warning) => /fail|cannot|missing|invalid|error/iu.test(warning))
     log(
       `plugins reloaded (warnings=${warnings.length} pending=${pending.length}${restartReason === null ? '' : ` restart=${restartReason}`})`,
     )
-    return { status: 'done', warnings, pending, restartReason }
+    return { status: 'done', warnings, pending, restartReason, failedEntries }
   }
 
   const flush = async () => {
@@ -381,8 +349,12 @@ function pluginReloader(ctx, config) {
     warnings: [],
     pending: [],
     restartReason: null,
+    failedEntries: [],
   })
 
+  /** A press made while an update is still running joins that update instead of queueing another. */
+  const busyAnswer = () => (work !== null ? { status: 'applying', warnings: [], pending: [], restartReason: null, failedEntries: [] } : queuedAnswer(queueReload()))
+
   /**
    * The button path: run now and report what happened, so the page can tell the user why the
    * press did not replace anything instead of looking broken.
@@ -390,12 +362,12 @@ function pluginReloader(ctx, config) {
    */
   const reloadNow = async (force = false) => {
     const hmr = hmrService()
-    if (hmr === null) return { status: 'unavailable', warnings: [], pending: [], restartReason: null }
+    if (hmr === null) return { status: 'unavailable', warnings: [], pending: [], restartReason: null, failedEntries: [] }
     if (turnsRunning()) log('reloading while turns are still running; they keep running')
-    if (running || (force === false && busy())) return queuedAnswer(queueReload())
+    if (running || (force === false && busy())) return busyAnswer()
     const wait = lastRun + MIN_INTERVAL_MS - Date.now()
     if (wait > 0) await new Promise((resolve) => setTimeout(resolve, Math.min(wait, 2000)))
-    if (running || (force === false && busy())) return queuedAnswer(queueReload())
+    if (running || (force === false && busy())) return busyAnswer()
     if (timer !== null) {
       clearTimeout(timer)
       timer = null
@@ -405,18 +377,53 @@ function pluginReloader(ctx, config) {
     lastRun = Date.now()
     try {
       const outcome = await reload(hmr)
+      /**
+       * `pending` means the changed modules are not loaded yet and need a restart this plugin does
+       * not perform; it is not a queued update that finishes on its own.
+       */
       if (outcome.pending.length > 0 || outcome.restartReason !== null) {
         // The app accepted the update but has not finished starting the new plugin set. Rebuilding
         // the page now would start a document against a set that is still settling.
-        return { status: 'failed', warnings: outcome.warnings, pending: outcome.pending, restartReason: outcome.restartReason }
+        return {
+          status: 'failed',
+          warnings: outcome.warnings,
+          pending: outcome.pending,
+          restartReason: outcome.restartReason,
+          failedEntries: outcome.failedEntries,
+        }
+      }
+      if (outcome.failedEntries.length > 0) {
+        return {
+          status: 'failed',
+          warnings: outcome.warnings,
+          pending: [],
+          restartReason: null,
+          failedEntries: outcome.failedEntries,
+        }
       }
       return outcome
     } catch (error) {
+      if (error?.stillRunning === true) {
+        // The queue still holds the request: it may yet apply, so the press is not called failed.
+        return { status: 'applying', warnings: [], pending: [], restartReason: null, failedEntries: [] }
+      }
       log(`reload did not finish; the plugin set may be partly applied: ${error?.message ?? error}`)
-      return { status: 'failed', warnings: [], pending: [], restartReason: null }
+      return { status: 'failed', warnings: [], pending: [], restartReason: null, failedEntries: [] }
     } finally {
-      running = false
-      again = false
+      if (work === null) {
+        running = false
+        again = false
+      } else {
+        // Stay busy until the queue request really settles, so a second press joins it.
+        const release = () => {
+          running = false
+          if (again) {
+            again = false
+            if (timer === null) timer = setTimeout(() => void flush(), debounce)
+          }
+        }
+        work.then(release, release)
+      }
     }
   }
 
@@ -475,10 +482,22 @@ function sendJson(res, status, payload) {
  * leaves it naming a module graph that no longer resolves, which is exactly the list a rebuild
  * must not trust.
  */
-function liveBootGraph(server) {
+function liveBootGraph(ctx) {
   try {
-    if (typeof server.collectIndexInjections !== 'function') return null
-    const rows = server.collectIndexInjections()
+    /**
+     * The module table's own graph is the list the next document is built from, and reading it has
+     * no side effects. The injection table needs a peer for anything page-scoped, so it is not a
+     * substitute: a graph that cannot be read stays null and the page holds instead of guessing.
+     */
+    const modules = ctx.get('clientModules')
+    if (typeof modules?.graph === 'function') {
+      const graph = modules.graph()
+      if (graph !== null && typeof graph === 'object' && Array.isArray(graph.entries)) return graph
+      return null
+    }
+    const server = ctx.get('webServer')
+    if (typeof server?.collectIndexInjections !== 'function') return null
+    const rows = server.collectIndexInjections({})
     if (!Array.isArray(rows)) return null
     for (const row of rows) {
       if (row?.kind !== 'global') continue
@@ -570,6 +589,43 @@ async function fetchBundleAt(clientModules, url, method) {
   return clientModules.fetchBundle({ method, url: address })
 }
 
+/**
+ * One plugin's current module body, read back from the table so it can be put in front of a
+ * document that expects a grouping the table no longer keeps.
+ */
+async function currentEntryBody(clientModules, graph, id) {
+  const entries = Array.isArray(graph?.entries) ? graph.entries : []
+  const entry = entries.find((candidate) => candidate?.id === id)
+  const raw = typeof entry?.url === 'string' ? entry.url : ''
+  if (raw === '') return null
+  const target = raw.startsWith('/') ? raw : `/${raw}`
+  const response = await fetchBundleAt(clientModules, target, 'GET')
+  if (response.status !== 200) return null
+  const body = Buffer.from(await response.arrayBuffer())
+  return body.length === 0 ? null : body
+}
+
+/**
+ * A plugin set from a generation the table no longer groups the same way. An app that started
+ * before plugins were installed asks for exactly the sets its document listed; those sets are not
+ * kept as sets any more, but every plugin in them is still served on its own. Reading each one and
+ * answering with them in the requested order registers exactly the plugins the document expects,
+ * so a boot that would otherwise 404 and end the app comes up instead.
+ */
+async function regroupedBundleAnswer(clientModules, graph, request) {
+  if (request.sourceMap) return null
+  const parts = []
+  for (const id of request.ids) {
+    const body = await currentEntryBody(clientModules, graph, id)
+    if (body === null) return null
+    parts.push(body)
+  }
+  if (parts.length === 0) return null
+  const body = Buffer.concat(parts)
+  if (!request.ids.every((id) => body.includes(id))) return null
+  return { body, contentType: 'text/javascript; charset=utf-8', ids: request.ids }
+}
+
 /**
  * The plugin set one stale request names, answered at the revision the app serves now. Only a body
  * that really contains every plugin it claims is handed back; anything unsure answers null, so the
@@ -578,22 +634,25 @@ async function fetchBundleAt(clientModules, url, method) {
 async function currentBundleAnswer(clientModules, method, url) {
   const request = bundleRequest(url)
   if (request === null) return null
-  const urls = currentBundleUrls(clientModules.graph(), request)
-  if (urls.length === 0) return null
-  if (request.rev !== '' && urls.some((target) => target.endsWith(`&rev=${request.rev}`))) return null
-  for (const target of urls) {
-    const response = await fetchBundleAt(clientModules, target, 'GET')
-    if (response.status !== 200) continue
-    const body = Buffer.from(await response.arrayBuffer())
-    if (body.length === 0) continue
-    if (!request.sourceMap && !request.ids.every((id) => body.includes(id))) continue
-    return {
-      body,
-      contentType: String(response.headers.get('content-type') ?? 'text/javascript; charset=utf-8'),
-      ids: request.ids,
+  const graph = clientModules.graph()
+  // A request already at the generation the table serves is the table's to answer.
+  if (typeof graph?.rev === 'string' && graph.rev !== '' && request.rev === graph.rev) return null
+  const urls = currentBundleUrls(graph, request)
+  if (urls.length > 0 && (request.rev === '' || !urls.some((target) => target.endsWith(`&rev=${request.rev}`)))) {
+    for (const target of urls) {
+      const response = await fetchBundleAt(clientModules, target, 'GET')
+      if (response.status !== 200) continue
+      const body = Buffer.from(await response.arrayBuffer())
+      if (body.length === 0) continue
+      if (!request.sourceMap && !request.ids.every((id) => body.includes(id))) continue
+      return {
+        body,
+        contentType: String(response.headers.get('content-type') ?? 'text/javascript; charset=utf-8'),
+        ids: request.ids,
+      }
     }
   }
-  return null
+  return regroupedBundleAnswer(clientModules, graph, request)
 }
 
 /** Answer one stale request over the plain request/response route an app registers. */
@@ -618,6 +677,29 @@ async function serveCurrentBundle(clientModules, req, res) {
   }
 }
 
+/** The revision the module table serves now, or null when it cannot be read. */
+function currentRevision(clientModules) {
+  try {
+    const graph = clientModules.graph()
+    return typeof graph?.rev === 'string' && graph.rev !== '' ? graph.rev : null
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Point a bundle request at the current revision while keeping the plugin set it names. The table
+ * only keeps the previous generation of whole documents, and dynamic chunks are served at the
+ * current revision alone; a page that kept an old revision would get a main bundle it cannot load
+ * chunks for. Rewriting the revision keeps one generation in the whole answer.
+ */
+function retargetRevision(url, current) {
+  if (current === null || typeof url !== 'string') return null
+  const match = /([?&])rev=([^&#]*)/u.exec(url)
+  if (match === null || match[2] === current) return null
+  return `${url.slice(0, match.index)}${match[1]}rev=${current}${url.slice(match.index + match[0].length)}`
+}
+
 /** The same answer over the request-in/response-out route a newer app registers. */
 async function serveCurrentBundleResource(clientModules, request) {
   try {
@@ -657,13 +739,36 @@ function serveBundlesAtCurrentRevision(ctx) {
   if (typeof route.resource === 'function') {
     const original = route.resource
     const wrapped = async (request) => {
+      /**
+       * The table's own answer comes first: it still holds the document generation this page booted
+       * from. Only when it has nothing is the current one served, and the request is retargeted at
+       * the current revision so the answer and its chunks belong to the same generation.
+       */
+      const retargeted = retargetRevision(String(request?.url ?? ''), currentRevision(clientModules))
+      const method = String(request?.method ?? 'GET').toUpperCase()
+      let answer = null
+      try {
+        answer = await original(request)
+      } catch (error) {
+        log(`cannot answer a bundle request: ${error?.message ?? error}`)
+      }
+      if (retargeted !== null && (answer === null || answer === undefined || answer.status === 404)) {
+        try {
+          const next = method === 'GET' || method === 'HEAD' ? new Request(retargeted, { method, headers: request.headers }) : request
+          const second = await original(next)
+          if (second !== null && second !== undefined) answer = second
+        } catch (error) {
+          log(`cannot answer a bundle request: ${error?.message ?? error}`)
+        }
+      }
+      if (answer !== null && answer !== undefined && answer.status !== 404) return answer
       try {
         const served = await serveCurrentBundleResource(clientModules, request)
         if (served !== null) return served
       } catch (error) {
         log(`cannot answer a bundle request: ${error?.message ?? error}`)
       }
-      return original(request)
+      return answer
     }
     route[SHIM_MARK] = true
     route.resource = wrapped
@@ -672,14 +777,82 @@ function serveBundlesAtCurrentRevision(ctx) {
   }
   if (typeof route.handler !== 'function') return null
   const original = route.handler
-  const wrapped = (req, res) => {
-    const fallback = () => original(req, res)
-    const answered = serveCurrentBundle(clientModules, req, res).catch((error) => {
+  /**
+   * The table's own answer is kept, and only a 404 is held back long enough to ask whether the
+   * current generation can answer instead; the plugin set is retargeted at the current revision
+   * first, so the served document and the chunks it later asks for are one generation.
+   */
+  const wrapped = async (req, res) => {
+    const originalUrl = String(req?.url ?? '')
+    const retargeted = retargetRevision(originalUrl, currentRevision(clientModules))
+    const realWriteHead = res.writeHead
+    const realEnd = res.end
+    const ask = async (url) => {
+      let held = null
+      let body
+      if (url !== originalUrl) {
+        try {
+          req.url = url
+        } catch {
+          /* a frozen request keeps its own address */
+        }
+      }
+      if (typeof realWriteHead === 'function') {
+        res.writeHead = (status, ...rest) => {
+          if (status === 404) {
+            held = { status, headers: rest[0] }
+            return res
+          }
+          return realWriteHead.call(res, status, ...rest)
+        }
+      }
+      if (typeof realEnd === 'function') {
+        res.end = (...args) => {
+          if (held !== null) {
+            body = typeof args[0] === 'string' || Buffer.isBuffer(args[0]) ? args[0] : ''
+            return res
+          }
+          return realEnd.apply(res, args)
+        }
+      }
+      try {
+        await Promise.resolve(original(req, res))
+      } catch (error) {
+        log(`cannot answer a bundle request: ${error?.message ?? error}`)
+      } finally {
+        try {
+          res.writeHead = realWriteHead
+          res.end = realEnd
+        } catch {
+          /* the response object owns its own shape */
+        }
+      }
+      return { held, body }
+    }
+    // The table's own answer first: it still holds the generation this page booted from.
+    let outcome = await ask(originalUrl)
+    if (outcome.held !== null && retargeted !== null) outcome = await ask(retargeted)
+    if (outcome.held === null) return undefined
+    // The shim resolves the set from the address the page asked for, not the retried one.
+    try {
+      req.url = originalUrl
+    } catch {
+      /* a frozen request keeps its own address */
+    }
+    let served = false
+    try {
+      served = await serveCurrentBundle(clientModules, req, res)
+    } catch (error) {
       log(`cannot answer a bundle request: ${error?.message ?? error}`)
-      return false
-    })
-    if (typeof answered?.then !== 'function') return fallback()
-    return answered.then((served) => (served === true ? undefined : fallback()))
+    }
+    if (served === true) return undefined
+    try {
+      realWriteHead.call(res, outcome.held.status, outcome.held.headers)
+      realEnd.call(res, outcome.body)
+    } catch {
+      /* the response is gone; nothing left to answer */
+    }
+    return undefined
   }
   route[SHIM_MARK] = true
   route.handler = wrapped
@@ -754,7 +927,7 @@ function serveButton(ctx, controller, config) {
       `${BASE_PATH}/graph`,
       (_req, res) => {
         ensureBundleShim(ctx)
-        sendJson(res, 200, { graph: liveBootGraph(server) })
+        sendJson(res, 200, { graph: liveBootGraph(ctx) })
       },
     ],
     [

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dsh-unlag",
-  "version": "1.7.11",
+  "version": "1.8.1",
   "type": "module",
   "description": "One press applies plugin edits right away and brings a laggy interface back; running turns, queued messages and unsent input are untouched, and nothing restarts.",
   "license": "MIT",