DeepSeek Harness prepare:dsh 失败：payload smoke 断言了已移除的 fs-ext

# 1. 全树有没有任何一个 manifest 还声明 fs-ext？
git grep -n '"fs-ext"' -- '*package.json' || echo 'NO manifest declares fs-ext'

# 2. lockfile 里有没有它的条目？
grep -n 'fs-ext' pnpm-lock.yaml || echo 'NO lockfile entry'

# 3. 还有哪些文件在提这个名字？
git grep -n 'fs-ext' -- ':!pnpm-lock.yaml'

checkFsExt()                                  apps/desktop/tests/fixtures/runtime-payload-smoke.mjs:69
  └─ requireRuntime('fs-ext')                 在 payload 内解析，必然 Cannot find module
       └─ 异常冒泡到 fixture 顶层 try          :124
            └─ 子进程非零退出
                 └─ prepare-dsh.ts 回调 throw   terminate 整个脚本
                      └─ resources/dsh 不生成
                           └─ electron-builder ENOENT …\resources\dsh\desktop-runtime.json
                                （verifyDesktopRuntime / afterPack 收尾失败）

// packages/session/session-persistence-jsonl/src/lease.ts:34
import { tryLockExclusive } from '@deepseek-ai/node-addon-system/flock'

// apps/desktop/scripts/prepare-dsh.ts 附近（修复前）
else { process.stdout.write(stdout); accept() }   // stdout 直写，不解析那行 JSON

--- a/apps/desktop/tests/fixtures/runtime-payload-smoke.mjs
+++ b/apps/desktop/tests/fixtures/runtime-payload-smoke.mjs
@@ -1,7 +1,7 @@
 /** Exercise filtered Desktop native and HTML dependencies under its bundled Node. */
 
 import assert from 'node:assert/strict'
-import { closeSync, mkdtempSync, openSync, readFileSync, readSync, writeFileSync } from 'node:fs'
+import { mkdtempSync, readFileSync, writeFileSync } from 'node:fs'
 import { rm } from 'node:fs/promises'
 import { createRequire } from 'node:module'
 import { tmpdir } from 'node:os'
@@ -64,22 +64,6 @@ async function checkPty() {
   }
 }
 
-/** fs-ext implements seek on Windows through SetFilePointerEx and on POSIX through lseek. */
-function checkFsExt() {
-  const fsExt = requireRuntime('fs-ext')
-  const file = join(scratch, 'seek.txt')
-  writeFileSync(file, 'abcdef', { flag: 'wx', mode: 0o600 })
-  const fd = openSync(file, 'r')
-  try {
-    assert.equal(fsExt.seekSync(fd, 2, fsExt.constants.SEEK_SET), 2)
-    const bytes = Buffer.alloc(4)
-    assert.equal(readSync(fd, bytes, 0, bytes.length, null), 4)
-    assert.equal(bytes.toString(), 'cdef')
-  } finally {
-    closeSync(fd)
-  }
-}
-
 /** Resolve one system function through Koffi's packaged native module. */
 function checkKoffi() {
   const koffi = requireRuntime('koffi')
@@ -121,7 +105,6 @@ function checkHtml() {
 }
 
 try {
-  checkFsExt()
   checkKoffi()
   await checkSharp()
   checkHtml()
@@ -134,5 +117,5 @@ try {
 process.once('beforeExit', () => {
   console.log(JSON.stringify({ node: process.versions.node, platform: process.platform, arch: process.arch,
-    fsExt: true, koffi: true, sharp: true, html: true, pty: true }))
+    koffi: true, sharp: true, html: true, pty: true }))
 })

--- a/apps/desktop/tests/fixtures/runtime-payload-smoke.mjs
+++ b/apps/desktop/tests/fixtures/runtime-payload-smoke.mjs
@@ -17,6 +17,9 @@ assert.equal(process.arch, descriptor.arch)
 const requireRuntime = createRequire(join(root, 'package.json'))
 const scratch = mkdtempSync(join(tmpdir(), 'dsh-runtime-payload-'))
 
+/** Prefix of the summary line prepare-dsh.ts parses; keep both copies in sync. */
+const SUMMARY_PREFIX = 'desktop-runtime-payload-smoke '
+
 /** Spawn only a fixed Node program and await the terminal's drained exit event. */
 async function checkPty() {
   const pty = requireRuntime('node-pty')
@@ -64,17 +67,19 @@ async function checkPty() {
   }
 }
 
-/** fs-ext implements seek on Windows through SetFilePointerEx and on POSIX through lseek. */
-function checkFsExt() {
-  const fsExt = requireRuntime('fs-ext')
-  const file = join(scratch, 'seek.txt')
-  writeFileSync(file, 'abcdef', { flag: 'wx', mode: 0o600 })
+/**
+ * The prebuilt Node-API system addon replaced fs-ext on POSIX. Windows keeps its
+ * koffi semaphore, so only the `./flock` subpath has to resolve there.
+ */
+async function checkSystemFlock() {
+  const flock = requireRuntime('@deepseek-ai/node-addon-system/flock')
+  assert.equal(typeof flock.tryLockExclusive, 'function')
+  if (process.platform === 'win32') return
+  const file = join(scratch, 'flock.txt')
+  writeFileSync(file, '', { flag: 'wx', mode: 0o600 })
   const fd = openSync(file, 'r')
   try {
-    assert.equal(fsExt.seekSync(fd, 2, fsExt.constants.SEEK_SET), 2)
-    const bytes = Buffer.alloc(4)
-    assert.equal(readSync(fd, bytes, 0, bytes.length, null), 4)
-    assert.equal(bytes.toString(), 'cdef')
+    await flock.tryLockExclusive(fd)
   } finally {
     closeSync(fd)
   }
@@ -121,7 +126,7 @@ function checkHtml() {
 }
 
 try {
-  checkFsExt()
+  await checkSystemFlock()
   checkKoffi()
   await checkSharp()
   checkHtml()
@@ -132,7 +137,9 @@ try {
 }
 
 // Natural event-loop drain includes node-pty's worker and console-list helper teardown.
+// prepare-dsh.ts asserts this summary, so a dropped check cannot pass as a green run.
 process.once('beforeExit', () => {
-  console.log(JSON.stringify({ node: process.versions.node, platform: process.platform, arch: process.arch,
-    fsExt: true, koffi: true, sharp: true, html: true, pty: true }))
+  console.log(`${SUMMARY_PREFIX}${JSON.stringify({ runtime: { node: process.versions.node,
+    platform: process.platform, arch: process.arch },
+    checks: { systemFlock: true, koffi: true, sharp: true, html: true, pty: true } })}`)
 })

--- a/apps/desktop/scripts/prepare-dsh.ts
+++ b/apps/desktop/scripts/prepare-dsh.ts
@@ -38,6 +38,11 @@ const PACKAGE_SET_ROOT = BUILD_PATHS.packageSet
 const NODE = join(RUNTIME_ROOT, 'node', process.platform === 'win32' ? 'node.exe' : 'node')
 const PNPM = join(RUNTIME_ROOT, 'pnpm', 'bin', 'pnpm.mjs')
 
+/** Must match the summary prefix in tests/fixtures/runtime-payload-smoke.mjs. */
+const PAYLOAD_SMOKE_SUMMARY_PREFIX = 'desktop-runtime-payload-smoke '
+/** Native checks the bundled payload must report; a silent removal must not look like a pass. */
+const EXPECTED_PAYLOAD_SMOKE_CHECKS: readonly string[] = ['systemFlock', 'koffi', 'sharp', 'html', 'pty']
+
 function manifestVersion(path: string, subject: string): string {
   const manifest = JSON.parse(readFileSync(path, 'utf8')) as { version?: unknown }
   if (typeof manifest.version !== 'string') throw new Error(`desktop runtime: ${subject} has no version`)
@@ -100,6 +105,17 @@ function runPnpm(args: readonly string[]): Promise<void> {
   })
 }
 
+function verifyPayloadSmokeSummary(stdout: string): void {
+  const line = stdout.split(/\r?\n/u).filter(entry => entry.startsWith(PAYLOAD_SMOKE_SUMMARY_PREFIX)).at(-1)
+  if (line === undefined) throw new Error('desktop runtime: payload smoke printed no summary line')
+  const summary = JSON.parse(line.slice(PAYLOAD_SMOKE_SUMMARY_PREFIX.length)) as { checks?: Record<string, unknown> }
+  const checks = Object.entries(summary.checks ?? {})
+  if (checks.length !== EXPECTED_PAYLOAD_SMOKE_CHECKS.length
+    || checks.some(([name, value]) => value !== true || !EXPECTED_PAYLOAD_SMOKE_CHECKS.includes(name))) {
+    throw new Error(`desktop runtime: payload smoke reported ${JSON.stringify(summary.checks ?? null)}`)
+  }
+}
+
 async function main(): Promise<void> {
   rmSync(DSH_OUTPUT_ROOT, { recursive: true, force: true })
   rmSync(PNPM_BUILD_STATE, { recursive: true, force: true })
@@ -142,7 +158,15 @@ async function main(): Promise<void> {
       execFile(NODE, [join(APP_ROOT, 'tests/fixtures/runtime-payload-smoke.mjs'), DSH_OUTPUT_ROOT],
         { timeout: 120_000, env: { ...process.env, NODE_OPTIONS: '' } }, (error, stdout, stderr) => {
           if (error !== null) reject(new Error(`desktop native payload smoke failed: ${stderr}`, { cause: error }))
-          else { process.stdout.write(stdout); accept() }
+          else {
+            try {
+              verifyPayloadSmokeSummary(stdout)
+              process.stdout.write(stdout)
+              accept()
+            } catch (cause) {
+              reject(cause instanceof Error ? cause : new Error(String(cause)))
+            }
+          }
         })
     })
     await smokeDesktopRuntime(DSH_OUTPUT_ROOT, NODE, descriptor)

async function checkSystemFlock() {
  const flock = requireRuntime('@deepseek-ai/node-addon-system/flock')
  assert.equal(typeof flock.tryLockExclusive, 'function')
  if (process.platform === 'win32') return          // ← Windows 到此为止
  const file = join(scratch, 'flock.txt')
  writeFileSync(file, '', { flag: 'wx', mode: 0o600 })
  const fd = openSync(file, 'r')
  try {
    await flock.tryLockExclusive(fd)                // ← 只有 POSIX 真锁
  } finally {
    closeSync(fd)
  }
}

desktop-runtime-payload-smoke {"runtime":{"node":"24.17.0","platform":"win32","arch":"x64"},"checks":{"systemFlock":true,"koffi":true,"sharp":true,"html":true,"pty":true}}