v1.9.1: fix Runtime switching and adopt verified external runtimes

CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## 1.9.1
+
+- Fix managed Runtime switching that could appear unresponsive by adding durable row-level preparation, plan, execution, verification, error, and result states.
+- Resolve every switch target from a backend-trusted stable Runtime ID instead of accepting frontend-provided kind, version, or path identity.
+- Allow strongly verified external JDK, Python, Node.js, Go, Maven, and Gradle installations to be adopted into the user environment without modifying or uninstalling their directories.
+- Add provider-aware switching for nvm, fnm, Volta, Scoop, and rustup, plus project-scoped .NET SDK selection through `global.json`.
+- Persist exact switch plans, environment diffs, backups, fingerprints, expiring confirmation tokens, single-use state, verification evidence, rollback results, and recovery guidance.
+- Restore persistent Runtime backup choices on initial page load after the application restarts.
+- Add focused acceptance and isolated Windows ReleaseLab coverage for managed switching, external adoption, restart recovery, MSI lifecycle, and v1.9.0 upgrade preservation.
+
+Exact asset identities, test evidence, acceptance boundaries, and disclosures are recorded in [docs/release-v1.9.1.md](docs/release-v1.9.1.md).
+
 ## 1.9.0
 
 - Redesign Runtime discovery around nine ecosystem groups with explicit current, managed, and external authority boundaries.

README.md

@@ -2,19 +2,19 @@
 
 [GitHub 主仓库](https://github.com/weidonglang/DevEnv-Manager) · [Gitee 国内镜像](https://gitee.com/weidonglang/DevEnv-Manager) · [GitHub Release](https://github.com/weidonglang/DevEnv-Manager/releases) · [Gitee Release](https://gitee.com/weidonglang/DevEnv-Manager/releases) · [完整操作手册](docs/user-guide.md) · [安全说明](docs/safety-and-disclaimer.md) · [问题反馈](https://github.com/weidonglang/DevEnv-Manager/issues)
 
-面向 Windows 的开发环境诊断器与安全操作面板。当前版本：**1.9.0 Stable**。
+面向 Windows 的开发环境诊断器与安全操作面板。当前版本：**1.9.1 Stable**。
 
-1.9.0 完成 Runtime 管理主线与 Profile 历史恢复：统一识别九类开发生态，明确受管、外部和当前运行时边界，安装后强校验但不擅自切换，并把切换与历史恢复绑定到可验证、可回滚、单次消费的后端计划。
+1.9.1 修复 Runtime 切换看似无响应的问题，并让经过强验证的外部 JDK、Python、Node.js、Go、Maven 和 Gradle 可以在不修改外部目录的前提下安全采用到用户环境。切换计划、差异、备份、验证、失败恢复和重启后的恢复入口现在都可见且可追踪。
 
 ## 下载与镜像
 
 - GitHub 主仓库：https://github.com/weidonglang/DevEnv-Manager
 - Gitee 国内镜像：https://gitee.com/weidonglang/DevEnv-Manager
 - GitHub Release：https://github.com/weidonglang/DevEnv-Manager/releases
 - Gitee Release：https://gitee.com/weidonglang/DevEnv-Manager/releases
-- v1.9.0 NSIS：https://github.com/weidonglang/DevEnv-Manager/releases/download/v1.9.0/DevEnv.Manager_1.9.0_x64-setup.exe
-- 国内下载：https://gitee.com/weidonglang/DevEnv-Manager/releases/download/v1.9.0/DevEnv.Manager_1.9.0_x64-setup.exe
-- NSIS SHA256：`0e44e6f9c591858c8981139c581ee70f6e79344b0850525d3f83f2bd257664c1`
+- v1.9.1 NSIS：https://github.com/weidonglang/DevEnv-Manager/releases/download/v1.9.1/DevEnv.Manager_1.9.1_x64-setup.exe
+- 国内下载：https://gitee.com/weidonglang/DevEnv-Manager/releases/download/v1.9.1/DevEnv.Manager_1.9.1_x64-setup.exe
+- NSIS SHA256：`ce4b9020d47258dd1668f0237a0b3fd0b061ddfc20c938fed56f5ddcf5cd0352`
 
 适合：
 
@@ -47,6 +47,25 @@ DevEnv Manager 解决的是 Windows 上多个开发生态互相影响的问题
 - 不适合希望软件自动接管整台机器、清理任意个人文件或替代专业包管理器的场景。
 - 熟练使用 mise/asdf/Scoop/Chocolatey 且环境已经稳定的用户，可以只使用诊断能力。
 
+## 1.9.1 Stable
+
+我们向在 v1.9.0 中点击“设为当前”却看不到可靠反馈、无法判断操作是否开始，以及不得不手工修改环境变量来采用外部 Runtime 的用户郑重道歉。一个涉及 PATH、`JAVA_HOME` 和项目 SDK 的操作不应该让用户猜测，也不应该依赖用户反复截图和重装才能暴露状态丢失。v1.9.1 将这条工作流重新收束为可见、可验证、可恢复的完整闭环。
+
+本次版本完成：
+
+- 受管 Runtime 的“设为当前”会持续显示准备、计划已创建、执行、验证、成功或失败状态；计划自动聚焦，错误和结果不会只停留在短暂 toast。
+- 前端不再把 `kind/version/path` 当作可信目标。后端只接收稳定 Runtime ID 和白名单切换模式，并重新解析发现来源、强验证结果、可执行文件与 provider 身份。
+- 强验证通过的外部 JDK、Python、Node.js、Go、Maven 和 Gradle 可以采用到当前用户环境；DevEnv Manager 不写入、不移动、不删除这些外部目录，也不提供直接卸载。
+- nvm、fnm、Volta、Scoop 和 rustup 使用各自 provider 语义；非 rustup Rust 保持只读；.NET SDK 使用项目级 `global.json`，不会伪装成全局 SDK 切换。
+- 每次切换都保存精确计划、环境差异、来源权威、状态指纹、备份路径、有效期和单次确认令牌。计划过期、目标变化、文件/provider 指纹变化、篡改或重复执行都会被拒绝。
+- 执行后使用新子进程验证真实版本、命令路径和必要组件；失败时执行受约束回滚，并把备份、验证证据、下一步和恢复入口保留在页面。
+- Runtime 备份列表跨应用重启持久化。修复了后端已经保存备份、但页面首次加载漏掉第四个返回值而不显示恢复选项的问题。
+- 保留 v1.9.0 的九类 Runtime 分组、强验证、安装不自动切换、Profile 历史恢复，以及 v1.8.3 的端口、归档、回收站、主题可读性和高风险计划保护。
+
+冻结产品源码提交 `4137fbe` 通过 230 项 Rust 测试、Clippy、113 模块前端生产构建、268 个前端 selector、30 项视觉验收和全部契约检查。聚合功能验收为 300 项：254 通过、0 失败、40 项危险动作按安全策略跳过、6 项人工或策略记录；P0/P1 失败、backend-only、ui-only、missing、partial 和 toast-only 均为 0。
+
+最终 Windows ReleaseLab 验证受管 Node 切换与恢复、外部 Node 采用与恢复、外部目录哈希不变、应用重启后备份列表恢复、NSIS/MSI 安装启动卸载，以及 v1.9.0 升级后设置和 Profile 哈希不变。正式资产、SHA256、验收边界和非阻塞限制记录在 [docs/release-v1.9.1.md](docs/release-v1.9.1.md)。安装器暂未进行 Authenticode 签名，Windows 可能显示常规信任提示。
+
 ## 1.9.0 Stable
 
 我们再次向受到此前版本 Runtime 状态混淆、安装与切换边界不清、Windows Store Alias 被误列为外部 Python，以及英文界面仍出现中文 Profile 结果影响的用户郑重道歉。用户不应该通过反复截图、重装和手工验证，替项目发现这些问题。v1.9.0 不只是增加页面选项，而是把运行时识别、安装、切换、验证和恢复重新收束到可审计的产品契约。

acceptance/feature-manifest.v1.8.2.json

@@ -261,7 +261,11 @@
             "discover_runtimes",
             "inspect_runtime_strong_verification",
             "create_runtime_switch_plan",
+            "cancel_runtime_switch_plan",
+            "export_runtime_switch_plan",
             "execute_runtime_switch_plan",
+            "list_runtime_switch_backups",
+            "restore_runtime_switch_backup",
             "uninstall_runtime",
             "open_analysis_path",
             "open_apps_features"
@@ -403,7 +407,11 @@
             "inspect_runtime_strong_verification",
             "export_runtime_verification_report",
             "create_runtime_switch_plan",
-            "execute_runtime_switch_plan"
+            "cancel_runtime_switch_plan",
+            "export_runtime_switch_plan",
+            "execute_runtime_switch_plan",
+            "list_runtime_switch_backups",
+            "restore_runtime_switch_backup"
           ],
           "backendExists": true,
           "frontendWired": true,

acceptance/visual-baseline.v1.9.0.json → acceptance/visual-baseline.v1.9.1.json

@@ -1,8 +1,8 @@
 {
-  "version": "1.9.0",
+  "version": "1.9.1",
   "algorithm": "dHash-32x32",
   "maximumHashDistance": 120,
-  "generatedAt": "2026-07-23T11:30:06.524Z",
+  "generatedAt": "2026-07-30T07:48:35.176Z",
   "cases": {
     "cleanup-light-wide-en": {
       "hash": "ce000601e538ce7b8db000030e9c000107041021058b1c3b0700300307c4313105044001078492310795955a054281090502c2210540000105960001050c800107316603070b0001070000010744da84059a192104205d0105030001059000030708800307b49235059807d50542c00305089081052000010565000304000001",
@@ -149,10 +149,10 @@
       }
     },
     "runtimes-dark-wide-en": {
-      "hash": "256b304124a0025724fc7227248a049500ad8001004b0001009810030043800300b149970165700100e9000100c02007004827db00000001003a000300596cd70180000100eb000300482de300a9000100700f83004824610089800100b249970400000100a3ac6f004829e300a9000100596e570060000100b0298304000041",
+      "hash": "344b30613ce0025734fd300124ba8d1300b9268300000003003000030018000100440003017645630070b00100c0000100a9800300b749970000079300c0000100c00007000020430001000300f16f9300c0000100600003004824430099800100f3efb7016c000100b00b810400000100b029a10400000100c628b300002561",
       "contentSize": {
         "width": 1351,
-        "height": 5340
+        "height": 5872
       },
       "viewport": {
         "width": 1366,
@@ -161,10 +161,10 @@
       }
     },
     "runtimes-hc-compact-zh": {
-      "hash": "410e0c1038000000000000010c0016b31b3800002660d000000000031000000316c00001400000012f030e01000000013f0000013830757080003801008000033d303a70c0000000170000070e000e010dc0000030001803000000013700000100020003264000003c303a702800000030023803000000010a9dfc0100008003",
+      "hash": "304d0e06380000003000000019ac0300000000031c120001090908302cc000001c000003440c00011930757038718000387180003e00000338b0357080003363000000033d3032706000000038000007000000013e00000118b135733dc0000030003803000000010a957003000000010a9df003000100030a9df00100008003",
       "contentSize": {
         "width": 965,
-        "height": 5504
+        "height": 5842
       },
       "viewport": {
         "width": 980,
@@ -305,7 +305,7 @@
       }
     },
     "profiles-dark-standard-en": {
-      "hash": "7c6c03f13ee000013eaa95813e7844a73ed25e5f3e7800013677720f360000010670000100061f2700164f2700ee00010070b00100594001007d00030078070100e0b8010064b001004e000100370003005c000100028c0100274f0b00e0de01005c98010071290300f1880100f9ce0100e10449007cf801003d0c0102000000",
+      "hash": "7c6c03f13ee000013eaa95813e7844a73ed25e5f3e7800013677720f360000010670000100061f2700164f2700ee00010070b00100594001007d00030078070100e0b80100daf001004e000100370003005c000100028c0100274f0b00e0de01005c98010071290300f1880100f9ce0100e10449007cf801003d0c0102000000",
       "contentSize": {
         "width": 1165,
         "height": 2662
@@ -317,7 +317,7 @@
       }
     },
     "profiles-hc-compact-zh": {
-      "hash": "5a0000007061876e300000007c000000387800013b16000016000a972046d05d184210312373b4ce3800000045c4fc9d41c0f8cd370000003836000238600003386000023004b803352f00008000000016000003040000000a6bc00008c70c33302bc002301f70023828c002302ce002a00000023c2bb7020e40000300000001",
+      "hash": "5a0000007061876e300000007c000000387800013b16000016000a972046d05d184210312373b4ce3800000045c4fc9d41c0f8cd370000003836000238600003386000023004b803382f00008000000016000003040000000a6bc00008c70c33302bc002301f70023828c002302ce002a00000023c2bb7020e40000300000001",
       "contentSize": {
         "width": 965,
         "height": 2910

docs/release-v1.9.1.md

@@ -0,0 +1,81 @@
+# DevEnv Manager v1.9.1 Stable Release Review
+
+Status: **Release candidate approved for publication**
+
+The v1.9.1 product source and reviewed assets are pinned to source commit `4137fbe75f50b46c7f4818c9bd29e1e4b38946f3` in PR #142. This document records the Runtime switching hotfix, exact assets, automated gates, Windows ReleaseLab evidence, and publication boundaries.
+
+## User Notice
+
+We apologize to users who clicked "Set current" in v1.9.0 and received no durable indication that Runtime switching had started, or who had to edit environment variables manually because a verified external Runtime could not be adopted. PATH, `JAVA_HOME`, provider, and project SDK changes must never leave users guessing. v1.9.1 makes preparation, plan review, execution, verification, failure, backup, and recovery visible and testable.
+
+## Scope Delivered
+
+- Managed JDK, Python, Node.js, Go, Maven, and Gradle rows expose durable preparing, plan-created, executing, verifying, success, and failure states.
+- The frontend submits only a stable Runtime ID and an allowlisted switch mode. The backend re-resolves trusted discovery, verification, executable, source-authority, and provider evidence.
+- Strongly verified external JDK, Python, Node.js, Go, Maven, and Gradle installations can be adopted into the user environment without writing, moving, deleting, or uninstalling their directories.
+- nvm, fnm, Volta, Scoop, and rustup use provider-aware adapters. Non-rustup Rust remains read-only.
+- .NET SDK selection is project-scoped through `global.json`; unknown tools remain read-only.
+- Exact backend-stored plans contain target identity, environment diff, source authority, backup, state and file/provider fingerprints, expiry, risk, and confirmation-token contract.
+- Plans reject expired, stale, tampered, reparse-changed, provider-changed, or already-consumed state.
+- Execution verifies a newly launched child command and required components. Failure records rollback and verification evidence.
+- Persistent Runtime switch backups are listed after application restart. The final source fix prevents initial page loading from discarding the backup list returned by the backend.
+- The public legacy direct `switch_runtime` command is removed.
+
+## Source Freeze Gates
+
+- Rust tests: 230 passed, 0 failed.
+- Clippy: `cargo clippy --all-targets -- -D warnings` passed.
+- Frontend production build: 113 modules passed.
+- Frontend acceptance selectors: 268 passed.
+- Visual acceptance: 30 passed, 0 failed.
+- Feature acceptance: 300 total; 254 passed, 0 failed, 40 policy skips, and 6 manual/policy records.
+- P0 and P1 failures: 0.
+- Backend-only, UI-only, missing, partial, deferred, and toast-only release features: 0.
+- Backend/UI drift: 191 registered commands, 158 frontend invokes, and 152 manifest commands.
+- Tauri command, frontend data/action/quality/localization, safety wording, repository hygiene, and release consistency gates passed.
+- GitHub Actions run `30529048257` for exact source commit `4137fbe` passed.
+
+The 40 safe skips are destructive, privileged, or installed-application actions that safe mode deliberately does not repeat. The six manual/policy records cover disposable process termination, previously retained Windows feature/service/database evidence, and advanced visual policy. They do not represent failed or missing P0/P1 functionality.
+
+## Exact Asset Identity
+
+| Bundle | Publication file | Size | SHA256 | Signature |
+|---|---|---:|---|---|
+| NSIS | `DevEnv.Manager_1.9.1_x64-setup.exe` | 2,951,926 bytes | `ce4b9020d47258dd1668f0237a0b3fd0b061ddfc20c938fed56f5ddcf5cd0352` | NotSigned |
+| MSI | `DevEnv.Manager_1.9.1_x64_en-US.msi` | 4,943,872 bytes | `cf26c80e2f67eb61b3c000e8bb91dd30af96deb6131268ec8350819e85a540c3` | NotSigned |
+
+Both assets were produced by one `tauri build` from exact source commit `4137fbe`. The package names, application metadata, architecture, file version, product version, and uninstall registration report v1.9.1/x64. Earlier v1.9.1 candidate assets were moved outside the repository and must not be uploaded.
+
+The standalone build executable is not a publication asset. Tauri applies bundle-specific metadata while creating MSI and NSIS payloads, so installed payload hashes are recorded separately: NSIS `37c47280fced8976fe1e7627e3a771acb8874ee7e0f63dfd9b430eb28054620a`; MSI `c63aae7a6bcaf7a0810a5e508567c4ee496e4fa0d95dd74efb9de3bef1fd438e`. Both installed executables are 7,010,816 bytes and report file/product version 1.9.1.
+
+## Exact-HEAD ReleaseLab Evidence
+
+The final NSIS and MSI matched their expected size and SHA256 after transfer into the isolated Windows guest under `DEVENV\ReleaseLabAdmin`.
+
+- NSIS installation registered and launched v1.9.1.
+- Managed Node 20 to Node 22 switching completed through plan, token, execution, and strong verification.
+- The managed switch backup restored Node 20.
+- A strongly verified external Node 22 installation was adopted into the user environment and restored to managed Node 20.
+- SHA256 and size for every file in the external Runtime directory were unchanged after adoption and restore.
+- After terminating and restarting DevEnv Manager, ten persistent, restorable switch backups were visible on the first Runtime page load.
+- High Contrast Runtime UI rendered with readable controls, plan state, recovery controls, managed rows, and external rows.
+- MSI installation returned exit code 0, registered product code `{FC9AB002-A4A7-4801-B40B-1280300FE79B}`, launched v1.9.1, and removed its uninstall registration after silent uninstall.
+- The frozen published v1.9.0 NSIS installed successfully and upgraded to v1.9.1 with exit code 0.
+- Upgrade preserved the exact settings SHA256 `923239a310c957dc32b9b4faffa8282d1db1d142f7928ff33dfa4deef9622504`.
+- Upgrade preserved the exact Profile SHA256 `a19c3715f3b4199c6e6e2ca7313418c1e15280adf8611f94edd6b45b47e93bfe`, and the test Profile remained visible.
+- Final cleanup left zero DevEnv Manager processes and zero uninstall registrations, and restored the test user's environment.
+
+Raw evidence is retained in the Git-ignored `artifacts/release-lab/v1.9.1/4137fbe/` directory.
+
+## Non-Blocking Disclosures
+
+- The bundles are not Authenticode-signed. Windows may show its normal trust warning.
+- NSIS uninstaller self-removal left normal temporary `~nsu*.tmp` pending-delete records; no DevEnv Manager process, registration, or installed product remained.
+- Safe acceptance deliberately does not terminate arbitrary user processes or repeat Windows feature, service, or database mutations.
+- Advanced-mode visual and policy behavior remains a manual acceptance item.
+- External Runtime adoption changes only the verified user/provider/project selection. It does not add full external installation or uninstall lifecycle.
+- Issue #130 remains open for broader Runtime lifecycle work. Issue #133 remains open for the application-internal Acceptance Center. Tracking issues with remaining content must not be closed by this release.
+
+## Release Decision
+
+The reviewed source, assets, CI, Runtime workflow, restart recovery, MSI lifecycle, and v1.9.0 upgrade path have no release blocker. The candidate may proceed through PR merge, target-branch CI, tag, GitHub Release, Gitee Release, online asset verification, and update-channel smoke in that order.

scripts/check_frontend_data_contracts.py

@@ -86,7 +86,13 @@ def main() -> int:
 
     runtime_render = read("tauri/src/features/runtimes/render.ts")
     runtime_events = read("tauri/src/features/runtimes/events.ts")
-    if "runtime.managed ? renderManagedActions(runtime) : renderExternalActions(runtime)" not in runtime_render:
+    separate_runtime_actions = (
+        "runtime.managed ? renderManagedActions(runtime) : renderExternalActions(runtime)"
+        in runtime_render
+        or "runtime.managed ? renderManagedActions(runtime, state) : renderExternalActions(runtime, state)"
+        in runtime_render
+    )
+    if not separate_runtime_actions:
         return fail("Runtimes must render managed and external runtimes through separate action paths")
     for required in ["createRuntimeSwitchPlan", "executeRuntimeSwitchPlan", "uninstallRuntime(kind, version, path"]:
         if required not in runtime_events: