docs(official-bundles): limit the protected-list contract to its own refusal

packages/client/ui-plugin-manager/src/client/PluginManagerPage.tsx

@@ -100,7 +100,7 @@ function AddPluginMenu({ t, disabled, openInstall, renderSlot }: {
 const HIGHLIGHT_MS = 2_400
 
 /**
- * Whether the main list shows an official optional bundle: the always-held ones, and any held-back one the profile enabled.
+ * Whether the main list shows an official optional bundle: any bundle outside `MORE_BUNDLES`, and any held-back one the profile enabled.
  * @param pkg - the official bundle as the Host reports it.
  * @returns whether the main list shows it.
  */
@@ -109,14 +109,14 @@ function pinnedToMainList(pkg: PackageView): boolean {
 }
 
 /**
- * Where an optional bundle sits on both lists: the always-held ones in their order, then the bundles neither list
+ * Where an optional bundle sits on both lists: the `EXTENSION_BUNDLES` in their order, then the bundles neither list
  * ranks, then the held-back ones in theirs, so Codex and Claude Code stay last on the More list.
  * @param name - the bundle's package name.
  * @returns the rank; bundles of equal rank keep the order the Host reported.
  */
 function optionalBundleRank(name: string): number {
-  const alwaysHeld = EXTENSION_BUNDLES.indexOf(name)
-  if (alwaysHeld >= 0) return alwaysHeld
+  const ranked = EXTENSION_BUNDLES.indexOf(name)
+  if (ranked >= 0) return ranked
   const heldBack = MORE_BUNDLES.indexOf(name)
   return heldBack < 0 ? EXTENSION_BUNDLES.length : EXTENSION_BUNDLES.length + 1 + heldBack
 }

packages/util/README.i18n.yaml

@@ -9,14 +9,14 @@
   en: 7283f2afb343d150
   zh: 32c56bd67c0314c6
 /util-shared-utilities/summary:
-  en: 3145a767f6ea7e1d
-  zh: 2c44a18a18f89462
+  en: ed8863365a68c0ef
+  zh: 4bcff265d4d5694e
 /util-shared-utilities/table-of-contents:
   en: 1eb35b015a6c423f
   zh: a8a3dceee2c9e943
 /util-shared-utilities/packages:
-  en: 069dbd056a60b42d
-  zh: d11751704d34daf4
+  en: 5d7eb32e5a9e81dc
+  zh: 5e419d4b44ffbd10
 /util-shared-utilities/related-documentation:
   en: 432ae81110914571
   zh: c5bf4efc007311f3

packages/util/README.md

@@ -9,7 +9,7 @@ English | [中文](README.zh.md)
 
 ## Summary
 
-The `util/` group gives capability packages shared mechanical primitives instead of duplicate implementations. It covers atomic writes, branded ids, deques, lossless JSON values, UUIDs, Harness-home paths, launch environments, outbound proxy policy, native commands, output retention, time-zone, instant, and span vocabulary, and timeout handling. Every root entry here is a library: it registers no product service or event, and the consuming capability retains the business semantics. The exception is `official-bundles`, which holds the installation's and the plugin manager's official package lists as data that their consumers apply.
+The `util/` group gives capability packages shared mechanical primitives instead of duplicate implementations. It covers atomic writes, branded ids, deques, lossless JSON values, UUIDs, Harness-home paths, launch environments, outbound proxy policy, native commands, output retention, time-zone, instant, and span vocabulary, and timeout handling. Every root entry here is a library: it registers no product service or event, and the consuming capability retains the business semantics. The exception is `official-bundles`: instead of a mechanical primitive, it holds the installation's and the plugin manager's official package lists as data their consumers apply.
 
 ## Table of Contents
 
@@ -22,7 +22,7 @@ The `util/` group gives capability packages shared mechanical primitives instead
 <a id="packages"></a>
 ## Packages
 
-Each package provides one primitive; open a package page for how to use it.
+Each package provides one primitive or one data set; open a package page for how to use it.
 
 | Package | Role |
 |---|---|

packages/util/README.zh.md

@@ -9,7 +9,7 @@ kind: "package-group"
 
 ## 概述
 
-`util/` 组为能力包提供共享的机制原语，避免重复实现。它涵盖原子写入、品牌化 id、双端队列、无损 JSON 值、UUID、Harness home 路径、启动环境、出站代理策略、原生命令、输出保留、时区、时刻与时间段词汇，以及超时处理。这里的每个根入口都是库：它不注册产品服务或事件，业务语义仍由消费它的能力负责。例外是 `official-bundles`，它以纯数据形式保存安装方和插件管理器的官方包列表，由各自的消费方应用。
+`util/` 组为能力包提供共享的机制原语，避免重复实现。它涵盖原子写入、品牌化 id、双端队列、无损 JSON 值、UUID、Harness home 路径、启动环境、出站代理策略、原生命令、输出保留、时区、时刻与时间段词汇，以及超时处理。这里的每个根入口都是库：它不注册产品服务或事件，业务语义仍由消费它的能力负责。例外是 `official-bundles`：它不是机制原语，而是以纯数据形式保存安装方和插件管理器的官方包列表，由各自的消费方应用。
 
 ## 目录
 
@@ -22,7 +22,7 @@ kind: "package-group"
 <a id="packages"></a>
 ## 包
 
-每个包提供一个原语；打开对应包页面了解如何使用。
+每个包提供一个原语或一组数据；打开对应包页面了解如何使用。
 
 | 包 | 职责 |
 |---|---|

packages/util/official-bundles/README.i18n.yaml

@@ -24,14 +24,14 @@
   en: 8d94e2b44efb9c1d
   zh: c049a19e471d188b
 /deepseek-ai-dsh-official-bundles/use-this-package/plugin-manager-lists:
-  en: fbde1ba9d7a235b2
-  zh: 780c862638d7e066
+  en: 27c22abdfff69a41
+  zh: e60d828cdb75c263
 /deepseek-ai-dsh-official-bundles/use-this-package/on-demand-bundles:
   en: 10dac368736afde3
   zh: 7684ca22ba4b5a67
 /deepseek-ai-dsh-official-bundles/understand-the-implementation:
-  en: f2af3b37ae2a9598
-  zh: 943f1f69a3deb925
+  en: 3fb2b58db529d8be
+  zh: 46064459a23d458d
 /deepseek-ai-dsh-official-bundles/understand-the-implementation/source-map:
   en: bbd3b4f82e6349d9
   zh: f1e056d14620519d

packages/util/official-bundles/README.md

@@ -37,7 +37,7 @@ Edit this package when the installation's bundle selection or the plugin manager
 <a id="plugin-manager-lists"></a>
 ### Plugin manager lists
 
-`PROTECTED_PLUGINS` names the plugin packages the [plugin manager](../../boot/plugin-manager/README.md) keeps read-only because management needs them; a bundle that contains one is a management bundle. Removing a name lets the Web page and the `plugin_manager` tool disable or remove that package and its bundle. The [Web plugin page](../../client/ui-plugin-manager/README.md) hides the `HIDDEN_BUNDLES`, ranks the `EXTENSION_BUNDLES` first in their order, keeps the `MORE_BUNDLES` off its main list until the profile enables them, and marks the `EXPERIMENTAL_BUNDLES` with the Experimental badge.
+`PROTECTED_PLUGINS` names the plugin packages the [plugin manager](../../boot/plugin-manager/README.md) keeps read-only because management needs them; a bundle that contains one is a management bundle. Removing a name drops only this `management-required` refusal; the manager's own entry, installation-carried bundles, and unaddressable rows stay protected by their own rules. The [Web plugin page](../../client/ui-plugin-manager/README.md) hides the `HIDDEN_BUNDLES`, ranks the `EXTENSION_BUNDLES` first in their order, keeps the `MORE_BUNDLES` off its main list until the profile enables them, and marks the `EXPERIMENTAL_BUNDLES` with the Experimental badge.
 
 ### On-demand bundles
 
@@ -51,7 +51,7 @@ Edit this package when the installation's bundle selection or the plugin manager
 <details>
 <summary>Implementation internals — click to expand</summary>
 
-Repository checks read the lists in `src/bundles.ts` as TypeScript literals without executing them, so each list stays a static array or object literal of package names. `ui-plugin-manager` inlines `src/plugin-manager.ts` into its browser bundle through `INLINE_SAFE` in [`tsdown.client.ts`](../../client/tsdown.client.ts), so its exports stay plain data without runtime identity; tree-shaking keeps the generated catalog out of that bundle while no Client code imports it.
+Repository checks read the lists in `src/bundles.ts` as TypeScript literals without executing them, so each list stays a static array or object literal of package names. `INLINE_SAFE` in [`tsdown.client.ts`](../../client/tsdown.client.ts) lets Client bundles inline this whole package, so every export stays data with no runtime identity to share. `ui-plugin-manager` imports the Web lists from the package root, and tree-shaking keeps the profile templates and the generated catalog out of its bundle while no Client code imports them.
 
 ### Source map
 

packages/util/official-bundles/README.zh.md

@@ -37,7 +37,7 @@ kind: "package-library"
 <a id="plugin-manager-lists"></a>
 ### 插件管理器列表
 
-`PROTECTED_PLUGINS` 列出[插件管理器](../../boot/plugin-manager/README.zh.md)因管理功能依赖而保持只读的插件包；包含其中任一插件的组合包是管理组合包。移除其中一项后，Web 插件页和 `plugin_manager` 工具就能禁用或移除该包及其所在组合包。[Web 插件页](../../client/ui-plugin-manager/README.zh.md)隐藏 `HIDDEN_BUNDLES`，把 `EXTENSION_BUNDLES` 按顺序排在最前，在 profile 启用 `MORE_BUNDLES` 之前不把它们放上主列表，并为 `EXPERIMENTAL_BUNDLES` 显示实验性标记。
+`PROTECTED_PLUGINS` 列出[插件管理器](../../boot/plugin-manager/README.zh.md)因管理功能依赖而保持只读的插件包；包含其中任一插件的组合包是管理组合包。移除其中一项只解除这一条 `management-required` 拒绝；管理器自身的入口、随安装提供的组合包和不可寻址的行仍由各自的规则保护。[Web 插件页](../../client/ui-plugin-manager/README.zh.md)隐藏 `HIDDEN_BUNDLES`，把 `EXTENSION_BUNDLES` 按顺序排在最前，在 profile 启用 `MORE_BUNDLES` 之前不把它们放上主列表，并为 `EXPERIMENTAL_BUNDLES` 显示实验性标记。
 
 ### 按需组合包
 
@@ -51,7 +51,7 @@ kind: "package-library"
 <details>
 <summary>实现细节——点击展开</summary>
 
-仓库检查把 `src/bundles.ts` 中的列表当作 TypeScript 字面量读取而不执行，因此每个列表都保持为由包名组成的静态数组或对象字面量。`ui-plugin-manager` 通过 [`tsdown.client.ts`](../../client/tsdown.client.ts) 中的 `INLINE_SAFE` 把 `src/plugin-manager.ts` 内联进浏览器 bundle，因此它的导出保持为没有运行时同一性的纯数据；只要没有 Client 代码导入生成的目录，tree-shaking 就会让目录数据不进入该 bundle。
+仓库检查把 `src/bundles.ts` 中的列表当作 TypeScript 字面量读取而不执行，因此每个列表都保持为由包名组成的静态数组或对象字面量。[`tsdown.client.ts`](../../client/tsdown.client.ts) 中的 `INLINE_SAFE` 允许 Client bundle 内联整个包，因此每个导出都保持为没有需要共享的运行时身份的数据。`ui-plugin-manager` 从包入口导入 Web 列表；只要没有 Client 代码导入 profile 模板和生成的目录，tree-shaking 就会让它们不进入该 bundle。
 
 ### 源码地图
 

packages/util/official-bundles/src/plugin-manager.ts

@@ -2,8 +2,8 @@
 
 /**
  * Plugin packages the plugin manager refuses to disable or remove, because management itself needs them; a bundle that
- * contains one is read-only as well. Removing a name lets the Web page and the `plugin_manager` tool disable or remove
- * that package and its bundle.
+ * contains one is read-only as well. Removing a name drops only this `management-required` refusal; the manager's own
+ * entry, installation-carried bundles, and unaddressable rows stay protected by their own rules.
  */
 export const PROTECTED_PLUGINS: ReadonlySet<string> = new Set([
   '@deepseek-ai/dsh-plugin-manager', '@deepseek-ai/cordis-plugin-loader',