基准扩展 exhaustive（文档化）+ 12→0：枚举 switch 补显式 case（全部与现有 default 行为等价，fail-explicit 防未来枚举静默落入 default）；source_tasks.go 为控制复杂度合并两个等价校验条件。

Result: {"status":"keep","total_issues":8,"golint_canonicalheader":0,"golint_errname":0,"golint_errorlint":1,"golint_exhaustive":0,"golint_forcetypeassert":0,"golint_gosec":0,"golint_intrange":0,"golint_modernize":3,"golint_nilnil":3,"golint_perfsprint":0,"golint_prealloc":0,"golint_recvcheck":1,"golint_usestdlibvars":0,"golint_wastedassign":0,"golint_total":8,"golint_test_testifylint":0,"golint_test_thelper":0,"golint_test_usetesting":0,"golint_test_total":0,"eslint_problems":0,"eslint_errors":0,"eslint_warnings":0,"tsc_errors":0,"measure_s":36}

internal/apps/agent/sync/sync_helpers.go

@@ -220,6 +220,9 @@ func updateSnapshotFromApplyOutcome(mode string, snapshot *state.Snapshot, confi
 		snapshot.OpenrestyStatus = protocol.OpenrestyStatusHealthy
 		snapshot.OpenrestyMessage = result.message
 		result.reportResult = ApplyResultWarning
+	case nginx.ApplyStatusFatal:
+		// 致命错误与普通失败同走失败路径：标记阻塞并上报 Unhealthy。
+		fallthrough
 	default:
 		if result.message == "" {
 			result.message = "openresty apply failed"

internal/apps/openflare/node/helpers.go

@@ -309,6 +309,8 @@ func fetchLatestGitHubRelease(ctx context.Context, repo string, channel releaseC
 	switch normalizeReleaseChannel(string(channel)) {
 	case releaseChannelPreview:
 		return fetchLatestPreviewGitHubRelease(ctx, repo)
+	case releaseChannelStable:
+		return fetchLatestStableGitHubRelease(ctx, repo)
 	default:
 		return fetchLatestStableGitHubRelease(ctx, repo)
 	}

internal/apps/openflare/pages/helpers.go

@@ -226,6 +226,8 @@ func safeTempSuffix(format pagesarchive.Format) string {
 		return "7z"
 	case pagesarchive.FormatTar:
 		return "tar"
+	case pagesarchive.FormatZip:
+		return "zip"
 	default:
 		return "zip"
 	}

internal/apps/openflare/pages/source_orphan_cleanup.go

@@ -111,6 +111,8 @@ func (summary *PagesOrphanCleanupSummary) add(outcome pagesOrphanCleanupOutcome)
 		summary.LeaseBusy++
 	case pagesOrphanCleanupInvalidMarker:
 		summary.InvalidMarker++
+	case pagesOrphanCleanupSkipped:
+		summary.Skipped++
 	default:
 		summary.Skipped++
 	}

internal/apps/openflare/pages/source_scanner.go

@@ -266,6 +266,8 @@ func scanOneDueGitHubSource(
 	case sourceLeaseStale:
 		summary.StaleSources++
 		return
+	case sourceLeaseAcquired:
+		// 获取执行权成功，继续执行扫描。
 	}
 	if snapshot == nil || snapshot.SourceType != PagesSourceTypeGitHubRelease ||
 		snapshot.ReleaseSelector != githubReleaseSelectorLatest {

internal/apps/openflare/pages/source_tasks.go

@@ -154,10 +154,8 @@ func (h *SourceActionHandler) Execute(ctx context.Context, payload []byte) (*tas
 	if source.SourceType != PagesSourceTypeRemoteURL && source.SourceType != PagesSourceTypeGitHubRelease {
 		return nil, task.PermanentError(errPagesSourceTypeUnsupported)
 	}
-	if source.SourceType == PagesSourceTypeRemoteURL && (input.TargetRevision != "" || input.ConfirmedRevision != "") {
-		return nil, task.PermanentError(errPagesSourceActionInvalid)
-	}
-	if input.Action == sourceActionCheck && (input.TargetRevision != "" || input.ConfirmedRevision != "") {
+	if (source.SourceType == PagesSourceTypeRemoteURL || input.Action == sourceActionCheck) &&
+		(input.TargetRevision != "" || input.ConfirmedRevision != "") {
 		return nil, task.PermanentError(errPagesSourceActionInvalid)
 	}
 
@@ -174,6 +172,8 @@ func (h *SourceActionHandler) Execute(ctx context.Context, payload []byte) (*tas
 	case sourceLeaseStale:
 		task.AppendLog(ctx, "[resolve] 来源配置或执行权已变化，本次任务跳过")
 		return &task.TaskResult{Message: errPagesSourceActionStale}, nil
+	case sourceLeaseAcquired:
+		// 已获取执行权，继续执行。
 	}
 
 	if input.Action == sourceActionCheck {

internal/apps/openflare/waf/graph_validate.go

@@ -383,6 +383,8 @@ func requiredHandles(t RuleNodeType) []string {
 		return []string{"next"}
 	case RuleNodeIPMatch, RuleNodeGeoMatch, RuleNodeUACheck, RuleNodeSecurityCheck:
 		return []string{"true", "false"}
+	case RuleNodeAllow, RuleNodeBlock:
+		return nil
 	default:
 		return nil
 	}

internal/apps/upload/filesrv/file_server.go

@@ -134,6 +134,8 @@ func ServeUpload(c *gin.Context, upload *model.Upload) {
 			return
 		}
 		fallthrough
+	case fileTypeVideo, fileTypeAudio, fileTypeOther:
+		serveOriginalWithConditionalCheck(c, upload)
 	default:
 		serveOriginalWithConditionalCheck(c, upload)
 	}

internal/apps/upload/ingest/ingest.go

@@ -54,6 +54,8 @@ func ingestWithHashPolicy(ctx context.Context, req Request) (Result, error) {
 				return Result{}, ErrStorageReadOnly
 			}
 			return createDedupRecord(ctx, existing, req)
+		case PolicyCreate:
+			// 忽略已存在记录，走下方的新建流程。
 		}
 	}
 	if err != nil && !errors.Is(err, gorm.ErrRecordNotFound) {