fix(deploy): nx 上帝菜单巡检修补 1panel-network 与升级竞态

purge 阶段 compose 叠加 1panel overlay；菜单启动/重建与回滚后校验网络；install-auto 已安装改走 update。

Co-authored-by: Cursor <cursoragent@cursor.com>

deploy/nexus-1panel.sh

@@ -436,6 +436,7 @@ rollback_compose_upgrade() {
         warn "健康检查失败，回滚至上一镜像..."
         docker tag nexus-prod-nexus:rollback nexus-prod-nexus:latest 2>/dev/null || true
         compose_cmd "$root" up -d --no-build --remove-orphans
+        verify_nexus_1panel_network "$root" || true
         return 0
     fi
     warn "无回滚镜像 nexus-prod-nexus:rollback，跳过自动回滚"
@@ -1159,8 +1160,13 @@ cmd_upgrade() {
         rollback_compose_upgrade "$NEXUS_ROOT" || true
         exit 1
     fi
-    local port wiz_code
+    local port wiz_code i health
     port="$(nexus_publish_port "$NEXUS_ROOT")"
+    for i in $(seq 1 30); do
+        health="$(curl -sf "http://127.0.0.1:${port}/health" 2>/dev/null || true)"
+        [[ "$health" == "ok" ]] && break
+        sleep 2
+    done
     wiz_code="$(curl -s -o /dev/null -w '%{http_code}' "http://127.0.0.1:${port}/app/install.html" 2>/dev/null || echo "000")"
     if [[ "$wiz_code" != "200" && -x "$NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh" ]]; then
         NEXUS_PUBLISH_PORT="$port" NEXUS_ROOT="$NEXUS_ROOT" bash "$NEXUS_ROOT/deploy/sync-install-wizard-to-container.sh"

deploy/nx

@@ -34,7 +34,11 @@ detect_runtime() {
         local prof q
         prof="$(profile_env_file "$NEXUS_ROOT")"
         if [[ -f "$prof" && -f "$NEXUS_ROOT/$ENV_PROD" ]]; then
-            q="$(cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" \
+            local -a det_args=(-f "$COMPOSE_FILE")
+            if has_1panel_network && [[ -f "$NEXUS_ROOT/$COMPOSE_1PANEL" ]]; then
+                det_args+=(-f "$COMPOSE_1PANEL")
+            fi
+            q="$(cd "$NEXUS_ROOT" && docker compose "${det_args[@]}" \
                 --env-file "$ENV_PROD" --env-file "$prof" ps -q nexus 2>/dev/null || true)"
             if [[ -n "$q" ]]; then
                 NX_RUNTIME="docker"
@@ -174,6 +178,7 @@ ops_stop_stack() {
 
 ops_start_stack() {
     compose_cmd "$NEXUS_ROOT" up -d --remove-orphans
+    verify_nexus_1panel_network "$NEXUS_ROOT" || return 1
     verify_health "$NEXUS_ROOT" "启动" || true
 }
 
@@ -309,6 +314,7 @@ EOF
                     compose_cmd "$NEXUS_ROOT" build --no-cache nexus
                 fi
                 compose_cmd "$NEXUS_ROOT" up -d --build --remove-orphans nexus
+                verify_nexus_1panel_network "$NEXUS_ROOT" || true
                 verify_health "$NEXUS_ROOT" "重建" || true
                 pause_enter
                 ;;
@@ -368,7 +374,8 @@ nx_main() {
         install-auto|auto)
             require_root
             if is_stack_installed; then
-                run_install "${NEXUS_PROFILE:-2c8g}" skip-clone
+                warn "已安装，install-auto 将执行升级而非重复安装"
+                exec bash "${NX_DIR}/update.sh"
             else
                 run_install "${NEXUS_PROFILE:-2c8g}" ""
             fi

deploy/uninstall-mysql-compose.sh

@@ -83,7 +83,12 @@ if [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" ]] && grep -q '^  mysql:' "${NEXUS_ROOT
     removed=$((removed + 1))
 elif [[ -f "${NEXUS_ROOT}/${COMPOSE_FILE}" && -f "${NEXUS_ROOT}/docker/.env.prod" ]]; then
     info "Compose --remove-orphans（从 nexus-prod 项目移除 mysql 孤儿容器）..."
-    (cd "$NEXUS_ROOT" && docker compose -f "$COMPOSE_FILE" "${local_env[@]}" up -d --remove-orphans 2>/dev/null || true)
+    compose_files=(-f "${NEXUS_ROOT}/${COMPOSE_FILE}")
+    if docker network inspect 1panel-network >/dev/null 2>&1 \
+        && [[ -f "${NEXUS_ROOT}/docker/docker-compose.1panel.yml" ]]; then
+        compose_files+=(-f "${NEXUS_ROOT}/docker/docker-compose.1panel.yml")
+    fi
+    (cd "$NEXUS_ROOT" && docker compose "${compose_files[@]}" "${local_env[@]}" up -d --remove-orphans 2>/dev/null || true)
     while IFS= read -r c; do
         [[ -z "$c" ]] && continue
         stop_rm_container "$c"

docs/changelog/2026-06-06-install-lock-persist-1panel-network-guard.md

@@ -24,9 +24,16 @@
 - 需重建 Nexus 镜像（entrypoint 变更）并 `compose up`。
 - 无 DB 迁移。
 
+## 后续修补（nx 上帝菜单巡检）
+
+- `uninstall-mysql-compose.sh`：`compose up` 叠加 `docker-compose.1panel.yml`，避免升级 purge 阶段摘掉 `1panel-network`。
+- `deploy/nx`：`ops_start_stack` / 菜单 `[8]` 重建后调用 `verify_nexus_1panel_network`；`install-auto` 已安装时改走 `update.sh`。
+- `cmd_upgrade`：同步 install.html 前等待 `/health`，减少误触发 `sync-install-wizard` 重启。
+
 ## 验证
 
 ```bash
+bash -n deploy/nx && bash -n deploy/nexus-1panel.sh && bash -n deploy/uninstall-mysql-compose.sh
 pytest tests/test_security_unit.py -k "sync_lock or install_reject" -q
 # 升级后容器应同时在 1panel-network 与 nexus-internal
 docker inspect nexus-prod-nexus-1 --format '{{range $k,$v := .NetworkSettings.Networks}}{{$k}} {{end}}'