@dsh-remote/relay 3.2.10 → 3.2.12

package/README.md

@@ -37,12 +37,12 @@ curl -s http://127.0.0.1:8787/healthz
 
 ### 端点
 
-| 路径                   | 说明                                                                                                                                                                                                                                                                                                                                                                                                                                     |
-| ---------------------- | ---------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
-| `GET /healthz`         | 运维契约（**二十四个字段**）：`ok` / `version` / `uptimeSec` / `hosts` / `clients` / `conversations` / `pendingPairs` / `hostTokens` / `droppedFrames` / `slowConsumers` / `rejectedPairs` / `shutdownForced` / `persistence` / `stateRestored` / `stateSavedAtSec` / `stateWrites` / `stateWriteFailures` / `lastPingAgo` / `shuttingDown` / `protocolSelf` / `protocolMin` / `peerProtocolMin` / `peerProtocolMax` / `peersNoProtocol` |
-| `GET /api/info`        | `{"publicUrl","protocol"}`                                                                                                                                                                                                                                                                                                                                                                                                               |
-| `GET /api/pair-status` | **默认 404**。无需认证地回答"配对码 N 是否有效"等于给 6 位码空间装了扫描 oracle；确需调试时 `DRC_PAIR_STATUS=1`，用完关掉                                                                                                                                                                                                                                                                                                                |
-| WebSocket              | 路径不设限，任意路径都能升级                                                                                                                                                                                                                                                                                                                                                                                                             |
+| 路径                   | 说明                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      |
+| ---------------------- | ----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| `GET /healthz`         | 运维契约（**二十六个字段**）：`ok` / `version` / `uptimeSec` / `hosts` / `clients` / `conversations` / `pendingPairs` / `hostTokens` / `droppedFrames` / `slowConsumers` / `rejectedPairs` / `shutdownForced` / `persistence` / `stateRestored` / `stateSavedAtSec` / `stateWrites` / `stateWriteFailures` / `lastPingAgo` / `shuttingDown` / `protocolSelf` / `protocolMin` / `peerProtocolMin` / `peerProtocolMax` / `peersNoProtocol` / `replayRingConversations` / `replayRingFrames` |
+| `GET /api/info`        | `{"publicUrl","protocol"}`                                                                                                                                                                                                                                                                                                                                                                                                                                                                |
+| `GET /api/pair-status` | **默认 404**。无需认证地回答"配对码 N 是否有效"等于给 6 位码空间装了扫描 oracle；确需调试时 `DRC_PAIR_STATUS=1`，用完关掉                                                                                                                                                                                                                                                                                                                                                                 |
+| WebSocket              | 路径不设限，任意路径都能升级                                                                                                                                                                                                                                                                                                                                                                                                                                                              |
 
 落盘五字段（`persistence` / `stateRestored` / `stateSavedAtSec` / `stateWrites` /
 `stateWriteFailures`）是"还在落盘"的唯一读数——换机器先看 `stateWriteFailures`，不是 0 就是没在写。

package/deploy/docker/compose.yaml

@@ -65,7 +65,7 @@ services:
       DRC_STATE_SAVE_MS: ${DRC_STATE_SAVE_MS:-60000}
       DRC_MAX_CONNS: ${DRC_MAX_CONNS:-200}
       DRC_CONV_IDLE_TTL_MS: ${DRC_CONV_IDLE_TTL_MS:-604800000}
-      DRC_HOST_GRACE_MS: ${DRC_HOST_GRACE_MS:-120000}
+      DRC_HOST_GRACE_MS: ${DRC_HOST_GRACE_MS:-600000}
       # 小程序码签发（2026-10-21「双码合一」）：**只有中继持有小程序的 appSecret**，
       # 主机插件那份永远拿不到它。两个都配了才启用 `GET /code?token=`；
       # 不配（自部署常态）那条路由回 501，主机自动回落到旧 `dshr:` 码。

package/dist/bundle/main.js

@@ -23443,7 +23443,7 @@ function date4(params) {
   return _coercedDate(ZodDate, params);
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/limits.js
 var MAX_RELAY_MESSAGE_BYTES = 1024 * 1024;
 var MAX_CIPHERTEXT_BYTES = MAX_RELAY_MESSAGE_BYTES - 8 * 1024;
 var MAX_IMAGE_ATTACHMENTS = 4;
@@ -23452,7 +23452,7 @@ var MAX_ATTACHMENT_BYTES = 512 * 1024;
 var MAX_ATTACHMENT_TOTAL_BYTES = 512 * 1024;
 var IDEMPOTENCY_WINDOW_MS = 5 * 60 * 1e3;
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/frames.js
 var PROTOCOL_VERSION = 1;
 var PAIRING_TOKEN_RE = /^\d{6}$/;
 var nonEmpty = external_exports.string().min(1);
@@ -23498,7 +23498,39 @@ var helloFrame = external_exports.object({
    * 它**不是**协议协商位：两端**永远不因它不同而拒连**（版本兼容性由各自的应用层判，
    * 见小程序的 `MIN_PLUGIN_VERSION`）⇒ 它只是给人看的读数。
    */
-  softwareVersion: external_exports.string().min(1).max(64).optional()
+  softwareVersion: external_exports.string().min(1).max(64).optional(),
+  /**
+   * 断线补帧请求（P1-3，2026-10-22）：客户端告诉中继"我上次收到这里，
+   * 断线期间的下行帧请从环形缓冲里补给我"。
+   *
+   * ## 为什么搭 `hello` 而不是单独发一帧 `resume`
+   *
+   * 竞态：客户端重连后 socket 一进成员表，主机的下行帧就会**立刻**推给它；
+   * 而一条独立的 `resume` 帧要等下一个事件循环才被处理 —— 中间挤进来的
+   * live 帧会**先于**回放到达（重连发生在输出流中段时几乎必然）。要么在客户端
+   * 做重排缓冲 + 去重，要么在中继侧按 socket 暂停投递 —— 两边都比问题本身大。
+   * 搭 `hello` 则整段（鉴权、进表、回放）在**同一个同步处理**里完成：
+   * 回放帧先于 socket 进入投递表，顺序由构造保证，客户端一行重排代码都不用。
+   *
+   * ## 为什么这是加性变更（§15.1 第一行：新增可选字段，不升 PROTOCOL_VERSION）
+   *
+   * - **旧中继 × 新客户端**：旧 schema 没有这一格 ⇒ zod strip 掉、静默忽略 ⇒
+   *   行为与加这个字段之前逐字节相同（客户端退回收不到回放，走既有历史重读）。
+   *   **不会**回 `unknown_frame` —— 这正是不发独立帧的第二个好处。
+   * - **新中继 × 旧客户端**：旧客户端不填 ⇒ 不回放 ⇒ 逐字节现状。
+   * - F2（client 只发 3 类帧 + `session-leave`）**不动**：没有新增客户端出站帧名。
+   *
+   * ⚠️ 只有 `role:'client'` 有意义；主机带了会被忽略（没有"主机断线补下行"的场景）。
+   * ⚠️ 只补**当前配对那一条**会话（小程序同时只有一条有效 convId）。
+   * ⚠️ `fromSeq` 是**中继编号**（`enc`/`enc-batch` 里的 `seq`），不是主机历史游标
+   *   `latestSeq` —— 两个序号空间互不相干，混用的症状是"补回来一段莫名其妙的内容"。
+   */
+  resume: external_exports.object({
+    /** 配对通道 id（与 `enc.sessionId` 同义，F3）。 */
+    sessionId: nonEmpty,
+    /** 已收到的最大中继编号；中继回放 `seq > fromSeq` 的存帧。0 = 一帧都没收到过。 */
+    fromSeq: external_exports.number().int().nonnegative()
+  }).optional()
 });
 var publicKeyB64 = external_exports.string().regex(/^[A-Za-z0-9+/]{43}=$/, "\u5FC5\u987B\u662F 32 \u5B57\u8282 base64 \u516C\u94A5");
 var pairBeginFrame = external_exports.object({
@@ -23723,6 +23755,11 @@ var errorFrame = external_exports.object({
   retryAfterMs: external_exports.number().int().positive().max(3e5).optional()
 });
 var pongFrame = external_exports.object({ t: external_exports.literal("pong"), ts: external_exports.number().optional() });
+var resumeGapFrame = external_exports.object({
+  t: external_exports.literal("resume-gap"),
+  sessionId: nonEmpty,
+  reason: external_exports.enum(["overflow", "reset"])
+});
 var relayFrame = external_exports.discriminatedUnion("t", [
   helloOkFrame,
   pairReadyFrame,
@@ -23736,14 +23773,15 @@ var relayFrame = external_exports.discriminatedUnion("t", [
   errorFrame,
   pongFrame,
   encFrame,
-  encBatchFrame
+  encBatchFrame,
+  resumeGapFrame
 ]);
 function parseEndpointFrame(value) {
   const parsed = endpointFrame.safeParse(value);
   return parsed.success ? parsed.data : null;
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/report-version.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/report-version.js
 var REPORT_VERSION_ENV = "DRC_REPORT_VERSION";
 function reportSoftwareVersion(env) {
   const raw = (env[REPORT_VERSION_ENV] ?? "").trim().toLowerCase();
@@ -23933,7 +23971,12 @@ function loadConfig(env, version2) {
     // 删的代价是手机再扫一次码；不删的代价是 conversations 计数虚高、排障对不上。
     // socket 断开不打点（D3 免扫码），这条只管"只剩主机"的真空会话。
     conversationEmptyTtlMs: integer2(env.DRC_CONV_EMPTY_TTL_MS, 30 * 60 * 1e3, "DRC_CONV_EMPTY_TTL_MS", problems),
-    hostGraceMs: integer2(env.DRC_HOST_GRACE_MS, 12e4, "DRC_HOST_GRACE_MS", problems),
+    // P1-4（2026-10-22 用户拍板 10 分钟）：主机 socket 断开的宽限期。原来 120s ——
+    // 太短：一次重启/网络抖动超过 2 分钟就 `dropHost` 删光该主机的会话，手机被迫重扫
+    // （PLAN-smooth-78-92 §L3：今天 9 次 grace expired，最长受害会话 219 帧）。
+    // 代价是孤儿会话多占表一段时间（`maxConversations` 满时只回收"已空"会话，可忽略）。
+    // 治本（休眠会话 + 同 hostId 重连自动回挂）留待观察一周后按投诉量决定。
+    hostGraceMs: integer2(env.DRC_HOST_GRACE_MS, 6e5, "DRC_HOST_GRACE_MS", problems),
     sweepMs: integer2(env.DRC_SWEEP_MS, 5e3, "DRC_SWEEP_MS", problems),
     countersLogMs: integer2(env.DRC_COUNTERS_LOG_MS, 6e4, "DRC_COUNTERS_LOG_MS", problems),
     pingIntervalMs: integer2(env.DRC_PING_INTERVAL_MS, 6e4, "DRC_PING_INTERVAL_MS", problems),
@@ -23995,7 +24038,7 @@ var import_subprotocol = __toESM(require_subprotocol(), 1);
 var import_websocket = __toESM(require_websocket(), 1);
 var import_websocket_server = __toESM(require_websocket_server(), 1);
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/identity/ids.js
 import { randomBytes, randomUUID } from "node:crypto";
 var CONVERSATION_ID_PREFIX = "c_";
 function newConversationId() {
@@ -24005,7 +24048,7 @@ function newHostId() {
   return randomBytes(4).toString("hex");
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/negotiate.js
 function negotiateProtocol(peerProtocol, own2 = PROTOCOL_VERSION) {
   if (peerProtocol === void 0 || peerProtocol === null) {
     return {
@@ -24125,16 +24168,16 @@ function createMpCodeIssuer(options) {
   };
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/errors.js
 var WAIT_HINTABLE = /* @__PURE__ */ new Set(["rate_limited", "pair_table_full"]);
 function wantsRetryAfter(code) {
   return typeof code === "string" && WAIT_HINTABLE.has(code);
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/platform/sleep.js
 var SLEEP_BACKENDS = ["caffeinate", "systemd-inhibit", "unsupported"];
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/payloads.js
 var SESSION_STATES = [
   "idle",
   "running",
@@ -24574,7 +24617,7 @@ var PAYLOAD_TYPES = {
   evSessionHistory: "ev.session_history"
 };
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/outbound.js
 function helloOkForClient(clientId, protocol) {
   return { t: "hello-ok", role: "client", clientId, ...protocol === void 0 ? {} : { protocol } };
 }
@@ -24622,6 +24665,12 @@ function makeError(code, message, retryAfterMs) {
 function pong(ts) {
   return { t: "pong", ...ts === void 0 ? {} : { ts } };
 }
+function resumeGap(sessionId, reason) {
+  if (reason !== "overflow" && reason !== "reset") {
+    throw new Error(`resume-gap \u7684 reason \u53EA\u80FD\u662F overflow|reset\uFF0C\u6536\u5230 ${JSON.stringify(reason)}`);
+  }
+  return { t: "resume-gap", sessionId, reason };
+}
 function encToClient(sessionId, seq, ciphertext) {
   if (ciphertext.length > MAX_CIPHERTEXT_BYTES) {
     throw new Error(`\u5BC6\u6587 ${ciphertext.length} \u5B57\u8282\u8D85\u8FC7\u4E0A\u9650 ${MAX_CIPHERTEXT_BYTES}`);
@@ -24661,7 +24710,7 @@ function encBatchToRelay(sessionId, items) {
   return { t: "enc-batch", sessionId, items: items.map((item) => ({ ...item })) };
 }
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/registry.js
 var ENDPOINT_FRAME_NAMES = [
   "hello",
   "pair-begin",
@@ -24685,7 +24734,9 @@ var RELAY_FRAME_NAMES = [
   "error",
   "pong",
   "enc",
-  "enc-batch"
+  "enc-batch",
+  // P1-3（2026-10-22）：`hello.resume` 补不出来时的回执（环滚过/序号重置）。
+  "resume-gap"
 ];
 var FRAME_TYPES = [
   .../* @__PURE__ */ new Set([...ENDPOINT_FRAME_NAMES, ...RELAY_FRAME_NAMES])
@@ -24726,7 +24777,7 @@ var EV_TYPES = [
 ];
 var PAYLOAD_TYPE_SET = /* @__PURE__ */ new Set([...CMD_TYPES, ...EV_TYPES]);
 
-// node_modules/.pnpm/@dsh-remote+protocol@3.2.9/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
+// node_modules/.pnpm/@dsh-remote+protocol@3.2.12/node_modules/@dsh-remote/protocol/dist/src/wire/classify.js
 function frameTypeOf(value) {
   if (typeof value !== "object" || value === null || Array.isArray(value))
     return void 0;
@@ -25027,6 +25078,99 @@ function writeStateFile(path, snapshot, log) {
   }
 }
 
+// src/replay.ts
+var REPLAY_MAX_FRAMES = 256;
+var REPLAY_MAX_BYTES_PER_CONV = 2 * 1024 * 1024;
+var REPLAY_MAX_BYTES_TOTAL = 64 * 1024 * 1024;
+var ReplayBuffer = class {
+  rings = /* @__PURE__ */ new Map();
+  totalBytes = 0;
+  tick = 0;
+  /**
+   * 存一帧。**在 seq 分配点调用**——包括"批量帧后半段因会话被删而放弃发送"的那些：
+   * 编号已经被 `nextHostSequence` 消耗掉，环里留着洞的话 `replay()` 的连续性判断
+   * 会把洞当成"已经补上了"，那是最坏的静默缺帧。
+   */
+  push(conversationId, seq, ciphertext) {
+    const bytes = Math.min(ciphertext.length, MAX_CIPHERTEXT_BYTES);
+    let ring = this.rings.get(conversationId);
+    if (!ring) {
+      ring = { entries: [], bytes: 0, tick: 0 };
+      this.rings.set(conversationId, ring);
+    }
+    ring.entries.push({ seq, ciphertext });
+    ring.bytes += bytes;
+    this.totalBytes += bytes;
+    this.tick += 1;
+    ring.tick = this.tick;
+    while (ring.entries.length > REPLAY_MAX_FRAMES) {
+      const gone = ring.entries.shift();
+      if (!gone) break;
+      ring.bytes -= Math.min(gone.ciphertext.length, MAX_CIPHERTEXT_BYTES);
+      this.totalBytes -= Math.min(gone.ciphertext.length, MAX_CIPHERTEXT_BYTES);
+    }
+    while (ring.bytes > REPLAY_MAX_BYTES_PER_CONV && ring.entries.length > 1) {
+      const gone = ring.entries.shift();
+      if (!gone) break;
+      const g = Math.min(gone.ciphertext.length, MAX_CIPHERTEXT_BYTES);
+      ring.bytes -= g;
+      this.totalBytes -= g;
+    }
+    while (this.totalBytes > REPLAY_MAX_BYTES_TOTAL && this.rings.size > 1) {
+      let victim = null;
+      let victimTick = Infinity;
+      for (const [id, r] of this.rings) {
+        if (id === conversationId) continue;
+        if (r.tick < victimTick) {
+          victimTick = r.tick;
+          victim = id;
+        }
+      }
+      if (victim === null) break;
+      this.forget(victim);
+    }
+  }
+  /**
+   * 补投 `seq > fromSeq` 的存帧。
+   *
+   * @param seqHost 会话的**权威计数器**（`Conversation.seqHost`）：判断"这段是不是
+   *   真的存在过"要用它，环只能证明"我们留住了什么"。中继重启后环空了而计数器
+   *   还在（它落盘）——那正是 `overflow` 的一半成因。
+   */
+  replay(conversationId, fromSeq, seqHost) {
+    if (fromSeq > seqHost) return { ok: false, reason: "reset" };
+    if (fromSeq === seqHost) return { ok: true, frames: [] };
+    const ring = this.rings.get(conversationId);
+    const oldest = ring?.entries[0];
+    const floor = oldest ? oldest.seq : seqHost + 1;
+    if (fromSeq + 1 < floor) return { ok: false, reason: "overflow" };
+    const frames = (ring?.entries ?? []).filter((e) => e.seq > fromSeq);
+    return { ok: true, frames };
+  }
+  /** 会话删除时一起清（作废时残留要一起清）。幂等。 */
+  forget(conversationId) {
+    const ring = this.rings.get(conversationId);
+    if (!ring) return;
+    this.totalBytes -= ring.bytes;
+    this.rings.delete(conversationId);
+  }
+  /** 全量清空（`RelayState.reset` 一起清：作废时残留要一起清）。幂等。 */
+  clear() {
+    this.rings.clear();
+    this.totalBytes = 0;
+  }
+  /** 诊断用：当前留着几条会话的环。 */
+  size() {
+    return this.rings.size;
+  }
+  /** 诊断用：当前环内帧数（全会话合计）。 */
+  frameCount() {
+    let n = 0;
+    for (const ring of this.rings.values()) n += ring.entries.length;
+    return n;
+  }
+};
+
 // src/state.ts
 var WS_OPEN = 1;
 var RelayState = class {
@@ -25034,6 +25178,13 @@ var RelayState = class {
   clients = /* @__PURE__ */ new Map();
   pendingPairs = /* @__PURE__ */ new Map();
   conversations = /* @__PURE__ */ new Map();
+  /**
+   * 下行帧环形缓冲（P1-3）：**刻意不落盘**——它是"断线那几秒的补帧"，
+   * 进程重启后补不回也不该补（`seqHost` 落盘而环不落盘 ⇒ 覆盖判定自然得出
+   * `overflow`，见 `ReplayBuffer` 头注）。挂在 state 上是为了**删会话时一起清**
+   * （作废时残留要一起清），六个删除点全部收在 `dropConv` 里。
+   */
+  replay = new ReplayBuffer();
   /** 按 hostId 一机一枚（键一定是非空 hostId，见 `HostTokenEntry`）。 */
   hostTokens = /* @__PURE__ */ new Map();
   /** 测试可注入固定时钟；默认用真实时间。 */
@@ -25128,7 +25279,7 @@ var RelayState = class {
     let dropped = 0;
     for (const [conversationId] of abandoned) {
       if (this.conversations.size < this.maxConversationsValue) break;
-      this.conversations.delete(conversationId);
+      this.purgeConv(conversationId);
       dropped += 1;
     }
     return dropped;
@@ -25239,7 +25390,7 @@ var RelayState = class {
         continue;
       }
       droppedMembers.push({ conversationId, clientIds: [...conv.clients] });
-      this.conversations.delete(conversationId);
+      this.purgeConv(conversationId);
       dropped.push(conversationId);
     }
     return { kept, dropped, droppedMembers, emptyAtRisk };
@@ -25321,12 +25472,21 @@ var RelayState = class {
     }
     return true;
   }
+  /**
+   * 删会话记录的唯一咽喉：**环形缓冲一起清**（作废时残留要一起清）。
+   * 六个删除点（空会话回收 / resync / 主动作废 / 主机判死 / 闲置清扫 / 空会话清扫）
+   * 全走这里——漏一处的形状是"会话没了、补帧环还在"，属于本仓咬过两次的那类残留。
+   */
+  purgeConv(conversationId) {
+    this.conversations.delete(conversationId);
+    this.replay.forget(conversationId);
+  }
   /** 主机主动作废某条会话（R1）：返回被摘掉的客户端，调用方据此发 peer-left。 */
   dropConversation(conversationId) {
     const conv = this.conversations.get(conversationId);
     if (!conv) return void 0;
     const clientIds = [...conv.clients];
-    this.conversations.delete(conversationId);
+    this.purgeConv(conversationId);
     return { conversationId, clientIds };
   }
   /** 立即判死某个主机（用于主机主动解配或会话被清）。返回需要向客户端发 peer-left 的清单。 */
@@ -25335,7 +25495,7 @@ var RelayState = class {
     for (const [conversationId, conv] of [...this.conversations]) {
       if (conv.hostId !== hostId) continue;
       dropped.push({ conversationId, hostId, clientIds: [...conv.clients] });
-      this.conversations.delete(conversationId);
+      this.purgeConv(conversationId);
     }
     this.hosts.delete(hostId);
     return dropped;
@@ -25400,7 +25560,7 @@ var RelayState = class {
     const dropped = [];
     for (const [conversationId, conv] of [...this.conversations]) {
       if (now - conv.lastActivityAt >= ttlMs) {
-        this.conversations.delete(conversationId);
+        this.purgeConv(conversationId);
         dropped.push(conversationId);
       }
     }
@@ -25426,7 +25586,7 @@ var RelayState = class {
     for (const [conversationId, conv] of [...this.conversations]) {
       if (conv.emptySince === void 0) continue;
       if (now - conv.emptySince >= emptyTtlMs) {
-        this.conversations.delete(conversationId);
+        this.purgeConv(conversationId);
         dropped.push(conversationId);
       }
     }
@@ -25485,13 +25645,14 @@ var RelayState = class {
       hostTokens: this.hostTokens.size
     };
   }
-  /** 全量清空（优雅停机或测试重置）。 */
+  /** 全量清空（优雅停机或测试重置）。环形缓冲一起清（作废时残留要一起清）。 */
   reset() {
     this.hosts.clear();
     this.clients.clear();
     this.pendingPairs.clear();
     this.conversations.clear();
     this.hostTokens.clear();
+    this.replay.clear();
   }
 };
 
@@ -25684,7 +25845,7 @@ function createRelay(config2) {
       }
       if (!hostTokenAccepted(hostId, frame.token)) {
         peer.authAttempts += 1;
-        log.warn("host auth failed", { attempts: peer.authAttempts });
+        log.warn("host auth failed", { attempts: peer.authAttempts, ip: peer.ip });
         sendError(peer, "bad_token");
         if (peer.authAttempts >= config2.maxHostAuthAttempts) peer.ws.close(4001, "too_many_auth_attempts");
         return;
@@ -25712,6 +25873,7 @@ function createRelay(config2) {
         replaced.close(CLOSE_REPLACED, "replaced_by_newer_socket");
       }
       sendToPeer(peer, helloOkForClient(clientId, frame.protocol));
+      if (frame.resume) replayToClient(peer, clientId, frame.resume);
       log.info("client online", { clientId, platform: frame.clientMeta?.platform });
       if (config2.reportSoftwareVersion && frame.softwareVersion) {
         log.info("client software version", { clientId, version: frame.softwareVersion });
@@ -25815,6 +25977,38 @@ function createRelay(config2) {
     const entry = state.hosts.get(hostId);
     return entry ? peers.get(entry.ws) : void 0;
   }
+  function replayToClient(peer, clientId, resume) {
+    const rejected = state.routeFrom(resume.sessionId, peer.ws, "client");
+    if (rejected) {
+      log.info("resume skipped", { clientId, sessionId: resume.sessionId, reason: rejected });
+      return;
+    }
+    const conv = state.conversations.get(resume.sessionId);
+    if (!conv) return;
+    const result = state.replay.replay(resume.sessionId, resume.fromSeq, conv.seqHost);
+    if (!result.ok) {
+      sendToPeer(peer, resumeGap(resume.sessionId, result.reason));
+      log.info("resume gap", {
+        clientId,
+        sessionId: resume.sessionId,
+        reason: result.reason,
+        fromSeq: resume.fromSeq,
+        seqHost: conv.seqHost
+      });
+      return;
+    }
+    for (const entry of result.frames) {
+      sendToPeer(peer, encToClient(resume.sessionId, entry.seq, entry.ciphertext));
+    }
+    if (result.frames.length > 0) {
+      log.info("resume replayed", {
+        clientId,
+        sessionId: resume.sessionId,
+        count: result.frames.length,
+        fromSeq: resume.fromSeq
+      });
+    }
+  }
   function forwardEnc(peer, frame) {
     const rejected = state.routeFrom(frame.sessionId, peer.ws, peer.role);
     if (rejected) {
@@ -25837,6 +26031,7 @@ function createRelay(config2) {
       return;
     }
     const seq = state.nextHostSequence(frame.sessionId);
+    if (seq !== void 0) state.replay.push(frame.sessionId, seq, frame.ciphertext);
     const sockets = state.clientSockets(frame.sessionId);
     if (sockets.length === 0) counters.droppedFrames += 1;
     for (const sock of sockets) {
@@ -25866,6 +26061,7 @@ function createRelay(config2) {
     for (const item of frame.items) {
       const seq = state.nextHostSequence(frame.sessionId);
       if (seq === void 0) return;
+      state.replay.push(frame.sessionId, seq, item.ciphertext);
       items.push({ seq, ciphertext: item.ciphertext });
     }
     for (const sock of clients) sendTo(sock, encBatchToClient(frame.sessionId, items));
@@ -25986,7 +26182,7 @@ function createRelay(config2) {
     ws.on("error", (e) => log.warn("socket error", { message: String(e?.message ?? e) }));
     ws.close(code, reason);
   }
-  function onConnection(ws) {
+  function onConnection(ws, ip) {
     if (shuttingDown) {
       rejectConnection(ws, 1013, "server_shutdown");
       return;
@@ -25997,6 +26193,7 @@ function createRelay(config2) {
     }
     const peer = {
       ws,
+      ip,
       role: "unknown",
       rate: new FrameRateGate(config2.maxFramesPerSec),
       authAttempts: 0,
@@ -26167,6 +26364,11 @@ function createRelay(config2) {
       // "手机不更新"这类排查分不清"现在是空的"和"一直送不出去"。
       ...state.counts(),
       ...counters,
+      // P1-3 的**可补面**（2026-10-22）：`droppedFrames` 里没有收件人的那部分，run 输出帧
+      // 现在多数进了环并在重连时补投。这两个读数回答"此刻环里还剩多少、挂在几条会话上"
+      // （瞬时值，会随补投/淘汰浮动）；历史累计仍看 `droppedFrames`。
+      replayRingConversations: state.replay.size(),
+      replayRingFrames: state.replay.frameCount(),
       // 落盘的可观测面。**刻意不暴露文件路径**：`/healthz` 是公网可达的，
       // 而一个绝对路径对排障没用、对探测者有用（告诉它这台机器上有什么、装在哪）。
       // 运维要知道路径看环境变量就够了。
@@ -26392,7 +26594,7 @@ function createRelay(config2) {
       socket.destroy();
     }
   });
-  wss.on("connection", (ws) => onConnection(ws));
+  wss.on("connection", (ws, req) => onConnection(ws, req.socket.remoteAddress ?? "unknown"));
   async function drain() {
     if (wss.clients.size === 0) return;
     await new Promise((resolve) => {
@@ -26500,7 +26702,7 @@ function registerSignalHandlers(shutdown) {
 
 // src/main.ts
 function readVersion() {
-  if ("3.2.10") return "3.2.10";
+  if ("3.2.12") return "3.2.12";
   try {
     const pkg = JSON.parse(readFileSync2(new URL("../../package.json", import.meta.url), "utf8"));
     if (typeof pkg.version === "string") return pkg.version;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dsh-remote/relay",
-  "version": "3.2.10",
+  "version": "3.2.12",
   "description": "DSH Remote Control 的零知识 WebSocket 中继：只做路由，不碰载荷明文。可自托管的单文件产物。",
   "type": "module",
   "license": "MIT",