@khorsheed/dsh-ankh-guard 0.2.0 → 0.3.0

package/CHANGELOG.md

@@ -1,5 +1,14 @@
 # 变更记录
 
+## 0.3.0（2026-09-11）
+
+适配宿主 0.1.5 线。
+
+- **BREAKING**：minHost 前移至 `0.1.5-rc.1`；宿主 `0.1.2-rc.1` ~ `0.1.4.x` 的用户请停留在 0.2.x 线（末版 `0.2.0`）
+- 冷读（用户输入停靠探测与 resume preset 推导）改走 0.1.5 的 handle 制 `sessionPersistence`（`open(id, 'read')` → `read` → `close`，与其他宿主面一样按调用探测）；0.1.5 已移除的一次性 `inspect` 会让重启 resume 静默降级
+- 生命周期漂移 lane 的通过计数改为环境感知：缺少部署 profile / 工具链缓存时合理跳过的绊线测试不再被硬编码期望数误伤（修 CI 红）
+- 开发基线随仓内 pin 对齐官方 `0.1.5-rc.1` / cordis `4.0.2`（单实例 cordis 终结 4.0.1/4.0.2 图分裂）；peer 范围保持宽松
+
 ## 0.2.0（2026-09-10）
 
 - **BREAKING**：minHost 前移至 `0.1.2-rc.1`；宿主 `0.1.0-rc.6` ~ `0.1.1-rc.2` 的用户请停留在 0.1.x 线（末版 `0.1.1`）

package/README.en.md

@@ -184,7 +184,7 @@ dsh-ankh-guard restart \
 
 Mounted as a cordis plugin (base bundle), the same surface is available as the `selfRestartGuard` service for in-app gates. Config: `maxAgeMinutes` (default 10), `stateDir`, `repoDir`, `reportRestartContext` (default `followup`), `fallbackGraceMs` (default 300000).
 
-Beyond the verify/record/canary gates, the service exposes `requestRestart({ start, profile, initiator })` — the in-process restart trigger for UI-grade callers (e.g. the mode switcher): `initiator` is required (the requesting session's real id) and the port comes from the launch record. With no live watchdog it drives `restart`; supervised instances drive the `reconfigure` transactional cutover (the only safe way to change the launch command under a watchdog). The credential/preflight/marker/lock gate chain is the CLI's own, refusals return a structured `{ accepted, stage, reason }` and never stop the instance. On the browser side, beside the cutover receipt channel there is a boot-generation channel: after an ordinary restart or a crash respawn, open tabs notice the process's boot id changed over the handoff long-poll and reload once to pick up the new bundle; a sustained disconnection (~5 s) raises a neutral overlay that never promises auto-recovery, and transient blips stay silent.
+Beyond the verify/record/canary gates, the service exposes `requestRestart({ start, profile, initiator })` — the in-process restart trigger for UI-grade callers (e.g. the mode switcher): `initiator` is required (the requesting session's real id) and the port comes from the launch record. With no live watchdog it drives `restart`; supervised instances drive the `reconfigure` transactional cutover (the only safe way to change the launch command under a watchdog). The credential/preflight/marker/lock gate chain is the CLI's own, refusals return a structured `{ accepted, stage, reason }` and never stop the instance. On the browser side, beside the cutover receipt channel there is a boot-generation channel: after an ordinary restart or a crash respawn, open tabs notice the process's boot id changed over the handoff long-poll and reload once to pick up the new bundle; visible sustained failures (~5 s) show a non-blocking connection banner with Retry; only confirmed cutovers use the restart overlay. Background/offline time does not count as failure. Returning to the foreground or online immediately resets backoff and restarts polling; stalled requests time out after 35 s and stale responses cannot trigger a reload.
 
 ## Model Experience
 
@@ -196,11 +196,11 @@ None.
 
 ## Compatibility
 
-- npm release line (`@deepseek-ai/dsh@0.1.2-rc.1`): ⚠️ degraded — everything works; the composition-preflight gate runs through the standalone `preflight-runner` (composing through the published `@deepseek-ai/dsh-app-boot` primitives with a drift tripwire, since 0.1.2-rc.1 still does not export `composeProfile`) wherever a dsh app layout resolves — `--harness-root`, the durable launch spec, `DSH_HARNESS`, or the default checkout. On a pure npm deployment with no harness checkout the gate reports a notice and proceeds instead. The original-tab bridge feature-probes the optional WebServer/connection authentication seams; hosts without token auth naturally take the existing-cookie path. Every other capability is intact on the npm line. minHost moves up to 0.1.2-rc.1 — older hosts stay on the previous release line.
+- npm release line (`@deepseek-ai/dsh@0.1.5-rc.1`): ⚠️ degraded — everything works; the composition-preflight gate runs through the standalone `preflight-runner` (composing through the published `@deepseek-ai/dsh-app-boot` primitives with a drift tripwire, since 0.1.5-rc.1 still does not export `composeProfile`) wherever a dsh app layout resolves — `--harness-root`, the durable launch spec, `DSH_HARNESS`, or the default checkout. On a pure npm deployment with no harness checkout the gate reports a notice and proceeds instead. The original-tab bridge feature-probes the optional WebServer/connection authentication seams; hosts without token auth naturally take the existing-cookie path. Cold reads (the parked probe and the preset derivation) ride the 0.1.5 handle-based sessionPersistence (`open(id, 'read')` → `read` → `close`; the one-shot `inspect` is gone). Every other capability is intact on the npm line. minHost moves up to 0.1.5-rc.1 — older hosts stay on the previous release line.
 - Historical verification: a live npm-host 0.1.1-rc.2 → 0.1.2-alpha.4 isolated cutover passed (transition preflight removed a v3 whole-unit projection cache with an old-schema record from a home copy, live apply quarantined the old file, and target completed Token URL → 303 → cookie 200, the ownership stability window, and canary at zero retries; the old file remained byte-exact in the cutover directory. An untransitioned control over the same home failed on the missing Alpha.4 record fields, demonstrating that acceptance covered the real schema break).
-- source line (deepseek-harness master, fork or upstream): ✅ (verifiedHost: 0.1.2-rc.1) — the gate runs through the standalone `preflight-runner` (resolves the published `@deepseek-ai/dsh-app-boot` etc. from the live checkout), so no fork patch is required.
+- source line (deepseek-harness master, fork or upstream): ✅ (verifiedHost: 0.1.5-rc.1) — the gate runs through the standalone `preflight-runner` (resolves the published `@deepseek-ai/dsh-app-boot` etc. from the live checkout), so no fork patch is required.
 
-**Version line mapping**: 0.2.0 and up support host `0.1.2-rc.1` and later; hosts on `0.1.0-rc.6` ~ `0.1.1-rc.2` stay on the 0.1.x release line (last release `0.1.1`).
+**Version line mapping**: the first release after 0.2.0 supports host `0.1.5-rc.1` and later; hosts on `0.1.2-rc.1` stay on `0.2.0`, hosts on `0.1.0-rc.6` ~ `0.1.1-rc.2` stay on the 0.1.x release line (last release `0.1.1`).
 
 ## Known Limitations and Deferred Work
 

package/README.i18n.yaml

@@ -2,5 +2,5 @@
 # last confirmed-consistent state. Both languages carry equal authority; after
 # editing either side, bring the other along and re-record with:
 #   pnpm run verify-translation-pairing --write packages/ankh-guard/README.en.md
-packages/ankh-guard/README.en.md: 941f3ceb4d5738244b46f4492eb8fc6c823fd967
-packages/ankh-guard/README.md: ab62e07753b0e0e24ff833aae5aafd600e184e95
+packages/ankh-guard/README.en.md: 0fcdb11556dd49ca9046648075ffcde6cab9e894
+packages/ankh-guard/README.md: 3cba2785e56bdfdf3566255aa3629e47c44f8570

package/README.md

@@ -183,7 +183,7 @@ dsh-ankh-guard restart \
 
 以 cordis 插件挂载（base bundle）后，同一套能力以 `selfRestartGuard` 服务的形式供应用内闸门使用。配置：`maxAgeMinutes`（默认 10）、`stateDir`、`repoDir`、`reportRestartContext`（默认 `followup`）、`fallbackGraceMs`（默认 300000）。
 
-除 verify/record/canary 等闸门外，服务还暴露 `requestRestart({ start, profile, initiator })`——UI 级调用方（如 mode-switcher）的进程内重启触发缝：`initiator` 必填（发起会话的真实 id），端口从 launch 记录自知；无活 watchdog 走 `restart`，受监督走 `reconfigure` 事务 cutover（受监督下唯一安全的换命令通道），凭证/preflight/marker/lock 全套闸门与 CLI 同源，拒绝返回结构化 `{ accepted, stage, reason }` 且绝不停机。浏览器侧，除 cutover receipt 通道外还有 boot 代际通道：普通重启或崩溃救回后，打开的标签页经 handoff 长轮询发现进程 boot id 已变，自动全页刷新一次拿到新 bundle；持续断连约 5 秒挂中性遮罩（不承诺自动恢复），瞬时抖动不闪屏。
+除 verify/record/canary 等闸门外，服务还暴露 `requestRestart({ start, profile, initiator })`——UI 级调用方（如 mode-switcher）的进程内重启触发缝：`initiator` 必填（发起会话的真实 id），端口从 launch 记录自知；无活 watchdog 走 `restart`，受监督走 `reconfigure` 事务 cutover（受监督下唯一安全的换命令通道），凭证/preflight/marker/lock 全套闸门与 CLI 同源，拒绝返回结构化 `{ accepted, stage, reason }` 且绝不停机。浏览器侧，除 cutover receipt 通道外还有 boot 代际通道：普通重启或崩溃救回后，打开的标签页经 handoff 长轮询发现进程 boot id 已变，自动全页刷新一次拿到新 bundle；仅前台持续失败约 5 秒后显示带重试按钮的轻量连接提示；只有确认的 cutover 使用重启遮罩。后台或离线时间不计入失败时长；回前台或恢复联网立即清除退避并重新轮询；挂起的请求在 35 秒后超时，过期响应不能触发刷新。
 
 ## Model Experience
 
@@ -195,11 +195,11 @@ dsh-ankh-guard restart \
 
 ## Compatibility
 
-- npm 发布线（`@deepseek-ai/dsh@0.1.2-rc.1`）：⚠️ 降级——一切可用；composition-preflight 门禁通过独立的 `preflight-runner` 运行（0.1.2-rc.1 仍未导出 `composeProfile`，runner 改经已发布的 `@deepseek-ai/dsh-app-boot` 原语组装，带漂移绊线测试），只要能解析到 dsh app 布局——`--harness-root`、耐久 launch spec、`DSH_HARNESS` 或默认检出路径——就完整运行。没有 harness 检出的纯 npm 部署下门禁退化为提示后放行。原标签页桥会探测可选 WebServer/connection 认证 seam，不使用 token 认证的宿主自然走现有 Cookie 路径；其余能力在 npm 线上完整。minHost 前移至 0.1.2-rc.1，旧宿主请停留在旧发布线。
+- npm 发布线（`@deepseek-ai/dsh@0.1.5-rc.1`）：⚠️ 降级——一切可用；composition-preflight 门禁通过独立的 `preflight-runner` 运行（0.1.5-rc.1 仍未导出 `composeProfile`，runner 改经已发布的 `@deepseek-ai/dsh-app-boot` 原语组装，带漂移绊线测试），只要能解析到 dsh app 布局——`--harness-root`、耐久 launch spec、`DSH_HARNESS` 或默认检出路径——就完整运行。没有 harness 检出的纯 npm 部署下门禁退化为提示后放行。原标签页桥会探测可选 WebServer/connection 认证 seam，不使用 token 认证的宿主自然走现有 Cookie 路径；冷读（停靠探测与 preset 推导）走 0.1.5 的 handle 制 sessionPersistence（`open(id, 'read')` → `read` → `close`，一次性 `inspect` 已移除）。其余能力在 npm 线上完整。minHost 前移至 0.1.5-rc.1，旧宿主请停留在旧发布线。
 - 历史验证：npm host 的 0.1.1-rc.2 → 0.1.2-alpha.4 隔离切换已通过（transition preflight 在 home 副本上移开带旧 schema record 的 v3 whole-unit projection cache，live apply 隔离旧文件，target 以零重试完成 Token URL → 303 → Cookie 200、ownership 稳定窗口与 canary；旧文件逐字节保留在 cutover 目录。相同 home 的无 transition 对照因缺少 Alpha.4 record 字段而拒绝，证明验收覆盖了真实 schema 断裂面）。
-- 源码线（deepseek-harness master，fork 或上游）：✅（verifiedHost: 0.1.2-rc.1）——门禁通过独立的 `preflight-runner` 运行（从在线 checkout 解析已发布的 `@deepseek-ai/dsh-app-boot` 等），不再需要 fork 补丁。
+- 源码线（deepseek-harness master，fork 或上游）：✅（verifiedHost: 0.1.5-rc.1）——门禁通过独立的 `preflight-runner` 运行（从在线 checkout 解析已发布的 `@deepseek-ai/dsh-app-boot` 等），不再需要 fork 补丁。
 
-**版本线对照**：0.2.0 起支持宿主 `0.1.2-rc.1` 及以后；宿主 `0.1.0-rc.6` ~ `0.1.1-rc.2` 的用户请停留在 0.1.x 发布线（末版 `0.1.1`）。
+**版本线对照**：0.2.0 之后的首个发布起支持宿主 `0.1.5-rc.1` 及以后；宿主 `0.1.2-rc.1` 请停留在 `0.2.0`，宿主 `0.1.0-rc.6` ~ `0.1.1-rc.2` 请停留在 0.1.x 发布线（末版 `0.1.1`）。
 
 ## Known Limitations and Deferred Work
 

package/lib/cli.js

@@ -1,6 +1,6 @@
 #!/usr/bin/env node
 import { i as resolveStateDir, n as isDirectInvocation, r as resolveRepoDir, t as SRC_ARTIFACT_PATTERN } from "./defaults-CduvOcGq.js";
-import { A as writeStableLaunchSpec, C as prepareLaunchCutover, D as selectedLaunchSpec, E as recordCutoverEvent, F as workingTreeChanges, M as currentHead, N as isWorkingTreeClean, O as summarizeLaunchState, P as resetToCheckpoint, T as readLaunchState, _ as writeRestartOutcome, b as activeCutover, c as readInstanceLaunch, f as writeAdoptionRecord, h as writeInstanceLaunchAsSupervisor, j as commitCheckpoint, k as writeCutoverControl, p as writeCompositionRecovery, u as readSkillRegistration, w as readCutoverReceipt, x as commandSha256, y as writeUnexpectedExitRecord } from "./restart-context-DUyExi9O.js";
+import { A as writeStableLaunchSpec, C as prepareLaunchCutover, D as selectedLaunchSpec, E as recordCutoverEvent, F as workingTreeChanges, M as currentHead, N as isWorkingTreeClean, O as summarizeLaunchState, P as resetToCheckpoint, T as readLaunchState, _ as writeRestartOutcome, b as activeCutover, c as readInstanceLaunch, f as writeAdoptionRecord, h as writeInstanceLaunchAsSupervisor, j as commitCheckpoint, k as writeCutoverControl, p as writeCompositionRecovery, u as readSkillRegistration, w as readCutoverReceipt, x as commandSha256, y as writeUnexpectedExitRecord } from "./restart-context-DlaDZWKq.js";
 import { _ as processIdentity, c as appendTestLifecycleEvent, d as registerTestProcess, f as discoverLaunchCommand, h as killPidTree, l as appendTestLifecycleEventForProcess, m as findPidOnPort, n as TEST_PROCESS_ROLE_ENV, p as findOwnedListener, r as TEST_PROCESS_TEMP_ROOT_ENV, t as TEST_PROCESS_PORT_ENV, u as registerCurrentTestProcess, v as processIdentityMatches } from "./test-seam-dwvaKjRp.js";
 import { a as setProvenDeployment, c as lastGoodBootRevision, d as pidAlive, f as stateFile, i as setCheckpoint, l as livePidIn, n as loadState, r as recordCredential, s as verifyCredential, t as clearCredential, u as liveWatchdogPid } from "./state-CZMypGkB.js";
 import { execFileSync, spawn } from "node:child_process";

package/lib/client.js

@@ -13,8 +13,9 @@ window.__ModuleLoader__.load({
 		const ACTIVE_RETRY_MS = 250;
 		const ERROR_RETRY_MIN_MS = 1e3;
 		const ERROR_RETRY_MAX_MS = 3e4;
-		/** Sustained-failure threshold for the disconnected overlay; transient blips never show it. */
-		const DISCONNECTED_OVERLAY_MS = 5e3;
+		/** Sustained-failure threshold for the connection notice; transient blips never show it. */
+		const DISCONNECTED_NOTICE_MS = 5e3;
+		const REQUEST_TIMEOUT_MS = 35e3;
 		/** No Cordis services are needed; this is a same-origin browser lifecycle observer. */
 		const inject = [];
 		function encodeBase64Url(bytes) {
@@ -80,16 +81,17 @@ window.__ModuleLoader__.load({
 			writePending(pending);
 			return pending;
 		}
-		function waitingOverlay(kind = "restarting") {
+		function waitingOverlay(kind = "restarting", retry) {
 			const existing = document.getElementById("ankh-guard-browser-handoff");
-			if (existing !== null) return existing;
+			if (existing?.dataset.kind === "restarting" && kind === "disconnected") return existing;
+			const element = existing ?? document.createElement("div");
 			const zh = navigator.language.toLowerCase().startsWith("zh");
-			const element = document.createElement("div");
 			element.id = "ankh-guard-browser-handoff";
+			element.dataset.kind = kind;
 			element.setAttribute("role", "status");
 			element.setAttribute("aria-live", "polite");
-			element.textContent = kind === "disconnected" ? zh ? "连接已断开,等待服务恢复。" : "Connection lost; waiting for the service to recover." : zh ? "dsh 正在重启；此标签页会自动恢复。" : "dsh is restarting; this tab will recover automatically.";
-			element.style.cssText = [
+			element.textContent = kind === "disconnected" ? zh ? "连接暂时中断，正在重试…" : "Connection interrupted; retrying…" : zh ? "dsh 正在重启；此标签页会自动恢复。" : "dsh is restarting; this tab will recover automatically.";
+			element.style.cssText = kind === "restarting" ? [
 				"position:fixed",
 				"inset:0",
 				"z-index:2147483647",
@@ -100,20 +102,48 @@ window.__ModuleLoader__.load({
 				"color:#fff",
 				"font:500 16px/1.5 system-ui,sans-serif",
 				"text-align:center"
+			].join(";") : [
+				"position:fixed",
+				"top:calc(env(safe-area-inset-top,0px) + 12px)",
+				"left:12px",
+				"right:12px",
+				"max-width:520px",
+				"margin:0 auto",
+				"box-sizing:border-box",
+				"z-index:2147483647",
+				"display:flex",
+				"align-items:center",
+				"justify-content:space-between",
+				"gap:12px",
+				"padding:12px 16px",
+				"border:1px solid var(--dsw-alias-border-l2,#8885)",
+				"border-radius:16px",
+				"background:var(--dsw-alias-bg-base,#fff)",
+				"color:var(--dsw-alias-label-primary,#181a20)",
+				"box-shadow:0 4px 24px #0002",
+				"font:400 15px/1.5 system-ui,sans-serif"
 			].join(";");
-			document.documentElement.append(element);
+			if (kind === "disconnected" && retry) {
+				const button = document.createElement("button");
+				button.textContent = zh ? "重试" : "Retry";
+				button.style.cssText = "flex:none;border:0;background:transparent;color:var(--dsw-alias-state-business-primary,#4d6bfe);font:inherit;min-height:36px;cursor:pointer";
+				button.onclick = retry;
+				element.append(button);
+			}
+			if (!existing) (document.body ?? document.documentElement).append(element);
 			return element;
 		}
-		async function post(body) {
+		async function post(body, signal) {
 			return fetch(ROUTE, {
 				method: "POST",
+				signal,
 				credentials: "same-origin",
 				cache: "no-store",
 				headers: { "content-type": "application/json" },
 				body: JSON.stringify(body)
 			});
 		}
-		async function acknowledge(pending) {
+		async function acknowledge(pending, signal) {
 			return (await post({
 				version: 1,
 				operation: "ack",
@@ -121,7 +151,7 @@ window.__ModuleLoader__.load({
 				channel: pending.channel,
 				authentication: pending.authentication,
 				...pending.capability !== void 0 ? { capability: pending.capability } : {}
-			})).status === 204;
+			}, signal)).status === 204;
 		}
 		/** Install the polling/reload loop for this tab's lifetime. */
 		function apply(_ctx) {
@@ -131,21 +161,61 @@ window.__ModuleLoader__.load({
 			let cap;
 			let errorRetryMs = ERROR_RETRY_MIN_MS;
 			let firstFailureAt;
+			let request;
+			let lastWakeAt = -Infinity;
+			const foreground = () => document.visibilityState !== "hidden" && navigator.onLine !== false;
+			const clearConnectionNotice = () => {
+				const notice = document.getElementById("ankh-guard-browser-handoff");
+				if (notice?.dataset.kind === "disconnected") notice.remove();
+			};
+			const pause = () => {
+				if (timer !== void 0) clearTimeout(timer);
+				timer = void 0;
+				const previous = request;
+				request = void 0;
+				previous?.abort();
+				firstFailureAt = void 0;
+				errorRetryMs = ERROR_RETRY_MIN_MS;
+				clearConnectionNotice();
+			};
+			const wake = () => {
+				if (disposed || !foreground() || Date.now() - lastWakeAt < 500) return;
+				lastWakeAt = Date.now();
+				pause();
+				schedule();
+			};
+			const visibility = () => {
+				if (!foreground()) {
+					lastWakeAt = -Infinity;
+					pause();
+				} else wake();
+			};
+			const page = (event) => {
+				if (event.persisted) wake();
+			};
 			const noteDisconnected = () => {
 				firstFailureAt ??= Date.now();
-				if (Date.now() - firstFailureAt >= DISCONNECTED_OVERLAY_MS) waitingOverlay("disconnected");
+				if (Date.now() - firstFailureAt >= DISCONNECTED_NOTICE_MS) waitingOverlay("disconnected", wake);
 			};
 			const schedule = (delayMs = 0) => {
-				if (!disposed) timer = setTimeout(() => {
+				if (timer !== void 0) clearTimeout(timer);
+				if (!disposed && foreground()) timer = setTimeout(() => {
+					timer = void 0;
 					tick();
 				}, delayMs);
 			};
 			const tick = async () => {
-				if (disposed) return;
+				if (disposed || !foreground() || request) return;
+				const current = new AbortController();
+				request = current;
+				const stale = () => disposed || request !== current || !foreground();
+				const deadline = setTimeout(() => current.abort(), REQUEST_TIMEOUT_MS);
 				try {
 					if (pending !== null) {
 						waitingOverlay();
-						if (await acknowledge(pending)) {
+						const acknowledged = await acknowledge(pending, current.signal);
+						if (stale()) return;
+						if (acknowledged) {
 							const returnPath = pending.returnPath;
 							const originalTab = pending.channel === "original-tab";
 							sessionStorage.removeItem(PENDING_KEY);
@@ -169,7 +239,8 @@ window.__ModuleLoader__.load({
 						operation: "poll",
 						capability: tabCapability,
 						...knownBootId === null ? {} : { knownBootId }
-					});
+					}, current.signal);
+					if (stale()) return;
 					if (!response.ok) {
 						noteDisconnected();
 						schedule(errorRetryMs);
@@ -179,6 +250,7 @@ window.__ModuleLoader__.load({
 					errorRetryMs = ERROR_RETRY_MIN_MS;
 					firstFailureAt = void 0;
 					const result = await response.json();
+					if (stale()) return;
 					if (typeof result.bootId === "string") sessionStorage.setItem(BOOT_ID_KEY, result.bootId);
 					if (result.state === "idle") {
 						document.getElementById("ankh-guard-browser-handoff")?.remove();
@@ -232,17 +304,32 @@ window.__ModuleLoader__.load({
 						return;
 					}
 				} catch {
+					if (stale()) return;
 					noteDisconnected();
 					schedule(errorRetryMs);
 					errorRetryMs = Math.min(errorRetryMs * 2, ERROR_RETRY_MAX_MS);
 					return;
+				} finally {
+					clearTimeout(deadline);
+					if (request === current) request = void 0;
 				}
 				schedule(ACTIVE_RETRY_MS);
 			};
+			document.addEventListener("visibilitychange", visibility);
+			window.addEventListener("online", wake);
+			window.addEventListener("offline", visibility);
+			window.addEventListener("pageshow", page);
+			window.addEventListener("dsh-mobile-foreground", wake);
 			tick();
 			return () => {
 				disposed = true;
-				if (timer !== void 0) clearTimeout(timer);
+				pause();
+				document.removeEventListener("visibilitychange", visibility);
+				window.removeEventListener("online", wake);
+				window.removeEventListener("offline", visibility);
+				window.removeEventListener("pageshow", page);
+				window.removeEventListener("dsh-mobile-foreground", wake);
+				document.getElementById("ankh-guard-browser-handoff")?.remove();
 			};
 		}
 		//#endregion

package/lib/index.js

@@ -1,5 +1,5 @@
 import { i as resolveStateDir, r as resolveRepoDir, t as SRC_ARTIFACT_PATTERN } from "./defaults-CduvOcGq.js";
-import { M as currentHead, N as isWorkingTreeClean, P as resetToCheckpoint, S as cutoverBlocksWake, a as interruptedSnapshotFile, b as activeCutover, c as readInstanceLaunch, d as restartContextText, g as writeInterruptedSnapshot, i as continueInterruptedText, j as commitCheckpoint, l as readInterruptedSnapshot, m as writeInstanceLaunch, n as buildLaunchCommand, o as isParkedOnUserInput, r as continueAndReportText, s as pendingRestartRecord, t as acknowledgeRestartRecord, v as writeSkillRegistration, w as readCutoverReceipt } from "./restart-context-DUyExi9O.js";
+import { M as currentHead, N as isWorkingTreeClean, P as resetToCheckpoint, S as cutoverBlocksWake, a as interruptedSnapshotFile, b as activeCutover, c as readInstanceLaunch, d as restartContextText, g as writeInterruptedSnapshot, i as continueInterruptedText, j as commitCheckpoint, l as readInterruptedSnapshot, m as writeInstanceLaunch, n as buildLaunchCommand, o as isParkedOnUserInput, r as continueAndReportText, s as pendingRestartRecord, t as acknowledgeRestartRecord, v as writeSkillRegistration, w as readCutoverReceipt } from "./restart-context-DlaDZWKq.js";
 import { _ as processIdentity, g as listeningPortsForPid, v as processIdentityMatches } from "./test-seam-dwvaKjRp.js";
 import { f as stateFile, i as setCheckpoint, n as loadState, r as recordCredential, s as verifyCredential, t as clearCredential, u as liveWatchdogPid } from "./state-CZMypGkB.js";
 import { spawn } from "node:child_process";
@@ -649,6 +649,25 @@ function deriveSessionPreset(host, session) {
 	}
 	return host.resolveSessionPreset?.(session);
 }
+/** Probe the session-persistence service's cold-read face. */
+function probeColdReader(ctx) {
+	const service = ctx.get("sessionPersistence");
+	if (service === void 0 || service === null) return void 0;
+	return typeof service.open === "function" ? service : void 0;
+}
+/** Read one persisted session's header and full log through a read handle. */
+async function readColdLog(persistence, id) {
+	const handle = await persistence.open(id, "read");
+	try {
+		const cold = await handle.read(0);
+		return {
+			meta: handle.header,
+			events: cold.events
+		};
+	} finally {
+		await handle.close();
+	}
+}
 const Config = z.object({
 	maxAgeMinutes: z.natural().min(1).default(10),
 	stateDir: z.string().default(""),
@@ -789,9 +808,9 @@ function apply(ctx, config) {
 			if (probe === void 0) {
 				probe = (async () => {
 					try {
-						const persistence = ctx.get("sessionPersistence");
+						const persistence = probeColdReader(ctx);
 						if (persistence === void 0) return false;
-						const { events } = await persistence.inspect(id);
+						const { events } = await readColdLog(persistence, id);
 						return isParkedOnUserInput(events);
 					} catch {
 						return false;
@@ -812,7 +831,11 @@ function apply(ctx, config) {
 			if (cutoverBlocksWake(stateDir)) return;
 			const id = agent.id;
 			const exitAt = pendingContinue.get(id);
-			const record = followupReport ? pendingRestartRecord(stateDir) : null;
+			let record = followupReport ? pendingRestartRecord(stateDir) : null;
+			if (record !== null && record.initiator === void 0 && record.unexpected !== true && record.compositionRecovered !== true && record.error === void 0) {
+				acknowledgeRestartRecord(stateDir, record, Date.now());
+				record = null;
+			}
 			const owesReport = record !== null && (record.initiator === void 0 || id === record.initiator);
 			if (exitAt !== void 0) {
 				(async () => {
@@ -876,9 +899,9 @@ function apply(ctx, config) {
 			if (selection?.model !== void 0) agentOptions.model = selection.model;
 			let setup;
 			const presets = ctx.get("agentPresets");
-			const persistence = ctx.get("sessionPersistence");
+			const persistence = probeColdReader(ctx);
 			if (presets !== void 0 && persistence !== void 0) {
-				const inspected = await persistence.inspect(id);
+				const inspected = await readColdLog(persistence, id);
 				const presetId = deriveSessionPreset(agentPresetsHost, {
 					header: inspected.meta,
 					events: inspected.events

package/lib/{restart-context-D6nISh28.js → restart-context-DlaDZWKq.js}

@@ -1,4 +1,4 @@
-import { l as stateFile } from "./state-4f7yny39.js";
+import { f as stateFile } from "./state-CZMypGkB.js";
 import { execFileSync } from "node:child_process";
 import { createHash } from "node:crypto";
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readFileSync, renameSync, rmSync, writeFileSync } from "node:fs";
@@ -902,12 +902,17 @@ function activeCutover(stateDir) {
 * Restart-record context injection and interrupted-session continuity. After
 * a scheduled restart, the FULL report waits for the initiating session's
 * root agent, whenever it resumes (session restore is lazy, so no other
-* session is ever woken for reporting); a record without an initiator is
-* claimed by the first root agent created. Separately, a snapshot written at
-* SIGTERM time (`interrupted-sessions.json`) records which root sessions had
-* a live turn when the process stopped, so the next restart boot can resume
-* those sessions and queue a "continue" turn. Pure logic reads the durable
-* files; the plugin wires them into `agent/created` and `agent.followup`.
+* session is ever woken for reporting). A record without an initiator splits
+* by kind: one carrying diagnostics someone must hear about (an unplanned
+* recovery, a composition rollback, a failed restart) is claimed by the
+* first root agent created, while a bare planned outcome — the restart was
+* driven from outside the host and the operator's terminal already has the
+* announcement — is settled without waking anyone. Separately, a snapshot
+* written at SIGTERM time (`interrupted-sessions.json`) records which root
+* sessions had a live turn when the process stopped, so the next restart
+* boot can resume those sessions and queue a "continue" turn. Pure logic
+* reads the durable files; the plugin wires them into `agent/created` and
+* `agent.followup`.
 */
 /** Absolute path of the restart record inside a state directory. */
 function restartRecordFile(stateDir) {

package/lib/types/client/index.d.ts

@@ -2,7 +2,7 @@
  * Browser half of the original-tab launch-cutover handoff, plus the
  * boot-generation reload loop: polls carry the last-seen boot id, a stale id
  * with no cutover in flight reloads the tab once, and a sustained disconnection
- * (not a transient blip) raises a neutral overlay.
+ * (not a transient blip) raises a non-blocking connection notice.
  */
 import type { Context as ClientContext } from '@deepseek-ai/cordis';
 /** No Cordis services are needed; this is a same-origin browser lifecycle observer. */

package/lib/types/client/index.js

@@ -6,8 +6,10 @@ const FALLBACK_HASH_KEY = 'ankh-guard-handoff';
 const ACTIVE_RETRY_MS = 250;
 const ERROR_RETRY_MIN_MS = 1_000;
 const ERROR_RETRY_MAX_MS = 30_000;
-/** Sustained-failure threshold for the disconnected overlay; transient blips never show it. */
-const DISCONNECTED_OVERLAY_MS = 5_000;
+/** Sustained-failure threshold for the connection notice; transient blips never show it. */
+const DISCONNECTED_NOTICE_MS = 5_000;
+// Server idle polls hold for 25s; bound a stalled browser request beyond that.
+const REQUEST_TIMEOUT_MS = 35_000;
 /** No Cordis services are needed; this is a same-origin browser lifecycle observer. */
 export const inject = [];
 function encodeBase64Url(bytes) {
@@ -88,38 +90,55 @@ function consumeFallbackFragment() {
     writePending(pending);
     return pending;
 }
-function waitingOverlay(kind = 'restarting') {
+function waitingOverlay(kind = 'restarting', retry) {
     const existing = document.getElementById('ankh-guard-browser-handoff');
-    if (existing !== null)
+    // A confirmed restart cannot be downgraded by a subsequent transport failure.
+    if (existing?.dataset.kind === 'restarting' && kind === 'disconnected')
         return existing;
+    const element = existing ?? document.createElement('div');
     const zh = navigator.language.toLowerCase().startsWith('zh');
-    const element = document.createElement('div');
     element.id = 'ankh-guard-browser-handoff';
+    element.dataset.kind = kind;
     element.setAttribute('role', 'status');
     element.setAttribute('aria-live', 'polite');
-    // 'disconnected' covers failures without a known restart in flight (a bare
-    // exit may never come back) — neutral copy, no auto-recovery promise.
     element.textContent = kind === 'disconnected'
-        ? (zh ? '连接已断开,等待服务恢复。' : 'Connection lost; waiting for the service to recover.')
+        ? (zh ? '连接暂时中断，正在重试…' : 'Connection interrupted; retrying…')
         : (zh ? 'dsh 正在重启；此标签页会自动恢复。' : 'dsh is restarting; this tab will recover automatically.');
-    element.style.cssText = [
+    element.style.cssText = kind === 'restarting' ? [
         'position:fixed', 'inset:0', 'z-index:2147483647', 'display:grid', 'place-items:center',
         'padding:24px', 'background:rgba(15,18,24,.92)', 'color:#fff',
         'font:500 16px/1.5 system-ui,sans-serif', 'text-align:center',
+    ].join(';') : [
+        'position:fixed', 'top:calc(env(safe-area-inset-top,0px) + 12px)', 'left:12px', 'right:12px',
+        'max-width:520px', 'margin:0 auto', 'box-sizing:border-box', 'z-index:2147483647',
+        'display:flex', 'align-items:center', 'justify-content:space-between', 'gap:12px',
+        'padding:12px 16px', 'border:1px solid var(--dsw-alias-border-l2,#8885)', 'border-radius:16px',
+        'background:var(--dsw-alias-bg-base,#fff)', 'color:var(--dsw-alias-label-primary,#181a20)',
+        'box-shadow:0 4px 24px #0002', 'font:400 15px/1.5 system-ui,sans-serif',
     ].join(';');
-    document.documentElement.append(element);
+    if (kind === 'disconnected' && retry) {
+        const button = document.createElement('button');
+        button.textContent = zh ? '重试' : 'Retry';
+        button.style.cssText = 'flex:none;border:0;background:transparent;color:var(--dsw-alias-state-business-primary,#4d6bfe);font:inherit;min-height:36px;cursor:pointer';
+        button.onclick = retry;
+        element.append(button);
+    }
+    // Official theme tokens live on body, so the notice must inherit from it.
+    if (!existing)
+        (document.body ?? document.documentElement).append(element);
     return element;
 }
-async function post(body) {
+async function post(body, signal) {
     return fetch(ROUTE, {
         method: 'POST',
+        signal,
         credentials: 'same-origin',
         cache: 'no-store',
         headers: { 'content-type': 'application/json' },
         body: JSON.stringify(body),
     });
 }
-async function acknowledge(pending) {
+async function acknowledge(pending, signal) {
     const response = await post({
         version: 1,
         operation: 'ack',
@@ -127,7 +146,7 @@ async function acknowledge(pending) {
         channel: pending.channel,
         authentication: pending.authentication,
         ...(pending.capability !== undefined ? { capability: pending.capability } : {}),
-    });
+    }, signal);
     return response.status === 204;
 }
 /** Install the polling/reload loop for this tab's lifetime. */
@@ -138,24 +157,68 @@ export function apply(_ctx) {
     let cap;
     let errorRetryMs = ERROR_RETRY_MIN_MS;
     let firstFailureAt;
-    // Fullscreen notice only for SUSTAINED disconnection (restart window, bare
-    // exit): transient network blips and the backoff cadence never trip it.
+    let request;
+    let lastWakeAt = -Infinity;
+    const foreground = () => document.visibilityState !== 'hidden' && navigator.onLine !== false;
+    const clearConnectionNotice = () => {
+        const notice = document.getElementById('ankh-guard-browser-handoff');
+        if (notice?.dataset.kind === 'disconnected')
+            notice.remove();
+    };
+    const pause = () => {
+        if (timer !== undefined)
+            clearTimeout(timer);
+        timer = undefined;
+        const previous = request;
+        request = undefined;
+        previous?.abort();
+        firstFailureAt = undefined;
+        errorRetryMs = ERROR_RETRY_MIN_MS;
+        clearConnectionNotice();
+    };
+    const wake = () => {
+        if (disposed || !foreground() || Date.now() - lastWakeAt < 500)
+            return;
+        lastWakeAt = Date.now();
+        pause();
+        schedule();
+    };
+    const visibility = () => {
+        if (!foreground()) {
+            lastWakeAt = -Infinity;
+            pause();
+        }
+        else
+            wake();
+    };
+    const page = (event) => { if (event.persisted)
+        wake(); };
+    // Only visible failures count. Ordinary outages never block the page.
     const noteDisconnected = () => {
         firstFailureAt ??= Date.now();
-        if (Date.now() - firstFailureAt >= DISCONNECTED_OVERLAY_MS)
-            waitingOverlay('disconnected');
+        if (Date.now() - firstFailureAt >= DISCONNECTED_NOTICE_MS)
+            waitingOverlay('disconnected', wake);
     };
     const schedule = (delayMs = 0) => {
-        if (!disposed)
-            timer = setTimeout(() => { void tick(); }, delayMs);
+        if (timer !== undefined)
+            clearTimeout(timer);
+        if (!disposed && foreground())
+            timer = setTimeout(() => { timer = undefined; void tick(); }, delayMs);
     };
     const tick = async () => {
-        if (disposed)
+        if (disposed || !foreground() || request)
             return;
+        const current = new AbortController();
+        request = current;
+        const stale = () => disposed || request !== current || !foreground();
+        const deadline = setTimeout(() => current.abort(), REQUEST_TIMEOUT_MS);
         try {
             if (pending !== null) {
                 waitingOverlay();
-                if (await acknowledge(pending)) {
+                const acknowledged = await acknowledge(pending, current.signal);
+                if (stale())
+                    return;
+                if (acknowledged) {
                     const returnPath = pending.returnPath;
                     const originalTab = pending.channel === 'original-tab';
                     sessionStorage.removeItem(PENDING_KEY);
@@ -178,7 +241,9 @@ export function apply(_ctx) {
             const response = await post({
                 version: 1, operation: 'poll', capability: tabCapability,
                 ...(knownBootId === null ? {} : { knownBootId }),
-            });
+            }, current.signal);
+            if (stale())
+                return;
             if (!response.ok) {
                 noteDisconnected();
                 schedule(errorRetryMs);
@@ -188,6 +253,8 @@ export function apply(_ctx) {
             errorRetryMs = ERROR_RETRY_MIN_MS;
             firstFailureAt = undefined;
             const result = await response.json();
+            if (stale())
+                return;
             // Learn the serving boot id before acting on it — storing the successor's
             // id ahead of the reload is what makes the generation check one-shot.
             if (typeof result.bootId === 'string')
@@ -247,18 +314,35 @@ export function apply(_ctx) {
             }
         }
         catch {
+            if (stale())
+                return;
             // The expected restart interval rejects fetches; keep the old page and retry.
             noteDisconnected();
             schedule(errorRetryMs);
             errorRetryMs = Math.min(errorRetryMs * 2, ERROR_RETRY_MAX_MS);
             return;
         }
+        finally {
+            clearTimeout(deadline);
+            if (request === current)
+                request = undefined;
+        }
         schedule(ACTIVE_RETRY_MS);
     };
+    document.addEventListener('visibilitychange', visibility);
+    window.addEventListener('online', wake);
+    window.addEventListener('offline', visibility);
+    window.addEventListener('pageshow', page);
+    window.addEventListener('dsh-mobile-foreground', wake);
     void tick();
     return () => {
         disposed = true;
-        if (timer !== undefined)
-            clearTimeout(timer);
+        pause();
+        document.removeEventListener('visibilitychange', visibility);
+        window.removeEventListener('online', wake);
+        window.removeEventListener('offline', visibility);
+        window.removeEventListener('pageshow', page);
+        window.removeEventListener('dsh-mobile-foreground', wake);
+        document.getElementById('ankh-guard-browser-handoff')?.remove();
     };
 }