@ljwei-stak/dsh-model-router 0.15.0 → 0.16.1

package/.dsh-plugin/shared/livebench.mjs

@@ -23,7 +23,7 @@ const TASK_ALIASES = Object.freeze({
 const CATEGORY_TO_TASK = Object.freeze({
   reasoning: 'reasoning',
   coding: 'code',
-  'agentic coding': 'code',
+  // Agentic Coding is a different task family, not silently a Coding score.
   mathematics: 'math',
   'data analysis': 'research',
   language: 'writing',
@@ -38,10 +38,12 @@ function normalized(value) {
   return String(value ?? '').toLowerCase().replace(/[^a-z0-9]+/g, '')
 }
 
-function asScore(value) {
+function asScore(value, scale) {
+  if (value === null || value === undefined || String(value).trim() === '') return undefined
   const number = Number(value)
   if (!Number.isFinite(number)) return undefined
-  return clamp(number > 1 ? number / 100 : number)
+  if (number < 0 || number > (scale ?? 100)) return undefined
+  return scale === undefined ? (number > 1 ? number / 100 : number) : number / scale
 }
 
 function modelRows(payload) {
@@ -59,13 +61,13 @@ function rowName(row) {
   return String(row.model ?? row.model_name ?? row.name ?? row.id ?? row.slug ?? '')
 }
 
-function rowScores(row) {
+function rowScores(row, scale) {
   const source = row?.scores ?? row?.categories ?? row?.benchmark ?? row
   const scores = {}
   if (source === null || typeof source !== 'object') return scores
   for (const [task, aliases] of Object.entries(TASK_ALIASES)) {
     for (const alias of aliases) {
-      const score = asScore(source[alias])
+      const score = asScore(source[alias], scale)
       if (score !== undefined) {
         scores[task] = score
         break
@@ -77,22 +79,27 @@ function rowScores(row) {
 
 /** Normalize a provider response into `{ models: Record<normalizedId, row> }`. */
 export function normalizeLiveBenchPayload(payload, fetchedAt = Date.now(), source = 'livebench') {
+  const scale = payload?.scoreScale === 1 || payload?.scoreScale === 100 ? payload.scoreScale : undefined
   const models = {}
   for (const row of modelRows(payload)) {
     const id = normalized(rowName(row))
     if (id === '') continue
-    const scores = rowScores(row)
+    const scores = rowScores(row, scale)
     const values = Object.values(scores)
-    const overall = asScore(row?.overall ?? row?.score ?? row?.livebench_score)
+    const suppliedOverall = asScore(row?.overall ?? row?.score ?? row?.livebench_score, scale)
+    const overall = suppliedOverall
       ?? (values.length > 0 ? values.reduce((sum, value) => sum + value, 0) / values.length : undefined)
     if (overall === undefined) continue
+    if (models[id]) throw new Error('LiveBench model identifiers collide after normalization')
     models[id] = {
+      model: rowName(row),
       overall: Number(clamp(overall).toFixed(4)),
+      overallSource: suppliedOverall !== undefined && row?.overallSource !== 'derived' ? 'explicit' : 'derived',
       scores,
       rank: Number.isFinite(Number(row?.rank)) ? Number(row.rank) : undefined,
     }
   }
-  return { source, fetchedAt, models }
+  return { source, fetchedAt, models, ...(payload?.publishedAt === undefined ? {} : { publishedAt: payload.publishedAt }) }
 }
 
 /** Parse a small RFC-4180-compatible CSV without adding a runtime dependency. */
@@ -134,13 +141,22 @@ export function parseCsv(text) {
   return rows.slice(1).map(cells => Object.fromEntries(headers.map((header, index) => [header, cells[index] ?? ''])))
 }
 
-function mean(values) {
-  const numbers = values.map(asScore).filter(value => value !== undefined)
+function mean(values, percent = false) {
+  const numbers = values.map(value => percent
+    ? (String(value ?? '').trim() !== '' && Number.isFinite(Number(value)) && Number(value) >= 0 && Number(value) <= 100 ? Number(value) / 100 : undefined)
+    : asScore(value)).filter(value => value !== undefined)
   return numbers.length === 0 ? undefined : numbers.reduce((sum, value) => sum + value, 0) / numbers.length
 }
 
-function officialCsvPayload(csv, categories = {}) {
+function officialCsvPayload(csv, categories = {}, percent = false, strict = false) {
   const rows = parseCsv(csv)
+  if (strict) for (const row of rows) {
+    if (!row.model) throw new Error('LiveBench row has no model')
+    for (const [column, value] of Object.entries(row)) {
+      if (column === 'model' || String(value).trim() === '') continue
+      if (!Number.isFinite(Number(value)) || Number(value) < 0 || Number(value) > 100) throw new Error('LiveBench CSV score is outside 0..100')
+    }
+  }
   const categoryColumns = new Map()
   for (const [label, columns] of Object.entries(categories ?? {})) {
     const task = CATEGORY_TO_TASK[String(label).trim().toLowerCase()]
@@ -149,16 +165,18 @@ function officialCsvPayload(csv, categories = {}) {
   const models = rows.map(row => {
     const scores = {}
     for (const [task, columns] of categoryColumns.entries()) {
-      const score = mean(columns.map(column => row[column]))
+      const score = mean(columns.map(column => row[column]), percent)
       if (score !== undefined) scores[task] = score
     }
     // A mirror may already provide normalized task columns, so preserve them.
     for (const [task, aliases] of Object.entries(TASK_ALIASES)) {
       if (scores[task] !== undefined) continue
-      const score = mean(aliases.map(alias => row[alias]))
+      const score = mean(aliases.map(alias => row[alias]), percent)
       if (score !== undefined) scores[task] = score
     }
-    return { model: row.model, scores, overall: mean(Object.values(row).slice(1)) }
+    const suppliedOverall = mean([row.overall ?? row.score ?? row.livebench_score], percent)
+    return { model: row.model, scores, overall: suppliedOverall ?? mean(Object.values(row).slice(1), percent),
+      overallSource: suppliedOverall === undefined ? 'derived' : 'explicit' }
   })
   return { models }
 }
@@ -194,7 +212,7 @@ async function fetchWithTimeout(fetchImpl, url, signal) {
   return response
 }
 
-async function officialSnapshot({ endpoint, fetchImpl, signal, fetchedAt }) {
+async function officialSnapshot({ endpoint, fetchImpl, signal, fetchedAt, strict }) {
   const base = new URL(endpoint).origin
   let releases = [DEFAULT_RELEASE]
   try {
@@ -219,7 +237,7 @@ async function officialSnapshot({ endpoint, fetchImpl, signal, fetchedAt }) {
       const categoryResponse = await fetchWithTimeout(fetchImpl, absoluteUrl(base, `categories_${token}.json`), signal)
       const table = (await readResponse(tableResponse)).text
       const categories = JSON.parse((await readResponse(categoryResponse)).text)
-      return normalizeLiveBenchPayload(officialCsvPayload(table, categories), fetchedAt, `livebench:${release}`)
+      return normalizeLiveBenchPayload(officialCsvPayload(table, categories, true, strict), fetchedAt, `livebench:${release}`)
     } catch (error) {
       lastError = error
     }
@@ -235,6 +253,7 @@ export async function fetchLiveBenchSnapshot({
   endpoint = 'https://livebench.ai',
   fetchImpl = globalThis.fetch,
   timeoutMs = 8000,
+  strict = false,
 } = {}) {
   if (typeof fetchImpl !== 'function') throw new Error('fetch is unavailable')
   const controller = new AbortController()
@@ -245,14 +264,29 @@ export async function fetchLiveBenchSnapshot({
     const parsed = new URL(rawEndpoint)
     if ((parsed.hostname === 'livebench.ai' || parsed.hostname === 'www.livebench.ai')
       && (parsed.pathname === '' || parsed.pathname === '/')) {
-      return await officialSnapshot({ endpoint: parsed.toString(), fetchImpl, signal: controller.signal, fetchedAt })
+      return await officialSnapshot({ endpoint: parsed.toString(), fetchImpl, signal: controller.signal, fetchedAt, strict })
     }
     const url = parsed.toString().replace('{release}', DEFAULT_RELEASE)
     const response = await fetchWithTimeout(fetchImpl, url, controller.signal)
     const { type, text } = await readResponse(response)
     const isCsv = type.includes('csv') || /\.csv(?:$|\?)/i.test(parsed.pathname)
-    if (isCsv) return normalizeLiveBenchPayload(officialCsvPayload(text), fetchedAt, 'livebench-csv-mirror')
-    return normalizeLiveBenchPayload(JSON.parse(text), fetchedAt, 'livebench-json-mirror')
+    if (isCsv) {
+      if (strict) throw new Error('Dynamic custom LiveBench feeds require JSON with explicit scoreScale')
+      return normalizeLiveBenchPayload(officialCsvPayload(text), fetchedAt, 'livebench-csv-mirror')
+    }
+    const payload = JSON.parse(text)
+    if (strict) {
+      if (![1, 100].includes(payload?.scoreScale) || modelRows(payload).length === 0) throw new Error('LiveBench feed needs explicit scoreScale and nonempty models')
+      for (const row of modelRows(payload)) {
+        if (!rowName(row) || rowName(row).trim() !== rowName(row)) throw new Error('LiveBench model identifier is invalid')
+        const scores = row?.scores ?? row?.categories ?? row?.benchmark ?? row
+        const values = [row.overall ?? row.score ?? row.livebench_score,
+          ...Object.values(TASK_ALIASES).flatMap(aliases => aliases.map(alias => scores?.[alias]))]
+          .filter(value => value !== undefined && value !== null && String(value).trim() !== '')
+        if (!values.length || values.some(value => typeof value !== 'number' || !Number.isFinite(value) || value < 0 || value > payload.scoreScale)) throw new Error('LiveBench score is invalid for declared scale')
+      }
+    }
+    return normalizeLiveBenchPayload(payload, fetchedAt, 'livebench-json-mirror')
   } finally {
     clearTimeout(timer)
   }
@@ -260,5 +294,8 @@ export async function fetchLiveBenchSnapshot({
 
 /** Return a model's benchmark row using the same normalization as the adapter. */
 export function liveBenchRow(snapshot, model) {
-  return snapshot?.models?.[normalized(model)] ?? null
+  const row = snapshot?.models?.[normalized(model)] ?? null
+  // Dynamic snapshots require explicit model identity. Old programmatic
+  // snapshots retain their previous normalization-only compatibility.
+  return snapshot?.exactModelMatch === true && row?.model !== model ? null : row
 }

package/.dsh-plugin/shared/model-profiles.mjs

@@ -22,7 +22,7 @@ function nonnegative(value, label) {
 function normalizeProfile(entry, index) {
   const label = `第 ${index + 1} 个模型`
   if (!entry || typeof entry !== 'object' || Array.isArray(entry)) throw new Error(`${label} 必须是对象`)
-  const allowed = new Set(['provider', 'model', 'quality', 'pricing', 'specialties', 'cliModel', 'execution', 'billing', 'subscription', 'apiRoute'])
+  const allowed = new Set(['provider', 'model', 'benchmarkModel', 'quality', 'pricing', 'specialties', 'cliModel', 'execution', 'billing', 'subscription', 'apiRoute'])
   const unknown = Object.keys(entry).find(key => !allowed.has(key))
   if (unknown) throw new Error(`${label} 含不支持的字段 ${unknown}；不要在这里填写密钥或命令`)
   const provider = id(entry.provider)
@@ -31,6 +31,11 @@ function normalizeProfile(entry, index) {
     throw new Error(`${label} 需要模型目录中的准确 provider 和 model`)
   }
   const profile = { provider, model }
+  if (entry.benchmarkModel !== undefined) {
+    const benchmarkModel = id(entry.benchmarkModel)
+    if (!benchmarkModel || benchmarkModel.length > 240 || /[\u0000-\u001f]/u.test(benchmarkModel)) throw new Error(`${label} 的 benchmarkModel 需要准确的基准模型名称`)
+    profile.benchmarkModel = benchmarkModel
+  }
   if (entry.quality !== undefined) {
     const value = nonnegative(entry.quality, `${label} 的 quality`)
     if (value > 100) throw new Error(`${label} 的 quality 应在 0 到 100 之间`)
@@ -129,6 +134,7 @@ export function applyModelProfiles(routes, profiles) {
     if (!profile) return route
     return {
       ...route,
+      ...(profile.benchmarkModel === undefined ? {} : { benchmarkModel: profile.benchmarkModel }),
       ...(profile.quality === undefined ? {} : { quality: profile.quality, qualitySource: 'user' }),
       ...(profile.pricing === undefined ? {} : { pricing: { ...profile.pricing }, pricingSource: 'user' }),
       ...(profile.specialties === undefined ? {} : { specialties: [...profile.specialties] }),

package/.dsh-plugin/shared/official-tools-remote.mjs

@@ -78,7 +78,9 @@ const optionalRouteText = (value, subject) => {
 const rateRequestCodec = strictCodec(`${OFFICIAL_TOOLS_REMOTE_PACKAGE}#RateRequest`, value => {
   const request = plainObject(value, 'rate request')
   if (!['up', 'down', 'clear'].includes(request.rating)) throw new TypeError('rating must be up, down or clear')
-  return { runId: idText(request.runId, 'runId'), packageId: idText(request.packageId, 'packageId'), rating: request.rating }
+  if (request.expectedFinishedAt !== undefined && (!Number.isFinite(request.expectedFinishedAt) || request.expectedFinishedAt < 0)) throw new TypeError('expectedFinishedAt must be a non-negative timestamp')
+  return { runId: idText(request.runId, 'runId'), packageId: idText(request.packageId, 'packageId'), rating: request.rating,
+    ...(request.expectedFinishedAt === undefined ? {} : { expectedFinishedAt: request.expectedFinishedAt }) }
 })
 
 const rerunRequestCodec = strictCodec(`${OFFICIAL_TOOLS_REMOTE_PACKAGE}#RerunRequest`, value => {

package/.dsh-plugin/shared/router-state.mjs

@@ -4,13 +4,15 @@
  * errors, cost, review and user ratings). One JSON file under the DSH home. Never stores keys.
  *
  * Several Host processes may share one DSH home, so every update takes a
- * lock file (`state.json.lock`, exclusive create; stale locks are broken),
+ * lock file (`state.json.lock`, exclusive create; only stale dead-owner locks
+ * are recovered). A busy live owner causes a bounded, explicit timeout,
  * re-reads the file, applies the change to the fresh copy and writes it back
  * atomically (temp file + rename). Reads re-read the file when its mtime or
  * size changed. A file that cannot be parsed is kept as
  * `state.json.corrupt-<timestamp>` and a notice is recorded instead of
  * silently discarding the history.
  */
+import { randomUUID } from 'node:crypto'
 import { mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
@@ -39,7 +41,7 @@ const LOCK_STALE_MS = 15_000
 const LOCK_TIMEOUT_MS = 10_000
 
 function emptyState() {
-  return { version: STATE_VERSION, onboarding: { completedAt: null }, health: null, quota: {}, authFailures: {}, runs: [], archivedSpending: sanitizeArchivedSpending(), notices: [], terminalSessions: [] }
+  return { version: STATE_VERSION, historyIncomplete: false, onboarding: { completedAt: null }, health: null, quota: {}, authFailures: {}, runs: [], dynamicData: { liveBench: null, pricing: null, status: {}, revision: '' }, archivedSpending: sanitizeArchivedSpending(), notices: [], terminalSessions: [] }
 }
 
 function sanitizeNotices(value) {
@@ -55,16 +57,63 @@ function retainRuns(state, maxRuns) {
   return state
 }
 
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+const nonnegative = value => typeof value === 'number' && Number.isFinite(value) && value >= 0
+function invalidArchivedSpending(value) {
+  if (value === undefined || value === null) return false // old v1 files omit it
+  if (!record(value)) return true
+  for (const [field, pattern] of [['days', /^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/u],
+    ['months', /^\d{4}-(?:0[1-9]|1[0-2])$/u]]) {
+    if (value[field] === undefined) continue
+    if (!record(value[field])) return true
+    for (const [key, totals] of Object.entries(value[field])) {
+      if (!pattern.test(key) || !record(totals)) return true
+      if (['costUsd', 'unknown', 'subscriptionUsd', 'subscriptionRuns'].some(name => totals[name] !== undefined
+        && (!nonnegative(totals[name]) || (['unknown', 'subscriptionRuns'].includes(name) && !Number.isInteger(totals[name]))))) return true
+    }
+  }
+  return false
+}
+
+function invalidRunSpending(run) {
+  if (!record(run) || invalidArchivedSpending(run.priorAttemptSpending)) return true
+  for (const field of ['packages', 'reviews']) {
+    if (run[field] === undefined) continue // missing legacy fields are not fabricated
+    if (!Array.isArray(run[field])) return true
+    for (const item of run[field]) {
+      if (!record(item) || (item.ran !== undefined && typeof item.ran !== 'boolean')) return true
+      if (['costUsd', 'referenceCostUsd'].some(name => item[name] !== undefined && item[name] !== null && !nonnegative(item[name]))) return true
+      if (item.ran === true || nonnegative(item.costUsd)) {
+        const at = item.finishedAt ?? run.createdAt
+        if (!nonnegative(at) || !Number.isFinite(new Date(at).getTime())) return true
+      }
+    }
+  }
+  return false
+}
+
 function sanitize(value, maxRuns) {
-  if (!value || typeof value !== 'object' || value.version !== STATE_VERSION) return emptyState()
+  if (!value || typeof value !== 'object' || Array.isArray(value) || value.version !== STATE_VERSION
+    || !Array.isArray(value.runs)) {
+    const error = new Error('模型路由状态版本或结构不受支持；原文件未修改，请先恢复或升级兼容版本。')
+    error.code = 'ROUTER_STATE_UNSUPPORTED'
+    throw error
+  }
+  const runs = value.runs.filter(run => run && typeof run.id === 'string')
   return retainRuns({
     version: STATE_VERSION,
+    // Unlike bounded notices, an incomplete-history marker cannot silently
+    // expire. Restoring a verified state file is required to recover budgets.
+    historyIncomplete: value.historyIncomplete === true || runs.length !== value.runs.length
+      || invalidArchivedSpending(value.archivedSpending) || runs.some(invalidRunSpending)
+      || sanitizeNotices(value.notices).some(notice => notice.kind === 'state-corrupt'),
     onboarding: { completedAt: Number.isFinite(value.onboarding?.completedAt) ? value.onboarding.completedAt : null },
     health: value.health && Array.isArray(value.health.tools) ? value.health : null,
     quota: value.quota && typeof value.quota === 'object' && !Array.isArray(value.quota) ? value.quota : {},
     authFailures: Object.fromEntries(Object.entries(value.authFailures && typeof value.authFailures === 'object' && !Array.isArray(value.authFailures) ? value.authFailures : {})
       .filter(([, entry]) => Number.isFinite(entry?.at))),
-    runs: Array.isArray(value.runs) ? value.runs.filter(run => run && typeof run.id === 'string') : [],
+    runs,
+    dynamicData: value.dynamicData && typeof value.dynamicData === 'object' && !Array.isArray(value.dynamicData) ? value.dynamicData : { liveBench: null, pricing: null, status: {}, revision: '' },
     archivedSpending: sanitizeArchivedSpending(value.archivedSpending),
     notices: sanitizeNotices(value.notices),
     terminalSessions: sanitizeTerminalSessions(value.terminalSessions),
@@ -92,36 +141,66 @@ export function terminalSessionRecord(record) {
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
 const stamp = at => new Date(at).toISOString().replace(/[:.]/g, '-')
 
-/** Exclusive lock file; a lock older than `staleMs` (crashed holder) is broken. */
+function ownerPid(raw) {
+  try {
+    const pid = JSON.parse(raw).pid
+    if (Number.isSafeInteger(pid) && pid > 0) return pid
+  } catch { /* support the previous pid/timestamp format */ }
+  const pid = Number(/^(\d+)\s+\d+\s*$/u.exec(raw)?.[1])
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null
+}
+
+function ownerIsDead(pid) {
+  if (pid === null) return false
+  try { process.kill(pid, 0); return false }
+  catch (error) { return error?.code === 'ESRCH' }
+}
+
+/** Never steal a live or unknown owner's lock, even after the wait timeout. */
 async function acquireLock(lockFile, { staleMs = LOCK_STALE_MS, timeoutMs = LOCK_TIMEOUT_MS, now = Date.now } = {}) {
-  const started = now()
+  // Elapsed waits must not freeze or jump when wall-clock time changes.
+  const started = performance.now()
   for (let attempt = 0; ; attempt += 1) {
     try {
       const handle = await open(lockFile, 'wx')
-      await handle.writeFile(`${process.pid} ${now()}\n`, 'utf8').catch(() => {})
+      const owner = `${JSON.stringify({ pid: process.pid, token: randomUUID(), at: now() })}\n`
+      try { await handle.writeFile(owner, 'utf8') }
+      catch (error) { await handle.close(); await unlink(lockFile).catch(() => {}); throw error }
       await handle.close()
-      return async () => { await unlink(lockFile).catch(() => {}) }
+      return async () => {
+        if (await readFile(lockFile, 'utf8').catch(() => null) === owner) await unlink(lockFile).catch(() => {})
+      }
     } catch (error) {
       if (error?.code !== 'EEXIST') throw error
       const info = await stat(lockFile).catch(() => null)
-      if (info && now() - info.mtimeMs > staleMs) {
-        await unlink(lockFile).catch(() => {})
-        continue
+      const owner = await readFile(lockFile, 'utf8').catch(() => null)
+      if (info && owner !== null && now() - info.mtimeMs > staleMs && ownerIsDead(ownerPid(owner))) {
+        const currentInfo = await stat(lockFile).catch(() => null)
+        if (currentInfo?.ino === info.ino && currentInfo?.mtimeMs === info.mtimeMs
+          && await readFile(lockFile, 'utf8').catch(() => null) === owner) {
+          await unlink(lockFile).catch(() => {})
+          continue
+        }
       }
-      if (now() - started > timeoutMs) {
-        // A live holder that never releases: break it rather than lose the write.
-        await unlink(lockFile).catch(() => {})
-        continue
+      if (performance.now() - started >= timeoutMs) {
+        const failure = new Error('模型路由状态正在被其他操作使用，保存未完成；请稍后重试。')
+        failure.code = 'ROUTER_STATE_LOCK_TIMEOUT'
+        throw failure
       }
       await sleep(Math.min(5 + attempt * 5, 50) + Math.floor(Math.random() * 10))
     }
   }
 }
 
-export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUNS, now = Date.now } = {}) {
+export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUNS, now = Date.now,
+  lockTimeoutMs = LOCK_TIMEOUT_MS, lockStaleMs = LOCK_STALE_MS } = {}) {
+  if (![lockTimeoutMs, lockStaleMs].every(value => Number.isFinite(value) && value >= 1 && value <= 3_600_000)) {
+    throw new RangeError('Lock timing must be between 1 and 3600000 milliseconds')
+  }
   const historyLimit = Number.isInteger(maxRuns) && maxRuns > 0 ? Math.min(maxRuns, MAX_RUNS) : MAX_RUNS
   let cache = null
   let cacheKey = ''
+  let cacheCorrupt = false
   let chain = Promise.resolve()
   let pendingNotices = []
   const lockFile = `${file}.lock`
@@ -130,43 +209,53 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
     return info ? `${info.mtimeMs}:${info.size}:${info.ino}` : 'missing'
   }
   /** Parse the file; keep an unparseable file as a backup and record a notice. */
-  const readFresh = async () => {
+  const readFresh = async ({ recoverCorrupt = false } = {}) => {
     let raw
     try { raw = await readFile(file, 'utf8') }
     catch (error) {
       if (error?.code === 'ENOENT') return { state: emptyState(), corrupt: false }
       throw error
     }
-    try { return { state: sanitize(JSON.parse(raw), historyLimit), corrupt: false } }
+    let parsed
+    try { parsed = JSON.parse(raw) }
     catch {
+      // Readers do not rename files outside the writer lock. Recheck under the
+      // lock so a concurrent valid replacement cannot be discarded as corrupt.
+      if (!recoverCorrupt) return { state: emptyState(), corrupt: true }
       const at = now()
-      const backup = `${file}.corrupt-${stamp(at)}`
-      let saved = true
-      try { await rename(file, backup) } catch { saved = false }
+      const backup = `${file}.corrupt-${stamp(at)}-${randomUUID()}`
+      await rename(file, backup)
       pendingNotices.push({
-        kind: 'state-corrupt', at, backup: saved ? backup : null,
-        message: saved
-          ? `模型路由状态文件已损坏，无法读取，已备份为 ${backup} 并重新开始记录。执行历史、评价和订阅冷却信息需要从备份中人工恢复。`
-          : '模型路由状态文件已损坏，无法读取，备份失败；已重新开始记录。',
+        kind: 'state-corrupt', at, backup,
+        message: `模型路由状态文件已损坏，无法读取，已备份为 ${backup} 并重新开始记录。执行历史、评价和订阅冷却信息需要从备份中人工恢复。`,
       })
-      return { state: emptyState(), corrupt: true }
+      return { state: { ...emptyState(), historyIncomplete: true }, corrupt: true }
     }
+    // Valid JSON with an unknown schema is not corrupt: preserve it exactly,
+    // and refuse both reads-as-empty and writes that would downgrade it.
+    return { state: sanitize(parsed, historyLimit), corrupt: false }
   }
   const load = async () => {
     const key = await fileKey()
     if (cache && key === cacheKey) return cache
     const fresh = await readFresh()
     cache = fresh.state
-    cacheKey = fresh.corrupt ? '' : key
+    cacheKey = key
+    cacheCorrupt = fresh.corrupt
     return cache
   }
   const persist = async state => {
     await mkdir(dirname(file), { recursive: true })
+    const committed = structuredClone(state)
+    const serialized = `${JSON.stringify(committed)}\n`
     const temp = `${file}.${process.pid}.${now()}.${Math.random().toString(36).slice(2, 8)}.tmp`
-    await writeFile(temp, `${JSON.stringify(state)}\n`, 'utf8')
-    await rename(temp, file)
-    cache = state
+    try {
+      await writeFile(temp, serialized, 'utf8')
+      await rename(temp, file)
+    } finally { await unlink(temp).catch(() => {}) }
+    cache = committed
     cacheKey = await fileKey()
+    cacheCorrupt = false
   }
   /**
    * Serialize read-modify-write updates within this process and, through the
@@ -175,17 +264,26 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
   const update = change => {
     const next = chain.then(async () => {
       await mkdir(dirname(file), { recursive: true })
-      const release = await acquireLock(lockFile, { now })
+      const release = await acquireLock(lockFile, { now, timeoutMs: lockTimeoutMs, staleMs: lockStaleMs })
       try {
         cache = null
-        const state = await load()
-        if (pendingNotices.length) { state.notices.push(...pendingNotices); pendingNotices = [] }
+        const { state } = await readFresh({ recoverCorrupt: true })
+        if (pendingNotices.length) state.notices.push(...pendingNotices)
         const result = await change(state)
+        const returned = result === undefined ? undefined : structuredClone(result)
         retainRuns(state, historyLimit)
         state.notices = sanitizeNotices(state.notices)
         state.terminalSessions = sanitizeTerminalSessions(state.terminalSessions)
         await persist(state)
-        return result
+        pendingNotices = []
+        return returned
+      } catch (error) {
+        // A rejected callback or disk write must not leak uncommitted state
+        // into the reader cache, including partial rating/budget changes.
+        cache = null
+        cacheKey = ''
+        cacheCorrupt = false
+        throw error
       } finally {
         await release()
       }
@@ -197,9 +295,13 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
   const read = async () => {
     await chain
     const state = await load()
-    if (pendingNotices.length) {
+    if (cacheCorrupt || pendingNotices.length) {
       const notices = [...pendingNotices]
-      try { await update(() => {}) } catch { return structuredClone({ ...state, notices: [...state.notices, ...notices] }) }
+      try { await update(() => {}) }
+      catch {
+        return structuredClone({ ...state, notices: [...state.notices, ...notices,
+          { kind: 'state-recovery-pending', at: now(), message: '模型路由状态恢复未完成；原文件保留，请稍后重试。' }] })
+      }
       return structuredClone(cache)
     }
     return structuredClone(state)
@@ -232,10 +334,10 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
       return entry
     }),
     appendRun: run => update(current => { current.runs.push(run); return run }),
-    updateRun: (id, change) => update(current => {
+    updateRun: (id, change) => update(async current => {
       const run = current.runs.find(item => item.id === id)
       if (!run) throw new Error(`未找到运行记录 ${id}`)
-      change(run)
+      await change(run)
       return structuredClone(run)
     }),
     /** Remove one notice (for example after the user read the corrupt-file warning). */