@ljwei-stak/dsh-model-router 0.16.0 → 0.16.1

package/.dsh-plugin/shared/dynamic-data.mjs

@@ -9,15 +9,16 @@
  * their own outbound network policy if untrusted users can configure endpoints.
  */
 import { createHash, randomUUID } from 'node:crypto'
-import { isIP } from 'node:net'
 import { fetchLiveBenchSnapshot } from './livebench.mjs'
-export { applyPricingSnapshot, dynamicDataSummary, routingData } from './dynamic-data-view.mjs'
+import { projectDynamicData, publicDynamicEndpoint } from './dynamic-data-view.mjs'
+export { applyPricingSnapshot, dynamicDataSummary, routingData, projectDynamicData, publicDynamicEndpoint } from './dynamic-data-view.mjs'
 
 const DEFAULT_TTL_MS = 86_400_000
 const TIMEOUT_MS = 8000
 const MAX_PAYLOAD_BYTES = 4 * 1024 * 1024
 const MAX_ROWS = 2000
 const MAX_CLOCK_SKEW_MS = 60_000
+const RESERVATION_GRACE_MS = 5000
 const ROW_FIELDS = new Set(['provider', 'model', 'input', 'output', 'cacheRead', 'cacheWrite', 'currency', 'unit', 'asOf', 'sourceUrl'])
 const PRICE_FIELDS = new Set(['schemaVersion', 'kind', 'version', 'publishedAt', 'rows'])
 const SCORE_FIELDS = new Set(['reasoning', 'code', 'math', 'research', 'writing', 'vision', 'summarization', 'classification'])
@@ -43,16 +44,7 @@ function revisionOf(data) {
   return hash({ liveBench: data.liveBench?.hash ?? null, pricing: data.pricing?.hash ?? null, status: data.status })
 }
 
-function publicUrl(value) {
-  if (typeof value !== 'string' || value.length > 2048) throw new Error('invalid-public-url')
-  const url = new URL(value)
-  const host = url.hostname.toLowerCase()
-  if (url.protocol !== 'https:' || url.username || url.password || url.search || url.hash
-    || (url.port && url.port !== '443') || isIP(host) || host.startsWith('[')
-    || !/^(?:[a-z0-9](?:[a-z0-9-]*[a-z0-9])?\.)+[a-z]{2,}$/u.test(host)
-    || /(?:^|\.)(?:localhost|local|internal|lan|home|test|invalid)$/u.test(host)) throw new Error('invalid-public-url')
-  return url.toString()
-}
+const publicUrl = publicDynamicEndpoint
 
 function identifier(value, max = 240) {
   if (typeof value !== 'string' || value.trim() !== value || !value || value.length > max
@@ -148,59 +140,94 @@ function mayPromote(previous, candidate) {
   return true
 }
 
-async function limitedText(response) {
+function cancelBody(body) {
+  try { Promise.resolve(body?.cancel?.()).catch(() => {}) } catch { /* best effort; never block rejection */ }
+}
+
+async function limitedText(response, signal) {
   const length = Number(response.headers?.get?.('content-length'))
-  if (Number.isFinite(length) && length > MAX_PAYLOAD_BYTES) throw new Error('payload-too-large')
+  if (Number.isFinite(length) && length > MAX_PAYLOAD_BYTES) {
+    cancelBody(response.body)
+    throw new Error('payload-too-large')
+  }
   if (!response.body?.getReader) {
     const text = await response.text()
     if (Buffer.byteLength(text, 'utf8') > MAX_PAYLOAD_BYTES) throw new Error('payload-too-large')
     return text
   }
   const reader = response.body.getReader()
-  const decoder = new TextDecoder()
+  const decoder = new TextDecoder('utf-8', { fatal: true })
   let size = 0
   let text = ''
+  const cancelReader = () => { try { Promise.resolve(reader.cancel()).catch(() => {}) } catch {} }
+  signal?.addEventListener('abort', cancelReader, { once: true })
   try {
     for (;;) {
+      if (signal?.aborted) throw new Error('refresh-aborted')
       const chunk = await reader.read()
+      if (signal?.aborted) throw new Error('refresh-aborted')
       if (chunk.done) return text + decoder.decode()
       size += chunk.value.byteLength
       if (size > MAX_PAYLOAD_BYTES) throw new Error('payload-too-large')
       text += decoder.decode(chunk.value, { stream: true })
     }
   } catch (error) {
-    await reader.cancel().catch(() => {})
+    cancelReader()
     throw error
-  } finally { reader.releaseLock() }
+  } finally { signal?.removeEventListener('abort', cancelReader); reader.releaseLock() }
 }
 
-function publicFetch(fetchImpl) {
+function publicFetch(fetchImpl, outerSignal) {
   return async (input, options = {}) => {
     const endpoint = publicUrl(String(input))
-    const response = await fetchImpl(endpoint, {
-      method: 'GET', headers: { accept: 'application/json,text/csv,text/html' },
-      credentials: 'omit', redirect: 'error', signal: options.signal,
-    })
-    if (!response?.ok || response.redirected) throw new Error('public-fetch-failed')
-    if (response.url && publicUrl(response.url) !== endpoint) throw new Error('public-fetch-redirected')
-    return { ok: true, status: response.status, headers: response.headers,
-      text: () => limitedText(response) }
+    const controller = new AbortController()
+    const signals = [...new Set([outerSignal, options.signal].filter(Boolean))]
+    const abort = () => controller.abort(new Error('refresh-aborted'))
+    const cleanup = () => { for (const signal of signals) signal.removeEventListener('abort', abort) }
+    for (const signal of signals) {
+      if (signal.aborted) abort()
+      else signal.addEventListener('abort', abort, { once: true })
+    }
+    controller.signal.addEventListener('abort', cleanup, { once: true })
+    let response
+    try {
+      if (controller.signal.aborted) throw new Error('refresh-aborted')
+      response = await fetchImpl(endpoint, {
+        method: 'GET', headers: { accept: 'application/json,text/csv,text/html' },
+        credentials: 'omit', redirect: 'error', signal: controller.signal,
+      })
+      if (controller.signal.aborted || !response?.ok || response.redirected) {
+        throw new Error('public-fetch-failed')
+      }
+      if (response.url && publicUrl(response.url) !== endpoint) {
+        throw new Error('public-fetch-redirected')
+      }
+      return { ok: true, status: response.status, headers: response.headers,
+        text: async () => { try { return await limitedText(response, controller.signal) } finally { cleanup() } } }
+    } catch (error) { cancelBody(response?.body); cleanup(); throw error }
   }
 }
 
-async function withTimeout(run) {
-  const controller = new AbortController()
-  let timer
-  let rejectTimeout
-  const timeout = new Promise((_, reject) => { rejectTimeout = reject })
-  timer = setTimeout(() => { controller.abort(); rejectTimeout(new Error('refresh-timeout')) }, TIMEOUT_MS)
-  try { return await Promise.race([run(controller.signal), timeout]) }
-  finally { clearTimeout(timer) }
+async function withTimeout(run, controller, timeoutMs) {
+  let rejectAborted
+  const aborted = new Promise((_, reject) => { rejectAborted = reject })
+  const onAbort = () => rejectAborted(new Error('refresh-aborted'))
+  controller.signal.addEventListener('abort', onAbort, { once: true })
+  const timer = setTimeout(() => controller.abort(new Error('refresh-timeout')), timeoutMs)
+  try {
+    if (controller.signal.aborted) throw new Error('refresh-aborted')
+    return await Promise.race([run(controller.signal), aborted])
+  } finally { clearTimeout(timer); controller.signal.removeEventListener('abort', onAbort) }
 }
 
 function due(data, kind, endpoint, ttlMs, at, force) {
   const status = data.status?.[kind]
   if (force || status?.endpoint !== endpoint || !finite(status?.lastAttemptAt)) return true
+  if (at < status.lastAttemptAt) return true // a corrected clock must not freeze refresh forever
+  if (status.requestId) {
+    const deadline = finite(status.requestDeadlineAt) ? status.requestDeadlineAt : status.lastAttemptAt + TIMEOUT_MS + RESERVATION_GRACE_MS
+    return at >= deadline
+  }
   const delay = status.error ? Math.min(ttlMs, 300_000) : ttlMs
   return at - status.lastAttemptAt >= delay
 }
@@ -210,11 +237,32 @@ function due(data, kind, endpoint, ttlMs, at, force) {
  * mutates the fresh state under the caller's interprocess/atomic write lock.
  */
 export function createDynamicDataRefresher({ store, fetchImpl = globalThis.fetch, now = Date.now,
-  fetchBenchmark = fetchLiveBenchSnapshot } = {}) {
+  fetchBenchmark = fetchLiveBenchSnapshot, timeoutMs = TIMEOUT_MS } = {}) {
   if (typeof store?.read !== 'function' || typeof store?.update !== 'function') throw new Error('dynamic-data-store-required')
+  if (!Number.isSafeInteger(timeoutMs) || timeoutMs < 1 || timeoutMs > TIMEOUT_MS) throw new Error('invalid-refresh-timeout')
   const flights = new Map()
+  const active = new Map()
+  const sourceStates = new Map()
+  const generationOf = kind => sourceStates.get(kind)?.generation ?? 0
   const refresh = async (options = {}) => {
-    if (options.enabled !== true) return emptyData()
+    if (options.enabled !== true) {
+      for (const kind of ['liveBench', 'pricing']) sourceStates.set(kind, { fingerprint: '', generation: generationOf(kind) + 1 })
+      const pending = [...active.values()]
+      for (const request of pending) request.controller.abort()
+      if (pending.length) {
+        try { await store.update(state => {
+          const data = dataOf(state)
+          for (const request of pending) if (data.status[request.kind]?.requestId === request.requestId) {
+            data.status[request.kind] = { ...data.status[request.kind], disabled: true, endpoint: '', error: '' }
+            delete data.status[request.kind].requestId
+            delete data.status[request.kind].requestDeadlineAt
+          }
+          data.revision = revisionOf(data)
+          state.dynamicData = data
+        }) } catch { /* disabled projection is safe even if cancellation cannot be persisted */ }
+      }
+      return emptyData()
+    }
     const ttlMs = finite(options.ttlMs) && options.ttlMs >= 0 ? options.ttlMs : DEFAULT_TTL_MS
     const liveBenchEndpoint = options.liveBenchEndpoint ?? 'https://livebench.ai'
     const pricingSnapshotEndpoint = options.pricingSnapshotEndpoint ?? ''
@@ -225,66 +273,96 @@ export function createDynamicDataRefresher({ store, fetchImpl = globalThis.fetch
       try { return { kind, endpoint: publicUrl(raw), disabled: false, invalid: false } }
       catch { return { kind, endpoint: '', disabled: false, invalid: true } }
     })
-    const key = stable([sources, ttlMs, options.force === true])
+    for (const source of sources) {
+      const fingerprint = stable(source)
+      if (fingerprint !== sourceStates.get(source.kind)?.fingerprint) {
+        sourceStates.set(source.kind, { fingerprint, generation: generationOf(source.kind) + 1 })
+        for (const request of active.values()) if (request.kind === source.kind) request.controller.abort()
+      }
+    }
+    const generations = Object.fromEntries(sources.map(source => [source.kind, generationOf(source.kind)]))
+    const key = stable([sources, generations, ttlMs, options.force === true])
     if (flights.has(key)) return flights.get(key)
     const operation = (async () => {
       const initial = dataOf(await store.read())
+      const storageFailures = new Set()
+      await Promise.all(sources.filter(source => source.disabled && (!initial.status[source.kind]?.disabled || initial.status[source.kind]?.requestId))
+        .map(async ({ kind }) => {
+          try { await store.update(state => {
+            if (generationOf(kind) !== generations[kind]) return
+            const data = dataOf(state)
+            data.status[kind] = { ...(data.status[kind] ?? {}), disabled: true, endpoint: '', error: '' }
+            delete data.status[kind].requestId
+            delete data.status[kind].requestDeadlineAt
+            data.revision = revisionOf(data)
+            state.dynamicData = data
+          }) } catch { storageFailures.add(kind) }
+        }))
       const requests = sources.filter(source => !source.disabled)
         .filter(({ kind, endpoint }) => due(initial, kind, endpoint, ttlMs, now(), options.force === true))
-      await Promise.all(requests.map(async ({ kind, endpoint, invalid }) => {
-        const at = now()
+      const settled = await Promise.allSettled(requests.map(async ({ kind, endpoint, invalid }) => {
         const requestId = randomUUID()
-        // Reserve before network I/O. Another process or source change wins by
-        // replacing this token; a late completion then cannot mutate its data.
-        const reserved = await store.update(state => {
-          const data = dataOf(state)
-          if (!due(data, kind, endpoint, ttlMs, at, options.force === true)) return false
-          data.status[kind] = { ...(data.status[kind] ?? {}), endpoint,
-            lastAttemptAt: at, requestId, error: '' }
-          data.revision = revisionOf(data)
-          state.dynamicData = data
-          return true
-        })
-        if (!reserved) return
-        let candidate
-        let error = ''
+        const controller = new AbortController()
+        const request = { kind, endpoint, requestId, controller }
+        active.set(requestId, request)
         try {
-          if (invalid) throw new Error('invalid-public-url')
-          if (typeof fetchImpl !== 'function') throw new Error('fetch-unavailable')
-          const fetchPublic = publicFetch(fetchImpl)
-          candidate = await withTimeout(async signal => {
-            if (kind === 'liveBench') {
-              const payload = await fetchBenchmark({ endpoint, fetchImpl: fetchPublic, timeoutMs: TIMEOUT_MS, strict: true })
-              return benchmarkSnapshot(payload, endpoint, now())
-            }
-            const response = await fetchPublic(endpoint, { signal })
-            return pricingSnapshot(JSON.parse(await response.text()), endpoint, now())
+          // Reserve before network I/O. Another process or source change wins by
+          // replacing this token; a late completion then cannot mutate its data.
+          const reserved = await store.update(state => {
+            if (generationOf(kind) !== generations[kind] || controller.signal.aborted) return false
+            const data = dataOf(state)
+            const at = now()
+            if (!due(data, kind, endpoint, ttlMs, at, options.force === true)) return false
+            data.status[kind] = { ...(data.status[kind] ?? {}), disabled: false, endpoint,
+              lastAttemptAt: at, requestId, requestDeadlineAt: at + timeoutMs + RESERVATION_GRACE_MS }
+            data.revision = revisionOf(data)
+            state.dynamicData = data
+            return true
           })
-        } catch { error = 'refresh-failed' }
-        await store.update(state => {
-          const data = dataOf(state)
-          if (data.status[kind]?.requestId !== requestId) return false
-          if (candidate && !mayPromote(data[kind], candidate)) error = 'snapshot-rollback-rejected'
-          if (candidate && !error) data[kind] = candidate
-          data.status[kind] = { ...data.status[kind], error,
-            ...(candidate && !error ? { lastSuccessAt: now() } : {}) }
-          delete data.status[kind].requestId
-          data.revision = revisionOf(data)
-          state.dynamicData = data
-          return true
-        })
+          if (!reserved) return
+          let candidate
+          let error = ''
+          try {
+            if (invalid) throw new Error('invalid-public-url')
+            if (typeof fetchImpl !== 'function') throw new Error('fetch-unavailable')
+            candidate = await withTimeout(async signal => {
+              const fetchPublic = publicFetch(fetchImpl, signal)
+              if (kind === 'liveBench') {
+                const payload = await fetchBenchmark({ endpoint, fetchImpl: fetchPublic, timeoutMs, signal, strict: true })
+                return benchmarkSnapshot(payload, endpoint, now())
+              }
+              const response = await fetchPublic(endpoint, { signal })
+              return pricingSnapshot(JSON.parse(await response.text()), endpoint, now())
+            }, controller, timeoutMs)
+          } catch { error = 'refresh-failed' }
+          await store.update(state => {
+            const data = dataOf(state)
+            if (data.status[kind]?.requestId !== requestId) return false
+            if (candidate && !mayPromote(data[kind], candidate)) error = 'snapshot-rollback-rejected'
+            if (candidate && !error) data[kind] = candidate
+            data.status[kind] = { ...data.status[kind], error,
+              ...(candidate && !error ? { lastSuccessAt: now() } : {}) }
+            delete data.status[kind].requestId
+            delete data.status[kind].requestDeadlineAt
+            data.revision = revisionOf(data)
+            state.dynamicData = data
+            return true
+          })
+        } finally { active.delete(requestId) }
       }))
+      for (let index = 0; index < settled.length; index += 1) if (settled[index].status === 'rejected') storageFailures.add(requests[index].kind)
       const result = dataOf(await store.read())
+      for (const kind of storageFailures) {
+        const endpoint = sources.find(source => source.kind === kind)?.endpoint ?? ''
+        result.status[kind] = { ...(result.status[kind]?.endpoint === endpoint ? result.status[kind] : {}),
+          endpoint, error: 'storage-failed' }
+        delete result.status[kind].requestId
+        delete result.status[kind].requestDeadlineAt
+      }
       // A user clearing a source disables its use immediately, without erasing
       // recoverable last-good snapshots from disk.
-      for (const { kind, disabled } of sources) {
-        if (disabled) {
-          result[kind] = null
-          result.status[kind] = { disabled: true, endpoint: '', error: '' }
-        }
-      }
       result.revision = revisionOf(result)
-      return result
+      return projectDynamicData(result, options)
     })()
     flights.set(key, operation)
     try { return await operation }

package/.dsh-plugin/shared/router-state.mjs

@@ -4,13 +4,15 @@
  * errors, cost, review and user ratings). One JSON file under the DSH home. Never stores keys.
  *
  * Several Host processes may share one DSH home, so every update takes a
- * lock file (`state.json.lock`, exclusive create; stale locks are broken),
+ * lock file (`state.json.lock`, exclusive create; only stale dead-owner locks
+ * are recovered). A busy live owner causes a bounded, explicit timeout,
  * re-reads the file, applies the change to the fresh copy and writes it back
  * atomically (temp file + rename). Reads re-read the file when its mtime or
  * size changed. A file that cannot be parsed is kept as
  * `state.json.corrupt-<timestamp>` and a notice is recorded instead of
  * silently discarding the history.
  */
+import { randomUUID } from 'node:crypto'
 import { mkdir, open, readFile, rename, stat, unlink, writeFile } from 'node:fs/promises'
 import { homedir } from 'node:os'
 import { dirname, isAbsolute, join, resolve } from 'node:path'
@@ -39,7 +41,7 @@ const LOCK_STALE_MS = 15_000
 const LOCK_TIMEOUT_MS = 10_000
 
 function emptyState() {
-  return { version: STATE_VERSION, onboarding: { completedAt: null }, health: null, quota: {}, authFailures: {}, runs: [], dynamicData: { liveBench: null, pricing: null, status: {}, revision: '' }, archivedSpending: sanitizeArchivedSpending(), notices: [], terminalSessions: [] }
+  return { version: STATE_VERSION, historyIncomplete: false, onboarding: { completedAt: null }, health: null, quota: {}, authFailures: {}, runs: [], dynamicData: { liveBench: null, pricing: null, status: {}, revision: '' }, archivedSpending: sanitizeArchivedSpending(), notices: [], terminalSessions: [] }
 }
 
 function sanitizeNotices(value) {
@@ -55,16 +57,62 @@ function retainRuns(state, maxRuns) {
   return state
 }
 
+const record = value => value !== null && typeof value === 'object' && !Array.isArray(value)
+const nonnegative = value => typeof value === 'number' && Number.isFinite(value) && value >= 0
+function invalidArchivedSpending(value) {
+  if (value === undefined || value === null) return false // old v1 files omit it
+  if (!record(value)) return true
+  for (const [field, pattern] of [['days', /^\d{4}-(?:0[1-9]|1[0-2])-(?:0[1-9]|[12]\d|3[01])$/u],
+    ['months', /^\d{4}-(?:0[1-9]|1[0-2])$/u]]) {
+    if (value[field] === undefined) continue
+    if (!record(value[field])) return true
+    for (const [key, totals] of Object.entries(value[field])) {
+      if (!pattern.test(key) || !record(totals)) return true
+      if (['costUsd', 'unknown', 'subscriptionUsd', 'subscriptionRuns'].some(name => totals[name] !== undefined
+        && (!nonnegative(totals[name]) || (['unknown', 'subscriptionRuns'].includes(name) && !Number.isInteger(totals[name]))))) return true
+    }
+  }
+  return false
+}
+
+function invalidRunSpending(run) {
+  if (!record(run) || invalidArchivedSpending(run.priorAttemptSpending)) return true
+  for (const field of ['packages', 'reviews']) {
+    if (run[field] === undefined) continue // missing legacy fields are not fabricated
+    if (!Array.isArray(run[field])) return true
+    for (const item of run[field]) {
+      if (!record(item) || (item.ran !== undefined && typeof item.ran !== 'boolean')) return true
+      if (['costUsd', 'referenceCostUsd'].some(name => item[name] !== undefined && item[name] !== null && !nonnegative(item[name]))) return true
+      if (item.ran === true || nonnegative(item.costUsd)) {
+        const at = item.finishedAt ?? run.createdAt
+        if (!nonnegative(at) || !Number.isFinite(new Date(at).getTime())) return true
+      }
+    }
+  }
+  return false
+}
+
 function sanitize(value, maxRuns) {
-  if (!value || typeof value !== 'object' || value.version !== STATE_VERSION) return emptyState()
+  if (!value || typeof value !== 'object' || Array.isArray(value) || value.version !== STATE_VERSION
+    || !Array.isArray(value.runs)) {
+    const error = new Error('模型路由状态版本或结构不受支持；原文件未修改，请先恢复或升级兼容版本。')
+    error.code = 'ROUTER_STATE_UNSUPPORTED'
+    throw error
+  }
+  const runs = value.runs.filter(run => run && typeof run.id === 'string')
   return retainRuns({
     version: STATE_VERSION,
+    // Unlike bounded notices, an incomplete-history marker cannot silently
+    // expire. Restoring a verified state file is required to recover budgets.
+    historyIncomplete: value.historyIncomplete === true || runs.length !== value.runs.length
+      || invalidArchivedSpending(value.archivedSpending) || runs.some(invalidRunSpending)
+      || sanitizeNotices(value.notices).some(notice => notice.kind === 'state-corrupt'),
     onboarding: { completedAt: Number.isFinite(value.onboarding?.completedAt) ? value.onboarding.completedAt : null },
     health: value.health && Array.isArray(value.health.tools) ? value.health : null,
     quota: value.quota && typeof value.quota === 'object' && !Array.isArray(value.quota) ? value.quota : {},
     authFailures: Object.fromEntries(Object.entries(value.authFailures && typeof value.authFailures === 'object' && !Array.isArray(value.authFailures) ? value.authFailures : {})
       .filter(([, entry]) => Number.isFinite(entry?.at))),
-    runs: Array.isArray(value.runs) ? value.runs.filter(run => run && typeof run.id === 'string') : [],
+    runs,
     dynamicData: value.dynamicData && typeof value.dynamicData === 'object' && !Array.isArray(value.dynamicData) ? value.dynamicData : { liveBench: null, pricing: null, status: {}, revision: '' },
     archivedSpending: sanitizeArchivedSpending(value.archivedSpending),
     notices: sanitizeNotices(value.notices),
@@ -93,36 +141,66 @@ export function terminalSessionRecord(record) {
 const sleep = ms => new Promise(resolve => setTimeout(resolve, ms))
 const stamp = at => new Date(at).toISOString().replace(/[:.]/g, '-')
 
-/** Exclusive lock file; a lock older than `staleMs` (crashed holder) is broken. */
+function ownerPid(raw) {
+  try {
+    const pid = JSON.parse(raw).pid
+    if (Number.isSafeInteger(pid) && pid > 0) return pid
+  } catch { /* support the previous pid/timestamp format */ }
+  const pid = Number(/^(\d+)\s+\d+\s*$/u.exec(raw)?.[1])
+  return Number.isSafeInteger(pid) && pid > 0 ? pid : null
+}
+
+function ownerIsDead(pid) {
+  if (pid === null) return false
+  try { process.kill(pid, 0); return false }
+  catch (error) { return error?.code === 'ESRCH' }
+}
+
+/** Never steal a live or unknown owner's lock, even after the wait timeout. */
 async function acquireLock(lockFile, { staleMs = LOCK_STALE_MS, timeoutMs = LOCK_TIMEOUT_MS, now = Date.now } = {}) {
-  const started = now()
+  // Elapsed waits must not freeze or jump when wall-clock time changes.
+  const started = performance.now()
   for (let attempt = 0; ; attempt += 1) {
     try {
       const handle = await open(lockFile, 'wx')
-      await handle.writeFile(`${process.pid} ${now()}\n`, 'utf8').catch(() => {})
+      const owner = `${JSON.stringify({ pid: process.pid, token: randomUUID(), at: now() })}\n`
+      try { await handle.writeFile(owner, 'utf8') }
+      catch (error) { await handle.close(); await unlink(lockFile).catch(() => {}); throw error }
       await handle.close()
-      return async () => { await unlink(lockFile).catch(() => {}) }
+      return async () => {
+        if (await readFile(lockFile, 'utf8').catch(() => null) === owner) await unlink(lockFile).catch(() => {})
+      }
     } catch (error) {
       if (error?.code !== 'EEXIST') throw error
       const info = await stat(lockFile).catch(() => null)
-      if (info && now() - info.mtimeMs > staleMs) {
-        await unlink(lockFile).catch(() => {})
-        continue
+      const owner = await readFile(lockFile, 'utf8').catch(() => null)
+      if (info && owner !== null && now() - info.mtimeMs > staleMs && ownerIsDead(ownerPid(owner))) {
+        const currentInfo = await stat(lockFile).catch(() => null)
+        if (currentInfo?.ino === info.ino && currentInfo?.mtimeMs === info.mtimeMs
+          && await readFile(lockFile, 'utf8').catch(() => null) === owner) {
+          await unlink(lockFile).catch(() => {})
+          continue
+        }
       }
-      if (now() - started > timeoutMs) {
-        // A live holder that never releases: break it rather than lose the write.
-        await unlink(lockFile).catch(() => {})
-        continue
+      if (performance.now() - started >= timeoutMs) {
+        const failure = new Error('模型路由状态正在被其他操作使用，保存未完成；请稍后重试。')
+        failure.code = 'ROUTER_STATE_LOCK_TIMEOUT'
+        throw failure
       }
       await sleep(Math.min(5 + attempt * 5, 50) + Math.floor(Math.random() * 10))
     }
   }
 }
 
-export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUNS, now = Date.now } = {}) {
+export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUNS, now = Date.now,
+  lockTimeoutMs = LOCK_TIMEOUT_MS, lockStaleMs = LOCK_STALE_MS } = {}) {
+  if (![lockTimeoutMs, lockStaleMs].every(value => Number.isFinite(value) && value >= 1 && value <= 3_600_000)) {
+    throw new RangeError('Lock timing must be between 1 and 3600000 milliseconds')
+  }
   const historyLimit = Number.isInteger(maxRuns) && maxRuns > 0 ? Math.min(maxRuns, MAX_RUNS) : MAX_RUNS
   let cache = null
   let cacheKey = ''
+  let cacheCorrupt = false
   let chain = Promise.resolve()
   let pendingNotices = []
   const lockFile = `${file}.lock`
@@ -131,43 +209,53 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
     return info ? `${info.mtimeMs}:${info.size}:${info.ino}` : 'missing'
   }
   /** Parse the file; keep an unparseable file as a backup and record a notice. */
-  const readFresh = async () => {
+  const readFresh = async ({ recoverCorrupt = false } = {}) => {
     let raw
     try { raw = await readFile(file, 'utf8') }
     catch (error) {
       if (error?.code === 'ENOENT') return { state: emptyState(), corrupt: false }
       throw error
     }
-    try { return { state: sanitize(JSON.parse(raw), historyLimit), corrupt: false } }
+    let parsed
+    try { parsed = JSON.parse(raw) }
     catch {
+      // Readers do not rename files outside the writer lock. Recheck under the
+      // lock so a concurrent valid replacement cannot be discarded as corrupt.
+      if (!recoverCorrupt) return { state: emptyState(), corrupt: true }
       const at = now()
-      const backup = `${file}.corrupt-${stamp(at)}`
-      let saved = true
-      try { await rename(file, backup) } catch { saved = false }
+      const backup = `${file}.corrupt-${stamp(at)}-${randomUUID()}`
+      await rename(file, backup)
       pendingNotices.push({
-        kind: 'state-corrupt', at, backup: saved ? backup : null,
-        message: saved
-          ? `模型路由状态文件已损坏，无法读取，已备份为 ${backup} 并重新开始记录。执行历史、评价和订阅冷却信息需要从备份中人工恢复。`
-          : '模型路由状态文件已损坏，无法读取，备份失败；已重新开始记录。',
+        kind: 'state-corrupt', at, backup,
+        message: `模型路由状态文件已损坏，无法读取，已备份为 ${backup} 并重新开始记录。执行历史、评价和订阅冷却信息需要从备份中人工恢复。`,
       })
-      return { state: emptyState(), corrupt: true }
+      return { state: { ...emptyState(), historyIncomplete: true }, corrupt: true }
     }
+    // Valid JSON with an unknown schema is not corrupt: preserve it exactly,
+    // and refuse both reads-as-empty and writes that would downgrade it.
+    return { state: sanitize(parsed, historyLimit), corrupt: false }
   }
   const load = async () => {
     const key = await fileKey()
     if (cache && key === cacheKey) return cache
     const fresh = await readFresh()
     cache = fresh.state
-    cacheKey = fresh.corrupt ? '' : key
+    cacheKey = key
+    cacheCorrupt = fresh.corrupt
     return cache
   }
   const persist = async state => {
     await mkdir(dirname(file), { recursive: true })
+    const committed = structuredClone(state)
+    const serialized = `${JSON.stringify(committed)}\n`
     const temp = `${file}.${process.pid}.${now()}.${Math.random().toString(36).slice(2, 8)}.tmp`
-    await writeFile(temp, `${JSON.stringify(state)}\n`, 'utf8')
-    await rename(temp, file)
-    cache = state
+    try {
+      await writeFile(temp, serialized, 'utf8')
+      await rename(temp, file)
+    } finally { await unlink(temp).catch(() => {}) }
+    cache = committed
     cacheKey = await fileKey()
+    cacheCorrupt = false
   }
   /**
    * Serialize read-modify-write updates within this process and, through the
@@ -176,17 +264,26 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
   const update = change => {
     const next = chain.then(async () => {
       await mkdir(dirname(file), { recursive: true })
-      const release = await acquireLock(lockFile, { now })
+      const release = await acquireLock(lockFile, { now, timeoutMs: lockTimeoutMs, staleMs: lockStaleMs })
       try {
         cache = null
-        const state = await load()
-        if (pendingNotices.length) { state.notices.push(...pendingNotices); pendingNotices = [] }
+        const { state } = await readFresh({ recoverCorrupt: true })
+        if (pendingNotices.length) state.notices.push(...pendingNotices)
         const result = await change(state)
+        const returned = result === undefined ? undefined : structuredClone(result)
         retainRuns(state, historyLimit)
         state.notices = sanitizeNotices(state.notices)
         state.terminalSessions = sanitizeTerminalSessions(state.terminalSessions)
         await persist(state)
-        return result
+        pendingNotices = []
+        return returned
+      } catch (error) {
+        // A rejected callback or disk write must not leak uncommitted state
+        // into the reader cache, including partial rating/budget changes.
+        cache = null
+        cacheKey = ''
+        cacheCorrupt = false
+        throw error
       } finally {
         await release()
       }
@@ -198,9 +295,13 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
   const read = async () => {
     await chain
     const state = await load()
-    if (pendingNotices.length) {
+    if (cacheCorrupt || pendingNotices.length) {
       const notices = [...pendingNotices]
-      try { await update(() => {}) } catch { return structuredClone({ ...state, notices: [...state.notices, ...notices] }) }
+      try { await update(() => {}) }
+      catch {
+        return structuredClone({ ...state, notices: [...state.notices, ...notices,
+          { kind: 'state-recovery-pending', at: now(), message: '模型路由状态恢复未完成；原文件保留，请稍后重试。' }] })
+      }
       return structuredClone(cache)
     }
     return structuredClone(state)
@@ -233,10 +334,10 @@ export function createRouterState({ file = defaultStatePath(), maxRuns = MAX_RUN
       return entry
     }),
     appendRun: run => update(current => { current.runs.push(run); return run }),
-    updateRun: (id, change) => update(current => {
+    updateRun: (id, change) => update(async current => {
       const run = current.runs.find(item => item.id === id)
       if (!run) throw new Error(`未找到运行记录 ${id}`)
-      change(run)
+      await change(run)
       return structuredClone(run)
     }),
     /** Remove one notice (for example after the user read the corrupt-file warning). */