@migor/agentia 0.10.4 → 0.10.6

package/dist/transport/approval-supervisor.js

@@ -20,6 +20,7 @@
 import { approvalExpired, approvalsComplete, fillTimeoutDenials } from './approval-policy.js';
 import { summarizeSuspended } from './wake-policy.js';
 import { isThenable } from '../store/store.js';
+import { TaskWakeGate } from './task-wake-gate.js';
 /**
  * `approve` 的失败：带 HTTP 语义的状态码（404 = 任务不存在，409 = 任务当前不在
  * `suspended` 状态），HTTP 宿主据此回对应响应。
@@ -56,8 +57,11 @@ export class ApprovalSupervisor {
      *  `approve` 与超时恢复都会「填决定 + 落库 + 派发」，不互斥就是同一任务跑两遍。 */
     #inflight = new Map();
     #deps;
+    /** 共享闸；单测可省略（省略时本件自建一把，跨路径互斥只在 AsyncRunner 注入时生效） */
+    #wakeGate;
     constructor(deps) {
         this.#deps = deps;
+        this.#wakeGate = deps.wakeGate ?? new TaskWakeGate();
     }
     /** 挂起读数：按原因分组的条数 + 最早的目标时刻（无时间挂起时为 `null`） */
     get summary() {
@@ -87,12 +91,18 @@ export class ApprovalSupervisor {
         }
     }
     /**
-     * 惰性审批超时：`approvalExpired` 为真 ⇒ 进在飞闸 + 自动全拒 + 落库 + 派发。返回是否命中。
+     * 惰性审批超时：`approvalExpired` 为真 ⇒ 进在飞闸 + 自动全拒 + 落库 + 派发。
+     *
+     * **返回是否真的起了这次恢复**（2026-11-09 深评 P2）：「命中超时判定」不等于「已经恢复」
+     * —— cancel 在飞、同任务已有别的唤醒路径占着互斥闸时，这里只是**跳过本轮**。此前它在
+     * 两条跳过路径上都返回 true，`resumePending` 据此 `expired++` 会说「处理了 N 条」而实际
+     * 一条没动；更糟的是宿主若只在启动时调一次 `resumePending`，这次跳过就等于该任务的
+     * 审批超时兜底丢了（下一个重判机会只来自 `poll`）。
      *
      * 与原 `#lazyGates` / `#redispatch` 里那两句 `if (approvalExpired(...)) #expireAndResume(...)`
-     * **逐字等价** —— `approvalExpired` 内部已判 `status === 'suspended'` 与
+     * 的**判定**逐字等价 —— `approvalExpired` 内部已判 `status === 'suspended'` 与
      * `reason === 'approval'`（见 approval-policy.ts），所以 `#redispatch` 原写法里那句额外的
-     * `rec.status !== 'suspended'` 短路是冗余的，合并到本方法不改变任何可观测行为。
+     * `rec.status !== 'suspended'` 短路是冗余的。
      */
     expireIfExpired(rec, now) {
         if (!approvalExpired(rec, now, this.#deps.approvalTimeoutMs))
@@ -101,8 +111,7 @@ export class ApprovalSupervisor {
         // 就是「取消后照常执行」那条竞态。惰性路径不丢事：下一轮读还会再判（若取消没成）。
         if (this.#deps.cancelInflight?.(rec.taskId))
             return false;
-        this.#expireAndResume(rec, now);
-        return true;
+        return this.#expireAndResume(rec, now);
     }
     /**
      * 审批一个处于 `suspended` 的任务（HITL）。
@@ -134,7 +143,9 @@ export class ApprovalSupervisor {
         const inflight = this.#inflight.get(taskId);
         if (inflight)
             return inflight;
-        const run = this.#approveInner(taskId, decisions, opts).finally(() => {
+        const run = this.#wakeGate
+            .run(taskId, () => this.#approveInner(taskId, decisions, opts))
+            .finally(() => {
             this.#inflight.delete(taskId);
         });
         this.#inflight.set(taskId, run);
@@ -173,8 +184,15 @@ export class ApprovalSupervisor {
         }
         rec.approvals ??= {};
         for (const [id, d] of Object.entries(decisions)) {
-            if (rec.approvals[id])
-                continue; // 逐 id 幂等：第一次决定赢
+            const existing = rec.approvals[id];
+            // 逐 id 幂等，但**旧挂起的决定**允许被本次覆盖（2026-11-07 深评）：
+            // OpenAI 兼容端点会复用 `call_1`，旧决定若不换新，新一次等待无法批准。
+            const stale = existing !== undefined &&
+                rec.suspendedSince !== undefined &&
+                existing.requestedAt !== undefined &&
+                existing.requestedAt !== rec.suspendedSince;
+            if (existing !== undefined && !stale)
+                continue;
             rec.approvals[id] = {
                 approved: d.approved,
                 ...(d.reason !== undefined ? { reason: d.reason } : {}),
@@ -186,7 +204,7 @@ export class ApprovalSupervisor {
         // 惰性审批超时：人的决定先并入（先到先赢），仍空着的待决项由超时兜底成 deny
         if (approvalExpired(rec, now, this.#deps.approvalTimeoutMs))
             fillTimeoutDenials(rec, now);
-        const complete = approvalsComplete(rec);
+        const complete = approvalsComplete(rec, rec.suspendedSince);
         if (complete) {
             rec.status = 'running'; // 由 #executeInner 接管（acquireSlot → 恢复执行）
             rec.ownerId = this.#deps.ownerId;
@@ -218,13 +236,21 @@ export class ApprovalSupervisor {
      */
     #expireAndResume(rec, now) {
         if (this.#inflight.has(rec.taskId))
-            return;
-        const run = this.#expireAndResumeInner(rec, now).finally(() => {
+            return false;
+        // 跨路径互斥（2026-11-07 深评 P1）：其它唤醒路径在飞 ⇒ 跳过本轮。
+        // 惰性路径不丢事：下一次 poll / resumePending 还会再判。返回 false 让调用方知道
+        // 「这一轮什么都没做」（2026-11-09 深评 P2：此前无条件返回 true，计数与事实不符）。
+        if (this.#wakeGate.busy(rec.taskId))
+            return false;
+        const run = this.#wakeGate
+            .run(rec.taskId, () => this.#expireAndResumeInner(rec, now))
+            .finally(() => {
             this.#inflight.delete(rec.taskId);
         });
         this.#inflight.set(rec.taskId, run);
         // poll / resumePending 路径没有调用方接 reject —— 订阅掉，不得逃逸成 unhandled rejection
         run.catch(() => undefined);
+        return true;
     }
     async #expireAndResumeInner(rec, now) {
         // 进闸后**重读一遍**再判：闸只互斥「进入」，挡不住「进闸前已取到的旧副本」——

package/dist/transport/approval-supervisor.js.map

@@ -1 +1 @@
-{"version":3,"file":"approval-supervisor.js","sourceRoot":"","sources":["../../src/transport/approval-supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAM/C;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,gEAAgE;IACvD,MAAM,CAAkB;IACjC,YAAY,MAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAmBD,MAAM,OAAO,kBAAkB;IAC7B;;;;;;;;;;;;;;;OAeG;IACM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAExD;yDACqD;IAC5C,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEnD,KAAK,CAAyB;IAEvC,YAAY,IAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;IACpB,CAAC;IAED,8CAA8C;IAC9C,IAAI,OAAO;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,mDAAmD;IACnD,aAAa,CAAC,GAAe;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO;QAC5E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,kCAAkC;IAClC,eAAe,CAAC,MAAc;QAC5B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAkB;QACxB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;gBAAE,SAAS;YAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED;;;;;;;OAOG;IACH,eAAe,CAAC,GAAe,EAAE,GAAW;QAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3E,sEAAsE;QACtE,2CAA2C;QAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,IAAI,CAAC;IACd,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,SAA4B,EAC5B,IAAI,GAA2B,EAAE;QAEjC,oEAAoE;QACpE,yDAAyD;QACzD,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YACnE,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,iEAAiE;IACjE,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,SAA4B,EAC5B,IAA4B;QAE5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,MAAM,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACrE,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,GAAG,CAAC,MAAM,KAAK,WAAW;gBACxB,CAAC,CAAC,QAAQ,MAAM,WAAW,GAAG,CAAC,eAAe,IAAI,IAAI,gBAAgB;gBACtE,CAAC,CAAC,QAAQ,MAAM,UAAU,GAAG,CAAC,MAAM,kBAAkB,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,iDAAiD;QACjD,2DAA2D;QAC3D,yDAAyD;QACzD,+CAA+C;QAC/C,qDAAqD;QACrD,mEAAmE;QACnE,aAAa;QACb,8DAA8D;QAC9D,mDAAmD;QACnD,8CAA8C;QAC9C,uCAAuC;QACvC,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,gBAAgB,UAAU,CAAC,MAAM,uBAAuB,UAAU,CAAC,CAAC,CAAC,eAAe,CACrF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,IAAI,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC;gBAAE,SAAS,CAAC,iBAAiB;YAClD,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,SAAS,EAAE,GAAG;gBACd,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;QACJ,CAAC;QACD,0CAA0C;QAC1C,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAAE,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,CAAC,CAAC;QACxC,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,yCAAyC;YACjE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,mDAAmD;QACnD,sCAAsC;QACtC,oCAAoC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,8BAA8B;YAC9B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC7B,iEAAiE;YACjE,2CAA2C;YAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,GAAe,EAAE,GAAW;QAC3C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO;QAC3C,MAAM,GAAG,GAAG,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,GAAG,EAAE;YAC5D,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACH,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,wEAAwE;QACxE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;IAC7B,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAe,EAAE,GAAW;QACtD,2CAA2C;QAC3C,iDAAiD;QACjD,sBAAsB;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC;QAC5B,IACE,MAAM,CAAC,MAAM,KAAK,WAAW;YAC7B,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAC3D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qCAAqC;YACrC,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,MAAM,UAAU,EACnD,GAAa,EAAE,OAAO,IAAI,GAAG,CAC/B,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,kCAAkC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,MAAM,UAAU,EACnD,GAAa,EAAE,OAAO,IAAI,GAAG,CAC/B,CAAC;gBACF,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,oDAAoD;QACpD,yDAAyD;QACzD,iDAAiD;QACjD,2CAA2C;QAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}
+{"version":3,"file":"approval-supervisor.js","sourceRoot":"","sources":["../../src/transport/approval-supervisor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,eAAe,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,sBAAsB,CAAC;AAC9F,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AAEtD,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C,OAAO,EAAE,YAAY,EAAE,MAAM,qBAAqB,CAAC;AAKnD;;;;GAIG;AACH,MAAM,OAAO,gBAAiB,SAAQ,KAAK;IACzC,gEAAgE;IACvD,MAAM,CAAkB;IACjC,YAAY,MAAuB,EAAE,OAAe;QAClD,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,kBAAkB,CAAC;QAC/B,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;IACvB,CAAC;CACF;AAwBD,MAAM,OAAO,kBAAkB;IAC7B;;;;;;;;;;;;;;;OAeG;IACM,UAAU,GAAG,IAAI,GAAG,EAA0B,CAAC;IAExD;yDACqD;IAC5C,SAAS,GAAG,IAAI,GAAG,EAA+B,CAAC;IAEnD,KAAK,CAAyB;IACvC,qDAAqD;IAC5C,SAAS,CAAe;IAEjC,YAAY,IAA4B;QACtC,IAAI,CAAC,KAAK,GAAG,IAAI,CAAC;QAClB,IAAI,CAAC,SAAS,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,YAAY,EAAE,CAAC;IACvD,CAAC;IAED,8CAA8C;IAC9C,IAAI,OAAO;QACT,OAAO,kBAAkB,CAAC,IAAI,CAAC,UAAU,CAAC,MAAM,EAAE,CAAC,CAAC;IACtD,CAAC;IAED,mDAAmD;IACnD,aAAa,CAAC,GAAe;QAC3B,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;YAAE,OAAO;QAC5E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;IACvF,CAAC;IAED,kCAAkC;IAClC,eAAe,CAAC,MAAc;QAC5B,IAAI,CAAC,UAAU,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;IACjC,CAAC;IAED;;;;OAIG;IACH,OAAO,CAAC,IAAkB;QACxB,IAAI,CAAC,UAAU,CAAC,KAAK,EAAE,CAAC;QACxB,KAAK,MAAM,GAAG,IAAI,IAAI,EAAE,CAAC;YACvB,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,SAAS;gBAAE,SAAS;YAC9E,IAAI,CAAC,UAAU,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,EAAE,MAAM,EAAE,GAAG,CAAC,eAAe,EAAE,MAAM,EAAE,GAAG,CAAC,MAAM,EAAE,CAAC,CAAC;QACvF,CAAC;IACH,CAAC;IAED;;;;;;;;;;;;;OAaG;IACH,eAAe,CAAC,GAAe,EAAE,GAAW;QAC1C,IAAI,CAAC,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAAE,OAAO,KAAK,CAAC;QAC3E,sEAAsE;QACtE,2CAA2C;QAC3C,IAAI,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAC1D,OAAO,IAAI,CAAC,gBAAgB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;IACzC,CAAC;IAED;;;;;;;;;;;;;;;;;OAiBG;IACH,KAAK,CAAC,OAAO,CACX,MAAc,EACd,SAA4B,EAC5B,IAAI,GAA2B,EAAE;QAEjC,oEAAoE;QACpE,yDAAyD;QACzD,6CAA6C;QAC7C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,cAAc,EAAE,CAAC,MAAM,CAAC,CAAC;QACrD,IAAI,QAAQ,EAAE,CAAC;YACb,MAAM,QAAQ,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;YACtC,OAAO,IAAI,CAAC,OAAO,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;QAC/C,CAAC;QACD,MAAM,QAAQ,GAAG,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC5C,IAAI,QAAQ;YAAE,OAAO,QAAQ,CAAC;QAC9B,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS;aACvB,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,aAAa,CAAC,MAAM,EAAE,SAAS,EAAE,IAAI,CAAC,CAAC;aAC9D,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QAChC,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,OAAO,GAAG,CAAC;IACb,CAAC;IAED,iEAAiE;IACjE,WAAW,CAAC,MAAc;QACxB,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;IACpC,CAAC;IAED,KAAK,CAAC,aAAa,CACjB,MAAc,EACd,SAA4B,EAC5B,IAA4B;QAE5B,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QAC/C,IAAI,CAAC,GAAG;YAAE,MAAM,IAAI,gBAAgB,CAAC,GAAG,EAAE,aAAa,MAAM,EAAE,CAAC,CAAC;QACjE,IAAI,GAAG,CAAC,MAAM,KAAK,WAAW,IAAI,GAAG,CAAC,eAAe,KAAK,UAAU,EAAE,CAAC;YACrE,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,GAAG,CAAC,MAAM,KAAK,WAAW;gBACxB,CAAC,CAAC,QAAQ,MAAM,WAAW,GAAG,CAAC,eAAe,IAAI,IAAI,gBAAgB;gBACtE,CAAC,CAAC,QAAQ,MAAM,UAAU,GAAG,CAAC,MAAM,kBAAkB,CACzD,CAAC;QACJ,CAAC;QACD,MAAM,GAAG,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;QACvB,iDAAiD;QACjD,2DAA2D;QAC3D,yDAAyD;QACzD,+CAA+C;QAC/C,qDAAqD;QACrD,mEAAmE;QACnE,aAAa;QACb,8DAA8D;QAC9D,mDAAmD;QACnD,8CAA8C;QAC9C,uCAAuC;QACvC,yBAAyB;QACzB,MAAM,UAAU,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,gBAAgB,IAAI,EAAE,CAAC,CAAC;QACvD,MAAM,UAAU,GAAG,MAAM,CAAC,IAAI,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC;QAC9E,IAAI,UAAU,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;YAC1B,MAAM,IAAI,gBAAgB,CACxB,GAAG,EACH,gBAAgB,UAAU,CAAC,MAAM,uBAAuB,UAAU,CAAC,CAAC,CAAC,eAAe,CACrF,CAAC;QACJ,CAAC;QACD,GAAG,CAAC,SAAS,KAAK,EAAE,CAAC;QACrB,KAAK,MAAM,CAAC,EAAE,EAAE,CAAC,CAAC,IAAI,MAAM,CAAC,OAAO,CAAC,SAAS,CAAC,EAAE,CAAC;YAChD,MAAM,QAAQ,GAAG,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,CAAC;YACnC,6CAA6C;YAC7C,6CAA6C;YAC7C,MAAM,KAAK,GACT,QAAQ,KAAK,SAAS;gBACtB,GAAG,CAAC,cAAc,KAAK,SAAS;gBAChC,QAAQ,CAAC,WAAW,KAAK,SAAS;gBAClC,QAAQ,CAAC,WAAW,KAAK,GAAG,CAAC,cAAc,CAAC;YAC9C,IAAI,QAAQ,KAAK,SAAS,IAAI,CAAC,KAAK;gBAAE,SAAS;YAC/C,GAAG,CAAC,SAAS,CAAC,EAAE,CAAC,GAAG;gBAClB,QAAQ,EAAE,CAAC,CAAC,QAAQ;gBACpB,GAAG,CAAC,CAAC,CAAC,MAAM,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,MAAM,EAAE,CAAC,CAAC,MAAM,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACvD,GAAG,CAAC,IAAI,CAAC,SAAS,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;gBACtE,SAAS,EAAE,GAAG;gBACd,GAAG,CAAC,GAAG,CAAC,cAAc,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,GAAG,CAAC,cAAc,EAAE,CAAC,CAAC,CAAC,EAAE,CAAC;aACjF,CAAC;QACJ,CAAC;QACD,0CAA0C;QAC1C,IAAI,eAAe,CAAC,GAAG,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC;YAAE,kBAAkB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;QAC1F,MAAM,QAAQ,GAAG,iBAAiB,CAAC,GAAG,EAAE,GAAG,CAAC,cAAc,CAAC,CAAC;QAC5D,IAAI,QAAQ,EAAE,CAAC;YACb,GAAG,CAAC,MAAM,GAAG,SAAS,CAAC,CAAC,yCAAyC;YACjE,GAAG,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACnC,CAAC;QACD,mDAAmD;QACnD,sCAAsC;QACtC,oCAAoC;QACpC,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QACjC,IAAI,QAAQ,EAAE,CAAC;YACb,8BAA8B;YAC9B,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,CAAC;YAC7B,iEAAiE;YACjE,2CAA2C;YAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC;QAC3B,CAAC;QACD,OAAO,EAAE,GAAG,GAAG,EAAE,CAAC;IACpB,CAAC;IAED;;;;;;;;;;;OAWG;IACH,gBAAgB,CAAC,GAAe,EAAE,GAAW;QAC3C,IAAI,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QACjD,2CAA2C;QAC3C,wDAAwD;QACxD,qDAAqD;QACrD,IAAI,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,GAAG,CAAC,MAAM,CAAC;YAAE,OAAO,KAAK,CAAC;QAClD,MAAM,GAAG,GAAG,IAAI,CAAC,SAAS;aACvB,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,EAAE,CAAC,IAAI,CAAC,qBAAqB,CAAC,GAAG,EAAE,GAAG,CAAC,CAAC;aAC3D,OAAO,CAAC,GAAG,EAAE;YACZ,IAAI,CAAC,SAAS,CAAC,MAAM,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACpC,CAAC,CAAC,CAAC;QACL,IAAI,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QACpC,wEAAwE;QACxE,GAAG,CAAC,KAAK,CAAC,GAAG,EAAE,CAAC,SAAS,CAAC,CAAC;QAC3B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,KAAK,CAAC,qBAAqB,CAAC,GAAe,EAAE,GAAW;QACtD,2CAA2C;QAC3C,iDAAiD;QACjD,sBAAsB;QACtB,MAAM,KAAK,GAAG,MAAM,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,MAAM,CAAC,CAAC;QACrD,MAAM,MAAM,GAAG,KAAK,IAAI,GAAG,CAAC;QAC5B,IACE,MAAM,CAAC,MAAM,KAAK,WAAW;YAC7B,CAAC,eAAe,CAAC,MAAM,EAAE,GAAG,EAAE,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAC3D,CAAC;YACD,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,kBAAkB,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;QAChC,MAAM,CAAC,MAAM,GAAG,SAAS,CAAC;QAC1B,MAAM,CAAC,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC;QACpC,IAAI,KAAyB,CAAC;QAC9B,IAAI,CAAC;YACH,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;QACxC,CAAC;QAAC,OAAO,GAAG,EAAE,CAAC;YACb,qCAAqC;YACrC,sCAAsC;YACtC,OAAO,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,MAAM,UAAU,EACnD,GAAa,EAAE,OAAO,IAAI,GAAG,CAC/B,CAAC;YACF,OAAO,MAAM,CAAC;QAChB,CAAC;QACD,IAAI,UAAU,CAAC,KAAK,CAAC,EAAE,CAAC;YACtB,kCAAkC;YAClC,IAAI,CAAC;gBACH,MAAM,KAAK,CAAC;YACd,CAAC;YAAC,OAAO,GAAG,EAAE,CAAC;gBACb,OAAO,CAAC,IAAI,CACV,6BAA6B,MAAM,CAAC,MAAM,UAAU,EACnD,GAAa,EAAE,OAAO,IAAI,GAAG,CAC/B,CAAC;gBACF,OAAO,MAAM,CAAC;YAChB,CAAC;QACH,CAAC;QACD,mDAAmD;QACnD,IAAI,CAAC,eAAe,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC;QACpC,oDAAoD;QACpD,yDAAyD;QACzD,iDAAiD;QACjD,2CAA2C;QAC3C,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAC;QAC5B,OAAO,MAAM,CAAC;IAChB,CAAC;CACF"}

package/dist/transport/async.d.ts

@@ -283,10 +283,8 @@ export declare class AsyncRunner {
      * （恢复段不把 session 交给 run 层，见 #executeInner 的 callOpts 注释）。
      * 只在首个挂起段快照；任务达终态时清掉（#execute 的出口）。
      *
-     * **刻意只放内存**：进程崩在「挂起 → 重启 → approve」之间会丢这一次会话回写 ——
-     * 会话少一轮，但绝写不进坏历史（孤立 tool_use / 历史翻倍），审批决定本身已落库、
-     * 不受影响。快照若落库就要动 TaskRecord 的序列化 schema（sqlite / redis），
-     * 而它相对审批决定只是锦上添花 —— 这个取舍是有意的。
+     * 这张 Map 只是本进程快路；同一份快照也由 applySuspendedOutcome 写进
+     * TaskRecord.sessionInput，挂起期间重启后仍能补写。终态两条路径一起清。
      */
     private readonly sessionInputs;
     constructor(app: AppCallable, opts?: AsyncRunnerOptions);
@@ -322,6 +320,7 @@ export declare class AsyncRunner {
      */
     streamTask(taskId: string, listener: (frame: TaskStreamFrame) => void, opts?: {
         from?: number;
+        pollMs?: number;
     }): Promise<() => void>;
     byIdempotency(key: string): MaybePromise<TaskRecord | undefined>;
     list(): MaybePromise<TaskRecord[]>;

package/dist/transport/async.js

@@ -8,11 +8,13 @@ import { combineSignals, releaseCombinedSignal } from '../core/abort.js';
 import { abortedError } from '../engine/turn.js';
 import { assertTimerDelay, TimeoutError } from '../core/timeout.js';
 import { zeroClauseOf } from '../core/limits.js';
-import { composeTraceEvents } from '../core/trace.js';
+import { addUsage, composeTraceEvents } from '../core/trace.js';
 import { SlotPool } from './slot-pool.js';
 import { ApprovalSupervisor } from './approval-supervisor.js';
 import { SignalSupervisor } from './signal-supervisor.js';
 import { ResumeScanner } from './resume-scanner.js';
+import { TaskWakeGate } from './task-wake-gate.js';
+import { createStreamJanitorGroup } from './stream-janitor.js';
 import { timerDue } from './wake-policy.js';
 import { DrainGate } from './drain-gate.js';
 import { formatOwnerId } from './owner-id.js';
@@ -96,6 +98,12 @@ export class TaskQueueFullError extends Error {
  * 如实抛 409（见 `#awaitCancelled`），不假装取消成功。
  */
 const CANCEL_GRACE_MS = 2_000;
+/**
+ * 跨进程流的兜底轮询间隔（2026-11-07 深评 F5）：本进程的 `markDone` 只覆盖本进程写终态，
+ * 后续段在别的进程完成时只能靠读 store 收口。5s 是「连接不挂死」与「store 读放大」的折中；
+ * 0 可关闭（内部/测试用）。
+ */
+const STREAM_CROSS_PROCESS_POLL_MS = 5_000;
 export class AsyncRunner {
     app;
     store;
@@ -157,6 +165,12 @@ export class AsyncRunner {
     }
     runTimeoutMs;
     approvalTimeoutMs;
+    /**
+     * 跨唤醒路径的 per-task 互斥闸（2026-11-07 深评 P1）：approve / signalTask / 审批超时 /
+     * 到期唤醒共用同一张表。缺了它，`approve × signalTask`（或 `wakeDue × signalTask`）
+     * 会各自凭同一份 suspended 快照派发一次 ⇒ 同一任务跑两遍、后写覆盖前写。
+     */
+    #wakeGate = new TaskWakeGate();
     /**
      * 审批监督簇（挂起登记 + 在飞闸 + `approve` + 超时恢复）—— 实现见 approval-supervisor.ts。
      * 依赖（store / ownerId / approvalTimeoutMs / dispatch 回调）在构造函数末尾注入。
@@ -200,6 +214,13 @@ export class AsyncRunner {
      * 纯记账件，独立于 store / 槽位 —— 所以在 855 行的类里单独抽一个文件。
      */
     #streams;
+    /**
+     * 跨进程流兜底的**单例扫描器**（2026-11-09 深评 P2-1）：此前 `streamTask` 给每个订阅
+     * 各建一个 5s 定时器去 `store.get`，N 个并发连接就是 N 个定时器 + N/5 QPS，无合并无上限 ——
+     * 而跨进程收口是低频事件，不值得按连接付这份成本。现在一拍里每个**任务**只读一次 store，
+     * 再把结论分发到该任务的各个订阅（见 stream-janitor.ts）。
+     */
+    #streamJanitors;
     /**
      * **同进程内的幂等键认领表**（idempotencyKey → 在飞记录）。
      *
@@ -219,10 +240,8 @@ export class AsyncRunner {
      * （恢复段不把 session 交给 run 层，见 #executeInner 的 callOpts 注释）。
      * 只在首个挂起段快照；任务达终态时清掉（#execute 的出口）。
      *
-     * **刻意只放内存**：进程崩在「挂起 → 重启 → approve」之间会丢这一次会话回写 ——
-     * 会话少一轮，但绝写不进坏历史（孤立 tool_use / 历史翻倍），审批决定本身已落库、
-     * 不受影响。快照若落库就要动 TaskRecord 的序列化 schema（sqlite / redis），
-     * 而它相对审批决定只是锦上添花 —— 这个取舍是有意的。
+     * 这张 Map 只是本进程快路；同一份快照也由 applySuspendedOutcome 写进
+     * TaskRecord.sessionInput，挂起期间重启后仍能补写。终态两条路径一起清。
      */
     sessionInputs = new Map();
     constructor(app, opts = {}) {
@@ -269,6 +288,15 @@ export class AsyncRunner {
             throw new Error(`approvalTimeoutMs 必须为 ≥ 0 的有限数（${zeroClauseOf('AsyncRunner.approvalTimeoutMs')}），收到 ${opts.approvalTimeoutMs}`);
         }
         this.ownerId = formatOwnerId(process.pid, this.#host, randomUUID().slice(0, 8));
+        // 跨进程流兜底（2026-11-09 深评 P2-1）：runner 级一个扫描器，一拍里每个任务只读一次 store。
+        // 用 `this.poll`（而不是裸 `store.get`）是为了保留惰性挂起闸 —— 审批超时 / 到期唤醒的
+        // 重判入口本来就搭在这条轮询上，换成裸 get 会让那两条兜底少一个触发点。
+        // 定时器**有订阅才存在**（见 stream-janitor.ts），空闲时零成本。
+        this.#streamJanitors = createStreamJanitorGroup({
+            poll: (taskId) => Promise.resolve(this.poll(taskId)),
+            ownerId: this.ownerId,
+            pollMs: STREAM_CROSS_PROCESS_POLL_MS,
+        });
         // 审批监督簇在 ownerId 就位后构造（它要用 store 与 ownerId）。`dispatch` 用**回调**
         // 注入而不是 import：派发入口 `#dispatch` 仍归本类（停机闸 + 唯一派发点 + 一次性告警），
         // 依赖保持单向（审批 → 派发），也避免两个模块互相 import。
@@ -276,6 +304,7 @@ export class AsyncRunner {
             store: this.store,
             ownerId: this.ownerId,
             approvalTimeoutMs: this.approvalTimeoutMs,
+            wakeGate: this.#wakeGate,
             dispatch: (rec) => this.#dispatch(rec),
             cancelInflight: (taskId) => this.#cancelInflight.get(taskId),
         });
@@ -286,6 +315,7 @@ export class AsyncRunner {
             store: this.store,
             ownerId: this.ownerId,
             approvals: this.#approvals,
+            wakeGate: this.#wakeGate,
             dispatch: (rec) => this.#dispatch(rec),
             cancelInflight: (taskId) => this.#cancelInflight.get(taskId),
         });
@@ -294,6 +324,7 @@ export class AsyncRunner {
             ownerId: this.ownerId,
             host: this.#host,
             approvals: this.#approvals,
+            wakeGate: this.#wakeGate,
             dispatch: (rec) => this.#dispatch(rec),
             isDraining: () => this.#drain.isDraining,
             cancelInflight: (taskId) => this.#cancelInflight.get(taskId),
@@ -429,17 +460,54 @@ export class AsyncRunner {
                 const rec = await this.poll(taskId);
                 if (rec)
                     listener({ type: 'end', record: rec });
+                // 终态但记录被清（TTL / 外部删除）也不能静默：客户端需要一个收口帧。
+                else
+                    listener({ type: 'closed', reason: 'not-in-this-process' });
                 return noop;
             }
             // 实时订阅：`onDone` 里补发 `end` 帧 —— 终态是流的一部分
             //（没有它，这条 SSE 会在任务跑完之后一直挂着，客户端以为它还在跑）
-            return this.#streams.subscribe(taskId, (item) => listener({ type: 'trace', index: item.index, event: item.event }), () => {
-                // poll 可能是异步 store ⇒ 用 then 补发（此刻任务已终态、记录已落库）
+            const off = this.#streams.subscribe(taskId, (item) => listener({ type: 'trace', index: item.index, event: item.event }), () => {
+                // poll 可能是异步 store ⇒ 用 then 补发（此刻任务已终态、记录已落库）。
+                // ⚠️ 必须有 rejection 处理（2026-11-07 深评）：`poll` 在 Redis 抖动时 reject，
+                // 没有第二个参数的 `.then` 会产生 unhandledRejection ⇒ Node ≥15 终止宿主进程。
                 void Promise.resolve(this.poll(taskId)).then((rec) => {
-                    if (rec)
-                        listener({ type: 'end', record: rec });
+                    try {
+                        if (rec)
+                            listener({ type: 'end', record: rec });
+                        // 记录被清（TTL / 外部删除）时也不能一帧都不发：`end` 是唯一会
+                        // closeStream 的帧，不发就是永远只有心跳。
+                        else
+                            listener({ type: 'closed', reason: 'not-in-this-process' });
+                    }
+                    catch {
+                        /* listener 自己的错由宿主记账，不得再变成 unhandled */
+                    }
+                }, () => {
+                    try {
+                        listener({ type: 'closed', reason: 'not-in-this-process' });
+                    }
+                    catch {
+                        /* 同上 */
+                    }
                 });
             });
+            // 跨进程收口（2026-11-07 深评 F5；2026-11-09 P2-1 提到 runner 级）：登记到单例扫描器，
+            // 本流关闭时注销。`pollMs <= 0` = 这条流不参与兜底（真正的时间间隔只有一个来源，
+            // 即 runner 上那个扫描器 —— 单连接不再各建定时器）。
+            let janitorCleanup = noop;
+            const cleanup = () => {
+                off();
+                janitorCleanup();
+            };
+            if ((opts.pollMs ?? STREAM_CROSS_PROCESS_POLL_MS) > 0) {
+                janitorCleanup = this.#streamJanitors.add(taskId, {
+                    isTerminal: (rec) => isTerminalTask(rec),
+                    onTerminal: () => this.#streams.markDone(taskId),
+                    onClosed: () => listener({ type: 'closed', reason: 'not-in-this-process' }),
+                });
+            }
+            return cleanup;
         }
         const rec = await this.poll(taskId);
         if (!rec)
@@ -516,11 +584,13 @@ export class AsyncRunner {
         if (advance !== undefined || isThenable(found)) {
             // 异步路径：先入闸（后续推进路径会看到它并等待/跳过），等在飞推进收口后**重读**再判
             const run = (async () => {
-                if (advance !== undefined)
-                    await advance.catch(() => undefined);
                 // 意图先立（等闸窗口里就要可见）：等槽位那趟 #executeInner 可能正好放行 ——
-                // 意图在场它才不会起跑（见 #executeInner 的取消意图闸）
+                // 意图在场它才不会起跑（见 #executeInner 的取消意图闸）。
+                // ⚠️ 必须在 `await advance` **之前**登记：此前写在等待之后，与注释相反，
+                // 让「等 approve 收口」的窗口里新起的 #execute 看不到意图（2026-11-07 深评）。
                 this.#cancels.add(taskId);
+                if (advance !== undefined)
+                    await advance.catch(() => undefined);
                 try {
                     const rec = advance !== undefined ? await this.store.get(taskId) : await found;
                     return await this.#cancel(rec, taskId);
@@ -541,7 +611,10 @@ export class AsyncRunner {
     }
     /** 三条推进路径（审批 / 事件投递 / 到期唤醒）在该任务上的在飞 Promise（无则 undefined） */
     #advanceInflight(taskId) {
-        return (this.#approvals.inflightFor(taskId) ??
+        // 跨路径闸的 tail 覆盖**全部**已登记的唤醒（含排队中的）；先取它，再退回各监督件的
+        // 单件读数 —— tail 是 2026-11-07 深评 P1 的修法，单件读数只作防御性兜底。
+        return (this.#wakeGate.tail(taskId) ??
+            this.#approvals.inflightFor(taskId) ??
             this.#signals.inflightFor(taskId) ??
             this.#scanner.inflightWakeFor(taskId));
     }
@@ -604,7 +677,10 @@ export class AsyncRunner {
             this.#reportPersistError(rec, error, 'outcome');
             saved = undefined;
         }
-        if (wasQueued)
+        // 只有「确实有一趟活着的 #execute 会消费这个标记」才登记；`queued` 但本进程没有
+        // 对应执行趟（resumePending 认领后被停机拒派 / 上一进程崩溃留下的记录）时登记
+        // 会永远没人摘（2026-11-07 深评 F8）。
+        if (wasQueued && this.#executions.has(taskId))
             this.#cancelSettled.add(taskId);
         const finish = () => {
             // 取消意图的终点（2026-10-13 ref-run-root-close）：还有活着的 #execute 时留给它消费 —— 它靠这个意图
@@ -820,11 +896,18 @@ export class AsyncRunner {
     /** 等到任务终态；超时抛错。`suspended` 不是终态 —— 继续等（人在路上 / 时刻未到）。 */
     async awaitTask(taskId, opts = {}) {
         const timeoutMs = opts.timeoutMs ?? 30_000;
+        // 坏值防线（2026-11-07 深评 F6）：`timeoutMs: NaN` 会让 `deadline` 变 NaN、
+        // `left <= 0` 恒假 ⇒ 永不超时；`Math.min(intervalMs, left)` 再把 NaN 交给
+        // setTimeout（Node 钳到 1ms）⇒ 每毫秒读一次 store。本仓其它定时旋钮全都挡了，这条漏了。
+        assertTimerDelay(timeoutMs, 'AsyncRunner.awaitTask 的 timeoutMs');
         // intervalMs 现在只是**兜底轮询**间隔，不是主路径：本进程把任务写到终态会主动唤醒
         // （见 task-waiters.ts 的 notify）。默认从 5ms 放宽到 250ms —— 旧实现每 5ms 读一次 store，
         // 等 30s 就是约 6000 次读（SQLite/Redis 下是 6000 次往返）。用异步 store 且终态由
         // **他进程**写入时唤不醒，才靠这个间隔兜底。
         const intervalMs = opts.intervalMs ?? 250;
+        if (!Number.isFinite(intervalMs) || intervalMs <= 0) {
+            throw new TypeError(`AsyncRunner.awaitTask 的 intervalMs 必须是正的有限数（毫秒），收到 ${String(opts.intervalMs)}`);
+        }
         const deadline = Date.now() + timeoutMs;
         for (;;) {
             // 走 poll 而不是裸 store.get：惰性审批超时的判定挂在那里（HITL）
@@ -1049,22 +1132,58 @@ export class AsyncRunner {
                         const out = await this.#raceTimeout(this.app.run(rec.spec.messages, callOpts), rec.taskId, () => runAc.abort());
                         rec.runId = out.run.runId;
                         rec.result = out.result;
+                        // 每段一棵 trace，但任务预算是一笔总账：先把本段落进累计，再供下一次恢复作 offset。
+                        // 自定义 AppCallable 若没交 trace（历史测试/薄宿主），跳过累计而不是把业务任务判失败。
+                        const segmentUsage = out.result.trace?.totalUsage;
+                        if (segmentUsage)
+                            rec.usageTotal = addUsage(rec.usageTotal, segmentUsage);
                         rec.error = out.result.error;
                         if (out.result.stopReason === 'suspended' && out.result.suspendedMessages) {
-                            // HITL 挂起：记录怎么改、事件簿记按 `eventsDelivered` 分档、以及「用户输入快照
-                            // 必须在 `rec.spec` 被覆盖**之前**取」那条顺序事实 —— 全在 `run-outcome.ts`。
-                            // 槽位照常释放（finally）、onFinished 不触发（#execute 的出口判断）、
-                            // finishedAt 不置（下面 finally 里按状态跳过）：它不是终态。
-                            const snapshot = applySuspendedOutcome(rec, out.result, out.result.suspendedMessages, {
-                                isResume,
-                                hasSessionStore: this.sessionStore !== undefined,
-                                now: Date.now(),
-                            });
-                            // 顺序承重：快照先落地，`markSuspended` 再登记（后者读 status / suspendedReason /
-                            // wakeAt —— 三样都刚被上一行写好；挂起读数纪律①：与落库同一个分支登记）
-                            if (snapshot !== undefined)
-                                this.sessionInputs.set(rec.taskId, snapshot);
-                            this.#approvals.markSuspended(rec);
+                            // 取消意图优先于挂起（2026-11-07 深评 P1-1）：引擎侧的 abort 守卫已覆盖
+                            // 「signal 已中止」的出口；这里再兜住「结果已返回、cancel 在随后一拍到达」的
+                            // 窗口 —— 否则记录会落成 suspended，cancel 等不到终态而 409。
+                            if (this.#cancels.has(rec.taskId)) {
+                                rec.status = 'cancelled';
+                                rec.error ??= abortedError();
+                                rec.pendingApprovals = undefined;
+                                rec.suspendedSince = undefined;
+                                rec.suspendedReason = undefined;
+                                rec.wakeAt = undefined;
+                                rec.pendingEvents = undefined;
+                                this.#approvals.unmarkSuspended(rec.taskId);
+                            }
+                            else {
+                                // HITL 挂起：记录怎么改、事件簿记按 `eventsDelivered` 分档、以及「用户输入快照
+                                // 必须在 `rec.spec` 被覆盖**之前**取」那条顺序事实 —— 全在 `run-outcome.ts`。
+                                // 槽位照常释放（finally）、onFinished 不触发（#execute 的出口判断）、
+                                // finishedAt 不置（下面 finally 里按状态跳过）：它不是终态。
+                                const snapshot = applySuspendedOutcome(rec, out.result, out.result.suspendedMessages, {
+                                    isResume,
+                                    hasSessionStore: this.sessionStore !== undefined,
+                                    now: Date.now(),
+                                });
+                                // 顺序承重：快照先落地，`markSuspended` 再登记（后者读 status / suspendedReason /
+                                // wakeAt —— 三样都刚被上一行写好；挂起读数纪律①：与落库同一个分支登记）
+                                if (snapshot !== undefined)
+                                    this.sessionInputs.set(rec.taskId, snapshot);
+                                this.#approvals.markSuspended(rec);
+                            }
+                        }
+                        else if (out.result.stopReason === 'suspended') {
+                            // 自定义 AppCallable 返回 suspended 却没给 suspendedMessages：内建引擎不会
+                            // 产生这种形状，但薄宿主/JS 宿主可达。按终态 failed 收口，别落成
+                            // 「suspended 但挂起痕迹全清」的僵尸记录（approve / resume 两条闸都判不到）。
+                            rec.status = 'failed';
+                            rec.error = {
+                                type: 'agent_error',
+                                message: 'AppCallable 返回了 stopReason=suspended，但没有 suspendedMessages —— 无法恢复，按失败收口',
+                                retryable: false,
+                            };
+                            rec.pendingApprovals = undefined;
+                            rec.suspendedSince = undefined;
+                            rec.suspendedReason = undefined;
+                            rec.wakeAt = undefined;
+                            this.#approvals.unmarkSuspended(rec.taskId);
                         }
                         else {
                             // 取消：机制与 `runTimeoutMs` 一字不差（同一条 abort signal），**意图**不同 ——
@@ -1109,6 +1228,9 @@ export class AsyncRunner {
                 }
             }
             finally {
+                // 所有终态出口都清补写快照（含异常/取消）；挂起则必须留下。
+                if (isTerminalTask(rec))
+                    rec.sessionInput = undefined;
                 // HITL：挂起不是「完成」—— finishedAt 不置（等待中的任务没有结束时刻）
                 if (rec.status !== 'suspended')
                     rec.finishedAt = Date.now();
@@ -1122,6 +1244,10 @@ export class AsyncRunner {
             }
         }
         catch (e) {
+            // 认领处的 #runAborts 登记在 save('running') **之前**，而 save 可能同步抛 /
+            // 异步 reject —— 那条路径跳过了内层 finally 的 delete ⇒ 句柄永久滞留。
+            // 这里兜底摘除（幂等），避免失败次数把 Map 撑成无界（2026-11-07 深评 F7）。
+            this.#runAborts.delete(rec.taskId);
             rec.status = 'failed';
             rec.error = classifyError(e);
             rec.finishedAt = Date.now();
@@ -1200,11 +1326,12 @@ export class AsyncRunner {
      * 只写「本轮用户输入 + 最终回复」（run 内部 tool 往返不进历史）、历史以 assistant
      * 结尾（无文本补占位）。回写失败吞掉 —— 辅助动作不得击穿任务（同 memory 回写防护）。
      *
-     * 无快照（进程在挂起期间重启过）时**跳过**：宁可少一轮历史，也不凭猜测写。
+     * 本进程优先读内存快路；重启后读 TaskRecord.sessionInput。只有旧版本留下的挂起记录
+     * 才可能两边都没有，那时跳过，不凭猜测写。
      */
     async #appendResumedSession(rec, finalText) {
         const sessionId = rec.spec.options?.sessionId;
-        const input = this.sessionInputs.get(rec.taskId);
+        const input = this.sessionInputs.get(rec.taskId) ?? rec.sessionInput;
         if (sessionId === undefined || this.sessionStore === undefined || input === undefined)
             return;
         try {