@rei-standard/amsg-server 2.6.0-next.30 → 2.6.0-next.31

package/README.md

@@ -703,6 +703,26 @@ LLM 这一条只认上游**答复了、并且拒了**的那几种状态码：Key
 
 `GET /capabilities` 的 features 里对应 `llm-permanent-errors`、`redeliver-committed-batch`、`hook-usage-total`、`max-delivery-retries`。
 
+## 按任务限制生成重试（`maxGenerationRetries`）
+
+用户主动触发的回复可以第一次生成失败就结束，定时任务则保留默认退避。工厂配置和 `runScheduledTick` / `runTask` 支持 `maxGenerationRetries`，值可以是非负整数，也可以是同步函数：
+
+```js
+createSingleUserCloudflareWorker((env) => ({
+  // 这里的 interactive 是宿主自己约定的 metadata，库不认识业务类型。
+  maxGenerationRetries: (task) => task.metadata?.interactive ? 0 : undefined,
+  // ...其余配置
+}));
+```
+
+回调收到与 `serializeBy` 相同的安全任务视图（含 metadata，不含 API Key 等凭据），每次尝试解析一次。返回 `undefined` 继承 `maxDeliveryRetries`（默认 3），返回 0 禁止本轮失败后重新生成；显式数值单独控制生成重试上限。不配置时行为不变，不需要修改任务 payload 或迁移数据库，已有任务也生效。所有服务端工厂和旧的 UUID 即时入口都透传这个配置。
+
+这里的“生成阶段”以**最终回复整批进入 outbox**为边界：前置 hook、模型、工具循环、组装和落库失败都使用生成上限；没有 outbox 的适配器发生推送失败时仍可能需要重新生成，因此也使用生成上限。完整批次已入 outbox 后的推送失败改用 `maxDeliveryRetries`，补投不会再次调用模型。hook 的独立 `emitResult` 不等于最终回复提交。
+
+`onFireSettled` 新增 `willRetry` 与 `failureStage`：失败时前者为本次的重试决策，后者为 `'generation'` 或 `'delivery'`；成功、跳过、未接管时两者均为 `null`。宿主可以用 `info.status === 'failed' && info.willRetry === false && !info.outboxed` 即时显示生成失败，无需修改错误对象或猜测重试次数。此回执发生在调度器写任务状态之前，`willRetry` 描述同源策略决策，不保证后续数据库写入成功；取消导致的失败不会重试。已有永久性错误判定仍然生效。
+
+策略回调抛错或返回非法值时，不调用生成 hook / 模型，以 `GENERATION_RETRY_POLICY_INVALID` 记录配置错误并沿默认投递上限退避，避免一次坏部署立即作废所有任务；此时尚未进入 fire，因此不触发 `onFireSettled`。
+
 ## 同一分组的任务不并发（`serializeBy`）
 
 同一个角色可能有好几条定时任务。撞在一起并发跑的话，用户一口气收到两条互不知情的消息；宿主在 hook 里维护的「我刚才说过什么」台账通常是读进内存 → 改 → 整份写回，两条各改各的再写回，后写的必然盖掉前面那条。

package/dist/adapters/d1.d.ts

@@ -110,6 +110,15 @@ export class D1Adapter {
         status: string;
     } | null>;
     updateTaskById(taskId: any, updates: any): Promise<any>;
+    /**
+     * 按 uuid 改一条 pending 任务（PUT /update-message、fire hook 的 renewTask）。
+     *
+     * 改排期（extraFields 里带 next_send_at）时多一道租约门：这条任务正被一次投递
+     * 占着的话不改，返回 null。投递收尾会按自己领取时看到的排期推进下一次（一次性
+     * 任务干脆标成已发送），这期间写进去的新时刻随后就被盖掉，接口却已经回了成功
+     * ——用户以为改期生效了，实际什么都没留下。正文这类字段不受这道门约束：它们
+     * 只影响以后的触发，收尾那边本来就不会覆盖（见 run-tick 的收尾守卫）。
+     */
     updateTaskByUuid(uuid: any, userId: any, encryptedPayload: any, extraFields: any): Promise<{
         uuid: any;
         updated_at: string;

package/dist/adapters/interface.d.ts

@@ -302,8 +302,10 @@ export type DbAdapter = {
         last_error: string | null;
     } | null>;
     /**
-     * （可选）建新任务的同一事务里取消旧的那条（POST /schedule-message 的
-     * supersedesUuid）。不实现时 handler 退回「先删再建」两步（失去原子性）。
+     * （可选）建新任务的同时取消旧的那条，两件事一起成败（POST /schedule-message
+     * 的 supersedesUuid）。内置的 D1 / pg / neon 都实现了。不实现时 handler 退回
+     * 两步：先建新、后删旧——删旧失败最坏是两条都留着，客户端重试一次就能收拾，
+     * 而反过来（先删后建）建新失败就把旧任务白删了，找不回来。
      */
     createTaskSuperseding?: (params: InsertTaskParams, supersedesUuid: string) => Promise<TaskRow & {
         superseded: boolean;

package/dist/adapters/neon.d.ts

@@ -39,6 +39,14 @@ export class NeonAdapter {
     }>;
     dropSchema(): Promise<void>;
     createTask(params: any): Promise<Record<string, any>>;
+    createTaskSuperseding(params: any, supersedesUuid: any): Promise<{
+        id: number;
+        uuid: string;
+        next_send_at: any;
+        status: string;
+        created_at: any;
+        superseded: boolean;
+    }>;
     getTaskByUuid(uuid: any, userId: any): Promise<Record<string, any>>;
     getTaskByUuidOnly(uuid: any): Promise<Record<string, any>>;
     /**
@@ -52,6 +60,15 @@ export class NeonAdapter {
         status: string;
     } | null>;
     updateTaskById(taskId: any, updates: any): Promise<Record<string, any>>;
+    /**
+     * 按 uuid 改一条 pending 任务（PUT /update-message、fire hook 的 renewTask）。
+     *
+     * 改排期（extraFields 里带 next_send_at）时多一道租约门：这条任务正被一次投递
+     * 占着的话不改，返回 null。投递收尾会按自己领取时看到的排期推进下一次（一次性
+     * 任务干脆标成已发送），这期间写进去的新时刻随后就被盖掉，接口却已经回了成功
+     * ——用户以为改期生效了，实际什么都没留下。正文这类字段不受这道门约束：它们
+     * 只影响以后的触发，收尾那边本来就不会覆盖（见 run-tick 的收尾守卫）。
+     */
     updateTaskByUuid(uuid: any, userId: any, encryptedPayload: any, extraFields: any): Promise<Record<string, any>>;
     deleteTaskById(taskId: any): Promise<boolean>;
     deleteTaskByUuid(uuid: any, userId: any): Promise<boolean>;

package/dist/adapters/pg-shared.d.ts

@@ -59,6 +59,39 @@ export function claimTask(query: PgQuery, taskId: number, expectedNextSendAt: st
  * @returns {Promise<boolean>} true = 续上了
  */
 export function renewTaskLease(query: PgQuery, taskId: number, leaseUntil: string | Date): Promise<boolean>;
+/**
+ * 建新任务的同时把被顶替的旧任务删掉（POST /schedule-message 带
+ * supersedesUuid 时走这条）。
+ *
+ * 删旧和建新必须一起成败：分成两次查询的话，建新那步失败（uuid 撞了、连接
+ * 一时抖了）时旧任务已经删掉了，接口却回失败——客户端以为旧任务还在，实际
+ * 上它已经没了，没有任何办法找回来。
+ *
+ * 一条语句解决，不用显式事务：数据修改型 CTE 里的 DELETE 一定会执行到底，
+ * 而 INSERT 抛错时整条语句一起回滚（pg 与 neon 的 HTTP 驱动都是单语句一个
+ * 隐式事务，用法完全一致）。superseded 由 DELETE 到底删没删到行推出来。
+ *
+ * @param {PgQuery} query
+ * @param {{ user_id: string, uuid: string, encrypted_payload: string,
+ *   next_send_at: string|Date, message_type: string }} params - 新任务
+ * @param {string} supersedesUuid - 要顶替掉的旧任务 uuid（同一个用户名下）
+ * @returns {Promise<{ id: number, uuid: string, next_send_at: any, status: string,
+ *   created_at: any, superseded: boolean }|null>}
+ */
+export function createTaskSuperseding(query: PgQuery, params: {
+    user_id: string;
+    uuid: string;
+    encrypted_payload: string;
+    next_send_at: string | Date;
+    message_type: string;
+}, supersedesUuid: string): Promise<{
+    id: number;
+    uuid: string;
+    next_send_at: any;
+    status: string;
+    created_at: any;
+    superseded: boolean;
+} | null>;
 /**
  * 状态 + 失败摘要（GET /message 用它把「为什么失败」透给已失败的行）。
  *

package/dist/adapters/pg.d.ts

@@ -35,6 +35,14 @@ export class PgAdapter {
     }>;
     dropSchema(): Promise<void>;
     createTask(params: any): Promise<any[]>;
+    createTaskSuperseding(params: any, supersedesUuid: any): Promise<{
+        id: number;
+        uuid: string;
+        next_send_at: any;
+        status: string;
+        created_at: any;
+        superseded: boolean;
+    }>;
     getTaskByUuid(uuid: any, userId: any): Promise<any[]>;
     getTaskByUuidOnly(uuid: any): Promise<any[]>;
     /**
@@ -48,6 +56,15 @@ export class PgAdapter {
         status: string;
     } | null>;
     updateTaskById(taskId: any, updates: any): Promise<any[]>;
+    /**
+     * 按 uuid 改一条 pending 任务（PUT /update-message、fire hook 的 renewTask）。
+     *
+     * 改排期（extraFields 里带 next_send_at）时多一道租约门：这条任务正被一次投递
+     * 占着的话不改，返回 null。投递收尾会按自己领取时看到的排期推进下一次（一次性
+     * 任务干脆标成已发送），这期间写进去的新时刻随后就被盖掉，接口却已经回了成功
+     * ——用户以为改期生效了，实际什么都没留下。正文这类字段不受这道门约束：它们
+     * 只影响以后的触发，收尾那边本来就不会覆盖（见 run-tick 的收尾守卫）。
+     */
     updateTaskByUuid(uuid: any, userId: any, encryptedPayload: any, extraFields: any): Promise<any[]>;
     deleteTaskById(taskId: any): Promise<boolean>;
     deleteTaskByUuid(uuid: any, userId: any): Promise<boolean>;

package/dist/{chunk-E4657Y5X.cjs → chunk-7TM3MH3Q.cjs}

@@ -754,62 +754,6 @@ function createGetUserKeyHandler(ctx) {
   return { GET };
 }
 
-// src/server/lib/webpush-webcrypto.js
-
-
-var WEB_PUSH_MAX_BODY_BYTES = 4096;
-var WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = 16 + 4 + 1 + 65 + 1 + 16;
-var MAX_PUSH_PAYLOAD_BYTES = WEB_PUSH_MAX_BODY_BYTES - WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES;
-var PUSH_ENVELOPE_RESERVED_BYTES = 384;
-var payloadEncoder = new TextEncoder();
-function measurePushPayload(payload, options) {
-  const reserveEnvelope = !!(options && options.reserveEnvelope);
-  const bytes = payloadEncoder.encode(typeof payload === "string" ? payload : String(payload)).length;
-  const envelopeReservedBytes = reserveEnvelope ? PUSH_ENVELOPE_RESERVED_BYTES : 0;
-  const maxBytes = MAX_PUSH_PAYLOAD_BYTES - envelopeReservedBytes;
-  return {
-    bytes,
-    maxBytes,
-    remainingBytes: maxBytes - bytes,
-    withinLimit: bytes <= maxBytes,
-    envelopeReservedBytes
-  };
-}
-async function sendWebPush(args) {
-  const { payload } = args || {};
-  if (typeof payload === "string") {
-    const size = measurePushPayload(payload);
-    if (!size.withinLimit) {
-      const err6 = new Error(
-        `sendWebPush: payload is ${size.bytes} bytes, over the ${MAX_PUSH_PAYLOAD_BYTES}-byte limit (push services cap the encrypted body at ${WEB_PUSH_MAX_BODY_BYTES} bytes; aes128gcm adds ${WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES} bytes)`
-      );
-      err6.code = "PUSH_PAYLOAD_TOO_LARGE";
-      err6.bytes = size.bytes;
-      err6.maxBytes = MAX_PUSH_PAYLOAD_BYTES;
-      throw err6;
-    }
-  }
-  return _amsgshared.sendWebPush.call(void 0, args);
-}
-var SCHEDULED_DEFAULT_TTL = 2419200;
-function createWebCryptoWebPush(vapid = {}, { ttl = SCHEDULED_DEFAULT_TTL } = {}) {
-  return {
-    async sendNotification(subscription, payload) {
-      return sendWebPush({
-        subscription,
-        payload,
-        ttl,
-        vapid: {
-          email: vapid.email,
-          publicKey: vapid.publicKey,
-          privateKey: vapid.privateKey
-        },
-        fetch: globalThis.fetch
-      });
-    }
-  };
-}
-
 // src/server/lib/errors.js
 
 var NonRetryableError = class extends Error {
@@ -949,6 +893,95 @@ function summarizeErrorCause(error, stage) {
   return cause;
 }
 
+// src/server/lib/retry-policy.js
+var DEFAULT_MAX_DELIVERY_RETRIES = 3;
+function resolveMaxDeliveryRetries(ctx) {
+  const value = ctx.maxDeliveryRetries;
+  return Number.isInteger(value) && value >= 0 ? value : DEFAULT_MAX_DELIVERY_RETRIES;
+}
+function resolveMaxGenerationRetries(ctx, safeTask) {
+  let value;
+  try {
+    value = typeof ctx.maxGenerationRetries === "function" ? ctx.maxGenerationRetries(safeTask) : ctx.maxGenerationRetries;
+  } catch (cause) {
+    throw new DeploymentConfigError("maxGenerationRetries callback failed", { code: "GENERATION_RETRY_POLICY_INVALID", cause });
+  }
+  if (value === void 0) return resolveMaxDeliveryRetries(ctx);
+  if (!Number.isInteger(value) || value < 0) {
+    throw new DeploymentConfigError("maxGenerationRetries must return a non-negative integer or undefined", { code: "GENERATION_RETRY_POLICY_INVALID" });
+  }
+  return value;
+}
+function failureRetryDecision(state, error) {
+  const retryLimit = state.outboxed ? state.deliveryLimit : state.generationLimit;
+  const permanent = isPermanentDeliveryFailure({
+    permanent: isNonRetryableError(error),
+    errorCode: _optionalChain([error, 'optionalAccess', _2 => _2.code]),
+    pushStatus: readPushStatusCode(error)
+  });
+  return {
+    failureStage: state.outboxed ? "delivery" : "generation",
+    retryLimit,
+    willRetry: !_optionalChain([state, 'access', _3 => _3.isCancelled, 'optionalCall', _4 => _4()]) && !isTaskCancelledError(error) && !permanent && state.retryCount < retryLimit
+  };
+}
+
+// src/server/lib/webpush-webcrypto.js
+
+
+var WEB_PUSH_MAX_BODY_BYTES = 4096;
+var WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = 16 + 4 + 1 + 65 + 1 + 16;
+var MAX_PUSH_PAYLOAD_BYTES = WEB_PUSH_MAX_BODY_BYTES - WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES;
+var PUSH_ENVELOPE_RESERVED_BYTES = 384;
+var payloadEncoder = new TextEncoder();
+function measurePushPayload(payload, options) {
+  const reserveEnvelope = !!(options && options.reserveEnvelope);
+  const bytes = payloadEncoder.encode(typeof payload === "string" ? payload : String(payload)).length;
+  const envelopeReservedBytes = reserveEnvelope ? PUSH_ENVELOPE_RESERVED_BYTES : 0;
+  const maxBytes = MAX_PUSH_PAYLOAD_BYTES - envelopeReservedBytes;
+  return {
+    bytes,
+    maxBytes,
+    remainingBytes: maxBytes - bytes,
+    withinLimit: bytes <= maxBytes,
+    envelopeReservedBytes
+  };
+}
+async function sendWebPush(args) {
+  const { payload } = args || {};
+  if (typeof payload === "string") {
+    const size = measurePushPayload(payload);
+    if (!size.withinLimit) {
+      const err6 = new Error(
+        `sendWebPush: payload is ${size.bytes} bytes, over the ${MAX_PUSH_PAYLOAD_BYTES}-byte limit (push services cap the encrypted body at ${WEB_PUSH_MAX_BODY_BYTES} bytes; aes128gcm adds ${WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES} bytes)`
+      );
+      err6.code = "PUSH_PAYLOAD_TOO_LARGE";
+      err6.bytes = size.bytes;
+      err6.maxBytes = MAX_PUSH_PAYLOAD_BYTES;
+      throw err6;
+    }
+  }
+  return _amsgshared.sendWebPush.call(void 0, args);
+}
+var SCHEDULED_DEFAULT_TTL = 2419200;
+function createWebCryptoWebPush(vapid = {}, { ttl = SCHEDULED_DEFAULT_TTL } = {}) {
+  return {
+    async sendNotification(subscription, payload) {
+      return sendWebPush({
+        subscription,
+        payload,
+        ttl,
+        vapid: {
+          email: vapid.email,
+          publicKey: vapid.publicKey,
+          privateKey: vapid.privateKey
+        },
+        fetch: globalThis.fetch
+      });
+    }
+  };
+}
+
 // src/server/lib/agentic-fire.js
 
 
@@ -1931,7 +1964,10 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
       retry_count: 0,
       ...typeof ctx.db.claimTask === "function" ? { retry_after: null } : {}
     });
-    if (!updated) return { renewed: false, reason: "not_found" };
+    if (!updated) {
+      const stillPending = await ctx.db.getTaskByUuid(uuid, task.user_id);
+      return { renewed: false, reason: stillPending ? "in_flight" : "not_found" };
+    }
     return { renewed: true, uuid, nextSendAt: nextSendAtIso };
   };
   const resolveLlmCredential2 = async (credId) => {
@@ -2000,6 +2036,7 @@ async function runAgenticFire({ task, decryptedPayload, userKey, ctx }) {
     await notifyFireSettled(ctx, {
       task,
       status: settledStatus,
+      ...settledStatus === "failed" && ctx._deliveryState ? failureRetryDecision(ctx._deliveryState, settledError) : { willRetry: null, failureStage: null },
       skipReason: settledStatus === "skipped" ? progress.skipReason : null,
       sentCount: progress.sentCount,
       pushedCount: progress.pushedCount,
@@ -2175,7 +2212,7 @@ async function runFireChain({
       toolResults = toolCalls.map((toolCall) => ({
         tool_call_id: toolCall && typeof toolCall === "object" && typeof toolCall.id === "string" ? toolCall.id : "",
         role: "tool",
-        content: `Tool execution failed: ${_nullishCoalesce(_optionalChain([error, 'optionalAccess', _2 => _2.message]), () => ( String(error)))}`
+        content: `Tool execution failed: ${_nullishCoalesce(_optionalChain([error, 'optionalAccess', _5 => _5.message]), () => ( String(error)))}`
       }));
     }
     const nativeCalls = Array.isArray(assistantMessage.tool_calls) ? assistantMessage.tool_calls : [];
@@ -2263,6 +2300,7 @@ async function sendHookPushPayloads({
     }
     outboxed = await appendPushesToOutbox({ db: ctx.db, userId: task.user_id, userKey, pushes: finalized });
     progress.outboxed = outboxed;
+    if (ctx._deliveryState) ctx._deliveryState.outboxed = outboxed;
     if (!ctx.vapid || !ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
       throw new Error("VAPID configuration missing - push notifications cannot be sent");
     }
@@ -2345,6 +2383,7 @@ function addTokenCount(sum, value) {
 
 
 
+
 var DEFAULT_SPLIT_REGEX = /([。！？!?]+)/;
 var SLEEP_BETWEEN_MESSAGES_MS2 = 1500;
 var MULTIPART_WINDOW_USAGE = 0.5;
@@ -2434,7 +2473,7 @@ function resolveMultipartOptions(ctx) {
 function assertChunkBytesFitPushLimit({ maxChunkBytes, maxChunks, ttlMs }) {
   const PROBE_CHUNK_BYTES = 3;
   const [probe] = _amsgshared.buildMultipartPushPayloads.call(void 0, 
-    { messageKind: "reasoning" },
+    { messageKind: longestMessageKind() },
     { serializedPayload: "x".repeat(PROBE_CHUNK_BYTES), maxChunkBytes: PROBE_CHUNK_BYTES, ttlMs }
   );
   const digitHeadroom = 2 * (String(maxChunks).length - 1);
@@ -2453,6 +2492,9 @@ function assertChunkBytesFitPushLimit({ maxChunkBytes, maxChunks, ttlMs }) {
 function base64UrlLength(n) {
   return Math.ceil(n * 4 / 3);
 }
+function longestMessageKind() {
+  return Object.values(_amsgshared.MESSAGE_KIND).reduce((a, b) => b.length > a.length ? b : a);
+}
 function positiveIntegerOr(value, fallback) {
   return Number.isInteger(value) && /** @type {number} */
   value > 0 ? (
@@ -2494,7 +2536,15 @@ async function redeliverCommittedBatch(task, ctx, userKey, decryptedPayload, bat
   }
   return { success: true, messagesSent, redelivered: true, pushedCount: sentIds.length };
 }
-async function processSingleMessage(task, ctx, providedMasterKey, predecrypted = null, options = {}) {
+async function processSingleMessage(task, ctx, providedMasterKey, predecrypted = null) {
+  const deliveryState = {
+    outboxed: false,
+    deliveryLimit: resolveMaxDeliveryRetries(ctx),
+    generationLimit: resolveMaxDeliveryRetries(ctx),
+    retryCount: _nullishCoalesce(task.retry_count, () => ( 0)),
+    isCancelled: ctx.isTaskCancelled
+  };
+  ctx = { ...ctx, _deliveryState: deliveryState };
   try {
     const masterKey = providedMasterKey || ctx.masterKey;
     if (!masterKey) {
@@ -2502,17 +2552,18 @@ async function processSingleMessage(task, ctx, providedMasterKey, predecrypted =
     }
     const userKey = predecrypted && predecrypted.userKey || await deriveUserEncryptionKey(task.user_id, masterKey);
     const decryptedPayload = predecrypted && predecrypted.payload || JSON.parse(await decryptFromStorage(task.encrypted_payload, userKey));
-    const resumeCommittedBatch = options && typeof options.resumeCommittedBatch === "boolean" ? options.resumeCommittedBatch : (task.retry_count || 0) > 0;
-    if (resumeCommittedBatch) {
-      const committed = await findCommittedBatch({
-        db: ctx.db,
-        userId: task.user_id,
-        userKey,
-        taskUuid: task.uuid,
-        occurrenceMs: occurrenceMsOf(task)
-      });
-      if (committed) return await redeliverCommittedBatch(task, ctx, userKey, decryptedPayload, committed);
+    const committed = await findCommittedBatch({
+      db: ctx.db,
+      userId: task.user_id,
+      userKey,
+      taskUuid: task.uuid,
+      occurrenceMs: occurrenceMsOf(task)
+    });
+    if (committed) {
+      deliveryState.outboxed = true;
+      return await redeliverCommittedBatch(task, ctx, userKey, decryptedPayload, committed);
     }
+    deliveryState.generationLimit = resolveMaxGenerationRetries(ctx, buildHookTask(task, decryptedPayload));
     if (ctx.hooks && typeof ctx.hooks.onBeforeFire === "function" && taskNeedsLlm(decryptedPayload)) {
       const agentic = await runAgenticFire({ task, decryptedPayload, userKey, ctx });
       if (agentic.handled) return agentic.result;
@@ -2593,6 +2644,7 @@ async function processSingleMessage(task, ctx, providedMasterKey, predecrypted =
     }
     const pushesToSend = reasoningPush ? [reasoningPush, ...contentPushes] : contentPushes;
     const outboxed = await appendPushesToOutbox({ db: ctx.db, userId: task.user_id, userKey, pushes: pushesToSend });
+    deliveryState.outboxed = outboxed;
     if (!ctx.vapid.email || !ctx.vapid.publicKey || !ctx.vapid.privateKey) {
       throw new Error("VAPID configuration missing - push notifications cannot be sent");
     }
@@ -2650,7 +2702,8 @@ async function processSingleMessage(task, ctx, providedMasterKey, predecrypted =
       error: error.message,
       errorCode: error.code || null,
       pushStatusCode: readPushStatusCode(error),
-      permanent: isNonRetryableError(error)
+      permanent: isNonRetryableError(error),
+      ...failureRetryDecision(deliveryState, error)
     };
   }
 }
@@ -2663,7 +2716,7 @@ async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, provided
       error: { code: "TENANT_MASTER_KEY_MISSING", message: "\u79DF\u6237\u4E3B\u5BC6\u94A5\u4E0D\u5B58\u5728\u6216\u914D\u7F6E\u5F02\u5E38" }
     };
   }
-  while (retryCount <= maxRetries) {
+  while (true) {
     let task;
     try {
       task = userId ? await ctx.db.getTaskByUuid(uuid, userId) : await ctx.db.getTaskByUuidOnly(uuid);
@@ -2681,16 +2734,14 @@ async function processMessagesByUuid(uuid, ctx, maxRetries = 2, userId, provided
     if (!task) {
       return { success: false, error: { code: "TASK_NOT_FOUND", message: "\u4EFB\u52A1\u4E0D\u5B58\u5728\u6216\u5DF2\u5904\u7406" } };
     }
-    const result = await processSingleMessage(task, ctx, masterKey, null, {
-      resumeCommittedBatch: retryCount > 0 || (task.retry_count || 0) > 0
-    });
+    const result = await processSingleMessage({ ...task, retry_count: retryCount }, { ...ctx, maxDeliveryRetries: maxRetries }, masterKey, null);
     if (!result.success) {
       const permanent = isPermanentDeliveryFailure({
         permanent: result.permanent,
         errorCode: result.errorCode,
         pushStatus: result.pushStatusCode
       });
-      if (!permanent && retryCount < maxRetries) {
+      if (!permanent && result.willRetry !== false && retryCount < (_nullishCoalesce(result.retryLimit, () => ( maxRetries)))) {
         retryCount++;
         await new Promise((resolve) => setTimeout(resolve, 1e3 * retryCount));
         continue;
@@ -2925,10 +2976,10 @@ function createScheduleMessageHandler(ctx) {
         dbResult = await db.createTaskSuperseding(createParams, supersedesUuid);
         superseded = !!(dbResult && dbResult.superseded);
       } else {
-        if (supersedesUuid) {
+        dbResult = await db.createTask(createParams);
+        if (supersedesUuid && dbResult) {
           superseded = await db.deleteTaskByUuid(supersedesUuid, userId);
         }
-        dbResult = await db.createTask(createParams);
       }
     } catch (error) {
       if (isUniqueViolation(error)) {
@@ -3010,7 +3061,6 @@ var CLAIM_LEASE_MARGIN_MS = 2 * 60 * 1e3;
 var DEFAULT_LEASE_HEARTBEAT_MS = 30 * 1e3;
 var DEFAULT_HEARTBEAT_LEASE_TTL_MS = 90 * 1e3;
 var STALE_AFTER_MS = 60 * 60 * 1e3;
-var DEFAULT_MAX_DELIVERY_RETRIES = 3;
 var adaptersWithoutLastErrorColumn = /* @__PURE__ */ new WeakSet();
 var lastErrorColumnSuspicions = /* @__PURE__ */ new WeakMap();
 var warnedAboutMissingLastErrorColumn = false;
@@ -3058,10 +3108,6 @@ function guardWebpushWithLease(webpush, lease) {
 function resolveStaleAfterMs(ctx) {
   return positiveNumber(ctx.staleAfterMs) || STALE_AFTER_MS;
 }
-function resolveMaxDeliveryRetries(ctx) {
-  const value = ctx.maxDeliveryRetries;
-  return Number.isInteger(value) && value >= 0 ? value : DEFAULT_MAX_DELIVERY_RETRIES;
-}
 function isRecurringType(recurrenceType) {
   return recurrenceType === "daily" || recurrenceType === "weekly";
 }
@@ -3324,7 +3370,7 @@ async function deliverTasks(ctx, tasks) {
     const permanent = isPermanentDeliveryFailure({ permanent: failure.permanent, errorCode, pushStatus });
     const errorExtra = buildErrorExtra(errorCode, pushStatus);
     try {
-      if (permanent || task.retry_count >= maxDeliveryRetries) {
+      if (permanent || failure.willRetry === false || task.retry_count >= (_nullishCoalesce(failure.retryLimit, () => ( maxDeliveryRetries)))) {
         const encrypted = await encryptPayloadWithLastError(task, decryptedPayload, userKey, reason, errorExtra);
         if (isRecurringType(recurrenceType)) {
           const nextSendAt = nextFutureOccurrence(Date.parse(task.next_send_at), recurrenceType, Date.now(), tzId);
@@ -3510,10 +3556,7 @@ async function deliverTasks(ctx, tasks) {
           isTaskCancelled: () => lease.lost
         },
         masterKey,
-        { userKey, payload: decryptedPayload },
-        // 重试计数就记在这一列上：大于 0 说明这是同一次触发的重试，内容已经落
-        // 进 outbox 的话只补推送、不再生成（见 redeliverCommittedBatch）。
-        { resumeCommittedBatch: (task.retry_count || 0) > 0 }
+        { userKey, payload: decryptedPayload }
       );
     } catch (error) {
       if (lease.lost) {
@@ -3541,7 +3584,7 @@ async function deliverTasks(ctx, tasks) {
         recurrenceType,
         decryptedPayload,
         userKey,
-        { errorCode: sendResult.errorCode || null, permanent: sendResult.permanent === true, pushStatus: sendResult.pushStatusCode }
+        { errorCode: sendResult.errorCode || null, permanent: sendResult.permanent === true, pushStatus: sendResult.pushStatusCode, willRetry: sendResult.willRetry, retryLimit: sendResult.retryLimit }
       );
       return;
     }
@@ -3822,6 +3865,16 @@ function createUpdateMessageHandler(ctx) {
     };
     const result = await db.updateTaskByUuid(taskUuid, userId, encryptedPayload, extraFields);
     if (!result) {
+      const inFlight = updates.nextSendAt && typeof db.getTaskByUuid === "function" && !!await db.getTaskByUuid(taskUuid, userId);
+      if (inFlight) {
+        return {
+          status: 409,
+          body: {
+            success: false,
+            error: { code: "TASK_IN_FLIGHT", message: "\u8FD9\u6761\u4EFB\u52A1\u6B63\u5728\u6295\u9012\uFF0C\u7B49\u8FD9\u6B21\u53D1\u5B8C\u518D\u6539\u6392\u671F" }
+          }
+        };
+      }
       return { status: 409, body: { success: false, error: { code: "UPDATE_CONFLICT", message: "\u4EFB\u52A1\u66F4\u65B0\u5931\u8D25\uFF0C\u4EFB\u52A1\u53EF\u80FD\u5DF2\u88AB\u4FEE\u6539\u6216\u5220\u9664" } } };
     }
     const applied = /* @__PURE__ */ new Set([
@@ -4758,6 +4811,15 @@ var D1Adapter = class {
     ).bind(...values).run();
     return this._db.prepare("SELECT * FROM scheduled_messages WHERE id = ?").bind(taskId).first();
   }
+  /**
+   * 按 uuid 改一条 pending 任务（PUT /update-message、fire hook 的 renewTask）。
+   *
+   * 改排期（extraFields 里带 next_send_at）时多一道租约门：这条任务正被一次投递
+   * 占着的话不改，返回 null。投递收尾会按自己领取时看到的排期推进下一次（一次性
+   * 任务干脆标成已发送），这期间写进去的新时刻随后就被盖掉，接口却已经回了成功
+   * ——用户以为改期生效了，实际什么都没留下。正文这类字段不受这道门约束：它们
+   * 只影响以后的触发，收尾那边本来就不会覆盖（见 run-tick 的收尾守卫）。
+   */
   async updateTaskByUuid(uuid, userId, encryptedPayload, extraFields) {
     const now = this._now();
     const sets = ["encrypted_payload = ?", "updated_at = ?"];
@@ -4772,9 +4834,14 @@ var D1Adapter = class {
       }
     }
     values.push(uuid, userId);
+    let leaseGate = "";
+    if (extraFields && Object.prototype.hasOwnProperty.call(extraFields, "next_send_at")) {
+      leaseGate = " AND (lease_until IS NULL OR lease_until <= ?)";
+      values.push(now);
+    }
     const res = await this._db.prepare(
       `UPDATE scheduled_messages SET ${sets.join(", ")}
-       WHERE uuid = ? AND user_id = ? AND status = 'pending'`
+       WHERE uuid = ? AND user_id = ? AND status = 'pending'${leaseGate}`
     ).bind(...values).run();
     if (!res.meta.changes) return null;
     return { uuid, updated_at: now };
@@ -5032,7 +5099,7 @@ var D1Adapter = class {
       result.cleanupOutcomes = probeIndexes.map((probeAt) => {
         if (probeAt === null) return null;
         const row = results[probeAt] && Array.isArray(results[probeAt].results) ? results[probeAt].results[0] : null;
-        return Number(_nullishCoalesce(_optionalChain([row, 'optionalAccess', _3 => _3.n]), () => ( 0))) === 0;
+        return Number(_nullishCoalesce(_optionalChain([row, 'optionalAccess', _6 => _6.n]), () => ( 0))) === 0;
       });
     }
     return result;
@@ -5893,7 +5960,7 @@ function createClientStateNamespacesHandler(ctx) {
 }
 
 // src/server/lib/version.js
-var SERVER_VERSION = true ? "2.6.0-next.30" : "0.0.0-dev";
+var SERVER_VERSION = true ? "2.6.0-next.31" : "0.0.0-dev";
 
 // src/server/handlers/capabilities.js
 var SERVER_FEATURES = Object.freeze([
@@ -6004,7 +6071,9 @@ var SERVER_FEATURES = Object.freeze([
   // onAfterSend / onFireSettled 的载荷带整次 fire 的 usageTotal 与 llmCalls。
   "hook-usage-total",
   // 工厂配置认 maxDeliveryRetries（投递失败的重试次数上限，默认 3）。
-  "max-delivery-retries"
+  "max-delivery-retries",
+  // Per-task pre-commit retry limit and fire receipt retry decision.
+  "max-generation-retries"
 ]);
 function createCapabilitiesHandler(ctx) {
   async function GET(url, headers) {
@@ -6217,6 +6286,7 @@ function createSingleUserServer(config) {
     maxScheduledTasksPerFire: config.maxScheduledTasksPerFire,
     // 定时任务投递失败后的重试次数上限（默认 3）。handlers 用不到，宿主拿这个
     // ctx 去调 runScheduledTick 时它跟着走。
+    maxGenerationRetries: config.maxGenerationRetries,
     maxDeliveryRetries: config.maxDeliveryRetries
   };
   return {
@@ -6400,6 +6470,7 @@ function createSingleUserCloudflareWorker(buildConfig, options = {}) {
       onFireSettled: cfg.onFireSettled,
       // 一次触发投递失败后最多再重试几次（默认 3，0 = 第一次失败就终审；见
       // lib/run-tick.js 的 DEFAULT_MAX_DELIVERY_RETRIES）。
+      maxGenerationRetries: cfg.maxGenerationRetries,
       maxDeliveryRetries: cfg.maxDeliveryRetries,
       // 分组串行：(task) => 分组标识 | null。同一分组的任务同时只跑一条，
       // 跨跳也算（见 lib/run-tick.js）。不配 = 全并发，与以前一致。
@@ -6630,4 +6701,4 @@ function createSingleUserCloudflareWorker(buildConfig, options = {}) {
 
 
 
-exports.isValidTimeZoneId = isValidTimeZoneId; exports.advanceOccurrence = advanceOccurrence; exports.planNextOccurrence = planNextOccurrence; exports.nextFutureOccurrence = nextFutureOccurrence; exports.base64UrlToBytes = _amsgshared.base64UrlToBytes; exports.utf8 = _amsgshared.utf8; exports.utf8Decode = _amsgshared.utf8Decode; exports.bytesToBase64Url = _amsgshared.bytesToBase64Url; exports.timingSafeEqualBytes = _amsgshared.timingSafeEqualBytes; exports.deriveUserEncryptionKey = deriveUserEncryptionKey; exports.decryptPayload = decryptPayload; exports.encryptForStorage = encryptForStorage; exports.decryptFromStorage = decryptFromStorage; exports.CRED_ID_MAX_LENGTH = CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = CRED_PUT_BATCH_MAX; exports.CRED_ROWS_PER_USER_MAX = CRED_ROWS_PER_USER_MAX; exports.CRED_REFS_MAX_ENTRIES = CRED_REFS_MAX_ENTRIES; exports.supportsLlmCredentialsStore = supportsLlmCredentialsStore; exports.isValidCredId = isValidCredId; exports.validateCredValue = validateCredValue; exports.validateCredRefs = validateCredRefs; exports.hasChatCredRef = hasChatCredRef; exports.resolveLlmCredential = resolveLlmCredential; exports.isValidUrl = _amsgshared.isValidUrl; exports.validateAvatarUrl = _amsgshared.validateAvatarUrl; exports.isValidISO8601 = isValidISO8601; exports.isValidUUID = isValidUUID; exports.isValidUUIDv4 = isValidUUIDv4; exports.validateSplitPattern = validateSplitPattern; exports.validateLlmMessagesArray = validateLlmMessagesArray; exports.MAX_TASK_PAYLOAD_BYTES = MAX_TASK_PAYLOAD_BYTES; exports.validateScheduleMessagePayload = validateScheduleMessagePayload; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = DEFAULT_MAX_REQUEST_BODY_BYTES; exports.readRequestBody = readRequestBody; exports.parseJsonBody = parseJsonBody; exports.getHeader = getHeader; exports.createGetUserKeyHandler = createGetUserKeyHandler; exports.WEB_PUSH_MAX_BODY_BYTES = WEB_PUSH_MAX_BODY_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.MAX_PUSH_PAYLOAD_BYTES = MAX_PUSH_PAYLOAD_BYTES; exports.PUSH_ENVELOPE_RESERVED_BYTES = PUSH_ENVELOPE_RESERVED_BYTES; exports.measurePushPayload = measurePushPayload; exports.createWebCryptoWebPush = createWebCryptoWebPush; exports.NonRetryableError = NonRetryableError; exports.isNonRetryableError = isNonRetryableError; exports.DeploymentConfigError = DeploymentConfigError; exports.sanitizeErrorSummary = sanitizeErrorSummary; exports.summarizeErrorCause = summarizeErrorCause; exports.DEFAULT_MAX_TOOL_ITERATIONS = DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = DEFAULT_TOTAL_TIMEOUT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.MIN_SCHEDULE_LEAD_MS = MIN_SCHEDULE_LEAD_MS; exports.createScheduleMessageHandler = createScheduleMessageHandler; exports.DEFAULT_CLAIM_LEASE_MS = DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.DEFAULT_MAX_DELIVERY_RETRIES = DEFAULT_MAX_DELIVERY_RETRIES; exports.runScheduledTick = runScheduledTick; exports.runTask = runTask; exports.createUpdateMessageHandler = createUpdateMessageHandler; exports.createCancelMessageHandler = createCancelMessageHandler; exports.createMessagesHandler = createMessagesHandler; exports.createGetMessageHandler = createGetMessageHandler; exports.createPushSubscriptionHandler = createPushSubscriptionHandler; exports.createLlmCredentialsHandler = createLlmCredentialsHandler; exports.createD1Adapter = createD1Adapter; exports.createSingleUserServer = createSingleUserServer; exports.SCHEMA_VERSION = SCHEMA_VERSION; exports.getSchemaVersion = getSchemaVersion; exports.ensureSchema = ensureSchema; exports.CORS_ALLOW_HEADERS = CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = CORS_ALLOW_METHODS; exports.createSingleUserCloudflareWorker = createSingleUserCloudflareWorker;
+exports.isValidTimeZoneId = isValidTimeZoneId; exports.advanceOccurrence = advanceOccurrence; exports.planNextOccurrence = planNextOccurrence; exports.nextFutureOccurrence = nextFutureOccurrence; exports.base64UrlToBytes = _amsgshared.base64UrlToBytes; exports.utf8 = _amsgshared.utf8; exports.utf8Decode = _amsgshared.utf8Decode; exports.bytesToBase64Url = _amsgshared.bytesToBase64Url; exports.timingSafeEqualBytes = _amsgshared.timingSafeEqualBytes; exports.deriveUserEncryptionKey = deriveUserEncryptionKey; exports.decryptPayload = decryptPayload; exports.encryptForStorage = encryptForStorage; exports.decryptFromStorage = decryptFromStorage; exports.CRED_ID_MAX_LENGTH = CRED_ID_MAX_LENGTH; exports.CRED_PUT_BATCH_MAX = CRED_PUT_BATCH_MAX; exports.CRED_ROWS_PER_USER_MAX = CRED_ROWS_PER_USER_MAX; exports.CRED_REFS_MAX_ENTRIES = CRED_REFS_MAX_ENTRIES; exports.supportsLlmCredentialsStore = supportsLlmCredentialsStore; exports.isValidCredId = isValidCredId; exports.validateCredValue = validateCredValue; exports.validateCredRefs = validateCredRefs; exports.hasChatCredRef = hasChatCredRef; exports.resolveLlmCredential = resolveLlmCredential; exports.isValidUrl = _amsgshared.isValidUrl; exports.validateAvatarUrl = _amsgshared.validateAvatarUrl; exports.isValidISO8601 = isValidISO8601; exports.isValidUUID = isValidUUID; exports.isValidUUIDv4 = isValidUUIDv4; exports.validateSplitPattern = validateSplitPattern; exports.validateLlmMessagesArray = validateLlmMessagesArray; exports.MAX_TASK_PAYLOAD_BYTES = MAX_TASK_PAYLOAD_BYTES; exports.validateScheduleMessagePayload = validateScheduleMessagePayload; exports.DEFAULT_MAX_REQUEST_BODY_BYTES = DEFAULT_MAX_REQUEST_BODY_BYTES; exports.readRequestBody = readRequestBody; exports.parseJsonBody = parseJsonBody; exports.getHeader = getHeader; exports.createGetUserKeyHandler = createGetUserKeyHandler; exports.NonRetryableError = NonRetryableError; exports.isNonRetryableError = isNonRetryableError; exports.DeploymentConfigError = DeploymentConfigError; exports.sanitizeErrorSummary = sanitizeErrorSummary; exports.summarizeErrorCause = summarizeErrorCause; exports.DEFAULT_MAX_DELIVERY_RETRIES = DEFAULT_MAX_DELIVERY_RETRIES; exports.WEB_PUSH_MAX_BODY_BYTES = WEB_PUSH_MAX_BODY_BYTES; exports.WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES = WEB_PUSH_ENCRYPTION_OVERHEAD_BYTES; exports.MAX_PUSH_PAYLOAD_BYTES = MAX_PUSH_PAYLOAD_BYTES; exports.PUSH_ENVELOPE_RESERVED_BYTES = PUSH_ENVELOPE_RESERVED_BYTES; exports.measurePushPayload = measurePushPayload; exports.createWebCryptoWebPush = createWebCryptoWebPush; exports.DEFAULT_MAX_TOOL_ITERATIONS = DEFAULT_MAX_TOOL_ITERATIONS; exports.DEFAULT_TOTAL_TIMEOUT_MS = DEFAULT_TOTAL_TIMEOUT_MS; exports.DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE = DEFAULT_MAX_SCHEDULED_TASKS_PER_FIRE; exports.MIN_SCHEDULE_LEAD_MS = MIN_SCHEDULE_LEAD_MS; exports.createScheduleMessageHandler = createScheduleMessageHandler; exports.DEFAULT_CLAIM_LEASE_MS = DEFAULT_CLAIM_LEASE_MS; exports.DEFAULT_LEASE_HEARTBEAT_MS = DEFAULT_LEASE_HEARTBEAT_MS; exports.DEFAULT_HEARTBEAT_LEASE_TTL_MS = DEFAULT_HEARTBEAT_LEASE_TTL_MS; exports.runScheduledTick = runScheduledTick; exports.runTask = runTask; exports.createUpdateMessageHandler = createUpdateMessageHandler; exports.createCancelMessageHandler = createCancelMessageHandler; exports.createMessagesHandler = createMessagesHandler; exports.createGetMessageHandler = createGetMessageHandler; exports.createPushSubscriptionHandler = createPushSubscriptionHandler; exports.createLlmCredentialsHandler = createLlmCredentialsHandler; exports.createD1Adapter = createD1Adapter; exports.createSingleUserServer = createSingleUserServer; exports.SCHEMA_VERSION = SCHEMA_VERSION; exports.getSchemaVersion = getSchemaVersion; exports.ensureSchema = ensureSchema; exports.CORS_ALLOW_HEADERS = CORS_ALLOW_HEADERS; exports.CORS_ALLOW_METHODS = CORS_ALLOW_METHODS; exports.createSingleUserCloudflareWorker = createSingleUserCloudflareWorker;