@sleep2agi/commhub-server 0.9.0-preview.39 → 0.9.0-preview.40

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@sleep2agi/commhub-server",
-  "version": "0.9.0-preview.39",
+  "version": "0.9.0-preview.40",
   "description": "CommHub Server — AI Agent communication hub with MCP protocol, multi-network isolation, user auth, and MCP tools (17 collaboration-core + node/provider ops tools; authoritative list: docs-site/docs/api/mcp-tools.md).",
   "type": "module",
   "main": "src/index.ts",

package/src/db.ts

@@ -414,6 +414,7 @@ db.exec(`
     daemon_node_id TEXT NOT NULL,
     child_node_id TEXT NOT NULL,
     child_alias TEXT NOT NULL,
+    child_token_id TEXT,
     action TEXT NOT NULL CHECK (action IN ('stop', 'delete')),
     delete_config INTEGER NOT NULL DEFAULT 1,
     grace_seconds INTEGER NOT NULL DEFAULT 10,
@@ -431,6 +432,10 @@ db.exec(`
 `);
 db.exec(`CREATE INDEX IF NOT EXISTS idx_stop_req_daemon ON node_stop_requests(daemon_node_id, status)`);
 db.exec(`CREATE INDEX IF NOT EXISTS idx_stop_req_child ON node_stop_requests(child_node_id)`);
+// #1448 finding-5 — 存 delete 目标 child 的 token_id,让 ack 精确按 token_id 撤 ntok
+// (而非按 name='node:<alias>' 广撤 → 同 alias 在 delete 窗口内重建会误杀新 token)。
+// 幂等迁移:已有库补列,旧行 child_token_id 为 NULL、ack 时 fallback 回按 name 撤。
+try { db.exec(`ALTER TABLE node_stop_requests ADD COLUMN child_token_id TEXT`); } catch { /* 已存在 */ }
 
 // Daemon-mediated start request. Kept separate from node_stop_requests:
 // the deployed stop table has a CHECK(action IN ('stop','delete')) and

package/src/desktop-message.test.ts

@@ -220,3 +220,67 @@ describe("send_desktop_message", () => {
     expect(auditCount()).toBe(0);
   });
 });
+
+// #1459 —— 返回值必须反映真实投递态。
+//
+// send_desktop_message 是 fire-and-forget：只 INSERT audit_log（不写 inbox），
+// 再 pushUserEvent 扇出；而 pushUserEvent 在没有订阅者时静默 return。
+// 用户 dashboard 离线/重连时消息永久丢（无 DB 行 ⇒ 无从 reconcile，
+// /api/messages 只 SELECT ... FROM inbox），而调用方拿到的是 ok:true。
+//
+// 本 PR 只做「让丢失可见」这一半：不碰 schema，返回值说实话。
+// 持久化 + 重连补投（让丢失不发生）是另一条，方向已定为按 user_id 寻址的新表。
+describe("#1459 send_desktop_message 返回值反映真实投递态", () => {
+  test("🔴 无活跃订阅者 ⇒ delivered:false + 可判读的 reason，而不是笼统 ok:true", async () => {
+    // 故意不建 SSE 流：这正是用户 dashboard 关着的情形
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const before = auditCount();
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      message: "nobody is listening",
+      severity: "info",
+    });
+
+    // ok 仍为 true：调用被接受、审计已落库 —— 这一格没变
+    expect(result.ok).toBe(true);
+    expect(result.message_id).toStartWith("dm_");
+    expect(auditCount()).toBe(before + 1);
+
+    // 新增的那一格：投递态
+    expect(result.delivered).toBe(false);
+    expect(result.reason).toBe("no_live_subscriber");
+  });
+
+  test("有活跃订阅者 ⇒ delivered:true 且不带 reason", async () => {
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const result = await call(tools.send_desktop_message, {
+      to_user_id: TARGET_A,
+      message: "someone is listening",
+      severity: "info",
+    });
+
+    expect(result.delivered).toBe(true);
+    expect(result.reason).toBeUndefined();
+    // 前提断言：这一条真的送到了订阅者手上，否则 delivered:true 就是空话
+    const evt = await readFrame(reader);
+    expect(evt.message).toBe("someone is listening");
+    await reader.cancel();
+  });
+
+  test("🔴 两种情形必须给出不同读数 —— 防止判据退化成恒真", async () => {
+    const tools = buildHandlers({ netId: NET_A, userId: NODE_USER, alias: "node-a", isNetwork: true });
+    const offline = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "off", severity: "info" });
+
+    const stream = createUserEventStream(NET_A, TARGET_A);
+    const reader = stream.body!.getReader();
+    await readFrame(reader);
+    const online = await call(tools.send_desktop_message, { to_user_id: TARGET_A, message: "on", severity: "info" });
+    await reader.cancel();
+
+    expect(offline.delivered).not.toBe(online.delivered);
+  });
+});

package/src/push.ts

@@ -464,6 +464,20 @@ export function pushNetworkObserverEvent(
 /** Push an event to every active Desktop/web client for one user in one
  *  network. No-op for falsy network/user ids; auth must be enforced by
  *  the caller before invoking this helper. */
+/** 这个用户此刻是否真的有活着的 SSE 订阅者。
+ *
+ *  与 alias 版 `hasSubscribers` 同形状：投递可达性的**实测**，
+ *  调用方据此把「送到了」和「没人听」区分开，而不是一律报成功。 */
+export function hasUserSubscribers(
+  networkId: string | null | undefined,
+  userId: string | null | undefined,
+): boolean {
+  if (!networkId || !userId) return false;
+  const arr = clients.get(userKey(networkId, userId));
+  if (!arr) return false;
+  return arr.some((c) => !c.closed);
+}
+
 export function pushUserEvent(
   networkId: string | null | undefined,
   userId: string | null | undefined,

package/src/start-node.test.ts

@@ -50,3 +50,60 @@ describe("start_node Hub -> daemon lifecycle", () => {
     expect((await call(u.start_node, { child_node_id: CHILD, daemon_node_id: "node_wrong", network_id: NET })).error).toBe("daemon_child_mismatch");
   });
 });
+
+// #1448 finding-2 — stale-starting reaper（对齐 update_node_config/restart_node 的 60s
+// single-flight stale-supersede）。start 只受理 stopped;卡在 starting 的节点(门铃丢 /
+// daemon 在 UPDATE starting 后死)改前永远 start 不了(gate 返 node_not_stopped)、也无
+// reaper 拉回 → 永久卡死。改后:in-flight start 请求晾过 60s ⇒ 标 timeout 超越 + 放行
+// 重派;未过阈值 ⇒ 拒 node_already_starting。
+describe("start_node — stale-starting reaper (#1448 finding-2)", () => {
+  function seedStartReq(reqId: string, status: string, ageMs: number) {
+    db.run(
+      `INSERT INTO node_start_requests(request_id,network_id,daemon_node_id,child_node_id,child_alias,created_by_token,status,created_at)
+       VALUES(?1,?2,?3,?4,?5,'t',?6,?7)`,
+      [reqId, NET, DAEMON, CHILD, CHILD_ALIAS, status, Date.now() - ageMs],
+    );
+  }
+
+  test("starting + FRESH in-flight start (< 60s) → refused node_already_starting (not superseded)", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    seedStartReq("str_fresh", "delivered", 5_000);   // 5s old — within threshold
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(false);
+    expect(r.error).toBe("node_already_starting");
+    expect(r.existing_request_id).toBe("str_fresh");
+    expect(typeof r.age_ms).toBe("number");
+    // old request untouched, no new dispatch
+    expect(db.get<any>(`SELECT status FROM node_start_requests WHERE request_id='str_fresh'`)?.status).toBe("delivered");
+  });
+
+  // witnessed-red：改前 gate 直接 `!== 'stopped' → node_not_stopped`，一个 stale 的
+  // 'starting' 节点返回 node_not_stopped、永远卡死。改后应超越重派(ok:true)。
+  test("starting + STALE in-flight start (> 60s) → supersede old + re-dispatch (converges)", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    seedStartReq("str_stale", "delivered", 61_000);   // 61s old — past 60s threshold
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(true);
+    expect(r.lifecycle_state).toBe("starting");
+    expect(typeof r.request_id).toBe("string");
+    expect(r.request_id).not.toBe("str_stale");                       // fresh request
+    // old stale request superseded → terminal, unblocks the child-inflight unique index
+    expect(db.get<any>(`SELECT status FROM node_start_requests WHERE request_id='str_stale'`)?.status).toBe("timeout");
+    // exactly one non-terminal start request now (the new one)
+    const live = db.all<any>(`SELECT request_id FROM node_start_requests WHERE child_node_id=?1 AND status IN ('pending','delivered')`, CHILD);
+    expect(live.map((x:any)=>x.request_id)).toEqual([r.request_id]);
+    // audit records the real prior state
+    const aud = db.get<any>(`SELECT detail FROM audit_log WHERE target_id=?1`, r.request_id);
+    expect(JSON.parse(aud.detail).lifecycle_state_before).toBe("starting");
+  });
+
+  test("starting + NO in-flight row (orphaned state) → self-heals by re-dispatching", async () => {
+    db.run(`UPDATE nodes SET lifecycle_state='starting' WHERE node_id=?1`, CHILD);
+    const u = handlers(USER);
+    const r = await call(u.start_node, { child_node_id: CHILD, network_id: NET });
+    expect(r.ok).toBe(true);
+    expect(r.lifecycle_state).toBe("starting");
+  });
+});

package/src/stop-delete-node.test.ts

@@ -409,6 +409,51 @@ describe("get_stop_request + ack_stop_request — daemon flow", () => {
     expect(JSON.parse(audits[0].detail).backup_path).toBe("/home/u/.anet/deleted/1719647200000-sd-child-a");
   });
 
+  // #1448 finding-4 — stop/delete 必须校验 daemon 是 child 的权威创建者(镜像 start)。
+  // 改前只校验 daemon 存在+同网 → 同网调用方传错 daemon_node_id,门铃路由到错 daemon。
+  // f3 合入后错 daemon 会 sweep 空 + ack stopped → hub 假收敛 stopped 而 child 仍在跑。
+  test("#1448 finding-4: stop/delete reject a wrong same-network daemon_node_id (daemon_child_mismatch)", async () => {
+    setupAlphaNetwork();
+    // authority: CHILD_A 由 DAEMON_A 创建(resolveDaemonForChild 读 node_create_requests)
+    db.run(
+      `INSERT INTO node_create_requests(request_id,daemon_node_id,child_name,network_id,runtime,model,flags_json,env_keys,status,created_at,created_by_token,child_node_id)
+       VALUES(?1,?2,?3,?4,'claude-agent-sdk','x','{}','[]','succeeded',1,'t',?5)`,
+      [`cr_${CHILD_A_ID.slice(5)}`, DAEMON_A_ID, CHILD_A_ALIAS, NET_A, CHILD_A_ID],
+    );
+    // 一个同网、存在、但没创建 CHILD_A 的 daemon
+    const DAEMON_B = "node_sd_daemon_b";
+    seedDaemon(NET_A, DAEMON_B, "sd-daemon-b", USER_A_ID, "tok_sd_daemon_b");
+    const u = buildHandlers(USER_A_ID);
+    // 错 daemon → mismatch(stop + delete 都拦)。改前会放行、路由到错 daemon。
+    expect((await call(u.stop_node, { child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_B, network_id: NET_A })).error).toBe("daemon_child_mismatch");
+    expect((await call(u.delete_node, { child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_B, confirm_alias: CHILD_A_ALIAS, network_id: NET_A })).error).toBe("daemon_child_mismatch");
+    // 正确 daemon → 放行(回归钉)
+    expect((await call(u.stop_node, { child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A })).ok).toBe(true);
+  });
+
+  // #1448 finding-5 — delete 完成时按派发时定住的 token_id 精确撤 ntok,而非按
+  // name='node:<alias>' 广撤。改前:同 alias 在 delete 未收敛窗口内被重建、拿到同名新
+  // token,ack 会把新 token 一并误撤(下面 REBUILT_TOK 断言 not revoked 会红)。
+  test("#1448 finding-5: delete revokes by token_id, spares a same-alias rebuilt token", async () => {
+    setupAlphaNetwork();
+    const userTools = buildHandlers(USER_A_ID);
+    const dispatch = await call(userTools.delete_node, {
+      child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A, confirm_alias: CHILD_A_ALIAS,
+    });
+    expect(dispatch.ok).toBe(true);
+    // 派发后、ack 前:同 alias 节点被重建,拿到**同名**新 ntok(不同 token_id,仍 active)。
+    const REBUILT_TOK = "tok_sd_child_a_rebuilt";
+    db.run(
+      `INSERT INTO api_tokens (token_id, user_id, network_id, scope, name, token_hash, expires_at, revoked_at)
+       VALUES (?1, ?2, ?3, 'network', ?4, ?5, NULL, NULL)`,
+      [REBUILT_TOK, USER_A_ID, NET_A, `node:${CHILD_A_ALIAS}`, `hash_${REBUILT_TOK}`],
+    );
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    await call(daemonTools.ack_stop_request, { request_id: dispatch.request_id as string, status: "stopped", exit_signal: "SIGTERM" });
+    expect(readToken(CHILD_TOK_A_ID)?.revoked_at).not.toBeNull();   // 原 token 撤销(精确命中)
+    expect(readToken(REBUILT_TOK)?.revoked_at).toBeNull();          // 重建的同名新 token 未被误撤(改前按 name 广撤会红)
+  });
+
   test("daemon ack 'stop_failed' → lifecycle_state=stop_failed, request error captured", async () => {
     setupAlphaNetwork();
     const userTools = buildHandlers(USER_A_ID);
@@ -731,6 +776,81 @@ describe("list_my_pending_create_requests HANDLER (#1362 SSE reconnect compensat
   });
 });
 
+describe("list_my_pending_lifecycle_requests HANDLER (#1448 SSE reconnect compensation)", () => {
+  function seedStop(reqId: string, daemonId: string, status: string, action: string, ageMs: number) {
+    db.run(
+      `INSERT INTO node_stop_requests (request_id, network_id, daemon_node_id, child_node_id,
+         child_alias, action, delete_config, created_by_token, status, created_at)
+       VALUES (?1, ?2, ?3, ?4, ?5, ?6, 1, 'tok_test', ?7, ?8)`,
+      [reqId, NET_A, daemonId, CHILD_A_ID, CHILD_A_ALIAS, action, status, Date.now() - ageMs],
+    );
+  }
+  // child_node_id parameterized: node_start_requests has a partial-unique
+  // index on child_node_id WHERE status IN ('pending','delivered'), so the
+  // "mine" and "other" pending start rows must target different children.
+  function seedStart(reqId: string, daemonId: string, childId: string, status: string, ageMs: number) {
+    db.run(
+      `INSERT INTO node_start_requests (request_id, network_id, daemon_node_id, child_node_id,
+         child_alias, created_by_token, status, created_at)
+       VALUES (?1, ?2, ?3, ?4, ?5, 'tok_test', ?6, ?7)`,
+      [reqId, NET_A, daemonId, childId, CHILD_A_ALIAS, status, Date.now() - ageMs],
+    );
+  }
+
+  test("daemon-bound caller gets only its own PENDING stop/delete + start (excludes delivered + other daemon)", async () => {
+    setupAlphaNetwork();
+    const otherDaemonId = "node_sd_daemon_other";
+    seedDaemon(NET_A, otherDaemonId, "sd-daemon-other", USER_A_ID, "tok_sd_daemon_other");
+    // mine — should be returned (stop + delete, oldest first)
+    seedStop("sr_pending_stop", DAEMON_A_ID, "pending", "stop", 30);
+    seedStop("sr_pending_delete", DAEMON_A_ID, "pending", "delete", 20);
+    seedStart("str_pending_mine", DAEMON_A_ID, CHILD_A_ID, "pending", 25);
+    // excluded — delivered (already pulled) + other daemon's pending
+    seedStop("sr_delivered_mine", DAEMON_A_ID, "delivered", "stop", 40);
+    seedStop("sr_pending_other", otherDaemonId, "pending", "stop", 10);
+    seedStart("str_pending_other", otherDaemonId, "node_sd_child_other", "pending", 10);
+
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    const res = await call(daemonTools.list_my_pending_lifecycle_requests, {});
+    expect(res.ok).toBe(true);
+    expect(res.stop_count).toBe(2);
+    expect((res.stop_requests as Array<{ request_id: string }>).map(x => x.request_id))
+      .toEqual(["sr_pending_stop", "sr_pending_delete"]);   // oldest-first, action preserved
+    expect(res.start_count).toBe(1);
+    expect((res.start_requests as Array<{ request_id: string }>).map(x => x.request_id))
+      .toEqual(["str_pending_mine"]);
+  });
+
+  // Witnessed-red 的核心链：真实 stop_node 派发时 daemon 无 SSE 订阅者 →
+  // pushEvent 静默丢门铃 → 行卡 pending / 节点卡 stopping（缺陷态）。修复后这条
+  // pending 行会被 list_my_pending_lifecycle_requests 列出 → 重连 reconcile 能重放。
+  // 改前（无此工具）该行永远无人发现、节点永久卡 stopping。
+  test("stuck-pending after a dropped doorbell IS surfaced for reconnect replay", async () => {
+    setupAlphaNetwork();
+    const userTools = buildHandlers(USER_A_ID);
+    // 无 SSE 订阅者：dispatch 建 pending 行 + pushEvent 丢弃（测试进程里没有 client）
+    const disp = await call(userTools.stop_node, { child_node_id: CHILD_A_ID, daemon_node_id: DAEMON_A_ID, network_id: NET_A });
+    expect(disp.ok).toBe(true);
+    const reqId = disp.request_id as string;
+    // 缺陷态：行 pending、节点 stopping（门铃没送达，无人推进）
+    const row = db.get<{ status: string }>("SELECT status FROM node_stop_requests WHERE request_id = ?1", reqId);
+    expect(row?.status).toBe("pending");
+    expect(readNode(CHILD_A_ID)?.lifecycle_state).toBe("stopping");
+    // 修复：pending 行经新工具对本 daemon 可见 → 重连补偿能拿到并重放
+    const daemonTools = buildHandlers(USER_A_ID, true, DAEMON_A_TOK, NET_A);
+    const r = await call(daemonTools.list_my_pending_lifecycle_requests, {});
+    expect(r.ok).toBe(true);
+    expect((r.stop_requests as Array<{ request_id: string }>).map(x => x.request_id)).toContain(reqId);
+  });
+
+  test("non-daemon caller (utok) refused", async () => {
+    setupAlphaNetwork();
+    const userTools = buildHandlers(USER_A_ID);
+    const r = await call(userTools.list_my_pending_lifecycle_requests, {});
+    expect(r.ok).toBe(false);
+  });
+});
+
 // ─── PR1.2a — restart_node resets lifecycle_state ──────────────────
 //
 // 通信龙 #346 ack latent: without this, a stopped node restart-ed via

package/src/tools.ts

@@ -4,7 +4,7 @@ import { z } from "zod/v4";
 import { parseAliasFilter } from "./alias-filter.js";
 import { createHash } from "node:crypto";
 import { db, uuidv4, logTaskEvent, chainReplyToParent, hashToken, generateId, generateNetworkToken, syncScheduledRunForTask } from "./db.js";
-import { getSSEStats, hasSubscribers, pushEvent, pushNetworkObserverEvent, pushUserEvent } from "./push.js";
+import { getSSEStats, hasSubscribers, hasUserSubscribers, pushEvent, pushNetworkObserverEvent, pushUserEvent } from "./push.js";
 import { assertNodeActive } from "./lifecycle-guard.js";
 import { pendingInboxCount } from "./inbox-count.js";
 import { getUserNetworkRole, createNetworkTokenForNode } from "./auth.js";
@@ -2382,9 +2382,30 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
           effectiveNetId,
         ],
       );
+      // #1459 — pushUserEvent 在没有订阅者时静默 return，而这个工具既不写
+      // inbox、也没有任何 user 级回读路径（/api/messages 只 SELECT FROM inbox）。
+      // 也就是说用户 dashboard 关着的时候这条消息就永久没了。
+      //
+      // 这里先把**丢失变可见**：`ok` 仍表示「请求被接受、审计已落库」，
+      // 新增 `delivered` 表示「此刻真的有人收到」。判据取自订阅者注册表，
+      // 不是猜的。持久化 + 重连补投是另一条（按 user_id 寻址的新收件表，#1459）。
+      //
+      // 🔴 `reason` 报的是**观测到的事实**（此刻没有活订阅者），不是它的后果。
+      //    今天「没有活订阅者」确实等于「丢了」，但持久化落地之后同一个事实会
+      //    变成「已入库、等重连补投」。把值取成 no_live_subscriber 而不是
+      //    "lost"/"dropped"，就是为了那天不用改写历史含义 —— 届时按需细分
+      //    （如 lost vs queued）即可，现在不预先把语义焊死。
+      const delivered = hasUserSubscribers(effectiveNetId, target.user_id);
       pushUserEvent(effectiveNetId, target.user_id, event);
 
-      return { content: [{ type: "text" as const, text: JSON.stringify({ ok: true, message_id: messageId, delivered_to_user_id: target.user_id, network_id: effectiveNetId }) }] };
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true,
+        message_id: messageId,
+        delivered,
+        ...(delivered ? {} : { reason: "no_live_subscriber" }),
+        delivered_to_user_id: target.user_id,
+        network_id: effectiveNetId,
+      }) }] };
     },
   );
 
@@ -3320,6 +3341,53 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     },
   );
 
+  // #1448 — stop/delete/start 门铃的 SSE 重连补偿，镜像 create 的
+  // list_my_pending_create_requests(#1394)。pushEvent(push.ts) 是纯内存
+  // fan-out：派发门铃那刻若 daemon 无 live SSE 订阅者(hub 重启/网络抖/boot
+  // 窗口)就静默丢弃、不入队，于是 node_stop_requests/node_start_requests 的行
+  // 永远停在 pending、节点卡死 stopping/deleting/starting。daemon 每次 SSE
+  // connected 调本工具把漏掉的门铃拉回来重放(reconcilePendingLifecycleRequestsOnConnect)。
+  //
+  // 统一一个工具返回两张表的 pending 行(stop 表用 action 区分 stop/delete)，
+  // 省一次往返。鉴权同 create：token-bound daemon 身份(alias 不是安全边界)，
+  // 只返回绑定到本 daemon + 本网络的 pending 行。
+  server.tool(
+    "list_my_pending_lifecycle_requests",
+    "Daemon lists pending stop/delete/start requests bound to itself for SSE reconnect compensation. Mirrors list_my_pending_create_requests (#1394/#1448).",
+    {},
+    async () => {
+      const callerDaemon = resolveCallerDaemonTokenBound();
+      if (!callerDaemon.ok) {
+        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: callerDaemon.error }) }] };
+      }
+      const stop_requests = db.all<{ request_id: string; action: string; child_node_id: string; child_alias: string; created_at: number }>(
+        `SELECT request_id, action, child_node_id, child_alias, created_at
+           FROM node_stop_requests
+          WHERE daemon_node_id = ?1
+            AND network_id = ?2
+            AND status = 'pending'
+          ORDER BY created_at ASC`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      const start_requests = db.all<{ request_id: string; child_node_id: string; child_alias: string; created_at: number }>(
+        `SELECT request_id, child_node_id, child_alias, created_at
+           FROM node_start_requests
+          WHERE daemon_node_id = ?1
+            AND network_id = ?2
+            AND status = 'pending'
+          ORDER BY created_at ASC`,
+        callerDaemon.daemonNodeId, callerDaemon.networkId,
+      );
+      return { content: [{ type: "text" as const, text: JSON.stringify({
+        ok: true,
+        stop_count: stop_requests.length,
+        start_count: start_requests.length,
+        stop_requests,
+        start_requests,
+      }) }] };
+    },
+  );
+
   // §2.5 step 3 — daemon-facing pull. Returns full spec + env_blob +
   // child_ntok in one shot. Map evicted on take (one-shot consume).
   //
@@ -3638,6 +3706,21 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       return { ok: false, error: "daemon_cross_tenant", message: "daemon and child are in different networks" };
     }
 
+    // #1448 finding-4 — daemon 必须是该 child 的**权威创建者**,镜像 start_node 的
+    // daemon_child_mismatch。此前 stop/delete 接受调用方传入的 daemon_node_id,只校验
+    // 它存在 + 同网,不验它真的创建了这个 child。同网调用方传错 daemon_node_id → 门铃
+    // 路由到错 daemon。🔴 f3(#1453) 合入后更糟:错 daemon 无该 child 的 map entry → 走
+    // 收敛分支 sweep(错机器 pgrep 空) + ack stopped → hub 假收敛 stopped、child 仍在
+    // 正确机器上跑(旧 noop 至少留下可见的卡死态)。网络 scope 只挡跨租户,网内是 footgun。
+    //
+    // 用「确定性不匹配」判据:authority 已知(child 有 create 记录)且不等 → 拒。不对
+    // authority==null(create 记录被裁剪的旧 child)加拒,避免给它们的 stop/delete 引入
+    // 新失败面——handler 的 daemon_node_id??resolveDaemonForChild 已兜住无法解析的情形。
+    const authoritativeDaemonId = resolveDaemonForChild(args.child_node_id);
+    if (authoritativeDaemonId && authoritativeDaemonId !== args.daemon_node_id) {
+      return { ok: false, error: "daemon_child_mismatch", message: "daemon_node_id is not this child's authoritative creator daemon" };
+    }
+
     // State machine gate.
     const state = node.lifecycle_state ?? "active";
     if (args.action === "stop" && state !== "active") {
@@ -3707,6 +3790,16 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
     const now = Date.now();
     const newState = args.action === "stop" ? "stopping" : "deleting";
 
+    // #1448 finding-5 — 记下该 child **当前活着的** ntok 的 token_id,让 ack 精确按
+    // token_id 撤销,而非按 name='node:<alias>' 广撤。后者会在「同 alias 节点在这次
+    // delete 未收敛的窗口内被重建(拿到同名新 token)」时,把新 token 一并误撤。这里
+    // 在派发时刻定住身份;若此刻没有活 token(异常),存 null,ack 退回按 name 撤(旧语义)。
+    const childTokenRow = db.get<{ token_id: string }>(
+      `SELECT token_id FROM api_tokens WHERE network_id = ?1 AND name = ?2 AND revoked_at IS NULL`,
+      node.network_id, `node:${node.alias}`,
+    );
+    const childTokenId = childTokenRow?.token_id ?? null;
+
     // §4.5 D8 — lifecycle UPDATE + audit INSERTs + request INSERT atomic.
     // PR1.1: use db.transaction() (SQLiteAdapter wraps better-sqlite3's
     // native transaction; PgAdapter ships a real BEGIN/COMMIT/ROLLBACK
@@ -3717,12 +3810,12 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       db.transaction(() => {
       db.run(
         `INSERT INTO node_stop_requests
-           (request_id, network_id, daemon_node_id, child_node_id, child_alias, action,
+           (request_id, network_id, daemon_node_id, child_node_id, child_alias, child_token_id, action,
             delete_config, grace_seconds, force, in_flight_at_dispatch, created_by_token,
             status, created_at)
-         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, 'pending', ?12)`,
+         VALUES (?1, ?2, ?3, ?4, ?5, ?6, ?7, ?8, ?9, ?10, ?11, ?12, 'pending', ?13)`,
         [
-          requestId, node.network_id, args.daemon_node_id, node.node_id, node.alias, args.action,
+          requestId, node.network_id, args.daemon_node_id, node.node_id, node.alias, childTokenId, args.action,
           args.delete_config ? 1 : 0, args.grace_seconds, args.force ? 1 : 0, inFlight,
           callerTokenId || "unknown", now,
         ],
@@ -3903,9 +3996,9 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       }
       const row = db.get<{
         daemon_node_id: string; status: string; network_id: string;
-        child_node_id: string; child_alias: string; action: string;
+        child_node_id: string; child_alias: string; child_token_id: string | null; action: string;
         in_flight_at_dispatch: number; force: number;
-      }>(`SELECT daemon_node_id, status, network_id, child_node_id, child_alias, action,
+      }>(`SELECT daemon_node_id, status, network_id, child_node_id, child_alias, child_token_id, action,
                  in_flight_at_dispatch, force
             FROM node_stop_requests WHERE request_id = ?1`, request_id);
       if (!row) {
@@ -3946,14 +4039,25 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
               },
             });
           } else if (status === "stopped" && row.action === "delete") {
-            // Revoke the child's ntok (name='node:<alias>') in the daemon's
-            // network, then DELETE the nodes row. Token revoke pattern mirrors
-            // ack_create_request's terminal path.
-            db.run(
-              `UPDATE api_tokens SET revoked_at = datetime('now')
-                 WHERE network_id = ?1 AND name = ?2 AND revoked_at IS NULL`,
-              [row.network_id, `node:${row.child_alias}`],
-            );
+            // Revoke the child's ntok, then DELETE the nodes row.
+            // #1448 finding-5 — 精确按派发时定住的 child_token_id 撤(镜像
+            // ack_create_request 的 token_id 精撤)。旧行(升级前派发,child_token_id
+            // 为 NULL)fallback 回按 name='node:<alias>' 撤——旧语义,不引入回归。
+            // 按 token_id 撤避免了「同 alias 在本次 delete 窗口内被重建、拿到同名新
+            // token」时把新 token 一并误撤。
+            if (row.child_token_id) {
+              db.run(
+                `UPDATE api_tokens SET revoked_at = datetime('now')
+                   WHERE token_id = ?1 AND revoked_at IS NULL`,
+                [row.child_token_id],
+              );
+            } else {
+              db.run(
+                `UPDATE api_tokens SET revoked_at = datetime('now')
+                   WHERE network_id = ?1 AND name = ?2 AND revoked_at IS NULL`,
+                [row.network_id, `node:${row.child_alias}`],
+              );
+            }
             db.run(`DELETE FROM nodes WHERE node_id = ?1`, [row.child_node_id]);
             auditCreateNodeStrict({
               action: "delete_node_completed",
@@ -4019,8 +4123,43 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
       );
       if (!child) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "forbidden_cross_tenant" }) }] };
       if (!canWrite(child.network_id)) return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "permission_denied" }) }] };
-      if ((child.lifecycle_state ?? "active") !== "stopped") {
-        return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_not_stopped", current_state: child.lifecycle_state ?? "active" }) }] };
+      // #1448 finding-2 — stale-starting reaper，对齐 update_node_config / restart_node
+      // 的 60s single-flight stale-supersede。start 只受理 'stopped';一旦卡 'starting'
+      // (门铃丢 / daemon 在 UPDATE 'starting' 后死),config/restart 有 reaper、delete 有
+      // 5min force,唯独 start 裸奔 → 下面的 gate 永远拦、也无人把节点拉回 stopped →
+      // 永久卡 'starting'。出口:'starting' 且最近一条 in-flight start 请求晾过阈值 → 标
+      // 旧请求 timeout 超越、放行重派;未过阈值则拒 node_already_starting(带 age)。
+      const priorState = child.lifecycle_state ?? "active";
+      if (priorState !== "stopped") {
+        if (priorState !== "starting") {
+          return { content: [{ type: "text" as const, text: JSON.stringify({ ok: false, error: "node_not_stopped", current_state: priorState }) }] };
+        }
+        const STALE_STARTING_MS = 60_000;
+        const inFlight = db.get<{ request_id: string; created_at: number; delivered_at: number | null; acked_at: number | null }>(
+          `SELECT request_id, created_at, delivered_at, acked_at FROM node_start_requests
+             WHERE child_node_id = ?1 AND status IN ('pending', 'delivered')
+             ORDER BY created_at DESC LIMIT 1`, child.node_id,
+        );
+        if (inFlight) {
+          // Age anchor = COALESCE(acked_at, delivered_at, created_at)，同 config reaper:
+          // 已 pull/已 ack 的活着但慢的 start 会刷新存活时钟,不被误 reap。
+          const ageAnchor = inFlight.acked_at ?? inFlight.delivered_at ?? inFlight.created_at;
+          const age = Date.now() - ageAnchor;
+          if (age <= STALE_STARTING_MS) {
+            return { content: [{ type: "text" as const, text: JSON.stringify({
+              ok: false, error: "node_already_starting",
+              existing_request_id: inFlight.request_id, age_ms: age,
+              hint: `再等一下;超过 ${STALE_STARTING_MS / 1000}s 仍卡 starting,重试 start 会重新派发`,
+            }) }] };
+          }
+          // Stale — 标旧请求 timeout(autocommit,先于下面 tx 的新 INSERT,解除
+          // node_start_requests 对 pending/delivered 的 child 唯一约束),放行重派。
+          db.run(
+            `UPDATE node_start_requests SET status = 'timeout', acked_at = ?1, error = ?2 WHERE request_id = ?3`,
+            [Date.now(), `superseded by new start after ${age}ms stale (> ${STALE_STARTING_MS}ms threshold)`, inFlight.request_id],
+          );
+        }
+        // else: 'starting' 但无 in-flight 行(异常残留态)——照样放行重派以自愈。
       }
       // The caller may provide daemon_node_id, but it cannot override the
       // authoritative child->daemon relationship recorded at creation.
@@ -4046,12 +4185,14 @@ export function registerTools(server: McpServer, clientIP?: string, enforceNetwo
              VALUES (?1, ?2, ?3, ?4, ?5, ?6, 'pending', ?7)`,
             [requestId, child.network_id, daemon.node_id, child.node_id, child.alias, callerTokenId || "unknown", now],
           );
-          db.run(`UPDATE nodes SET lifecycle_state = 'starting' WHERE node_id = ?1 AND lifecycle_state = 'stopped'`, [child.node_id]);
+          // #1448 finding-2 — 也接受从 'starting' 重派(stale-supersede 后原态仍是
+          // starting);两种入态都合法地转/留到 'starting'。
+          db.run(`UPDATE nodes SET lifecycle_state = 'starting' WHERE node_id = ?1 AND lifecycle_state IN ('stopped', 'starting')`, [child.node_id]);
           auditCreateNodeStrict({
             action: "start_node_dispatched", user_id: enforceUserId,
             network_id: child.network_id, target_id: requestId,
             detail: { child_node_id: child.node_id, child_alias: child.alias, daemon_node_id: daemon.node_id,
-              lifecycle_state_before: "stopped", lifecycle_state_after: "starting", ts_request: now },
+              lifecycle_state_before: priorState, lifecycle_state_after: "starting", ts_request: now },
           });
         });
       } catch (e: any) {