comfyui-mcp 0.52.113 → 0.52.115

package/dist/services/download-jobs.js

@@ -18,7 +18,7 @@ import { realpath } from "node:fs/promises";
 import { extname, basename, dirname, join } from "node:path";
 import { downloadModel, findResumablePartialForLocalDownload, liveListingHasEntry, managerJobFilename, resolveDownloadTarget, shouldDispatchDownloadToManager, verifyLandedModel, verifyManagerVisibility, } from "./model-resolver.js";
 import { ModelError } from "../utils/errors.js";
-import { readDownloadProgress, listInFlightDownloadProgress, persistDownloadJob, readPersistedDownloadJob, listPersistedDownloadJobs, findPersistedDownloadJob, removePersistedDownloadJobFor, clearDownloadProgress, persistedRecordsEnabled, PERSIST_OWNER, PERSISTED_INFLIGHT_STALE_MS, } from "./download-progress.js";
+import { readDownloadProgress, listInFlightDownloadProgress, persistDownloadJob, currentDownloadTarget, listPersistedDownloadJobs, findPersistedDownloadJob, removePersistedDownloadJobFor, clearDownloadProgress, persistedRecordsEnabled, PERSIST_OWNER, PERSISTED_INFLIGHT_STALE_MS, } from "./download-progress.js";
 import { logger } from "../utils/logger.js";
 /** How often an in-flight job re-persists its record (liveness heartbeat). Must stay
  *  comfortably below PERSISTED_INFLIGHT_STALE_MS so a live download is always fresh. */
@@ -311,6 +311,7 @@ dispatchToManagerOverride) {
     // when locally resolvable (two-URLs-one-dest dedup).
     const lookupKeys = destKey ? [reqKey, destKey] : [reqKey];
     const trayId = downloadIdFor(url);
+    const downloadTarget = currentDownloadTarget();
     // ADOPT ONLY AN IN-FLIGHT ENTRY (#420 codex round 3, rule 3): a FINISHED entry
     // under any key is treated as absent — it must never shadow a currently-downloading
     // writer reachable under another key, nor cause a retire that overwrites a live row.
@@ -375,6 +376,7 @@ dispatchToManagerOverride) {
         rec.status === "downloading" &&
         nowForAdopt - (rec.updated ?? 0) < PERSISTED_INFLIGHT_STALE_MS &&
         rec.trayId === trayId &&
+        rec.target === downloadTarget &&
         (rec.id === id || (rec.req_key !== undefined && rec.req_key === reqKey)) &&
         // A FRESH HEARTBEAT IS NOT A LIVE WRITER. The heartbeat is written every
         // 15s and only goes stale after 60, so a process that died a moment ago
@@ -417,6 +419,7 @@ dispatchToManagerOverride) {
     const job = {
         id,
         trayId,
+        target: downloadTarget,
         url,
         target_subfolder: targetSubfolder,
         filename,
@@ -773,11 +776,12 @@ function finalizeCancelled(job) {
  *  URL. No-op outside the panel. Keeps the persisted copy in step with the job.
  *  Returns whether the record was DURABLY replaced (so the heartbeat can retry a
  *  transiently-failing terminal persist). */
-function persistJobRecord(job) {
+function persistJobRecord(job, owner = PERSIST_OWNER) {
     return persistDownloadJob({
         id: job.id,
         trayId: job.trayId,
         progressId: job.progressId,
+        target: job.target,
         url: job.url,
         target_subfolder: job.target_subfolder,
         filename: job.filename,
@@ -797,7 +801,34 @@ function persistJobRecord(job) {
         disk_verified: job.disk_verified,
         verified_root: job.verified_root,
         reclaimed_dead: job.reclaimedDead,
-    });
+    }, owner);
+}
+function boundedDownloadJobError(value) {
+    if (typeof value !== "string")
+        return undefined;
+    const compact = value.replace(/\s+/g, " ").trim();
+    return compact ? compact.slice(0, 400) : undefined;
+}
+/** Turn a stale/frozen in-flight record into the terminal state the tray is reporting. */
+export function reconcileStalledDownloadRecord(job, error) {
+    if (job.status !== "downloading")
+        return true;
+    const wasPersisted = job.updated !== undefined;
+    job.status = "error";
+    job.error = boundedDownloadJobError(error);
+    job.finished_at = Date.now();
+    job.updated = job.finished_at;
+    // A reconstructed foreign record must be terminalized in its ORIGINAL owner file;
+    // writing a fresh current-owner snapshot leaves the original fresh downloading row
+    // authoritative to status. Legacy persisted records without an owner cannot be safely
+    // reconciled, so callers keep the event explicitly disclosed instead.
+    if (wasPersisted && !job.owner)
+        return false;
+    const durable = persistJobRecord(job, job.owner ?? PERSIST_OWNER);
+    // In non-panel mode the in-memory object is the authoritative status store. In panel
+    // mode a failed persist leaves the old downloading snapshot visible, so the caller must
+    // keep the event explicitly reconciled instead of emitting an unflagged FAILED row.
+    return durable || !persistedRecordsEnabled();
 }
 /** Rebuild an in-memory DownloadJob view from a persisted record (#529 adoption
  *  after a reconnect). It is a read-only snapshot — there is no live AbortController
@@ -808,10 +839,13 @@ function jobFromPersisted(rec) {
         id: rec.id,
         trayId: rec.trayId,
         progressId: rec.progressId,
+        target: rec.target,
+        owner: rec.owner,
         url: rec.url,
         target_subfolder: rec.target_subfolder,
         filename: rec.filename,
         status: rec.status,
+        updated: rec.updated,
         path: rec.path,
         error: rec.error,
         started_at: rec.started_at,
@@ -842,10 +876,10 @@ function jobFromPersisted(rec) {
  *  distinct URLs resolving to the same dest+auth). The id alone can't disambiguate, so
  *  a by-id lookup/cancel must decline rather than silently act on the local one.
  *  Excludes this process's own records (same owner) and heartbeat-stale ones. */
-function hasAmbiguousForeignSibling(id, localTrayId) {
+function hasAmbiguousForeignSibling(id, localTrayId, localTarget) {
     const now = Date.now();
     return listPersistedDownloadJobs().some((rec) => rec.id === id &&
-        rec.trayId !== localTrayId &&
+        (rec.trayId !== localTrayId || rec.target !== localTarget) &&
         rec.owner !== PERSIST_OWNER &&
         rec.status === "downloading" &&
         now - (rec.updated ?? 0) < PERSISTED_INFLIGHT_STALE_MS);
@@ -1015,7 +1049,7 @@ ctx) {
 /**
  * Every DISTINCT tracked download that answers to `id`, across this process's
  * registry AND the persisted store, deduped by the TRUE composite identity
- * (id, trayId) — the same key `listDownloadJobs`/`findDownloadJob` already use.
+ * (id, trayId, target) — the same target-aware key `listDownloadJobs` uses.
  *
  * `id` is derived from destination+auth, so two different SOURCE URLs landing on
  * one file deliberately share it (#467 P1-A dedup). That makes `id` a
@@ -1027,7 +1061,7 @@ ctx) {
  * Newest-started first, so a caller printing candidates leads with the live one.
  */
 export function listDownloadJobCandidates(id) {
-    const keyOf = (j) => `${j.id}\n${j.trayId}`;
+    const keyOf = (j) => `${j.id}\n${j.trayId}\n${j.target ?? ""}`;
     const byKey = new Map();
     for (const e of new Set(jobs.values())) {
         if (e.job.id !== id)
@@ -1038,7 +1072,8 @@ export function listDownloadJobCandidates(id) {
     }
     // `trayId` is a hash of the URL, so it does NOT separate sessions: this
     // session's SETTLED record for a URL and ANOTHER session's still-running
-    // download of the same URL to the same destination collapse to one key. Which
+    // download of the same URL to the same destination collapse to one target-aware
+    // key. Which
     // one is reported matters — showing the local "cancelled" row while a foreign
     // transfer is live would hide a running download behind a stale verdict, and
     // that is worse than the ambiguity this function exists to surface.
@@ -1083,23 +1118,33 @@ export function listDownloadJobCandidates(id) {
  * Resolve ONE download.
  *
  * `trayId` is the DISAMBIGUATOR (#822): with it the lookup keys on the full
- * composite identity (id, trayId) and can always name exactly one row. Without
+ * composite identity (id, trayId, target) and can name exactly one row when the
+ * current target is known. Without
  * it, an id that denotes more than one download still resolves to nothing —
  * but callers can now distinguish that from "no such download" by asking
  * {@link listDownloadJobCandidates}, which is the difference between an
  * actionable "say which one" and a false "it never existed".
  */
-export function getDownloadJob(id, trayId) {
-    if (trayId) {
-        return listDownloadJobCandidates(id).find((j) => j.trayId === trayId);
-    }
+export function getDownloadJob(id, trayId, target) {
+    const targetSelector = target ?? currentDownloadTarget();
+    const candidates = listDownloadJobCandidates(id).filter((j) => (!trayId || j.trayId === trayId) &&
+        (targetSelector === undefined || j.target === targetSelector));
+    const selectOne = (rows) => {
+        const identities = new Set(rows.map((j) => `${j.id}\n${j.trayId}\n${j.target ?? ""}`));
+        return identities.size === 1 ? rows[0] : undefined;
+    };
+    if (trayId)
+        return selectOne(candidates);
     // The registry indexes each job under its request key and (when local) its
     // destination key; the public id is one of those, so a direct get resolves it.
     const live = jobs.get(id)?.job;
     // A LIVE in-flight job in THIS process is authoritative (it's actively writing here) —
-    // but decline if a concurrent live FOREIGN session shares the id with a different trayId.
-    if (live && live.status === "downloading") {
-        if (hasAmbiguousForeignSibling(id, live.trayId))
+    // but decline if a concurrent live FOREIGN session shares the id with a different
+    // (trayId, target) identity.
+    if (live &&
+        (targetSelector === undefined || live.target === targetSelector) &&
+        live.status === "downloading") {
+        if (hasAmbiguousForeignSibling(id, live.trayId, live.target))
             return undefined;
         return live;
     }
@@ -1109,10 +1154,21 @@ export function getDownloadJob(id, trayId) {
     // same id. A cancel/error never lands a file, so it must never mask another session's
     // validated-complete file (cancelled-over-complete), and this holds whether the
     // cancelled/error record is in-memory or persisted.
-    if (live && live.status === "done")
+    if (live &&
+        (targetSelector === undefined || live.target === targetSelector) &&
+        live.status === "done")
         return live;
     const now = Date.now();
-    const matches = listPersistedDownloadJobs().filter((r) => r.id === id);
+    const matches = listPersistedDownloadJobs().filter((r) => r.id === id && (targetSelector === undefined || r.target === targetSelector));
+    const freshIdentities = new Set(matches
+        .filter((r) => r.status === "downloading" && now - (r.updated ?? 0) < PERSISTED_INFLIGHT_STALE_MS)
+        .map((r) => `${r.id}\n${r.trayId}\n${r.target ?? ""}`));
+    const settledIdentities = new Set(matches
+        .filter((r) => r.status !== "downloading")
+        .map((r) => `${r.id}\n${r.trayId}\n${r.target ?? ""}`));
+    if (freshIdentities.size > 1 || (freshIdentities.size === 0 && settledIdentities.size > 1)) {
+        return undefined;
+    }
     const persistedDone = matches
         .filter((r) => r.status === "done")
         .sort((a, b) => (b.updated ?? 0) - (a.updated ?? 0))[0];
@@ -1123,11 +1179,12 @@ export function getDownloadJob(id, trayId) {
     // record, then the newest persisted terminal.
     const foreignLive = matches.filter((r) => r.status === "downloading" && now - (r.updated ?? 0) < PERSISTED_INFLIGHT_STALE_MS);
     if (foreignLive.length > 0) {
-        if (new Set(foreignLive.map((r) => r.trayId)).size > 1)
+        if (new Set(foreignLive.map((r) => `${r.trayId}\n${r.target ?? ""}`)).size > 1)
             return undefined; // ambiguous live
         return jobFromPersisted(foreignLive.sort((a, b) => (b.updated ?? 0) - (a.updated ?? 0))[0]);
     }
-    if (live)
+    if (live &&
+        (targetSelector === undefined || live.target === targetSelector))
         return live; // this session's terminal (cancelled/error), no DONE to prefer
     const terminal = matches.sort((a, b) => (b.updated ?? 0) - (a.updated ?? 0))[0];
     return terminal ? jobFromPersisted(terminal) : undefined;
@@ -1158,8 +1215,15 @@ export function getDownloadJob(id, trayId) {
  */
 export function describeUnresolvedDownload(id) {
     const now = Date.now();
-    const liveInMemory = jobs.get(id)?.job;
-    const inFlight = listPersistedDownloadJobs().filter((r) => r.id === id && r.status === "downloading");
+    const targetSelector = currentDownloadTarget();
+    const liveInMemoryCandidate = jobs.get(id)?.job;
+    const liveInMemory = liveInMemoryCandidate &&
+        (targetSelector === undefined || liveInMemoryCandidate.target === targetSelector)
+        ? liveInMemoryCandidate
+        : undefined;
+    const inFlight = listPersistedDownloadJobs().filter((r) => r.id === id &&
+        r.status === "downloading" &&
+        (targetSelector === undefined || r.target === targetSelector));
     const livePersisted = inFlight.filter((r) => now - (r.updated ?? 0) < PERSISTED_INFLIGHT_STALE_MS);
     // A STALE in-flight record counts here, hedged — and getting that wrong is
     // what would have left the REPORTED case uncovered.
@@ -1217,6 +1281,7 @@ export function describeUnresolvedDownload(id) {
 export function findDownloadJob(query) {
     const trayId = query.url ? downloadIdFor(query.url) : undefined;
     const destKey = query.destKey;
+    const targetSelector = query.target ?? currentDownloadTarget();
     if (!trayId && !destKey)
         return undefined;
     // Gather candidate IN-FLIGHT jobs from BOTH this process's registry AND the cross-
@@ -1225,18 +1290,19 @@ export function findDownloadJob(query) {
     // job for URL→destA plus another session's persisted in-flight job for URL→destB are
     // two DISTINCT jobs for the same URL, and adopting either by URL alone would be a
     // guess — so decline (the caller must use the exact id).
-    // Key candidates by (id, trayId): two distinct URLs to one dest+auth share an id but
+    // Key candidates by (id, trayId, target): two distinct URLs to one dest+auth share an id but
     // differ in trayId (distinct physical downloads), so id alone would wrongly collapse
     // them and mask the ambiguity. A live in-memory copy wins over its persisted snapshot
     // (same id+trayId key).
-    const keyOf = (id, tray) => `${id}\n${tray}`;
+    const keyOf = (id, tray, targetValue) => `${id}\n${tray}\n${targetValue ?? ""}`;
     const now = Date.now();
     const inflightByKey = new Map();
     for (const e of new Set(jobs.values())) {
         if (e.job.status !== "downloading")
             continue;
-        if ((query.url && e.job.url === query.url) || (destKey && e.job.destKey === destKey)) {
-            inflightByKey.set(keyOf(e.job.id, e.job.trayId), e.job);
+        if (((query.url && e.job.url === query.url) || (destKey && e.job.destKey === destKey)) &&
+            (targetSelector === undefined || e.job.target === targetSelector)) {
+            inflightByKey.set(keyOf(e.job.id, e.job.trayId, e.job.target), e.job);
         }
     }
     for (const rec of listPersistedDownloadJobs()) {
@@ -1246,7 +1312,9 @@ export function findDownloadJob(query) {
         if (rec.status !== "downloading" || now - (rec.updated ?? 0) >= PERSISTED_INFLIGHT_STALE_MS) {
             continue;
         }
-        const key = keyOf(rec.id, rec.trayId);
+        if (targetSelector !== undefined && rec.target !== targetSelector)
+            continue;
+        const key = keyOf(rec.id, rec.trayId, rec.target);
         if (inflightByKey.has(key))
             continue;
         if ((trayId && rec.trayId === trayId) || (destKey && rec.dest_key === destKey)) {
@@ -1259,7 +1327,7 @@ export function findDownloadJob(query) {
         return [...inflightByKey.values()][0];
     // No in-flight match anywhere — fall back to a single unambiguous SETTLED persisted
     // record (for status reporting); findPersistedDownloadJob declines if ambiguous.
-    const persisted = findPersistedDownloadJob({ trayId, destKey });
+    const persisted = findPersistedDownloadJob({ trayId, destKey, target: targetSelector });
     return persisted ? jobFromPersisted(persisted) : undefined;
 }
 /**
@@ -1287,12 +1355,11 @@ export function compareTrayIds(a, b) {
 }
 export function listDownloadJobs() {
     // One Entry is indexed under multiple keys — dedup by identity so a job appears once
-    // regardless of how many keys point at it. Identity is (id, trayId), NOT id alone:
-    // two distinct URLs to one dest+auth share an id but are distinct physical downloads
-    // (different trayId), and both must be listed — download_model action:"status" with no selector
-    // promises EVERY tracked download.
+    // regardless of how many keys point at it. Identity is (id, trayId, target), NOT id alone:
+    // concurrent local and pod transfers can share the first two fields and must remain
+    // separately visible to the tray reconciliation and status action.
     const seen = new Set();
-    const keyOf = (j) => `${j.id}\n${j.trayId}`;
+    const keyOf = (j) => `${j.id}\n${j.trayId}\n${j.target ?? ""}`;
     const byKey = new Map();
     for (const e of jobs.values()) {
         if (seen.has(e))
@@ -1305,11 +1372,10 @@ export function listDownloadJobs() {
     }
     // #529: fold in persisted records for jobs THIS session's registry doesn't hold
     // (started before a reconnect), so download_model action:"status" still lists in-flight downloads.
-    // INTEGRITY TRUTH: a validated DONE (file landed) WINS over a cancelled/error record for
-    // the SAME (id, trayId) — whether that other record is a persisted counterpart OR this
-    // session's own in-memory cancelled/error. So a persisted DONE overrides any current
-    // entry that is neither DONE nor a LIVE in-memory download (which stays visible as the
-    // user's active action). The list never shows a cancelled in place of a validated file.
+    // INTEGRITY TRUTH: a LIVE or validated DONE record WINS over a cancelled/error snapshot
+    // for the SAME (id, trayId, target) — whether that other record is persisted or this session's
+    // in-memory terminal entry. A live record must stay visible as the user's active action,
+    // and the list must never replace a validated file with a terminal snapshot.
     for (const rec of listPersistedDownloadJobs()) {
         const job = jobFromPersisted(rec);
         const k = keyOf(job);
@@ -1317,7 +1383,18 @@ export function listDownloadJobs() {
         if (!cur) {
             byKey.set(k, job);
         }
-        else if (job.status === "done" && cur.status !== "done" && cur.status !== "downloading") {
+        else if ((job.status === "downloading" &&
+            job.staleInflight !== true &&
+            cur.status !== "done" &&
+            !(cur.status === "downloading" && cur.staleInflight !== true)) ||
+            // A persisted terminal may replace a stale persisted in-flight snapshot, but
+            // never an active in-memory writer. The latter has no heartbeat `updated` field;
+            // comparing the terminal timestamp against zero made an old terminal shadow the
+            // bytes that are still advancing in this process (#2057 recurrence).
+            (job.status !== "downloading" &&
+                cur.status === "downloading" &&
+                cur.staleInflight === true) ||
+            (job.status === "done" && cur.status !== "done" && cur.status !== "downloading")) {
             byKey.set(k, job);
         }
     }
@@ -1504,6 +1581,7 @@ export async function adoptOrphanedDownloadJobs() {
     if (routeToManager)
         return adopted;
     const now = Date.now();
+    const target = currentDownloadTarget();
     const records = listPersistedDownloadJobs();
     // Ids this pass already re-issued. `records` is a SNAPSHOT taken before the loop,
     // so without this a second dead record for the SAME id (two dead sessions each
@@ -1515,6 +1593,11 @@ export async function adoptOrphanedDownloadJobs() {
     for (const rec of records) {
         if (rec.status !== "downloading")
             continue;
+        // Adoption runs in the current target's process. A targetless record cannot
+        // be used to adopt a local/pod transfer when the process has a real target,
+        // and a targetful record must never be adopted by a targetless process.
+        if (rec.target !== target)
+            continue;
         if (!rec.owner || rec.owner === PERSIST_OWNER)
             continue;
         if (rec.via_manager)
@@ -1523,10 +1606,13 @@ export async function adoptOrphanedDownloadJobs() {
             continue;
         if (!rec.url || downloadIdFor(rec.url) !== rec.trayId)
             continue;
-        if (adoptedIds.has(rec.id))
+        const identity = `${rec.id}\n${rec.trayId}\n${rec.target ?? ""}`;
+        if (adoptedIds.has(identity))
             continue;
         const alreadyAdopted = records.some((other) => other !== rec &&
             other.id === rec.id &&
+            other.trayId === rec.trayId &&
+            other.target === rec.target &&
             other.status === "downloading" &&
             now - (other.updated ?? 0) < PERSISTED_INFLIGHT_STALE_MS);
         if (alreadyAdopted)
@@ -1565,7 +1651,7 @@ export async function adoptOrphanedDownloadJobs() {
             resumedBytes: partial.bytes,
             staleRecordLeft: reclaim.staleRecordLeft || undefined,
         });
-        adoptedIds.add(rec.id);
+        adoptedIds.add(identity);
     }
     return adopted;
 }
@@ -1590,11 +1676,32 @@ export function cancelDownloadJob(id,
  *  it the composite identity (id, trayId) selects exactly one row, which is what
  *  made the stale job in #822 unselectable — and therefore unstoppable. */
 trayId) {
+    const targetSelector = currentDownloadTarget();
     if (trayId) {
+        const trayCandidates = listDownloadJobCandidates(id).filter((j) => j.trayId === trayId &&
+            (targetSelector === undefined || j.target === targetSelector));
+        if (targetSelector === undefined) {
+            const identities = new Set(listDownloadJobCandidates(id)
+                .filter((j) => j.trayId === trayId)
+                .map((j) => `${j.id}\n${j.trayId}\n${j.target ?? ""}`));
+            if (identities.size > 1) {
+                return {
+                    found: true,
+                    owned: false,
+                    aborted: false,
+                    ambiguous: true,
+                    candidates: listDownloadJobCandidates(id),
+                    status: trayCandidates[0]?.status,
+                    job: trayCandidates[0],
+                };
+            }
+        }
         // Explicit selection: find the ONE local entry with this composite identity.
         // Scanning entries (rather than jobs.get(id)) matters because the registry's
         // id row holds only one of several same-destination jobs.
-        const entry = [...new Set(jobs.values())].find((e) => e.job.id === id && e.job.trayId === trayId);
+        const entry = [...new Set(jobs.values())].find((e) => e.job.id === id &&
+            e.job.trayId === trayId &&
+            (targetSelector === undefined || e.job.target === targetSelector));
         if (entry) {
             const { job, controller } = entry;
             // No ambiguity check here: the caller named the exact download, which is
@@ -1610,10 +1717,13 @@ trayId) {
         // Not ours. It may be another session's (persisted). A LIVE one is reportable,
         // not abortable — but a STALE one whose writer is proven gone is reclaimed
         // (#858): closed as cancelled so the download can be safely re-issued.
-        const foreign = listDownloadJobCandidates(id).find((j) => j.trayId === trayId);
+        const foreign = trayCandidates[0];
         if (foreign) {
             if (foreign.status === "downloading" && foreign.staleInflight) {
-                const rec = listPersistedDownloadJobs().find((r) => r.id === id && r.trayId === trayId && r.status === "downloading");
+                const rec = listPersistedDownloadJobs().find((r) => r.id === id &&
+                    r.trayId === trayId &&
+                    r.status === "downloading" &&
+                    (targetSelector === undefined || r.target === targetSelector));
                 if (rec) {
                     const re = reclaimDeadPersistedDownload(rec);
                     if (re.reclaimed) {
@@ -1642,12 +1752,16 @@ trayId) {
         return { found: false, owned: false, aborted: false, candidates: listDownloadJobCandidates(id) };
     }
     const entry = jobs.get(id);
-    if (entry) {
-        const { job, controller } = entry;
+    const localEntry = entry &&
+        (targetSelector === undefined || entry.job.target === targetSelector)
+        ? entry
+        : undefined;
+    if (localEntry) {
+        const { job, controller } = localEntry;
         // Cross-session ambiguity: a live foreign download shares this id with a DIFFERENT
         // trayId. Aborting by id could act on the wrong logical download — decline so a
         // cancel-by-id can never hit an unintended concurrent download (a #515 invariant).
-        if (job.status === "downloading" && hasAmbiguousForeignSibling(id, job.trayId)) {
+        if (job.status === "downloading" && hasAmbiguousForeignSibling(id, job.trayId, job.target)) {
             return {
                 found: true,
                 owned: true,
@@ -1694,7 +1808,7 @@ trayId) {
     // tray id of the one they mean. Only STILL-DOWNLOADING records create that
     // ambiguity: a settled record cannot be cancelled wrongly (the call is a no-op
     // report either way), so it must not block the one row that could be acted on.
-    const persistedCandidates = listDownloadJobCandidates(id);
+    const persistedCandidates = listDownloadJobCandidates(id).filter((candidate) => targetSelector === undefined || candidate.target === targetSelector);
     if (persistedCandidates.filter((c) => c.status === "downloading").length > 1) {
         return {
             found: true,
@@ -1706,7 +1820,24 @@ trayId) {
             job: persistedCandidates[0],
         };
     }
-    const persisted = readPersistedDownloadJob(id);
+    const persistedMatches = listPersistedDownloadJobs().filter((r) => r.id === id && (targetSelector === undefined || r.target === targetSelector));
+    const persistedLive = persistedMatches.filter((r) => r.status === "downloading" && Date.now() - (r.updated ?? 0) < PERSISTED_INFLIGHT_STALE_MS);
+    const persistedIdentities = new Set(persistedLive.map((r) => `${r.id}\n${r.trayId}\n${r.target ?? ""}`));
+    if (persistedIdentities.size > 1) {
+        return {
+            found: true,
+            owned: false,
+            aborted: false,
+            ambiguous: true,
+            candidates: persistedCandidates,
+            status: persistedCandidates[0]?.status,
+            job: persistedCandidates[0],
+        };
+    }
+    const persistedPool = persistedMatches.filter((r) => r.status === "done");
+    const persisted = (persistedLive[0] ?? (persistedPool.length > 0
+        ? persistedPool.sort((a, b) => (b.updated ?? 0) - (a.updated ?? 0))[0]
+        : persistedMatches.sort((a, b) => (b.updated ?? 0) - (a.updated ?? 0))[0])) ?? null;
     if (persisted) {
         // A STALE in-flight record whose writer is proven gone is reclaimed (#858);
         // a live or unprovable one stays refused exactly as before (#761).