dowafu 0.5.0 → 0.6.0

package/README.md

@@ -208,7 +208,7 @@ not work: a reviewer's fixed closing line has to match the template the audit ch
 against.
 
 ```bash
-npx degit eyesofkids/dowafu/publish/en#v0.5.0 .claude-pack   # or publish/zh-tw
+npx degit eyesofkids/dowafu/publish/en#v0.6.0 .claude-pack   # or publish/zh-tw
 
 cd .claude-pack
 TARGET=<your project>
@@ -244,8 +244,9 @@ There are two transports, and the difference that matters is who starts what.
 ### Both transports need `dowafu serve`
 
 `dowafu mcp` only answers tool calls — **it never runs a reviewer**. The worker that
-actually spends money lives in `dowafu serve`. Without one running, an approved job sits
-in the queue forever and nothing tells the agent why.
+actually spends money lives in `dowafu serve`. Without one running, an approved job never
+runs — `dispatch_submit`, `dispatch_approve` and `dispatch_status` each print a `⚠` line
+saying so.
 
 ```
 stdio:  your client ──spawn──→ dowafu mcp ──┐
@@ -255,9 +256,11 @@ stdio:  your client ──spawn──→ dowafu mcp ──┐
 HTTP:   your client ──x-api-key──→ dowafu serve  (endpoint and worker, one process)
 ```
 
-So on stdio you keep `dowafu serve` running in a terminal next to the client. The order
-is forgiving there — start it before or after approving, and the daemon picks the job up
-on its next tick.
+So on stdio you keep `dowafu serve` running in a terminal next to the client. **Start it
+before you approve.** A daemon only runs approvals made while it is up: when it starts,
+and again when it stops, any job still waiting in `approved` goes back to pending approval,
+so an approval given before the daemon was running has to be given again. `dowafu serve`
+prints how many it sent back.
 
 ### stdio
 
@@ -353,6 +356,25 @@ With the daemon always up the stdio path needs nothing extra — `dowafu mcp` fi
 worker already running. Typing `dowafu serve` yourself will then refuse with
 `daemon already running (pid N)`: that is the guard working, not a fault.
 
+### Stopping and restarting
+
+`dowafu serve --stop` stops the daemon; `dowafu serve --restart` stops it and starts a new
+one (or just starts one if none is running). When something would be affected, both ask
+first — separately — about:
+
+- **jobs still running** — stopping the daemon does not stop a reviewer already in flight.
+  It runs to completion, and its results and API cost are still recorded.
+- **jobs approved but not yet started** — they go back to pending approval, so the next
+  daemon cannot run them without a fresh approval.
+
+With no terminal to answer (an agent calling it, a script), a question counts as "no" and
+nothing is stopped; pass `--yes` to go ahead.
+
+If the daemon ignores SIGTERM, `--stop` says so and prints the pid to inspect. Do not reach
+for SIGKILL: a reviewer's worker process can outlive the daemon and still write its results.
+And if the daemon comes straight back after stopping, a service manager (the `KeepAlive` /
+`Restart=always` above) is restarting it — stop it with `launchctl` or `systemctl` instead.
+
 ### Approval is still a separate step
 
 `dispatch_submit` queues a job and stops; nothing is billed until it is approved. Two

package/README_zh-tw.md

@@ -199,7 +199,7 @@ dowafu providers import <path>             # 匯入自己的設定檔
 `publish/` 提供兩種語言：`publish/en/` 與 `publish/zh-tw/`。**擇一複製，不可混裝**——審查者的固定收尾句必須與稽核檢查用的範本是同一種語言。
 
 ```bash
-npx degit eyesofkids/dowafu/publish/zh-tw#v0.5.0 .claude-pack   # 或 publish/en
+npx degit eyesofkids/dowafu/publish/zh-tw#v0.6.0 .claude-pack   # 或 publish/en
 
 cd .claude-pack
 TARGET=<your project>
@@ -238,8 +238,8 @@ Agent 可以不走 shell，改用 MCP 驅動 `dowafu`。露出五個 tool：`dis
 ### 兩條路都需要 `dowafu serve`
 
 `dowafu mcp` 只回應 tool 呼叫，**它不執行任何 reviewer**。真正花錢的 worker 在
-`dowafu serve` 裡。沒有它，核准過的 job 會永遠留在佇列裡，而且沒有任何東西會告訴 agent
-為什麼。
+`dowafu serve` 裡。沒有它，核准過的 job 永遠不會執行——`dispatch_submit`、`dispatch_approve`、
+`dispatch_status` 都會印一行 `⚠` 說明這件事。
 
 ```
 stdio：  你的 client ──spawn──→ dowafu mcp ──┐
@@ -249,8 +249,9 @@ stdio：  你的 client ──spawn──→ dowafu mcp ──┐
 HTTP：   你的 client ──x-api-key──→ dowafu serve  （端點與 worker 同一個行程）
 ```
 
-所以走 stdio 時，要在 client 旁邊另開一個終端機讓 `dowafu serve` 跑著。這條路的順序很寬鬆
-——核准之前或之後才起都可以，daemon 下一個 tick 就會把它撿走。
+所以走 stdio 時，要在 client 旁邊另開一個終端機讓 `dowafu serve` 跑著。**要先起 daemon，再核准。**
+daemon 只執行它在線期間核准的 job：它啟動時、以及停止時，還停在「已核准」的 job 會被退回待核准，
+所以在 daemon 起來之前給的核准要再給一次。`dowafu serve` 會印出退回了幾張。
 
 ### stdio
 
@@ -339,6 +340,20 @@ daemon 常駐之後，stdio 那條路不需要任何額外動作——`dowafu mc
 這時自己再打 `dowafu serve` 會被擋下並回報 `daemon already running (pid N)`：
 **那是守衛在運作，不是故障。**
 
+### 停止與重啟
+
+`dowafu serve --stop` 停掉 daemon；`dowafu serve --restart` 停掉之後再起一支新的
+（沒在跑的話就直接起）。有東西會受影響時，兩者都會先分開問兩件事：
+
+- **還在執行的 job**——停掉 daemon 不會停掉已經在跑的審查者，它會跑完，結果與 API 成本照樣記帳。
+- **已核准但還沒開始的 job**——會退回待核准，下一支 daemon 沒有新的核准就不會跑它們。
+
+沒有終端機可以回答時（agent 代為呼叫、腳本），問題一律視為「不要」，什麼都不會停；要繼續就帶 `--yes`。
+
+daemon 收到 SIGTERM 卻沒停下來時，`--stop` 會明說並印出要檢查的 pid。**不要改用 SIGKILL**：
+審查者的 worker 行程可能比 daemon 活得久，照樣會寫入結果。停掉之後 daemon 馬上又回來，
+代表有服務管理器（上面的 `KeepAlive`／`Restart=always`）在重拉它——那要用 `launchctl` 或 `systemctl` 停。
+
 ### 核准仍然是獨立的一步
 
 `dispatch_submit` 只把 job 排進佇列就停下，核准之前不會計費。兩種核准方式：在自己的終端機下

package/dist/cli-args.js

@@ -104,6 +104,7 @@ export function parseArgs(argv, lang) {
     let doctorMode = false;
     let serveMode = false;
     let serveStop = false;
+    let serveRestart = false;
     let mcpMode = false;
     const numFlag = (name, apply) => {
         flagHandlers[name] = (v) => {
@@ -159,6 +160,9 @@ export function parseArgs(argv, lang) {
         else if (arg === "--stop") {
             serveStop = true;
         }
+        else if (arg === "--restart") {
+            serveRestart = true;
+        }
         else if (arg === "mcp") {
             mcpMode = true;
         }
@@ -190,16 +194,18 @@ export function parseArgs(argv, lang) {
         if (ticketDir !== undefined) {
             throw new DispatchError(m(lang, "tooManyArgs", ticketDir, "--doctor", helpText), 2);
         }
-        if (serveStop)
+        if (serveStop || serveRestart)
             throw new DispatchError(m(lang, "stopRequiresServe"), 2);
         return { mode: "doctor", options };
     }
     if (serveMode) {
         if (ticketDir !== undefined)
             throw new DispatchError(m(lang, "tooManyArgs", ticketDir, "serve", helpText), 2);
-        return { mode: "serve", options, stop: serveStop };
+        if (serveStop && serveRestart)
+            throw new DispatchError(m(lang, "stopRestartConflict"), 2);
+        return { mode: "serve", options, stop: serveStop, restart: serveRestart };
     }
-    if (serveStop)
+    if (serveStop || serveRestart)
         throw new DispatchError(m(lang, "stopRequiresServe"), 2);
     if (mcpMode) {
         if (ticketDir !== undefined)

package/dist/cli.js

@@ -34,7 +34,7 @@ import { m } from "./messages.js";
 import { defaultDbPath, openDb } from "./db.js";
 import { issueToken, listTokens, revokeToken } from "./api-token.js";
 import { addAllow, addSpoke, createTicket, formatTicket, hasResults, importTicketDirectory } from "./ticket-store.js";
-import { approveJob, findJobsByIdPrefix, getJob, listPendingApprovalJobs } from "./job.js";
+import { approveJob, countQueueJobs, findJobsByIdPrefix, getJob, listPendingApprovalJobs } from "./job.js";
 import { serve, stopDaemon } from "./daemon.js";
 import { daemonAlive, daemonStatePath } from "./liveness.js";
 import { startStdioServer } from "./mcp/stdio.js";
@@ -611,6 +611,9 @@ async function main() {
         // 工單 key-db §B-3 #6：逐 provider 印出實際生效的是哪一層——doctorDb 開不起來時就沒有
         // DB 可查，keyStatusRows 留空陣列（buildApiKeyValue 對空陣列的降級輸出）。
         let keyStatusRows = [];
+        // A database failure must leave --doctor usable. Its JSON contract still has
+        // numeric queue fields, so the unavailable DB degrades to zero counts.
+        let queue = { pendingApproval: 0, approved: 0, running: 0 };
         // A（gaps #1）：整份報表——DB、金鑰、型號白名單、daemon——都要來自**這次真的會用到的**
         // 那個 DB。先前這裡寫死 undefined／defaultDbPath()，於是 `--doctor --db <別的>` 印的
         // 全是預設 DB 的狀況，而使用者指定的那個檔連建都不會建。
@@ -620,49 +623,60 @@ async function main() {
             const providers = loadProviders(doctorDb, messageLang);
             providersResult = { ok: true, providers, models: listModels(doctorDb) };
             keyStatusRows = buildKeyStatusRows(doctorDb);
+            queue = countQueueJobs(doctorDb);
         }
         catch (err) {
             const reason = err instanceof DispatchError ? err.message : maskString(String(err));
             providersResult = { ok: false, reason };
         }
-        const doctorData = buildDoctorReportData(getCommandName(), providersResult, process.env, undefined, undefined, undefined, daemonAlive(daemonStatePath(doctorDbPath)), keyStatusRows, doctorDbPath);
+        const doctorData = buildDoctorReportData(getCommandName(), providersResult, process.env, undefined, undefined, undefined, daemonAlive(daemonStatePath(doctorDbPath)), keyStatusRows, doctorDbPath, queue);
         console.log(parsed.options.json ? JSON.stringify(doctorData) : renderDoctorReport(messageLang, getCommandName(), doctorData));
         return;
     }
     if (parsed.mode === "serve") {
-        if (parsed.stop) {
+        if (parsed.stop || parsed.restart) {
             const outcome = await stopDaemon(parsed.options.dbPath, {
                 force: parsed.options.yes,
                 confirmRunningJobs: async (count) => {
                     console.log(m(messageLang, "daemonStopRunningWarning", count));
                     return confirm(m(messageLang, "daemonStopConfirmPrompt"), process.stdout);
                 },
+                confirmApprovedJobs: async (count) => {
+                    console.log(m(messageLang, "daemonStopApprovedWarning", count));
+                    return confirm(m(messageLang, "daemonStopApprovedConfirmPrompt"), process.stdout);
+                },
             });
             switch (outcome.status) {
                 case "not_running":
                     console.log(m(messageLang, "daemonStopNotRunning", outcome.reason));
+                    if (parsed.restart)
+                        break;
                     break;
                 case "cancelled":
                     console.log(m(messageLang, "daemonStopCancelled"));
-                    break;
+                    return;
                 case "pid_not_dowafu":
                     console.log(m(messageLang, "daemonStopPidNotDowafu", outcome.pid));
-                    break;
+                    return;
                 case "signal_failed":
                     console.log(m(messageLang, "daemonStopSignalFailed", outcome.pid));
-                    break;
+                    console.log(m(messageLang, "daemonStopApprovedCleaned", outcome.requeuedApprovedJobs));
+                    return;
                 case "stopped":
                     console.log(m(messageLang, "daemonStopSucceeded", outcome.pid));
+                    console.log(m(messageLang, "daemonStopApprovedCleaned", outcome.requeuedApprovedJobs));
                     break;
                 case "restarted":
                     console.log(m(messageLang, "daemonStopRestarted", outcome.pid));
-                    break;
+                    return;
             }
-            return;
+            if (parsed.stop)
+                return;
         }
         try {
             const daemon = await serve(parsed.options.dbPath, undefined, parsed.options.httpPort, messageLang);
-            console.log(m(messageLang, "daemonStarted"));
+            console.log(m(messageLang, parsed.restart ? "daemonRestartStarted" : "daemonStarted"));
+            console.log(m(messageLang, "daemonStartApprovedCleaned", daemon.requeuedApprovedJobs));
             console.log(m(messageLang, "httpServerStarted", daemon.httpPort));
             // B-1 #6：端點活著但沒發過 token，任何請求都進不來——失敗長得像成功，必須警告。
             if (!daemon.hasActiveToken)

package/dist/daemon.js

@@ -2,7 +2,7 @@ import { execFileSync, spawn } from "node:child_process";
 import { fileURLToPath } from "node:url";
 import { hasAnyActiveToken } from "./api-token.js";
 import { defaultDbPath, openDb } from "./db.js";
-import { claimNextJob, finishJob, heartbeatJob, reapInterruptedJobs } from "./job.js";
+import { claimNextJob, finishJob, heartbeatJob, reapInterruptedJobs, requeueApprovedJobs } from "./job.js";
 import { DAEMON_STALE_MS, daemonAlive, daemonStatePath, writeHeartbeat } from "./liveness.js";
 import { createHttpServer, DEFAULT_HTTP_PORT } from "./mcp/http.js";
 import { maskString } from "./mask.js";
@@ -79,9 +79,13 @@ export function workerFailureMessage(lang, code, signal, stderr) {
 export function runCliJob(job, dbPath, lang = "en", deps = DEFAULT_RUN_CLI_JOB_DEPS) {
     const sourceMode = fileURLToPath(import.meta.url).endsWith(".ts");
     const cliPath = fileURLToPath(new URL(sourceMode ? "./cli.ts" : "./cli.js", import.meta.url));
+    // v5 jobs carry an explicit language; rows queued by an older client keep NULL and retain
+    // the daemon-startup fallback.  Pass the resolved value to the child so its prompt and
+    // stdout use the same language as the daemon's own failure message.
+    const jobLang = job.lang ?? lang;
     const args = sourceMode
-        ? ["--import", "tsx", cliPath, job.ticket, "--yes", "--job-id", job.id, "--db", dbPath]
-        : [cliPath, job.ticket, "--yes", "--job-id", job.id, "--db", dbPath];
+        ? ["--import", "tsx", cliPath, job.ticket, "--yes", "--job-id", job.id, "--db", dbPath, "--lang", jobLang]
+        : [cliPath, job.ticket, "--yes", "--job-id", job.id, "--db", dbPath, "--lang", jobLang];
     return new Promise((resolve) => {
         const child = deps.spawn(process.execPath, args, { stdio: ["inherit", "inherit", "pipe"], env: process.env });
         let stderrTail = Buffer.alloc(0);
@@ -90,12 +94,12 @@ export function runCliJob(job, dbPath, lang = "en", deps = DEFAULT_RUN_CLI_JOB_D
             deps.stderr.write(chunk);
             stderrTail = Buffer.concat([stderrTail, chunk]).subarray(-WORKER_STDERR_TAIL_BYTES);
         });
-        child.once("error", (err) => resolve({ error: m(lang, "daemonWorkerSpawnFailed", maskString(String(err))) }));
+        child.once("error", (err) => resolve({ error: m(jobLang, "daemonWorkerSpawnFailed", maskString(String(err))) }));
         child.once("exit", (code, signal) => {
             if (code === 0)
                 resolve({});
             else
-                resolve({ error: workerFailureMessage(lang, code, signal, stderrTail.toString("utf8")) });
+                resolve({ error: workerFailureMessage(jobLang, code, signal, stderrTail.toString("utf8")) });
         });
     });
 }
@@ -108,6 +112,11 @@ const DEFAULT_STOP_DAEMON_DEPS = {
         const row = openDb(dbPath).prepare("SELECT COUNT(*) AS count FROM jobs WHERE status = 'running'").get();
         return row.count;
     },
+    countApprovedJobs: (dbPath) => {
+        const row = openDb(dbPath).prepare("SELECT COUNT(*) AS count FROM jobs WHERE status = 'approved'").get();
+        return row.count;
+    },
+    requeueApprovedJobs: (dbPath) => requeueApprovedJobs(openDb(dbPath)),
     processCommand: (pid) => {
         try {
             return execFileSync("ps", ["-p", String(pid), "-o", "command="], { encoding: "utf8", stdio: ["ignore", "pipe", "ignore"] }).trim();
@@ -116,6 +125,15 @@ const DEFAULT_STOP_DAEMON_DEPS = {
             return null;
         }
     },
+    processExists: (pid) => {
+        try {
+            process.kill(pid, 0);
+            return true;
+        }
+        catch {
+            return false;
+        }
+    },
     kill: (pid, signal) => process.kill(pid, signal),
     wait: (ms) => new Promise((resolve) => setTimeout(resolve, ms)),
 };
@@ -128,28 +146,33 @@ export async function stopDaemon(dbPath = defaultDbPath(), options = {}) {
     const initial = deps.liveness(statePath);
     if (!initial.alive)
         return { status: "not_running", reason: initial.reason };
-    const runningJobs = deps.countRunningJobs(dbPath);
-    if (runningJobs > 0 && !options.force) {
-        const confirmed = await (options.confirmRunningJobs?.(runningJobs) ?? Promise.resolve(false));
-        if (!confirmed)
-            return { status: "cancelled", runningJobs };
-    }
     if (!isDowafuProcess(deps.processCommand(initial.pid)))
         return { status: "pid_not_dowafu", pid: initial.pid };
+    const runningJobs = deps.countRunningJobs(dbPath);
+    const approvedJobs = deps.countApprovedJobs(dbPath);
+    const confirmedRunning = runningJobs === 0 || options.force || await (options.confirmRunningJobs?.(runningJobs) ?? Promise.resolve(false));
+    // Ask independently even when the stop confirmation was declined.  A running
+    // worker warning and an old-approval cleanup warning describe different risks.
+    const confirmedApproved = approvedJobs === 0 || options.force || await (options.confirmApprovedJobs?.(approvedJobs) ?? Promise.resolve(false));
+    if (!confirmedRunning || !confirmedApproved)
+        return { status: "cancelled", runningJobs, approvedJobs };
+    const requeuedApprovedJobs = deps.requeueApprovedJobs(dbPath);
     try {
         deps.kill(initial.pid, "SIGTERM");
     }
     catch {
-        return { status: "signal_failed", pid: initial.pid };
+        return { status: "signal_failed", pid: initial.pid, requeuedApprovedJobs };
     }
     for (let attempt = 0; attempt < STOP_CHECK_ATTEMPTS; attempt++) {
         await deps.wait(STOP_CHECK_INTERVAL_MS);
-        if (!deps.liveness(statePath).alive) {
+        if (!deps.liveness(statePath).alive && !deps.processExists(initial.pid)) {
             await deps.wait(STOP_RESTART_WAIT_MS);
-            return deps.liveness(statePath).alive ? { status: "restarted", pid: initial.pid } : { status: "stopped", pid: initial.pid };
+            return deps.liveness(statePath).alive
+                ? { status: "restarted", pid: initial.pid }
+                : { status: "stopped", pid: initial.pid, requeuedApprovedJobs };
         }
     }
-    return { status: "signal_failed", pid: initial.pid };
+    return { status: "signal_failed", pid: initial.pid, requeuedApprovedJobs };
 }
 function bindHttp(db, dbPath, httpPort) {
     return new Promise((resolve, reject) => {
@@ -182,7 +205,9 @@ export function serve(dbPath = defaultDbPath(), maxConcurrent = Number(process.e
     const db = openDb(dbPath);
     return bindHttp(db, dbPath, httpPort).then((httpServer) => {
         let daemon;
+        let requeuedApprovedJobs;
         try {
+            requeuedApprovedJobs = requeueApprovedJobs(db);
             daemon = createDaemon(db, { dbPath, maxConcurrent, execute: (job) => runCliJob(job, dbPath, lang) });
         }
         catch (err) {
@@ -204,6 +229,7 @@ export function serve(dbPath = defaultDbPath(), maxConcurrent = Number(process.e
             },
             httpPort: boundPort,
             hasActiveToken: hasAnyActiveToken(db),
+            requeuedApprovedJobs,
         };
     });
 }

package/dist/db.js

@@ -180,6 +180,17 @@ const MIGRATIONS = [
                 db.exec("ALTER TABLE provider_keys ADD COLUMN last_test_succeeded INTEGER");
         },
     },
+    // queue-lang-rerun §A: old queued rows deliberately remain NULL so they keep the daemon's
+    // startup-language behavior.  Inspect columns even when a downgraded fixture already has
+    // user_version 5; SQLite has no ADD COLUMN IF NOT EXISTS form for this migration.
+    {
+        version: 5,
+        up: (db) => {
+            const columns = new Set(db.prepare("PRAGMA table_info(jobs)").all().map((column) => column.name));
+            if (!columns.has("lang"))
+                db.exec("ALTER TABLE jobs ADD COLUMN lang TEXT");
+        },
+    },
 ];
 const LATEST_SCHEMA_VERSION = MIGRATIONS[MIGRATIONS.length - 1].version;
 function migrate(db, lang) {

package/dist/doctor.js

@@ -64,6 +64,9 @@ function buildDaemonValue(lang, daemon) {
         return m(lang, "doctorDaemonAlive", daemon.pid);
     return m(lang, "doctorDaemonMissing", daemon?.reason ?? "heartbeat_missing");
 }
+function buildQueueValue(lang, queue) {
+    return m(lang, "doctorQueueValue", queue.pendingApproval, queue.approved, queue.running);
+}
 function buildConfigDirValue(lang, configDir) {
     if (configDir.source === "unresolved")
         return m(lang, "doctorConfigDirUnresolved");
@@ -117,7 +120,7 @@ function buildLensValue(lang, lenses) {
     const closingNames = lenses.withClosing.length > 0 ? lenses.withClosing.join(joiner) : m(lang, "noneLabel");
     return m(lang, "doctorLensFoundValue", lenses.dirPath, lenses.withClosing.length + lenses.withoutClosing.length, lenses.withClosing.length, closingNames, noClosingSuffix);
 }
-export function buildDoctorReportData(cmd, providers, env = process.env, homedir = os.homedir, probe = DEFAULT_PROBE, cwd = process.cwd(), daemon, keyStatusRows = [], dbPath) {
+export function buildDoctorReportData(cmd, providers, env = process.env, homedir = os.homedir, probe = DEFAULT_PROBE, cwd = process.cwd(), daemon, keyStatusRows = [], dbPath, queue = { pendingApproval: 0, approved: 0, running: 0 }) {
     const dispatchHome = resolveDispatchHome(env, homedir);
     const configDir = dispatchHome === null
         ? { source: "unresolved" }
@@ -149,6 +152,7 @@ export function buildDoctorReportData(cmd, providers, env = process.env, homedir
         apiKeys: keyStatusRows.map((row) => ({ ...row })),
         models,
         daemon: daemon ?? { alive: false, reason: "heartbeat_missing" },
+        queue: { ...queue },
         lenses: buildLensData(probe, cwd),
     };
 }
@@ -163,12 +167,13 @@ export function renderDoctorReport(lang, cmd, data) {
         m(lang, "doctorApiKeyLine", buildApiKeyValue(lang, data.apiKeys)),
         m(lang, "doctorModelListLine", buildModelListValue(lang, data.models)),
         m(lang, "doctorDaemonLine", buildDaemonValue(lang, data.daemon)),
+        m(lang, "doctorQueueLine", buildQueueValue(lang, data.queue)),
         m(lang, "doctorLensLine", buildLensValue(lang, data.lenses)),
         "",
         m(lang, "doctorFooter"),
     ];
     return lines.join("\n");
 }
-export function buildDoctorReport(lang, cmd, providers, env = process.env, homedir = os.homedir, probe = DEFAULT_PROBE, cwd = process.cwd(), daemon, keyStatusRows = [], dbPath) {
-    return renderDoctorReport(lang, cmd, buildDoctorReportData(cmd, providers, env, homedir, probe, cwd, daemon, keyStatusRows, dbPath));
+export function buildDoctorReport(lang, cmd, providers, env = process.env, homedir = os.homedir, probe = DEFAULT_PROBE, cwd = process.cwd(), daemon, keyStatusRows = [], dbPath, queue = { pendingApproval: 0, approved: 0, running: 0 }) {
+    return renderDoctorReport(lang, cmd, buildDoctorReportData(cmd, providers, env, homedir, probe, cwd, daemon, keyStatusRows, dbPath, queue));
 }

package/dist/job.js

@@ -21,19 +21,65 @@ export function findJobsByIdPrefix(db, prefix) {
 export function listPendingApprovalJobs(db) {
     return db.prepare("SELECT * FROM jobs WHERE status = 'pending_approval' ORDER BY created_at, id").all();
 }
-export function submitJob(db, ticket, id = randomUUID()) {
+// Keep this to one indexed aggregate query rather than loading jobs and counting
+// in JavaScript. `idx_jobs_status` covers both the WHERE predicate and status.
+export function countQueueJobs(db) {
+    const rows = db
+        .prepare(`SELECT status, COUNT(*) AS count
+         FROM jobs
+        WHERE status IN ('pending_approval', 'approved', 'running')
+        GROUP BY status`)
+        .all();
+    const counts = { pendingApproval: 0, approved: 0, running: 0 };
+    for (const row of rows) {
+        if (row.status === "pending_approval")
+            counts.pendingApproval = Number(row.count);
+        else if (row.status === "approved")
+            counts.approved = Number(row.count);
+        else
+            counts.running = Number(row.count);
+    }
+    return counts;
+}
+export function submitJob(db, ticket, id = randomUUID(), lang = null) {
     if (!db.prepare("SELECT 1 FROM tickets WHERE name = ?").get(ticket))
         throw new Error(`ticket does not exist: ${ticket}`);
     const createdAt = now();
-    db.prepare("INSERT INTO jobs (id, ticket, status, created_at) VALUES (?, ?, 'pending_approval', ?)").run(id, ticket, createdAt);
+    db.prepare("INSERT INTO jobs (id, ticket, lang, status, created_at) VALUES (?, ?, ?, 'pending_approval', ?)").run(id, ticket, lang, createdAt);
     return getJob(db, id);
 }
+// A dispatch can leave one __summary__ row plus one row per spoke.  Count distinct result
+// keys rather than rows so a single run remains one reminder even when its summary is absent
+// or it has many spokes.  The UNION covers both historical CLI keys (ticket name) and queued
+// job keys (jobs.id for the same ticket) without double-counting a pathological overlap.
+export function countTicketResultRuns(db, ticket) {
+    const row = db
+        .prepare(`SELECT COUNT(*) AS count FROM (
+         SELECT job_id FROM results WHERE job_id = ? GROUP BY job_id
+         UNION
+         SELECT r.job_id
+           FROM jobs j JOIN results r ON r.job_id = j.id
+          WHERE j.ticket = ?
+          GROUP BY r.job_id
+       )`)
+        .get(ticket, ticket);
+    return Number(row.count);
+}
 export function approveJob(db, id) {
     return one(db, `UPDATE jobs
        SET status = 'approved', approved_at = ?
      WHERE id = ? AND status = 'pending_approval'
      RETURNING *`, now(), id);
 }
+// A daemon owns only approvals made after it starts.  Before a new daemon begins
+// claiming work, return any older approvals to the explicit human-approval gate.
+// Keep this as a single guarded UPDATE: concurrent approval is allowed to remain
+// approved for the new daemon, and no other lifecycle state is touched.
+export function requeueApprovedJobs(db) {
+    return Number(db.prepare(`UPDATE jobs
+         SET status = 'pending_approval', approved_at = NULL
+       WHERE status = 'approved'`).run().changes);
+}
 export function rejectJob(db, id) {
     return one(db, `UPDATE jobs
        SET status = 'rejected', finished_at = ?

package/dist/mcp/protocol.js

@@ -1,6 +1,6 @@
 import path from "node:path";
 import { defaultDbPath, openDb } from "../db.js";
-import { approveJob, findJobsByIdPrefix, getJob, submitJob } from "../job.js";
+import { approveJob, countTicketResultRuns, findJobsByIdPrefix, getJob, submitJob } from "../job.js";
 import { DAEMON_STALE_MS, daemonAlive, daemonStatePath, daemonWarning } from "../liveness.js";
 import { readProgress } from "../progress.js";
 import { m } from "../messages.js";
@@ -20,7 +20,10 @@ export const TOOLS = [
         description: "Queue a DB ticket by name. It remains pending human terminal approval and is not executed by this tool.",
         inputSchema: {
             type: "object",
-            properties: { ticket: { type: "string", description: "DB ticket name, not a filesystem path" } },
+            properties: {
+                ticket: { type: "string", description: "DB ticket name, not a filesystem path" },
+                lang: { type: "string", enum: ["en", "zh-tw", "zh"], description: "Language for this queued job's CLI output and spoke prompts" },
+            },
             required: ["ticket"],
         },
     },
@@ -70,6 +73,17 @@ function stringParam(params, name) {
     const value = record(params)?.[name];
     return typeof value === "string" && value.length > 0 ? value : null;
 }
+// Keep this acceptance and normalization identical to the CLI's --lang contract without
+// importing cli-args.ts: cli-args imports the MCP HTTP transport, so sharing it here would
+// create a protocol -> CLI args -> HTTP -> protocol runtime cycle.
+function parseSubmitLang(value) {
+    const normalized = value.trim().toLowerCase();
+    if (normalized === "en")
+        return "en";
+    if (normalized === "zh-tw" || normalized === "zh")
+        return "zh";
+    return null;
+}
 function keyStatusText(lang, row) {
     if (row.maskedTail === null)
         return m(lang, "keyStatusMissing");
@@ -122,6 +136,9 @@ export function createProtocol(options) {
                 for (const { name: ticket } of names) {
                     const doc = getTicketDoc(options.db, ticket, options.lang);
                     lines.push(m(options.lang, "mcpTicketsRow", ticket, doc.spokes.length));
+                    const priorRuns = countTicketResultRuns(options.db, ticket);
+                    if (priorRuns > 0)
+                        lines.push(`  ${m(options.lang, "mcpPriorResultsReminder", priorRuns)}`);
                     for (const spoke of doc.spokes) {
                         lines.push(m(options.lang, "mcpTicketsSpoke", spoke.agent, spoke.provider, spoke.model, spoke.allow.length));
                     }
@@ -139,11 +156,23 @@ export function createProtocol(options) {
                 const ticket = stringParam(args, "ticket");
                 if (!ticket)
                     return text("dispatch_submit requires a non-empty ticket name", true);
+                const suppliedLang = record(args)?.lang;
+                let jobLang = null;
+                if (suppliedLang !== undefined) {
+                    if (typeof suppliedLang !== "string")
+                        return text(m(options.lang, "mcpSubmitInvalidLang", "(not a string)", m(options.lang, "availableLangValues")), true);
+                    jobLang = parseSubmitLang(suppliedLang);
+                    if (jobLang === null)
+                        return text(m(options.lang, "mcpSubmitInvalidLang", suppliedLang, m(options.lang, "availableLangValues")), true);
+                }
                 try {
-                    const job = submitJob(options.db, ticket);
+                    const priorRuns = countTicketResultRuns(options.db, ticket);
+                    const job = submitJob(options.db, ticket, undefined, jobLang);
                     const cliPath = path.resolve(process.argv[1] ?? "cli.js");
                     const approveCommand = `node ${JSON.stringify(cliPath)} approve ${job.id.slice(0, 8)} --db ${JSON.stringify(options.dbPath)}`;
                     const lines = [m(options.lang, "mcpSubmitQueued", job.id), m(options.lang, "mcpApproveCommand", approveCommand), formatTicket(options.db, ticket, options.lang)];
+                    if (priorRuns > 0)
+                        lines.push(m(options.lang, "mcpPriorResultsReminder", priorRuns));
                     const offline = warning();
                     if (offline)
                         lines.push(offline);

package/dist/messages.js

@@ -27,6 +27,18 @@ const MESSAGES = {
         dryRunNotice: () => "--dry-run：僅解析／驗證／估算／印報表，未呼叫任何 API。",
         helpText: (cmd) => `用法：${cmd} <ticket-id> [options]
 
+子指令（各自有自己的 --help／用法訊息）：
+  ${cmd} ticket ...        建立、匯入、檢視工單
+  ${cmd} result <id>       印出一次派工的結果（各 spoke 原文與稽核表）
+  ${cmd} key               設定 provider API key（互動選單）
+  ${cmd} providers ...     型號白名單與啟用狀態
+  ${cmd} token ...         入站 HTTP 憑證的發／列／撤銷
+  ${cmd} approve [jobId]   核准佇列中等待的派工
+  ${cmd} serve             啟動常駐 daemon（含 MCP 的 HTTP binding）
+  ${cmd} serve --stop [--yes] 停止常駐 daemon；有執行中的 job 或舊核准 job 時會先確認
+  ${cmd} serve --restart [--yes] 停止後重新啟動 daemon，會走兩端清理
+  ${cmd} mcp               以 stdio 提供 MCP server
+
   --lang <en|zh-tw>        CLI 輸出與 spoke prompt 的語言，預設 en
   --repo-root <dir>        白名單邊界與 .claude/agents 的根，預設 cwd
   --db <path>              SQLite 工單與產物資料庫，預設 DISPATCH_HOME/dowafu.db
@@ -47,18 +59,7 @@ const MESSAGES = {
   --yes                    略過派工確認。非互動環境（stdin 不是 TTY）沒帶就中止
   --doctor                 印出設定自檢（不呼叫 API、不花錢）後結束（exit 0）
   --help, -h               印本說明後結束（exit 0）
-  --version, -V            印版本號後結束（exit 0）
-
-子指令（各自有自己的 --help／用法訊息）：
-  ${cmd} ticket ...        建立、匯入、檢視工單
-  ${cmd} result <id>       印出一次派工的結果（各 spoke 原文與稽核表）
-  ${cmd} key               設定 provider API key（互動選單）
-  ${cmd} providers ...     型號白名單與啟用狀態
-  ${cmd} token ...         入站 HTTP 憑證的發／列／撤銷
-  ${cmd} approve [jobId]   核准佇列中等待的派工
-  ${cmd} serve             啟動常駐 daemon（含 MCP 的 HTTP binding）
-  ${cmd} serve --stop [--yes] 停止常駐 daemon；有執行中的 job 時會先確認
-  ${cmd} mcp               以 stdio 提供 MCP server`,
+  --version, -V            印版本號後結束（exit 0）`,
         availableLangValues: () => "en、zh-tw、zh",
         availableValuesSuffix: (values) => `（可用值：${values}）`,
         numberFlagInvalid: (name, value) => `--${name} 需要數字，收到：${value}`,
@@ -107,7 +108,8 @@ const MESSAGES = {
         mcpJobPrefixAmbiguous: (prefix, count) => `前綴 ${prefix} 命中 ${count} 個 job，請改用完整 id：`,
         jobNotApprovable: (jobId, status) => `job ${jobId} 目前是 ${status}，不能核准`,
         jobApproved: (jobId) => `已核准 job：${jobId}`,
-        daemonStarted: () => "daemon 已啟動。收到 SIGINT 時會乾淨退出；進行中的 job 下次啟動會被回收。",
+        daemonStarted: () => "daemon 已啟動。收到 SIGINT 時會乾淨退出。",
+        daemonStartApprovedCleaned: (count) => `啟動前已將 ${count} 張舊的已核准 job 退回待核准。`,
         daemonStartFailed: (detail) => `daemon 無法啟動：${detail}`,
         daemonWorkerSpawnFailed: (detail) => `worker 無法啟動：${detail}`,
         daemonWorkerExited: (exitCode) => `worker 以 exit code ${exitCode} 結束`,
@@ -115,18 +117,23 @@ const MESSAGES = {
         daemonWorkerTerminated: (signal) => `worker 被訊號 ${signal} 終止`,
         daemonWorkerTerminatedDetail: (signal, detail) => `worker 被訊號 ${signal} 終止：${detail}`,
         stopRequiresServe: () => "--stop 只能與 serve 一起使用。",
+        stopRestartConflict: () => "--stop 與 --restart 不能同時使用。",
         daemonStopRunningWarning: (count) => `目前有 ${count} 張 job 正在執行；停止 daemon 不會停止正在跑的 spoke，它們會繼續跑完，之後結果與 API 成本仍會被認列。`,
         daemonStopConfirmPrompt: () => "確定要停止 daemon 嗎？[y/N] ",
+        daemonStopApprovedWarning: (count) => `目前有 ${count} 張已核准 job 尚未執行；停止前會退回待核准，避免下一支 daemon 未經本輪核准就執行。`,
+        daemonStopApprovedConfirmPrompt: () => "確定要清理這些已核准 job 嗎？[y/N] ",
         daemonStopCancelled: () => "已取消，daemon 仍在執行。",
         daemonStopNotRunning: (reason) => `daemon 未在執行（${reason}）。`,
         daemonStopPidNotDowafu: (pid) => `pid ${pid} 的行程不是 dowafu，為避免誤殺未送出訊號。`,
-        daemonStopSignalFailed: (pid) => `已向 pid ${pid} 送出停止訊號，但它沒有停止。`,
+        daemonStopSignalFailed: (pid) => `已向 pid ${pid} 送出 SIGTERM，但它沒有停止。請手動檢查：ps -p ${pid} -o pid,ppid,command=；確認後可再送 SIGTERM。不要用 SIGKILL，worker 子行程可能仍會繼續寫入。`,
         daemonStopSucceeded: (pid) => `daemon（pid ${pid}）已停止。`,
         daemonStopRestarted: (pid) => `daemon（原 pid ${pid}）停止後又恢復運行；看起來有 OS 層服務管理在重拉它。要真的停下來請用 launchctl 或 systemctl。`,
+        daemonStopApprovedCleaned: (count) => `已將 ${count} 張已核准 job 退回待核准。`,
+        daemonRestartStarted: () => "daemon 已重新啟動。",
         doctorDaemonLine: (value) => `  daemon      ${value}`,
         doctorDaemonAlive: (pid) => `運行中（pid ${pid}）`,
         doctorDaemonMissing: (reason) => `未運行（${reason}）`,
-        daemonOfflineWarning: (reason) => `⚠ worker daemon 未運行（${reason}）；job 已排入但不會執行。請先執行 dowafu serve。`,
+        daemonOfflineWarning: (reason) => `⚠ worker daemon 未運行（${reason}）；job 已排入但不會執行。請先起 dowafu serve 再核准——daemon 沒在跑時給的核准，會在它啟動時退回待核准。`,
         mcpTicketsEmpty: () => "沒有可派的 DB 工單。",
         mcpTicketsTitle: () => "可派工單：",
         mcpTicketsRow: (ticket, spokeCount) => `- ${ticket}：${spokeCount} 個 spoke`,
@@ -136,6 +143,8 @@ const MESSAGES = {
         mcpEnabledModelsTitle: () => "已啟用型號白名單：",
         mcpEnabledModelRow: (provider, model) => `  ${provider}/${model}`,
         mcpSubmitQueued: (jobId) => `已排入佇列，job id = ${jobId}，狀態 pending_approval。尚未執行，須由人在終端機核准。`,
+        mcpSubmitInvalidLang: (value, available) => `dispatch_submit 的 lang 無效：${value}（可用值：${available}）。未建立 job。`,
+        mcpPriorResultsReminder: (runs) => `提醒：這張工單已有 ${runs} 次結果；這不是錯誤，仍可照常排入佇列。`,
         mcpApproveCommand: (command) => `請在終端機執行：${command}`,
         mcpJobStarted: (at) => `開始於 ${at}`,
         mcpJobFinished: (at) => `結束於 ${at}`,
@@ -273,8 +282,8 @@ const MESSAGES = {
         observationCountCell: (display) => `觀察:${display}`,
         cannotCountObservations: () => "無法計數",
         cannotVerifySectionCell: (passFail) => `無法驗證欄:${passFail}`,
-        templatePlaceholderEntry: (placeholder, count) => `${placeholder}×${count}`,
-        templatePlaceholdersCell: (detail) => `佔位符:${detail}`,
+        templatePlaceholdersPassCell: () => "佔位符:pass",
+        templatePlaceholdersFailCell: (count) => `佔位符:fail（內容可用，但含 ${count} 處佔位符標記，交付前請清理）`,
         auditUnavailable: () => "(無法稽核)",
         summaryHeader: (ticketId) => `# dispatch summary — ${ticketId}
 
@@ -344,8 +353,10 @@ const MESSAGES = {
         doctorModelListValue: (enabled, total, mostExpensive) => `啟用 ${enabled}/${total}；最貴啟用型號 ${mostExpensive}；來源 SQLite DB`,
         doctorModelListLoadFailedValue: (reason) => `無法載入：${reason}`,
         doctorLensLine: (value) => `  lens 定義   ${value}`,
+        doctorQueueLine: (value) => `  佇列        ${value}`,
+        doctorQueueValue: (pendingApproval, approved, running) => `待核准 ${pendingApproval}；已核准 ${approved}；執行中 ${running}`,
         doctorLensFoundValue: (dirPath, total, closingCount, closingNames, noClosingSuffix) => `${dirPath} 找到 ${total} 個定義檔，其中 ${closingCount} 個具備固定收尾句：\n${" ".repeat(14)}${closingNames}${noClosingSuffix}`,
-        doctorLensNoClosingSuffix: (count, names) => `\n${" ".repeat(14)}（另 ${count} 個無收尾句：${names}）`,
+        doctorLensNoClosingSuffix: (count, names) => `\n${" ".repeat(14)}（另有 ${count} 個不是 lens：${names}）`,
         doctorLensDirMissingValue: (dirPath) => `目錄不存在：${dirPath}`,
         doctorFooter: () => "本指令不呼叫任何 API，不會花錢。缺的項目怎麼補，見 README 的〈API keys〉一節。",
     },
@@ -355,6 +366,18 @@ const MESSAGES = {
         dryRunNotice: () => "--dry-run: parsed, validated, estimated, and reported only; no API calls were made.",
         helpText: (cmd) => `Usage: ${cmd} <ticket-id> [options]
 
+Subcommands (each has its own usage message):
+  ${cmd} ticket ...        Create, import and inspect tickets
+  ${cmd} result <id>       Print the results of one dispatch (spoke output and audit table)
+  ${cmd} key               Set provider API keys (interactive menu)
+  ${cmd} providers ...     Model whitelist and enabled state
+  ${cmd} token ...         Issue, list and revoke inbound HTTP tokens
+  ${cmd} approve [jobId]   Approve a dispatch waiting in the queue
+  ${cmd} serve             Run the daemon (includes the MCP HTTP binding)
+  ${cmd} serve --stop [--yes] Stop the daemon; asks first about running or old approved jobs
+  ${cmd} serve --restart [--yes] Stop then start the daemon, running both cleanup phases
+  ${cmd} mcp               Serve MCP over stdio
+
   --lang <en|zh-tw>        Language for CLI output and spoke prompts, default en
   --repo-root <dir>        Root for the allowlist boundary and .claude/agents, default cwd
   --db <path>              SQLite ticket/result database, default DISPATCH_HOME/dowafu.db
@@ -375,18 +398,7 @@ const MESSAGES = {
   --yes                    Skip the dispatch confirmation. Aborts in non-interactive environments (stdin not a TTY) unless given
   --doctor                 Print the configuration self-check (no API call, no cost) and exit (exit 0)
   --help, -h               Print this help and exit (exit 0)
-  --version, -V            Print the version and exit (exit 0)
-
-Subcommands (each has its own usage message):
-  ${cmd} ticket ...        Create, import and inspect tickets
-  ${cmd} result <id>       Print the results of one dispatch (spoke output and audit table)
-  ${cmd} key               Set provider API keys (interactive menu)
-  ${cmd} providers ...     Model whitelist and enabled state
-  ${cmd} token ...         Issue, list and revoke inbound HTTP tokens
-  ${cmd} approve [jobId]   Approve a dispatch waiting in the queue
-  ${cmd} serve             Run the daemon (includes the MCP HTTP binding)
-  ${cmd} serve --stop [--yes] Stop the daemon; asks first if jobs are running
-  ${cmd} mcp               Serve MCP over stdio`,
+  --version, -V            Print the version and exit (exit 0)`,
         availableLangValues: () => "en, zh-tw, zh",
         availableValuesSuffix: (values) => ` (available: ${values})`,
         numberFlagInvalid: (name, value) => `--${name} requires a number, got: ${value}`,
@@ -433,7 +445,8 @@ Subcommands (each has its own usage message):
         mcpJobPrefixAmbiguous: (prefix, count) => `Prefix ${prefix} matches ${count} jobs; use the full id:`,
         jobNotApprovable: (jobId, status) => `Job ${jobId} is ${status} and cannot be approved`,
         jobApproved: (jobId) => `Approved job: ${jobId}`,
-        daemonStarted: () => "Daemon started. SIGINT exits cleanly; running jobs are reaped on the next start.",
+        daemonStarted: () => "Daemon started. SIGINT exits cleanly.",
+        daemonStartApprovedCleaned: (count) => `${count} older approved job(s) returned to pending approval before startup.`,
         daemonStartFailed: (detail) => `Could not start daemon: ${detail}`,
         daemonWorkerSpawnFailed: (detail) => `Could not start worker: ${detail}`,
         daemonWorkerExited: (exitCode) => `worker exited ${exitCode}`,
@@ -441,18 +454,23 @@ Subcommands (each has its own usage message):
         daemonWorkerTerminated: (signal) => `worker terminated by ${signal}`,
         daemonWorkerTerminatedDetail: (signal, detail) => `worker terminated by ${signal}: ${detail}`,
         stopRequiresServe: () => "--stop can only be used with serve.",
+        stopRestartConflict: () => "--stop and --restart cannot be used together.",
         daemonStopRunningWarning: (count) => `${count} job(s) are running; stopping the daemon does not stop their active spokes, which continue to completion and will still have their results and API costs recorded.`,
         daemonStopConfirmPrompt: () => "Stop the daemon? [y/N] ",
+        daemonStopApprovedWarning: (count) => `${count} approved job(s) have not started; stopping returns them to pending approval so the next daemon cannot run them without a new approval.`,
+        daemonStopApprovedConfirmPrompt: () => "Clear these approved jobs? [y/N] ",
         daemonStopCancelled: () => "Cancelled; the daemon is still running.",
         daemonStopNotRunning: (reason) => `Daemon is not running (${reason}).`,
         daemonStopPidNotDowafu: (pid) => `pid ${pid} is not a dowafu process; no signal was sent to avoid killing the wrong process.`,
-        daemonStopSignalFailed: (pid) => `A stop signal was sent to pid ${pid}, but it did not stop.`,
+        daemonStopSignalFailed: (pid) => `SIGTERM was sent to pid ${pid}, but it did not stop. Inspect it manually: ps -p ${pid} -o pid,ppid,command=; after confirming, you can send SIGTERM again. Do not use SIGKILL: worker children may still write results.`,
         daemonStopSucceeded: (pid) => `Daemon (pid ${pid}) stopped.`,
         daemonStopRestarted: (pid) => `Daemon (previous pid ${pid}) came back after stopping; an OS-level service manager appears to be restarting it. Use launchctl or systemctl to stop it permanently.`,
+        daemonStopApprovedCleaned: (count) => `${count} approved job(s) returned to pending approval.`,
+        daemonRestartStarted: () => "Daemon restarted.",
         doctorDaemonLine: (value) => `  Daemon       ${value}`,
         doctorDaemonAlive: (pid) => `running (pid ${pid})`,
         doctorDaemonMissing: (reason) => `not running (${reason})`,
-        daemonOfflineWarning: (reason) => `⚠ The worker daemon is not running (${reason}); the job is queued but will not execute. Start it with dowafu serve.`,
+        daemonOfflineWarning: (reason) => `⚠ The worker daemon is not running (${reason}); the job is queued but will not execute. Start dowafu serve before approving — approvals given while no daemon is running are returned to pending approval when it starts.`,
         mcpTicketsEmpty: () => "No dispatchable DB tickets.",
         mcpTicketsTitle: () => "Dispatchable tickets:",
         mcpTicketsRow: (ticket, spokeCount) => `- ${ticket}: ${spokeCount} spoke(s)`,
@@ -462,6 +480,8 @@ Subcommands (each has its own usage message):
         mcpEnabledModelsTitle: () => "Enabled model allowlist:",
         mcpEnabledModelRow: (provider, model) => `  ${provider}/${model}`,
         mcpSubmitQueued: (jobId) => `Job queued: ${jobId}; status pending_approval. It has not started and needs terminal approval by a human.`,
+        mcpSubmitInvalidLang: (value, available) => `dispatch_submit lang is invalid: ${value} (available values: ${available}). No job was created.`,
+        mcpPriorResultsReminder: (runs) => `Reminder: this ticket already has ${runs} result run(s). This is not an error; it can still be queued.`,
         mcpApproveCommand: (command) => `Run this in a terminal: ${command}`,
         mcpJobStarted: (at) => `Started at ${at}`,
         mcpJobFinished: (at) => `Finished at ${at}`,
@@ -606,8 +626,8 @@ Subcommands (each has its own usage message):
         observationCountCell: (display) => `Observations:${display}`,
         cannotCountObservations: () => "uncountable",
         cannotVerifySectionCell: (passFail) => `Cannot-verify section:${passFail}`,
-        templatePlaceholderEntry: (placeholder, count) => `${placeholder}×${count}`,
-        templatePlaceholdersCell: (detail) => `Template placeholders:${detail}`,
+        templatePlaceholdersPassCell: () => "Template placeholders:pass",
+        templatePlaceholdersFailCell: (count) => `Template placeholders:fail (content is usable, but contains ${count} placeholder marker(s); clean them before delivery)`,
         auditUnavailable: () => "(audit unavailable)",
         summaryHeader: (ticketId) => `# dispatch summary — ${ticketId}
 
@@ -673,8 +693,10 @@ Subcommands (each has its own usage message):
         doctorModelListValue: (enabled, total, mostExpensive) => `enabled ${enabled}/${total}; most expensive enabled ${mostExpensive}; source SQLite DB`,
         doctorModelListLoadFailedValue: (reason) => `failed to load: ${reason}`,
         doctorLensLine: (value) => `  Lens defs    ${value}`,
+        doctorQueueLine: (value) => `  Queue        ${value}`,
+        doctorQueueValue: (pendingApproval, approved, running) => `pending approval ${pendingApproval}; approved ${approved}; running ${running}`,
         doctorLensFoundValue: (dirPath, total, closingCount, closingNames, noClosingSuffix) => `${dirPath} holds ${total} definition file(s), ${closingCount} with a fixed closing line:\n${" ".repeat(15)}${closingNames}${noClosingSuffix}`,
-        doctorLensNoClosingSuffix: (count, names) => `\n${" ".repeat(15)}(${count} more without a closing line: ${names})`,
+        doctorLensNoClosingSuffix: (count, names) => `\n${" ".repeat(15)}(${count} other agent file(s), not lenses: ${names})`,
         doctorLensDirMissingValue: (dirPath) => `directory not found: ${dirPath}`,
         doctorFooter: () => 'This command calls no API and costs nothing. To fill in what is missing, see "API keys" in the README.',
     },

package/dist/output.js

@@ -23,12 +23,12 @@ function formatFinishReasonCell(r, lang) {
         return null;
     return m(lang, "finishReasonWarningCell", r.finishReason ?? "unknown");
 }
-// 工單 X1 v1.1 §二：模板佔位符若被留在回報裡，列出是哪幾個、各幾次；沒有命中維持既有
-// 風格印「無」。
+// 工單 report-format §三 B：污染標記只改稽核欄的 pass／fail 語義，絕不改 SpokeRunResult
+// （其 status 仍由執行器／job 狀態機決定）。失敗格給可操作的總命中數，細節仍在 JSON audit。
 function formatPlaceholdersCell(hits, lang) {
     if (hits.length === 0)
-        return m(lang, "noneLabel");
-    return hits.map((h) => m(lang, "templatePlaceholderEntry", h.placeholder, h.count)).join(", ");
+        return m(lang, "templatePlaceholdersPassCell");
+    return m(lang, "templatePlaceholdersFailCell", hits.reduce((total, hit) => total + hit.count, 0));
 }
 export function buildSummaryMarkdown(ticketId, results, audits, toolCallAudits, lang) {
     const rows = results.map((r) => {
@@ -54,7 +54,7 @@ export function buildSummaryMarkdown(ticketId, results, audits, toolCallAudits,
         if (a) {
             cells.push(m(lang, "closingLineCell", a.finalLinePass ? "pass" : "fail"), 
             // v1.9 §15：null（數不出來）與 0（明確為零）須可區分，不得混印
-            m(lang, "observationCountCell", a.observationCount !== null ? String(a.observationCount) : m(lang, "cannotCountObservations")), m(lang, "cannotVerifySectionCell", a.cannotVerifySectionPresent ? "pass" : "fail"), m(lang, "templatePlaceholdersCell", formatPlaceholdersCell(a.templatePlaceholdersFound, lang)));
+            m(lang, "observationCountCell", a.observationCount !== null ? String(a.observationCount) : m(lang, "cannotCountObservations")), m(lang, "cannotVerifySectionCell", a.cannotVerifySectionPresent ? "pass" : "fail"), formatPlaceholdersCell(a.templatePlaceholdersFound, lang));
         }
         const auditCell = cells.length > 0 ? cells.join(" / ") : m(lang, "auditUnavailable");
         // plan_fixes_v1.0.md §4：無價目資料須與「估出來是 $0」區分，不能印成空白或 0——

package/dist/prompt.js

@@ -8,9 +8,10 @@ import path from "node:path";
 // 結束，因為稽核靠那句話判斷回報有沒有寫完。翻譯時刻意保留祈使句與「原文是主要依據、
 // 行號是輔助」這兩處措辭：實測顯示 spoke 對句型敏感，描述句會被當成建議略過。
 const REPORT_TEMPLATE_EN = `# Observations
-1. <observation>
+1. Example: a retry after a timeout can repeat a write operation.
    Evidence: <file:line, or explicit reasoning>
    Quote: <when citing a file, copy that one line verbatim; write "reasoning" when the evidence is reasoning>
+   —— follow this shape for every observation; replace every angle-bracket marker with actual content and do not leave any behind.
    —— when citing a file, the path must match the string in "Allowed reads" character for character; do not abbreviate it or write the filename alone.
    —— **the quote is the primary evidence, the line number is secondary**: the hub locates the
      real position by matching the quote, so quote verbatim. Copy only the line you are sure
@@ -21,9 +22,10 @@ const REPORT_TEMPLATE_EN = `# Observations
 
 These are observations and questions. Whether to adopt them is for the hub and the user to decide.`;
 const REPORT_TEMPLATE = `# 觀察
-1. <觀察>
+1. 範例：逾時後的重試作業可能重複執行一次寫入。
    依據：<檔案:行號 或 明確推理>
    原文：<引用檔案時，逐字複製該處的一行原文；依據為推理時寫「推理」>
+   ——每條觀察均依此形狀撰寫；所有角括號標記都要換成實際內容，不要保留。
    ——引用檔案時，路徑須與「允許讀取」清單中的字串逐字相同，不得縮寫或只寫檔名。
    ——**原文是主要依據，行號是輔助**：hub 會用原文比對出實際位置，所以原文必須逐字，
      寧可只複製確定的那一行，也不要憑印象重寫。
@@ -32,9 +34,9 @@ const REPORT_TEMPLATE = `# 觀察
 - <需要但讀不到的檔案，或清單不足之處>；沒有則寫「無」
 
 以上為觀察與問題，採用與否由 hub 與使用者裁決。`;
-// 工單 X1 v1.1 §二：模板要求 spoke 填空，卻沒有檢查空有沒有被填——四格產物實測中過招
-// （`<觀察>` 字面留在回報裡）。清單從這裡匯出，audit.ts 不得重打一份字串，否則模板改了
-// 檢查就會跟著失效。
+// 工單 report-format §二：這是「已知污染標記」清單，不再與模板雙向同源。模板現有的尖括號
+// 標記仍須收錄（prompt.test.ts 防漏），而已移除的 <觀察>／<observation> 也必須保留：真實
+// spoke 曾把它們原樣帶進交付物。清單從這裡匯出，audit.ts 不得重打一份字串。
 export const REPORT_PLACEHOLDERS = [
     "<觀察>",
     "<檔案:行號 或 明確推理>",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "dowafu",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Send a section of your design doc to external LLMs for review. They read only the files you whitelist, and nothing is billed until you confirm.",
   "keywords": [
     "llm",
@@ -25,7 +25,7 @@
   },
   "type": "module",
   "engines": {
-    "node": ">=20"
+    "node": ">=22.13.0"
   },
   "bin": {
     "dowafu": "dist/cli.js"