evolcore 0.0.19 → 0.0.20

package/CHANGELOG.md

@@ -3,6 +3,26 @@
 本文件记录 EvolCore 的重要变更。EvolClaw 版本线的历史记录已归档至
 [`docs/_archive/CHANGELOG-evolclaw.md`](docs/_archive/CHANGELOG-evolclaw.md)。
 
+## 0.0.20 (2026-08-28)
+
+### AUN 网关与投递可靠性
+
+- 接入 SDK 网关发现结果，校验消息 ID、投递状态和显式路由，区分永久失败与可重试失败。
+- Outbox 保留永久失败诊断，并以路由条件更新避免并发投递覆盖修正后的目标。
+
+### Bootstrap 与配置生命周期
+
+- 收紧 Bootstrap 消息路由和 Agent 生命周期门禁，补充配置兼容校验及 `ec init` 的 ecagent 配置交互。
+- 增加 Agent、Daemon 和默认配置 schema 版本，权限审计记录命中的策略路径。
+
+### 观察者模式
+
+- 观察者模式默认开启，显式设置 `false` 才关闭并持久化覆盖。
+
+### 跨平台运行与安装
+
+- 统一运行时根目录解析，延长 Windows Daemon IPC 优雅关闭等待，并完善 Codex 受管目录安装准备。
+
 ## 0.0.19 (2026-08-27)
 
 ### PowerShell EC 命令安全
@@ -18,7 +38,7 @@
 ### 跨平台安装与诊断
 
 - Windows 数据迁移固定调用系统 `bsdtar`，避免 Git Bash GNU tar 误解析 Windows 绝对路径。
-- Linux 安装器幂等创建真实 `/etc/codex` 目录，拒绝同名文件和符号链接。
+- Linux 公开安装器与 npm 全局安装/升级均幂等创建真实 `/etc/codex` 目录；root 历史实例可在启动任务时自愈缺失目录，同名文件和符号链接仍被拒绝。
 - 统一数据根解析，仅使用 `EVOLCORE_HOME` 或 `~/.evolcore`，避免因启动目录不同误用数据目录。
 - `ec start` 已运行提示新增 Daemon 持续运行时长，并支持 IPC uptime 回退探测。
 

package/README.md

@@ -103,6 +103,8 @@ curl -fsSL https://download.evolai.cn/install.sh | bash
 npm install -g evolcore
 ```
 
+Linux 全局安装会在 `postinstall` 阶段准备 Codex 受管运行所需的真实目录 `/etc/codex`。如果当前 npm 全局目录属于普通用户且该系统目录尚不存在，请先执行 `sudo install -d -m 0755 /etc/codex`，再重新安装。
+
 > **Windows 用户**：首次运行前可能需要执行 `Set-ExecutionPolicy RemoteSigned -Scope CurrentUser`
 
 **从源码安装**：

package/bin/install-codex-managed-hooks.mjs

@@ -18,6 +18,59 @@ function fail(message) {
   process.exit(1);
 }
 
+function isGlobalInstall() {
+  return ['1', 'true'].includes(String(process.env.npm_config_global || '').toLowerCase());
+}
+
+function ensureRealDirectory(directory) {
+  let stat;
+  try {
+    stat = fs.lstatSync(directory);
+  } catch (error) {
+    if (error?.code !== 'ENOENT') {
+      fail(`could not inspect the Codex managed requirements mountpoint ${directory}: ${error?.message || String(error)}`);
+    }
+  }
+
+  if (stat) {
+    if (!stat.isDirectory() || stat.isSymbolicLink()) {
+      fail(`Codex managed requirements mountpoint is unsafe: ${directory} must be a real directory.`);
+    }
+    return;
+  }
+
+  try {
+    fs.mkdirSync(directory, { mode: 0o755 });
+    fs.chmodSync(directory, 0o755);
+  } catch (error) {
+    if (error?.code === 'EEXIST') {
+      const raced = fs.lstatSync(directory);
+      if (raced.isDirectory() && !raced.isSymbolicLink()) return;
+    }
+    fail(
+      `Linux global installation requires the real directory ${directory}, but it could not be created: `
+      + `${error?.message || String(error)}. `
+      + `Create it first with: sudo install -d -m 0755 ${directory}`,
+    );
+  }
+
+  const created = fs.lstatSync(directory);
+  if (!created.isDirectory() || created.isSymbolicLink()) {
+    fail(`Codex managed requirements mountpoint provisioning failed: ${directory} must be a real directory.`);
+  }
+  process.stdout.write(`[evolcore] Prepared Codex managed requirements mountpoint at ${directory}.\n`);
+}
+
+function runLinuxPostinstall() {
+  const explicitMountpoint = argument('--mountpoint');
+  if (process.platform !== 'linux') return;
+  // Local source installs do not launch the Linux Codex guard and must not
+  // mutate machine-wide configuration. An explicit path is accepted only for
+  // isolated lifecycle behavior tests.
+  if (!isGlobalInstall() && !explicitMountpoint) return;
+  ensureRealDirectory(explicitMountpoint || '/etc/codex');
+}
+
 function tomlString(value) {
   return JSON.stringify(value);
 }
@@ -139,6 +192,14 @@ try {
 }
 
 function main() {
+  if (process.env.npm_lifecycle_event === 'postinstall') {
+    runLinuxPostinstall();
+    return;
+  }
+  if (process.platform === 'linux' && argument('--mountpoint')) {
+    runLinuxPostinstall();
+    return;
+  }
   if (process.platform !== 'win32' && !argument('--requirements')) {
     fail('Codex managed hook provisioning is only supported on Windows.');
   }

package/dist/agents/claude-runner.js

@@ -2041,7 +2041,7 @@ export class AgentRunner {
                 ...(updatedInput ? { updatedInput } : {}),
             },
         });
-        const recordPreflightDenial = async (toolName, toolInput, preflight, requestId, policyCode) => {
+        const recordPreflightDenial = async (toolName, toolInput, preflight, requestId, policyCode, matchedPath) => {
             const code = policyCode ?? (preflight?.behavior === 'deny' ? preflight.policyCode : undefined);
             if (!code)
                 return;
@@ -2061,6 +2061,7 @@ export class AgentRunner {
                 selfAid: ctx?.selfAid,
                 requestId: typeof requestId === 'string' ? requestId : undefined,
                 taskId: ctx?.taskId,
+                matchedPath: matchedPath ?? (preflight?.behavior === 'deny' ? preflight.matchedPath : undefined),
             });
             try {
                 await ctx?.recordExecutionAnomaly?.({
@@ -2186,7 +2187,7 @@ export class AgentRunner {
                 };
                 const roResult = checkReadonly(toolName, toolInput, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, roResult.policyCode ?? 'readonly_mode');
+                    await recordPreflightDenial(toolName, toolInput, undefined, input.tool_use_id ?? input.toolUseID, roResult.policyCode ?? 'readonly_mode', roResult.matchedPath);
                     return hookDecision('deny', roResult.message, updatedInput);
                 }
                 return hookDecision('allow', undefined, updatedInput);
@@ -2346,7 +2347,7 @@ export class AgentRunner {
                 };
                 const roResult = checkReadonly(toolName, input, projectPath, readonlyContext);
                 if (roResult.behavior === 'deny') {
-                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, roResult.policyCode ?? 'readonly_mode');
+                    await recordPreflightDenial(toolName, input, undefined, options.toolUseID, roResult.policyCode ?? 'readonly_mode', roResult.matchedPath);
                     return { behavior: 'deny', message: roResult.message, decisionClassification: 'user_reject' };
                 }
                 return { behavior: 'allow', updatedInput: input, decisionClassification: 'user_permanent' };

package/dist/agents/codex-runner.js

@@ -2356,7 +2356,7 @@ export class CodexRunner {
         // per-session 权限模式（runQuery 写入）；缺省回落实例级 currentMode（兼容无 runQuery 上下文的调用）
         const rawMode = this.chatModes.get(sessionKey) ?? this.currentMode;
         const mode = normalizePermissionMode(rawMode).mode;
-        const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied') => {
+        const recordBlockedOperation = async (policyCode, operationInput = toolInput, denialReason = 'policy denied', matchedPath) => {
             const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
             auditToolPreflightDenial({
                 toolName,
@@ -2372,6 +2372,7 @@ export class CodexRunner {
                 selfAid: permissionContext?.selfAid,
                 requestId: typeof requestId === 'string' || typeof requestId === 'number' ? String(requestId) : undefined,
                 taskId: permissionContext?.taskId,
+                matchedPath,
             });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
@@ -2413,7 +2414,7 @@ export class CodexRunner {
             logger.warn(`[CodexRunner] tool preflight denied: session=${sessionKey} tool=${toolName} ` +
                 `policy=${preflight.policyCode ?? 'unknown'} reason=${preflight.message ?? 'policy denied'}`);
             if (preflight.policyCode) {
-                await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied');
+                await recordBlockedOperation(preflight.policyCode, toolInput, preflight.message ?? 'tool preflight denied', preflight.matchedPath);
             }
             return 'deny';
         }

package/dist/agents/ecagent-runner.js

@@ -987,7 +987,7 @@ export class EcagentRunner {
     }
     async authorizeTool(sessionId, projectPath, mode, toolName, input) {
         const permissionContext = this.permissionContexts.get(sessionId);
-        const recordBlockedOperation = async (policyCode, operationInput = input) => {
+        const recordBlockedOperation = async (policyCode, operationInput = input, matchedPath) => {
             const summary = summarizeToolInputForAudit(toolName, operationInput).slice(0, 512);
             auditToolPreflightDenial({
                 toolName,
@@ -1002,6 +1002,7 @@ export class EcagentRunner {
                 role: permissionContext?.role,
                 selfAid: permissionContext?.selfAid,
                 taskId: permissionContext?.taskId,
+                matchedPath,
             });
             try {
                 await permissionContext?.recordExecutionAnomaly?.({
@@ -1039,7 +1040,7 @@ export class EcagentRunner {
         });
         if (preflight.behavior === 'deny') {
             if (preflight.policyCode) {
-                await recordBlockedOperation(preflight.policyCode, input);
+                await recordBlockedOperation(preflight.policyCode, input, preflight.matchedPath);
             }
             return { block: true, reason: preflight.message };
         }

package/dist/aun/aid/agentmd.js

@@ -266,6 +266,13 @@ export async function agentmdSync(aid, opts) {
     const ownStore = !opts?.store;
     const localPath = agentMdPath(aid);
     try {
+        // AIDStore owns the agent.md consistency API in fastaun 0.5.x.  Keep this
+        // runtime guard because callers and test doubles can still accidentally
+        // pass an AUNClient (which deliberately does not expose these methods).
+        const candidate = store;
+        if (typeof candidate.checkAgentMd !== 'function' || typeof candidate.downloadAgentMd !== 'function') {
+            throw new TypeError('invalid AIDStore: checkAgentMd/downloadAgentMd unavailable');
+        }
         const check = await store.checkAgentMd(aid, 30);
         // In sync (cache fresh) — return local file content with cached verification status.
         if (check.ok && !check.data.needs_update && check.data.local_found) {

package/dist/aun/msg/group.js

@@ -211,12 +211,23 @@ export async function groupSend(args) {
         const encrypt = resolveAunMessageEncrypt(args.encrypt);
         const sendParams = { group_id: args.groupId, payload, encrypt };
         const result = await conn.call('group.send', sendParams);
-        const messageId = typeof result?.message?.message_id === 'string' ? result.message.message_id : undefined;
-        if (messageId)
-            appendGroupSendOutboundLog(args, messageId, payload, runtimeContext, encrypt);
+        const messageId = typeof result?.message?.message_id === 'string' && result.message.message_id.trim()
+            ? result.message.message_id
+            : typeof result?.message_id === 'string' && result.message_id.trim()
+                ? result.message_id
+                : undefined;
+        if (!messageId) {
+            return {
+                ok: false,
+                error: 'group.send returned no message_id',
+                code: 'MISSING_MESSAGE_ID',
+            };
+        }
+        appendGroupSendOutboundLog(args, messageId, payload, runtimeContext, encrypt);
         return {
             ok: true,
             group_id: result?.group_id ?? args.groupId,
+            message_id: messageId,
             message: result?.message,
             event: result?.event,
         };

package/dist/aun/msg/p2p.js

@@ -289,24 +289,34 @@ export async function msgSend(args) {
         const encrypt = resolveAunMessageEncrypt(args.encrypt);
         const sendParams = { to: args.to, payload, encrypt };
         const result = await conn.call('message.send', sendParams);
+        const messageId = typeof result?.message_id === 'string' && result.message_id.trim()
+            ? result.message_id
+            : typeof result?.message?.message_id === 'string' && result.message.message_id.trim()
+                ? result.message.message_id
+                : undefined;
+        if (!messageId) {
+            return {
+                ok: false,
+                error: 'message.send returned no message_id',
+                code: 'MISSING_MESSAGE_ID',
+            };
+        }
         // 5. 写出方向 jsonl（与 daemon 一致格式，标记 source）
         // source 标记：
         // - 'cli': 用户手动调用 ec msg send
         // - 'msg': agent 在会话中调用 ec msg send
-        if (result?.message_id) {
-            try {
-                await appendMsgSendOutboundLog(args, { ok: true, message_id: result.message_id }, {
-                    payload,
-                    runtimeContext,
-                    chatmode,
-                    encrypt,
-                });
-            }
-            catch { }
+        try {
+            await appendMsgSendOutboundLog(args, { ok: true, message_id: messageId }, {
+                payload,
+                runtimeContext,
+                chatmode,
+                encrypt,
+            });
         }
+        catch { }
         return {
             ok: true,
-            message_id: result?.message_id,
+            message_id: messageId,
             seq: result?.seq,
             timestamp: result?.timestamp,
             status: result?.status,

package/dist/aun/outbox.js

@@ -3,6 +3,7 @@ import { agentOutboxPath } from '../paths.js';
 import { atomicRead, atomicWrite } from '../utils/atomic-write.js';
 import { isDeliveryTarget, isDeliveryTargetForChannel, sameDeliveryTarget } from '../core/message/message-utils.js';
 const MAX_ENTRIES_PER_AID = 20;
+const MAX_TERMINAL_ENTRIES_PER_AID = 100;
 const DEFAULT_TTL = 300_000; // 5 minutes
 function outboxFile(aid) {
     return agentOutboxPath(aid);
@@ -13,6 +14,11 @@ function generateId() {
     return `out-${ts}-${rand}`;
 }
 function isExpired(entry) {
+    // Terminal failures are retained as durable diagnostics. They are excluded
+    // from `load()`/`hasPending()` and must not disappear merely because the
+    // original delivery TTL elapsed.
+    if (entry.terminal)
+        return false;
     if (entry.critical)
         return false;
     return Date.now() - entry.ts > entry.ttl;
@@ -41,11 +47,22 @@ function readEntries(aid) {
 }
 function writeEntries(aid, entries) {
     const file = outboxFile(aid);
-    const content = entries.length > 0
-        ? entries.map(e => JSON.stringify(e)).join('\n') + '\n'
+    const boundedEntries = trimTerminalEntries(entries);
+    const content = boundedEntries.length > 0
+        ? boundedEntries.map(e => JSON.stringify(e)).join('\n') + '\n'
         : '';
     atomicWrite(file, content);
 }
+function trimTerminalEntries(entries) {
+    const terminalEntries = entries.filter(entry => !!entry.terminal);
+    if (terminalEntries.length <= MAX_TERMINAL_ENTRIES_PER_AID)
+        return entries;
+    const retainedTerminalIds = new Set(terminalEntries
+        .sort((left, right) => (left.terminal?.at ?? left.ts) - (right.terminal?.at ?? right.ts))
+        .slice(-MAX_TERMINAL_ENTRIES_PER_AID)
+        .map(entry => entry.id));
+    return entries.filter(entry => !entry.terminal || retainedTerminalIds.has(entry.id));
+}
 export function enqueue(aid, opts) {
     const delivery = opts.delivery;
     if (!isDeliveryForChannel(delivery, opts.channelId)) {
@@ -54,6 +71,9 @@ export function enqueue(aid, opts) {
     }
     let existingEntries = readEntries(aid);
     if (opts.dedupeKey) {
+        // Terminal results are decisions for this logical operation. Reusing the
+        // same route must not silently turn a permanent rejection into a retry;
+        // an explicit route correction is the only case that replaces it.
         const existing = existingEntries.find(entry => entry.dedupeKey === opts.dedupeKey && !isExpired(entry));
         if (existing
             && existing.channelId === opts.channelId
@@ -86,10 +106,12 @@ export function enqueue(aid, opts) {
         ttl: opts.ttl ?? DEFAULT_TTL,
         postSend: opts.postSend,
     };
-    // Enforce cap: read existing, drop oldest if over limit
+    // Enforce the pending-entry cap without allowing historical terminal
+    // diagnostics to evict live messages. Terminal records are bounded
+    // separately so a permanently failing target cannot grow the file forever.
     let entries = existingEntries;
-    if (entries.filter(candidate => !candidate.critical).length >= MAX_ENTRIES_PER_AID) {
-        const dropIndex = entries.findIndex(candidate => !candidate.critical);
+    if (entries.filter(candidate => !candidate.critical && !candidate.terminal).length >= MAX_ENTRIES_PER_AID) {
+        const dropIndex = entries.findIndex(candidate => !candidate.critical && !candidate.terminal);
         if (dropIndex >= 0)
             entries.splice(dropIndex, 1);
         entries = [...entries, entry];
@@ -104,6 +126,16 @@ export function remove(aid, id) {
     const entries = readEntries(aid).filter(e => e.id !== id);
     writeEntries(aid, entries);
 }
+/** Remove an entry only if it still points at the route that was submitted. */
+export function removeIfRouteMatches(aid, submitted) {
+    const entries = readEntries(aid);
+    const index = entries.findIndex(entry => entry.id === submitted.id);
+    if (index < 0 || !hasSamePersistedRoute(entries[index], submitted))
+        return false;
+    entries.splice(index, 1);
+    writeEntries(aid, entries);
+    return true;
+}
 /** Replace an existing entry without consuming another outbox slot. */
 export function replace(aid, entry) {
     const entries = readEntries(aid);
@@ -114,6 +146,30 @@ export function replace(aid, entry) {
     writeEntries(aid, entries);
     return true;
 }
+/** Replace an entry only while its submitted route is still current. */
+export function replaceIfRouteMatches(aid, submitted, replacement) {
+    const entries = readEntries(aid);
+    const index = entries.findIndex(candidate => candidate.id === submitted.id);
+    if (index < 0)
+        return 'missing';
+    if (!hasSamePersistedRoute(entries[index], submitted))
+        return 'route-changed';
+    entries[index] = replacement;
+    writeEntries(aid, entries);
+    return 'replaced';
+}
+/** Update only the delivery receipt while preserving concurrent entry changes. */
+export function updateDeliveryReceiptIfRouteMatches(aid, submitted, receipt) {
+    const entries = readEntries(aid);
+    const index = entries.findIndex(candidate => candidate.id === submitted.id);
+    if (index < 0)
+        return 'missing';
+    if (!hasSamePersistedRoute(entries[index], submitted))
+        return 'route-changed';
+    entries[index].deliveryReceipt = receipt;
+    writeEntries(aid, entries);
+    return 'replaced';
+}
 /** Remove durable interaction cards that were cancelled before delivery. */
 export function removeInteractionCards(aid, requestId) {
     const entries = readEntries(aid);
@@ -125,10 +181,13 @@ export function removeInteractionCards(aid, requestId) {
     return removed;
 }
 export function load(aid) {
-    return readEntries(aid).filter(e => !isExpired(e));
+    return readEntries(aid).filter(e => !e.terminal && !isExpired(e));
 }
-export function findByDedupeKey(aid, dedupeKey) {
-    return load(aid).find(entry => entry.dedupeKey === dedupeKey);
+export function findByDedupeKey(aid, dedupeKey, opts = {}) {
+    const entries = opts.includeTerminal
+        ? readEntries(aid).filter(entry => !isExpired(entry))
+        : load(aid);
+    return entries.find(entry => entry.dedupeKey === dedupeKey);
 }
 export function cleanup(aid) {
     const all = readEntries(aid);
@@ -138,6 +197,19 @@ export function cleanup(aid) {
         writeEntries(aid, valid);
     return removed;
 }
+/** Mark a durable entry terminal while keeping its reason for diagnostics. */
+export function markTerminal(aid, id, failure, submitted) {
+    const entries = readEntries(aid);
+    const entry = entries.find(candidate => candidate.id === id);
+    if (!entry || (submitted && !hasSamePersistedRoute(entry, submitted)))
+        return false;
+    entry.lastError = failure.error ?? 'permanent send failure';
+    if (failure.code !== undefined)
+        entry.lastErrorCode = failure.code;
+    entry.terminal = { at: Date.now(), error: entry.lastError, ...(failure.code !== undefined ? { code: failure.code } : {}) };
+    writeEntries(aid, entries);
+    return true;
+}
 // Each caller gets its own pass over the current disk state. This prevents
 // duplicate sends while allowing a later drain trigger to pick up entries
 // enqueued during an active pass.
@@ -145,14 +217,25 @@ const activeDrainTails = new Map();
 function hasRouteForChannel(entry) {
     return isDeliveryForChannel(entry.delivery, entry.channelId);
 }
+function hasSamePersistedRoute(left, right) {
+    if (left.channelId !== right.channelId)
+        return false;
+    if (left.delivery === undefined && right.delivery === undefined)
+        return true;
+    return isDeliveryTarget(left.delivery)
+        && isDeliveryTarget(right.delivery)
+        && sameDeliveryTarget(left.delivery, right.delivery);
+}
 async function drainOnce(aid, sender) {
-    const entries = readEntries(aid);
+    const entries = readEntries(aid).filter(entry => !entry.terminal);
     if (entries.length === 0)
         return { sent: 0, expired: 0, failed: 0 };
     const drainedIds = new Set(entries.map(e => e.id));
+    const drainedById = new Map(entries.map(entry => [entry.id, entry]));
     let sent = 0;
     let expired = 0;
     let failed = 0;
+    let permanent = 0;
     const remaining = [];
     for (const entry of entries) {
         if (isExpired(entry)) {
@@ -161,20 +244,48 @@ async function drainOnce(aid, sender) {
         }
         if (!hasRouteForChannel(entry)) {
             // A route is security-sensitive metadata. An entry whose groupId does
-            // not match its address cannot be repaired from channelId, so remove it
-            // instead of retrying the same malformed send forever.
-            expired++;
+            // not match its address cannot be repaired from channelId. Keep a
+            // terminal diagnostic record instead of retrying the same malformed
+            // send forever or silently deleting evidence of the failure.
+            permanent++;
+            entry.lastError = 'outbox entry has no valid delivery route';
+            entry.lastErrorCode = 'AUN_OUTBOUND_ROUTE_REQUIRED';
+            entry.terminal = {
+                at: Date.now(),
+                error: entry.lastError,
+                code: entry.lastErrorCode,
+            };
+            remaining.push(entry);
             continue;
         }
         try {
             entry.attempts = (entry.attempts ?? 0) + 1;
-            const ok = await sender(entry);
-            if (ok) {
+            const raw = await sender(entry);
+            const result = typeof raw === 'boolean'
+                ? { status: raw ? 'sent' : 'retry' }
+                : raw;
+            if (result.status === 'sent') {
                 sent++;
             }
+            else if (result.status === 'permanent') {
+                permanent++;
+                entry.lastError = result.error ?? 'permanent send failure';
+                if (result.code !== undefined)
+                    entry.lastErrorCode = result.code;
+                entry.terminal = {
+                    at: Date.now(),
+                    error: entry.lastError,
+                    ...(result.code !== undefined ? { code: result.code } : {}),
+                };
+                // Keep a terminal record for diagnostics, but exclude it from all
+                // pending-send views so the timer cannot submit it again.
+                remaining.push(entry);
+            }
             else {
                 failed++;
-                entry.lastError = 'sender returned false';
+                entry.lastError = result.error ?? 'sender returned false';
+                if (result.code !== undefined)
+                    entry.lastErrorCode = result.code;
                 remaining.push(entry);
             }
         }
@@ -190,17 +301,31 @@ async function drainOnce(aid, sender) {
         if (!drainedIds.has(entry.id))
             return [entry];
         const failedEntry = failedById.get(entry.id);
-        if (!failedEntry)
-            return [];
+        if (!failedEntry) {
+            const submittedEntry = drainedById.get(entry.id);
+            return submittedEntry && !hasSamePersistedRoute(entry, submittedEntry)
+                ? [entry]
+                : [];
+        }
+        // A failure belongs to the route that was actually submitted. If another
+        // writer corrected that route while the RPC was in flight, preserve the
+        // corrected entry as pending instead of terminating it with a stale
+        // target's permanent error.
+        if (!hasSamePersistedRoute(entry, failedEntry))
+            return [entry];
+        if (entry.terminal && !failedEntry.terminal)
+            return [entry];
         return [{
                 ...failedEntry,
                 ...entry,
                 attempts: failedEntry.attempts,
                 lastError: failedEntry.lastError,
+                lastErrorCode: failedEntry.lastErrorCode,
+                ...(failedEntry.terminal ? { terminal: failedEntry.terminal } : {}),
             }];
     });
     writeEntries(aid, retained);
-    return { sent, expired, failed };
+    return { sent, expired, failed, ...(permanent > 0 ? { permanent } : {}) };
 }
 export async function drain(aid, sender) {
     const previous = activeDrainTails.get(aid);
@@ -220,7 +345,7 @@ export async function drain(aid, sender) {
     }
 }
 export function hasPending(aid) {
-    return readEntries(aid).some(entry => !isExpired(entry));
+    return readEntries(aid).some(entry => !entry.terminal && !isExpired(entry));
 }
 /**
  * 当前 outbox 中待发送条目数。用于诊断发送管线堵塞：depth 持续增长说明