mslxdff 0.1.159 → 0.1.161

package/src/routes/stream.js

@@ -1,8 +1,10 @@
 import { performance } from "node:perf_hooks";
 import { applyFallbackHeaders, enrichNonStreamJson, enrichSseChunkText } from "./fallback.js";
 import { json } from "./helpers.js";
-import { extractUsageFromJson, extractUsageFromSseText } from "../metrics.js";
-
+import { extractUsageFromSseText } from "../metrics.js";
+import { scanSseChunk, scanNonStreamBody, preflightMs, createTalkBucket, captureTalkFallback, isEmptyTurnDetail, holdableChunk, extractRetryAfterSec, isTrivialFrame } from "./stream-scan.js"; // 逐帧/逐体观测累加器 + 锚点偏移 + 对话正文 + 空轮判据 + 错误包络暂扣 + 可撤销前缀判据（纯函数全在 stream-scan）
+import { talkLogEnabled } from "../talk-log.js"; // 环形对话日志开关（默认开）
+import { holdEndEnabled, createRevocablePrefix, endEmptyTurnStream } from "./stream-hold.js"; // 空轮可撤销前缀 / 延后封口 / 终局收场（拆出去是为了不破 stream.js 20KB 硬门）
 // SDK 通道（TextEncoder）产出 Uint8Array，legacy 通道为 Buffer；
 // 统一转文本，避免 [DONE]/finish_reason/usage/chars 统计在 SDK 路径下静默失效。
 function chunkText(chunk) {
@@ -30,79 +32,6 @@ function hasPayload(text) {
   return false;
 }
 
-// 错误包络 chunk 判定（纯函数）：data 行 JSON 含顶层 .error 对象、或只有 finish_reason=error
-// 的空帧，且整 chunk 无任何 content/tool_calls/reasoning 输出 → 返回错误摘要（建议暂扣），
-// 否则返回 null（透传）。解析失败一律透传（默认保安全）。
-// 背景：网关把上游失败包成 HTTP 200 SSE；暂扣后下游流式 UI 不再展示瞬时错误
-//（如 Vertex 503 + google fallback 400），本轮走空转重试，客户端只看到最终结果。
-// Note: 流内错误包络捕获与 retryAfterSeconds 错误直出 — 见 .agents/notes/implemented/bug-fix/2026-09-28-retry-after-surfacing-error.md
-function extractRetryAfterSec(obj) {
-  if (!obj) return null;
-  if (typeof obj === "number") return obj;
-  if (typeof obj === "string") {
-    const m = obj.match(/"retryAfterSeconds"\s*:\s*(\d+)/i) || obj.match(/\bretryAfterSeconds\s*[:=]\s*(\d+)/i);
-    if (m) return Number(m[1]);
-    try {
-      const parsed = JSON.parse(obj);
-      return extractRetryAfterSec(parsed);
-    } catch {}
-  }
-  if (typeof obj === "object") {
-    if (Number.isFinite(obj.retryAfterSeconds)) return Number(obj.retryAfterSeconds);
-    if (obj.message) {
-      const r = extractRetryAfterSec(obj.message);
-      if (r != null) return r;
-    }
-  }
-  return null;
-}
-
-function holdableChunk(txt) {
-  if (typeof txt !== "string" || !txt.includes("data:")) return null;
-  let sawData = false;
-  let sawEventError = false;
-  let retrySec = null;
-  const errs = [];
-  for (const rawLine of txt.split("\n")) {
-    const t = rawLine.trim();
-    if (t.startsWith("event:") && t.slice(6).trim() === "error") {
-      sawEventError = true;
-      continue;
-    }
-    if (!t.startsWith("data:")) continue;
-    const d = t.slice(5).trim();
-    if (!d || d === "[DONE]") continue;
-    let j = null;
-    try { j = JSON.parse(d); } catch { return null; }
-    if (!j || typeof j !== "object") return null;
-    sawData = true;
-    const c0 = (Array.isArray(j.choices) && j.choices[0]) || {};
-    const delta = c0.delta || {};
-    const msg = c0.message || {};
-    const out = delta.content || msg.content || delta.tool_calls || msg.tool_calls || delta.reasoning || msg.reasoning;
-    if (out && !(Array.isArray(out) && out.length === 0)) return null;
-
-    const r = extractRetryAfterSec(j);
-    if (r != null) {
-      retrySec = r;
-      continue;
-    }
-    if (j.error && typeof j.error === "object") {
-      const m = j.error.message || j.error.code || "";
-      if (m) errs.push(String(m).slice(0, 300));
-    } else if (sawEventError && j.message) {
-      errs.push(String(j.message).slice(0, 300));
-    } else if (c0.finish_reason === "error") {
-      errs.push("finish_reason=error 空帧");
-    }
-  }
-  if (!sawData) return null;
-  if (retrySec != null) return `上游供应商触发 retryAfterSeconds: ${retrySec} ，请等候重试`;
-  if (errs.length) return errs.join(" | ");
-  if (sawEventError) return "event: error 空帧";
-  return null;
-}
-
 // 自持 reader 优先：for-await 会锁定 ReadableStream，使 body.cancel() 必 reject（真流上等于空操作），
 // 超时/断下游要真能掐上游必须走 reader.cancel()
 async function* bodyChunks(body, reader) {
@@ -149,28 +78,36 @@ export const MAX_STREAM_MS = (() => {
   return Number.isInteger(n) && n > 0 ? n : 0;
 })();
 
-export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort, streamTimeoutMs = STREAM_TIMEOUT_MS, keepaliveMs = KEEPALIVE_MS, fallback } = {}) {
+export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort, streamTimeoutMs = STREAM_TIMEOUT_MS, keepaliveMs = KEEPALIVE_MS, fallback, attemptStartMs } = {}) {
   const t0 = performance.now();
+  // 上报锚点偏移：只加给「上报用时长」（usage 行），闸门计时仍从上面的 t0 起算，两者不得混用
+  const preflight = preflightMs(t0, attemptStartMs);
   const contentType = upRes.headers.get("content-type") || "";
   // 需同时满足：客户端要流 + 上游真的是 SSE；避免 muse-spark 聚合 JSON 被误判为流式，或 workbuddy SSE 被聚合
   const isStream = Boolean(body?.stream) && contentType.includes("text/event-stream");
-  res.statusCode = upRes.status;
-  // propagate workbuddy uid / allowlist headers
-  try {
-    const uid = upRes.headers.get("x-mslxdff-workbuddy-uid");
-    if (uid) res.setHeader("x-mslxdff-workbuddy-uid", uid);
-    const reason = upRes.headers.get("x-mslxdff-workbuddy-reason");
-    if (reason) res.setHeader("x-mslxdff-workbuddy-reason", reason);
-    const allow = upRes.headers.get("x-mslxdff-allowlist");
-    if (allow) res.setHeader("x-mslxdff-allowlist", allow);
-    const engine = upRes.headers.get("x-mslxdff-upstream-engine");
-    if (engine) res.setHeader("x-mslxdff-upstream-engine", engine);
-  } catch {}
-  if (fallback) applyFallbackHeaders(res, fallback);
+  // 重入同一条连接（空轮留口后同模型重拉 / 换候选）时 headers 可能已 flush（前一发发过 keepalive 注释帧）：
+  // 此时 statusCode 与自定义头都不可再设，否则 setHeader 抛 ERR_HTTP_HEADERS_SENT，重拉直接炸在半路
+  if (!res.headersSent) {
+    res.statusCode = upRes.status;
+    // propagate workbuddy uid / allowlist headers
+    try {
+      const uid = upRes.headers.get("x-mslxdff-workbuddy-uid");
+      if (uid) res.setHeader("x-mslxdff-workbuddy-uid", uid);
+      const reason = upRes.headers.get("x-mslxdff-workbuddy-reason");
+      if (reason) res.setHeader("x-mslxdff-workbuddy-reason", reason);
+      const allow = upRes.headers.get("x-mslxdff-allowlist");
+      if (allow) res.setHeader("x-mslxdff-allowlist", allow);
+      const engine = upRes.headers.get("x-mslxdff-upstream-engine");
+      if (engine) res.setHeader("x-mslxdff-upstream-engine", engine);
+    } catch {}
+    if (fallback) applyFallbackHeaders(res, fallback);
+  }
 
   let ttf = null;
   let interrupted = false;
   let finishedNormally = false;
+  let commitPendingPrefix = () => {};
+  let flushHeldTail = () => {}; // 把暂扣的 [DONE] 补写出去（错误帧必须能先站在它前面）
   const detail = {
     receivedChunks: 0,
     receivedBytes: 0,
@@ -187,11 +124,14 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
     downstreamClosed: false,
     usage: null,
     chars: 0,
+    reasoningChars: 0, // 思考内容字符数（与 chars 分列，相加会重复计数）
     toolCalls: 0,
     chatShaped: false,
+    talk: talkLogEnabled() ? createTalkBucket() : null, // 环形对话日志正文桶（关闭时为 null，零开销）
     heldErrorChunks: 0,
     upstreamErrorText: null,
     recoveries: 0,
+    wrotePayload: false, // 是否已向下游写出真实数据帧（注释帧不算）：决定空转还能不能靠重试救
   };
   let prevChunkAt = t0;
   // 断下游即掐上游：流式分支装配真实取消，非流式保持 no-op
@@ -204,6 +144,8 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
     }
   };
   res.on("close", onClose);
+  // 入口即已断开/已收场：先落账，否则这一发会把留口当成「下游还活着」，重拉写给消失的读者
+  if (res.writableEnded || res.destroyed) detail.downstreamClosed = true;
 
   if (isStream) {
     // failover 重入时 headers 可能已发（前一个候选只发过 keepalive 注释帧就被掐）——已发则不可再设
@@ -224,6 +166,12 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
       let first = true;
       let wroteAny = false;
       let wrotePayload = false; // 真实数据帧（注释帧不算）：决定能否安全 failover
+      const revocableHold = holdEndEnabled(); // HOLD_END=0 时连缓冲都不做（逐字节复现旧行为，含时机）
+      // 可撤销前缀缓冲（策略见 stream-hold.js）：模型产出出现前，空 delta 帧与 [DONE] 先不入下游，
+      // 这样同模型重拉 / 换候选的正文还能顺着同一条连接送出去；上限兜底防异常形状囤内存。
+      const prefix = createRevocablePrefix(res, detail);
+      commitPendingPrefix = () => prefix.commit();
+      flushHeldTail = () => prefix.flushTail();
       let timedOut = false;
       let stalled = false;
       let tooLong = false;
@@ -289,48 +237,11 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
             if (!detail.upstreamErrorText) detail.upstreamErrorText = String(holdErr).slice(0, 500);
           }
           const isPayload = hasPayload(txt);
-          try {
-            if (txt.includes("[DONE]")) detail.sawDone = true;
-            const m = txt.match(/"finish_reason"\s*:\s*"([^"]+)"/);
-            if (m) detail.sawFinishReason = m[1];
-            // chat 形状证据：只有看得出是 chat 轮才配判空（非 chat SSE/JSON 透传是正式契约，不得误伤）
-            if (!detail.chatShaped && (txt.includes('"choices"') || txt.includes('"delta"') || txt.includes('"finish_reason"') || txt.includes('"usage"') || txt.includes('"prompt_tokens"') || txt.includes("[DONE]"))) detail.chatShaped = true;
-            // 工具调用计数（空数组不算）：tool_calls 无正文是合法 agent 轮，
-            // 空转闸门必须豁免它，否则所有工具轮都会被误判为空轮——见 relay-pipeline 4b。
-            const tc = txt.match(/"tool_calls"\s*:\s*\[\s*\{/g);
-            if (tc) detail.toolCalls = (detail.toolCalls || 0) + tc.length;
-            // 尝试提取 usage（流式末帧）：口径收口到 metrics.js，与未流式分支共用
-            if (txt.includes("\"usage\"") || txt.includes("\"prompt_tokens\"")) {
-              try {
-                const lines = txt.split("\n");
-                for (const line of lines) {
-                  const t = line.trim();
-                  if (!t.startsWith("data:")) continue;
-                  const d = t.slice(5).trim();
-                  if (d === "[DONE]" || !d) continue;
-                  // 行级隔离：单行坏 JSON 不拖累同 chunk 其余行
-                  try {
-                    const j = JSON.parse(d);
-                    if (!j || typeof j !== "object") continue;
-                    const u = extractUsageFromJson(j);
-                    if (u) detail.usage = u;
-                    // 兜底 chars：从 choices 文本长度累加
-                    const delta = j.choices?.[0]?.delta?.content || j.choices?.[0]?.message?.content || "";
-                    if (delta) detail.chars += String(delta).length;
-                  } catch { /* 单行坏帧忽略 */ }
-                }
-              } catch {}
-            } else {
-              // 非 usage 的普通 delta 也累 chars
-              try {
-                const ms = txt.match(/"content"\s*:\s*"([^"]*)"/g);
-                if (ms) for (const mm of ms) {
-                  const c = JSON.parse(`{${mm}}`);
-                  if (c.content) detail.chars += String(c.content).length;
-                }
-              } catch {}
-            }
-          } catch { /* ignore */ }
+          const prevChars = detail.chars, prevTools = detail.toolCalls, prevReason = detail.reasoningChars;
+          scanSseChunk(detail, txt);
+          // 「模型产出」＝正文/工具调用/思考三者本轮有新增。思考也算：已发出的思考撤不回，
+          // 从它出现的那刻起这次尝试就提交了（现网空轮多数正是「思考刷满、正文为零」）。
+          const gained = Number(detail.chars) > prevChars || Number(detail.toolCalls) > prevTools || Number(detail.reasoningChars) > prevReason;
           // 首块/空闲超时后上游仍吐出了真实数据 → 只是慢，不是死：撤销超时判定，照常转发
           //（cancel 是异步的，竞态窗口内已到达的数据是纯收益；丢掉是纯损失）
           // 注释帧（keepalive）不算：否则对端只要在发心跳，闸门就永远解除
@@ -362,11 +273,24 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
             } catch {}
           }
           if (!holdErr) {
-            wroteAny = true;
-            if (isPayload) wrotePayload = true;
-            detail.wroteChunks += 1;
-            detail.wroteBytes += Buffer.isBuffer(outChunk) ? outChunk.length : (outChunk?.length ?? len);
-            try { res.write(outChunk); } catch { /* 下游已断开：onClose 已掐上游 */ }
+            const size = Buffer.isBuffer(outChunk) ? outChunk.length : (outChunk?.length ?? len);
+            if (!isPayload) {
+              // 注释帧等非数据帧：与改前一致直写（客户端视作噪声，不影响可撤销性）
+              wroteAny = true;
+              prefix.writeNow(outChunk, size);
+            } else if (gained || !revocableHold || !isTrivialFrame(txt)) {
+              // 有模型产出（正文/工具/思考）、留口已关、或看不懂的异形帧：按序补写暂扣前缀 + 本帧，
+              // 这条流就此提交不可撤销（透传契约要求解析失败的帧必须原样走，绝不为救空轮扣下）
+              wroteAny = true;
+              wrotePayload = true; detail.wrotePayload = true;
+              prefix.submit(outChunk, size);
+            } else if (!prefix.hold(outChunk, size, txt.includes("[DONE]"))) {
+              // 可撤销前缀：空 delta 暂扣（判为空轮时整段撤销，留给重拉的正文）；
+              // [DONE] 无论是否已提交都进 tail 槽 —— 错误帧必须能排在它前面，否则客户端一见 [DONE] 就收尾
+              wroteAny = true;
+              wrotePayload = true; detail.wrotePayload = true;
+              prefix.submit(outChunk, size); // 暂扣超上限（异常形状）→ 被迫提交，退回旧行为
+            }
           }
           armStall();
         }
@@ -386,14 +310,14 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
       if ((timedOut || stalled || tooLong) && !wrotePayload) {
         res.removeListener("close", onClose);
         // Note: 超时是显式字段（timedOut），别再用 status 数值当信号 — 见 .agents/notes/implemented/architecture/2026-09-17-relay-timedout-explicit-and-metrics-seam.md
-        return { status: 504, timedOut: true, ttfMs: null, totalMs: Math.round(performance.now() - t0), aborted: true, interrupted: false, detail };
+        return { status: 504, timedOut: true, ttfMs: null, totalMs: Math.round(performance.now() - t0), aborted: true, interrupted: false, preflightMs: preflight, detail };
       }
       if ((stalled || tooLong) && wrotePayload) {
         interrupted = true;
         detail.exitReason = detail.exitReason || (stalled ? "stall" : "max");
-        res.removeListener("close", onClose);
+        flushHeldTail(); // 断流收场也要把 [DONE] 按序补上，别让客户端等一个不存在的终止符
         try { res.end(); } catch { /* ignore */ }
-        return { status: 200, timedOut: false, ttfMs: ttf, totalMs: Math.round(performance.now() - t0), aborted: false, interrupted, detail };
+        return { status: 200, timedOut: false, ttfMs: ttf, totalMs: Math.round(performance.now() - t0), aborted: false, interrupted, preflightMs: preflight, detail };
       }
     } else {
       detail.exitReason = "empty-body";
@@ -401,9 +325,30 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
     const totalMs = Math.round(performance.now() - t0);
     if (!detail.exitReason) detail.exitReason = "normal";
     finishedNormally = true;
-    res.removeListener("close", onClose);
-    try { res.end(); } catch { /* ignore */ }
-    return { status: 200, timedOut: false, ttfMs: ttf, totalMs, aborted: false, interrupted: false, detail };
+    // 留口期间不摘 close 监听（close 只发一次，摘了客户端窗口内断开就永久盲窗、照烧额度）
+    const heldOpen = holdEndEnabled() && detail.wrotePayload !== true && !detail.downstreamClosed && isEmptyTurnDetail(detail);
+    if (!heldOpen) res.removeListener("close", onClose);
+    let terminalForm = null;
+    if (heldOpen) {
+      detail.exitReason = "empty-turn-hold";
+    } else {
+      if (!detail.downstreamClosed) {
+        commitPendingPrefix(); // 不留口 = 补写暂扣前缀（HOLD_END=0 时逐字节复现改前行为）
+        // 思考刷满 max_tokens、正文为零（现网主流）：思考撤不回，错误帧必须排在 [DONE] 之前才看得见
+        const reasoningOnly = Number(detail.chars) === 0 && Number(detail.toolCalls) === 0 && Number(detail.reasoningChars) > 0;
+        if (reasoningOnly && holdEndEnabled()) {
+          detail.exitReason = "reasoning-only";
+          terminalForm = "sse-error-tail";
+          endEmptyTurnStream(res, `EMPTY_MODEL_RESPONSE: 只产出思考 ${detail.reasoningChars} 字、正文为零（额度被思考吃满），已重试仍无正文 — raise max_tokens or rephrase`, () => flushHeldTail());
+        } else {
+          flushHeldTail(); // 没有错误帧要插队，[DONE] 按原序发出
+          try { res.end(); } catch { /* ignore */ }
+        }
+      } else {
+        try { res.end(); } catch { /* ignore */ }
+      }
+    }
+    return { status: 200, timedOut: false, ttfMs: ttf, totalMs, aborted: false, interrupted: false, heldOpen, terminalForm, preflightMs: preflight, detail };
   }
 
   finishedNormally = true;
@@ -411,28 +356,31 @@ export async function relay(res, upRes, body, { onFirstChunk, onDownstreamAbort,
   const text = await upRes.text();
   detail.receivedBytes = Buffer.byteLength(text);
   detail.exitReason = "normal-non-stream";
-  // 非流式 usage 与 chars 提取（口径与流式分支共用 metrics.js）
+  // 非流式同样「先判后写」：此刻 headers 还没 flush，body 一写下去就再无退路。
+  let enriched = null;
   try {
     const parsed = JSON.parse(text);
-    const u = extractUsageFromJson(parsed);
-    if (u) detail.usage = u;
-    if (parsed.choices?.[0]?.message?.content) detail.chars = String(parsed.choices[0].message.content).length;
-    else if (parsed.choices?.[0]?.text) detail.chars = String(parsed.choices[0].text).length;
-    // 非流式同样只判 chat 形状：无 choices 的任意 JSON 是透传契约（chat-route 单测锁死），不得判空
-    if (Array.isArray(parsed?.choices)) detail.chatShaped = true;
-    const _tcList = parsed.choices?.[0]?.message?.tool_calls;
-    if (Array.isArray(_tcList) && _tcList.length) detail.toolCalls = _tcList.length;
-    const enriched = enrichNonStreamJson(parsed, fallback);
+    scanNonStreamBody(detail, parsed);
+    enriched = enrichNonStreamJson(parsed, fallback);
+  } catch { /* 上游给的不是可解析 JSON：走下面的原文透传 */ }
+  if (enriched === null) {
+    // 纯文本时按长度估 chars；若文本其实是 SSE（client 未要流但上游给流）仍尝试提 usage
+    try { detail.chars = text.length; } catch {}
+    try { const u = extractUsageFromSseText(text); if (u) detail.usage = u; } catch {}
+    try { if (detail.talk) captureTalkFallback(detail.talk, text); } catch {}
+  } else if (holdEndEnabled() && !detail.downstreamClosed && isEmptyTurnDetail(detail)) {
+    detail.exitReason = "empty-turn-hold";
+    return { status: upRes.status, timedOut: false, ttfMs: null, totalMs: Math.round(performance.now() - t0), aborted: false, interrupted: false, heldOpen: true, preflightMs: preflight, detail };
+  }
+  detail.wrotePayload = true; // 真写下去了：从此撤不回，也不再判空轮
+  const nsTotalMs = Math.round(performance.now() - t0);
+  if (enriched !== null) {
     json(res, upRes.status, enriched);
-  } catch {
+  } else {
     res.statusCode = upRes.status;
     res.setHeader("Content-Type", contentType || "text/plain");
     res.end(text);
-    // 纯文本时按长度估 chars；若文本其实是 SSE（client 未要流但上游给流）仍尝试提 usage
-    try { detail.chars = text.length; } catch {}
-    try { const u = extractUsageFromSseText(text); if (u) detail.usage = u; } catch {}
   }
   // 非流式 ttf 视为 total（一次性返回）
-  const totalMs = Math.round(performance.now() - t0);
-  return { status: upRes.status, timedOut: false, ttfMs: totalMs, totalMs, aborted: false, interrupted: false, detail };
+  return { status: upRes.status, timedOut: false, ttfMs: nsTotalMs, totalMs: nsTotalMs, aborted: false, interrupted: false, heldOpen: false, preflightMs: preflight, detail };
 }

package/src/runtime/lifecycle-forensics.js

@@ -0,0 +1,116 @@
+// daemon 上一次死亡的验尸官 —— 死亡证明从来不能由死者开：Windows 的关机/TerminateProcess
+// 不给被杀进程跑任何 JS 的机会，硬死在遗言层面是零痕迹的（见 crosscut 叶"四种死法"）。
+// 所以抓捕靠三方各出一块拼图：
+//   ① 杀者留牌：stopDaemon / autostart 清场等"我方所杀"在动手前写 daemon.exit-marker
+//      （带死者 pid/版本/意图）——反正 Windows 下被杀者说不出话，牌只能杀者挂；
+//   ② 活体信标：daemon 心跳同步写 daemon.alive，钉死"最后一次确证活着"的时刻（死亡窗口下界）；
+//   ③ 开机验尸：新进程在 installLifecycleLog（早于 writePid 覆盖 pid 文件）读
+//      pid/alive/marker + os.uptime() 回推本机开机时刻，纯函数分桶，结论落 errors.log。
+// 分类恒给 diedBetween（死亡窗口）与 detail（中文归因），unknown/reboot/kill 各归各桶，
+// 宁可报"不可解释的强杀"也不假装干净。全部 IO 吞异常——验尸失败绝不挡启动。
+import { mkdirSync, readFileSync, unlinkSync, writeFileSync } from "node:fs";
+import { dirname, join } from "node:path";
+import os from "node:os";
+
+const SLACK_MS = 15_000; // 时钟/顺序抖动容差：牌的 at 不早于最后心跳−slack 才算"死于本牌"
+
+export function aliveFile(dir) { return join(dir, "daemon.alive"); }
+export function markerFile(dir) { return join(dir, "daemon.exit-marker"); }
+export function pidPath(dir) { return join(dir, "daemon.pid"); }
+
+function readJsonSafe(file) {
+  try { return JSON.parse(readFileSync(file, "utf8")); } catch { return null; }
+}
+function writeJsonSafe(file, obj) {
+  try {
+    mkdirSync(dirname(file), { recursive: true });
+    writeFileSync(file, JSON.stringify(obj), { mode: 0o600 });
+    return true;
+  } catch { return false; }
+}
+
+/** 活体信标：{pid, version, at, uptimeMs, rssMb}。daemon 模式专属写（debug 前台不碰，防污染死亡窗口）。 */
+export function writeAlive(dir, info) { return writeJsonSafe(aliveFile(dir), { at: Date.now(), ...info }); }
+export function readAlive(dir) { return readJsonSafe(aliveFile(dir)); }
+
+/** 杀者牌：动手前写，必须自带死者身份（stopDaemon 随后会 unlink pid 文件）。 */
+export function writeExitMarker(dir, { reason, prevPid, prevVersion = null, byPid = process.pid, code = null, at } = {}) {
+  return writeJsonSafe(markerFile(dir), { reason, prevPid, prevVersion, byPid, code, at: at ?? Date.now() });
+}
+/** 读后即删：一张牌只许生效一代，防止下代异常死亡被旧牌误导归因。 */
+export function consumeExitMarker(dir) {
+  const m = readJsonSafe(markerFile(dir));
+  try { if (m) unlinkSync(markerFile(dir)); } catch {}
+  return m;
+}
+
+export function readPidFrom(dir) {
+  try {
+    const n = Number(String(readFileSync(pidPath(dir), "utf8")).trim().split("\n")[0]);
+    return Number.isInteger(n) && n > 0 ? n : null;
+  } catch { return null; }
+}
+export function readPidVersionFrom(dir) {
+  try {
+    const l = String(readFileSync(pidPath(dir), "utf8")).split("\n");
+    return l.length > 1 && l[1].trim() ? l[1].trim() : null;
+  } catch { return null; }
+}
+
+/** 开机时刻 = now − 整机 uptime。重启后它是硬事实，任何进程都伪造不了。 */
+export function bootTimeMs(now = Date.now()) {
+  try { return now - Math.round(os.uptime() * 1000); } catch { return null; }
+}
+
+/**
+ * 纯函数分桶（可测，不碰 fs）：
+ *  none             无前任痕迹（首装 / uninstall 清干净后）
+ *  clean-exit       死者自己跑完了 exit 钩子（Linux 信号优雅退出 / process.exit）
+ *  killed-by-cli    新鲜杀者牌：via=stop|restart|upgrade|debug-takeover|uninstall|autostart-cleanup…
+ *  reboot           无牌，但开机时刻晚于最后信标 → 整机重启带走
+ *  holder-alive     旧 pid 仍活（抢端口/接管现场）
+ *  unknown          有旧 pid 无信标（早于验尸功能的旧版本残留），死亡窗口给不出
+ *  unexplained-kill 机器没重启、无牌、信标戛然而止 → taskkill/任务管理器/硬杀
+ */
+export function classifyPrevExit({ prevPid = null, prevVersion = null, alive = null, marker = null, bootAtMs = null, now = Date.now(), selfPid = 0, prevStillRunning = false } = {}) {
+  const lastAlive = Number.isFinite(alive?.at) ? alive.at : null;
+  if (!prevPid && !alive && !marker) return { verdict: "none", detail: "无前任 daemon 痕迹" };
+  const freshMarker = marker && Number.isFinite(marker.at) && (lastAlive == null || marker.at >= lastAlive - SLACK_MS);
+  if (freshMarker && marker.reason === "process-exit") {
+    return { verdict: "clean-exit", prevPid: marker.prevPid ?? prevPid, prevVersion: marker.prevVersion ?? prevVersion, at: marker.at, diedBetween: [lastAlive, marker.at], detail: `前任进程自写遗书正常退出 (pid=${marker.prevPid ?? prevPid} exit code=${marker.code ?? "?"})` };
+  }
+  if (freshMarker) {
+    return { verdict: "killed-by-cli", via: marker.reason, prevPid: marker.prevPid ?? prevPid, prevVersion: marker.prevVersion ?? prevVersion, byPid: marker.byPid ?? null, at: marker.at, diedBetween: [lastAlive, marker.at], detail: `被 CLI/清理方 (pid=${marker.byPid ?? "?"}) 以 ${marker.reason} 名义主动杀死` };
+  }
+  if (lastAlive != null && bootAtMs != null && bootAtMs > lastAlive + SLACK_MS) {
+    return { verdict: "reboot", prevPid, prevVersion, lastAliveAt: lastAlive, bootAt: bootAtMs, diedBetween: [lastAlive, bootAtMs], detail: "死者零遗言，且本机开机时刻晚于最后心跳 → 整机重启带走（Windows 关机不跑 exit 钩子，属预期盲区，靠本桶收口）" };
+  }
+  if (prevPid && prevStillRunning && prevPid !== selfPid) {
+    return { verdict: "holder-alive", prevPid, prevVersion, detail: `旧 pid=${prevPid} 仍在世（抢端口/接管现场，本进程=${selfPid}）` };
+  }
+  if (lastAlive == null) {
+    return { verdict: "unknown", prevPid, prevVersion, detail: "有旧 pid 无活体信标（前任早于验尸功能上线），只能确认已死" };
+  }
+  return { verdict: "unexplained-kill", prevPid, prevVersion, lastAliveAt: lastAlive, diedBetween: [lastAlive, now], detail: "机器未重启、无杀者牌、信标戛然而止：taskkill/任务管理器/硬杀或断电级崩溃（exit 钩子未跑）" };
+}
+
+function defaultIsPidAlive(pid) {
+  try { process.kill(pid, 0); return true; } catch (err) { return err.code !== "ESRCH"; }
+}
+
+/** 开机验尸入口：读齐三方证据 → 收牌（读后即删）→ 分桶。collect 与 report 一起回，供调用方落日志。 */
+export function collectAutopsy({ dir, selfPid = process.pid, now = Date.now(), isPidAliveFn } = {}) {
+  const prevPid = readPidFrom(dir);
+  const alive = readAlive(dir);
+  const input = {
+    prevPid,
+    prevVersion: readPidVersionFrom(dir),
+    alive,
+    marker: consumeExitMarker(dir),
+    bootAtMs: bootTimeMs(now),
+    now,
+    selfPid,
+    prevStillRunning: !!prevPid && prevPid !== selfPid ? (isPidAliveFn ?? defaultIsPidAlive)(prevPid) : false,
+  };
+  return { input, report: classifyPrevExit(input) };
+}

package/src/runtime/lifecycle-log.js

@@ -3,8 +3,11 @@
 //   被信号杀（有 `SIGTERM received` 行）、崩溃（有 uncaughtException 行）、
 //   被 SIGKILL/任务管理器杀（只有未送达的 exit 行 → 看最后一条 heartbeat 定位死亡时刻）、
 //   OOM 积累（heartbeat 的 rss 曲线）。
+// 验尸三件套（详见 src/runtime/lifecycle-forensics.js）：daemon.alive 活体信标 + daemon.exit-marker 杀者牌 + 开机分桶 → errors.log(type=daemon-exit)。
 // 顶层异常只记录不退出（代理服务无持久状态，活着比干净退出更有价值；异常多为请求级漏网）。
 import { appendEvent } from "../logs.js";
+import { daemonDir } from "../daemon.js";
+import { collectAutopsy, writeAlive, writeExitMarker } from "./lifecycle-forensics.js";
 
 const HEARTBEAT_MS = Math.max(60_000, Number(process.env.MSLXDFF_HEARTBEAT_MS) || 30 * 60 * 1000);
 
@@ -39,25 +42,45 @@ export function installLifecycleLog({ version, bus, logs } = {}) {
   }));
   emit("lifecycle-start", { pid: process.pid, ppid: process.ppid, version, node: process.version });
 
+  // 开机验尸：上一次死亡归因（七桶），结论落 errors.log 供事后排查——必须赶在 server-lifecycle writePid 覆盖旧 pid 文件之前
+  const dir = daemonDir();
+  const isDaemon = process.env.MSLXDFF_DAEMON === "1";
+  try {
+    const { report } = collectAutopsy({ dir, selfPid: process.pid });
+    if (report.verdict !== "none") {
+      const w = report.diedBetween && report.diedBetween[0] ? ` window=${new Date(report.diedBetween[0]).toISOString()}..${report.diedBetween[1] ? new Date(report.diedBetween[1]).toISOString() : "?"}` : "";
+      log(`[lifecycle] autopsy prev-run verdict=${report.verdict}${w} ${report.detail}`);
+      try { logs?.appendError?.({ type: "daemon-exit", model: "daemon", status: 0, verdict: report.verdict, via: report.via ?? null, prevPid: report.prevPid ?? null, prevVersion: report.prevVersion ?? null, byPid: report.byPid ?? null, lastAliveAt: report.lastAliveAt ?? null, diedBetween: report.diedBetween ?? null, bootAt: report.bootAt ?? null, detail: report.detail }); } catch {}
+      emit("lifecycle-autopsy", { verdict: report.verdict, via: report.via ?? null, prevPid: report.prevPid ?? null });
+    }
+  } catch {}
+  // 活体信标：启动即写一条，死亡窗口下界不必等 30min 心跳
+  if (isDaemon) { try { writeAlive(dir, { pid: process.pid, version, uptimeMs: 0, rssMb: rssMb() }); } catch {} }
+
   process.on("uncaughtException", (e) => {
     const detail = String(e?.stack || e?.message || e).slice(0, 2000);
     log(`[lifecycle] uncaughtException (kept running): ${detail}`);
     emit("lifecycle-uncaught", { detail: detail.slice(0, 500) });
+    try { logs?.appendError?.({ type: "daemon-uncaught", model: "daemon", status: 0, message: `uncaughtException (kept running): ${detail.slice(0, 400)}` }); } catch {}
   });
   process.on("unhandledRejection", (r) => {
     const detail = String(r?.stack || r?.message || r).slice(0, 2000);
     log(`[lifecycle] unhandledRejection (kept running): ${detail}`);
     emit("lifecycle-unhandled-rejection", { detail: detail.slice(0, 500) });
+    try { logs?.appendError?.({ type: "daemon-unhandled", model: "daemon", status: 0, message: `unhandledRejection (kept running): ${detail.slice(0, 400)}` }); } catch {}
   });
   process.on("exit", (code) => {
     const uptimeSec = Math.round((Date.now() - t0) / 1000);
     log(`[lifecycle] exit code=${code} uptime=${uptimeSec}s rss=${rssMb()}mb`);
+    // 遗书：exit 钩子跑得动 = 非硬杀（Linux 信号善终 / process.exit）；Windows 强杀场景永远看不到这行，缺它本身就是证据
+    try { writeExitMarker(dir, { reason: "process-exit", prevPid: process.pid, prevVersion: version, byPid: process.pid, code }); } catch {}
   });
   process.on("SIGHUP", () => log(`[lifecycle] SIGHUP received (ignored, pid ${process.pid})`));
 
   const hb = setInterval(() => {
     // 心跳只落 daemon.log（不写 events.log：48 条/天，避免污染结构化事件流）
     log(lifecycleHeartbeatLine({ pid: process.pid, uptimeMin: Math.round((Date.now() - t0) / 60000), rssMb: rssMb() }));
+    if (isDaemon) { try { writeAlive(dir, { pid: process.pid, version, uptimeMs: Date.now() - t0, rssMb: rssMb() }); } catch {} }
   }, HEARTBEAT_MS);
   hb.unref?.();
   return { heartbeatMs: HEARTBEAT_MS };

package/src/runtime/provider-gate.js

@@ -4,7 +4,7 @@
 // Note: auth 号型不要求 baseUrl 是硬约束（旧门禁 baseUrl&&keys 曾静默跳过整家 qoder）— 见 .agents/notes/implemented/bug-fix/2026-09-21-auth-doc-provider-gate.md
 
 /** 凭证在 auth 目录、无需 baseUrl 的「auth 号型」定制供应商（端点由各自 constants 决定）。 */
-export const AUTH_DOC_PROVIDER_IDS = ["workbuddy", "traework", "qoder", "qwenwork"];
+export const AUTH_DOC_PROVIDER_IDS = ["workbuddy", "traework", "qoder", "qwenwork", "globalqwenwork"];
 
 /**
  * - auth 号型：keys 或 auths 或 auth 目录有号 → 启用（baseUrl 可空）
@@ -24,8 +24,9 @@ export async function loadAuthDocs(gid) {
         ? await import("../providers/traework/account-store.js")
         : gid === "qwenwork"
           ? await import("../providers/qwenwork/account-store.js")
-          : await import("../providers/qoder/account-store.js");
-    return store.listAccountDocs();
+          : gid === "globalqwenwork"
+            ? await import("../providers/globalqwenwork/account-store.js")
+            : await import("../providers/qoder/account-store.js");
     return store.listAccountDocs();
   } catch {
     return [];