pixivflow 2.20.2 → 2.20.4

package/dist/commands/scheduler-runtime.d.ts

@@ -111,6 +111,14 @@ export interface SchedulerRuntime {
     close(): void;
 }
 export declare function notifyScheduleFailure(config: StandaloneConfig, database: Database, schedule: ScheduleConfig, failure: JobFailure): Promise<void>;
+/**
+ * Expanded, still-bounded candidate scan bound for one fallback stage
+ * (§schedule-recovery). Stage 0 is the primary pass; stage N scans
+ * `base * (N + 1)` candidates, hard-capped so a fallback can never become an
+ * unbounded scan of the whole tag. `undefined` (no declared bound) stays
+ * `undefined`: the handler's own default applies, not a fabricated number.
+ */
+export declare function fallbackScanLimit(base: number | undefined, stage: number): number | undefined;
 export declare function createSchedulerRuntime(configPathArg?: string): Promise<SchedulerRuntime>;
 /**
  * Watchdog for a single plan run (used by `run-once`; the daemon's cron runs

package/dist/commands/scheduler-runtime.js

@@ -45,6 +45,7 @@ exports.EXECUTION_MODES = void 0;
 exports.withDeliveryMode = withDeliveryMode;
 exports.shouldTerminaliseAbortedSlot = shouldTerminaliseAbortedSlot;
 exports.notifyScheduleFailure = notifyScheduleFailure;
+exports.fallbackScanLimit = fallbackScanLimit;
 exports.createSchedulerRuntime = createSchedulerRuntime;
 exports.runWithTimeout = runWithTimeout;
 const config_1 = require("../config");
@@ -199,6 +200,16 @@ function buildProxyUrl(network) {
     const auth = proxy.username ? `${proxy.username}:${proxy.password ?? ''}@` : '';
     return `${protocol}://${auth}${proxy.host}:${proxy.port}`;
 }
+/**
+ * Expanded, still-bounded candidate scan bound for one fallback stage
+ * (§schedule-recovery). Stage 0 is the primary pass; stage N scans
+ * `base * (N + 1)` candidates, hard-capped so a fallback can never become an
+ * unbounded scan of the whole tag. `undefined` (no declared bound) stays
+ * `undefined`: the handler's own default applies, not a fabricated number.
+ */
+function fallbackScanLimit(base, stage) {
+    return base === undefined ? undefined : Math.min(Math.max(base, 1) * (stage + 1), 100);
+}
 async function createSchedulerRuntime(configPathArg) {
     logger_1.logger.info('PixivFlow runtime starting', { component: 'pixivflow', version: version_1.BUILD.version, commit: version_1.BUILD.commit });
     // Keep TODAY/YESTERDAY placeholders intact. They are resolved afresh for
@@ -241,6 +252,7 @@ async function createSchedulerRuntime(configPathArg) {
     const deliveryDispatcher = new DeliveryDispatcher_1.DeliveryDispatcher(config.delivery, buildProxyUrl(config.network));
     const notificationPolicy = new NotificationPolicy_1.NotificationPolicy(database, config);
     const outboxWorker = new OutboxWorker_1.OutboxWorker(database, deliveryDispatcher, {
+        beforeDrain: () => notificationPolicy.reconcileScheduleSummaries(),
         retryBaseMs: config.delivery?.outboxRetryBaseMs,
         retryMaxMs: config.delivery?.outboxRetryMaxMs,
         // A confirmed ACK settles the owning Slot cell (submitted / duplicate /
@@ -445,21 +457,54 @@ async function createSchedulerRuntime(configPathArg) {
                 targets: runTargets.map((t) => t.id),
             });
         }
-        const downloadManager = new DownloadManager_1.DownloadManager(scopedConfig, pixivClient, database, fileService);
-        if (targetExecutionContexts)
-            downloadManager.setTargetExecutionContexts(targetExecutionContexts);
-        if (options.excludedWorkIds)
-            downloadManager.setProcessedWorkIds(options.excludedWorkIds);
-        activeDownloadManager = downloadManager;
-        await downloadManager.initialise();
         const scheduleSlot = slotCtx; // stable for callbacks; null for ad-hoc runs
+        // Bounded candidate fallback budget (§schedule-recovery): a missing required
+        // target must exhaust its recovery stages before the occurrence may roll up
+        // as a degraded (partial) terminal result.
+        const maxFallbackStages = Math.max(0, Math.min(10, Number(runtimeConfig.download?.maxFallbackStages ?? 3)));
+        const boostScanLimit = fallbackScanLimit;
+        const boostedTargets = (list) => list.map((t) => {
+            const stage = scheduleSlot && t.id ? coordinator.cellFallbackStage(scheduleSlot.slotId, t.id) : 0;
+            return stage === 0 ? t : {
+                ...t,
+                candidateScanLimit: boostScanLimit(t.candidateScanLimit ?? runtimeConfig.download?.candidateScanLimit, stage),
+            };
+        });
+        const buildManager = (list) => {
+            const scoped = {
+                ...runtimeConfig,
+                targets: withDeliveryMode(list.map((t) => ({
+                    ...t,
+                    delivery: t.delivery
+                        ? { ...t.delivery, slotContext: slotCtx ?? undefined, executionContext }
+                        : t.delivery,
+                })), options.deliveryMode),
+            };
+            const manager = new DownloadManager_1.DownloadManager(scoped, pixivClient, database, fileService);
+            if (targetExecutionContexts)
+                manager.setTargetExecutionContexts(targetExecutionContexts);
+            if (options.excludedWorkIds)
+                manager.setProcessedWorkIds(options.excludedWorkIds);
+            manager.setTargetOutcomeHook(outcomeHook);
+            if (scheduleSlot) {
+                manager.slotContext = {
+                    slotId: scheduleSlot.slotId,
+                    scheduleId: scheduleSlot.scheduleId,
+                    occurrenceAtIso: new Date(scheduleSlot.occurrenceAt).toISOString(),
+                    triggerSource: scheduleSlot.triggerSource,
+                    slotName: scheduleSlot.slotName,
+                    slotDate: scheduleSlot.slotDate,
+                };
+            }
+            return manager;
+        };
         // TYPED outcome -> explicit FSM transition. No message regex, no
         // "no throw => submitted". Only a confirmed ACK yields 'submitted'.
         //
         // Registered for EVERY run, not just scheduled ones: the batch runner
         // (execute-slot) runs without a Slot and still has to report a
         // machine-readable per-target result to its caller.
-        downloadManager.setTargetOutcomeHook((target, outcome) => {
+        const outcomeHook = (target, outcome) => {
             if (!target.id)
                 return;
             options.onTargetOutcome?.(target.id, outcome);
@@ -467,6 +512,21 @@ async function createSchedulerRuntime(configPathArg) {
                 // No durable slot (run-once CLI): nothing to converge or report.
                 return;
             }
+            // A scheduled (non-manual) target with nothing to submit advances to its
+            // next bounded fallback stage instead of terminalising: the cell returns
+            // to `pending` and the next pass re-selects it with expanded scan bounds.
+            // The FINAL stage (stage == maxFallbackStages - 1) does NOT advance: its
+            // real terminal outcome (no_candidate / duplicate / failed) is applied, so
+            // an exhausted occurrence reports the true cause — never a generic
+            // "target did not complete".
+            if (!scheduleSlot.manualRequestId &&
+                (outcome.kind === 'no_candidate' || outcome.kind === 'duplicate') &&
+                coordinator.cellFallbackStage(scheduleSlot.slotId, target.id) < maxFallbackStages - 1) {
+                coordinator.advanceFallback(scheduleSlot.slotId, target.id, outcome.kind === 'duplicate'
+                    ? `duplicate candidates (stage ${coordinator.cellFallbackStage(scheduleSlot.slotId, target.id)})`
+                    : outcome.reason ?? 'no eligible candidate', maxFallbackStages);
+                return;
+            }
             coordinator.applyOutcome(scheduleSlot.slotId, target.id, outcome);
             notificationPolicy.noteOutcome(scheduleSlot.slotId, scheduleSlot, schedule, target, outcome);
             if (scheduleSlot.manualRequestId && (outcome.kind === 'no_candidate' || outcome.kind === 'duplicate' ||
@@ -475,17 +535,10 @@ async function createSchedulerRuntime(configPathArg) {
                 // fallback for retry exhaustion, timeout, and outbox dead-letter.
                 notificationPolicy.noteRefetchOutcome(scheduleSlot, schedule, target, scheduleSlot.manualRequestId, outcome);
             }
-        });
-        if (scheduleSlot) {
-            downloadManager.slotContext = {
-                slotId: scheduleSlot.slotId,
-                scheduleId: scheduleSlot.scheduleId,
-                occurrenceAtIso: new Date(scheduleSlot.occurrenceAt).toISOString(),
-                triggerSource: scheduleSlot.triggerSource,
-                slotName: scheduleSlot.slotName,
-                slotDate: scheduleSlot.slotDate,
-            };
-        }
+        };
+        let downloadManager = buildManager(boostedTargets(runTargets));
+        activeDownloadManager = downloadManager;
+        await downloadManager.initialise();
         // Apply initial delay if configured
         if (runtimeConfig.initialDelay && runtimeConfig.initialDelay > 0) {
             logger_1.logger.info(`Waiting ${runtimeConfig.initialDelay}ms before starting download...`, {
@@ -507,7 +560,25 @@ async function createSchedulerRuntime(configPathArg) {
         if (slotCtx && varReleaseLease)
             releaseLease = varReleaseLease;
         try {
-            await downloadManager.runAllTargets();
+            // Candidate fallback passes (§schedule-recovery): after each pass, cells
+            // still mid-fallback (advanced stages) are re-selected with expanded,
+            // still-bounded scan limits. Successful sibling cells are NEVER re-run:
+            // pendingTargets only returns unconverged cells of this slot.
+            for (let pass = 0;; pass += 1) {
+                await downloadManager.runAllTargets();
+                if (!slotCtx || pass >= maxFallbackStages - 1)
+                    break;
+                const pendingFallback = coordinator
+                    .pendingTargets(slotCtx.slotId, targets)
+                    .filter((p) => p.cell &&
+                    p.cell.fallback_stage > 0 &&
+                    p.cell.fallback_stage < maxFallbackStages);
+                if (pendingFallback.length === 0)
+                    break;
+                downloadManager = buildManager(boostedTargets(pendingFallback.map((p) => p.target)));
+                activeDownloadManager = downloadManager;
+                await downloadManager.initialise();
+            }
         }
         catch (error) {
             if (!slotCtx || !(error instanceof Error) || !/^All \d+ target\(s\) failed\./.test(error.message)) {
@@ -550,17 +621,22 @@ async function createSchedulerRuntime(configPathArg) {
             for (const target of targets)
                 if (target.id)
                     notificationPolicy.noteTerminalRefetchCell(slotCtx.slotId, target.id);
-            notificationPolicy.sendSlotSummary(slotCtx, schedule, summary.cells.map((c) => {
-                const t = targets.find((x) => x.id === c.targetId);
-                return {
-                    targetId: c.targetId,
-                    label: c.targetId,
-                    workType: t?.type ?? 'unknown',
-                    status: c.status,
-                    workId: c.workId,
-                    error: c.error ?? null,
-                };
-            }));
+            // Terminal summaries are for SCHEDULED occurrences (P0-B). Remote manual
+            // replacements already report through their own verdict channel
+            // (refetchOutcomeUrl); a schedule summary would double-notify the group.
+            if (!slotCtx.manualRequestId) {
+                notificationPolicy.sendSlotSummary(slotCtx, schedule, summary.cells.map((c) => {
+                    const t = targets.find((x) => x.id === c.targetId);
+                    return {
+                        targetId: c.targetId,
+                        label: c.targetId,
+                        workType: t?.type ?? 'unknown',
+                        status: c.status,
+                        workId: c.workId,
+                        error: c.error ?? null,
+                    };
+                }));
+            }
             releaseLease();
         }
         if (!slotCtx && allTargetsFailed)

package/dist/config/types.d.ts

@@ -524,6 +524,12 @@ export interface HttpMultipartDeliveryConfig {
      * `headers` for auth, so no extra credential is needed.
      */
     refetchOutcomeUrl?: string;
+    /**
+     * Optional JSON endpoint for TERMINAL SCHEDULE occurrence summaries
+     * (success/partial/failed) — delivered by the durable outbox to TelePost,
+     * which relays a user/operator-visible message. Reuses `headers` for auth.
+     */
+    scheduleOutcomeUrl?: string;
     method?: 'POST' | 'PUT';
     /** 支持 ${ENV_NAME} 环境变量插值 */
     headers?: Record<string, string>;
@@ -683,6 +689,12 @@ export interface StandaloneConfig {
          * Default: 5 (clamped to 1..100)
          */
         candidateScanLimit?: number;
+        /**
+         * Bounded candidate-fallback budget for SCHEDULED occurrences
+         * (§schedule-recovery). 0 disables fallback (no_candidate/duplicate
+         * terminalises immediately). Default: 3.
+         */
+        maxFallbackStages?: number;
     };
 }
 //# sourceMappingURL=types.d.ts.map

package/dist/config/validation.js

@@ -312,6 +312,16 @@ function validateConfig(config, location, databasePath) {
                     errors.push(`${prefix}.refetchOutcomeUrl: Must be a valid HTTP or HTTPS URL`);
                 }
             }
+            if (delivery.scheduleOutcomeUrl && !/\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(delivery.scheduleOutcomeUrl)) {
+                try {
+                    const url = new URL(delivery.scheduleOutcomeUrl);
+                    if (!['http:', 'https:'].includes(url.protocol))
+                        throw new Error('unsupported protocol');
+                }
+                catch {
+                    errors.push(`${prefix}.scheduleOutcomeUrl: Must be a valid HTTP or HTTPS URL`);
+                }
+            }
             if (delivery.readinessUrl && !/\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(delivery.readinessUrl)) {
                 try {
                     const url = new URL(delivery.readinessUrl);

package/dist/delivery/DeliveryDispatcher.js

@@ -53,8 +53,13 @@ class DeliveryDispatcher {
         if (target.type !== 'httpMultipart') {
             throw new errors_1.ConfigError(`Unsupported delivery target type: ${target.type}`);
         }
-        if (!(request.refetchOutcome ? target.refetchOutcomeUrl : target.notificationUrl)?.trim()) {
-            throw new errors_1.ConfigError(`Delivery target does not configure ${request.refetchOutcome ? 'refetchOutcomeUrl' : 'notificationUrl'}: ${name}`);
+        const urlKey = request.refetchOutcome
+            ? 'refetchOutcomeUrl'
+            : request.scheduleOutcome
+                ? 'scheduleOutcomeUrl'
+                : 'notificationUrl';
+        if (!target[urlKey]?.trim()) {
+            throw new errors_1.ConfigError(`Delivery target does not configure ${urlKey}: ${name}`);
         }
         return new HttpMultipartDelivery_1.HttpMultipartDelivery(target, this.proxyUrl).notifyOnce(request);
     }

package/dist/delivery/DeliveryService.d.ts

@@ -39,6 +39,19 @@ export interface RefetchOutcomePayload {
         unavailable: number;
     };
 }
+/** Terminal SCHEDULE occurrence verdict (success/partial/failed), reported via
+ * the durable outbox to TelePost, which relays the user-visible summary. */
+export interface ScheduleOutcomePayload {
+    scheduleId: string;
+    slotId: string;
+    status: 'success' | 'partial' | 'failed';
+    targets?: Array<{
+        targetId: string;
+        workType: string;
+        status: string;
+        workId?: string | null;
+    }>;
+}
 export declare class DeliveryService {
     private readonly database;
     constructor(database: Database);
@@ -96,7 +109,7 @@ export declare class DeliveryService {
         created: boolean;
     };
     /** Enqueue a durable notification (retried independently; never affects content). */
-    enqueueNotification(deliveryTarget: string, text: string, idempotencyKey: string, refetchOutcome?: RefetchOutcomePayload): void;
+    enqueueNotification(deliveryTarget: string, text: string, idempotencyKey: string, refetchOutcome?: RefetchOutcomePayload, scheduleOutcome?: ScheduleOutcomePayload): void;
     private guardCell;
     private contextFrom;
 }

package/dist/delivery/DeliveryService.js

@@ -175,12 +175,16 @@ class DeliveryService {
         return { deliveryId: row.id, created };
     }
     /** Enqueue a durable notification (retried independently; never affects content). */
-    enqueueNotification(deliveryTarget, text, idempotencyKey, refetchOutcome) {
+    enqueueNotification(deliveryTarget, text, idempotencyKey, refetchOutcome, scheduleOutcome) {
         this.database.outbox.enqueue({
             kind: 'notification',
             deliveryTarget,
             idempotencyKey,
-            payload: refetchOutcome ? { text, refetchOutcome } : { text },
+            payload: refetchOutcome
+                ? { text, refetchOutcome }
+                : scheduleOutcome
+                    ? { text, scheduleOutcome }
+                    : { text },
         });
     }
     guardCell(slotId, targetId, next) {

package/dist/delivery/HttpMultipartDelivery.js

@@ -134,18 +134,23 @@ class HttpMultipartDelivery {
     /** Single notification attempt; the outbox owns retries. */
     async notifyOnce(request) {
         const outcome = request.refetchOutcome;
-        const url = (outcome ? this.config.refetchOutcomeUrl?.trim() : this.config.notificationUrl?.trim());
+        const scheduleOutcome = request.scheduleOutcome;
+        const url = (outcome ? this.config.refetchOutcomeUrl?.trim()
+            : scheduleOutcome ? this.config.scheduleOutcomeUrl?.trim()
+                : this.config.notificationUrl?.trim());
         if (!url) {
             throw new Error(outcome
                 ? 'HTTP delivery refetchOutcomeUrl is not configured'
-                : 'HTTP delivery notificationUrl is not configured');
+                : scheduleOutcome
+                    ? 'HTTP delivery scheduleOutcomeUrl is not configured'
+                    : 'HTTP delivery notificationUrl is not configured');
         }
         const headers = {
             ...this.resolveHeaders(this.config.headers ?? {}),
             'Content-Type': 'application/json',
         };
-        // Refetch verdicts are machine-readable JSON (the requester's review state
-        // machine consumes disposition, not prose). Plain notifications remain
+        // Refetch verdicts and schedule outcomes are machine-readable JSON for
+        // TelePost's state machines/relays. Plain notifications remain
         // {text, idempotency_key}.
         const body = outcome
             ? {
@@ -156,7 +161,19 @@ class HttpMultipartDelivery {
                 scanned: outcome.scanned,
                 skipped: outcome.skipped,
             }
-            : { text: request.text, idempotency_key: request.idempotencyKey };
+            : scheduleOutcome
+                ? {
+                    schedule_id: scheduleOutcome.scheduleId,
+                    slot_id: scheduleOutcome.slotId,
+                    status: scheduleOutcome.status,
+                    targets: (scheduleOutcome.targets ?? []).map((t) => ({
+                        target_id: t.targetId,
+                        work_type: t.workType,
+                        status: t.status,
+                        work_id: t.workId ?? null,
+                    })),
+                }
+                : { text: request.text, idempotency_key: request.idempotencyKey };
         const options = {
             method: 'POST',
             headers,

package/dist/delivery/OutboxWorker.d.ts

@@ -3,6 +3,8 @@ import { OutboxRow } from '../storage/repositories/OutboxRepository';
 import { DeliveryDispatcher } from './DeliveryDispatcher';
 import { DeliveryAck } from './DeliveryAck';
 export interface OutboxWorkerOptions {
+    /** Reconcile durable notification intents before consuming due rows. */
+    beforeDrain?: () => void;
     /** How often to scan for due rows. */
     pollIntervalMs?: number;
     /** Row lease duration while one attempt is in flight. */
@@ -31,6 +33,8 @@ export interface NotificationPayload {
     text: string;
     /** Optional structured remote-manual-replacement verdict (refetch outcome). */
     refetchOutcome?: unknown;
+    /** Optional structured terminal SCHEDULE occurrence verdict. */
+    scheduleOutcome?: unknown;
 }
 /** Exponential backoff with jitter, capped. */
 export declare function backoffDelayMs(attempt: number, base: number, max: number): number;
@@ -43,6 +47,7 @@ export declare function backoffDelayMs(attempt: number, base: number, max: numbe
 export declare class OutboxWorker {
     private readonly database;
     private readonly dispatcher;
+    private readonly options;
     private timer;
     private running;
     private stopped;

package/dist/delivery/OutboxWorker.js

@@ -23,6 +23,7 @@ function backoffDelayMs(attempt, base, max) {
 class OutboxWorker {
     database;
     dispatcher;
+    options;
     timer = null;
     running = false;
     stopped = false;
@@ -37,6 +38,7 @@ class OutboxWorker {
     constructor(database, dispatcher, options = {}) {
         this.database = database;
         this.dispatcher = dispatcher;
+        this.options = options;
         this.pollIntervalMs = options.pollIntervalMs ?? 10_000;
         this.leaseMs = options.leaseMs ?? 120_000;
         this.batchSize = options.batchSize ?? 4;
@@ -73,6 +75,7 @@ class OutboxWorker {
         let retried = 0;
         let dead = 0;
         for (let round = 0; round < maxRounds; round++) {
+            this.options.beforeDrain?.();
             const rows = this.database.outbox.claimDue(this.owner, this.leaseMs, this.batchSize);
             if (rows.length === 0)
                 break;
@@ -104,6 +107,7 @@ class OutboxWorker {
             return;
         this.running = true;
         try {
+            this.options.beforeDrain?.();
             const rows = this.database.outbox.claimDue(this.owner, this.leaseMs, this.batchSize);
             for (const row of rows) {
                 if (this.stopped) {
@@ -214,6 +218,9 @@ class OutboxWorker {
                     refetchOutcome: payload.refetchOutcome !== undefined
                         ? payload.refetchOutcome
                         : undefined,
+                    scheduleOutcome: payload.scheduleOutcome !== undefined
+                        ? payload.scheduleOutcome
+                        : undefined,
                 });
             }
             else {

package/dist/delivery/types.d.ts

@@ -113,6 +113,22 @@ export interface DeliveryNotificationRequest {
             unavailable: number;
         };
     };
+    /**
+     * Structured terminal schedule verdict for a SCHEDULED occurrence. When
+     * present the delivery posts JSON to `scheduleOutcomeUrl` instead of
+     * `notificationUrl` (auth reuses `headers`).
+     */
+    scheduleOutcome?: {
+        scheduleId: string;
+        slotId: string;
+        status: 'success' | 'partial' | 'failed';
+        targets?: Array<{
+            targetId: string;
+            workType: string;
+            status: string;
+            workId?: string | null;
+        }>;
+    };
 }
 export interface DeliveryProvider {
     deliver(request: DeliveryRequest): Promise<DeliveryResult>;

package/dist/notification/NotificationPolicy.d.ts

@@ -45,6 +45,14 @@ export declare class NotificationPolicy {
         workId: string | null;
         error: string | null;
     }>): void;
+    /**
+     * Delivery targets whose HTTP target declares the given outcome URL.
+     * Schedule summaries require `scheduleOutcomeUrl`; manual refetch outcomes
+     * use `refetchOutcomeUrl`; generic notifications use `notificationUrl`.
+     */
+    private targetsWithUrl;
+    /** The durable cells remain the notification intent across crashes and late ACKs. */
+    reconcileScheduleSummaries(): void;
     private send;
     /**
      * Report the terminal verdict of a REMOTE MANUAL replacement ("重抓") back to

package/dist/notification/NotificationPolicy.js

@@ -2,6 +2,7 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.NotificationPolicy = void 0;
 const DeliveryService_1 = require("../delivery/DeliveryService");
+const SlotCoordinator_1 = require("../scheduler/SlotCoordinator");
 const logger_1 = require("../logger");
 /**
  * Central policy for all operational notifications. Handlers/scheduler do not
@@ -76,8 +77,11 @@ class NotificationPolicy {
     }
     /** One consolidated summary per slot, delivered to every notifying target's endpoint. */
     sendSlotSummary(slot, schedule, rows) {
-        const notifiable = this.notifiableTargets();
-        if (notifiable.size === 0 || rows.length === 0)
+        if (slot.manualRequestId || rows.length === 0 || rows.some((r) => !['submitted', 'no_candidate', 'duplicate', 'failed'].includes(r.status)))
+            return;
+        const memberIds = new Set(rows.map((r) => r.targetId));
+        const targets = this.targetsWithUrl('scheduleOutcomeUrl', memberIds);
+        if (targets.size === 0)
             return;
         const icon = (s) => s === 'submitted' ? '✅' : s === 'no_candidate' ? '⚠️' : s === 'duplicate' ? '♱' : s === 'delivery_pending' ? '🕓' : '❌';
         const lines = rows.map((r) => `${icon(r.status)} ${r.label}（${r.workType === 'novel' ? '小说' : '插画'}）` +
@@ -91,9 +95,60 @@ class NotificationPolicy {
             ...lines,
             `结果：${submitted === rows.length ? 'success' : submitted > 0 ? 'partial' : 'failed'}（${submitted}/${rows.length} 已确认投递）`,
         ].join('\n');
+        const outcomeStatus = submitted === rows.length ? 'success' : submitted > 0 ? 'partial' : 'failed';
         const service = new DeliveryService_1.DeliveryService(this.database);
-        for (const name of notifiable) {
-            service.enqueueNotification(name, text, NotificationPolicy.keys.summary(slot.slotId));
+        for (const [index, name] of [...targets].entries()) {
+            service.enqueueNotification(name, text, NotificationPolicy.keys.summary(slot.slotId) + (index === 0 ? '' : `:${name}`), undefined, {
+                scheduleId: schedule.id,
+                slotId: slot.slotId,
+                status: outcomeStatus,
+                targets: rows.map((r) => ({
+                    targetId: r.targetId,
+                    workType: r.workType,
+                    status: r.status,
+                    workId: r.workId,
+                })),
+            });
+        }
+    }
+    /**
+     * Delivery targets whose HTTP target declares the given outcome URL.
+     * Schedule summaries require `scheduleOutcomeUrl`; manual refetch outcomes
+     * use `refetchOutcomeUrl`; generic notifications use `notificationUrl`.
+     */
+    targetsWithUrl(urlKey, memberIds) {
+        const result = new Set();
+        for (const target of this.config.targets ?? []) {
+            if (memberIds && !memberIds.has(target.id ?? ''))
+                continue;
+            const deliveryTarget = target.delivery?.target;
+            if (!deliveryTarget)
+                continue;
+            const delivery = this.config.delivery?.targets?.[deliveryTarget];
+            if (delivery?.type === 'httpMultipart' && delivery[urlKey]?.trim()) {
+                result.add(deliveryTarget);
+            }
+        }
+        return result;
+    }
+    /** The durable cells remain the notification intent across crashes and late ACKs. */
+    reconcileScheduleSummaries() {
+        for (const record of this.database.slots.getUnreportedTerminalSchedules()) {
+            const slot = {
+                slotId: record.id, scheduleId: record.scheduleId,
+                occurrenceAt: record.occurrenceAt ?? 0, occurrenceDate: record.occurrenceDate,
+                occurrenceLabel: record.occurrenceLabel, timezone: record.timezone,
+                triggerSource: 'http', slotName: record.slotName, slotDate: record.slotDate,
+            };
+            const schedule = this.config.schedules?.find((item) => item.id === record.scheduleId)
+                ?? { id: record.scheduleId };
+            const targets = this.config.targets.filter((target) => record.targetIds.includes(target.id ?? ''));
+            const summary = new SlotCoordinator_1.SlotCoordinator(this.database).finish(slot, schedule, targets);
+            this.sendSlotSummary(slot, schedule, summary.cells.map((cell) => ({
+                ...cell, label: cell.targetId,
+                workType: targets.find((target) => target.id === cell.targetId)?.type ?? 'unknown',
+                error: cell.error ?? null,
+            })));
         }
     }
     send(targetName, key, text) {

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow",
-  "version": "2.20.2",
+  "version": "2.20.4",
   "private": true
 }

package/dist/scheduler/SlotCoordinator.d.ts

@@ -252,7 +252,20 @@ export declare class SlotCoordinator {
     claimRunLease(slotId: string, owner: string, leaseMs: number): boolean;
     heartbeatLease(slotId: string, owner: string, leaseMs: number): void;
     releaseRunLease(slotId: string, owner: string): void;
-    /** Roll cell results up into the slot status (one place computes the aggregate). */
+    /**
+     * Current durable fallback stage of a cell (0 = primary selection pass).
+     * Mirrors the repository accessor so scheduler-runtime reads one surface.
+     */
+    cellFallbackStage(slotId: string, targetId: string): number;
+    /**
+     * Advance a recoverable candidate cell to its next durable fallback stage
+     * (§schedule-recovery). no_candidate/duplicate from a non-final stage MUST
+     * NOT terminalize: pendingTargets then re-selects the same target with
+     * expanded, still-bounded scan parameters. Returns the new stage, or the
+     * previous stage when the budget was already exhausted (callers then let the
+     * terminal outcome apply).
+     */
+    advanceFallback(slotId: string, targetId: string, reason: string, maxStages: number): number;
     finish(slot: SlotContext, schedule: ScheduleConfig, targets: TargetConfig[]): SlotRunSummary;
     /**
      * Project the terminal slot row into the one structured outcome record. Every

package/dist/scheduler/SlotCoordinator.js

@@ -355,7 +355,31 @@ class SlotCoordinator {
     releaseRunLease(slotId, owner) {
         this.database.slots.releaseSlotLease(slotId, owner);
     }
-    /** Roll cell results up into the slot status (one place computes the aggregate). */
+    /**
+     * Current durable fallback stage of a cell (0 = primary selection pass).
+     * Mirrors the repository accessor so scheduler-runtime reads one surface.
+     */
+    cellFallbackStage(slotId, targetId) {
+        return this.database.slots.cellFallbackStage(slotId, targetId);
+    }
+    /**
+     * Advance a recoverable candidate cell to its next durable fallback stage
+     * (§schedule-recovery). no_candidate/duplicate from a non-final stage MUST
+     * NOT terminalize: pendingTargets then re-selects the same target with
+     * expanded, still-bounded scan parameters. Returns the new stage, or the
+     * previous stage when the budget was already exhausted (callers then let the
+     * terminal outcome apply).
+     */
+    advanceFallback(slotId, targetId, reason, maxStages) {
+        const current = this.database.slots.cellFallbackStage(slotId, targetId);
+        if (current >= maxStages)
+            return current;
+        const next = this.database.slots.bumpFallbackStage(slotId, targetId, reason);
+        logger_1.logger.info('Candidate fallback advanced', {
+            slot: slotId, target: targetId, stage: next, reason: String(reason).slice(0, 160),
+        });
+        return next;
+    }
     finish(slot, schedule, targets) {
         const membership = this.database.slots.getSlotTargetIds(slot.slotId);
         const ids = membership.length > 0 ? membership : targets.map((t) => t.id).filter(Boolean);

package/dist/storage/DatabaseMigration.js

@@ -124,6 +124,7 @@ class DatabaseMigration {
             work_type TEXT,
             status TEXT NOT NULL DEFAULT 'pending',
             attempt_count INTEGER NOT NULL DEFAULT 0,
+            fallback_stage INTEGER NOT NULL DEFAULT 0,
             last_error TEXT,
             created_at DATETIME DEFAULT CURRENT_TIMESTAMP,
             updated_at DATETIME DEFAULT CURRENT_TIMESTAMP,
@@ -244,6 +245,10 @@ class DatabaseMigration {
                 if (!slotCols.includes(col))
                     columnAlters.push(sql);
             }
+            const itemCols = this.db.prepare(`PRAGMA table_info(schedule_slot_items)`).all().map((c) => c.name);
+            if (!itemCols.includes('fallback_stage')) {
+                columnAlters.push(`ALTER TABLE schedule_slot_items ADD COLUMN fallback_stage INTEGER NOT NULL DEFAULT 0`);
+            }
             // Create indexes for better query performance
             const indexes = [
                 `CREATE INDEX IF NOT EXISTS idx_downloads_pixiv_id_type ON downloads(pixiv_id, type)`,

package/dist/storage/repositories/SlotRepository.d.ts

@@ -38,6 +38,12 @@ export interface SlotItemRecord {
     workType: string | null;
     status: CellStatus;
     attemptCount: number;
+    /**
+     * Bounded candidate-fallback depth for this cell (§schedule-recovery). 0 means
+     * the primary selection pass; each advance re-selects the SAME target with
+     * expanded scan bounds. Durable so a crash-resume re-enters at the same stage.
+     */
+    fallback_stage: number;
     lastError: string | null;
     createdAt: string;
     updatedAt: string;
@@ -83,6 +89,8 @@ export declare class SlotRepository extends BaseRepository {
     /** Target ids materialized for a slot (stable membership; falls back to []). */
     getSlotTargetIds(id: string): string[];
     getRecentSlots(limit?: number): SlotRecord[];
+    /** Completed cells whose summary enqueue or aggregate rollup was interrupted. */
+    getUnreportedTerminalSchedules(): SlotRecord[];
     markSlotStatus(id: string, status: SlotStatus, error?: string): void;
     /** All cells for a slot (one per target). */
     getCells(slotId: string): SlotItemRecord[];
@@ -131,6 +139,9 @@ export declare class SlotRepository extends BaseRepository {
     releaseCellWork(slotId: string, targetId: string, workId: string): boolean;
     /** Explicit operator action: forget the locked work so a re-run picks another candidate. */
     clearCellWork(slotId: string, targetId: string): void;
+    /** Durable candidate-fallback bookkeeping (§schedule-recovery). */
+    bumpFallbackStage(slotId: string, targetId: string, reason: string): number;
+    cellFallbackStage(slotId: string, targetId: string): number;
     setCellStatus(slotId: string, targetId: string, status: CellStatus, error?: string): void;
     /**
      * Transition a cell with FSM validation. Never downgrades a confirmed cell;

package/dist/storage/repositories/SlotRepository.js

@@ -71,6 +71,18 @@ class SlotRepository extends BaseRepository_1.BaseRepository {
             .all(limit);
         return rows.map((r) => this.toSlot(r));
     }
+    /** Completed cells whose summary enqueue or aggregate rollup was interrupted. */
+    getUnreportedTerminalSchedules() {
+        const rows = this.db.prepare(`SELECT s.* FROM schedule_slots s
+      WHERE s.manual_request_id IS NULL AND s.status != 'expired'
+        AND EXISTS (SELECT 1 FROM schedule_slot_items c WHERE c.slot_id = s.id)
+        AND NOT EXISTS (SELECT 1 FROM schedule_slot_items c WHERE c.slot_id = s.id
+          AND c.status NOT IN ('submitted', 'no_candidate', 'duplicate', 'failed'))
+        AND (s.status IN ('pending', 'running') OR NOT EXISTS (
+          SELECT 1 FROM outbox o WHERE o.idempotency_key = 'notification:' || s.id || ':summary'
+        ))`).all();
+        return rows.map((row) => this.toSlot(row));
+    }
     markSlotStatus(id, status, error) {
         const stamp = status === 'running' ? 'started_at' : status === 'success' || status === 'partial' || status === 'failed' ? 'completed_at' : null;
         const sets = ['status = @status', 'last_error = @error'];
@@ -198,6 +210,28 @@ class SlotRepository extends BaseRepository_1.BaseRepository {
          WHERE slot_id = @slotId AND target_id = @targetId`)
             .run({ slotId, targetId });
     }
+    /** Durable candidate-fallback bookkeeping (§schedule-recovery). */
+    bumpFallbackStage(slotId, targetId, reason) {
+        const item = this.db
+            .prepare(`SELECT fallback_stage FROM schedule_slot_items WHERE slot_id = ? AND target_id = ?`)
+            .get(slotId, targetId);
+        const stage = Number(item?.fallback_stage ?? 0);
+        this.db
+            .prepare(`UPDATE schedule_slot_items
+            SET fallback_stage = ?, last_error = ?,
+                status = 'pending',
+                updated_at = CURRENT_TIMESTAMP,
+                completed_at = NULL
+          WHERE slot_id = ? AND target_id = ?`)
+            .run(stage + 1, String(reason).slice(0, 400), slotId, targetId);
+        return stage + 1;
+    }
+    cellFallbackStage(slotId, targetId) {
+        const item = this.db
+            .prepare(`SELECT fallback_stage FROM schedule_slot_items WHERE slot_id = ? AND target_id = ?`)
+            .get(slotId, targetId);
+        return Number(item?.fallback_stage ?? 0);
+    }
     setCellStatus(slotId, targetId, status, error) {
         const terminal = status === 'submitted' ||
             status === 'no_candidate' ||
@@ -379,6 +413,7 @@ class SlotRepository extends BaseRepository_1.BaseRepository {
             workType: row.work_type,
             status: row.status,
             attemptCount: row.attempt_count,
+            fallback_stage: Number(row.fallback_stage ?? 0),
             lastError: row.last_error,
             createdAt: row.created_at,
             updatedAt: row.updated_at,

package/dist/utils/config-validator-unified.js

@@ -261,6 +261,20 @@ class ConfigValidator {
                     });
                 }
             }
+            if (delivery.scheduleOutcomeUrl && !/\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(delivery.scheduleOutcomeUrl)) {
+                try {
+                    const url = new URL(delivery.scheduleOutcomeUrl);
+                    if (!['http:', 'https:'].includes(url.protocol))
+                        throw new Error('unsupported protocol');
+                }
+                catch {
+                    errors.push({
+                        code: 'CONFIG_VALIDATION_DELIVERY_SCHEDULE_OUTCOME_URL_INVALID',
+                        field: `${prefix}.scheduleOutcomeUrl`,
+                        message: `Delivery target '${name}': scheduleOutcomeUrl must be valid HTTP or HTTPS`,
+                    });
+                }
+            }
             if (delivery.readinessUrl && !/\$\{[A-Za-z_][A-Za-z0-9_]*\}/.test(delivery.readinessUrl)) {
                 try {
                     const url = new URL(delivery.readinessUrl);

package/dist/version.js

@@ -2,5 +2,5 @@
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.BUILD = void 0;
 // GENERATED by scripts/write-version.js — do not edit manually.
-exports.BUILD = { version: '2.20.2', commit: 'cdaedd018e4d' };
+exports.BUILD = { version: '2.20.4', commit: '5bb73436b670' };
 //# sourceMappingURL=version.js.map

package/dist/webui/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow-webui-backend",
-  "version": "2.20.2",
+  "version": "2.20.4",
   "description": "PixivFlow WebUI Backend - CommonJS module"
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "pixivflow",
-  "version": "2.20.2",
+  "version": "2.20.4",
   "description": "🎨 智能的 Pixiv 自动化下载工具 - 支持批量下载插画和小说、定时任务、Docker部署 | Intelligent Pixiv Automation Downloader with batch download, scheduler, and Docker support",
   "repository": {
     "type": "git",