pixivflow 2.20.4 → 2.21.0

package/dist/commands/SchedulerCommand.js

@@ -208,6 +208,65 @@ class SchedulerCommand extends Command_1.BaseCommand {
                             ? { requestId, slotId: slot.id, state: cell.status, slotStatus: slot.status }
                             : null;
                     },
+                    /**
+                     * Manual recovery of a FAILED target (§manual-recovery). Distinct
+                     * from refetch: there is no review chain to replace and no
+                     * replacement payload — the target is simply re-acquired under a
+                     * server-defined policy preset, and its outcome is reported through
+                     * the ordinary schedule-outcome channel so the automatic history is
+                     * never rewritten.
+                     */
+                    recover: async (targetId, requestId, retryMode, correlationId) => {
+                        const cfg = resolveConfig();
+                        const plans = (cfg.schedules ?? []).filter((plan) => plan.enabled !== false && (0, schedules_1.selectScheduleTargets)(cfg.targets, plan).some((target) => target.id === targetId));
+                        if (plans.length === 0)
+                            throw new Error('unknown target');
+                        if (plans.length !== 1)
+                            throw new Error('ambiguous target');
+                        const plan = plans[0];
+                        const target = (0, schedules_1.selectScheduleTargets)(cfg.targets, plan).find((item) => item.id === targetId);
+                        const deliveryName = target.delivery?.target;
+                        const delivery = deliveryName ? cfg.delivery?.targets?.[deliveryName] : undefined;
+                        if (delivery?.type !== 'httpMultipart' || !delivery.scheduleOutcomeUrl?.trim()) {
+                            throw new Error('schedule outcome endpoint not configured');
+                        }
+                        const now = new Date();
+                        const date = new Intl.DateTimeFormat('en-CA', {
+                            timeZone: plan.timezone ?? 'UTC', year: 'numeric', month: '2-digit', day: '2-digit',
+                        }).format(now);
+                        const slot = {
+                            slotId: `${plan.id}@recover-${requestId.toLowerCase()}`,
+                            scheduleId: plan.id,
+                            occurrenceAt: now.getTime(),
+                            occurrenceDate: date,
+                            occurrenceLabel: 'manual',
+                            timezone: plan.timezone ?? 'UTC',
+                            triggerSource: 'manual',
+                            slotName: retryMode === 'relaxed' ? '手动恢复（放宽条件重试）' : '手动恢复（再试一次）',
+                            slotDate: date,
+                            recoveryRequestId: requestId,
+                            recoveryMode: retryMode,
+                            correlationId: correlationId || undefined,
+                        };
+                        const existing = runtime.database.slots.getSlot(slot.slotId);
+                        if (existing && (existing.scheduleId !== plan.id || existing.targetIds.length !== 1 || existing.targetIds[0] !== targetId)) {
+                            throw new Error('ambiguous target');
+                        }
+                        const prepared = coordinator.prepare(slot, plan, [target]);
+                        if (prepared.alreadyCompleted)
+                            return { slotId: slot.slotId, disposition: 'already_completed' };
+                        // Same resource admission as every other Pixiv-consuming work
+                        // item: a busy account queues this run, it does not fail it.
+                        const started = manager.triggerSchedule(plan.id, { slot, onlyTarget: targetId, triggerSource: 'manual' });
+                        return { slotId: slot.slotId, disposition: started ? 'accepted' : 'queued' };
+                    },
+                    recoverStatus: (targetId, requestId) => {
+                        const slot = runtime.database.slots.findRecoverySlot(requestId, targetId);
+                        const cell = slot && runtime.database.slots.getCell(slot.id, targetId);
+                        return slot && cell
+                            ? { requestId, slotId: slot.id, state: cell.status, slotStatus: slot.status }
+                            : null;
+                    },
                     status: (scheduleId) => {
                         const cfg = resolveConfig();
                         const plan = findPlan(cfg, scheduleId);
@@ -255,6 +314,13 @@ class SchedulerCommand extends Command_1.BaseCommand {
                             // attempts are exhausted, which does not block exit), so this
                             // cannot hold the machine open indefinitely.
                             pendingOutbox: outbox.pending,
+                            // Second belt: never exit underneath an in-flight slot execution
+                            // even if a durable row ever looks a beat early (§idle-inflight).
+                            activeExecutions: runtime.activeExecutionCount(),
+                            // Third belt: work parked waiting for resource capacity is
+                            // unfinished work (§resource-governance) — a queued run must not
+                            // let the machine stop before it runs.
+                            waitingForResource: manager.waitingWorkCount(),
                         };
                     },
                     idleGraceMs: scheduling.idleGraceMs,

package/dist/commands/SchedulerIdleLifecycle.d.ts

@@ -41,6 +41,23 @@ export interface IdleSnapshot {
     processingOutbox: number;
     /** Undelivered outbox rows (pending, or waiting on a bounded retry backoff). */
     pendingOutbox: number;
+    /**
+     * In-process slot executions currently awaiting async work (candidate scan,
+     * download, delivery). This is a SECOND belt behind the durable ledger: even
+     * if a DB row is an instant ahead of its awaiting Promise (or a mis-write
+     * ever terminalized a row early), the idle detector must not exit underneath
+     * a live execution. In-memory only — a process crash still resumes from the
+     * durable slot/outbox rows.
+     */
+    activeExecutions: number;
+    /**
+     * Work items parked in the resource admission queue (§resource-governance).
+     * Waiting for capacity is UNFINISHED work, not idleness: a queued run has a
+     * durable slot row (counted above) but may not have reached `claimRunLease`
+     * yet in internal mode, so this explicit belt prevents the worker from
+     * shutting down while a run is still waiting to start.
+     */
+    waitingForResource: number;
 }
 /** True only when the worker has no work of any kind left. */
 export declare function isIdle(snapshot: IdleSnapshot): boolean;

package/dist/commands/SchedulerIdleLifecycle.js

@@ -38,7 +38,9 @@ const logger_1 = require("../logger");
 function isIdle(snapshot) {
     return (snapshot.activeSlots === 0 &&
         snapshot.processingOutbox === 0 &&
-        snapshot.pendingOutbox === 0);
+        snapshot.pendingOutbox === 0 &&
+        snapshot.activeExecutions === 0 &&
+        snapshot.waitingForResource === 0);
 }
 /** Default idle grace: long enough to merge two schedules ~10 minutes apart. */
 exports.DEFAULT_IDLE_GRACE_MS = 10 * 60 * 1000;

package/dist/commands/scheduler-runtime.d.ts

@@ -100,6 +100,14 @@ export interface SchedulerRuntime {
     notifyScheduleFailure(snapshot: StandaloneConfig, schedule: ScheduleConfig, failure: JobFailure): Promise<void>;
     /** Start the independent outbox pump (long-running daemon). */
     startOutboxWorker(): void;
+    /**
+     * Number of slot executions currently awaiting async work in THIS process
+     * (candidate scan / download / delivery). Bounded second belt for the idle
+     * lifecycle: exit is only allowed when this is 0 AND the durable ledger is
+     * empty (§idle-inflight). In-memory only; crash recovery still rides the
+     * durable slot/outbox rows.
+     */
+    activeExecutionCount(): number;
     /** Drain due outbox rows once (run-once / watchdog wake). */
     drainOutbox(): Promise<{
         processed: number;

package/dist/commands/scheduler-runtime.js

@@ -58,6 +58,7 @@ const DeliveryDispatcher_1 = require("../delivery/DeliveryDispatcher");
 const token_maintenance_1 = require("../utils/token-maintenance");
 const schedules_1 = require("../scheduler/schedules");
 const SlotCoordinator_1 = require("../scheduler/SlotCoordinator");
+const RecoveryPolicy_1 = require("../scheduler/RecoveryPolicy");
 const DeliveryLedgerPort_1 = require("../delivery/DeliveryLedgerPort");
 const OutboxWorker_1 = require("../delivery/OutboxWorker");
 const settleDeliveryTerminal_1 = require("../delivery/settleDeliveryTerminal");
@@ -275,6 +276,7 @@ async function createSchedulerRuntime(configPathArg) {
             notificationPolicy.noteTerminalRefetchCell(delivery.slotId, delivery.targetId);
         },
     });
+    let activeExecutions = 0;
     const runJob = async (snapshot, schedule, options = {}) => {
         const { onlyTarget, adhoc = false, slot: providedSlot } = options;
         // A scheduled run is cron by default; an HTTP/manual trigger passes its own.
@@ -285,6 +287,20 @@ async function createSchedulerRuntime(configPathArg) {
             // "重抓/换一张" 只重跑产生该审核的那一个 target。
             targets = targets.filter((t) => t.id === onlyTarget);
         }
+        // Occurrence-scoped acquisition policy (§recovery-policy). A manual recovery
+        // slot carries a server-defined preset; `relaxed` widens only SOFT criteria
+        // (search range / candidate count / language window) for THIS occurrence.
+        // The global config is never written, so future schedules are unaffected.
+        const recoveryMode = providedSlot?.recoveryMode;
+        if (recoveryMode && recoveryMode !== 'normal') {
+            targets = targets.map((target) => (0, RecoveryPolicy_1.applyAcquisitionPolicy)(target, recoveryMode));
+            logger_1.logger.info('Manual recovery policy applied to this occurrence', {
+                scheduleId: schedule.id,
+                slot: providedSlot?.slotId,
+                recoveryMode,
+                targets: targets.map((t) => t.id),
+            });
+        }
         if (targets.length === 0) {
             logger_1.logger.warn('Scheduled plan has no selected targets; skipping', {
                 scheduleId: schedule.id,
@@ -546,107 +562,117 @@ async function createSchedulerRuntime(configPathArg) {
             });
             await new Promise((resolve) => setTimeout(resolve, runtimeConfig.initialDelay));
         }
-        logger_1.logger.info('='.repeat(60));
-        logger_1.logger.info('Starting scheduled Pixiv download plan', {
-            scheduleId: schedule.id,
-            slot: slotCtx?.slotId ?? '(ad-hoc)',
-            trigger: triggerSource,
-            targets: runTargets.map((target) => target.id ?? target.tag ?? target.filterTag ?? target.type),
-        });
-        logger_1.logger.info('='.repeat(60));
-        const startTime = Date.now();
-        let allTargetsFailed;
-        let releaseLease = () => undefined;
-        if (slotCtx && varReleaseLease)
-            releaseLease = varReleaseLease;
+        // Execution belt (§idle-inflight): this run is live until releaseLease
+        // completes. The idle detector must see it even if a durable row lags.
+        activeExecutions += 1;
         try {
-            // Candidate fallback passes (§schedule-recovery): after each pass, cells
-            // still mid-fallback (advanced stages) are re-selected with expanded,
-            // still-bounded scan limits. Successful sibling cells are NEVER re-run:
-            // pendingTargets only returns unconverged cells of this slot.
-            for (let pass = 0;; pass += 1) {
-                await downloadManager.runAllTargets();
-                if (!slotCtx || pass >= maxFallbackStages - 1)
-                    break;
-                const pendingFallback = coordinator
-                    .pendingTargets(slotCtx.slotId, targets)
-                    .filter((p) => p.cell &&
-                    p.cell.fallback_stage > 0 &&
-                    p.cell.fallback_stage < maxFallbackStages);
-                if (pendingFallback.length === 0)
-                    break;
-                downloadManager = buildManager(boostedTargets(pendingFallback.map((p) => p.target)));
-                activeDownloadManager = downloadManager;
-                await downloadManager.initialise();
+            logger_1.logger.info('='.repeat(60));
+            logger_1.logger.info('Starting scheduled Pixiv download plan', {
+                scheduleId: schedule.id,
+                slot: slotCtx?.slotId ?? '(ad-hoc)',
+                trigger: triggerSource,
+                targets: runTargets.map((target) => target.id ?? target.tag ?? target.filterTag ?? target.type),
+            });
+            logger_1.logger.info('='.repeat(60));
+            const startTime = Date.now();
+            let allTargetsFailed;
+            let releaseLease = () => undefined;
+            if (slotCtx && varReleaseLease)
+                releaseLease = varReleaseLease;
+            try {
+                // Candidate fallback passes (§schedule-recovery): after each pass, cells
+                // still mid-fallback (advanced stages) are re-selected with expanded,
+                // still-bounded scan limits. Successful sibling cells are NEVER re-run:
+                // pendingTargets only returns unconverged cells of this slot.
+                for (let pass = 0;; pass += 1) {
+                    await downloadManager.runAllTargets();
+                    if (!slotCtx || pass >= maxFallbackStages - 1)
+                        break;
+                    const pendingFallback = coordinator
+                        .pendingTargets(slotCtx.slotId, targets)
+                        .filter((p) => p.cell &&
+                        p.cell.fallback_stage > 0 &&
+                        p.cell.fallback_stage < maxFallbackStages);
+                    if (pendingFallback.length === 0)
+                        break;
+                    downloadManager = buildManager(boostedTargets(pendingFallback.map((p) => p.target)));
+                    activeDownloadManager = downloadManager;
+                    await downloadManager.initialise();
+                }
             }
-        }
-        catch (error) {
-            if (!slotCtx || !(error instanceof Error) || !/^All \d+ target\(s\) failed\./.test(error.message)) {
-                // Abnormal abort. Two very different situations land here, and treating
-                // them as one is what produced the production loop:
-                //
-                //  - this process cancelled itself (scheduler timeout / watchdog) and is
-                //    still alive. It will never touch the Slot again, so releasing the
-                //    lease while leaving the status `running` makes the Slot look exactly
-                //    like a crashed worker: `recoverableSlots()` matches a NULL lease on
-                //    purpose (its "recorded but never claimed" case), so the recovery
-                //    sweep re-dispatches the SAME occurrence on every tick, forever.
-                //    Terminalise it instead: the occurrence is finished, and failed.
-                //
-                //  - the process is going away (`shutdown`). Deliberately leave the Slot
-                //    non-terminal so recovery resumes the same occurrence after restart.
-                if (slotCtx && shouldTerminaliseAbortedSlot(activeAbortOrigin, slotAbandoned)) {
-                    coordinator.finish(slotCtx, schedule, targets);
-                    for (const target of targets)
-                        if (target.id)
-                            notificationPolicy.noteTerminalRefetchCell(slotCtx.slotId, target.id);
+            catch (error) {
+                if (!slotCtx || !(error instanceof Error) || !/^All \d+ target\(s\) failed\./.test(error.message)) {
+                    // Abnormal abort. Two very different situations land here, and treating
+                    // them as one is what produced the production loop:
+                    //
+                    //  - this process cancelled itself (scheduler timeout / watchdog) and is
+                    //    still alive. It will never touch the Slot again, so releasing the
+                    //    lease while leaving the status `running` makes the Slot look exactly
+                    //    like a crashed worker: `recoverableSlots()` matches a NULL lease on
+                    //    purpose (its "recorded but never claimed" case), so the recovery
+                    //    sweep re-dispatches the SAME occurrence on every tick, forever.
+                    //    Terminalise it instead: the occurrence is finished, and failed.
+                    //
+                    //  - the process is going away (`shutdown`). Deliberately leave the Slot
+                    //    non-terminal so recovery resumes the same occurrence after restart.
+                    if (slotCtx && shouldTerminaliseAbortedSlot(activeAbortOrigin, slotAbandoned)) {
+                        coordinator.finish(slotCtx, schedule, targets);
+                        for (const target of targets)
+                            if (target.id)
+                                notificationPolicy.noteTerminalRefetchCell(slotCtx.slotId, target.id);
+                    }
+                    // Hand the lease back either way: a terminal Slot cannot be re-dispatched,
+                    // and a non-terminal one (shutdown) must not wait for its TTL to expire.
+                    releaseLease?.();
+                    throw error;
+                }
+                // Scheduled Slots treat terminal target failures (failed/no_candidate) as
+                // a finished partial/failed aggregate. Finish before returning so the HTTP
+                // trigger can report the durable state instead of 500 and never roll up.
+                allTargetsFailed = error;
+            }
+            finally {
+                if (activeDownloadManager === downloadManager)
+                    activeDownloadManager = null;
+            }
+            const duration = Math.round((Date.now() - startTime) / 1000);
+            if (slotCtx && !slotAbandoned) {
+                const summary = coordinator.finish(slotCtx, schedule, targets);
+                for (const target of targets)
+                    if (target.id)
+                        notificationPolicy.noteTerminalRefetchCell(slotCtx.slotId, target.id);
+                // Terminal summaries are for SCHEDULED occurrences (P0-B). Remote manual
+                // replacements already report through their own verdict channel
+                // (refetchOutcomeUrl); a schedule summary would double-notify the group.
+                if (!slotCtx.manualRequestId) {
+                    notificationPolicy.sendSlotSummary(slotCtx, schedule, summary.cells.map((c) => {
+                        const t = targets.find((x) => x.id === c.targetId);
+                        return {
+                            targetId: c.targetId,
+                            label: c.targetId,
+                            workType: t?.type ?? 'unknown',
+                            status: c.status,
+                            workId: c.workId,
+                            error: c.error ?? null,
+                            terminal_reason_code: c.terminalReasonCode ?? null,
+                            reason: c.terminalReasonMessage ?? null,
+                        };
+                    }));
                 }
-                // Hand the lease back either way: a terminal Slot cannot be re-dispatched,
-                // and a non-terminal one (shutdown) must not wait for its TTL to expire.
-                releaseLease?.();
-                throw error;
+                releaseLease();
             }
-            // Scheduled Slots treat terminal target failures (failed/no_candidate) as
-            // a finished partial/failed aggregate. Finish before returning so the HTTP
-            // trigger can report the durable state instead of 500 and never roll up.
-            allTargetsFailed = error;
+            if (!slotCtx && allTargetsFailed)
+                throw allTargetsFailed;
+            logger_1.logger.info('='.repeat(60));
+            logger_1.logger.info(`Scheduled download plan finished (took ${duration}s)`, {
+                scheduleId: schedule.id,
+                slot: slotCtx?.slotId ?? '(ad-hoc)',
+            });
+            logger_1.logger.info('='.repeat(60));
         }
         finally {
-            if (activeDownloadManager === downloadManager)
-                activeDownloadManager = null;
-        }
-        const duration = Math.round((Date.now() - startTime) / 1000);
-        if (slotCtx && !slotAbandoned) {
-            const summary = coordinator.finish(slotCtx, schedule, targets);
-            for (const target of targets)
-                if (target.id)
-                    notificationPolicy.noteTerminalRefetchCell(slotCtx.slotId, target.id);
-            // Terminal summaries are for SCHEDULED occurrences (P0-B). Remote manual
-            // replacements already report through their own verdict channel
-            // (refetchOutcomeUrl); a schedule summary would double-notify the group.
-            if (!slotCtx.manualRequestId) {
-                notificationPolicy.sendSlotSummary(slotCtx, schedule, summary.cells.map((c) => {
-                    const t = targets.find((x) => x.id === c.targetId);
-                    return {
-                        targetId: c.targetId,
-                        label: c.targetId,
-                        workType: t?.type ?? 'unknown',
-                        status: c.status,
-                        workId: c.workId,
-                        error: c.error ?? null,
-                    };
-                }));
-            }
-            releaseLease();
+            activeExecutions -= 1;
         }
-        if (!slotCtx && allTargetsFailed)
-            throw allTargetsFailed;
-        logger_1.logger.info('='.repeat(60));
-        logger_1.logger.info(`Scheduled download plan finished (took ${duration}s)`, {
-            scheduleId: schedule.id,
-            slot: slotCtx?.slotId ?? '(ad-hoc)',
-        });
-        logger_1.logger.info('='.repeat(60));
     };
     const cancelActive = (reason, origin = 'timeout') => {
         activeAbortOrigin = origin;
@@ -680,6 +706,7 @@ async function createSchedulerRuntime(configPathArg) {
         runJob,
         cancelActive,
         abandonActiveRun,
+        activeExecutionCount: () => activeExecutions,
         startOutboxWorker: () => outboxWorker.start(),
         drainOutbox: () => outboxWorker.drainOnce(),
         notifyScheduleFailure: (snapshot, schedule, failure) => notifyScheduleFailure(snapshot, database, schedule, failure),

package/dist/config/types.d.ts

@@ -279,6 +279,25 @@ export interface PixivCredentialConfig {
     deviceToken: string;
     refreshToken: string;
     userAgent: string;
+    /**
+     * Stable internal identity of this credential profile (§resource-governance).
+     * It is the RESOURCE identity used for admission keys (`pixiv-account:<id>`),
+     * never a token/cookie and never a bot/schedule/target name. Default 'default'.
+     */
+    accountId?: string;
+}
+/**
+ * Operator-level resource capacity configuration (§resource-governance).
+ * Concurrency is scoped by the real constrained resource, not by bot/schedule/
+ * target. Current production resource: the single Pixiv account profile, with
+ * `maxConcurrency: 1` recommended. This is deployment config — never exposed
+ * to ordinary manager UI.
+ */
+export interface ResourceGovernanceConfig {
+    /** Per-Pixiv-account-profile capacity. Keyed by `pixiv.accountId`. */
+    pixivAccounts?: Record<string, {
+        maxConcurrency?: number;
+    }>;
 }
 export interface NetworkConfig {
     /**
@@ -473,6 +492,13 @@ export interface SchedulerRuntimeConfig {
      * resumes from the same durable Slot/outbox rows. Default: 10800000ms (3h).
      */
     maxLifetimeMs?: number;
+    /**
+     * Operator-level resource capacity (§resource-governance). Concurrency is
+     * scoped by the real constrained resource (e.g. the shared Pixiv account),
+     * never by bot/schedule/target. Waiting for capacity is a normal state, not
+     * an execution failure. Not exposed to ordinary manager UI.
+     */
+    resourceGovernance?: ResourceGovernanceConfig;
     /**
      * External-mode HTTP trigger settings. Ignored in internal mode.
      */

package/dist/config/validation.js

@@ -473,6 +473,27 @@ function validateConfig(config, location, databasePath) {
                 errors.push('schedulerRuntime.trigger.graceMinutes: Must be a positive integer (minutes)');
             }
         }
+        const rg = rt.resourceGovernance;
+        if (rg) {
+            if (rg.pixivAccounts !== undefined && (typeof rg.pixivAccounts !== 'object' || rg.pixivAccounts === null || Array.isArray(rg.pixivAccounts))) {
+                errors.push('schedulerRuntime.resourceGovernance.pixivAccounts: Must be an object keyed by pixiv account id');
+            }
+            else if (rg.pixivAccounts) {
+                for (const [accountId, profile] of Object.entries(rg.pixivAccounts)) {
+                    if (!accountId.trim()) {
+                        errors.push('schedulerRuntime.resourceGovernance.pixivAccounts: account ids must be non-empty');
+                    }
+                    if (profile === null || typeof profile !== 'object' || Array.isArray(profile)) {
+                        errors.push(`schedulerRuntime.resourceGovernance.pixivAccounts.${accountId}: Must be an object`);
+                        continue;
+                    }
+                    const max = profile.maxConcurrency;
+                    if (max !== undefined && (!Number.isInteger(max) || max < 1 || max > 16)) {
+                        errors.push(`schedulerRuntime.resourceGovernance.pixivAccounts.${accountId}.maxConcurrency: Must be an integer between 1 and 16`);
+                    }
+                }
+            }
+        }
     }
     // Validate download config
     if (config.download) {

package/dist/delivery/types.d.ts

@@ -122,11 +122,26 @@ export interface DeliveryNotificationRequest {
         scheduleId: string;
         slotId: string;
         status: 'success' | 'partial' | 'failed';
+        /**
+         * Present when this terminal outcome belongs to a MANUAL RECOVERY run
+         * (§manual-recovery): the request id and the policy preset used. Lets the
+         * receiving service render "已恢复" instead of the daily summary.
+         */
+        recovery?: {
+            mode: 'normal' | 'relaxed';
+            requestId: string;
+        };
         targets?: Array<{
             targetId: string;
             workType: string;
             status: string;
             workId?: string | null;
+            /** Raw cell error (request-level observability; NOT user-safe text). */
+            error?: string | null;
+            /** Normalized terminal failure code (§terminal-reason). */
+            terminal_reason_code?: string | null;
+            /** User-facing business reason message for the failure. */
+            reason?: string | null;
         }>;
     };
 }

package/dist/notification/NotificationPolicy.d.ts

@@ -44,6 +44,8 @@ export declare class NotificationPolicy {
         status: string;
         workId: string | null;
         error: string | null;
+        terminal_reason_code?: string | null;
+        reason?: string | null;
     }>): void;
     /**
      * Delivery targets whose HTTP target declares the given outcome URL.

package/dist/notification/NotificationPolicy.js

@@ -88,7 +88,13 @@ class NotificationPolicy {
             (r.workId ? ` #${r.workId}` : '') +
             (r.status === 'delivery_pending' ? ' 投递中' : '') +
             (r.status === 'no_candidate' ? ' 无候选' : '') +
-            (r.status === 'failed' && r.error ? ` ${r.error.slice(0, 120)}` : ''));
+            // First-level cause, business language only: the durable normalized
+            // reason replaces any raw error text (§terminal-reason).
+            ((r.status === 'failed' || r.status === 'no_candidate' || r.status === 'duplicate') && r.reason
+                ? ` ${r.reason.slice(0, 80)}`
+                : r.status === 'failed' && r.error
+                    ? ` ${r.error.slice(0, 80)}`
+                    : ''));
         const submitted = rows.filter((r) => r.status === 'submitted').length;
         const text = [
             `${schedule.name?.trim() || schedule.id} · ${slot.occurrenceLabel}`,
@@ -102,11 +108,22 @@ class NotificationPolicy {
                 scheduleId: schedule.id,
                 slotId: slot.slotId,
                 status: outcomeStatus,
+                ...(slot.recoveryRequestId
+                    ? {
+                        recovery: {
+                            mode: slot.recoveryMode ?? 'normal',
+                            requestId: slot.recoveryRequestId,
+                        },
+                    }
+                    : {}),
                 targets: rows.map((r) => ({
                     targetId: r.targetId,
                     workType: r.workType,
                     status: r.status,
                     workId: r.workId,
+                    error: r.error,
+                    terminal_reason_code: r.terminal_reason_code ?? null,
+                    reason: r.reason ?? null,
                 })),
             });
         }

package/dist/package.json

@@ -1,6 +1,6 @@
 {
   "type": "commonjs",
   "name": "pixivflow",
-  "version": "2.20.4",
+  "version": "2.21.0",
   "private": true
 }

package/dist/scheduler/MultiScheduleManager.d.ts

@@ -34,7 +34,9 @@ export declare const RECOVERY_INTERVAL_MS: number;
 /**
  * Hosts many cron plans in one process. A validated config snapshot replaces
  * the complete cron table at once; invalid updates leave the previous table
- * running. All jobs share one bounded serial admission queue by default.
+ * running. All jobs that consume the same constrained resource (today: the
+ * shared Pixiv account) pass through ONE bounded resource admission; work for
+ * different resource identities runs concurrently.
  */
 export declare class MultiScheduleManager {
     private readonly options;
@@ -46,6 +48,15 @@ export declare class MultiScheduleManager {
     private watching;
     private readonly admission;
     constructor(options: MultiScheduleManagerOptions);
+    /**
+     * Deduplicated, log-safe observable: how many work items are parked waiting
+     * for any resource. Used by the idle lifecycle — waiting work is unfinished
+     * work and must prevent premature shutdown (§waiting-is-not-idle).
+     */
+    waitingWorkCount(): number;
+    /** The resource key a plan's work consumes (resource identity, never a bot/
+     *  schedule/target name). All Pixiv-consuming work shares the account id. */
+    private resourceKeyForPlan;
     start(initialConfig?: StandaloneConfig): ConfigReloadResult;
     private startRecoveryLoop;
     /**