sintbot 1.4.0 → 1.4.1

package/CHANGELOG.en.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "1.4.1",
+    "date": "2026-11-09",
+    "name": "A failing group stops only itself",
+    "items": [
+      {
+        "t": "One group's fault leaves the others working",
+        "d": "When a group's last task has an outcome that cannot be confirmed (for example a reply whose delivery is unknown, or a runner that exited without a result), only that group is paused; nothing is replayed or retried and the other groups keep working. A paused group answers new messages with a short notice."
+      },
+      {
+        "t": "One group no longer blocks startup",
+        "d": "If a group's records cannot be recovered, the other groups still start and the console marks that group Needs attention. The startup preflight fails and lists such groups."
+      },
+      {
+        "t": "Incident seal command",
+        "d": "Restart first; for a group that is still paused, stop the service and run sintbot incident seal --group <group ID>. The old records are kept unchanged, the group reopens with new records, and messages left unfinished before the seal are not processed again."
+      }
+    ]
+  },
   {
     "version": "1.4.0",
     "date": "2026-11-08",

package/CHANGELOG.json

@@ -1,4 +1,23 @@
 [
+  {
+    "version": "1.4.1",
+    "date": "2026-11-09",
+    "name": "一个群出问题，只停这个群",
+    "items": [
+      {
+        "t": "一个群出问题，其他群照常",
+        "d": "某个群上一个任务的结果无法确认时（例如回复是否送达不明，或执行器退出时没有结果），只暂停这个群，不重放、不重试，其他群继续处理。暂停的群收到新消息会回一句说明。"
+      },
+      {
+        "t": "启动时不再被一个群拖住",
+        "d": "某个群的记录恢复不了时，其他群照常启动，控制台把这个群标为「需要处理」。启动预检遇到这样的群会直接失败并列出原因。"
+      },
+      {
+        "t": "新增封存命令",
+        "d": "先重启服务；仍然暂停的群，在服务停止后运行 sintbot incident seal --group 群 ID。原记录原样封存，这个群换一份新记录重新开放，封存前未完成的消息不会再处理。"
+      }
+    ]
+  },
   {
     "version": "1.4.0",
     "date": "2026-11-08",

package/bin/sintbot-v2.js

@@ -122,11 +122,18 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     for (const name of ['pending-turns.json', 'engine-receipts.json']) {
       if (fs.existsSync(path.join(stateDir, name))) throw new Error('Legacy pending authority needs explicit migration')
     }
+    // A journal that cannot be opened or audited holds only its own group.
     const journals = new Map()
+    const holds = new Map()
     for (const route of routes) {
-      const journal = C2DurableJournal.open(route.file, validators)
-      assertJournalScope(journal, route.chatId, { requireSettled: preflightOnly || route.paused })
-      journals.set(route.chatId, journal)
+      try {
+        const journal = C2DurableJournal.open(route.file, validators)
+        assertJournalScope(journal, route.chatId, { requireSettled: preflightOnly || route.paused })
+        journals.set(route.chatId, journal)
+      } catch (error) {
+        if (!assertWriterLock()) throw error
+        holds.set(route.chatId, error?.message || String(error))
+      }
     }
     // All group Engines must share this exact object: separate Store caches
     // would overwrite sibling sessions when they save the same state file.
@@ -136,6 +143,13 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       'codex-exec': require('../src/agent/codexcode').isClosedRunnerResult,
       'codex-app': require('../src/agent/codexapp').isClosedRunnerResult,
     }
+    // A runner that failed from its own exit event has closed; this frees its
+    // model permit but never proves the turn's outcome.
+    const closeErrorChecks = {
+      claude: require('../src/agent/claudecode').isClosedRunnerError,
+      'codex-exec': require('../src/agent/codexcode').isClosedRunnerError,
+      'codex-app': require('../src/agent/codexapp').isClosedRunnerError,
+    }
     const limits = { maxEventCount: 100_000, maxJournalBytes: 64 * 1024 * 1024,
       maxCompletionEvents: 1_000, maxCompletionBytes: 8 * 1024 * 1024 }
     let finishing = false
@@ -148,7 +162,9 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
         () => process.exit(result.code))
     }
     service = createC2MultiGroupService({ routes, assertWriterLock, quarantine: combinedQuarantine,
-      closeCapacity: () => capacity.close(),
+      holds, closeCapacity: () => capacity.close(),
+      // Faults in a shared resource stop every group; others hold one group.
+      sharedFault: () => capacity.snapshot().closed ? 'model concurrency closed' : null,
       log: message => process.stderr.write(`C2 multi-group · ${message}\n`),
       onFatal: (error, result) => {
         process.stderr.write(`C2 multi-group failure: ${error?.message || String(error)}\n`)
@@ -199,10 +215,15 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
             verifyFile: path.join(stateDir, 'verify.json'), assertWriterLock,
             resolveTurn: identity => resolveC2LocalEffectTurn(engine, identity) })
           const closedResults = new WeakSet()
+          const closedErrors = new WeakSet()
           const startTurn = async input => {
             const backend = routeBackend(input.provider?.runner, input.codexApp,
               input.codexSteer, input.codexProjectDocFallback)
-            const result = await runner.runTurn(input)
+            let result
+            try { result = await runner.runTurn(input) } catch (error) {
+              if (closeErrorChecks[backend]?.(error) === true) closedErrors.add(error)
+              throw error
+            }
             if (closeChecks[backend]?.(result) === true) closedResults.add(result)
             return result
           }
@@ -210,14 +231,15 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
             store, log: message => process.stderr.write(`C2 v2 · ${message}\n`),
             durableV2Runtime: runtime, durableV2Payloads: handles,
             durableV2StartTurn: startTurn, durableV2ApplyLocalEffect: applyLocalEffect,
-            durableV2VerifyRunnerClosed: ({ result }) => !!result &&
-              typeof result === 'object' && closedResults.has(result),
+            durableV2VerifyRunnerClosed: ({ result, error }) => result
+              ? typeof result === 'object' && closedResults.has(result)
+              : !!error && typeof error === 'object' && closedErrors.has(error),
             durableV2AssertWriterLock: assertWriterLock, durableV2Journal: journal,
             durableV2AcquireCapacity: options => capacity.acquire(options),
-            // A failed model turn is closed for its group alone; every other
-            // route error still seals shared grants before the process stops.
+            // A route fault holds or recovers its group alone. Shared grants
+            // are sealed only when the process writer lease itself is gone.
             durableV2SealCapacity: error => {
-              if (error?.code !== 'C2_V2_UNRESOLVED_TURN') capacity.close(error)
+              if (assertWriterLock() !== true) capacity.close(error)
             },
             durableV2SwitchProvider: (chatId, name) => {
               if (chatId !== route.chatId) throw new Error('Model switch targets another group')
@@ -231,7 +253,8 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       } })
     // One configuration writer for the console and the chat /model command.
     configControl = require('../src/c2configcontrol').createC2ConfigControl({
-      installation, getBindings: () => service.bindings, assertWriterLock, store,
+      installation, getBindings: () => service.bindings, getHeld: () => service.held,
+      assertWriterLock, store,
       activateRoute: route => service.addRoute(route),
       log: message => process.stderr.write(`C2 multi-group · ${message}\n`) })
     const stop = reason => { void service.stop(reason, 0).then(finish) }
@@ -243,7 +266,7 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
       ui = require('../src/c2console').createC2Console({
         configPath: cfg._path, stateDir, host: uiHost,
         getConfig: () => cfg, getBindings: () => service.bindings,
-        getCapacity: () => capacity.snapshot(),
+        getHeld: () => service.held, getCapacity: () => capacity.snapshot(),
         getConnHealth: () => liveTransport?.platform.connHealth?.() || {},
         assertWriterLock, ...configControl,
         log: message => process.stderr.write(`Console · ${message}\n`) })
@@ -261,6 +284,9 @@ async function startMultiGroupService({ installation, preflightOnly, uiEnabled =
     process.on('exit', lock.release)
     running = true
     process.stderr.write(`SintBot Feishu ingress connected for ${started.groups} groups\n`)
+    for (const item of started.held || []) {
+      process.stderr.write(`SintBot group ${item.chatId} is held: ${item.reason}\n`)
+    }
   } catch (error) {
     ui?.close()
     const stopped = await service?.stop('startup-failed', 1)
@@ -303,6 +329,7 @@ const HELP = `SintBot macOS Feishu multi-group candidate
 Usage:
   sintbot init [--config <absolute path>] [--data-dir <absolute path>]
   sintbot start [--config <absolute path>] [--data-dir <absolute path>] [--preflight] [--ui] [--ui-host <address>] [--ui-port <port>] [--no-open]
+  sintbot incident seal --group <oc_…> [--config <absolute path>] [--data-dir <absolute path>] [--reason <text>]
   sintbot version
   sintbot help
 
@@ -311,7 +338,10 @@ Initialization is for a new installation only; existing journals are never reset
 Console shows live groups, binds groups and switches models or projects of idle groups;
 in a group, /model lists or switches models. Unsupported actions stay disabled.
 Canvas, scheduled tasks, terminal chat and other platforms are unavailable.
-Group faults stop the shared process safely; unknown effects are never replayed.
+A group whose last result cannot be proven is held alone; the other groups keep serving.
+Restart first: a journal that can recover reopens on its own. If the group is still held,
+stop the service, run incident seal for that group, then start again.
+Sealing keeps the old journal unchanged; unknown effects are never replayed.
 `
 
 async function main(argv = process.argv.slice(2)) {
@@ -326,10 +356,27 @@ async function main(argv = process.argv.slice(2)) {
     process.stdout.write(HELP)
     return
   }
-  if (!['init', 'start'].includes(sub)) {
+  if (!['init', 'start', 'incident'].includes(sub)) {
     throw new Error(`${sub} is unavailable in this release; use sintbot help`)
   }
   if (process.platform !== 'darwin') throw new Error('this release supports macOS only')
+  if (sub === 'incident') {
+    const [action, ...args] = rest
+    if (rest.some(arg => arg === '--help' || arg === '-h')) { process.stdout.write(HELP); return }
+    if (action !== 'seal') throw new Error('Usage: sintbot incident seal --group <oc_…> [--config <path>] [--data-dir <path>]')
+    const { values } = parseArgs({ args, allowPositionals: false, options: {
+      config: { type: 'string' }, 'data-dir': { type: 'string' },
+      group: { type: 'string' }, reason: { type: 'string' } } })
+    const installation = require('../src/c2install').loadInstallation(values.config,
+      { dataDir: values['data-dir'], allowAddedGroups: true })
+    const result = require('../src/c2incident').sealC2GroupIncident({ installation,
+      chatId: values.group, ...(values.reason !== undefined ? { reason: values.reason } : {}),
+      version: require('../package.json').version })
+    process.stdout.write(`Sealed the group's previous journal unchanged in ${result.incident}.\n` +
+      `${result.refusedSources} unsettled message(s) will not be processed again. ` +
+      'Start the service to reopen the group with a new journal.\n')
+    return
+  }
   if (sub === 'init') {
     const { values } = parseArgs({ args: rest, allowPositionals: false,
       options: { config: { type: 'string' }, 'data-dir': { type: 'string' } } })

package/docs/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.0 with an AI assistant
+# Install SintBot 1.4.1 with an AI assistant
 
 English · [简体中文](./zh-CN/AI-ASSISTED-INSTALL.md)
 
@@ -15,5 +15,5 @@ Use the terminal on the Mac that will run SintBot. A cloud shell cannot install
 ## Copyable request
 
 ```text
-Install SintBot 1.4.0 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
+Install SintBot 1.4.1 on this Mac using the one-line installation guide. Preserve existing services, configuration, state and Codex or Claude Code account data. Do not expose credentials. Verify the actual installed executable and binary core, configure the Feishu groups with their runners, and initialize only clean new state. Run the foreground preflight and an authorized read-only group test, check the result, then verify clean stop/restart. Stop temporary processes when finished, and distinguish package installation from successful group acceptance.
 ```

package/docs/install.md

@@ -1,4 +1,4 @@
-# Install SintBot 1.4.0
+# Install SintBot 1.4.1
 
 English · [简体中文](./zh-CN/install.md)
 
@@ -10,7 +10,7 @@ You need a Mac, Node.js 22 or newer, and projects stored on that Mac. Install an
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-The installer checks the environment, installs `sintbot@1.4.0` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.0`. No sudo is needed.
+The installer checks the environment, installs `sintbot@1.4.1` into `~/.local/share/sintbot`, and verifies the entry, built-in core and Feishu module. Continue when you see `Installed and verified SintBot 1.4.1`. No sudo is needed.
 
 To preview, append `-s -- --dry-run`. To choose another location, set `SINTBOT_INSTALL_DIR` and adjust the executable paths below.
 
@@ -98,11 +98,11 @@ Any text message is a task. Replies arrive in a card that appears once the model
 | `/hud` | Quota of the current model and usage of this conversation |
 | `/issue text` | Log feedback; review and close it in the console overview |
 
-Messages sent while a task runs are added to that task in Codex groups (`codexSteer: true`) and queued in Claude Code groups. If a turn returns a model error or no result, only that group is asked to resend; there is no automatic retry and other groups are unaffected.
+Messages sent while a task runs are added to that task in Codex groups (`codexSteer: true`) and queued in Claude Code groups. If a turn returns a model error or no result, only that group is asked to resend; there is no automatic retry. If a group's last result cannot be confirmed, such as a reply whose delivery is unknown, only that group is paused and answers new messages with a short notice; other groups keep working. Nothing is replayed or retried.
 
 ## 6. Console
 
-With `--ui`, open `http://127.0.0.1:4600` on this Mac. The console shows each group, stops tasks, binds new groups, and switches the model or project folder of an idle group. For LAN access, set a console password in its settings first, then enable LAN access.
+With `--ui`, open `http://127.0.0.1:4600` on this Mac. The console shows each group (a paused group shows Needs attention), stops tasks, binds new groups, and switches the model or project folder of an idle group. For LAN access, set a console password in its settings first, then enable LAN access.
 
 You can also add a group without the console: add it to the configuration, stop the service and run `start` again; the new group is registered automatically. Bound groups cannot be removed or renamed by editing the configuration.
 
@@ -114,6 +114,12 @@ Press Ctrl-C and wait for exit. With the Feishu variables set, run:
 "$HOME/.local/share/sintbot/bin/sintbot" start --config "$HOME/.sbot/config.json" --ui
 ```
 
-If startup reports an unsettled receipt or a result is uncertain, keep the journals and check what actually happened; never delete journals or resend to get around it. Run only one connected process per Feishu app. This release does not register a background service.
+If a group stays paused, first restart: a group whose records can recover reopens on its own and is told once to resend. If it is still paused, check what actually happened in that group, then stop the service and seal the group's incident:
+
+```bash
+"$HOME/.local/share/sintbot/bin/sintbot" incident seal --config "$HOME/.sbot/config.json" --group oc_PAUSED_GROUP_ID
+```
+
+Sealing keeps the old journal unchanged under `incidents/` in the data directory and gives the group a new journal; messages left unfinished before the seal are never processed again. Start the service again to reopen the group. A preflight fails while any group would stay paused. Never delete journals or resend to get around a paused group. Run only one connected process per Feishu app. This release does not register a background service.
 
 [Illustrated website guide](https://sintbot.com/guide/install/) · [AI-assisted installation](./AI-ASSISTED-INSTALL.md)

package/docs/zh-CN/AI-ASSISTED-INSTALL.md

@@ -1,4 +1,4 @@
-# 用 AI 助手安装 SintBot 1.4.0
+# 用 AI 助手安装 SintBot 1.4.1
 
 [English](../AI-ASSISTED-INSTALL.md) · 简体中文
 
@@ -15,5 +15,5 @@
 ## 可复制的请求
 
 ```text
-按一行安装指南，在这台 Mac 安装 SintBot 1.4.0。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
+按一行安装指南，在这台 Mac 安装 SintBot 1.4.1。保留已有服务、配置、状态和 Codex 或 Claude Code 账号数据，不输出凭据。验证实际入口与二进制核心，配置飞书群及各群的执行器，只对全新状态初始化。运行前台预检和已授权的只读群测试，对照结果，再验证正常停止与重启。完成后停止临时进程，并区分程序包安装与群验收结果。
 ```

package/docs/zh-CN/install.md

@@ -1,4 +1,4 @@
-# 安装 SintBot 1.4.0
+# 安装 SintBot 1.4.1
 
 [English](../install.md) · 简体中文
 
@@ -10,7 +10,7 @@
 curl -fsSL https://sintbot.com/install.sh | bash
 ```
 
-安装器会自动检查环境，把 `sintbot@1.4.0` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.0` 就可以继续。不需要 sudo。
+安装器会自动检查环境，把 `sintbot@1.4.1` 装到 `~/.local/share/sintbot`，并验证程序入口、内置核心和飞书模块。看到 `Installed and verified SintBot 1.4.1` 就可以继续。不需要 sudo。
 
 可选预览：在命令末尾加 `-s -- --dry-run`。要自定义安装位置，设置 `SINTBOT_INSTALL_DIR` 环境变量，并同步修改后面的可执行文件路径。
 
@@ -98,11 +98,11 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 | `/hud` | 当前模型的额度与本段对话的用量 |
 | `/issue 一句话` | 记下问题反馈，在控制台概览里查看和标记处理 |
 
-任务进行中再发的消息：Codex 群（`codexSteer: true`）会补充进当前任务，Claude Code 群会排队，等这一轮结束再处理。某一轮模型报错或没有结果时，只在本群提示重新发送，不会自动重试，也不影响其他群。
+任务进行中再发的消息：Codex 群（`codexSteer: true`）会补充进当前任务，Claude Code 群会排队，等这一轮结束再处理。某一轮模型报错或没有结果时，只在本群提示重新发送，不会自动重试。某个群上一轮的结果无法确认时（例如回复是否送达不明），只暂停这个群，它收到新消息会回一句说明，其他群照常；不重放、不重试。
 
 ## 6. 控制台
 
-带 `--ui` 启动后，在本机浏览器打开 `http://127.0.0.1:4600`。控制台可以查看各群状态、停止任务、绑定新群、给空闲的群切换模型或项目目录。要从局域网访问，先在控制台的设置里设访问密码，再开启局域网访问。
+带 `--ui` 启动后，在本机浏览器打开 `http://127.0.0.1:4600`。控制台可以查看各群状态（暂停的群显示「需要处理」）、停止任务、绑定新群、给空闲的群切换模型或项目目录。要从局域网访问，先在控制台的设置里设访问密码，再开启局域网访问。
 
 不用控制台也能加群：在配置里加上新群，停止后重新 `start` 即可，新群会自动登记。已绑定的群不能通过改配置删除或改名。
 
@@ -114,6 +114,12 @@ SINTBOT="$HOME/.local/share/sintbot/bin/sintbot"
 "$HOME/.local/share/sintbot/bin/sintbot" start --config "$HOME/.sbot/config.json" --ui
 ```
 
-如果启动提示有未结收据，或任务结果不明，保留日志并核对实际结果；不要通过删除日志或重复发送来绕过。一个飞书应用同一时间只运行一个连接进程。本版不自动注册后台服务。
+某个群一直暂停时，先重启：记录能恢复的群会自己重新开放，并提示一次重新发送。重启后仍暂停，先核对这个群实际发生了什么，再停止服务，封存这个群的事故记录：
+
+```bash
+"$HOME/.local/share/sintbot/bin/sintbot" incident seal --config "$HOME/.sbot/config.json" --group oc_暂停的群ID
+```
+
+封存会把原日志原样留在数据目录的 `incidents/` 下，并给这个群换一份新日志；封存前没处理完的消息不会再处理。再次启动服务，这个群就重新开放。有群会保持暂停时，预检会失败。不要通过删除日志或重复发送来绕过暂停。一个飞书应用同一时间只运行一个连接进程。本版不自动注册后台服务。
 
 [带图示的官网指南](https://sintbot.com/zh/guide/install/) · [AI 辅助安装](./AI-ASSISTED-INSTALL.md)

package/install.sh

@@ -2,7 +2,7 @@
 # The function is parsed in full before installation starts, including when piped.
 sintbot_install() (
   set -eu
-  version=1.4.0
+  version=1.4.1
   prefix="${SINTBOT_INSTALL_DIR:-$HOME/.local/share/sintbot}"
   fail() { printf 'SintBot: %s\n' "$*" >&2; exit 1; }
   case "${1:-}" in

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "sintbot",
-  "version": "1.4.0",
+  "version": "1.4.1",
   "private": false,
   "description": "Drive your Mac projects from Feishu groups with Codex or Claude Code, using a built-in agent core.",
   "bin": {
@@ -58,6 +58,7 @@
     "src/agent/winexec.js",
     "src/c2configcontrol.js",
     "src/c2console.js",
+    "src/c2incident.js",
     "src/c2install.js",
     "src/c2migration.js",
     "src/c2multigroupcapacity.js",

package/src/agent/claudecode.js

@@ -29,6 +29,11 @@ const { IS_WIN, resolveSpawn } = require('./winexec')
 const { tagError } = require('./errtag') // 出错原话 → quota / sessionMissing / transient 之一(优先级只在那一处定),与 codex runner 共用
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const PRE_INIT_HOOK_EVENTS = new Set(['hook_started', 'hook_response'])
 const DURABLE_EVENT_TYPES = new Set(['system', 'assistant', 'user', 'result', 'tool_result'])
 // Tool output is completion evidence only, never answer text.
@@ -451,7 +456,7 @@ function runTurn({
 
       const completeClose = (code) => finish(() => {
         if (code !== 0 && !lastResult && !aborted) {
-          return reject(new Error(`claude exited ${code}: ${stderr.trim().slice(0, 800) || '(no stderr)'}`))
+          return reject(closedError(new Error(`claude exited ${code}: ${stderr.trim().slice(0, 800) || '(no stderr)'}`)))
         }
         resolveRun({ sessionId: capturedSessionId, result: lastResult, code, aborted })
       })
@@ -524,4 +529,4 @@ function probeVersion(bin = 'claude') {
   })
 }
 
-module.exports = { runTurn, isClosedRunnerResult, buildEnv, normalizeEvent, probeVersion, supportsFlag, BASE_SKILL_ALLOWS }
+module.exports = { runTurn, isClosedRunnerResult, isClosedRunnerError, buildEnv, normalizeEvent, probeVersion, supportsFlag, BASE_SKILL_ALLOWS }

package/src/agent/codexapp.js

@@ -4,6 +4,11 @@
 const { spawn } = require('node:child_process')
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const { IS_WIN, resolveSpawn } = require('./winexec')
 const { normalizeEvent, isEffortRejection } = require('./codexcode')
 const { coreFailedResult, isCoreFailure } = require('./errtag')
@@ -439,7 +444,7 @@ function runTurn(opts = {}) {
     })
     const completeClose = (code) => settle(() => {
       if (onDurableEvent && !completed && !aborted) {
-        reject(new Error(`codex app-server exited ${code} before a durable result`))
+        reject(closedError(new Error(`codex app-server exited ${code} before a durable result`)))
         return
       }
       if (!completed && !aborted) {
@@ -467,4 +472,4 @@ function runTurn(opts = {}) {
   })
 }
 
-module.exports = { runTurn, isClosedRunnerResult, usageFromTotal, itemEvent, failedTurnEvent }
+module.exports = { runTurn, isClosedRunnerResult, isClosedRunnerError, usageFromTotal, itemEvent, failedTurnEvent }

package/src/agent/codexcode.js

@@ -13,6 +13,11 @@
 const { spawn } = require('node:child_process')
 const closedRunnerResults = new WeakSet()
 const isClosedRunnerResult = result => !!result && typeof result === 'object' && closedRunnerResults.has(result)
+// A rejection raised from the child's own 'close' event: the process has
+// exited even though the turn has no result. It never proves the turn's outcome.
+const closedRunnerErrors = new WeakSet()
+const isClosedRunnerError = error => !!error && typeof error === 'object' && closedRunnerErrors.has(error)
+const closedError = error => { closedRunnerErrors.add(error); return error }
 const { StringDecoder } = require('node:string_decoder')
 const { IS_WIN, resolveSpawn } = require('./winexec')
 const { tagError } = require('./errtag') // 出错原话 → quota / sessionMissing / transient 之一(优先级只在那一处定),与 claude runner 共用
@@ -398,11 +403,11 @@ function runOnce(opts, effort) {
 
     const completeClose = (code) => {
       if (onDurableEvent && code !== 0 && !lastResult && !aborted) {
-        done(() => reject(new Error(`codex exited ${code} before a durable result`)))
+        done(() => reject(closedError(new Error(`codex exited ${code} before a durable result`))))
         return
       }
       if (durableStart && !acceptedStart && !aborted && !acceptanceFailed) {
-        done(() => reject(new Error('Codex exited before turn.started acceptance')))
+        done(() => reject(closedError(new Error('Codex exited before turn.started acceptance'))))
         return
       }
       // Watch the answer→close (rollout-flush) lag. Healthy = ~2–3s (real-machine verified),
@@ -450,4 +455,4 @@ function probeVersion(bin = 'codex') {
   })
 }
 
-module.exports = { runTurn, runOnce, isClosedRunnerResult, probeVersion, normalizeEvent, parseCodexError, isEffortRejection, sandboxMode, buildArgs, buildPrompt }
+module.exports = { runTurn, runOnce, isClosedRunnerResult, isClosedRunnerError, probeVersion, normalizeEvent, parseCodexError, isEffortRejection, sandboxMode, buildArgs, buildPrompt }

package/src/c2configcontrol.js

@@ -17,10 +17,11 @@ const RESET_KEYS = ['provider', 'model', 'workdir', 'codexApp']
 // model, project or backend clears its session before the new configuration
 // is written, so no later turn can resume a session from another backend.
 // It never moves a journal, settles a receipt or reconnects the platform.
-function createC2ConfigControl({ installation, getBindings, assertWriterLock,
-  store = null, activateRoute = null, probeRunner = assertRunnerExecutable,
+function createC2ConfigControl({ installation, getBindings, getHeld = () => new Map(),
+  assertWriterLock, store = null, activateRoute = null, probeRunner = assertRunnerExecutable,
   log = () => {} } = {}) {
   if (!installation?.cfg?._path || typeof getBindings !== 'function' ||
+      typeof getHeld !== 'function' ||
       typeof assertWriterLock !== 'function' ||
       store !== null && typeof store.resetGroupSession !== 'function' ||
       activateRoute !== null && typeof activateRoute !== 'function' ||
@@ -72,11 +73,19 @@ function createC2ConfigControl({ installation, getBindings, assertWriterLock,
       throw new Error('Changing global concurrency requires a service restart')
     }
     const resets = [], activations = [], changed = []
+    const heldGroups = getHeld()
     for (const route of routes) {
       const target = next.routes.find(item => item.chatId === route.chatId)
       if (route.group.platform !== target.group.platform) {
         throw new Error('Moving a group to another platform requires an explicit state migration')
       }
+      if (heldGroups.has(route.chatId)) {
+        // Edits elsewhere proceed; the held group keeps its exact settings.
+        if (!isDeepStrictEqual(route.group, target.group)) {
+          throw new Error('This group is held after an unresolved fault; seal its incident and restart before changing it')
+        }
+        continue
+      }
       if (!isDeepStrictEqual(route.group, target.group)) changed.push(route.chatId)
       if (RESET_KEYS.some(key => !isDeepStrictEqual(route.group[key], target.group[key]))) {
         if (!store) throw new Error('Changing model or project requires session reset authority')

package/src/c2console.js

@@ -20,9 +20,9 @@ const WRITE_PATHS = ['/api/login', '/api/logout', '/api/logout/all',
   '/api/inbox/dismiss', '/api/issues/status']
 const SUPPORTED_RUNNERS = ['claude', 'codex']
 
-function createC2ConsoleFacade({ getBindings, getCapacity, getConfig,
+function createC2ConsoleFacade({ getBindings, getCapacity, getConfig, getHeld = () => new Map(),
   assertWriterLock, validateConfig, applyConfig, beforeWrite = () => true, now = Date.now } = {}) {
-  for (const callback of [getBindings, getCapacity, getConfig, assertWriterLock,
+  for (const callback of [getBindings, getCapacity, getConfig, getHeld, assertWriterLock,
     validateConfig, applyConfig, beforeWrite, now]) {
     if (typeof callback !== 'function') throw new TypeError('C2 console needs live authority and configuration hooks')
   }
@@ -45,10 +45,12 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig,
   function getLiveState() {
     const cfg = getConfig()
     const capacity = getCapacity()
+    const heldGroups = getHeld()
     const groups = {}
     let queue = 0
     for (const [chatId, group] of Object.entries(cfg.groups || {})) {
       const binding = bindings().get(chatId)
+      const hold = heldGroups.get(chatId)
       const rt = binding?.engine?.rts.get(chatId)
       const snapshot = binding?.journal?.snapshot()
       const pending = snapshot?.receipts?.pending || []
@@ -63,14 +65,17 @@ function createC2ConsoleFacade({ getBindings, getCapacity, getConfig,
         waitingForCapacity: !!rt?.v2AdmissionPending,
         sinceMs: rt?.v2StartedAt ? Math.max(0, now() - rt.v2StartedAt) : 0,
         sessionId: binding?.engine?.store?.getSession(chatId) || '',
+        // A held group needs the operator: its last result is unknown.
+        ...(hold ? { held: true, heldReason: hold.reason, heldSinceMs: Math.max(0, now() - hold.since) } : {}),
       }
     }
     const activeBindingsReady = Object.entries(cfg.groups || {})
-      .filter(([, group]) => !group.paused).every(([chatId]) => bindings().has(chatId))
+      .filter(([chatId, group]) => !group.paused && !heldGroups.has(chatId))
+      .every(([chatId]) => bindings().has(chatId))
     return { running: assertWriterLock() === true && !capacity.closed && activeBindingsReady,
       uptimeMs: Math.max(0, now() - startedAt),
       concurrency: { active: capacity.active, max: capacity.maxConcurrent },
-      queue, waiting: capacity.waiting, groups }
+      queue, waiting: capacity.waiting, held: heldGroups.size, groups }
   }
   function getActivity() {
     const cfg = getConfig(), items = []

package/src/c2incident.js

@@ -0,0 +1,125 @@
+'use strict'
+
+// Operator tool for a group the service holds after an unresolved fault.
+// With the service stopped and the writer lock held, it moves that group's
+// journal unchanged under <data>/incidents/, records the source messages it
+// left unsettled and the receipts it had settled, then gives the group a new
+// empty journal under the same mapped name. Nothing is settled, rewritten,
+// replayed or notified; every later start refuses those messages from
+// incident.json (see loadC2IncidentQuarantine).
+const fs = require('node:fs')
+const path = require('node:path')
+const { createHash } = require('node:crypto')
+const { C2DurableJournal } = require('./core/c2durablejournal')
+const { assertJournalScope, assertPrivateDirectory, VALIDATORS } = require('./c2install')
+
+const GROUP_ID = /^oc_[A-Za-z0-9_-]{1,124}$/
+const FEISHU_MESSAGE_ID = /^om_[A-Za-z0-9_-]{1,124}$/
+const SCHEMA = 'sbot-c2-incident-seal-v1'
+
+const sha256 = file => createHash('sha256').update(fs.readFileSync(file)).digest('hex')
+function privateFile(file, label) {
+  const st = fs.lstatSync(file)
+  if (!st.isFile() || st.isSymbolicLink() ||
+      typeof process.getuid === 'function' && st.uid !== process.getuid() ||
+      process.platform !== 'win32' && (st.mode & 0o077)) {
+    throw new Error(`${label} is not a private regular file owned by this user; preserve it and review`)
+  }
+  return st
+}
+function writeNew(file, value) {
+  const fd = fs.openSync(file, 'wx', 0o600)
+  try { fs.writeSync(fd, JSON.stringify(value, null, 2) + '\n'); fs.fsyncSync(fd) }
+  finally { fs.closeSync(fd) }
+}
+function fsyncDir(dir) {
+  const fd = fs.openSync(dir, 'r')
+  try { fs.fsyncSync(fd) } finally { fs.closeSync(fd) }
+}
+const pad = n => String(n).padStart(2, '0')
+function stamp(ms) {
+  const d = new Date(ms)
+  return `${d.getFullYear()}${pad(d.getMonth() + 1)}${pad(d.getDate())}-${pad(d.getHours())}${pad(d.getMinutes())}${pad(d.getSeconds())}`
+}
+
+function sealC2GroupIncident({ installation, chatId, reason = 'operator sealed a held group',
+  now = Date.now, acquireLock = require('./core/instancelock').acquire, version = '' } = {}) {
+  if (typeof chatId !== 'string' || !GROUP_ID.test(chatId)) {
+    throw new Error('Name the held group with --group oc_…')
+  }
+  if (typeof reason !== 'string' || !reason.trim() || reason.length > 500) {
+    throw new Error('The incident reason must be 1 to 500 characters')
+  }
+  const { stateDir, routes } = installation || {}
+  const route = routes?.find(item => item.chatId === chatId)
+  if (!route) throw new Error('This group is not in the configuration')
+  if ((installation.addedRoutes || []).some(item => item.chatId === chatId)) {
+    throw new Error('This group has no journal yet; nothing to seal')
+  }
+  assertPrivateDirectory(stateDir)
+  const lockFile = path.join(stateDir, 'daemon.lock')
+  const lock = acquireLock(lockFile)
+  if (!lock?.ok) throw new Error('The service is running; stop it before sealing an incident')
+  const held = () => {
+    try { return fs.readFileSync(lockFile, 'utf8').trim() === String(process.pid) } catch { return false }
+  }
+  try {
+    const file = route.file
+    const stat = privateFile(file, 'The group journal')
+    const before = { sha256: sha256(file), bytes: stat.size }
+    let journal
+    try { journal = C2DurableJournal.open(file, VALIDATORS) } catch (error) {
+      throw new Error(`The group journal cannot be read (${error.message}); preserve it unchanged and review it manually`)
+    }
+    const snapshot = assertJournalScope(journal, chatId)
+    let settled = true
+    try { assertJournalScope(journal, chatId, { requireSettled: true }) } catch { settled = false }
+    if (settled) throw new Error('This group journal is settled; nothing to seal. Start the service normally')
+    if (sha256(file) !== before.sha256) {
+      throw new Error('Opening the group journal changed it; preserve every file for review')
+    }
+    const pending = snapshot.receipts.pending
+    if (pending.some(item => item.source !== 'message' || !FEISHU_MESSAGE_ID.test(item.sourceId))) {
+      throw new Error('The journal holds a receipt that is not a Feishu message; review it manually')
+    }
+    const incidents = path.join(stateDir, 'incidents')
+    fs.mkdirSync(incidents, { recursive: true, mode: 0o700 })
+    fs.chmodSync(incidents, 0o700)
+    const sealedAt = now()
+    const dir = path.join(incidents, `${stamp(sealedAt)}-group-${chatId.slice(-8)}`)
+    fs.mkdirSync(dir, { mode: 0o700 })
+    writeNew(path.join(dir, 'incident.json'), { schema: SCHEMA, chatId,
+      journal: path.basename(file), sha256: before.sha256, bytes: before.bytes,
+      cursor: snapshot.cursor,
+      pending: pending.map(item => ({ id: item.id, sourceId: item.sourceId })),
+      completedReceiptIds: snapshot.receipts.completed.map(item => item.id),
+      sealedAt, reason: reason.trim(),
+      handling: 'frozen unchanged; receipts not settled; turn not replayed; source messages refused at admission from incident.json',
+      tool: 'sintbot incident seal', version })
+    if (!held()) throw new Error('The writer lock was lost before sealing; preserve every file for review')
+    const sealed = path.join(dir, path.basename(file))
+    fs.renameSync(file, sealed)
+    fsyncDir(stateDir); fsyncDir(dir)
+    if (sha256(sealed) !== before.sha256 || fs.existsSync(file)) {
+      throw new Error('The sealed journal differs; preserve every file for review')
+    }
+    if (!held()) throw new Error('The writer lock was lost before the new journal; preserve every file for review')
+    C2DurableJournal.initialize(file, { state: { version: 2, seq: 0, lanes: {} },
+      receipts: { pending: [], completed: [] } }, VALIDATORS)
+    fs.chmodSync(file, 0o600)
+    const fresh = C2DurableJournal.open(file, VALIDATORS)
+    const empty = assertJournalScope(fresh, chatId, { requireSettled: true })
+    if (fresh.blocked || empty.cursor !== 0 || empty.eventCount !== 0 ||
+        empty.receipts.pending.length || empty.receipts.completed.length ||
+        empty.effects.size || empty.notices.size || Object.keys(empty.state.lanes).length) {
+      throw new Error('New group journal verification failed; preserve every file for review')
+    }
+    const result = Object.freeze({ incident: dir, sealed, sealedSha256: before.sha256,
+      newJournal: file, newJournalSha256: sha256(file),
+      refusedSources: pending.length, settledRemembered: snapshot.receipts.completed.length })
+    writeNew(path.join(dir, 'result.json'), result)
+    return result
+  } finally { lock.release() }
+}
+
+module.exports = { sealC2GroupIncident }

package/src/c2install.js

@@ -201,7 +201,7 @@ function assertJournalScope(journal, chatId, { requireSettled = false } = {}) {
       Object.values(snap.state.lanes.queue || {}).some(lane => lane.queue.length) ||
       Object.values(snap.state.lanes.session || {}).some(lane => lane.settled !== true) ||
       ['terminal', 'stopIntent', 'cardCleanup', 'steer'].some(domain => Object.keys(snap.state.lanes[domain] || {}).length))) {
-    throw new Error('Paused group journal has unresolved work; preserve it and explicitly review recovery')
+    throw new Error('Group journal has unresolved work; preserve it and explicitly review recovery')
   }
   return snap
 }

package/src/c2multigroupservice.js

@@ -4,6 +4,8 @@ const { isC2InputRejection, answerC2InputRejection, rejectC2Input } = require('.
 const { coordinateC2GlobalFault } = require('./core/c2globalfault')
 
 const RECOVERING_NOTICE = '上一个任务出错，正在收尾，这条消息没有处理，请稍后重发。'
+const HELD_NOTICE = '本群上一个任务结果不明，已暂停处理，等待人工确认；其他群不受影响。'
+const reasonOf = error => String(error?.message || error || 'unknown').slice(0, 300)
 
 // Turns a group binding still holds: a running turn, a non-idle handoff or a
 // busy lifecycle. Scoped to one group's own journal.
@@ -23,12 +25,20 @@ function activeTurns(snapshot) {
   return turns.sort((a, b) => a.chatId.localeCompare(b.chatId))
 }
 
+const runtimesOf = binding => binding?.engine?.rts instanceof Map ? [...binding.engine.rts.values()] : []
+
 // Process-local organization only. Each binding owns a distinct durable
 // authority; the transport and writer lease belong to this single process.
+// A fault that only one group's journal can explain holds that group: its
+// sealed binding stays as evidence, nothing is replayed or retried, and every
+// other group keeps serving. Only a shared resource (writer lease, transport,
+// model capacity) stops the process. `holds` lists groups whose journal could
+// not be opened before the service was created.
 function createC2MultiGroupService({ routes, assertWriterLock,
   createTransport, createBinding, onFatal = () => {}, closeCapacity = () => {},
   quarantine = null, stopTimeoutMs = 2_000, drainTimeoutMs = 12_000,
-  createRecoveryAuthority = null, log = () => {} } = {}) {
+  createRecoveryAuthority = null, holds = new Map(), sharedFault = () => null,
+  now = Date.now, log = () => {} } = {}) {
   if (!Array.isArray(routes) || !routes.length ||
       new Set(routes.map(route => route.chatId)).size !== routes.length ||
       routes.some(route => !route || typeof route.chatId !== 'string' ||
@@ -36,7 +46,9 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       typeof assertWriterLock !== 'function' ||
       typeof createTransport !== 'function' || typeof createBinding !== 'function' ||
       typeof onFatal !== 'function' || typeof closeCapacity !== 'function' ||
-      typeof log !== 'function' ||
+      typeof log !== 'function' || typeof sharedFault !== 'function' ||
+      typeof now !== 'function' || !(holds instanceof Map) ||
+      [...holds.keys()].some(chatId => !routes.some(route => route.chatId === chatId)) ||
       createRecoveryAuthority !== null && typeof createRecoveryAuthority !== 'function' ||
       !Number.isSafeInteger(stopTimeoutMs) || stopTimeoutMs < 1 ||
       !Number.isSafeInteger(drainTimeoutMs) || drainTimeoutMs < 1) {
@@ -44,6 +56,8 @@ function createC2MultiGroupService({ routes, assertWriterLock,
   }
   const configured = new Map(routes.map(route => [route.chatId, route]))
   const bindings = new Map()
+  // chatId -> { reason, source: 'startup' | 'runtime', since, binding }
+  const suspended = new Map()
   let transport = null
   let started = false
   let starting = false
@@ -92,7 +106,8 @@ function createC2MultiGroupService({ routes, assertWriterLock,
         () => transport.stopPlatform(), stopTimeoutMs) === true
       const drained = (await Promise.all([...bindings.values()].map(binding =>
         bounded(() => binding.engine.drainDurableV2(drainTimeoutMs), drainTimeoutMs + 100))))
-        .every(value => value === true)
+        .every(value => value === true) && [...suspended.values()].every(entry =>
+        runtimesOf(entry.binding).every(rt => !rt.v2Controller))
       return Object.freeze({ reason, code: code === 0 && startupStopped && platformStopped && drained ? 0 : 1,
         startupStopped, platformStopped, drained })
     })()
@@ -105,6 +120,22 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     await onFatal(error, result)
     return result
   }
+  // Seal one group in place. Its binding and journal are kept unchanged as
+  // evidence; a later restart reopens it only through the normal recovery
+  // gate, or after its incident has been sealed by the operator.
+  function suspend(chatId, error, { source, binding = null }) {
+    if (suspended.has(chatId)) return suspended.get(chatId)
+    const entry = Object.freeze({ reason: reasonOf(error), source, since: now(), binding })
+    suspended.set(chatId, entry)
+    for (const sealed of new Set([binding, bindings.get(chatId)])) {
+      if (!sealed) continue
+      try { sealed.gate.stop() } catch {}
+      try { sealed.engine.shutdown() } catch {}
+    }
+    bindings.delete(chatId)
+    log(`group ${chatId}: held (${entry.reason}); other groups keep serving`)
+    return entry
+  }
   function allowed(chatId) {
     const route = configured.get(chatId)
     if (!route || route.paused === true) return false
@@ -155,6 +186,34 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     work.then(() => recovering.delete(chatId), () => recovering.delete(chatId))
     return work
   }
+  // One group's route, recall or ingress failed. Close the failed turn when
+  // its journal proves every effect; otherwise hold the group alone. Returns
+  // 'recovered', 'held', 'fatal' (process stop begun) or 'stopping'.
+  async function groupFault(chatId, binding, error) {
+    const shared = () => !writerHeld() ? 'writer lock lost' : sharedFault()
+    if (shared()) { await fatal(error); return 'fatal' }
+    if (!started || stopPromise) return 'stopping'
+    if (suspended.has(chatId)) return 'held'
+    const current = bindings.get(chatId)
+    if (!binding || current !== binding && !failedBindings.has(binding)) {
+      // An error from a binding this service never published is not attributable.
+      await fatal(error); return 'fatal'
+    }
+    if (!createRecoveryAuthority) { await fatal(error); return 'fatal' }
+    try {
+      await recoverGroup(chatId, binding, error)
+    } catch (failure) {
+      log(`group ${chatId}: failed turn could not be closed: ${reasonOf(failure)}`)
+      if (shared()) { await fatal(failure); return 'fatal' }
+      if (!started || stopPromise) return 'stopping'
+      suspend(chatId, failure, { source: 'runtime', binding })
+    }
+    return suspended.has(chatId) ? 'held' : 'recovered'
+  }
+  function heldReply(msg, sourceAdapter) {
+    return answerC2InputRejection({ error: rejectC2Input('C2 group held',
+      { reason: 'group-held', notice: HELD_NOTICE }), msg, platform: sourceAdapter, log })
+  }
   // Open one more group on the live transport: a newly added route or one
   // paused since startup. It runs the same recovery gate as startup; only a
   // fully opened binding is published. Failure leaves the group unserved.
@@ -162,13 +221,16 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     if (!route || typeof route.chatId !== 'string' || typeof route.file !== 'string') {
       return Promise.reject(new TypeError('C2 online route needs an explicit group and journal'))
     }
+    if (suspended.has(route.chatId)) {
+      return Promise.reject(new Error('This group is held after an unresolved fault; seal its incident and restart'))
+    }
     if (bindings.has(route.chatId)) return Promise.resolve(bindings.get(route.chatId))
     if (activating.has(route.chatId)) return activating.get(route.chatId)
     const opening = (async () => {
       if (!started || starting || stopPromise) throw new Error('C2 service is not serving')
       held()
       const binding = await createBinding({ route, transport })
-      if (!started || stopPromise || !writerHeld() ||
+      if (!started || stopPromise || !writerHeld() || suspended.has(route.chatId) ||
           !binding || !binding.gate || !binding.engine || binding.gate.blocked) {
         binding?.gate?.stop?.()
         binding?.engine?.shutdown?.()
@@ -184,6 +246,12 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     return opening
   }
   function routeMessage(msg, sourceAdapter) {
+    const route = configured.get(msg?.chatId)
+    if (route && route.paused !== true && suspended.has(msg.chatId)) {
+      // A held group admits nothing; a replay of a sealed source stays silent.
+      if (quarantine?.rejects(msg)) return { quarantined: true }
+      if (started && !stopPromise) return heldReply(msg, sourceAdapter)
+    }
     // Foreign/paused group events are not faults and never get a receipt.
     if (!allowed(msg?.chatId)) return { ignored: true, reason: 'unconfigured-or-paused' }
     if (quarantine?.rejects(msg)) return { quarantined: true }
@@ -192,32 +260,46 @@ function createC2MultiGroupService({ routes, assertWriterLock,
       return answerC2InputRejection({ error: rejectC2Input('C2 group recovering',
         { reason: 'group-recovering', notice: RECOVERING_NOTICE }), msg, platform: sourceAdapter, log })
     }
+    let binding
     try {
       held()
-      const binding = bindings.get(msg.chatId)
-      if (!started || starting || stopPromise || !binding || binding.gate.blocked) {
+      binding = bindings.get(msg.chatId)
+      if (!started || starting || stopPromise || !binding) {
         throw new Error('C2 group ingress authority closed')
       }
+      if (binding.gate.blocked) {
+        // A turn still running under a closed authority delivers its own
+        // rejection; until then this message, which has no receipt, is
+        // refused. An idle closed group is closed as its own fault here.
+        if (runtimesOf(binding).some(rt => rt.v2NormalRouteActive)) {
+          return answerC2InputRejection({ error: rejectC2Input('C2 group closing',
+            { reason: 'group-recovering', notice: RECOVERING_NOTICE }), msg, platform: sourceAdapter, log })
+        }
+        return groupFault(msg.chatId, binding, new Error('C2 group ingress authority closed'))
+          .then(async outcome => {
+            if (outcome === 'held') return heldReply(msg, sourceAdapter)
+            if (outcome === 'recovered') {
+              return answerC2InputRejection({ error: rejectC2Input('C2 group recovered',
+                { reason: 'group-recovering', notice: RECOVERING_NOTICE }), msg, platform: sourceAdapter, log })
+            }
+            throw new Error('C2 group ingress authority closed')
+          })
+      }
       const running = binding.engine.runDurableV2Message(msg, sourceAdapter)
       return Promise.resolve(running).catch(async error => {
         // A refused command or premature /stop wrote nothing durable. Answer it
-        // once and keep every group serving; any other error stays fatal.
+        // once and keep every group serving.
         if (isC2InputRejection(error) && started && !stopPromise &&
             !binding.gate.blocked && writerHeld()) {
           log(`group ${msg.chatId}: refused input before receipt (${error.reason})`)
           return answerC2InputRejection({ error, msg, platform: sourceAdapter, log })
         }
-        // A closed model turn that failed (error or empty result) is closed for
-        // this group alone. Other errors from that same superseded binding are
-        // part of the same fault and wait for its recovery.
-        if (createRecoveryAuthority && started && !stopPromise &&
-            (failedBindings.has(binding) ||
-              error?.code === 'C2_V2_UNRESOLVED_TURN' && bindings.get(msg.chatId) === binding)) {
-          const recovered = await recoverGroup(msg.chatId, binding, error).then(() => true, failure => {
-            log(`group ${msg.chatId}: failed turn could not be closed: ${failure?.message || String(failure)}`)
-            return false
-          })
-          if (recovered) return { recovered: true, reason: 'group-fault-closed' }
+        // Any other route error belongs to this group alone unless a shared
+        // resource failed. Errors from a superseded binding join its fault.
+        if (started && !stopPromise) {
+          const outcome = await groupFault(msg.chatId, binding, error)
+          if (outcome === 'recovered') return { recovered: true, reason: 'group-fault-closed' }
+          if (outcome === 'held') return { held: true, reason: 'group-held' }
         }
         await fatal(error)
         throw error
@@ -236,15 +318,22 @@ function createC2MultiGroupService({ routes, assertWriterLock,
     }
   }
   function recall(event) {
+    if (suspended.has(event?.chatId)) return { ignored: true, reason: 'group-held' }
     if (!allowed(event?.chatId)) return { ignored: true }
+    let binding
     try {
       held()
-      const binding = bindings.get(event.chatId)
+      binding = bindings.get(event.chatId)
       if (!started || stopPromise || !binding) return { ignored: true, reason: 'ingress-closed' }
       const handled = binding.engine.handleRecall?.(event) === true
       if (binding.runtime?.blocked) throw new Error('Recall closed its durable authority')
       return handled ? { handled: true } : { ignored: true, reason: 'unsupported-or-inactive-recall' }
-    } catch (error) { return fatal(error) }
+    } catch (error) {
+      if (!binding || !writerHeld() || !started || stopPromise) return fatal(error)
+      return groupFault(event.chatId, binding, error).then(outcome =>
+        outcome === 'recovered' || outcome === 'held'
+          ? { ignored: true, reason: `group-${outcome}` } : fatal(error))
+    }
   }
   async function start({ preflightOnly = false } = {}) {
     if (started || starting || stopPromise) throw new Error('C2 service already started or stopped')
@@ -260,9 +349,19 @@ function createC2MultiGroupService({ routes, assertWriterLock,
           typeof transport.stopPlatform !== 'function') {
         throw new TypeError('C2 transport lacks a single start/stop boundary')
       }
+      for (const [chatId, reason] of holds) suspend(chatId, reason, { source: 'startup' })
       for (const route of routes) {
-        if (route.paused) continue // Its settled journal is audited before start.
-        const binding = await createBinding({ route, transport })
+        if (route.paused || suspended.has(route.chatId)) continue // Paused journals are audited before start.
+        let binding
+        try {
+          binding = await createBinding({ route, transport })
+        } catch (error) {
+          held()
+          if (stopPromise) throw new Error('C2 service stopped during group recovery')
+          // This group's journal could not be recovered; it alone stays closed.
+          suspend(route.chatId, error, { source: 'startup' })
+          continue
+        }
         held()
         if (stopPromise) {
           binding?.gate?.stop?.()
@@ -273,11 +372,19 @@ function createC2MultiGroupService({ routes, assertWriterLock,
         if (!binding || !binding.gate || !binding.engine || binding.gate.blocked) {
           binding?.gate?.stop?.()
           binding?.engine?.shutdown?.()
-          throw new Error('C2 group binding did not open its durable authority')
+          suspend(route.chatId, 'C2 group binding did not open its durable authority', { source: 'startup' })
+          continue
         }
         bindings.set(route.chatId, binding)
       }
       held()
+      const heldList = [...suspended].map(([chatId, entry]) => `${chatId}: ${entry.reason}`)
+      if (preflightOnly && heldList.length) {
+        throw new Error(`Startup preflight would hold ${heldList.length} group(s): ${heldList.join('; ')}`)
+      }
+      if (heldList.length && !bindings.size) {
+        throw new Error(`Every active group is held: ${heldList.join('; ')}`)
+      }
       if (preflightOnly) {
         finishStartup()
         await stop('preflight', 0)
@@ -291,14 +398,21 @@ function createC2MultiGroupService({ routes, assertWriterLock,
         onCardAction: unsupported('card action'), onBoardUpdated: unsupported('board update') })
       held()
       if (stopPromise) throw new Error('C2 service stopped during connection')
-      return { groups: bindings.size, connected: true }
+      return { groups: bindings.size, connected: true, ...(suspended.size ? { held: heldGroups() } : {}) }
     } catch (error) {
       finishStartup()
       await stop('startup-failed', 1)
       throw error
     } finally { starting = false; finishStartup() }
   }
-  return { start, stop, routeMessage, addRoute, get bindings() { return new Map(bindings) } }
+  function heldGroups() {
+    return [...suspended].map(([chatId, entry]) => Object.freeze({ chatId,
+      reason: entry.reason, source: entry.source, since: entry.since }))
+  }
+  return { start, stop, routeMessage, addRoute, heldGroups,
+    get bindings() { return new Map(bindings) },
+    get held() { return new Map([...suspended].map(([chatId, entry]) =>
+      [chatId, { reason: entry.reason, source: entry.source, since: entry.since }])) } }
 }
 
 module.exports = { createC2MultiGroupService }

package/src/core/c2sourcequarantine.js

@@ -29,14 +29,21 @@ function createC2V2SourceQuarantine(value, { required = false } = {}) {
 
 // Every sealed incident under <data>/incidents/*/incident.json keeps its
 // unsettled source messages out of admission for that group, on every start.
-// A malformed seal stops startup: an unreadable fence cannot be skipped.
+// A seal written by `sintbot incident seal` also lists the receipts its
+// journal had already settled, so the group's new journal never runs one of
+// those messages again. A malformed seal stops startup: an unreadable fence
+// cannot be skipped.
 const CHAT_ID = /^oc_[A-Za-z0-9_-]{1,124}$/
+const RECEIPT_ID = /^[0-9a-f]{32}$/
 function loadC2IncidentQuarantine(stateDir, { fs = require('node:fs'), path = require('node:path') } = {}) {
   if (typeof stateDir !== 'string' || !path.isAbsolute(stateDir)) {
     throw new TypeError('C2 incident quarantine needs the installation directory')
   }
   const root = path.join(stateDir, 'incidents')
+  // Loaded here so the source quarantine above stays a standalone module.
+  const { taskId } = require('./enginecheckpoint')
   const byChat = new Map()
+  const settled = new Map()
   const fail = name => { throw new Error(`Sealed incident record is invalid: ${name}; preserve it and review`) }
   let entries = []
   try { entries = fs.readdirSync(root, { withFileTypes: true }) }
@@ -53,14 +60,26 @@ function loadC2IncidentQuarantine(stateDir, { fs = require('node:fs'), path = re
     try { record = JSON.parse(fs.readFileSync(file, 'utf8')) } catch { fail(entry.name) }
     if (record?.schema !== 'sbot-c2-incident-seal-v1' || !CHAT_ID.test(record.chatId || '') ||
         !Array.isArray(record.pending) ||
-        record.pending.some(item => !FEISHU_MESSAGE_ID.test(item?.sourceId || ''))) fail(entry.name)
+        record.pending.some(item => !FEISHU_MESSAGE_ID.test(item?.sourceId || '')) ||
+        record.completedReceiptIds !== undefined && (!Array.isArray(record.completedReceiptIds) ||
+          record.completedReceiptIds.some(id => typeof id !== 'string' || !RECEIPT_ID.test(id)))) fail(entry.name)
     const ids = byChat.get(record.chatId) || new Set()
     for (const item of record.pending) ids.add(item.sourceId)
     byChat.set(record.chatId, ids)
+    if (record.completedReceiptIds?.length) {
+      const done = settled.get(record.chatId) || new Set()
+      for (const id of record.completedReceiptIds) done.add(id)
+      settled.set(record.chatId, done)
+    }
   }
   const sourceIds = Object.freeze([...byChat.values()].flatMap(ids => [...ids]))
+  const settledBefore = message => {
+    const done = settled.get(message?.chatId)
+    if (!done || typeof message.msgId !== 'string' || !message.msgId) return false
+    return done.has(taskId({ source: 'message', chatId: message.chatId, sourceId: message.msgId }))
+  }
   return Object.freeze({ sourceIds,
-    rejects: message => !!byChat.get(message?.chatId)?.has(message?.msgId) })
+    rejects: message => !!byChat.get(message?.chatId)?.has(message?.msgId) || settledBefore(message) })
 }
 
 module.exports = { createC2V2SourceQuarantine, loadC2IncidentQuarantine }

package/src/core/v2engine.js

@@ -596,6 +596,7 @@ async runDurableV2Message(msg, platform) {
     rt.v2NormalRouteActive = true
     const execute = async () => {
       let release = null
+      let failed = false
       try {
         let receiptId = accepted.receiptId
         if (this.durableV2AcquireCapacity) {
@@ -628,12 +629,13 @@ async runDurableV2Message(msg, platform) {
         // Seal shared grants before releasing this turn's permit. Waiting
         // siblings must not dispatch in the microtask before the service sees
         // this rejection and begins its process-wide stop.
+        failed = true
         this.durableV2SealCapacity?.(error)
         throw error
       } finally {
         rt.v2AdmissionPending = false
         rt.v2AdmissionController = null
-        release?.()
+        if (release) this._releaseDurableV2Capacity(rt, release, failed)
       }
     }
     const execution = execute()
@@ -649,6 +651,24 @@ async runDurableV2Message(msg, platform) {
     }
   }
 
+// A failed route returns its shared model permit only once its runner is
+// proven closed or proven never started. Otherwise the permit stays taken
+// until the process exits, so a sibling group never runs beside a child that
+// may still be alive.
+_releaseDurableV2Capacity(rt, release, failed) {
+    const closed = () => !rt.v2Controller && (rt.v2RunnerStopVerified === true ||
+      rt.v2RunnerNotStarted === true)
+    const stop = rt.v2RunnerStopPromise
+    if (!failed || !rt.v2Controller && (!stop || closed())) return release()
+    const kept = () => this.log(`group ${rt.chatId}: model permit kept until restart; runner close unproven`)
+    if (!stop) return kept()
+    stop.then(() => {
+      if (!closed()) return kept()
+      // A failed binary release closes the shared capacity itself.
+      try { release() } catch (error) { this.log(`group ${rt.chatId}: model permit release failed: ${error.message}`) }
+    }, kept)
+  }
+
 async _runDurableV2Steer(rt, receiptId) {
     const authority = this.durableV2Runtime
     const chatId = rt.chatId
@@ -1323,6 +1343,7 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
       rt.v2Controller = controller
       rt.v2RunnerStopPromise = null
       rt.v2RunnerStopVerified = false
+      rt.v2RunnerNotStarted = false
       let streamChain = Promise.resolve()
       let streamFailure = null
       const enqueueFrame = event => {
@@ -1508,6 +1529,7 @@ async startDurableV2Runner({ chatId, receiptId, turnToken, effectId } = {}) {
         rt.v2RunnerGeneration = null
         rt.v2RunningJobs = null
         rt.v2DispatchEffect = null
+        rt.v2RunnerNotStarted = true
         return { effectId, accepted: false, startFailureRecovered: true }
       }
       if (capability && !accepted) {

package/src/ui/console.html

@@ -392,6 +392,7 @@ code{font-family:var(--mono);font-size:.95em} /* 中文说明里内嵌的命令/
 }
 .tag{font-family:var(--mono);font-size:10.5px;letter-spacing:.5px;padding:3px 8px;border-radius:5px;border:1px solid var(--tag-line,var(--line-hi));color:var(--tag-ink,var(--dim));background:var(--tag-bg,transparent);white-space:nowrap}
 .tag.busy{color:var(--ember);border-color:rgba(var(--ember-rgb),.4);box-shadow:0 0 10px rgba(var(--ember-rgb),.12) inset}
+.tag.held{color:var(--fail);border-color:rgba(var(--fail-rgb),.42);background:rgba(var(--fail-rgb),.08)}
 .tag.idle{color:var(--ok);border-color:rgba(var(--ok-rgb),.28)}
 .tag.pz{color:var(--muted);border-color:var(--line-hi);background:transparent}  /* 暂停态:中性灰,不是错误(bad 红留给真异常) */
 .card.gpaused{opacity:.55;transition:opacity .15s}  /* 暂停群卡整体降透明度示意下线;hover 提回可读 —— 配置项不禁用,暂停期间照样可调 */
@@ -1353,9 +1354,9 @@ function updateOverviewLive(){
   const a=$('#ovActive'); if(a)a.textContent=active;
   const q=$('#ovQueue'); if(q)q.textContent=live.queue||0;
   $$('#overview [data-g]').forEach(el=>{const lv=(live.groups&&live.groups[el.dataset.g])||{};
-    el.className='tag glive '+(lv.busy?'busy':'idle');
-    el.textContent=lv.queueFaulted?'待处理异常':lv.waitingForCapacity?'等待容量':lv.finalizing?'收尾中':(lv.busy?('busy '+(lv.sinceMs?Math.round(lv.sinceMs/1000)+'s':'')):'idle');
-    el.title=(S.runtimeCapabilities?(lv.queueFaulted?'服务当前未开放此群':lv.waitingForCapacity?'消息已登记，等待并发名额':lv.finalizing?'正在确认发送与结账结果':lv.busy?'运行中':'空闲'):(lv.finalizing?'答案已发送 · 进程收尾中(新消息会排队)':(lv.busy?'运行中':'空闲')))+(lv.sessionId?(' · 会话 #'+String(lv.sessionId).slice(-6)):' · 无会话');});
+    el.className='tag glive '+(lv.held?'held':lv.busy?'busy':'idle');
+    el.textContent=lv.held?'需要处理':lv.queueFaulted?'待处理异常':lv.waitingForCapacity?'等待容量':lv.finalizing?'收尾中':(lv.busy?('busy '+(lv.sinceMs?Math.round(lv.sinceMs/1000)+'s':'')):'idle');
+    el.title=lv.held?('上一个任务结果不明，此群已暂停，其他群照常。原因：'+(lv.heldReason||'未知')+'。处理：先重启服务，能自动收尾的会恢复；重启后仍需处理，再停止服务，运行 sintbot incident seal --group '+el.dataset.g+'，然后启动。'):(S.runtimeCapabilities?(lv.queueFaulted?'服务当前未开放此群':lv.waitingForCapacity?'消息已登记，等待并发名额':lv.finalizing?'正在确认发送与结账结果':lv.busy?'运行中':'空闲'):(lv.finalizing?'答案已发送 · 进程收尾中(新消息会排队)':(lv.busy?'运行中':'空闲')))+(lv.sessionId?(' · 会话 #'+String(lv.sessionId).slice(-6)):' · 无会话');});
   // Self-heal stuck 'running' rows: a done SSE frame can be lost on a reconnect gap and
   // SSE has no replay, so the row would spin forever. Per-group turns are serialized, so a
   // 'running' row whose group is no longer busy has finished (busy=false ⇔ the turn settled
@@ -4029,6 +4030,7 @@ updateThemeBtn();
 /* I18N_DICT_BEGIN —— 合并翻译片段时整块替换这两个数组,不要改此标记之外的代码
    ⚠ 正则一律 ^…$ 整串、不加 g 标志;更具体的条目必须排在泛化条之前。 */
 const I18N_EN=[
+  ["需要处理", "Needs attention"],
   ["当前可用操作", "Available controls"],
   ["当前支持多群消息、流式卡片回复、忙时跟进、停止任务、状态查看、认证管理、绑定新群，以及空闲群的模型（Codex / Claude Code）和项目目录切换。新会话、解除绑定、控制台插话、定时任务、生图、画布、预览与升级暂不可用。", "Available: group messages, streaming reply cards, busy-turn followups, stopping tasks, live status, authentication, binding new groups, and switching the model (Codex / Claude Code) or project of an idle group. New sessions, unbinding, console messages, schedules, image generation, canvas, previews and upgrades are unavailable."],
   ["可绑定新群，修改模型、项目目录、权限、数据输出和忙时跟进；该群须没有进行中的任务和未结记录。切模型或项目会开始新的一段对话。停止任务在「概览」。群里发 /model 也能切换模型。", "Bind new groups and change the model, project folder, permissions, data display and busy-turn followups of a group with no running task or unsettled record. Changing the model or project starts a new conversation. Stop tasks in Overview. Members can also switch models with /model in the group."],