wezard 2.6.2 → 2.6.4

package/dist/daemon/receipts.js

@@ -26,6 +26,8 @@ const DEADLINE_MIN_SEC = 60;
 const DEADLINE_MAX_SEC = 12 * 3600;
 /** 交接把义务转进新会话时, 至少再给它这么久: 不然对方一交接, 这份就提前超时。 */
 const CARRY_GRACE_MS = 10 * 60_000;
+/** The same accepted quoting/whitespace syntax applies at every turn lookup. */
+export const canonicalTurn = (turn) => turn.replace(/[`\s]/g, "");
 /** 一件活的编号: 注入之前生成, 写进信封, 回执按它定位答句。 */
 export const newTurn = () => `t${randomBytes(3).toString("hex")}`;
 /** `at` 发出、给了 `sec` 秒 (缺省 / 越界取默认或夹到边上) 的期限。 */
@@ -62,21 +64,32 @@ const sameK = (a, b) => kAttr(a) === kAttr(b);
 /** 落盘的登记留多久。比对方最长允许干的时长宽, 好让续守的那一份仍数得进工单。 */
 const KEEP_MS = 24 * 3600_000;
 export const createReceipts = (deps) => {
+    let stopped = false;
+    let writeFailed = false;
     const keyOfPair = (from, to) => `${from}\u0000${to}`;
     const keyOfTurn = (from, to, turn) => `${keyOfPair(from, to)}\u0000${turn}`;
     const keyOf = (s) => (s.parked ? keyOfTurn(s.from, s.to, s.turn ?? "") : keyOfPair(s.from, s.to));
-    const live = (s) => Date.now() - s.at < KEEP_MS;
+    const live = (s) => !s.settled || Date.now() - s.at < KEEP_MS || !!s.inbox?.some((m) => ["queued", "delivering", "uncertain"].includes(m.state));
     // 过了保留期的行开机时从盘上抹掉: 同一对的位置会被下一句覆盖, 按件号停放的不会。
     Object.entries(deps.store?.all() ?? {}).filter(([, s]) => !live(s)).forEach(([key]) => deps.store?.drop(key));
-    const slots = new Map(Object.values(deps.store?.all() ?? {}).filter(live).map((s) => [keyOf(s), s]));
+    const slots = new Map(Object.values(deps.store?.all() ?? {}).filter(live).map((s) => { const row = structuredClone(s); return [keyOf(row), row]; }));
     const holds = new Map(Object.values(deps.holdStore?.all() ?? {}).map((h) => [keyOfTurn(h.from, h.to, h.turn), h]));
     /** 写穿到磁盘。被同一对的新一句顶掉的旧 slot 不写 —— 它的 key 已经归新的了。 */
-    const save = (s) => {
-        if (!stale(s))
-            deps.store?.set(keyOf(s), s);
+    const persist = (rows) => {
+        if (writeFailed)
+            throw new Error("receipt persistence failed; consumers paused for reconciliation");
+        try {
+            deps.store?.merge(structuredClone(rows));
+        }
+        catch (e) {
+            writeFailed = true;
+            throw e;
+        }
     };
+    const save = (s) => { if (!stale(s))
+        persist({ [keyOf(s)]: s }); };
     const settle = (s) => { s.settled = true; save(s); };
-    const stale = (s) => slots.get(keyOf(s))?.gen !== s.gen;
+    const stale = (s) => stopped || slots.get(keyOf(s)) !== s;
     /** `to` 答 `k` 那件活的那一份 —— 在 `from→to` 的位置上, 或已按件号停放。 */
     const upstream = (k, to) => [slots.get(keyOfPair(k.from, to)), slots.get(keyOfTurn(k.from, to, k.turn))].find((p) => p?.turn === k.turn);
     const ofJob = (from, job) => [...slots.values()].filter((x) => x.from === from && x.job === job);
@@ -132,20 +145,12 @@ export const createReceipts = (deps) => {
         if (p)
             wake(p);
     };
-    // 同一个 pane 的回执串行投递。两份回执同时等到发话方 idle 时, 两次 paste 会挤进
-    // 同一个输入框被当成一轮读掉 —— 正是异步化最容易带进来的那个故障。
-    const chains = new Map();
-    const serial = (k, job) => {
-        const next = (chains.get(k) ?? Promise.resolve()).then(job, job);
-        chains.set(k, next.catch(() => undefined));
-        return next;
-    };
     // 一份 slot 同时只有一个 watcher: reload 续守与 relay 叫醒可能撞在一起, 两个 watcher
     // 会把同一个答案投两遍。叫醒挂起的那份要 `force`: 挂起那一刻旧 watcher 已经同步返回,
     // 只是 finally 还没跑; 用 token 免得旧的 finally 删掉新登记的那个。
     const watching = new Map();
     const arm = (s, force = false) => {
-        if (watching.has(s) && !force)
+        if (s.queued || (watching.has(s) && !force))
             return;
         const token = Symbol();
         watching.set(s, token);
@@ -253,9 +258,191 @@ export const createReceipts = (deps) => {
             silent: `它停下了 ${MAX_FRUITLESS} 次, 都没答这一句`,
             dead: "它的 pane 没了",
         };
-        const last = deps.lastWords?.(s.to, s.at).trim();
+        // An answer transfer belongs to a specific human turn. The target may have
+        // handled another person's message since then, so a time-only transcript
+        // tail can disclose that unrelated message in the failure receipt.
+        const last = (s.answerTransfer
+            ? (s.turn ? deps.replyFor(s.to, deps.nameOf(s.from), s.at, s.turn)?.text : undefined)
+            : !s.turn ? deps.lastWords?.(s.to, s.at) : undefined)?.trim();
         return `（守护进程: ${deps.nameOf(s.to)} 没有给出结论 —— ${why[status] ?? status}。）${last ? `\n它最后说的: ${clipMiddle(last, 600)}` : ""}`;
     };
+    // Inbox consumers are independent of outcome watchers. One consumer per asker
+    // waits for that pane; every other asker can consume while it is busy/offline.
+    let mailOrder = Math.max(0, ...[...slots.values()].flatMap((s) => (s.inbox ?? []).map((m) => m.order)));
+    const consumers = new Set();
+    const retryTimers = new Map();
+    const mails = (from) => [...slots.values()].filter((s) => !from || s.from === from)
+        .flatMap((s) => (s.inbox ?? []).map((mail) => ({ s, mail })));
+    const queued = (from) => mails(from).filter(({ mail }) => mail.state === "queued")
+        .sort((a, b) => a.mail.order - b.mail.order);
+    const activeMail = (s, m) => !writeFailed && !stale(s)
+        && !!s.inbox?.includes(m) && ["queued", "delivering"].includes(m.state);
+    const retry = (s, m, reason) => {
+        m.state = "queued";
+        m.reason = reason;
+        m.retryAt = Date.now() + Math.min(30_000, (deps.retryMs ?? 1000) * 2 ** Math.min(m.attempts, 5));
+        s.undelivered = true;
+        save(s);
+    };
+    const account = (s, m) => {
+        if (m.accounted)
+            return;
+        deps.onOutcome?.(s, m.outcome.status, m.outcome.body, false);
+        if (isTerminal(m.outcome.status) && s.job)
+            deps.settleJob?.(s.job, s.to, m.outcome.status, parseClosing(m.outcome.body).artifacts, { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
+        m.accounted = true;
+        save(s);
+        if (isTerminal(m.outcome.status))
+            nudgeHolds();
+    };
+    // The ACK is durable before waking a parent. Replay only the local relay after
+    // a crash between these writes, never the external paste.
+    const finishMail = (s, m) => {
+        if (m.state !== "delivered" || m.relayed)
+            return;
+        const k = m.meta?.replyTo;
+        const p = k?.kind === "peer" ? upstream(k, s.from) : undefined;
+        if (p && !p.resolved && !p.claimed && m.sentAt !== undefined && (p.deferred || p.at < m.sentAt))
+            relay(p, m.sentAt);
+        m.relayed = true;
+        save(s);
+    };
+    const consume = async (from) => {
+        while (!stopped && !writeFailed) {
+            const next = queued(from)[0];
+            if (!next)
+                return;
+            const { s, mail: m } = next;
+            if ((m.retryAt ?? 0) > Date.now())
+                return;
+            if (!activeMail(s, m)) {
+                m.state = "superseded";
+                save(s);
+                continue;
+            }
+            account(s, m);
+            await deps.handedOff?.(from);
+            if (!activeMail(s, m))
+                continue;
+            if (!(await deps.paneLive(from))) {
+                retry(s, m, "asker unavailable; retained in inbox");
+                return;
+            }
+            if (!activeMail(s, m))
+                continue;
+            if (!(await deps.idleNow(from))) {
+                await deps.untilIdle(from, IDLE_STEP_MS, { aborted: () => !activeMail(s, m) });
+                continue;
+            }
+            if (!activeMail(s, m) || deps.handingOff?.(from))
+                continue;
+            const final = isTerminal(m.outcome.status);
+            const current = (m.generation ?? s.gen) === s.gen;
+            const { parent: _parent, ...route } = routeOf(s, final && current);
+            const peers = s.job ? ofJob(from, s.job) : [s];
+            const tally = s.job ? deps.jobTally?.(s.job) : undefined;
+            m.meta = {
+                eventId: m.id, from: s.to, job: s.job, status: m.outcome.status, turn: s.turn ?? "",
+                done: Math.max(peers.filter((x) => x.resolved).length, tally?.done ?? 0),
+                total: Math.max(peers.length, tally?.total ?? 0),
+                ...(s.asker ? { asker: s.asker } : {}), ...route,
+            };
+            m.state = "delivering";
+            m.attempts++;
+            m.sentAt = Date.now();
+            // Persist the ambiguous boundary before transport. A restarted delivering
+            // event is uncertain even if its ACK never made it to disk.
+            save(s);
+            let result;
+            try {
+                result = await deps.deliver(from, m.outcome.body, m.meta, () => activeMail(s, m));
+            }
+            catch (e) {
+                result = { ok: false, uncertain: true, reason: e.message };
+            }
+            if (stale(s))
+                continue;
+            if (!result.uncertain && result.ok) {
+                m.state = "delivered";
+                if (current) {
+                    s.delivered = true;
+                    delete s.undelivered;
+                    if (final) {
+                        s.claimed = true;
+                        s.settled = true;
+                    }
+                }
+                save(s);
+                finishMail(s, m);
+            }
+            else if (!result.uncertain && result.retryable === true) {
+                if (!activeMail(s, m)) {
+                    m.state = "superseded";
+                    save(s);
+                    continue;
+                }
+                retry(s, m, result.reason ?? "transport confirmed no input sent");
+                return;
+            }
+            else {
+                m.state = "uncertain";
+                m.reason = result.reason ?? "delivery acknowledgement unknown; reconciliation required";
+                s.undelivered = true;
+                save(s);
+                // No settle/release: an uncertain last sibling cannot acquire answer
+                // ownership for an unrelated later receipt, nor be sent twice on restart.
+            }
+            deps.log.info({ from, turn: s.turn, eventId: m.id, state: m.state, attempts: m.attempts }, "receipt inbox: delivery");
+        }
+    };
+    const pump = (from, retryReady = false) => {
+        if (stopped || writeFailed || consumers.has(from))
+            return;
+        const old = retryTimers.get(from);
+        if (old) {
+            clearTimeout(old);
+            retryTimers.delete(from);
+        }
+        const head = queued(from)[0];
+        if (!head)
+            return;
+        const delay = (head.mail.retryAt ?? 0) - Date.now();
+        if (delay > 0 || (head.mail.retryAt !== undefined && !retryReady)) {
+            // Even expired backoff yields to the event loop (slow fsync can consume it).
+            const timer = setTimeout(() => { retryTimers.delete(from); pump(from, true); }, Math.max(0, delay));
+            timer.unref?.();
+            retryTimers.set(from, timer);
+            return;
+        }
+        consumers.add(from);
+        void consume(from).catch((e) => {
+            deps.log.warn({ from, err: e.message }, "receipt inbox: consumer failed");
+            const head = queued(from)[0];
+            if (head && !writeFailed && !stopped)
+                retry(head.s, head.mail, e.message);
+        }).finally(() => { consumers.delete(from); pump(from); });
+    };
+    const enqueueOutcome = (s, out) => {
+        // A newer result makes a not-yet-consumed NEED/error obsolete. Anything
+        // already exposed retains its delivery evidence in the event history.
+        (s.inbox ?? []).filter((m) => m.state === "queued" && !isTerminal(m.outcome.status))
+            .forEach((m) => { m.state = "superseded"; });
+        const m = { id: `r${randomBytes(12).toString("hex")}`, order: ++mailOrder,
+            queuedAt: Date.now(), generation: s.gen, outcome: out, state: "queued", attempts: 0 };
+        s.outcome = out;
+        if (out.status === "canceled")
+            s.cancellationId = m.id;
+        s.resolved = isTerminal(out.status);
+        s.delivered = false;
+        s.inbox = [...(s.inbox ?? []), m];
+        save(s); // outcome + queued event in one durable write, before any asker IO
+        try {
+            account(s, m);
+        }
+        finally {
+            pump(s.from);
+        }
+    };
     const watch = async (s) => {
         const lg = deps.log.child({ mod: "receipt", from: deps.nameOf(s.from), to: deps.nameOf(s.to), ...(s.job ? { job: s.job } : {}) });
         const anchor = s.at;
@@ -265,11 +452,15 @@ export const createReceipts = (deps) => {
         const out = canceled(s) ? s.outcome : got;
         if (stale(s))
             return;
+        if (canceled(s) && s.cancellationId && s.inbox?.some((m) => m.id === s.cancellationId)) {
+            pump(s.from);
+            return;
+        }
         if (s.claimed || !out) { // wait_peer 抢先取走了
             s.resolved = true;
             settle(s);
             if (s.job)
-                deps.settleJob?.(s.job, s.to, "done", []);
+                deps.settleJob?.(s.job, s.to, "done", [], { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
             return;
         }
         // 下面到 save 之间不能有 await: relay 与这里的判定必须看到同一个状态。
@@ -285,12 +476,18 @@ export const createReceipts = (deps) => {
         }
         // 工单验收: 交了个空 RESULT (或缺约定的 ARTIFACT) —— 不投、不计数, 以发话方的名义同件号
         // 打回一次; 再交上来的照收。新登记顶掉这一份 (它随即 stale), 守的是打回那一句的答案。
-        const why = out.status === "done" && s.job && !s.bounced ? deps.accept?.(s.job, out.body) : undefined;
+        const why = out.status === "done" && s.job && !s.bounced && !deps.workflowPrereq?.(s.from, s.turn ?? "") ? deps.accept?.(s.job, out.body) : undefined;
         if (why && deps.rebound) {
             const at = Date.now();
             const legs = (s.legs ?? 1) + 1;
-            register({ from: s.from, to: s.to, channel: s.channel, job: s.job, at, turn: s.turn, legs, deadlineAt: deadlineOf(at), ...(s.k ? { k: s.k } : {}), ...(s.asker ? { asker: s.asker } : {}), bounced: out.body });
-            const ok = await deps.rebound({ from: s.from, to: s.to, turn: s.turn, legs, channel: s.channel, ...(s.asker ? { asker: s.asker } : {}) }, why);
+            const tell = { from: s.from, to: s.to, channel: s.channel, job: s.job, at, turn: s.turn, legs, deadlineAt: deadlineOf(at), ...(s.k ? { k: s.k } : {}), ...(s.asker ? { asker: s.asker } : {}), bounced: out.body, jobDispatchKey: s.jobDispatchKey ?? s.dispatchKey };
+            if (!deps.durableRebound)
+                register(tell);
+            const ok = await deps.rebound({ from: s.from, to: s.to, turn: s.turn, legs, channel: s.channel, ...(s.asker ? { asker: s.asker } : {}) }, why, tell);
+            if (!ok && deps.durableRebound) {
+                enqueueOutcome(s, out);
+                return;
+            }
             lg.info({ why, ok }, "receipt: 不合工单验收, 打回一次");
             // 打回没注入进去: 原来那份照常交上去 (钉成新 slot 的答案, 它的 watcher 直接拿去投)。
             if (!ok) {
@@ -302,108 +499,43 @@ export const createReceipts = (deps) => {
             }
             return;
         }
-        const final = isTerminal(out.status);
-        s.outcome = out;
-        s.resolved = final;
-        save(s);
-        deps.onOutcome?.(s, out.status, out.body, false);
-        if (final && s.job)
-            deps.settleJob?.(s.job, s.to, out.status, parseClosing(out.body).artifacts);
-        if (final)
-            nudgeHolds();
-        // 发话方自己在交接: 重开的那几秒里 pane 是死的, 别把这当成"已经不在了"。
-        await deps.handedOff?.(s.from);
-        if (!(await deps.paneLive(s.from))) {
-            lg.info({ status: out.status }, "receipt: 发话方已经不在了, 丢弃");
+        if (s.answerTransfer) {
+            // Human answer transfers have their own durable delivery protocol.
+            s.outcome = out;
+            s.resolved = isTerminal(out.status);
+            save(s);
+            deps.onOutcome?.(s, out.status, out.body, false);
+            if (s.resolved && s.job)
+                deps.settleJob?.(s.job, s.to, out.status, parseClosing(out.body).artifacts, { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
+            if (s.resolved)
+                nudgeHolds();
+            s.claimed = true;
+            save(s);
+            s.delivered = await deps.deliverAnswer?.(s.answerTransfer, out) ?? false;
+            s.resolved = true;
             settle(s);
-            if (final)
-                release(s);
             return;
         }
-        if (final)
-            s.claimed = true; // 占位先于投递: 这中间来的 wait_peer 不该把同一段再取一遍
-        const peers = s.job ? ofJob(s.from, s.job) : [s];
-        const tally = s.job ? deps.jobTally?.(s.job) : undefined;
-        const meta = {
-            from: s.to,
-            channel: s.channel,
-            job: s.job,
-            done: Math.max(peers.filter((x) => x.resolved).length, tally?.done ?? 0),
-            total: Math.max(peers.length, tally?.total ?? 0),
-            status: out.status,
-            turn: s.turn ?? "",
-            ...(s.asker ? { asker: s.asker } : {}),
-        };
-        const sent = await serial(s.from, async () => {
-            // 发话方正在生成 → 等它这一轮说完, 一结束就投。它的 pane 还活着就一直等 (上限是
-            // 登记的保留期): 回执到了却因为它在跑长活而扔掉, 它就只能永远等。
-            // 等的过程中它开始交接 → 等交接完再来一圈: 投进旧会话会被交接一并带走 (简报
-            // 已经写完了, 不含这一段), 投进还没贴回简报的新会话会抢在简报前面。
-            // 每圈都查 stale: 等发话方闲下来可能要很久, 同一对的新一句正是在这期间来的。
-            for (;;) {
-                await deps.handedOff?.(s.from);
-                // settled 只可能是 wait_peer 在这期间取走了 (watcher 自己投完才 settle)。
-                // 排队期间被 cancel 落了终态: 手上这份 (need / error) 已经过时, 改投 canceled。
-                if (stale(s) || s.settled || (canceled(s) && out !== s.outcome))
-                    return false;
-                if (Date.now() >= s.at + KEEP_MS || !(await deps.paneLive(s.from))) {
-                    lg.warn({ status: out.status }, "receipt: 发话方一直没空或已不在, 放弃回注");
-                    return false;
-                }
-                if (!(await deps.idleNow(s.from))) {
-                    await deps.untilIdle(s.from, Math.min(IDLE_STEP_MS, s.at + KEEP_MS - Date.now()), { aborted: () => stale(s) });
-                    continue;
-                }
-                if (!deps.handingOff?.(s.from))
-                    break;
-            }
-            // 上面最后一圈的 await 期间可能被 wait_peer 取走; 从这里到 deliver 之间不能有 await。
-            if (stale(s) || s.settled)
-                return false;
-            const { parent, ...route } = routeOf(s, final);
-            const at = Date.now();
-            // 先记成已投: 投递途中被 wait_peer 取走的, 要告诉它「这段已经在你会话里了」。
-            s.delivered = true;
-            const r = await deps.deliver(s.from, out.body, { ...meta, ...route });
-            if (!r.ok) {
-                s.delivered = false;
-                s.undelivered = true;
-            }
-            if (r.ok && parent)
-                relay(parent, at);
-            lg.info({ ok: r.ok, reason: r.reason, status: out.status, len: out.body.length, done: meta.done, total: meta.total, ...(route.replyTo ? { replyTo: kAttr(route.replyTo) } : {}), ...(route.pending ? { pending: route.pending } : {}) }, "receipt: 回注");
-            return true;
-        });
-        if (stale(s)) {
-            lg.info("receipt: 被同一对的新一句顶掉, 不回注");
-            return;
-        }
-        // error / need 只是中途报了一声: 接着守续跑 (或答复之后) 出来的答案。
-        if (!final && (sent || canceled(s)))
+        enqueueOutcome(s, out);
+        // Watching the worker continues even if the asker cannot consume NEED/error.
+        if (!isTerminal(out.status))
             return watch(s);
-        settle(s);
-        if (!s.delivered)
-            release(s);
     };
-    const register = (tell, watchIt = true) => {
+    const register = (tell, watchIt = true, interim) => {
         const at = tell.at ?? Date.now();
         const turn = tell.turn ?? newTurn();
         // 续问一件停放着的: 接替它在停放处的位置, 不碰这一对眼下那一件。
         const parked = slots.get(keyOfTurn(tell.from, tell.to, turn));
         const prev = parked ?? slots.get(keyOfPair(tell.from, tell.to));
-        // 挂起等子活的那份被另一件顶下来: 按件号停放, 不作废 (见 Slot.parked)。还没标上挂起、
-        // 但它已经为这件派了活的也算 —— watcher 可能还没读到那句「已派」。
-        const park = !parked && !!prev && !prev.settled && prev.turn !== turn && (!!prev.deferred || children(prev).length > 0);
-        if (park) {
-            prev.parked = true;
-            slots.set(keyOf(prev), prev);
-            save(prev);
-        }
+        // The pair remains a compatibility index for wait_peer/pending. Every older
+        // turn, including completed but unconsumed results, keeps its own slot.
+        const park = !parked && !!prev && prev.turn !== turn;
         // 顶掉一份还没落定的工单活、自己又没带工单: 继承那张工单 —— 旧那份不会再投了,
         // 这一句的答案就是那个成员的交代; 不继承它就永远不计 done, 工单齐不了。停放的那份还会投, 不让。
         const job = tell.job || (!park && prev?.job && !prev.resolved ? prev.job : "");
         const s = {
             ...tell,
+            ...(interim && ["need", "error"].includes(interim.status) ? { outcome: interim } : {}),
             job,
             at,
             turn,
@@ -414,24 +546,58 @@ export const createReceipts = (deps) => {
             delivered: false,
             resolved: false,
             ...(parked ? { parked: true } : {}),
+            ...(!park && prev?.inbox ? { inbox: prev.inbox.map((m) => ({ ...m,
+                    generation: m.generation ?? prev.gen,
+                    state: m.state === "queued" && !isTerminal(m.outcome.status) ? "superseded" : m.state === "delivering" ? "uncertain" : m.state,
+                })) } : {}),
         };
+        // Commit both keys atomically; a crash cannot leave two live aliases for
+        // the same turn or erase an old event between parking and registering.
+        const oldKey = prev && keyOfTurn(prev.from, prev.to, prev.turn ?? "");
+        persist({ ...(park && prev && oldKey ? { [oldKey]: { ...prev, parked: true } } : {}), [keyOf(s)]: s });
+        if (park && prev && oldKey) {
+            prev.parked = true;
+            slots.set(oldKey, prev);
+        }
         slots.set(keyOf(s), s);
-        if (watchIt)
+        if (tell.queued) { /* accepted obligation; no silent/dead watcher until submission */ }
+        else if (watchIt)
             arm(s);
         else {
             s.claimed = true;
             s.resolved = true;
-            s.settled = true;
+            settle(s);
         } // 不守 = 这一份没人会投
-        save(s);
+        pump(s.from);
         return { at: s.at, turn: s.turn };
     };
     // ── 停放 (after) ─────────────────────────────────────────────────────
     const holdKey = (h) => keyOfTurn(h.from, h.to, h.turn);
-    const saveHold = (h) => { deps.holdStore?.set(holdKey(h), h); };
-    const dropHold = (h) => { holds.delete(holdKey(h)); deps.holdStore?.drop(holdKey(h)); };
+    // A failed write pauses all releases, including closures already inside transport.
+    // Failed cancellation is not acknowledged: retain the original durable/memory row
+    // for operator reconciliation before restarting the store.
+    let holdWriteFailed = false;
+    const writeHold = (write) => {
+        if (holdWriteFailed)
+            throw new Error("hold persistence failed; reconcile storage before reload");
+        try {
+            write();
+        }
+        catch (e) {
+            holdWriteFailed = true;
+            throw e;
+        }
+    };
+    const saveHold = (h) => writeHold(() => { deps.holdStore?.set(holdKey(h), h); });
+    const dropHold = (h) => {
+        writeHold(() => { deps.holdStore?.drop(holdKey(h)); });
+        holds.delete(holdKey(h));
+    };
     /** 前置件号 → 此刻的样子。先看回执槽 (按发话方 + 件号找, 不论发给谁), 再看自己也停放着的, 最后看快照。 */
     const prereqOf = (from, turn, seen = {}) => {
+        const tracked = deps.workflowPrereq?.(from, turn);
+        if (tracked)
+            return tracked;
         const s = [...slots.values()].find((x) => x.from === from && x.turn === turn);
         const st = s?.outcome?.status;
         if (s && s.resolved && st && isTerminal(st))
@@ -452,32 +618,45 @@ export const createReceipts = (deps) => {
     /** 不投了: 落成一份 canceled 回给发话方, 走与别的回执同一条路 (投递、计数、记账都在 watch 里)。
      *  按件号停放着放进去 (parked), 绝不占 from→to 的位置 —— 那里可能有在飞的另一件。 */
     const cancelHold = (h, why, silent = false) => {
-        dropHold(h);
-        if (silent)
+        if (holds.get(holdKey(h)) !== h)
+            return;
+        const existing = slots.get(keyOfTurn(h.from, h.to, h.turn));
+        if (existing?.outcome?.status === "canceled") {
+            dropHold(h);
+            if (!existing.claimed)
+                arm(existing);
             return;
+        }
         const at = Date.now();
         const s = {
             from: h.from, to: h.to, channel: h.channel, job: h.job, at, turn: h.turn, legs: 1, deadlineAt: at,
             ...(h.k ? { k: h.k } : {}), ...(h.asker ? { asker: h.asker } : {}),
             gen: (slots.get(keyOfTurn(h.from, h.to, h.turn))?.gen ?? 0) + 1,
-            claimed: false, delivered: false, resolved: false, parked: true,
+            claimed: silent, delivered: false, resolved: silent, settled: silent, parked: true,
             outcome: { status: "canceled", body: `（守护进程: ${why}）` },
         };
         slots.set(keyOf(s), s);
         save(s);
-        arm(s);
+        if (silent)
+            deps.onOutcome?.(s, "canceled", s.outcome.body, true);
+        if (!silent)
+            enqueueOutcome(s, s.outcome);
+        dropHold(h);
     };
     const releasing = new Set();
     /** 逐件看停放着的: 有失败的 → 不投; 都 done 了且这一对没被占着 → 放行; 超过保留期 → 不投。 */
     const tickHolds = async () => {
+        if (stopped || writeFailed || holdWriteFailed)
+            return;
         for (const h of [...holds.values()]) {
             if (releasing.has(holdKey(h)) || !holds.has(holdKey(h)))
                 continue;
             const ps = h.after.map((t) => [t, prereqOf(h.from, t, h.seen)]);
             const fresh = ps.filter(([t, p]) => (p.state === "done" || p.state === "failed") && !h.seen[t]);
             if (fresh.length) {
-                fresh.forEach(([t, p]) => { h.seen[t] = p.seen; });
-                saveHold(h);
+                const seen = { ...h.seen, ...Object.fromEntries(fresh.map(([t, p]) => [t, p.seen])) };
+                saveHold({ ...h, seen });
+                h.seen = seen;
             }
             const bad = ps.find(([, p]) => p.state === "failed" || p.state === "unknown");
             if (bad) {
@@ -497,14 +676,24 @@ export const createReceipts = (deps) => {
             releasing.add(holdKey(h));
             void (async () => {
                 try {
-                    const r = (await deps.release?.(h, h.seen)) ?? { ok: false, reason: "没有放行通路" };
+                    const r = (await deps.release?.(h, h.seen, () => !stopped && !writeFailed && !holdWriteFailed && holds.get(holdKey(h)) === h)) ?? { ok: false, reason: "没有放行通路" };
+                    if (holds.get(holdKey(h)) !== h)
+                        return;
                     if (r.ok)
                         dropHold(h);
                     else
                         cancelHold(h, `前置都 done 了, 但这件 (${h.turn}) 投不出去: ${r.reason ?? "未知原因"}, 没投。`);
                 }
                 catch (e) {
-                    cancelHold(h, `放行时出错 (${e.message}), 这件 (${h.turn}) 没投。`);
+                    try {
+                        if (!holdWriteFailed)
+                            cancelHold(h, `放行时出错 (${e.message}), 这件 (${h.turn}) 没投。`);
+                    }
+                    catch (writeError) {
+                        deps.log.error({ err: writeError.message, turn: h.turn }, "receipt: cancellation persistence failed");
+                    }
+                    if (holdWriteFailed)
+                        deps.log.error({ err: e.message, turn: h.turn }, "receipt: hold persistence failed; releases paused for reconciliation");
                 }
                 finally {
                     releasing.delete(holdKey(h));
@@ -523,27 +712,87 @@ export const createReceipts = (deps) => {
     const nudgeHolds = () => { if (holds.size)
         void tickHolds().catch(() => undefined); };
     return {
+        stop: () => {
+            stopped = true;
+            retryTimers.forEach(clearTimeout);
+            retryTimers.clear();
+            if (holdTimer)
+                clearInterval(holdTimer);
+        },
+        inbox: (from) => mails(from).sort((a, b) => a.mail.order - b.mail.order).map(({ s, mail }) => structuredClone({ ...mail, from: s.from, to: s.to, turn: s.turn ?? "" })),
         register,
+        confirmDelivery: (eventId) => {
+            for (const s of slots.values()) {
+                const m = s.inbox?.find((m) => m.id === eventId && m.state === "uncertain");
+                if (!m)
+                    continue;
+                m.state = "delivered";
+                m.reason = "submission confirmed by durable event/transcript evidence";
+                if ((m.generation ?? s.gen) === s.gen) {
+                    s.delivered = true;
+                    delete s.undelivered;
+                    if (isTerminal(m.outcome.status)) {
+                        s.claimed = true;
+                        s.settled = true;
+                    }
+                }
+                save(s);
+                finishMail(s, m);
+                pump(s.from);
+            }
+        },
+        commit: (tell) => {
+            let s = upstream({ from: tell.from, turn: tell.turn ?? "" }, tell.to);
+            if (!s) {
+                register({ ...tell, queued: true });
+                s = upstream({ from: tell.from, turn: tell.turn ?? "" }, tell.to);
+            }
+            if (!s || s.dispatchKey !== tell.dispatchKey || !s.queued)
+                return;
+            s.queued = false;
+            save(s);
+            arm(s);
+        },
+        watching: (tell) => {
+            const s = upstream({ from: tell.from, turn: tell.turn ?? "" }, tell.to);
+            return !!s && !s.resolved && !s.claimed && (tell.dispatchKey
+                ? s.dispatchKey === tell.dispatchKey
+                : s.at === tell.at && (s.legs ?? 1) === (tell.legs ?? 1));
+        },
+        continuation: (from, to, turn) => {
+            const s = upstream({ from, turn }, to);
+            return !s || s.resolved || s.claimed ? undefined : { from, to, turn, channel: s.channel, job: s.job,
+                at: Date.now(), legs: (s.legs ?? 1) + 1, deadlineAt: s.deadlineAt, k: s.k, asker: s.asker, jobDispatchKey: s.jobDispatchKey ?? s.dispatchKey };
+        },
         reask: (from, to, turn) => {
             const s = upstream({ from, turn }, to);
             if (!s || s.resolved || s.claimed)
                 return undefined;
             const legs = (s.legs ?? 1) + 1;
-            register({ from, to, channel: s.channel, job: s.job, turn, legs, ...(s.deadlineAt ? { deadlineAt: s.deadlineAt } : {}), ...(s.k ? { k: s.k } : {}), ...(s.asker ? { asker: s.asker } : {}) });
+            register({ from, to, channel: s.channel, job: s.job, turn, legs, ...(s.answerTransfer ? { answerTransfer: s.answerTransfer } : {}), ...(s.deadlineAt ? { deadlineAt: s.deadlineAt } : {}), ...(s.k ? { k: s.k } : {}), ...(s.asker ? { asker: s.asker } : {}) });
             return { legs, channel: s.channel, ...(s.asker ? { asker: s.asker } : {}) };
         },
         prepare: (from, to, re) => {
-            const want = re?.replace(/[`\s]/g, "");
+            const want = re ? canonicalTurn(re) : undefined;
             const s = want ? upstream({ from, turn: want }, to) : undefined;
             return s?.turn && s.turn === want
                 ? { turn: s.turn, legs: (s.legs ?? 1) + 1, job: s.job, channel: s.channel, asker: s.asker, k: s.k }
                 : { turn: newTurn(), legs: 1, ...(re ? { reUnknown: true } : {}) };
         },
-        claim: (from, to) => {
-            const s = slots.get(keyOfPair(from, to));
+        pendingDelivery: (from, k, except) => [...slots.values()].some((s) => s.from === from && !!s.k && sameK(s.k, k)
+            && s.inbox?.some((m) => m.id !== except && ["queued", "delivering", "uncertain"].includes(m.state))),
+        claim: (from, to, turn) => {
+            const s = turn ? upstream({ from, turn }, to) : slots.get(keyOfPair(from, to));
             if (!s)
                 return false;
+            if (s.answerTransfer)
+                return s.delivered;
+            // Transport may already have exposed this event. Do not let a concurrent
+            // wait_peer take a second copy, or turn an unknown ACK into a success.
+            if (s.inbox?.some((m) => (m.generation ?? s.gen) === s.gen && ["delivering", "uncertain"].includes(m.state)))
+                return "uncertain";
             const fresh = !s.settled;
+            s.inbox?.filter((m) => m.state === "queued" && (m.generation ?? s.gen) === s.gen).forEach((m) => { m.state = "claimed"; });
             s.claimed = true;
             s.resolved = true;
             settle(s);
@@ -553,6 +802,7 @@ export const createReceipts = (deps) => {
             }
             return s.delivered;
         },
+        sentTurn: (from, to) => slots.get(keyOfPair(from, to))?.turn,
         sentAt: (from, to) => slots.get(keyOfPair(from, to))?.at ?? 0,
         outstanding: (from, job) => [...slots.values()]
             .filter((s) => s.from === from && !s.resolved && (job === undefined || s.job === job))
@@ -586,47 +836,54 @@ export const createReceipts = (deps) => {
                 .filter((s) => !s.resolved && !s.claimed)
                 .map((s) => ({
                 from: s.from, to: s.to, turn: s.turn ?? "", job: s.job,
-                state: turnState(s, { parked: !s.outcome && parked(s.to) }),
+                state: s.queued ? "queued" : turnState(s, { parked: !s.outcome && parked(s.to) }),
                 ageMs: Date.now() - s.at,
+                ...(s.k ? { k: s.k } : {}),
             }))
                 // 停放着的 (等前置): 还没投出去, 但发话方在等它 —— 同样在飞。
-                .concat([...holds.values()].map((h) => ({ from: h.from, to: h.to, turn: h.turn, job: h.job, state: "queued", ageMs: Date.now() - h.at })));
+                .concat([...holds.values()].map((h) => ({ from: h.from, to: h.to, turn: h.turn, job: h.job, state: "queued", ageMs: Date.now() - h.at, ...(h.k ? { k: h.k } : {}) })));
         },
         cancel: (target, by, only = () => true) => {
             // 排着还没投的 (停放): 不投了; 发起 stop 的那方自己知道, 不回执。
             const held = [...holds.values()].filter((h) => h.to === target && only({ from: h.from, turn: h.turn }));
             held.forEach((h) => cancelHold(h, `${deps.nameOf(target)} 被 ${deps.nameOf(by)} 收掉 / 打断了, 这件排着的活 (${h.turn}) 没投。`, h.from === by));
-            const hit = [...slots.values()].filter((s) => s.to === target && !s.resolved && !s.claimed && only({ from: s.from, turn: s.turn ?? "" }));
+            const hit = [...slots.values()].filter((s) => s.to === target && !s.resolved && !s.claimed && !canceled(s) && only({ from: s.from, turn: s.turn ?? "" }));
             for (const s of hit) {
-                const last = deps.lastWords?.(s.to, s.at).trim();
+                // Keep cancellation consistent with timeout/dead/silent: transferred
+                // answers may only quote text tied to their own source turn.
+                const last = (s.answerTransfer
+                    ? (s.turn ? deps.replyFor(s.to, deps.nameOf(s.from), s.at, s.turn)?.text : undefined)
+                    : !s.turn ? deps.lastWords?.(s.to, s.at) : undefined)?.trim();
                 s.outcome = {
                     status: "canceled",
                     body: `（守护进程: ${deps.nameOf(s.to)} 被 ${deps.nameOf(by)} 收掉 / 打断了, 这件活没有结论。）${last ? `\n它最后说的: ${clipMiddle(last, 600)}` : ""}`,
                 };
                 if (s.job)
-                    deps.settleJob?.(s.job, s.to, "canceled", []);
-                deps.onOutcome?.(s, "canceled", s.outcome.body, s.from === by);
+                    deps.settleJob?.(s.job, s.to, "canceled", [], { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
                 // 发起 stop 的那方自己知道, 不投; 守着的 watcher 看到 claimed 就收尾。
-                if (s.from === by) {
+                if (s.from === by && !s.answerTransfer) {
+                    deps.onOutcome?.(s, "canceled", s.outcome.body, true);
                     s.claimed = true;
                     s.resolved = true;
                     settle(s);
                     continue;
                 }
+                s.queued = false;
                 save(s);
-                // 挂起等子活的没有 watcher 在守: 叫醒它去投这份 canceled。
-                if (s.deferred)
-                    wake(s);
+                if (s.answerTransfer)
+                    arm(s, true);
+                else
+                    enqueueOutcome(s, s.outcome);
             }
             if (hit.length)
                 nudgeHolds();
             return hit.length + held.length;
         },
-        prereqs: (from, turns) => turns.map((t) => prereqOf(from, t.replace(/[`\s]/g, ""))),
+        prereqs: (from, turns, seen) => turns.map((t) => prereqOf(from, canonicalTurn(t), seen)),
         hold: (h) => {
             const x = { ...h, seen: {} };
-            holds.set(holdKey(x), x);
             saveHold(x);
+            holds.set(holdKey(x), x);
             startHolds();
             nudgeHolds();
         },
@@ -636,6 +893,8 @@ export const createReceipts = (deps) => {
             return hit.length;
         },
         parentOf: (self, env, channel, opening) => {
+            if (env?.quiet)
+                return undefined;
             if (env?.receipt)
                 return env.k ? kOfAttr(env.k) : undefined;
             if (env?.kind === "peer" && env.private) {
@@ -643,7 +902,7 @@ export const createReceipts = (deps) => {
                 return p && { kind: "peer", from: p.from, turn: p.turn };
             }
             // 私聊轮 (频道 "") 派出的活没有群可续: 不能回落成 home, 否则回执轮就进了群。
-            return channel ? { kind: "chat", channel, turn: opening } : undefined;
+            return channel ? { kind: "chat", channel, turn: env?.eventId ?? opening } : undefined;
         },
         ancestorsOf: (self, k) => {
             // 第一跳 (self 此刻答的那件) 按定义在途; 往上每一跳都要那件活还没落定 / 没被 wait_peer 取走 ——
@@ -668,8 +927,37 @@ export const createReceipts = (deps) => {
         resume: () => {
             // 挂起且子活还没落定的不守: 叫醒它是 relay / release 的事, 这里再 arm 一个就是两个 watcher。
             const open = [...slots.values()].filter((s) => !s.settled && !(s.deferred && children(s).length));
-            // 投到一半被 reload 打断的那份: claimed 是上一个进程的占位, 这里重新来过。
-            open.forEach((s) => { s.claimed = false; arm(s); });
+            // Restore durable inboxes before observing new worker results. The
+            // delivering boundary is ambiguous after a crash, never an automatic retry.
+            for (const s of slots.values()) {
+                for (const m of s.inbox ?? []) {
+                    if (m.state === "delivering") {
+                        m.state = "uncertain";
+                        m.reason = "daemon restarted during delivery; reconciliation required";
+                        s.undelivered = true;
+                        save(s);
+                    }
+                    if (!m.accounted && !["superseded", "claimed"].includes(m.state))
+                        account(s, m);
+                    finishMail(s, m);
+                }
+                pump(s.from);
+            }
+            open.forEach((s) => {
+                if (s.resolved && s.inbox?.some((m) => (m.generation ?? s.gen) === s.gen))
+                    return;
+                if (!s.answerTransfer && s.outcome && isTerminal(s.outcome.status) && (s.claimed || s.delivered)) {
+                    // Old-format transport had no intent journal. Preserve it explicitly
+                    // rather than replaying a possibly delivered legacy result.
+                    s.inbox = [{ id: `r${randomBytes(12).toString("hex")}`, order: ++mailOrder, queuedAt: Date.now(),
+                            outcome: s.outcome, state: "uncertain", attempts: 1, reason: "legacy delivery boundary unknown" }];
+                    s.undelivered = true;
+                    save(s);
+                    return;
+                }
+                s.claimed = false;
+                arm(s);
+            });
             if (open.length)
                 deps.log.info({ mod: "receipt", resumed: open.map((s) => `${deps.nameOf(s.from)}←${deps.nameOf(s.to)}`) }, "receipt: reload 后续守");
             startHolds();