wezard 2.6.4 → 2.7.1

package/dist/daemon/receipts.js

@@ -1,968 +0,0 @@
-// 回执: 一次 tell_peer 之后, 对方干完那一轮, 守护进程把它的结论**自动**送回发话方
-// 的输入框。
-//
-// 在这之前, 发话方只有两条路: 挂在 wait_peer 上阻塞等 (把一个能干活的 pane 锁死在
-// 轮询里, 而且一次只能等一批、等完才醒), 或者自己记得回头 peek —— 后者实际上没人做。
-// 异步回执把「问」和「收」拆开: 问完就接着干自己的事, 答案到了作为新的一轮进来。
-//
-// 这不是第二个编排器, 是一条投递通路。它只做四件事, 每一件都复用现成的判定:
-//   等对方停下 (mirror.untilIdle, 注册表判闲) → 取它答**这一句**的那段话
-//   (peers.replyToPeer, 按信封定位而不是按时刻) → 等发话方停下 → paste 进去。
-// 控制流仍在发话方自己的上下文里: 它没有被阻塞, 也没有被谁代理。
-//
-// 登记落盘 (`store`), boot 时把没收尾的重新守起来。不能纯内存: 这个仓库里被派活的
-// wizard 自己就常以 `build + reload` 收尾 —— reload 恰好落在它那一轮里, 内存里的
-// watcher 跟着进程一起没了, 发话方永远等不到回执。答案本来就在对方的 transcript 里
-// (按信封定位), 重启后接着守, 取到的还是同一段。
-import { randomBytes } from "node:crypto";
-import { clipMiddle, parseClosing } from "./peers.js";
-import { isTerminal, turnState } from "../shared/turn-state.js";
-import { sleep } from "../shared/std.js";
-/** 对方最长允许干多久 (超过就投一份 timeout 回执, 不占着内存等到天亮)。默认值;
- *  tell_peer 的 `deadline` 可在 [MIN, MAX] 里改 —— 上限留在 KEEP_MS 之内, 超时那份
- *  回执还得数得进工单。 */
-const TARGET_WAIT_SEC = 3600;
-const DEADLINE_MIN_SEC = 60;
-const DEADLINE_MAX_SEC = 12 * 3600;
-/** 交接把义务转进新会话时, 至少再给它这么久: 不然对方一交接, 这份就提前超时。 */
-const CARRY_GRACE_MS = 10 * 60_000;
-/** The same accepted quoting/whitespace syntax applies at every turn lookup. */
-export const canonicalTurn = (turn) => turn.replace(/[`\s]/g, "");
-/** 一件活的编号: 注入之前生成, 写进信封, 回执按它定位答句。 */
-export const newTurn = () => `t${randomBytes(3).toString("hex")}`;
-/** `at` 发出、给了 `sec` 秒 (缺省 / 越界取默认或夹到边上) 的期限。 */
-export const deadlineOf = (at, sec) => at + 1000 * (sec === undefined || !Number.isFinite(sec) ? TARGET_WAIT_SEC : Math.min(Math.max(sec, DEADLINE_MIN_SEC), DEADLINE_MAX_SEC));
-/** 对方 pane 不在了, 隔这么久再看一眼才判 dead: 非交接的 pane 换新 (respawn) 也有
- *  几秒是死的。 */
-const DEAD_GRACE_MS = 5000;
-/** 停放件隔多久看一次前置落定了没有 (落定时另有事件触发, 这是兜底)。 */
-const HOLD_POLL_MS = 3000;
-/** 对方读进了我们这一句、停下了却没答 —— 再等下一次停下。连着这么多次都没答就认定
- *  它不会答了, 别守到天亮。我们那一句还没被读进 (排在别的轮后面) 的那几次不算: 那是
- *  在等前面的轮, 不是它不答; 只有整段 ramp 都闲着、问话仍不在 transcript 里, 才算一次
- *  (那一句多半丢了)。 */
-const MAX_FRUITLESS = 3;
-/** 等对方「动起来」的窗口: 注册表在它读进这一句之前仍报 idle, 不等这一下就会在它开工
- *  之前读 transcript, 读到的还是上一件事。轮询放慢到 2s: idleNow 与 answered 都同步读
- *  tail, 十几路 fan-out 同时 ramp 时 1s 一次会压住事件循环。 */
-const RAMP_MS = 20_000;
-const RAMP_POLL_MS = 2000;
-/** 每次最多等对方这么久就回来重读 deadline: 交接 transfer 会把 s.at 往后推, 一次定死的
- *  超时会早于新的 deadline 放弃。 */
-const IDLE_STEP_MS = 5 * 60_000;
-/** codebuddy 没有注册表, 判闲靠 pane 采样 —— 它停在本地对话框上时 spinner 也会消失,
- *  仍会被算作闲 (P1 在那边没修), 多采一次压低误判。发话方投递路径保持 2。 */
-const IDLE_CONFIRM = 3;
-/** 信封属性上的 k: `chat:<turn>:<base>` / `peer:<turn>:<key>` —— 只给机器读。chat 的
- *  `turn` 是开那一轮的那句人话的时刻: 人先后问的两件事各派了活, 不能被当成兄弟。 */
-export const kAttr = (k) => `${k.kind}:${k.turn}:${k.kind === "chat" ? k.channel : k.from}`;
-export const kOfAttr = (a) => {
-    const m = a.match(/^(chat|peer):([^:]+):(.+)$/);
-    return !m ? undefined : m[1] === "chat" ? { kind: "chat", turn: m[2], channel: m[3] } : { kind: "peer", turn: m[2], from: m[3] };
-};
-const sameK = (a, b) => kAttr(a) === kAttr(b);
-/** 落盘的登记留多久。比对方最长允许干的时长宽, 好让续守的那一份仍数得进工单。 */
-const KEEP_MS = 24 * 3600_000;
-export const createReceipts = (deps) => {
-    let stopped = false;
-    let writeFailed = false;
-    const keyOfPair = (from, to) => `${from}\u0000${to}`;
-    const keyOfTurn = (from, to, turn) => `${keyOfPair(from, to)}\u0000${turn}`;
-    const keyOf = (s) => (s.parked ? keyOfTurn(s.from, s.to, s.turn ?? "") : keyOfPair(s.from, s.to));
-    const live = (s) => !s.settled || Date.now() - s.at < KEEP_MS || !!s.inbox?.some((m) => ["queued", "delivering", "uncertain"].includes(m.state));
-    // 过了保留期的行开机时从盘上抹掉: 同一对的位置会被下一句覆盖, 按件号停放的不会。
-    Object.entries(deps.store?.all() ?? {}).filter(([, s]) => !live(s)).forEach(([key]) => deps.store?.drop(key));
-    const slots = new Map(Object.values(deps.store?.all() ?? {}).filter(live).map((s) => { const row = structuredClone(s); return [keyOf(row), row]; }));
-    const holds = new Map(Object.values(deps.holdStore?.all() ?? {}).map((h) => [keyOfTurn(h.from, h.to, h.turn), h]));
-    /** 写穿到磁盘。被同一对的新一句顶掉的旧 slot 不写 —— 它的 key 已经归新的了。 */
-    const persist = (rows) => {
-        if (writeFailed)
-            throw new Error("receipt persistence failed; consumers paused for reconciliation");
-        try {
-            deps.store?.merge(structuredClone(rows));
-        }
-        catch (e) {
-            writeFailed = true;
-            throw e;
-        }
-    };
-    const save = (s) => { if (!stale(s))
-        persist({ [keyOf(s)]: s }); };
-    const settle = (s) => { s.settled = true; save(s); };
-    const stale = (s) => stopped || slots.get(keyOf(s)) !== s;
-    /** `to` 答 `k` 那件活的那一份 —— 在 `from→to` 的位置上, 或已按件号停放。 */
-    const upstream = (k, to) => [slots.get(keyOfPair(k.from, to)), slots.get(keyOfTurn(k.from, to, k.turn))].find((p) => p?.turn === k.turn);
-    const ofJob = (from, job) => [...slots.values()].filter((x) => x.from === from && x.job === job);
-    /** P 的答话方在答 P 的那一轮里又派出去、还没落定的活。 */
-    const children = (p) => [
-        ...[...slots.values()].filter((c) => c.from === p.to && c.k?.kind === "peer" && c.k.from === p.from && c.k.turn === p.turn && !c.settled),
-        // 停放着的子活同样挂住上游: 它投出去、落定之前, 发话方给上游的交代不能先走。
-        ...[...holds.values()].filter((c) => c.from === p.to && c.k?.kind === "peer" && c.k.from === p.from && c.k.turn === p.turn),
-    ];
-    /** 与 c 同一个发话方、同一个父 k、定论还没送进去的那几份 (不含 c)。送进去的只是一份
-     *  error 的那种还没落定: 续跑出来的真答案还要来。 */
-    const siblings = (c) => [
-        ...[...slots.values()].filter((x) => x !== c && x.from === c.from && !!x.k && sameK(x.k, c.k) && !x.settled && !(x.delivered && x.resolved)),
-        ...[...holds.values()].filter((x) => x.from === c.from && !!x.k && sameK(x.k, c.k)),
-    ];
-    /** 这份回执送进去之后, 发话方那一轮的终句去哪 (§3.3)。只在投递那一刻算: 兄弟们是
-     *  陆续回来的, 早算一步就会两份都以为自己不是最后一份。
-     *  频道只由去向定: 续回进群 (父 k 是人在群里开的那一轮、兄弟都落定了) 才有频道, 其余
-     *  一律 "" —— 回执轮不是谁在群里问的话。那件子活当初 public:true 派的也不例外: 公开的是
-     *  派活那一句和对方的答复, 不是发话方收到回执之后那一轮; 沿用它的频道, 私聊 ask 底下的
-     *  一轮就会因为没有父 k (chain:false)、只是中途回执 (NEED)、或上游那份已被取走而进群。 */
-    const routeOf = (s, final) => {
-        const k = s.k;
-        if (!k || !final)
-            return { channel: "", ...(k ? { k } : {}) };
-        const pending = siblings(s).length;
-        if (pending)
-            return { channel: "", k, pending };
-        if (k.kind === "chat")
-            return { channel: k.channel, k, replyTo: k };
-        const p = upstream(k, s.from);
-        return p && !p.resolved && !p.claimed ? { channel: "", k, replyTo: k, parent: p } : { channel: "", k };
-    };
-    /** 续回: 上游那一份改锚到刚送进去的那份回执 (answerOf 按 reply-to 认它), 重新守。
-     *  正在守的那个 watcher 自己会发现锚变了; 挂起 (deferred) 的才要重新 arm。 */
-    const relay = (p, at) => {
-        p.at = at;
-        p.deadlineAt = Math.max(p.deadlineAt ?? 0, deadlineOf(at));
-        wake(p);
-    };
-    const wake = (p) => {
-        const was = p.deferred;
-        delete p.deferred;
-        save(p);
-        if (was)
-            arm(p, true);
-    };
-    /** 子活落定了却没有一份回执送进发话方 (发话方不在了 / 等不到它闲 / wait_peer 取走):
-     *  它若是挂起的上游等着的最后一份, 照样叫醒上游 —— 不然上游连一份 dead 都收不到。
-     *  锚不动: 上游按原来那一句重新守, 答话方不在了就落成 dead。 */
-    const release = (s) => {
-        const p = routeOf(s, true).parent;
-        if (p)
-            wake(p);
-    };
-    // 一份 slot 同时只有一个 watcher: reload 续守与 relay 叫醒可能撞在一起, 两个 watcher
-    // 会把同一个答案投两遍。叫醒挂起的那份要 `force`: 挂起那一刻旧 watcher 已经同步返回,
-    // 只是 finally 还没跑; 用 token 免得旧的 finally 删掉新登记的那个。
-    const watching = new Map();
-    const arm = (s, force = false) => {
-        if (s.queued || (watching.has(s) && !force))
-            return;
-        const token = Symbol();
-        watching.set(s, token);
-        void watch(s)
-            .catch((e) => deps.log.warn({ err: e.message }, "receipt watch failed"))
-            .finally(() => { if (watching.get(s) === token)
-            watching.delete(s); });
-    };
-    /** 对方这一轮结束了。判闲以注册表为准 (`untilIdle`): pane 的 spinner 在本地对话框上
-     *  (hook 回落成 ask / AskUserQuestion) 和长工具调用的间隙里都会消失, 按它判闲会把
-     *  一个停在对话框上的 wizard 当成「答完了却没答」, 扑空三次就把回执扔了。
-     *  先等它动起来 (`rampEnd` 之前): 还没读进这一句的会话注册表照样报 idle; 已经答出
-     *  来了 (`answered`, 太快的一轮可能在两次采样之间就跑完) 就不必等满。
-     *  `quiet` = 整段 ramp 它都闲着、什么也没答 —— 调用方据此判断那一句是不是丢了。 */
-    const settled = async (to, rampEnd, deadline, aborted, answered) => {
-        for (;;) {
-            if (aborted())
-                return { idle: false, reason: "stopped" };
-            if (Date.now() >= rampEnd)
-                return { idle: true, quiet: true };
-            if (!(await deps.idleNow(to)) || answered())
-                break;
-            await sleep(RAMP_POLL_MS);
-        }
-        for (;;) {
-            const left = deadline() - Date.now();
-            if (left <= 0)
-                return { idle: false, reason: "timeout" };
-            const r = await deps.untilIdle(to, Math.min(left, IDLE_STEP_MS), { aborted, confirm: IDLE_CONFIRM });
-            if (r.idle || aborted())
-                return r;
-        }
-    };
-    const canceled = (s) => s.outcome?.status === "canceled";
-    /** 守到对方答出**我们这一句**为止。信封是比发话时刻更硬的锚 (见 peers.replyToPeer):
-     *  对方正忙时我们那一句是排队的, 它先吐出来的是上一件事的结论 —— 按时刻取就会把
-     *  旧结论当成这一次的回执。所以"停下了但还没答我们"要接着等, 不能将就; 定位不到
-     *  问话 (undefined) 也只说明它还没读进, 绝不退回按时刻取。
-     *  那一轮以 CLI 报错收尾 → `error`; 报过一次之后只等续跑出来的真答案, 不再计扑空。
-     *  `undefined` = 被 wait_peer 取走或被新的一句顶掉, 调用方自己知道。 */
-    const awaitReply = async (s) => {
-        // 锚在发话时刻而不是此刻: reload 后续守的那一份不该重新领一整份时长。交接转过来
-        // 的那份改锚到贴回简报的时刻, 所以每圈重算。
-        const deadline = () => s.deadlineAt ?? s.at + TARGET_WAIT_SEC * 1000;
-        // cancel 落的终态也算: 守到一半被别人收掉, 不再等它的答案。
-        const aborted = () => s.claimed || stale(s) || canceled(s);
-        const reported = () => s.outcome?.status === "error";
-        // 反问过了: 同一段 NEED 不再投第二遍, 等发话方 tell_peer({re}) 答 (那会顶掉这份)。
-        const asked = () => s.outcome?.status === "need";
-        const reply = () => deps.replyFor(s.to, deps.nameOf(s.from), s.at, s.turn);
-        const news = (r) => !!r?.text.trim() && !(r.error && reported()) && !(asked() && r.text === s.outcome.body) && r.text !== s.bounced;
-        const failed = (status) => ({ status, body: failure(s, status) });
-        for (let fruitless = 0; fruitless < MAX_FRUITLESS;) {
-            if (Date.now() >= deadline())
-                return failed("timeout");
-            // 对方 pane 没了 (被收掉 / 崩了): 不会再答, 别空转三次 ramp。交接重开的那几秒
-            // pane 也是死的, 先等交接收尾再看; 别的换新 (respawn) 给一小段 grace。
-            await deps.handedOff?.(s.to);
-            if (s.answer !== undefined)
-                return { status: "done", body: s.answer };
-            if (!(await deps.paneLive(s.to))) {
-                await sleep(DEAD_GRACE_MS);
-                await deps.handedOff?.(s.to);
-                if (s.answer !== undefined)
-                    return { status: "done", body: s.answer };
-                if (!(await deps.paneLive(s.to)))
-                    return failed("dead");
-            }
-            const wr = await settled(s.to, Math.min(deadline(), Date.now() + RAMP_MS), deadline, aborted, () => news(reply()));
-            if (aborted())
-                return undefined;
-            if (!wr.idle) {
-                if (wr.reason === "timeout")
-                    return failed("timeout");
-                continue;
-            }
-            // 它停下是因为在交接: 等交接收尾, 答案要么已钉在 s.answer, 要么义务转进了新会话
-            // (那就接着守新会话)。这一段与下面的 replyFor 之间不能有 await —— 交接一旦
-            // 开始就在旧会话还在时把 transfer 做完, 同步读到的必然还是旧 transcript。
-            const handing = deps.handingOff?.(s.to) ?? false;
-            if (handing)
-                await deps.handedOff?.(s.to);
-            if (s.answer !== undefined)
-                return { status: "done", body: s.answer };
-            if (handing)
-                continue;
-            const got = reply();
-            if (got && news(got))
-                return { status: got.error ? "error" : parseClosing(got.text).kind === "need" ? "need" : "done", body: got.text };
-            // 读进了没答 = 扑空一次; 还没读进 = 前面有别的轮, 接着等 —— 除非整段 ramp 都静着。
-            // 报过 error / NEED 之后它停着是在等人续跑或答复, 不算扑空, 守到期限。
-            if (!reported() && !asked() && (got !== undefined || wr.quiet))
-                fruitless++;
-        }
-        // 打回过的那份: 它原样再交一遍 (按原文排除, 看不出是新的), 或打回那句因 reload 没注入
-        // 进去 —— 都扑空到这里。手上的原文就是它的交代, 照收, 别报 silent。
-        return s.bounced ? { status: "done", body: s.bounced } : failed("silent");
-    };
-    /** 失败回执的正文: 守护进程的一句说明 + 对方最后一句 (给发话方一点线索)。 */
-    const failure = (s, status) => {
-        const why = {
-            timeout: s.outcome?.status === "need"
-                ? `它的反问 (NEED) 等了 ${Math.round((Date.now() - s.at) / 60_000)} 分钟没人答`
-                : `等了 ${Math.round((Date.now() - s.at) / 60_000)} 分钟它还没答完`,
-            silent: `它停下了 ${MAX_FRUITLESS} 次, 都没答这一句`,
-            dead: "它的 pane 没了",
-        };
-        // An answer transfer belongs to a specific human turn. The target may have
-        // handled another person's message since then, so a time-only transcript
-        // tail can disclose that unrelated message in the failure receipt.
-        const last = (s.answerTransfer
-            ? (s.turn ? deps.replyFor(s.to, deps.nameOf(s.from), s.at, s.turn)?.text : undefined)
-            : !s.turn ? deps.lastWords?.(s.to, s.at) : undefined)?.trim();
-        return `（守护进程: ${deps.nameOf(s.to)} 没有给出结论 —— ${why[status] ?? status}。）${last ? `\n它最后说的: ${clipMiddle(last, 600)}` : ""}`;
-    };
-    // Inbox consumers are independent of outcome watchers. One consumer per asker
-    // waits for that pane; every other asker can consume while it is busy/offline.
-    let mailOrder = Math.max(0, ...[...slots.values()].flatMap((s) => (s.inbox ?? []).map((m) => m.order)));
-    const consumers = new Set();
-    const retryTimers = new Map();
-    const mails = (from) => [...slots.values()].filter((s) => !from || s.from === from)
-        .flatMap((s) => (s.inbox ?? []).map((mail) => ({ s, mail })));
-    const queued = (from) => mails(from).filter(({ mail }) => mail.state === "queued")
-        .sort((a, b) => a.mail.order - b.mail.order);
-    const activeMail = (s, m) => !writeFailed && !stale(s)
-        && !!s.inbox?.includes(m) && ["queued", "delivering"].includes(m.state);
-    const retry = (s, m, reason) => {
-        m.state = "queued";
-        m.reason = reason;
-        m.retryAt = Date.now() + Math.min(30_000, (deps.retryMs ?? 1000) * 2 ** Math.min(m.attempts, 5));
-        s.undelivered = true;
-        save(s);
-    };
-    const account = (s, m) => {
-        if (m.accounted)
-            return;
-        deps.onOutcome?.(s, m.outcome.status, m.outcome.body, false);
-        if (isTerminal(m.outcome.status) && s.job)
-            deps.settleJob?.(s.job, s.to, m.outcome.status, parseClosing(m.outcome.body).artifacts, { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
-        m.accounted = true;
-        save(s);
-        if (isTerminal(m.outcome.status))
-            nudgeHolds();
-    };
-    // The ACK is durable before waking a parent. Replay only the local relay after
-    // a crash between these writes, never the external paste.
-    const finishMail = (s, m) => {
-        if (m.state !== "delivered" || m.relayed)
-            return;
-        const k = m.meta?.replyTo;
-        const p = k?.kind === "peer" ? upstream(k, s.from) : undefined;
-        if (p && !p.resolved && !p.claimed && m.sentAt !== undefined && (p.deferred || p.at < m.sentAt))
-            relay(p, m.sentAt);
-        m.relayed = true;
-        save(s);
-    };
-    const consume = async (from) => {
-        while (!stopped && !writeFailed) {
-            const next = queued(from)[0];
-            if (!next)
-                return;
-            const { s, mail: m } = next;
-            if ((m.retryAt ?? 0) > Date.now())
-                return;
-            if (!activeMail(s, m)) {
-                m.state = "superseded";
-                save(s);
-                continue;
-            }
-            account(s, m);
-            await deps.handedOff?.(from);
-            if (!activeMail(s, m))
-                continue;
-            if (!(await deps.paneLive(from))) {
-                retry(s, m, "asker unavailable; retained in inbox");
-                return;
-            }
-            if (!activeMail(s, m))
-                continue;
-            if (!(await deps.idleNow(from))) {
-                await deps.untilIdle(from, IDLE_STEP_MS, { aborted: () => !activeMail(s, m) });
-                continue;
-            }
-            if (!activeMail(s, m) || deps.handingOff?.(from))
-                continue;
-            const final = isTerminal(m.outcome.status);
-            const current = (m.generation ?? s.gen) === s.gen;
-            const { parent: _parent, ...route } = routeOf(s, final && current);
-            const peers = s.job ? ofJob(from, s.job) : [s];
-            const tally = s.job ? deps.jobTally?.(s.job) : undefined;
-            m.meta = {
-                eventId: m.id, from: s.to, job: s.job, status: m.outcome.status, turn: s.turn ?? "",
-                done: Math.max(peers.filter((x) => x.resolved).length, tally?.done ?? 0),
-                total: Math.max(peers.length, tally?.total ?? 0),
-                ...(s.asker ? { asker: s.asker } : {}), ...route,
-            };
-            m.state = "delivering";
-            m.attempts++;
-            m.sentAt = Date.now();
-            // Persist the ambiguous boundary before transport. A restarted delivering
-            // event is uncertain even if its ACK never made it to disk.
-            save(s);
-            let result;
-            try {
-                result = await deps.deliver(from, m.outcome.body, m.meta, () => activeMail(s, m));
-            }
-            catch (e) {
-                result = { ok: false, uncertain: true, reason: e.message };
-            }
-            if (stale(s))
-                continue;
-            if (!result.uncertain && result.ok) {
-                m.state = "delivered";
-                if (current) {
-                    s.delivered = true;
-                    delete s.undelivered;
-                    if (final) {
-                        s.claimed = true;
-                        s.settled = true;
-                    }
-                }
-                save(s);
-                finishMail(s, m);
-            }
-            else if (!result.uncertain && result.retryable === true) {
-                if (!activeMail(s, m)) {
-                    m.state = "superseded";
-                    save(s);
-                    continue;
-                }
-                retry(s, m, result.reason ?? "transport confirmed no input sent");
-                return;
-            }
-            else {
-                m.state = "uncertain";
-                m.reason = result.reason ?? "delivery acknowledgement unknown; reconciliation required";
-                s.undelivered = true;
-                save(s);
-                // No settle/release: an uncertain last sibling cannot acquire answer
-                // ownership for an unrelated later receipt, nor be sent twice on restart.
-            }
-            deps.log.info({ from, turn: s.turn, eventId: m.id, state: m.state, attempts: m.attempts }, "receipt inbox: delivery");
-        }
-    };
-    const pump = (from, retryReady = false) => {
-        if (stopped || writeFailed || consumers.has(from))
-            return;
-        const old = retryTimers.get(from);
-        if (old) {
-            clearTimeout(old);
-            retryTimers.delete(from);
-        }
-        const head = queued(from)[0];
-        if (!head)
-            return;
-        const delay = (head.mail.retryAt ?? 0) - Date.now();
-        if (delay > 0 || (head.mail.retryAt !== undefined && !retryReady)) {
-            // Even expired backoff yields to the event loop (slow fsync can consume it).
-            const timer = setTimeout(() => { retryTimers.delete(from); pump(from, true); }, Math.max(0, delay));
-            timer.unref?.();
-            retryTimers.set(from, timer);
-            return;
-        }
-        consumers.add(from);
-        void consume(from).catch((e) => {
-            deps.log.warn({ from, err: e.message }, "receipt inbox: consumer failed");
-            const head = queued(from)[0];
-            if (head && !writeFailed && !stopped)
-                retry(head.s, head.mail, e.message);
-        }).finally(() => { consumers.delete(from); pump(from); });
-    };
-    const enqueueOutcome = (s, out) => {
-        // A newer result makes a not-yet-consumed NEED/error obsolete. Anything
-        // already exposed retains its delivery evidence in the event history.
-        (s.inbox ?? []).filter((m) => m.state === "queued" && !isTerminal(m.outcome.status))
-            .forEach((m) => { m.state = "superseded"; });
-        const m = { id: `r${randomBytes(12).toString("hex")}`, order: ++mailOrder,
-            queuedAt: Date.now(), generation: s.gen, outcome: out, state: "queued", attempts: 0 };
-        s.outcome = out;
-        if (out.status === "canceled")
-            s.cancellationId = m.id;
-        s.resolved = isTerminal(out.status);
-        s.delivered = false;
-        s.inbox = [...(s.inbox ?? []), m];
-        save(s); // outcome + queued event in one durable write, before any asker IO
-        try {
-            account(s, m);
-        }
-        finally {
-            pump(s.from);
-        }
-    };
-    const watch = async (s) => {
-        const lg = deps.log.child({ mod: "receipt", from: deps.nameOf(s.from), to: deps.nameOf(s.to), ...(s.job ? { job: s.job } : {}) });
-        const anchor = s.at;
-        // 终态写一次不再改: reload 打断投递后续守的那一份直接重投同一个结果, 不再重等。
-        const got = s.outcome && isTerminal(s.outcome.status) ? s.outcome : await awaitReply(s);
-        // 等的过程中被 cancel 落了终态: 以它为准 (pane 随后被杀, awaitReply 可能报的是 dead)。
-        const out = canceled(s) ? s.outcome : got;
-        if (stale(s))
-            return;
-        if (canceled(s) && s.cancellationId && s.inbox?.some((m) => m.id === s.cancellationId)) {
-            pump(s.from);
-            return;
-        }
-        if (s.claimed || !out) { // wait_peer 抢先取走了
-            s.resolved = true;
-            settle(s);
-            if (s.job)
-                deps.settleJob?.(s.job, s.to, "done", [], { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
-            return;
-        }
-        // 下面到 save 之间不能有 await: relay 与这里的判定必须看到同一个状态。
-        // 锚被 relay 挪到了回执那一句: 刚取到的是旧锚的答案 (那句「已派」), 重来。
-        if (s.at !== anchor)
-            return watch(s);
-        // 它这一轮又派了活, 结论要等那些回来 —— 这一句不是定论: 不投、不计数 (§3.2)。
-        if (out.status === "done" && children(s).length) {
-            s.deferred = true;
-            save(s);
-            lg.info({ children: children(s).map((c) => deps.nameOf(c.to)) }, "receipt: 答话方又派了活, 等子回执回来再续");
-            return;
-        }
-        // 工单验收: 交了个空 RESULT (或缺约定的 ARTIFACT) —— 不投、不计数, 以发话方的名义同件号
-        // 打回一次; 再交上来的照收。新登记顶掉这一份 (它随即 stale), 守的是打回那一句的答案。
-        const why = out.status === "done" && s.job && !s.bounced && !deps.workflowPrereq?.(s.from, s.turn ?? "") ? deps.accept?.(s.job, out.body) : undefined;
-        if (why && deps.rebound) {
-            const at = Date.now();
-            const legs = (s.legs ?? 1) + 1;
-            const tell = { from: s.from, to: s.to, channel: s.channel, job: s.job, at, turn: s.turn, legs, deadlineAt: deadlineOf(at), ...(s.k ? { k: s.k } : {}), ...(s.asker ? { asker: s.asker } : {}), bounced: out.body, jobDispatchKey: s.jobDispatchKey ?? s.dispatchKey };
-            if (!deps.durableRebound)
-                register(tell);
-            const ok = await deps.rebound({ from: s.from, to: s.to, turn: s.turn, legs, channel: s.channel, ...(s.asker ? { asker: s.asker } : {}) }, why, tell);
-            if (!ok && deps.durableRebound) {
-                enqueueOutcome(s, out);
-                return;
-            }
-            lg.info({ why, ok }, "receipt: 不合工单验收, 打回一次");
-            // 打回没注入进去: 原来那份照常交上去 (钉成新 slot 的答案, 它的 watcher 直接拿去投)。
-            if (!ok) {
-                const n = upstream({ from: s.from, turn: s.turn }, s.to);
-                if (n?.bounced) {
-                    n.answer = out.body;
-                    save(n);
-                }
-            }
-            return;
-        }
-        if (s.answerTransfer) {
-            // Human answer transfers have their own durable delivery protocol.
-            s.outcome = out;
-            s.resolved = isTerminal(out.status);
-            save(s);
-            deps.onOutcome?.(s, out.status, out.body, false);
-            if (s.resolved && s.job)
-                deps.settleJob?.(s.job, s.to, out.status, parseClosing(out.body).artifacts, { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
-            if (s.resolved)
-                nudgeHolds();
-            s.claimed = true;
-            save(s);
-            s.delivered = await deps.deliverAnswer?.(s.answerTransfer, out) ?? false;
-            s.resolved = true;
-            settle(s);
-            return;
-        }
-        enqueueOutcome(s, out);
-        // Watching the worker continues even if the asker cannot consume NEED/error.
-        if (!isTerminal(out.status))
-            return watch(s);
-    };
-    const register = (tell, watchIt = true, interim) => {
-        const at = tell.at ?? Date.now();
-        const turn = tell.turn ?? newTurn();
-        // 续问一件停放着的: 接替它在停放处的位置, 不碰这一对眼下那一件。
-        const parked = slots.get(keyOfTurn(tell.from, tell.to, turn));
-        const prev = parked ?? slots.get(keyOfPair(tell.from, tell.to));
-        // The pair remains a compatibility index for wait_peer/pending. Every older
-        // turn, including completed but unconsumed results, keeps its own slot.
-        const park = !parked && !!prev && prev.turn !== turn;
-        // 顶掉一份还没落定的工单活、自己又没带工单: 继承那张工单 —— 旧那份不会再投了,
-        // 这一句的答案就是那个成员的交代; 不继承它就永远不计 done, 工单齐不了。停放的那份还会投, 不让。
-        const job = tell.job || (!park && prev?.job && !prev.resolved ? prev.job : "");
-        const s = {
-            ...tell,
-            ...(interim && ["need", "error"].includes(interim.status) ? { outcome: interim } : {}),
-            job,
-            at,
-            turn,
-            legs: tell.legs ?? 1,
-            deadlineAt: tell.deadlineAt ?? deadlineOf(at),
-            gen: (prev?.gen ?? 0) + 1,
-            claimed: false,
-            delivered: false,
-            resolved: false,
-            ...(parked ? { parked: true } : {}),
-            ...(!park && prev?.inbox ? { inbox: prev.inbox.map((m) => ({ ...m,
-                    generation: m.generation ?? prev.gen,
-                    state: m.state === "queued" && !isTerminal(m.outcome.status) ? "superseded" : m.state === "delivering" ? "uncertain" : m.state,
-                })) } : {}),
-        };
-        // Commit both keys atomically; a crash cannot leave two live aliases for
-        // the same turn or erase an old event between parking and registering.
-        const oldKey = prev && keyOfTurn(prev.from, prev.to, prev.turn ?? "");
-        persist({ ...(park && prev && oldKey ? { [oldKey]: { ...prev, parked: true } } : {}), [keyOf(s)]: s });
-        if (park && prev && oldKey) {
-            prev.parked = true;
-            slots.set(oldKey, prev);
-        }
-        slots.set(keyOf(s), s);
-        if (tell.queued) { /* accepted obligation; no silent/dead watcher until submission */ }
-        else if (watchIt)
-            arm(s);
-        else {
-            s.claimed = true;
-            s.resolved = true;
-            settle(s);
-        } // 不守 = 这一份没人会投
-        pump(s.from);
-        return { at: s.at, turn: s.turn };
-    };
-    // ── 停放 (after) ─────────────────────────────────────────────────────
-    const holdKey = (h) => keyOfTurn(h.from, h.to, h.turn);
-    // A failed write pauses all releases, including closures already inside transport.
-    // Failed cancellation is not acknowledged: retain the original durable/memory row
-    // for operator reconciliation before restarting the store.
-    let holdWriteFailed = false;
-    const writeHold = (write) => {
-        if (holdWriteFailed)
-            throw new Error("hold persistence failed; reconcile storage before reload");
-        try {
-            write();
-        }
-        catch (e) {
-            holdWriteFailed = true;
-            throw e;
-        }
-    };
-    const saveHold = (h) => writeHold(() => { deps.holdStore?.set(holdKey(h), h); });
-    const dropHold = (h) => {
-        writeHold(() => { deps.holdStore?.drop(holdKey(h)); });
-        holds.delete(holdKey(h));
-    };
-    /** 前置件号 → 此刻的样子。先看回执槽 (按发话方 + 件号找, 不论发给谁), 再看自己也停放着的, 最后看快照。 */
-    const prereqOf = (from, turn, seen = {}) => {
-        const tracked = deps.workflowPrereq?.(from, turn);
-        if (tracked)
-            return tracked;
-        const s = [...slots.values()].find((x) => x.from === from && x.turn === turn);
-        const st = s?.outcome?.status;
-        if (s && s.resolved && st && isTerminal(st))
-            return { state: st === "done" ? "done" : "failed", seen: { to: s.to, status: st, body: s.outcome.body } };
-        // wait_peer 取走的: resolved 而没有 outcome —— 结论已在发话方会话里, 算 done。
-        if (s && s.resolved && !st)
-            return { state: "done", seen: { to: s.to, status: "done", body: "" } };
-        if (s || [...holds.values()].some((h) => h.from === from && h.turn === turn))
-            return { state: "pending" };
-        const old = seen[turn];
-        return old ? { state: old.status === "done" ? "done" : "failed", seen: old } : { state: "unknown" };
-    };
-    /** 同一对眼下有一件别的、没落定的活: 现在投会顶掉它的回执槽 —— 等它落定。 */
-    const pairBusy = (h) => {
-        const cur = slots.get(keyOfPair(h.from, h.to));
-        return !!cur && !cur.resolved && !cur.claimed && cur.turn !== h.turn;
-    };
-    /** 不投了: 落成一份 canceled 回给发话方, 走与别的回执同一条路 (投递、计数、记账都在 watch 里)。
-     *  按件号停放着放进去 (parked), 绝不占 from→to 的位置 —— 那里可能有在飞的另一件。 */
-    const cancelHold = (h, why, silent = false) => {
-        if (holds.get(holdKey(h)) !== h)
-            return;
-        const existing = slots.get(keyOfTurn(h.from, h.to, h.turn));
-        if (existing?.outcome?.status === "canceled") {
-            dropHold(h);
-            if (!existing.claimed)
-                arm(existing);
-            return;
-        }
-        const at = Date.now();
-        const s = {
-            from: h.from, to: h.to, channel: h.channel, job: h.job, at, turn: h.turn, legs: 1, deadlineAt: at,
-            ...(h.k ? { k: h.k } : {}), ...(h.asker ? { asker: h.asker } : {}),
-            gen: (slots.get(keyOfTurn(h.from, h.to, h.turn))?.gen ?? 0) + 1,
-            claimed: silent, delivered: false, resolved: silent, settled: silent, parked: true,
-            outcome: { status: "canceled", body: `（守护进程: ${why}）` },
-        };
-        slots.set(keyOf(s), s);
-        save(s);
-        if (silent)
-            deps.onOutcome?.(s, "canceled", s.outcome.body, true);
-        if (!silent)
-            enqueueOutcome(s, s.outcome);
-        dropHold(h);
-    };
-    const releasing = new Set();
-    /** 逐件看停放着的: 有失败的 → 不投; 都 done 了且这一对没被占着 → 放行; 超过保留期 → 不投。 */
-    const tickHolds = async () => {
-        if (stopped || writeFailed || holdWriteFailed)
-            return;
-        for (const h of [...holds.values()]) {
-            if (releasing.has(holdKey(h)) || !holds.has(holdKey(h)))
-                continue;
-            const ps = h.after.map((t) => [t, prereqOf(h.from, t, h.seen)]);
-            const fresh = ps.filter(([t, p]) => (p.state === "done" || p.state === "failed") && !h.seen[t]);
-            if (fresh.length) {
-                const seen = { ...h.seen, ...Object.fromEntries(fresh.map(([t, p]) => [t, p.seen])) };
-                saveHold({ ...h, seen });
-                h.seen = seen;
-            }
-            const bad = ps.find(([, p]) => p.state === "failed" || p.state === "unknown");
-            if (bad) {
-                const [t, p] = bad;
-                cancelHold(h, p.state === "unknown"
-                    ? `前置 ${t} 的登记找不到了 (被同一对的新一句顶掉或已过期), 这件 (${h.turn}) 没投。`
-                    : `前置 ${t} (${deps.nameOf(p.seen.to)}) 以 ${p.seen.status} 收场, 这件 (${h.turn}) 没投。`);
-                continue;
-            }
-            if (Date.now() - h.at >= KEEP_MS) {
-                cancelHold(h, `这件 (${h.turn}) 排了超过 24 小时, 前置始终没落定, 不投了。`);
-                continue;
-            }
-            if (ps.some(([, p]) => p.state === "pending") || pairBusy(h))
-                continue;
-            // 放行可能要等目标闲下来 (几分钟): 不堵住巡检里别的停放件。
-            releasing.add(holdKey(h));
-            void (async () => {
-                try {
-                    const r = (await deps.release?.(h, h.seen, () => !stopped && !writeFailed && !holdWriteFailed && holds.get(holdKey(h)) === h)) ?? { ok: false, reason: "没有放行通路" };
-                    if (holds.get(holdKey(h)) !== h)
-                        return;
-                    if (r.ok)
-                        dropHold(h);
-                    else
-                        cancelHold(h, `前置都 done 了, 但这件 (${h.turn}) 投不出去: ${r.reason ?? "未知原因"}, 没投。`);
-                }
-                catch (e) {
-                    try {
-                        if (!holdWriteFailed)
-                            cancelHold(h, `放行时出错 (${e.message}), 这件 (${h.turn}) 没投。`);
-                    }
-                    catch (writeError) {
-                        deps.log.error({ err: writeError.message, turn: h.turn }, "receipt: cancellation persistence failed");
-                    }
-                    if (holdWriteFailed)
-                        deps.log.error({ err: e.message, turn: h.turn }, "receipt: hold persistence failed; releases paused for reconciliation");
-                }
-                finally {
-                    releasing.delete(holdKey(h));
-                }
-            })();
-        }
-    };
-    let holdTimer;
-    const startHolds = () => {
-        if (holdTimer)
-            return;
-        holdTimer = setInterval(() => { void tickHolds().catch((e) => deps.log.warn({ err: e.message }, "receipt: 停放巡检出错")); }, HOLD_POLL_MS);
-        holdTimer.unref?.();
-    };
-    /** 事件驱动再补一刀: 前置一落定就立刻判, 不等下一个巡检周期。 */
-    const nudgeHolds = () => { if (holds.size)
-        void tickHolds().catch(() => undefined); };
-    return {
-        stop: () => {
-            stopped = true;
-            retryTimers.forEach(clearTimeout);
-            retryTimers.clear();
-            if (holdTimer)
-                clearInterval(holdTimer);
-        },
-        inbox: (from) => mails(from).sort((a, b) => a.mail.order - b.mail.order).map(({ s, mail }) => structuredClone({ ...mail, from: s.from, to: s.to, turn: s.turn ?? "" })),
-        register,
-        confirmDelivery: (eventId) => {
-            for (const s of slots.values()) {
-                const m = s.inbox?.find((m) => m.id === eventId && m.state === "uncertain");
-                if (!m)
-                    continue;
-                m.state = "delivered";
-                m.reason = "submission confirmed by durable event/transcript evidence";
-                if ((m.generation ?? s.gen) === s.gen) {
-                    s.delivered = true;
-                    delete s.undelivered;
-                    if (isTerminal(m.outcome.status)) {
-                        s.claimed = true;
-                        s.settled = true;
-                    }
-                }
-                save(s);
-                finishMail(s, m);
-                pump(s.from);
-            }
-        },
-        commit: (tell) => {
-            let s = upstream({ from: tell.from, turn: tell.turn ?? "" }, tell.to);
-            if (!s) {
-                register({ ...tell, queued: true });
-                s = upstream({ from: tell.from, turn: tell.turn ?? "" }, tell.to);
-            }
-            if (!s || s.dispatchKey !== tell.dispatchKey || !s.queued)
-                return;
-            s.queued = false;
-            save(s);
-            arm(s);
-        },
-        watching: (tell) => {
-            const s = upstream({ from: tell.from, turn: tell.turn ?? "" }, tell.to);
-            return !!s && !s.resolved && !s.claimed && (tell.dispatchKey
-                ? s.dispatchKey === tell.dispatchKey
-                : s.at === tell.at && (s.legs ?? 1) === (tell.legs ?? 1));
-        },
-        continuation: (from, to, turn) => {
-            const s = upstream({ from, turn }, to);
-            return !s || s.resolved || s.claimed ? undefined : { from, to, turn, channel: s.channel, job: s.job,
-                at: Date.now(), legs: (s.legs ?? 1) + 1, deadlineAt: s.deadlineAt, k: s.k, asker: s.asker, jobDispatchKey: s.jobDispatchKey ?? s.dispatchKey };
-        },
-        reask: (from, to, turn) => {
-            const s = upstream({ from, turn }, to);
-            if (!s || s.resolved || s.claimed)
-                return undefined;
-            const legs = (s.legs ?? 1) + 1;
-            register({ from, to, channel: s.channel, job: s.job, turn, legs, ...(s.answerTransfer ? { answerTransfer: s.answerTransfer } : {}), ...(s.deadlineAt ? { deadlineAt: s.deadlineAt } : {}), ...(s.k ? { k: s.k } : {}), ...(s.asker ? { asker: s.asker } : {}) });
-            return { legs, channel: s.channel, ...(s.asker ? { asker: s.asker } : {}) };
-        },
-        prepare: (from, to, re) => {
-            const want = re ? canonicalTurn(re) : undefined;
-            const s = want ? upstream({ from, turn: want }, to) : undefined;
-            return s?.turn && s.turn === want
-                ? { turn: s.turn, legs: (s.legs ?? 1) + 1, job: s.job, channel: s.channel, asker: s.asker, k: s.k }
-                : { turn: newTurn(), legs: 1, ...(re ? { reUnknown: true } : {}) };
-        },
-        pendingDelivery: (from, k, except) => [...slots.values()].some((s) => s.from === from && !!s.k && sameK(s.k, k)
-            && s.inbox?.some((m) => m.id !== except && ["queued", "delivering", "uncertain"].includes(m.state))),
-        claim: (from, to, turn) => {
-            const s = turn ? upstream({ from, turn }, to) : slots.get(keyOfPair(from, to));
-            if (!s)
-                return false;
-            if (s.answerTransfer)
-                return s.delivered;
-            // Transport may already have exposed this event. Do not let a concurrent
-            // wait_peer take a second copy, or turn an unknown ACK into a success.
-            if (s.inbox?.some((m) => (m.generation ?? s.gen) === s.gen && ["delivering", "uncertain"].includes(m.state)))
-                return "uncertain";
-            const fresh = !s.settled;
-            s.inbox?.filter((m) => m.state === "queued" && (m.generation ?? s.gen) === s.gen).forEach((m) => { m.state = "claimed"; });
-            s.claimed = true;
-            s.resolved = true;
-            settle(s);
-            if (fresh) {
-                release(s);
-                deps.onOutcome?.(s, "done", "", true);
-            }
-            return s.delivered;
-        },
-        sentTurn: (from, to) => slots.get(keyOfPair(from, to))?.turn,
-        sentAt: (from, to) => slots.get(keyOfPair(from, to))?.at ?? 0,
-        outstanding: (from, job) => [...slots.values()]
-            .filter((s) => s.from === from && !s.resolved && (job === undefined || s.job === job))
-            .map((s) => deps.nameOf(s.to)),
-        transfer: (to, answered, carryAt) => {
-            const owed = [...slots.values()].filter((s) => s.to === to && !s.resolved && !s.claimed);
-            const carried = owed.filter((s) => {
-                const got = answered(s);
-                if (got.trim())
-                    s.answer = got;
-                else {
-                    s.at = carryAt;
-                    s.deadlineAt = Math.max(s.deadlineAt ?? 0, carryAt + CARRY_GRACE_MS);
-                }
-                save(s);
-                return !got.trim();
-            });
-            if (owed.length)
-                deps.log.info({ mod: "receipt", to: deps.nameOf(to), answered: owed.length - carried.length, carried: carried.map((s) => deps.nameOf(s.from)) }, "receipt: 交接时转交");
-            return carried;
-        },
-        pending: (from, to) => {
-            const s = slots.get(keyOfPair(from, to));
-            return s && !s.resolved && !s.claimed ? { job: s.job, turn: s.turn ?? "", need: s.outcome?.status === "need", ...(s.deferred ? { deferred: true } : {}) } : undefined;
-        },
-        states: () => {
-            // 一个 target 欠好几份时只探一次 (探针要读它 transcript 的尾巴)。
-            const probed = new Map();
-            const parked = (t) => probed.get(t) ?? probed.set(t, deps.parkedNow?.(t) ?? false).get(t);
-            return [...slots.values()]
-                .filter((s) => !s.resolved && !s.claimed)
-                .map((s) => ({
-                from: s.from, to: s.to, turn: s.turn ?? "", job: s.job,
-                state: s.queued ? "queued" : turnState(s, { parked: !s.outcome && parked(s.to) }),
-                ageMs: Date.now() - s.at,
-                ...(s.k ? { k: s.k } : {}),
-            }))
-                // 停放着的 (等前置): 还没投出去, 但发话方在等它 —— 同样在飞。
-                .concat([...holds.values()].map((h) => ({ from: h.from, to: h.to, turn: h.turn, job: h.job, state: "queued", ageMs: Date.now() - h.at, ...(h.k ? { k: h.k } : {}) })));
-        },
-        cancel: (target, by, only = () => true) => {
-            // 排着还没投的 (停放): 不投了; 发起 stop 的那方自己知道, 不回执。
-            const held = [...holds.values()].filter((h) => h.to === target && only({ from: h.from, turn: h.turn }));
-            held.forEach((h) => cancelHold(h, `${deps.nameOf(target)} 被 ${deps.nameOf(by)} 收掉 / 打断了, 这件排着的活 (${h.turn}) 没投。`, h.from === by));
-            const hit = [...slots.values()].filter((s) => s.to === target && !s.resolved && !s.claimed && !canceled(s) && only({ from: s.from, turn: s.turn ?? "" }));
-            for (const s of hit) {
-                // Keep cancellation consistent with timeout/dead/silent: transferred
-                // answers may only quote text tied to their own source turn.
-                const last = (s.answerTransfer
-                    ? (s.turn ? deps.replyFor(s.to, deps.nameOf(s.from), s.at, s.turn)?.text : undefined)
-                    : !s.turn ? deps.lastWords?.(s.to, s.at) : undefined)?.trim();
-                s.outcome = {
-                    status: "canceled",
-                    body: `（守护进程: ${deps.nameOf(s.to)} 被 ${deps.nameOf(by)} 收掉 / 打断了, 这件活没有结论。）${last ? `\n它最后说的: ${clipMiddle(last, 600)}` : ""}`,
-                };
-                if (s.job)
-                    deps.settleJob?.(s.job, s.to, "canceled", [], { turn: s.turn, dispatchKey: s.jobDispatchKey ?? s.dispatchKey });
-                // 发起 stop 的那方自己知道, 不投; 守着的 watcher 看到 claimed 就收尾。
-                if (s.from === by && !s.answerTransfer) {
-                    deps.onOutcome?.(s, "canceled", s.outcome.body, true);
-                    s.claimed = true;
-                    s.resolved = true;
-                    settle(s);
-                    continue;
-                }
-                s.queued = false;
-                save(s);
-                if (s.answerTransfer)
-                    arm(s, true);
-                else
-                    enqueueOutcome(s, s.outcome);
-            }
-            if (hit.length)
-                nudgeHolds();
-            return hit.length + held.length;
-        },
-        prereqs: (from, turns, seen) => turns.map((t) => prereqOf(from, canonicalTurn(t), seen)),
-        hold: (h) => {
-            const x = { ...h, seen: {} };
-            saveHold(x);
-            holds.set(holdKey(x), x);
-            startHolds();
-            nudgeHolds();
-        },
-        cancelHeld: (job, by) => {
-            const hit = [...holds.values()].filter((h) => h.job === job);
-            hit.forEach((h) => cancelHold(h, `工单 ${job} 收了, 这件排着的活 (${h.turn}) 没投。`, h.from === by));
-            return hit.length;
-        },
-        parentOf: (self, env, channel, opening) => {
-            if (env?.quiet)
-                return undefined;
-            if (env?.receipt)
-                return env.k ? kOfAttr(env.k) : undefined;
-            if (env?.kind === "peer" && env.private) {
-                const p = [...slots.values()].find((x) => x.to === self && !x.resolved && !x.claimed && (env.turn ? x.turn === env.turn : deps.nameOf(x.from) === env.from));
-                return p && { kind: "peer", from: p.from, turn: p.turn };
-            }
-            // 私聊轮 (频道 "") 派出的活没有群可续: 不能回落成 home, 否则回执轮就进了群。
-            return channel ? { kind: "chat", channel, turn: env?.eventId ?? opening } : undefined;
-        },
-        ancestorsOf: (self, k) => {
-            // 第一跳 (self 此刻答的那件) 按定义在途; 往上每一跳都要那件活还没落定 / 没被 wait_peer 取走 ——
-            // 已结束的那一跳不再是在等, 链到此为止 (宁可少拦)。
-            const go = (who, cur, seen, first) => {
-                if (cur?.kind !== "peer" || seen.has(cur.from))
-                    return [];
-                const up = upstream(cur, who);
-                if (!first && (!up || up.resolved || up.claimed))
-                    return [];
-                return [cur.from, ...go(cur.from, up?.k, new Set([...seen, cur.from]), false)];
-            };
-            return go(self, k, new Set([self]), true);
-        },
-        askerOf: (self, env) => {
-            // 回执轮: 那件活是 self 派出去的; 派来的活: 那件活是派给 self 的。同一对后来又说了一句,
-            // 槽被顶掉 —— 件号对不上就认不出, 宁可不知道。
-            const mine = (x) => (env.receipt ? x.from === self : x.to === self);
-            const hit = [...slots.values()].find((x) => mine(x) && (env.turn ? x.turn === env.turn : deps.nameOf(env.receipt ? x.to : x.from) === env.from));
-            return hit?.asker;
-        },
-        resume: () => {
-            // 挂起且子活还没落定的不守: 叫醒它是 relay / release 的事, 这里再 arm 一个就是两个 watcher。
-            const open = [...slots.values()].filter((s) => !s.settled && !(s.deferred && children(s).length));
-            // Restore durable inboxes before observing new worker results. The
-            // delivering boundary is ambiguous after a crash, never an automatic retry.
-            for (const s of slots.values()) {
-                for (const m of s.inbox ?? []) {
-                    if (m.state === "delivering") {
-                        m.state = "uncertain";
-                        m.reason = "daemon restarted during delivery; reconciliation required";
-                        s.undelivered = true;
-                        save(s);
-                    }
-                    if (!m.accounted && !["superseded", "claimed"].includes(m.state))
-                        account(s, m);
-                    finishMail(s, m);
-                }
-                pump(s.from);
-            }
-            open.forEach((s) => {
-                if (s.resolved && s.inbox?.some((m) => (m.generation ?? s.gen) === s.gen))
-                    return;
-                if (!s.answerTransfer && s.outcome && isTerminal(s.outcome.status) && (s.claimed || s.delivered)) {
-                    // Old-format transport had no intent journal. Preserve it explicitly
-                    // rather than replaying a possibly delivered legacy result.
-                    s.inbox = [{ id: `r${randomBytes(12).toString("hex")}`, order: ++mailOrder, queuedAt: Date.now(),
-                            outcome: s.outcome, state: "uncertain", attempts: 1, reason: "legacy delivery boundary unknown" }];
-                    s.undelivered = true;
-                    save(s);
-                    return;
-                }
-                s.claimed = false;
-                arm(s);
-            });
-            if (open.length)
-                deps.log.info({ mod: "receipt", resumed: open.map((s) => `${deps.nameOf(s.from)}←${deps.nameOf(s.to)}`) }, "receipt: reload 后续守");
-            startHolds();
-            return open.length;
-        },
-    };
-};
-//# sourceMappingURL=receipts.js.map