wezard 2.7.1 → 2.7.3

package/dist/daemon/message-events.js

@@ -1,5 +1,17 @@
 import { createHash } from "node:crypto";
 import { loadJsonMap } from "../shared/json-map-store.js";
+const TOMB_AFTER_MS = 24 * 3600_000;
+const TOMB_TTL_MS = 7 * 24 * 3600_000;
+const isTomb = (x) => x.tomb === true;
+const terminal = (x) => x === "complete" || x === "canceled";
+/** complete 要等 finalized (路由判定补完) 才算了结; canceled 本身就是了结。 */
+const settled = (e) => e.execution === "canceled" || (e.execution === "complete" && !!e.finalized);
+const endedAt = (e) => e.endedAt ?? Math.max(e.at, e.result?.at ?? 0, e.turnClosedAt ?? 0, e.releasedAt ?? 0);
+const entomb = (e) => ({ id: e.id, fingerprint: e.fingerprint, execution: e.execution, endedAt: endedAt(e), tomb: true });
+/** 每次落盘前跑: 了结满一天的行裁成墓碑, 墓碑满七天删掉。 */
+export const gcEvents = (now) => (rows) => Object.fromEntries(Object.entries(rows).flatMap(([id, x]) => isTomb(x) ? (now - x.endedAt >= TOMB_TTL_MS ? [] : [[id, x]])
+    : settled(x) && terminal(x.execution) && now - endedAt(x) >= TOMB_AFTER_MS ? [[id, entomb({ ...x, execution: x.execution })]]
+        : [[id, x]]));
 const HOLD_LOG_MS = 30_000;
 const HOLD_RELOG_MS = 5 * 60_000;
 const canonical = (x) => Array.isArray(x) ? x.map(canonical)
@@ -15,9 +27,14 @@ export const rejectedAck = (e) => !!e && typeof e === "object"
     && typeof e.errcode === "number" && e.errcode !== 0
     && typeof e.errmsg === "string" && !!e.headers;
 export const createMessageEvents = (file, io) => {
-    const db = loadJsonMap(file, undefined, { strict: true });
+    const db = loadJsonMap(file, (rows) => gcEvents(Date.now())(rows), { strict: true });
     const outbox = loadJsonMap(`${file}.finals`, undefined, { strict: true });
     Object.entries(db.all()).forEach(([id, e]) => {
+        if (e && isTomb(e)) {
+            if (e.id !== id || typeof e.fingerprint !== "string" || !terminal(e.execution) || !Number.isFinite(e.endedAt))
+                throw new Error(`invalid message event tombstone ${id}`);
+            return;
+        }
         if (!e || e.id !== id || typeof e.fingerprint !== "string" || !e.target || typeof e.speaker !== "string" || typeof e.channel !== "string" || (e.serves !== undefined && typeof e.serves !== "string") || !e.payload || typeof e.payload.text !== "string" || (!e.payload.human === !e.payload.peer) || !Number.isFinite(e.at) || !Number.isFinite(e.attempts) || !Number.isFinite(e.deadline) || !["queued", "dispatching", "awaiting-result", "complete", "canceled", "uncertain"].includes(e.execution))
             throw new Error(`invalid message event ${id}`);
     });
@@ -25,8 +42,12 @@ export const createMessageEvents = (file, io) => {
         if (!d || d.id !== id || !Array.isArray(d.parts) || d.parts.length !== d.chunks?.length || !d.chunks.every((c) => typeof c === "string") || !d.parts.every((p) => ["pending", "sending", "waiting-ack", "delivered", "uncertain", "failed"].includes(p.state)) || !d.channel)
             throw new Error(`invalid final delivery ${id}`);
     });
+    /** 调度只看活行; 墓碑只给 accept 判重 (与 `known`)。 */
+    const live = (id) => { const x = db.get(id); return x && !isTomb(x) ? x : undefined; };
+    const liveRows = () => Object.values(db.all()).filter((x) => !isTomb(x));
     let stopped = true;
     let accepting = true;
+    let draining = false;
     let pumping = false;
     let timer;
     const active = new Set();
@@ -47,21 +68,44 @@ export const createMessageEvents = (file, io) => {
         if (due)
             io.held?.(e, why, now - h.since);
     };
+    /** 一次同步扫描 (pump 的一轮 / status 的一次) 内, 三个适配器按 target 只问一次: 它们读注册表、
+     *  读绑定, 每行现问就是 O(行数) 次 I/O, 而 pinOf / queue 又对每行扫全表 —— 那就是 O(R²)。
+     *  同一次同步调用里 pane / 会话本来不会变, 快照反而让一次扫描内各行口径一致。扫描外 (异步
+     *  回调、注入边界) 不在 scope 里, 照旧现问。 */
+    let pass;
+    const scan = (run) => {
+        if (pass)
+            return run();
+        pass = new Map();
+        try {
+            return run();
+        }
+        finally {
+            pass = undefined;
+        }
+    };
+    const ask = (kind, target) => {
+        const key = `${kind}\0${target}`;
+        if (pass?.has(key))
+            return pass.get(key);
+        const v = io[kind](target);
+        pass?.set(key, v);
+        return v;
+    };
+    const resourceAt = (target) => ask("resource", target);
     // An exposed event belongs to the session that received it, not a replacement
     // pane now bound to the same wizard. Keep its uncertain history for reconciliation.
     const resourceOf = (e) => {
-        const transcript = io.transcript(e.target);
-        const sessionId = io.sessionId(e.target);
         if (e.exposure === "none")
-            return io.resource(e.target);
+            return resourceAt(e.target);
         if (e.sessionId)
-            return e.sessionId === sessionId ? io.resource(e.target) : `session:${e.sessionId}`;
+            return e.sessionId === ask("sessionId", e.target) ? resourceAt(e.target) : `session:${e.sessionId}`;
         if (e.transcript)
-            return e.transcript === transcript ? io.resource(e.target) : `transcript:${e.transcript}`;
-        return io.resource(e.target);
+            return e.transcript === ask("transcript", e.target) ? resourceAt(e.target) : `transcript:${e.transcript}`;
+        return resourceAt(e.target);
     };
     const bounded = (id, read) => {
-        const e = db.get(id);
+        const e = live(id);
         const target = e ? resourceOf(e) : id;
         if (probing.has(id) || probeTargets.has(target) || probeCount >= 16)
             return Promise.reject(new Error("probe already running or probe capacity occupied"));
@@ -82,13 +126,17 @@ export const createMessageEvents = (file, io) => {
                 timer = setTimeout(() => reject(new Error("pane probe exceeded 5s; no transport attempted")), 5000);
             })]).finally(() => { clearTimeout(timer); probeCount--; release(); });
     };
-    const patch = (id, p) => db.set(id, { ...db.get(id), ...p });
+    const patch = (id, p) => {
+        const prev = live(id);
+        const next = { ...prev, ...p };
+        return db.set(id, terminal(next.execution) && !terminal(prev.execution) ? { ...next, endedAt: Date.now() } : next);
+    };
     const part = (id, n, p) => {
         const d = outbox.get(id);
         outbox.set(id, { ...d, parts: d.parts.map((x, i) => i === n ? { ...x, ...p } : x) });
     };
     const cancel = (select, reason = "canceled by owner") => {
-        const rows = Object.values(db.all()).filter((e) => !["complete", "canceled"].includes(e.execution) && select(e));
+        const rows = liveRows().filter((e) => !["complete", "canceled"].includes(e.execution) && select(e));
         rows.forEach((e) => {
             const next = patch(e.id, { canceled: true, reason, execution: e.exposure === "none" ? "canceled" : "uncertain" });
             io.canceled(next); // Cancellation after exposure never asserts the pane stopped.
@@ -103,10 +151,13 @@ export const createMessageEvents = (file, io) => {
         // 内容就该是同一条消息, 哪怕 serves 的来历变了 —— 它不算内容的一部分。
         const { serves: _routing, ...identified } = clean;
         const fingerprint = digest(identified.identity ? [JSON.parse(identified.identity), identified.speaker, identified.channel] : identified);
-        const old = db.get(input.id);
-        if (old && old.fingerprint !== fingerprint)
+        const prior = db.get(input.id);
+        if (prior && prior.fingerprint !== fingerprint)
             throw new Error(`event identity conflict: ${input.id}`);
-        let e = old;
+        // 墓碑 = 早已投过并了结: 重放 / 重入箱到此为止, 不复活、不再注入。
+        if (prior && isTomb(prior))
+            return { ok: true, queued: false, eventId: prior.id };
+        let e = prior;
         if (!e) {
             e = { ...clean, fingerprint, at: Date.now(), execution: "queued", exposure: "none", attempts: 0 };
             db.merge({ [e.id]: e });
@@ -124,11 +175,11 @@ export const createMessageEvents = (file, io) => {
         return { ok: true, queued: e.execution === "queued", eventId: e.id };
     };
     const result = (id, body, revision, turn) => {
-        const e = db.get(id);
+        const e = live(id);
         if (!e || e.result?.revision === revision)
             return;
         patch(id, { finalized: false, result: { body, revision, at: Date.now() }, execution: "complete", exposure: "consumed", ...(turn ? { turn } : {}) });
-        io.final?.(db.get(id), { text: body });
+        io.final?.(live(id), { text: body });
     };
     const delivery = (input) => {
         const old = outbox.get(input.id);
@@ -175,7 +226,7 @@ export const createMessageEvents = (file, io) => {
             return;
         if (!evidence.consumed)
             return;
-        const current = db.get(e.id);
+        const current = live(e.id);
         if (["complete", "canceled"].includes(current.execution))
             return;
         if (current.exposure !== "consumed" || (evidence.closedAt && !current.turnClosedAt))
@@ -187,15 +238,15 @@ export const createMessageEvents = (file, io) => {
                 ...(evidence.closedAt ? { turnClosedAt: evidence.closedAt } : {}), turn: evidence.turn ?? current.turn,
             });
         if (!current.canceled)
-            io.committed(db.get(e.id));
+            io.committed(live(e.id));
         if (evidence.body !== undefined && evidence.error) {
             // CLI 报错收尾: 那段报错不是定论 (§5), 交路由表落中途态 —— 事件本身不动, 它的执行态
             // 自有 deadline / 续跑那条路管 (与改动前一致)。
-            io.final?.(db.get(e.id), { text: evidence.body, error: true });
+            io.final?.(live(e.id), { text: evidence.body, error: true });
         }
         else if (evidence.body !== undefined && evidence.revision) {
             result(e.id, evidence.body, evidence.revision, evidence.turn);
-            io.recovered(db.get(e.id));
+            io.recovered(live(e.id));
         }
     };
     /** 收件箱里的回执事件 (`rcpt:<event>:<rev>`): 只有它带路由归属 (serves), 也只有它该合并。 */
@@ -205,10 +256,10 @@ export const createMessageEvents = (file, io) => {
      *  (`execution: complete`, 它们的 id 已终态, 重放不再注入); 结论由这一轮的终句统一交代。
      *  回执的正文与信封是分开的两件 (`payload.text` 不含信封), 所以并的只是正文, 信封留注入那一份。 */
     const absorb = (id) => {
-        const e = db.get(id);
+        const e = live(id);
         if (!e || !isRcpt(e))
             return;
-        const absorbed = Object.values(db.all())
+        const absorbed = liveRows()
             .filter((x) => x.id !== e.id && isRcpt(x) && x.target === e.target && x.serves === e.serves
             && x.execution === "queued" && !x.canceled)
             .sort((a, b) => a.at - b.at || (a.id < b.id ? -1 : 1));
@@ -219,17 +270,18 @@ export const createMessageEvents = (file, io) => {
         absorbed.forEach((x) => patch(x.id, { execution: "complete", exposure: "consumed", finalized: true, reason: `merged into ${e.id}` }));
     };
     const inject = async (id, resource) => {
+        const target = live(id).target;
         active.add(resource);
-        targets.add(db.get(id).target);
+        targets.add(target);
         try {
             absorb(id);
-            const e = db.get(id);
+            const e = live(id);
             if (stopped || e.execution !== "queued" || !io.valid(e))
                 return;
             io.accepted(e);
             patch(id, { execution: "dispatching", attempts: e.attempts + 1, transcript: io.transcript(e.target) ?? e.transcript });
             const boundary = (phase, identity) => {
-                const current = db.get(id);
+                const current = live(id);
                 if (stopped || current.canceled || !io.valid(current))
                     return false;
                 if (current.exposure !== "none" && current.transcript && current.transcript !== io.transcript(e.target))
@@ -241,12 +293,12 @@ export const createMessageEvents = (file, io) => {
             };
             let r;
             try {
-                r = await io.inject(db.get(id), boundary);
+                r = await io.inject(live(id), boundary);
             }
             catch (error) {
-                r = { ok: false, uncertain: db.get(id).exposure !== "none", retryable: db.get(id).exposure === "none", reason: why(error) };
+                r = { ok: false, uncertain: live(id).exposure !== "none", retryable: live(id).exposure === "none", reason: why(error) };
             }
-            const latest = db.get(id);
+            const latest = live(id);
             if (latest.result || latest.execution === "complete") {
                 if (!latest.canceled)
                     io.committed(latest);
@@ -257,6 +309,10 @@ export const createMessageEvents = (file, io) => {
                 if (!latest.canceled)
                     io.committed(committed);
             }
+            else if (r.gone && !r.uncertain && latest.exposure === "none" && !latest.canceled) {
+                // 收方真没了 (绑定按 store 也恢复不了): 退避重投只会空转到期限, 收成 canceled 交给路由层上浮。
+                io.gone?.(patch(id, { execution: "canceled", reason: r.reason || "target gone" }));
+            }
             else if (r.retryable && !r.uncertain && !latest.canceled) {
                 patch(id, { execution: "queued", exposure: "none", retryAt: backoff(latest.attempts), reason: r.reason });
             }
@@ -265,7 +321,7 @@ export const createMessageEvents = (file, io) => {
         }
         catch (e) {
             try {
-                patch(id, { reason: why(e), retryAt: backoff(db.get(id).attempts) });
+                patch(id, { reason: why(e), retryAt: backoff(live(id).attempts) });
             }
             catch {
                 accepting = false;
@@ -277,7 +333,7 @@ export const createMessageEvents = (file, io) => {
         }
         finally {
             active.delete(resource);
-            targets.delete(db.get(id).target);
+            targets.delete(target);
             void pump();
         }
     };
@@ -291,38 +347,36 @@ export const createMessageEvents = (file, io) => {
      *  `retryAt` 未到的行不算挡住 —— 它在退避, 不该把整条 pane 的后来者一起钉住: 队头一次
      *  探测超时 (5s) 就能把一个 target 静音十几分钟, 人话排在后面时是纯损失。
      *  injectable 与 blocker 共用这一条 —— 判据分家过一次, 表现是「对外说没人挡着, 实际谁也进不去」。 */
-    const pinOf = (e) => {
-        const rows = Object.values(db.all()).sort((a, b) => a.at - b.at);
-        const resource = io.resource(e.target);
+    // 先判执行态 (纯字段), 再问 resourceOf: 表里九成多是终态行, 不该替它们付 I/O。
+    const pinOf = (e) => scan(() => {
+        const rows = liveRows().sort((a, b) => a.at - b.at);
+        const resource = resourceAt(e.target);
         const older = new Set(rows.slice(0, rows.findIndex((x) => x.id === e.id)).map((x) => x.id));
-        return rows.find((x) => x.id !== e.id && resourceOf(x) === resource
+        return rows.find((x) => x.id !== e.id
             && (x.execution === "dispatching"
                 || (!direct(e) && ((x.execution === "uncertain" && !x.releasedAt)
                     || (e.priority === "normal" && (x.execution === "awaiting-result"
-                        || (x.execution === "queued" && (x.retryAt ?? 0) <= Date.now() && older.has(x.id))))))));
-    };
+                        || (x.execution === "queued" && (x.retryAt ?? 0) <= Date.now() && older.has(x.id)))))))
+            && resourceOf(x) === resource);
+    });
     /** 全局 4 路并发只限回执 / 派活: 人话之间、人话与别的 pane 都互不相干, 只认同 pane 物理互斥。 */
     const injectable = (e) => !stopped && e.execution === "queued" && !e.canceled && e.deadline > Date.now() && io.valid(e)
-        && !targets.has(e.target) && !active.has(io.resource(e.target)) && (direct(e) || active.size < 4)
+        && !targets.has(e.target) && !active.has(resourceAt(e.target)) && (direct(e) || active.size < 4)
         && pinOf(e) === undefined;
+    const blockerOf = (hit) => hit && { id: hit.id, execution: hit.execution,
+        reason: hit.reason ?? (hit.execution === "uncertain" ? "旧事件投递结果不确定，需对账" : `等待较早事件（${hit.execution}）`) };
     const blocker = (id) => {
-        const e = db.get(id);
-        if (!e || e.execution !== "queued")
-            return undefined;
-        const hit = pinOf(e);
-        return hit ? { id: hit.id, execution: hit.execution,
-            reason: hit.reason ?? (hit.execution === "uncertain" ? "旧事件投递结果不确定，需对账" : `等待较早事件（${hit.execution}）`) } : undefined;
+        const e = live(id);
+        return e?.execution === "queued" ? blockerOf(pinOf(e)) : undefined;
     };
     /** 一条还没贴出去的 event 此刻的排队全貌: 同 pane 上排在它前面的未了结行, 以及 injectable
-     *  的每一条否决项各自落在哪 —— 给人看「卡在谁后面、为什么、几时再试」, 不是一句「已排队」。 */
-    const queue = (id) => {
-        const e = db.get(id);
-        if (!e)
-            return undefined;
-        const resource = io.resource(e.target);
-        const ahead = Object.values(db.all())
-            .filter((x) => x.id !== e.id && x.at <= e.at && resourceOf(x) === resource
-            && ["queued", "dispatching", "awaiting-result"].includes(x.execution) && !x.canceled)
+     *  的每一条否决项各自落在哪 —— 给人看「卡在谁后面、为什么、几时再试」, 不是一句「已排队」。
+     *  `pin` 一并交回, 让 status 不必为 blocker 再扫一遍全表。 */
+    const queueOf = (e) => scan(() => {
+        const resource = resourceAt(e.target);
+        const ahead = liveRows()
+            .filter((x) => x.id !== e.id && x.at <= e.at && ["queued", "dispatching", "awaiting-result"].includes(x.execution) && !x.canceled
+            && resourceOf(x) === resource)
             .sort((a, b) => a.at - b.at);
         const pin = pinOf(e);
         const holds = [
@@ -332,10 +386,33 @@ export const createMessageEvents = (file, io) => {
             !direct(e) && active.size >= 4 ? `全局同时投递已满 ${active.size} 路` : "",
             pin ? `挡在前面: ${pin.id.slice(0, 10)}（${pin.execution}${pin.reason ? ` · ${pin.reason}` : ""}）` : "",
         ].filter(Boolean);
-        return { execution: e.execution, ahead: ahead.map(clone), holds };
+        return { execution: e.execution, ahead: ahead.map(clone), holds, pin };
+    });
+    const queue = (id) => {
+        const e = live(id);
+        if (!e)
+            return undefined;
+        const { pin: _pin, ...q } = queueOf(e);
+        return q;
+    };
+    const partsByEvent = () => Object.values(outbox.all()).reduce((m, d) => d.eventId ? m.set(d.eventId, [...(m.get(d.eventId) ?? []), ...d.parts]) : m, new Map());
+    const deliveryOf = (parts) => parts.some((p) => p.state === "failed") ? "failed"
+        : parts.some((p) => p.state === "uncertain") ? "uncertain" : parts.some((p) => p.state !== "delivered") ? "delivery-pending" : parts.length ? "delivered" : "none";
+    /** status 里的一行: 排着的行只扫一次队 (blocker 取 queueOf 交回的 pin)。 */
+    const view = (e, parts) => {
+        const q = e.execution === "queued" ? queueOf(e) : undefined;
+        const blockedBy = blockerOf(q?.pin);
+        const held = holding.get(e.id);
+        return { ...clone(e),
+            status: e.execution === "dispatching" ? "executing" : e.execution,
+            ...(blockedBy ? { blockedBy } : {}),
+            // 回执 / 派活排着时把扣住它的每一条都摆出来 (含 ready=false 这种 queue() 看不见的)。
+            ...(q && !direct(e) ? { holds: [...q.holds, ...(held ? [`${held.why} · 已扣 ${Math.round((Date.now() - held.since) / 1000)}s`] : [])] } : {}),
+            delivery: deliveryOf(parts),
+        };
     };
     const release = (id, reason) => {
-        const e = db.get(id);
+        const e = live(id);
         const note = reason.trim().slice(0, 500);
         if (!e)
             return { ok: false, reason: "unknown event" };
@@ -355,118 +432,120 @@ export const createMessageEvents = (file, io) => {
             return;
         pumping = true;
         try {
-            // Scan the first unfinished part; later pending parts cannot jump an uncertain predecessor.
-            Object.values(outbox.all()).forEach((d) => d.parts.forEach((p, n) => {
-                if (!["waiting-ack", "uncertain"].includes(p.state))
-                    return;
-                const evidence = io.deliveryEvidence?.(d, n);
-                if (evidence)
-                    part(d.id, n, { state: evidence.state === "queued" ? "waiting-ack" : evidence.state, ack: evidence.ack, reason: evidence.reason });
-            }));
-            const finals = Object.values(outbox.all());
-            const rotated = [...finals.slice(deliveryCursor), ...finals.slice(0, deliveryCursor)];
-            rotated.filter((d) => {
-                const p = d.parts.find((x) => x.state !== "delivered");
-                return !delivering.has(d.id) && p?.state === "pending" && (p.retryAt ?? 0) <= Date.now();
-            }).slice(0, Math.max(0, 4 - delivering.size)).forEach((d) => {
-                deliveryCursor = (finals.findIndex((x) => x.id === d.id) + 1) % Math.max(1, finals.length);
-                void send(d.id).catch(io.error);
-            });
-            const rows = Object.values(db.all()).sort((a, b) => a.at - b.at);
-            [...holding.keys()].filter((id) => db.get(id)?.execution !== "queued").forEach((id) => holding.delete(id));
-            const fair = [...rows.slice(probeCursor), ...rows.slice(0, probeCursor)];
-            fair.forEach((e) => {
-                if (stopped)
-                    return;
-                // Expiration and permission withdrawal are ledger work; a busy or hung
-                // probe on this pane must not prevent queued messages from expiring.
-                if (e.execution === "queued" && (e.deadline <= Date.now() || !io.valid(e))) {
-                    cancel((x) => x.id === e.id, e.deadline <= Date.now() ? "deadline expired before submission" : "permission withdrawn");
-                    return;
-                }
-                if (["awaiting-result", "uncertain"].includes(e.execution) && e.deadline <= Date.now() && !e.releasedAt) {
-                    patch(e.id, { execution: "uncertain", releasedAt: Date.now(),
-                        releaseSource: "deadline",
-                        releaseReason: "event deadline elapsed; uncertainty retained and automatic retry withheld",
-                        reason: `${e.reason ? `${e.reason}; ` : ""}event deadline elapsed; queue released with uncertain delivery` });
-                    return;
-                }
-                // 人话的 ready 不碰 pane (只看交接闸), 不必占探测位: 否则同 pane 上一条 awaiting-result
-                // 每秒一次的 evidence 探测 (最长 5s) 几乎一直占着 probeTargets, 人话被反复跳过或误判失败退避。
-                if (e.execution === "queued" && direct(e)) {
-                    if ((e.retryAt ?? 0) > Date.now() || !injectable(e))
+            scan(() => {
+                // Scan the first unfinished part; later pending parts cannot jump an uncertain predecessor.
+                Object.values(outbox.all()).forEach((d) => d.parts.forEach((p, n) => {
+                    if (!["waiting-ack", "uncertain"].includes(p.state))
+                        return;
+                    const evidence = io.deliveryEvidence?.(d, n);
+                    if (evidence)
+                        part(d.id, n, { state: evidence.state === "queued" ? "waiting-ack" : evidence.state, ack: evidence.ack, reason: evidence.reason });
+                }));
+                const finals = Object.values(outbox.all());
+                const rotated = [...finals.slice(deliveryCursor), ...finals.slice(0, deliveryCursor)];
+                rotated.filter((d) => {
+                    const p = d.parts.find((x) => x.state !== "delivered");
+                    return !delivering.has(d.id) && p?.state === "pending" && (p.retryAt ?? 0) <= Date.now();
+                }).slice(0, Math.max(0, 4 - delivering.size)).forEach((d) => {
+                    deliveryCursor = (finals.findIndex((x) => x.id === d.id) + 1) % Math.max(1, finals.length);
+                    void send(d.id).catch(io.error);
+                });
+                const rows = liveRows().sort((a, b) => a.at - b.at);
+                [...holding.keys()].filter((id) => live(id)?.execution !== "queued").forEach((id) => holding.delete(id));
+                const fair = [...rows.slice(probeCursor), ...rows.slice(0, probeCursor)];
+                fair.forEach((e) => {
+                    if (stopped)
+                        return;
+                    // Expiration and permission withdrawal are ledger work; a busy or hung
+                    // probe on this pane must not prevent queued messages from expiring.
+                    if (e.execution === "queued" && (e.deadline <= Date.now() || !io.valid(e))) {
+                        cancel((x) => x.id === e.id, e.deadline <= Date.now() ? "deadline expired before submission" : "permission withdrawn");
                         return;
-                    void io.ready(e).then((ready) => {
-                        const current = db.get(e.id);
-                        if (ready && injectable(current))
-                            void inject(e.id, io.resource(current.target));
-                    }).catch(io.error);
-                    return;
-                }
-                if (probing.has(e.id) || probeTargets.has(resourceOf(e)) || probeCount >= 16) {
-                    if (e.execution === "queued")
-                        hold(e, "探测位被占 (同 pane 上另一条正在探测)");
-                    return;
-                }
-                probeCursor = (rows.findIndex((x) => x.id === e.id) + 1) % Math.max(1, rows.length);
-                const failed = (error) => {
-                    const current = db.get(e.id);
-                    if (!stopped && current && !["complete", "canceled"].includes(current.execution)) {
-                        const probeAttempts = (current.probeAttempts ?? 0) + 1;
-                        patch(e.id, { probeAttempts, retryAt: backoff(probeAttempts), reason: `${current.reason ? `${current.reason}; ` : ""}${why(error)}` });
                     }
-                    io.error(error);
-                };
-                if (["awaiting-result", "uncertain"].includes(e.execution)) {
-                    if (e.execution === "uncertain" && (e.turnClosedAt || e.releasedAt))
+                    if (["awaiting-result", "uncertain"].includes(e.execution) && e.deadline <= Date.now() && !e.releasedAt) {
+                        patch(e.id, { execution: "uncertain", releasedAt: Date.now(),
+                            releaseSource: "deadline",
+                            releaseReason: "event deadline elapsed; uncertainty retained and automatic retry withheld",
+                            reason: `${e.reason ? `${e.reason}; ` : ""}event deadline elapsed; queue released with uncertain delivery` });
                         return;
-                    if ((e.retryAt ?? 0) > Date.now())
+                    }
+                    // 人话的 ready 不碰 pane (只看交接闸), 不必占探测位: 否则同 pane 上一条 awaiting-result
+                    // 每秒一次的 evidence 探测 (最长 5s) 几乎一直占着 probeTargets, 人话被反复跳过或误判失败退避。
+                    if (e.execution === "queued" && direct(e)) {
+                        if ((e.retryAt ?? 0) > Date.now() || !injectable(e))
+                            return;
+                        void io.ready(e).then((ready) => {
+                            const current = live(e.id);
+                            if (ready && injectable(current))
+                                void inject(e.id, io.resource(current.target));
+                        }).catch(io.error);
                         return;
-                    const currentSession = io.sessionId(e.target);
-                    const currentTranscript = io.transcript(e.target);
-                    const replaced = e.exposure !== "none" && (e.sessionId
-                        ? e.sessionId !== currentSession : !!e.transcript && e.transcript !== currentTranscript);
-                    if (replaced && !e.supersededBy)
-                        patch(e.id, { supersededBy: currentSession ?? (currentTranscript ? `transcript:${currentTranscript}` : "replacement-session-unavailable"),
-                            reason: `${e.reason ? `${e.reason}; ` : ""}session replaced; old execution remains uncertain pending transcript reconciliation` });
-                    void observe(e).then(() => {
-                        if (!stopped && e.deadline <= Date.now() && db.get(e.id).execution === "awaiting-result")
-                            patch(e.id, { execution: "uncertain", reason: "deadline exceeded; result/physical completion not confirmed" });
-                    }).catch(failed);
-                    return;
-                }
-                if (e.execution === "complete") {
-                    if (!e.finalized) {
-                        if (!e.canceled)
-                            io.committed(e);
-                        if (e.result) {
-                            io.recovered(e);
-                            // reload 落在 result 与 finalized 之间: 重放这一刻补上路由判定 (幂等 —— 同一条
-                            // 定论重放只会在表上再写一次同样的 op)。
-                            io.final?.(e, { text: e.result.body });
+                    }
+                    if (probing.has(e.id) || probeTargets.has(resourceOf(e)) || probeCount >= 16) {
+                        if (e.execution === "queued")
+                            hold(e, "探测位被占 (同 pane 上另一条正在探测)");
+                        return;
+                    }
+                    probeCursor = (rows.findIndex((x) => x.id === e.id) + 1) % Math.max(1, rows.length);
+                    const failed = (error) => {
+                        const current = live(e.id);
+                        if (!stopped && current && !["complete", "canceled"].includes(current.execution)) {
+                            const probeAttempts = (current.probeAttempts ?? 0) + 1;
+                            patch(e.id, { probeAttempts, retryAt: backoff(probeAttempts), reason: `${current.reason ? `${current.reason}; ` : ""}${why(error)}` });
                         }
-                        patch(e.id, { finalized: true });
+                        io.error(error);
+                    };
+                    if (["awaiting-result", "uncertain"].includes(e.execution)) {
+                        if (e.execution === "uncertain" && (e.turnClosedAt || e.releasedAt))
+                            return;
+                        if ((e.retryAt ?? 0) > Date.now())
+                            return;
+                        const currentSession = ask("sessionId", e.target);
+                        const currentTranscript = ask("transcript", e.target);
+                        const replaced = e.exposure !== "none" && (e.sessionId
+                            ? e.sessionId !== currentSession : !!e.transcript && e.transcript !== currentTranscript);
+                        if (replaced && !e.supersededBy)
+                            patch(e.id, { supersededBy: currentSession ?? (currentTranscript ? `transcript:${currentTranscript}` : "replacement-session-unavailable"),
+                                reason: `${e.reason ? `${e.reason}; ` : ""}session replaced; old execution remains uncertain pending transcript reconciliation` });
+                        void observe(e).then(() => {
+                            if (!stopped && e.deadline <= Date.now() && live(e.id).execution === "awaiting-result")
+                                patch(e.id, { execution: "uncertain", reason: "deadline exceeded; result/physical completion not confirmed" });
+                        }).catch(failed);
+                        return;
                     }
-                    return;
-                }
-                if (e.execution !== "queued")
-                    return;
-                // 原因里不带重试时刻: 每次退避时刻都在变, 带上就成了「原因变了」, 日志每轮重报。
-                if ((e.retryAt ?? 0) > Date.now()) {
-                    hold(e, `投递失败退避中${e.reason ? `（${e.reason}）` : ""}`);
-                    return;
-                }
-                if (!injectable(e)) {
-                    hold(e, `injectable=false: ${queue(e.id)?.holds.join("; ") || "无效 / 过期"}`);
-                    return;
-                }
-                void bounded(e.id, () => io.ready(e)).then((ready) => {
-                    const current = db.get(e.id);
-                    if (ready && injectable(current))
-                        void inject(e.id, io.resource(current.target));
-                    else if (current.execution === "queued")
-                        hold(current, ready ? "injectable=false (ready 之后)" : "ready=false (前置未落定 / owner 未判闲)");
-                }).catch(failed);
+                    if (e.execution === "complete") {
+                        if (!e.finalized) {
+                            if (!e.canceled)
+                                io.committed(e);
+                            if (e.result) {
+                                io.recovered(e);
+                                // reload 落在 result 与 finalized 之间: 重放这一刻补上路由判定 (幂等 —— 同一条
+                                // 定论重放只会在表上再写一次同样的 op)。
+                                io.final?.(e, { text: e.result.body });
+                            }
+                            patch(e.id, { finalized: true });
+                        }
+                        return;
+                    }
+                    if (e.execution !== "queued")
+                        return;
+                    // 原因里不带重试时刻: 每次退避时刻都在变, 带上就成了「原因变了」, 日志每轮重报。
+                    if ((e.retryAt ?? 0) > Date.now()) {
+                        hold(e, `投递失败退避中${e.reason ? `（${e.reason}）` : ""}`);
+                        return;
+                    }
+                    if (!injectable(e)) {
+                        hold(e, `injectable=false: ${queue(e.id)?.holds.join("; ") || "无效 / 过期"}`);
+                        return;
+                    }
+                    void bounded(e.id, () => io.ready(e)).then((ready) => {
+                        const current = live(e.id);
+                        if (ready && injectable(current))
+                            void inject(e.id, io.resource(current.target));
+                        else if (current.execution === "queued")
+                            hold(current, ready ? "injectable=false (ready 之后)" : "ready=false (前置未落定 / owner 未判闲)");
+                    }).catch(failed);
+                });
             });
         }
         catch (e) {
@@ -477,7 +556,10 @@ export const createMessageEvents = (file, io) => {
         }
     }
     const resume = () => {
-        Object.values(db.all()).filter((e) => e.execution === "dispatching").forEach((e) => patch(e.id, {
+        // Boot restoration may finish after shutdown has begun; never restart delivery then.
+        if (draining)
+            return;
+        liveRows().filter((e) => e.execution === "dispatching").forEach((e) => patch(e.id, {
             execution: e.exposure === "none" ? "queued" : "uncertain", reason: "daemon restarted at input boundary; transcript evidence required",
         }));
         Object.values(outbox.all()).forEach((d) => d.parts.forEach((p, n) => {
@@ -493,16 +575,16 @@ export const createMessageEvents = (file, io) => {
     return {
         accept, pump, resume, result, delivery, cancel, blocker, queue, release,
         running: () => !stopped,
-        bind: (id, turn) => { if (db.get(id))
+        bind: (id, turn) => { if (live(id))
             patch(id, { turn }); },
-        finished: (id) => { const e = db.get(id); if (e && !e.canceled && !e.result)
+        finished: (id) => { const e = live(id); if (e && !e.canceled && !e.result)
             patch(id, { execution: "complete", exposure: "consumed" }); },
-        released: (id) => { const e = db.get(id); if (e?.canceled)
+        released: (id) => { const e = live(id); if (e?.canceled)
             patch(id, { execution: "canceled", reason: `${e.reason ?? "canceled"}; pane idle confirmed` }); },
-        stopped: (target, reason) => Object.values(db.all()).filter((e) => e.target === target && e.canceled).forEach((e) => patch(e.id, { execution: "canceled", reason })),
+        stopped: (target, reason) => liveRows().filter((e) => e.target === target && e.canceled).forEach((e) => patch(e.id, { execution: "canceled", reason })),
         submission: async (id) => {
             for (;;) {
-                const e = db.get(id);
+                const e = live(id);
                 if (!e)
                     return { ok: false, retryable: true, reason: "event missing" };
                 if (["submitted", "consumed"].includes(e.exposure))
@@ -514,21 +596,24 @@ export const createMessageEvents = (file, io) => {
                 await new Promise((resolve) => setTimeout(resolve, 250));
             }
         },
+        // Keep ingress durable until WS/HTTP and their in-flight handlers have closed.
+        drain: () => { draining = true; stopped = true; clearInterval(timer); timer = undefined; },
         stop: () => { accepting = false; stopped = true; clearInterval(timer); timer = undefined; },
-        get: (id) => { const e = db.get(id); return e && clone(e); },
-        status: () => ({ events: Object.values(db.all()).map((e) => ({ ...clone(e),
-                status: e.execution === "dispatching" ? "executing" : e.execution,
-                ...(e.execution === "queued" && blocker(e.id) ? { blockedBy: blocker(e.id) } : {}),
-                // 回执 / 派活排着时把扣住它的每一条都摆出来 (含 ready=false 这种 queue() 看不见的)。
-                ...(e.execution === "queued" && !direct(e) ? { holds: [...queue(e.id).holds,
-                        ...(holding.get(e.id) ? [`${holding.get(e.id).why} · 已扣 ${Math.round((Date.now() - holding.get(e.id).since) / 1000)}s`] : [])] } : {}),
-                delivery: (() => {
-                    const parts = Object.values(outbox.all()).filter((d) => d.eventId === e.id).flatMap((d) => d.parts);
-                    return parts.some((p) => p.state === "failed") ? "failed" : parts.some((p) => p.state === "uncertain") ? "uncertain" : parts.some((p) => p.state !== "delivered") ? "delivery-pending" : parts.length ? "delivered" : "none";
-                })(), })), deliveries: Object.values(outbox.all()).map(clone) }),
+        get: (id) => { const e = live(id); return e && clone(e); },
+        /** 这个 id 用过没有 (含墓碑): 自己配 id 的调用方 (续问序号 / 交接续答) 据此避开撞号。 */
+        known: (id) => db.get(id) !== undefined,
+        ids: () => Object.keys(db.all()),
+        /** 只问执行态 (含墓碑): 判「这份投过没有」的调用方不必在乎它是不是已被裁掉。 */
+        executionOf: (id) => db.get(id)?.execution,
+        status: () => scan(() => {
+            const parts = partsByEvent();
+            return { events: liveRows().map((e) => view(e, parts.get(e.id) ?? [])), deliveries: Object.values(outbox.all()).map(clone) };
+        }),
+        /** 一条 event 的 status 视图 —— 轮询单条的调用方 (回归脚本) 不必为它把全表算一遍。 */
+        event: (id) => { const e = live(id); return e && scan(() => view(e, partsByEvent().get(id) ?? [])); },
         deliveryStatus: (id) => outbox.get(id)?.parts.map((p) => p.state),
-        reconcile: async (id) => { const e = db.get(id); if (e)
-            await observe(e); return db.get(id); },
+        reconcile: async (id) => { const e = live(id); if (e)
+            await observe(e); return live(id); },
     };
 };
 //# sourceMappingURL=message-events.js.map