telepost-bot 2.84.0__tar.gz → 2.84.2__tar.gz

{telepost_bot-2.84.0 → telepost_bot-2.84.2}/CHANGELOG.md

@@ -8,6 +8,24 @@
 > 发布说明面向普通用户：写「对用户有什么改变」，不写内部实现细节（模块名、函数名、配置键）；
 > 技术细节放进代码注释或 `docs/`。每个 Release 的正文由本文件对应版本段自动生成。
 
+## [2.84.2](https://github.com/redtidev1918/TelePost/compare/v2.84.1...v2.84.2) (2026-10-22)
+
+
+### Bug Fixes
+
+* **review:** answer each callback once and make failure feedback non-destructive ([223b1c1](https://github.com/redtidev1918/TelePost/commit/223b1c1f4e718273253a140c416e8eea58458989))
+* **review:** keep review cards actionable when a callback fails ([455ba69](https://github.com/redtidev1918/TelePost/commit/455ba690e0ac15a95b986c8e83eeaadf6e5375bf))
+* **review:** keep review cards actionable when a callback fails ([1827946](https://github.com/redtidev1918/TelePost/commit/1827946759284ddf9143f913bb22ae2b1a6408dc))
+
+## [2.84.1](https://github.com/redtidev1918/TelePost/compare/v2.84.0...v2.84.1) (2026-10-22)
+
+
+### Bug Fixes
+
+* exclude runtime tasks from update persistence ([b420ed6](https://github.com/redtidev1918/TelePost/commit/b420ed629b2fa1e64d38f2f2a763439b199d956f))
+* harden inbox completion and spoiler replay idempotency ([4c6375c](https://github.com/redtidev1918/TelePost/commit/4c6375c4514cfe2b5ae5f18f55a6169b8763ef7c))
+* prevent runtime task persistence from blocking review callbacks ([21dec7d](https://github.com/redtidev1918/TelePost/commit/21dec7d41965bb436d309715c1e58668ae479d1c))
+
 ## [2.84.0](https://github.com/redtidev1918/TelePost/compare/v2.83.2...v2.84.0) (2026-10-21)
 
 

{telepost_bot-2.84.0/telepost_bot.egg-info → telepost_bot-2.84.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: telepost-bot
-Version: 2.84.0
+Version: 2.84.2
 Summary: Telegram submission, review, and publication bot with a Mini App, HTTP API, and multi-bot supervisor.
 Author: redtidev1918
 License-Expression: MIT

{telepost_bot-2.84.0 → telepost_bot-2.84.2}/database/db_manager.py

@@ -107,6 +107,17 @@ async def init_db():
                 'CREATE INDEX IF NOT EXISTS idx_webhook_inbox_due '
                 'ON webhook_inbox(state, next_attempt_at, update_id)')
 
+            # A toggle and its callback receipt commit together; Inbox replay
+            # must not invert the same review a second time.
+            await conn.execute('''
+                CREATE TABLE IF NOT EXISTS review_spoiler_callbacks (
+                    callback_id TEXT NOT NULL,
+                    review_id INTEGER NOT NULL,
+                    created_at REAL NOT NULL,
+                    PRIMARY KEY (callback_id, review_id)
+                )
+            ''')
+
             # 媒体追加去重日志：同一 (user, update) 跨投稿代只应用一次
             # （epoch 仅作审计），与 submissions 行的更新同事务提交，崩溃后
             # 重放收敛。worker 严格按 update_id 头部顺序处理，正常路径不会
@@ -1063,6 +1074,9 @@ async def cleanup_old_data():
             await conn.execute(
                 "DELETE FROM webhook_inbox WHERE state='done' AND done_at < ?",
                 (now_ts - 7 * 86400,))
+            await conn.execute(
+                "DELETE FROM review_spoiler_callbacks WHERE review_id NOT IN "
+                "(SELECT id FROM pending_reviews)")
             await conn.execute(
                 "DELETE FROM webhook_inbox WHERE state='dead' AND updated_at < ?",
                 (now_ts - 30 * 86400,))

{telepost_bot-2.84.0 → telepost_bot-2.84.2}/handlers/callback_handlers.py

@@ -3,10 +3,12 @@
 """
 from ui.i18n import tr
 import logging
+import re
 from telegram import Update
 from telegram.ext import CallbackContext, ConversationHandler
 from telegram.constants import ParseMode
 
+from telepost.telegram.callback_feedback import answer_callback, has_answered
 from ui.keyboards import Keyboards
 from ui.messages import MessageFormatter
 from database.db_manager import get_db
@@ -33,16 +35,15 @@ GLOBAL_CALLBACK_PATTERNS = (
 
 async def _safe_answer(query, text: str = None, **kwargs):
     """
-    安全应答回调查询。
+    安全应答回调查询（§review-card-recovery）。
 
-    每个 callback query 只能被应答一次，重复应答会抛出 telegram.error.BadRequest。
-    这里统一吞掉该类错误：先到的应答生效（例如带 show_alert 的提示），
-    后续重复调用不再中断业务流程。
+    每个 callback query 只能被应答一次，重复应答会被 Telegram 拒绝。这里统一
+    委托给 ``callback_feedback.answer_callback``：先到的应答生效（例如带
+    show_alert 的提示），后续重复调用直接跳过且不抛错。
     """
-    try:
-        await query.answer(text=text, **kwargs)
-    except Exception as e:
-        logger.debug(f"回调应答失败（通常为重复应答或已过期）: {e}")
+    await answer_callback(
+        query, text, show_alert=bool(kwargs.get("show_alert", False)),
+    )
 
 
 async def handle_callback_query(update: Update, context: CallbackContext):
@@ -173,17 +174,59 @@ async def handle_callback_query(update: Update, context: CallbackContext):
             
     except Exception as e:
         logger.error(f"处理回调查询时出错: {e}", exc_info=True)
-        try:
-            await query.edit_message_text(
-                MessageFormatter.error_message("general")
+        # §review-card-recovery: no text-based "UI-only" classification here. The
+        # global catch is the *outer* boundary: a Telegram edit failure inside a
+        # handler is classified at that call site (is_ui_only_error requires a
+        # BadRequest raised by the edit itself), while anything reaching this
+        # level may have been raised by a channel publish, media upload or the
+        # review DB. Treating it as display noise would mark the update done and
+        # silently drop a retryable business failure.
+        #
+        # Feedback is answer-only when the callback has not been answered yet
+        # (handlers answer exactly once, before long work); otherwise the card is
+        # rebuilt from the row — a second answer would be dropped by Telegram.
+        if not has_answered(query):
+            await _safe_answer(
+                query, tr('操作失败，已记录；卡片与审核状态保持不变。'),
+                show_alert=True,
             )
-        except:
-            pass
+        await _restore_card_after_failure(context, data)
+        # Re-raise so PTB's error observers and the durable inbox worker record a
+        # bounded retry instead of a silent "done".
+        raise
+
+
+_REVIEW_CALLBACK_DATA = re.compile(
+    r"^review_(?:approve|reject|spoiler|preview|refetch|block_user|block_api):(\d+)$"
+)
+
+
+async def _restore_card_after_failure(context, data: str) -> None:
+    """Best-effort card rebuild for a review callback that just failed."""
+    match = _REVIEW_CALLBACK_DATA.match(data or "")
+    if not match:
+        return
+    bot = getattr(context, "bot", None)
+    if bot is None:
+        return
+    try:
+        from handlers.review import restore_review_card
+        await restore_review_card(bot, int(match.group(1)))
+    except Exception:
+        logger.debug("失败后恢复审核卡出错: data=%s", data, exc_info=True)
 
 
 async def handle_unknown_callback(update: Update, context: CallbackContext):
-    """Final fallback for callback data unclaimed by every business namespace."""
-    await update.callback_query.edit_message_text(tr('❌ 未知操作'))
+    """Final fallback for callback data unclaimed by every business namespace.
+
+    §review-card-recovery: an unroutable click (stale menu, old client, a card
+    whose namespace was removed) is answered with a popup. The message is NOT
+    edited — editing it here used to strip the keyboard off a message that may
+    still carry working buttons.
+    """
+    query = update.callback_query
+    logger.warning("未路由的回调查询: %s", query.data)
+    await _safe_answer(query, tr('❌ 未知操作'), show_alert=True)
 
 
 async def handle_hot_filter(update: Update, context: CallbackContext):

{telepost_bot-2.84.0 → telepost_bot-2.84.2}/handlers/review.py

@@ -49,6 +49,10 @@ from telepost.telegram.delivery.preparation import PHOTO_MAX_BYTES
 from telepost.telegram.delivery.sender import file_id_of as _file_id_of
 from telepost.telegram.review_stager import TelegramReviewStager
 from telepost.telegram import review_keyboard
+from telepost.telegram.callback_feedback import (
+    answer_callback,
+    is_ui_only_error,
+)
 
 logger = logging.getLogger(__name__)
 
@@ -1572,6 +1576,214 @@ async def refresh_refetch_card(bot, review_id: int, *,
         return False
 
 
+async def _record_card_restored(review_id: int, outcome: str, status: str,
+                                actor=None) -> None:
+    try:
+        from telepost.observability import audit
+        await audit.record_event(
+            "review.card_restored", review_id=int(review_id), actor=actor,
+            detail={"status": status, "result": outcome},
+        )
+    except Exception:
+        logger.debug("记录审核卡恢复审计失败: review_id=%s", review_id, exc_info=True)
+
+
+async def restore_review_card(bot, review_id: int, *, dry_run: bool = False,
+                             actor=None) -> dict:
+    """Re-render a review's control card from its DB row (§review-card-recovery).
+
+    The row is the source of truth and Telegram is a projection: a card that a
+    failed callback replaced with an error text (or that lost its buttons on a
+    replay) is rebuilt in place from ``pending_reviews``. Only an actionable
+    review gets moderation buttons — terminal rows come back READ-ONLY — and
+    review state is NEVER touched here. Nothing is ever reposted: the edit always
+    targets the durable ``control_message_id``.
+
+    Never raises; returns a small JSON-serializable plan/result dict.
+    """
+    result: dict = {"review_id": int(review_id), "ok": False}
+    try:
+        from telepost.storage.sqlite.reviews import ReviewRepository
+        row = await ReviewRepository().get(int(review_id))
+    except Exception:
+        logger.warning("恢复审核卡：读取审核记录失败 review_id=%s", review_id, exc_info=True)
+        result["reason"] = "read_failed"
+        return result
+    if row is None:
+        result["reason"] = "not_found"
+        return result
+
+    status = _row_value(row, "status") or ""
+    control = _row_value(row, "control_message_id")
+    chat_id = _row_value(row, "review_chat_id") or REVIEW_CHAT_ID
+    result.update({"status": status, "control_message_id": control,
+                   "chat_id": str(chat_id)})
+    if not control:
+        # A card was never durably recorded: the queue's
+        # reconcile_incomplete_reviews path owns that row. Never repost here.
+        result["reason"] = "no_control_message"
+        return result
+
+    if status == "pending":
+        if dry_run:
+            result.update({"ok": True, "dry_run": True, "card": "pending"})
+            return result
+        if await refresh_refetch_card(bot, int(review_id)):
+            result.update({"ok": True, "card": "pending", "edit": "edited"})
+            await _record_card_restored(review_id, "edited", status, actor)
+        else:
+            result.update({"ok": False, "reason": "edit_failed", "card": "pending"})
+        return result
+
+    text, markup = review_keyboard.card_from_row(row)
+    result.update({"card": "read_only", "text": text})
+    if dry_run:
+        result.update({"ok": True, "dry_run": True})
+        return result
+
+    from telepost.telegram.callback_feedback import edit_card_message
+    try:
+        outcome = await edit_card_message(bot, chat_id, control, text, markup)
+    except Exception:
+        logger.warning("恢复审核卡：编辑消息失败 review_id=%s", review_id, exc_info=True)
+        result.update({"ok": False, "reason": "edit_failed"})
+        await _record_card_restored(review_id, "failed", status, actor)
+        return result
+    result.update({"ok": outcome in ("edited", "unchanged"), "edit": outcome})
+    if outcome == "gone":
+        result["reason"] = "message_gone"
+    await _record_card_restored(review_id, outcome, status, actor)
+    return result
+
+
+async def _notify_state_mismatch(query, context, review_id: int, text: str) -> None:
+    """§review-card-recovery: report a decided/changed review WITHOUT killing the card.
+
+    The callback was already answered before the business call, so a second
+    ``answerCallbackQuery`` would be ignored by Telegram and the operator would
+    see nothing. Instead the card is rebuilt from the row: it shows the real
+    state (read-only when terminal) plus the original-link button, which is the
+    non-destructive feedback the operator needs. The reason is logged either way.
+    """
+    logger.info(
+        "审核操作与当前状态不一致（已应答，改用卡片状态同步）: review_id=%s reason=%s",
+        review_id, text,
+    )
+    bot = getattr(context, "bot", None)
+    if bot is None:
+        return
+    await restore_review_card(bot, int(review_id))
+
+
+_TERMINAL_REVIEW_STATUSES = ("rejected", "expired", "superseded")
+
+
+async def _terminal_state_alert(query, context, review_id: int) -> bool:
+    """Answer a click on an already-decided review, BEFORE any business call.
+
+    This is the only place a state conflict still gets a popup: the callback has
+    not been answered yet, so the alert actually reaches the client. The database
+    state machine stays authoritative — this pre-flight only decides *feedback*;
+    a pending/failed/publishing row still goes through the service CAS, and a
+    published row keeps the publish-reuse ledger path (``duplicate_suppressed``)
+    instead of being short-circuited here.
+    Returns True when the handler must stop.
+    """
+    row = await review_service.get_row(review_id)
+    if row is None:
+        await _answer(query, tr('审核记录不存在'), show_alert=True)
+        return True
+    status = _row_value(row, "status") or ""
+    if status not in _TERMINAL_REVIEW_STATUSES:
+        return False
+    await _answer(query, f"该投稿当前状态：{status}", show_alert=True)
+    bot = getattr(context, "bot", None)
+    if bot is not None:
+        await restore_review_card(bot, int(review_id))
+    return True
+
+
+async def _edit_card_or_recover(query, context, review_id: int, text: str,
+                                markup) -> None:
+    """Update a card AFTER a business decision has been committed.
+
+    A display failure here must never repeat the business action (publish,
+    reject, refetch) — the inbox would replay the whole handler. The card is
+    therefore best-effort: Telegram-side edit failures are logged and the card
+    is re-rendered read-only from the row; non-UI failures are surfaced in the
+    log and recovered the same way instead of being re-raised.
+    """
+    try:
+        await query.edit_message_text(
+            text, reply_markup=markup, disable_web_page_preview=True,
+        )
+        return
+    except Exception as exc:  # noqa: BLE001 - post-commit display must not raise
+        if is_ui_only_error(exc):
+            logger.info(
+                "审核卡更新未生效（消息不可编辑/未变化，业务已完成）: review_id=%s reason=%s",
+                review_id, exc,
+            )
+        else:
+            logger.warning(
+                "审核卡更新失败（业务已完成，不回滚、不重试）: review_id=%s",
+                review_id, exc_info=True,
+            )
+    bot = getattr(context, "bot", None)
+    if bot is not None:
+        await restore_review_card(bot, review_id)
+
+
+async def restore_card_command(update, context):
+    """`/restore_card <review_id> [--dry-run]` — admin recovery of a lost card.
+
+    The command only ever touches the database of the Bot it is sent to: every
+    Bot owns its own SQLite file and review ids collide across Bots, so an admin
+    must send it to the target Bot itself. Cross-Bot addressing is unsupported
+    and rejected explicitly.
+    """
+    user = update.effective_user
+    if user is None or user.id not in ADMIN_IDS:
+        await update.message.reply_text(tr('你没有审核权限'))
+        return
+    args = list(getattr(context, "args", None) or [])
+    # Exactly: one review id (``202`` or ``#202``) + optionally one ``--dry-run``.
+    # ``--bot``, unknown flags, extra tokens and duplicated flags are rejected
+    # without touching any Telegram card.
+    valid = (
+        len(args) in (1, 2)
+        and re.fullmatch(r"#?\d+", args[0]) is not None
+        and (len(args) == 1 or args[1] == "--dry-run")
+    )
+    if not valid:
+        await update.message.reply_text(
+            tr('用法：/restore_card <审核ID> [--dry-run]（只重建卡片，不改变审核状态）')
+        )
+        return
+    review_id = int(args[0].lstrip("#"))
+    dry_run = len(args) == 2
+    result = await restore_review_card(
+        context.bot, review_id, dry_run=dry_run, actor=user.id,
+    )
+    if not result.get("ok"):
+        await update.message.reply_text(
+            tr('恢复审核卡失败：{p0}').format(p0=result.get("reason") or 'unknown')
+        )
+        return
+    if dry_run:
+        await update.message.reply_text(
+            tr('审核 #{p0} 卡片预览（状态：{p1}，未修改任何内容）：\n\n{p2}').format(
+                p0=review_id, p1=result.get("status"), p2=result.get("text") or tr('（待审核，将按重抓状态重建）'),
+            )
+        )
+        return
+    await update.message.reply_text(
+        tr('已恢复审核 #{p0} 的卡片（状态：{p1}，未改变审核状态）。').format(
+            p0=review_id, p1=result.get("status"),
+        )
+    )
+
+
 async def reconcile_incomplete_reviews(bot, *, stale_seconds: float = 60.0) -> int:
     """Repair crash-left review rows by restoring a durable control message."""
     repaired = await queue_service.reconcile_incomplete(
@@ -1677,10 +1889,13 @@ async def _apply_review_group_mask(bot, row, mask_on: bool):
 
 # ---- callback handlers ----------------------------------------------------
 async def _answer(query, text=None, **kwargs):
-    try:
-        await query.answer(text=text, **kwargs)
-    except Exception:
-        logger.debug("回应审核按钮失败", exc_info=True)
+    # §review-card-recovery: Telegram accepts exactly ONE answer per callback
+    # query. Bookkeeping lives in ``callback_feedback.answer_callback`` so every
+    # handler (and the global fallback) shares it; a second answer would be
+    # silently dropped by Telegram, losing the operator-visible message.
+    await answer_callback(
+        query, text, show_alert=bool(kwargs.get("show_alert", False)),
+    )
 
 
 async def toggle_review_spoiler(update, context):
@@ -1696,7 +1911,8 @@ async def toggle_review_spoiler(update, context):
 
     try:
         await review_service.toggle_spoiler(
-            review_id, actor=update.effective_user.id
+            review_id, actor=update.effective_user.id,
+            callback_id=query.id if isinstance(query.id, str) else "",
         )
     except ReviewNotFoundError:
         await _answer(query, tr('审核记录不存在'), show_alert=True)
@@ -1727,24 +1943,17 @@ async def toggle_review_spoiler(update, context):
                 media_cleared=_row_value(row, "preview_state") == "cleared",
             )
         )
-    except Exception:
-        # §review-button-refresh: the mask is already in the DB and the
-        # review-group media already re-masked above, so a keyboard refresh
-        # failure must NOT be swallowed silently — otherwise the button label
-        # stays showing the stale spoiler value. Log at warn (with traceback)
-        # and surface a transient, visible alert to the admin via show_alert
-        # (a popup, not a new chat message, so repeated toggles do not spam).
+    except Exception as exc:  # noqa: BLE001 - business already committed
+        # §review-card-recovery: the spoiler flag + the review-group mask are
+        # already applied; a keyboard refresh failure must not be re-raised (the
+        # inbox would replay the handler and flip the mask again). Log and rebuild
+        # the card from the row — the callback was answered earlier, so a second
+        # answer would be dropped by Telegram anyway.
         logger.warning(
-            "刷新审核键盘失败，审核卡遮罩按钮标签可能已陈旧（遮罩状态已入库生效）: "
-            "review_id=%s",
-            review_id,
-            exc_info=True,
-        )
-        await _answer(
-            query,
-            tr('已遮罩，但按钮无法刷新（状态已{p0}）。').format(p0=tr('开启') if new_spoiler else tr('关闭')),
-            show_alert=True,
+            "刷新审核键盘失败，已按库内状态重建审核卡: review_id=%s ui_only=%s",
+            review_id, is_ui_only_error(exc), exc_info=True,
         )
+        await restore_review_card(bot, review_id)
 
 
 async def restore_review_preview(update, context):
@@ -1792,13 +2001,30 @@ async def restore_review_preview(update, context):
         await _answer(query, tr('预览正在恢复中，请稍候。'))
         return
 
+    # Answer BEFORE the staging uploads: regeneration sends media to Telegram
+    # and can outlive the callback answer window, and a later answer would be
+    # rejected by Telegram (one answer per callback). The restored media itself
+    # is the visible outcome; the card keeps its handle either way.
+    await _answer(query, tr('预览正在恢复中，请稍候。'))
+
     from telepost.telegram.review_media import regenerate_review_preview
     result = await regenerate_review_preview(context.bot, row)
     if not result["ok"]:
-        await _answer(query, result["message"], show_alert=True)
+        logger.warning(
+            "恢复审核预览失败: review_id=%s reason=%s",
+            review_id, result.get("message"),
+        )
+        chat_id = getattr(getattr(query, "message", None), "chat_id", None)
+        if chat_id is not None:
+            try:
+                await context.bot.send_message(
+                    chat_id=chat_id,
+                    text=f"⚠️ 审核 #{review_id} 预览恢复失败：{result['message']}",
+                )
+            except Exception:  # noqa: BLE001 - notice is best-effort
+                logger.debug("发送预览恢复失败提示失败", exc_info=True)
+        await restore_review_card(context.bot, review_id)
         return
-    await _answer(query, tr('预览已恢复（{p0} 条消息），将按同样的时限自动清理。').format(
-        p0=len(result["message_ids"])))
     try:
         await query.edit_message_reply_markup(
             reply_markup=_review_keyboard(
@@ -2003,12 +2229,21 @@ async def approve_review(update, context):
     if update.effective_user.id not in ADMIN_IDS:
         await _answer(query, tr('你没有审核权限'), show_alert=True)
         return
-    await _answer(query)
     try:
         review_id = int(query.data.split(":", 1)[1])
     except (ValueError, IndexError):
-        await query.edit_message_text(tr('❌ 无效的审核记录'))
+        # §review-card-recovery: invalid payload is answerable — alert, never
+        # overwrite the card with an error text.
+        await _answer(query, tr('无效的审核记录'), show_alert=True)
         return
+    # Pre-flight: an already-decided review is answered HERE (the callback is
+    # still answerable, so the popup actually reaches the operator). The review
+    # state machine (service CAS) stays authoritative for anything not terminal.
+    if await _terminal_state_alert(query, context, review_id):
+        return
+    # Single acknowledgement before the (possibly tens-of-seconds) publish. All
+    # later feedback must be card state sync, not a second answer.
+    await _answer(query)
 
     async def _show_publishing(row):
         try:
@@ -2018,7 +2253,8 @@ async def approve_review(update, context):
                 reply_markup=InlineKeyboardMarkup([]),
             )
         except Exception:
-            pass
+            logger.debug("发布中卡片更新失败（不改写业务状态）: review_id=%s", review_id,
+                         exc_info=True)
 
     try:
         result = await review_service.approve(
@@ -2027,20 +2263,25 @@ async def approve_review(update, context):
             on_claim=_show_publishing,
         )
     except ReviewNotFoundError:
-        await query.edit_message_text(tr('❌ 审核记录不存在'))
+        logger.info("审核不存在（已应答，改用卡片同步）: review_id=%s", review_id)
+        await restore_review_card(context.bot, review_id)
         return
     except ReviewBusyError:
-        await query.edit_message_text(tr('ℹ️ 该投稿当前状态：publishing'))
-        return
-    except ReviewStateError as error:
-        await query.edit_message_text(f"ℹ️ {error.message}")
+        # Still being published by another claim: the card already carries the
+        # in-progress shape; re-render it instead of a second answer.
+        logger.info("审核正在发布中（已应答）: review_id=%s", review_id)
+        await restore_review_card(context.bot, review_id)
         return
     except PublishFailedError as error:
         row = await _load_review_for_action(query, review_id)
-        await query.edit_message_text(
+        if row is None:
+            await restore_review_card(context.bot, review_id)
+            return
+        await _edit_card_or_recover(
+            query, context, review_id,
             tr("""⚠️ 审核 #{p0} {p1}：
 {p2}""").format(p0=review_id, p1=error.retry_hint, p2=error.message),
-            reply_markup=_review_keyboard(
+            _review_keyboard(
                 review_id, row["link"],
                 spoiler=bool(row["spoiler"]), source=row["source"],
                 work_id=_work_id_from_link(row["link"] or ""),
@@ -2051,11 +2292,21 @@ async def approve_review(update, context):
             ),
         )
         return
+    except ReviewStateError as error:
+        await _notify_state_mismatch(query, context, review_id, error.message)
+        return
+    except ReviewError as error:
+        await _notify_state_mismatch(
+            query, context, review_id,
+            getattr(error, "message", None) or tr('该投稿已处理，无法发布'),
+        )
+        return
 
-    await query.edit_message_text(
+    await _edit_card_or_recover(
+        query, context, review_id,
         tr("""✅ 审核 #{p0} 已发布
 {p1}""").format(p0=review_id, p1=result.link or ''),
-        disable_web_page_preview=True,
+        None,
     )
 
 
@@ -2064,12 +2315,14 @@ async def reject_review(update, context):
     if update.effective_user.id not in ADMIN_IDS:
         await _answer(query, tr('你没有审核权限'), show_alert=True)
         return
-    await _answer(query)
     try:
         review_id = int(query.data.split(":", 1)[1])
     except (ValueError, IndexError):
-        await query.edit_message_text(tr('❌ 无效的审核记录'))
+        await _answer(query, tr('无效的审核记录'), show_alert=True)
+        return
+    if await _terminal_state_alert(query, context, review_id):
         return
+    await _answer(query)
 
     try:
         await review_service.reject(
@@ -2077,13 +2330,23 @@ async def reject_review(update, context):
             actor=update.effective_user.id, source="telegram",
         )
     except ReviewNotFoundError:
-        await query.edit_message_text(tr('❌ 审核记录不存在'))
+        logger.info("审核不存在（已应答，改用卡片同步）: review_id=%s", review_id)
+        await restore_review_card(context.bot, review_id)
         return
     except ReviewStateError as error:
-        await query.edit_message_text(f"ℹ️ {error.message}")
+        await _notify_state_mismatch(query, context, review_id, error.message)
+        return
+    except ReviewError as error:
+        await _notify_state_mismatch(
+            query, context, review_id,
+            getattr(error, "message", None) or tr('该投稿已处理，无法拒绝'),
+        )
         return
 
-    await query.edit_message_text(tr('❌ 审核 #{p0} 已拒绝').format(p0=review_id))
+    await _edit_card_or_recover(
+        query, context, review_id,
+        tr('❌ 审核 #{p0} 已拒绝').format(p0=review_id), None,
+    )
 
 
 async def block_review_user(update, context):
@@ -2120,10 +2383,22 @@ async def block_review_user(update, context):
     )
     await _answer(query, tr('已封禁该投稿人：后续投稿将被自动拒绝'))
     try:
+        # §review-card-recovery: append the audit note WITHOUT dropping the
+        # keyboard — losing 发布/拒绝 on a still-pending review is exactly the
+        # reported production failure, only here it would be self-inflicted.
         await query.edit_message_text(
             tr("""{p0}
 
-🚫 投稿人封禁已由管理员 {p1} 记录""").format(p0=query.message.text, p1=update.effective_user.id)
+🚫 投稿人封禁已由管理员 {p1} 记录""").format(p0=query.message.text, p1=update.effective_user.id),
+            reply_markup=_review_keyboard(
+                int(review_id), row["link"],
+                spoiler=bool(row["spoiler"]), source=row["source"],
+                work_id=_work_id_from_link(row["link"] or ""),
+                submitter_user_id=_row_value(row, "submitter_user_id"),
+                actor_kind=_row_value(row, "actor_kind") or "user",
+                actor_subject=_row_value(row, "actor_subject") or "",
+                media_cleared=_row_value(row, "preview_state") == "cleared",
+            ),
         )
     except Exception as exc:
         logger.debug("封禁后更新审核卡失败: %s", exc)
@@ -2165,7 +2440,16 @@ async def block_review_api(update, context):
         await query.edit_message_text(
             tr("""{p0}
 
-🔑 API token 禁用已由管理员 {p1} 记录""").format(p0=query.message.text, p1=update.effective_user.id)
+🔑 API token 禁用已由管理员 {p1} 记录""").format(p0=query.message.text, p1=update.effective_user.id),
+            reply_markup=_review_keyboard(
+                int(review_id), row["link"],
+                spoiler=bool(row["spoiler"]), source=row["source"],
+                work_id=_work_id_from_link(row["link"] or ""),
+                submitter_user_id=_row_value(row, "submitter_user_id"),
+                actor_kind=_row_value(row, "actor_kind") or "user",
+                actor_subject=_row_value(row, "actor_subject") or "",
+                media_cleared=_row_value(row, "preview_state") == "cleared",
+            ),
         )
     except Exception as exc:
         logger.debug("禁用API后更新审核卡失败: %s", exc)