fix: harden workflow continuation and skill route stale recovery

Author: rockyshi1993

hooks/_runtime/skill-route-state.cjs

@@ -740,6 +740,37 @@ function pressureReclaimReason (envelope, entryName, options, now) {
   return null
 }
 
+function canReplaceUnconsumedBootstrapEnvelope (existing, expected = {}) {
+  const state = existing?.state
+  if (!state || state.project !== expected.project ||
+      state.activeRoot !== portable(expected.activeRoot) ||
+      state.turnBinding !== expected.turnBinding ||
+      state.contextEpoch !== expected.contextEpoch) {
+    return false
+  }
+  if (expected.hostSessionId && state.hostSessionId &&
+      state.hostSessionId !== expected.hostSessionId) {
+    return false
+  }
+  if (expected.paths) {
+    const progress = readCatalogProgress(expected.paths, existing, expected.fs || fs)
+    if (progress.status === 'invalid') return false
+    if (Array.isArray(progress.progress?.servedCatalogPages) &&
+        progress.progress.servedCatalogPages.length) {
+      return false
+    }
+  } else if (Array.isArray(state.servedCatalogPages) && state.servedCatalogPages.length) {
+    return false
+  }
+  if (state.decision || state.plan || state.routeRetirement) return false
+  if (state.stageProgress && Object.keys(state.stageProgress).length) return false
+  if (Array.isArray(state.bodyChargeLedger?.items) && state.bodyChargeLedger.items.length) return false
+  if (Number(state.bodyChargeLedger?.unattributedBodyBytes || 0) > 0) return false
+  if (Array.isArray(state.obligationLedger?.requiredStageIds) &&
+      state.obligationLedger.requiredStageIds.length) return false
+  return true
+}
+
 function collectExpiredTurns (activeRoot, options = {}) {
   const fsImpl = options.fs || fs
   const routeRoot = routeRootForActiveRoot(activeRoot)
@@ -1168,9 +1199,91 @@ function bootstrapSkillRoute (input, options = {}) {
         existing.state?.catalog?.catalogDigest === catalog.catalogDigest &&
         existing.state?.bootstrap?.bootstrapDigest === bootstrap.bootstrapDigest
       if (!sameIdentity) {
-        const error = new Error('BOOTSTRAP_IDENTITY_COLLISION')
-        error.code = 'BOOTSTRAP_IDENTITY_COLLISION'
-        throw error
+        const replaceable = canReplaceUnconsumedBootstrapEnvelope(existing, {
+          project,
+          activeRoot,
+          turnBinding,
+          contextEpoch,
+          hostSessionId,
+          paths,
+          fs: fsImpl
+        })
+        if (!replaceable) {
+          const error = new Error('BOOTSTRAP_IDENTITY_COLLISION')
+          error.code = 'BOOTSTRAP_IDENTITY_COLLISION'
+          throw error
+        }
+        const replacementNow = options.now == null ? new Date() : new Date(options.now)
+        const replacement = {
+          ...existing,
+          version: Number(existing.version || 1) + 1,
+          state: {
+            project,
+            activeRoot: portable(activeRoot),
+            turnBinding,
+            contextEpoch,
+            hostSessionId,
+            mode: input.mode,
+            modeReceipt,
+            runtimeContractDigest,
+            bootstrap,
+            index,
+            catalog,
+            explicit: {
+              requestedSkillId: explicitSkillId,
+              status: explicitStatus,
+              skillId: explicitEntry?.skillId || null
+            },
+            servedCatalogPages: [],
+            decision: null,
+            plan: null,
+            stageProgress: {},
+            budget: {
+              bodyBytesConsumed: 0,
+              bodyLimitBytes: TURN_BODY_LIMIT_BYTES
+            },
+            bodyChargeLedger: {
+              schemaVersion: 'SkillRouteBodyChargeLedgerV1',
+              items: [],
+              unattributedBodyBytes: 0
+            },
+            contributionLedger: {
+              schemaVersion: 'ContributionLedgerV1',
+              items: [{
+                channel: 'runtime-bootstrap',
+                observedAt: replacementNow.toISOString(),
+                outcome: 'replaced-unconsumed-stale-bootstrap',
+                priorRuntimeContractDigest: existing.state?.runtimeContractDigest || null,
+                runtimeContractDigest
+              }]
+            },
+            obligationLedger: {
+              schemaVersion: 'ObligationLedgerV1',
+              items: [],
+              selectedBusinessSkillId: null,
+              requiredStageIds: [],
+              satisfiedStageIds: []
+            }
+          },
+          updatedAt: replacementNow.toISOString(),
+          expiresAt: new Date(replacementNow.getTime() + (options.turnTtlMs || TURN_TTL_MS)).toISOString()
+        }
+        assertProjectedCapacity(paths, replacement, fsImpl)
+        atomicWriteJson(paths.envelope, replacement, fsImpl)
+        const readBack = readJson(paths.envelope, fsImpl)
+        if (!readBack || readBack.state?.bootstrap?.bootstrapDigest !== bootstrap.bootstrapDigest) {
+          const error = new Error('TURN_ENVELOPE_READBACK_FAILED')
+          error.code = 'TURN_ENVELOPE_READBACK_FAILED'
+          throw error
+        }
+        return {
+          bootstrap,
+          envelope: readBack,
+          reused: false,
+          replaced: true,
+          paths,
+          retention
+        }
       }
       return {
         bootstrap,
@@ -1633,6 +1746,7 @@ module.exports = {
   atomicWriteJson,
   parseExplicitSkillId,
   bootstrapSkillRoute,
+  canReplaceUnconsumedBootstrapEnvelope,
   bindExplicitSkillRequest,
   loadEnvelope,
   transactEnvelope,

scripts/test-skill-route-state.js

@@ -2474,6 +2474,74 @@ try {
     snapshotFixture.cleanup()
   }
 
+  // Acceptance T01b: a stale bootstrap envelope that has never served catalog,
+  // committed a route, or loaded any stage may be replaced by the current
+  // runtime identity for the same turn. Once the turn has been consumed, the
+  // existing identity collision guard must remain strict.
+  const staleBootstrapReplacementFixture = createSkillRouteFixture({ project: 'stale-bootstrap-replacement' })
+  try {
+    const staleRuntimeDigest = '1'.repeat(64)
+    const replacementEpoch = 'ctx-stale-bootstrap-replacement'
+    const staleBoot = bootstrapSkillRoute({
+      project: staleBootstrapReplacementFixture.project,
+      activeRoot: staleBootstrapReplacementFixture.activeRoot,
+      contextEpoch: replacementEpoch,
+      prompt: 'Run stale bootstrap replacement probe',
+      mode: 'unified',
+      cwd: staleBootstrapReplacementFixture.projectRoot,
+      runtimeContractDigest: staleRuntimeDigest
+    }, staleBootstrapReplacementFixture.runtimeOptions)
+    assert.strictEqual(staleBoot.reused, false)
+    assert.strictEqual(staleBoot.bootstrap.runtimeContractDigest, staleRuntimeDigest)
+
+    const replacementBoot = bootstrapSkillRoute({
+      project: staleBootstrapReplacementFixture.project,
+      activeRoot: staleBootstrapReplacementFixture.activeRoot,
+      contextEpoch: replacementEpoch,
+      prompt: 'Run stale bootstrap replacement probe',
+      mode: 'unified',
+      cwd: staleBootstrapReplacementFixture.projectRoot
+    }, staleBootstrapReplacementFixture.runtimeOptions)
+    assert.strictEqual(replacementBoot.reused, false)
+    assert.strictEqual(replacementBoot.replaced, true)
+    assert.notStrictEqual(replacementBoot.bootstrap.runtimeContractDigest, staleRuntimeDigest)
+    assert.strictEqual(
+      replacementBoot.envelope.state.contributionLedger.items[0].outcome,
+      'replaced-unconsumed-stale-bootstrap'
+    )
+    requestCatalogAll(staleBootstrapReplacementFixture, replacementBoot.bootstrap)
+  } finally {
+    staleBootstrapReplacementFixture.cleanup()
+  }
+
+  const consumedBootstrapCollisionFixture = createSkillRouteFixture({ project: 'consumed-bootstrap-collision' })
+  try {
+    const consumedEpoch = 'ctx-consumed-bootstrap-collision'
+    const consumedBoot = bootstrapSkillRoute({
+      project: consumedBootstrapCollisionFixture.project,
+      activeRoot: consumedBootstrapCollisionFixture.activeRoot,
+      contextEpoch: consumedEpoch,
+      prompt: 'Run consumed bootstrap collision probe',
+      mode: 'unified',
+      cwd: consumedBootstrapCollisionFixture.projectRoot
+    }, consumedBootstrapCollisionFixture.runtimeOptions)
+    requestCatalogAll(consumedBootstrapCollisionFixture, consumedBoot.bootstrap)
+    assert.throws(
+      () => bootstrapSkillRoute({
+        project: consumedBootstrapCollisionFixture.project,
+        activeRoot: consumedBootstrapCollisionFixture.activeRoot,
+        contextEpoch: consumedEpoch,
+        prompt: 'Run consumed bootstrap collision probe',
+        mode: 'unified',
+        cwd: consumedBootstrapCollisionFixture.projectRoot,
+        runtimeContractDigest: '2'.repeat(64)
+      }, consumedBootstrapCollisionFixture.runtimeOptions),
+      error => error && error.code === 'BOOTSTRAP_IDENTITY_COLLISION'
+    )
+  } finally {
+    consumedBootstrapCollisionFixture.cleanup()
+  }
+
   const replayBudgetFixture = createSkillRouteFixture({ project: 'replay-budget' })
   try {
     const replayBoot = bootstrapSkillRoute({

scripts/test-task-admission-authority.js

@@ -74,6 +74,21 @@ const TEST_RUNTIME = {
   runtimeDigest: 'a'.repeat(64)
 }
 
+function removeReparseEntryNoFollow(entryPath) {
+  let stat
+  try {
+    stat = fs.lstatSync(entryPath)
+  } catch (error) {
+    if (error?.code === 'ENOENT') return
+    throw error
+  }
+  if (stat.isSymbolicLink()) {
+    fs.unlinkSync(entryPath)
+    return
+  }
+  fs.rmSync(entryPath, { recursive: true, force: true })
+}
+
 function setupRoot(name) {
   const physicalRoot = path.join(TEMP_ROOT, name)
   const activeRoot = path.join(physicalRoot, '.devcodex')
@@ -2787,7 +2802,7 @@ try {
   const reparseInput = admissionInput(reparseRoot, 'reparse')
   assert.strictEqual(run(reparseInput).status, 'needs-reconcile')
   assert.strictEqual(fs.readdirSync(outside).length, 0)
-  fs.rmSync(path.join(reparseRoot.activeRoot, 'bugs', '任务-reparse'), { recursive: true, force: true })
+  removeReparseEntryNoFollow(path.join(reparseRoot.activeRoot, 'bugs', '任务-reparse'))
   const reparseRecovered = run(reparseInput)
   assert.strictEqual(reparseRecovered.phase, 'cp-state-written', 'zero-effect precondition failure must recover after the unsafe path is removed')