fix(vc-agent): durable 启动失败 gate 覆盖 fork-error 与 pre-ready exit

复审(Codex)揪出的 blocker：#3 的 gate 只堵了带 dispatchAttempt 的 structured
error;durable 投递被 dispatch(queued)进还没 ready 的 worker、worker 崩在 ready 前时,
fork-level `error`(直接 sessionReply)和 abrupt pre-ready `exit`(notifyStartupFailure
无 attempt)两条 fallback 仍会 out-of-band 发 Lark,silent 投递尤其会被误发、且与
receipt/lease 重试双发,绕过副作用边界。

修法:
- 把 initTurnId/initDispatchAttempt 冻进 WorkerStartupState(fork 时)。
- fork-level `error` 与 pre-ready `exit` 都走同一 durable gate:VC receiver +
  有 dispatchAttempt → 交给 receipt/lease→ambiguous,不 out-of-band reply。
- worker.ts crash-loop relaunch 显式透传 msg.dispatchAttempt(不再退回 stale current)。
- 补测:durable pre-ready exit / durable fork-error 各 0 reply;VC receiver 的 IM turn
  (无 attempt)fork-error 仍通知一次(证明 gate 精确,不 blanket 抑制)。

Author: deepcoldy

src/core/worker-pool.ts

@@ -94,6 +94,13 @@ type WindowsForkOptions = ForkOptions & { windowsHide?: boolean };
 type WorkerStartupState = {
   ready: boolean;
   failureNotified: boolean;
+  /** Init turn attribution frozen at fork. A durable VC delivery is dispatched
+   *  (queued) into a not-yet-ready worker; if that worker dies before ready
+   *  (fork ENOENT, syntax/import crash, abrupt exit) the fork-level `error` and
+   *  pre-ready `exit` paths must route the failure through the same receipt/lease
+   *  gate as a structured error, not reply out-of-band. */
+  initTurnId?: string;
+  initDispatchAttempt?: number;
 };
 
 const __filename = fileURLToPath(import.meta.url);
@@ -1859,7 +1866,9 @@ export function forkWorker(ds: DaemonSession, prompt: string, resumeOrTurnId: bo
       LARK_APP_SECRET: botCfg.larkAppSecret,
     },
   } as WindowsForkOptions);
-  const startupState: WorkerStartupState = { ready: false, failureNotified: false };
+  const startupState: WorkerStartupState = {
+    ready: false, failureNotified: false, initTurnId, initDispatchAttempt,
+  };
 
   // A fork-level failure (spawn ENOENT, etc.) emits 'error'; without a handler
   // the unhandled event crashes the daemon. It also happens before worker IPC
@@ -1869,6 +1878,16 @@ export function forkWorker(ds: DaemonSession, prompt: string, resumeOrTurnId: bo
     logger.error(`[${t}] Worker fork error: ${reason}`);
     if (startupState.failureNotified) return;
     startupState.failureNotified = true;
+    // A durable VC meeting delivery fork failure is fenced to the receipt/lease
+    // chain (workerGeneration → ambiguous → retry); replying here would bypass
+    // that boundary and could post on a silent delivery.
+    if (ds.session.vcMeetingReceiver && initDispatchAttempt !== undefined) {
+      logger.info(
+        `[${t}] VC durable fork failure left to receipt/lease recovery `
+        + `turn=${initTurnId?.slice(0, 12) ?? '-'} attempt=${initDispatchAttempt}: ${reason}`,
+      );
+      return;
+    }
     const cliName = getCliDisplayName(agentCfg.cliId);
     const message = tr('worker.start_failed', { cliName, reason }, botLocale(botCfg));
     emitSessionLifecycleHook(ds, 'session.requires_attention', {
@@ -3001,7 +3020,10 @@ function setupWorkerHandlers(
     // replacement kills are excluded to avoid noisy false alarms.
     if (!startupState.ready && !startupState.failureNotified && !worker.killed && ds.session.status !== 'closed') {
       const reason = tr('worker.start_exited_early', { code: code ?? 'null' }, loc);
-      void notifyStartupFailure(reason);
+      // Carry the frozen init attribution so an abrupt pre-ready exit of a
+      // durable VC delivery is fenced to the receipt/lease chain, not replied
+      // out-of-band (which could post on a silent delivery).
+      void notifyStartupFailure(reason, startupState.initTurnId, startupState.initDispatchAttempt);
     }
     // Clear the current child before notifying durable consumers. A callback
     // may schedule a retry; it must not observe/send to this dead IPC channel.

src/worker.ts

@@ -7332,7 +7332,10 @@ process.on('message', async (raw: unknown) => {
         try {
           spawnCli({ ...lastInitConfig, resume: true, prompt: '' });
         } catch (err) {
-          await sendFatalWorkerErrorAndExit(err, msg.turnId);
+          // Pass the message's own attempt (not the stale currentBotmux* from a
+          // prior IM turn) so a durable delivery relaunch failure carries the
+          // right attribution for the daemon's receipt/lease gate.
+          await sendFatalWorkerErrorAndExit(err, msg.turnId, msg.dispatchAttempt);
           return;
         }
       }

test/session-lifecycle-start.test.ts

@@ -316,6 +316,62 @@ describe('worker startup failure delivery', () => {
     expect(sessionReply).not.toHaveBeenCalled();
   });
 
+  it('leaves a durable VC delivery pre-ready worker exit to the receipt chain (no reply)', async () => {
+    const sessionReply = vi.fn(async () => 'om_error_reply');
+    initWorkerPool({ sessionReply, getSessionWorkingDir: () => '/repo', getActiveCount: () => 1, closeSession: vi.fn() });
+    const ds = makeDs();
+    (ds.session as unknown as { vcMeetingReceiver: unknown }).vcMeetingReceiver = {
+      meetingId: 'm1', memberId: 'mem1', memberEpoch: 1,
+    };
+    // Dispatched (queued) into a worker that dies before ready — no structured
+    // error precedes it, so the abrupt-exit guard must use the frozen init attempt.
+    forkWorker(ds, 'deliver', { turnId: 'vc-delivery', dispatchAttempt: 3 });
+    const worker = forkMock.mock.results.at(-1)!.value;
+
+    worker.emit('exit', 9);
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(sessionReply).not.toHaveBeenCalled();
+  });
+
+  it('leaves a durable VC delivery fork-level error to the receipt chain (no reply)', async () => {
+    const sessionReply = vi.fn(async () => 'om_error_reply');
+    initWorkerPool({ sessionReply, getSessionWorkingDir: () => '/repo', getActiveCount: () => 1, closeSession: vi.fn() });
+    const ds = makeDs();
+    (ds.session as unknown as { vcMeetingReceiver: unknown }).vcMeetingReceiver = {
+      meetingId: 'm1', memberId: 'mem1', memberEpoch: 1,
+    };
+    forkWorker(ds, 'deliver', { turnId: 'vc-delivery', dispatchAttempt: 3 });
+    const worker = forkMock.mock.results.at(-1)!.value;
+
+    // OS-level fork failure (e.g. spawn ENOENT) surfaces via the child 'error' event.
+    worker.emit('error', new Error('spawn ENOENT'));
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(sessionReply).not.toHaveBeenCalled();
+  });
+
+  it('still surfaces a VC receiver IM-turn (no dispatchAttempt) fork error exactly once', async () => {
+    const sessionReply = vi.fn(async () => 'om_error_reply');
+    initWorkerPool({ sessionReply, getSessionWorkingDir: () => '/repo', getActiveCount: () => 1, closeSession: vi.fn() });
+    const ds = makeDs();
+    (ds.session as unknown as { vcMeetingReceiver: unknown }).vcMeetingReceiver = {
+      meetingId: 'm1', memberId: 'mem1', memberEpoch: 1,
+    };
+    // A listener-group @agent IM turn has no durable dispatchAttempt; the gate is
+    // precise, so its startup failure is still surfaced (not blanket-suppressed).
+    forkWorker(ds, 'deliver', { turnId: 'im-turn' });
+    const worker = forkMock.mock.results.at(-1)!.value;
+
+    worker.emit('error', new Error('spawn ENOENT'));
+    await Promise.resolve();
+    await Promise.resolve();
+
+    expect(sessionReply).toHaveBeenCalledTimes(1);
+  });
+
   it('posts a generic fallback when the worker exits before ready or structured error', async () => {
     const sessionReply = vi.fn(async () => 'om_error_reply');
     initWorkerPool({

test/worker-pipe-initial-screen-order.test.ts

@@ -186,7 +186,10 @@ describe('worker pipe initial screen ordering', () => {
     expect(guard).toContain('throw new Error(backendGateUserMessage(');
     expect(guard).not.toContain("effectiveBackend = 'pty'");
     expect(source).toContain('await sendAndFlush({');
-    expect(source).toContain('await sendFatalWorkerErrorAndExit(err, msg.turnId)');
+    // The crash-loop relaunch carries the message's own durable attempt so a
+    // meeting delivery relaunch failure is attributed to the right receipt
+    // (not the stale currentBotmux* from a prior IM turn).
+    expect(source).toContain('await sendFatalWorkerErrorAndExit(err, msg.turnId, msg.dispatchAttempt)');
     expect(source).toContain('await sendFatalWorkerErrorAndExit(err);');
   });