fix(v2-read): finalize crash orphans as completed deltas on cold reads (1.7.16)

- dead-session req-without-done now emits as a completed delta (response:{body:null})
  so the client reconstructor accumulates its slice; previously the skipped slice
  failed every later _totalMessageCount check and blanked the whole chat. Live
  sessions keep the placeholder (liveness gate: owner pid + journal mtime).
- degraded broken-carrier merge: a _reconstructBroken entry that is its session's
  only carrier merges as a truthful prefix (create branches only, _seqEpoch
  guard), stamped _partialData; ChatView shows an incomplete-session banner.
  Same-session merges onto a partial base whole-replace instead of prefix-extending.
- parity/reorder test pipelines kept in sync; new adapter orphan + predicate tests.

Author: weiesky.wangc

history.md

@@ -1,5 +1,10 @@
 # Changelog
 
+## 1.7.16 (unreleased)
+
+- fix(v2-read): **crash orphans finalize as completed deltas on cold reads** — a dead session's req-without-done now emits as a completed delta (`response:{body:null}`) instead of an inProgress placeholder, so the client reconstructor accumulates its message slice; previously the slice was skipped, every later entry failed its `_totalMessageCount` check and the batch slimmer's last-carrier merge blanked the whole chat. Live sessions keep the placeholder (liveness gate: owner pid + journal mtime).
+- fix(chat): **degraded merge for broken carriers** — a `_reconstructBroken` entry that is its session's only carrier merges as a truthful prefix (create branches only, `_seqEpoch` three-part guard); the session is stamped `_partialData` and ChatView shows an "incomplete session" banner. Same-session merges onto a partial base whole-replace instead of prefix-extending (no tail duplication); anchor-hit merges clear the flag. Parity/reorder test pipelines kept in sync.
+
 ## 1.7.15 (2026-08-03)
 
 - feat(chat): **render tool_result images from Claude Code 2.x session logs** — new `server/lib/v2-transcript-normalizer.js` (CLIENT-SAFE) converts the new top-level-`message` JSONL format into legacy entries (per-session grouping, `/clear` segmentation, `message.id` assistant-row merging, `uuid` dedup), wired into cold/local/live ingest. The existing `extractToolResultImages` → `ToolResultView` chain then renders base64 images unchanged.

server/lib/v2/adapter.js

@@ -34,6 +34,7 @@ import { isMainAgentRequest } from '../interceptor-core.js';
 import { readSession } from './replay.js';
 import { iterateJsonlLines } from './jsonl-read.js';
 import { isDiscardableSession } from './session-select.js';
+import { LIVE_SESSION_MTIME_MS } from '../log-management.js';
 import { blobPath, isSupportedWireFormat } from './layout.js';
 import { SingleFlight } from './singleflight.js';
 import { listV2Sessions } from './session-list.js';
@@ -183,6 +184,29 @@ export class SessionSynthesizer {
     this._leader = opts.teammateOf || this._meta.leader || null;
     this._loadBlob = makeBlobLoader({ blobsDir: join(sessionDir, 'blobs') }, this.sessionId);
     this.unsupported = false;
+    // Liveness gate — KEEP IN SYNC with log-management.js deleteLogFiles
+    // (same pid(0)-probe + EPERM + LIVE_SESSION_MTIME_MS mtime triple; the
+    // constant is imported here so only the ordering can drift). Cold reads
+    // finalize crash orphans as completed deltas ONLY when the session is dead.
+    // A live writer may still emit an orphan's done later — its completed twin
+    // would then be replayed by the client's seq guard as stale (_staleReorder)
+    // and the tail of the chat would vanish (cold-read + live-feed race).
+    this._sessionLive = false;
+    try {
+      const meta = this._meta;
+      if (meta && typeof meta.pid === 'number' && meta.pid !== process.pid) {
+        try { process.kill(meta.pid, 0); this._sessionLive = true; } catch (err) {
+          // EPERM = the pid exists under another user — that IS live.
+          if (err && err.code === 'EPERM') this._sessionLive = true;
+        }
+      }
+    } catch { /* unreadable meta — fall through to the mtime guard */ }
+    if (!this._sessionLive) {
+      try {
+        const jStat = statSync(join(sessionDir, 'journal.jsonl'));
+        if (this._now() - jStat.mtimeMs < LIVE_SESSION_MTIME_MS) this._sessionLive = true;
+      } catch { /* no journal — nothing fresh to protect */ }
+    }
     if (meta && meta.wireFormat != null && !isSupportedWireFormat(meta.wireFormat)) {
       this._markUnsupported(meta.wireFormat);
     }
@@ -508,9 +532,23 @@ export class SessionSynthesizer {
 
     if (this._dones.has(seq)) {
       this._tryComplete(seq);
+    } else if (this._deferMs === 0 && !this._sessionLive) {
+      // Cold read of a DEAD session: the orphan is definitively terminal. Emit
+      // it as a completed delta (no inProgress / requestId — the exact shape
+      // _complete produces) so the client batch reconstructor accumulates its
+      // message slice: inProgress rows are skipped by the reconstructor, which
+      // would otherwise drop the slice and fail every later completed entry's
+      // _totalMessageCount integrity check — blanking the whole chat.
+      entry.response = { body: null }; // mirrors _complete's no-response branch
+      // Push the SAME item reference (phase aside): _complete's dedup splice
+      // (this._out.indexOf(item)) depends on the queued object identity — a
+      // spread copy would dodge it and the twin completed frame would double.
+      item.phase = 'completed';
+      this._out.push(item);
     } else {
       // req without done — in-flight or the process died (spec §4). This IS the
-      // v1 placeholder, so it wears the same flags.
+      // v1 placeholder, so it wears the same flags. Live reads keep it so the
+      // incremental reconstructor can render the in-flight turn as it streams.
       entry.inProgress = true;
       entry.requestId = req.rid || `${seq}`;
       this._out.push(item);

src/AppBase.jsx

@@ -20,7 +20,7 @@ import { getDefaultBindingsForLocale as vpDefaultBindingsForLocale } from '../se
 import { mergeVoicePackInto } from '../server/lib/approval-modal-prefs';
 import { saveEntries, loadEntries, clearEntries, getCacheMeta } from './utils/entryCache';
 import { assignMessageTimestamps, applyInPlaceLastMsgReplace, getSessionStableId, resolveDisplaySessions, getLatestSessionByActivity, resolveHydratedPin, runPinHydration, applyBatchEntryTimestamps } from './utils/sessionManager';
-import { mergeMainAgentSessions as _mergeMainAgentSessions, isMergeBlockedEntry } from './utils/sessionMerge';
+import { mergeMainAgentSessions as _mergeMainAgentSessions, isMergeBlockedEntry, shouldDegradeBrokenMerge } from './utils/sessionMerge';
 import { reconstructEntries, createIncrementalReconstructor } from '../server/lib/delta-reconstructor.js';
 import { normalizeV2Entries, createV2IncrementalReconstructor, isV2TranscriptLine, isMetadataRow } from '../server/lib/v2-transcript-normalizer.js';
 import { createEntrySlimmer, createIncrementalSlimmer, internEntryBigFields } from './utils/entry-slim.js';
@@ -606,8 +606,15 @@ class AppBase extends React.Component {
       // this slim → applyBatchEntryTimestamps → merge call order.
       applyBatchEntryTimestamps(st, entry);
 
-      // session 合并（跳过 _slimmed；批量路径额外跳过 stale/broken/inProgress，见谓词 JSDoc）
-      if (!entry._slimmed && !isMergeBlockedEntry(entry, { batch: true })) {
+      // Session merge (skips _slimmed; the batch path additionally skips
+      // stale/broken/inProgress — see the predicate JSDoc). Degradation
+      // exception (shouldDegradeBrokenMerge): when a broken carrier is its
+      // session's only carrier, merge it as a truthful prefix and STAMP
+      // _partialData (the create branches propagate it, ChatView renders the
+      // banner, and the same-session defuse branch keys off it) — avoids
+      // blanking the whole chat (2026-07-26 orphan-slice regression).
+      if (!entry._slimmed && (shouldDegradeBrokenMerge(entry, st.sessions) || !isMergeBlockedEntry(entry, { batch: true }))) {
+        if (shouldDegradeBrokenMerge(entry, st.sessions)) entry._partialData = true;
         st.sessions = this.mergeMainAgentSessions(st.sessions, entry);
       }
     }

src/components/chat/ChatView.jsx

@@ -1772,6 +1772,16 @@ class ChatView extends React.Component {
         );
       }
 
+      // Degraded (partial-data) session banner — rendered unconditionally
+      // inside the forEach: the divider above is skipped for the first visible
+      // session, but the banner must render for it too (2026-07-26 orphan-slice
+      // regression).
+      if (session._partialData) {
+        allItems.push(
+          <div key={`partial-${si}`} className={styles.partialDataBanner}>{t('ui.partialDataBanner')}</div>
+        );
+      }
+
       // Session-level model fallback: when per-message producer resolution is null (the session's
       // carrier entry is in-flight and filtered out — the "MainAgent" flash on carried-over
       // history), fall back to the session's stamped model. The `_fromSession` marker on the

src/components/chat/ChatView.module.css

@@ -439,3 +439,14 @@
 .hideLastResponseDivider .lastResponseDivider {
   display: none;
 }
+
+/* Degraded partial-session banner: data incomplete (interrupted requests), best-effort recovery applied. */
+.partialDataBanner {
+  font-size: 12px;
+  color: var(--text-muted);
+  background: var(--bg-surface);
+  border: 1px solid var(--border-secondary);
+  border-radius: 6px;
+  padding: 6px 12px;
+  margin: 4px 16px 8px;
+}

src/i18n.js

@@ -3678,6 +3678,26 @@ const i18nData = {
     "tr": "MainAgent konuşma verisi yok",
     "uk": "Немає даних діалогу MainAgent"
   },
+  "ui.partialDataBanner": {
+    "zh": "此会话数据不完整（部分请求中断），已尽力恢复",
+    "en": "This session is incomplete (some requests were interrupted); best-effort recovery applied",
+    "zh-TW": "此會話資料不完整（部分請求中斷），已盡力恢復",
+    "ko": "이 세션의 데이터가 불완전합니다(일부 요청이 중단됨). 최선을 다해 복구했습니다",
+    "ja": "このセッションのデータは不完全です（一部のリクエストが中断）。最善を尽くして復元しました",
+    "de": "Diese Sitzung ist unvollständig (einige Anfragen wurden unterbrochen); bestmögliche Wiederherstellung angewendet",
+    "es": "Esta sesión está incompleta (algunas solicitudes se interrumpieron); se aplicó la mejor recuperación posible",
+    "fr": "Cette session est incomplète (certaines requêtes ont été interrompues) ; récupération du mieux possible",
+    "it": "Questa sessione è incompleta (alcune richieste sono state interrotte); recupero del meglio possibile",
+    "da": "Denne session er ufuldstændig (nogle anmodninger blev afbrudt); bedst mulig gendannelse anvendt",
+    "pl": "Ta sesja jest niekompletna (niektóre żądania zostały przerwane); zastosowano najlepszą możliwą rekonstrukcję",
+    "ru": "Эта сессия неполна (часть запросов прервана); применено наилучшее возможное восстановление",
+    "ar": "هذه الجلسة غير مكتملة (انقطعت بعض الطلبات)؛ تم تطبيق أفضل استرداد ممكن",
+    "no": "Denne økten er ufullstendig (noen forespørsler ble avbrutt); best mulig gjenoppretting brukt",
+    "pt-BR": "Esta sessão está incompleta (algumas solicitações foram interrompidas); recuperação da melhor forma possível",
+    "th": "เซสชันนี้ไม่สมบูรณ์ (บางคำขอถูกขัดจังหวะ); ใช้การกู้คืนที่ดีที่สุดเท่าที่จะทำได้",
+    "tr": "Bu oturum eksik (bazı istekler kesildi); mümkün olan en iyi kurtarma uygulandı",
+    "uk": "Ця сесія неповна (деякі запити перервано); застосовано найкраще можливе відновлення"
+  },
   "ui.fileExplorer": {
     "zh": "文件浏览器",
     "en": "File Explorer",

src/utils/sessionMerge.js

@@ -18,6 +18,10 @@ export { messageFingerprint };
  *    无 live-port 配置下"提问气泡请求时即显示"依赖这一行为。
  * AppBase 的 SSE 与批量两个 merge 入口、以及单测共用此谓词，防三处逻辑漂移。
  *
+ * 批量路径的降级例外见 shouldDegradeBrokenMerge：当 broken 条目恰好是它那个
+ * session 的唯一载体（slim 只留最后一条 main）时，其 messages 是可信前缀，
+ * 降级合并比整会话空白更可取（会话打 _partialData 标记，ChatView 显示提示条）。
+ *
  * @param {object} entry
  * @param {object} [options]
  * @param {boolean} [options.batch=false] - 批量（强刷/历史加载）路径
@@ -30,6 +34,36 @@ export function isMergeBlockedEntry(entry, options = {}) {
   return false;
 }
 
+/**
+ * 批量路径降级例外：broken 载体能否以"可信前缀"身份合并进 mainAgentSessions。
+ *
+ * 仅在两条安全路径放行（两条都只会走进 mergeMainAgentSessions 的创建分支，
+ * 不会触发 anchor/rebuild 等可能翻倍的对齐逻辑）：
+ *  - prevSessions 为空：会话直接创建，无对齐风险；
+ *  - 双方都有 _seqEpoch 且不同：确定性会话边界，走 epochChanged append 分支
+ *    （三部分守卫防 v1 无 epoch 的条目被误放行）。
+ *
+ * `_staleReorder` 明确不降级（流内稍后有权威副本自建会话）；inProgress 不降级
+ * （批量下其 messages 是裸切片，不是可信前缀）。v1 / 无 epoch 会话的 broken
+ * 载体也刻意不降级（放松守卫会让 broken 条目掉进同会话分支，错位前缀 → 翻倍）。
+ *
+ * @param {object} entry
+ * @param {Array} prevSessions - 当前已合并的 sessions
+ * @returns {boolean} true = 允许降级合并
+ */
+export function shouldDegradeBrokenMerge(entry, prevSessions) {
+  if (!entry || !entry._reconstructBroken) return false;
+  if (entry._staleReorder || entry.inProgress) return false;
+  if (!Array.isArray(prevSessions) || prevSessions.length === 0) return true;
+  const e = entry._seqEpoch;
+  if (!e) return false; // v1 / epoch-less carriers never degrade
+  // Reject when ANY already-merged session shares the entry's epoch (a same-
+  // session broken carrier preceded by a healthy one must not degrade into the
+  // same-session merge branch). Today batches are single-session per epoch, so
+  // this is a defensive closure for future non-monotonic epoch streams.
+  return prevSessions.every((s) => !s._seqEpoch || s._seqEpoch !== e);
+}
+
 /**
  * 增量合并 mainAgent sessions。
  *
@@ -39,6 +73,8 @@ export function isMergeBlockedEntry(entry, options = {}) {
  *  - 命中且 overlapLen <  newLen：push `newMessages[overlapLen..]`，引用稳定。
  *  - 未命中：newLen<curLen → rebuild（/compact summary）；newLen===curLen → 整段 append（Plan Mode 全新片段）；
  *           newLen>curLen → 严格前缀扩展语义（push tail），fp 加固后真正存在重叠的窗口必被 anchor 命中。
+ *  - 降级 partial 基底（lastSession._partialData）且 anchor 未命中：任何长度的全量条目都整段替换
+ *    （partial 前缀有中段缺口、不可信，push tail 会翻倍）。
  *
  * 顶部守卫（isPostClearCheckpoint / userId / transient filter）维持 1.6.245 行为不变。
  *
@@ -68,7 +104,13 @@ export function mergeMainAgentSessions(prevSessions, entry, options = {}) {
   const entryModel = getEffectiveModel(entry);
 
   if (prevSessions.length === 0) {
-    return [{ userId, messages: newMessages, response: newResponse, entryTimestamp, model: entryModel, _seqEpoch: seqEpoch }];
+    return [{
+      userId, messages: newMessages, response: newResponse, entryTimestamp, model: entryModel, _seqEpoch: seqEpoch,
+      // Degraded-broken carrier: truthful prefix with a mid-session hole. Only
+      // the create branches carry it (a same-session merge onto a partial base
+      // is defused by the whole-replace below); ChatView renders the banner.
+      ...(entry._partialData === true && { _partialData: true }),
+    }];
   }
 
   const lastSession = prevSessions[prevSessions.length - 1];
@@ -90,7 +132,10 @@ export function mergeMainAgentSessions(prevSessions, entry, options = {}) {
     for (let i = 0; i < newMessages.length; i++) {
       if (!newMessages[i]._timestamp) newMessages[i]._timestamp = entryTimestamp;
     }
-    return [...prevSessions, { userId, messages: newMessages, response: newResponse, entryTimestamp, model: entryModel, _seqEpoch: seqEpoch }];
+    return [...prevSessions, {
+      userId, messages: newMessages, response: newResponse, entryTimestamp, model: entryModel, _seqEpoch: seqEpoch,
+      ...(entry._partialData === true && { _partialData: true }),
+    }];
   }
 
   if (!options.skipTransientFilter && isNewConversation && newMessages.length <= 4 && prevMsgCount > 4) {
@@ -119,6 +164,17 @@ export function mergeMainAgentSessions(prevSessions, entry, options = {}) {
           lastSession.messages.push(newMessages[i]);
         }
       }
+      // Anchor 对齐成功：新全量条目与 partial 前缀吻合，数据已恢复完整。
+      delete lastSession._partialData;
+    } else if (lastSession._partialData) {
+      // 降级合并的 partial 会话（中段缺口，前缀不可信）：anchor 未命中时任何
+      // 同长/更长的全量条目都是权威真值，整段替换而非前缀扩展——否则会 push 出
+      // 尾部重复（partial 里已含 416..418，新全量 419 会被 append 一遍）。
+      for (let i = 0; i < newLen; i++) {
+        if (!newMessages[i]._timestamp) newMessages[i]._timestamp = entryTimestamp;
+      }
+      lastSession.messages = newMessages;
+      delete lastSession._partialData;
     } else if (newLen < curLen) {
       // /compact summary 等真重建：替换 messages 引用。
       for (let i = 0; i < newLen; i++) {
@@ -175,6 +231,9 @@ export function mergeMainAgentSessions(prevSessions, entry, options = {}) {
     if (entryModel) lastSession.model = entryModel; // latest wins; model-less entries keep the stamp
     return [...prevSessions];
   } else {
-    return [...prevSessions, { userId, messages: newMessages, response: newResponse, entryTimestamp, model: entryModel, _seqEpoch: seqEpoch }];
+    return [...prevSessions, {
+      userId, messages: newMessages, response: newResponse, entryTimestamp, model: entryModel, _seqEpoch: seqEpoch,
+      ...(entry._partialData === true && { _partialData: true }),
+    }];
   }
 }