v0.4.1 — 安全兜底修复 / Fail-safe fixes

中文

v0.4.1 是 v0.4.0 的安全性补丁版本。它保留“借鉴 Claude Code auto mode 的用户意图覆盖与混淆熔断”、/auto-report 和离线日志调优，并修复发布后审查发现的 fail-safe 边界问题：

• 保证一次审批最多调用一次下游 next()；下游应答者异常不会导致 waterfall 被重复消费。
• 最新真人消息超过 2000 字符时不再静默截断，而是以 latest-user-message-too-long 明确转人工。
• force-push 前置危险清单补齐 +refspec、--mirror、git -C … push --force 等标准写法。
• 分类超时会先恢复人工审批；流迭代器清理由插件生命周期继续持有，卸载仍会等待合规 adapter 完成清理。
• 离线调优脚本接受合法的第三方扩展事件原始值数据，正确合并同一 session 的 append-only 多份导出，并把空样本明确标为“证据不足”而非“死正则”。

所有失败路径仍只会转人工，插件永不替用户拒绝。Node 26 本机测试 88/88；GitHub Actions 的 Node 22.x 与 24.x 均通过。

English

v0.4.1 is a safety patch for v0.4.0. It keeps the Claude Code auto mode-inspired user-intent override and confusion circuit breaker, /auto-report, and offline log tuning while closing fail-safe gaps found during post-release review:

• Each approval delegates through next() at most once; a downstream responder failure can no longer consume the waterfall twice.
• Genuine user messages longer than 2,000 characters are no longer silently truncated; they fall back to human review with latest-user-message-too-long.
• The pre-classification force-push guard now covers standard forms such as +refspec, --mirror, and git -C … push --force.
• Classification timeouts return to human review promptly, while iterator cleanup remains owned by the plugin lifecycle and is still drained on unload for conforming adapters.
• The offline tuner accepts valid primitive data on third-party extension events, deduplicates append-only exports of the same session, and reports empty samples as insufficient evidence instead of a dead regex.

Every failure path still delegates to a human, and the plugin never rejects on the user's behalf. Local Node 26 tests pass 88/88; GitHub Actions passes on Node 22.x and 24.x.