fix(tsf): resync 自愈加时限与失败上限, 防止 IPC 持续失败导致按键永久被吃

_needsCompositionResync 原本只能由"下一次按键再走 IPC 且成功"清除, 当 Go
服务长时间不可用时, ENTER/ESC/Ctrl+Alt 等键会持续被吃且每次重试都失败,
形成永久卡死。新增 3 秒自愈窗口 + 连续失败 3 次降级 passthrough, 最坏
阻塞窗口收敛到 ~5s, 服务恢复后任一成功响应立即清零计数。

Author: huanfeng

wind_tsf/include/KeyEventSink.h

@@ -91,7 +91,7 @@ class CKeyEventSink : public ITfKeyEventSink,
     // 用于 Excel/WPS cell-select(按数字直通) → cell-edit(按标点) 这种焦点切换
     // 场景的数字后智能标点判断。残留由按键事件路径（_SendKeyToService 非智能
     // 标点目标键清零）和光标 Y 跨行检测兜底，不应在 IME 会话状态重置时一起清。
-    void ResetComposingState() { _isComposing = FALSE; _hasCandidates = FALSE; _needsCompositionResync = FALSE; _skipKeyCount = 0; _pendingPairAction = {}; _englishPairEngine.Clear(); }
+    void ResetComposingState() { _isComposing = FALSE; _hasCandidates = FALSE; _needsCompositionResync = FALSE; _resyncDeadline = 0; _resyncFailStreak = 0; _skipKeyCount = 0; _pendingPairAction = {}; _englishPairEngine.Clear(); }
 
     // Flush pending English pass-through stats before focus/mode teardown.
     void FlushEnglishStats();
@@ -130,6 +130,14 @@ class CKeyEventSink : public ITfKeyEventSink,
     // 下一次按键前提下视作"有会话"，让 ENTER/ESC 也能发给 Go 走重握手；
     // 任何一次成功 ReceiveResponse 之后清旗，状态由响应处理路径自然重建。
     BOOL _needsCompositionResync;
+    // resync 自愈窗口：deadline 到期或连续失败超限后自动放弃，避免 Go/IPC 长时间不可用
+    // 时把 ENTER/ESC/Ctrl+Alt 等键永久吃掉。失败 streak 在响应成功后清零。
+    DWORD _resyncDeadline;        // GetTickCount() 时间戳，0 表示无 deadline
+    int   _resyncFailStreak;      // 连续 IPC 失败次数，超过 RESYNC_MAX_RETRIES 强制降级 passthrough
+    static constexpr DWORD RESYNC_WINDOW_MS = 3000;
+    static constexpr int   RESYNC_MAX_RETRIES = 3;
+    BOOL _IsResyncActive();       // 读旗+过期检查；过期会自动清旗
+
     WCHAR _lastPassthroughDigit; // Last digit key that passed through (for smart punct fallback in apps where TSF can't read text)
     uint32_t _pendingKeyUpKey;   // Key code of pending KeyUp toggle key
     uint32_t _pendingKeyUpModifiers; // Modifiers when KeyDown was pressed

wind_tsf/src/KeyEventSink.cpp

@@ -89,6 +89,8 @@ CKeyEventSink::CKeyEventSink(CTextService* pTextService)
     , _isComposing(FALSE)
     , _hasCandidates(FALSE)
     , _needsCompositionResync(FALSE)
+    , _resyncDeadline(0)
+    , _resyncFailStreak(0)
     , _lastPassthroughDigit(0)
     , _pendingKeyUpKey(0)
     , _pendingKeyUpModifiers(0)
@@ -269,7 +271,7 @@ STDAPI CKeyEventSink::OnTestKeyDown(ITfContext* pContext, WPARAM wParam, LPARAM
         BOOL chineseMode = _pTextService->IsChineseMode();
         // resync 期 (上次 IPC 失败后) 视作有会话, 让 ENTER/ESC/Backspace 等 session 热键
         // 也走 Go 重握手, 由 Go 权威响应清旗 + 重建状态。
-        BOOL hasSession  = _pTextService->HasActiveComposition() || _hasCandidates || _needsCompositionResync;
+        BOOL hasSession  = _pTextService->HasActiveComposition() || _hasCandidates || _IsResyncActive();
         if (chineseMode && hasSession)
         {
             WIND_LOG_DEBUG_FMT(L"KeyDown session hotkey matched: vk=0x%02X, hash=0x%08X\n",
@@ -389,7 +391,7 @@ STDAPI CKeyEventSink::OnTestKeyDown(ITfContext* pContext, WPARAM wParam, LPARAM
     // Also check _hasCandidates for cases where InlinePreedit is disabled
     // (Go sends UpdateComposition with empty text, _hasCandidates is TRUE but HasActiveComposition is FALSE)
     // _needsCompositionResync: 上次 IPC 失败后强行视作有会话, 让 ENTER/ESC 也能发给 Go 重握手。
-    BOOL hasInputSession = hasComposition || _hasCandidates || _needsCompositionResync;
+    BOOL hasInputSession = hasComposition || _hasCandidates || _IsResyncActive();
 
     // English auto-pair: intercept bracket keys in English mode
     if (!isChineseMode && _englishPairEngine.IsEnabled())
@@ -847,7 +849,7 @@ STDAPI CKeyEventSink::OnKeyDown(ITfContext* pContext, WPARAM wParam, LPARAM lPar
     BOOL hasComposition = _pTextService->HasActiveComposition();
     // Also check _hasCandidates for cases where InlinePreedit is disabled.
     // _needsCompositionResync: 上次 IPC 失败后强行视作有会话, 让 ENTER/ESC 也能发给 Go 重握手。
-    BOOL hasInputSession = hasComposition || _hasCandidates || _needsCompositionResync;
+    BOOL hasInputSession = hasComposition || _hasCandidates || _IsResyncActive();
 
     // Track whether this is a Ctrl/Alt combo that needs cleanup-then-passthrough
     BOOL isCtrlAltCleanup = FALSE;
@@ -1531,12 +1533,30 @@ BOOL CKeyEventSink::_HandleServiceResponse()
         _isComposing = FALSE;
         _hasCandidates = FALSE;
         _pTextService->NotifyCandidatesVisibilityChanged(FALSE);
-        _needsCompositionResync = TRUE;
+
+        // resync 自愈：累计连续失败，到上限就放弃自愈、走 passthrough，
+        // 避免 Go 服务长时间挂掉时 ENTER/ESC/Ctrl+Alt 被永久吃。
+        // 任一次响应成功 (下方 _resyncFailStreak=0) 即清零计数。
+        _resyncFailStreak++;
+        if (_resyncFailStreak >= RESYNC_MAX_RETRIES)
+        {
+            WIND_LOG_WARN_FMT(L"Resync fail streak=%d reached limit, dropping to passthrough mode",
+                              _resyncFailStreak);
+            _needsCompositionResync = FALSE;
+            _resyncDeadline = 0;
+        }
+        else
+        {
+            _needsCompositionResync = TRUE;
+            _resyncDeadline = GetTickCount() + RESYNC_WINDOW_MS;
+        }
         return TRUE; // Default to eating the key on error
     }
 
-    // 响应成功 → 状态由下方 switch 各分支按权威重建, 清 resync 旗。
+    // 响应成功 → 状态由下方 switch 各分支按权威重建, 清 resync 旗 + 失败计数。
     _needsCompositionResync = FALSE;
+    _resyncDeadline = 0;
+    _resyncFailStreak = 0;
 
     QueryPerformanceCounter(&midTime);
     int ipcMs = (int)((midTime.QuadPart - startTime.QuadPart) * 1000 / freq.QuadPart);
@@ -1981,6 +2001,24 @@ void CKeyEventSink::_HandleCommitResult(uint16_t barrierSeq, const std::wstring&
     }
 }
 
+// 读 resync 旗 + 过期检查。deadline 到期立即清旗，保证只读处不需要关心时间窗口。
+// 注意：_resyncFailStreak 在此不清零——streak 仅由"响应成功"清零，否则失败计数被
+// 时间衰减抹掉就失去了"连续失败 → 降级"的语义。
+BOOL CKeyEventSink::_IsResyncActive()
+{
+    if (!_needsCompositionResync)
+        return FALSE;
+    if (GetTickCount() >= _resyncDeadline)
+    {
+        WIND_LOG_DEBUG_FMT(L"Resync window expired (streak=%d), auto-clearing flag",
+                           _resyncFailStreak);
+        _needsCompositionResync = FALSE;
+        _resyncDeadline = 0;
+        return FALSE;
+    }
+    return TRUE;
+}
+
 void CKeyEventSink::_CheckBarrierTimeout()
 {
     if (!_pendingCommit.waiting)