fix(processing): 收紧消息生命周期与投递约束

src/main/kotlin/com/gzzn/omms/msgexchange/processing/Pump.kt

@@ -66,33 +66,39 @@ class Pump(
         val head = procState.headUnfinished()
         when {
             head == null -> sleepQuietly(props.pipeline.pollInterval)
+            head.state == ProcStatus.FAILED && poisoned(head) -> {
+                log.error("poison -> DEAD msgId={} attempts={} lastError={}", head.msgId, head.attempts, head.lastError)
+                procState.markTerminal(
+                    head.msgId, ProcStatus.DEAD,
+                    errorClass = ErrorClass.EXHAUSTED,
+                    lastError = head.lastError ?: "head-deadline-exceeded",
+                    attempts = head.attempts,
+                    now = clock.instant(),
+                )
+                backfill.attempt(head.msgId)
+            }
             head.state == ProcStatus.FAILED && (head.nextAttemptAt ?: Instant.EPOCH) > clock.instant() ->
-                if (poisoned(head)) {
-                    log.error("poison -> DEAD msgId={} attempts={} lastError={}", head.msgId, head.attempts, head.lastError)
-                    procState.markTerminal(
-                        head.msgId, ProcStatus.DEAD,
-                        errorClass = ErrorClass.EXHAUSTED,
-                        lastError = head.lastError ?: "head-deadline-exceeded",
-                        attempts = head.attempts,
-                    )
-                    backfill.attempt(head.msgId)
-                } else {
-                    sleepQuietly(Duration.between(clock.instant(), head.nextAttemptAt))
-                }
+                sleepQuietly(Duration.between(clock.instant(), head.nextAttemptAt))
             // 其余情况（新消息，或退避到期的重试）交给处理入口
-            else -> processor.processOne(head)
+            else -> {
+                procState.markProcessingStartedIfAbsent(head.msgId, clock.instant())
+                processor.processOne(head)
+            }
         }
     }
 
     private fun poisoned(head: ProcState): Boolean =
-        head.attempts >= props.pipeline.maxAttempts ||
-            Duration.between(head.updatedAt, clock.instant()) > props.pipeline.headDeadline
+        isHeadPoisoned(head, clock.instant(), props)
 
     private fun sleepQuietly(d: Duration) {
         if (!d.isNegative && !d.isZero) Thread.sleep(d.toMillis().coerceAtLeast(1))
     }
 }
 
+internal fun isHeadPoisoned(head: ProcState, now: Instant, props: PipelineProps): Boolean =
+    head.attempts >= props.pipeline.maxAttempts ||
+        Duration.between(head.processingStartedAt ?: head.updatedAt, now) >= props.pipeline.headDeadline
+
 /**
  * 处理一条消息：读原文 → 解码 → 绑定业务身份 → 分派给对应处理器 → 提交后回填标记。
  *