fix: 集群操作日志同步修复 — 全量回填 + 重启节点 seq 水位抬升

两个根因:
1. 离线错过条目永久缺失: token delta 被下游 trim (keep=seq>wm)，
   离线节点错过的 seq 再也收不到 → 'log delta gap: want N got N+1' 死循环。
   修复: OnToken 改为附带自己的全量日志 (Snapshot)，接收方 ApplyDelta 按 seq 幂等去重，
   缺口节点下一轮自动补齐。日志量小(几十条)，开销可忽略。

2. 重启节点重新从 seq=1 编号: NewClusterLog 从 Seq=0 起，重启后产生的新事件
   与环上历史 seq 冲突 → ApplyDelta 视为 already-have 静默丢弃 + 全量附带出现歧义 id。
   修复: OnToken 收到日志时把本地 Seq 抬到环高水位之上，新编号接在历史之后。

测试: TestFullLogBackfillAfterGap / TestApplyDeltaIdempotentOnFullResend

实测: 三台集群撤销 minecraft 转发 → 三台均记录 seq=10 forward.remove;
恢复后三台均记录 seq=11 forward.add

internal/cluster/ring_engine.go

@@ -238,6 +238,16 @@ func (e *Engine) OnToken(ctx context.Context, tk *Token) (*Token, error) {
 
 	// (b) apply incremental log delta; trim consumed entries off the token.
 	if e.Log != nil && len(tk.Log) > 0 {
+		// Raise the local seq allocator above the ring's high-water mark so a
+		// restarted node (whose log was rebuilt from scratch at Seq=0) never
+		// re-issues sequence numbers that already exist in the shared history —
+		// duplicate seqs would make ApplyDelta silently drop the new entries as
+		// "already have" and pollute full-log attachments with ambiguous ids.
+		for _, en := range tk.Log {
+			if en.Seq > e.Log.Seq {
+				e.Log.Seq = en.Seq
+			}
+		}
 		wm, err := e.Log.ApplyDelta(tk.Log)
 		if err != nil {
 			log.Printf("ring[%s] log delta gap: %v (request full sync later)", e.ID, err)
@@ -275,9 +285,15 @@ func (e *Engine) OnToken(ctx context.Context, tk *Token) (*Token, error) {
 	// flows to the newcomer (its successor) so it can participate.
 	e.injectPendingJoin()
 
-	// re-attach own fresh log entries so peers converge.
+	// re-attach OWN full log so peers converge even after gaps. A node that
+	// was offline when seq=N circulated never gets seq=N from the delta (it
+	// was trimmed off by peers whose watermark advanced past N). Attaching the
+	// FULL local log every cycle lets any peer missing entries backfill them
+	// next round — the cluster log is small (tens of entries) so the cost is
+	// negligible. ApplyDelta dedupes by seq so re-sent entries are a no-op
+	// for peers that already have them.
 	if !e.selfRemoved && e.Log != nil {
-		mine := e.Log.EntriesAfter(e.lastLogSent)
+		mine := e.Log.Snapshot()
 		if len(mine) > 0 {
 			tk.Log = append(tk.Log, mine...)
 			if last := mine[len(mine)-1]; last.Seq > e.lastLogSent {

internal/cluster/ring_log_test.go

@@ -77,3 +77,60 @@ func TestClaimLogsToEngine(t *testing.T) {
 		t.Fatalf("engine log = %+v", snap)
 	}
 }
+
+// TestFullLogBackfillAfterGap: a node that missed entries while offline
+// (Synced stuck below the ring's max) must backfill from a peer's FULL log
+// attachment. This is the regression test for the "log delta gap: want 1 got
+// N" livelock where offline nodes could never rejoin the log history.
+func TestFullLogBackfillAfterGap(t *testing.T) {
+	// Peer with complete history [1..4].
+	var peer ClusterLog
+	for i := 1; i <= 4; i++ {
+		if _, err := peer.Append("n1", LogNodeJoin, map[string]int{"i": i}); err != nil {
+			t.Fatal(err)
+		}
+	}
+	// Straggler that only has [1]; it missed [2..3] while offline and now
+	// receives the peer's FULL attachment [1..4].
+	straggler := NewClusterLog()
+	if _, err := straggler.Append("n2", LogNodeJoin, nil); err != nil {
+		t.Fatal(err)
+	}
+	// Force straggler to look like it has seq1 only (Synced=1).
+	straggler.Synced = 1
+
+	wm, err := straggler.ApplyDelta(peer.Snapshot())
+	if err != nil {
+		t.Fatalf("full backfill failed: %v", err)
+	}
+	if wm != 4 {
+		t.Fatalf("watermark = %d, want 4", wm)
+	}
+	if len(straggler.Snapshot()) != 4 {
+		t.Fatalf("log length = %d, want 4 (no dupes)", len(straggler.Snapshot()))
+	}
+}
+
+// TestApplyDeltaIdempotentOnFullResend: applying the same full attachment
+// twice must not duplicate entries or error — peers re-attach their full log
+// every cycle now.
+func TestApplyDeltaIdempotentOnFullResend(t *testing.T) {
+	var src ClusterLog
+	for i := 1; i <= 3; i++ {
+		if _, err := src.Append("n1", LogNodeJoin, nil); err != nil {
+			t.Fatal(err)
+		}
+	}
+	full := src.Snapshot()
+	dst := NewClusterLog()
+	if _, err := dst.ApplyDelta(full); err != nil {
+		t.Fatalf("first apply: %v", err)
+	}
+	wm, err := dst.ApplyDelta(full)
+	if err != nil {
+		t.Fatalf("second apply (idempotence): %v", err)
+	}
+	if wm != 3 || len(dst.Snapshot()) != 3 {
+		t.Fatalf("wm=%d len=%d, want 3/3", wm, len(dst.Snapshot()))
+	}
+}

internal/httpapi/server.go

@@ -144,10 +144,14 @@ func NewServeMux(h *Handler) (http.Handler, error) {
 	// resolve to admin via the flag fast path.
 	mux.HandleFunc("/frpc/", h.auth("read")(h.handleFrpcBinary))
 
-	// Static assets behind the same auth as the API: the browser caches the
-	// Basic header once and sends it on every asset + /api/* request, so the
-	// SPA loads for any valid identity (viewer included).
-	mux.HandleFunc("/", h.auth("read")(h.handleStatic))
+	// Static assets WITHOUT auth: the SPA must load before it can show its
+	// login form (auth.ts resolves GET /me on mount; a 401 there drops the UI
+	// into the login page). Gating index.html behind auth() would make an
+	// unauthenticated browser see {"error":"unauthorized"} instead of the
+	// app shell — exactly the bug where the domain showed raw JSON. The
+	// embedded assets are static/public (no user data); every privileged
+	// action still requires an authenticated API call.
+	mux.HandleFunc("/", h.handleStatic)
 
 	return mux, nil
 }

internal/httpapi/server_test.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"context"
 	"encoding/json"
+	"io"
 	"net/http"
 	"net/http/httptest"
 	"path/filepath"
@@ -249,3 +250,32 @@ func TestSaveCanvasPublishesRevokeTask(t *testing.T) {
 		t.Fatalf("expected revoke task for web, pending=%+v", ring.State().PendingList())
 	}
 }
+
+// TestStaticServesWithoutAuth: the SPA shell (index.html) must load WITHOUT
+// credentials so an unauthenticated browser sees the login page instead of a
+// raw {"error":"unauthorized"} JSON body. API routes stay gated.
+func TestStaticServesWithoutAuth(t *testing.T) {
+	_, ts := newTestHandler(t)
+	resp, err := http.Get(ts.URL + "/")
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp.Body.Close()
+	if resp.StatusCode != http.StatusOK {
+		t.Fatalf("status = %d, want 200 for SPA shell", resp.StatusCode)
+	}
+	body, _ := io.ReadAll(resp.Body)
+	if !strings.Contains(string(body), "<div id=\"app\">") && !strings.Contains(string(body), "<!DOCTYPE html>") {
+		t.Fatalf("body does not look like index.html: %.80s", body)
+	}
+	// API remains gated.
+	req, _ := http.NewRequest(http.MethodGet, ts.URL+"/api/manager/status", nil)
+	resp2, err := http.DefaultClient.Do(req)
+	if err != nil {
+		t.Fatal(err)
+	}
+	defer resp2.Body.Close()
+	if resp2.StatusCode != http.StatusUnauthorized {
+		t.Fatalf("API status = %d, want 401", resp2.StatusCode)
+	}
+}