@agentunion/kite 1.5.0 → 1.6.0

package/kernel/event_hub.py

@@ -22,10 +22,39 @@ except ImportError:
 
 from starlette.websockets import WebSocket
 
+from dataclasses import dataclass, field
+
 from .dedup import EventDedup
 from .router import match_parts
 
 
+@dataclass
+class OrderingGroup:
+    """保序集合：同组事件 key 绑定同一 slot 发送，保证顺序。"""
+    name: str
+    keys: set = field(default_factory=set)
+    bound_slot: int | None = None
+    last_enqueued_seq: int | None = None
+
+
+# ── Multi-instance helpers ──
+
+def instance_key(module_id: str, instance_num: int = 1) -> str:
+    """Build internal key: 'module_id' for instance 1, 'module_id#N' for N>1."""
+    return module_id if instance_num <= 1 else f"{module_id}#{instance_num}"
+
+
+def parse_instance_key(key: str) -> tuple[str, int]:
+    """Parse internal key back to (module_id, instance_num)."""
+    if "#" in key:
+        name, num_str = key.rsplit("#", 1)
+        try:
+            return name, int(num_str)
+        except ValueError:
+            pass
+    return key, 1
+
+
 def _dumps(obj) -> str:
     if orjson is not None:
         return orjson.dumps(obj).decode()
@@ -39,21 +68,63 @@ def _loads(raw: str):
 
 
 QUEUE_MAXSIZE = 10000
+QUEUE_MAX_BYTES = 10 * 1024 * 1024  # 10 MB
+
+# Compression limits
+COMPRESS_MAX_COUNT = 100  # 每次最多压缩 100 条消息
+COMPRESS_MAX_BYTES = 100 * 1024  # 每次最多压缩 100KB
 
 # System events that are auto-broadcast to ALL connected modules (no subscription needed)
-SYSTEM_EVENTS = {"module.offline", "module.ready", "module.shutdown"}
+# These events can ONLY be published via publish_internal() (Kernel-originated).
+# Modules attempting to publish these via event.publish RPC will be rejected.
+SYSTEM_EVENTS = {"module.offline", "module.ready", "module.shutdown",
+                 "module.degraded", "module.recovered",
+                 "system.connection.offer", "system.connection.release",
+                 "system.instance.started", "system.instance.stopped",
+                 "system.ping"}
+
+# Queue pressure system events (always delivered, never filtered by pressure)
+PRESSURE_EVENTS = {"system.queue_pressure", "system.queue_warning"}
 
 # Callback execution pool size (max concurrent callback tasks)
 CALLBACK_POOL_SIZE = 100
 
+# ── Queue pressure levels & thresholds ──
+# Hysteresis: upgrade uses high thresholds, downgrade uses low thresholds
+PRESSURE_LEVELS = ("idle", "busy", "overload", "critical")
+PRESSURE_UPGRADE = {"idle": 0.30, "busy": 0.60, "overload": 0.85}   # -> next level
+PRESSURE_DOWNGRADE = {"busy": 0.20, "overload": 0.45, "critical": 0.70}  # -> prev level
+PRESSURE_SUGGESTIONS = {
+    "idle": "正常发送",
+    "busy": "注意队列压力",
+    "overload": "减少事件发送",
+    "critical": "立即停止发送"
+}
+
+# Critical countdown durations (seconds)
+CRITICAL_TIMEOUT_ELASTIC = 60    # 支持弹性管理的模块
+CRITICAL_TIMEOUT_DEFAULT = 30    # 不支持弹性管理的模块
+CRITICAL_WARNING_INTERVAL = 5    # 警告事件发送间隔
+
 
 class EventHub:
 
     def __init__(self):
-        # Connection table: module_id -> WebSocket
-        self.connections: dict[str, WebSocket] = {}
+        # Connection table: module_id -> {slot -> WebSocket}
+        self.connections: dict[str, dict[int, WebSocket]] = {}
         # Connection metadata: module_id -> {connected_at}
         self.connection_info: dict[str, dict] = {}
+
+        # ── 多连接：双层队列 ──
+        self._slot_queues: dict[str, dict[int, asyncio.Queue]] = {}   # mid → {slot → queue}
+        self._slot_senders: dict[str, dict[int, asyncio.Task]] = {}   # mid → {slot → task}
+
+        # ── 多连接：保序集合 ──
+        self._ordering_groups: dict[str, list[OrderingGroup]] = {}     # mid → groups
+        self._key_to_group: dict[tuple[str, str], OrderingGroup] = {}  # (mid, key) → group
+
+        # ── 多连接：轮询计数 ──
+        self._rr_counters: dict[str, int] = {}
         # Subscription table: module_id -> set of (pattern_str, pattern_tuple)
         self.subscriptions: dict[str, set[tuple]] = {}
         # Per-subscriber delivery queue + sender task
@@ -76,49 +147,374 @@ class EventHub:
         # Queue overflow tracking (per module)
         self._queue_overflow: dict[str, int] = {}  # module_id -> overflow count
 
+        # Queue byte size tracking (per module)
+        self._queue_bytes: dict[str, int] = {}  # module_id -> current bytes in queue
+
+        # Event statistics (per event type)
+        # event_type -> {count, last_time, last_source}
+        self._event_stats: dict[str, dict] = {}
+
+        # ── Queue pressure management ──
+        self._queue_levels: dict[str, str] = {}          # module_id -> current pressure level
+        self._module_elastic: dict[str, bool] = {}       # module_id -> supports queue_elastic
+        self._critical_timers: dict[str, asyncio.Task] = {}  # module_id -> countdown task
+        self._cnt_dropped: int = 0  # total events dropped by pressure filtering
+
+        # ── Session sequence number management ──
+        self._session_ids: dict[str, str] = {}  # module_id -> session_id (UUID)
+        self._session_seq: dict[str, int] = {}  # module_id -> current sequence number
+
+        # ── Periodic pressure notification ──
+        self._pressure_reminder_tasks: dict[str, asyncio.Task] = {}  # module_id -> reminder task
+
+        # ── Source-side throttle ──
+        self._throttle_last: dict[str, float] = {}  # full_key -> last publish timestamp
+        self._cnt_throttled: int = 0  # total events throttled
+
+        # ── Multi-instance tracking ──
+        # module_id → [instance_key, ...] (ordered, primary first)
+        self._module_instances: dict[str, list[str]] = {}
+        # module_id → round-robin counter for instance selection
+        self._instance_rr: dict[str, int] = {}
+        # (module_id, event_key) → instance_key — sticky binding for ordering
+        self._instance_bindings: dict[tuple[str, str], str] = {}
+
+        # ── Instance pressure reports (from modules) ──
+        # instance_key → {level, depth, capacity, updated_at}
+        self._instance_pressure: dict[str, dict] = {}
+
+        # ── Draining instances ──
+        # 正在排干队列的实例：路由层不再向其派发新请求/事件，等队列清空后由 scaler 关闭
+        self._draining_instances: set[str] = set()
+
     # ── Connection lifecycle ──
 
-    def add_connection(self, module_id: str, ws: WebSocket):
-        """Add a new connection. If module_id already connected, close the old one."""
-        old_ws = self.connections.get(module_id)
-        if old_ws is not None:
-            asyncio.ensure_future(self._close_old(module_id, old_ws))
+    def add_connection(self, module_id: str, ws: WebSocket, slot: int = 0):
+        """Add a new connection.
 
-        self.connections[module_id] = ws
-        self.connection_info[module_id] = {
-            "connected_at": datetime.now(timezone.utc).isoformat(),
-        }
-        self.subscriptions.pop(module_id, None)
-        # Create delivery queue + sender task
-        q = asyncio.Queue(maxsize=QUEUE_MAXSIZE)
-        self._queues[module_id] = q
-        self._senders[module_id] = asyncio.create_task(
-            self._sender_loop(module_id, ws, q)
+        module_id: For single-instance modules this is the module name.
+                   For multi-instance, this is instance_key (e.g. 'assistant#2').
+        slot 0: 主连接，重建 session 和共享队列（与原逻辑一致）。
+        slot > 0: 附加连接，不重建 session，只创建 slot 队列和 sender。
+        """
+        # Track instance in _module_instances
+        base_mid, inst_num = parse_instance_key(module_id)
+        if base_mid not in self._module_instances:
+            self._module_instances[base_mid] = []
+        if module_id not in self._module_instances[base_mid]:
+            self._module_instances[base_mid].append(module_id)
+
+        if slot == 0:
+            # 主连接逻辑
+            old_slots = self.connections.get(module_id)
+            if old_slots and 0 in old_slots:
+                asyncio.ensure_future(self._close_old(module_id, old_slots[0]))
+
+            # 生成新的会话 ID
+            import uuid
+            session_id = str(uuid.uuid4())
+            self._session_ids[module_id] = session_id
+            self._session_seq[module_id] = 0
+
+            # 初始化连接表
+            if module_id not in self.connections:
+                self.connections[module_id] = {}
+            self.connections[module_id][0] = ws
+            self.connection_info[module_id] = {
+                "connected_at": datetime.now(timezone.utc).isoformat(),
+                "session_id": session_id,
+            }
+            # 仅主实例重连时清除订阅（多实例场景下不影响其他实例的订阅）
+            if inst_num <= 1:
+                self.subscriptions.pop(base_mid, None)
+
+            # 创建共享队列 + 分发器（sender_loop）
+            q = asyncio.Queue(maxsize=QUEUE_MAXSIZE)
+            self._queues[module_id] = q
+            old_sender = self._senders.pop(module_id, None)
+            if old_sender:
+                old_sender.cancel()
+            self._senders[module_id] = asyncio.create_task(
+                self._sender_loop(module_id, q)
+            )
+
+            # 初始化 slot 队列表
+            if module_id not in self._slot_queues:
+                self._slot_queues[module_id] = {}
+            if module_id not in self._slot_senders:
+                self._slot_senders[module_id] = {}
+
+            # 清理旧的 slot 0 队列和 sender（如果有的话）
+            old_slot_sender = self._slot_senders.get(module_id, {}).pop(0, None)
+            if old_slot_sender:
+                old_slot_sender.cancel()
+            self._slot_queues.get(module_id, {}).pop(0, None)
+
+            print(f"[kernel] {module_id} connected (slot 0), session={session_id[:8]}")
+        else:
+            # 附加 slot：不重建 session，不清订阅
+            if module_id not in self.connections:
+                self.connections[module_id] = {}
+            self.connections[module_id][slot] = ws
+            if module_id not in self._slot_queues:
+                self._slot_queues[module_id] = {}
+            if module_id not in self._slot_senders:
+                self._slot_senders[module_id] = {}
+            print(f"[kernel] {module_id} connected (slot {slot})")
+
+        # 为该 slot 创建独立的发送队列和 sender
+        slot_q = asyncio.Queue(maxsize=QUEUE_MAXSIZE)
+        self._slot_queues.setdefault(module_id, {})[slot] = slot_q
+        self._slot_senders.setdefault(module_id, {})[slot] = asyncio.create_task(
+            self._slot_sender(module_id, slot, ws, slot_q)
         )
-        print(f"[kernel] {module_id} connected")
 
     async def _close_old(self, module_id: str, ws: WebSocket):
         try:
-            await ws.close(code=4000, reason="replaced by new connection")
+            await ws.close(code=4010, reason="replaced by new connection")
         except Exception:
             pass
         print(f"[kernel] Closed old connection for {module_id}")
 
-    def remove_connection(self, module_id: str):
-        """Clean up on disconnect."""
+    def remove_connection(self, module_id: str, slot: int = 0):
+        """Clean up on disconnect.
+
+        删除指定 slot。只有当所有 slot 都断开时才清理模块级资源。
+        """
+        # 删除该 slot 的 ws
+        slots = self.connections.get(module_id)
+        if slots:
+            slots.pop(slot, None)
+
+        # 删除该 slot 的队列和 sender
+        slot_senders = self._slot_senders.get(module_id, {})
+        slot_task = slot_senders.pop(slot, None)
+        if slot_task:
+            slot_task.cancel()
+        slot_queues = self._slot_queues.get(module_id, {})
+        slot_queues.pop(slot, None)
+
+        # 清理该 slot 上的保序绑定
+        for group in self._ordering_groups.get(module_id, []):
+            if group.bound_slot == slot:
+                group.bound_slot = None
+
+        # 检查是否所有 slot 都已断开
+        remaining_slots = self.connections.get(module_id, {})
+        if remaining_slots:
+            print(f"[kernel] {module_id} slot {slot} disconnected, {len(remaining_slots)} slot(s) remaining")
+            return
+
+        # 所有 slot 都断开 → 清理模块级资源
         self.connections.pop(module_id, None)
         self.connection_info.pop(module_id, None)
-        self.subscriptions.pop(module_id, None)
+
+        # Remove this instance from _module_instances
+        base_mid = parse_instance_key(module_id)[0]
+        inst_list = self._module_instances.get(base_mid, [])
+        if module_id in inst_list:
+            inst_list.remove(module_id)
+        if not inst_list:
+            self._module_instances.pop(base_mid, None)
+            # 最后一个实例断开 → 清除订阅和所有实例绑定
+            self.subscriptions.pop(base_mid, None)
+            self._instance_bindings = {
+                k: v for k, v in self._instance_bindings.items()
+                if k[0] != base_mid
+            }
+            self._instance_rr.pop(base_mid, None)
+        else:
+            # 清理指向已断开实例的绑定（让 _pick_instance 重新绑定）
+            stale = [k for k, v in self._instance_bindings.items()
+                     if k[0] == base_mid and v == module_id]
+            for k in stale:
+                del self._instance_bindings[k]
+
         self._queues.pop(module_id, None)
         task = self._senders.pop(module_id, None)
         if task:
             task.cancel()
-        print(f"[kernel] {module_id} disconnected")
+        self._slot_queues.pop(module_id, None)
+        self._slot_senders.pop(module_id, None)
+        # Clean up pressure state
+        self._queue_levels.pop(module_id, None)
+        self._queue_overflow.pop(module_id, None)
+        self._queue_bytes.pop(module_id, None)
+        timer = self._critical_timers.pop(module_id, None)
+        if timer:
+            timer.cancel()
+        # Clean up pressure reminder task
+        reminder_task = self._pressure_reminder_tasks.pop(module_id, None)
+        if reminder_task:
+            reminder_task.cancel()
+        # Clean up session state
+        self._session_ids.pop(module_id, None)
+        self._session_seq.pop(module_id, None)
+        # Clean up ordering groups
+        groups = self._ordering_groups.pop(module_id, [])
+        for g in groups:
+            for key in g.keys:
+                self._key_to_group.pop((module_id, key), None)
+        self._rr_counters.pop(module_id, None)
+        # Clean up instance pressure data
+        self._instance_pressure.pop(module_id, None)
+        print(f"[kernel] {module_id} disconnected (all slots)")
+
+    def get_instance_keys(self, module_id: str) -> list[str]:
+        """Return active instance_keys for a module_id. Single-instance returns [module_id]."""
+        return list(self._module_instances.get(module_id, []))
+
+    def get_active_instance_keys(self, module_id: str) -> list[str]:
+        """Return non-draining instance_keys. Used by scaler to count live targets."""
+        return [k for k in self._module_instances.get(module_id, [])
+                if k not in self._draining_instances]
+
+    def set_draining(self, inst_key: str):
+        """标记实例为 draining：路由层不再派发新请求/事件，等队列清空后由 scaler 关闭。"""
+        self._draining_instances.add(inst_key)
+
+    def clear_draining(self, inst_key: str):
+        """清除 draining 标记（实例已停止）。"""
+        self._draining_instances.discard(inst_key)
+
+    def is_draining(self, inst_key: str) -> bool:
+        return inst_key in self._draining_instances
+
+    def has_other_instances(self, module_id: str, exclude_key: str) -> bool:
+        """Check if module has other active instances besides exclude_key."""
+        inst_list = self._module_instances.get(module_id, [])
+        return any(k != exclude_key for k in inst_list)
+
+    def _pick_instance(self, module_id: str, event_key: str) -> str | None:
+        """Pick one instance_key for event delivery.
+
+        Strategy:
+        - Single instance: fast path, return it
+        - Ordering key has sticky binding: return bound instance (migrate if dead)
+        - Otherwise: round-robin
+        """
+        inst_keys = self._module_instances.get(module_id, [])
+        if not inst_keys:
+            return None
+
+        # 过滤掉正在 draining 的实例；若全部 draining 则 fallback 到 primary
+        active = [k for k in inst_keys if k not in self._draining_instances]
+        if not active:
+            active = inst_keys[:1]  # fallback: primary 兜底
+
+        if len(active) == 1:
+            return active[0]
+
+        # Check sticky binding for ordering keys
+        if event_key:
+            binding_key = (module_id, event_key)
+            bound = self._instance_bindings.get(binding_key)
+            if bound and bound in active:
+                return bound
+            # Bind to round-robin choice (or rebind if instance died/draining)
+            picked = self._instance_round_robin(module_id, active)
+            self._instance_bindings[binding_key] = picked
+            return picked
+
+        return self._instance_round_robin(module_id, active)
+
+    def _instance_round_robin(self, module_id: str, inst_keys: list[str]) -> str:
+        """Round-robin across instances."""
+        idx = self._instance_rr.get(module_id, 0) % len(inst_keys)
+        self._instance_rr[module_id] = idx + 1
+        return inst_keys[idx]
+
+    # ── Instance pressure reports ──
+
+    def report_instance_pressure(self, instance_key: str, data: dict):
+        """Store pressure report from a module instance.
+
+        Args:
+            instance_key: e.g. 'assistant' or 'assistant#2'
+            data: {level: str, depth: int, capacity: int}
+        """
+        self._instance_pressure[instance_key] = {
+            "level": data.get("level", "idle"),
+            "depth": data.get("depth", 0),
+            "capacity": data.get("capacity", 0),
+            "updated_at": time.time(),
+        }
+
+    def get_instance_pressure(self, instance_key: str) -> dict | None:
+        """Get last reported pressure for an instance."""
+        return self._instance_pressure.get(instance_key)
+
+    def get_module_pressure(self, module_id: str) -> dict:
+        """Get pressure summary for all instances of a module.
+
+        Returns: {instance_key: {level, depth, capacity, updated_at}, ...}
+        """
+        result = {}
+        for inst_key in self._module_instances.get(module_id, []):
+            p = self._instance_pressure.get(inst_key)
+            if p:
+                result[inst_key] = p
+        return result
 
     # ── Sender loop (per-subscriber) ──
 
-    async def _sender_loop(self, mid: str, ws: WebSocket, queue: asyncio.Queue):
-        """Drain queue and send to subscriber. Exits on send failure."""
+    async def _sender_loop(self, mid: str, queue: asyncio.Queue):
+        """分发器：从共享队列取消息 → 添加 seq → 选 slot → 放入 slot 队列。
+
+        弹性模块在 critical 级别时执行压缩后再分发。
+        """
+        try:
+            is_elastic = self._module_elastic.get(mid, False)
+            while True:
+                # 弹性模块压缩逻辑
+                if is_elastic:
+                    level = self._queue_levels.get(mid, "idle")
+                    should_compress = level == "critical"
+                else:
+                    should_compress = False
+
+                if should_compress and queue.qsize() > 1:
+                    compressed_msg = await self._compress_and_send(mid, queue)
+                    if compressed_msg:
+                        # 压缩摘要也需要分发到某个 slot
+                        slot = self._pick_slot(mid, "system.events_compressed")
+                        slot_q = self._slot_queues.get(mid, {}).get(slot)
+                        if slot_q:
+                            try:
+                                slot_q.put_nowait(compressed_msg)
+                            except asyncio.QueueFull:
+                                pass
+                        continue
+
+                raw = await queue.get()
+
+                # 减少字节计数
+                msg_size = len(raw)
+                current_bytes = self._queue_bytes.get(mid, 0)
+                self._queue_bytes[mid] = max(0, current_bytes - msg_size)
+
+                # 添加序列号
+                raw = self._add_sequence_number(mid, raw)
+
+                # 提取事件 key 用于保序
+                event_key = self._extract_event_key(raw)
+
+                # 选 slot 并放入 slot 队列
+                slot = self._pick_slot(mid, event_key)
+                slot_q = self._slot_queues.get(mid, {}).get(slot)
+                if slot_q:
+                    try:
+                        slot_q.put_nowait(raw)
+                    except asyncio.QueueFull:
+                        self._cnt_dropped += 1
+                else:
+                    # 没有可用 slot，消息丢弃
+                    self._cnt_dropped += 1
+        except asyncio.CancelledError:
+            pass
+
+    async def _slot_sender(self, mid: str, slot: int, ws: WebSocket, queue: asyncio.Queue):
+        """每个 slot 独立发送协程：从 slot 队列取消息 → 发送到 WebSocket。"""
         try:
             while True:
                 raw = await queue.get()
@@ -126,14 +522,230 @@ class EventHub:
                     if len(raw) > 65536:
                         await asyncio.wait_for(ws.send_text(raw), timeout=5 + len(raw) / 102400)
                     else:
-                        await ws.send_text(raw)
+                        await asyncio.wait_for(ws.send_text(raw), timeout=10.0)
                     self._cnt_routed += 1
+                except asyncio.TimeoutError:
+                    print(f"[kernel] slot_sender timeout: {mid} slot {slot}, closing")
+                    try:
+                        await ws.close(code=4013, reason="Send timeout")
+                    except Exception:
+                        pass
+                    break
                 except Exception:
-                    # Connection closed (normal during shutdown) — exit silently
                     break
         except asyncio.CancelledError:
             pass
 
+    def _extract_event_key(self, raw: str) -> str:
+        """从 JSON 消息中提取事件 key（event type）用于保序分发。"""
+        try:
+            msg = _loads(raw)
+            return msg.get("params", {}).get("event", "")
+        except Exception:
+            return ""
+
+    def _pick_slot(self, mid: str, event_key: str) -> int:
+        """选择目标 slot：保序集合绑定 → 轮询。"""
+        slot_queues = self._slot_queues.get(mid, {})
+        alive_slots = list(slot_queues.keys())
+        if not alive_slots:
+            return 0  # fallback
+
+        # 单 slot 快速路径
+        if len(alive_slots) == 1:
+            return alive_slots[0]
+
+        # 检查保序集合
+        if event_key:
+            group = self._key_to_group.get((mid, event_key))
+            if group:
+                if group.bound_slot is not None and group.bound_slot in slot_queues:
+                    return group.bound_slot
+                # 需要绑定新 slot
+                slot = self._round_robin(mid, alive_slots)
+                group.bound_slot = slot
+                # 记录最后入队的 seq，用于释放绑定
+                group.last_enqueued_seq = self._session_seq.get(mid, 0)
+                return slot
+
+        # 不在任何保序集合 → 轮询
+        return self._round_robin(mid, alive_slots)
+
+    def _round_robin(self, mid: str, alive_slots: list[int]) -> int:
+        """轮询选择 slot。"""
+        idx = self._rr_counters.get(mid, 0)
+        slot = alive_slots[idx % len(alive_slots)]
+        self._rr_counters[mid] = idx + 1
+        return slot
+
+    def set_ordering_groups(self, module_id: str, groups: list[dict]):
+        """设置模块的保序集合（由 kernel.set_ordering_groups RPC 调用）。
+
+        Args:
+            module_id: 模块 ID
+            groups: [{"name": "session", "keys": ["session.started", "session.ended"]}]
+        """
+        # 清理旧映射
+        old_groups = self._ordering_groups.pop(module_id, [])
+        for g in old_groups:
+            for key in g.keys:
+                self._key_to_group.pop((module_id, key), None)
+
+        # 创建新映射
+        new_groups = []
+        for g_data in groups:
+            name = g_data.get("name", "")
+            keys = set(g_data.get("keys", []))
+            group = OrderingGroup(name=name, keys=keys)
+            new_groups.append(group)
+            for key in keys:
+                self._key_to_group[(module_id, key)] = group
+
+        self._ordering_groups[module_id] = new_groups
+        print(f"[kernel] {module_id} set ordering groups: {[g.name for g in new_groups]}")
+
+    def get_slot_count(self, module_id: str) -> int:
+        """获取模块当前活跃的 slot 数量。"""
+        return len(self.connections.get(module_id, {}))
+
+    def _add_sequence_number(self, module_id: str, raw: str) -> str:
+        """为消息添加序列号和会话 ID"""
+        # 分配序列号
+        seq = self._session_seq.get(module_id, 0) + 1
+        self._session_seq[module_id] = seq
+
+        # 获取会话 ID
+        session_id = self._session_ids.get(module_id, "")
+
+        # 解析消息并添加 seq 和 session_id
+        msg = _loads(raw)
+        if "params" in msg:
+            msg["params"]["seq"] = seq
+            msg["params"]["session_id"] = session_id
+            # 剥离内部 _priority 字段（不发给订阅者）
+            msg["params"].pop("_priority", None)
+
+        return _dumps(msg)
+
+    async def _compress_and_send(self, module_id: str, queue: asyncio.Queue) -> str | None:
+        """从队列中取出多条可压缩消息，合并成压缩摘要。
+
+        压缩规则：
+        1. 最多压缩 100 条消息或 100KB 内容
+        2. 遇到不可压缩消息（系统事件、压力事件）时停止
+        3. 返回压缩摘要消息（JSON-RPC 2.0 格式）
+        """
+        compressed = []
+        total_bytes = 0
+        event_types = {}
+        sources = {}
+        seq_list = []
+
+        # 尝试从队列中取出消息
+        while len(compressed) < COMPRESS_MAX_COUNT and total_bytes < COMPRESS_MAX_BYTES:
+            if queue.empty():
+                break
+
+            try:
+                raw = queue.get_nowait()
+            except asyncio.QueueEmpty:
+                break
+
+            msg_size = len(raw)
+
+            # 解析消息
+            try:
+                msg = _loads(raw)
+                params = msg.get("params", {})
+                event_type = params.get("event", "")
+                source = params.get("source", "")
+                event_id = params.get("event_id", "")
+
+                # 检查是否可压缩
+                if event_type in SYSTEM_EVENTS or event_type in PRESSURE_EVENTS:
+                    # 不可压缩 → 放回队列，停止压缩
+                    # 注意：put_nowait 可能失败（队列满），但这是极端情况
+                    try:
+                        queue.put_nowait(raw)
+                    except asyncio.QueueFull:
+                        pass
+                    break
+
+                # priority=critical 的事件不可压缩（与系统事件同等待遇）
+                msg_priority = params.get("_priority", "normal")
+                if msg_priority == "critical":
+                    try:
+                        queue.put_nowait(raw)
+                    except asyncio.QueueFull:
+                        pass
+                    break
+
+                # 可压缩 → 加入压缩列表
+                compressed.append({
+                    "event_id": event_id,
+                    "event": event_type,
+                    "source": source,
+                    "timestamp": params.get("timestamp", ""),
+                })
+
+                # 统计
+                event_types[event_type] = event_types.get(event_type, 0) + 1
+                sources[source] = sources.get(source, 0) + 1
+                seq_list.append(params.get("seq"))
+
+                # 减少字节计数
+                current_bytes = self._queue_bytes.get(module_id, 0)
+                self._queue_bytes[module_id] = max(0, current_bytes - msg_size)
+
+                total_bytes += msg_size
+
+            except Exception as e:
+                # 解析失败 → 跳过这条消息
+                print(f"[kernel] Failed to parse message for compression: {e}")
+                continue
+
+        # 如果没有压缩任何消息，返回 None
+        if not compressed:
+            return None
+
+        # 构建压缩摘要
+        import uuid
+        seq_range = None
+        if seq_list:
+            valid_seqs = [s for s in seq_list if s is not None]
+            if valid_seqs:
+                seq_range = (min(valid_seqs), max(valid_seqs))
+
+        compress_msg = {
+            "jsonrpc": "2.0",
+            "method": "event",
+            "params": {
+                "event_id": str(uuid.uuid4()),
+                "event": "system.events_compressed",
+                "source": "kernel",
+                "timestamp": datetime.now(timezone.utc).isoformat(),
+                "session_id": self._session_ids.get(module_id, ""),
+                "data": {
+                    "module_id": module_id,
+                    "compressed_count": len(compressed),
+                    "event_types": event_types,
+                    "sources": sources,
+                    "seq_range": seq_range,
+                    "level": self._queue_levels.get(module_id, "idle"),
+                    "total_bytes": total_bytes,
+                },
+            },
+        }
+
+        # 添加序列号（压缩摘要本身也需要序列号）
+        seq = self._session_seq.get(module_id, 0) + 1
+        self._session_seq[module_id] = seq
+        compress_msg["params"]["seq"] = seq
+
+        print(f"[kernel] Compressed {len(compressed)} events for {module_id}, seq_range={seq_range}, bytes={total_bytes}")
+
+        return _dumps(compress_msg)
+
     async def _callback_sender_loop(self, mid: str, callback: callable, queue: asyncio.Queue):
         """回调专用的发送循环（类似 _sender_loop，但调用回调而不是发送 WS）
 
@@ -183,6 +795,13 @@ class EventHub:
             q = asyncio.Queue(maxsize=QUEUE_MAXSIZE)
             self._queues[module_id] = q
 
+        # 注册到实例列表（使 subscription-based routing 能找到此模块）
+        base_mid = parse_instance_key(module_id)[0]
+        if base_mid not in self._module_instances:
+            self._module_instances[base_mid] = []
+        if module_id not in self._module_instances[base_mid]:
+            self._module_instances[base_mid].append(module_id)
+
         print(f"[kernel] Registered internal callback for {module_id}")
 
     def start_internal_senders(self):
@@ -204,16 +823,19 @@ class EventHub:
             task.cancel()
 
     def handle_subscribe(self, module_id: str, events: list[str]):
-        if module_id not in self.subscriptions:
-            self.subscriptions[module_id] = set()
-        self.subscriptions[module_id].update(
+        """Store subscription patterns. Keyed by base module_id (shared across instances)."""
+        base_mid = parse_instance_key(module_id)[0]
+        if base_mid not in self.subscriptions:
+            self.subscriptions[base_mid] = set()
+        self.subscriptions[base_mid].update(
             (p, tuple(p.split("."))) for p in events
         )
         print(f"[kernel] {module_id} subscribed: {events}")
 
     def handle_unsubscribe(self, module_id: str, events: list[str]) -> dict:
         """Unsubscribe from events. Returns dict with unsubscribed events and count."""
-        subs = self.subscriptions.get(module_id)
+        base_mid = parse_instance_key(module_id)[0]
+        subs = self.subscriptions.get(base_mid)
         unsubscribed = []
         if subs:
             to_remove = {item for item in subs if item[0] in events}
@@ -222,10 +844,270 @@ class EventHub:
         print(f"[kernel] {module_id} unsubscribed: {events}")
         return {"unsubscribed": unsubscribed, "count": len(unsubscribed)}
 
+    # ── Queue pressure management ──
+
+    def set_module_elastic(self, module_id: str, elastic: bool):
+        """记录模块是否支持弹性队列管理（由 set_ready 时调用）"""
+        self._module_elastic[module_id] = elastic
+
+    def _calc_pressure_level(self, module_id: str, queue: asyncio.Queue) -> str:
+        """根据队列使用率和字节使用率计算压力等级（取较高者）"""
+        # 消息数量使用率
+        count_usage = queue.qsize() / QUEUE_MAXSIZE
+        # 字节大小使用率
+        bytes_usage = self._queue_bytes.get(module_id, 0) / QUEUE_MAX_BYTES
+        # 取两者中较高的使用率
+        usage = max(count_usage, bytes_usage)
+
+        current = self._queue_levels.get(module_id, "idle")
+        level_idx = PRESSURE_LEVELS.index(current)
+
+        # 尝试升级
+        if current in PRESSURE_UPGRADE and usage > PRESSURE_UPGRADE[current]:
+            return PRESSURE_LEVELS[level_idx + 1]
+        # 尝试降级
+        if current in PRESSURE_DOWNGRADE and usage < PRESSURE_DOWNGRADE[current]:
+            return PRESSURE_LEVELS[level_idx - 1]
+        return current
+
+    def _on_pressure_change(self, module_id: str, old_level: str, new_level: str, queue: asyncio.Queue):
+        """压力等级变化时的处理逻辑"""
+        self._queue_levels[module_id] = new_level
+        usage_pct = round(queue.qsize() / QUEUE_MAXSIZE * 100, 1)
+
+        print(f"[kernel] Queue pressure {module_id}: {old_level} → {new_level} ({usage_pct}%)")
+
+        # 发送压力通知事件（直接入队，不经过 _route_event）
+        self._send_pressure_notification(module_id, new_level, queue, old_level)
+
+        # 管理定期提醒任务
+        if new_level in ("busy", "overload", "critical"):
+            # 进入 busy 及以上级别 → 启动定期提醒
+            if module_id not in self._pressure_reminder_tasks:
+                self._pressure_reminder_tasks[module_id] = asyncio.create_task(
+                    self._pressure_reminder_loop(module_id)
+                )
+        else:
+            # 回落到 idle → 停止定期提醒
+            reminder_task = self._pressure_reminder_tasks.pop(module_id, None)
+            if reminder_task:
+                reminder_task.cancel()
+
+        # 管理 critical 倒计时
+        if new_level == "critical":
+            self._start_critical_countdown(module_id)
+        elif old_level == "critical":
+            # 从 critical 回落，取消倒计时
+            timer = self._critical_timers.pop(module_id, None)
+            if timer:
+                timer.cancel()
+                print(f"[kernel] {module_id} critical countdown cancelled (pressure relieved)")
+
+    async def _pressure_reminder_loop(self, module_id: str):
+        """定期发送压力状态提醒（每 3 秒）"""
+        try:
+            while True:
+                await asyncio.sleep(3)
+
+                # 检查当前压力等级
+                level = self._queue_levels.get(module_id, "idle")
+                if level not in ("busy", "overload", "critical"):
+                    # 压力已降到 idle，停止提醒
+                    break
+
+                # 获取队列
+                queue = self._queues.get(module_id)
+                if not queue:
+                    break
+
+                # 发送状态通知（old_level = level 表示无变化）
+                self._send_pressure_notification(module_id, level, queue, level)
+
+        except asyncio.CancelledError:
+            pass
+        finally:
+            self._pressure_reminder_tasks.pop(module_id, None)
+
+    def _send_pressure_notification(self, module_id: str, level: str, queue: asyncio.Queue, old_level: str = None):
+        """向目标模块发送 system.queue_pressure 事件"""
+        import uuid
+
+        queue_bytes = self._queue_bytes.get(module_id, 0)
+        count_usage = queue.qsize() / QUEUE_MAXSIZE
+        bytes_usage = queue_bytes / QUEUE_MAX_BYTES
+
+        # 判断是升级还是降级
+        direction = None
+        if old_level:
+            old_idx = PRESSURE_LEVELS.index(old_level) if old_level in PRESSURE_LEVELS else -1
+            new_idx = PRESSURE_LEVELS.index(level) if level in PRESSURE_LEVELS else -1
+            if new_idx > old_idx:
+                direction = "upgrade"
+            elif new_idx < old_idx:
+                direction = "downgrade"
+
+        msg = {
+            "jsonrpc": "2.0",
+            "method": "event",
+            "params": {
+                "event_id": str(uuid.uuid4()),
+                "event": "system.queue_pressure",
+                "source": "kernel",
+                "timestamp": datetime.now(timezone.utc).isoformat(),
+                "data": {
+                    "module_id": module_id,
+                    "level": level,
+                    "old_level": old_level,
+                    "direction": direction,  # "upgrade" | "downgrade" | None
+                    # 消息数量
+                    "queue_size": queue.qsize(),
+                    "queue_max": QUEUE_MAXSIZE,
+                    "count_usage_percent": round(count_usage * 100, 1),
+                    # 字节大小
+                    "queue_bytes": queue_bytes,
+                    "queue_max_bytes": QUEUE_MAX_BYTES,
+                    "bytes_usage_percent": round(bytes_usage * 100, 1),
+                    # 综合使用率（取较高者）
+                    "usage_percent": round(max(count_usage, bytes_usage) * 100, 1),
+                    "suggestion": PRESSURE_SUGGESTIONS[level],
+                },
+            },
+        }
+        raw = _dumps(msg)
+        # 直接入队（压力通知本身不受压力过滤）
+        try:
+            queue.put_nowait(raw)
+        except asyncio.QueueFull:
+            pass  # 队列满也无法发送，只能放弃
+
+    def _start_critical_countdown(self, module_id: str):
+        """启动 critical 倒计时"""
+        # 如果已有倒计时在运行，不重复启动
+        if module_id in self._critical_timers:
+            return
+
+        is_elastic = self._module_elastic.get(module_id, False)
+        timeout = CRITICAL_TIMEOUT_ELASTIC if is_elastic else CRITICAL_TIMEOUT_DEFAULT
+        self._critical_timers[module_id] = asyncio.create_task(
+            self._critical_countdown_loop(module_id, timeout)
+        )
+        print(f"[kernel] {module_id} critical countdown started ({timeout}s, elastic={is_elastic})")
+
+    async def _critical_countdown_loop(self, module_id: str, timeout: int):
+        """倒计时循环：定期发送警告，超时后断开连接
+
+        弹性模块：由 _on_pressure_change 在压力回落时取消此 task
+        非弹性模块：在此循环中自行检查队列使用率 < 85% 时退出
+        """
+        try:
+            is_elastic = self._module_elastic.get(module_id, False)
+            remaining = timeout
+            while remaining > 0:
+                await asyncio.sleep(CRITICAL_WARNING_INTERVAL)
+                remaining -= CRITICAL_WARNING_INTERVAL
+
+                # 检查模块是否还在连接中
+                queue = self._queues.get(module_id)
+                slots = self.connections.get(module_id)
+                if not queue or not slots:
+                    return
+
+                # 非弹性模块：检查队列使用率是否降到 85% 以下
+                if not is_elastic:
+                    count_usage = queue.qsize() / QUEUE_MAXSIZE
+                    bytes_usage = self._queue_bytes.get(module_id, 0) / QUEUE_MAX_BYTES
+                    usage = max(count_usage, bytes_usage)
+                    if usage < 0.85:
+                        self._critical_timers.pop(module_id, None)
+                        print(f"[kernel] {module_id} critical countdown cancelled (usage dropped to {round(usage * 100, 1)}%)")
+                        return
+
+                # 弹性模块：由 _on_pressure_change 取消此 task，这里只负责发送警告和最终断开
+
+                # 发送警告事件
+                import uuid
+                warning_msg = {
+                    "jsonrpc": "2.0",
+                    "method": "event",
+                    "params": {
+                        "event_id": str(uuid.uuid4()),
+                        "event": "system.queue_warning",
+                        "source": "kernel",
+                        "timestamp": datetime.now(timezone.utc).isoformat(),
+                        "data": {
+                            "module_id": module_id,
+                            "remaining_seconds": max(remaining, 0),
+                            "reason": "queue_critical_timeout",
+                            "message": f"Queue pressure critical, will disconnect in {max(remaining, 0)}s",
+                        },
+                    },
+                }
+                try:
+                    queue.put_nowait(_dumps(warning_msg))
+                except asyncio.QueueFull:
+                    pass
+
+            # 倒计时归零，断开所有连接
+            self._critical_timers.pop(module_id, None)
+            slots = self.connections.get(module_id, {})
+            if slots:
+                print(f"[kernel] {module_id} disconnected due to critical queue pressure timeout")
+                for ws in list(slots.values()):
+                    try:
+                        await ws.close(code=4011, reason="queue_pressure_critical")
+                    except Exception:
+                        pass
+
+        except asyncio.CancelledError:
+            pass
+
+    def _check_pressure(self, module_id: str, queue: asyncio.Queue):
+        """检查队列压力并处理等级变化（在 _route_event 入队前调用）"""
+        new_level = self._calc_pressure_level(module_id, queue)
+        old_level = self._queue_levels.get(module_id, "idle")
+        if new_level != old_level:
+            self._on_pressure_change(module_id, old_level, new_level, queue)
+
+    def _should_drop(self, module_id: str, event_type: str, droppable: bool,
+                     priority: str = "normal") -> bool:
+        """判断是否应丢弃该事件
+
+        丢弃决策矩阵：
+        压力等级 →       idle    busy    overload              critical
+        ─────────────────────────────────────────────────────────────────
+        系统/压力事件     KEEP    KEEP    KEEP                  KEEP
+        priority=critical KEEP    KEEP    KEEP                  KEEP
+        priority=high     KEEP    KEEP    KEEP                  DROP if droppable
+        priority=normal   KEEP    KEEP    DROP if droppable     DROP (always)
+        """
+        level = self._queue_levels.get(module_id, "idle")
+        # idle/busy: 不丢弃
+        if level in ("idle", "busy"):
+            return False
+        # 系统事件和压力事件永不丢弃
+        if event_type in SYSTEM_EVENTS or event_type in PRESSURE_EVENTS:
+            return False
+        # priority=critical: 永不被压力丢弃
+        if priority == "critical":
+            return False
+        # overload: normal 丢弃 droppable，high 不丢弃
+        if level == "overload":
+            if priority == "high":
+                return False
+            return droppable
+        # critical 压力: high 仅当 droppable 时丢弃，normal 全部丢弃
+        if priority == "high":
+            return droppable
+        return True
+
     # ── Event publishing (called by RpcRouter) ──
 
     def publish_event(self, sender_id: str, event_id: str, event_type: str,
-                      data: dict = None, echo: bool = False) -> dict:
+                      data: dict = None, echo: bool = False,
+                      droppable: bool = False,
+                      priority: str = "normal",
+                      throttle_key: str = "",
+                      throttle_ms: int = 0) -> dict:
         """Publish an event from a module. Called by RpcRouter for event.publish RPC.
         Returns empty dict on success, raises exception on validation failure."""
         self._cnt_received += 1
@@ -234,10 +1116,39 @@ class EventHub:
             self._cnt_errors += 1
             raise ValueError("Missing required field: event_id or event")
 
+        # 安全加固：以下系统事件只能由 Kernel 通过 publish_internal() 发出
+        # - module.offline：Kernel 检测连接断开时发布
+        # - module.degraded / module.recovered：必须走 kernel.report_* RPC 中转
+        # 注意：module.ready 由模块自身通过 event.publish 发布（合法），不在此列
+        # 注意：module.shutdown 由 Launcher 通过 event.publish 发布（合法），不在此列
+        KERNEL_ONLY_EVENTS = {"module.offline",
+                              "module.degraded", "module.recovered"}
+        if event_type in KERNEL_ONLY_EVENTS:
+            self._cnt_errors += 1
+            raise ValueError(f"System event '{event_type}' cannot be published by modules directly. "
+                             f"Use the corresponding kernel.* RPC method instead.")
+
         if self.dedup.is_duplicate(event_id):
             self._cnt_dedup += 1
             return {}  # silently accept duplicates
 
+        # 源端节流：同一 key 在间隔内的重复发布被静默丢弃
+        if throttle_key and throttle_ms > 0:
+            now = time.time()
+            full_key = f"{sender_id}:{throttle_key}"
+            last = self._throttle_last.get(full_key, 0)
+            if (now - last) * 1000 < throttle_ms:
+                self._cnt_throttled += 1
+                return {}
+            self._throttle_last[full_key] = now
+
+        # Update event statistics
+        self._event_stats[event_type] = {
+            "count": self._event_stats.get(event_type, {}).get("count", 0) + 1,
+            "last_time": time.time(),
+            "last_source": sender_id,
+        }
+
         msg = {
             "jsonrpc": "2.0",
             "method": "event",
@@ -250,10 +1161,11 @@ class EventHub:
             },
         }
 
-        self._route_event(sender_id, msg, event_type, echo)
+        self._route_event(sender_id, msg, event_type, echo, droppable, priority)
         return {}
 
-    def publish_internal(self, event_type: str, data: dict, source: str):
+    def publish_internal(self, event_type: str, data: dict, source: str,
+                         priority: str = "normal"):
         """Publish a Kernel-originated event (e.g. module.offline, module.registered).
         No dedup check — internal events are unique by nature.
 
@@ -261,11 +1173,19 @@ class EventHub:
             event_type: 事件类型（如 "module.ready"）
             data: 事件数据
             source: 事件来源模块 ID（必填，通常是调用者的 module_id）
+            priority: 事件优先级 ("normal" | "high" | "critical")
         """
         import uuid
         event_id = str(uuid.uuid4())
         self._cnt_received += 1
 
+        # Update event statistics
+        self._event_stats[event_type] = {
+            "count": self._event_stats.get(event_type, {}).get("count", 0) + 1,
+            "last_time": time.time(),
+            "last_source": source,
+        }
+
         msg = {
             "jsonrpc": "2.0",
             "method": "event",
@@ -278,86 +1198,145 @@ class EventHub:
             },
         }
 
-        self._route_event(source, msg, event_type, echo=False)
+        self._route_event(source, msg, event_type, echo=False, droppable=False,
+                         priority=priority)
 
     # ── Routing ──
 
-    def _route_event(self, sender_id: str, msg: dict, event_type: str, echo: bool):
+    def _route_event(self, sender_id: str, msg: dict, event_type: str, echo: bool,
+                     droppable: bool = False, priority: str = "normal"):
         """Enqueue event to all matching subscribers' delivery queues.
         System events (module.offline, module.ready, module.shutdown) are auto-broadcast
         to ALL connected modules, regardless of subscription.
 
         Exception: module.shutdown with a target module_id is sent ONLY to that module.
+
+        Queue pressure management:
+        - Checks pressure level before each enqueue
+        - Drops events based on pressure level, droppable flag, and priority
+        - Sends pressure notifications on level change
         """
         e_parts = tuple(event_type.split("."))
         raw = None  # lazy serialization
         params = msg.get("params", {})
         data = params.get("data", {})
 
+        # 注入 _priority 到 params（非 normal 时），用于 _compress_and_send 判断
+        if priority != "normal":
+            msg["params"]["_priority"] = priority
+
         # System events → broadcast to all connected modules (unless targeted)
         if event_type in SYSTEM_EVENTS:
-            # Check if this is a targeted shutdown (has module_id in data)
-            if event_type == "module.shutdown":
+            # Targeted delivery: module.shutdown / connection offer/release → send only to target
+            if event_type in ("module.shutdown", "system.connection.offer", "system.connection.release"):
                 target_module = data.get("module_id", "")
 
-                # Targeted shutdown → send only to target module
                 if target_module:
+                    # target_module may be instance_key or module_id; try instance_key first
                     queue = self._queues.get(target_module)
                     if queue:
                         if raw is None:
                             raw = _dumps(msg)
-                        try:
-                            queue.put_nowait(raw)
-                            self._cnt_queued += 1
-                        except asyncio.QueueFull:
-                            # Queue 满了，记录溢出
-                            self._queue_overflow[target_module] = self._queue_overflow.get(target_module, 0) + 1
-                            overflow_count = self._queue_overflow[target_module]
-                            # 每 100 次溢出打印一次警告
-                            if overflow_count % 100 == 1:
-                                print(f"[kernel] Warning: Queue full for {target_module}, dropped {overflow_count} events")
+                        self._enqueue_with_pressure(target_module, queue, raw, event_type, droppable, priority)
                     return
 
-            # Broadcast system events (no target or non-shutdown events)
+            # Broadcast system events to all instance queues
             for mid, queue in self._queues.items():
                 if mid == sender_id and not echo:
                     continue
                 if raw is None:
                     raw = _dumps(msg)
-                try:
-                    queue.put_nowait(raw)
-                    self._cnt_queued += 1
-                except asyncio.QueueFull:
-                    # Queue 满了，记录溢出
-                    self._queue_overflow[mid] = self._queue_overflow.get(mid, 0) + 1
-                    overflow_count = self._queue_overflow[mid]
-                    if overflow_count % 100 == 1:
-                        print(f"[kernel] Warning: Queue full for {mid}, dropped {overflow_count} events")
+                self._enqueue_with_pressure(mid, queue, raw, event_type, droppable, priority)
 
             return
 
         # Normal events → subscription-based routing
+        # subscriptions keyed by base module_id, queues keyed by instance_key
+        sender_module = parse_instance_key(sender_id)[0]
+        event_key = data.get("ordering_key", "") or event_type
         for mid, patterns in self.subscriptions.items():
-            if mid == sender_id and not echo:
+            if mid == sender_module and not echo:
                 continue
             for _pat_str, p_parts in patterns:
                 if match_parts(p_parts, e_parts):
-                    queue = self._queues.get(mid)
+                    picked = self._pick_instance(mid, event_key)
+                    if not picked:
+                        break  # no active instance
+                    queue = self._queues.get(picked)
                     if queue:
                         if raw is None:
                             raw = _dumps(msg)
-                        try:
-                            queue.put_nowait(raw)
-                            self._cnt_queued += 1
-                        except asyncio.QueueFull:
-                            # Queue 满了，记录溢出
-                            self._queue_overflow[mid] = self._queue_overflow.get(mid, 0) + 1
-                            overflow_count = self._queue_overflow[mid]
-                            # 每 100 次溢出打印一次警告
-                            if overflow_count % 100 == 1:
-                                print(f"[kernel] Warning: Queue full for {mid}, dropped {overflow_count} events")
+                        self._enqueue_with_pressure(picked, queue, raw, event_type, droppable, priority)
                     break
 
+    def _enqueue_with_pressure(self, module_id: str, queue: asyncio.Queue,
+                                raw: str, event_type: str, droppable: bool,
+                                priority: str = "normal"):
+        """入队并执行压力检测。统一所有入队逻辑到一个方法。
+
+        弹性模块（queue_elastic: true）：完整压力管理（等级检测、分级丢弃、通知）
+        非弹性模块：先进先发，溢出即丢，队列使用率 >= 85% 时启动倒计时
+        """
+        msg_size = len(raw)
+        current_bytes = self._queue_bytes.get(module_id, 0)
+        is_elastic = self._module_elastic.get(module_id, False)
+
+        if is_elastic:
+            # ── 弹性模块：完整压力管理路径 ──
+            # 检查字节限制
+            if current_bytes + msg_size > QUEUE_MAX_BYTES:
+                if self._should_drop(module_id, event_type, droppable, priority):
+                    self._cnt_dropped += 1
+                    self._queue_overflow[module_id] = self._queue_overflow.get(module_id, 0) + 1
+                    overflow_count = self._queue_overflow[module_id]
+                    if overflow_count % 100 == 1:
+                        print(f"[kernel] Bytes overflow for {module_id}: {overflow_count} events dropped")
+                    return
+
+            # 检查压力等级（等级变化时自动发送通知）
+            self._check_pressure(module_id, queue)
+
+            # 压力过滤：根据等级决定是否丢弃
+            if self._should_drop(module_id, event_type, droppable, priority):
+                self._cnt_dropped += 1
+                self._queue_overflow[module_id] = self._queue_overflow.get(module_id, 0) + 1
+                overflow_count = self._queue_overflow[module_id]
+                if overflow_count % 100 == 1:
+                    level = self._queue_levels.get(module_id, "idle")
+                    print(f"[kernel] Pressure drop for {module_id} [{level}]: {overflow_count} events dropped")
+                return
+
+            # 正常入队
+            try:
+                queue.put_nowait(raw)
+                self._cnt_queued += 1
+                self._queue_bytes[module_id] = current_bytes + msg_size
+            except asyncio.QueueFull:
+                self._cnt_dropped += 1
+                self._queue_overflow[module_id] = self._queue_overflow.get(module_id, 0) + 1
+                overflow_count = self._queue_overflow[module_id]
+                if overflow_count % 100 == 1:
+                    print(f"[kernel] Queue full for {module_id}, dropped {overflow_count} events")
+        else:
+            # ── 非弹性模块：极简路径（先进先发，溢出即丢） ──
+            try:
+                queue.put_nowait(raw)
+                self._cnt_queued += 1
+                self._queue_bytes[module_id] = current_bytes + msg_size
+            except asyncio.QueueFull:
+                self._cnt_dropped += 1
+                self._queue_overflow[module_id] = self._queue_overflow.get(module_id, 0) + 1
+                overflow_count = self._queue_overflow[module_id]
+                if overflow_count % 100 == 1:
+                    print(f"[kernel] Queue full for {module_id} (non-elastic), dropped {overflow_count} events")
+
+            # 检查队列使用率，>= 85% 时启动倒计时
+            count_usage = queue.qsize() / QUEUE_MAXSIZE
+            bytes_usage = self._queue_bytes.get(module_id, 0) / QUEUE_MAX_BYTES
+            usage = max(count_usage, bytes_usage)
+            if usage >= 0.85:
+                self._start_critical_countdown(module_id)
+
     # ── Stats ──
 
     def _counters_dict(self) -> dict:
@@ -366,6 +1345,8 @@ class EventHub:
             "events_routed": self._cnt_routed,
             "events_queued": self._cnt_queued,
             "events_deduplicated": self._cnt_dedup,
+            "events_dropped": self._cnt_dropped,
+            "events_throttled": self._cnt_throttled,
             "errors": self._cnt_errors,
         }
 
@@ -377,17 +1358,84 @@ class EventHub:
                 for mid, patterns in self.subscriptions.items()
             },
             "counters": self._counters_dict(),
+            "queue_pressure": self._get_pressure_stats(),
+        }
+
+    def _get_pressure_stats(self) -> dict:
+        """返回每个模块的队列压力信息"""
+        result = {}
+        for mid, queue in self._queues.items():
+            qsize = queue.qsize()
+            result[mid] = {
+                "level": self._queue_levels.get(mid, "idle"),
+                "queue_size": qsize,
+                "usage_percent": round(qsize / QUEUE_MAXSIZE * 100, 1),
+                "elastic": self._module_elastic.get(mid, False),
+                "overflow_count": self._queue_overflow.get(mid, 0),
+            }
+        return result
+
+    def get_event_info(self, event_pattern: str) -> dict:
+        """获取事件的详细信息，包括订阅者和统计数据。
+
+        Args:
+            event_pattern: 事件模式（如 "module.started" 或 "module.*"）
+
+        Returns:
+            {
+                "subscribers": [module_id],  # 订阅此事件的模块列表
+                "stats": {
+                    "count": int,           # 发布次数
+                    "last_time": float,     # 最后发布时间戳
+                    "last_source": str      # 最后发布者
+                }
+            }
+        """
+        from .router import match_parts
+
+        # 查找订阅此事件的模块
+        subscribers = []
+        pattern_tuple = tuple(event_pattern.split("."))
+
+        for module_id, patterns in self.subscriptions.items():
+            for pattern_str, pattern_parts in patterns:
+                # 检查模式是否匹配事件
+                if match_parts(pattern_tuple, pattern_parts):
+                    subscribers.append(module_id)
+                    break
+
+        # 获取统计信息
+        stats = self._event_stats.get(event_pattern, {
+            "count": 0,
+            "last_time": None,
+            "last_source": None
+        })
+
+        return {
+            "subscribers": sorted(subscribers),
+            "stats": stats
         }
 
+
     def get_health(self) -> dict:
+        # 如果有模块处于 overload 或 critical，整体状态为 degraded
+        pressure_levels = {self._queue_levels.get(mid, "idle") for mid in self._queues}
+        if "critical" in pressure_levels:
+            status = "degraded"
+        elif "overload" in pressure_levels:
+            status = "degraded"
+        else:
+            status = "healthy"
+
         return {
-            "status": "healthy",
+            "status": status,
             "details": {
-                "connections": len(self.connections),
+                "connections": sum(len(s) for s in self.connections.values()),
                 "subscriptions": sum(
                     len(p) for p in self.subscriptions.values()
                 ),
                 "events_routed": self._cnt_routed,
+                "events_dropped": self._cnt_dropped,
                 "dedup_size": self.dedup.size,
                 "uptime_seconds": round(time.time() - self._start_time),
             },