@alipay/alipay-aipay 1.6.2-beta → 1.6.2-beta3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alipay/alipay-aipay",
-  "version": "1.6.2-beta",
+  "version": "1.6.2-beta3",
   "description": "支付宝 AI 付 Skill 安装包 - 优先安装 Agent Skill，并在 macOS/Linux 后台准备用户级 CLI 工具",
   "type": "module",
   "bin": {

package/skill/SKILL.md

@@ -5,27 +5,23 @@ description: >-
   触发关键词："AI支付"、"接支付宝"、"一站式接支付宝"、"接个支付"、"开发支付"、"402收款"、"AI按量付费"、"AI网页应用收款"、"AI移动应用收款"、"按量付费"、"快捷收款"、"快捷收单"、"网站支付"、"APP 支付"、"产品开通"、"商家开通"、"签约入驻"等。
 ---
 
-# 支付宝 AI 付 Skill 启动器
+本文件只负责在加载业务规则前确定本轮实际使用的 Skill 版本。禁止在完成下列启动协议前读取 `references/runtime-entry.md`、flow、模块、消息目录或业务脚本。
 
-本文件只负责在加载业务规则前确定本轮实际使用的 Skill 版本。禁止在完成下列启动协议前读取 `references/runtime-entry.md`、任一 flow、模块、消息目录或业务脚本。
-
-## 前置版本检查
-
-本次 Agent 对话首次使用 `alipay-aipay` 时，先把本文件所在目录解析为规范化绝对路径 `<SKILL_DIR>`，记录一次性事实 `ALIPAY_AIPAY_SELF_UPDATE_CHECKED=true`，再执行以下单条命令。`<SKILL_DIR>` 是执行时替换的路径占位符；禁止用 shell 变量赋值、命令替换或依赖特定 shell：
+首次使用 `alipay-aipay`：解析本文件目录为规范化绝对 `<SKILL_DIR>`，记录 `ALIPAY_AIPAY_SELF_UPDATE_CHECKED=true`，执行单命令；`<SKILL_DIR>` 是占位符，禁止用 shell 变量赋值、命令替换或依赖特定 shell：
 
 ```text
 node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" self-update check --skill-dir "<SKILL_DIR>"
 ```
 
-`SKILL_DIR` 必须绑定刚触发且正在执行本命令的 Skill 规范化绝对路径，不得换成 Agent 启动目录、用户项目目录、用户 Home、npm 包源码根或另一份 Skill 副本。`VERSION` 缺失/非法或 `references/runtime-entry.md` 缺失时由本命令尝试精确修复；命令失败或 marker 无法唯一解析时按 `SELF_UPDATE:CHECK_FAILED`。
+`SKILL_DIR` 只绑定当前 Skill，禁止换成 Agent 启动目录、用户项目、Home、npm 源码根或其他副本。`VERSION` 缺失/非法或入口缺失由命令修复；失败或 marker 不唯一按 `SELF_UPDATE:CHECK_FAILED`。
 
-stderr 只允许出现以下一个内部终态；不得向用户展示 marker 或 npm/npx 原始输出：
+stderr 只允许一个内部终态，禁止展示 marker 或 npm/npx 原始输出：
 
-- `SELF_UPDATE:UPDATED=<合法 SemVer>`：当前 Skill 目录已原子切换到新版。
+- `SELF_UPDATE:UPDATED=<合法 SemVer>`：已切换新版。
 - `SELF_UPDATE:CURRENT=<合法 SemVer>`：继续当前版本。
-- `SELF_UPDATE:RETRY_WITH_NETWORK`：registry 或安装阶段网络不可达；可申请联网后原样重试本命令一次。
-- `SELF_UPDATE:SKIPPED_NETWORK_RESTRICTED|CHECK_FAILED|INSTALL_FAILED|VERIFY_FAILED`：静默继续当前可用版本，不重试、不申请权限。
+- `SELF_UPDATE:RETRY_WITH_NETWORK`：可取权后原样重试一次。
+- `SELF_UPDATE:SKIPPED_NETWORK_RESTRICTED|CHECK_FAILED|INSTALL_FAILED|VERIFY_FAILED`：继续当前可用版本。
 
-除 `RETRY_WITH_NETWORK` 的一次原样重试外，只完整读取同一 `SKILL_DIR` 的 `references/runtime-entry.md`，在当前上下文记录 `ALIPAY_AIPAY_RUNTIME_ENTRY_LOADED=true` 和规范化路径，再按原请求路由。`UPDATED` 后先废弃旧 loaded 事实，禁止继续读取更新前版本的任何业务文档；其他终态同样不再读取本启动器或 `self-update.md` 补充规则。
+除 `RETRY_WITH_NETWORK` 外，只完整读取同一 `SKILL_DIR` 的 `references/runtime-entry.md`，记录 `ALIPAY_AIPAY_RUNTIME_ENTRY_LOADED=true` 和路径，再路由。`UPDATED` 后废弃旧 loaded 事实，禁止继续读取更新前版本的任何业务文档；其他终态同样不再读取本启动器或 `self-update.md` 补充规则。
 
-同一对话后续确认、补材料、候选选择、恢复、中断继续、重复触发和 Full Process 衔接，两项事实存在、路径未变且入口规则仍在时，跳过版本检查和入口重读。仅 `UPDATED`、路径变化或上下文压缩导致规则不可用时重读并刷新；事实不落盘。
+同一对话后续确认、补材料、候选、恢复、中断继续、重复触发和 Full Process 衔接，两项事实存在且路径未变时跳过版本检查和入口重读；仅 `UPDATED`、路径变化或上下文压缩导致规则不可用时重读并刷新；事实不落盘。

package/skill/VERSION

@@ -1 +1 @@
-1.6.2-beta
+1.6.2-beta3

package/skill/references/integration/flow.md

@@ -203,7 +203,7 @@ runner 失败时不得展示手写方案或进入步骤 3。成功时必须取
 
 - `full_process`：`../normal/full-process-routing.md` 已使用同一个 `integration.start.confirm`，在同一方案中绑定检查器产生的项目来源、代码状态和其他产品，以及产品、项目路径、语言/框架和服务声明；消息送达后已经直接进入本步骤，禁止再次渲染或要求确认。该消息不展示步骤清单，也不缩减执行范围；后续仍必须按当前产品完成本 flow 的全部适用接口、完成条件和 checklist。用户中断后若项目、产品、语言或框架发生变化，返回完整接入 router 重新澄清和扫描，再输出一条当前方案并继续。该方案仍禁止提前展示 MCC、授权范围、产品开通材料或 onboarding 待办。
 
-方案送达后只通过上述 development loader 进入步骤 3；loader 仍在原位置记录兼容 stage `integration.user_confirmed` 和 `integration.pre_dev_reading.start`。前者表示已基于完整确定事实自动进入执行，不表示收到额外确认回复；不得另行执行 telemetry 命令或伪造用户回复。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。
+方案送达后只通过上述 development loader 进入步骤 3；loader 仍在原位置记录兼容 stage `integration.user_confirmed` 和 `integration.pre_dev_reading.start`。前者表示已基于完整确定事实自动进入执行并自动标记计数 flow start，不表示收到额外确认回复；不得另行执行 telemetry 命令或伪造用户回复。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。
 
 **方案后的上下文锁定**：已有项目保持步骤 1 前已经唯一解析的实际根目录和原有工程结构；新项目必须已经在步骤 1 前按用户明确选择的方式完成初始化并通过构建标识检查。此处不重复准备、初始化或探测项目。路径内容与步骤 1 成功时不一致则停止并重新澄清；只有目标项目或服务端语言变化时返回步骤 1，其他情况直接进入步骤 3。
 
@@ -554,20 +554,22 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message saf
 
 <!-- ALIPAY_AIPAY_PRODUCT:aipay:START -->
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant AIPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-result "$SANDBOX_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER" --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant AIPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-result "$SANDBOX_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 <!-- ALIPAY_AIPAY_PRODUCT:webpay:START -->
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant WEBPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --webpay-experience-result "$WEBPAY_EXPERIENCE_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER" --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant WEBPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --webpay-experience-result "$WEBPAY_EXPERIENCE_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 <!-- ALIPAY_AIPAY_PRODUCT:apppay:START -->
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant APPPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER" --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant APPPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 
+用户输入计数默认由 telemetry run state 派生。只有本地计数状态不可用且已重新核对时，才在 checklist 命令末尾同时追加 `--user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>`；runner 会拒绝明显不合理计数。
+
 同一次代码开发流程只渲染一次最终 checklist 结果；renderer stdout 是本次默认收口的唯一对客正文，禁止在前后追加风险说明、通过项摘要、执行说明、衔接提醒或第二份待办。
 
 这些产品专属字段只用于 renderer 校验最终结论，不在 checklist 对客结果中重复展示。APP 支付未来沙箱测试对客引导的维护 TODO 只保留在消息目录对应变体，不得渲染给用户；补充时必须同步本 flow、`modules/checklist.md` 和测试。

package/skill/references/normal/scripts/flow_loader.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 
 import { checklistForProduct } from './checklist_sections.mjs';
 import { createChecklistScopeReceipt } from './integration_message_runner.mjs';
-import { emitStageMetricAsync } from './telemetry.mjs';
+import { emitStageMetricAsync, markTelemetryFlowStart } from './telemetry.mjs';
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const referencesDir = path.resolve(scriptDir, '../..');
@@ -239,6 +239,9 @@ export function runFlowCli(argv = process.argv) {
   const phaseBlock = extractFlowBlock(source, phaseBlockName(flow, phase));
   for (const stage of stageDeclarations(phaseBlock, productType)) {
     emitStageMetricAsync(stage, { productType });
+    if (stage === 'integration.user_confirmed' || stage === 'onboarding.user_confirmed') {
+      markTelemetryFlowStart();
+    }
   }
   process.stdout.write(`${loadFlowBundle(flow, phase, { productType })}\n`);
 }

package/skill/references/normal/scripts/integration_message_runner.mjs

@@ -1357,7 +1357,11 @@ async function runChecklistResult(args) {
   }
   const rendered = renderMessage('integration.checklist.result', variant, input);
   if (input.executionMode === '仅代码开发') {
-    emitTerminalMetric({ rootIntent: 'integration_only', productType: variant, ...terminalMetricContextFromArgs(args) });
+    emitTerminalMetric({
+      rootIntent: 'integration_only',
+      productType: variant,
+      ...terminalMetricContextFromArgs(args, { rootIntent: 'integration_only' })
+    });
   }
   return rendered;
 }

package/skill/references/normal/scripts/onboarding_message_runner.mjs

@@ -751,7 +751,11 @@ function closeoutInputFromArgs(args) {
 async function runCloseout(args) {
   const variables = closeoutInputFromArgs(args);
   const rendered = renderMessage('process.partial_result', 'DEFAULT', variables);
-  emitTerminalMetric({ productName: variables.productName, ...terminalMetricContextFromArgs(args) });
+  emitTerminalMetric({
+    productName: variables.productName,
+    rootIntent: args['root-intent'],
+    ...terminalMetricContextFromArgs(args, { rootIntent: args['root-intent'] })
+  });
   return rendered;
 }
 

package/skill/references/normal/scripts/telemetry.mjs

@@ -18,12 +18,35 @@ const syncLogCode = '1005';
 const syncLogMsg = 'alipay_aipay_skill_event';
 const syncLogYuyanID = '180020010001290755';
 const uploadTimeoutMs = 2500;
+const terminalForegroundUploadTimeoutMs = 1200;
+const terminalForegroundUploadMaxAttempts = 2;
+const terminalForegroundUploadRetryDelayMs = 300;
+const terminalBackgroundRetryDelayMs = 1000;
+const terminalCountArgNames = Object.freeze([
+  'user-input-count-total',
+  'user-input-count-after-flow-start',
+  'flow-start-observed'
+]);
 const outboxFlushLimit = 50;
 const outboxClaimTtlMs = 5 * 60 * 1000;
 const outboxMaxRecords = 1000;
 const outboxMaxAgeMs = 7 * 24 * 60 * 60 * 1000;
 const permissionedFlushTtlMs = 12 * 60 * 60 * 1000;
 const platformProjectIdEnvKeys = Object.freeze(['COZE_PROJECT_ID', 'MEOO_PROJECT_ID']);
+const sessionStateEnvKeys = Object.freeze([
+  'CODEX_THREAD_ID',
+  'CODEX_SESSION_ID',
+  'CLAUDE_CODE_SESSION_ID',
+  'OPENCLAW_SESSION_ID',
+  'CURSOR_SESSION_ID',
+  'CURSOR_TRACE_ID',
+  'COZE_SESSION_ID',
+  'COZE_CONVERSATION_ID',
+  'HERMES_SESSION_ID',
+  'OPENAI_CONVERSATION_ID',
+  'SESSION_ID',
+  'CI_JOB_ID'
+]);
 const permissionedFlushNetworkErrors = new Set([
   'ENOTFOUND',
   'EAI_AGAIN',
@@ -119,6 +142,14 @@ function safeDimension(value, fallback = 'unknown', maxLength = 80) {
   return trimmed.slice(0, maxLength);
 }
 
+function failedResult(error, code = 'REQUEST_ERROR', message = 'request error') {
+  return {
+    ok: false,
+    error_code: safeDimension(error?.code || error?.name || code, code, 80),
+    error_message: safeDimension(error?.message || message, message, 240)
+  };
+}
+
 function normalizeSwitch(value) {
   return String(value || '').trim().toLowerCase();
 }
@@ -161,28 +192,20 @@ function isMaintenanceProcess(env = process.env, argv = process.argv) {
   return argv.some((arg) => /(^|[/\\])test[/\\].+\.test\.mjs$/u.test(String(arg || '')));
 }
 
-function stableStateKey(env = process.env) {
-  const source =
-    env.ALIPAY_AIPAY_SESSION_ID ||
-    platformProjectRunId(env) ||
-    env.CODEX_THREAD_ID ||
-    env.CODEX_SESSION_ID ||
-    env.CLAUDE_CODE_SESSION_ID ||
-    env.OPENCLAW_SESSION_ID ||
-    env.CURSOR_SESSION_ID ||
-    env.CURSOR_TRACE_ID ||
-    env.COZE_SESSION_ID ||
-    env.COZE_CONVERSATION_ID ||
-    env.HERMES_SESSION_ID ||
-    env.OPENAI_CONVERSATION_ID ||
-    env.SESSION_ID ||
-    env.CI_JOB_ID ||
-    '';
+function stableStateSource(env = process.env) {
+  return env.ALIPAY_AIPAY_SESSION_ID || platformProjectRunId(env) || sessionStateEnvKeys.map((key) => env[key]).find(Boolean) || '';
+}
+
+function stateKeyFromSource(source) {
   if (!source) return 'default';
   if (safeText(source) && source.length <= 128) return source;
   return `key-${crypto.createHash('sha256').update(source).digest('hex')}`;
 }
 
+function stableStateKey(env = process.env) {
+  return stateKeyFromSource(stableStateSource(env));
+}
+
 function stateDir(env = process.env) {
   if (env.ALIPAY_AIPAY_TELEMETRY_DIR) return env.ALIPAY_AIPAY_TELEMETRY_DIR;
   return telemetryRoot();
@@ -207,7 +230,8 @@ function permissionedFlushStatePath(env = process.env) {
   if (env.ALIPAY_AIPAY_TELEMETRY_PERMISSIONED_FLUSH_STATE_FILE) {
     return env.ALIPAY_AIPAY_TELEMETRY_PERMISSIONED_FLUSH_STATE_FILE;
   }
-  return path.join(stateDir(env), `${stableStateKey(env)}.permissioned-flush.json`);
+  const source = stableStateSource(env) || (Object.keys(env).length > 0 ? readRunState(env)?.run_id : '') || '';
+  return path.join(stateDir(env), `${stateKeyFromSource(source)}.permissioned-flush.json`);
 }
 
 export function telemetryStoragePaths(env = process.env) {
@@ -224,8 +248,21 @@ function ensurePrivateDir(dir) {
   fs.mkdirSync(dir, { recursive: true, mode: 0o700 });
   try {
     fs.chmodSync(dir, 0o700);
+  } catch {}
+}
+
+function writePrivateJson(file, value) {
+  try {
+    ensurePrivateDir(path.dirname(file));
+    const tempPath = path.join(path.dirname(file), `.${path.basename(file)}.${process.pid}.tmp`);
+    fs.writeFileSync(tempPath, `${JSON.stringify(value)}\n`, { mode: 0o600 });
+    try {
+      fs.chmodSync(tempPath, 0o600);
+    } catch {}
+    fs.renameSync(tempPath, file);
+    return true;
   } catch {
-    // chmod is best-effort on Windows.
+    return false;
   }
 }
 
@@ -273,21 +310,7 @@ function recordLocalTelemetryFailure(errorCode, message, env = process.env) {
 }
 
 function writeRunState(state, env = process.env) {
-  try {
-    const statePath = runStatePath(env);
-    ensurePrivateDir(path.dirname(statePath));
-    const tempPath = path.join(path.dirname(statePath), `.${path.basename(statePath)}.${process.pid}.tmp`);
-    fs.writeFileSync(tempPath, `${JSON.stringify(state)}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, statePath);
-    return true;
-  } catch {
-    return false;
-  }
+  return writePrivateJson(runStatePath(env), state);
 }
 
 function outboxFilename(event) {
@@ -296,36 +319,31 @@ function outboxFilename(event) {
   return `${timestamp}-${eventID}.json`;
 }
 
-export function enqueueMetricEvent(event, env = process.env) {
+function writeOutboxRecord(event, env = process.env) {
   try {
-    if (!event) return false;
+    if (!event) return '';
     const dir = outboxDir(env);
     ensurePrivateDir(dir);
     const filename = outboxFilename(event);
     const finalPath = path.join(dir, filename);
-    const tempPath = path.join(dir, `.${filename}.${process.pid}.tmp`);
-    const record = {
+    if (!writePrivateJson(finalPath, {
       schema_ver: 1,
       created_at: Date.now(),
       event
-    };
-    fs.writeFileSync(tempPath, `${JSON.stringify(record)}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, finalPath);
+    })) return '';
     pruneOutbox(env);
-    return true;
+    return finalPath;
   } catch {
-    return false;
+    return '';
   }
 }
 
+export function enqueueMetricEvent(event, env = process.env) {
+  return Boolean(writeOutboxRecord(event, env));
+}
+
 function safeRunId(value) {
   if (typeof value !== 'string' || !value.trim()) return '';
-  // Run IDs also participate in state keys and param4 matching, so keep them separator-free.
   return /[\u0000-\u001f\u007f,^=]/u.test(value) ? '' : value;
 }
 
@@ -382,6 +400,13 @@ function parseNonNegativeInteger(value) {
   return Number.isSafeInteger(parsed) ? parsed : null;
 }
 
+function sleepSync(ms) {
+  if (!Number.isFinite(ms) || ms <= 0) return;
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(ms, 30000));
+  } catch {}
+}
+
 function parseBooleanFlag(value) {
   if (typeof value === 'boolean') return value;
   if (typeof value !== 'string') return null;
@@ -391,23 +416,60 @@ function parseBooleanFlag(value) {
   return null;
 }
 
-function terminalExtInfoFromPayload(payload = {}, env = process.env) {
-  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return '';
+function normalizeUserInputCounts(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return { total: 0, after_flow_start: 0, flow_start_observed: false };
+  }
+  const total = parseNonNegativeInteger(value.total ?? value.user_input_count_total);
+  const afterFlowStart = parseNonNegativeInteger(value.after_flow_start ?? value.user_input_count_after_flow_start);
+  const flowStartObserved = parseBooleanFlag(value.flow_start_observed);
+  if (total === null || afterFlowStart === null || flowStartObserved === null) {
+    return { total: 0, after_flow_start: 0, flow_start_observed: false };
+  }
+  return {
+    total,
+    after_flow_start: Math.min(afterFlowStart, total),
+    flow_start_observed: flowStartObserved,
+    flow_start_observed_at: parseNonNegativeInteger(value.flow_start_observed_at) || undefined,
+    updated_at: parseNonNegativeInteger(value.updated_at) || undefined
+  };
+}
+
+function validateTerminalCountPayload(payload = {}, env = process.env, { strict = false } = {}) {
+  const fail = (message) => {
+    if (strict) throw new Error(message);
+    return null;
+  };
   const total = parseNonNegativeInteger(payload.userInputCountTotal ?? payload.user_input_count_total);
   const afterFlowStart = parseNonNegativeInteger(
     payload.userInputCountAfterFlowStart ?? payload.user_input_count_after_flow_start
   );
   const flowStartObserved = parseBooleanFlag(payload.flowStartObserved ?? payload.flow_start_observed);
   const rootIntent = rootIntentFrom(payload, env);
-  if (total === null || afterFlowStart === null || flowStartObserved === null) return '';
-  if (!rootIntent) return '';
-  if (afterFlowStart > total) return '';
-  if (!flowStartObserved && afterFlowStart !== 0) return '';
+  if (total === null || afterFlowStart === null || flowStartObserved === null) {
+    return fail('终态用户输入计数必须是合法非负整数，flow-start-observed 必须是 true/false');
+  }
+  if (total < 1) return fail('终态 user_input_count_total 必须至少包含触发当前 run 的用户输入');
+  if (!rootIntent) return fail('终态用户输入计数缺少合法 root_intent');
+  if (afterFlowStart > total) return fail('终态 user_input_count_after_flow_start 不能大于 user_input_count_total');
+  if (flowStartObserved && afterFlowStart >= total) {
+    return fail('终态 flow start 已观测时，after-flow 用户输入数必须小于 total；请重新核对 before-flow/after-flow 分界');
+  }
+  if (!flowStartObserved && afterFlowStart !== 0) {
+    return fail('终态 flow start 未观测时，after-flow 用户输入数必须为 0');
+  }
+  return { total, afterFlowStart, flowStartObserved, rootIntent };
+}
+
+function terminalExtInfoFromPayload(payload = {}, env = process.env) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return '';
+  const counts = validateTerminalCountPayload(payload, env);
+  if (!counts) return '';
   return JSON.stringify({
-    user_input_count_total: total,
-    user_input_count_after_flow_start: afterFlowStart,
-    flow_start_observed: flowStartObserved,
-    root_intent: rootIntent
+    user_input_count_total: counts.total,
+    user_input_count_after_flow_start: counts.afterFlowStart,
+    flow_start_observed: counts.flowStartObserved,
+    root_intent: counts.rootIntent
   });
 }
 
@@ -441,6 +503,7 @@ export function stageMetricEvent(stage, context = {}, nowMs = Date.now(), env =
     schema_ver: 2,
     event_id: crypto.randomUUID(),
     skill: 'alipay-aipay',
+    skill_version: skillVersionFromDisk(),
     run_id: runId,
     stage: rule.stage,
     timestamp: nowMs,
@@ -564,15 +627,41 @@ function parseCliArgs(argv) {
   return { command, args };
 }
 
-export function terminalMetricContextFromArgs(args) {
+export function terminalMetricContextFromArgs(args, context = {}) {
   const optional = (name) => {
     const value = args[name];
     return typeof value === 'string' && value.length > 0 ? value : undefined;
   };
+  const hasCountArg = terminalCountArgNames.some((name) => Object.prototype.hasOwnProperty.call(args, name));
+  if (hasCountArg) {
+    const missing = terminalCountArgNames.filter((name) => optional(name) === undefined);
+    if (missing.length > 0) throw new Error(`终态用户输入计数参数必须同时提供，缺少 --${missing[0]}`);
+    const counts = validateTerminalCountPayload({
+      userInputCountTotal: optional('user-input-count-total'),
+      userInputCountAfterFlowStart: optional('user-input-count-after-flow-start'),
+      flowStartObserved: optional('flow-start-observed'),
+      rootIntent: args['root-intent'] || args.rootIntent || args.root_intent || context.rootIntent || context.root_intent
+    }, process.env, { strict: true });
+    return {
+      userInputCountTotal: counts.total,
+      userInputCountAfterFlowStart: counts.afterFlowStart,
+      flowStartObserved: counts.flowStartObserved
+    };
+  }
+  const state = readRunState(process.env);
+  const stored = normalizeUserInputCounts(state?.user_input_counts);
+  if (stored.total < 1) return {};
+  const counts = validateTerminalCountPayload({
+    userInputCountTotal: stored.total,
+    userInputCountAfterFlowStart: stored.after_flow_start,
+    flowStartObserved: stored.flow_start_observed,
+    rootIntent: state?.root_intent
+  }, process.env);
+  if (!counts) return {};
   return {
-    userInputCountTotal: optional('user-input-count-total'),
-    userInputCountAfterFlowStart: optional('user-input-count-after-flow-start'),
-    flowStartObserved: optional('flow-start-observed')
+    userInputCountTotal: counts.total,
+    userInputCountAfterFlowStart: counts.afterFlowStart,
+    flowStartObserved: counts.flowStartObserved
   };
 }
 
@@ -661,9 +750,26 @@ function createOrReuseRunState(args, env = process.env, nowMs = Date.now()) {
   return createRunState(args, env, nowMs);
 }
 
+function flowStartStage(stage) {
+  return stage === 'integration.user_confirmed' || stage === 'onboarding.user_confirmed';
+}
+
+function withFlowStartObserved(state, nowMs = Date.now()) {
+  const counts = normalizeUserInputCounts(state.user_input_counts);
+  return {
+    ...state,
+    user_input_counts: {
+      ...counts,
+      flow_start_observed: true,
+      flow_start_observed_at: counts.flow_start_observed_at || nowMs,
+      updated_at: nowMs
+    }
+  };
+}
+
 function updateRunStateFromEvent(event, env = process.env) {
   const existing = readRunState(env) || {};
-  const next = {
+  let next = {
     ...existing,
     schema_ver: 1,
     run_id: event.run_id,
@@ -672,6 +778,9 @@ function updateRunStateFromEvent(event, env = process.env) {
     created_at: existing.created_at || Date.now(),
     updated_at: Date.now()
   };
+  if (flowStartStage(event.stage)) {
+    next = withFlowStartObserved(next, Number.isFinite(Number(event.timestamp)) ? Number(event.timestamp) : Date.now());
+  }
   if (event.stage === 'run.terminal') {
     next.terminal = true;
     next.terminal_at = Number.isFinite(Number(event.timestamp)) ? Number(event.timestamp) : Date.now();
@@ -682,6 +791,46 @@ function updateRunStateFromEvent(event, env = process.env) {
   writeRunState(next, env);
 }
 
+export function markTelemetryFlowStart(env = process.env, nowMs = Date.now()) {
+  if (!telemetryEnabled(env)) return null;
+  const existing = readRunState(env);
+  if (!existing?.run_id || existing.terminal) return null;
+  const next = withFlowStartObserved({
+    ...existing,
+    updated_at: nowMs
+  }, nowMs);
+  writeRunState(next, env);
+  return next.user_input_counts;
+}
+
+export function recordTelemetryUserInput(phase, env = process.env, nowMs = Date.now()) {
+  if (!telemetryEnabled(env)) return null;
+  if (!['before-flow', 'after-flow'].includes(phase)) {
+    throw new Error('--phase 仅支持 before-flow、after-flow');
+  }
+  const existing = readRunState(env);
+  if (!existing?.run_id || existing.terminal) return null;
+  const counts = normalizeUserInputCounts(existing.user_input_counts);
+  if (phase === 'before-flow' && counts.flow_start_observed) {
+    throw new Error('当前 run 已观测 flow start，后续用户输入必须记录为 after-flow');
+  }
+  const nextCounts = {
+    ...counts,
+    total: counts.total + 1,
+    after_flow_start: counts.after_flow_start + (phase === 'after-flow' ? 1 : 0),
+    flow_start_observed: counts.flow_start_observed || phase === 'after-flow',
+    updated_at: nowMs
+  };
+  if (phase === 'after-flow' && !counts.flow_start_observed) nextCounts.flow_start_observed_at = nowMs;
+  const next = {
+    ...existing,
+    user_input_counts: nextCounts,
+    updated_at: nowMs
+  };
+  writeRunState(next, env);
+  return nextCounts;
+}
+
 function updateExistingRunStateFromEvent(event, env = process.env) {
   const existing = readRunState(env);
   if (!existing) return false;
@@ -745,15 +894,20 @@ function modelFromEnv(env = process.env) {
 
 function skillVersionFromDisk() {
   try {
-    const raw = fs.readFileSync(path.join(skillRoot(), 'VERSION'), 'utf8').trim();
-    const match = raw.match(/^v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/);
-    if (match) return `v${match[1]}`;
-  } catch {
-    // fall through
-  }
+    return normalizeSkillVersion(fs.readFileSync(path.join(skillRoot(), 'VERSION'), 'utf8')) || 'unknown';
+  } catch {}
   return 'unknown';
 }
 
+function normalizeSkillVersion(value) {
+  const match = String(value || '').trim().match(/^v?(\d+\.\d+\.\d+(?:[-+][0-9A-Za-z.-]+)?)$/);
+  return match ? `v${match[1]}` : '';
+}
+
+function skillVersionFromEvent(event) {
+  return normalizeSkillVersion(event?.skill_version) || skillVersionFromDisk();
+}
+
 function isLocalSkillCheckout() {
   try {
     return fs.existsSync(path.join(skillRoot(), '../.git'));
@@ -792,15 +946,11 @@ function machineCodeRaw(env = process.env) {
       const match = output.match(/MachineGuid\s+REG_SZ\s+([^\s\r\n]+)/);
       if (match?.[1]) return match[1];
     }
-  } catch {
-    // fall through
-  }
+  } catch {}
   try {
     const hostname = os.hostname();
     if (hostname) return `hostname:${hostname}`;
-  } catch {
-    // fall through
-  }
+  } catch {}
   return '';
 }
 
@@ -811,7 +961,7 @@ function machineUserID(env = process.env) {
   return `machine_${hash}`;
 }
 
-function monitorEnv(env = process.env) {
+function monitorEnv(env = process.env, skillVersion = skillVersionFromDisk()) {
   switch (normalizeSwitch(env.AIPAY_BUILD_ENV)) {
     case 'dev':
       return 'DEV';
@@ -822,7 +972,6 @@ function monitorEnv(env = process.env) {
     default:
       break;
   }
-  const skillVersion = skillVersionFromDisk();
   if (/^v?\d+\.\d+\.\d+-/.test(skillVersion)) return 'PRE';
   if (skillVersion !== 'unknown' && !isLocalSkillCheckout()) return 'PROD';
   return 'DEV';
@@ -830,7 +979,7 @@ function monitorEnv(env = process.env) {
 
 export function buildSyncLogReport(event, env = process.env) {
   if (!event) return null;
-  const skillVersion = skillVersionFromDisk();
+  const skillVersion = skillVersionFromEvent(event);
   const item = {
     code: syncLogCode,
     msg: syncLogMsg,
@@ -848,7 +997,7 @@ export function buildSyncLogReport(event, env = process.env) {
   return {
     item,
     options: {
-      Env: monitorEnv(env),
+      Env: monitorEnv(env, skillVersion),
       SprintID: skillVersion,
       UserID: machineUserID(env),
       YuyanID: syncLogYuyanID
@@ -971,8 +1120,8 @@ export function sendSyncLogReportDetailed(report, { timeoutMs = uploadTimeoutMs
             status_code: statusCode || undefined,
             error_code: ok ? undefined : statusCode > 0 ? `HTTP_${statusCode}` : 'NO_HTTP_STATUS',
             error_message: ok ? undefined : statusCode > 0
-              ? `sync log endpoint returned ${statusCode}`
-              : 'sync log endpoint returned no HTTP status'
+              ? `http ${statusCode}`
+              : 'no http status'
           });
         });
       });
@@ -980,18 +1129,10 @@ export function sendSyncLogReportDetailed(report, { timeoutMs = uploadTimeoutMs
         finish({ ok: false, error_code: 'ETIMEDOUT', error_message: 'request timeout' });
         req.destroy();
       });
-      req.on('error', (error) => finish({
-        ok: false,
-        error_code: safeDimension(error?.code || error?.name || 'REQUEST_ERROR', 'REQUEST_ERROR', 80),
-        error_message: safeDimension(error?.message || 'request error', 'request error', 240)
-      }));
+      req.on('error', (error) => finish(failedResult(error)));
       req.end(body);
     } catch (error) {
-      finish({
-        ok: false,
-        error_code: safeDimension(error?.code || error?.name || 'REQUEST_ERROR', 'REQUEST_ERROR', 80),
-        error_message: safeDimension(error?.message || 'request error', 'request error', 240)
-      });
+      finish(failedResult(error));
     }
   });
 }
@@ -1001,14 +1142,25 @@ export async function sendSyncLogReport(report, { timeoutMs = uploadTimeoutMs }
   return result.ok;
 }
 
-function outboxFiles(env = process.env) {
+function outboxFiles(env = process.env, { targetFile = '', limit = 0 } = {}) {
   try {
     const dir = outboxDir(env);
     recoverStaleOutboxClaims(env);
     pruneOutbox(env);
-    return outboxRecordEntries(dir)
+    if (targetFile) {
+      const resolved = path.resolve(String(targetFile));
+      const basename = path.basename(resolved);
+      return path.dirname(resolved) === path.resolve(dir)
+        && basename.endsWith('.json')
+        && !basename.startsWith('.')
+        && fs.existsSync(resolved)
+        ? [resolved]
+        : [];
+    }
+    const files = outboxRecordEntries(dir)
       .sort((left, right) => left.name.localeCompare(right.name))
       .map((entry) => entry.file);
+    return limit > 0 ? files.slice(0, limit) : files;
   } catch {
     return [];
   }
@@ -1022,9 +1174,7 @@ function outboxRecordEntries(dir) {
       let mtimeMs = 0;
       try {
         mtimeMs = fs.statSync(file).mtimeMs;
-      } catch {
-        // The file may have been claimed or removed concurrently.
-      }
+      } catch {}
       return { file, name, mtimeMs };
     })
     .filter((entry) => entry.mtimeMs > 0);
@@ -1038,9 +1188,7 @@ function pruneOutbox(env = process.env, nowMs = Date.now()) {
       if (nowMs - entry.mtimeMs <= outboxMaxAgeMs) continue;
       try {
         fs.unlinkSync(entry.file);
-      } catch {
-        // A concurrent flush may have claimed it first.
-      }
+      } catch {}
     }
     entries = outboxRecordEntries(dir);
     const overflow = entries.length - outboxMaxRecords;
@@ -1051,13 +1199,9 @@ function pruneOutbox(env = process.env, nowMs = Date.now()) {
       .forEach((entry) => {
         try {
           fs.unlinkSync(entry.file);
-        } catch {
-          // Best-effort local retention cap.
-        }
+        } catch {}
       });
-  } catch {
-    // Pruning is best-effort and must not affect the customer flow.
-  }
+  } catch {}
 }
 
 function recoverStaleOutboxClaims(env = process.env, nowMs = Date.now()) {
@@ -1073,13 +1217,9 @@ function recoverStaleOutboxClaims(env = process.env, nowMs = Date.now()) {
       try {
         if (fs.existsSync(originalPath)) fs.unlinkSync(claimedPath);
         else fs.renameSync(claimedPath, originalPath);
-      } catch {
-        // Leave the claim for a later recovery attempt.
-      }
+      } catch {}
     }
-  } catch {
-    // Recovery is best-effort.
-  }
+  } catch {}
 }
 
 function claimOutboxFile(file) {
@@ -1103,6 +1243,17 @@ function releaseOutboxClaim(claimedPath) {
   }
 }
 
+function outboxTargetFilePending(file) {
+  try {
+    if (fs.existsSync(file)) return true;
+    const dir = path.dirname(file);
+    const prefix = `${path.basename(file)}.sending.`;
+    return fs.readdirSync(dir).some((name) => name.startsWith(prefix));
+  } catch {
+    return false;
+  }
+}
+
 function readOutboxRecord(file) {
   try {
     const record = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -1116,26 +1267,7 @@ function readOutboxRecord(file) {
 }
 
 function writeUploadStatus(status, env = process.env) {
-  try {
-    const statusPath = uploadStatusPath(env);
-    ensurePrivateDir(path.dirname(statusPath));
-    const next = {
-      schema_ver: 1,
-      updated_at: Date.now(),
-      ...status
-    };
-    const tempPath = path.join(path.dirname(statusPath), `.${path.basename(statusPath)}.${process.pid}.tmp`);
-    fs.writeFileSync(tempPath, `${JSON.stringify(next)}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, statusPath);
-    return true;
-  } catch {
-    return false;
-  }
+  return writePrivateJson(uploadStatusPath(env), { schema_ver: 1, updated_at: Date.now(), ...status });
 }
 
 function readUploadStatus(env = process.env) {
@@ -1161,21 +1293,7 @@ function readPermissionedFlushState(env = process.env, nowMs = Date.now()) {
 }
 
 function writePermissionedFlushState(state, env = process.env) {
-  try {
-    const statePath = permissionedFlushStatePath(env);
-    ensurePrivateDir(path.dirname(statePath));
-    const tempPath = path.join(path.dirname(statePath), `.${path.basename(statePath)}.${process.pid}.tmp`);
-    fs.writeFileSync(tempPath, `${JSON.stringify({ schema_ver: 1, ...state })}\n`, { mode: 0o600 });
-    try {
-      fs.chmodSync(tempPath, 0o600);
-    } catch {
-      // chmod is best-effort on Windows.
-    }
-    fs.renameSync(tempPath, statePath);
-    return true;
-  } catch {
-    return false;
-  }
+  return writePrivateJson(permissionedFlushStatePath(env), { schema_ver: 1, ...state });
 }
 
 function networkUploadFailure(status) {
@@ -1227,12 +1345,13 @@ export function permissionedFlushDecision(env = process.env, nowMs = Date.now(),
 
 export async function flushOutbox(env = process.env, {
   limit = outboxFlushLimit,
+  targetFile = '',
   timeoutMs = uploadTimeoutMs,
   sender = sendSyncLogReportDetailed
 } = {}) {
   const result = { attempted: 0, sent: 0, retained: 0, invalid: 0 };
   if (!telemetryUploadEnabled(env)) return result;
-  const files = outboxFiles(env).slice(0, Math.max(0, limit));
+  const files = outboxFiles(env, { targetFile, limit });
   for (const file of files) {
     const claimedFile = claimOutboxFile(file);
     if (!claimedFile) continue;
@@ -1241,9 +1360,7 @@ export async function flushOutbox(env = process.env, {
       result.invalid += 1;
       try {
         fs.unlinkSync(claimedFile);
-      } catch {
-        // best-effort cleanup.
-      }
+      } catch {}
       continue;
     }
     const report = record.report?.item && record.report?.options ? record.report : buildSyncLogReport(record.event, env);
@@ -1251,9 +1368,7 @@ export async function flushOutbox(env = process.env, {
       result.invalid += 1;
       try {
         fs.unlinkSync(claimedFile);
-      } catch {
-        // best-effort cleanup.
-      }
+      } catch {}
       continue;
     }
     result.attempted += 1;
@@ -1262,18 +1377,13 @@ export async function flushOutbox(env = process.env, {
       const rawSendResult = await sender(report, { timeoutMs });
       sendResult = typeof rawSendResult === 'boolean' ? { ok: rawSendResult } : rawSendResult;
     } catch (error) {
-      sendResult = {
-        ok: false,
-        error_code: safeDimension(error?.code || error?.name || 'SENDER_THROW', 'SENDER_THROW', 80),
-        error_message: safeDimension(error?.message || 'sender threw', 'sender threw', 240)
-      };
+      sendResult = failedResult(error, 'SENDER_THROW', 'sender threw');
     }
     if (sendResult?.ok) {
       result.sent += 1;
       try {
         fs.unlinkSync(claimedFile);
       } catch {
-        // If delete fails, keep the record for a later retry.
         result.retained += 1;
         releaseOutboxClaim(claimedFile);
       }
@@ -1303,22 +1413,24 @@ export async function flushOutbox(env = process.env, {
   return result;
 }
 
-function spawnOutboxFlush(env = process.env) {
+function spawnOutboxFlush(env = process.env, { delayMs = 0 } = {}) {
   if (!telemetryUploadEnabled(env)) return false;
   try {
+    const childEnv = {
+      ...env,
+      ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: env.ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS || String(uploadTimeoutMs)
+    };
+    if (delayMs > 0) childEnv.ALIPAY_AIPAY_TELEMETRY_FLUSH_DELAY_MS = String(Math.min(delayMs, 30000));
     const child = spawn(process.execPath, [scriptPath(), 'flush-outbox-worker'], {
       detached: true,
       stdio: 'ignore',
-      env: {
-        ...env,
-        ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: env.ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS || String(uploadTimeoutMs)
-      }
+      env: childEnv
     });
     child.on('error', (error) => {
       writeUploadStatus({
         status: 'spawn_failed',
         error_code: safeDimension(error?.code || error?.name || 'UPLOAD_SPAWN_FAILED', 'UPLOAD_SPAWN_FAILED', 80),
-        error_message: safeDimension(error?.message || 'failed to start background telemetry uploader', 'failed to start background telemetry uploader', 240)
+        error_message: safeDimension(error?.message || 'upload spawn failed', 'upload spawn failed', 240)
       }, env);
     });
     child.unref();
@@ -1327,18 +1439,59 @@ function spawnOutboxFlush(env = process.env) {
     writeUploadStatus({
       status: 'spawn_failed',
       error_code: 'UPLOAD_SPAWN_FAILED',
-      error_message: 'failed to start background telemetry uploader'
+      error_message: 'upload spawn failed'
     }, env);
     return false;
   }
 }
 
+function foregroundFlushTerminalOutboxFile(file, env = process.env) {
+  if (!telemetryUploadEnabled(env) || !file) return false;
+  const parsed = parseNonNegativeInteger(env.ALIPAY_AIPAY_TELEMETRY_TERMINAL_FLUSH_TIMEOUT_MS);
+  const timeoutMs = parsed && parsed > 0 ? Math.min(parsed, 30000) : terminalForegroundUploadTimeoutMs;
+  const parsedAttempts = parseNonNegativeInteger(env.ALIPAY_AIPAY_TELEMETRY_TERMINAL_FLUSH_ATTEMPTS);
+  const attempts = parsedAttempts && parsedAttempts > 0
+    ? Math.min(parsedAttempts, 3)
+    : terminalForegroundUploadMaxAttempts;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      execFileSync(process.execPath, [scriptPath(), 'flush-outbox-worker'], {
+        stdio: 'ignore',
+        timeout: timeoutMs + 800,
+        env: {
+          ...env,
+          ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: String(timeoutMs),
+          ALIPAY_AIPAY_TELEMETRY_FLUSH_TARGET_FILE: file
+        }
+      });
+    } catch (error) {
+      writeUploadStatus({
+        status: 'failed',
+        error_code: safeDimension(error?.code || error?.signal || error?.name || 'TERMINAL_FLUSH_FAILED', 'TERMINAL_FLUSH_FAILED', 80),
+        error_message: 'terminal flush failed'
+      }, env);
+    }
+    if (!outboxTargetFilePending(file)) return true;
+    const retryable = Boolean(networkUploadFailure(readUploadStatus(env)));
+    if (!retryable || attempt >= attempts) return false;
+    sleepSync(terminalForegroundUploadRetryDelayMs);
+  }
+  return !outboxTargetFilePending(file);
+}
+
 function scheduleSyncLogUpload(event, env = process.env) {
   if (!telemetryUploadEnabled(env)) return false;
-  if (!enqueueMetricEvent(event, env)) {
-    recordLocalTelemetryFailure('LOCAL_OUTBOX_WRITE_FAILED', 'failed to write local telemetry outbox', env);
+  const queuedFile = writeOutboxRecord(event, env);
+  if (!queuedFile) {
+    recordLocalTelemetryFailure('LOCAL_OUTBOX_WRITE_FAILED', 'outbox write failed', env);
     return false;
   }
+  if (event?.stage === 'run.terminal') {
+    if (!foregroundFlushTerminalOutboxFile(queuedFile, env)) {
+      spawnOutboxFlush(env, { delayMs: terminalBackgroundRetryDelayMs });
+    }
+    return true;
+  }
   return spawnOutboxFlush(env);
 }
 
@@ -1347,7 +1500,6 @@ function emitTelemetryError(error) {
     const message = safeDimension(error instanceof Error ? error.message : String(error), 'unknown', 240);
     process.stderr.write(`${internalPrefix}TELEMETRY_ERROR=${message}\n`);
   } catch {
-    // Telemetry must stay nonblocking.
   }
 }
 
@@ -1380,12 +1532,41 @@ export async function runTelemetryCli(argv = process.argv) {
       }
       return 0;
     }
+    if (command === 'count-user-input' && args._.length === 0) {
+      assertCliArgs(args, new Set(['phase']), 0);
+      const counts = recordTelemetryUserInput(args.phase, process.env, Date.now());
+      if (counts) {
+        process.stderr.write(`${internalPrefix}USER_INPUT_COUNT_STATE=${JSON.stringify(counts)}\n`);
+      } else {
+        process.stderr.write(`${internalPrefix}USER_INPUT_COUNT_STATE_MISSING=true\n`);
+      }
+      return 0;
+    }
+    if (command === 'mark-flow-start' && args._.length === 0) {
+      assertCliArgs(args, new Set(), 0);
+      const counts = markTelemetryFlowStart(process.env, Date.now());
+      if (counts) {
+        process.stderr.write(`${internalPrefix}USER_INPUT_FLOW_START_STATE=${JSON.stringify(counts)}\n`);
+      } else {
+        process.stderr.write(`${internalPrefix}USER_INPUT_FLOW_START_STATE_MISSING=true\n`);
+      }
+      return 0;
+    }
     if (command === 'upload-status' && args._.length === 0) {
       assertCliArgs(args, new Set(), 0);
       const status = readUploadStatus(process.env) || { schema_ver: 1, status: 'unknown' };
       process.stderr.write(`${internalPrefix}TELEMETRY_UPLOAD_STATUS=${JSON.stringify(status)}\n`);
       return 0;
     }
+    if (command === 'permissioned-flush-status' && args._.length === 0) {
+      assertCliArgs(args, new Set(), 0);
+      const decision = permissionedFlushDecision(process.env, Date.now(), { markRequested: false });
+      process.stderr.write(`${internalPrefix}PERMISSIONED_FLUSH_STATUS=${JSON.stringify(decision)}\n`);
+      if (decision.needed) {
+        process.stderr.write(`${internalPrefix}PERMISSIONED_FLUSH_CANDIDATE=true\n`);
+      }
+      return 0;
+    }
     if (command === 'permissioned-flush-needed' && args._.length === 0) {
       assertCliArgs(args, new Set(), 0);
       const decision = permissionedFlushDecision(process.env, Date.now(), { markRequested: true });
@@ -1405,7 +1586,12 @@ export async function runTelemetryCli(argv = process.argv) {
       assertCliArgs(args, new Set(), 0);
       if (!telemetryEnabled(process.env)) return 0;
       const timeout = Number(process.env.ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS || uploadTimeoutMs);
-      await flushOutbox(process.env, { timeoutMs: Number.isFinite(timeout) ? timeout : uploadTimeoutMs });
+      const delay = parseNonNegativeInteger(process.env.ALIPAY_AIPAY_TELEMETRY_FLUSH_DELAY_MS);
+      if (delay && delay > 0) sleepSync(Math.min(delay, 30000));
+      await flushOutbox(process.env, {
+        targetFile: process.env.ALIPAY_AIPAY_TELEMETRY_FLUSH_TARGET_FILE || '',
+        timeoutMs: Number.isFinite(timeout) ? timeout : uploadTimeoutMs
+      });
       return 0;
     }
     if (!telemetryEnabled(process.env)) return 0;

package/skill/references/normal/telemetry.md

@@ -1,5 +1,4 @@
-- stage/Yuyan 低敏维度以 `scripts/telemetry.mjs` 与测试白名单为准；只含阶段、产品、根意图、时间戳、版本、宿主/模型、匿名机器哈希、run_id、终态计数。禁密钥、账号密码、订单/交易号、截图/凭证、用户输入、路径/URL、响应、命令输出/堆栈原文。遥测失败不影响业务；内部行 `ALIPAY_AIPAY_INTERNAL:`。
-- `start-run` 创建/复用 `run_id`；脚本继承 `PLATFORM_ID=<run_id>`，Agent 不手写环境前缀或 MCP payload。outbox 在系统临时目录，collector 2xx 后才删；维护/测试/Benchmark 禁上传。
-- run 复用：`root_intent + product_type` 判定复用/新建；`UNKNOWN` 补全产品仍复用同一 `run_id`。仅换产品、换根意图或已有终态才重建；“重新开始/重新走流程/作废本轮流程”但组合未变仍复用。`COZE_PROJECT_ID`、`MEOO_PROJECT_ID`、`VITE_APP_ID`/`PLATFORM_ID` 优先作新 run ID。`current-run-id` 只查看，不新建 run。
-- 计数：`user_input_count_total` 从触发当前 `run_id` 的用户消息起；`user_input_count_after_flow_start` 从方案送达并进入正式执行后的下一条用户消息起（`integration_only/full_process=integration.user_confirmed`，`onboarding_only=onboarding.user_confirmed`）。产品/MCC 澄清或选择、项目/语言/框架补齐、项目候选和方案本身只计 total；`full_process` 不因 Onboarding 重置。`flow_start_observed` 表示正式 flow start；用户 kill 未终态不补报。终态只加三项计数参数，不新增业务确认点、stage 或独立上报。`c4=ext_info`，计数合法且有 `root_intent` 才写 JSON，否则省略。
-- 补传：`telemetry upload-status` 只读。最近失败为网络错误（含 `ENOTFOUND|EAI_AGAIN|ETIMEDOUT`）且 outbox 积压时，执行 `telemetry permissioned-flush-needed`；仅 `PERMISSIONED_FLUSH_NEEDED=true` 时可申请最小权限执行 `telemetry flush-outbox`：HTTPS POST `https://collect.alipay.com/yuyan/`（`collect.alipay.com:443`，路径 `/yuyan/`）。说明：`是否允许 Agent 上报 Skill 使用过程的统计信息？只含产品类别、时间、Skill 版本、匿名设备标识、人机交互次数等用于帮助改善用户体验的非敏感信息，不会采集包含源代码、用户输入内容等任何敏感信息。` 同一 Agent 会话只请求一次，状态键抑制 12h。`flush-outbox` 后台补传；拒绝、失败或非 2xx 保留 outbox。collector 结果非业务条件。无 `inspect-outbox`、`--confirm-reviewed`、`alipay-cli whoami` 兜底。
+- 测试白名单：stage/flow、产品、根意图、时间戳、Skill 版本、宿主/模型、匿名机器哈希、`run_id`、终态计数；禁密钥/账号密码/订单/交易号/截图/凭证/用户输入/路径/URL/响应/命令输出/堆栈原文；失败不影响业务，内部行 `ALIPAY_AIPAY_INTERNAL:`。
+- run：`start-run` 创建/复用 `run_id`，脚本继承 `PLATFORM_ID=<run_id>`；`root_intent + product_type` 判定复用/新建，`UNKNOWN` 补全产品仍复用同一 `run_id`；换产品/根意图/已终态/重新开始/重新走流程/作废本轮流程才新建。`COZE_PROJECT_ID`、`MEOO_PROJECT_ID`、`VITE_APP_ID`/`PLATFORM_ID` 优先；`current-run-id` 只查看，不新建 run。outbox 2xx 才删；维护/测试/Benchmark 禁上传。
+- 计数：每条用户输入到达当前 run 后立刻执行 `telemetry count-user-input --phase before-flow|after-flow` 写本地 run state，不联网；触发 run 的首条消息计 before-flow。`user_input_count_total` 自触发 run 用户消息起；`user_input_count_after_flow_start` 自方案送达并进入正式执行后的下一条用户消息起。产品/MCC 澄清或选择、项目/语言/框架补齐、项目候选和方案本身只计 total；`full_process` 不因 Onboarding 重置。`flow_start_observed`=正式 flow start，由 `integration.user_confirmed|onboarding.user_confirmed` 自动标记；用户 kill 未终态不补报。closeout 默认派生本地计数，状态不可用且已核对时才显式传三项；runner 拒绝缺项、负数、`after > total`、已观测 flow start 但 `after >= total`。终态只追加计数，不新增确认点、stage 或独立上报。`run.terminal` 入队后以短超时前台 drain，仅当前 terminal 文件，避免流程最后的 detached worker 被宿主回收；若文件仍在且是网络类错误，短重试一次并挂延迟后台补传，不申请额外权限；失败保留 outbox。`c4=ext_info`，计数合法且有 `root_intent` 才写 JSON。
+- 补传：不为权限探测新增网络事件；实际低敏上传就是自然探测，宿主已允许访问 collector 时不额外申请权限。`upload-status`/`permissioned-flush-status` 不联网、不消耗请求窗口；后者在最近 `ENOTFOUND|EAI_AGAIN|ETIMEDOUT`、outbox 积压、12h 未请求时出 `PERMISSIONED_FLUSH_CANDIDATE=true`，再执行 `permissioned-flush-needed` 预占；唯一 `PERMISSIONED_FLUSH_NEEDED=true` 时才申请。`flush-outbox` 后台补传：POST 到 `collect.alipay.com:443`，路径 `/yuyan/`。说明：`是否允许 Agent 上报 Skill 使用过程的统计信息？只含产品类别、时间、Skill 版本、匿名设备标识、人机交互次数等用于帮助改善用户体验的非敏感信息，不会采集包含源代码、用户输入内容等任何敏感信息。` 同一 Agent 会话只请求一次；无宿主标识时按当前 `run_id` 隔离 12h；拒绝/失败/非2xx留 outbox；collector 结果非业务条件；无 `inspect-outbox`、`--confirm-reviewed`、`alipay-cli whoami` 兜底。

package/skill/references/onboarding/flow.md

@@ -59,7 +59,7 @@ Step 1: 方案规划 → Step 2: 环境检查 → Step 3: 登录授权
 环境检查、产品/MCC 澄清或方案展示前先执行平台入口。`onboarding_only` 正常由 `onboarding-bootstrap --root-intent onboarding_only` 包含本动作和 entry 加载；仅原子 fallback 或 `full_process` 衔接时执行：
 
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message platform-entry --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message platform-entry
 ```
 
 - Windows：runner 从私有 run context 取 `run_id` 生成 `platform_id`，禁止 Agent 传入或拼接；消息渲染即终结 run，送达唯一 stdout 后停止 Onboarding；`full_process` 保留 Integration 结果。
@@ -68,7 +68,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message plat
 用户明确要用企业账号通过 Skill 开通时执行下列消息并停止 Onboarding；不得主动询问账号类型，也不得从 MCC、营业执照或“公司”等描述推断。
 
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message enterprise-unsupported --variant <ONBOARDING_ONLY|FULL_PROCESS> --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message enterprise-unsupported --variant <ONBOARDING_ONLY|FULL_PROCESS>
 ```
 
 `onboarding_only` 固定 `ONBOARDING_ONLY`，`full_process` 固定 `FULL_PROCESS`。原文送达最终 stdout 后停止，不执行 Step 6 或追加收口。
@@ -121,7 +121,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message mcc-
 
 `salesCode`、`scope` 和材料要求只取“产品映射”。方案只由 `mcc-resolve-plan` 或已有唯一 MCC 时的 `onboarding-message plan-confirm` 生成，须展示产品/scope、MCC、条件材料、企业账号边界及商家平台链接；名称、编码和资质由同一表事实交叉校验，`-` 固定显示“当前类目参考表未列出”。禁止补充模板外资格或审核规则。
 
-不得保留“先运行旧字符串搜索，无匹配后再临时让 Agent 猜”的两阶段流程，或重复询问已知信息。只有唯一事实通过机器校验、方案 marker 唯一且 stdout 已送达，才执行 `onboarding-execute-ready --product-type "$PRODUCT_TYPE"`；缺值、冲突或非唯一继续澄清。产品/MCC 变化时重新校验并渲染。execute loader 记录兼容 stage `onboarding.user_confirmed`，不代表新增用户回复，禁止手工上报。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。`full_process` 不在本阶段重置。
+不得保留“先运行旧字符串搜索，无匹配后再临时让 Agent 猜”的两阶段流程，或重复询问已知信息。只有唯一事实通过机器校验、方案 marker 唯一且 stdout 已送达，才执行 `onboarding-execute-ready --product-type "$PRODUCT_TYPE"`；缺值、冲突或非唯一继续澄清。产品/MCC 变化时重新校验并渲染。execute loader 记录兼容 stage `onboarding.user_confirmed` 并自动标记计数 flow start，不代表新增用户回复，禁止手工上报。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。`full_process` 不在本阶段重置。
 
 <!-- ALIPAY_AIPAY_FLOW:ONBOARDING_ENTRY:END -->
 
@@ -501,9 +501,11 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message appl
 `SIGNING_RESULT`、`SERVICE_RESULT`、`APPLICATION_RESULT` 和 `INTEGRATION_RESULT` 必须使用消息目录允许的状态枚举原文，禁止拼接 `appId`、公钥文件路径、错误码、截图证据或其他自由文本；支付宝公钥保存路径只允许在已取得唯一 `ALIPAY_PUBLIC_KEY_EXPORT_STATUS=EXPORTED` 和 `ALIPAY_PUBLIC_KEY_FILE` 时，通过 `APP_KEY_SAVE_PATH` 或 `APPLICATION_OPERATION_APP_KEY_SAVE_PATH` 独立传入结果 runner。这些证据不能污染分支结果枚举。
 
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message closeout --product-type "$PRODUCT_TYPE" --root-intent "$ROOT_INTENT" --signing-result "$SIGNING_RESULT" --application-result "$APPLICATION_RESULT" --remaining-actions "$REMAINING_ACTIONS" [--integration-result "$INTEGRATION_RESULT"] [--service-result "$SERVICE_RESULT"] [--sandbox-config-state "$SANDBOX_CONFIG_STATE"] [--manual-verification-items "$MANUAL_VERIFICATION_ITEMS"] [--application-operation-app-id "$APPLICATION_OPERATION_APP_ID" [--application-operation-next-action "$APPLICATION_OPERATION_NEXT_ACTION"] [--application-operation-app-key-save-path "$APPLICATION_OPERATION_APP_KEY_SAVE_PATH"]] --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message closeout --product-type "$PRODUCT_TYPE" --root-intent "$ROOT_INTENT" --signing-result "$SIGNING_RESULT" --application-result "$APPLICATION_RESULT" --remaining-actions "$REMAINING_ACTIONS" [--integration-result "$INTEGRATION_RESULT"] [--service-result "$SERVICE_RESULT"] [--sandbox-config-state "$SANDBOX_CONFIG_STATE"] [--manual-verification-items "$MANUAL_VERIFICATION_ITEMS"] [--application-operation-app-id "$APPLICATION_OPERATION_APP_ID" [--application-operation-next-action "$APPLICATION_OPERATION_NEXT_ACTION"] [--application-operation-app-key-save-path "$APPLICATION_OPERATION_APP_KEY_SAVE_PATH"]]
 ```
 
+用户输入计数默认由 telemetry run state 派生，不在 closeout 事后回溯。只有本地计数状态不可用且已重新核对时，才在 closeout 命令末尾同时追加 `--user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>`；runner 会拒绝明显不合理计数。
+
 runner 从 `PRODUCT_TYPE` 派生产品名，网站支付/APP 支付派生服务结果“无需处理”，从 `ROOT_INTENT` 派生代码开发栏和后续衔接；标题只按完成条件派生。`onboarding_only` 省略 `--integration-result`、`--sandbox-config-state` 和 `--manual-verification-items`。`full_process`：代码开发通过填“已完成”并传 `READY`；仅沙箱待配置且其余代码与安全检查通过填“部分完成，沙箱配置待完成”并传 `CREATE_PENDING|VERIFY_PENDING`；沙箱 `READY` 且只剩非阻塞人工待验证项时填“部分完成，人工待验证”，传 `READY`，把 checklist `manualItems` 原样作为 `MANUAL_VERIFICATION_ITEMS`，并在 `REMAINING_ACTIONS` 写明实际待办，禁止传“无”。runner 拒绝旧完整参数、stdin JSON、`--input-json`、可派生字段和空字符串伪值。renderer 校验结果与沙箱状态/人工待验证项一致，并派生恢复口令或人工待验证展示；不增加确认点。不得在 stdout 前后追加衔接提醒，不伪造本轮代码修改、沙箱创建或测试结果，也不重复进入 integration。
 
 若 `full_process` 最后一跳紧接应用创建、审核提交或复用，不再先输出 `application.operation.result` 再立刻 closeout；只记录同一 `APPLICATION_OPERATION_APP_ID`，runner 复用 `APPLICATION_RESULT`，非“需人工配置”还记录 `APPLICATION_OPERATION_NEXT_ACTION`；“需人工配置”的下一步由 runner 派生。若同一动作已成功导出支付宝公钥，同时传 `APPLICATION_OPERATION_APP_KEY_SAVE_PATH`，收口必须展示“当前 appId: xxx 对应的支付宝公钥保存在:xxx”；“需人工配置”禁止传该路径。已上线且无保存路径时不展开“应用分支结果”；已上线且有保存路径时只展开 appId、状态和路径；其他应用结果合并展示并保留完成态红线。`onboarding_only`、应用分支仍需用户补材料/确认，或应用操作结果不是紧邻 Step 6 收口时，仍按应用模块输出 `application.operation.result`。合并展示不得改写完成条件，待审核、待设置公钥或待人工配置仍不得表述为应用发布完成。

package/skill/references/runtime-entry.md

@@ -41,14 +41,14 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" render <messageId> --va
 | 意图 | 判定 | 入口 | 后续按需加载 |
 |---|---|---|---|
 | `integration_only` | 只要求代码开发、支付集成或集成排障，未同时要求产品开通 | 执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-bootstrap --root-intent integration_only` | 当前阶段、产品和语言的契约、示例与脚本 |
-| `onboarding_only` | 只要求签约、入驻或产品开通，未同时要求代码开发 | 执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-bootstrap --root-intent onboarding_only --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>` | 当前阶段的授权、查询或写分支模块 |
+| `onboarding_only` | 只要求签约、入驻或产品开通，未同时要求代码开发 | 执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-bootstrap --root-intent onboarding_only` | 当前阶段的授权、查询或写分支模块 |
 | `full_process` | 明确要求完整接入、一站式，或同一请求同时要求代码开发和产品开通 | `normal/full-process-routing.md` | 先 Integration，满足衔接条件后 Onboarding |
 
 `integration_only` 的 `integration-bootstrap` 只在同一 Node 进程串行执行 `telemetry start-run` 与 `flow integration entry`。`onboarding_only` 的 `onboarding-bootstrap` 只串行执行 `telemetry start-run`、`onboarding-message platform-entry` 与 `flow onboarding entry`。两者均为既有无业务写入动作，执行后不得重复原子命令。Windows 引导渲染即终结 run 并停止，`platform_id` 取本次 `run_id` 且禁止 Agent 传入；非 Windows 返回 entry 契约。`full_process` 不使用 `integration-bootstrap`；衔接 Onboarding 也不使用带 `start-run` 的 bootstrap，仍执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message platform-entry` 后按需加载 entry，避免重复 `run.intent_detected`。
 
 `full_process` 识别根意图后立即执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" telemetry start-run --root-intent full_process`；产品已唯一确定时追加 `--product-type <aipay|webpay|apppay>`。`integration_only` 和 `onboarding_only` 已由上表各自 bootstrap 包含同一次 `start-run`，不得重复执行本条 telemetry。命令创建/复用当前流程 `run_id`，并在遥测开启时记录 `run.intent_detected`：同一意图和产品继续复用，`UNKNOWN` 补全产品仍复用同一 `run_id`；明确换产品、换根意图或既有 run 已终态才重建。第三方平台项目 ID 仍优先固定为 `run_id`，不得被显式 run ID 或本地生成值覆盖。业务 stage 只由登记 runner/script 异步记录。
 
-遥测默认开启，`ALIPAY_AIPAY_TELEMETRY=0|false|off|no` 可关闭 `METRIC_EVENT`、outbox、上传和 flush；私有流程 run context 仍用于 `PLATFORM_ID` 和终态生命周期。落盘/网络/上传/flush 失败静默，不改变业务、消息或确认，stdout 为空且 stderr 内部行不对客。`integration_only` 由 checklist 终结；Onboarding 由 closeout 或登记的提前终止消息终结。Agent 按 `normal/telemetry.md` 维护本轮用户输入计数，并只在终态命令追加可选参数，不新增业务确认点或独立上报。after-flow 以方案后 `*.user_confirmed` 为起点；前置澄清和候选选择不计入。脚本始终以当前流程 `run_id` 为 `PLATFORM_ID`，Agent 不手写环境前缀或改 MCP payload；维护诊断、outbox、上传和 flush 细节只在 `normal/telemetry.md` 按需读取。
+遥测默认开启，`ALIPAY_AIPAY_TELEMETRY=0|false|off|no` 关闭事件/outbox/上传/flush；私有 run context 仍供 `PLATFORM_ID` 与终态生命周期。失败静默，不改变业务/消息/确认，stdout 空且 stderr 内部行不对客。`integration_only` 由 checklist 终结；Onboarding 由 closeout 或登记提前终止消息终结。上报权限不新增专门网络探针，首次 `start-run` 及后续 stage 的实际低敏上传就是自然探测；宿主已允许访问 collector 时不额外申请权限，仅 `normal/telemetry.md` 的不联网状态命令确认网络失败和 outbox 积压后，才允许一次补传权限申请。Agent 按 `normal/telemetry.md` 在每条用户输入到达时即时记录本轮计数：flow start 前执行 `telemetry count-user-input --phase before-flow`，`*.user_confirmed` 由 flow loader 自动标记起点，之后执行 `--phase after-flow`；closeout 默认从本地 run state 派生计数，状态不可用且已核对时才显式传三项计数参数，runner 拒绝缺项、负数、`after > total`、已观测 flow start 但 `after >= total` 等明显错误。不新增业务确认点或独立上报；入队后当前 `run.terminal` 文件做短超时前台 drain，失败仍保留 outbox 且不影响业务收口，网络类失败按维护文档短重试/后台兜底。after-flow 以方案后 `*.user_confirmed` 为起点；前置澄清和候选不计。脚本以当前 `run_id` 为 `PLATFORM_ID`，Agent 不手写环境前缀或改 MCP payload；维护诊断、outbox、上传和 flush 细节只在 `normal/telemetry.md` 按需读取。
 
 三种入口均只在无法从已有产品名称或业务描述可靠确定唯一产品时执行 flow 登记的 `product-clarify` runner；不得推定或手写澄清。产品明确但 MCC 尚无检索输入时使用 `mcc-clarify`；已有经营描述后先按 Onboarding flow 读取一次当前 `<SKILL_DIR>/references/onboarding/modules/mcc-reference.md` 做 Agent 语义候选，再统一调用 `mcc-resolve-plan` 由 runner 复核、合并和渲染；用户直接提供当前表内完整 MCC 编码时可跳过 Agent 泛化并由 runner 精确校验。不得拆回 `mcc-search + mcc-candidates`、先旧检索失败后临时猜测，或为方案展示再拼 renderer 输入。