@alipay/alipay-aipay 1.6.2-beta2 → 1.6.2-beta3

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@alipay/alipay-aipay",
-  "version": "1.6.2-beta2",
+  "version": "1.6.2-beta3",
   "description": "支付宝 AI 付 Skill 安装包 - 优先安装 Agent Skill，并在 macOS/Linux 后台准备用户级 CLI 工具",
   "type": "module",
   "bin": {

package/skill/VERSION

@@ -1 +1 @@
-1.6.2-beta2
+1.6.2-beta3

package/skill/references/integration/flow.md

@@ -203,7 +203,7 @@ runner 失败时不得展示手写方案或进入步骤 3。成功时必须取
 
 - `full_process`：`../normal/full-process-routing.md` 已使用同一个 `integration.start.confirm`，在同一方案中绑定检查器产生的项目来源、代码状态和其他产品，以及产品、项目路径、语言/框架和服务声明；消息送达后已经直接进入本步骤，禁止再次渲染或要求确认。该消息不展示步骤清单，也不缩减执行范围；后续仍必须按当前产品完成本 flow 的全部适用接口、完成条件和 checklist。用户中断后若项目、产品、语言或框架发生变化，返回完整接入 router 重新澄清和扫描，再输出一条当前方案并继续。该方案仍禁止提前展示 MCC、授权范围、产品开通材料或 onboarding 待办。
 
-方案送达后只通过上述 development loader 进入步骤 3；loader 仍在原位置记录兼容 stage `integration.user_confirmed` 和 `integration.pre_dev_reading.start`。前者表示已基于完整确定事实自动进入执行，不表示收到额外确认回复；不得另行执行 telemetry 命令或伪造用户回复。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。
+方案送达后只通过上述 development loader 进入步骤 3；loader 仍在原位置记录兼容 stage `integration.user_confirmed` 和 `integration.pre_dev_reading.start`。前者表示已基于完整确定事实自动进入执行并自动标记计数 flow start，不表示收到额外确认回复；不得另行执行 telemetry 命令或伪造用户回复。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。
 
 **方案后的上下文锁定**：已有项目保持步骤 1 前已经唯一解析的实际根目录和原有工程结构；新项目必须已经在步骤 1 前按用户明确选择的方式完成初始化并通过构建标识检查。此处不重复准备、初始化或探测项目。路径内容与步骤 1 成功时不一致则停止并重新澄清；只有目标项目或服务端语言变化时返回步骤 1，其他情况直接进入步骤 3。
 
@@ -554,20 +554,22 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message saf
 
 <!-- ALIPAY_AIPAY_PRODUCT:aipay:START -->
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant AIPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-result "$SANDBOX_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER" --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant AIPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-result "$SANDBOX_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 <!-- ALIPAY_AIPAY_PRODUCT:webpay:START -->
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant WEBPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --webpay-experience-result "$WEBPAY_EXPERIENCE_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER" --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant WEBPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --webpay-experience-result "$WEBPAY_EXPERIENCE_RESULT" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 <!-- ALIPAY_AIPAY_PRODUCT:apppay:START -->
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant APPPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER" --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-message checklist-result --variant APPPAY --project-path "$PROJECT_PATH" --scope-receipt "$CHECKLIST_SCOPE_RECEIPT" --overall-result "$OVERALL_RESULT" --failed-items "$FAILED_ITEMS" --manual-items "$MANUAL_ITEMS" --sandbox-config-state "$SANDBOX_CONFIG_STATE" --blocking-defect-state "$BLOCKING_DEFECT_STATE" --execution-mode "$EXECUTION_MODE" --next-flow-reminder "$NEXT_FLOW_REMINDER"
 ```
 <!-- ALIPAY_AIPAY_PRODUCT:END -->
 
+用户输入计数默认由 telemetry run state 派生。只有本地计数状态不可用且已重新核对时，才在 checklist 命令末尾同时追加 `--user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>`；runner 会拒绝明显不合理计数。
+
 同一次代码开发流程只渲染一次最终 checklist 结果；renderer stdout 是本次默认收口的唯一对客正文，禁止在前后追加风险说明、通过项摘要、执行说明、衔接提醒或第二份待办。
 
 这些产品专属字段只用于 renderer 校验最终结论，不在 checklist 对客结果中重复展示。APP 支付未来沙箱测试对客引导的维护 TODO 只保留在消息目录对应变体，不得渲染给用户；补充时必须同步本 flow、`modules/checklist.md` 和测试。

package/skill/references/normal/scripts/flow_loader.mjs

@@ -7,7 +7,7 @@ import { fileURLToPath } from 'node:url';
 
 import { checklistForProduct } from './checklist_sections.mjs';
 import { createChecklistScopeReceipt } from './integration_message_runner.mjs';
-import { emitStageMetricAsync } from './telemetry.mjs';
+import { emitStageMetricAsync, markTelemetryFlowStart } from './telemetry.mjs';
 
 const scriptDir = path.dirname(fileURLToPath(import.meta.url));
 const referencesDir = path.resolve(scriptDir, '../..');
@@ -239,6 +239,9 @@ export function runFlowCli(argv = process.argv) {
   const phaseBlock = extractFlowBlock(source, phaseBlockName(flow, phase));
   for (const stage of stageDeclarations(phaseBlock, productType)) {
     emitStageMetricAsync(stage, { productType });
+    if (stage === 'integration.user_confirmed' || stage === 'onboarding.user_confirmed') {
+      markTelemetryFlowStart();
+    }
   }
   process.stdout.write(`${loadFlowBundle(flow, phase, { productType })}\n`);
 }

package/skill/references/normal/scripts/integration_message_runner.mjs

@@ -1357,7 +1357,11 @@ async function runChecklistResult(args) {
   }
   const rendered = renderMessage('integration.checklist.result', variant, input);
   if (input.executionMode === '仅代码开发') {
-    emitTerminalMetric({ rootIntent: 'integration_only', productType: variant, ...terminalMetricContextFromArgs(args) });
+    emitTerminalMetric({
+      rootIntent: 'integration_only',
+      productType: variant,
+      ...terminalMetricContextFromArgs(args, { rootIntent: 'integration_only' })
+    });
   }
   return rendered;
 }

package/skill/references/normal/scripts/onboarding_message_runner.mjs

@@ -751,7 +751,11 @@ function closeoutInputFromArgs(args) {
 async function runCloseout(args) {
   const variables = closeoutInputFromArgs(args);
   const rendered = renderMessage('process.partial_result', 'DEFAULT', variables);
-  emitTerminalMetric({ productName: variables.productName, ...terminalMetricContextFromArgs(args) });
+  emitTerminalMetric({
+    productName: variables.productName,
+    rootIntent: args['root-intent'],
+    ...terminalMetricContextFromArgs(args, { rootIntent: args['root-intent'] })
+  });
   return rendered;
 }
 

package/skill/references/normal/scripts/telemetry.mjs

@@ -19,12 +19,34 @@ const syncLogMsg = 'alipay_aipay_skill_event';
 const syncLogYuyanID = '180020010001290755';
 const uploadTimeoutMs = 2500;
 const terminalForegroundUploadTimeoutMs = 1200;
+const terminalForegroundUploadMaxAttempts = 2;
+const terminalForegroundUploadRetryDelayMs = 300;
+const terminalBackgroundRetryDelayMs = 1000;
+const terminalCountArgNames = Object.freeze([
+  'user-input-count-total',
+  'user-input-count-after-flow-start',
+  'flow-start-observed'
+]);
 const outboxFlushLimit = 50;
 const outboxClaimTtlMs = 5 * 60 * 1000;
 const outboxMaxRecords = 1000;
 const outboxMaxAgeMs = 7 * 24 * 60 * 60 * 1000;
 const permissionedFlushTtlMs = 12 * 60 * 60 * 1000;
 const platformProjectIdEnvKeys = Object.freeze(['COZE_PROJECT_ID', 'MEOO_PROJECT_ID']);
+const sessionStateEnvKeys = Object.freeze([
+  'CODEX_THREAD_ID',
+  'CODEX_SESSION_ID',
+  'CLAUDE_CODE_SESSION_ID',
+  'OPENCLAW_SESSION_ID',
+  'CURSOR_SESSION_ID',
+  'CURSOR_TRACE_ID',
+  'COZE_SESSION_ID',
+  'COZE_CONVERSATION_ID',
+  'HERMES_SESSION_ID',
+  'OPENAI_CONVERSATION_ID',
+  'SESSION_ID',
+  'CI_JOB_ID'
+]);
 const permissionedFlushNetworkErrors = new Set([
   'ENOTFOUND',
   'EAI_AGAIN',
@@ -170,28 +192,20 @@ function isMaintenanceProcess(env = process.env, argv = process.argv) {
   return argv.some((arg) => /(^|[/\\])test[/\\].+\.test\.mjs$/u.test(String(arg || '')));
 }
 
-function stableStateKey(env = process.env) {
-  const source =
-    env.ALIPAY_AIPAY_SESSION_ID ||
-    platformProjectRunId(env) ||
-    env.CODEX_THREAD_ID ||
-    env.CODEX_SESSION_ID ||
-    env.CLAUDE_CODE_SESSION_ID ||
-    env.OPENCLAW_SESSION_ID ||
-    env.CURSOR_SESSION_ID ||
-    env.CURSOR_TRACE_ID ||
-    env.COZE_SESSION_ID ||
-    env.COZE_CONVERSATION_ID ||
-    env.HERMES_SESSION_ID ||
-    env.OPENAI_CONVERSATION_ID ||
-    env.SESSION_ID ||
-    env.CI_JOB_ID ||
-    '';
+function stableStateSource(env = process.env) {
+  return env.ALIPAY_AIPAY_SESSION_ID || platformProjectRunId(env) || sessionStateEnvKeys.map((key) => env[key]).find(Boolean) || '';
+}
+
+function stateKeyFromSource(source) {
   if (!source) return 'default';
   if (safeText(source) && source.length <= 128) return source;
   return `key-${crypto.createHash('sha256').update(source).digest('hex')}`;
 }
 
+function stableStateKey(env = process.env) {
+  return stateKeyFromSource(stableStateSource(env));
+}
+
 function stateDir(env = process.env) {
   if (env.ALIPAY_AIPAY_TELEMETRY_DIR) return env.ALIPAY_AIPAY_TELEMETRY_DIR;
   return telemetryRoot();
@@ -216,7 +230,8 @@ function permissionedFlushStatePath(env = process.env) {
   if (env.ALIPAY_AIPAY_TELEMETRY_PERMISSIONED_FLUSH_STATE_FILE) {
     return env.ALIPAY_AIPAY_TELEMETRY_PERMISSIONED_FLUSH_STATE_FILE;
   }
-  return path.join(stateDir(env), `${stableStateKey(env)}.permissioned-flush.json`);
+  const source = stableStateSource(env) || (Object.keys(env).length > 0 ? readRunState(env)?.run_id : '') || '';
+  return path.join(stateDir(env), `${stateKeyFromSource(source)}.permissioned-flush.json`);
 }
 
 export function telemetryStoragePaths(env = process.env) {
@@ -385,6 +400,13 @@ function parseNonNegativeInteger(value) {
   return Number.isSafeInteger(parsed) ? parsed : null;
 }
 
+function sleepSync(ms) {
+  if (!Number.isFinite(ms) || ms <= 0) return;
+  try {
+    Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, Math.min(ms, 30000));
+  } catch {}
+}
+
 function parseBooleanFlag(value) {
   if (typeof value === 'boolean') return value;
   if (typeof value !== 'string') return null;
@@ -394,23 +416,60 @@ function parseBooleanFlag(value) {
   return null;
 }
 
-function terminalExtInfoFromPayload(payload = {}, env = process.env) {
-  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return '';
+function normalizeUserInputCounts(value) {
+  if (!value || typeof value !== 'object' || Array.isArray(value)) {
+    return { total: 0, after_flow_start: 0, flow_start_observed: false };
+  }
+  const total = parseNonNegativeInteger(value.total ?? value.user_input_count_total);
+  const afterFlowStart = parseNonNegativeInteger(value.after_flow_start ?? value.user_input_count_after_flow_start);
+  const flowStartObserved = parseBooleanFlag(value.flow_start_observed);
+  if (total === null || afterFlowStart === null || flowStartObserved === null) {
+    return { total: 0, after_flow_start: 0, flow_start_observed: false };
+  }
+  return {
+    total,
+    after_flow_start: Math.min(afterFlowStart, total),
+    flow_start_observed: flowStartObserved,
+    flow_start_observed_at: parseNonNegativeInteger(value.flow_start_observed_at) || undefined,
+    updated_at: parseNonNegativeInteger(value.updated_at) || undefined
+  };
+}
+
+function validateTerminalCountPayload(payload = {}, env = process.env, { strict = false } = {}) {
+  const fail = (message) => {
+    if (strict) throw new Error(message);
+    return null;
+  };
   const total = parseNonNegativeInteger(payload.userInputCountTotal ?? payload.user_input_count_total);
   const afterFlowStart = parseNonNegativeInteger(
     payload.userInputCountAfterFlowStart ?? payload.user_input_count_after_flow_start
   );
   const flowStartObserved = parseBooleanFlag(payload.flowStartObserved ?? payload.flow_start_observed);
   const rootIntent = rootIntentFrom(payload, env);
-  if (total === null || afterFlowStart === null || flowStartObserved === null) return '';
-  if (!rootIntent) return '';
-  if (afterFlowStart > total) return '';
-  if (!flowStartObserved && afterFlowStart !== 0) return '';
+  if (total === null || afterFlowStart === null || flowStartObserved === null) {
+    return fail('终态用户输入计数必须是合法非负整数，flow-start-observed 必须是 true/false');
+  }
+  if (total < 1) return fail('终态 user_input_count_total 必须至少包含触发当前 run 的用户输入');
+  if (!rootIntent) return fail('终态用户输入计数缺少合法 root_intent');
+  if (afterFlowStart > total) return fail('终态 user_input_count_after_flow_start 不能大于 user_input_count_total');
+  if (flowStartObserved && afterFlowStart >= total) {
+    return fail('终态 flow start 已观测时，after-flow 用户输入数必须小于 total；请重新核对 before-flow/after-flow 分界');
+  }
+  if (!flowStartObserved && afterFlowStart !== 0) {
+    return fail('终态 flow start 未观测时，after-flow 用户输入数必须为 0');
+  }
+  return { total, afterFlowStart, flowStartObserved, rootIntent };
+}
+
+function terminalExtInfoFromPayload(payload = {}, env = process.env) {
+  if (!payload || typeof payload !== 'object' || Array.isArray(payload)) return '';
+  const counts = validateTerminalCountPayload(payload, env);
+  if (!counts) return '';
   return JSON.stringify({
-    user_input_count_total: total,
-    user_input_count_after_flow_start: afterFlowStart,
-    flow_start_observed: flowStartObserved,
-    root_intent: rootIntent
+    user_input_count_total: counts.total,
+    user_input_count_after_flow_start: counts.afterFlowStart,
+    flow_start_observed: counts.flowStartObserved,
+    root_intent: counts.rootIntent
   });
 }
 
@@ -568,15 +627,41 @@ function parseCliArgs(argv) {
   return { command, args };
 }
 
-export function terminalMetricContextFromArgs(args) {
+export function terminalMetricContextFromArgs(args, context = {}) {
   const optional = (name) => {
     const value = args[name];
     return typeof value === 'string' && value.length > 0 ? value : undefined;
   };
+  const hasCountArg = terminalCountArgNames.some((name) => Object.prototype.hasOwnProperty.call(args, name));
+  if (hasCountArg) {
+    const missing = terminalCountArgNames.filter((name) => optional(name) === undefined);
+    if (missing.length > 0) throw new Error(`终态用户输入计数参数必须同时提供，缺少 --${missing[0]}`);
+    const counts = validateTerminalCountPayload({
+      userInputCountTotal: optional('user-input-count-total'),
+      userInputCountAfterFlowStart: optional('user-input-count-after-flow-start'),
+      flowStartObserved: optional('flow-start-observed'),
+      rootIntent: args['root-intent'] || args.rootIntent || args.root_intent || context.rootIntent || context.root_intent
+    }, process.env, { strict: true });
+    return {
+      userInputCountTotal: counts.total,
+      userInputCountAfterFlowStart: counts.afterFlowStart,
+      flowStartObserved: counts.flowStartObserved
+    };
+  }
+  const state = readRunState(process.env);
+  const stored = normalizeUserInputCounts(state?.user_input_counts);
+  if (stored.total < 1) return {};
+  const counts = validateTerminalCountPayload({
+    userInputCountTotal: stored.total,
+    userInputCountAfterFlowStart: stored.after_flow_start,
+    flowStartObserved: stored.flow_start_observed,
+    rootIntent: state?.root_intent
+  }, process.env);
+  if (!counts) return {};
   return {
-    userInputCountTotal: optional('user-input-count-total'),
-    userInputCountAfterFlowStart: optional('user-input-count-after-flow-start'),
-    flowStartObserved: optional('flow-start-observed')
+    userInputCountTotal: counts.total,
+    userInputCountAfterFlowStart: counts.afterFlowStart,
+    flowStartObserved: counts.flowStartObserved
   };
 }
 
@@ -665,9 +750,26 @@ function createOrReuseRunState(args, env = process.env, nowMs = Date.now()) {
   return createRunState(args, env, nowMs);
 }
 
+function flowStartStage(stage) {
+  return stage === 'integration.user_confirmed' || stage === 'onboarding.user_confirmed';
+}
+
+function withFlowStartObserved(state, nowMs = Date.now()) {
+  const counts = normalizeUserInputCounts(state.user_input_counts);
+  return {
+    ...state,
+    user_input_counts: {
+      ...counts,
+      flow_start_observed: true,
+      flow_start_observed_at: counts.flow_start_observed_at || nowMs,
+      updated_at: nowMs
+    }
+  };
+}
+
 function updateRunStateFromEvent(event, env = process.env) {
   const existing = readRunState(env) || {};
-  const next = {
+  let next = {
     ...existing,
     schema_ver: 1,
     run_id: event.run_id,
@@ -676,6 +778,9 @@ function updateRunStateFromEvent(event, env = process.env) {
     created_at: existing.created_at || Date.now(),
     updated_at: Date.now()
   };
+  if (flowStartStage(event.stage)) {
+    next = withFlowStartObserved(next, Number.isFinite(Number(event.timestamp)) ? Number(event.timestamp) : Date.now());
+  }
   if (event.stage === 'run.terminal') {
     next.terminal = true;
     next.terminal_at = Number.isFinite(Number(event.timestamp)) ? Number(event.timestamp) : Date.now();
@@ -686,6 +791,46 @@ function updateRunStateFromEvent(event, env = process.env) {
   writeRunState(next, env);
 }
 
+export function markTelemetryFlowStart(env = process.env, nowMs = Date.now()) {
+  if (!telemetryEnabled(env)) return null;
+  const existing = readRunState(env);
+  if (!existing?.run_id || existing.terminal) return null;
+  const next = withFlowStartObserved({
+    ...existing,
+    updated_at: nowMs
+  }, nowMs);
+  writeRunState(next, env);
+  return next.user_input_counts;
+}
+
+export function recordTelemetryUserInput(phase, env = process.env, nowMs = Date.now()) {
+  if (!telemetryEnabled(env)) return null;
+  if (!['before-flow', 'after-flow'].includes(phase)) {
+    throw new Error('--phase 仅支持 before-flow、after-flow');
+  }
+  const existing = readRunState(env);
+  if (!existing?.run_id || existing.terminal) return null;
+  const counts = normalizeUserInputCounts(existing.user_input_counts);
+  if (phase === 'before-flow' && counts.flow_start_observed) {
+    throw new Error('当前 run 已观测 flow start，后续用户输入必须记录为 after-flow');
+  }
+  const nextCounts = {
+    ...counts,
+    total: counts.total + 1,
+    after_flow_start: counts.after_flow_start + (phase === 'after-flow' ? 1 : 0),
+    flow_start_observed: counts.flow_start_observed || phase === 'after-flow',
+    updated_at: nowMs
+  };
+  if (phase === 'after-flow' && !counts.flow_start_observed) nextCounts.flow_start_observed_at = nowMs;
+  const next = {
+    ...existing,
+    user_input_counts: nextCounts,
+    updated_at: nowMs
+  };
+  writeRunState(next, env);
+  return nextCounts;
+}
+
 function updateExistingRunStateFromEvent(event, env = process.env) {
   const existing = readRunState(env);
   if (!existing) return false;
@@ -1098,6 +1243,17 @@ function releaseOutboxClaim(claimedPath) {
   }
 }
 
+function outboxTargetFilePending(file) {
+  try {
+    if (fs.existsSync(file)) return true;
+    const dir = path.dirname(file);
+    const prefix = `${path.basename(file)}.sending.`;
+    return fs.readdirSync(dir).some((name) => name.startsWith(prefix));
+  } catch {
+    return false;
+  }
+}
+
 function readOutboxRecord(file) {
   try {
     const record = JSON.parse(fs.readFileSync(file, 'utf8'));
@@ -1257,16 +1413,18 @@ export async function flushOutbox(env = process.env, {
   return result;
 }
 
-function spawnOutboxFlush(env = process.env) {
+function spawnOutboxFlush(env = process.env, { delayMs = 0 } = {}) {
   if (!telemetryUploadEnabled(env)) return false;
   try {
+    const childEnv = {
+      ...env,
+      ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: env.ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS || String(uploadTimeoutMs)
+    };
+    if (delayMs > 0) childEnv.ALIPAY_AIPAY_TELEMETRY_FLUSH_DELAY_MS = String(Math.min(delayMs, 30000));
     const child = spawn(process.execPath, [scriptPath(), 'flush-outbox-worker'], {
       detached: true,
       stdio: 'ignore',
-      env: {
-        ...env,
-        ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: env.ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS || String(uploadTimeoutMs)
-      }
+      env: childEnv
     });
     child.on('error', (error) => {
       writeUploadStatus({
@@ -1291,25 +1449,34 @@ function foregroundFlushTerminalOutboxFile(file, env = process.env) {
   if (!telemetryUploadEnabled(env) || !file) return false;
   const parsed = parseNonNegativeInteger(env.ALIPAY_AIPAY_TELEMETRY_TERMINAL_FLUSH_TIMEOUT_MS);
   const timeoutMs = parsed && parsed > 0 ? Math.min(parsed, 30000) : terminalForegroundUploadTimeoutMs;
-  try {
-    execFileSync(process.execPath, [scriptPath(), 'flush-outbox-worker'], {
-      stdio: 'ignore',
-      timeout: timeoutMs + 800,
-      env: {
-        ...env,
-        ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: String(timeoutMs),
-        ALIPAY_AIPAY_TELEMETRY_FLUSH_TARGET_FILE: file
-      }
-    });
-    return true;
-  } catch (error) {
-    writeUploadStatus({
-      status: 'failed',
-      error_code: safeDimension(error?.code || error?.signal || error?.name || 'TERMINAL_FLUSH_FAILED', 'TERMINAL_FLUSH_FAILED', 80),
-      error_message: 'terminal flush failed'
-    }, env);
-    return false;
+  const parsedAttempts = parseNonNegativeInteger(env.ALIPAY_AIPAY_TELEMETRY_TERMINAL_FLUSH_ATTEMPTS);
+  const attempts = parsedAttempts && parsedAttempts > 0
+    ? Math.min(parsedAttempts, 3)
+    : terminalForegroundUploadMaxAttempts;
+  for (let attempt = 1; attempt <= attempts; attempt += 1) {
+    try {
+      execFileSync(process.execPath, [scriptPath(), 'flush-outbox-worker'], {
+        stdio: 'ignore',
+        timeout: timeoutMs + 800,
+        env: {
+          ...env,
+          ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS: String(timeoutMs),
+          ALIPAY_AIPAY_TELEMETRY_FLUSH_TARGET_FILE: file
+        }
+      });
+    } catch (error) {
+      writeUploadStatus({
+        status: 'failed',
+        error_code: safeDimension(error?.code || error?.signal || error?.name || 'TERMINAL_FLUSH_FAILED', 'TERMINAL_FLUSH_FAILED', 80),
+        error_message: 'terminal flush failed'
+      }, env);
+    }
+    if (!outboxTargetFilePending(file)) return true;
+    const retryable = Boolean(networkUploadFailure(readUploadStatus(env)));
+    if (!retryable || attempt >= attempts) return false;
+    sleepSync(terminalForegroundUploadRetryDelayMs);
   }
+  return !outboxTargetFilePending(file);
 }
 
 function scheduleSyncLogUpload(event, env = process.env) {
@@ -1320,7 +1487,9 @@ function scheduleSyncLogUpload(event, env = process.env) {
     return false;
   }
   if (event?.stage === 'run.terminal') {
-    foregroundFlushTerminalOutboxFile(queuedFile, env);
+    if (!foregroundFlushTerminalOutboxFile(queuedFile, env)) {
+      spawnOutboxFlush(env, { delayMs: terminalBackgroundRetryDelayMs });
+    }
     return true;
   }
   return spawnOutboxFlush(env);
@@ -1363,6 +1532,26 @@ export async function runTelemetryCli(argv = process.argv) {
       }
       return 0;
     }
+    if (command === 'count-user-input' && args._.length === 0) {
+      assertCliArgs(args, new Set(['phase']), 0);
+      const counts = recordTelemetryUserInput(args.phase, process.env, Date.now());
+      if (counts) {
+        process.stderr.write(`${internalPrefix}USER_INPUT_COUNT_STATE=${JSON.stringify(counts)}\n`);
+      } else {
+        process.stderr.write(`${internalPrefix}USER_INPUT_COUNT_STATE_MISSING=true\n`);
+      }
+      return 0;
+    }
+    if (command === 'mark-flow-start' && args._.length === 0) {
+      assertCliArgs(args, new Set(), 0);
+      const counts = markTelemetryFlowStart(process.env, Date.now());
+      if (counts) {
+        process.stderr.write(`${internalPrefix}USER_INPUT_FLOW_START_STATE=${JSON.stringify(counts)}\n`);
+      } else {
+        process.stderr.write(`${internalPrefix}USER_INPUT_FLOW_START_STATE_MISSING=true\n`);
+      }
+      return 0;
+    }
     if (command === 'upload-status' && args._.length === 0) {
       assertCliArgs(args, new Set(), 0);
       const status = readUploadStatus(process.env) || { schema_ver: 1, status: 'unknown' };
@@ -1397,6 +1586,8 @@ export async function runTelemetryCli(argv = process.argv) {
       assertCliArgs(args, new Set(), 0);
       if (!telemetryEnabled(process.env)) return 0;
       const timeout = Number(process.env.ALIPAY_AIPAY_TELEMETRY_UPLOAD_TIMEOUT_MS || uploadTimeoutMs);
+      const delay = parseNonNegativeInteger(process.env.ALIPAY_AIPAY_TELEMETRY_FLUSH_DELAY_MS);
+      if (delay && delay > 0) sleepSync(Math.min(delay, 30000));
       await flushOutbox(process.env, {
         targetFile: process.env.ALIPAY_AIPAY_TELEMETRY_FLUSH_TARGET_FILE || '',
         timeoutMs: Number.isFinite(timeout) ? timeout : uploadTimeoutMs

package/skill/references/normal/telemetry.md

@@ -1,4 +1,4 @@
-- 字段/测试白名单：stage/flow、产品、根意图、时间戳、Skill 版本、宿主/模型、匿名机器哈希、`run_id`、终态计数；禁密钥、账号密码、订单/交易号、截图/凭证、用户输入、路径/URL、响应、命令输出、堆栈原文。失败不影响业务；内部行 `ALIPAY_AIPAY_INTERNAL:`。
-- run：`start-run` 创建/复用 `run_id`，脚本继承 `PLATFORM_ID=<run_id>`；`root_intent + product_type` 判定复用/新建，`UNKNOWN` 补全产品仍复用同一 `run_id`；换产品/根意图/已终态/重新开始/重新走流程/作废本轮流程才新建。第三方 ID（`COZE_PROJECT_ID`、`MEOO_PROJECT_ID`、`VITE_APP_ID`/`PLATFORM_ID`）优先；`current-run-id` 只查看，不新建 run。outbox 落盘，collector 2xx 才删；维护/测试/Benchmark 禁上传。
-- 计数：`user_input_count_total` 自触发当前 run 的用户消息起；`user_input_count_after_flow_start` 自方案送达并进入正式执行后的下一条用户消息起。产品/MCC 澄清或选择、项目/语言/框架补齐、项目候选和方案本身只计 total；`full_process` 不因 Onboarding 重置。`flow_start_observed` 表示正式 flow start；用户 kill 未终态不补报。终态只追加计数，不新增确认点、stage 或独立上报。`run.terminal` 入队后以短超时前台 drain，仅当前 terminal 文件，避免流程最后的 detached worker 被宿主回收，不申请额外权限；失败仍保留 outbox。`c4=ext_info`，计数合法且有 `root_intent` 才写 JSON。
-- 补传：不为权限探测新增网络事件；实际低敏上传就是自然探测，宿主已允许访问 collector 时不额外申请权限。`upload-status`/`permissioned-flush-status` 只读；后者输出 `PERMISSIONED_FLUSH_CANDIDATE=true`（最近 `ENOTFOUND|EAI_AGAIN|ETIMEDOUT`、outbox 积压、12h 未请求）后执行 `permissioned-flush-needed` 预占窗口。唯一 `PERMISSIONED_FLUSH_NEEDED=true` 时才申请 `telemetry flush-outbox`；`flush-outbox` 后台补传：POST `https://collect.alipay.com/yuyan/`（`collect.alipay.com:443`，路径 `/yuyan/`）。说明：`是否允许 Agent 上报 Skill 使用过程的统计信息？只含产品类别、时间、Skill 版本、匿名设备标识、人机交互次数等用于帮助改善用户体验的非敏感信息，不会采集包含源代码、用户输入内容等任何敏感信息。` 同一 Agent 会话只请求一次；拒绝/失败/非 2xx 保留 outbox；collector 结果非业务条件；无 `inspect-outbox`、`--confirm-reviewed`、`alipay-cli whoami` 兜底。
+- 测试白名单：stage/flow、产品、根意图、时间戳、Skill 版本、宿主/模型、匿名机器哈希、`run_id`、终态计数；禁密钥/账号密码/订单/交易号/截图/凭证/用户输入/路径/URL/响应/命令输出/堆栈原文；失败不影响业务，内部行 `ALIPAY_AIPAY_INTERNAL:`。
+- run：`start-run` 创建/复用 `run_id`，脚本继承 `PLATFORM_ID=<run_id>`；`root_intent + product_type` 判定复用/新建，`UNKNOWN` 补全产品仍复用同一 `run_id`；换产品/根意图/已终态/重新开始/重新走流程/作废本轮流程才新建。`COZE_PROJECT_ID`、`MEOO_PROJECT_ID`、`VITE_APP_ID`/`PLATFORM_ID` 优先；`current-run-id` 只查看，不新建 run。outbox 2xx 才删；维护/测试/Benchmark 禁上传。
+- 计数：每条用户输入到达当前 run 后立刻执行 `telemetry count-user-input --phase before-flow|after-flow` 写本地 run state，不联网；触发 run 的首条消息计 before-flow。`user_input_count_total` 自触发 run 用户消息起；`user_input_count_after_flow_start` 自方案送达并进入正式执行后的下一条用户消息起。产品/MCC 澄清或选择、项目/语言/框架补齐、项目候选和方案本身只计 total；`full_process` 不因 Onboarding 重置。`flow_start_observed`=正式 flow start，由 `integration.user_confirmed|onboarding.user_confirmed` 自动标记；用户 kill 未终态不补报。closeout 默认派生本地计数，状态不可用且已核对时才显式传三项；runner 拒绝缺项、负数、`after > total`、已观测 flow start 但 `after >= total`。终态只追加计数，不新增确认点、stage 或独立上报。`run.terminal` 入队后以短超时前台 drain，仅当前 terminal 文件，避免流程最后的 detached worker 被宿主回收；若文件仍在且是网络类错误，短重试一次并挂延迟后台补传，不申请额外权限；失败保留 outbox。`c4=ext_info`，计数合法且有 `root_intent` 才写 JSON。
+- 补传：不为权限探测新增网络事件；实际低敏上传就是自然探测，宿主已允许访问 collector 时不额外申请权限。`upload-status`/`permissioned-flush-status` 不联网、不消耗请求窗口；后者在最近 `ENOTFOUND|EAI_AGAIN|ETIMEDOUT`、outbox 积压、12h 未请求时出 `PERMISSIONED_FLUSH_CANDIDATE=true`，再执行 `permissioned-flush-needed` 预占；唯一 `PERMISSIONED_FLUSH_NEEDED=true` 时才申请。`flush-outbox` 后台补传：POST 到 `collect.alipay.com:443`，路径 `/yuyan/`。说明：`是否允许 Agent 上报 Skill 使用过程的统计信息？只含产品类别、时间、Skill 版本、匿名设备标识、人机交互次数等用于帮助改善用户体验的非敏感信息，不会采集包含源代码、用户输入内容等任何敏感信息。` 同一 Agent 会话只请求一次；无宿主标识时按当前 `run_id` 隔离 12h；拒绝/失败/非2xx留 outbox；collector 结果非业务条件；无 `inspect-outbox`、`--confirm-reviewed`、`alipay-cli whoami` 兜底。

package/skill/references/onboarding/flow.md

@@ -59,7 +59,7 @@ Step 1: 方案规划 → Step 2: 环境检查 → Step 3: 登录授权
 环境检查、产品/MCC 澄清或方案展示前先执行平台入口。`onboarding_only` 正常由 `onboarding-bootstrap --root-intent onboarding_only` 包含本动作和 entry 加载；仅原子 fallback 或 `full_process` 衔接时执行：
 
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message platform-entry --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message platform-entry
 ```
 
 - Windows：runner 从私有 run context 取 `run_id` 生成 `platform_id`，禁止 Agent 传入或拼接；消息渲染即终结 run，送达唯一 stdout 后停止 Onboarding；`full_process` 保留 Integration 结果。
@@ -68,7 +68,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message plat
 用户明确要用企业账号通过 Skill 开通时执行下列消息并停止 Onboarding；不得主动询问账号类型，也不得从 MCC、营业执照或“公司”等描述推断。
 
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message enterprise-unsupported --variant <ONBOARDING_ONLY|FULL_PROCESS> --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message enterprise-unsupported --variant <ONBOARDING_ONLY|FULL_PROCESS>
 ```
 
 `onboarding_only` 固定 `ONBOARDING_ONLY`，`full_process` 固定 `FULL_PROCESS`。原文送达最终 stdout 后停止，不执行 Step 6 或追加收口。
@@ -121,7 +121,7 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message mcc-
 
 `salesCode`、`scope` 和材料要求只取“产品映射”。方案只由 `mcc-resolve-plan` 或已有唯一 MCC 时的 `onboarding-message plan-confirm` 生成，须展示产品/scope、MCC、条件材料、企业账号边界及商家平台链接；名称、编码和资质由同一表事实交叉校验，`-` 固定显示“当前类目参考表未列出”。禁止补充模板外资格或审核规则。
 
-不得保留“先运行旧字符串搜索，无匹配后再临时让 Agent 猜”的两阶段流程，或重复询问已知信息。只有唯一事实通过机器校验、方案 marker 唯一且 stdout 已送达，才执行 `onboarding-execute-ready --product-type "$PRODUCT_TYPE"`；缺值、冲突或非唯一继续澄清。产品/MCC 变化时重新校验并渲染。execute loader 记录兼容 stage `onboarding.user_confirmed`，不代表新增用户回复，禁止手工上报。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。`full_process` 不在本阶段重置。
+不得保留“先运行旧字符串搜索，无匹配后再临时让 Agent 猜”的两阶段流程，或重复询问已知信息。只有唯一事实通过机器校验、方案 marker 唯一且 stdout 已送达，才执行 `onboarding-execute-ready --product-type "$PRODUCT_TYPE"`；缺值、冲突或非唯一继续澄清。产品/MCC 变化时重新校验并渲染。execute loader 记录兼容 stage `onboarding.user_confirmed` 并自动标记计数 flow start，不代表新增用户回复，禁止手工上报。after-flow 从此后下一条用户消息开始；前置澄清、候选和方案只计 total。`full_process` 不在本阶段重置。
 
 <!-- ALIPAY_AIPAY_FLOW:ONBOARDING_ENTRY:END -->
 
@@ -501,9 +501,11 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message appl
 `SIGNING_RESULT`、`SERVICE_RESULT`、`APPLICATION_RESULT` 和 `INTEGRATION_RESULT` 必须使用消息目录允许的状态枚举原文，禁止拼接 `appId`、公钥文件路径、错误码、截图证据或其他自由文本；支付宝公钥保存路径只允许在已取得唯一 `ALIPAY_PUBLIC_KEY_EXPORT_STATUS=EXPORTED` 和 `ALIPAY_PUBLIC_KEY_FILE` 时，通过 `APP_KEY_SAVE_PATH` 或 `APPLICATION_OPERATION_APP_KEY_SAVE_PATH` 独立传入结果 runner。这些证据不能污染分支结果枚举。
 
 ```bash
-node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message closeout --product-type "$PRODUCT_TYPE" --root-intent "$ROOT_INTENT" --signing-result "$SIGNING_RESULT" --application-result "$APPLICATION_RESULT" --remaining-actions "$REMAINING_ACTIONS" [--integration-result "$INTEGRATION_RESULT"] [--service-result "$SERVICE_RESULT"] [--sandbox-config-state "$SANDBOX_CONFIG_STATE"] [--manual-verification-items "$MANUAL_VERIFICATION_ITEMS"] [--application-operation-app-id "$APPLICATION_OPERATION_APP_ID" [--application-operation-next-action "$APPLICATION_OPERATION_NEXT_ACTION"] [--application-operation-app-key-save-path "$APPLICATION_OPERATION_APP_KEY_SAVE_PATH"]] --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>
+node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message closeout --product-type "$PRODUCT_TYPE" --root-intent "$ROOT_INTENT" --signing-result "$SIGNING_RESULT" --application-result "$APPLICATION_RESULT" --remaining-actions "$REMAINING_ACTIONS" [--integration-result "$INTEGRATION_RESULT"] [--service-result "$SERVICE_RESULT"] [--sandbox-config-state "$SANDBOX_CONFIG_STATE"] [--manual-verification-items "$MANUAL_VERIFICATION_ITEMS"] [--application-operation-app-id "$APPLICATION_OPERATION_APP_ID" [--application-operation-next-action "$APPLICATION_OPERATION_NEXT_ACTION"] [--application-operation-app-key-save-path "$APPLICATION_OPERATION_APP_KEY_SAVE_PATH"]]
 ```
 
+用户输入计数默认由 telemetry run state 派生，不在 closeout 事后回溯。只有本地计数状态不可用且已重新核对时，才在 closeout 命令末尾同时追加 `--user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>`；runner 会拒绝明显不合理计数。
+
 runner 从 `PRODUCT_TYPE` 派生产品名，网站支付/APP 支付派生服务结果“无需处理”，从 `ROOT_INTENT` 派生代码开发栏和后续衔接；标题只按完成条件派生。`onboarding_only` 省略 `--integration-result`、`--sandbox-config-state` 和 `--manual-verification-items`。`full_process`：代码开发通过填“已完成”并传 `READY`；仅沙箱待配置且其余代码与安全检查通过填“部分完成，沙箱配置待完成”并传 `CREATE_PENDING|VERIFY_PENDING`；沙箱 `READY` 且只剩非阻塞人工待验证项时填“部分完成，人工待验证”，传 `READY`，把 checklist `manualItems` 原样作为 `MANUAL_VERIFICATION_ITEMS`，并在 `REMAINING_ACTIONS` 写明实际待办，禁止传“无”。runner 拒绝旧完整参数、stdin JSON、`--input-json`、可派生字段和空字符串伪值。renderer 校验结果与沙箱状态/人工待验证项一致，并派生恢复口令或人工待验证展示；不增加确认点。不得在 stdout 前后追加衔接提醒，不伪造本轮代码修改、沙箱创建或测试结果，也不重复进入 integration。
 
 若 `full_process` 最后一跳紧接应用创建、审核提交或复用，不再先输出 `application.operation.result` 再立刻 closeout；只记录同一 `APPLICATION_OPERATION_APP_ID`，runner 复用 `APPLICATION_RESULT`，非“需人工配置”还记录 `APPLICATION_OPERATION_NEXT_ACTION`；“需人工配置”的下一步由 runner 派生。若同一动作已成功导出支付宝公钥，同时传 `APPLICATION_OPERATION_APP_KEY_SAVE_PATH`，收口必须展示“当前 appId: xxx 对应的支付宝公钥保存在:xxx”；“需人工配置”禁止传该路径。已上线且无保存路径时不展开“应用分支结果”；已上线且有保存路径时只展开 appId、状态和路径；其他应用结果合并展示并保留完成态红线。`onboarding_only`、应用分支仍需用户补材料/确认，或应用操作结果不是紧邻 Step 6 收口时，仍按应用模块输出 `application.operation.result`。合并展示不得改写完成条件，待审核、待设置公钥或待人工配置仍不得表述为应用发布完成。

package/skill/references/runtime-entry.md

@@ -41,14 +41,14 @@ node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" render <messageId> --va
 | 意图 | 判定 | 入口 | 后续按需加载 |
 |---|---|---|---|
 | `integration_only` | 只要求代码开发、支付集成或集成排障，未同时要求产品开通 | 执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" integration-bootstrap --root-intent integration_only` | 当前阶段、产品和语言的契约、示例与脚本 |
-| `onboarding_only` | 只要求签约、入驻或产品开通，未同时要求代码开发 | 执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-bootstrap --root-intent onboarding_only --user-input-count-total <total> --user-input-count-after-flow-start <afterFlowStart> --flow-start-observed <true|false>` | 当前阶段的授权、查询或写分支模块 |
+| `onboarding_only` | 只要求签约、入驻或产品开通，未同时要求代码开发 | 执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-bootstrap --root-intent onboarding_only` | 当前阶段的授权、查询或写分支模块 |
 | `full_process` | 明确要求完整接入、一站式，或同一请求同时要求代码开发和产品开通 | `normal/full-process-routing.md` | 先 Integration，满足衔接条件后 Onboarding |
 
 `integration_only` 的 `integration-bootstrap` 只在同一 Node 进程串行执行 `telemetry start-run` 与 `flow integration entry`。`onboarding_only` 的 `onboarding-bootstrap` 只串行执行 `telemetry start-run`、`onboarding-message platform-entry` 与 `flow onboarding entry`。两者均为既有无业务写入动作，执行后不得重复原子命令。Windows 引导渲染即终结 run 并停止，`platform_id` 取本次 `run_id` 且禁止 Agent 传入；非 Windows 返回 entry 契约。`full_process` 不使用 `integration-bootstrap`；衔接 Onboarding 也不使用带 `start-run` 的 bootstrap，仍执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" onboarding-message platform-entry` 后按需加载 entry，避免重复 `run.intent_detected`。
 
 `full_process` 识别根意图后立即执行 `node "<SKILL_DIR>/references/normal/scripts/runtime.mjs" telemetry start-run --root-intent full_process`；产品已唯一确定时追加 `--product-type <aipay|webpay|apppay>`。`integration_only` 和 `onboarding_only` 已由上表各自 bootstrap 包含同一次 `start-run`，不得重复执行本条 telemetry。命令创建/复用当前流程 `run_id`，并在遥测开启时记录 `run.intent_detected`：同一意图和产品继续复用，`UNKNOWN` 补全产品仍复用同一 `run_id`；明确换产品、换根意图或既有 run 已终态才重建。第三方平台项目 ID 仍优先固定为 `run_id`，不得被显式 run ID 或本地生成值覆盖。业务 stage 只由登记 runner/script 异步记录。
 
-遥测默认开启，`ALIPAY_AIPAY_TELEMETRY=0|false|off|no` 可关闭 `METRIC_EVENT`、outbox、上传和 flush；私有 run context 仍供 `PLATFORM_ID` 与终态生命周期使用。落盘/网络/上传/flush 失败静默，不改变业务、消息或确认，stdout 为空且 stderr 内部行不对客。`integration_only` 由 checklist 终结；Onboarding 由 closeout 或登记的提前终止消息终结。上报权限不新增专门网络探针，首次 `start-run` 及后续 stage 的实际低敏上传就是自然探测；宿主已允许访问 collector 时不额外申请权限，仅 `normal/telemetry.md` 的只读状态命令确认网络失败和 outbox 积压后，才允许一次补传权限申请。Agent 按 `normal/telemetry.md` 维护本轮用户输入计数，只在终态命令追加参数，不新增业务确认点或独立上报；入队后当前 `run.terminal` 文件做短超时前台 drain，失败仍保留 outbox 且不影响业务收口。after-flow 以方案后 `*.user_confirmed` 为起点；前置澄清和候选选择不计入。脚本始终以当前 `run_id` 为 `PLATFORM_ID`，Agent 不手写环境前缀或改 MCP payload；维护诊断、outbox、上传和 flush 细节只在 `normal/telemetry.md` 按需读取。
+遥测默认开启，`ALIPAY_AIPAY_TELEMETRY=0|false|off|no` 关闭事件/outbox/上传/flush；私有 run context 仍供 `PLATFORM_ID` 与终态生命周期。失败静默，不改变业务/消息/确认，stdout 空且 stderr 内部行不对客。`integration_only` 由 checklist 终结；Onboarding 由 closeout 或登记提前终止消息终结。上报权限不新增专门网络探针，首次 `start-run` 及后续 stage 的实际低敏上传就是自然探测；宿主已允许访问 collector 时不额外申请权限，仅 `normal/telemetry.md` 的不联网状态命令确认网络失败和 outbox 积压后，才允许一次补传权限申请。Agent 按 `normal/telemetry.md` 在每条用户输入到达时即时记录本轮计数：flow start 前执行 `telemetry count-user-input --phase before-flow`，`*.user_confirmed` 由 flow loader 自动标记起点，之后执行 `--phase after-flow`；closeout 默认从本地 run state 派生计数，状态不可用且已核对时才显式传三项计数参数，runner 拒绝缺项、负数、`after > total`、已观测 flow start 但 `after >= total` 等明显错误。不新增业务确认点或独立上报；入队后当前 `run.terminal` 文件做短超时前台 drain，失败仍保留 outbox 且不影响业务收口，网络类失败按维护文档短重试/后台兜底。after-flow 以方案后 `*.user_confirmed` 为起点；前置澄清和候选不计。脚本以当前 `run_id` 为 `PLATFORM_ID`，Agent 不手写环境前缀或改 MCP payload；维护诊断、outbox、上传和 flush 细节只在 `normal/telemetry.md` 按需读取。
 
 三种入口均只在无法从已有产品名称或业务描述可靠确定唯一产品时执行 flow 登记的 `product-clarify` runner；不得推定或手写澄清。产品明确但 MCC 尚无检索输入时使用 `mcc-clarify`；已有经营描述后先按 Onboarding flow 读取一次当前 `<SKILL_DIR>/references/onboarding/modules/mcc-reference.md` 做 Agent 语义候选，再统一调用 `mcc-resolve-plan` 由 runner 复核、合并和渲染；用户直接提供当前表内完整 MCC 编码时可跳过 Agent 泛化并由 runner 精确校验。不得拆回 `mcc-search + mcc-candidates`、先旧检索失败后临时猜测，或为方案展示再拼 renderer 输入。