@bolloon/bolloon-agent 0.4.33 → 0.5.0

package/dist/agents/network-pulse.js

@@ -103,7 +103,34 @@ function writeEvents(list, h) {
         /* 统计失败绝不影响主路径 */
     }
 }
-// ── 匿名化 ──────────────────────────────────────────────────────────────────
+export function tallySignatureAudit(h, opts = {}) {
+    const now = opts.now ?? Date.now();
+    const windowMs = opts.windowMs ?? PULSE_LIMITS.windowMs;
+    const file = path.join(home(h), '.bolloon', 'wallet-signatures.jsonl');
+    if (!fs.existsSync(file))
+        return { available: false, count: 0, window_ms: windowMs };
+    let count = 0;
+    try {
+        for (const line of fs.readFileSync(file, 'utf8').split('\n')) {
+            if (!line.trim())
+                continue;
+            let row = null;
+            try {
+                row = JSON.parse(line);
+            }
+            catch {
+                continue;
+            } // 坏行跳过, 不让一行坏数据毁掉整个计数
+            const at = Number(row?.at);
+            if (Number.isFinite(at) && at >= now - windowMs)
+                count += 1;
+        }
+    }
+    catch {
+        return { available: false, count: 0, window_ms: windowMs };
+    }
+    return { available: true, count, window_ms: windowMs };
+}
 /** 节点摘要: sha256(值) 前 16 位。不可逆, 不暴露原值。 */
 export function nodeDigest(value) {
     return crypto.createHash('sha256').update(`bolloon-pulse|${String(value)}`).digest('hex').slice(0, 16);
@@ -728,6 +755,8 @@ export function buildChainIdScope(rows) {
  *      (页面不许出现「0 个任务」与「N 行任务」并存而**不解释**)
  *   ⑥ 0x 长 hex 越界 (2026-09-23): 只许出现在 tx_hash/contract/explorer_* 四个白名单键下 ——
  *      EOA 地址跑到别的键 (或白名单键形状不对) 就拒绝导出
+ *   ⑧ ★ **同一概念不许并排两个数** (2026-09-24, 见 `totalsScopeIssues`): 顶部计数与表格行数/
+ *      同源计数矛盾, 或者某个数没有来源却不标「未接入」→ 拒绝导出 (这道门在 UI 侧还有一份镜像)
  */
 export function snapshotConsistencyIssues(snap) {
     const issues = [];
@@ -756,8 +785,137 @@ export function snapshotConsistencyIssues(snap) {
     }
     issues.push(...auditPublicHexLeaks(snap)); // ⑥ 0x 长 hex 越界 → 拒绝导出 (不静默放行)
     issues.push(...openTasksIssues(snap)); // ⑦ 待接单任务的字段白名单与「只含未认领」不变式
+    issues.push(...totalsScopeIssues(snap)); // ⑧ ★ 同一概念不得并排两个数 (顶部 vs 表格)
     return issues;
 }
+/** 顶部逐字段口径的键 (与 `TotalsFieldKey` 逐字一致; 少一个 = 那个数没有来源说明) */
+export const TOTALS_FIELD_KEYS = [
+    'nodes', 'agents', 'active_agents', 'seen_last_24h',
+    'tasks', 'tasks_completed', 'tasks_verified', 'tasks_settled', 'signatures',
+];
+const TOTALS_FIELD_SOURCES = ['pulse-events', 'chain-index', 'signature-audit', 'none'];
+const TOTALS_FIELD_WINDOWS = ['window-24h', 'full', 'unknown'];
+/** 「未接入」类措辞 (无源时必须出现, 否则等于没说清为什么没有数) */
+const UNAVAILABLE_WORDS = /未接入|not connected|无可用源|no available source/;
+/**
+ * ★ 新不变量门 (2026-09-24 leo:「数量怎么对不上」): **同一概念不许并排两个数**。
+ *
+ * 检查的是「页面会把它们放在同一屏里」的那几个数 —— 它们的口径必须各自挂得住:
+ *   ① 逐字段口径 `totals_scope.fields` 九个键必须齐 (source/window/short/label 双语都在) ——
+ *      缺了就只能靠 notes 辩解, 而那正是当初「顶部 0 个任务 vs 表格 25 行」能上线的路径;
+ *   ② 值 `null` ⇔ 口径标 `none` + 明说「未接入」; **有源却不给数** 或 **无源却拿 0 冒充** 都算矛盾;
+ *   ③ 同一概念对账 (表里有 5 个任务而顶部写 0 任务 → 判红):
+ *        · 链上索引可用时, 顶部 tasks/tasks_completed/tasks_settled **必须逐字等于** activity_totals
+ *          的同名字段 (同源即恒等, 任何解释都救不了);
+ *        · 表格行数/同源计数非零而顶部为 0 或缺值 → 必须有口径说明 (note 里写清) 才放行;
+ *        · 顶部说有 N 个任务而表格一行都没有 (反向矛盾) → 同样判红。
+ *   `status === 'unavailable'` 的整份快照不发布任何计数 (页面整块显示「快照读不到」), 故只查形状。
+ */
+export function totalsScopeIssues(snap) {
+    const out = [];
+    const t = snap?.totals || {};
+    const ts = snap?.totals_scope;
+    const at = snap?.activity_totals || {};
+    const rows = Array.isArray(snap?.confirmed_activity) ? snap.confirmed_activity : [];
+    const unavailableSnap = String(snap?.status || '') === 'unavailable';
+    if (!ts || typeof ts !== 'object')
+        return ['totals_scope 缺失 (顶部计数的口径必须随快照一起给)'];
+    if (!ts.fields || typeof ts.fields !== 'object') {
+        return ['totals_scope.fields 缺失 (顶部每个数都要能就地说明来自哪 —— 不许只靠 notes 辩解)'];
+    }
+    // ① 形状: 九个键齐 + 每个键的 source/window/short/label 都合法
+    for (const k of TOTALS_FIELD_KEYS) {
+        const f = ts.fields[k];
+        if (!f || typeof f !== 'object') {
+            out.push(`totals_scope.fields.${k} 缺失`);
+            continue;
+        }
+        if (!TOTALS_FIELD_SOURCES.includes(f.source))
+            out.push(`totals_scope.fields.${k}.source=${JSON.stringify(f.source)} 不在白名单`);
+        if (!TOTALS_FIELD_WINDOWS.includes(f.window))
+            out.push(`totals_scope.fields.${k}.window=${JSON.stringify(f.window)} 不在白名单`);
+        if (!f.label?.zh || !f.label?.en)
+            out.push(`totals_scope.fields.${k}.label 必须双语都给`);
+        if (!f.short?.zh || !f.short?.en)
+            out.push(`totals_scope.fields.${k}.short 必须双语都给 (页面要就地贴在数字旁)`);
+    }
+    if (out.length)
+        return out; // 形状都不对就不往下算数
+    if (!unavailableSnap) {
+        // ② 值 ⇔ 口径 (null = 未接入; 有源必须有数; 无源不许给 0)
+        for (const k of TOTALS_FIELD_KEYS) {
+            const f = ts.fields[k];
+            const v = t[k];
+            const isNull = v === null || v === undefined;
+            if (isNull) {
+                if (f.source !== 'none') {
+                    out.push(`totals.${k} 没有值 (未接入) 却标了源 ${f.source} —— 有源就必须给真值, 没源就标 none`);
+                }
+                if (!UNAVAILABLE_WORDS.test(`${f.short?.zh}${f.short?.en}${f.label?.zh}${f.label?.en}`)) {
+                    out.push(`totals.${k} 没有值却没有一句「未接入」说明 (读者会把空白读成 0)`);
+                }
+            }
+            else {
+                if (typeof v !== 'number' || !Number.isFinite(v) || v < 0) {
+                    out.push(`totals.${k}=${JSON.stringify(v)} 不是非负有限数`);
+                }
+                else if (f.source === 'none') {
+                    out.push(`totals.${k}=${v} 却标「无源」 —— 不许拿裸 0 冒充「没有接入」(那会被读成"没发生过")`);
+                }
+            }
+        }
+        // ③ 同一概念对账 (顶部计数 vs 表格行数/同源计数)
+        const notes = Array.isArray(snap.notes) ? snap.notes.join(' ') : '';
+        const pairs = [
+            ['tasks', t.tasks, at.tasks],
+            ['tasks_completed', t.tasks_completed, at.tasks_completed],
+            ['tasks_settled', t.tasks_settled, at.tasks_settled],
+        ];
+        const tableRows = Number(at.rows) || rows.length;
+        const sameSourceChain = String(at.source) === 'chain-index';
+        // ⑨ 声明与能力不符: 某字段自称「链上索引」口径, 而这一份快照的链上索引根本不可用 ——
+        //    那就是替一个不存在的源背书 (页面会写「链上索引·全量」, 而索引这一份没读出来)。
+        //    注: 本块必须放在 pairs / sameSourceChain 之后 (先声明后使用, 否则 TDZ 崩)。
+        if (!sameSourceChain) {
+            for (const [k] of pairs) {
+                const f = ts.fields[k];
+                if (f.source === 'chain-index') {
+                    out.push(`totals_scope.fields.${k}.source='chain-index' 而这一份快照的链上索引不可用 ` +
+                        `(activity_totals.source=${JSON.stringify(at.source)}) —— 声明与能力不符`);
+                }
+            }
+        }
+        for (const [k, top, src] of pairs) {
+            const n = Number(src) || 0;
+            const topN = (top === null || top === undefined) ? null : Number(top);
+            const topScope = ts.fields[k];
+            if (sameSourceChain && topScope.source === 'chain-index') {
+                // 同源: 必须逐字相等, 不需要任何"解释"
+                if (topN !== n) {
+                    out.push(`同一概念两个数: 顶部 totals.${k}=${topN === null ? '未接入' : topN} ≠ 链上索引同源计数 activity_totals.${k}=${n}` +
+                        ` (表格 ${tableRows} 行) —— 同源即恒等, 页面并排出现两个数就是矛盾`);
+                }
+                continue;
+            }
+            if (n > 0 && (topN === null || topN === 0)) {
+                const explained = notes.includes('口径') && notes.includes(String(tableRows)) && notes.includes('脉冲事件');
+                if (!explained) {
+                    out.push(`顶部 totals.${k}=${topN === null ? '未接入' : 0} 与表格里的 ${n} 个同类 (${tableRows} 行) 矛盾, 且没有任何口径说明`);
+                }
+            }
+            if (topN !== null && n === 0 && tableRows === 0 && topN > 0) {
+                out.push(`顶部 totals.${k}=${topN} 而表格一行都没有 (${tableRows} 行) —— 反向矛盾: 数不出行却报了数`);
+            }
+        }
+    }
+    // ④ 明说"数字不一样"时必须有解释 (老规矩保留; 不许只靠一句 label)
+    if (ts.differs_from_activity === true) {
+        const notes = Array.isArray(snap.notes) ? snap.notes.join(' ') : '';
+        if (!notes.includes('口径'))
+            out.push('totals_scope.differs_from_activity=true 但 notes 里没有任何口径说明');
+    }
+    return out;
+}
 /** open_tasks 行的字段白名单 (与 `OpenTaskRow` 逐字一致; 多一个键 = 可能把正文/身份带出去了) */
 export const OPEN_TASK_KEYS = ['capability', 'budget', 'currency', 'network', 'deadline', 'claimed', 'announcementId'];
 /**
@@ -798,26 +956,85 @@ export function openTasksIssues(snap) {
     });
     return out;
 }
+// ── 顶部计数的逐字段口径 (2026-09-24) ────────────────────────────────────────
+// 页面把 8~9 个数字并排放在**一行**里, 一行一个总口径是解释不了它们的 —— 每个数必须自带来源。
+const WINDOW_HOURS = Math.round(PULSE_LIMITS.windowMs / 3600000);
+/** 「本节点 N h 脉冲事件」口径 (节点/智能体类计数, 以及链上索引不可用时的降级口径) */
+function pulseField(what) {
+    return {
+        source: 'pulse-events',
+        window: 'window-24h',
+        short: { zh: `${WINDOW_HOURS}h 脉冲`, en: `${WINDOW_HOURS}h pulse` },
+        label: {
+            zh: `本节点 ${WINDOW_HOURS}h 观察窗口内收到的脉冲事件 · ${what.zh}`,
+            en: `pulse events received by this node within the ${WINDOW_HOURS}h window · ${what.en}`,
+        },
+    };
+}
+/** 「链上索引 · 全量」口径 (与下方活动表**同源**: 同源即恒等, 页面不许并排两个数) */
+function chainField(what) {
+    return {
+        source: 'chain-index',
+        window: 'full',
+        short: { zh: '链上索引·全量', en: 'chain index · whole' },
+        label: {
+            zh: `链上索引全量 (与下方活动表同源) · ${what.zh}`,
+            en: `chain index, whole (same source as the activity table below) · ${what.en}`,
+        },
+    };
+}
+/** 「本机签名审计账」口径 (真源: `<home>/.bolloon/wallet-signatures.jsonl` 窗口内条数) */
+function signatureAuditField() {
+    return {
+        source: 'signature-audit',
+        window: 'window-24h',
+        short: { zh: `${WINDOW_HOURS}h 签名审计`, en: `${WINDOW_HOURS}h signature audit` },
+        label: {
+            zh: `本机签名审计账 (wallet-signatures.jsonl) ${WINDOW_HOURS}h 内条数 —— 只数条数, 不含签名内容`,
+            en: `rows in this node's signature audit log (wallet-signatures.jsonl) within ${WINDOW_HOURS}h — count only, no content`,
+        },
+    };
+}
+/** 「没有可用源」= 未接入 (值必须是 null; 页面必须写「未接入」, 不许拿 0 冒充「没发生过」) */
+function noneField(why) {
+    return {
+        source: 'none',
+        window: 'unknown',
+        short: { zh: '未接入', en: 'not connected' },
+        label: { zh: `没有可用源 → 报「未接入」而不是 0 · ${why.zh}`, en: `no available source → reported as "not connected", not 0 · ${why.en}` },
+        unavailable: true,
+    };
+}
 export function computeSnapshot(events, opts) {
     const now = opts.now;
     const fresh_until = now + PULSE_LIMITS.snapshotTtlMs;
     if (opts.unavailable) {
         const emptyRows = [];
         const gates = normalizeActivityGates(DEFAULT_CONFIRMATIONS);
+        // 观察层不可用 = **没有数** (不是 0): 计数一律 null/0 占位由页面整块隐藏, 口径逐字段标「未接入」。
+        const downField = noneField({ zh: '观察层不可用', en: 'observation layer unavailable' });
         return {
             status: 'unavailable',
             generated_at: now,
             fresh_until,
             scope: 'observed',
             scope_label: { zh: '当前节点观察到', en: 'Observed by this node' },
-            totals: { nodes: 0, agents: 0, active_agents: 0, seen_last_24h: 0, tasks: 0, tasks_completed: 0, tasks_verified: 0, signatures: 0 },
+            totals: {
+                nodes: 0, agents: 0, active_agents: 0, seen_last_24h: 0,
+                tasks: null, tasks_completed: null, tasks_verified: null, signatures: null, tasks_settled: null,
+            },
             totals_scope: {
                 source: 'pulse-events', window_ms: PULSE_LIMITS.windowMs,
                 label: {
-                    zh: `只统计本节点 ${PULSE_LIMITS.windowMs / 3600000}h 观察窗口内收到的脉冲事件 (本节点自己上报的)`,
-                    en: `Only pulse events received by this node within the ${PULSE_LIMITS.windowMs / 3600000}h observation window (reported by this node itself)`,
+                    zh: `本节点 ${WINDOW_HOURS}h 观察窗口的脉冲事件层不可用 → 没有数 (不是 0)`,
+                    en: `This node's ${WINDOW_HOURS}h pulse layer is unavailable → no counts (not zero)`,
                 },
                 differs_from_activity: false,
+                fields: {
+                    nodes: downField, agents: downField, active_agents: downField, seen_last_24h: downField,
+                    tasks: downField, tasks_completed: downField, tasks_verified: downField,
+                    tasks_settled: downField, signatures: downField,
+                },
             },
             capabilities: [],
             recent_activity: [],
@@ -859,10 +1076,13 @@ export function computeSnapshot(events, opts) {
         capabilities.push({ key: 'other', count: otherCount.size });
         capabilities.sort((a, b) => b.count - a.count || (a.key < b.key ? -1 : 1));
     }
-    // 经济计数: 按**不同任务**去重 (同一任务重复事件不虚增), 且只给聚合数不给内容
+    // 经济计数 (**脉冲口径**) —— 注意: 顶部「任务/已完成/已结算」的**权威源是链上索引**
+    // (见下面 chainAuthoritative 那一段), 脉冲口径只在索引不可用时才顶上去。
+    // 按**不同任务**去重 (同一任务重复事件不虚增), 且只给聚合数不给内容
     const tasks = new Set();
     const tasksCompleted = new Set();
     const tasksVerified = new Set();
+    const tasksSettledPulse = new Set();
     for (const e of window) {
         const t = e.taskProof;
         if (!t)
@@ -871,6 +1091,8 @@ export function computeSnapshot(events, opts) {
             tasks.add(t);
         if (e.type === 'task_completed' || e.type === 'trade_settled')
             tasksCompleted.add(t);
+        if (e.type === 'trade_settled')
+            tasksSettledPulse.add(t);
         if (e.type === 'trade_verified')
             tasksVerified.add(t);
     }
@@ -895,15 +1117,62 @@ export function computeSnapshot(events, opts) {
     // 同源计数 + 链归属: **输入就是上表那批行**, 所以不可能与行数/链 id 打架
     const activity_totals = summarizeActivityRows(activity.rows, { source: activity.source, gates: activity.gates });
     const chain_id_scope = buildChainIdScope(activity.rows);
+    // ★ 2026-09-24 (leo: 「数量怎么对不上, 尤其是后面的任务和钱包」):
+    //   顶部任务类计数的**权威源改成链上索引** —— 它与下面那张表**同源**, 同源即恒等,
+    //   从根上消灭「顶部 0 个任务 / 表格 15 行任务」这种并排矛盾 (不再靠 notes 辩解)。
+    //   链上索引不可用 (降级 pulse-events) 时才退回旧的脉冲口径, 并在 fields 里如实标出降级。
+    const chainAuthoritative = activity.source === 'chain-index';
+    const totalsTasks = chainAuthoritative ? activity_totals.tasks : tasks.size;
+    const totalsCompleted = chainAuthoritative ? activity_totals.tasks_completed : tasksCompleted.size;
+    const totalsSettled = chainAuthoritative ? activity_totals.tasks_settled : tasksSettledPulse.size;
+    // 「验真」在链上索引里**没有**对应事件 → 链上口径下这个数没有源 (null + 未接入), 不拿结算数冒充已验证
+    const totalsVerified = chainAuthoritative ? null : tasksVerified.size;
+    // 钱包签名: 真源 = 本机签名审计账 (窗口内条数, 只计数); 没有审计账 → 退回脉冲事件上报数;
+    // 两个都没有 → null (未接入)。**绝不**在没有源的时候报 0 (那是「没发生过」, 是另一句话)。
+    const sigTally = opts.signatureAudit ?? null;
+    const auditWired = !!sigTally && sigTally.available === true;
+    const totalsSignatures = auditWired
+        ? Number(sigTally.count)
+        : (signatureKeys.size > 0 ? signatureKeys.size : null);
+    const fields = {
+        nodes: pulseField({ zh: '不同节点数', en: 'distinct nodes' }),
+        agents: pulseField({ zh: '不同 Agent 数', en: 'distinct agents' }),
+        active_agents: pulseField({ zh: '活跃 Agent 数', en: 'active agents' }),
+        seen_last_24h: pulseField({ zh: '24h 内出现过的不同 Agent', en: 'distinct agents seen within 24h' }),
+        tasks: chainAuthoritative
+            ? chainField({ zh: '有链上活动的不同任务', en: 'distinct tasks with on-chain activity' })
+            : pulseField({ zh: '观察到发起的任务', en: 'tasks observed as created' }),
+        tasks_completed: chainAuthoritative
+            ? chainField({ zh: '交付完成 (ProofSubmittedV2) 的不同任务', en: 'distinct tasks with ProofSubmittedV2' })
+            : pulseField({ zh: '交付完成的任务', en: 'tasks observed as completed' }),
+        tasks_settled: chainAuthoritative
+            ? chainField({ zh: '托管结算 (Released/Refunded/Expired/Disputed) 的不同任务', en: 'distinct tasks with an on-chain escrow settlement' })
+            : pulseField({ zh: '链上口径结算的任务', en: 'tasks with on-chain settlement' }),
+        tasks_verified: chainAuthoritative
+            ? noneField({ zh: '链上索引没有「验真」事件', en: 'the chain index has no verification event' })
+            : pulseField({ zh: '真验真 (trade_verified) 的任务', en: 'tasks truly verified (trade_verified)' }),
+        signatures: auditWired
+            ? signatureAuditField()
+            : (signatureKeys.size > 0
+                ? pulseField({ zh: '上报过的钱包签名 (按来源+时刻去重)', en: 'reported wallet signatures (deduped by source+time)' })
+                : noneField({ zh: '本节点既没有签名审计账, 也没有签名脉冲事件', en: 'this node has neither a signature audit log nor signature pulse events' })),
+    };
     const totals_scope = {
-        source: 'pulse-events',
+        source: chainAuthoritative ? 'mixed' : 'pulse-events',
         window_ms: PULSE_LIMITS.windowMs,
         label: {
-            zh: `只统计本节点 ${PULSE_LIMITS.windowMs / 3600000}h 观察窗口内收到的脉冲事件 (本节点自己上报的)`,
-            en: `Only pulse events received by this node within the ${PULSE_LIMITS.windowMs / 3600000}h observation window (reported by this node itself)`,
+            zh: chainAuthoritative
+                ? `节点/智能体 = 本节点 ${WINDOW_HOURS}h 脉冲事件; 任务/已完成/已结算 = 链上索引全量 (与下表同源); 钱包签名 = 本机签名审计`
+                : `只统计本节点 ${WINDOW_HOURS}h 观察窗口内收到的脉冲事件 (本节点自己上报的)`,
+            en: chainAuthoritative
+                ? `nodes/agents = this node's ${WINDOW_HOURS}h pulse events; tasks/completed/settled = chain index, whole (same source as the table below); wallet signatures = this node's signature audit log`
+                : `Only pulse events received by this node within the ${WINDOW_HOURS}h observation window (reported by this node itself)`,
         },
         differs_from_activity: activity_totals.rows > 0 &&
-            (tasks.size !== activity_totals.tasks || tasksCompleted.size !== activity_totals.tasks_completed),
+            (totalsTasks !== activity_totals.tasks ||
+                totalsCompleted !== activity_totals.tasks_completed ||
+                totalsSettled !== activity_totals.tasks_settled),
+        fields,
     };
     if (activity.source === 'chain-index') {
         notes.push(`confirmed_activity 来自链上索引 (chain-index): ${activity_totals.rows} 行 · ${activity_totals.tasks} 个不同任务 · ` +
@@ -916,10 +1185,21 @@ export function computeSnapshot(events, opts) {
     }
     // 两套计数口径不同时**必须**解释 —— 页面不许出现「0 个任务」与「N 行任务」并存而不解释
     if (totals_scope.differs_from_activity) {
-        notes.push(`口径不同, 不是数据丢失: totals.tasks/tasks_completed/tasks_verified/signatures 只数本节点 ` +
-            `${PULSE_LIMITS.windowMs / 3600000}h 窗口内的脉冲事件 (本快照 tasks=${tasks.size} · tasks_completed=${tasksCompleted.size} · ` +
-            `tasks_verified=${tasksVerified.size} · signatures=${signatureKeys.size}); 上表 ${activity_totals.rows} 行来自链上索引 ` +
-            `(全量, 不是 ${PULSE_LIMITS.windowMs / 3600000}h 窗口) —— 同源计数见 activity_totals`);
+        notes.push(`口径不同, 不是数据丢失: 链上索引不可用 → 顶部任务类计数**降级为脉冲口径** (本快照 tasks=${tasks.size} · ` +
+            `tasks_completed=${tasksCompleted.size} · tasks_verified=${tasksVerified.size} · tasks_settled=${tasksSettledPulse.size} · ` +
+            `signatures=${signatureKeys.size}); 上表 ${activity_totals.rows} 行来自脉冲事件 (同源计数见 activity_totals, ` +
+            `不是链上索引全量) —— 每个数的来源见 totals_scope.fields`);
+    }
+    if (chainAuthoritative) {
+        notes.push(`顶部「任务/已完成/已结算」= 链上索引的**同源计数** (= activity_totals, 与下表同源, 同源即恒等): ` +
+            `tasks=${totalsTasks} · tasks_completed=${totalsCompleted} · tasks_settled=${totalsSettled}; ` +
+            `「节点/智能体」= 本节点 ${WINDOW_HOURS}h 脉冲事件; 「已验证」在链上索引里没有对应事件 → ` +
+            `该口径无对应事件源, 不下发该字段 (不是 0); 「钱包签名」= ${auditWired
+                ? `本机签名审计账 ${totalsSignatures} 条 (${WINDOW_HOURS}h 窗口, 只计数)`
+                : (totalsSignatures === null
+                    ? '无可用源 (本节点既没有签名审计账, 也没有签名脉冲事件), 不下发该字段'
+                    : `脉冲事件上报 ${totalsSignatures} 条`)} — ` +
+            `每个数的来源见 totals_scope.fields`);
     }
     if (activity_totals.rows > 0)
         notes.push(chain_id_scope.note.zh);
@@ -936,10 +1216,12 @@ export function computeSnapshot(events, opts) {
             agents: agents.size,
             active_agents: active.size,
             seen_last_24h: agents.size, // 24h 窗口内的不同 Agent
-            tasks: tasks.size, // 观察到发起的任务数 (聚合, 无内容)
-            tasks_completed: tasksCompleted.size,
-            tasks_verified: tasksVerified.size,
-            signatures: signatureKeys.size, // 真实签名次数 (只计数)
+            // ★ 任务类计数 = 链上索引同源值 (与下表恒等); 索引不可用才退回脉冲口径 (见 fields.tasks)
+            tasks: totalsTasks,
+            tasks_completed: totalsCompleted,
+            tasks_verified: totalsVerified, // 链上口径下 = null (未接入), 不冒充 0
+            signatures: totalsSignatures, // 真源 = 本机签名审计账; 无源 = null (未接入)
+            tasks_settled: totalsSettled, // 新增字段一律排最后 (老 8 个字段顺序逐字不变)
         },
         totals_scope,
         capabilities,
@@ -966,6 +1248,7 @@ export async function getNetworkPulse(opts = {}) {
             const shapeOk = Array.isArray(cached?.confirmed_activity)
                 && typeof cached?.confirmed_activity_source === 'string'
                 && !!cached?.totals_scope
+                && !!cached?.totals_scope?.fields // 老缓存没有逐字段口径 → 过期形状, 重算
                 && !!cached?.activity_totals
                 && !!cached?.chain_id_scope
                 && Array.isArray(cached?.open_tasks); // 老缓存没有待接单任务 → 过期形状, 重算
@@ -983,8 +1266,11 @@ export async function getNetworkPulse(opts = {}) {
     }
     // 活动行优先取 P5 链上索引 (真链上事实); 索引不可用 → 退回脉冲事件, 并在快照里标出来源
     const confirmedActivity = await resolveConfirmedActivity({ home: opts.home, events, now });
+    // 钱包签名的**真源**: 本机签名审计账 (窗口内条数)。没有账 → 注入 available:false → 快照标「未接入」
+    // (不拿 0 冒充「没发生过」: 本机明明签过而脉冲事件丢了的那次真事故就是这么来的)
+    const signatureAudit = tallySignatureAudit(opts.home, { now, windowMs: PULSE_LIMITS.windowMs });
     // 待接单任务: 只读本机公告板目录 (未认领且未过期), 投影成白名单 7 字段 —— 与脉冲事件层无关
-    const snap = computeSnapshot(events, { now, confirmedActivity, openTasks: readOpenTasks(opts.home, now) });
+    const snap = computeSnapshot(events, { now, confirmedActivity, openTasks: readOpenTasks(opts.home, now), signatureAudit });
     try {
         fs.mkdirSync(pulseDir(opts.home), { recursive: true });
         fs.writeFileSync(snapshotFile(opts.home), JSON.stringify(snap), 'utf8');

package/dist/agents/pi-sdk.js

@@ -29,7 +29,7 @@ import { DeepThinkingEngine, AgentCoordinator } from '@bolloon/constraint-runtim
 import { WorkflowPivotLoop, createDefaultPivotConfig } from './workflow-pivot-loop.js';
 import { initDocumentReceiver } from './p2p-document-tools.js';
 import { startRun, recordStep, finishRun, readRun, budgetVerdict, recordDegradation, recordHarnessEvent, recordRecovery, setRunStatus, prepareResume, markRunRunning, buildResumeInstruction, argsDigestOf, repeatedFailureCount, classifyError as classifyRunError } from './run-store.js';
-import { createGoal, readGoal, attachRun, findActiveGoal, completeGoalIfEligible, setUnresolved, addEvidence, evaluateGoalCompletion } from './goal-store.js';
+import { createGoal, attachRun, findActiveGoal } from './goal-store.js';
 import { PiAgentHarness } from './pi-harness.js';
 import { DiscoveredAgentsManager, createSocialHeartbeat } from '../social/heartbeat.js';
 import { SkillRegistry } from '@bolloon/constraint-runtime';
@@ -757,6 +757,30 @@ export class PiAgentSession {
                     status: 'needs_human',
                     error: 'LLM 不可用: provider 未初始化或无 apiKey (fallback 不是执行结果, 需要配置或人工处理)',
                 });
+                // ★ M0: "工具/权限不可用"也是一条终止路径 → 同样进收尾漏斗 (规则 ④)。
+                const wiring = await import('./goal-flywheel-wiring.js');
+                const closed = await wiring.closeRunOnce({
+                    goalId: boundGoalId,
+                    runId: rec.runId,
+                    caller: 'runner',
+                    now: new Date().toISOString(),
+                    finalReview: `LLM 不可用 → fallback 收尾 (不是执行结果): ${response}`,
+                });
+                if (!wiring.isRefusal(closed) && closed.outcome) {
+                    const { reduceGoalState } = await import('./goal-state-reducer.js');
+                    await reduceGoalState({
+                        goalId: boundGoalId,
+                        intent: 'closure_outcome',
+                        now: new Date().toISOString(),
+                        by: 'runner',
+                        outcome: {
+                            goalStatus: wiring.goalStatusFromDecision(closed.outcome.decision),
+                            continuation: wiring.toGoalStoreContinuation(closed.outcome.continuation),
+                            reason: closed.outcome.decision.reason,
+                        },
+                        runId: rec.runId,
+                    });
+                }
                 console.log(`[PiAgent] LLM 不可用 → 本次仍落 Run ${rec.runId} (needs_human), 不伪装成正常执行`);
             }
             catch (err) {
@@ -2341,30 +2365,61 @@ ${PiAgentSession.TOOL_SELECTION_GUIDE}
                 await recordDegradation({ kind: 'core', op: 'pi-sdk.finishRun', runId: this.currentRunId, message }).catch(() => { });
                 onStream?.({ type: 'error', content: `⚠️ ${message}`, tool: 'harness' });
             }
-            // 2026-09-16 (M4): Goal 侧完成门 —— Run 结束 ≠ Goal 完成; 只有判据全满足 + 有证据 + 无未解决项才算
+            // ★ 2026-09-25 (M0 接线冻结, 规则 ③ + ④): Run 结束**必过收尾漏斗**。
+            //
+            // 旧写法在这里另起了一套 Goal 侧收尾 (读证据 → `evaluateGoalCompletion` →
+            // `completeGoalIfEligible` / `setUnresolved`): 它**不收尾** —— 不写 Memory、不生成 Skill 候选、
+            // 不写权威 continuation、不留决策记录。于是同一条 Run 在 Supervisor 那里还会再收一次 (或反过来
+            // 这条路径根本不收), 全仓就有了两套"这一轮跑完意味着什么"。那一套已删除。
+            //
+            // 现在: `closeRunOnce` (幂等) → 9 步收尾 → 产物落盘; 再由 Goal reducer 把"下一步是什么"
+            // 落进 Goal (没有 Supervisor 宿主时 Runner 也要留下 continuation, 否则下一次还是从零开始)。
             if (this.currentGoalId) {
                 try {
-                    const full = await readRun(this.currentRunId).catch(() => null);
-                    const ev = (full?.evidence || []).slice(-10);
-                    if (ev.length)
-                        await addEvidence(this.currentGoalId, ev);
-                    const goal = await readGoal(this.currentGoalId);
-                    if (goal) {
-                        const verdict = evaluateGoalCompletion(goal);
-                        if (verdict.complete) {
-                            const done = await completeGoalIfEligible(this.currentGoalId);
-                            onStream?.({ type: 'status', content: `🎯 目标已达成: ${done.reason} (goal=${this.currentGoalId})`, tool: 'harness' });
-                        }
-                        else {
-                            // 不静默: 未达成的目标留在 active, 未解决项写清楚 (下次 prompt 会继续这个 Goal)
-                            const items = verdict.missing.length ? verdict.missing : [`run=${this.currentRunId} 结束但目标未达成: ${verdict.reason}`];
-                            await setUnresolved(this.currentGoalId, items);
-                            onStream?.({ type: 'status', content: `🎯 目标仍在进行 (未判完成): ${verdict.reason}`, tool: 'harness' });
-                        }
+                    const wiring = await import('./goal-flywheel-wiring.js');
+                    const { reduceGoalState } = await import('./goal-state-reducer.js');
+                    const nowIso = new Date().toISOString();
+                    const closed = await wiring.closeRunOnce({
+                        goalId: this.currentGoalId,
+                        runId: this.currentRunId,
+                        caller: 'runner',
+                        now: nowIso,
+                        finalReview: finalResponse ? String(finalResponse).slice(0, 2000) : '',
+                    });
+                    if (wiring.isRefusal(closed)) {
+                        onStream?.({ type: 'status', content: `⚠️ 收尾被拒 (不当作收过): ${closed.reason}`, tool: 'harness' });
+                    }
+                    else if (closed.outcome) {
+                        const view = closed.outcome;
+                        const applied = await reduceGoalState({
+                            goalId: this.currentGoalId,
+                            intent: 'closure_outcome',
+                            now: nowIso,
+                            by: 'runner',
+                            outcome: {
+                                goalStatus: wiring.goalStatusFromDecision(view.decision),
+                                continuation: wiring.toGoalStoreContinuation(view.continuation),
+                                reason: view.decision.reason,
+                            },
+                            runId: view.runId,
+                        });
+                        const line = view.decision.decision === 'complete'
+                            ? `🎯 目标已达成 (仍要过完成门): ${view.decision.reason}`
+                            : `🎯 目标仍在进行 (未判完成): ${view.decision.reason}`;
+                        onStream?.({
+                            type: 'status',
+                            content: `${line}${applied.gateRejected ? ` [完成门拒绝: ${applied.gateRejected}]` : ''} `
+                                + `(收尾 ${view.steps} 步 · memory ${view.memories} · skill 候选 ${view.candidates} · goal=${this.currentGoalId})`,
+                            tool: 'harness',
+                        });
+                    }
+                    else {
+                        // 幂等: 别处 (或上一次) 已经收过尾 —— 事实读不回来就如实说, 不重收也不假装
+                        onStream?.({ type: 'status', content: `🎯 ${closed.reason}`, tool: 'harness' });
                     }
                 }
                 catch (err) {
-                    await recordDegradation({ kind: 'observational', op: 'pi-sdk.goalCompletion', runId: this.currentRunId, message: String(err?.message || err).slice(0, 160) }).catch(() => { });
+                    await recordDegradation({ kind: 'observational', op: 'pi-sdk.runClosure', runId: this.currentRunId, message: String(err?.message || err).slice(0, 160) }).catch(() => { });
                 }
             }
             this.currentRunId = '';

package/dist/agents/run-store.js

@@ -24,14 +24,14 @@ export const RUN_TRANSITIONS = {
     queued: ['running', 'aborted', 'interrupted'],
     running: ['recovering', 'paused', 'awaiting_external', 'done', 'failed', 'aborted', 'interrupted', 'stalled', 'needs_human'],
     recovering: ['running', 'failed', 'aborted', 'needs_human', 'interrupted', 'stalled'],
-    paused: ['running', 'aborted', 'interrupted'],
-    awaiting_external: ['running', 'failed', 'aborted', 'interrupted', 'stalled'],
+    paused: ['running', 'aborted', 'interrupted', 'recovering'],
+    awaiting_external: ['running', 'failed', 'aborted', 'interrupted', 'stalled', 'recovering'],
     done: [],
     failed: [],
     aborted: [],
     interrupted: ['recovering', 'aborted'], // 允许"从 checkpoint 恢复"
     stalled: ['recovering', 'aborted', 'needs_human'],
-    needs_human: ['running', 'aborted'],
+    needs_human: ['running', 'aborted', 'recovering'],
 };
 export function canTransition(from, to) {
     if (from === to)
@@ -572,6 +572,13 @@ function pidAlive(pid) {
         return e?.code === 'EPERM';
     }
 }
+let onRunTerminal = null;
+export function setOnRunTerminal(hook) {
+    onRunTerminal = hook;
+}
+export function getOnRunTerminal() {
+    return onRunTerminal;
+}
 /**
  * 孤儿对账: 启动时把 pid 已死的 running 记录改判 interrupted。
  * 不做这一层的话, 重载后 UI/CLI 会显示"还在跑"的幽灵运行 —— 那是最典型的假状态。
@@ -588,11 +595,14 @@ export async function reconcileOrphans() {
             continue;
         }
         try {
-            await finishRun(r.runId, {
+            const closed = await finishRun(r.runId, {
                 status: 'interrupted',
                 error: `进程 ${r.pid} 已不在 (刷新/重载/崩溃); 运行到此中断`,
             });
             interrupted.push(r.runId);
+            // 终止路径进唯一责任链 (拿不到 Goal 就不收, 不假装收过)
+            if (onRunTerminal)
+                await Promise.resolve(onRunTerminal(closed || r)).catch(() => null);
         }
         catch (err) {
             failed.push(r.runId);
@@ -615,11 +625,14 @@ export async function superviseRuns(now = Date.now()) {
             continue; // 交给 reconcileOrphans
         if (now - Date.parse(r.updatedAt) > cfg.staleMs) {
             try {
-                await finishRun(r.runId, {
+                const closed = await finishRun(r.runId, {
                     status: 'stalled',
                     error: `超过 ${Math.round(cfg.staleMs / 1000)}s 没有新进展 (可能是工具卡住或模型长时间无响应)`,
                 });
                 stalled.push(r.runId);
+                // 同上: 失速也是一条终止路径
+                if (onRunTerminal)
+                    await Promise.resolve(onRunTerminal(closed || r)).catch(() => null);
             }
             catch (err) {
                 failed.push(r.runId);