@danceiny/gotry 0.0.1-rc.16 → 0.0.1-rc.17

package/README.md

@@ -12,7 +12,7 @@
 | | |
 |---|---|
 | **Version** | `v0.0.1-rc.13+` (npm `latest`; [release notes](docs/release-notes.md)) |
-| **Runtime** | DeepSeek Harness **0.1.2-alpha.1** (vendored; [upstream](https://github.com/deepseek-ai/DeepSeek-Harness)) · Z3 WASM · Cordis |
+| **Runtime** | DeepSeek Harness **0.1.2-alpha.3** (root-pinned; [upstream](https://github.com/deepseek-ai/DeepSeek-Harness)) · Z3 WASM · Cordis |
 | **License** | **MIT** ([LICENSE](LICENSE)) |
 | **Docs** | English (this file) · [简体中文 README](README.zh-CN.md) · deep engineering docs are Chinese-first ([docs/architecture.md](docs/architecture.md)) |
 
@@ -23,10 +23,15 @@
 ```bash
 npx @danceiny/gotry web
 # First run creates .env: LLM_API_KEY=<DeepSeek key, or OpenAI-compatible key>
+#   Not using DeepSeek directly? Also set LLM_BASE_URL=<your endpoint, usually ending in /v1>
+#   Need a specific model (relays often do)? Set LLM_MODEL=<model name> — it drives the
+#   dsh chat face (web/headless) and overrides any model picked in the dsh web settings.
 # → open http://127.0.0.1:3080 and chat: "I want three relaxing days in Dali"
 ```
 
-> **Switching models / providers?** The price table (`ts/data/llm-price-table.json`, schema `gotry_llm_price_table_v2`) is the single source of truth for `gotry_m3_nightly_run_v1.cost_usd`. Adding a new model or switching relay = update this file via PR (ADR-11, peak-conservative upper bound only). Unknown models **fail-closed** — no guessed prices. Drift monitor: `npx tsx ts/scripts/price-drift-watch.ts` (offline baseline diff; `--fetch` for live official pages). Never auto-applies changes.
+> **Switching models / providers?** The price table (`ts/data/llm-price-table.json`, schema `gotry_llm_price_table_v2`) is the single source of truth for `gotry_m3_nightly_run_v1.cost_usd`. Adding a new model or switching relay = update this file via PR (ADR-11, peak-conservative upper bound only)
+- . Unknown models **fail-closed** — no guessed prices. Drift monitor: `npx tsx ts/scripts/price-drift-watch.ts` (offline baseline diff;
+- `--fetch` for live official pages). Never auto-applies changes.
 
 | You want | Command |
 |---|---|
@@ -34,7 +39,9 @@ npx @danceiny/gotry web
 | 🤖 Scripted / one-shot answer | `npx @danceiny/gotry "Two recovery days from Shenzhen, budget 3000"` |
 | 🛠️ Developer: run from source | see [source install](#%EF%B8%8F-developer-source-install) below |
 
-- Requires Node 22+ and one LLM API key. Zero-config startup — the dsh runtime is mounted automatically via a cordis patch.
+- Requires Node 22.15+ and one LLM API key. Any OpenAI-compatible endpoint (MiniMax / relays / self-hosted gateways) works too — add `LLM_BASE_URL` to `.env` (usually ends with `/v1`, e.g. `https://api.minimax.io/v1`) and requests follow it instead of the DeepSeek default. To pin the model,
+  - set `LLM_MODEL` (e.g. `MiniMax-M2`): it applies to both the dsh chat face and the repo scripts, and beats the model selection persisted in the dsh web UI;
+  - unset, the dsh built-in default (`deepseek-v4-flash`) or your web-UI choice is used. Zero-config startup — the dsh runtime is mounted automatically via a cordis patch.
 
 ---
 
@@ -68,9 +75,10 @@ That's it — the dsh chat UI on `:3080` with the GoTry persona mounted. First c
 
 ```bash
 git clone https://github.com/Danceiny/gotry && cd gotry
-cd ts/dsh-runtime && pnpm install && cd ../..    # ① vendored dsh 0.1.2-alpha.1 (one-off)
-cp .env.example .env                              # ② set LLM_API_KEY
-./gotry web                                       # ③ in-repo entry, same UX
+npm ci && npm --prefix ts ci                      # ① install the pinned root/TS closure
+node scripts/build-dist.mjs                       # ② build the source checkout's JS runtime
+cp .env.example .env                              # ③ set LLM_API_KEY (+ LLM_BASE_URL if not on DeepSeek; + LLM_MODEL to pin the model)
+./gotry web                                       # ④ in-repo entry, same UX
 ```
 
 | Entry | Command | When |
@@ -78,6 +86,8 @@ cp .env.example .env                              # ② set LLM_API_KEY
 | dsh Web chat (recommended) | `./gotry web` | multi-turn planning with visualized reasoning → :3080 |
 | headless one-shot | `./gotry "one full task"` | scripts / CI / targeted debugging → stdout |
 
+The source entry and npm package both resolve one 216-package DSH `0.1.2-alpha.3` closure declared as exact direct dependencies. The manifest, package lock, and root pnpm importer must expose the same 216-name set; publish preverify rejects omissions, mixed versions, and ranges. Source checkout runs dsh from `ts/dsh-runtime/` in normal mode so `gotry-state/` continuity is preserved; benchmark opt-in and npm-package runs use the invocation directory for isolation. The old `ts/dsh-runtime/` vendor tree remains a non-benchmark legacy resolution fallback, not a promised runnable path or the recommended install path.
+
 ---
 
 ## 🧰 21 tools
@@ -111,7 +121,8 @@ The account session channel reads realtime hotel/flight data from **the user's o
 3. **Physically read-only.** A ReadGuard aborts all write requests at the network layer (ordering/payment is unreachable in transport); the agent never touches credentials or captchas — on a captcha it stops and hands control back.
 4. **Never hijacks your browser.** Retrieval/login always open their own dedicated tab; the login page is brought to front and stays with you; routine test runs never open browser windows.
 
-> One-time prerequisite: install the bundled **GoTry Session Bridge** browser extension (MV3, ~30 seconds): run `npx gotry setup` to place it at `~/.gotry/extension`, then in Chrome open `chrome://extensions`, enable Developer mode and "Load unpacked" that folder. Zero Chrome system dialogs afterwards — the extension passively forwards the site's own search responses (read-only by construction; cookies are read by NAME only, values never leave the browser). Until installed, tools return `needs-extension` with instructions and spend nothing. (A `cdp` fallback via `chrome://inspect` remote debugging still exists for diagnostics: `GOTRY_SESSION_TRANSPORT=cdp` — note Chrome 144+ shows a permission box on every connection.)
+> One-time prerequisite: install the [GoTry Session Bridge](https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd) Chrome extension from the Chrome Web Store (one click, auto-updates) — done in the browser, not by gotry. Review-free GitHub-channel fallback is optional; for that variant see [`docs/extension-webstore-submission.md`](docs/extension-webstore-submission.md). Zero Chrome system dialogs afterwards — the extension passively forwards the site's own search responses (read-only by construction;
+- cookies are read by NAME only, values never leave the browser). Until installed, tools return `needs-extension` with the store URL as a clickable link and spend nothing. (A `cdp` fallback via `chrome://inspect` remote debugging still exists for diagnostics: `GOTRY_SESSION_TRANSPORT=cdp` — note Chrome 144+ shows a permission box on every connection.)
 
 ---
 
@@ -153,7 +164,7 @@ Engine verdict:
 
 | Layer | Module | Role |
 |---|---|---|
-| L2 | `ts/src/index.ts` (dsh plugin) | 21 tools, time-anchor & memory-brief variables; execute isolation + consent gate + process guards |
+| L2 | `ts/src/index.ts` (dsh plugin) | 21 tools, time-anchor & memory-brief variables; execute isolation + consent gate + per-turn tool budget + process guards |
 | L3 | `ts/src/unified.ts` · `py/gotry_feasibility/` | single solving entry (candidate enumeration + flight-chain Z3) |
 | L4 | `ts/capabilities/effect.ts` · `hbcli.ts` · `skeleton-check.ts` | effect interpreter (backoff retry / circuit breaker / mock interpreter, issue #16) + realtime inventory bridge + OpenFlights skeleton (three-valued semantics) |
 | L5 | loopx governance | objective / gates / evidence / quota |
@@ -164,24 +175,40 @@ Engine verdict:
 
 ## ⚠️ Status & limitations
 
+Evaluation Phase 0 foundation boundary: contracts/registry/validators/unmatched diagnostic fixtures/test-only aggregate admission plus a deterministic PR/nightly/weekly/milestone cadence policy/planner. It returns admission, `pass^k`, budgets, calibration, failure-registry, and cross-benchmark synthesis obligations only; it does not schedule or launch adapters, spend, generate a benchmark score, create an Agent optimization round, or support an uplift claim. No external runner, Python runtime dependency, baseline, or matched production evidence is included.
+
 **Working today** (full-stack regression §1–§34 green; every item has deterministic tests):
 
 - **Z3 solving engine** — feasibility verdicts + door-to-door whole-cost; the historical concurrency race is fixed (§30 regression gate)
 - **Realtime retrieval** — flight/train/hotel (Fliggy official channel), destination/hotel catalogs, weather, live flight observation, route connectivity; realtime prices can overwrite solver prices (`GOTRY_REALTIME_PRICING=1`)
 - **Account session search** — Ctrip flights on your own logged-in Chrome; consent & privacy rules above (see 🔐 **Account session: consent & privacy**)
-- **One-time browser extension setup** — `npx gotry setup wizard` walks you through a 30-second install of GoTry Session Bridge (MV3, fixed extension ID, zero system dialogs per session). Background health-watch auto-plays your query once the extension is connected — no manual retry needed.
+- **One-time browser extension setup** — install [GoTry Session Bridge](https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd) from the Chrome Web Store (a browser concern, not a gotry one — one click on "Add to Chrome"). When `gotry_session_search` returns `needs-extension`, the verdict surfaces the store URL as a clickable link in the dsh UI; the background health-watch auto-replays your query once the extension is connected — no manual retry needed.
+- **Extension distribution (issue #21, ADR-21)** — three channels, same extension: the [Chrome Web Store](https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd) (recommended: one-click install + auto-update; live since 2026-09-02) is what dsh users should rely on; the review-free GitHub Releases channel is an opt-in escape hatch; the npm-bundled copy stays the offline-deterministic fallback;
+  - any GitHub-channel failure falls back to the bundled copy. The store re-signs with its own key, so the store build's extension ID differs from the fixed-key unpacked ID — the local bridge trusts both origins (§38 regression).
+- **Session data cross-verification (issues #21 / #67)** — 8 benchmark queries (sf-01..sf-08) verified end-to-end: 7/8 verdict=hit, 6/6 manual-golden soft-score 100%, all hits <15s, zero ReadGuard writes. The comparator is pluggable: `--golden=manual` (default), `--golden=flyai`,
+  - or `--golden=static`. Static mode pins an ODbL OpenFlights route/carrier snapshot and combines it with manual time/price bands;
+  - evidence records requested vs effective source, provenance, estimated fields, and fallback reason. Snapshot/route failure prints a warning to stderr and falls back to manual. Static mode is deterministic benchmark data, **not live schedule, fare, or availability**.
+- **Observed static-source runs (2026-08-30, logged-in Chrome)** — two consecutive runs produced static official 8/8 with zero fallback each time;
+  - Ctrip session hits varied from 3/8 to 5/8, while every scored hit across both runs (3+5 records) passed 13/13 (100%). Non-hits remain explicit `miss` records,
+    - so the ≥90% field score is not presented as 8/8 live availability. The same runs exposed and fixed an online-extension lifecycle bug: idle parked timers/sockets no longer pin the default CLI bridge, while wizardless `keepBridge` behavior remains unchanged (§38: 24/24, §40: 9/9).
 - **Memory & reachability** — motivation profile / wish pool / companions / travel timeline; English output via `GOTRY_LOCALE=en`
+- **Bounded agent tool loops** — a soft convergence context is injected after real dispatch 16; dispatch 18 is the last tool body, already-prepared calls 19+ receive structured `TOOL_BUDGET_EXHAUSTED` failures without entering the body, and inherited native tool schemas are suppressed at `step/end` for a text-only next step. The boundary is exercised through the packaged `dist` entry and a real dsh headless loop against an offline relay; CI packs the current SHA and repeats the E2E from an isolated pnpm consumer install rather than the root development tree. Direct/programmatic calls are outside this per-turn budget.
 
 **Open limitations** (as of 2026-08-29, honest list):
 
 - ⏳ **M3 Exit not closed** — engineering & distribution ready, but real seed-user evidence (50–200 person cohort) not yet accumulated; automated tests prove contracts and formulas, not business pass
 - ⏳ **Ctrip-hotel / Meituan logged-in adapters** — flights done; hotel session surfaces await real login-state backfill (next tick)
 - ⏳ **Interface language** — English currently covers the deterministic solve-output layer only; the dsh host UI and dialogue surface belong to the host / calibration samples
+- ⏳ **External benchmark generalization / Phase 1 bridge** — Round 1's exact DeepSeek treatment was environment-unavailable/schema-invalid (score 0), while GLM timed out at 300 s. Round 2 added the default-off owner-local bridge; its frozen treatment remained diagnostic-only because no structured native bridge call or tagged JSON reached the evaluator. Round 3 added provider-neutral native-call/result/terminal conformance, but its new frozen treatment still stopped after one runner spawn with planner/runner exit 1, zero released terminal bytes, no evaluator entry, and null official scores. Round 4's treatment at SHA `5ebddb2` had primary preflight pass, but planner/runner both exited 1 after 30.968 s, released 0 bytes, the evaluator was not entered, and official scores were null. The product Node gate was v24.20.0 while that treatment used v26.3.0, so the result remains diagnostic-only with no uplift claim. GitHub Node 22/24 §48 separately exposed a source default-off 30 s lifecycle hang. Round 5 is limited to removing the timer/keepalive preload, pinning the root/package DSH closure to alpha.3, making source checkout resolve that locked runtime before the legacy vendored fallback, preserving source normal-mode state under `ts/dsh-runtime/gotry-state/` while benchmark/package runs use the invocation directory for isolation, rejecting a non-alpha.3 benchmark runtime before spawn, enforcing Node 22.15+, and adding a benchmark-only structured diagnostic pipe with allowlisted redacted reason codes while stdout remains fail-closed. Its frozen treatment at code SHA `752e54c` stopped after 140.715 s with `child_nonzero_exit`, zero terminal bytes, and null evaluator/official scores, so it remains diagnostic-only; the lock-consistency successor does not rewrite that UID attribution. Cross-benchmark evidence remains open. See [`docs/benchmark-environment-bridge.md`](docs/benchmark-environment-bridge.md).
+- ⏳ **Round 6 structured terminal diagnostics** — benchmark mode maps only the final structured `turn/end` into closed, redacted model/runtime reason families. A per-session arbiter emits at most once and preserves a specific bridge/conformance reason over a later generic runtime reason; recovered transient retries emit no failure. Free-form messages, raw stderr, paths, prompts, request IDs, and credentials never cross the control pipe. The frozen ChinaTravel treatment at code SHA `c61600b` (`..._00001`, `deepseek-v4-flash`) stopped after 49.546 s with `child_runtime_error`, zero terminal bytes, and null evaluator/official scores; leakage and local credential/endpoint scans were zero. This is diagnostic evidence only and creates no score/uplift claim; later documentation-only successors do not rewrite the treatment attribution.
+- ⏳ **Round 7 minimal benchmark kernel** — at code SHA `edb9392896625adbb48abae4a2ecf968dbfc0349`, benchmark opt-in retains only tool budget, model override, one bridge, and isolation/conformance; product prompt variables, process guards, consent hooks, and ordinary GoTry tools are not installed, while the default path is unchanged. The CLI projects a stable task-agnostic persona and accepts only canonical `insert` and `system-prompt` root items, failing closed on missing, duplicate, quoted, reordered, flow, or noncanonical items. ChinaTravel frozen treatment UID `e20241028160248698752` (`easy`, `deepseek-v4-flash`) passed preflight without fallback, then ended after 80.463 s with runner exit 1 and zero/invalid terminal bytes; the evaluator was not entered, official score is null, and the case is not countable. The allowlisted attribution is `child_bridge_runner_failed`; no uplift or external benchmark closure is claimed. The next problem is a generic bridge-tool schema and recoverable domain-error contract.
 
 <details>
 <summary>📖 Deeper engineering state (ledger contracts / evidence contracts / milestone stance)</summary>
 
-The authoritative state lives in the docs, not this README: transactional state ledger (ADR-15) + dual-form freeze (ADR-16: one ledger semantics for local+web); the M3 real-cohort evidence contract stands (fixtures don't count toward Exit; 50–200 real samples open the gate); the M4 paired-cohort value evidence contract (run-all §34 — synthetic data is never Exit evidence); async work-order terminal contract (`gotry_async_terminal.v1`: 4/4 → succeeded / ledger settled / exit 0). Details: [`docs/roadmap.md`](docs/roadmap.md) / [`docs/architecture.md`](docs/architecture.md) §1 and issues #19–#22.
+The authoritative state lives in the docs, not this README: transactional state ledger (ADR-15) + dual-form freeze (ADR-16: one ledger semantics for local+web); the M3 real-cohort evidence contract stands (fixtures don't count toward Exit; 50–200 real samples open the gate);
+- the M4 paired-cohort value evidence contract (run-all §34 — synthetic data is never Exit evidence);
+- async work-order terminal contract (`gotry_async_terminal.v1`: 4/4 → succeeded / ledger settled / exit 0). Details: [`docs/roadmap.md`](docs/roadmap.md) / [`docs/architecture.md`](docs/architecture.md) §1 and issues #19–#22.
 
 </details>
 
@@ -191,9 +218,16 @@ The authoritative state lives in the docs, not this README: transactional state
 
 ```bash
 ./scripts/run-all-tests.sh
+# Evaluation Phase 0 diagnostic contracts and deterministic cadence planner
+# (offline; no adapter/scheduler/runner/spend/score/Python)
+cd ts
+npx tsx scripts/evaluation-contract-tests.ts
+npx tsx scripts/evaluation-cadence-tests.ts
 ```
 
-One-shot full-stack green (pure TS, no Python needed): golden engines · dialogue replay · cross-process async work-orders · plugin smoke · hbcli · process guards · weather · flights · Anything · probePoi · agent-reach · dual-path stability · time-awareness eval · memory domain · **Z3 race (§30) · realtime pricing (§31) · i18n catalog (§32) · M3 cohort evidence contract (§33) · M4 value evidence contract (§34) · M3 nightly evidence producer contract (§35) · session transport extension bridge (§38) · onboarding UX wizard (§40) · bookable-fact gate (§39)**.
+One-shot full-stack green (pure TS, no Python needed): golden engines · dialogue replay · cross-process async work-orders · plugin smoke · hbcli · process guards · weather · flights · Anything · probePoi · agent-reach · dual-path stability · time-awareness eval · memory domain · **Z3 race (§30)
+- · realtime pricing (§31) · i18n catalog (§32) · M3 cohort evidence contract (§33) · M4 value evidence contract (§34) · M3 nightly evidence producer contract (§35) · session transport extension bridge (§38) · extension onboarding pre-check (§40) · bookable-fact gate (§39)
+- · extension distribution channel (§43) · sf-live static-golden offline contracts (§44) · evaluation foundation and cadence policy (§45–§46) · agent tool-budget Cordis integration + dsh headless E2E (§47)**. The live runner remains `cd ts && npx tsx scripts/sf-live-benchmark.ts --golden=static` and requires the user's connected Chrome session.
 
 ---
 
@@ -211,6 +245,6 @@ Standard open-source flow: branch off latest `main` (`feat/ · fix/ · docs/ ·
 
 ---
 
-**Built with**: DeepSeek Harness 0.1.2-alpha.1 (vendored) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 (`.venv/`) · OpenFlights · TypeScript
+**Built with**: DeepSeek Harness 0.1.2-alpha.3 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 (`.venv/`) · OpenFlights · TypeScript
 
-**Last verified against `v0.0.1-rc.16` (2026-08-30)** — full-stack regression green §1-§42 (release flow: `scripts/publish-npm.sh`).
+**Version baseline: `v0.0.1-rc.16` (2026-08-30).** The current checkout's authoritative verification gates are enumerated by `scripts/run-all-tests.sh` (release flow: `scripts/publish-npm.sh`).

package/README.zh-CN.md

@@ -18,6 +18,9 @@
 ```bash
 npx @danceiny/gotry web
 # 首跑会提示建 .env:LLM_API_KEY=<DeepSeek key 或 OpenAI 兼容 key>
+#   不走 DeepSeek 官方?再配一行 LLM_BASE_URL=<你的端点,一般以 /v1 结尾>
+#   要指定模型(中转而常需要)?配 LLM_MODEL=<模型名>——同时驱动 dsh 会话面
+#   (web/headless)与仓内脚本,并压过你在 dsh web 设置里选过的模型。
 # → 浏览器打开 http://127.0.0.1:3080,像聊天一样说「我想去大理三天」
 ```
 
@@ -29,7 +32,7 @@ npx @danceiny/gotry web
 | 🤖 脚本/一次性问答 | `npx @danceiny/gotry "我想从深圳休整两天,预算 3000"` |
 | 🛠️ 开发者:仓内运行 | 见下方[源码安装](#-快速开始) |
 
-- 前置:Node 22+;一个 LLM API key。零成本启动——dsh 运行时以 cordis patch 自动挂载,无额外配置。
+- 前置:Node 22.15+;一个 LLM API key。任何 OpenAI 兼容端点(MiniMax/中转/自建网关)也可——在 `.env` 另配 `LLM_BASE_URL`(一般以 `/v1` 结尾,如 `https://api.minimax.io/v1`),请求即走它而非 DeepSeek 默认端点。要锁定模型就配 `LLM_MODEL`(如 `MiniMax-M2`):对 dsh 会话面与仓内脚本同时生效,并压过 dsh web 设置里持久化的模型选择;不配则用 dsh 内置默认(`deepseek-v4-flash`)或你在 web 界面的选择。零成本启动——dsh 运行时以 cordis patch 自动挂载,无额外配置。
 - 例外提示:`:3080` 端口被占时先 `kill <PID>`;首启 6–15 秒属正常冷启动;异常退出会留证据到 `gotry-state/incidents.jsonl`(不静默)。
 
 <details>
@@ -37,9 +40,10 @@ npx @danceiny/gotry web
 
 ```bash
 git clone https://github.com/Danceiny/gotry && cd gotry
-cd ts/dsh-runtime && pnpm install && cd ../..    # ① vendored dsh 0.1.2-alpha.1(一次性)
-cp .env.example .env                              # ② 填 LLM_API_KEY
-./gotry web                                       # ③ 仓内入口,同 npm 形态
+npm ci && npm --prefix ts ci                      # ① 安装 root/TS 锁定依赖闭包
+node scripts/build-dist.mjs                       # ② 构建源码检出的 JS runtime
+cp .env.example .env                              # ③ 填 LLM_API_KEY(非 DeepSeek 官方另配 LLM_BASE_URL;锁定模型另配 LLM_MODEL)
+./gotry web                                       # ④ 仓内入口,同 npm 形态
 ```
 
 | 入口 | 命令 | 什么时候用 |
@@ -48,7 +52,7 @@ cp .env.example .env                              # ② 填 LLM_API_KEY
 | headless 一问一答 | `./gotry "一句任务"` | 脚本 / CI / 定向调试 → stdout |
 | help | `./gotry help` | 三行帮助 |
 
-为什么源码模式要先装 runtime:dsh 以 vendored tarball 进 git(`ts/dsh-runtime/`),npm 一键分发不打包它;源码检出读 `.ts` 源码,装完一次重复可用。
+为什么源码模式先装 root/TS 闭包并构建 dist:源码入口与 npm 包都解析同一组 216 个精确直接依赖的 DSH `0.1.2-alpha.3` closure；manifest、package-lock 与 root pnpm importer 必须暴露同一 216 项名称集合，publish preverify 会拒绝漏钉、混版和 range；源码普通运行的 dsh cwd 仍是 `ts/dsh-runtime/`，因此状态继续落 `ts/dsh-runtime/gotry-state/`；benchmark opt-in 与 npm 包运行使用调用目录隔离。`ts/dsh-runtime/` 的旧 vendored runtime 只保留为非 benchmark legacy 解析兼容，不承诺可运行，也不再是推荐安装路径。
 
 </details>
 
@@ -131,7 +135,7 @@ GoTry: 收到。先把约束记下来——
 3. **物理只读** —— ReadGuard 在网络层中止一切写请求(下单/支付在传输层不可达),agent 永不接触凭证与验证码;遇到验证码立即停,交还给你。
 4. **绝不劫持你的浏览器** —— 检索/登录只开自己的独立标签页,登录页置前台、留在你那;例行动测试永不自动开浏览器窗。
 
-> 前置(一次性):安装随包分发的 **GoTry Session Bridge** 浏览器扩展(MV3,约 30 秒):跑 `npx gotry setup` 落位到 `~/.gotry/extension`,再到 Chrome `chrome://extensions` 开启「开发者模式」→「加载已解压的扩展程序」选该目录。装完**零系统弹窗**——扩展只被动转发站点自己发出的检索响应(构造上只读;cookie 只读名字,值永不离开浏览器)。未安装时工具返回 `needs-extension` 并给出指引,不消耗执行配额。(诊断后备:cdp 车道经 `chrome://inspect` 远程调试,`GOTRY_SESSION_TRANSPORT=cdp` 显式开启——注意 Chrome 144+ 每次连接都会弹权限框。)
+> 前置(一次性):去 [Chrome 应用商店](https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd) 点「添加至 Chrome」——这是浏览器的事,不由 gotry 兜(`gotry setup wizard` 不复存在);想用免审核/更新更快的 GitHub 通道见 [docs/extension-webstore-submission.md](docs/extension-webstore-submission.md)。装完**零系统弹窗**——扩展只被动转发站点自己发出的检索响应(构造上只读;cookie 只读名字,值永不离开浏览器)。未安装时工具返回 `needs-extension` 并把商店 URL 作为 dsh UI 的可点链接给出,不消耗执行配额。(诊断后备:cdp 车道经 `chrome://inspect` 远程调试,`GOTRY_SESSION_TRANSPORT=cdp` 显式开启——注意 Chrome 144+ 每次连接都会弹权限框。)
 
 ---
 
@@ -165,7 +169,10 @@ GoTry: 收到。先把约束记下来——
 - **Z3 求解引擎** —— 可行性判定 + 门到门全成本;历史并发竞态已根治(§30 并发回归闸)
 - **实时检索**:机票/火车/酒店(飞猪官方通道)、目的地/酒店目录、天气、航班观测、通航性校验;可选让实时票价覆写进求解(`GOTRY_REALTIME_PRICING=1`)
 - **账号会话检索**:你本人登录态查携程机票,授权与隐私规则见上方 **🔐 账号会话:授权与隐私** 小节
-- **一次性浏览器扩展安装**:`npx gotry setup wizard` 引导你 30 秒装好 GoTry Session Bridge(MV3,扩展 ID 跨机器稳定,会话内零系统弹窗);后台 health-watch 探活,扩展一就位自动重放你的检索,**无需你手动重跑命令**
+- **一次性浏览器扩展安装**:去 [Chrome 应用商店](https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd) 点「添加至 Chrome」(浏览器的事,gotry 不介入);扩展未装时 `gotry_session_search` 返回的 `needs-extension` 由 dsh UI 把商店 URL 渲成可点链接;后台 health-watch 探活,扩展一就位自动重放你的检索,**无需你手动重跑命令**
+- **扩展分发三通道(issue #21,ADR-21)**:同一扩展三个通道——[Chrome 应用商店](https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd)(dsh 用户就走这条:一键装 + 自动更新,2026-09-02 上架);GitHub Releases 通道(免审核、版本更新更快,见 docs/extension-webstore-submission.md);包内副本保离线兜底。商店用自己签名 key 重签,商店版扩展 ID 与 unpacked 固定 ID 不同,本机桥双 Origin 白名单同信(§38 回归)。
+- **会话数据交叉验证(issue #21 / #67)**:8 条 sf-01..sf-08 benchmark query 端到端验证 —— 7/8 verdict=hit / 6/6 manual-golden 软命中 100% / hit 全部 <15s / ReadGuard 零写。对照源可插拔:`--golden=manual`(默认)、`--golden=flyai`、`--golden=static`。static 模式以 OpenFlights ODbL 固定修订提供航线/承运人,叠加手工时刻与价格带；evidence 分开记录请求源/实际源、provenance、estimated fields 与 fallback reason。快照/路由异常会向 stderr 告警后回退 manual。static 是确定性 benchmark 数据,**不是实时班期、票价或库存**。
+- **static 源登录态观测(2026-08-30)**:连续两轮 static official 均 8/8 hit、零 fallback;携程 session hit 从 3/8 波动到 5/8,两轮所有可评分 hit(3+5 条)全部 13/13(100%)。非 hit 均是显式 `miss`,因此 ≥90% 字段分不表述为 8/8 实时可售。同轮修复扩展在线时空闲 parked timer/socket 钉住默认 CLI 桥的生命周期缺口,wizardless `keepBridge` 语义不变(§38:24/24,§40:9/9)。
 - **记忆与触达**:动机画像 / 愿望池 / 同行人 / 旅行时间线;英文输出一键切换(`GOTRY_LOCALE=en`)
 
 **已知限制**(截至 2026-08-29,诚实清单):
@@ -173,6 +180,9 @@ GoTry: 收到。先把约束记下来——
 - ⏳ **M3 Exit 未关闭** —— 工程与分发面就绪,但"真实种子用户"证据(50–200 人 cohort)尚未积累;自动化测试证明的是合同与公式,不是 business pass
 - ⏳ **携程酒店 / 美团的登录态会话适配** —— 机票已通,酒店面等登录态实测回填(下一个 tick)
 - ⏳ **界面语言** —— 英文界面仅覆盖求解确定性输出层;dsh 宿主界面与对话面属宿主/校准件
+- ⏳ **外部 benchmark 泛化 / Phase 1 bridge** —— Round 1 的 exact DeepSeek treatment 为 environment unavailable/schema-invalid（score 0），GLM 为 300 秒超时。Round 2 建立 default-off owner-local bridge；其冻结 treatment 因没有 structured native bridge call 与 tagged JSON，只到 diagnostic-only。Round 3 增加 provider-neutral 的 native call/result/terminal conformance，但新冻结 treatment 仍在 runner 仅派发一次后以 planner/runner exit 1 停止，parent 释放 0 字节终态，evaluator 未进入，official scores 全为 null。Round 4 treatment（SHA `5ebddb2`）primary preflight=pass，但 planner/runner 均在 30.968s 以 exit 1 结束，释放 0 字节，evaluator 未进入，official scores 全为 null。产品 gate 使用 Node v24.20.0，而该 treatment 使用 v26.3.0，因此该结果仅 diagnostic-only，不产生 uplift。GitHub Node 22/24 §48 另暴露 source default-off 30s lifecycle hang。Round 5 仅限移除 timer/keepalive preload、将 root/package DSH closure 锁定为 alpha.3、让 source checkout 优先解析该锁定 runtime、保留源码普通运行的 `ts/dsh-runtime/gotry-state/` 状态连续性、让 benchmark/package 用调用目录隔离、在 spawn 前拒绝非 alpha.3 benchmark runtime、强制 Node 22.15+，并增加 benchmark-only 结构化诊断 pipe（allowlisted redacted reason codes），stdout 继续 fail-closed；其 frozen treatment（代码 SHA `752e54c`）在 140.715 秒后以 `child_nonzero_exit`、0 terminal bytes、evaluator/official scores null 停止，仅 diagnostic-only，后续纯 lock-consistency 提交不改写该 UID 归属。跨 benchmark 证据仍待运行，不声称 external benchmark closure。详见 [`docs/benchmark-environment-bridge.md`](docs/benchmark-environment-bridge.md)。
+- ⏳ **Round 6 结构化终态诊断** —— benchmark 模式只把最终结构化 `turn/end` 投影为闭合、脱敏的模型/运行时原因族；per-session 仲裁最多写一次，且 bridge/conformance 专项原因优先于后续 generic runtime。恢复成功的 transient retry 不写失败；message、raw stderr、路径、prompt、request id 与凭证不跨控制通道。代码 SHA `c61600b` 的 ChinaTravel 冻结 treatment（`..._00001`，`deepseek-v4-flash`）在 49.546 秒后以 `child_runtime_error`、0 terminal bytes、evaluator/official scores null 停止；leakage 与本地凭证/端点扫描均为 0。该证据只改善归因，不产生 score/uplift 结论；后续纯文档 successor 不改写 treatment 归属。
+- ⏳ **Round 7 minimal kernel** —— 代码 SHA `edb9392896625adbb48abae4a2ecf968dbfc0349` 的 benchmark opt-in 仅保留 tool budget、model override、唯一 bridge、isolation/conformance；不装产品 prompt variables、process guards、consent hooks 与普通 GoTry tools，默认路径不变。CLI 将系统人格投影为稳定、task-agnostic persona，root patch 只接受 canonical `insert` 与 `system-prompt` 各一，缺失、重复、quoted、reordered、flow 或其他非 canonical root item 均 fail-closed。ChinaTravel 冻结 treatment UID `e20241028160248698752`（`easy`，`deepseek-v4-flash`）preflight pass 且未回退，80.463 秒后 runner exit 1、terminal 0 bytes/invalid，evaluator 未进入、official null、不可计分；白名单归因为 `child_bridge_runner_failed`，不产生 uplift 或 external benchmark closure。下一轮聚焦 generic bridge tool schema 与可恢复 domain-error contract。
 
 <details>
 <summary>📖 更深的工程状态(账本合同 / 证据合同 / 里程碑口径)</summary>
@@ -204,7 +214,7 @@ GoTry: 收到。先把约束记下来——
 ./scripts/run-all-tests.sh
 ```
 
-全栈一次性绿(纯 TS,无 Python 依赖):engine/journey/unified 金标准 · 对话重放 · 异步工单跨进程 · 插件 smoke · hbcli · 进程护栏(含工具异常隔离)· 天气 · 航班 · Anything · probePoi · agent-reach(web/deep/wrapper)· 双路径稳定性 · 时间感评测(锚点卡/槽位过期校验/评分器/mock 回放;真模型巡检 `time-eval-tests.ts --real`)· 记忆域(动机合并守门/效用 sidecar/只读指标投影)· **Z3 并发竞态(§30)· 实时票价桥(§31)· i18n 目录(§32)· M3 cohort 证据合同(§33)· M4 价值证据合同(§34)· 会话传输扩展桥(§38)· onboarding UX wizard(§40)· 可下单事实闸(§39)**。
+全栈一次性绿(纯 TS,无 Python 依赖):engine/journey/unified 金标准 · 对话重放 · 异步工单跨进程 · 插件 smoke · hbcli · 进程护栏(含工具异常隔离)· 天气 · 航班 · Anything · probePoi · agent-reach(web/deep/wrapper)· 双路径稳定性 · 时间感评测(锚点卡/槽位过期校验/评分器/mock 回放;真模型巡检 `time-eval-tests.ts --real`)· 记忆域(动机合并守门/效用 sidecar/只读指标投影)· **Z3 并发竞态(§30)· 实时票价桥(§31)· i18n 目录(§32)· M3 cohort 证据合同(§33)· M4 价值证据合同(§34)· 会话传输扩展桥(§38)· 扩展 onboarding 静态预检(§40)· 可下单事实闸(§39)· 扩展分发通道(§43)· sf-live static-golden 离线合同(§44)**。真实 runner 为 `cd ts && npx tsx scripts/sf-live-benchmark.ts --golden=static`,仍需用户 Chrome 会话扩展在线。
 
 ---
 
@@ -234,6 +244,6 @@ GoTry: 收到。先把约束记下来——
 
 ---
 
-**Built with**: DeepSeek Harness 0.1.2-alpha.1 (vendored) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 (`.venv/`) · OpenFlights · TypeScript
+**Built with**: DeepSeek Harness 0.1.2-alpha.3 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 (`.venv/`) · OpenFlights · TypeScript
 
-**Last verified against `v0.0.1-rc.16`(2026-08-30)** — 全栈回归全绿 §1-§42(发布流程见 `scripts/publish-npm.sh`)。
+**版本基线:`v0.0.1-rc.16`(2026-08-30)。** 当前 checkout 的权威验证闸以 `scripts/run-all-tests.sh` 实际分节为准(发布流程见 `scripts/publish-npm.sh`)。

package/bin/gotry-booking-copilot.js

@@ -0,0 +1,53 @@
+#!/usr/bin/env node
+/** Standalone, BFF-only Booking Copilot HTTP/SSE service. */
+
+import { existsSync, readFileSync } from 'node:fs'
+import { dirname, join } from 'node:path'
+import { fileURLToPath, pathToFileURL } from 'node:url'
+
+const here = dirname(fileURLToPath(import.meta.url))
+const root = join(here, '..')
+const startupPath = join(root, 'dist/src/booking-surface/startup.js')
+
+function safeError(error) {
+  let message = error instanceof Error ? error.message : String(error)
+  for (const secret of [
+    process.env.GOTRY_BOOKING_COPILOT_API_KEY,
+    process.env.DEEPSEEK_API_KEY,
+    process.env.LLM_API_KEY,
+  ]) {
+    if (secret) message = message.replaceAll(secret, '[REDACTED]')
+  }
+  return message.slice(0, 512)
+}
+
+async function main() {
+  if (!existsSync(startupPath)) throw new Error('booking_copilot_compiled_runtime_missing')
+  const artifactPath = join(root, 'ARTIFACT_ID')
+  if (existsSync(artifactPath)) {
+    const artifactId = readFileSync(artifactPath, 'utf8').trim()
+    if (!/^[0-9a-f]{40}$/.test(artifactId)) throw new Error('booking_copilot_artifact_id_invalid')
+    process.env.GOTRY_BOOKING_COPILOT_ARTIFACT_ID = artifactId
+  }
+  const startup = await import(pathToFileURL(startupPath).href)
+  const config = startup.resolveBookingCopilotStartupConfig(process.env)
+  const handle = await startup.startBookingCopilotFromEnvironment(process.env)
+  process.stderr.write(`[gotry-booking-copilot] listening on http://${config.host}:${handle.port}/a2a/booking-copilot/turn\n`)
+
+  let stopping = false
+  const stop = () => {
+    if (stopping) return
+    stopping = true
+    void handle.close().then(() => process.exit(0), (error) => {
+      process.stderr.write(`[gotry-booking-copilot] shutdown failed: ${safeError(error)}\n`)
+      process.exit(1)
+    })
+  }
+  process.once('SIGINT', stop)
+  process.once('SIGTERM', stop)
+}
+
+main().catch((error) => {
+  process.stderr.write(`[gotry-booking-copilot] startup failed: ${safeError(error)}\n`)
+  process.exitCode = 1
+})

package/bin/gotry-bootstrap.js

@@ -9,13 +9,20 @@
  *                           gotry 产物(工单交付 md/行程 md)的成熟查看面(issue #25)。
  *                           宿主层安装(dsh plugin → ~/.dsh/profiles/web),不进 gotry 依赖。
  *   gotry-session-bridge   → 会话检索浏览器扩展(issue #21 传输层方案 C,2026-08-29 定案):
- *                           一次性安装替代逐连接 CDP 弹窗;幂等拷贝到 ~/.gotry/extension,
- *                           最后一步是用户在 chrome://extensions 「加载已解压的扩展程序」(约 30 秒,零系统弹窗)。
+ *                           一次性安装替代逐连接 CDP 弹窗;已上架 Chrome Web Store
+ *                           (2026-09-02,一键装+自动更新)。**gory 不介入浏览器**——
+ *                           商店页安装是浏览器的事;`gotry setup wizard` 仅作离线检测的
+ *                           进程护栏(打印商店 URL + 健康探活等待),不动剪贴板、
+ *                           不弹 osascript、不 open 浏览器。
  *
  * 用法:
  *   node bin/gotry-bootstrap.js              # 显式安装(缺啥装啥;失败 exit 1)
  *   node bin/gotry-bootstrap.js --auto       # postinstall 模式:CI/跳过开关检测,任何失败不挡安装(exit 0)
  *   node bin/gotry-bootstrap.js --check-only # 只探测报告,不安装(测试钩子)
+ *   node bin/gotry-bootstrap.js --extension-from=github
+ *                                           # 扩展改走 GitHub Releases 下载通道(ADR-21):
+ *                                           #   dist-manifest → tar.gz → SHA256 → key 钉扎 → 原子交换;
+ *                                           #   任何失败显式降级回包内副本(离线确定性不变)。
  *   node bin/gotry-bootstrap.js wizard       # 会话扩展 onboarding 闭环(issue #21 onboarding UX,§3.3):
  *                                           #   5 步编排 + 后台 health-watch 等扩展心跳,
  *                                           #   扩展一就位 stdout 翻绿并自动重放同 query。
@@ -27,11 +34,15 @@
  *   GOTRY_SETUP_REACH=0           跳过 agent-reach
  *   GOTRY_SETUP_SIDEBAR=0         跳过 dsh-better-sidebar
  *   GOTRY_SETUP_EXTENSION=0       跳过会话检索扩展落位
- *   GOTRY_ONBOARDING_HEADLESS=1   wizard 子命令强制走终端面板(SSH/CI 默认探测)
+ *   GOTRY_EXTENSION_SOURCE=github 等效 --extension-from=github(显式 opt-in,默认 bundled)
+ *   GOTRY_EXTENSION_RELEASE_BASE=<url> 下载通道基址覆盖(镜像/测试;缺省 GitHub 官方)
+ *   GOTRY_ONBOARDING_HEADLESS=1   wizard 仅 stdout(SSH/CI 默认探测)
  *
- * 契约:安装外部依赖永远不挡 gotry 本体——能力层各有降级路径(静态包/not-installed
- * verdict),自举失败只降级体验,不产生故障。凭证(hbcli auth / agent-reach 渠道
- * cookie)属用户资产,不自动配置,装完二进制后给指引。
+ * 设计纪律(wizard 子命令,2026-09-02 商店上架后):
+ * **浏览器自己当安装器**——浏览器商店页直达,点「添加至 Chrome」即完事;gotry
+ * 不扮演 GUI/CLI 越界者:不动剪贴板、不动 osascript/zenity/msg、不 open 浏览器。
+ * dsh host UI 是 gotry 工具渲染面,needs-extension 时 URL 走 verdict 字段给 UI
+ * 自渲。wizard 子命令退化为「离线健康探活等待」,只输出 stdout,不挡用户。
  */
 
 import { spawn } from 'node:child_process'
@@ -45,6 +56,10 @@ const AUTO = process.argv.includes('--auto')
 const CHECK_ONLY = process.argv.includes('--check-only')
 const WIZARD = process.argv.includes('wizard') || process.argv.includes('--wizard')
 const WIZARD_DRY_RUN = process.argv.includes('--dry-run')
+// 扩展分发源(ADR-21):默认 bundled(包内副本,离线确定性);github 显式 opt-in
+// (镜像 GOTRY_SESSION_TRANSPORT=cdp 的显式 opt-in 文化——不静默引入网络依赖)
+const EXT_FROM_ARG = (process.argv.find((a) => a.startsWith('--extension-from=')) ?? '').split('=')[1]
+const EXTENSION_FROM = EXT_FROM_ARG === 'github' || EXT_FROM_ARG === 'bundled' ? EXT_FROM_ARG : process.env.GOTRY_EXTENSION_SOURCE === 'github' ? 'github' : 'bundled'
 
 const HBCLI_INSTALL_CMD = 'curl -fsSL https://github.com/hotelbyte-com/docs/releases/latest/download/install.sh | bash'
 const REACH_INSTALL_URL = 'git+https://github.com/Panniantong/Agent-Reach.git'
@@ -188,29 +203,85 @@ async function setupExtension() {
     say(`  ✗ 落位失败(${e.message})——不影响 gotry:会话检索降级;可手动拷贝 ${srcDir} → ${dstDir}`)
     return { ok: false }
   }
-  say(`  ✓ 已落位 ${dstDir}(v${srcVersion};manifest 带固定 key,扩展 ID 恒为 olpgkofjhhiiiahdkkbcninhjmegghfe)`)
-  say('  最后一步(每台浏览器一次,约 30 秒):Chrome 打开 chrome://extensions → 右上角开启「开发者模式」→「加载已解压的扩展程序」→ 选择 ~/.gotry/extension')
+  say(`  ✓ 已落位 ${dstDir}(v${srcVersion};manifest 带固定 key,unpacked 扩展 ID 恒为 olpgkofjhhiiiahdkkbcninhjmegghfe)`)
+  say('  推荐(免下面三步):Chrome 应用商店一键安装 GoTry Session Bridge(自动更新): https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd')
+  say('  本地加载(每台浏览器一次,约 30 秒):Chrome 打开 chrome://extensions → 右上角开启「开发者模式」→「加载已解压的扩展程序」→ 选择 ~/.gotry/extension')
+  say('  获取/更新本地通道扩展可走 GitHub Releases:npx gotry setup --extension-from=github(自动下载校验落位;手动下载: github.com/Danceiny/gotry/releases 标签 ext-*)')
   say('  装好即生效,零系统弹窗;扩展卡片开关=总闸(与 gotry 授权闸 sessionAccess 双重控制)')
   return { ok: true }
 }
 
 /**
- * 调 wizard-bootstrap.ts(wizard.ts 的 CLI 入口):拿 5 步 OnboardingResult 打印到 stdout。
- * tsx 子进程跑 wizard 全套(扩展落位 + 开 Chrome + pbcopy 真实覆写剪贴板 + osascript GUI 面板);
- * bootstrap 不再 inline 任何 spawn——所有 UX 都走 wizard.ts,与 onboarding-tests §40 同一份代码。
- * npm 安装态(无 ts/目录):降级 inline 跑 5 步的最小子集——只调 setupExtension + 打印路径,UI 面板/剪贴板由用户手动。
+ * GitHub Releases 下载通道(ADR-21 分发 A,--extension-from=github 显式 opt-in):
+ * repo 态 spawn tsx CLI(与 wizard/health-watch 同款单行 JSON 回传),npm 态 import dist JS;
+ * 任何失败显式降级 bundled 包内副本——安装外部产物永远不挡 gotry 本体。
+ */
+async function setupExtensionFromGithub() {
+  say('[gotry-setup] GoTry Session Bridge 扩展 · GitHub Releases 下载通道(dist-manifest → tar.gz → SHA256 → key 钉扎)')
+  const destDir = join(homedir(), '.gotry', 'extension')
+  const cliScript = join(repoRoot, 'ts', 'scripts', 'extension-distribution-cli.ts')
+  const releaseBase = process.env.GOTRY_EXTENSION_RELEASE_BASE // 镜像/测试基址覆盖;缺省 GitHub 官方
+  let r = null
+  if (existsSync(cliScript)) {
+    r = await new Promise((resolve) => {
+      const child = spawn('npx', ['--yes', 'tsx', cliScript, '--dest', destDir, '--source-dir', join(repoRoot, 'extension'), ...(releaseBase ? ['--release-base', releaseBase] : []), ...(CHECK_ONLY ? ['--check-only'] : [])], {
+        cwd: join(repoRoot, 'ts'),
+        stdio: ['ignore', 'pipe', 'inherit'],
+      })
+      let buf = ''
+      child.stdout.on('data', (c) => { buf += c.toString('utf8') })
+      child.on('close', () => {
+        const line = (buf.trim().split('\n').pop() ?? '')
+        if (line.startsWith('{')) { try { resolve(JSON.parse(line)); return } catch { /* 落到下一行 */ } }
+        resolve({ ok: false, action: 'fallback-bundled', error: `CLI 无 JSON 输出(末行:${line.slice(0, 120)})` })
+      })
+      child.on('error', (e) => resolve({ ok: false, action: 'fallback-bundled', error: `CLI 启动失败 ${e.message}` }))
+    })
+  } else {
+    try {
+      const mod = await import('../dist/capabilities/session/extension-distribution.js')
+      r = await mod.installExtensionFromGithub({ destDir, pinnedSourceDir: join(repoRoot, 'extension'), ...(releaseBase ? { releaseBase } : {}), checkOnly: CHECK_ONLY })
+    } catch (e) {
+      r = { ok: false, action: 'fallback-bundled', error: `dist 模块不可用:${e.message}` }
+    }
+  }
+  if (r && r.ok) {
+    if (r.action === 'installed') {
+      say(`  ✓ 已从 GitHub Releases 落位 ${destDir}(v${r.version}${r.previousVersion ? `,旧 v${r.previousVersion}` : ''})`)
+      say('  已装过旧版的浏览器:chrome://extensions → GoTry Session Bridge 卡片 → 「重新加载」一次即生效(新装跳过)。')
+      return { ok: true }
+    }
+    // up-to-date(check-only 下远端更新也会走到这里,只报告不落盘)
+    if (r.version != null && r.previousVersion != null && r.version !== r.previousVersion) {
+      say(`  ✓ 远端有新版 v${r.version}(本地 v${r.previousVersion})${CHECK_ONLY ? '(--check-only 只报告)' : ''}`)
+      return { ok: true }
+    }
+    say(`  ✓ 已是最新(v${r.version ?? '?'});若浏览器里尚未加载:chrome://extensions → 开发者模式 → 加载已解压 → 选 ${destDir}`)
+    return { ok: true }
+  }
+  say(`  ✗ GitHub 通道失败(${r && r.error ? r.error : '未知'})——显式降级包内副本:`)
+  return setupExtension()
+}
+
+/**
+ * 调 (npm 安装态降级)只确保扩展落位后跑扩展分支 hydration。wizard.ts 现在
+ * 只做 ensure + watch precheck(Node 端职责),不 spawn 任何 GUI;真正的浏览器
+ * 商店页安装走 dsh UI 渲染的 verdict.installUrl,健康探活走 runHealthWatch。
+ *
+ * 历史:wizard-bootstrap.ts(此文件之前 spawn 的 tsx 子进程)已删除;
+ * run-all §40 onboarding-tests 直接 import wizard.ts 的 runOnboardingWizard。
  */
 async function runWizardBootstrap() {
+  // wizard.ts 已退化为纯 Node 2 步(ensure + watch precheck),不 spawn 任何东西;
+  // tsx 子进程路径 = <repoRoot>/ts;npm 安装态(wizard-bootstrap.ts 已删除)走包内 setupExtension。
   const wizardScript = join(repoRoot, 'ts', 'scripts', 'wizard-bootstrap.ts')
-  const extensionDir = join(homedir(), '.gotry', 'extension')
   if (!existsSync(wizardScript)) {
-    // npm 安装态降级:只确保扩展落位,文案照常打
-    say('[gotry-wizard] 内置 wizard 脚本缺失(已装 npm 包态)——降级手动模式:')
+    say('[gotry-wizard] 内置 wizard 脚本缺失(已装 npm 包态;npm 安装态应在浏览器商店一键装,不需要 wizard 跑落位)——只跑包内扩展落位:')
     await setupExtension()
     return { ok: true }
   }
   return new Promise((resolve) => {
-    const child = spawn('npx', ['--yes', 'tsx', wizardScript, '--extension-dir', extensionDir, '--source-dir', join(repoRoot, 'extension')], {
+    const child = spawn('npx', ['--yes', 'tsx', wizardScript, '--extension-dir', join(homedir(), '.gotry', 'extension'), '--source-dir', join(repoRoot, 'extension')], {
       cwd: join(repoRoot, 'ts'),
       stdio: ['ignore', 'pipe', 'inherit'],
     })
@@ -230,17 +301,17 @@ async function runWizardBootstrap() {
         if (line.startsWith('{')) {
           try {
             const o = JSON.parse(line)
-            // 打印 5 步 status(wizard 自己的 print 已在子进程跑了;此处父进程再 human-friendly 一次)
+            // 打印 2 步 status(wizard 自己的 print 已在子进程跑了;此处父进程再 human-friendly 一次)
             if (Array.isArray(o.steps)) {
               for (const s of o.steps) {
                 const tag = s.status === 'ok' ? '✅' : s.status === 'skip' ? '⏭ ' : '❌'
                 say(`[gotry-wizard] ${tag} ${s.step}: ${s.summary}`)
               }
             }
-            say(`[gotry-wizard] platform=${o.platform}; extensionDir=${o.extensionDir}; ok=${o.ok}`)
+            say(`[gotry-wizard] extensionDir=${o.extensionDir}; ok=${o.ok}`)
             finish({ ok: o.ok === true })
           } catch {
-            say(`[gotry-wizard] ✗ wizard JSON 解析失败`)
+            say('[gotry-wizard] ✗ wizard JSON 解析失败')
             finish({ ok: false })
           }
           try { child.kill('SIGTERM') } catch { /* ignore */ }
@@ -369,49 +440,38 @@ async function runInlineHealthWatch(timeoutMs) {
 }
 
 async function main() {
-  // wizard 子命令(issue #21 onboarding UX,§3.3 / P3.6):扩展安装闭环,5 步 + 后台 health-watch。
-  // **纯 onboarding**,不调 hbcli/agent-reach/sidebar 等其他节——只跑扩展落位 + 健康探活;
-  // 想要全量安装仍走 `npx gotry setup`(无 wizard)。
+  // wizard 子命令(2026-09-02 商店上架后退化):**只走 stdout 提示 + 健康探活等待**;
+  // 不 spawn 任何 GUI 工具(不动 pbcopy / osascript / open / xdg-open / zenity),
+  // 不打开 chrome://extensions,不动扩展路径——浏览器自己当安装器,gotry 不越界。
+  // 期望用户路径:`npx gotry web` → dsh UI → 调 gotry_session_search 遇 needs-extension
+  // → dsh UI 渲商店 URL → 用户点链接 → 装好 → 同会话内自动 retry(health-watch)。
   if (WIZARD) {
     if (WIZARD_DRY_RUN) {
-      say('[gotry-wizard] dry-run 模式(零网络零浏览器,只校验命令编排与输出形态;run-all §40 走这条)')
-      say('  步骤: ensure-extension-files → open-chrome-extensions → clipboard-extension-path → panel-guide → watch-extension-ready')
-      say('  平台: darwin(zh-CN stdout);headless/Linux/Windows 同理降级')
+      say('[gotry-wizard] dry-run(零网络零浏览器零剪贴板;run-all §40 走这条)')
+      say('  步骤: ensure-extension-files → watch-extension-ready(2 步纯 Node 端)')
+      say('  平台: 不依赖 darwin/linux/win32(只 stdout)')
       say('  ✅ exit 0')
       process.exit(0)
     }
-    // 真实路径:spawn tsx 子进程跑 wizard-bootstrap.ts(同一份 wizard.ts 代码),
-    // 拿 5 步 OnboardingResult 打印 status(ok/✅/⏭ /❌)+ 剪贴板/GUI 面板/落位实跑。
-    const wizardResult = await runWizardBootstrap()
-    if (!wizardResult.ok) {
-      say('[gotry-wizard] ✗ wizard 编排有失败步——见上方;扩展未引导到位;可手动 chrome://extensions 加载 ~/.gotry/extension')
-      process.exit(1)
-    }
-    // wizard 闭环:装完扩展就位 stdout 翻「✅ 就绪」(由 health-watch 推动)
     say('')
     say('[gotry-wizard] ────────────────────────────────')
-    say('[gotry-wizard] 共 3 步,约 30 秒,装完零弹窗:')
-    say('[gotry-wizard]   ① Chrome 右上角开启「开发者模式」')
-    say(`[gotry-wizard]   ② 点「加载已解压的扩展程序」,选这个目录(已复制到剪贴板):`)
-    say(`[gotry-wizard]      ${join(homedir(), '.gotry', 'extension')}`)
-    say('[gotry-wizard]   ③ 弹窗「添加扩展」点「添加」')
+    say('[gotry-wizard] GoTry Session Bridge 是浏览器的事——在 Chrome 应用商店一键装:')
+    say('[gotry-wizard]   https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd')
+    say('[gotry-wizard] 装好即生效;装完后我会自动检测到(下方探活等待,最长 120s)。')
+    say('[gotry-wizard] 全过程 gotry 不动你的剪贴板、不开你的 Chrome、不弹任何面板。')
     say('[gotry-wizard] ────────────────────────────────')
-    say('[gotry-wizard] 装好后**无需重跑任何命令**——下面会自动探活,扩展一就位 stdout 翻绿。')
     say('')
-    say('[gotry-wizard] 正在后台探活扩展心跳(最长 120s;Ctrl+C 取消)...')
-    // 后台 health-watch:spawn tsx 子进程跑 health-watch.ts(纯 TS 模块,browser-only),
-    // 探活逻辑与 onboarding-tests §40 同一份代码;无 GUI 依赖。
+    say('[gotry-wizard] 探活中(Ctrl+C 立即退出)…')
+
+    // 健康探活等待:扩展一就位即返回;无 GUI/剪贴板副作用
     const watchResult = await runHealthWatch()
     if (watchResult.ready) {
-      say(`[gotry-wizard] ✅ 扩展就绪(等待 ${watchResult.waitedMs}ms,${watchResult.attempts} 次探活)`)
-      say('[gotry-wizard] 现在调用 gotry_session_search 即可拿到会话检索结果(零后续手工动作)。')
-      say('[gotry-wizard] 入口示例:')
-      say('  ./gotry        # 启动 dsh → 用 gotry_session_search 工具')
-      say('  ./gotry session-check  # 跑 sf-01..08 八条 query 双源 scorer(goal 2)')
+      say(`[gotry-wizard] ✅ 扩展就绪(${watchResult.attempts} 次探活,等待 ${watchResult.waitedMs}ms)`)
+      say('[gotry-wizard] 现在 `npx gotry web` → dsh UI → 调 gotry_session_search 即可拿到结果。')
       process.exit(0)
     } else {
-      say(`[gotry-wizard] ✗ ${watchResult.reason}(${watchResult.attempts} 次探活)——扩展未在 ${watchResult.timeoutMs}ms 内就绪`)
-      say('[gotry-wizard] 重新打开 chrome://extensions 确认「GoTry Session Bridge · 已启用」,再跑 `npx gotry setup wizard` 重试。')
+      say(`[gotry-wizard] ✗ ${watchResult.reason}——未在 ${watchResult.timeoutMs}ms 内就绪`)
+      say('[gotry-wizard] dsh UI 中 `gotry_session_search` 的 needs-extension 仍带商店链接;无需重跑,wizard 完全幂等。')
       process.exit(1)
     }
   }
@@ -420,7 +480,7 @@ async function main() {
     say('[gotry-setup] Windows 暂不支持自动安装(hbcli 上游仅 darwin/linux)。手动指引:')
     say(`  hbcli: ${HBCLI_INSTALL_CMD}(WSL);agent-reach: python -m venv .venv && .venv/Scripts/pip install ${REACH_INSTALL_URL}`)
     say('  dsh-better-sidebar: npx -y --package @deepseek-ai/dsh dsh plugin --profile web add dsh-better-sidebar@latest')
-    say('  GoTry Session Bridge 扩展:手动把包内 extension/ 目录拷到 %USERPROFILE%\\.gotry\\extension,再在 chrome://extensions 开发者模式「加载已解压的扩展程序」')
+    say('  GoTry Session Bridge 扩展:推荐 Chrome 应用商店一键安装 https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd ;本地通道:手动把包内 extension/ 目录拷到 %USERPROFILE%\\.gotry\\extension,再在 chrome://extensions 开发者模式「加载已解压的扩展程序」')
     process.exit(AUTO ? 0 : 1)
   }
   if (AUTO && (process.env.CI || process.env.GOTRY_SETUP_SKIP === '1')) {
@@ -436,7 +496,7 @@ async function main() {
   else say('[gotry-setup] agent-reach:GOTRY_SETUP_REACH=0 跳过')
   if (process.env.GOTRY_SETUP_SIDEBAR !== '0') results.push(await setupSidebar())
   else say('[gotry-setup] dsh-better-sidebar:GOTRY_SETUP_SIDEBAR=0 跳过')
-  if (process.env.GOTRY_SETUP_EXTENSION !== '0') results.push(await setupExtension())
+  if (process.env.GOTRY_SETUP_EXTENSION !== '0') results.push(await (EXTENSION_FROM === 'github' ? setupExtensionFromGithub() : setupExtension()))
   else say('[gotry-setup] GoTry Session Bridge 扩展:GOTRY_SETUP_EXTENSION=0 跳过')
   say('[gotry-setup] flyai:无需安装(npx 每次自拉 @fly-ai/flyai-cli,免 key)')
   const failed = results.filter((r) => !r.ok).length