@danceiny/gotry 0.0.1-rc.21 → 0.0.1-rc.24

package/ts/src/state-ledger.ts

@@ -29,10 +29,11 @@ import { appendTrip as gateTrip, type TimelineEvent } from './travel-timeline.ts
 import { upsertCompanion, type CompanionProfile, type CompanionConstraints } from './companions.ts'
 import type { WishPoolEntry } from './wish-pool.ts'
 
-const SCHEMA_VERSION = '1'
+const SCHEMA_VERSION = '2'
 
 export interface LedgerEventRow {
   seq: number
+  tenant_id: string
   ts: string
   actor: string
   kind: string
@@ -180,11 +181,12 @@ export class StateLedger {
     ts?: string
   }): number | null {
     const stmt = this.db.prepare(
-      `INSERT INTO events (ts, actor, kind, subject_id, payload, idem_key, run_id)
-       VALUES (?, ?, ?, ?, ?, ?, ?)`,
+      `INSERT INTO events (tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?)`,
     )
     try {
       const info = stmt.run(
+        this.tenant,
         ev.ts ?? new Date().toISOString(),
         ev.actor,
         ev.kind,
@@ -201,12 +203,16 @@ export class StateLedger {
   }
 
   readEvents(kind?: string, limit = 100): LedgerEventRow[] {
-    const where = kind ? 'WHERE kind = ?' : ''
-    const rows = this.db.prepare(
-      `SELECT seq, ts, actor, kind, subject_id, payload, idem_key, run_id
-       FROM events ${where} ORDER BY seq DESC LIMIT ?`,
-    ).all(...(kind ? [kind, limit] : [limit])) as LedgerEventRow[]
-    return rows
+    const rows = kind
+      ? this.db.prepare(
+          `SELECT seq, tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id
+           FROM events WHERE tenant_id = ? AND kind = ? ORDER BY seq DESC LIMIT ?`,
+        ).all(this.tenant, kind, limit)
+      : this.db.prepare(
+          `SELECT seq, tenant_id, ts, actor, kind, subject_id, payload, idem_key, run_id
+           FROM events WHERE tenant_id = ? ORDER BY seq DESC LIMIT ?`,
+        ).all(this.tenant, limit)
+    return rows as LedgerEventRow[]
   }
 
   countEvents(): number {
@@ -261,10 +267,12 @@ export class StateLedger {
     saved: boolean
     profile: MergedProfile & { updated_at?: string }
   } {
+    // 事件边界 ISO:事件行的 ts 就是 homeCityPreference.updated_at 的源头,
+    // fold 路径会读同一字段回放——rebuildProjections 必须能复现该值。
     const ts = new Date().toISOString()
     const run = this.db.transaction((): { saved: boolean; profile: MergedProfile & { updated_at?: string } } => {
       const current = this.readMotivation()
-      const merged = mergeProfile(current, patch)
+      const merged = mergeProfile(current, patch, ts)
       if (!merged) {
         const unchanged = { ...(current ?? { weights: {}, evidence: [], hard: {} }), updated_at: current?.updated_at ?? ts } as MergedProfile & { updated_at?: string }
         return { saved: false, profile: unchanged }
@@ -462,7 +470,8 @@ export class StateLedger {
       }
       case 'motivation.patch': {
         const current = this.readMotivation()
-        const merged = mergeProfile(current, p['patch'] as ProfilePatch)
+        // 重建路径:时间戳 = 事件行 row.ts(账本事实);不在 fold 里再读时钟
+        const merged = mergeProfile(current, p['patch'] as ProfilePatch, row.ts)
         if (merged) {
           const doc = { ...merged, updated_at: row.ts }
           this.db.prepare(
@@ -481,7 +490,7 @@ export class StateLedger {
       case 'wish.updated': {
         const id = String(p['wish_id'])
         const patch = (p['patch'] ?? {}) as Record<string, unknown>
-        const rows = this.db.prepare(`SELECT doc FROM projection_items WHERE subject = 'wish_pool' AND item_id = ?`).get(id) as { doc: string } | undefined
+        const rows = this.db.prepare(`SELECT doc FROM projection_items WHERE subject = 'wish_pool' AND item_id = ? AND tenant_id = ?`).get(id, this.tenant) as { doc: string } | undefined
         if (rows) {
           const doc = { ...JSON.parse(rows.doc), ...patch } as WishPoolEntry
           this.upsertItem('wish_pool', id, doc)
@@ -668,7 +677,7 @@ export class StateLedger {
       for (const s of subjects) {
         const placeholders = s.kinds.map(() => '?').join(',')
         const info = this.db.prepare(
-          `DELETE FROM events WHERE subject_id = ? AND tenant_id = ? AND kind IN (${placeholders})`,
+          'DELETE FROM events WHERE subject_id = ? AND tenant_id = ? AND kind IN (' + placeholders + ')',
         ).run(s.subjectId, this.tenant, ...s.kinds)
         deleted += info.changes
       }
@@ -735,11 +744,11 @@ export function openDb(stateRoot: string, tenant = 'local'): StateLedger {
       }
       db.exec(SCHEMA)
       db.pragma('user_version = 2')
-      db.prepare('INSERT INTO kv (k, v) VALUES (?, ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v').run('schema_version', '2')
+      db.prepare('INSERT INTO kv (k, v) VALUES (?, ?) ON CONFLICT(k) DO UPDATE SET v = excluded.v').run('schema_version', SCHEMA_VERSION)
     })()
-    // v1 升级后:从 events 重建投影(v1 投影表已 DROP)
+    // v1 升级后:旧单用户事件只可安全归入 local;即使调用者打开非 local 租户,也只重建 local 投影。
     if (isV1) {
-      const ledger = new StateLedger(db, stateRoot, tenant)
+      const ledger = new StateLedger(db, stateRoot, 'local')
       ledger.rebuildProjections()
     }
   } else {
@@ -782,9 +791,13 @@ export function ensureLedger(stateRoot: string, tenant = 'local'): StateLedger {
       if (existsSync(join(dir, f))) copyFileSync(join(dir, f), join(backupDir, f))
     }
   }
-  const ledger = openDb(stateRoot, tenant)
-  if (hasLegacy) importLegacyInto(ledger, dir)
-  return ledger
+  if (hasLegacy) {
+    // 旧 JSON/JSONL 是单用户本地状态,没有可审计租户归属;迁移边界=只归入 local,绝不按调用 tenant 猜测或搬移。
+    const localLedger = openDb(stateRoot, 'local')
+    importLegacyInto(localLedger, dir)
+    return tenant === 'local' ? localLedger : openDb(stateRoot, tenant)
+  }
+  return openDb(stateRoot, tenant)
 }
 
 function importLegacyInto(ledger: StateLedger, dir: string): MigrationReport['imported'] {
@@ -863,32 +876,37 @@ function readLegacyJsonl<T>(stateRoot: string, name: string): T[] {
   }
 }
 
-export function readMotivationWithFallback(stateRoot: string): (MergedProfile & { updated_at?: string }) | null {
-  const ledger = openLedgerIfExists(stateRoot)
+export function readMotivationWithFallback(stateRoot: string, tenant = 'local'): (MergedProfile & { updated_at?: string }) | null {
+  const ledger = openLedgerIfExists(stateRoot, tenant)
   if (ledger) return ledger.readMotivation()
+  if (tenant !== 'local') return null
   return readLegacyJson<(MergedProfile & { updated_at?: string }) | null>(stateRoot, 'motivation-profile.json', null)
 }
 
-export function readWishPoolWithFallback(stateRoot: string): WishPoolEntry[] {
-  const ledger = openLedgerIfExists(stateRoot)
+export function readWishPoolWithFallback(stateRoot: string, tenant = 'local'): WishPoolEntry[] {
+  const ledger = openLedgerIfExists(stateRoot, tenant)
   if (ledger) return ledger.readWishPool()
+  if (tenant !== 'local') return []
   return readLegacyJson<WishPoolEntry[]>(stateRoot, 'wish-pool.json', [])
 }
 
-export function readUtilityEventsWithFallback(stateRoot: string): MemoryUtilityEvent[] {
-  const ledger = openLedgerIfExists(stateRoot)
+export function readUtilityEventsWithFallback(stateRoot: string, tenant = 'local'): MemoryUtilityEvent[] {
+  const ledger = openLedgerIfExists(stateRoot, tenant)
   if (ledger) return ledger.readUtilityEvents()
+  if (tenant !== 'local') return []
   return readLegacyJsonl<MemoryUtilityEvent>(stateRoot, 'memory-utility.jsonl')
 }
 
-export function readTripsWithFallback(stateRoot: string): TimelineEvent[] {
-  const ledger = openLedgerIfExists(stateRoot)
+export function readTripsWithFallback(stateRoot: string, tenant = 'local'): TimelineEvent[] {
+  const ledger = openLedgerIfExists(stateRoot, tenant)
   if (ledger) return ledger.readTrips()
+  if (tenant !== 'local') return []
   return readLegacyJsonl<TimelineEvent>(stateRoot, 'trips.jsonl')
 }
 
-export function readCompanionsWithFallback(stateRoot: string): CompanionProfile[] {
-  const ledger = openLedgerIfExists(stateRoot)
+export function readCompanionsWithFallback(stateRoot: string, tenant = 'local'): CompanionProfile[] {
+  const ledger = openLedgerIfExists(stateRoot, tenant)
   if (ledger) return ledger.readCompanions()
+  if (tenant !== 'local') return []
   return readLegacyJson<CompanionProfile[]>(stateRoot, 'companions.json', [])
 }

package/ts/src/subagent-job-id-guard.ts

@@ -0,0 +1,72 @@
+/**
+ * Prevent a continuable subagent durable id from entering the jobs tool family.
+ *
+ * dsh deliberately keeps continuable children out of the jobs registry. The
+ * jobs tools therefore cannot distinguish a mistaken durable child id from any
+ * other unknown id once their body runs. GoTry owns the surrounding plugin and
+ * can use dsh's typed pre-execute waterfall to give the model a recoverable,
+ * actionable error before the jobs registry is consulted.
+ */
+import type { Context } from '@deepseek-ai/cordis'
+import type { Agent } from '@deepseek-ai/dsh-agent'
+import type { SessionId } from '@deepseek-ai/dsh-session'
+import type { PreToolDecision, ToolExecution } from '@deepseek-ai/dsh-tools'
+import type { SubagentListEntry, SubagentRuntime } from '@deepseek-ai/dsh-subagent'
+
+const JOB_TOOLS = new Set(['job_output', 'job_kill'])
+
+function subagentsOf(ctx: Context): SubagentRuntime | undefined {
+  try {
+    return (ctx as Context & { subagents?: SubagentRuntime }).subagents
+  } catch {
+    // Minimal hosts and benchmark contexts may not mount the optional service.
+    return undefined
+  }
+}
+
+function jobIdOf(exec: ToolExecution): string | undefined {
+  if (!exec.arguments || typeof exec.arguments !== 'object') return undefined
+  const jobId = (exec.arguments as Record<string, unknown>).job_id
+  return typeof jobId === 'string' && jobId.length > 0 ? jobId : undefined
+}
+
+function isContinuableChild(entry: SubagentListEntry, jobId: string): boolean {
+  return entry.kind === 'child' && entry.mode === 'continuable' && entry.id === jobId
+}
+
+function recoveryReason(toolName: string, jobId: string): string {
+  const stopHint = toolName === 'job_kill'
+    ? '; use interrupt_agent to stop its current turn.'
+    : '.'
+  return [
+    `SUBAGENT_ID_IS_NOT_JOB_ID: ${JSON.stringify(jobId)} is a continuable subagent durable id, not a background job id.`,
+    'Its completion arrives as a completion notice; use list_agents to inspect it and send_message to continue it',
+    stopHint,
+  ].join(' ')
+}
+
+/** Install the GoTry-owned safety net around dsh's jobs tools. */
+export function installSubagentJobIdGuard(ctx: Context): void {
+  const ctxOn = (ctx as unknown as { on?: typeof ctx.on }).on
+  if (typeof ctxOn !== 'function') return
+  ctx.on('tools/pre-execute', async (exec, next): Promise<PreToolDecision> => {
+    if (!JOB_TOOLS.has(exec.name)) return next()
+    const jobId = jobIdOf(exec)
+    const agent = exec.agent as Agent | undefined
+    const subagents = subagentsOf(ctx)
+    if (!jobId || !agent || !subagents) return next()
+
+    let children: SubagentListEntry[]
+    try {
+      children = await subagents.listChildren(agent.id as SessionId, exec.signal)
+    } catch (error) {
+      // The guard is diagnostic, not an alternate ownership or availability
+      // path. Preserve cancellation; otherwise retain dsh's native job error.
+      if (exec.signal.aborted) throw error
+      return next()
+    }
+
+    if (!children.some(entry => isContinuableChild(entry, jobId))) return next()
+    return { kind: 'deny', reason: recoveryReason(exec.name, jobId) }
+  }, { prepend: true })
+}

package/ts/src/time-anchor.ts

@@ -7,8 +7,10 @@
  *  - legacy 抽取路径:dsh-llm.ts 注入 FACTS/SKELETON/槽位抽取 prompt;
  *  - 评测:time-eval-tests.ts 用固定 now(2026-08-27)保证确定性。
  *
- * 债务(architecture §10 登记):节日锚点表 SPRING_FESTIVAL 硬编码(2026-08-28 扩至 2031);
- * 跨 2031 前必须再扩表,否则春节锚点静默缺失。
+ * 节日锚点表 SPRING_FESTIVAL:由构建期生成器机械生成(issue #274 清偿 D-9 手抄债务,覆盖 2026-2099);
+ * 扩表/换库 = 重跑 ts/scripts/gen-lunar-anchors.ts(--check 为漂移闸,run-all §58)。
+ * 到期即红守卫 springFestivalHorizonOk:最晚锚点年份 < 当前年+3 时测试红;表耗尽后锚点卡
+ * 显式告警(不再静默省略)——「换个日子的同款债务」的静默耗尽模式已消灭。
  */
 
 export interface TimeAnchor {
@@ -16,12 +18,30 @@ export interface TimeAnchor {
   today: string
   /** 今天星期几,如「周四」 */
   todayWeekdayZh: string
-  /** 时区标注,如 UTC+8 / UTC+5:30 */
+  /** 时区标注,固定为 UTC±HH:MM,如 UTC+08:00 / UTC+05:30 */
   tzLabel: string
   /** 注入 prompt 的多行锚点卡文本 */
   card: string
 }
 
+export type PlanningDateIntent = 'future' | 'historical'
+
+/**
+ * Named-year planning context. It is derived per turn from the current
+ * TimeAnchor; it is deliberately not part of TripState so a later turn cannot
+ * inherit a stale planning reference date.
+ */
+export interface PlanningWindow {
+  referenceDate: string
+  requestedYear: number
+  intent: PlanningDateIntent
+}
+
+export interface PlanningWindowBounds {
+  start: string
+  end: string
+}
+
 const WEEKDAYS_ZH = ['日', '一', '二', '三', '四', '五', '六'] as const
 
 export function ymd(d: Date): string {
@@ -37,23 +57,116 @@ function weekMonday(d: Date): Date {
   return addDays(d, -((d.getDay() + 6) % 7))
 }
 
-/** 春节锚点表(仅此节日漂移大,硬编码;元旦/国庆固定月日,按「下一次发生」算)。D-9:2026-08-28 扩至 2031 */
-const SPRING_FESTIVAL: Record<number, string> = {
+/**
+ * 春节锚点表(正月初一;仅此节日漂移大,故表驱动;元旦/国庆固定月日按「下一次发生」算)。
+ * 本块由构建期生成器机械生成,禁止手改(issue #274:手抄常量表=换个日子的同款债务,已否决)。
+ * provenance:lunar-typescript@1.8.6(MIT,零传递依赖,devDependency 不进 runtime)· 生成时间 2026-09-11T17:19:45.752Z
+ * 命令:cd ts && npx tsx scripts/gen-lunar-anchors.ts(扩表/换库=重跑;--check=漂移闸,run-all §58)
+ * 交叉验证:2026-2031 旧表 6 条 + 港天文台 2032-2040 核实 9 条逐条一致(time-eval §7 双 oracle)。
+ * 到期守卫:springFestivalHorizonOk——最晚锚点年份 < 当前年+3 测试即红(临近耗尽先红于静默缺失)。
+ */
+// [gen:lunar-anchors:begin] 生成块起点——手改会被下次生成覆盖
+export const SPRING_FESTIVAL: Record<number, string> = {
   2026: '2026-02-17',
   2027: '2027-02-06',
   2028: '2028-01-26',
   2029: '2029-02-13',
   2030: '2030-02-03',
   2031: '2031-01-23',
+  2032: '2032-02-11',
+  2033: '2033-01-31',
+  2034: '2034-02-19',
+  2035: '2035-02-08',
+  2036: '2036-01-28',
+  2037: '2037-02-15',
+  2038: '2038-02-04',
+  2039: '2039-01-24',
+  2040: '2040-02-12',
+  2041: '2041-02-01',
+  2042: '2042-01-22',
+  2043: '2043-02-10',
+  2044: '2044-01-30',
+  2045: '2045-02-17',
+  2046: '2046-02-06',
+  2047: '2047-01-26',
+  2048: '2048-02-14',
+  2049: '2049-02-02',
+  2050: '2050-01-23',
+  2051: '2051-02-11',
+  2052: '2052-02-01',
+  2053: '2053-02-19',
+  2054: '2054-02-08',
+  2055: '2055-01-28',
+  2056: '2056-02-15',
+  2057: '2057-02-04',
+  2058: '2058-01-24',
+  2059: '2059-02-12',
+  2060: '2060-02-02',
+  2061: '2061-01-21',
+  2062: '2062-02-09',
+  2063: '2063-01-29',
+  2064: '2064-02-17',
+  2065: '2065-02-05',
+  2066: '2066-01-26',
+  2067: '2067-02-14',
+  2068: '2068-02-03',
+  2069: '2069-01-23',
+  2070: '2070-02-11',
+  2071: '2071-01-31',
+  2072: '2072-02-19',
+  2073: '2073-02-07',
+  2074: '2074-01-27',
+  2075: '2075-02-15',
+  2076: '2076-02-05',
+  2077: '2077-01-24',
+  2078: '2078-02-12',
+  2079: '2079-02-02',
+  2080: '2080-01-22',
+  2081: '2081-02-09',
+  2082: '2082-01-29',
+  2083: '2083-02-17',
+  2084: '2084-02-06',
+  2085: '2085-01-26',
+  2086: '2086-02-14',
+  2087: '2087-02-03',
+  2088: '2088-01-24',
+  2089: '2089-02-10',
+  2090: '2090-01-30',
+  2091: '2091-02-18',
+  2092: '2092-02-07',
+  2093: '2093-01-27',
+  2094: '2094-02-15',
+  2095: '2095-02-05',
+  2096: '2096-01-25',
+  2097: '2097-02-12',
+  2098: '2098-02-01',
+  2099: '2099-01-21',
 }
+// [gen:lunar-anchors:end]
 
-function tzLabelOf(d: Date): string {
-  const offsetMin = -d.getTimezoneOffset()
-  const sign = offsetMin >= 0 ? '+' : '-'
-  const abs = Math.abs(offsetMin)
+/** 到期即红守卫阈值(issue #274):最晚春节锚点年份必须 ≥ 当前年+3——临近耗尽先红于静默缺失。 */
+export const SPRING_FESTIVAL_HORIZON_MIN_YEARS = 3
+
+/** 表内最晚锚点年份距 now 的年数(守卫与 time-eval §7 共用;旧表「牙齿证明」传表参)。 */
+export function springFestivalHorizonYears(table: Record<number, string>, now: Date = new Date()): number {
+  return Math.max(...Object.keys(table).map(Number)) - now.getFullYear()
+}
+
+/** D-9 到期即红守卫:最晚锚点年份 < 当前年+3 → 测试红(而非春节锚点静默缺失)。 */
+export function springFestivalHorizonOk(now: Date = new Date()): boolean {
+  return springFestivalHorizonYears(SPRING_FESTIVAL, now) >= SPRING_FESTIVAL_HORIZON_MIN_YEARS
+}
+
+export function formatUtcOffsetLabel(utcOffsetMinutes: number): string {
+  const sign = utcOffsetMinutes >= 0 ? '+' : '-'
+  const abs = Math.abs(utcOffsetMinutes)
   const h = Math.floor(abs / 60)
   const m = abs % 60
-  return `UTC${sign}${m === 0 ? h : `${h}:${String(m).padStart(2, '0')}`}`
+  return `UTC${sign}${String(h).padStart(2, '0')}:${String(m).padStart(2, '0')}`
+}
+
+function tzLabelOf(d: Date): string {
+  return formatUtcOffsetLabel(-d.getTimezoneOffset())
 }
 
 function weekdayOf(d: Date): string {
@@ -101,6 +214,7 @@ export function buildTimeAnchor(now: Date = new Date()): TimeAnchor {
   ]
   const spring = Object.values(SPRING_FESTIVAL).filter(d => d >= today).sort()[0]
   if (spring) festivals.push(`春节 ${spring}`)
+  else festivals.push('春节(锚点表已到期:重跑 ts/scripts/gen-lunar-anchors.ts 扩表,勿静默省略)')
 
   const card = [
     `今天 ${today} ${weekdayOf(now)}(时区 ${tzLabelOf(now)})`,
@@ -116,19 +230,109 @@ export function buildTimeAnchor(now: Date = new Date()): TimeAnchor {
   return { today, todayWeekdayZh: weekdayOf(now), tzLabel: tzLabelOf(now), card }
 }
 
+/**
+ * Extract the smallest named-year intent needed by the planning guard.
+ * Relative future years (今年/明年/后年/年内) resolve against the current
+ * TimeAnchor, so a future-tense phrase without a four-digit year still yields
+ * a named-year window. Historical bypass is intentionally narrow: a negated
+ * warning about past dates is not historical lookup, and multiple eligible
+ * years are ambiguous. Same-year restatements (「今年年内」「2026 年内」) are
+ * one window, not a conflict.
+ */
+export function parsePlanningWindow(text: string, anchor: TimeAnchor): PlanningWindow | null {
+  const historical = /(?:回测|复盘|backtest|historical)|(?:历史|过去).{0,8}(?:查询|查|检索|回看|回测|复盘)|(?:查询|查|检索|回看).{0,8}(?:历史|过去)/i.test(text)
+  const anchorYear = Number(anchor.today.slice(0, 4))
+  const relativeYear = (token: string): number =>
+    token === '今年' ? anchorYear : token === '明年' ? anchorYear + 1 : anchorYear + 2
+  const matches: Array<{ year: number; start: number; end: number }> = []
+  for (const m of text.matchAll(/(?<!\d)(\d{4})\s*年/g)) {
+    const start = m.index ?? 0
+    matches.push({ year: Number(m[1]), start, end: start + m[0].length })
+  }
+  for (const m of text.matchAll(/\b(?:in|within|by)\s+(\d{4})\b/gi)) {
+    const start = m.index ?? 0
+    matches.push({ year: Number(m[1]), start, end: start + m[0].length })
+  }
+  for (const m of text.matchAll(/今年|明年|后年/g)) {
+    const start = m.index ?? 0
+    matches.push({ year: relativeYear(m[0]), start, end: start + m[0].length })
+  }
+  for (const m of text.matchAll(/年内/g)) {
+    const start = m.index ?? 0
+    // 「明年年内」「2025 年内」继承紧邻前缀的年份(「年」可已被年份 token 消费);裸「年内」= 锚点当前年
+    const adjacent = text.slice(0, start).match(/(今年|明年|后年|\d{4})\s*年?\s*$/)
+    matches.push({ year: adjacent ? (/^\d{4}$/.test(adjacent[1]!) ? Number(adjacent[1]) : relativeYear(adjacent[1]!)) : anchorYear, start, end: start + m[0].length })
+  }
+  if (matches.some(m => !Number.isInteger(m.year) || m.year < 1_000 || m.year > 9_999)) return null
+  const distinct = [...new Map(matches.map(m => [m.year, m])).values()]
+  if (historical && distinct.length !== 1) return null
+
+  const planningCue = /计划|规划|安排|打算|希望|想在|要在|完成|出行|旅行|预订|预定/i
+  const eligibleYears = new Set(
+    matches
+      .filter(m => {
+        const before = text.slice(Math.max(0, m.start - 24), m.start)
+        const after = text.slice(m.end, m.end + 24)
+        return planningCue.test(before) || /^\s*(?:内|以内|完成|出行|旅行|预订|预定)/i.test(after)
+      })
+      .map(m => m.year),
+  )
+  const selectedYear = eligibleYears.size === 1 ? [...eligibleYears][0]!
+    : (historical && distinct.length === 1 ? distinct[0]!.year : null)
+  if (selectedYear === null) return null
+  return { referenceDate: anchor.today, requestedYear: selectedYear, intent: historical ? 'historical' : 'future' }
+}
+
+export function planningWindowBounds(window: PlanningWindow, anchor: TimeAnchor): PlanningWindowBounds | null {
+  if (window.intent === 'historical') return null
+  const currentYear = Number(anchor.today.slice(0, 4))
+  if (window.requestedYear < currentYear) return null
+  const year = String(window.requestedYear).padStart(4, '0')
+  return {
+    start: window.requestedYear === currentYear ? anchor.today : `${year}-01-01`,
+    end: `${year}-12-31`,
+  }
+}
+
+/** 严格 ISO 校验:YYYY-MM-DD 必须落在真实日历(2026-02-30/2026-13-01 一律拒)。
+ *  复用 Date 月末自动进位:同年/月/day 还原回同一串 = 真日历;否则越界。
+ *  同时拒掉非有限值(NaN/Infinity)与越界月日(1-12/1-31)。
+ *  供 parseAbsoluteDate 词表口径 + hotel-date-gate 终消费层 复用。 */
+export function isRealIsoDate(y: number, m: number, d: number): boolean {
+  if (!Number.isFinite(y) || !Number.isFinite(m) || !Number.isFinite(d)) return false
+  if (m < 1 || m > 12) return false
+  if (d < 1 || d > 31) return false
+  const dt = new Date(y, m - 1, d)
+  return dt.getFullYear() === y && dt.getMonth() === m - 1 && dt.getDate() === d
+}
+
 /**
  * 绝对月日表达 → YYYY-MM-DD(年缺省时按锚点年)。只识别**绝对**表达:
  * ISO(2026-08-01)、数字点分(8.1 / 9.10)、中文(8月5日 / 8月5号)。
+ * 严格校验真日历存在性:2026-02-30 / 2026-13-01 / 2025-02-29 等一律返回 null——
+ * 词表外不一致日期不冒充合法,闸会归 unresolved 拒绝发供应商查询(issue #283 红线)。
  * 相对/模糊表达(下周一/明天/本周三/下个月中旬/近期/Aug-5 英文月名)一律返回 null——
  * 逐字保留给下游,本层不做换算也不做过期判定(与评测 golden 对齐:英文月日不判过期)。
  */
 export function parseAbsoluteDate(expr: string, anchorYear: number): string | null {
   const t = expr.trim()
   let m = t.match(/^(\d{4})-(\d{1,2})-(\d{1,2})$/)
-  if (m) return `${m[1]}-${m[2].padStart(2, '0')}-${m[3].padStart(2, '0')}`
+  if (m) {
+    const y = Number(m[1]); const mo = Number(m[2]); const d = Number(m[3])
+    if (!isRealIsoDate(y, mo, d)) return null
+    return `${m[1]}-${m[2].padStart(2, '0')}-${m[3].padStart(2, '0')}`
+  }
   m = t.match(/^(\d{1,2})[./](\d{1,2})(?:日|号)?$/)
-  if (m) return `${anchorYear}-${m[1].padStart(2, '0')}-${m[2].padStart(2, '0')}`
+  if (m) {
+    const mo = Number(m[1]); const d = Number(m[2])
+    if (!isRealIsoDate(anchorYear, mo, d)) return null
+    return `${anchorYear}-${m[1].padStart(2, '0')}-${m[2].padStart(2, '0')}`
+  }
   m = t.match(/^(\d{1,2})月(\d{1,2})[日号]?$/)
-  if (m) return `${anchorYear}-${m[1].padStart(2, '0')}-${m[2].padStart(2, '0')}`
+  if (m) {
+    const mo = Number(m[1]); const d = Number(m[2])
+    if (!isRealIsoDate(anchorYear, mo, d)) return null
+    return `${anchorYear}-${m[1].padStart(2, '0')}-${m[2].padStart(2, '0')}`
+  }
   return null
 }