@danceiny/gotry 0.0.1-rc.8 → 0.2.0-rc.27

package/ts/src/itinerary-html.ts

@@ -0,0 +1,171 @@
+/**
+ * 行程 HTML 渲染器(issue #442,父 #438;共享契约层抽取见 issue #564)。
+ *
+ * 纯有界渲染器:拒绝畸形输入,产出单文件自包含 HTML。本模块不执行 IO、
+ * 不启动服务、不解析 Markdown、不做夜数/预算/时间运算——只把显式行程结构
+ * 与已注册事实投影成可导航、可展开的安全文档。
+ *
+ * 输入校验、事实归一化与证据卡渲染的单一事实源在 `itinerary-doc-shared.ts`
+ * (两个文档投影共用,防第二实现漂移);本模块只保留单页文档的排版与组装。
+ *
+ * 两条永不合流的证据面:
+ *   1. 计划面(planner:trip_start/trip_end/stays/od_segments)——用户排期意图;
+ *   2. 证据面(facts:调用方从注册表选出的 BookableFact)——exact-date 查询结论,
+ *      逐条保留 tier/bookability/source/query_id/fetched_at/as_of。
+ * 目的地级酒店库存绝不宣称「某家酒店有房/可订」;无任何整体 verified 徽章。
+ *
+ * 渲染闸锚点纪律:本模块不嵌入 `<!-- fact:<id> -->` 锚点(那属 Markdown 产物闸),
+ * 事实 id 只作为可见文本展示,避免整篇 HTML 被当作锚点行解析。
+ */
+
+import {
+  DOC_BASE_CSS,
+  DOC_NARROW_CSS,
+  EVIDENCE_BOUNDARY_NOTICE,
+  MODE_LABEL,
+  TWO_PLANE_STATEMENT,
+  buildDateIndex,
+  docBytesError,
+  escapeHtml,
+  factIdSlug,
+  hotelFactsForStay,
+  leftoverFacts,
+  normalizeDocInput,
+  renderDateList,
+  renderFact,
+  renderFactCountsLine,
+  renderHotelEvidenceSection,
+  renderHotelNote,
+  renderLeftoverBlock,
+  renderPlannedStay,
+  renderPolicyNote,
+  renderSegment,
+  routeFactsFor,
+  timeEl,
+  type ItineraryDocResult,
+  type NormalizedFact,
+  type NormalizedFlight,
+  type NormalizedHotel,
+  type NormalizedItinerary,
+  type NormalizedPolicy,
+} from './itinerary-doc-shared.ts'
+
+// API 面稳定性:既有消费方(itinerary-artifact.ts / 测试)继续从本模块导入
+export { ITINERARY_DOC_LIMITS as ITINERARY_HTML_LIMITS } from './itinerary-doc-shared.ts'
+export type { ItineraryDocInput as ItineraryHtmlInput, ItineraryDocResult as ItineraryHtmlResult } from './itinerary-doc-shared.ts'
+
+// ---------------------------------------------------------------------------
+// 单页文档排版(组装共享层的内容原语;CSS 为本形态私有)
+// ---------------------------------------------------------------------------
+
+const CSS = DOC_BASE_CSS + `
+.wrap{max-width:64rem;margin:0 auto;padding:1rem}
+header.doc{border-bottom:1px solid var(--line);padding-bottom:.75rem}
+nav.toc{border:1px solid var(--line);border-radius:6px;padding:.6rem .8rem;margin:1rem 0;background:var(--card)}
+nav.toc h2{font-size:1rem}
+nav.toc ul{list-style:none;margin:0;padding:0;display:flex;flex-wrap:wrap;gap:.35rem .9rem}
+nav.toc ul ul{margin-left:.9rem;font-size:.92rem;display:block}
+section{margin:1.75rem 0}
+` + DOC_NARROW_CSS + `
+@media (max-width:480px){
+.wrap{padding:.6rem}
+}`
+
+function render(input: { title: string; itinerary: NormalizedItinerary; facts: NormalizedFact[] }): string {
+  const { title, itinerary, facts } = input
+  const stays = itinerary.stays
+  const segs = itinerary.od_segments
+  const hotelFacts = facts.filter((f): f is NormalizedHotel => f.kind === 'hotel')
+  const policyFacts = facts.filter((f): f is NormalizedPolicy => f.kind === 'policy')
+  const flightFacts = facts.filter((f): f is NormalizedFlight => f.kind === 'flight' || f.kind === 'train')
+
+  const stayBlocks = stays.map((stay, i) => renderPlannedStay(stay, `stay-${i + 1}`, hotelFactsForStay(hotelFacts, stay)))
+  const segBlocks = segs.map((seg, i) => renderSegment(seg, `seg-${i + 1}`, routeFactsFor(facts, seg), itinerary.trip_start))
+
+  const stayDateItems = stays.filter((s, i) => stays.findIndex(x => x.check_in === s.check_in) === i)
+    .map(s => `<li>${timeEl(s.check_in)} — <a href="#stay-${stays.indexOf(s) + 1}">计划住宿 ${escapeHtml(s.place)}</a></li>`)
+    .join('')
+  const segDateItems = [...new Set(segs.map(s => s.date))].sort()
+    .map(d => `<li>${timeEl(d)} — <a href="#segments">交通段</a></li>`)
+    .join('')
+
+  const dateList = renderDateList(buildDateIndex(itinerary))
+  const leftovers = leftoverFacts(facts, itinerary)
+  const leftoverBlock = renderLeftoverBlock(leftovers, itinerary.trip_start)
+  const hotelNote = renderHotelNote(hotelFacts)
+  const policyNote = renderPolicyNote(policyFacts)
+
+  return `<!DOCTYPE html>
+<html lang="zh-CN">
+<head>
+<meta charset="utf-8">
+<meta name="viewport" content="width=device-width, initial-scale=1">
+<meta name="referrer" content="no-referrer">
+<title>${escapeHtml(title)}</title>
+<style>${CSS}</style>
+</head>
+<body>
+<a class="skip" href="#main">跳到主要内容</a>
+<div class="wrap">
+<header class="doc">
+<h1>${escapeHtml(title)}</h1>
+<p>行程 ${timeEl(itinerary.trip_start)} → ${timeEl(itinerary.trip_end)}</p>
+${TWO_PLANE_STATEMENT}
+</header>
+<main id="main">
+${EVIDENCE_BOUNDARY_NOTICE}
+<nav class="toc" aria-label="行程导航">
+<h2>导航</h2>
+<ul>
+<li><a href="#dates">按日期</a><ul>${dateList.startsWith('<p') ? '<li class="muted">无</li>' : ''}</ul></li>
+<li><a href="#segments">航班/交通段</a><ul>${segDateItems || '<li class="muted">无</li>'}</ul></li>
+<li><a href="#stays">住宿</a><ul>${stayDateItems || '<li class="muted">无</li>'}</ul></li>
+<li><a href="#facts">事实与证据</a></li>
+</ul>
+</nav>
+<section id="dates"><h2>按日期行程</h2>
+${dateList}
+</section>
+<section id="segments"><h2>航班/交通段</h2>
+<p class="muted">下列条目是计划段(用户排期意图);每段内另列可回溯到该 route + date 的已注册事实。计划段不因存在事实而变成可下单。</p>
+${segBlocks.join('') || '<p class="muted missing">没有显式交通段。</p>'}
+</section>
+<section id="stays"><h2>住宿</h2>
+${hotelNote}
+${stayBlocks.join('') || '<p class="muted missing">没有显式住宿段。</p>'}
+${renderHotelEvidenceSection(hotelFacts, itinerary.trip_start)}
+</section>
+<section id="facts"><h2>事实与证据</h2>
+${renderFactCountsLine(facts)}
+${policyFacts.map(f => renderFact(f, `policy-${factIdSlug(f.fact.fact_id)}`, itinerary.trip_start)).join('')}
+${policyNote}
+${leftoverBlock}
+<h3>全部航班/车次事实(含负事实与冲突)</h3>
+${flightFacts.map(f => renderFact(f, `flight-${factIdSlug(f.fact.fact_id)}`, itinerary.trip_start)).join('') || '<p class="muted missing">本次输入没有航班/车次事实。</p>'}
+</section>
+</main>
+</div>
+</body>
+</html>
+`
+}
+
+// ---------------------------------------------------------------------------
+// 入口
+// ---------------------------------------------------------------------------
+
+/**
+ * 纯渲染入口。`input` 是任意运行时数据:结构、枚举、真实日历日期、有限数值、
+ * 容量与文档大小全部现场校验;任何一项不合法即返回 `ok:false` + 结构化 errors,
+ * 绝不静默丢弃核心行程后仍返回「成功」。校验与归一化的单一事实源在
+ * `itinerary-doc-shared.ts`,与 deck 投影共用同一拒绝语义。
+ */
+export function renderItineraryHtml(input: unknown): ItineraryDocResult {
+  const normalized = normalizeDocInput(input)
+  if (!normalized.ok) return normalized
+  const html = render(normalized)
+  // 输出大小硬上限:超限即整体失败(检查实现于共享层)
+  const bytesError = docBytesError(html)
+  if (bytesError !== undefined) return { ok: false, errors: bytesError }
+  return { ok: true, html }
+}

package/ts/src/loop.ts

@@ -1,5 +1,5 @@
 /**
- * Stage 1 对话循环(S2 段1,docs/stage1-top-down-design.md §2.3)。
+ * Stage 1 对话循环(S2 段1,docs/design/stage1-top-down-design.md §2.3)。
  *
  * 自顶向下:循环只依赖两个端口——LlmPort(mock/真)与确定性工具(interview_next)。
  * 求解/渲染接线是 S2 后续段;本段验收:重放用户开场白,系统一轮内完成
@@ -8,6 +8,7 @@
 
 import type { InterviewQuestion, TripState, TravelerProfile, Turn, CalendarState, SolveResult } from './contracts.ts'
 import type { JourneySpecTS } from './unified.ts'
+import { buildTimeAnchor, isRealIsoDate, planningWindowBounds, parsePlanningWindow, type PlanningWindow, type TimeAnchor } from './time-anchor.ts'
 import type { TravelSlotExtraction } from './travel-slots.ts'
 import { anythingSearch } from '../capabilities/anything.ts'
 
@@ -95,6 +96,98 @@ export function validateSpec(spec: JourneySpecTS): string | null {
   return null
 }
 
+export interface PlanningWindowRejection {
+  segmentId: string
+  optionId: string
+  date: string
+}
+
+export interface PlanningWindowCheck {
+  spec: JourneySpecTS
+  rejected: PlanningWindowRejection[]
+  error?: string
+}
+
+export interface PlanningWindowOptions {
+  /** Registered feasibility tool opts into the dated-candidate default future floor. */
+  defaultDatedFuture?: boolean
+}
+
+function isoDateInBounds(date: string, bounds: { start: string; end: string }): boolean {
+  const m = date.match(/^(\d{4})-(\d{2})-(\d{2})$/)
+  if (!m || !isRealIsoDate(Number(m[1]), Number(m[2]), Number(m[3]))) return false
+  return date >= bounds.start && date <= bounds.end
+}
+
+function hasDatedCandidates(spec: JourneySpecTS): boolean {
+  return spec.segments.some(segment => segment.date !== undefined || segment.options.some(option => option.date !== undefined))
+}
+
+/**
+ * Enforce a named-year future window at the planner boundary. Historical
+ * lookup/backtesting remains an explicit bypass; an expired named year fails
+ * instead of being silently rolled into a different year.
+ */
+export function applyPlanningWindow(
+  spec: JourneySpecTS,
+  window: PlanningWindow | null,
+  anchor: TimeAnchor,
+  options: PlanningWindowOptions = {},
+): PlanningWindowCheck {
+  // Dated recommendations are future-oriented even without optional named-year context.
+  // Fully dateless legacy calculations remain untouched; historical bypass is explicit.
+  if (window?.intent === 'historical') return { spec, rejected: [] }
+  const implicitFutureFloor = !window && options.defaultDatedFuture === true && hasDatedCandidates(spec)
+  if (!window && !implicitFutureFloor) return { spec, rejected: [] }
+
+  const currentYear = Number(anchor.today.slice(0, 4))
+  if (window && window.requestedYear < currentYear) {
+    return {
+      spec,
+      rejected: [],
+      error: `${window.requestedYear} 年已结束(当前规划参考日 ${anchor.today}),不会自动改用其他年份;如需历史查询请明确说明“历史/回测”。`,
+    }
+  }
+
+  const bounds = window
+    ? planningWindowBounds(window, anchor)
+    : { start: anchor.today, end: '9999-12-31' }
+  if (!bounds) return { spec, rejected: [], error: `无法建立 ${window!.requestedYear} 年的未来规划窗口。` }
+
+  const rejected: PlanningWindowRejection[] = []
+  const guardedSegments = spec.segments.map(segment => ({
+    ...segment,
+    options: segment.options.filter(option => {
+      const date = option.date ?? segment.date
+      if (date && isoDateInBounds(date, bounds)) return true
+      rejected.push({ segmentId: segment.id, optionId: option.id, date: date ?? '未提供明确日期' })
+      return false
+    }),
+  }))
+
+  if (guardedSegments.some(segment => segment.options.length === 0)) {
+    return {
+      spec: { ...spec, segments: guardedSegments },
+      rejected,
+      error: implicitFutureFloor
+        ? `带日期的未来推荐必须不早于当前规划参考日 ${bounds.start};没有带明确日期且在未来窗口内的可接受方案。`
+        : `${window!.requestedYear} 年未来规划窗口为 ${bounds.start} 至 ${bounds.end};没有带明确日期且落在窗口内的可接受方案。`,
+    }
+  }
+  return { spec: { ...spec, segments: guardedSegments }, rejected }
+}
+
+function latestPlanningWindow(history: Turn[], userMsg: string, anchor: TimeAnchor): PlanningWindow | null {
+  const turns = [...history, { role: 'user' as const, text: userMsg }]
+  for (let i = turns.length - 1; i >= 0; i--) {
+    const turn = turns[i]
+    if (turn?.role !== 'user') continue
+    const parsed = parsePlanningWindow(turn.text, anchor)
+    if (parsed) return parsed
+  }
+  return null
+}
+
 /** 求解端口:S3 起由 unified 求解器实现;循环只认此签名(确定性责任)。 */
 export type SolvePort = (spec: JourneySpecTS) => Promise<SolveResult>
 
@@ -110,6 +203,51 @@ export interface AsyncTicket {
   etaLabel: string
 }
 
+export const ASYNC_TERMINAL_SCHEMA = 'gotry_async_terminal.v1' as const
+
+export interface AsyncTerminalOutcome {
+  schema: typeof ASYNC_TERMINAL_SCHEMA
+  ticket_id: string
+  status: 'succeeded' | 'failed'
+  passed: number
+  total: 4
+  checks: Record<string, boolean>
+  failed_checks: string[]
+}
+
+function asyncTerminalOutcome(ticketId: string, checks: Record<string, boolean>): AsyncTerminalOutcome {
+  const failedChecks = Object.entries(checks).filter(([, passed]) => !passed).map(([name]) => name)
+  return {
+    schema: ASYNC_TERMINAL_SCHEMA,
+    ticket_id: ticketId,
+    status: failedChecks.length === 0 ? 'succeeded' : 'failed',
+    passed: Object.values(checks).filter(Boolean).length,
+    total: 4,
+    checks,
+    failed_checks: failedChecks,
+  }
+}
+
+function terminalOutcomeFromState(ticketId: string, state: TripState): AsyncTerminalOutcome {
+  if (!state.spec || !state.solve) {
+    return asyncTerminalOutcome(ticketId, {
+      '1_承诺时间后必有明确产物': false,
+      '2_产物通过自检清单': false,
+      '3_待决问题全部是简单选择题': false,
+      '4_做不到的诚实说': false,
+    })
+  }
+
+  return asyncTerminalOutcome(ticketId, {
+    '1_承诺时间后必有明确产物': Boolean(state.solve.legs?.length || state.solve.verdicts?.length),
+    '2_产物通过自检清单': state.solve.feasible
+      ? (state.solve.legs?.every(l => (l as Record<string, unknown>)['energy_pct'] !== undefined) ?? false)
+      : Boolean(state.solve.unsat_core?.length),
+    '3_待决问题全部是简单选择题': state.gates.every(g => g.id === 'budget' || g.options.length >= 2),
+    '4_做不到的诚实说': state.solve.feasible || Boolean(state.solve.suggestions?.length),
+  })
+}
+
 export function isComplex(state: TripState): boolean {
   /** 复杂度判据(架构占位,后续可细化):多段或多约束即深规划 */
   const p = state.profile
@@ -134,21 +272,19 @@ export async function collectDeepPlanning(
   state: TripState,
   ticket: AsyncTicket,
   solve: SolvePort,
-): Promise<{ reply: string; state: TripState }> {
+): Promise<{ reply: string; state: TripState; outcome: AsyncTerminalOutcome }> {
   const spec = state.spec
-  if (!spec) return { reply: '(内部状态缺失 spec——深度规划未就绪,这是不应发生的路径)', state }
+  if (!spec) {
+    const outcome = terminalOutcomeFromState(ticket.id, state)
+    return { reply: '(内部状态缺失 spec——深度规划未就绪,这是不应发生的路径)', state, outcome }
+  }
   state.solve = await solve(spec)
   state.gates = state.gates.filter(g => !g.id.startsWith('async-'))
 
   // 不失望四条自检(交付物自带,总纲 3.6)
-  const checks = {
-    '1_承诺时间后必有明确产物': Boolean(state.solve.legs?.length || state.solve.verdicts?.length),
-    '2_产物通过自检清单': state.solve.feasible ? (state.solve.legs?.every(l => (l as Record<string, unknown>)['energy_pct'] !== undefined) ?? false) : Boolean(state.solve.unsat_core?.length),
-    '3_待决问题全部是简单选择题': state.gates.every(g => g.id === 'budget' || g.options.length >= 2),
-    '4_做不到的诚实说': state.solve.feasible || Boolean(state.solve.suggestions?.length),
-  }
-  const head = `# 回访交付:${ticket.objective}\n(工单 ${ticket.id},不失望四条:${Object.values(checks).every(Boolean) ? '4/4 ✅' : '有未达项 ❌'})`
-  return { reply: `${head}\n\n${renderSolve(state)}`, state }
+  const outcome = terminalOutcomeFromState(ticket.id, state)
+  const head = `# 回访交付:${ticket.objective}\n(工单 ${ticket.id},不失望四条:${outcome.status === 'succeeded' ? '4/4 ✅' : '有未达项 ❌'})`
+  return { reply: `${head}\n\n${renderSolve(state)}`, state, outcome }
 }
 
 /** 求解结果 → 人话(模板;S4 可由 LLM 润色,数字与判定不可改) */
@@ -158,13 +294,20 @@ export function renderSolve(state: TripState): string {
   const lines: string[] = []
   if (s.feasible) {
     lines.push(`**方案可行,机票合计 ¥${s.money_cny}**`)
-    for (const lg of s.legs ?? []) {
-      const l = lg as Record<string, string | number>
-      lines.push(`- ${l['leg']} ${l['service']}:${l['dep']} 起飞,${l['wake']} 出发,${l['arrive_stay']} 到,`
-        + `门到门 ${l['door_to_door']},落地精力 ${l['energy_pct']}%,¥${l['price_cny']}`)
+    // §7-1 issue #559 卡点 4:从 s.skeleton_notes 字符串编码里推断 unscaffolded 的 seg.id,
+    // 不动 unified.ts/journey.ts(内核冻结面 #234),用户面给 ⚠ 前缀与「枢纽对未在骨架覆盖」补充。
+    // skeleton_notes 单条形态:`<seg.id>: [骨架:openflights] ❌ ...` 或 `<seg.id>: [骨架:openflights] ✅ ...`
+    const unscaffoldedSegIds = new Set<string>()
+    for (const n of s.skeleton_notes ?? []) {
+      const m = /^([^:]+):\s*\[骨架:openflights\]\s*❌/.exec(n)
+      if (m) unscaffoldedSegIds.add(m[1])
     }
-    for (const e of s.work_window_exclusions ?? []) {
-      lines.push(`- 已排除 ${e.option}(工作窗口):${e.reason}`)
+    for (const lg of s.legs ?? []) {
+      const l = lg as Record<string, string | number | boolean>
+      const unscaffoldedFlag = unscaffoldedSegIds.has(String(l['leg'])) ? '⚠ ' : ''
+      const unscaffoldedNote = unscaffoldedSegIds.has(String(l['leg'])) ? '(枢纽对未在骨架覆盖,实时源以新航线为准)' : ''
+      lines.push(`- ${unscaffoldedFlag}${l['leg']} ${l['service']}:${l['dep']} 起飞,${l['wake']} 出发,${l['arrive_stay']} 到,`
+        + `门到门 ${l['door_to_door']},落地精力 ${l['energy_pct']}%,¥${l['price_cny']}${unscaffoldedNote ? ` ${unscaffoldedNote}` : ''}`)
     }
     for (const n of s.skeleton_notes ?? []) lines.push(`- ${n}`)
     for (const f of s.red_flags ?? []) lines.push(`- ⚠️ ${f}`)
@@ -172,6 +315,9 @@ export function renderSolve(state: TripState): string {
     lines.push(`**当前约束下不可行——冲突:${(s.unsat_core ?? []).join('、')}`)
     for (const sg of s.suggestions ?? []) lines.push(`- 放宽「${sg.relax}」可解(约 ¥${sg.money_cny})`)
   }
+  for (const e of s.work_window_exclusions ?? []) {
+    lines.push(`- 已排除 ${e.option}(工作窗口):${e.reason}`)
+  }
   if (state.gates.length) {
     lines.push('', '**待你决定(选择题)**')
     for (const g of state.gates) {
@@ -188,7 +334,9 @@ export async function runTurn(
   llm: LlmPort,
   history: Turn[] = [],
   solve: SolvePort | null = null,
+  now: Date = new Date(),
 ): Promise<{ reply: string; state: TripState }> {
+  const anchor = buildTimeAnchor(now)
   const facts = await llm.extractFacts([...history, { role: 'user', text: userMsg }], state)
 
   const conflicts: string[] = []
@@ -236,7 +384,10 @@ export async function runTurn(
     } else if (ar.verdict === 'miss') {
       parts.push(`**${poiProbe} → miss** (酒店-be Anything 一切正常但无候选)\n${ar.evidence}`)
     } else {
-      parts.push(`**${poiProbe} → unavailable** (${ar.error ?? 'hbcli 不可达'})\n${ar.evidence}`)
+      // 用户面只给人话原因 + 来源 tag:evidence 里的上游原话是溯源契约(能力层测试锁),
+      // 其中的进程噪音(如 `(exit null)`)不该渲染进回复。
+      const sourceTag = ar.evidence.match(/^\[[^\]]+\]/)?.[0]
+      parts.push(`**${poiProbe} → 实时查询不可用**(${ar.error ?? 'hbcli 不可达'})——这条不阻塞本轮规划,只影响实时数据源,其余结论照常带来源标注${sourceTag ? `\n${sourceTag}` : ''}`)
     }
   }
 
@@ -244,7 +395,22 @@ export async function runTurn(
 
   // 约束齐备(无阻塞问题)→ 翻译 spec → **校验闸 + 日期一致性闸** → 求解 → 渲染
   if (blocking.length === 0 && solve) {
-    const spec = await llm.extractSpec([...history, { role: 'user', text: userMsg }], state)
+    const extractedSpec = await llm.extractSpec([...history, { role: 'user', text: userMsg }], state)
+    const planning = latestPlanningWindow(history, userMsg, anchor)
+    const planningCheck = extractedSpec ? applyPlanningWindow(extractedSpec, planning, anchor) : null
+    if (planningCheck?.error) {
+      state.spec = undefined
+      state.solve = undefined
+      parts.push(`⚠️ ${planningCheck.error}`)
+      return { reply: parts.join('\n\n'), state }
+    }
+    if (planningCheck?.rejected.length) {
+      const rejected = planningCheck.rejected
+        .map(r => `${r.segmentId}/${r.optionId}(${r.date})`)
+        .join('、')
+      parts.push(`已排除规划窗口外的候选:${rejected}`)
+    }
+    const spec = planningCheck?.spec ?? extractedSpec
     // 场景路由:erhai 候选标记 → 候选求解(洱海金标准的引擎判定)——纯 TS unify 路径
     if (spec && (spec as unknown as { note?: string }).note === 'erhai-candidates') {
       const { readFile } = await import('node:fs/promises')
@@ -268,11 +434,10 @@ export async function runTurn(
         // D-10 切片 C:spec↔槽位日期一致性闸(ADR-10 翻译≠造数的执行点)。
         // LLM 翻译的 spec 日期与代码层换算的槽位日期分歧时不求解、不猜,追问确认——
         // 日期是求解关键输入,错日期 = 错判决。槽位缺失/unresolved 不参与(不造假阳性)。
-        const ext = await llm.extractSlots([...history, { role: 'user', text: userMsg }])
+        const ext = await llm.extractSlots([...history, { role: 'user', text: userMsg }], now)
         if (ext) {
           const { resolveSlots, specDateMismatches } = await import('./slot-spec.ts')
-          const { buildTimeAnchor } = await import('./time-anchor.ts')
-          const mismatches = specDateMismatches(spec, resolveSlots(ext, buildTimeAnchor()))
+          const mismatches = specDateMismatches(spec, resolveSlots(ext, anchor))
           if (mismatches.length > 0) {
             const lines = mismatches.map(m => `- ${m.specAt}:翻译说 ${m.specDate},你的原话换算是 ${m.slotDate}(${m.field})`)
             parts.push(`⚠️ 日期分歧,确认后我再算(以你为准):\n${lines.join('\n')}`)
@@ -292,42 +457,112 @@ export async function runTurn(
   return { reply: parts.join('\n\n'), state }
 }
 
-// ---- 异步工单持久化(S5 编排半段):真正的「一小时后」必须跨进程存续 ----
-// 请求时落盘(ticket+state 快照);任意后续进程(如 loopx 驱动的 tick)执行
-// async-collect 加载、求解、写回交付物。状态目录属用户数据(红线 6)。
+// ---- 异步工单持久化(S5 编排半段 → ADR-15 durable 工单):真正的「一小时后」必须跨进程存续 ----
+// 权威 = 账本 workflow_runs/workflow_steps(单事务;崩溃后 done 步骤不重执行);
+// {id}.json / {id}.deliverable.md 降级为视图(AGENTS.md 清扫合同 + 人工检视),
+// tmp+rename 原子写——此前裸 writeFile 的非原子缺口(RFC §1.1)就此关闭。
 
 import { join } from 'node:path'
-import { mkdir } from 'node:fs/promises'
-import { readFile, writeFile } from 'node:fs/promises'
+import { mkdir, rename, writeFile, readFile } from 'node:fs/promises'
+import { ensureLedger, openLedgerIfExists, type StateLedger } from './state-ledger.ts'
 
-const ASYNC_DIR = 'gotry-state/async'
+async function asyncDir(stateRoot: string): Promise<string> {
+  const root = stateRoot === '.' ? process.cwd() : stateRoot
+  const dir = join(root, 'gotry-state', 'async')
+  await mkdir(dir, { recursive: true })
+  return dir
+}
 
-async function asyncPath(name: string): Promise<string> {
-  await mkdir(ASYNC_DIR, { recursive: true })
-  return join(ASYNC_DIR, name)
+async function atomicWrite(path: string, text: string): Promise<void> {
+  const tmp = `${path}.tmp`
+  await writeFile(tmp, text, 'utf-8')
+  await rename(tmp, path)
 }
 
-export async function persistAsyncTicket(ticket: AsyncTicket, state: TripState): Promise<string> {
-  const p = await asyncPath(`${ticket.id}.json`)
-  await writeFile(p, JSON.stringify({ ticket, state }, null, 2), 'utf-8')
+export async function persistAsyncTicket(ticket: AsyncTicket, state: TripState, stateRoot = '.'): Promise<string> {
+  const ledger = ensureLedger(stateRoot)
+  ledger.createWorkflowRun({ id: ticket.id, goal: ticket.objective, ticket, state })
+  const dir = await asyncDir(stateRoot)
+  const p = join(dir, `${ticket.id}.json`)
+  await atomicWrite(p, JSON.stringify({ ticket, state }, null, 2))
   return p
 }
 
-export async function loadAsyncTicket(ticketId: string): Promise<{ ticket: AsyncTicket; state: TripState } | null> {
+export async function loadAsyncTicket(ticketId: string, stateRoot = '.'): Promise<{ ticket: AsyncTicket; state: TripState } | null> {
+  // 账本优先;无账本的 root 回退旧 json 文件(只读,兼容存量已交付工单)
+  const ledger = openLedgerIfExists(stateRoot)
+  const run = ledger?.getWorkflowRun(ticketId)
+  if (run) {
+    return {
+      ticket: JSON.parse(run.ticket_json) as AsyncTicket,
+      state: JSON.parse(run.state_json) as TripState,
+    }
+  }
   try {
-    const p = await asyncPath(`${ticketId}.json`)
+    const p = join(await asyncDir(stateRoot), `${ticketId}.json`)
     return JSON.parse(await readFile(p, 'utf-8')) as { ticket: AsyncTicket; state: TripState }
   } catch {
     return null
   }
 }
 
-export async function settleAsyncTicket(ticketId: string, reply: string): Promise<string> {
-  const p = await asyncPath(`${ticketId}.deliverable.md`)
-  await writeFile(p, reply, 'utf-8')
+export async function settleAsyncTicket(
+  ticketId: string,
+  reply: string,
+  stateRoot = '.',
+  outcome?: AsyncTerminalOutcome,
+): Promise<string> {
+  const ledger = openLedgerIfExists(stateRoot)
+  const terminalOutcome = outcome ?? recoverAsyncTerminalOutcome(ledger, ticketId)
+  if (ledger && !terminalOutcome) {
+    throw new Error(`workflow ${ticketId} 缺少可恢复的 ${ASYNC_TERMINAL_SCHEMA}，拒绝误结算`)
+  }
+  if (terminalOutcome?.status === 'failed') ledger?.failWorkflowRun(ticketId, reply, terminalOutcome)
+  else ledger?.settleWorkflowRun(ticketId, reply, terminalOutcome)
+  const dir = await asyncDir(stateRoot)
+  const p = join(dir, `${ticketId}.deliverable.md`)
+  await atomicWrite(p, reply)
   return p
 }
 
+function recoverAsyncTerminalOutcome(ledger: StateLedger | null, ticketId: string): AsyncTerminalOutcome | undefined {
+  if (!ledger) return undefined
+  const run = ledger.getWorkflowRun(ticketId)
+  if (!run) return undefined
+
+  try {
+    const state = JSON.parse(run.state_json) as TripState
+    if (!state.spec) return terminalOutcomeFromState(ticketId, state)
+
+    const solveStep = ledger.getWorkflowStep(ticketId, 'solve')
+    if (solveStep?.status !== 'done' || !solveStep.result) return undefined
+    state.solve = JSON.parse(solveStep.result) as SolveResult
+    state.gates = state.gates.filter(g => !g.id.startsWith('async-'))
+    return terminalOutcomeFromState(ticketId, state)
+  } catch {
+    return undefined
+  }
+}
+
+/**
+ * 可日志化 solve 端口(ADR-15 步骤日志,intent-before-execute):
+ * 先记 intent 再执行,done 后结果落账本——任意进程恢复时 done 的步骤直接复用
+ * 结果不重执行(exactly-once:LLM/求解调用不重复花钱),intent 悬挂的重试。
+ */
+export function makeJournaledSolvePort(ledger: StateLedger, runId: string, solve: SolvePort, opts?: { onRealSolve?: () => void }): SolvePort {
+  return async spec => {
+    const step = ledger.getWorkflowStep(runId, 'solve')
+    if (step?.status === 'done' && step.result) {
+      return JSON.parse(step.result) as Awaited<ReturnType<SolvePort>>
+    }
+    ledger.markStepIntent(runId, 'solve')
+    opts?.onRealSolve?.()
+    const r = await solve(spec)
+    ledger.markStepDone(runId, 'solve', r)
+    return r
+  }
+}
+
 /**
  * probePoi:从 user msg 探测"查 POI/酒店" 信号,返回关键词。
  * 触发的不是关键词,是**结构**;关键词抓取有方向性——
@@ -340,6 +575,9 @@ export async function settleAsyncTicket(ticketId: string, reply: string): Promis
  *     2026-08-28 巡检收紧:旧版 ≤24 直通把访谈答案整句当关键词,垃圾 hbcli 调用+证据噪音)。
  * 不是意图(改求解器),只是 datasources 编排层的"提早调 anything"提示。
  */
+/** 住宿名称段上界:路径 2 已要求含拉丁/数字且被标点截断,旧 24 字会把
+ *  「The Title East Wing Rawai」这类真实酒店名截残后回显给用户(2026-09-22)。 */
+const POI_NAME_MAX = 48
 export function probePoi(msg: string): string | null {
   const trimmed = msg.trim()
   if (!trimmed) return null
@@ -355,7 +593,7 @@ export function probePoi(msg: string): string | null {
   if (/(酒店|民宿|客栈|饭店)/.test(trimmed)) {
     const parts = trimmed.split(/(酒店|民宿|客栈|饭店)/)
     const after = cutAtPunct((parts[2] ?? '').replace(/^[的:：\s]+/, ''))
-    if (after.length >= 2 && /[A-Za-z0-9]/.test(after)) return after.slice(0, 24)
+    if (after.length >= 2 && /[A-Za-z0-9]/.test(after)) return after.length > POI_NAME_MAX ? `${after.slice(0, POI_NAME_MAX - 1)}…` : after
     const nounAt = trimmed.search(/(酒店|民宿|客栈|饭店)/)
     const pre = trimmed.slice(Math.max(0, nounAt - 6), nounAt).match(/[一-龥]{2,6}$/)
     if (pre && !/(机票|车票|和|做|订|的)$/.test(pre[0])) return pre[0]