@danceiny/gotry 0.0.1-rc.9 → 0.2.0-rc.27

package/dist/scripts/gen-lunar-anchors.js

@@ -0,0 +1,106 @@
+/**
+ * 春节锚点表生成器(issue #274,D-9 清偿:手抄常量表已被否决——「换个日子的同款债务」)。
+ *
+ * 用 lunar-typescript(devDependency,MIT,零传递依赖,不进 runtime bundle)在构建期把
+ * 正月初一锚点机械生成到 SPRING_FESTIVAL 表,回写 ../src/time-anchor.ts 的生成块
+ * ([gen:lunar-anchors:begin/end] 标记之间);首次运行会把旧手抄表原位迁移为生成块。
+ * 扩表/换库 = 重跑本命令;表未变则为无 diff 幂等(生成时间只在表真变时刷新)。
+ *
+ * 运行(在 ts/ 下):
+ *   npx tsx scripts/gen-lunar-anchors.ts           # 生成并回写(全离线,不访问网络)
+ *   npx tsx scripts/gen-lunar-anchors.ts --check   # 只比对不写:表/库版本漂移即非零退出
+ *                                                  # (挂 run-all-tests.sh §58 漂移闸)
+ *
+ * 交叉验证不在这里做:2026-2031 旧表 6 条 + 港天文台 2032-2040 核实 9 条已固化为
+ * time-eval §7 的双 oracle 断言(红→绿:生成前 oracle B 必红)。
+ */
+import { readFileSync, writeFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { Lunar } from 'lunar-typescript';
+const TARGET = join(import.meta.dirname, '..', 'src', 'time-anchor.ts');
+const BEGIN = '// [gen:lunar-anchors:begin] 生成块起点——手改会被下次生成覆盖';
+const END = '// [gen:lunar-anchors:end]';
+const START_YEAR = 2026;
+const END_YEAR = 2099;
+/** 正月初一 → 公历 YYYY-MM-DD(lunar-typescript:农历年 y 正月初一 的 Solar)。 */
+function springFestivalOf(lunarYear) {
+    return Lunar.fromYmd(lunarYear, 1, 1).getSolar().toYmd();
+}
+function buildTable() {
+    const table = {};
+    for (let y = START_YEAR; y <= END_YEAR; y++)
+        table[y] = springFestivalOf(y);
+    return table;
+}
+function libVersion() {
+    const pkg = JSON.parse(readFileSync(join(import.meta.dirname, '..', 'node_modules', 'lunar-typescript', 'package.json'), 'utf-8'));
+    return pkg.version;
+}
+function renderBlock(table, generatedAt) {
+    const entries = Object.keys(table).map(y => `  ${y}: '${table[Number(y)]}',`).join('\n');
+    return `/**
+ * 春节锚点表(正月初一;仅此节日漂移大,故表驱动;元旦/国庆固定月日按「下一次发生」算)。
+ * 本块由构建期生成器机械生成,禁止手改(issue #274:手抄常量表=换个日子的同款债务,已否决)。
+ * provenance:lunar-typescript@${libVersion()}(MIT,零传递依赖,devDependency 不进 runtime)· 生成时间 ${generatedAt}
+ * 命令:cd ts && npx tsx scripts/gen-lunar-anchors.ts(扩表/换库=重跑;--check=漂移闸,run-all §58)
+ * 交叉验证:2026-2031 旧表 6 条 + 港天文台 2032-2040 核实 9 条逐条一致(time-eval §7 双 oracle)。
+ * 到期守卫:springFestivalHorizonOk——最晚锚点年份 < 当前年+3 测试即红(临近耗尽先红于静默缺失)。
+ */
+${BEGIN}
+export const SPRING_FESTIVAL: Record<number, string> = {
+${entries}
+}
+${END}`;
+}
+/** 提取文件中现有生成块;无标记则匹配旧手抄声明(含其上一行单行 doc 注释)原位迁移。 */
+function extractExisting(src) {
+    const b = src.indexOf(BEGIN);
+    const e = src.indexOf(END);
+    if (b !== -1 && e !== -1) {
+        const end = e + END.length;
+        return { block: src.slice(b, end), replaceFrom: next => src.slice(0, b) + next + src.slice(end) };
+    }
+    const legacy = src.match(/(?:\/\*\*[^\n]*\*\/\n)?(?:export )?const SPRING_FESTIVAL: Record<number, string> = \{\n(?:  \d{4}: '\d{4}-\d{2}-\d{2}',\n)+\}/);
+    if (!legacy)
+        throw new Error('未找到 SPRING_FESTIVAL 表(既无生成标记也无手抄声明)');
+    const m = legacy[0];
+    return { block: null, replaceFrom: next => src.replace(m, next) };
+}
+/** 从块文本解析 年→日期 映射(--check 与幂等判定用,生成时间/库版本不参与比较)。 */
+function parseTable(block) {
+    const table = {};
+    if (!block)
+        return table;
+    for (const m of block.matchAll(/(\d{4}): '(\d{4}-\d{2}-\d{2})'/g))
+        table[Number(m[1])] = m[2];
+    return table;
+}
+function tablesEqual(a, b) {
+    const ka = Object.keys(a);
+    const kb = Object.keys(b);
+    return ka.length === kb.length && ka.every(k => a[Number(k)] === b[Number(k)]);
+}
+const check = process.argv.includes('--check');
+const table = buildTable();
+const src = readFileSync(TARGET, 'utf-8');
+const { block, replaceFrom } = extractExisting(src);
+if (block && tablesEqual(parseTable(block), table)) {
+    console.log(`lunar-anchors:表已是最新(${START_YEAR}-${END_YEAR},共 ${Object.keys(table).length} 条),无 diff`);
+    process.exit(0);
+}
+const next = renderBlock(table, new Date().toISOString());
+if (check) {
+    console.error(`lunar-anchors:漂移!${TARGET} 与生成器输出不一致(表内容或生成块缺失),应重跑:cd ts && npx tsx scripts/gen-lunar-anchors.ts`);
+    if (block) {
+        const have = parseTable(block);
+        const want = table;
+        for (let y = Math.min(START_YEAR, ...Object.keys(have).map(Number)); y <= END_YEAR; y++) {
+            if (have[y] !== want[y])
+                console.error(`  ${y}: 文件=${have[y] ?? '(缺)'} 生成=${want[y] ?? '(缺)'}`);
+        }
+    }
+    process.exit(1);
+}
+writeFileSync(TARGET, replaceFrom(next));
+const diffYears = Object.keys(table).filter(y => !block || parseTable(block)[Number(y)] !== table[Number(y)]);
+console.log(`lunar-anchors:已回写 ${TARGET}(覆盖 ${START_YEAR}-${END_YEAR},共 ${Object.keys(table).length} 条;本次新增/变更 ${diffYears.length} 条)`);

package/dist/scripts/geo-atlas-tests.js

@@ -0,0 +1,283 @@
+/**
+ * Offline geo-atlas loader contract tests (issue #342, mechanism only —
+ * default off, zero product callers).
+ *
+ * Run: cd ts && npx tsx scripts/geo-atlas-tests.ts
+ *
+ * Fully offline: driven by a small synthetic fixture GeoJSON written to a
+ * temp directory (never the committed build output, never the network). The
+ * offline claim itself is executed: globalThis.fetch is replaced by a
+ * throwing spy for the whole run and asserted to stay at zero calls.
+ */
+import assert from 'node:assert/strict';
+import { createHash } from 'node:crypto';
+import { readFile, mkdir, mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { GEO_ATLAS_MANIFEST_SCHEMA, loadGeoAtlas, lookupById, lookupByName, normalizeAtlasName, } from '../capabilities/geo-atlas.js';
+function sha256(data) {
+    return createHash('sha256').update(Buffer.from(data, 'utf8')).digest('hex');
+}
+const SQUARE = [[[[100.0, 21.0], [102.0, 21.0], [102.0, 25.0], [100.0, 25.0], [100.0, 21.0]]]];
+const OTHER_SQUARE = [[[[11.0, 60.0], [13.0, 60.0], [13.0, 62.0], [11.0, 62.0], [11.0, 60.0]]]];
+function feature(properties, coordinates = SQUARE) {
+    return { type: 'Feature', properties, geometry: { type: 'MultiPolygon', coordinates } };
+}
+const ADMIN_0_FEATURES = [
+    feature({ id: 'CHN', name: 'China', name_zh: '中华人民共和国', admin: 'China', iso_a2: 'CN', iso_a3: 'CHN' }),
+    feature({ id: 'NOR', name: 'Norway', name_zh: '挪威', admin: 'Norway', iso_a2: 'NO', iso_a3: 'NOR' }, OTHER_SQUARE),
+    feature({ id: 'TL', name: 'Testland', admin: 'Testland', iso_a2: 'TX' }),
+];
+const ADMIN_1_FEATURES = [
+    feature({ id: 'CN-YN', name: 'Yunnan', name_zh: '云南省', admin: 'China', iso_a2: 'CN', adm0_a3: 'CHN' }),
+    feature({ id: 'NO-18', name: 'Nordland', admin: 'Norway', iso_a2: 'NO', adm0_a3: 'NOR' }, OTHER_SQUARE),
+    feature({ id: 'TL-NR', name: 'Nordland', admin: 'Testland', iso_a2: 'TX', adm0_a3: 'TL' }),
+];
+const UPSTREAM = { repository: 'https://example.invalid/natural-earth-vector', tag: 'fixture-tag', commit: 'fixture-commit' };
+const LICENSE = 'Natural Earth — public domain (no attribution required)';
+async function writeFixture(dir, options = {}) {
+    const versionDir = join(dir, 'fixture-v1');
+    await mkdir(versionDir, { recursive: true });
+    const admin0Text = options.admin0Text ?? JSON.stringify({ type: 'FeatureCollection', features: ADMIN_0_FEATURES });
+    const admin1Text = options.admin1Text ?? JSON.stringify({ type: 'FeatureCollection', features: ADMIN_1_FEATURES });
+    await writeFile(join(versionDir, 'admin-0.geojson'), admin0Text, 'utf8');
+    await writeFile(join(versionDir, 'admin-1.geojson'), admin1Text, 'utf8');
+    const manifest = {
+        schemaVersion: GEO_ATLAS_MANIFEST_SCHEMA,
+        dataset: 'natural-earth',
+        version: 'fixture-v1',
+        upstream: UPSTREAM,
+        license: { name: LICENSE },
+        build: { fetchedAt: '2026-10-02T00:00:00.000Z' },
+        artifacts: [
+            {
+                layer: 'admin-0',
+                file: 'admin-0.geojson',
+                upstreamUrl: 'https://example.invalid/admin-0.geojson',
+                upstreamSha256: 'a'.repeat(64),
+                recordCount: 3,
+                bytes: Buffer.byteLength(admin0Text),
+                sha256: sha256(admin0Text),
+            },
+            {
+                layer: 'admin-1',
+                file: 'admin-1.geojson',
+                upstreamUrl: 'https://example.invalid/admin-1.geojson',
+                upstreamSha256: 'b'.repeat(64),
+                recordCount: 3,
+                bytes: Buffer.byteLength(admin1Text),
+                sha256: sha256(admin1Text),
+            },
+        ],
+    };
+    await writeFile(join(versionDir, 'manifest.json'), options.manifestText ?? JSON.stringify(manifest, null, 2), 'utf8');
+    return versionDir;
+}
+async function loadOk(dir) {
+    const result = await loadGeoAtlas(dir);
+    assert.equal(result.status, 'ok', `fixture load must succeed, got ${JSON.stringify(result)}`);
+    return result.atlas;
+}
+async function loadErr(dir) {
+    const result = await loadGeoAtlas(dir);
+    assert.equal(result.status, 'error', `fixture load must fail, got ${JSON.stringify(result)}`);
+    return result.reason;
+}
+async function withFixture(name, fn) {
+    const root = await mkdtemp(join(tmpdir(), name));
+    try {
+        await fn(await writeFixture(root));
+    }
+    finally {
+        await rm(root, { recursive: true, force: true });
+    }
+}
+const tests = [];
+tests.push({
+    name: 'green path: SHA-256 verified load, both layers indexed, provenance asserted',
+    fn: async () => {
+        await withFixture('geo-atlas-green-', async (versionDir) => {
+            const atlas = await loadOk(versionDir);
+            assert.equal(atlas.version, 'fixture-v1');
+            assert.equal(atlas.recordCount(), 6);
+            assert.equal(atlas.recordCount('admin-0'), 3);
+            assert.equal(atlas.recordCount('admin-1'), 3);
+            assert.equal(atlas.snapshot.dataset, 'natural-earth');
+            assert.equal(atlas.snapshot.license, LICENSE);
+            assert.deepEqual(atlas.snapshot.upstream, UPSTREAM);
+            assert.equal(atlas.snapshot.fetchedAt, '2026-10-02T00:00:00.000Z');
+            const hit = lookupByName(atlas, 'China');
+            assert.equal(hit.status, 'hit');
+            if (hit.status !== 'hit')
+                return;
+            assert.equal(hit.record.id, 'CHN');
+            assert.equal(hit.record.nameZh, '中华人民共和国');
+            assert.equal(hit.record.geometry.type, 'MultiPolygon');
+            assert.ok(hit.record.geometry.coordinates.length >= 1);
+            assert.equal(hit.record.provenance.layer, 'admin-0');
+            assert.equal(hit.record.provenance.snapshotFile, 'admin-0.geojson');
+            assert.equal(hit.record.provenance.upstreamUrl, 'https://example.invalid/admin-0.geojson');
+            const onDisk = await readFile(join(versionDir, 'admin-0.geojson'), 'utf8');
+            assert.equal(hit.record.provenance.snapshotSha256, sha256(onDisk));
+            assert.equal(hit.snapshot.version, 'fixture-v1');
+        });
+    },
+});
+tests.push({
+    name: 'by-name matches the zh name and normalizes case/whitespace',
+    fn: async () => {
+        await withFixture('geo-atlas-names-', async (versionDir) => {
+            const atlas = await loadOk(versionDir);
+            const zh = lookupByName(atlas, '中华人民共和国');
+            assert.equal(zh.status, 'hit');
+            if (zh.status === 'hit')
+                assert.equal(zh.record.id, 'CHN');
+            const messy = lookupByName(atlas, '   cHina ');
+            assert.equal(messy.status, 'hit');
+            assert.equal(normalizeAtlasName('  YUNNAN '), 'yunnan');
+        });
+    },
+});
+tests.push({
+    name: 'by-id lookup hits with the layer provenance of that record',
+    fn: async () => {
+        await withFixture('geo-atlas-id-', async (versionDir) => {
+            const atlas = await loadOk(versionDir);
+            const hit = lookupById(atlas, 'CN-YN');
+            assert.equal(hit.status, 'hit');
+            if (hit.status !== 'hit')
+                return;
+            assert.equal(hit.record.admin, 'China');
+            assert.equal(hit.record.provenance.layer, 'admin-1');
+            assert.equal(hit.record.provenance.snapshotFile, 'admin-1.geojson');
+            assert.equal(hit.record.provenance.snapshotSha256, sha256(await readFile(join(versionDir, 'admin-1.geojson'), 'utf8')));
+            const country = lookupById(atlas, 'chn');
+            assert.equal(country.status, 'hit');
+        });
+    },
+});
+tests.push({
+    name: 'same-name place → ambiguous with candidates, never a silent pick; layer filter narrows',
+    fn: async () => {
+        await withFixture('geo-atlas-ambig-', async (versionDir) => {
+            const atlas = await loadOk(versionDir);
+            const ambiguous = lookupByName(atlas, 'Nordland');
+            assert.equal(ambiguous.status, 'ambiguous');
+            if (ambiguous.status !== 'ambiguous')
+                return;
+            assert.equal(ambiguous.candidates.length, 2);
+            const ids = ambiguous.candidates.map((c) => c.id).sort();
+            assert.deepEqual(ids, ['NO-18', 'TL-NR']);
+            for (const candidate of ambiguous.candidates) {
+                assert.equal(candidate.layer, 'admin-1');
+                assert.ok(candidate.admin);
+            }
+            assert.match(ambiguous.note, /clarify/i);
+            const narrowed = lookupByName(atlas, 'Nordland', { layer: 'admin-0' });
+            assert.equal(narrowed.status, 'unknown');
+        });
+    },
+});
+tests.push({
+    name: 'unknown region → three-valued miss, snapshot provenance still attached',
+    fn: async () => {
+        await withFixture('geo-atlas-unknown-', async (versionDir) => {
+            const atlas = await loadOk(versionDir);
+            for (const miss of [lookupByName(atlas, 'Atlantis'), lookupById(atlas, 'XX-XX')]) {
+                assert.equal(miss.status, 'unknown');
+                if (miss.status !== 'unknown')
+                    continue;
+                assert.equal(miss.snapshot.version, 'fixture-v1');
+                assert.match(miss.note, /not proof/);
+            }
+            const empty = lookupByName(atlas, '   ');
+            assert.equal(empty.status, 'unknown');
+        });
+    },
+});
+tests.push({
+    name: 'fail-closed: missing/corrupt/invalid manifest, missing/tampered/corrupt/invalid artifact, duplicate id',
+    fn: async () => {
+        const base = await mkdtemp(join(tmpdir(), 'geo-atlas-fail-'));
+        try {
+            const missing = await loadGeoAtlas(join(base, 'no-such-dir'));
+            assert.equal(missing.status, 'error');
+            const rawManifestDir = join(base, 'raw-manifest');
+            await mkdir(rawManifestDir, { recursive: true });
+            await writeFile(join(rawManifestDir, 'manifest.json'), '{not json', 'utf8');
+            assert.equal(await loadErr(rawManifestDir), 'manifest-corrupt');
+            const badSchemaDir = await writeFixture(base, {
+                manifestText: JSON.stringify({ schemaVersion: 'something-else', dataset: 'x', version: 'y', artifacts: [] }),
+            });
+            assert.equal(await loadErr(badSchemaDir), 'manifest-invalid');
+            const missingArtifactDir = await writeFixture(base);
+            await rm(join(missingArtifactDir, 'admin-1.geojson'));
+            assert.equal(await loadErr(missingArtifactDir), 'artifact-missing');
+            // Tamper happens AFTER the manifest is on disk: the snapshot file no
+            // longer matches its recorded SHA-256 (this is the fail-closed seam).
+            const tamperedDir = await writeFixture(base);
+            await writeFile(join(tamperedDir, 'admin-1.geojson'), await readFile(join(tamperedDir, 'admin-1.geojson'), 'utf8') + ' ', 'utf8');
+            assert.equal(await loadErr(tamperedDir), 'artifact-sha-mismatch');
+            const brokenJson = JSON.stringify({ type: 'FeatureCollection', features: ADMIN_1_FEATURES }).slice(0, 40);
+            const corruptArtifactDir = await writeFixture(base, { admin1Text: brokenJson });
+            assert.equal(await loadErr(corruptArtifactDir), 'artifact-corrupt');
+            const shapeDriftText = JSON.stringify({
+                type: 'FeatureCollection',
+                features: [{ type: 'Feature', properties: { id: 'NO-18', name: 'Nordland' } }, ...ADMIN_1_FEATURES.slice(1)],
+            });
+            const shapeDriftDir = await writeFixture(base, { admin1Text: shapeDriftText });
+            assert.equal(await loadErr(shapeDriftDir), 'artifact-invalid');
+            const notACollection = JSON.stringify({ type: 'Feature', geometry: null });
+            const notCollectionDir = await writeFixture(base, { admin0Text: notACollection });
+            assert.equal(await loadErr(notCollectionDir), 'artifact-invalid');
+            const duplicateText = JSON.stringify({
+                type: 'FeatureCollection',
+                features: [...ADMIN_0_FEATURES, feature({ id: 'CHN', name: 'China Duplicate' })],
+            });
+            const duplicateDir = await writeFixture(base, { admin0Text: duplicateText });
+            assert.equal(await loadErr(duplicateDir), 'duplicate-id');
+        }
+        finally {
+            await rm(base, { recursive: true, force: true });
+        }
+    },
+});
+tests.push({
+    name: 'determinism: two loads of the same root answer identically',
+    fn: async () => {
+        await withFixture('geo-atlas-det-', async (versionDir) => {
+            const first = await loadOk(versionDir);
+            const second = await loadOk(versionDir);
+            assert.deepEqual(first.snapshot, second.snapshot);
+            assert.deepEqual(lookupByName(first, 'Yunnan'), lookupByName(second, 'Yunnan'));
+            assert.deepEqual(lookupById(first, 'TL-NR'), lookupById(second, 'TL-NR'));
+        });
+    },
+});
+// The offline spy wraps the entire suite (installed before any test runs and
+// asserted afterwards): zero network is an executed contract, not a claim.
+const realFetch = globalThis.fetch;
+let fetchCalls = 0;
+globalThis.fetch = ((...args) => {
+    fetchCalls += 1;
+    throw new Error(`geo-atlas loader must be offline; fetch called with ${JSON.stringify(args[0])}`);
+});
+let failed = 0;
+for (const test of tests) {
+    try {
+        await test.fn();
+        console.log(`ok - ${test.name}`);
+    }
+    catch (error) {
+        failed += 1;
+        console.error(`FAIL - ${test.name}`);
+        console.error(error);
+    }
+}
+globalThis.fetch = realFetch;
+assert.equal(fetchCalls, 0, `loader made ${fetchCalls} network call(s); offline contract violated`);
+if (failed > 0) {
+    console.error(`${failed} geo-atlas test(s) failed`);
+    process.exit(1);
+}
+console.log(`geo-atlas contract tests: ${tests.length} passed, 0 failed (fetch calls: ${fetchCalls})`);

package/dist/scripts/gotry-backend-kernel-tests.js

@@ -0,0 +1,206 @@
+/**
+ * gotry-backend 内核离线合同测试(路由精确分发/冲突拒装/404/异常隔离/模块鉴权;
+ * 不发真实会话检索——session-search 模块以注入 fake 驱动)。
+ */
+import assert from 'node:assert/strict';
+import { closeBackend, createBackendServer } from '../src/backend/kernel.js';
+import { startSessionSearchModule } from '../src/backend/modules/session-search.js';
+import { resolveGotryBackendPort } from '../src/gotry-backend.js';
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+let pass = 0;
+let fail = 0;
+const check = (cond, label) => {
+    if (cond) {
+        pass += 1;
+        console.log(`  ok - ${label}`);
+    }
+    else {
+        fail += 1;
+        console.log(`  FAIL - ${label}`);
+    }
+};
+async function jfetch(url, init) {
+    const r = await fetch(url, init);
+    let body = null;
+    try {
+        body = await r.json();
+    }
+    catch { /* 空体 */ }
+    return { status: r.status, body };
+}
+async function main() {
+    check(resolveGotryBackendPort({}) === 3082, '统一入口未配置端口时默认 3082');
+    check(resolveGotryBackendPort({ GOTRY_BACKEND_PORT: '0' }) === 0, '统一入口显式端口 0 保留为临时监听');
+    check(resolveGotryBackendPort({ GOTRY_BACKEND_PORT: '3083', GOTRY_BOOKING_COPILOT_PORT: '3999' }) === 3083, '统一入口端口优先级稳定');
+    for (const invalid of ['-1', '1.5', '65536', 'not-a-port']) {
+        assert.throws(() => resolveGotryBackendPort({ GOTRY_BACKEND_PORT: invalid }), /gotry_backend_invalid_port/);
+        pass += 1;
+    }
+    // M1 内核:路由精确分发 + 未知 404 + 异常隔离 500(进程不倒)
+    const okModule = {
+        name: 'fake-ok',
+        routes: [{ method: 'GET', path: '/m1/ping', handle: (_req, res) => { res.setHeader('content-type', 'application/json'); res.end(JSON.stringify({ pong: true })); } }],
+    };
+    const boomModule = {
+        name: 'fake-boom',
+        routes: [{ method: 'GET', path: '/m2/boom', handle: async () => { throw new Error('boom'); } }],
+    };
+    const session = startSessionSearchModule({
+        apiKey: () => 'test-key',
+        search: async () => ({
+            ok: true, via: 'session-dida-portal', evidence: '[会话:dida-portal@test]', latencyMs: 1, verdict: 'hit',
+            rates: [{ hotelName: 'T', roomName: 'R', ratePlanId: 'RP', price: 100, currency: 'CNY', referenceNo: 'REF' }],
+        }),
+    });
+    const handle = await createBackendServer({ modules: [okModule, boomModule, session], port: 0 });
+    const base = `http://127.0.0.1:${handle.port}`;
+    try {
+        const ping = await jfetch(`${base}/m1/ping`);
+        check(ping.status === 200 && ping.body.pong === true, '模块路由精确分发');
+        const nf = await jfetch(`${base}/nope`);
+        check(nf.status === 404 && nf.body.error?.code === 'not_found', '未知路由 404');
+        const boom = await jfetch(`${base}/m2/boom`);
+        check(boom.status === 500 && boom.body.error?.code === 'gotry_backend_module_error', '模块异常隔离 500(服务面不倒)');
+        const afterBoom = await jfetch(`${base}/m1/ping`);
+        check(afterBoom.status === 200, '异常后服务面存活');
+        check(handle.moduleNames.includes('session-search') && handle.moduleNames.includes('fake-ok'), '模块注册表名单');
+        // M2 session-search 模块:鉴权 fail-closed + 注入 fake 检索合同
+        const noAuth = await jfetch(`${base}/v1/session/search`, { method: 'POST', body: '{"supplier":"dida-portal"}' });
+        check(noAuth.status === 403, '无 token 403');
+        const badSupplier = await jfetch(`${base}/v1/session/search`, {
+            method: 'POST',
+            headers: { authorization: 'Bearer test-key', 'content-type': 'application/json' },
+            body: '{"supplier":"ctrip-flight"}',
+        });
+        check(badSupplier.status === 400, '未知供应商通道 400');
+        const hit = await jfetch(`${base}/v1/session/search`, {
+            method: 'POST',
+            headers: { authorization: 'Bearer test-key', 'content-type': 'application/json' },
+            body: '{"supplier":"dida-portal"}',
+        });
+        const hitBody = hit.body;
+        check(hit.status === 200 && hitBody.verdict === 'hit' && hitBody.rates?.[0]?.ratePlanId === 'RP', '注入 fake 检索:结果合同透传');
+        // M2b needs-extension:安装入口是该 verdict 唯一的行动项,hotel-fe#3611
+        const STORE_URL = 'https://chromewebstore.google.com/detail/gotry-session-bridge/oeajpiccmonococjcegddlooeeohlbgd';
+        const extModule = startSessionSearchModule({
+            apiKey: () => 'test-key',
+            search: async () => ({
+                ok: false,
+                via: 'session-dida-portal-error',
+                evidence: '[会话:dida-portal-needs-extension@test]',
+                latencyMs: 1,
+                verdict: 'needs-extension',
+                error: 'GoTry Session Bridge 扩展未连接',
+                installUrl: STORE_URL,
+                installAction: 'add-to-chrome',
+            }),
+        });
+        const extHandle = await createBackendServer({ modules: [extModule], port: 0 });
+        try {
+            const ext = await jfetch(`http://127.0.0.1:${extHandle.port}/v1/session/search`, {
+                method: 'POST',
+                headers: { authorization: 'Bearer test-key', 'content-type': 'application/json' },
+                body: '{"supplier":"dida-portal"}',
+            });
+            const extBody = ext.body;
+            check(ext.status === 200 && extBody.verdict === 'needs-extension', 'needs-extension verdict 透传');
+            check(extBody.installUrl === STORE_URL, '安装链接随 verdict 透出');
+            check(extBody.installAction === 'add-to-chrome', '安装动作随 verdict 透出');
+        }
+        finally {
+            await closeBackend(extHandle, [extModule]).catch(() => { });
+        }
+        // M3 #483:POST search/login 输入守卫。submit / search 注入计数证明
+        // 被拦截请求到达底层 = 0;/m1/ping 作 liveness 探针验证内核未被
+        // unhandledRejection 拖垮。
+        const submitCalls = { count: 0 };
+        const fakeQueue = {
+            extensionConnected: () => true,
+            port: 0,
+            close: async () => undefined,
+            handleMountedRequest: () => undefined,
+            submit: async (job) => {
+                submitCalls.count += 1;
+                submitCalls.lastJob = job;
+                return { ok: true, result: { ok: true, opened: true } };
+            },
+        };
+        let searchCalls = 0;
+        const guardSession = startSessionSearchModule({
+            apiKey: () => 'test-key',
+            search: async () => {
+                searchCalls += 1;
+                return {
+                    ok: true, via: 'session-dida-portal', evidence: '[会话:dida-portal@test]', latencyMs: 1, verdict: 'hit',
+                    rates: [{ hotelName: 'T', roomName: 'R', ratePlanId: 'RP', price: 100, currency: 'CNY', referenceNo: 'REF' }],
+                };
+            },
+            jobQueue: fakeQueue,
+        });
+        const guardHandle = await createBackendServer({ modules: [okModule, guardSession], port: 0 });
+        const guardBase = `http://127.0.0.1:${guardHandle.port}`;
+        const authHeader = { authorization: 'Bearer test-key', 'content-type': 'application/json' };
+        try {
+            const rejectionCases = [
+                { label: 'search body=null', path: '/v1/session/search', body: 'null', expectError: 'body 必须是 JSON 对象' },
+                { label: 'search body=[]', path: '/v1/session/search', body: '[]', expectError: 'body 必须是 JSON 对象' },
+                { label: 'search body=number', path: '/v1/session/search', body: '42', expectError: 'body 必须是 JSON 对象' },
+                { label: 'search body=string', path: '/v1/session/search', body: '"x"', expectError: 'body 必须是 JSON 对象' },
+                { label: 'search body=bool', path: '/v1/session/search', body: 'true', expectError: 'body 必须是 JSON 对象' },
+                { label: 'search supplier=number', path: '/v1/session/search', body: '{"supplier":123}', expectError: 'supplier 必须是字符串' },
+                { label: 'search supplier=null', path: '/v1/session/search', body: '{"supplier":null}', expectError: 'supplier 必须是字符串' },
+                { label: 'search query=string', path: '/v1/session/search', body: '{"supplier":"dida-portal","query":"foo"}', expectError: 'body 必须是 JSON 对象' },
+                { label: 'search query.timeoutMs=string', path: '/v1/session/search', body: '{"supplier":"dida-portal","query":{"timeoutMs":"30"}}', expectError: 'body 必须是 JSON 对象' },
+                { label: 'search query.timeoutMs=Infinity', path: '/v1/session/search', body: '{"supplier":"dida-portal","query":{"timeoutMs":1e309}}', expectError: 'body 必须是 JSON 对象' },
+                { label: 'login body=null', path: '/v1/session/login/open', body: 'null', expectError: 'body 必须是 JSON 对象' },
+                { label: 'login url=number', path: '/v1/session/login/open', body: '{"supplier":"dida-portal","url":123}', expectError: 'url 必须是字符串' },
+                { label: 'login supplier=bool', path: '/v1/session/login/open', body: '{"supplier":true}', expectError: 'supplier 必须是字符串' },
+                { label: 'search 非法 JSON', path: '/v1/session/search', body: '{not-json', expectError: 'body 不是 JSON' },
+                { label: 'login 非法 JSON', path: '/v1/session/login/open', body: '{not-json', expectError: 'body 不是 JSON' },
+            ];
+            for (const c of rejectionCases) {
+                const r = await jfetch(`${guardBase}${c.path}`, { method: 'POST', headers: authHeader, body: c.body });
+                const err = r.body?.error ?? '';
+                check(r.status === 400, `${c.label}:HTTP 400`);
+                check(err === c.expectError, `${c.label}:error 稳定(${c.expectError})`);
+                const live = await jfetch(`${guardBase}/m1/ping`);
+                check(live.status === 200, `${c.label}:拒后 server 存活`);
+            }
+            // 超 64KB 触发 readBody 拒绝;确保不抛错 / 进程不倒。
+            const oversize = 'x'.repeat(64 * 1024 + 16);
+            const rOversize = await jfetch(`${guardBase}/v1/session/search`, { method: 'POST', headers: authHeader, body: oversize });
+            check(rOversize.status === 400 && (rOversize.body?.error ?? '') === 'body 读取失败', 'search 超 64KB:HTTP 400 body 读取失败');
+            const liveOversize = await jfetch(`${guardBase}/m1/ping`);
+            check(liveOversize.status === 200, 'search 超 64KB:拒后 server 存活');
+            check(searchCalls === 0, '所有被拒 search:search 注入 0 次调用');
+            check(submitCalls.count === 0, '所有被拒 login:bridge.submit 0 次调用');
+            // 合法路径需真正穿过守卫、调用底层
+            const validSearch = await jfetch(`${guardBase}/v1/session/search`, {
+                method: 'POST', headers: authHeader, body: '{"supplier":"dida-portal","query":{"entryUrl":"https://portal.dida.com/find","timeoutMs":5000}}',
+            });
+            check(validSearch.status === 200, '合法 search(query 对象含 entryUrl/timeoutMs):200');
+            check(searchCalls === 1, '合法 search:search 注入 +1 次');
+            const validLogin = await jfetch(`${guardBase}/v1/session/login/open`, {
+                method: 'POST', headers: authHeader, body: '{"supplier":"dida-portal","url":"https://portal.dida.com/login"}',
+            });
+            check(validLogin.status === 200, '合法 login/open:200');
+            check(submitCalls.count === 1 && submitCalls.lastJob?.kind === 'open-login', '合法 login:bridge.submit +1 次且 kind=open-login');
+            const offDomain = await jfetch(`${guardBase}/v1/session/login/open`, {
+                method: 'POST', headers: authHeader, body: '{"supplier":"dida-portal","url":"https://evil.example.com/login"}',
+            });
+            check(offDomain.status === 400 && (offDomain.body?.error ?? '').includes('portal.dida.com'), 'login url 域外 400(fail-closed)');
+            check(submitCalls.count === 1, 'login url 域外:bridge.submit 未增');
+        }
+        finally {
+            await closeBackend(guardHandle, [okModule, guardSession]);
+        }
+    }
+    finally {
+        await closeBackend(handle, [okModule, boomModule, session]).catch(() => { });
+    }
+    await sleep(50);
+    console.log(`\nGOTRY BACKEND KERNEL: ${pass} pass, ${fail} fail`);
+    if (fail > 0)
+        process.exitCode = 1;
+}
+void main();