@danceiny/gotry 0.0.1-rc.9 → 0.2.0-rc.28

package/dist/scripts/spawn-bounded-abort-tests.js

@@ -0,0 +1,244 @@
+/**
+ * spawn-bounded 取消/进程树回收 E2E(issue #519;真实进程,非 mock):
+ *   1. pre-aborted signal → 零 spawn;
+ *   2. 启动真父子(父忽略 SIGTERM、持续 spawn 孙)→ abort →
+ *      父与孙均被杀,有界等待,结果语义 aborted;
+ *   3. 超时 → SIGKILL 进程树;
+ *   4. abort 不触发候选重试(直接 callHbcliJson 双候选场景验证)。
+ * 全程临时目录 fixture,结束前 kill -0 复核并兜底清理同根 pid。
+ * 运行: cd ts && npx tsx scripts/spawn-bounded-abort-tests.ts
+ */
+import assert from 'node:assert/strict';
+import { existsSync, mkdtempSync, readFileSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { spawnBounded } from '../capabilities/spawn-bounded.js';
+import { callHbcliJson, searchHotels } from '../capabilities/hbcli.js';
+import { anythingSearch } from '../capabilities/anything.js';
+// issue #617:本套件要真起 fake hbcli(进程树回收证明),而 `GOTRY_HBCLI_LIVE=0 ./scripts/run-all-tests.sh`
+// 会把 anythingSearch 的离线开关带进来——此处显式开启,不让外部环境改变进程回收断言的对象。
+delete process.env['GOTRY_HBCLI_LIVE'];
+const root = mkdtempSync(join(tmpdir(), 'gotry-519-abort-'));
+const ownedPids = new Set();
+let activeWork;
+let activeAbort;
+const waitForFile = async (path, label, boundMs = 5_000) => {
+    let settled = false;
+    let outcome;
+    activeWork?.then(value => { settled = true; outcome = value; }, error => { settled = true; outcome = String(error); });
+    const deadline = Date.now() + boundMs;
+    while (!existsSync(path) && !settled && Date.now() < deadline) {
+        await new Promise(r => setTimeout(r, 10));
+    }
+    assert.ok(existsSync(path), `${label} ready handshake failed within ${boundMs}ms; settled=${settled}; outcome=${JSON.stringify(outcome)}`);
+};
+const pidAlive = (pid) => {
+    try {
+        process.kill(pid, 0);
+        return true;
+    }
+    catch {
+        return false;
+    }
+};
+const waitForPidDead = async (pid, boundMs = 1_500) => {
+    const deadline = Date.now() + boundMs;
+    while (pidAlive(pid) && Date.now() < deadline) {
+        await new Promise(r => setTimeout(r, 10));
+    }
+    assert.equal(pidAlive(pid), false, `owned pid ${pid} survived cleanup bound`);
+};
+const cleanupOwnedProcesses = () => {
+    for (const pid of ownedPids) {
+        try {
+            process.kill(pid, 'SIGKILL');
+        }
+        catch { /* already exited */ }
+    }
+};
+try {
+    const marker = join(root, 'started');
+    const preabortBin = join(root, 'preabort.js');
+    writeFileSync(preabortBin, `#!${process.execPath}
+const fs=require('node:fs');fs.writeFileSync(${JSON.stringify(marker)},'started');console.log('{}');`, { mode: 0o700 });
+    // 1) pre-aborted:零 spawn
+    const pre = new AbortController();
+    pre.abort();
+    const preResult = await spawnBounded(preabortBin, [], { env: process.env, timeoutMs: 1000, signal: pre.signal });
+    assert.equal(preResult.aborted, true, JSON.stringify(preResult));
+    assert.equal(preResult.groupReaped, true);
+    assert.equal(existsSync(marker), false, 'pre-aborted signal must produce zero spawn');
+    // 经 callHbcliJson(带 fallback 候选语义)同样零 spawn、不触发候选
+    const preViaApi = await callHbcliJson([], { hbcliBin: preabortBin, timeoutMs: 1000, signal: pre.signal });
+    assert.equal(preViaApi.via, 'hbcli-error');
+    assert.equal(/abort/.test(preViaApi.error ?? ''), true, preViaApi.error);
+    assert.equal(existsSync(marker), false, 'callHbcliJson pre-aborted must not spawn either');
+    const preViaSearch = await searchHotels({ destination: '普吉岛' }, { hbcliBin: preabortBin, fallbackPath: join(root, 'missing-fallback.json'), signal: pre.signal });
+    assert.match(preViaSearch.summary, /检索已取消/);
+    assert.doesNotMatch(preViaSearch.summary, /静态包/);
+    // 2) 真父子进程树:父捕获 SIGTERM 不退出、孙独立常驻
+    const childBin = join(root, 'descendant.js');
+    const parentBin = join(root, 'parent.js');
+    const pidsFile = join(root, 'pids.json');
+    const readyFile = join(root, 'ready');
+    writeFileSync(childBin, `setInterval(()=>{},1000)\n`);
+    writeFileSync(parentBin, `#!${process.execPath}
+const {spawn}=require('node:child_process');const fs=require('node:fs');
+process.on('SIGTERM',()=>{});
+const c=spawn(process.execPath,[${JSON.stringify(childBin)}]);
+fs.writeFileSync(${JSON.stringify(pidsFile)},JSON.stringify({parent:process.pid,child:c.pid}));
+fs.writeFileSync(${JSON.stringify(readyFile)},'ready');
+setInterval(()=>{},1000);`, { mode: 0o700 });
+    const abort = new AbortController();
+    activeAbort = abort;
+    const work = spawnBounded(parentBin, [], { env: process.env, timeoutMs: 10_000, signal: abort.signal });
+    activeWork = work;
+    await waitForFile(readyFile, 'process tree');
+    const ids = JSON.parse(readFileSync(pidsFile, 'utf8'));
+    ownedPids.add(ids.parent);
+    ownedPids.add(ids.child);
+    const abortStarted = Date.now();
+    abort.abort();
+    const result = await work;
+    activeWork = undefined;
+    activeAbort = undefined;
+    const recycleElapsed = Date.now() - abortStarted;
+    assert.equal(result.aborted, true, JSON.stringify(result));
+    assert.equal(result.timedOut, false);
+    assert.equal(result.groupReaped, true, JSON.stringify(result));
+    // 有界回收:TERM_GRACE(500)+ 观测窗,父忽略 SIGTERM 由 SIGKILL 兜底
+    assert.ok(recycleElapsed < 3_000, `abort bounded wait exceeded: ${recycleElapsed}ms`);
+    assert.equal(pidAlive(ids.parent), false, 'parent survived abort');
+    assert.equal(pidAlive(ids.child), false, 'descendant survived abort — kill of parent pid is not tree cleanup');
+    // 2a) 脱离进程组的自有子进程继续持有 stdout/stderr:close 不应无限等待。
+    //     child 设 20s 自退只用于让旧实现稳定红灯；finally 仍按已知 PID 立即清理并读回。
+    const escapedBin = join(root, 'escaped-child.js');
+    const escapedParentBin = join(root, 'escaped-parent.js');
+    const escapedPidsFile = join(root, 'escaped-pids.json');
+    const escapedReadyFile = join(root, 'escaped-ready');
+    writeFileSync(escapedBin, `setInterval(()=>{},1000);setTimeout(()=>process.exit(0),20000);\n`);
+    writeFileSync(escapedParentBin, `#!${process.execPath}
+const {spawn}=require('node:child_process');const fs=require('node:fs');
+const c=spawn(process.execPath,[${JSON.stringify(escapedBin)}],{detached:true,stdio:['ignore','inherit','inherit']});
+c.unref();
+fs.writeFileSync(${JSON.stringify(escapedPidsFile)},JSON.stringify({child:c.pid}));
+fs.writeFileSync(${JSON.stringify(escapedReadyFile)},'ready');
+process.on('SIGTERM',()=>process.exit(0));
+setInterval(()=>{},1000);`, { mode: 0o700 });
+    const escapedAbort = new AbortController();
+    activeAbort = escapedAbort;
+    // Startup has its own 5s readiness bound. Schedule abort 1s before the ordinary
+    // 10s timeout so both timers still overlap the 2.5s drain window, even on a cold host.
+    const escapedSpawnStarted = Date.now();
+    const escapedWork = spawnBounded(escapedParentBin, [], { env: process.env, timeoutMs: 10_000, signal: escapedAbort.signal });
+    activeWork = escapedWork;
+    await waitForFile(escapedReadyFile, 'escaped process');
+    const escapedIds = JSON.parse(readFileSync(escapedPidsFile, 'utf8'));
+    ownedPids.add(escapedIds.child);
+    // Abort precedes the ordinary timeout; that later timer must not change the cause or extend cleanup.
+    await new Promise(r => setTimeout(r, Math.max(0, escapedSpawnStarted + 9_000 - Date.now())));
+    assert.ok(Date.now() - escapedSpawnStarted < 10_000, 'fixture must abort before the ordinary timeout');
+    const escapedStarted = Date.now();
+    escapedAbort.abort();
+    const escapedResult = await escapedWork;
+    activeWork = undefined;
+    activeAbort = undefined;
+    const escapedElapsed = Date.now() - escapedStarted;
+    assert.ok(escapedElapsed < 3_000, `escaped-pipe settlement exceeded bound: ${escapedElapsed}ms`);
+    assert.equal(escapedResult.aborted, true, JSON.stringify(escapedResult));
+    assert.equal(escapedResult.groupReaped, false, JSON.stringify(escapedResult));
+    assert.match(escapedResult.error ?? '', /cleanup incomplete/, JSON.stringify(escapedResult));
+    assert.equal(pidAlive(escapedIds.child), true, 'escaped child should remain for explicit finally cleanup');
+    try {
+        process.kill(escapedIds.child, 'SIGKILL');
+        await waitForPidDead(escapedIds.child);
+    }
+    finally {
+        ownedPids.delete(escapedIds.child);
+    }
+    // 2a-adapter) hbcli/Anything 必须把同一 cleanup 不完整状态透传到 error 面。
+    const adapterCleanupProbe = async (label, invoke) => {
+        rmSync(escapedPidsFile, { force: true });
+        rmSync(escapedReadyFile, { force: true });
+        const controller = new AbortController();
+        activeAbort = controller;
+        const work = invoke(controller.signal);
+        activeWork = work;
+        let pid;
+        try {
+            await waitForFile(escapedReadyFile, `${label} escaped process`);
+            pid = JSON.parse(readFileSync(escapedPidsFile, 'utf8')).child;
+            ownedPids.add(pid);
+            controller.abort();
+            const result = await work;
+            activeWork = undefined;
+            activeAbort = undefined;
+            assert.match(result.error ?? '', /process group cleanup incomplete/, `${label} hid cleanup failure`);
+        }
+        finally {
+            controller.abort();
+            if (pid !== undefined) {
+                try {
+                    process.kill(pid, 'SIGKILL');
+                }
+                catch { /* already exited */ }
+                await waitForPidDead(pid);
+                ownedPids.delete(pid);
+            }
+        }
+    };
+    await adapterCleanupProbe('hbcli', signal => callHbcliJson([], { hbcliBin: escapedParentBin, timeoutMs: 10_000, signal }));
+    await adapterCleanupProbe('anything', signal => anythingSearch({ keyword: 'x', hbcliBin: escapedParentBin, timeoutMs: 10_000, signal }));
+    // 2b) abort 后不走已知安装位候选:首个缺失后启动 ~/.local/bin，第三候选永不执行
+    const home = join(root, 'fake-home');
+    const secondMarker = join(home, 'second-started');
+    const thirdMarker = join(home, 'third-started');
+    const localDir = join(home, '.local/bin');
+    const staicliDir = join(home, '.staicli/current');
+    const emptyPath = join(root, 'empty-path');
+    const { mkdirSync } = await import('node:fs');
+    mkdirSync(localDir, { recursive: true });
+    mkdirSync(staicliDir, { recursive: true });
+    mkdirSync(emptyPath, { recursive: true });
+    const candidateScript = (startedMarker) => `#!${process.execPath}
+require('node:fs').writeFileSync(${JSON.stringify(startedMarker)},'started');
+setInterval(()=>{},1000);`;
+    writeFileSync(join(localDir, 'hbcli'), candidateScript(secondMarker), { mode: 0o700 });
+    writeFileSync(join(staicliDir, 'hbcli'), candidateScript(thirdMarker), { mode: 0o700 });
+    const savedHome = process.env.HOME;
+    const savedPath = process.env.PATH;
+    process.env.HOME = home;
+    process.env.PATH = emptyPath;
+    const candidateAbort = new AbortController();
+    const candidateWork = callHbcliJson([], { hbcliBin: 'hbcli', timeoutMs: 10_000, signal: candidateAbort.signal });
+    try {
+        await waitForFile(secondMarker, 'candidate process');
+        candidateAbort.abort();
+        const candidateResult = await candidateWork;
+        assert.equal(candidateResult.error, 'aborted by host signal');
+        assert.equal(existsSync(thirdMarker), false, 'abort must not continue to another candidate');
+    }
+    finally {
+        candidateAbort.abort();
+        await candidateWork;
+        process.env.HOME = savedHome;
+        process.env.PATH = savedPath;
+    }
+    // 3) 超时:SIGKILL 树,语义 timedOut
+    const slow = join(root, 'slow.js');
+    writeFileSync(slow, `#!${process.execPath}
+const t=setInterval(()=>{},1000);`, { mode: 0o700 });
+    const timed = await spawnBounded(slow, [], { env: process.env, timeoutMs: 300 });
+    assert.equal(timed.timedOut, true, JSON.stringify(timed));
+    assert.equal(timed.aborted, false);
+    assert.equal(timed.groupReaped, true, JSON.stringify(timed));
+    assert.match(timed.error ?? '', /timeout/);
+    console.log(`SPAWN BOUNDED ABORT TESTS: 8/8 OK(pre-abort 零 spawn/取消不静态降级/abort 有界杀真父子树/escaped-pipe settlement/adapter cleanup error/abort 不换候选/timeout SIGKILL 树/语义区分)`);
+}
+finally {
+    activeAbort?.abort();
+    if (activeWork)
+        await activeWork;
+    cleanupOwnedProcesses();
+    rmSync(root, { recursive: true, force: true });
+}

package/dist/scripts/sponsor-reuse-tests.js

@@ -0,0 +1,262 @@
+/**
+ * sponsor 插件与同内核端到端复用证明测试(issue #235;全离线 fixture 合成数据,零真实调用):
+ *  1. 插件配置 fail-closed(反例先行):缺 sponsorId/travelerPrincipalId/bffPrincipalId、
+ *     空路由表/重复路由、缺披露文案或缺排序偏置声明、负/非整数佣金、sponsorId 冒充 traveler
+ *     principal(三主体混同)——全部构造即拒
+ *  2. 运行激活默认关闭:SPONSOR_RUNTIME_ACTIVATION_DEFAULT=false,requireRuntimeActivation(false) 抛错,
+ *     显式 true 才放行(本件为结构性证明,非运行时激活,零真实交易路径)
+ *  3. 路由授权(越权反例):路由不在 sponsor allowedRoutes 闭集 → route-unauthorized;
+ *     授权路由但缺 session/order 绑定 → missing-session-binding(禁止复制 Buyer/credentials 规避)
+ *  4. 同内核引用证明(复用面):sponsor 模块源码必须 import 自 src/booking-saga.ts 与 src/wish-pool.ts
+ *     (同源调用,零拷贝——不重声明边表/解析器);运行时面 ts/src/** 零 sponsor-plugin 引用
+ *     (C 端默认路径结构性隔离);内核边表/拒绝表十二格从消费侧逐字钉死(内核漂移即本套件红)
+ *  5. 排序红线:高佣金候选不满足旅行者条件 → 保持排除,赞助权重不可伪造用户效用;
+ *     同分 tie-break 只按申报顺位且必须显式披露偏置;佣金数值从不进入排序键
+ *  6. 端到端 B2B(fixture):配置→路由授权→库存/规划(内核评分)→确认闸
+ *     (write.pending→write.confirmed,披露 digest 进入确认指纹,必携 receipt)→审计/回放
+ *     (内核 sagaTraceViolations 空违例)
+ *  7. 端到端 B2C + 隔离:同一 runner 不带 plugin → b2c 形态;saga 边序列与 B2B 逐格相同
+ *     (同一内核函数);leak 检查器零发现(sponsor 字段零渗入);空 receipt 两种形态同拒
+ *     (同一 WriteGate 规则,无豁免)
+ *  8. A/B 同业务 id 不串:同 businessId 不同 sponsor → scope 三元组隔离,事件/指纹/approval
+ *     互不可见;A 的 approval 绑定在 B 的指纹上校验失败;取消退款路径(propose→confirm→compensate)
+ *     在 sponsor 形态同样走内核边表,回放零违例
+ *
+ * 运行: cd ts && npx tsx scripts/sponsor-reuse-tests.ts
+ */
+import assert from 'node:assert/strict';
+import { readFileSync, readdirSync, statSync } from 'node:fs';
+import { join } from 'node:path';
+import { SAGA_EDGES, SAGA_REJECTIONS, } from '../src/booking-saga.js';
+import { SPONSOR_PLUGIN_SCHEMA, SPONSOR_RUNTIME_ACTIVATION_DEFAULT, authorizeSponsorRoute, buildConfirmationFingerprint, bindApproval, createSponsorPlugin, rankSponsorCandidates, requireRuntimeActivation, runBookingScenario, scoreCandidateAgainstWish, sponsorLeakFindings, verifyApprovalBinding, } from '../capabilities/sponsor-plugin.js';
+const REPO_TS = new URL('..', import.meta.url).pathname;
+// ── fixture:两个 sponsor 配置 + 三条合成库存候选 ─────────────────────────────
+function sponsorConfigA() {
+    return {
+        sponsorId: 'sponsor-a-travel',
+        travelerPrincipalId: 'traveler-001',
+        bffPrincipalId: 'bff-agency-a',
+        allowedRoutes: ['route.packaged-erhai-4d', 'route.packaged-yunnan-5d'],
+        disclosure: {
+            commissionBps: 300,
+            statement: '本方案由旅行社 A 提供库存,成交后旅行社获得 3% 佣金。',
+            rankingBiasNotice: '同分候选按旅行社申报顺位排序;佣金不影响条件判定。',
+        },
+    };
+}
+function sponsorConfigB() {
+    const c = sponsorConfigA();
+    return { ...c, sponsorId: 'sponsor-b-board', bffPrincipalId: 'bff-board-b', disclosure: { ...c.disclosure, commissionBps: 0 } };
+}
+function makePlugin(overrides = {}) {
+    return createSponsorPlugin({ ...sponsorConfigA(), ...overrides });
+}
+const WISH = { days: 4, budgetCny: 8000, month: 7 };
+function candidates() {
+    return [
+        {
+            candidateRef: 'cand-alpha',
+            route: 'route.packaged-erhai-4d',
+            name: '大理洱海 4 日包价',
+            priceCny: 6500,
+            conditions: { days: 4, budget_cny: 7000, best_months: [7] },
+            commissionBps: 300,
+        },
+        {
+            candidateRef: 'cand-beta',
+            route: 'route.packaged-yunnan-5d',
+            name: '云南 5 日(旅行者只有 4 天)',
+            priceCny: 7200,
+            conditions: { days: 5, budget_cny: 7000, best_months: [7] },
+            commissionBps: 900,
+        },
+    ];
+}
+// ── 1. 插件配置 fail-closed(反例先行) ───────────────────────────────────────
+for (const [field, broken] of [
+    ['sponsorId', { sponsorId: '' }],
+    ['travelerPrincipalId', { travelerPrincipalId: '   ' }],
+    ['bffPrincipalId', { bffPrincipalId: '' }],
+    ['allowedRoutes-empty', { allowedRoutes: [] }],
+    ['allowedRoutes-dup', { allowedRoutes: ['route.a', 'route.a'] }],
+    ['statement', { disclosure: { commissionBps: 100, statement: '', rankingBiasNotice: 'x' } }],
+    ['rankingBiasNotice', { disclosure: { commissionBps: 100, statement: 'x', rankingBiasNotice: '' } }],
+    ['commissionBps-negative', { disclosure: { commissionBps: -1, statement: 'x', rankingBiasNotice: 'y' } }],
+    ['commissionBps-fraction', { disclosure: { commissionBps: 1.5, statement: 'x', rankingBiasNotice: 'y' } }],
+]) {
+    assert.throws(() => makePlugin(broken), Error, `缺/坏 ${field} → 拒绝建插件(fail-closed)`);
+}
+assert.throws(() => makePlugin({ travelerPrincipalId: 'sponsor-a-travel' }), Error, 'sponsorId 冒充 traveler principal(三主体混同)→ 拒绝');
+const pluginA = makePlugin();
+assert.equal(pluginA.schemaVersion, SPONSOR_PLUGIN_SCHEMA, '插件 schema = sponsor.plugin.v1');
+assert.match(pluginA.disclosureDigestSha256, /^[0-9a-f]{64}$/, '披露口径摘要为 sha256(佣金/文案/偏置声明进 digest)');
+// ── 2. 运行激活默认关闭 ─────────────────────────────────────────────────────
+assert.equal(SPONSOR_RUNTIME_ACTIVATION_DEFAULT, false, '激活常量默认 false(结构性默认关)');
+assert.throws(() => requireRuntimeActivation(SPONSOR_RUNTIME_ACTIVATION_DEFAULT), Error, '默认态调用激活门 → 抛错');
+assert.doesNotThrow(() => requireRuntimeActivation(true), '显式 opt-in 才放行(真实运行时接线属 M6 Entry 后)');
+// ── 3. 路由授权(越权反例) ──────────────────────────────────────────────────
+const unauthorized = authorizeSponsorRoute(pluginA, 'route.not-declared', { sessionRef: 'sess-1' });
+assert.equal(unauthorized.ok, false, '越权路由 → 拒绝');
+assert.equal(unauthorized.ok ? '' : unauthorized.reason, 'route-unauthorized', '拒绝理由 = route-unauthorized');
+const unbound = authorizeSponsorRoute(pluginA, 'route.packaged-erhai-4d', { sessionRef: null });
+assert.equal(unbound.ok ? '' : unbound.reason, 'missing-session-binding', '授权路由但缺 session 绑定 → 拒绝(禁止复制 Buyer/credentials 规避)');
+const okRoute = authorizeSponsorRoute(pluginA, 'route.packaged-erhai-4d', { sessionRef: 'sess-traveler-001', orderRef: 'ord-fix-1' });
+assert.equal(okRoute.ok, true, '闭集内路由 + session/order 绑定 → 授权通过');
+const pluginB = makePlugin(sponsorConfigB());
+const crossRoute = authorizeSponsorRoute(pluginB, 'route.packaged-yunnan-5d', { sessionRef: 'sess-b' });
+assert.equal(crossRoute.ok, true, '每个 sponsor 的授权闭集独立维护');
+// ── 4. 同内核引用证明(复用面 = 零拷贝 + 零内核改动 + C 端隔离) ───────────────
+// 4a. 内核契约从消费侧钉死:12 格 (origin,trigger) 边表/拒绝表与冻结字面量逐字一致
+const EDGE_GOLDEN = [
+    'none:propose>pending:write.pending',
+    'pending:confirm>confirmed:write.confirmed',
+    'pending:compensate>compensated:write.compensated',
+    'confirmed:compensate>compensated:write.compensated',
+];
+assert.equal(SAGA_EDGES.map((e) => `${e.from}:${e.trigger}>${e.to}:${e.event}`).join('|'), EDGE_GOLDEN.join('|'), '内核 booking_saga_fsm.v1 边表与冻结字面量逐字一致(内核漂移即红)');
+const REJECT_GOLDEN = [
+    'none:confirm', 'none:compensate', 'pending:propose', 'confirmed:propose',
+    'confirmed:confirm', 'compensated:propose', 'compensated:confirm', 'compensated:compensate',
+];
+assert.equal(SAGA_REJECTIONS.map((e) => `${e.from}:${e.trigger}`).join('|'), REJECT_GOLDEN.join('|'), '内核拒绝闭集八格与冻结字面量逐字一致');
+// 4b. sponsor 模块同源 import(零拷贝:不重声明内核边表/解析器/评分器)
+const sponsorSrc = readFileSync(join(REPO_TS, 'capabilities/sponsor-plugin.ts'), 'utf8');
+assert.match(sponsorSrc, /from '\.\.\/src\/booking-saga\.ts'/, 'sponsor 模块 import 自内核 booking-saga.ts(同一内核函数)');
+assert.match(sponsorSrc, /from '\.\.\/src\/wish-pool\.ts'/, 'sponsor 模块 import 自内核 wish-pool.ts(同一评分函数)');
+assert.doesNotMatch(sponsorSrc, /function resolveSagaTrigger/, '零拷贝:不重声明内核触发解析器');
+assert.doesNotMatch(sponsorSrc, /const SAGA_EDGES/, '零拷贝:不重声明内核边表');
+assert.doesNotMatch(sponsorSrc, /function scoreWishMatch/, '零拷贝:不重声明内核评分器');
+// 4c. 运行时面隔离:ts/src/** 无任何文件引用 sponsor-plugin(C 端默认路径结构性零渗入)
+function walkTs(dir) {
+    return readdirSync(dir).flatMap((name) => {
+        const p = join(dir, name);
+        if (statSync(p).isDirectory())
+            return walkTs(p);
+        return name.endsWith('.ts') ? [p] : [];
+    });
+}
+const runtimeFiles = walkTs(join(REPO_TS, 'src'));
+assert.ok(runtimeFiles.length > 20, `运行时面文件枚举非空(实得 ${runtimeFiles.length})`);
+const leaked = runtimeFiles.filter((f) => readFileSync(f, 'utf8').includes('sponsor-plugin'));
+assert.deepEqual(leaked, [], 'ts/src/** 零 sponsor-plugin 引用(C 端默认路径不接线 sponsor 面)');
+// ── 5. 排序红线(赞助收益不伪造用户效用) ────────────────────────────────────
+const ranking = rankSponsorCandidates(pluginA, candidates(), WISH);
+assert.deepEqual(ranking.excluded.map((e) => `${e.candidateRef}:${e.why}`), ['cand-beta:conditions-not-met'], '高佣金(900bps)但天数不足的候选保持排除——佣金不可赎回条件');
+assert.equal(ranking.ranked.length, 1, '只有条件全命中的候选进入排序');
+assert.equal(ranking.ranked[0].candidate.candidateRef, 'cand-alpha', '命中候选 = cand-alpha');
+assert.equal(ranking.ranked[0].sponsorTieBreakApplied, false, '无同分不发生赞助 tie-break');
+assert.ok(ranking.ranked[0].disclosure.statement.length > 0, '排序结果必携披露文案');
+assert.ok(ranking.biasNotice.length > 0, '排序输出顶层必携偏置声明(渲染面必须可见)');
+// 同分 tie:按申报顺位,不按佣金;发生 tie-break 必须显式披露
+const tieCandidates = [
+    { candidateRef: 'tie-low', route: 'route.packaged-erhai-4d', name: '低佣金', priceCny: 6600, conditions: { days: 4, budget_cny: 7000 }, commissionBps: 100 },
+    { candidateRef: 'tie-high', route: 'route.packaged-yunnan-5d', name: '高佣金同分', priceCny: 6700, conditions: { days: 4, budget_cny: 7000 }, commissionBps: 900 },
+];
+const tieRank = rankSponsorCandidates(pluginA, tieCandidates, { days: 4, budgetCny: 8000 });
+assert.deepEqual(tieRank.ranked.map((r) => r.candidate.candidateRef), ['tie-low', 'tie-high'], '同分按申报顺位(申报顺位在前的低佣金居首)');
+assert.equal(tieRank.ranked[0].sponsorTieBreakApplied, false, '申报顺位首位无需 tie-break 标记');
+const tieReversed = rankSponsorCandidates(pluginA, [tieCandidates[1], tieCandidates[0]], { days: 4, budgetCny: 8000 });
+assert.deepEqual(tieReversed.ranked.map((r) => r.candidate.candidateRef), ['tie-high', 'tie-low'], '调换申报顺位则高佣金居首——排序键是申报顺位而非佣金');
+assert.equal(tieReversed.ranked[0].sponsorTieBreakApplied, true, 'tie-break 真实发生时必须标记');
+assert.ok(tieReversed.ranked[0].disclosure.rankingBiasNotice.length > 0, 'tie-break 候选必携偏置声明(偏置必须展示给旅行者)');
+// 内核评分器直证:同一 scoreCandidateAgainstWish 在两形态共用(条件不满足 → null)
+assert.equal(scoreCandidateAgainstWish(candidates()[1], WISH), null, '内核评分:天数不足 → null(不可预订)');
+assert.equal(scoreCandidateAgainstWish(candidates()[0], WISH)?.hits.length, 3, '内核评分:三条件全命中');
+// ── 6. 端到端 B2B(fixture 合成数据,零真实调用) ─────────────────────────────
+const b2bTrace = runBookingScenario({
+    businessId: 'BIZ-1',
+    travelerPrincipalId: 'traveler-001',
+    sessionRef: 'sess-traveler-001',
+    candidates: candidates(),
+    wish: WISH,
+    action: 'confirm',
+    receipt: 'receipt-hb-fix-001',
+    plugin: pluginA,
+});
+assert.equal(b2bTrace.form, 'b2b-sponsor', 'B2B 形态标记 b2b-sponsor');
+assert.equal(b2bTrace.selectedCandidateRef, 'cand-alpha', '选中条件全命中候选');
+const b2bKinds = b2bTrace.events.map((e) => e.kind);
+assert.deepEqual(b2bKinds, ['route.authorized', 'candidate.ranked', 'write.pending', 'write.confirmed'], 'B2B 事件序列:路由授权→排序→propose→confirm');
+const b2bPending = b2bTrace.events[2];
+const b2bConfirmed = b2bTrace.events[3];
+assert.equal(b2bTrace.sagaStatus, 'confirmed', 'saga 终态 confirmed');
+assert.ok(b2bPending.guard !== null && b2bPending.guard.includes('idem_key UNIQUE'), 'write.pending 携内核边表守卫原文(同一张边表)');
+assert.ok(b2bConfirmed.guard !== null && b2bConfirmed.guard.includes('receipt'), 'write.confirmed 携内核边表守卫原文(L3 具名确认)');
+assert.equal(b2bConfirmed.receipt, 'receipt-hb-fix-001', '确认必携外部回执');
+assert.deepEqual(b2bTrace.sagaViolations, [], '内核 sagaTraceViolations 回放零违例(审计链合法)');
+// 披露 digest 进入确认指纹:同一请求换披露 → 指纹必变
+const fpA = buildConfirmationFingerprint({
+    businessId: 'BIZ-1', travelerPrincipalId: 'traveler-001', sponsorId: 'sponsor-a-travel',
+    candidateRef: 'cand-alpha', route: 'route.packaged-erhai-4d', priceCny: 6500,
+    disclosureDigestSha256: pluginA.disclosureDigestSha256,
+});
+const fpA2 = buildConfirmationFingerprint({
+    businessId: 'BIZ-1', travelerPrincipalId: 'traveler-001', sponsorId: 'sponsor-a-travel',
+    candidateRef: 'cand-alpha', route: 'route.packaged-erhai-4d', priceCny: 6500,
+    disclosureDigestSha256: '0'.repeat(64),
+});
+assert.notEqual(fpA, fpA2, '披露口径变化 → 确认指纹变化(佣金披露进入确认指纹)');
+assert.ok(b2bConfirmed.fingerprintSha256 && b2bConfirmed.fingerprintSha256.length === 64, '确认事件携带 64 位指纹');
+const approval = bindApproval({ fingerprintSha256: fpA, receipt: 'receipt-hb-fix-001', travelerPrincipalId: 'traveler-001', sponsorId: 'sponsor-a-travel' });
+assert.equal(verifyApprovalBinding(fpA, approval), true, 'approval 绑定同指纹校验通过');
+assert.equal(verifyApprovalBinding(fpA2, approval), false, '指纹不匹配 → approval 绑定校验失败');
+// ── 7. 端到端 B2C + 隔离(同一 runner,零 sponsor 渗入) ──────────────────────
+const b2cTrace = runBookingScenario({
+    businessId: 'BIZ-1',
+    travelerPrincipalId: 'traveler-001',
+    candidates: candidates(),
+    wish: WISH,
+    action: 'confirm',
+    receipt: 'receipt-hb-fix-001',
+});
+assert.equal(b2cTrace.form, 'b2c', '无 plugin → C 端默认形态');
+assert.equal(b2cTrace.selectedCandidateRef, 'cand-alpha', 'C 端同一内核评分选中同一候选(复用)');
+assert.deepEqual(b2cTrace.events.map((e) => e.kind), ['candidate.ranked', 'write.pending', 'write.confirmed'], 'C 端无路由授权/披露事件');
+// 同一内核边序列:两形态 saga 段逐格相同(from/to/event/guard)
+const sagaSlice = (t) => t.events
+    .filter((e) => e.sagaEvent !== null)
+    .map((e) => `${e.kind}:${e.from}>${e.to}:${(e.guard ?? '').slice(0, 12)}`);
+assert.deepEqual(sagaSlice(b2bTrace), sagaSlice(b2cTrace), 'B2B/B2C saga 段逐格相同——同一内核函数在 sponsor 形态下跑通同一状态机');
+assert.deepEqual(sponsorLeakFindings(b2cTrace), [], 'C 端 trace 泄漏检查零发现(sponsor 字段零渗入)');
+assert.ok(sponsorLeakFindings(b2bTrace).length > 0, '对照:B2B trace 泄漏检查有发现(检查器本身有效)');
+// 空 receipt 两种形态同拒(同一 WriteGate/空 receipt 红线,无豁免)
+for (const [form, opts] of [
+    ['b2b', { plugin: pluginA, sessionRef: 'sess-traveler-001' }],
+    ['b2c', {}],
+]) {
+    assert.throws(() => runBookingScenario({
+        businessId: 'BIZ-1', travelerPrincipalId: 'traveler-001',
+        candidates: candidates(), wish: WISH, action: 'confirm',
+        receipt: '   ', ...opts,
+    }), Error, `${form} 空 receipt → 拒绝(空 receipt 红线无 B2B 豁免)`);
+}
+assert.throws(() => runBookingScenario({
+    businessId: 'BIZ-1', travelerPrincipalId: 'traveler-001', sessionRef: 'sess-x',
+    candidates: [{ ...candidates()[0], route: 'route.not-declared' }], wish: WISH,
+    action: 'confirm', receipt: 'r-1', plugin: pluginA,
+}), Error, 'B2B 端到端越权路由 → fail-closed 中止(不静默换路由)');
+// ── 8. A/B 同业务 id 不串(事件/投影/approval/effect) ────────────────────────
+const traceA = b2bTrace;
+const traceB = runBookingScenario({
+    businessId: 'BIZ-1',
+    travelerPrincipalId: 'traveler-001',
+    sessionRef: 'sess-board-b',
+    candidates: candidates(),
+    wish: WISH,
+    action: 'cancel',
+    receipt: 'receipt-hb-fix-002',
+    plugin: pluginB,
+});
+assert.equal(traceA.scope.sponsorId, 'sponsor-a-travel', 'A 事件 scope 携 sponsor-a');
+assert.equal(traceB.scope.sponsorId, 'sponsor-b-board', 'B 事件 scope 携 sponsor-b');
+assert.ok(traceA.events.every((e) => e.scope.sponsorId === 'sponsor-a-travel'), 'A 的全部事件归属 A(同业务 id 不串事件)');
+assert.ok(traceB.events.every((e) => e.scope.sponsorId === 'sponsor-b-board'), 'B 的全部事件归属 B');
+assert.notEqual(traceA.scope.key, traceB.scope.key, '同 businessId 不同 sponsor → scope 键不同(投影隔离)');
+assert.equal(traceB.sagaStatus, 'compensated', 'B 走取消退款:propose→confirm→compensate');
+assert.deepEqual(traceB.events.map((e) => e.kind), ['route.authorized', 'candidate.ranked', 'write.pending', 'write.confirmed', 'write.compensated'], '取消路径事件序列');
+assert.deepEqual(traceB.sagaViolations, [], 'B 取消退款回放零违例(sponsor 形态同一取消/退款规则)');
+// approval 不可跨 scope 重放:A 的 approval 绑到 B 的指纹 → 校验失败
+const approvalB = bindApproval({ fingerprintSha256: traceB.events[3].fingerprintSha256, receipt: 'receipt-hb-fix-002', travelerPrincipalId: 'traveler-001', sponsorId: 'sponsor-b-board' });
+assert.equal(verifyApprovalBinding(traceA.events[3].fingerprintSha256, approvalB), false, 'A 的指纹不接受 B 的 approval(BFF 重放/跨租户绑定拒绝)');
+assert.deepEqual(traceA.sagaViolations, [], 'A 回放零违例');
+console.log('SPONSOR REUSE TESTS: 8/8 OK(配置 fail-closed / 默认关激活门 / 越权路由拒绝 / 同内核零拷贝+C端隔离 / 佣金不伪造效用 / B2B fixture E2E+披露入指纹 / B2C 同 runner 零渗入+同 saga 边 / A/B 同业务id不串)');