@danceiny/gotry 0.0.1-rc.9 → 0.2.0-rc.28

package/dist/src/index.js

@@ -1,557 +1,1291 @@
-import { join } from 'node:path';
+/**
+ * GoTry dsh 插件(gotry-tools):把 GoTry 的领域能力注册为 dsh 工具。
+ *
+ * 对应总纲 3.2 插件清单中的三个最小集:
+ *   - gotry_feasibility_check   可行性引擎(门到门全成本,bridge → Python Z3)
+ *   - gotry_motivation_save     动机画像落盘(为什么出发;B2B 接缝的契约对象)
+ *   - gotry_wish_pool_add       「下一次出发」清单(憧憬不被拒绝)
+ *
+ * 插件形态遵循 dsh 约定(name/inject/Config/apply + ctx.tools.register(defineTool(...))),
+ * 对齐 @deepseek-ai/dsh-tools@0.2.0-rc.2 的契约:
+ * render 位于 output 对象内,参数属性是 ValueSchemaSpec(支持 type:'json')。
+ *
+ * @module @gotry/plugin
+ */
+import { isAbsolute, join } from 'node:path';
 import z from '@deepseek-ai/schemastery';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { ensureStateDir, recordLatency } from './bridge.js';
 import { segmentsFromCandidate, solveChoiceSegment } from './unified.js';
 import { checkConnectivity } from '../scripts/skeleton-check.js';
 import { parseCandidate, parseRequest } from './model.js';
-import { searchHotels as hbcliSearchHotels } from '../capabilities/hbcli.js';
 import { installProcessGuards, guardToolExecute } from '../capabilities/incident-log.js';
 import { interpretArgs } from './tool-packet.js';
 import { projectUtility } from './memory-utility.js';
 import { pickNudgeWish } from './wish-pool.js';
 import { resolveTimelineDate } from './travel-timeline.js';
-import { ensureLedger, readCompanionsWithFallback, readMotivationWithFallback, readTripsWithFallback, readWishPoolWithFallback } from './state-ledger.js';
+import { ensureLedger, openLedgerIfExists, readCompanionsWithFallback, readMotivationWithFallback, readTripsWithFallback } from './state-ledger.js';
+import { applyZoneNote, bindZoneSession, boundZoneSession, isZoneObservableTool, observeToolResult, promoteWithRouting, renderSessionZoneBrief, resolveZoneSwitch, zoneScopeOfExec, zoneSessionRefFromExec, } from './session-zone-wiring.js';
+import { isValidHomeCityPreference, resolveDefaultOrigin } from './memory-capture.js';
+import { applyPlanningWindow } from './loop.js';
 import { buildTimeAnchor } from './time-anchor.js';
-import { resolveSlotDate } from './slot-spec.js';
-import { geocodePlace, getForecast, getClimate, wmoLabel } from '../capabilities/weather.js';
-import { verifyFlight } from '../capabilities/opensky.js';
-import { anythingSearch } from '../capabilities/anything.js';
-import { readUrl, reach, reachStatus } from '../capabilities/agent-reach.js';
-import { videoSubtitle, githubSearch } from '../capabilities/agent-reach-deep.js';
-import { flyaiSearch } from '../capabilities/flyai.js';
-import { sessionFlightSearch } from '../capabilities/session-search.js';
+import { evaluateHotelStayDates } from './hotel-date-gate.js';
+import { wmoLabel } from '../capabilities/weather.js';
+import { runDoctorChecks, renderDoctorReportMd, runDoctorRepair, createRepairApprovalGate } from '../capabilities/doctor.js';
+import { EXTENSION_STORE_URL } from '../capabilities/session/extension-bridge.js';
+import { createConsentGate, approvalFromContext, resolveSessionSearchKind } from '../capabilities/session-consent.js';
+import { installModelOverride } from '../capabilities/model-override.js';
+import { listArtifacts, readArtifact } from '../capabilities/artifacts.js';
+import { generateItineraryArtifact } from '../capabilities/itinerary-artifact.js';
+import { generateItineraryDeckArtifact } from '../capabilities/itinerary-deck-artifact.js';
+import { generateItineraryDeckExport } from '../capabilities/itinerary-deck-export.js';
+import { interpretEffect, declinedObservation } from '../capabilities/effect.js';
+import { customerSendCode, customerLogin } from '../capabilities/hbcli.js';
+import { FLYAI_POI_CATEGORIES } from '../capabilities/flyai.js';
+import { createFlyaiSetupTool } from './flyai-setup-tool.js';
+import { appendFacts, loadFactRegistry } from '../capabilities/fact-log.js';
+import { factsFromFlyai, factsFromHotel, factsFromSession, factsFromSessionTrain } from './bookable-facts.js';
+import { hasRecognizedAvailableSeat } from '../capabilities/session/adapters/rail-12306.js';
+import { gateArtifact } from './artifact-gate.js';
+import { installTurnDeadline, listTurnHandoffTickets } from './turn-deadline.js';
+import { noteChannelVerdict, recordChannelEvent, readLatestChannelEvents } from '../capabilities/channel-health.js';
+import { routingAdvice, renderRoutingCard, toolRoutingHeadline, persistedDownChannels } from '../capabilities/channel-registry.js';
+import { registerBenchmarkEnvironmentBridge } from './benchmark-environment-bridge.js';
+import { installBenchmarkToolIsolation } from './benchmark-tool-isolation.js';
+import { installBenchmarkAgentConformance } from './benchmark-agent-conformance.js';
+import { installSubagentJobIdGuard } from './subagent-job-id-guard.js';
+import { registerLavishTools } from './lavish-tools.js';
+import { createGroundTransferResolver, createPublicMapDrivingRouteProvider, exposeGroundTransferEvidence, resolveGroundTransferPayload, } from '../capabilities/ground-transfer.js';
+/** 航司→机场映射表(issue #46 冲突检测面;data/airline-airports.json,as_of 快照) */
+let airlineAirportMapCache = null;
+async function loadAirlineAirportMap() {
+    if (airlineAirportMapCache)
+        return airlineAirportMapCache;
+    try {
+        const { readFile } = await import('node:fs/promises');
+        airlineAirportMapCache = JSON.parse(await readFile(join(import.meta.dirname, '..', '..', 'data', 'airline-airports.json'), 'utf-8'));
+        return airlineAirportMapCache;
+    }
+    catch {
+        return null; // 映射缺失不阻塞检索主路径;闸工具侧另行显式报错
+    }
+}
 export const name = 'gotry-tools';
-export const inject = [
-    'tools',
-    'systemPrompt'
-];
+// The benchmark CLI projection adds a required subprocess loader dependency.
+// Keep the plugin's ordinary mode independent of that opt-in-only service.
+export const inject = ['tools', 'systemPrompt'];
+function sessionCwd(exec) {
+    const candidate = exec;
+    return typeof candidate?.agent?.session?.header?.cwd === 'string'
+        ? candidate.agent.session.header.cwd
+        : undefined;
+}
 export const Config = z.object({
     stateRoot: z.string().default('.'),
     timeoutMs: z.number().default(30_000),
-    hbcliBin: z.string().default('hbcli')
+    hbcliBin: z.string().default('hbcli'),
+    sessionAccess: z.string().default('ask'),
+    sessionZones: z.string().default('off'),
+    benchmarkEnvironmentConfigPath: z.string().default(''),
+    lavishAxiPackageRoot: z.string().default(''),
 });
+/**
+ * query 包装参数的三形态归一(#12/#13):实现移居 tool-packet.ts(interpretArgs,
+ * RFC S1 interpretation 层语义归位),此处按旧名引 handy 别名,调用点零漂移。
+ */
 const unwrapQuery = interpretArgs;
+/**
+ * 动机画像 → persona 紧凑 brief(M4 T1 读回路径):空画像返回 ''(首访),
+ * persona 据此决定是否访谈。只读,不猜——画像里没有的字段不编。
+ * ADR-15:读经账本(未迁移 root 回退旧文件,只读)。
+ */
 function renderMotivationBrief(stateRoot) {
     const p = readMotivationWithFallback(stateRoot);
-    if (!p) return '';
-    const lines = [
-        '## 用户记忆(跨会话画像;与用户当轮说法冲突时以用户为准,更新经 gotry_motivation_save)'
-    ];
+    if (!p)
+        return ''; // 首访:无画像
+    const lines = ['## 用户记忆(跨会话画像;与用户当轮说法冲突时以用户为准,更新经 gotry_motivation_save)'];
     const weights = Object.entries(p.weights ?? {});
-    if (weights.length) lines.push(`- 动机权重: ${weights.map(([k, v])=>`${k}=${v}`).join(', ')}(证据 ${p.evidence?.length ?? 0} 条)`);
+    if (weights.length)
+        lines.push(`- 动机权重: ${weights.map(([k, v]) => `${k}=${v}`).join(', ')}(证据 ${p.evidence?.length ?? 0} 条)`);
     const hard = Object.entries(p.hard ?? {});
-    if (hard.length) lines.push(`- 硬约束: ${hard.map(([k, v])=>`${k}=${String(v)}`).join(', ')}`);
+    if (hard.length)
+        lines.push(`- 硬约束: ${hard.map(([k, v]) => `${k}=${String(v)}`).join(', ')}`);
+    // 持久默认城市(issue #338):生产 brief 复用纯 resolver 的 precedence
+    // 契约;这里仍只负责读回渲染,不把 resolver 接入 feasibility/evaluate。
+    const profile = p;
+    const homeResolution = resolveDefaultOrigin(undefined, profile);
+    const homePref = profile.homeCityPreference;
+    const typedPreferenceIsValid = isValidHomeCityPreference(profile);
+    const hasHomeCityData = Object.prototype.hasOwnProperty.call(profile, 'homeCity')
+        || Object.prototype.hasOwnProperty.call(profile, 'homeCityPreference');
+    if (homeResolution.source === 'home_default' && homeResolution.origin && typedPreferenceIsValid && homePref) {
+        const evidence = homeResolution.homeCityEvidence?.[0] ?? '';
+        lines.push(`- 常驻城市: ${homeResolution.origin}(原话证据:${evidence};记录于 ${homePref.updated_at})——本轮未指明出发地时作为软默认;本轮显式出发地优先;不进可行性硬约束,不删候选`);
+    }
+    else if (typedPreferenceIsValid && homePref?.value === null) {
+        lines.push(`- 常驻城市: 已显式清除(原话证据:${homePref.evidence};记录于 ${homePref.updated_at})——已无持久软默认;每次行程必须由用户明确出发地,不猜测`);
+    }
+    else if (hasHomeCityData) {
+        lines.push('- 常驻城市: 无可验证的持久默认——本轮请明确出发地;不从旧画像或全局 evidence 猜测');
+    }
+    // 旅行时间线(memory-design P1):去过的地方不再主动推荐,除非用户点名
     const trips = readTimelineTrips(stateRoot);
     if (trips.length) {
-        lines.push(`- 去过: ${trips.map((t)=>`${t.destination}(${t.start.slice(0, 7)})`).join('、')}——去过的地方不再主动推荐,除非用户点名`);
+        lines.push(`- 去过: ${trips.map(t => `${t.destination}(${t.start.slice(0, 7)})`).join('、')}——去过的地方不再主动推荐,除非用户点名`);
     }
+    // 同行人档案(memory-design P2):约束只进排序与行程结构建议,永不硬过滤
     const companions = readCompanions(stateRoot);
     if (companions.length) {
-        lines.push(`- 同行人: ${companions.map((c)=>`${c.label}(${c.brief})`).join('、')}——约束进结构与排序建议,不硬过滤;引用时带当初的原话依据`);
+        lines.push(`- 同行人: ${companions.map(c => `${c.label}(${c.brief})`).join('、')}——约束进结构与排序建议,不硬过滤;引用时带当初的原话依据`);
     }
     lines.push(`- 愿望池: 用 gotry_wish_pool_list 按条件召回(0..1),勿直接堆砌`);
-    if (p.updated_at) lines.push(`- 更新于: ${p.updated_at}`);
-    return weights.length || hard.length ? lines.join('\n') : '';
+    if (p.updated_at)
+        lines.push(`- 更新于: ${p.updated_at}`);
+    return weights.length || hard.length || hasHomeCityData ? lines.join('\n') : '';
 }
+/**
+ * 时间线摘要(brief 用):最近 3 次行程(目的地+年月);账本优先,未迁移回退文件 */
+/** 同行人摘要(brief 用):label + 约束串 */
 function readCompanions(stateRoot) {
-    return readCompanionsWithFallback(stateRoot).map((c)=>{
-        const bits = [
-            c.constraints.mobility,
-            ...c.constraints.health ?? [],
-            ...c.constraints.prefs ?? []
-        ].filter(Boolean);
-        return {
-            label: c.label,
-            brief: bits.join('/')
-        };
+    return readCompanionsWithFallback(stateRoot)
+        .map(c => {
+        const bits = [c.constraints.mobility, ...(c.constraints.health ?? []), ...(c.constraints.prefs ?? [])].filter(Boolean);
+        return { label: c.label, brief: bits.join('/') };
     });
 }
 function readTimelineTrips(stateRoot) {
-    return readTripsWithFallback(stateRoot).map((t)=>({
-            destination: t.destination,
-            start: t.start
-        })).sort((a, b)=>a.start < b.start ? 1 : -1).slice(0, 3);
+    return readTripsWithFallback(stateRoot)
+        .map(t => ({ destination: t.destination, start: t.start }))
+        .sort((a, b) => (a.start < b.start ? 1 : -1))
+        .slice(0, 3);
+}
+const FLYAI_TOOL_KINDS = ['flight', 'train', 'hotel', 'poi', 'keyword', 'ai', 'marriott-hotel', 'marriott-package'];
+function isFlyaiKind(value) {
+    return typeof value === 'string' && FLYAI_TOOL_KINDS.includes(value);
+}
+function textArg(args, ...names) {
+    for (const name of names) {
+        const value = args[name];
+        if (value !== undefined)
+            return typeof value === 'string' ? value : undefined;
+    }
+    return undefined;
+}
+function numberArg(args, ...names) {
+    for (const name of names) {
+        const value = args[name];
+        if (value !== undefined)
+            return typeof value === 'number' ? value : undefined;
+    }
+    return undefined;
+}
+function putText(target, key, args, ...names) {
+    const value = textArg(args, ...names);
+    if (value !== undefined)
+        target[key] = value;
+}
+function putNumber(target, key, args, ...names) {
+    const value = numberArg(args, ...names);
+    if (value !== undefined)
+        target[key] = value;
+}
+function flyaiToolQuery(args, signal) {
+    if (!isFlyaiKind(args.kind)) {
+        return { error: `kind 必须是 ${FLYAI_TOOL_KINDS.join('/')}，未知值不会按 flight 处理` };
+    }
+    const kind = args.kind;
+    const query = { kind };
+    putText(query, 'origin', args, 'from', 'origin');
+    putText(query, 'destination', args, 'to', 'destination');
+    putText(query, 'depDate', args, 'date', 'depDate');
+    putText(query, 'depDateStart', args, 'dateStart', 'depDateStart');
+    putText(query, 'depDateEnd', args, 'dateEnd', 'depDateEnd');
+    putText(query, 'backDate', args, 'backDate');
+    putNumber(query, 'journeyType', args, 'journeyType');
+    putText(query, 'seatClassName', args, 'seatClassName');
+    putText(query, 'transportNo', args, 'transportNo');
+    putText(query, 'transferCity', args, 'transferCity');
+    putNumber(query, 'depHourStart', args, 'depHourStart');
+    putNumber(query, 'depHourEnd', args, 'depHourEnd');
+    putNumber(query, 'arrHourStart', args, 'arrHourStart');
+    putNumber(query, 'arrHourEnd', args, 'arrHourEnd');
+    putNumber(query, 'totalDurationHour', args, 'totalDurationHour');
+    putNumber(query, 'maxPrice', args, 'maxPrice');
+    putText(query, 'sortType', args, 'sortType');
+    putText(query, 'destName', args, 'destName', 'to');
+    putText(query, 'checkInDate', args, 'checkIn', 'checkInDate');
+    putText(query, 'checkOutDate', args, 'checkOut', 'checkOutDate');
+    putText(query, 'keyWords', args, 'keyWords');
+    putText(query, 'poiName', args, 'poiName');
+    putText(query, 'hotelTypes', args, 'hotelTypes');
+    putText(query, 'sort', args, 'sort');
+    putText(query, 'hotelStars', args, 'hotelStars');
+    putText(query, 'hotelBedTypes', args, 'hotelBedTypes');
+    putText(query, 'cityName', args, 'cityName', 'to');
+    putNumber(query, 'poiLevel', args, 'poiLevel');
+    putText(query, 'keyword', args, 'keyword');
+    putText(query, 'category', args, 'category');
+    putText(query, 'query', args, 'query');
+    putText(query, 'hotelBrands', args, 'hotelBrands');
+    putText(query, 'hotelName', args, 'hotelName');
+    putText(query, 'provinceOrCity', args, 'provinceOrCity');
+    putNumber(query, 'timeoutMs', args, 'timeoutMs');
+    if (signal)
+        query.signal = signal;
+    const isCalendarDate = (value) => {
+        if (!/^\d{4}-\d{2}-\d{2}$/.test(value))
+            return false;
+        const date = new Date(`${value}T00:00:00.000Z`);
+        const [year, month, day] = value.split('-').map(Number);
+        return Number.isFinite(date.valueOf())
+            && date.getUTCFullYear() === year
+            && date.getUTCMonth() + 1 === month
+            && date.getUTCDate() === day;
+    };
+    const dateError = (label, value) => isCalendarDate(value) ? undefined : `${label} 必须是有效的 YYYY-MM-DD 日历日期`;
+    if (kind === 'flight' || kind === 'train') {
+        // Official 1.0.16 requires only --origin; omitting destination/date is a
+        // supported exploration query and must reach the upstream command.
+        if (!query.origin?.trim())
+            return { error: `kind=${kind} 需要 from/origin（中文城市名或机场）` };
+        const hasExact = Boolean(query.depDate);
+        const hasStart = Boolean(query.depDateStart);
+        const hasEnd = Boolean(query.depDateEnd);
+        if (hasStart !== hasEnd)
+            return { error: 'dateStart/depDateStart 与 dateEnd/depDateEnd 必须成对' };
+        if (hasExact && (hasStart || hasEnd))
+            return { error: 'date 与日期范围不能同时传入，请选择 exact-date 或 range 查询' };
+        for (const [label, value] of [
+            ['date', query.depDate],
+            ['dateStart', query.depDateStart],
+            ['dateEnd', query.depDateEnd],
+            ['backDate', query.backDate],
+        ]) {
+            if (value) {
+                const error = dateError(label, value);
+                if (error)
+                    return { error };
+            }
+        }
+        if (query.depDateStart && query.depDateEnd && query.depDateStart > query.depDateEnd) {
+            return { error: 'dateStart 不能晚于 dateEnd' };
+        }
+        if (query.depDate && query.backDate && query.backDate < query.depDate) {
+            return { error: 'backDate 不能早于 date' };
+        }
+        if (query.sortType && !/^[1-8]$/.test(query.sortType.trim())) {
+            return { error: 'flight/train 的 sortType 只接受 1–8' };
+        }
+    }
+    if (kind === 'hotel' || kind === 'marriott-hotel') {
+        if (!query.destName?.trim())
+            return { error: `kind=${kind} 需要 to/destName（目的地）` };
+        const hasIn = Boolean(query.checkInDate);
+        const hasOut = Boolean(query.checkOutDate);
+        if (hasIn !== hasOut)
+            return { error: 'checkIn/checkOut 必须成对' };
+        for (const [label, value] of [['checkIn', query.checkInDate], ['checkOut', query.checkOutDate]]) {
+            if (value) {
+                const error = dateError(label, value);
+                if (error)
+                    return { error };
+            }
+        }
+        if (query.checkInDate && query.checkOutDate && query.checkOutDate <= query.checkInDate) {
+            return { error: 'checkOut 必须晚于 checkIn' };
+        }
+        if (kind === 'marriott-hotel') {
+            // The official Marriott command has one keyword field covering hotel
+            // name/brand; it does not accept generic hotel-types/hotel-stars or
+            // the non-existent hotel-brands/hotel-name flags.
+            if (query.hotelTypes?.trim() || query.hotelStars?.trim()) {
+                return { error: 'marriott-hotel 不支持 hotelTypes/hotelStars；请使用 hotelBrands/hotelName' };
+            }
+            const marriottKeywords = [query.keyWords, query.hotelBrands, query.hotelName]
+                .map(value => value?.trim())
+                .filter((value) => Boolean(value));
+            query.keyWords = marriottKeywords.length ? marriottKeywords.join(' ') : undefined;
+            delete query.hotelBrands;
+            delete query.hotelName;
+        }
+    }
+    if (kind === 'poi' && !query.cityName?.trim())
+        return { error: 'kind=poi 需要 cityName（景点所在城市）' };
+    if ((kind === 'keyword' || kind === 'ai') && !query.query?.trim())
+        return { error: `kind=${kind} 需要 query` };
+    if (kind === 'marriott-package' && ![query.keyword, query.hotelName, query.provinceOrCity].some(value => value?.trim()))
+        return { error: 'kind=marriott-package 需要 keyword/hotelName/provinceOrCity 至少一项' };
+    return { query };
+}
+function flyaiToolSummary(query, result) {
+    const label = query.kind === 'flight' ? '机票' : query.kind === 'train' ? '火车票' : query.kind === 'hotel' || query.kind === 'marriott-hotel' ? '酒店' : query.kind;
+    if (result.verdict === 'miss')
+        return `${label}查询完成，官方通道返回 0 条。${result.evidence}`;
+    if (result.verdict !== 'hit')
+        return `${label}查询未完成：${result.error ?? result.verdict}。${result.setup ? `\n${result.setup}` : ''}\n${result.evidence}`;
+    const price = (raw, numeric) => raw?.trim() || (numeric !== undefined && numeric > 0 ? `¥${numeric}` : '价格待询');
+    const lines = [];
+    if (query.kind === 'flight' || query.kind === 'train') {
+        for (const option of (result.options ?? []).slice(0, 8)) {
+            const route = option.nonstop === false ? '中转' : option.nonstop === true ? '直达' : '路线待确认';
+            const services = option.segments?.map(segment => segment.no).join('→') || option.no;
+            lines.push(`${route} ${services} ${option.name} ${option.depDateTime.slice(0, 16)}→${option.arrDateTime.slice(0, 16)} ${price(option.priceRaw, option.price)}${option.jumpUrl ? ` · ${option.jumpUrl}` : ''}`);
+        }
+    }
+    else if (query.kind === 'hotel' || query.kind === 'marriott-hotel') {
+        for (const option of (result.hotels ?? []).slice(0, 8)) {
+            lines.push(`${option.name} ${price(option.priceRaw, option.price)}${option.score ? ` · ${option.score}` : ''}${option.jumpUrl ? ` · ${option.jumpUrl}` : ''}`);
+        }
+    }
+    else if (query.kind === 'poi') {
+        for (const option of (result.pois ?? []).slice(0, 8))
+            lines.push(`${option.name}${option.address ? ` · ${option.address}` : ''}${option.jumpUrl ? ` · ${option.jumpUrl}` : ''}`);
+    }
+    else if (query.kind === 'keyword') {
+        for (const option of (result.keywords ?? []).slice(0, 8))
+            lines.push(`${option.title}${option.price ? ` · ${option.price}` : ''}${option.jumpUrl ? ` · ${option.jumpUrl}` : ''}`);
+    }
+    else if (query.kind === 'marriott-package') {
+        for (const option of (result.packages ?? []).slice(0, 8))
+            lines.push(`${option.name}${option.price ? ` · ${option.price}` : ''}${option.detailUrl ? ` · ${option.detailUrl}` : ''}`);
+    }
+    else if (query.kind === 'ai') {
+        lines.push(`上游 ai-search data 已原样保留（${JSON.stringify(result.aiData).slice(0, 500)}）`);
+    }
+    return `${label}官方只读查询命中 ${lines.length} 条：\n${lines.join('\n')}\n${result.evidence}`;
+}
+function flyaiRoutingIntent(kind) {
+    if (kind === 'flight')
+        return 'search-flight';
+    if (kind === 'train')
+        return 'search-train';
+    if (kind === 'hotel' || kind === 'marriott-hotel')
+        return 'search-hotel';
+    return undefined;
+}
+/** Benchmark 治理面钉死预算(Round 9,#100/#102):官方任务形态(如 ChinaTravel
+ *  单查询 300s)超出内置 60/120s;预算仍必须「按 run 钉死」保证可复现——允许
+ *  owner 经 env 按次显式设定,缺省维持既有值,非法值启动即抛。 */
+function benchmarkPinnedPolicy() {
+    const parse = (name, fallback) => {
+        const raw = process.env[name];
+        if (raw === undefined || raw === '')
+            return fallback;
+        const value = Number.parseInt(raw, 10);
+        if (!Number.isSafeInteger(value) || value <= 0) {
+            throw new Error(`invalid ${name}: ${JSON.stringify(raw)} (expected a positive safe integer)`);
+        }
+        return value;
+    };
+    const softMs = parse('GOTRY_BENCHMARK_SOFT_MS', 60_000);
+    const hardMs = parse('GOTRY_BENCHMARK_HARD_MS', 120_000);
+    if (hardMs <= softMs)
+        throw new Error(`GOTRY_BENCHMARK_HARD_MS (${hardMs}) must exceed GOTRY_BENCHMARK_SOFT_MS (${softMs})`);
+    return { softMs, hardMs, exit: 'converge' };
+}
+/** 把 hotel-date-gate.message 里的模型转手措辞(请告诉用户 / 请告诉 gotry /
+ *  请向用户确认)归一为直接对用户措辞(请补充 / 请提供)。仅做这一类短语的字面
+ *  替换,日期示例等可行动细节保留不动;只服务 hotel_search input_required 卡
+ *  单点,不动 date-gate 契约、不动其它 presentResult 路径。 */
+function normalizeHotelGateHandoff(message) {
+    const raw = String(message ?? '');
+    if (!raw)
+        return '';
+    return raw
+        .replace(/请告诉\s*(?:用户|gotry)\s*/g, '请补充 ')
+        .replace(/请向用户确认/g, '请提供');
+}
+function parseFeasibilityPlanning(raw, anchor) {
+    if (raw === undefined)
+        return null;
+    if (!raw || typeof raw !== 'object' || Array.isArray(raw))
+        throw new Error('planning must be an object');
+    const planning = raw;
+    const intent = planning['intent'];
+    const requestedYear = planning['requested_year'];
+    if (intent !== 'future' && intent !== 'historical') {
+        throw new Error('planning.intent must be future or historical');
+    }
+    if (!Number.isInteger(requestedYear) || Number(requestedYear) < 1_000 || Number(requestedYear) > 9_999) {
+        throw new Error('planning.requested_year must be a four-digit integer');
+    }
+    // referenceDate is always the host clock; the payload cannot supply a stale now.
+    return { intent, requestedYear: Number(requestedYear), referenceDate: anchor.today };
 }
-export function apply(ctx, config) {
+function feasibilityValidationFailure(code, summary, rejected) {
+    return { ok: false, code, summary, rejected: rejected ?? [] };
+}
+export function apply(ctx, config, seams = {}) {
+    const clock = seams.clock ?? (() => new Date());
+    const runFlyaiEffect = (seams.effect ?? interpretEffect);
+    const groundTransferResolver = createGroundTransferResolver({
+        provider: seams.groundTransfer?.provider ?? createPublicMapDrivingRouteProvider(ctx),
+        clock,
+    });
+    const rawBenchmarkEnvironmentConfigPath = config.benchmarkEnvironmentConfigPath ?? '';
+    // ADR-24 v2:产品路径装「路由 + wall-clock 双出口」——用户主观时间是唯一
+    // 预算,复杂度决定出口结构(converge/handoff)。benchmark opt-in 钉死
+    // 固定 policy 保证评测可复现,不走路由。GOTRY_HANDOFF_CHILD=1 是收集器
+    // 派生的后台规划会话:唯一出口 converge + 长 leash——前台转后台,后台
+    // 必须产出最终交付物,不得再次 handoff(否则无限递归)。
+    const handoffChild = process.env.GOTRY_HANDOFF_CHILD === '1';
+    installTurnDeadline(ctx, handoffChild
+        ? { fixedPolicy: { softMs: 300_000, hardMs: 900_000, exit: 'converge' } }
+        : rawBenchmarkEnvironmentConfigPath.trim()
+            ? { fixedPolicy: benchmarkPinnedPolicy() }
+            : { stateRoot: process.env.GOTRY_TURN_HANDOFF_ROOT ?? config.stateRoot ?? '.' });
+    if (rawBenchmarkEnvironmentConfigPath.trim()) {
+        // Benchmark mode is a deliberately minimal kernel: only the model
+        // override and the environment bridge are installed besides the pinned
+        // turn-deadline policy above. In particular, product prompt variables,
+        // process/consent guards, and guarded product tools must not be
+        // observable on this path.
+        installModelOverride(ctx);
+        const getService = ctx.get;
+        const directSubprocess = (typeof getService === 'function'
+            ? getService.call(ctx, 'subprocess')
+            : undefined);
+        const projection = registerBenchmarkEnvironmentBridge(rawBenchmarkEnvironmentConfigPath, tool => ctx.tools.register(tool), directSubprocess);
+        installBenchmarkToolIsolation(ctx);
+        installBenchmarkAgentConformance(ctx, projection);
+        return;
+    }
+    // 时间感知:注册动态变量,persona 里用 {{current_date}} 引用。
+    // 每次 assemble 时取系统时钟——LLM 始终知道「今天是几号」。
+    // provider 收到本次组装的 AssembleContext(dsh-system-prompt 契约:
+    // `variable(name, provider: (context: AssembleContext) => string | undefined)`);
+    // `scope` 是不透明、按身份比较的 ScopeKey —— 分区读回据此分辨会话。
     const sp = ctx['systemPrompt'];
-    sp?.variable?.('current_date', ()=>{
+    sp?.variable?.('current_date', () => {
         const d = new Date();
         const ymd = `${d.getFullYear()}-${String(d.getMonth() + 1).padStart(2, '0')}-${String(d.getDate()).padStart(2, '0')}`;
-        const weekdays = [
-            '日',
-            '一',
-            '二',
-            '三',
-            '四',
-            '五',
-            '六'
-        ];
+        const weekdays = ['日', '一', '二', '三', '四', '五', '六'];
         return `${ymd} 周${weekdays[d.getDay()]}`;
     });
-    sp?.variable?.('time_anchor_card', ()=>buildTimeAnchor(new Date()).card);
-    sp?.variable?.('motivation_brief', ()=>renderMotivationBrief(config.stateRoot ?? '.'));
-    installProcessGuards(config.stateRoot ?? '.', {
-        uncaughtException: 'gotry-tools',
-        unhandledRejection: 'gotry-tools'
+    // 时间锚点卡(time-anchor 层,确定性):相对日期换算的唯一依据——
+    // 明天/下周X/下个月中旬/节日都查卡,LLM 不自算(算术只在代码层)。
+    sp?.variable?.('time_anchor_card', () => buildTimeAnchor(new Date()).card);
+    // M4 记忆读回(T1 闭环的另一半):motivation-profile 此前只写不读,每个新会话
+    // 模型都是盲的、重新访谈——「回访规划时长降 ≥50%」不可能成立。这里把画像
+    // 渲染成紧凑 brief 注入 persona;为空 = 首访。与当轮说法冲突时以用户为准。
+    sp?.variable?.('motivation_brief', () => renderMotivationBrief(config.stateRoot ?? '.'));
+    // 会话双区记忆读回(issue #255 P4-3,design/session-dual-zone-memory-design.md §5):
+    // 变量恒注册(persona 侧可随时引用),但总闸 off(默认)时恒返回空串 —— 接线惰性,
+    // 不建库、不读库、零事件;persona 模板本身不在本 PR 改动,因此开关 off 时注入面
+    // 输出逐字节不变。空串 = 首访/无活笔记(与 motivation_brief 同纪律)。
+    // 会话双区读回(issue #255 P4-3):**只在总闸 on 时注册**。
+    //  - 为什么是条件注册:默认关必须与 main **不可区分**——注入面多出一个变量名
+    //    就已经是可观测差异(§48 benchmark-environment-bridge-tests 的
+    //    「normal product mode keeps its prompt variables」逐项断言会红)。
+    //    出厂 persona(cordis.gotry-patch.yml)今天不引用本变量,所以条件注册安全。
+    //  - **后续约束**:创始人一旦把 `{{session_zone_brief}}` 写进出厂 persona,
+    //    本变量必须改为**无条件注册**(关闸时返回空串)——strict 插值下未注册的
+    //    引用会让整段 persona 渲染失败。那一步同时要改 §48 的变量清单断言、
+    //    persona-surface-guard-tests 的注入面清单与 benchmark-environment-bridge-e2e
+    //    的 CANONICAL_RAW_VARIABLES。
+    //  - 读回按**组装 scope** 取会话身份(dsh agent-loop 以 agent 对象为 ScopeKey,
+    //    与工具侧 exec.agent 同一身份):同一宿主进程里的两个会话因此读不到对方的
+    //    resource 层笔记(设计 §1.1);取不到 scope → 不出 resource 段(fail-closed)。
+    const zoneSwitch = resolveZoneSwitch(config.sessionZones);
+    if (zoneSwitch === 'on') {
+        sp?.variable?.('session_zone_brief', assembleContext => renderSessionZoneBrief({
+            ledger: openLedgerIfExists(config.stateRoot ?? '.'),
+            now: new Date().toISOString(),
+            sessionRef: boundZoneSession(assembleContext?.scope),
+            zoneSwitch,
+        }));
+    }
+    // 通道路由卡(通道注册表生成,docs/design/tool-orchestration-design.md §2.1/D-8):
+    // persona 检索条款只留行为契约,机/火/酒通道顺位与额度口径查卡——prose 教义
+    // 变查表教义,注册表加通道卡片自动一致。
+    sp?.variable?.('channel_routing_card', () => renderRoutingCard());
+    // 通道健康面接线(issue #107/#108):检索通道 verdict → 会话状态标记 +
+    // down/cooldown 事件落持久面(doctor CLI 进程消费)。落盘失败不阻塞检索。
+    const noteChannel = async (channel, verdict) => {
+        const ev = noteChannelVerdict(channel, verdict);
+        if (ev)
+            await recordChannelEvent(config.stateRoot ?? '.', ev);
+    };
+    /**
+     * verdict≠hit 时在平铺 envelope 上追加 routing 建议(§3.3:失败现场教学)。
+     * 健康态两源并集(issue #436):进程内会话态 + 本 stateRoot 持久健康面
+     * (channel-probe / 外部本地生产者 append 的 channel-health.jsonl)。持久面在
+     * **工具结果边界**读入并投影为 down 集合(IO 只在此层,注册表保持纯函数);
+     * 读不到/坏行/未来时间戳=不排除——坏输入不能凭空压制通道,与会话态失联同纪律。
+     * 持久面只会加排除项:它写的 'ok' 恢复事件不能解除本会话刚发生的失败。
+     */
+    const routingField = async (intent, excludeChannel) => {
+        let persistedDown;
+        try {
+            // 同一个捕获时钟贯穿读者与投影:坏时间戳行在 latest-wins 覆盖前就被读者丢弃,
+            // 否则一条未来/缺时间戳的新行会顶掉更早的有效 down,把通道错误判回可用。
+            const now = Date.now();
+            persistedDown = persistedDownChannels(await readLatestChannelEvents(config.stateRoot ?? '.', { now, requireValidTimestamp: true }), now);
+        }
+        catch { /* 健康面缺席=不启用持久排除,建议表退回会话态口径 */ }
+        return { routing: routingAdvice(intent, { excludeChannel, ...(persistedDown ? { persistedDownChannels: persistedDown } : {}) }) };
+    };
+    // D-NEW 进程护栏(Z3 WASM crash 教训):dsh 0.1.1-rc.1 缺 uncaughtException
+    // handler,插件异常穿透即杀进程。我们在 gotry 侧挂护栏:同步 fsync 写事故证据
+    // (gotry-state/incidents.jsonl),handler 自身不再抛,不阻塞后续控制流。
+    // 不调 process.exit——让 dsh/上级容器决定生死,我们只留现场。
+    installProcessGuards(config.stateRoot ?? '.', { uncaughtException: 'gotry-tools', unhandledRejection: 'gotry-tools' });
+    // 账号会话授权闸(RFC 支柱④「用户明示授权 + 站点白名单 + 随时可关」进代码;v2 每会话一次):
+    // 会话面工具动用用户本人登录态,**每会话每站点首次调用**弹 dsh 原生审批卡——
+    // allowed-once 记入会话 granted 集,后续同站调用免弹;用户拒绝 = 本会话吊销
+    // (denied 集,不再弹卡也不再执行——拒绝是裁决,不反复骚扰);无审批通道
+    // (headless 无用户在场)一律 fail-closed 拒绝。sessionAccess: ask(默认)|allow|off。
+    // v1 教训(2026-08-29 founder 实测「每次都要弹,经常无法点击」):逐调用弹卡 = 骚扰,
+    // 会话态收归 capabilities/session-consent.ts。防御:极简宿主/mock ctx 无事件总线时跳过。
+    // issue #194 A-轨道 guard 先注册；生产 Cordis 的 prepend 保证它在授权闸
+    // 前运行，smoke 的轻量事件采集器也继续把授权闸作为最后一个观察项。
+    installSubagentJobIdGuard(ctx);
+    const ctxOn = ctx.on;
+    if (typeof ctxOn === 'function') {
+        const gate = createConsentGate({
+            access: () => config.sessionAccess ?? 'ask',
+            approval: approvalFromContext(ctx),
+        });
+        // site 绑定(#308):dsh pre-execute 实际派发的 arguments 原样进入 gate;
+        // gate 与 execute 共用 resolveSessionSearchKind/interpretArgs,因此 wrapped
+        // query.*、缺省 flight、unknown/malformed 的选择与授权和效应路径保持一致。
+        ctx.on('tools/pre-execute', gate);
+    }
+    // issue #284 修复闸:gotry_doctor.action='repair' 走同一审批缝(scope-keyed,
+    // WeakMap<agent>)——同 agent + 同 scope 复用批准,不同 scope 重问,rejected/cancelled
+    // = 本会话吊销,unavailable 通道不记。同口径 session-consent,不增新持久面。
+    // 注册早于 gotry_doctor(下方),保证工具面闭包捕获当前会话的闸实例。
+    const repairApprovalGate = createRepairApprovalGate({
+        approval: approvalFromContext(ctx),
     });
-    const registerGuarded = (tool)=>{
-        const t = {
-            ...tool
-        };
+    // LLM_MODEL → dsh 会话面模型覆盖(issue #77;机制与分层见
+    // capabilities/model-override.ts 头注)。GOTRY_LLM_MODEL 未设时零行为变化。
+    installModelOverride(ctx);
+    // D-NEW 收尾:全部工具 execute 统一异常隔离——单个工具抛错/拒绝不再沿 cordis
+    // 传到 dsh 主循环,降级为结构化错误返回给 LLM + incident 落盘(incident-log.ts)。
+    const registerGuarded = (tool) => {
+        const t = { ...tool };
         if (typeof t.execute === 'function') {
             t.execute = guardToolExecute(String(t.name), config.stateRoot ?? '.', t.execute);
         }
+        // 工具观察捕获缝(issue #255 P4-3):总闸 on 且工具在闭集白名单内才包裹——
+        // off(默认)时 execute 一层不多包,行为逐字节不变。捕获只投影形状字段
+        // (verdict/条数/价格带),证据只走指针;捕获失败永不影响工具返回值。
+        if (zoneSwitch === 'on' && typeof t.execute === 'function' && isZoneObservableTool(t.name)) {
+            const inner = t.execute;
+            const toolName = String(t.name);
+            t.execute = async (args, exec) => {
+                const result = await inner(args, exec);
+                try {
+                    const sessionRef = zoneSessionRefFromExec(exec);
+                    if (sessionRef) {
+                        bindZoneSession(zoneScopeOfExec(exec), sessionRef);
+                        observeToolResult(openLedgerIfExists(config.stateRoot ?? '.') ?? ensureLedger(config.stateRoot ?? '.'), {
+                            tool: toolName,
+                            result,
+                            session_ref: sessionRef,
+                            ts: new Date().toISOString(),
+                        });
+                    }
+                }
+                catch { /* 记忆面永不把产品主路径带红 */ }
+                return result;
+            };
+        }
         ctx.tools.register(t);
     };
+    // Issue #443: register the five local editor tools only from trusted host
+    // configuration. Tool arguments cannot select process or filesystem authority.
+    registerLavishTools({
+        ctx,
+        register: registerGuarded,
+        getConfig: () => ({ lavishAxiPackageRoot: config.lavishAxiPackageRoot ?? '' }),
+    });
+    // 工具描述首行生成(issue #113,L1):检索工具描述统一前置注册表生成的
+    // 「服务意图 × 通道顺位」卡——模型选工具时(读描述)与失败后(读 routing)
+    // 两个决策点拿到同一张表;注册表加行,描述自动一致。非检索工具原样返回。
+    const routed = (tool, desc) => {
+        const head = toolRoutingHeadline(tool);
+        return head ? `${head}\n${desc}` : desc;
+    };
     registerGuarded(defineTool({
         name: 'gotry_feasibility_check',
-        description: 'Check travel candidates against the user\'s motivation and hard constraints using the ' + 'door-to-door true-cost engine (wake time, arrival state, energy, usable hours, money). ' + 'Input is the structured request (motivation weights + hard constraints + window + budget + home hubs) ' + 'and the candidate list (services/transfers/stay costs/min days): ' + 'structure { request: { motivation weights, hard constraints, window, budget, home hubs }, candidates: [ { id, label, services, transfers, stay, minDays } ] }. ' + 'Returns per-candidate verdicts, unsat cores with minimal-modification suggestions, ' + 'a wish-pool entry for infeasible aspirations, and a ready-to-show markdown answer.',
+        description: 'Check travel candidates against the user\'s motivation and hard constraints using the '
+            + 'door-to-door true-cost engine (wake time, arrival state, energy, usable hours, money). '
+            + 'Input is the structured request (motivation weights + hard constraints + window + budget + home hubs) '
+            + 'and the candidate list (services/transfers/stay costs/min days): '
+            + 'structure { request: { motivation weights, hard constraints, window, budget, home hubs }, candidates: [ { id, label, services, transfers, stay, minDays } ] }. '
+            + 'Returns per-candidate verdicts, unsat cores with minimal-modification suggestions, '
+            + 'a wish-pool entry for infeasible aspirations, and a ready-to-show markdown answer.',
+        // D-30 第五刀(issue #112):payload json blob → 结构化对象(request/candidates 模型可见,
+        // 嵌套形状权威在 unified 引擎契约,工具面不越层强约束)
         parameters: {
             payload: {
-                type: 'json',
+                type: 'object',
+                additionalProperties: false,
                 required: true,
-                description: 'The full engine payload: { request, candidates }.'
-            }
+                properties: {
+                    request: { type: 'object', additionalProperties: true, required: true, description: '引擎请求:{ motivation weights, hard constraints, window, budget, home hubs }' },
+                    candidates: { type: 'array', items: { type: 'object', additionalProperties: true }, required: true, description: '候选列表:[{ id, label, date?, services, transfers, stay, minDays }]' },
+                    planning: {
+                        type: 'object', additionalProperties: false,
+                        description: '可选显式规划上下文;dated 候选省略时默认按宿主时钟作 future 下界过滤,指定 future 年份再加年末上界,historical 仅用于明确历史/回测查询;完全 dateless 输入保持旧可行性计算',
+                        properties: {
+                            intent: { type: 'string', enum: ['future', 'historical'], required: true },
+                            requested_year: { type: 'integer', required: true, description: '用户明确请求的四位年份,不传宿主当前年份' },
+                        },
+                    },
+                    ground_transfer: {
+                        type: 'object',
+                        additionalProperties: false,
+                        description: '可选显式地面接驳覆盖:仅 destination 位置、显式经纬度和 mode=driving;路线同时绑定抵达方向(A→B)与返程方向(B→A),两方向分别请求/缓存/降级,价格仍来自静态包;缓存 TTL 由能力层固定',
+                        properties: {
+                            candidate_id: { type: 'string', description: '要绑定的候选 id;不会按相似度推断' },
+                            transfer_index: { type: 'integer', description: 'dest_transfers 的零基位置;不会按 mode 推断' },
+                            position: { type: 'string', description: '当前切片固定为 destination' },
+                            mode: { type: 'string', description: '当前只接受 driving;其它/缺省模式显式回退静态分钟' },
+                            origin: {
+                                type: 'object',
+                                additionalProperties: false,
+                                description: '旧版单对坐标:等同于 outbound.origin(能力层自动把返程方向设为其互换)',
+                                properties: {
+                                    longitude: { type: 'number' },
+                                    latitude: { type: 'number' },
+                                },
+                            },
+                            destination: {
+                                type: 'object',
+                                additionalProperties: false,
+                                description: '旧版单对坐标:等同于 outbound.destination',
+                                properties: {
+                                    longitude: { type: 'number' },
+                                    latitude: { type: 'number' },
+                                },
+                            },
+                            outbound: {
+                                type: 'object',
+                                additionalProperties: false,
+                                description: '显式抵达方向坐标对(A→B):不指定时回退 origin/destination',
+                                properties: {
+                                    origin: {
+                                        type: 'object',
+                                        additionalProperties: false,
+                                        properties: {
+                                            longitude: { type: 'number' },
+                                            latitude: { type: 'number' },
+                                        },
+                                    },
+                                    destination: {
+                                        type: 'object',
+                                        additionalProperties: false,
+                                        properties: {
+                                            longitude: { type: 'number' },
+                                            latitude: { type: 'number' },
+                                        },
+                                    },
+                                },
+                            },
+                            return: {
+                                type: 'object',
+                                additionalProperties: false,
+                                description: '显式返程方向坐标对(B→A):不指定时回退 outbound 互换',
+                                properties: {
+                                    origin: {
+                                        type: 'object',
+                                        additionalProperties: false,
+                                        properties: {
+                                            longitude: { type: 'number' },
+                                            latitude: { type: 'number' },
+                                        },
+                                    },
+                                    destination: {
+                                        type: 'object',
+                                        additionalProperties: false,
+                                        properties: {
+                                            longitude: { type: 'number' },
+                                            latitude: { type: 'number' },
+                                        },
+                                    },
+                                },
+                            },
+                        },
+                    },
+                },
+            },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.answer_md ?? JSON.stringify(value))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{
+                    type: 'text',
+                    text: String(value.answer_md ?? JSON.stringify(value)),
+                }],
         },
-        async execute (args, _exec) {
+        async execute(args, _exec) {
+            // 纯 TS 路径:D-7 后 unified solveChoiceSegment 是唯一求解入口(无 Python 桥、无 z3 WASM
+            // 路径——候选形态枚举求解,~6ms/次)。unified 内部有 try-catch 护栏覆盖 wasm 异常。
             const started = Date.now();
             const payload = args.payload;
+            const anchor = buildTimeAnchor(clock());
+            let planning;
+            try {
+                planning = parseFeasibilityPlanning(payload['planning'], anchor);
+            }
+            catch (error) {
+                const summary = error instanceof Error ? error.message : 'planning context is invalid';
+                return feasibilityValidationFailure('invalid_planning_context', summary);
+            }
             const req = parseRequest(payload['request']);
             const cands = payload['candidates'].map(parseCandidate);
-            const spec = segmentsFromCandidate(req, cands);
-            const result = solveChoiceSegment(spec, req);
+            const execution = _exec && typeof _exec === 'object' ? _exec : undefined;
+            let solverCandidates = cands;
+            let groundTransferEvidence;
+            if (payload['ground_transfer'] !== undefined) {
+                const prepared = await resolveGroundTransferPayload(payload['ground_transfer'], cands, groundTransferResolver, { signal: execution?.signal, execution });
+                solverCandidates = prepared.candidates;
+                groundTransferEvidence = prepared.resolution;
+            }
+            const spec = segmentsFromCandidate(req, solverCandidates);
+            const planningCheck = applyPlanningWindow(spec, planning, anchor, { defaultDatedFuture: true });
+            if (planningCheck.error) {
+                return feasibilityValidationFailure('planning_window_rejected', planningCheck.error, planningCheck.rejected);
+            }
+            const solved = solveChoiceSegment(planningCheck.spec, req);
+            const result = groundTransferEvidence
+                ? exposeGroundTransferEvidence(solved, groundTransferEvidence)
+                : solved;
             const dir = await ensureStateDir(config.stateRoot);
-            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, 'feasibility_check:in-process-unified').catch(()=>{});
-            return {
-                ok: true,
-                ...result,
-                latency_ms: Date.now() - started,
-                via: 'in-process-unified'
-            };
+            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, 'feasibility_check:in-process-unified').catch(() => { });
+            return { ok: true, ...result, latency_ms: Date.now() - started, via: 'in-process-unified' };
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: 'GoTry 可行性检查(门到门全成本)',
-                kind: 'execute',
-                rawInput: args.payload
-            }),
-        presentResult: (args, value)=>{
+        presentCall: args => ({ card: 'generic', title: 'GoTry 可行性检查(门到门全成本)', kind: 'execute', rawInput: args.payload }),
+        presentResult: (args, value) => {
+            // D-4 卡片赎回:结果卡不再是裸 JSON —— 逐候选判定 + 全成本 vs 预算紧凑行 + 人话答案
             const r = value;
-            const budget = args.payload?.request?.budget_cny;
-            const lines = (r.verdicts ?? []).map((v)=>{
-                const tc = v.true_cost ?? {};
-                const money = typeof tc.money_cny === 'number' ? ` ¥${tc.money_cny}/人` + (typeof budget === 'number' ? `(预算 ¥${budget},${tc.money_cny <= budget ? '余' : '超'} ¥${Math.abs(budget - tc.money_cny)})` : '') : '';
-                return v.feasible ? `✅ ${String(v.name ?? v.candidate_id)}${money}${v.candidate_id === r.recommended ? ' ← 推荐' : ''}` : `❌ ${String(v.name ?? v.candidate_id)} — ${Array.isArray(v.unsat_core) ? v.unsat_core.join(',') : '不可行'}`;
+            const budget = (args.payload?.request)?.budget_cny;
+            const lines = (r.verdicts ?? []).map(v => {
+                const tc = (v.true_cost ?? {});
+                const money = typeof tc.money_cny === 'number'
+                    ? ` ¥${tc.money_cny}/人` + (typeof budget === 'number' ? `(预算 ¥${budget},${tc.money_cny <= budget ? '余' : '超'} ¥${Math.abs(budget - tc.money_cny)})` : '')
+                    : '';
+                return v.feasible
+                    ? `✅ ${String(v.name ?? v.candidate_id)}${money}${v.candidate_id === r.recommended ? ' ← 推荐' : ''}`
+                    : `❌ ${String(v.name ?? v.candidate_id)} — ${(Array.isArray(v.unsat_core) ? v.unsat_core.join(',') : '不可行')}`;
             });
             return {
                 card: 'generic',
                 title: `可行性:${r.recommended ? `推荐 ${r.recommended}` : '全部不可行'}`,
-                content: [
-                    {
-                        type: 'text',
-                        text: (lines.length ? lines.join('\n') + '\n\n' : '') + String(r.answer_md ?? '').slice(0, 1500)
-                    }
-                ]
+                content: [{ type: 'text', text: (lines.length ? lines.join('\n') + '\n\n' : '') + String(r.answer_md ?? '').slice(0, 1500) }],
             };
-        }
+        },
     }));
     registerGuarded(defineTool({
         name: 'gotry_motivation_save',
-        description: 'Persist the traveler\'s motivation profile (the "why depart" contract object). ' + 'This is the B2B reuse seam: downstream plugins consume only MotivationProfile + constraints, ' + 'never the principal/sponsor distinction. MERGE semantics (T1): call again with just the NEW ' + 'facts learned this turn (weights delta optional but MUST bring fresh evidence; evidence = user quotes); ' + 'existing history is never deleted. Requires evidence on every call (P0 anti-fabrication rule).',
+        description: 'Persist the traveler\'s motivation profile (the "why depart" contract object). '
+            + 'This is the B2B reuse seam: downstream plugins consume only MotivationProfile + constraints, '
+            + 'never the principal/sponsor distinction. MERGE semantics (T1): call again with just the NEW '
+            + 'facts learned this turn (weights delta optional but MUST bring fresh evidence; evidence = user quotes); '
+            + 'existing history is never deleted. Requires evidence on every call (P0 anti-fabrication rule).',
+        // D-30 第五刀(issue #112):profile blob → 结构化闭合对象;evidence(P0 反伪造红线)进嵌套
+        // schema 由宿主权闸——无证据的保存请求入口即被结构化拒绝(ToolFailure 形状)
+        // issue #338:homeCity 字段(string=设置,null=显式清除,undefined=不动);单条非空
+        // evidence 可省略 binding,多条 evidence 必须显式 homeCityEvidence。
+        // dsh 参数 schema 仅支持单值 type,string|null 用 oneOf 表达。
         parameters: {
             profile: {
-                type: 'json',
+                type: 'object',
+                additionalProperties: false,
                 required: true,
-                description: '{ weights: {escape_rest: 0.7, ...}, evidence: [user quotes...], hard: {wake_not_before, min_arrival_energy_pct} }'
-            }
+                properties: {
+                    weights: { type: 'object', additionalProperties: true, description: '动机权重增量,如 { escape_rest: 0.7 }(可选,权重变更须伴新证据)' },
+                    evidence: { type: 'array', items: { type: 'string' }, required: true, description: '本轮新事实的用户原话数组(P0:必带)' },
+                    hard: { type: 'object', additionalProperties: true, description: '硬约束:{ wake_not_before, min_arrival_energy_pct }(可选)' },
+                    homeCity: {
+                        oneOf: [
+                            { type: 'string', description: '设置持久常驻城市/默认出发地(用户原话指明常驻),如 "上海"' },
+                            { type: 'null', description: '显式清除常驻城市(用于遗忘/迁居)' },
+                        ],
+                        description: '持久常驻城市/默认出发地(string=设置,null=显式清除);改值须伴新 evidence(P0);恰一条非空可省略 binding,多条须显式;不删候选/不压当轮 origin',
+                    },
+                    homeCityEvidence: {
+                        type: 'string',
+                        description: 'homeCity 对应的 exact 用户原话;显式传入时必须逐字出现在本次 profile.evidence 中且为新证据(同值同绑定重复调用例外为幂等);evidence 恰好一条非空时可省略并绑定该条,多条时必须显式传入',
+                    },
+                },
+            },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: `动机画像已保存:${String(value.path ?? '')}`
-                    }
-                ]
+            // loose json:guard 兜底字段(ok/summary)不被 strict schema 拒(骨架事故同款)
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: `动机画像已保存:${String(value.path ?? '')}` }],
         },
-        async execute (args, _exec) {
-            const incoming = args.profile ?? {};
+        async execute(args, _exec) {
+            // T1 接线:本工具是增量补丁语义(契约 18——模型每轮把对话新事实带进来),
+            // 经 mergeProfile 守门合并进既有画像(追加不删史/幂等/权重变更须伴新证据),
+            // 不再整档覆盖。首次调用(无档案)= 全量建立。
+            // ADR-15:守门+事件+投影在账本单事务内完成,evidence 红线拒绝即回滚,账本无痕。
+            // issue #338:homeCity 同走 mergeProfile 守门(null=显式清除)。单条非空
+            // evidence 可提供省略的 unambiguous binding;多条 evidence 不按数组位置推断。
+            const incoming = (args.profile ?? {});
             if (!incoming.evidence?.length) {
                 throw new Error('refusing to save a motivation profile without evidence (P0 anti-fabrication rule)');
             }
+            // issue #338:trim 后空白拒绝(零事件落账)。空白字符串「无值」≠
+            // 「显式清除」——后者是 null,前者是没有声明。不擅自解释,显式拒收。
+            if (typeof incoming.homeCity === 'string' && incoming.homeCity.trim().length === 0) {
+                throw new Error('gotry_motivation_save.homeCity 是空白字符串,既不是声明也不是清除;请明确传城市名或 null');
+            }
+            let boundHomeCityEvidence;
+            if (incoming.homeCity !== undefined) {
+                if (incoming.homeCityEvidence !== undefined) {
+                    if (typeof incoming.homeCityEvidence !== 'string' || incoming.homeCityEvidence.trim().length === 0) {
+                        throw new Error('gotry_motivation_save.homeCityEvidence 为空白;homeCity 必须绑定本次 evidence 中的一条 exact 用户原话');
+                    }
+                    if (!incoming.evidence.some(e => e === incoming.homeCityEvidence)) {
+                        throw new Error('gotry_motivation_save.homeCityEvidence 必须逐字匹配本次 profile.evidence 中的一条用户原话');
+                    }
+                    boundHomeCityEvidence = incoming.homeCityEvidence;
+                }
+                else if (incoming.evidence.length === 1 && typeof incoming.evidence[0] === 'string' && incoming.evidence[0].trim().length > 0) {
+                    boundHomeCityEvidence = incoming.evidence[0];
+                }
+                else {
+                    throw new Error('gotry_motivation_save.homeCityEvidence 缺失或有歧义;evidence 恰好一条非空时可省略,多条 evidence 必须显式绑定 exact 用户原话');
+                }
+            }
+            else if (incoming.homeCityEvidence !== undefined) {
+                throw new Error('gotry_motivation_save.homeCityEvidence 只能与 homeCity 一起传入');
+            }
             const ledger = ensureLedger(config.stateRoot);
             const res = ledger.appendMotivationPatch({
                 weights: incoming.weights,
                 evidence: incoming.evidence,
-                hard: incoming.hard
+                hard: incoming.hard,
+                homeCity: incoming.homeCity,
+                homeCityEvidence: boundHomeCityEvidence,
             });
             const profileJson = JSON.parse(JSON.stringify(res.profile));
-            return res.saved ? {
-                ok: true,
-                saved: true,
-                path: ledger.dbPath,
-                profile: profileJson,
-                summary: '画像已合并入账本(单事务)'
-            } : {
-                ok: true,
-                saved: false,
-                path: ledger.dbPath,
-                profile: profileJson,
-                summary: '无新内容(幂等跳过)'
-            };
+            return res.saved
+                ? { ok: true, saved: true, path: ledger.dbPath, profile: profileJson, summary: '画像已合并入账本(单事务)' }
+                : { ok: true, saved: false, path: ledger.dbPath, profile: profileJson, summary: '无新内容(幂等跳过)' };
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: '保存动机画像',
-                kind: 'edit',
-                rawInput: args.profile
-            })
+        presentCall: args => ({ card: 'generic', title: '保存动机画像', kind: 'edit', rawInput: args.profile }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_wish_pool_add',
-        description: 'Add an aspiration to the "next departure" wish pool — the graceful home for infeasible dreams. ' + 'An entry carries its fulfilment conditions (days needed, budget, best months) so a future ' + '"next departure" nudge can fire when the window matches. Each entry gets a stable wish_id ' + '(the memory-utility sidecar keys on it); muted:true puts a wish dormant (永不删除,只是不再召回). 憧憬不被拒绝。',
+        description: 'Add an aspiration to the "next departure" wish pool — the graceful home for infeasible dreams. '
+            + 'An entry carries its fulfilment conditions (days needed, budget, best months) so a future '
+            + '"next departure" nudge can fire when the window matches. Each entry gets a stable wish_id '
+            + '(the memory-utility sidecar keys on it); muted:true puts a wish dormant (永不删除,只是不再召回). 憧憬不被拒绝。',
         parameters: {
             entry: {
                 type: 'json',
                 required: true,
-                description: '{ name, reason?, conditions: { days, budget_cny, best_months }, muted?: boolean }'
-            }
+                description: '{ name, reason?, conditions: { days, budget_cny, best_months, channels? }, muted?: boolean }',
+            },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>{
+            // loose json:guard 兜底字段(ok/summary)不被 strict schema 拒(骨架事故同款)
+            schema: { type: 'json' },
+            render: (_args, value) => {
                 const v = value;
-                return [
-                    {
-                        type: 'text',
-                        text: `已加入「下一次出发」清单(共 ${v.total ?? '?'} 项):${v.path ?? ''}`
-                    }
-                ];
-            }
+                return [{ type: 'text', text: `已加入「下一次出发」清单(共 ${v.total ?? '?'} 项):${v.path ?? ''}` }];
+            },
         },
-        async execute (args, _exec) {
-            const entry = args.entry ?? {};
+        async execute(args, _exec) {
+            const entry = (args.entry ?? {});
+            // 同名憧憬幂等更新(刷新理由与成行条件),不重复入池;wish_id 语义派生自名称,稳定可重放。
+            // ADR-15:conditions 红线在账本事务内校验拒绝。
             const ledger = ensureLedger(config.stateRoot);
-            const r = ledger.appendWish({
-                name: entry.name,
-                reason: entry.reason,
-                conditions: entry.conditions,
-                muted: entry.muted
-            });
-            return {
-                ok: true,
-                added: r.added,
-                wish_id: r.wish_id,
-                total: r.total,
-                path: ledger.dbPath
-            };
+            const r = ledger.appendWish({ name: entry.name, reason: entry.reason, conditions: entry.conditions, muted: entry.muted });
+            return { ok: true, added: r.added, wish_id: r.wish_id, total: r.total, path: ledger.dbPath };
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: '加入「下一次出发」清单',
-                kind: 'edit',
-                rawInput: args.entry
-            })
+        presentCall: args => ({ card: 'generic', title: '加入「下一次出发」清单', kind: 'edit', rawInput: args.entry }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_wish_pool_list',
-        description: 'Surface AT MOST ONE "next departure" wish whose fulfilment conditions match the user\'s current window ' + '(0..1 rule: never more than one nudge per turn, never push when nothing matches — 憧憬不被拒绝,也不被硬推). ' + 'Muted wishes never surface. Surfacing records a recalled event in the memory-utility sidecar. ' + 'action="confirm-outcome" records the user-confirmed real-world outcome (attribution helpful/harmful/neutral) — ' + 'ONLY pass attribution the user explicitly stated; the agent must never self-attribute usefulness.',
+        description: 'Surface AT MOST ONE "next departure" wish whose fulfilment conditions match the user\'s current window '
+            + '(0..1 rule: never more than one nudge per turn, never push when nothing matches — 憧憬不被拒绝,也不被硬推). '
+            + 'Muted wishes never surface. Surfacing records a recalled event in the memory-utility sidecar. '
+            + 'A wish whose conditions.channels names a channel that is currently down (out-of-band health facts) is vetoed for this recall — 不推当下走不通的憧憬. '
+            + 'action="confirm-outcome" records the user-confirmed real-world outcome (attribution helpful/harmful/neutral) — '
+            + 'ONLY pass attribution the user explicitly stated; the agent must never self-attribute usefulness.',
+        // D-30 第四刀(issue #112):query blob → 平铺 typed;全字段可选 → interpretArgs 容忍层
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ action?: "recall"|"confirm-outcome", days?, budgetCny?, month?, wishId?, attribution?: "helpful"|"harmful"|"neutral", detail?, tripStart?: "行程起始(确认成行时挂时间线)" }'
-            }
+            action: { type: 'string', description: 'recall(默认,召回下一次出发建议)或 confirm-outcome(确认某条建议成/不成)' },
+            days: { type: 'integer', description: '回看天数窗(recall)' },
+            budgetCny: { type: 'number', description: '预算上限(recall 过滤)' },
+            month: { type: 'integer', description: '出行月份 1-12(recall)' },
+            wishId: { type: 'string', description: 'confirm-outcome 目标愿望 id' },
+            attribution: { type: 'string', enum: ['helpful', 'harmful', 'neutral'], description: 'confirm-outcome 归因' },
+            detail: { type: 'string', description: '一句话细节(用户原话)' },
+            tripStart: { type: 'string', description: '确认成行时挂时间线的行程起始日' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? '')
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
         },
-        async execute (args, _exec) {
+        async execute(args, _exec) {
             const q = unwrapQuery(args, 'action');
             const ledger = ensureLedger(config.stateRoot);
             const now = new Date().toISOString();
             if (q.action === 'confirm-outcome') {
                 if (!q.wishId || !q.attribution) {
-                    return {
-                        ok: false,
-                        summary: 'confirm-outcome 需要 wishId + attribution(helpful|harmful|neutral)'
-                    };
+                    return { ok: false, summary: 'confirm-outcome 需要 wishId + attribution(helpful|harmful|neutral)' };
                 }
+                // 成行确认 = 效用事件 + 可选时间线行程,账本单事务(ADR-15:原两文件写在崩溃时分叉)
                 let tripInput;
-                const wish = ledger.readWishPool().find((e)=>String(e.wish_id) === q.wishId);
+                const wish = ledger.readWishPool().find(e => String(e.wish_id) === q.wishId);
                 if (q.tripStart && wish?.name) {
                     const anchor = buildTimeAnchor(new Date());
                     const start = resolveTimelineDate(q.tripStart, anchor) ?? (/^\d{4}-\d{2}-\d{2}$/.test(q.tripStart) ? q.tripStart : undefined);
                     if (start) {
                         tripInput = {
-                            destination: String(wish.name),
-                            start,
-                            companions: undefined,
-                            source: 'wish-confirmed',
-                            evidence: `wish ${q.wishId} confirm-outcome(${q.attribution})`
+                            destination: String(wish.name), start, companions: undefined,
+                            source: 'wish-confirmed', evidence: `wish ${q.wishId} confirm-outcome(${q.attribution})`,
                         };
                     }
                 }
-                const r = ledger.confirmOutcome({
-                    wishId: q.wishId,
-                    attribution: q.attribution,
-                    detail: q.detail,
-                    trip: tripInput
-                });
-                return {
-                    ok: true,
-                    recorded: r.recorded,
-                    wish_id: q.wishId,
-                    status: q.attribution,
-                    ...r.trip ? {
-                        trip: r.trip
-                    } : {}
-                };
+                const r = ledger.confirmOutcome({ wishId: q.wishId, attribution: q.attribution, detail: q.detail, trip: tripInput });
+                return { ok: true, recorded: r.recorded, wish_id: q.wishId, status: q.attribution, ...(r.trip ? { trip: r.trip } : {}) };
             }
+            // recall:0..1 条件匹配(判定归 wish-pool 纯函数),muted 永不召回,无命中不硬推;
+            // 通道否证(接缝第 2 段):持久健康面里处于 down 的通道集合进 context——
+            // conditions.channels 命名依赖通道的愿望在被否证时不当场推荐(读不到健康面=不启用)。
             const pool = ledger.readWishPool();
-            const candidates = pool.filter((e)=>!e.muted && typeof e.wish_id === 'string');
+            const candidates = pool.filter(e => !e.muted && typeof e.wish_id === 'string');
             const month = q.month ?? new Date().getMonth() + 1;
-            const match = pickNudgeWish(candidates, {
-                days: q.days,
-                budgetCny: q.budgetCny,
-                month
-            });
+            let channelDown;
+            try {
+                const latest = await readLatestChannelEvents(config.stateRoot);
+                const down = new Set();
+                for (const [ch, ev] of latest)
+                    if (ev.state === 'down')
+                        down.add(ch);
+                channelDown = down;
+            }
+            catch { /* 健康面缺席=不启用否证,召回行为与旧版一致 */ }
+            const match = pickNudgeWish(candidates, { days: q.days, budgetCny: q.budgetCny, month, channelDown });
             if (!match) {
-                return {
-                    ok: true,
-                    suggestion: null,
-                    summary: `无可成行的憧憬匹配当前窗口(${candidates.length} 条在册,0..1 纪律:不硬推)`
-                };
+                return { ok: true, suggestion: null, summary: `无可成行的憧憬匹配当前窗口(${candidates.length} 条在册,0..1 纪律:不硬推)` };
             }
             const { events: next } = ledger.appendUtilityEvent({
-                wish_id: match.wishId,
-                kind: 'recalled',
-                ts: now,
-                ctx: 'gotry_wish_pool_list.recall'
+                wish_id: match.wishId, kind: 'recalled', ts: now, ctx: 'gotry_wish_pool_list.recall',
             });
             const utility = projectUtility(next)[match.wishId];
             return {
                 ok: true,
-                suggestion: {
-                    wish_id: match.entry['wish_id'],
-                    name: match.entry['name'],
-                    reason: match.entry['reason'],
-                    conditions: match.entry['conditions'],
-                    match_score: match.score,
-                    hits: match.hits
-                },
-                utility: {
-                    status: utility?.status ?? 'unknown',
-                    recalled: utility?.recalled ?? 1
-                },
-                summary: `「下一次出发」候选(0..1):${String(match.entry['name'])}——成行条件 ${JSON.stringify(match.entry['conditions'])},本次窗口命中 ${match.score}/3 项(${match.hits.join('+')});效用状态 ${utility?.status ?? 'unknown'}`
+                suggestion: { wish_id: match.entry['wish_id'], name: match.entry['name'], reason: match.entry['reason'], conditions: match.entry['conditions'], match_score: match.score, hits: match.hits },
+                utility: { status: utility?.status ?? 'unknown', recalled: utility?.recalled ?? 1 },
+                summary: `「下一次出发」候选(0..1):${String(match.entry['name'])}——成行条件 ${JSON.stringify(match.entry['conditions'])},本次窗口命中 ${match.score}/3 项(${match.hits.join('+')});效用状态 ${utility?.status ?? 'unknown'}`,
             };
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: '「下一次出发」召回',
-                kind: 'search',
-                rawInput: args.query
-            })
+        presentCall: args => ({ card: 'generic', title: '「下一次出发」召回', kind: 'search', rawInput: args }),
+    }));
+    // ADR-24 v2 复访交付面:用户回问「行程规划好了吗」时,模型用这个只读工具
+    // 查后台工单状态;settled 附交付物摘录(完整内容在工单同目录
+    // .deliverable.md)。工单由 scripts/turn-handoff-collect.ts 收集结算。
+    registerGuarded(defineTool({
+        name: 'gotry_turn_handoff_list',
+        description: 'List background deep-planning handoff tickets (read-only). Call this whenever the user asks about '
+            + 'a previously handed-off plan («规划好了吗» / «上次那个行程»): open = still being worked in the '
+            + 'background (ETA ' + '约 1 小时' + '), settled = deliverable ready (excerpt included, full text in the '
+            + 'ticket\'s .deliverable.md), failed = honest failure note. Never fabricate a deliverable that is not here.',
+        // D-30 第三刀(issue #112):query blob → 平铺 typed;全字段可选 → interpretArgs 容忍层(同 session 刀法)
+        parameters: {
+            ticketId: { type: 'string', description: '只看这一单,如 th-...(缺省列全部)' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
+        },
+        async execute(args, _exec) {
+            const q = interpretArgs(args);
+            const root = process.env.GOTRY_TURN_HANDOFF_ROOT ?? config.stateRoot ?? '.';
+            const all = await listTurnHandoffTickets(root);
+            const tickets = (q.ticketId ? all.filter(t => t.id === q.ticketId) : all).slice(0, 10);
+            if (tickets.length === 0) {
+                return {
+                    ok: true, count: 0,
+                    summary: q.ticketId
+                        ? `没有 id 为 ${q.ticketId} 的后台规划工单(可能已被清理或记错 id)`
+                        : '当前没有后台深度规划工单(无挂起、无历史)',
+                };
+            }
+            const lines = tickets.map(t => {
+                const head = `[${t.status}] ${t.id} ${t.objective.slice(0, 40)}`;
+                if (t.status === 'open')
+                    return `${head}——后台规划中,ETA ${t.etaLabel}`;
+                if (t.status === 'failed')
+                    return `${head}——失败:${t.error ?? '未知原因'}(请重新发起规划)`;
+                return `${head}——已交付,摘要:${(t.deliverableExcerpt ?? '').slice(0, 120).replace(/\n/g, ' ')}`;
+            });
+            return {
+                ok: true, count: tickets.length, tickets,
+                summary: `后台规划工单 ${tickets.length} 张:\n${lines.join('\n')}`,
+            };
+        },
+        presentCall: args => ({ card: 'generic', title: '后台规划工单查询', kind: 'search', rawInput: args }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_companion_save',
-        description: 'Save/update a travel companion profile (memory-design M5 layer): constraints that shape itinerary STRUCTURE and ranking — ' + 'never a hard filter (「爸爸65轻度高血压」→ 不排高海拔/控制步行量;「晕车」→ 优先火车/备提示). ' + 'evidence MUST be the user\'s verbatim words (append-only, traceable). ' + 'NEGATIVE LIST: passport/ID/phone numbers are rejected on sight — such fields never enter storage.',
+        description: 'Save/update a travel companion profile (memory-design M5 layer): constraints that shape itinerary STRUCTURE and ranking — '
+            + 'never a hard filter (「爸爸65轻度高血压」→ 不排高海拔/控制步行量;「晕车」→ 优先火车/备提示). '
+            + 'evidence MUST be the user\'s verbatim words (append-only, traceable). '
+            + 'NEGATIVE LIST: passport/ID/phone numbers are rejected on sight — such fields never enter storage.',
+        // D-30 第五刀(issue #112):companion blob → 结构化闭合对象;label/evidence required 由宿主权闸
+        // (evidence append-only 溯源 P0;additionalProperties:false 与负面清单同向——护照/证件号类
+        // 杂散字段入口即拒)
         parameters: {
             companion: {
-                type: 'json',
+                type: 'object',
+                additionalProperties: false,
                 required: true,
-                description: '{ label: "爸爸", constraints: { mobility?: "步行≤4h", health?: ["轻度高血压"], prefs?: ["怕吵"] }, evidence: "<用户原话>" }'
-            }
+                properties: {
+                    label: { type: 'string', required: true, description: '称呼,如 爸爸' },
+                    constraints: { type: 'object', additionalProperties: true, description: '{ mobility?: "步行≤4h", health?: ["轻度高血压"], prefs?: ["怕吵"] }' },
+                    evidence: { type: 'string', required: true, description: '用户原话(append-only 可溯源,P0)' },
+                },
+            },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? '')
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
         },
-        async execute (args, _exec) {
-            const c = args.companion ?? {};
-            if (!c.evidence) return {
-                ok: false,
-                summary: 'evidence 必填(用户原话,溯源 P0)'
-            };
+        async execute(args, _exec) {
+            const c = (args.companion ?? {});
+            if (!c.evidence)
+                return { ok: false, summary: 'evidence 必填(用户原话,溯源 P0)' };
+            // ADR-15:负面清单守卫(upsertCompanion)在账本事务内执行,拒收即回滚
             const ledger = ensureLedger(config.stateRoot);
             const res = ledger.appendCompanion({
                 label: String(c.label ?? ''),
-                constraints: {
-                    mobility: c.constraints?.mobility,
-                    health: c.constraints?.health,
-                    prefs: c.constraints?.prefs
-                },
-                evidence: c.evidence
+                constraints: { mobility: c.constraints?.mobility, health: c.constraints?.health, prefs: c.constraints?.prefs },
+                evidence: c.evidence,
             });
-            if (!res.appended && res.reason) return {
-                ok: false,
-                summary: res.reason
-            };
-            return {
-                ok: true,
-                appended: res.appended,
-                companion_id: res.companionId,
-                total: res.total,
-                summary: res.appended ? `同行人已保存:${res.companionId}` : `无新内容(幂等跳过):${res.companionId}`
-            };
+            if (!res.appended && res.reason)
+                return { ok: false, summary: res.reason };
+            return { ok: true, appended: res.appended, companion_id: res.companionId, total: res.total, summary: res.appended ? `同行人已保存:${res.companionId}` : `无新内容(幂等跳过):${res.companionId}` };
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: '保存同行人',
-                kind: 'edit',
-                rawInput: args.companion
-            })
+        presentCall: args => ({ card: 'generic', title: '保存同行人', kind: 'edit', rawInput: args.companion }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_trip_log',
-        description: 'Record a PAST trip into the travel timeline (memory-design M4 layer). Use when the user mentions a trip they already took ' + '(「去年国庆去了大理」) — dates resolve via the time anchor (词表外日期会拒绝,请用户给绝对日期), evidence MUST be the user\'s verbatim words. ' + 'Append-only and idempotent (same destination+start+source = same trip); overlapping same-destination trips are rejected for human adjudication. ' + 'Past trips power origin resolution and 「去过不再推」 ranking — never a hard filter.',
+        description: 'Record a PAST trip into the travel timeline (memory-design M4 layer). Use when the user mentions a trip they already took '
+            + '(「去年国庆去了大理」) — dates resolve via the time anchor (词表外日期会拒绝,请用户给绝对日期), evidence MUST be the user\'s verbatim words. '
+            + 'Append-only and idempotent (same destination+start+source = same trip); overlapping same-destination trips are rejected for human adjudication. '
+            + 'Past trips power origin resolution and 「去过不再推」 ranking — never a hard filter.',
+        // D-30 第四刀(issue #112):平铺 typed;destination/evidence required → 宿主权入口拒缺参
+        // (evidence 是 P0 溯源红线,进 schema 由宿主权闸,不再依赖 execute 散文报错)
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ destination: "大理", start: "2025-10-01 或绝对日期表达", end?: 同上, companions?: ["爸爸"], evidence: "<用户原话>" }'
-            }
+            destination: { type: 'string', required: true, description: '目的地,如 大理' },
+            start: { type: 'string', required: true, description: '行程起始:YYYY-MM-DD 或绝对日期表达(解析不了 execute 结构化报错不猜)' },
+            end: { type: 'string', description: '行程结束,形态同 start(可选)' },
+            companions: { type: 'array', items: { type: 'string' }, description: '同行人,如 ["爸爸"]' },
+            evidence: { type: 'string', required: true, description: '用户原话(溯源 P0 红线)' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? '')
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'destination');
-            if (!q.destination) return {
-                ok: false,
-                summary: 'destination 必填'
-            };
-            if (!q.evidence) return {
-                ok: false,
-                summary: 'evidence 必填(用户原话,溯源 P0)'
-            };
+        async execute(args, _exec) {
+            const q = args;
+            if (!q.destination)
+                return { ok: false, summary: 'destination 必填' };
+            if (!q.evidence)
+                return { ok: false, summary: 'evidence 必填(用户原话,溯源 P0)' };
             const anchor = buildTimeAnchor(new Date());
             const start = resolveTimelineDate(q.start ?? '', anchor) ?? (/^\d{4}-\d{2}-\d{2}$/.test(q.start ?? '') ? q.start : undefined);
-            if (!start) return {
-                ok: false,
-                summary: `start 无法解析为绝对日期(${q.start ?? '缺'})——请向用户要具体日期,不猜`
-            };
-            const end = q.end ? resolveTimelineDate(q.end, anchor) ?? (/^\d{4}-\d{2}-\d{2}$/.test(q.end) ? q.end : undefined) : undefined;
+            if (!start)
+                return { ok: false, summary: `start 无法解析为绝对日期(${q.start ?? '缺'})——请向用户要具体日期,不猜` };
+            const end = q.end ? (resolveTimelineDate(q.end, anchor) ?? (/^\d{4}-\d{2}-\d{2}$/.test(q.end) ? q.end : undefined)) : undefined;
+            // ADR-15:appendTrip 守门(必填/绝对日期/重叠冲突即停)在账本事务内执行
             const ledger = ensureLedger(config.stateRoot);
             const res = ledger.appendTripEvent({
-                destination: q.destination.trim(),
-                start,
-                end,
-                companions: q.companions,
-                source: 'user-verbatim',
-                evidence: q.evidence
+                destination: q.destination.trim(), start, end, companions: q.companions,
+                source: 'user-verbatim', evidence: q.evidence,
             });
-            if (!res.appended && res.reason) return {
-                ok: false,
-                summary: res.reason
-            };
-            return {
-                ok: true,
-                appended: res.appended,
-                trip_id: res.tripId,
-                total: res.total,
-                summary: res.appended ? `已入时间线:${q.destination} @ ${start}` : `已存在(幂等跳过):${res.tripId}`
-            };
+            if (!res.appended && res.reason)
+                return { ok: false, summary: res.reason };
+            return { ok: true, appended: res.appended, trip_id: res.tripId, total: res.total, summary: res.appended ? `已入时间线:${q.destination} @ ${start}` : `已存在(幂等跳过):${res.tripId}` };
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: '记录旅行',
-                kind: 'edit',
-                rawInput: args.query
-            })
+        presentCall: args => ({ card: 'generic', title: '记录旅行', kind: 'edit', rawInput: args }),
     }));
+    // 会话双区记忆工具面(issue #255 P4-3):**只在总闸 on 时注册**——off(默认)时
+    // 工具清单逐项不变,模型看不到任何分区入口(接线惰性的第一道)。
+    if (zoneSwitch === 'on') {
+        registerGuarded(defineTool({
+            name: 'gotry_session_zone_note',
+            description: 'Session working-zone memory (hot context, issue #255): capture a STRUCTURED fragment of what is still in play this session '
+                + '(destination / date window / party size / budget stance = intent tier, 24h; search shapes = resource tier, 30min), '
+                + 'revise it with optimistic CAS when the user corrects a detail, or drop it when it stops being true. '
+                + 'Payload must be typed slot-spec-family fields — NEVER raw conversation text, IDs, phone numbers, URLs or credentials '
+                + '(the write gate rejects those shapes). Evidence is a pointer (session + observation index), never content. '
+                + 'action="propose" only PROPOSES moving a note into the durable notebook: it writes NOTHING; the owner must confirm in their own words, '
+                + 'after which you call gotry_session_zone_promote with that quote. The model may never self-promote. '
+                + 'action="deny" records that the owner declined to remember it long-term (writes nothing; stop re-proposing it this session).',
+            parameters: {
+                action: { type: 'string', required: true, enum: ['capture', 'revise', 'drop', 'propose', 'deny'], description: 'capture=新片段入工作区;revise=CAS 修订(需 noteId+expectedRev);drop=更正即弃;propose=提议晋升(零写入);deny=owner 否决提议(零写入)' },
+                tier: { type: 'string', enum: ['resource', 'intent'], description: 'capture 必填:intent(目的地/日期/人数/预算立场,24h)或 resource(检索形态,30min)' },
+                kind: { type: 'string', enum: ['availability', 'price_band', 'destination', 'date_window', 'party_size', 'budget_stance'], description: 'capture 必填;revise 可选(改 kind)' },
+                payload: { type: 'object', additionalProperties: true, description: '结构化片段,如 { city: "大理" } / { start: "2026-11-01", end: "2026-11-05" };禁放原文/证件/电话/URL/凭证' },
+                noteId: { type: 'string', description: 'revise/drop/propose 的目标笔记 id' },
+                expectedRev: { type: 'integer', description: 'revise 的父 rev(必须等于当前 rev,否则 stale_rev 拒绝)' },
+                promoteKind: { type: 'string', enum: ['trip_fact', 'preference', 'constraint', 'lesson'], description: 'propose 时提议的持久条目类别' },
+            },
+            output: {
+                schema: { type: 'json' },
+                render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
+            },
+            async execute(args, exec) {
+                const sessionRef = zoneSessionRefFromExec(exec);
+                if (!sessionRef) {
+                    return { ok: false, code: 'bad_session', summary: '无会话身份(exec.agent.session.id 缺失):分区不记忆无主体的片段' };
+                }
+                bindZoneSession(zoneScopeOfExec(exec), sessionRef);
+                const r = applyZoneNote(ensureLedger(config.stateRoot), {
+                    action: args.action,
+                    ...(args.tier !== undefined ? { tier: args.tier } : {}),
+                    ...(args.kind !== undefined ? { kind: args.kind } : {}),
+                    ...(args.payload !== undefined ? { payload: args.payload } : {}),
+                    ...(args.noteId !== undefined ? { noteId: args.noteId } : {}),
+                    ...(args.expectedRev !== undefined ? { expectedRev: args.expectedRev } : {}),
+                    ...(args.promoteKind !== undefined ? { promoteKind: args.promoteKind } : {}),
+                    session_ref: sessionRef,
+                    ts: new Date().toISOString(),
+                });
+                if (!r.ok)
+                    return { ok: false, code: r.code, summary: r.detail };
+                const summary = r.proposed
+                    ? `已提议(未写入):${r.ask ?? ''}`
+                    : `${r.action}${r.appended ? ' 已落账' : ' 幂等跳过'}${r.noteId ? `:${r.noteId.slice(0, 60)}` : ''}`;
+                return { ok: true, action: r.action, appended: r.appended, note_id: r.noteId, requires_owner_confirm: r.requiresOwnerConfirm === true, summary };
+            },
+            presentCall: args => ({ card: 'generic', title: `会话记忆:${String(args.action ?? '')}`, kind: 'edit', rawInput: args }),
+        }));
+        registerGuarded(defineTool({
+            name: 'gotry_session_zone_promote',
+            description: 'Owner-confirmed promotion into the durable trip notebook (issue #255) — the ONLY write path into durable memory. '
+                + 'Requires ownerQuote: the user\'s OWN words confirming they want this remembered long-term; your own summary is not a confirmation. '
+                + 'Routing rule: a preference ALSO goes through the motivation-profile gate (pass motivation.{weights|hard|homeCity}), '
+                + 'a trip fact through the timeline gate (pass trip.{destination,start}), a companion constraint through the companion gate (pass companion.{label,constraints}). '
+                + 'Without the required routed payload the promotion is REJECTED — the notebook never becomes a parallel store for a fact that already has an owner. '
+                + 'Generic constraints and lessons live in the notebook itself. The notebook write and the routed gate write are one transaction: they cannot diverge.',
+            parameters: {
+                noteId: { type: 'string', required: true, description: '源工作区笔记 id(必须未过期)' },
+                kind: { type: 'string', required: true, enum: ['trip_fact', 'preference', 'constraint', 'lesson'], description: '持久条目类别' },
+                ownerQuote: { type: 'string', required: true, description: '用户本人确认要长期记住的原话(≤200 字;模型自述不算确认)' },
+                surface: { type: 'string', required: true, enum: ['user_reply', 'approval_card'], description: '确认表面:用户回复 或 审批卡' },
+                payload: { type: 'object', additionalProperties: true, description: '可选:覆盖源笔记载荷的结构化断言' },
+                motivation: { type: 'object', additionalProperties: true, description: 'preference 必填:{ weights?, hard?, homeCity? } 至少一项(经动机画像闸)' },
+                trip: { type: 'object', additionalProperties: true, description: 'trip_fact 必填:{ destination, start(YYYY-MM-DD), end?, companions? }(经时间线闸)' },
+                companion: { type: 'object', additionalProperties: true, description: '同行人约束必填:{ label, constraints:{ mobility?, health?, prefs? } }(经同行人闸)' },
+            },
+            output: {
+                schema: { type: 'json' },
+                render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
+            },
+            async execute(args, exec) {
+                const sessionRef = zoneSessionRefFromExec(exec);
+                if (sessionRef)
+                    bindZoneSession(zoneScopeOfExec(exec), sessionRef);
+                const r = promoteWithRouting(ensureLedger(config.stateRoot), {
+                    noteId: String(args.noteId ?? ''),
+                    kind: String(args.kind ?? ''),
+                    ownerQuote: String(args.ownerQuote ?? ''),
+                    surface: String(args.surface ?? ''),
+                    ...(args.payload !== undefined ? { payload: args.payload } : {}),
+                    ...(args.motivation !== undefined ? { motivation: args.motivation } : {}),
+                    ...(args.trip !== undefined ? { trip: args.trip } : {}),
+                    ...(args.companion !== undefined ? { companion: args.companion } : {}),
+                    ts: new Date().toISOString(),
+                });
+                if (!r.ok)
+                    return { ok: false, code: r.code, summary: r.detail };
+                const routed = r.routed ? `;并经 ${r.routed.authority} 闸${r.routed.applied ? '落地' : '幂等跳过'}` : '';
+                return {
+                    ok: true,
+                    appended: r.appended,
+                    entry_id: r.entryId,
+                    authority: r.authority,
+                    routed: r.routed ? JSON.parse(JSON.stringify(r.routed)) : null,
+                    summary: `${r.appended ? '已写入笔记本' : '笔记本幂等跳过'}${routed}`,
+                };
+            },
+            presentCall: args => ({ card: 'generic', title: '笔记本晋升(owner 确认)', kind: 'edit', rawInput: args }),
+        }));
+    }
     registerGuarded(defineTool({
         name: 'gotry_hotel_search',
-        description: 'Search hotels via hotelbyte-cli (real-time when hbcli credentials exist, falls back to the static pack with explicit evidence tagging). ' + 'Input: destination city name + optional dates/occupancy. Dates accept verbatim natural expressions (下周五 / 8.20 / 下周五+3) — ' + 'the code layer resolves them against the time anchor; unresolved expressions degrade to an undated search with an explicit ' + 'date_notes entry instead of guessing. Output: hotel list with evidence chain ([realtime-API:hbcli] + fetch timestamp, ' + 'or [static-pack:estimate]) per the L4 invariant.',
+        description: routed('gotry_hotel_search', 'Search hotels via hotelbyte-cli (real-time when hbcli credentials exist, falls back to the static pack with explicit evidence tagging). '
+            + 'Input: destination city name + optional dates/adults. Dates accept verbatim natural expressions (下周五 / 8.20 / 下周五+3) — '
+            + 'the code layer resolves them against the time anchor. **Dates are required for a supplier search** (issue #283): missing, blank, '
+            + 'single-side, unresolvable, or checkOut ≤ checkIn returns an actionable input_required result WITHOUT spawning the vendor CLI; '
+            + 'only after a complete valid stay window is fixed do we forward to hbcli. '
+            + 'Output: hotel list with evidence chain ([realtime-API:hbcli] + fetch timestamp, '
+            + 'or [static-pack:estimate]) per the L4 invariant. Independent read-only: safe to issue in the same step as other independent searches; '
+            + 'the host abort signal is forwarded to the spawned process tree.'),
+        // 并发安全(issue #519):只读检索,execute 不写共享会话态(延迟/事实落盘 append-only 且失败不阻塞),
+        // 私有进程组接收宿主 signal；取消有界返回，未知组外后代不冒充已回收。
+        isConcurrencySafe: () => true,
+        // D-30 第二刀(issue #112):query blob → 平铺 typed 契约(同 flyai 刀法)。
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ destination: "<目的地城市>", checkIn?: "YYYY-MM-DD 或自然表达(下周五/8.20)", checkOut?: 同上, occupancy?: { adults: 2 } }'
-            }
+            destination: { type: 'string', required: true, description: '目的地城市,如 大理' },
+            // issue #283 闸:日期字段对模型面仍是契约必填(required 标在 description,schema 不强制,
+            // 让 gate 产出更可行动的错误——dsh schema 拒绝信息太泛)
+            checkIn: { type: 'string', description: '入住日:YYYY-MM-DD 或自然表达(下周五/8.20/下周五+3);REQUIRED——缺失/空白/无法解析由 date-gate 返回 input_required,不查' },
+            checkOut: { type: 'string', description: 'checkOut 退房日:YYYY-MM-DD 或自然表达,形态同 checkIn;REQUIRED——必须晚于入住日,否则不查' },
+            adults: { type: 'integer', description: '成人数(顶层字段,默认 2)' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? JSON.stringify(value).slice(0, 400))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 400)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'destination');
-            if (!q.destination) throw new Error('gotry_hotel_search requires destination');
+        async execute(args, _exec) {
+            const q = args;
+            if (!q.destination)
+                throw new Error('gotry_hotel_search requires destination');
             const started = Date.now();
+            const execSignal = _exec?.signal;
             const fallbackPath = join(import.meta.dirname, '..', '..', 'data', 'hotels_2026.json');
-            const anchor = buildTimeAnchor(new Date());
-            const dateNotes = [];
-            const resolveDate = (expr)=>{
-                if (!expr) return undefined;
-                const r = resolveSlotDate(expr, anchor);
-                if (!r.date) {
-                    dateNotes.push(`日期未解析:${r.raw}——请向用户确认具体日期`);
-                    return undefined;
-                }
-                if (r.raw !== r.date) dateNotes.push(`slot-resolved: ${r.raw} → ${r.date}`);
-                return r.date;
-            };
-            const resp = await hbcliSearchHotels({
-                destination: q.destination,
-                checkIn: resolveDate(q.checkIn),
-                checkOut: resolveDate(q.checkOut),
-                adults: q.adults
-            }, {
-                hbcliBin: config.hbcliBin,
-                timeoutMs: config.timeoutMs,
-                fallbackPath
+            // issue #283 闸:完整、有效且退房晚于入住才能派发 hbcli;失败直接返回
+            // input_required,不发供应商命令,不把当前窗口查询当所需日期结果。
+            // 复用既有 time-anchor/slot-spec:词表内自然表达 → 绝对日期;
+            // 词表外 → unresolved,闸失败,不再走「无日期降级」伪装默认窗口价。
+            const gate = evaluateHotelStayDates(q.checkIn, q.checkOut);
+            if (!gate.ok) {
+                // 闸失败:不调用 interpretEffect,不调 hbcli;延迟日志不写(no spawn)。
+                // summary 用「需要 X 信息才能查询酒店」开头的可行动句式,presentResult 直接
+                // 渲成「酒店:<dest> 缺日期」行动卡(替代旧版「无结果」空卡)。
+                const summary = `需要补充${(gate.missing ?? []).map(m => m === 'checkIn' ? '入住日' : '退房日').join('和')}才能查询酒店「${q.destination ?? ''}」:${gate.message}`;
+                return {
+                    ok: false,
+                    verdict: gate.verdict,
+                    reason: gate.reason,
+                    missing: gate.missing,
+                    raw: gate.raw,
+                    destination: q.destination,
+                    message: gate.message,
+                    summary,
+                    evidence: gate.evidence,
+                    latency_ms: Date.now() - started,
+                };
+            }
+            // 闸通过:绝对日期已就位;slot 解析过程产生的原话 → 绝对日期 注记回显
+            // (工具层 date_notes 与既有 D-10 切片 B 形态兼容)
+            const dateNotes = [...gate.notes];
+            // 效应解译层(ADR-18):渠道选择/韧性(重试/熔断)在解译器,result 原样透传——
+            // 断路拒绝时返回平铺失败面(不发起查询,不伪装成 miss)
+            const itp = await interpretEffect({
+                effect: 'HBCLI_HOTEL_SEARCH',
+                params: { destination: q.destination, checkIn: gate.checkIn, checkOut: gate.checkOut, adults: q.adults, hbcliBin: config.hbcliBin, timeoutMs: config.timeoutMs, fallbackPath, signal: execSignal },
             });
+            if (!itp.result)
+                return declinedObservation('HBCLI_HOTEL_SEARCH', itp.trace);
+            const resp = itp.result;
             const dir = await ensureStateDir(config.stateRoot);
             const isLive = resp.via === 'hbcli-realtime';
             const evidence = isLive ? resp.evidence : '[静态包:估算]';
-            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `hotel_search:${resp.via}`).catch(()=>{});
+            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `hotel_search:${resp.via}`).catch(() => { });
             const payload = {
                 ok: true,
                 hotels: resp.hotels ?? null,
@@ -561,679 +1295,1449 @@ export function apply(ctx, config) {
                 latency_ms: Date.now() - started,
                 summary: resp.summary,
                 error: resp.error,
-                ...dateNotes.length ? {
-                    date_notes: dateNotes
-                } : {}
+                ...(dateNotes.length ? { date_notes: dateNotes } : {}),
             };
             return JSON.parse(JSON.stringify(payload));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `酒店搜索:${String(args.query?.destination ?? '')}`,
-                kind: 'search',
-                rawInput: args.query
-            }),
-        presentResult: (_args, value)=>{
+        presentCall: args => ({ card: 'generic', title: `酒店搜索:${args.destination ?? ''}`, kind: 'search', rawInput: args }),
+        presentResult: (_args, value) => {
+            // 闸失败:渲染为「input_required」行动卡,引导模型向用户追问日期;
+            // 不再退化为「无结果」空卡——闸拒绝的可行动语义必须显式进 UI。
+            // UI 面禁用内部工程词(check_in_blank / 闸拒绝 / ISO 字符串),只露「入住日/退房日」
+            // 与具体日期示例供模型追问。
             const r = value;
-            const n = Array.isArray(r.hotels) ? r.hotels.length : 0;
+            if (r.verdict === 'input_required') {
+                const missingLabels = (r.missing ?? []).map(m => m === 'checkIn' ? '入住日' : '退房日');
+                const fieldText = missingLabels.length ? missingLabels.join('和') : '入住日和退房日';
+                const dateHint = !missingLabels.length || missingLabels.length === 2
+                    ? '例如 2026-09-18 / 2026-09-20'
+                    : missingLabels[0] === '入住日' ? '例如 2026-09-18' : '例如 2026-09-20';
+                return {
+                    card: 'generic',
+                    title: `酒店:${r.destination ?? ''} 需要${fieldText}`,
+                    // P2 措辞修正:直接对用户说话的句式,不再绕一道「请告诉.../请向用户确认」转给模型;
+                    // gate.message 里残留的字段指引也归一为直接对用户措辞,保留日期示例等可行动细节。
+                    content: [{ type: 'text', text: `请补充 ${fieldText}(${dateHint})后再次查询。\n${normalizeHotelGateHandoff(r.message)}` }],
+                };
+            }
+            const h = r.hotels;
+            const liveCount = Array.isArray(h) ? h.length : 0;
+            // 静态包是 {meta, stays} 对象而非数组(issue #24:此前计数恒 0 → UI 显示「无结果」)
+            const stays = !Array.isArray(h) && h && typeof h === 'object' ? h.stays : undefined;
+            const staticCount = Array.isArray(stays) ? stays.length : 0;
+            const tag = r.via === 'hbcli-realtime'
+                ? (liveCount ? `实时 ${liveCount} 家` : '实时')
+                : staticCount ? `静态包 ${staticCount} 块` : (liveCount ? `${liveCount} 家` : '无结果');
             return {
                 card: 'generic',
-                title: `酒店:${r.destination ?? ''} ${n ? `${n} 家(${r.via === 'hbcli-realtime' ? '实时' : '静态包'})` : '无结果'}`,
-                content: [
-                    {
-                        type: 'text',
-                        text: String(r.summary ?? '')
-                    }
-                ]
+                title: `酒店:${r.destination ?? ''} ${tag}`,
+                content: [{ type: 'text', text: String(r.summary ?? '') }],
             };
-        }
+        },
     }));
+    // ---- hotelbyte 客户认证面(hbcli auth customer-*;新邮箱即注册,无需密码)----
+    // 两步流:send_code(外发邮件,须用户明示同意)→ 用户从收件箱报码 → login。
+    // 刻意不走 interpretEffect 效应层:发码/验码非幂等(超时重试会重复发信/浪费
+    // 一次性验证码),直调能力层 fail-fast;凭据写 hbcli customer 档(CLI 侧最低
+    // 优先级,不劫持既有 portal/API-key 凭据),token 值不进 gotry 会话/日志。
     registerGuarded(defineTool({
-        name: 'gotry_skeleton_check',
-        description: 'Check flight connectivity between two airports against the OpenFlights skeleton (free tier). ' + 'Three-valued: found = strong positive (airlines returned); hub-to-hub absence = downgrade signal, NEVER disproof ' + '(skeleton lags reality); outside hub set = no conclusion. Use BEFORE recommending a route.',
+        name: 'gotry_hotel_auth_send_code',
+        description: 'Send an email verification code to the user for HotelByte customer login (step 1 of 2). '
+            + '**Only call after the user explicitly agreed to login/register with that email** — this sends a real email and the backend rate-limits sends. '
+            + 'Step 2 is gotry_hotel_auth_login with the code the user reads from their inbox (never guess or fabricate the code). '
+            + 'Requires hbcli with auth support (npm staicli ≥ 0.0.4); on older versions it fails with unknown-command via the error surface.',
         parameters: {
-            from: {
-                type: 'string',
-                required: true,
-                description: 'IATA, e.g. HKG'
-            },
-            to: {
-                type: 'string',
-                required: true,
-                description: 'IATA, e.g. HKT'
+            email: { type: 'string', required: true, description: '用户邮箱(验证码发送目标,须用户自己提供)' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 400)) }],
+        },
+        async execute(args, _exec) {
+            const q = args;
+            const email = String(q.email ?? '').trim();
+            if (!email || !email.includes('@')) {
+                return { ok: false, summary: `需要有效邮箱才能发送验证码(收到:${email || '空'})——请向用户要邮箱,不猜` };
             }
+            const started = Date.now();
+            const r = await customerSendCode(email, { hbcliBin: config.hbcliBin, timeoutMs: config.timeoutMs });
+            return JSON.parse(JSON.stringify({
+                ok: r.via === 'hbcli-realtime',
+                summary: r.summary,
+                evidence: r.evidence,
+                via: r.via,
+                detail: r.result,
+                latency_ms: Date.now() - started,
+            }));
+        },
+        presentCall: args => ({ card: 'generic', title: `发送验证码:${args.email ?? ''}`, kind: 'execute', rawInput: args }),
+    }));
+    registerGuarded(defineTool({
+        name: 'gotry_hotel_auth_login',
+        description: 'Complete HotelByte customer login with email + code (step 2 of 2; pairs with gotry_hotel_auth_send_code). '
+            + 'The code comes from the user\'s inbox — never guess. A NEW email is auto-registered (no password needed): verified email = account. '
+            + 'On success the credential is stored in hbcli\'s customer profile (lowest precedence — existing portal/API-key credentials are NOT hijacked), '
+            + 'and subsequent hotel search/rates run realtime under that identity. Optional attributionToken (from an advisor share link) binds the user '
+            + 'to that advisor. Login failure consumes the one-shot code: re-send a new code before retrying.',
+        parameters: {
+            email: { type: 'string', required: true, description: '用户邮箱(与发送验证码时一致)' },
+            code: { type: 'string', required: true, description: '用户从邮箱收到的验证码(一次性凭据;失败即作废,需重新发码)' },
+            attributionToken: { type: 'string', description: '顾问归因令牌(顾问分享链接携带;可选,绑定后该客户计入顾问客户簿)' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.evidence ?? JSON.stringify(value))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 400)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args);
-            const verdict = await checkConnectivity(String(q.from ?? ''), String(q.to ?? ''));
+        async execute(args, _exec) {
+            const q = args;
+            const email = String(q.email ?? '').trim();
+            const code = String(q.code ?? '').trim();
+            if (!email || !email.includes('@')) {
+                return { ok: false, summary: `需要有效邮箱才能登录(收到:${email || '空'})——请向用户确认邮箱` };
+            }
+            if (!code) {
+                return { ok: false, summary: '需要邮箱验证码才能登录——请让用户从收件箱查收并报码(先 gotry_hotel_auth_send_code)' };
+            }
+            const started = Date.now();
+            const r = await customerLogin({ email, code, attributionToken: q.attributionToken ? String(q.attributionToken) : undefined }, { hbcliBin: config.hbcliBin, timeoutMs: config.timeoutMs });
             return JSON.parse(JSON.stringify({
-                ok: true,
-                ...verdict
+                ok: r.via === 'hbcli-realtime' && r.result?.status === 'logged_in',
+                summary: r.summary,
+                evidence: r.evidence,
+                via: r.via,
+                detail: r.result,
+                latency_ms: Date.now() - started,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `骨架校验:${args.from}-${args.to}`,
-                kind: 'execute',
-                rawInput: args
-            })
+        presentCall: args => ({ card: 'generic', title: `客户登录:${args.email ?? ''}`, kind: 'execute', rawInput: args }),
+    }));
+    registerGuarded(defineTool({
+        name: 'gotry_skeleton_check',
+        description: 'Check flight connectivity between two airports against the OpenFlights skeleton (free tier). '
+            + 'Three-valued: found = strong positive (airlines returned); hub-to-hub absence = downgrade signal, NEVER disproof '
+            + '(skeleton lags reality); outside hub set = no conclusion. Use BEFORE recommending a route.',
+        parameters: {
+            from: { type: 'string', required: true, description: 'IATA, e.g. HKG' },
+            to: { type: 'string', required: true, description: 'IATA, e.g. HKT' },
+        },
+        output: {
+            // loose json(与兄弟工具一致):strict additionalProperties:false 会拒 guard 的
+            // 错误兜底字段(ok/summary),校验错掩盖真实错误
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.evidence ?? JSON.stringify(value)) }],
+        },
+        async execute(args, _exec) {
+            // 平铺参数的工具也会被 LLM 包进 query(#12/#13 同款形态),unwrapQuery 兜住
+            const q = unwrapQuery(args);
+            const verdict = await checkConnectivity(String(q.from ?? ''), String(q.to ?? ''));
+            return JSON.parse(JSON.stringify({ ok: true, ...verdict }));
+        },
+        presentCall: args => ({ card: 'generic', title: `骨架校验:${args.from}-${args.to}`, kind: 'execute', rawInput: args }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_weather_check',
-        description: 'Check weather for a destination: forecast (≤16 days) or historical climate (seasonality baseline). ' + 'Free Open-Meteo API, no key required. Input: place name (Chinese ok) or lat/lng. ' + 'Returns daily temp range, precipitation probability, weather code — with evidence chain tagging ' + '[实时API:open-meteo@ts]. Use to ground seasonal advice in real data instead of LLM guessing.',
+        description: routed('gotry_weather_check', 'Check weather for a destination: forecast (≤16 days) or historical climate (seasonality baseline). '
+            + 'Free Open-Meteo API, no key required. Input: place name (Chinese ok) or lat/lng. '
+            + 'Returns daily temp range, precipitation probability, weather code — with evidence chain tagging '
+            + '[实时API:open-meteo@ts]. Use to ground seasonal advice in real data instead of LLM guessing.'),
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ place: "<城市名>", month?: 8, mode?: "forecast"|"climate", days?: 7 }'
-            }
+            // D-30 第二刀(issue #112):query blob → 平铺 typed 契约(同 flyai 刀法)。
+            place: { type: 'string', description: '城市名(中文可),如 大理;与 lat/lng 二选一,都没给 execute 结构化报错' },
+            lat: { type: 'number', description: '纬度(与 lng 成对;给了则跳过地理编码)' },
+            lng: { type: 'number', description: '经度(与 lat 成对)' },
+            month: { type: 'integer', description: '气候基线月份 1-12(mode=climate 或给了 month 未指 mode 时用)' },
+            mode: { type: 'string', enum: ['forecast', 'climate'], description: '默认 forecast' },
+            days: { type: 'integer', description: '预报天数(≤16,默认 7)' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? JSON.stringify(value).slice(0, 600))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 600)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'place');
+        async execute(args, _exec) {
+            const q = args;
             const started = Date.now();
             let lat = q.lat, lng = q.lng;
             let placeLabel = q.place ?? `${q.lat},${q.lng}`;
             if (lat === undefined || lng === undefined) {
-                if (!q.place) throw new Error('gotry_weather_check requires place name or lat/lng');
-                const geo = await geocodePlace(q.place);
+                if (!q.place)
+                    throw new Error('gotry_weather_check requires place name or lat/lng');
+                const geoItp = await interpretEffect({ effect: 'WEATHER_GEOCODE', params: { name: q.place } });
+                if (!geoItp.result)
+                    return declinedObservation('WEATHER_GEOCODE', geoItp.trace);
+                const geo = geoItp.result;
                 if (!geo.ok || geo.results.length === 0) {
-                    return JSON.parse(JSON.stringify({
-                        ok: false,
-                        summary: `地点「${q.place}」地理编码失败:${geo.error ?? '无结果'}`,
-                        evidence: geo.evidence
-                    }));
+                    return JSON.parse(JSON.stringify({ ok: false, summary: `地点「${q.place}」地理编码失败:${geo.error ?? '无结果'}`, evidence: geo.evidence }));
                 }
                 const hit = geo.results[0];
                 lat = hit.latitude;
                 lng = hit.longitude;
                 placeLabel = `${hit.name}(${hit.admin1 ?? hit.country ?? ''})`;
             }
-            const isClimate = q.mode === 'climate' || q.month !== undefined && q.mode !== 'forecast';
-            const r = isClimate ? await getClimate({
-                latitude: lat,
-                longitude: lng
-            }, q.month ?? new Date().getMonth() + 1) : await getForecast({
-                latitude: lat,
-                longitude: lng
-            }, {
-                days: q.days
-            });
+            const isClimate = q.mode === 'climate' || (q.month !== undefined && q.mode !== 'forecast');
+            const wxItp = isClimate
+                ? await interpretEffect({ effect: 'WEATHER_CLIMATE', params: { latitude: lat, longitude: lng, month: q.month ?? new Date().getMonth() + 1 } })
+                : await interpretEffect({ effect: 'WEATHER_FORECAST', params: { latitude: lat, longitude: lng, days: q.days } });
+            if (!wxItp.result)
+                return declinedObservation(isClimate ? 'WEATHER_CLIMATE' : 'WEATHER_FORECAST', wxItp.trace);
+            const r = wxItp.result;
             const dir = await ensureStateDir(config.stateRoot);
-            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `weather:${r.via}`).catch(()=>{});
-            const dailyLines = (r.daily ?? []).slice(0, 7).map((d)=>`${d.date} ${d.tempMinC.toFixed(0)}–${d.tempMaxC.toFixed(0)}°C ${wmoLabel(d.weatherCode)}${d.precipProbMaxPct !== null ? ` 降水概率${d.precipProbMaxPct}%` : ''}`);
-            const summary = r.ok ? `${placeLabel}:${isClimate ? '历史气候' : `${q.days ?? 7} 天预报`}\n${dailyLines.join('\n')}\n${r.evidence}` : `${placeLabel}:天气查询失败(${r.error})${r.evidence}`;
+            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `weather:${r.via}`).catch(() => { });
+            const dailyLines = (r.daily ?? []).slice(0, 7).map(d => `${d.date} ${d.tempMinC.toFixed(0)}–${d.tempMaxC.toFixed(0)}°C ${wmoLabel(d.weatherCode)}${d.precipProbMaxPct !== null ? ` 降水概率${d.precipProbMaxPct}%` : ''}`);
+            const summary = r.ok
+                ? `${placeLabel}:${isClimate ? '历史气候' : `${q.days ?? 7} 天预报`}\n${dailyLines.join('\n')}\n${r.evidence}`
+                : `${placeLabel}:天气查询失败(${r.error})${r.evidence}`;
             return JSON.parse(JSON.stringify({
-                ok: r.ok,
-                place: placeLabel,
-                mode: isClimate ? 'climate' : 'forecast',
-                daily: r.daily,
-                evidence: r.evidence,
-                summary,
-                latency_ms: Date.now() - started
+                ok: r.ok, place: placeLabel, mode: isClimate ? 'climate' : 'forecast',
+                daily: r.daily, evidence: r.evidence, summary,
+                latency_ms: Date.now() - started,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `天气:${String(args.query?.place ?? '')}`,
-                kind: 'fetch',
-                rawInput: args.query
-            }),
-        presentResult: (args, value)=>{
+        presentCall: args => ({ card: 'generic', title: `天气:${args.place ?? `${args.lat ?? ''},${args.lng ?? ''}`}`, kind: 'fetch', rawInput: args }),
+        presentResult: (args, value) => {
             const r = value;
-            const place = String(args.query?.place ?? '');
+            const place = String(args.place ?? '');
             const failed = String(r.summary ?? '').includes('降级') || String(r.summary ?? '').includes('unavailable');
             return {
                 card: 'generic',
                 title: `天气:${place} ${failed ? '降级' : 'ok'}`,
-                content: [
-                    {
-                        type: 'text',
-                        text: String(r.summary ?? '')
-                    }
-                ]
+                content: [{ type: 'text', text: String(r.summary ?? '') }],
             };
-        }
+        },
     }));
     registerGuarded(defineTool({
         name: 'gotry_flight_verify',
-        description: 'Verify whether a flight callsign is currently observable on the OpenSky ADS-B network. ' + 'Free anonymous API (~400 credits/day, 4 req/s burst). Three-valued semantics: ' + 'observed = strong positive (the aircraft is currently being broadcast); ' + 'not_observed = no conclusion (ADS-B coverage is limited by geography/altitude — ' + 'a missing signal does NOT disprove the flight); ' + 'unavailable = API failure, gracefully degraded. ' + 'Use to ground "is this flight actually flying right now?" in real data, complementing ' + 'the OpenFlights skeleton (historical connectivity) and the static flight pack (planned schedule).',
+        description: routed('gotry_flight_verify', 'Verify whether a flight callsign is currently observable on the OpenSky ADS-B network. '
+            + 'Free anonymous API (~400 credits/day, 4 req/s burst). Three-valued semantics: '
+            + 'observed = strong positive (the aircraft is currently being broadcast); '
+            + 'not_observed = no conclusion (ADS-B coverage is limited by geography/altitude — '
+            + 'a missing signal does NOT disprove the flight); '
+            + 'unavailable = API failure, gracefully degraded. '
+            + 'Use to ground "is this flight actually flying right now?" in real data, complementing '
+            + 'the OpenFlights skeleton (historical connectivity) and the static flight pack (planned schedule).'),
+        // D-30 第四刀(issue #112):平铺 typed;callsign required → 宿主权即拒
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ callsign: "EK329", airport?: "OMDB", timeoutMs?: 10000 }'
-            }
+            callsign: { type: 'string', required: true, description: '航班呼号,如 EK329' },
+            airport: { type: 'string', description: '预期机场 IATA,如 OMDB(观测命中时展示)' },
+            timeoutMs: { type: 'integer', description: '超时毫秒,默认 10000' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? JSON.stringify(value).slice(0, 500))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 500)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'callsign');
+        async execute(args, _exec) {
+            const q = args;
             const started = Date.now();
             if (!q.callsign) {
-                return JSON.parse(JSON.stringify({
-                    verdict: 'unavailable',
-                    evidence: '[校验不可用:无 callsign]',
-                    summary: 'callsign 必填'
-                }));
+                return JSON.parse(JSON.stringify({ verdict: 'unavailable', evidence: '[校验不可用:无 callsign]', summary: 'callsign 必填' }));
             }
-            const r = await verifyFlight({
-                callsign: q.callsign,
-                airport: q.airport,
-                timeoutMs: q.timeoutMs
-            });
+            const itp = await interpretEffect({ effect: 'OPENSKY_FLIGHT_VERIFY', params: { callsign: q.callsign, airport: q.airport, timeoutMs: q.timeoutMs } });
+            if (!itp.result)
+                return declinedObservation('OPENSKY_FLIGHT_VERIFY', itp.trace);
+            const r = itp.result;
             const dir = await ensureStateDir(config.stateRoot);
-            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `flight_verify:${r.via}`).catch(()=>{});
-            const summary = r.verdict === 'observed' ? `${r.callsign} 当前 ADS-B 观测命中 (${r.hits?.length ?? 0} 架)${r.airport ? ` 在 ${r.airport}` : ''}\n${r.evidence}` : r.verdict === 'not_observed' ? `${r.callsign} 当前观测列表未见(ADS-B 覆盖有限,不否定该航班存在)\n${r.evidence}` : `${r.callsign} OpenSky 不可用:${r.error}\n${r.evidence}`;
+            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `flight_verify:${r.via}`).catch(() => { });
+            const summary = r.verdict === 'observed'
+                ? `${r.callsign} 当前 ADS-B 观测命中 (${r.hits?.length ?? 0} 架)${r.airport ? ` 在 ${r.airport}` : ''}\n${r.evidence}`
+                : r.verdict === 'not_observed'
+                    ? `${r.callsign} 当前观测列表未见(ADS-B 覆盖有限,不否定该航班存在)\n${r.evidence}`
+                    : `${r.callsign} OpenSky 不可用:${r.error}\n${r.evidence}`;
             return JSON.parse(JSON.stringify({
                 ok: true,
-                verdict: r.verdict,
-                callsign: r.callsign,
-                airport: r.airport,
-                sample_size: r.sampleSize,
-                hits: r.hits,
-                evidence: r.evidence,
-                summary,
-                latency_ms: Date.now() - started
+                verdict: r.verdict, callsign: r.callsign, airport: r.airport,
+                sample_size: r.sampleSize, hits: r.hits, evidence: r.evidence, summary,
+                latency_ms: Date.now() - started,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `飞行校验:${String(args.query?.callsign ?? '')}`,
-                kind: 'fetch',
-                rawInput: args.query
-            })
+        presentCall: args => ({ card: 'generic', title: `飞行校验:${args.callsign ?? ''}`, kind: 'fetch', rawInput: args }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_flyai_search',
-        description: 'Live flight/train search via Fliggy official FlyAI channel (read-only, no key, booking only via jumpUrl by the human). ' + 'PRIMARY source for real schedules & prices (RFC user-session-data-rfc). Input: kind=flight|train, from/to city names (Chinese), date YYYY-MM-DD. ' + 'Evidence [实时API:flyai@ts]. Cross-validate expensive claims against gotry_session_search when it matters.',
+        description: routed('gotry_flyai_search', 'Live travel search through the Fliggy official FlyAI channel (read-only, no key; booking/comparison happens by the HUMAN on the jumpUrl page). '
+            + 'kind="flight"|"train": from/origin is required; to/destination and date/dateStart+dateEnd are optional for official exploration, and exact-date results split 直达/中转. '
+            + 'kind="hotel"|"marriott-hotel": to/destName=目的地中文, checkIn/checkOut (YYYY-MM-DD,成对可选——未定档期可不填先摸底). '
+            + 'kind="poi": cityName=城市; kind="keyword"|"ai": query; kind="marriott-package": keyword. '
+            + 'Hotel prices may be masked upstream (priceRaw like "¥7xx"): always present the mask as a range, and let the human open jumpUrl for the real price. '
+            + 'Evidence [实时API:flyai@ts]. verdict=needs-setup (anonymous trial quota exhausted, upstream 429) is a CONFIG issue, not a search failure: surface the setup hint once, do NOT retry this tool this session — switch to gotry_session_search or web search. '
+            + 'Errors (rate-limit Sentinel / invalid dates) degrade as structured errors with the upstream message — surface them, never guess.'),
+        // D-30 第一刀(issue #112):query json blob → 平铺 typed 契约。内部 cliBin、
+        // cliPrefixArgs、credentials、endpoint 不进入模型可见 schema；from/to/date 与
+        // checkIn/checkOut 保留为兼容别名，adapter 的完整公共筛选面在同一平铺入口透传。
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ kind: "flight"|"train", from: "上海", to: "丽江", date: "2026-10-01" }'
+            kind: { type: 'string', enum: [...FLYAI_TOOL_KINDS], required: true, description: '检索类型:flight/train/hotel/poi/keyword/ai/marriott-hotel/marriott-package' },
+            from: { type: 'string', description: '兼容字段：机/火出发城市；等价于 origin' },
+            to: { type: 'string', description: '兼容字段：机/火到达城市或酒店目的地；等价于 destination/destName' },
+            date: { type: 'string', description: '兼容字段：机/火 exact-date YYYY-MM-DD；等价于 depDate' },
+            origin: { type: 'string', description: '机/火出发城市或机场' },
+            destination: { type: 'string', description: '机/火到达城市或机场' },
+            depDate: { type: 'string', description: '机/火 exact-date YYYY-MM-DD' },
+            dateStart: { type: 'string', description: '机/火日期范围起点 YYYY-MM-DD，与 dateEnd 成对' },
+            dateEnd: { type: 'string', description: '机/火日期范围终点 YYYY-MM-DD，与 dateStart 成对' },
+            depDateStart: { type: 'string', description: '机/火日期范围起点 YYYY-MM-DD' },
+            depDateEnd: { type: 'string', description: '机/火日期范围终点 YYYY-MM-DD' },
+            backDate: { type: 'string', description: '机票返程日期 YYYY-MM-DD' },
+            journeyType: { type: 'integer', enum: [1, 2], description: '机票 1=直达，2=中转' },
+            seatClassName: { type: 'string', description: '机/火舱位或坐席，逗号分隔' },
+            transportNo: { type: 'string', description: '航班号或车次，逗号分隔' },
+            transferCity: { type: 'string', description: '中转城市，逗号分隔' },
+            depHourStart: { type: 'integer', description: '出发时段起点 0–23' },
+            depHourEnd: { type: 'integer', description: '出发时段终点 0–23' },
+            arrHourStart: { type: 'integer', description: '到达时段起点 0–23' },
+            arrHourEnd: { type: 'integer', description: '到达时段终点 0–23' },
+            totalDurationHour: { type: 'number', description: '机票总时长上限（小时）' },
+            maxPrice: { type: 'number', description: '最高价格（CNY）' },
+            sortType: { type: 'string', description: '机/火排序或万豪套餐 price_asc/price_desc' },
+            destName: { type: 'string', description: '酒店/万豪酒店目的地' },
+            checkIn: { type: 'string', description: '兼容字段：酒店入住日期 YYYY-MM-DD' },
+            checkOut: { type: 'string', description: '兼容字段：酒店退房日期 YYYY-MM-DD' },
+            checkInDate: { type: 'string', description: '酒店入住日期 YYYY-MM-DD' },
+            checkOutDate: { type: 'string', description: '酒店退房日期 YYYY-MM-DD' },
+            keyWords: { type: 'string', description: '酒店关键词；hotel/marriott-hotel 均支持' },
+            poiName: { type: 'string', description: '酒店周边景点名' },
+            hotelTypes: { type: 'string', description: '酒店类型，逗号分隔；仅 kind=hotel' },
+            sort: { type: 'string', enum: ['distance_asc', 'rate_desc', 'price_asc', 'price_desc', 'no_rank'], description: '酒店排序' },
+            hotelStars: { type: 'string', description: '酒店星级，1–5 逗号分隔；仅 kind=hotel' },
+            hotelBedTypes: { type: 'string', description: '床型，逗号分隔' },
+            cityName: { type: 'string', description: '景点所在城市；kind=poi 必填' },
+            poiLevel: { type: 'integer', description: '景点等级 1–5' },
+            keyword: { type: 'string', description: '景点关键词或万豪套餐单维度关键词' },
+            category: { type: 'string', enum: [...FLYAI_POI_CATEGORIES], description: '景点官方闭集类别' },
+            query: { type: 'string', description: 'keyword/ai 的查询词' },
+            hotelBrands: { type: 'string', description: 'kind=marriott-hotel 的品牌关键词（与 hotelName 合并为官方 --key-words）' },
+            hotelName: { type: 'string', description: '万豪酒店名；marriott-hotel 合并为 --key-words，marriott-package 使用 --hotel-name' },
+            provinceOrCity: { type: 'string', description: '万豪套餐的省份或城市；与 keyword/hotelName 至少填写一项' },
+            timeoutMs: { type: 'integer', description: '本次查询本地超时毫秒' },
+        },
+        output: { schema: { type: 'json' }, render: (_a, v) => [{ type: 'text', text: JSON.stringify({ ...v, raw: undefined }) }] },
+        async execute(args, exec) {
+            const raw = args;
+            const signal = exec?.signal;
+            const built = flyaiToolQuery(raw, signal);
+            if (built.error || !built.query) {
+                return JSON.parse(JSON.stringify({ ok: false, verdict: 'error', summary: `未发起 FlyAI 查询：${built.error ?? '参数无效'}`, evidence: '[校验:gotry_flyai_search] rejected' }));
+            }
+            const q = built.query;
+            const todayYmd = new Date().toISOString().slice(0, 10);
+            if ((q.kind === 'flight' || q.kind === 'train') && q.depDate && /^\d{4}-\d{2}-\d{2}$/.test(q.depDate) && q.depDate < todayYmd) {
+                return JSON.parse(JSON.stringify({ ok: false, verdict: 'error', kind: q.kind, summary: `未发起查询：日期 ${q.depDate} 已是过去（今天 ${todayYmd}）。`, evidence: '[校验:gotry_flyai_search] past exact date' }));
+            }
+            if ((q.kind === 'hotel' || q.kind === 'marriott-hotel') && q.checkInDate && q.checkOutDate
+                && /^\d{4}-\d{2}-\d{2}$/.test(q.checkInDate) && /^\d{4}-\d{2}-\d{2}$/.test(q.checkOutDate)
+                && (q.checkInDate < todayYmd || q.checkOutDate <= q.checkInDate)) {
+                return JSON.parse(JSON.stringify({ ok: false, verdict: 'error', kind: q.kind, summary: `未发起查询：入住 ${q.checkInDate} / 退房 ${q.checkOutDate} 不是未来合法区间。`, evidence: '[校验:gotry_flyai_search] invalid stay dates' }));
+            }
+            const itp = await runFlyaiEffect({ effect: 'FLYAI_SEARCH', params: q, signal });
+            if (!itp.result)
+                return declinedObservation('FLYAI_SEARCH', itp.trace);
+            const r = itp.result;
+            await noteChannel('flyai', r.verdict);
+            const fetchedAt = new Date().toISOString();
+            if ((q.kind === 'flight' || q.kind === 'train') && q.origin && q.destination && q.depDate && !q.depDateStart && !q.depDateEnd) {
+                const avMap = await loadAirlineAirportMap();
+                await appendFacts(config.stateRoot ?? '.', factsFromFlyai({ kind: q.kind, origin: q.origin, destination: q.destination, date: q.depDate }, r, fetchedAt, avMap?.city_alias));
+            }
+            else if ((q.kind === 'hotel' || q.kind === 'marriott-hotel') && q.destName && q.checkInDate && q.checkOutDate) {
+                await appendFacts(config.stateRoot ?? '.', factsFromHotel({
+                    source: q.kind === 'hotel' ? 'flyai-hotel' : 'flyai-marriott-hotel',
+                    destination: q.destName, checkIn: q.checkInDate, checkOut: q.checkOutDate,
+                    verdict: r.verdict, options: r.hotels?.length ?? 0, evidence: r.evidence, fetchedAt,
+                }));
             }
+            const intent = flyaiRoutingIntent(q.kind);
+            const routing = r.verdict !== 'hit' && intent ? await routingField(intent, 'flyai') : {};
+            return JSON.parse(JSON.stringify({ ...r, summary: flyaiToolSummary(q, r), ...routing }));
         },
-        output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_a, v)=>[
-                    {
-                        type: 'text',
-                        text: String(v.summary ?? JSON.stringify(v).slice(0, 600))
-                    }
-                ]
+        presentCall: args => ({ card: 'generic', title: `官方检索:${args.kind}`, kind: 'fetch', rawInput: args }),
+        presentResult: (args, value) => {
+            const isHotel = args.kind === 'hotel';
+            const r = value;
+            const n = Math.max((r.options ?? []).length, (r.hotels ?? []).length);
+            return { card: 'generic', title: `${isHotel ? '飞猪酒店' : '飞猪检索'}:${r.ok && n > 0 ? `${n} 条` : '降级'}`, content: [{ type: 'text', text: String(value.summary ?? '') }] };
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'from');
-            const kind = q.kind === 'train' ? 'train' : 'flight';
-            if (!q.from || !q.to || !q.date) {
-                return {
-                    ok: false,
-                    summary: '需要 from/to(中文城市名)与 date(YYYY-MM-DD)'
-                };
-            }
-            const r = await flyaiSearch({
-                kind,
-                origin: q.from,
-                destination: q.to,
-                depDate: q.date
-            });
-            const top = (r.options ?? []).slice(0, 8).map((o)=>`${o.no} ${o.name} ${o.depDateTime.slice(11, 16)}→${o.arrDateTime.slice(11, 16)} ¥${o.price}`);
-            const summary = r.verdict === 'hit' ? `${q.from}→${q.to} ${q.date} ${kind === 'flight' ? '机票' : '火车票'}(飞猪官方只读)前 ${top.length} 条:\n${top.join('\n')}\n${r.evidence}` : `${q.from}→${q.to} ${q.date} 无结果或失败:${r.error ?? 'miss'} ${r.evidence}`;
-            return JSON.parse(JSON.stringify({
-                ...r,
-                kind,
-                summary
-            }));
+    }));
+    registerGuarded(createFlyaiSetupTool((seams.effect ?? interpretEffect), config.stateRoot));
+    registerGuarded(defineTool({
+        name: 'gotry_session_login',
+        description: 'Productized login bootstrap for the account session channel (call this when gotry_session_search returns needs-login — the user never needs a terminal). ' + 'AUTO-DETECTION FIRST: it reads ticket-cookie NAMES before anything else — if the user already logged in (on the external site) it confirms instantly WITHOUT opening any page. '
+            + 'OPENS the site login entry in the USER\'S OWN Chrome (foreground tab, left open for the user) and waits for the user to finish logging in on the external site. '
+            + 'GoTry NEVER collects, stores, or transmits credentials: no passwords, no SMS codes, no cookie values — it only checks the boolean fact "already logged in" (reads cookie NAMES only, zero values). '
+            + 'Transport: the GoTry Session Bridge browser extension (one-time install, ZERO Chrome system dialogs). '
+            + `verdict logged-in (tickets detected) | pending (login tab opened, user not done yet — offer to re-check later) | needs-extension (one-time extension install: the verdict surfaces the Chrome Web Store installUrl as a clickable link for dsh UI to render — installation is a browser concern, not gotry's). `
+            + 'Evidence [会话:<site>-login@ts].',
+        // D-30 第三刀(issue #112):query blob → 平铺 typed;全字段可选 → interpretArgs 容忍层
+        parameters: {
+            waitSeconds: { type: 'integer', description: '等待用户完成登录的上限秒数,默认 90,至多 300;不传用默认' },
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `官方检索:${String(args.query?.kind ?? 'flight')}`,
-                kind: 'fetch',
-                rawInput: args.query
-            }),
-        presentResult: (args, value)=>{
+        output: { schema: { type: 'json' }, render: (_a, v) => [{ type: 'text', text: String(v.evidence ?? JSON.stringify(v).slice(0, 600)) }] },
+        async execute(args, _exec) {
+            const q = unwrapQuery(args, 'waitSeconds');
+            // D-23 收编(issue #115):登录引导入效应注册表(SESSION_LOGIN,浏览器族永不重试不熔断)
+            const itpL = await interpretEffect({ effect: 'SESSION_LOGIN', params: { waitSeconds: q?.waitSeconds } });
+            if (!itpL.result)
+                return declinedObservation('SESSION_LOGIN', itpL.trace);
+            const r = itpL.result;
+            const summary = r.verdict === 'logged-in'
+                ? `${r.site} 登录完成确认(票据 cookie 名已检出,只读名字)。说明:登录是在携程官网、用你自己的浏览器完成的——gotry 全程未接触任何密码/验证码/cookie 值。现在可以继续会话检索了。${r.evidence}`
+                : r.verdict === 'pending'
+                    ? `登录入口已在你的 Chrome 打开;请在弹出的标签页里正常登录携程(登录由你在官网完成,不属于 gotry)。完成后说一声"继续",我再确认。gotry 只检查"是否已登录",永不收集你的账号信息。${r.evidence}`
+                    : r.verdict === 'needs-extension'
+                        ? `需要一次性安装 GoTry Session Bridge 浏览器扩展:这是浏览器的事,gotry 不弹面板不开剪贴板——请直接在 Chrome 应用商店一键装(add-to-chrome 自动更新)。storeUrl=${EXTENSION_STORE_URL}. 装好即生效,装完后告诉我「重试」即可。${r.evidence}`
+                        : r.verdict === 'needs-attach'
+                            ? `cdp 车道需要一次性开启你 Chrome 的远程调试开关:在你的 Chrome 地址栏打开 chrome://inspect/#remote-debugging 并打开开关,然后说一声"重试"(默认走扩展车道,无需此步)。${r.evidence}`
+                            : `登录引导未完成:${r.error ?? '未知原因'} ${r.evidence}`;
+            return JSON.parse(JSON.stringify({ ...r, summary }));
+        },
+        presentCall: _args => ({ card: 'generic', title: '登录携程(用你自己的浏览器,不在 gotry 输入)', kind: 'fetch', rawInput: {} }),
+        presentResult: (_args, value) => {
             const r = value;
-            return {
-                card: 'generic',
-                title: `飞猪检索:${r.ok && (r.options?.length ?? 0) > 0 ? `${r.options.length} 条` : '降级'}`,
-                content: [
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? '')
-                    }
-                ]
-            };
-        }
+            const needsExt = r.verdict === 'needs-extension';
+            const label = r.verdict === 'logged-in'
+                ? `已登录(${(r.tickets ?? []).length} 票据)`
+                : r.verdict === 'pending'
+                    ? '等待你在携程页面完成登录'
+                    : needsExt
+                        ? '🧩 需装 GoTry Session Bridge 扩展(浏览器商店一键装,自动更新)'
+                        : r.verdict ?? '降级';
+            const content = [{ type: 'text', text: String(value.summary ?? '') }];
+            // needs-extension:把商店 URL 渲成可点链接(浏览器自己当安装器,gotry 不插手)
+            // dsh presentResult 若支持 actions 字段,URL 可被原生渲染;否则 content 里也保留文本兜底
+            if (needsExt && r.installUrl)
+                content.push({ type: 'text', text: `安装链接:${r.installUrl}` });
+            return { card: 'generic', title: `账号登录:${label}`, content };
+        },
     }));
     registerGuarded(defineTool({
         name: 'gotry_session_search',
-        description: 'Cross-validation search on the user\'s OWN logged-in browser session (dedicated persistent profile, ReadGuard = physically read-only: ' + 'write requests are aborted at network layer; agent NEVER touches credentials/captcha; on captcha it stops and returns challenged). ' + 'Currently ctrip-flight: sniffs the site search API for structured options. Evidence [会话:ctrip-flight@ts]. ' + 'verdict needs-login = run scripts/session-login.ts once with the human logging in. Rate-limited (≥30s between same-site calls). ' + 'Use to verify/double-check prices from gotry_flyai_search on the same itinerary (split by 直达/中转).',
+        description: routed('gotry_session_search', 'Search on the USER\'S OWN browser session (Ctrip kind="flight"(default)/"hotel"; 12306 kind="train" — public query face, no login needed). '
+            + 'Consent gate: the FIRST call in a session asks the user via the runtime approval card; once granted it holds for the session, a refusal revokes it for the session (no repeat prompting). '
+            + 'Transport: GoTry Session Bridge browser extension (one-time install) — the agent side never talks to Chrome debugging, ZERO system dialogs; read-only by construction (the extension never issues requests; it only passively forwards the site\'s own search responses; agent NEVER touches credentials/captcha; on captcha it stops and returns challenged). '
+            + 'kind="flight": from/to 中文城市名 + date YYYY-MM-DD — sniffs the site search API for structured options. Evidence [会话:ctrip-flight@ts]. '
+            + 'kind="hotel": to=目的地中文, cityId? = the numeric city= in a hotels.ctrip.com list URL (web-search it when the destination is outside the built-in city table), checkIn?/checkOut? (YYYY-MM-DD), adults?; hotel prices are the user\'s real logged-in prices. Evidence [会话:ctrip-hotel@ts]. '
+            + 'kind="dida": Dida supplier-portal realtime hotel rates on the employee\'s own logged-in session (hotel-be portal integration line) — no from/to needed; the portal find page\'s own requests are sniffed passively. Rates carry ratePlanId/referenceNo for the server-side booking chain. Evidence [会话:dida-portal@ts]. '
+            + 'kind="train": from/to/date(YYYY-MM-DD) + fromStationTelecode?/toStationTelecode? (three-letter codes in the kyfw query URL, for cities outside the built-in table) — 12306 left-ticket query (public face): train codes, times, durations, seat availability; the list API carries NO prices (prices live on the 12306 page). Evidence [会话:train-12306@ts]. '
+            + 'verdict needs-login = call gotry_session_login (opens the Ctrip login entry in the user\'s own foreground tab — no terminal, no credentials through GoTry); '
+            + `needs-extension = one-time browser-extension install (Chrome Web Store one-click, installUrl is also surfaced as a clickable link in the verdict field for dsh UI to render) — the DEFAULT transport; cdp (chrome://inspect remote debugging) is a diagnostic fallback only via GOTRY_SESSION_TRANSPORT=cdp. `
+            + 'Rate-limited (≥30s between same-site calls; a challenged/timeout verdict means STOP — never retry, fall back to other tools).'),
+        // D-30 第二刀(issue #112):query blob → 平铺 typed 契约(逐字段 schema 模型可见)。
+        // 与 flyai 刀的差异:本工具三意图无公共 required 字段(kind 缺省=flight),根 schema 是
+        // 隐式开放对象,宿主权无法用 required 拒 legacy blob——故保留 interpretArgs 容忍层
+        // (docs/design/tool-orchestration-design.md §4③「interpretArgs 留作旧形态容忍层」),blob 调用在
+        // execute 内归一后走原条件闸,结构化报错不崩。flyai 因 kind required 仍在宿主权即拒。
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ from: "上海", to: "丽江", date: "2026-10-01" }'
-            }
+            kind: { type: 'string', enum: ['flight', 'hotel', 'train', 'dida'], description: '默认 flight 机票;hotel 携程酒店(用户登录态真实价);train 12306 余票(公开面);dida 供应商门户实时价(员工登录态)' },
+            from: { type: 'string', description: '出发城市中文(词表内),如 上海——kind=flight|train 必填' },
+            to: { type: 'string', description: '到达城市中文——kind=flight|train 必填;kind=hotel 时为目的地(必填)' },
+            date: { type: 'string', description: '出发日期 YYYY-MM-DD——kind=flight|train 必填,须为今天或未来' },
+            cityId: { type: 'integer', description: '携程酒店 city= 数字,仅 kind=hotel;目的地码表外时 web 搜 hotels.ctrip.com list URL 取 city=' },
+            checkIn: { type: 'string', description: '入住日 YYYY-MM-DD,仅 kind=hotel 可选' },
+            checkOut: { type: 'string', description: '退房日 YYYY-MM-DD,仅 kind=hotel 可选' },
+            adults: { type: 'integer', description: '成人数,仅 kind=hotel 可选' },
+            fromStationTelecode: { type: 'string', description: '出发站三位电报码,仅 kind=train;城市码表外时填(kyfw 查询页 URL 里)' },
+            toStationTelecode: { type: 'string', description: '到达站三位电报码,仅 kind=train,同上' },
         },
-        output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_a, v)=>[
-                    {
-                        type: 'text',
-                        text: String(v.summary ?? JSON.stringify(v).slice(0, 600))
-                    }
-                ]
-        },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'from');
+        output: { schema: { type: 'json' }, render: (_a, v) => [{ type: 'text', text: String(v.summary ?? JSON.stringify(v).slice(0, 600)) }] },
+        async execute(args, _exec) {
+            const selectedKind = resolveSessionSearchKind(args);
+            if (!selectedKind.ok)
+                return { ok: false, summary: selectedKind.reason };
+            const q = { ...unwrapQuery(args), kind: selectedKind.kind };
+            const runSessionEffect = seams.effect ?? interpretEffect;
+            // ---- Dida 供应商门户(2026-09-09 实装;hotel-be portal integration 迁移线)----
+            if (q.kind === 'dida') {
+                const itpD = await runSessionEffect({
+                    effect: 'SESSION_DIDA_SEARCH',
+                    params: {
+                        auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
+                    },
+                });
+                if (!itpD.result)
+                    return declinedObservation('SESSION_DIDA_SEARCH', itpD.trace);
+                const rD = itpD.result;
+                await noteChannel('session:dida-portal', rD.verdict);
+                const topD = (rD.rates ?? []).slice(0, 8).map(x => `${x.hotelName ?? x.hotelId ?? '?'} ${x.roomName ?? ''} ${x.ratePlanId ?? ''} ${x.currency ?? ''}${x.price} 库存${x.inventory ?? '?'}${x.referenceNo ? ` ref=${x.referenceNo.slice(0, 12)}…` : ''}`);
+                const summaryD = rD.verdict === 'hit'
+                    ? `Dida 门户实时价(员工本人登录态,被动嗅探)前 ${topD.length} 条(预订由服务端适配器凭 referenceNo 续链,gotry 不碰下单):\n${topD.join('\n')}\n${rD.evidence}`
+                    : rD.verdict === 'cooldown'
+                        ? `会话检索节律闸冷却中(两次会话检索需 ≥30s 间隔)——稍候重试或先用其他工具推进。${rD.evidence}`
+                        : rD.verdict === 'needs-login'
+                            ? `${rD.error ?? ''} ${rD.evidence}`
+                            : `Dida 门户会话检索未取回(${rD.verdict}):${rD.error ?? ''} ${rD.evidence}`;
+                return JSON.parse(JSON.stringify({
+                    ...rD, summary: summaryD,
+                    ...(rD.verdict !== 'hit' ? await routingField('search-hotel', 'session:dida-portal') : {}),
+                }));
+            }
+            // ---- 会话酒店(2026-09-03 实装;2026-09-02 迪拜 session:用户要携程找酒店,会话面却只有机票)----
+            // ---- 会话火车(2026-09-03 实装;12306 公开查询面,无登录闸)----
+            if (q.kind === 'train') {
+                if (!q.from || !q.to || !q.date) {
+                    return { ok: false, summary: 'kind=train 需要 from/to(中文城市/车站名)与 date(YYYY-MM-DD);城市电报码表外带 fromStationTelecode/toStationTelecode(kyfw 查询页 URL 里的三位码)' };
+                }
+                const nowT = new Date();
+                const todayT = `${nowT.getFullYear()}-${String(nowT.getMonth() + 1).padStart(2, '0')}-${String(nowT.getDate()).padStart(2, '0')}`;
+                if (q.date < todayT) {
+                    return JSON.parse(JSON.stringify({
+                        ok: false, verdict: 'error',
+                        summary: `未发起查询:日期 ${q.date} 已是过去(今天 ${todayT}),过去不存在在售火车票。向用户确认日期后再查。`,
+                    }));
+                }
+                const itpT = await runSessionEffect({
+                    effect: 'SESSION_TRAIN_SEARCH',
+                    params: {
+                        from: q.from, to: q.to, date: q.date,
+                        fromStationTelecode: q.fromStationTelecode, toStationTelecode: q.toStationTelecode,
+                        auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
+                    },
+                });
+                if (!itpT.result)
+                    return declinedObservation('SESSION_TRAIN_SEARCH', itpT.trace);
+                const rT = itpT.result;
+                await noteChannel('session:12306-train', rT.verdict);
+                // #355:only the invocation-produced binding may enter the fact log;
+                // malformed/transport/challenge states remain no-fact, and Y alone is
+                // not rendered as bookable without a recognized available seat token.
+                await appendFacts(config.stateRoot ?? '.', factsFromSessionTrain({ from: q.from, to: q.to, date: q.date }, rT, clock()));
+                const topT = (rT.trains ?? []).slice(0, 10).map(t => `${t.trainCode} ${t.depTime}→${t.arrTime} 历时${Math.round(t.durationMin / 60 * 10) / 10}h ${t.canWebBuy === 'Y' && hasRecognizedAvailableSeat(t) ? '可订' : '余票待确认'}${Object.entries(t.seats).filter(([, v]) => v && v !== '--' && v !== '无').slice(0, 3).map(([k, v]) => `${k}:${v}`).join(' ')}`);
+                const summaryT = rT.verdict === 'hit'
+                    ? `${q.from}→${q.to} ${q.date} 余票(12306 公开查询面,${(rT.trains ?? []).length} 趟)前 ${topT.length} 条(列表接口不含票价,票价以 12306 落地页为准):\n${topT.join('\n')}\n${rT.evidence}`
+                    : rT.verdict === 'cooldown'
+                        ? `会话火车检索节律闸冷却中(两次会话检索需 ≥30s 间隔)——稍候重试或先用其他工具推进。${rT.evidence}`
+                        : `会话火车检索未取回(${rT.verdict}):${rT.error ?? ''} ${rT.evidence}`;
+                return JSON.parse(JSON.stringify({
+                    ...rT, summary: summaryT,
+                    ...(rT.verdict !== 'hit' ? await routingField('search-train', 'session:12306-train') : {}),
+                }));
+            }
+            if (q.kind === 'hotel') {
+                if (!q.to) {
+                    return { ok: false, summary: 'kind=hotel 需要 to(目的地中文;城市码表外带 cityId=携程酒店 list 页 URL 里的 city= 数字)' };
+                }
+                const itp = await runSessionEffect({
+                    effect: 'SESSION_HOTEL_SEARCH',
+                    params: {
+                        to: q.to, cityId: q.cityId, checkIn: q.checkIn, checkOut: q.checkOut, adults: q.adults,
+                        auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
+                    },
+                });
+                if (!itp.result)
+                    return declinedObservation('SESSION_HOTEL_SEARCH', itp.trace);
+                const r = itp.result;
+                await noteChannel('session:ctrip-hotel', r.verdict);
+                // D-26(issue #118):exact-date 会话酒店 hit/miss 落账(摸底无档期不落;cooldown 是节律闸非结论,不落)
+                if (r.verdict === 'hit' || r.verdict === 'miss') {
+                    await appendFacts(config.stateRoot ?? '.', factsFromHotel({
+                        source: 'session:ctrip-hotel', destination: q.to ?? '', checkIn: q.checkIn, checkOut: q.checkOut,
+                        verdict: r.verdict, options: r.hotels?.length ?? 0, evidence: r.evidence, fetchedAt: new Date().toISOString(),
+                    }));
+                }
+                const top = (r.hotels ?? []).slice(0, 8).map(h => `${h.name}${h.star ? `(${h.star}星)` : ''} ${h.priceRaw ?? (h.price > 0 ? `¥${h.price}` : '价待询')}${h.score ? ` 评分${h.score}` : ''}`);
+                const summary = r.verdict === 'hit'
+                    ? `${q.to} 酒店(携程,用户本人登录态,真实价)前 ${top.length} 家(预订以 jumpUrl 落地页为准):\n${top.join('\n')}\n${r.evidence}`
+                    : r.verdict === 'cooldown'
+                        ? `会话酒店检索节律闸冷却中(两次会话检索需 ≥30s 间隔)——稍候重试或先用其他工具推进。${r.evidence}`
+                        : `会话酒店检索未取回(${r.verdict}):${r.error ?? ''} ${r.evidence}`;
+                return JSON.parse(JSON.stringify({
+                    ...r, summary,
+                    ...(r.verdict !== 'hit' ? await routingField('search-hotel', 'session:ctrip-hotel') : {}),
+                }));
+            }
             if (!q.from || !q.to || !q.date) {
-                return {
-                    ok: false,
-                    summary: '需要 from/to(中文城市名,词表内)与 date(YYYY-MM-DD)'
-                };
+                return { ok: false, summary: '需要 from/to(中文城市名,词表内)与 date(YYYY-MM-DD);酒店/火车检索分别用 kind=hotel / kind=train' };
             }
-            const r = await sessionFlightSearch({
-                from: q.from,
-                to: q.to,
-                date: q.date,
-                auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl')
+            // 效应解译层(ADR-18):SESSION 通道策略=永不重试/不熔断,节律闸在渠道内;
+            // 解译器只做分发与证据拼装,verdict 语义(risk 型 needs-login/challenged)原样透传
+            const itp = await runSessionEffect({
+                effect: 'SESSION_FLIGHT_SEARCH',
+                params: {
+                    from: q.from, to: q.to, date: q.date,
+                    // ADR-15 收尾:ReadGuard 审计在生产工具路径同样落盘(此前仅测试传隔离 stateRoot 才有 JSONL)
+                    auditPath: join(config.stateRoot ?? '.', 'gotry-state', 'session-incidents.jsonl'),
+                },
             });
-            const top = (r.options ?? []).slice(0, 8).map((o)=>`${o.flightNo} ${o.airline} ${o.depDateTime.slice(11, 16)}→${o.arrDateTime.slice(11, 16)} ¥${o.price}`);
-            const summary = r.verdict === 'hit' ? `${q.from}→${q.to} ${q.date} 会话检索(携程,用户本人登录态)前 ${top.length} 条:\n${top.join('\n')}\n${r.evidence}` : `会话检索未取回(${r.verdict}):${r.error ?? ''} ${r.evidence}`;
+            if (!itp.result)
+                return declinedObservation('SESSION_FLIGHT_SEARCH', itp.trace);
+            const r = itp.result;
+            await noteChannel('session:ctrip-flight', r.verdict);
+            // issue #46 事实落账(ADR-19):会话面 exact-date 结论同样进事实注册表(独立 source 并列标注)
+            const avMapS = await loadAirlineAirportMap();
+            await appendFacts(config.stateRoot ?? '.', factsFromSession({ origin: q.from, destination: q.to, date: q.date }, r, new Date().toISOString(), avMapS?.city_alias));
+            const top = (r.options ?? []).slice(0, 8).map(o => `${o.flightNo} ${o.airline} ${o.depDateTime.slice(11, 16)}→${o.arrDateTime.slice(11, 16)} ¥${o.price}`);
+            const summary = r.verdict === 'hit'
+                ? `${q.from}→${q.to} ${q.date} 会话检索(携程,用户本人登录态)前 ${top.length} 条:\n${top.join('\n')}\n${r.evidence}`
+                : `会话检索未取回(${r.verdict}):${r.error ?? ''} ${r.evidence}`;
             return JSON.parse(JSON.stringify({
-                ...r,
-                summary
+                ...r, summary,
+                ...(r.verdict !== 'hit' ? await routingField('search-flight', 'session:ctrip-flight') : {}),
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `会话检索:${String(args.query?.from ?? '')}`,
-                kind: 'fetch',
-                rawInput: args.query
-            }),
-        presentResult: (_args, value)=>{
+        presentCall: args => {
+            const selected = resolveSessionSearchKind(args);
+            const kind = selected.ok ? selected.kind : undefined;
+            const raw = args;
+            const callTitle = kind === 'hotel' ? `会话酒店:${raw.to ?? ''}` : kind === 'train' ? `会话火车:${raw.from ?? ''}` : kind === 'dida' ? '会话酒店:Dida 门户实时价' : `会话检索:${raw.from ?? ''}`;
+            return { card: 'generic', title: callTitle, kind: 'fetch', rawInput: args };
+        },
+        presentResult: (args, value) => {
+            const selected = resolveSessionSearchKind(args);
+            const kind = selected.ok ? selected.kind : undefined;
             const r = value;
-            const label = r.verdict === 'hit' ? `会话 ${r.options.length} 条` : r.verdict === 'needs-login' ? '需登录' : r.verdict ?? '降级';
-            return {
-                card: 'generic',
-                title: `会话检索:${label}`,
-                content: [
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? '')
-                    }
-                ]
-            };
-        }
+            const isHotel = kind === 'hotel';
+            const n = Math.max((r.options ?? []).length, (r.hotels ?? []).length);
+            const needsExt = r.verdict === 'needs-extension';
+            const label = r.verdict === 'hit'
+                ? `会话 ${n} 条`
+                : r.verdict === 'needs-login'
+                    ? '需登录'
+                    : needsExt
+                        ? '🧩 需装 GoTry Session Bridge 扩展(浏览器商店一键装,自动更新)'
+                        : r.verdict ?? '降级';
+            const content = [{ type: 'text', text: String(value.summary ?? '') }];
+            if (needsExt && r.installUrl)
+                content.push({ type: 'text', text: `安装链接:${r.installUrl}` });
+            const face = kind === 'hotel' ? '会话酒店' : kind === 'train' ? '会话火车' : kind === 'dida' ? '会话酒店:Dida' : '会话检索';
+            return { card: 'generic', title: `${face}:${label}`, content };
+        },
     }));
     registerGuarded(defineTool({
         name: 'gotry_anything_search',
-        description: 'Travel-domain search via hotel-byte CLI → hotel-be Anything (cities/hotels/destinations) — NOT general web search; for general internet facts use gotry_agent_reach. ' + 'Mixed destinations (cities / metropolitan areas / high-level regions) + hotels in one call. ' + 'Returns candidates with type, name, optional coordinates and hotel-id. ' + 'Three-valued semantics: hit = ≥1 candidate; miss = 0 candidates (try synonyms or contentType=city/hotel); ' + 'unavailable = hbcli failed (degraded, never blocks). ' + 'Use as the first stop when the user mentions a place/city/hotel name and you need to ground it in real catalog data ' + '(OpenFlights skeleton tells you connectivity; Anything tells you what EXISTS at a city/region).',
+        description: routed('gotry_anything_search', 'Travel-domain search via hotel-byte CLI → hotel-be Anything (cities/hotels/destinations) — NOT general web search; for general internet facts use gotry_agent_reach. ' +
+            'Mixed destinations (cities / metropolitan areas / high-level regions) + hotels in one call. ' +
+            'Returns candidates with type, name, optional coordinates and hotel-id. ' +
+            'Three-valued semantics: hit = ≥1 candidate; miss = 0 candidates (try synonyms or contentType=city/hotel); ' +
+            'unavailable = hbcli failed (degraded, never blocks). ' +
+            'Use as the first stop when the user mentions a place/city/hotel name and you need to ground it in real catalog data ' +
+            '(OpenFlights skeleton tells you connectivity; Anything tells you what EXISTS at a city/region). Independent read-only: safe in the same step as other independent searches; host abort is forwarded to the process tree.'),
+        // 并发安全(issue #519):同 hotel_search,只读 + append-only 延迟日志 + 宿主取消信号。
+        isConcurrencySafe: () => true,
+        // D-30 第四刀(issue #112):平铺 typed;keyword required → 宿主权即拒
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ keyword: "<搜索关键词>", contentType?: "city"|"hotel", parentDestinationId?: "?", timeoutMs?: 12000 }'
-            }
+            keyword: { type: 'string', required: true, description: '搜索关键词' },
+            contentType: { type: 'string', enum: ['city', 'hotel'], description: '内容类型(缺省由上游推断)' },
+            parentDestinationId: { type: 'string', description: '父目的地 id(上游形态)' },
+            timeoutMs: { type: 'integer', description: '超时毫秒,默认 12000' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? JSON.stringify(value).slice(0, 800))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 800)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'keyword');
+        async execute(args, _exec) {
+            const q = args;
+            const rawQuery = String(q.keyword ?? '');
             const started = Date.now();
+            const execSignal = _exec?.signal;
             if (!q.keyword) {
-                return JSON.parse(JSON.stringify({
-                    ok: false,
-                    verdict: 'error',
-                    summary: 'keyword 必填',
-                    evidence: '[hbcli-anything@error] empty'
-                }));
+                return JSON.parse(JSON.stringify({ ok: false, verdict: 'error', summary: 'keyword 必填', evidence: '[hbcli-anything@error] empty' }));
             }
-            const r = await anythingSearch(q);
+            // hbcliBin 直通 config(缺省 'hbcli',能力层按已知安装位回退)——issue #195 教训:
+            // 此前 params 只透 q,config.hbcliBin 永远到不了能力层
+            const itpA = await interpretEffect({ effect: 'ANYTHING_SEARCH', params: { ...q, hbcliBin: config.hbcliBin, signal: execSignal } });
+            if (!itpA.result)
+                return declinedObservation('ANYTHING_SEARCH', itpA.trace);
+            const r = itpA.result;
             const dir = await ensureStateDir(config.stateRoot);
-            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `anything:${r.via}`).catch(()=>{});
+            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `anything:${r.via}`).catch(() => { });
             const top5 = (r.hits ?? []).slice(0, 5);
-            const summary = r.verdict === 'hit' ? `${q.keyword} → hit (${r.hits?.length ?? 0} 候选项)\n${top5.map((h, i)=>`  ${i + 1}. [${h.type}] ${h.name}${h.latitude !== undefined && h.longitude !== undefined ? ` @ (${h.latitude.toFixed(3)},${h.longitude.toFixed(3)})` : ''}`).join('\n')}\n${r.evidence}` : r.verdict === 'miss' ? `${q.keyword} → miss (酒店-be 一切正常但无候选)\n${r.evidence}` : `${q.keyword} → unavailable (${r.error})\n${r.evidence}`;
+            const summary = r.verdict === 'hit'
+                ? `${q.keyword} → hit (${r.hits?.length ?? 0} 候选项)\n${top5.map((h, i) => `  ${i + 1}. [${h.type}] ${h.name}${h.star ? ` ${h.star}★` : ''}${h.latitude !== undefined && h.longitude !== undefined ? ` @ (${h.latitude.toFixed(3)},${h.longitude.toFixed(3)})` : ''}${h.hotelId ? ` hotelId=${h.hotelId}` : h.destinationId ? ` destinationId=${h.destinationId}` : ''}`).join('\n')}\n${r.evidence}`
+                : r.verdict === 'miss'
+                    ? `${q.keyword} → miss (酒店-be 一切正常但无候选)\n${r.evidence}`
+                    : `${q.keyword} → unavailable (${r.error})\n${r.evidence}`;
             return JSON.parse(JSON.stringify({
-                ok: r.ok,
-                verdict: r.verdict,
-                keyword: q.keyword,
+                ok: r.ok, verdict: r.verdict, keyword: q.keyword,
                 content_type: q.contentType ?? null,
-                total_candidates: r.totalCandidates,
-                hits: r.hits,
-                evidence: r.evidence,
-                summary,
-                latency_ms: Date.now() - started
+                total_candidates: r.totalCandidates, hits: r.hits, evidence: r.evidence, summary,
+                latency_ms: Date.now() - started,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `Anything search:${String(args.query?.keyword ?? '')}`,
-                kind: 'search',
-                rawInput: args.query
-            }),
-        presentResult: (_args, value)=>{
+        presentCall: args => ({ card: 'generic', title: `Anything search:${args.keyword ?? ''}`, kind: 'search', rawInput: args }),
+        presentResult: (_args, value) => {
             const r = value;
-            const n = Array.isArray(r.hits) ? r.hits.length : r.total_candidates ?? 0;
+            const n = Array.isArray(r.hits) ? r.hits.length : (r.total_candidates ?? 0);
             return {
                 card: 'generic',
-                title: `Anything:${r.keyword ?? ''} ${r.verdict === 'hit' ? `${n} hits` : r.verdict ?? 'no-result'}`,
-                content: [
-                    {
-                        type: 'text',
-                        text: String(r.summary ?? '')
-                    }
-                ]
+                title: `Anything:${r.keyword ?? ''} ${r.verdict === 'hit' ? `${n} hits` : (r.verdict ?? 'no-result')}`,
+                content: [{ type: 'text', text: String(r.summary ?? '') }],
             };
-        }
+        },
     }));
     registerGuarded(defineTool({
         name: 'gotry_web_search',
-        description: 'Read any public URL as markdown (Jina Reader, free, no key). ' + 'Use as the "last mile" web reader when hotel-be Anything or gotry tools lack the answer. ' + 'NOT a general-purpose search engine — only fetches a URL you already know. ' + 'Three-valued: ok / error(非法 URL/超时)/not-reachable(r.jina.ai 不可用).' + 'Contract with gotry capabilities/anything.ts: 同构(L4 证据链 + 降级不阻塞 + 三值)。',
+        description: routed('gotry_web_search', 'Read any public URL as markdown (Jina Reader, free, no key). ' +
+            'Use as the "last mile" web reader when hotel-be Anything or gotry tools lack the answer. ' +
+            'NOT a general-purpose search engine — only fetches a URL you already know. ' +
+            'Three-valued: ok / error(非法 URL/超时)/not-reachable(r.jina.ai 不可用).' +
+            'Contract with gotry capabilities/anything.ts: 同构(L4 证据链 + 降级不阻塞 + 三值)。'),
+        // D-30 第四刀(issue #112):平铺 typed;url required → 宿主权即拒(字符串 blob 形态退役)
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ url: "https://example.com", timeoutMs?: 20000 }'
-            }
+            url: { type: 'string', required: true, description: '完整 URL,https://…' },
+            timeoutMs: { type: 'integer', description: '超时毫秒,默认 20000' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.content?.slice(0, 800) ?? JSON.stringify(value).slice(0, 800))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.content?.slice(0, 800) ?? JSON.stringify(value).slice(0, 800)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'url');
+        async execute(args, _exec) {
+            const q = args;
             const started = Date.now();
             if (!q.url) {
-                return JSON.parse(JSON.stringify({
-                    ok: false,
-                    summary: 'url 必填',
-                    evidence: '[agent-reach:error] empty url'
-                }));
+                return JSON.parse(JSON.stringify({ ok: false, summary: 'url 必填', evidence: '[agent-reach:error] empty url' }));
             }
-            const r = await readUrl({
-                url: q.url,
-                timeoutMs: q.timeoutMs
-            });
+            const itpW = await interpretEffect({ effect: 'WEB_READ', params: { url: q.url, timeoutMs: q.timeoutMs } });
+            if (!itpW.result)
+                return declinedObservation('WEB_READ', itpW.trace);
+            const r = itpW.result;
             const dir = await ensureStateDir(config.stateRoot);
-            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `agent-reach:${r.via}`).catch(()=>{});
-            const summary = r.ok ? `${q.url} → ${r.title ?? '(no title)'} (${r.latencyMs}ms)\n${r.evidence}\n---\n${r.content?.slice(0, 600) ?? ''}` : `${q.url} → unavailable (${r.error})\n${r.evidence}`;
+            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `agent-reach:${r.via}`).catch(() => { });
+            const summary = r.ok
+                ? `${q.url} → ${r.title ?? '(no title)'} (${r.latencyMs}ms)\n${r.evidence}\n---\n${r.content?.slice(0, 600) ?? ''}`
+                : `${q.url} → unavailable (${r.error})\n${r.evidence}`;
             return JSON.parse(JSON.stringify({
-                ok: r.ok,
-                url: q.url,
-                via: r.via,
-                title: r.title,
-                content: r.content,
-                evidence: r.evidence,
-                summary,
-                latency_ms: Date.now() - started
+                ok: r.ok, url: q.url, via: r.via, title: r.title,
+                content: r.content, evidence: r.evidence, summary,
+                latency_ms: Date.now() - started,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `读网页:${String(args.query?.url ?? '')}`,
-                kind: 'fetch',
-                rawInput: args.query
-            })
+        presentCall: args => ({ card: 'generic', title: `读网页:${args.url ?? ''}`, kind: 'fetch', rawInput: args }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_video_subtitle',
-        description: 'Extract subtitles from a YouTube/Bilibili video (yt-dlp, optional tool). ' + 'If yt-dlp is installed on this machine, returns the subtitle text (vtt, zh-Hans/zh/en preference). ' + 'If NOT installed, degrades gracefully with install instructions — never blocks. ' + 'Evidence chain: [agent-reach:yt-dlp@ts] / [@not-installed@ts].',
+        description: 'Extract subtitles from a YouTube/Bilibili video (yt-dlp, optional tool). ' +
+            'If yt-dlp is installed on this machine, returns the subtitle text (vtt, zh-Hans/zh/en preference). ' +
+            'If NOT installed, degrades gracefully with install instructions — never blocks. ' +
+            'Evidence chain: [agent-reach:yt-dlp@ts] / [@not-installed@ts].',
+        // D-30 第四刀(issue #112):平铺 typed;url required → 宿主权即拒
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ url: "https://www.youtube.com/watch?v=...", lang?: "zh-Hans,zh,en" }'
-            }
+            url: { type: 'string', required: true, description: '视频页 URL(youtube 等)' },
+            lang: { type: 'string', description: '字幕语言优先级,如 zh-Hans,zh,en' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? JSON.stringify(value).slice(0, 600))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 600)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'url');
+        async execute(args, _exec) {
+            const q = args;
             if (!q.url) {
-                return JSON.parse(JSON.stringify({
-                    ok: false,
-                    summary: 'url 必填'
-                }));
+                return JSON.parse(JSON.stringify({ ok: false, summary: 'url 必填' }));
             }
-            const r = await videoSubtitle({
-                url: q.url,
-                lang: q.lang
-            });
-            const summary = r.verdict === 'found' ? `${q.url} 字幕提取成功 (${r.latencyMs}ms)\n${r.evidence}\n---\n${(r.subtitles ?? '').slice(0, 800)}` : r.verdict === 'not-installed' ? `yt-dlp 未安装。${r.stderr}\n${r.evidence}` : `${q.url} 字幕提取失败(${r.verdict})\n${r.evidence}`;
+            const itpV = await interpretEffect({ effect: 'VIDEO_SUBTITLE', params: { url: q.url, lang: q.lang } });
+            if (!itpV.result)
+                return declinedObservation('VIDEO_SUBTITLE', itpV.trace);
+            const r = itpV.result;
+            const summary = r.verdict === 'found'
+                ? `${q.url} 字幕提取成功 (${r.latencyMs}ms)\n${r.evidence}\n---\n${(r.subtitles ?? '').slice(0, 800)}`
+                : r.verdict === 'not-installed'
+                    ? `yt-dlp 未安装。${r.stderr}\n${r.evidence}`
+                    : `${q.url} 字幕提取失败(${r.verdict})\n${r.evidence}`;
             return JSON.parse(JSON.stringify({
-                ok: r.ok,
-                verdict: r.verdict,
-                url: q.url,
-                subtitles: r.subtitles?.slice(0, 4000),
-                evidence: r.evidence,
-                summary,
-                latency_ms: r.latencyMs
+                ok: r.ok, verdict: r.verdict, url: q.url,
+                subtitles: r.subtitles?.slice(0, 4000), evidence: r.evidence, summary,
+                latency_ms: r.latencyMs,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `视频字幕:${String(args.query?.url ?? '')}`,
-                kind: 'fetch',
-                rawInput: args.query
-            })
+        presentCall: args => ({ card: 'generic', title: `视频字幕:${args.url ?? ''}`, kind: 'fetch', rawInput: args }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_github_search',
-        description: 'Search GitHub repositories (gh CLI, optional tool). ' + 'If gh is installed and authenticated, returns repos with name/description/stars/url. ' + 'If NOT installed, degrades with install instructions — never blocks. ' + 'Evidence chain: [agent-reach:gh@ts] / [@not-installed@ts].',
+        description: 'Search GitHub repositories (gh CLI, optional tool). ' +
+            'If gh is installed and authenticated, returns repos with name/description/stars/url. ' +
+            'If NOT installed, degrades with install instructions — never blocks. ' +
+            'Evidence chain: [agent-reach:gh@ts] / [@not-installed@ts].',
+        // D-30 第四刀(issue #112):平铺 typed;query required → 宿主权即拒(顶层字段与旧内层同名,形态从对象变字符串)
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ query: "agent-reach", limit?: 5 }'
-            }
+            query: { type: 'string', required: true, description: 'GitHub 搜索关键词,如 agent-reach' },
+            limit: { type: 'integer', description: '结果数上限,默认 5' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? JSON.stringify(value).slice(0, 600))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 600)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'query');
+        async execute(args, _exec) {
+            const q = args;
             if (!q.query) {
-                return JSON.parse(JSON.stringify({
-                    ok: false,
-                    summary: 'query 必填'
-                }));
+                return JSON.parse(JSON.stringify({ ok: false, summary: 'query 必填' }));
             }
-            const r = await githubSearch({
-                query: q.query,
-                limit: q.limit
-            });
-            const summary = r.verdict === 'found' ? `${q.query} → ${r.repos?.length ?? 0} repos\n${(r.repos ?? []).map((x, i)=>`  ${i + 1}. ${x.name} ★${x.stars ?? '?'} — ${(x.description ?? '').slice(0, 60)}`).join('\n')}\n${r.evidence}` : r.verdict === 'not-installed' ? `gh 未安装。${r.stderr}\n${r.evidence}` : `${q.query} 搜索失败(${r.verdict})\n${r.evidence}`;
+            const itpG = await interpretEffect({ effect: 'GITHUB_SEARCH', params: { query: q.query, limit: q.limit } });
+            if (!itpG.result)
+                return declinedObservation('GITHUB_SEARCH', itpG.trace);
+            const r = itpG.result;
+            const summary = r.verdict === 'found'
+                ? `${q.query} → ${r.repos?.length ?? 0} repos\n${(r.repos ?? []).map((x, i) => `  ${i + 1}. ${x.name} ★${x.stars ?? '?'} — ${(x.description ?? '').slice(0, 60)}`).join('\n')}\n${r.evidence}`
+                : r.verdict === 'not-installed'
+                    ? `gh 未安装。${r.stderr}\n${r.evidence}`
+                    : `${q.query} 搜索失败(${r.verdict})\n${r.evidence}`;
             return JSON.parse(JSON.stringify({
-                ok: r.ok,
-                verdict: r.verdict,
-                query: q.query,
-                repos: r.repos,
-                evidence: r.evidence,
-                summary,
-                latency_ms: r.latencyMs
+                ok: r.ok, verdict: r.verdict, query: q.query,
+                repos: r.repos, evidence: r.evidence, summary,
+                latency_ms: r.latencyMs,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `GitHub 搜索:${String(args.query?.query ?? '')}`,
-                kind: 'search',
-                rawInput: args.query
-            })
+        presentCall: args => ({ card: 'generic', title: `GitHub 搜索:${args.query ?? ''}`, kind: 'search', rawInput: args }),
     }));
     registerGuarded(defineTool({
         name: 'gotry_agent_reach',
-        description: 'Agent Reach — the PRIMARY external-data gateway (thin wrapper over Panniantong/Agent-Reach upstream registry, zero channel knowledge here). ' + 'Prefer this for ANY external/internet fact beyond weather/flights/hotels. ' + 'Call ANY upstream channel method by reflection: web.read(url) / v2ex.get_hot_topics() / v2ex.search(query) / ' + 'xueqiu.get_stock_quote(symbol) / xueqiu.search_stock(query) / youtube.transcribe(url) / <channel>.check() ... ' + 'Unknown channel or method? Just call it — the error returns the upstream inventory (channel list or method signatures) so you can self-correct. ' + 'Action "status" runs the real `agent-reach doctor` (.venv/bin/agent-reach). ' + 'Channels needing cookies/setup return the upstream check() guidance verbatim — do NOT give up there: hand the user the exact configure command, then offer to re-check. ' + 'Evidence chain: [agent-reach:<channel>.<method>@ts].',
+        description: 'Agent Reach — the PRIMARY external-data gateway (thin wrapper over Panniantong/Agent-Reach upstream registry, zero channel knowledge here). ' +
+            'Prefer this for ANY external/internet fact beyond weather/flights/hotels. ' +
+            'Call ANY upstream channel method by reflection: web.read(url) / v2ex.get_hot_topics() / v2ex.search(query) / ' +
+            'xueqiu.get_stock_quote(symbol) / xueqiu.search_stock(query) / youtube.transcribe(url) / <channel>.check() ... ' +
+            'Unknown channel or method? Just call it — the error returns the upstream inventory (channel list or method signatures) so you can self-correct. ' +
+            'Action "status" runs the real `agent-reach doctor` (.venv/bin/agent-reach). ' +
+            'Channels needing cookies/setup return the upstream check() guidance verbatim — do NOT give up there: hand the user the exact configure command, then offer to re-check. ' +
+            'Evidence chain: [agent-reach:<channel>.<method>@ts].',
+        // D-30 第三刀(issue #112):query blob → 平铺 typed;全字段可选 → interpretArgs 容忍层。
+        // action 不设 enum:反射桥按 D-4a' 透传上游新增渠道/方法,gotry 零改动(生态开放面)
         parameters: {
-            query: {
-                type: 'json',
-                required: true,
-                description: '{ action: "status" } 或 { action: "reach", channel: "<上游渠道名,如 web/v2ex/xueqiu>", method: "<上游方法名,如 read/get_hot_topics/get_stock_quote>", args?: "<空格分隔参数>" }'
-            }
+            action: { type: 'string', description: 'status(默认,无 channel 时)或 reach' },
+            channel: { type: 'string', description: '上游渠道名,如 web/v2ex/xueqiu(action=reach 时)' },
+            method: { type: 'string', description: '上游方法名,如 read/get_hot_topics/get_stock_quote' },
+            args: { type: 'string', description: '空格分隔参数' },
+            timeoutMs: { type: 'integer', description: '超时毫秒' },
         },
         output: {
-            schema: {
-                type: 'json'
-            },
-            render: (_args, value)=>[
-                    {
-                        type: 'text',
-                        text: String(value.summary ?? JSON.stringify(value).slice(0, 800))
-                    }
-                ]
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 800)) }],
         },
-        async execute (args, _exec) {
-            const q = unwrapQuery(args, 'channel');
+        async execute(args, _exec) {
+            const q = unwrapQuery(args);
             const started = Date.now();
             const dir = await ensureStateDir(config.stateRoot);
-            if (q.action === 'status' || !q.action && !q.channel) {
-                const st = await reachStatus(q.timeoutMs);
-                await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, 'agent-reach:doctor').catch(()=>{});
-                const summary = st.via === 'agent-reach-cli' ? `Agent Reach doctor(上游 CLI,原样透传):\n${st.output}\n${st.evidence}` : `Agent Reach 未装:\n${st.output}\n${st.evidence}`;
+            // D-23 收编(issue #115):status/reach 两分支收敛为单一 AGENT_REACH 效应——
+            // 解译器横切(trace/declined 面)统一,渲染逻辑留在工具层不变
+            const itpAR = await interpretEffect({ effect: 'AGENT_REACH', params: { action: q.action, channel: q.channel, method: q.method, args: q.args, timeoutMs: q.timeoutMs } });
+            if (!itpAR.result)
+                return declinedObservation('AGENT_REACH', itpAR.trace);
+            if (q.action === 'status' || (!q.action && !q.channel)) {
+                const st = itpAR.result;
+                await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, 'agent-reach:doctor').catch(() => { });
+                const summary = st.via === 'agent-reach-cli'
+                    ? `Agent Reach doctor(上游 CLI,原样透传):\n${st.output}\n${st.evidence}`
+                    : `Agent Reach 未装配(.venv 缺失)——可选依赖,机/酒/网页社媒读取之外的工具不受影响。\n补装:终端跑 npx @danceiny/gotry doctor --fix;整体依赖状态可调 gotry_doctor 工具查看。\n${st.evidence}`;
                 return JSON.parse(JSON.stringify({
-                    ok: st.ok,
-                    via: st.via,
-                    output: st.output,
-                    evidence: st.evidence,
-                    summary,
-                    latency_ms: Date.now() - started
+                    ok: st.ok, via: st.via, output: st.output, evidence: st.evidence, summary,
+                    latency_ms: Date.now() - started,
                 }));
             }
             if (!q.channel || !q.method) {
-                return JSON.parse(JSON.stringify({
-                    ok: false,
-                    summary: 'channel 与 method 必填(或 action=status);清单可先随便调一次,inventory 会带回上游渠道/方法表'
-                }));
+                return JSON.parse(JSON.stringify({ ok: false, summary: 'channel 与 method 必填(或 action=status);清单可先随便调一次,inventory 会带回上游渠道/方法表' }));
             }
-            const r = await reach({
-                channel: q.channel,
-                method: q.method,
-                args: q.args,
-                timeoutMs: q.timeoutMs
-            });
-            const dataStr = (v)=>{
+            const r = itpAR.result;
+            // 长结果干净截断:数组按条目边界保留(dsh 工具上限会拦腰断 JSON,模型只能看到半条)
+            const dataStr = (v) => {
                 if (Array.isArray(v)) {
                     const kept = [];
                     let budget = 3500;
-                    for (const item of v){
+                    for (const item of v) {
                         const s = JSON.stringify(item);
-                        if (budget - s.length < 0) break;
+                        if (budget - s.length < 0)
+                            break;
                         budget -= s.length + 1;
                         kept.push(item);
                     }
-                    if (kept.length < v.length) kept.push(`…(截断:保留 ${kept.length}/${v.length} 条;可用上游方法带 limit 参数取更少)`);
+                    if (kept.length < v.length)
+                        kept.push(`…(截断:保留 ${kept.length}/${v.length} 条;可用上游方法带 limit 参数取更少)`);
                     return kept;
                 }
-                if (typeof v === 'string') return v.length > 4000 ? v.slice(0, 4000) + '…(截断)' : v;
+                if (typeof v === 'string')
+                    return v.length > 4000 ? v.slice(0, 4000) + '…(截断)' : v;
                 return v;
             };
-            if (r.ok) r.data = dataStr(r.data);
-            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `agent-reach:${q.channel}.${q.method}:${r.verdict}`).catch(()=>{});
-            const summary = r.verdict === 'found' ? `${q.channel}.${q.method} → found (${r.latencyMs}ms)\n${r.evidence}\n${typeof r.data === 'string' ? r.data.slice(0, 600) : JSON.stringify(r.data ?? null).slice(0, 600)}` : r.verdict === 'needs-setup' ? `${q.channel}.${q.method} → 需配置(上游 check() 原话): ${r.setup ?? ''}\n${r.evidence}` : r.verdict === 'not-installed' ? `${q.channel}.${q.method} → 上游未装: ${r.setup ?? ''}\n${r.evidence}` : `${q.channel}.${q.method} → ${r.error ?? 'error'}${r.inventory ? `\n上游清单: ${JSON.stringify(r.inventory).slice(0, 1200)}` : ''}\n${r.evidence}`;
+            if (r.ok)
+                r.data = dataStr(r.data);
+            await recordLatency(join(dir, 'bridge-latency.jsonl'), Date.now() - started, `agent-reach:${q.channel}.${q.method}:${r.verdict}`).catch(() => { });
+            const summary = r.verdict === 'found'
+                ? `${q.channel}.${q.method} → found (${r.latencyMs}ms)\n${r.evidence}\n${typeof r.data === 'string' ? r.data.slice(0, 600) : JSON.stringify(r.data ?? null).slice(0, 600)}`
+                : r.verdict === 'needs-setup'
+                    ? `${q.channel}.${q.method} → 需配置(上游 check() 原话): ${r.setup ?? ''}\n${r.evidence}`
+                    : r.verdict === 'not-installed'
+                        ? `${q.channel}.${q.method} → 上游未装配(可选依赖): ${r.setup ?? ''}\n整体依赖状态可调 gotry_doctor 查看;补装: npx @danceiny/gotry doctor --fix\n${r.evidence}`
+                        : `${q.channel}.${q.method} → ${r.error ?? 'error'}${r.inventory ? `\n上游清单: ${JSON.stringify(r.inventory).slice(0, 1200)}` : ''}\n${r.evidence}`;
             return JSON.parse(JSON.stringify({
-                ok: r.ok,
-                channel: r.channel,
-                method: q.method,
-                verdict: r.verdict,
+                ok: r.ok, channel: r.channel, method: q.method, verdict: r.verdict,
                 data: typeof r.data === 'string' ? r.data.slice(0, 4000) : r.data,
-                inventory: r.inventory,
-                setup: r.setup,
-                evidence: r.evidence,
-                summary,
-                latency_ms: Date.now() - started
+                inventory: r.inventory, setup: r.setup, evidence: r.evidence, summary,
+                latency_ms: Date.now() - started,
             }));
         },
-        presentCall: (args)=>({
-                card: 'generic',
-                title: `Agent Reach:${String(args.query?.channel ?? '')}.${String(args.query?.method ?? 'status')}`,
-                kind: 'fetch',
-                rawInput: args.query
-            }),
-        presentResult: (args, value)=>{
+        presentCall: args => ({ card: 'generic', title: `Agent Reach:${String(args.channel ?? '')}.${String(args.method ?? 'status')}`, kind: 'fetch', rawInput: args }),
+        presentResult: (args, value) => {
             const r = value;
-            const q = args.query ?? {};
+            const q = args ?? {};
             const icon = r.verdict === 'found' ? '✅' : r.verdict === 'needs-setup' ? '🔧' : r.verdict === 'not-installed' ? '📦' : '❌';
             return {
                 card: 'generic',
                 title: `AgentReach ${icon} ${q.channel ?? ''}.${q.method ?? 'status'} ${r.verdict ?? ''}`,
+                content: [{ type: 'text', text: String(r.summary ?? '') }],
+            };
+        },
+    }));
+    // ---- 依赖体检面(2026-09-02 迪拜 session 复盘:可选依赖未装配时,LLM 需要一个
+    // 统一的状态入口来「显示状态 + 引导补装」,而不是在 not-installed 里各自摸索)----
+    registerGuarded(defineTool({
+        name: 'gotry_doctor',
+        description: 'Check optional-dependency health for ALL gotry tools (read-only by default). Coverage: GoTry Session Bridge extension / Agent Reach (.venv) / hbcli (hotel realtime) / FlyAI key + recent trial-quota exhaustion time / dsh-calendar mount state / dsh-better-sidebar / dsh-map-tools / dsh-tool-ask-user. '
+            + 'Call this when ANY gotry tool returns not-installed / needs-setup, when the user asks 「体检/依赖状态/工具为什么不可用」, or BEFORE leaning on a channel for a plan. '
+            + 'Returns per-item status (ok/degraded/missing) with exact fix commands. '
+            + 'Action=diagnose (default): pure read-only — never installs anything, only renders the report. '
+            + 'Action=repair: optional autonomous repair — only attempts items the user named via `items` (stable doctor item ids, e.g. ["agent-reach","sidebar"]); empty/missing items means repair every auto-repairable gap. Items requiring browser-store install / credentials / API key / profile config / package reinstall / Node upgrade are NEVER auto-installed — they are reported as needs-user-action / unavailable and require the user to handle them. '
+            + 'Repair flow is observable: diagnosis → scope-keyed plan (selected auto-repairable items + skipped) → runtime approval card (per agent, per scope; same agent+scope reuses approval, different scope re-asks) → execute installer → recheck → per-item installed/failed with retry command. '
+            + 'Rejected/cancelled = no execution; unavailable approval channel = no execution (clear structured outcome). LLM keys are the dsh host\'s business and are deliberately out of scope. '
+            + 'A markdown report is rendered for the workspace (gotry-state/doctor-report.md) so the sidebar workbench can preview it.',
+        // D-30 第三刀(issue #112):query blob → 平铺 typed;全字段可选 → interpretArgs 容忍层
+        // issue #284 增量:action + items 两参数;默认 diagnose 保持读-only 不变(向后兼容)
+        parameters: {
+            action: { type: 'string', enum: ['diagnose', 'repair'], description: '默认 diagnose;repair 时按 items 范围补装可选依赖,user-action / unavailable 项永不冒充 auto' },
+            items: { type: 'array', items: { type: 'string', enum: ['node', 'extension', 'agent-reach', 'hbcli', 'flyai', 'sidebar', 'llm-key', 'calendar', 'map-tools', 'ask-user'] }, description: 'repair 时的 doctor item id 范围;空 = 全部 auto-repairable' },
+            writeReport: { type: 'boolean', description: '默认 true,把 markdown 报告写进 gotry-state/doctor-report.md(侧栏工作台可预览)' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 900)) }],
+        },
+        async execute(args, _exec) {
+            const q = unwrapQuery(args, 'action');
+            const action = q?.action === 'repair' ? 'repair' : 'diagnose';
+            const check = seams.doctor?.check ?? runDoctorChecks;
+            const report = await check({ stateRoot: config.stateRoot ?? '.' });
+            // repair 时必须把复检后的报告写盘，避免侧栏仍显示修复前状态。
+            let reportPath;
+            const writeReport = async (current) => {
+                if (q?.writeReport === false)
+                    return;
+                try {
+                    const { writeFile } = await import('node:fs/promises');
+                    const dir = await ensureStateDir(config.stateRoot);
+                    reportPath = join(dir, 'doctor-report.md');
+                    await writeFile(reportPath, renderDoctorReportMd(current), 'utf-8');
+                }
+                catch {
+                    reportPath = undefined;
+                }
+            };
+            const icon = (s) => (s === 'ok' ? '✅' : s === 'degraded' ? '⚠️' : '❌');
+            const reportLines = (current) => current.items.map(i => `${icon(i.status)} ${i.label}:${i.detail}${i.fix ? `\n   ↳ 修复: ${i.fix}` : ''}`);
+            if (action === 'diagnose') {
+                await writeReport(report);
+                const diagSummary = `${report.summary}\n${reportLines(report).join('\n')}${reportPath ? `\n报告已写: ${reportPath}(侧栏工作台可直接预览)` : '\n(报告写盘失败,仅本对话展示)'}`;
+                // 读-only 路径:保持向后兼容,模型拿到的 verdict/items 与 issue #284 之前一致
+                return JSON.parse(JSON.stringify({
+                    ok: true,
+                    action: 'diagnose',
+                    verdict: report.ok ? 'all-clear' : 'needs-attention',
+                    items: report.items,
+                    report_path: reportPath,
+                    evidence: `[doctor@${new Date().toISOString()}]`,
+                    summary: diagSummary,
+                }));
+            }
+            // action='repair':从诊断 → 选定 auto-repairable → scope-keyed 审批 → 真执行(走 bootstrap.runOnboardingFix)→ 复检。
+            // 范围过滤:items 非空时只考虑这些 id(未知 id 静默剔除,落 skipped 不冒充 auto)。
+            // runDoctorRepair 内部懒加载 bin/gotry-bootstrap.js,自适应 status→level 适配 + 真实安装器。
+            const requestedItems = Array.isArray(q?.items) && q.items.length > 0 ? new Set(q.items) : null;
+            const scopedReport = requestedItems
+                ? { ...report, items: report.items.filter((i) => requestedItems.has(i.id)) }
+                : report;
+            const exec = _exec;
+            // 生产 repair 让 bootstrap 安装编排复用本工具的同一诊断注册表做终态复检；
+            // fixture 若显式提供 recheck，则保留其隔离实现，再单独取一次工具报告。
+            let recheck;
+            const injectedRepair = seams.doctor?.repair;
+            const repairOptions = {
+                ...injectedRepair,
+                recheck: injectedRepair?.recheck ?? (async () => {
+                    recheck = await check({ stateRoot: config.stateRoot ?? '.' });
+                    return recheck.items.map((item) => ({
+                        label: item.label,
+                        level: item.status,
+                        detail: item.detail,
+                        fix: item.fix,
+                    }));
+                }),
+            };
+            const repair = await runDoctorRepair(scopedReport, (scopeKey, reason) => repairApprovalGate.request(exec?.agent, scopeKey, reason, { callId: exec?.callId, signal: exec?.signal }), repairOptions);
+            if (repair.approval === 'granted' && !recheck) {
+                recheck = await check({ stateRoot: config.stateRoot ?? '.' });
+            }
+            const finalReport = recheck ?? report;
+            await writeReport(finalReport);
+            const diagSummary = `${report.summary}\n${reportLines(report).join('\n')}`;
+            // 整合诊断 + 修复双视角 summary(模型可分清哪段是体检、哪段是修复)
+            const repairLines = [];
+            for (const r of repair.repairs) {
+                repairLines.push(`${r.status === 'installed' ? '✅' : '❌'} ${r.label}: ${r.reason}${r.nextAction ? ` → ${r.nextAction}` : ''}`);
+            }
+            for (const s of repair.skipped) {
+                repairLines.push(`⏭  ${s.label}: ${s.reason}(bucket=${s.bucket})`);
+            }
+            const recheckSummary = recheck
+                ? `\n\n[recheck] ${recheck.summary}\n${reportLines(recheck).join('\n')}`
+                : '';
+            const reportSummary = reportPath ? `\n报告已写: ${reportPath}(侧栏工作台可直接预览)` : '\n(报告写盘失败,仅本对话展示)';
+            const combinedSummary = `${diagSummary}\n\n[repair] verdict=${repair.verdict}, approval=${repair.approval}, plan=${repair.selected.length} 项 auto / ${repair.skipped.length} 项 skipped\n${repairLines.join('\n')}\n${repair.summary}${recheckSummary}${reportSummary}`;
+            return JSON.parse(JSON.stringify({
+                ok: repair.ok,
+                action: 'repair',
+                verdict: repair.verdict,
+                diagnosis: report,
+                recheck,
+                plan: {
+                    selected: repair.selected,
+                    needs_user_action: repair.skipped.filter((s) => s.bucket === 'user-action').map((s) => ({ id: s.id, label: s.label, reason: s.reason })),
+                    unavailable: repair.skipped.filter((s) => s.bucket === 'unavailable').map((s) => ({ id: s.id, label: s.label, reason: s.reason })),
+                    scope_key: repair.scopeKey,
+                },
+                approval: repair.approval,
+                repairs: repair.repairs,
+                skipped: repair.skipped,
+                evidence: `[doctor@${new Date().toISOString()}]`,
+                summary: combinedSummary,
+                report_path: reportPath,
+            }));
+        },
+        presentCall: args => {
+            const q = unwrapQuery(args, 'action');
+            const a = q?.action === 'repair';
+            return { card: 'generic', title: a ? '🩺 依赖体检+修复(待批准)' : '🩺 依赖体检', kind: 'execute', rawInput: args };
+        },
+        presentResult: (_args, value) => {
+            const r = value;
+            const deniedLabel = r.approval === 'cancelled'
+                ? '↩️ 已取消'
+                : r.approval === 'unavailable'
+                    ? '⚠️ 无审批通道'
+                    : '🚫 已拒绝';
+            const title = r.action === 'repair'
+                ? `🩺 修复:${r.verdict === 'repaired' ? '✅ 已就位' : r.verdict === 'partial-repair' ? '⚠️ 部分成功' : r.verdict === 'repair-blocked' ? '❌ 复检未通过' : r.verdict === 'approval-denied' ? deniedLabel : '🔧 无可补装项'}`
+                : `🩺 依赖体检:${r.verdict === 'all-clear' ? '✅ 全部就绪' : '🔧 有项待处理'}`;
+            return {
+                card: 'generic',
+                title,
+                content: [{ type: 'text', text: String(r.summary ?? '') }],
+            };
+        },
+    }));
+    // ---- 产物面(issue #25):agent 生成的文件可在 dsh 内发现与阅读,不再只是本地文件名 ----
+    registerGuarded(defineTool({
+        name: 'gotry_artifacts_list',
+        description: 'List GoTry artifacts — deep-planning deliverables (async runs from the state ledger) plus agent-written markdown/HTML itinerary files ' +
+            'in the working directory (trip plans as .md, .html or .htm). READ-ONLY discovery. ' +
+            'Opening a listed .html/.htm goes through the host native HTML preview, which the client labels as an HTML preview because its scripts may run; gotry_artifacts_read is the source-text path. ' +
+            'Generated itinerary HTML documents (gotry_itinerary_render) land in the same working-directory view. ' +
+            'Use when the user asks to see/open/revisit a previously generated artifact ' +
+            '(「看看刚才生成的行程」「上次的规划在哪」「打开那个 md／html」) — list first, then read with gotry_artifacts_read. ' +
+            'Optional `offset` (zero-based nonnegative integer) and `search` (literal, case-insensitive substring over id/title/filename; ' +
+            'trim then empty = no filter; no regex/glob semantics, body content is never searched) let you page past the default 20 / cap 50 ' +
+            'to enumerate every eligible artifact and find an older one by name. `total` is the post-filter total; `nextOffset` is present ' +
+            'only when another page exists; an offset past the end returns an empty page with the known `total` and no `nextOffset`. ' +
+            'The list is not a stable snapshot across filesystem mutations.',
+        // D-30 第三刀(issue #112):query blob → 平铺 typed;全字段可选 → interpretArgs 容忍层
+        parameters: {
+            limit: { type: 'integer', description: '最多返回条数,默认 20,上限 50' },
+            offset: { type: 'integer', description: '零-based 非负整数,跳过前 N 条;越界返回空页 + 准确 total + 无 nextOffset' },
+            search: { type: 'string', description: '字面大小写无关子串(匹配 id/title/filename);trim 后空 = 不过滤;非正则/非 glob,不搜内容' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 600)) }],
+            presentationMeta: (_args, value) => {
+                const r = value;
+                const paths = Array.isArray(r.artifacts)
+                    ? r.artifacts.map(a => String(a.path ?? '')).filter(Boolean)
+                    : [];
+                return {
+                    shape: 'paths',
+                    paths,
+                    truncated: Boolean(r.truncated),
+                    total: r.total ?? paths.length,
+                };
+            },
+        },
+        async execute(args, exec) {
+            const q = unwrapQuery(args, 'limit');
+            let r;
+            try {
+                r = await listArtifacts({
+                    stateRoot: config.stateRoot ?? '.',
+                    cwd: sessionCwd(exec),
+                    limit: q.limit,
+                    offset: q.offset,
+                    search: q.search,
+                });
+            }
+            catch (err) {
+                const msg = err instanceof Error ? err.message : String(err);
+                return JSON.parse(JSON.stringify({ ok: false, error: msg, summary: msg, hint: 'limit 必须是有限整数(零/负夹到 1,大值封顶 50);offset 必须是非负安全整数(≤ Number.MAX_SAFE_INTEGER);search 必须是字符串(trim 后空 = 不过滤,非字符串 predictably 拒绝)' }));
+            }
+            const lines = r.artifacts.map(a => `- [${a.source}] ${a.title}${a.status ? `(${a.status})` : ''} — ${a.path}${a.updated ? ` @ ${a.updated.slice(0, 16).replace('T', ' ')}` : ''}`);
+            // Echo the requested offset (post-validation), not the clamped page start,
+            // so a caller that asked for an offset past the end can tell.
+            const requestedOffset = q.offset ?? 0;
+            const position = r.artifacts.length > 0
+                ? `${requestedOffset + 1}-${requestedOffset + r.artifacts.length}`
+                : '无';
+            const sizeInfo = `第 ${position}/${r.total} 项(limit=${r.limit})`;
+            const searchInfo = r.search ? `,搜索「${r.search}」` : '';
+            const summary = r.artifacts.length
+                ? `在册产物 ${r.artifacts.length}/${r.total} 项${r.truncated ? `(后续页 offset=${r.nextOffset})` : ''}${searchInfo},${sizeInfo}:\n${lines.join('\n')}`
+                : r.total > 0
+                    // Beyond the end with a known total — never claim "no artifacts".
+                    ? `空页(${requestedOffset + 1} 起越界;总在册 ${r.total} 项,本次 limit=${r.limit})${searchInfo},${sizeInfo}`
+                    : `无在册产物(异步深度规划交付与工作目录 md/html 文件都会出现在这里)${searchInfo ? `(搜索「${r.search}」无匹配)` : ''}`;
+            return JSON.parse(JSON.stringify({
+                ok: true,
+                artifacts: r.artifacts,
+                total: r.total,
+                truncated: r.truncated,
+                offset: requestedOffset,
+                limit: r.limit,
+                ...(r.nextOffset !== undefined ? { nextOffset: r.nextOffset } : {}),
+                ...(r.search !== undefined ? { search: r.search } : {}),
+                summary,
+            }));
+        },
+        // Host presentationMeta remains persisted with the ToolResult for Host-side
+        // consumers; the packaged public Client separately renders the runtime block
+        // for these custom wire names in DSH Web.
+        presentResult: (_args, result) => {
+            if (result.isError || typeof result.meta !== 'object' || result.meta === null || Array.isArray(result.meta))
+                return undefined;
+            const meta = result.meta;
+            if (meta.shape !== 'paths' || !Array.isArray(meta.paths) || !meta.paths.every(p => typeof p === 'string') ||
+                typeof meta.truncated !== 'boolean' || typeof meta.total !== 'number' || !Number.isInteger(meta.total) || meta.total < 0) {
+                return undefined;
+            }
+            return {
+                card: 'search',
+                shape: 'paths',
+                title: `产物:${meta.total} 项在册${meta.truncated ? '(已截断)' : ''}`,
+                paths: meta.paths,
+                truncated: meta.truncated,
+                total: meta.total,
+            };
+        },
+    }));
+    registerGuarded(defineTool({
+        name: 'gotry_artifacts_read',
+        description: 'Read one GoTry artifact as a line-numbered file view rendered directly in the chat UI. ' +
+            'Input: the path from gotry_artifacts_list, or a bare async ticket id (e.g. dp-xxxx). ' +
+            'Optional offset (1-based) / limit window for paging large files. ' +
+            'READ-ONLY; text artifacts only (md/txt/json/jsonl/csv/log/yaml/html/htm). ' +
+            'HTML/HTM is returned as source text by this tool only — it does not parse markup, run scripts or inline event handlers, or fetch anything; opening a listed HTML file is a separate action the client labels as an interactive HTML preview.',
+        // D-30 第三刀(issue #112):query blob → 平铺 typed;path required → 宿主权入口拒畸形参数(同 flyai/hotel 刀法)
+        parameters: {
+            path: { type: 'string', required: true, description: 'list 返回的路径或工单 id' },
+            offset: { type: 'integer', description: '起始行号(1 起)' },
+            limit: { type: 'integer', description: '窗口行数,默认 400' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.content ?? JSON.stringify(value).slice(0, 600)) }],
+            presentationMeta: (_args, value) => {
+                const r = value;
+                return {
+                    path: String(r.path ?? ''),
+                    offset: r.offset ?? 1,
+                    lines: Array.isArray(r.lines) ? r.lines.map(line => ({ number: line.number, text: line.text })) : [],
+                    totalLines: r.totalLines ?? 0,
+                    ...(r.lang ? { lang: r.lang } : {}),
+                    ...(r.source ? { source: r.source } : {}),
+                    ...(r.version ? { version: r.version } : {}),
+                };
+            },
+        },
+        async execute(args, exec) {
+            const q = args;
+            if (!q.path)
+                throw new Error('gotry_artifacts_read requires path');
+            if (!q.path)
+                return JSON.parse(JSON.stringify({ ok: false, error: 'path 必填(来自 gotry_artifacts_list)' }));
+            const r = await readArtifact({ stateRoot: config.stateRoot ?? '.', cwd: sessionCwd(exec), path: q.path, offset: q.offset, limit: q.limit });
+            if (!r.ok)
+                return JSON.parse(JSON.stringify(r));
+            // 身份/来源展示(issue #285 第 1 条「显示身份/来源」):行号视图保留 read 卡的
+            // path/offset/lines/totalLines/lang;fallback content 用 source label 前缀,
+            // 让无法渲染 read 卡的 UI 也能区分「本会话选了哪个产物」,避免把旧摘要当新内容。
+            return JSON.parse(JSON.stringify({
+                ...r,
+                source: r.source,
+                summary: `${r.path}(${r.totalLines} 行)第 ${r.offset}-${r.offset + r.lines.length - 1} 行${r.windowed ? `(共 ${r.totalLines} 行,可翻页)` : ''}`,
+            }));
+        },
+        // Keep the standard location payload for Host consumers. The Web client only
+        // renders its built-in keyed tools, so this is not claimed as native custom-card E2E.
+        presentCall: args => ({
+            card: 'generic',
+            title: `读产物:${args.path ?? ''}`,
+            kind: 'read',
+            rawInput: args,
+            ...(args.path ? { locations: [{ path: String(args.path), line: 1 }] } : {}),
+        }),
+        presentResult: (_args, result) => {
+            if (result.isError || typeof result.meta !== 'object' || result.meta === null || Array.isArray(result.meta))
+                return undefined;
+            const meta = result.meta;
+            if (typeof meta.path !== 'string' || meta.path === '' || typeof meta.offset !== 'number' || !Number.isInteger(meta.offset) || meta.offset < 1 ||
+                !Array.isArray(meta.lines) || !meta.lines.every(line => typeof line === 'object' && line !== null && !Array.isArray(line) &&
+                typeof line.number === 'number' && Number.isInteger(line.number) &&
+                typeof line.text === 'string') ||
+                typeof meta.totalLines !== 'number' || !Number.isInteger(meta.totalLines) || meta.totalLines < 0) {
+                return undefined;
+            }
+            const source = typeof meta.source === 'string' ? meta.source : 'unknown';
+            const identityLine = `source: ${source} · path: ${meta.path} · ${meta.totalLines} lines`;
+            const rawContent = result.content
+                .filter(block => block.type === 'text')
+                .map(block => block.text)
+                .join('\n');
+            return {
+                card: 'read',
+                title: meta.path.split('/').pop() ?? meta.path,
+                path: meta.path,
+                offset: meta.offset,
+                lines: meta.lines,
+                totalLines: meta.totalLines,
+                ...(typeof meta.lang === 'string' ? { lang: meta.lang } : {}),
                 content: [
-                    {
-                        type: 'text',
-                        text: String(r.summary ?? '')
-                    }
-                ]
+                    { type: 'text', text: identityLine },
+                    { type: 'text', text: rawContent },
+                ],
             };
-        }
+        },
+    }));
+    // ---- 行程 HTML 产物生成(issue #442,父 #438):显式行程 + 注册表事实 → 会话工作目录内的新文件 ----
+    // 只新建(独占 O_EXCL,绝不覆盖);事实只从 config.stateRoot 注册表按 id 取,
+    // 不收调用方自带事实对象;空 fact_ids = 明确未核验计划(无整体「已验证」结论)。
+    registerGuarded(defineTool({
+        name: 'gotry_itinerary_render',
+        description: 'Generate a local, self-contained HTML itinerary document as a NEW file in the session working directory (never overwrites; '
+            + 'the file can then be listed/read with gotry_artifacts_list / gotry_artifacts_read). '
+            + 'Input: title, the explicit itinerary object { trip_start, trip_end, stays:[{place,check_in,check_out}], '
+            + 'od_segments:[{from,to,date,mode,legs}] } (same shape as gotry_fact_gate itinerary; nights/budget fields are not accepted), '
+            + 'and fact_ids — the ids of already-recorded bookable facts to project as evidence. Facts are loaded ONLY from the session fact '
+            + 'registry (stateRoot bookable-facts log): caller-supplied fact objects are never accepted, and unknown/duplicate/over-limit ids are rejected. '
+            + 'An empty fact_ids array is legitimate and renders an explicitly unverified plan — this document never carries an overall "verified" badge, '
+            + 'only per-fact bookability/tier/source labels. No Markdown-to-facts guessing, no date/night/budget arithmetic, no upstream queries. '
+            + 'Optional basename must match gotry-itinerary-<ASCII token>.html; when omitted a random name is generated. '
+            + 'The result returns the final absolute path.',
+        parameters: {
+            title: { type: 'string', required: true, description: '文档标题(作为页面标题与 h1,原样转义)' },
+            itinerary: { type: 'object', additionalProperties: true, required: true, description: '结构化行程 { trip_start, trip_end, stays:[{place,check_in,check_out}], od_segments:[{from,to,date,mode,legs}] }; 不做夜数/预算/时间运算' },
+            fact_ids: { type: 'array', items: { type: 'string' }, required: true, description: '要投影的事实 id 数组(来自本会话 exact-date 工具结果登记的注册表);必填,空数组 = 明确未核验计划' },
+            basename: { type: 'string', description: '可选文件名,必须形如 gotry-itinerary-<ASCII token>.html;不传则用 crypto 随机名' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 800)) }],
+        },
+        async execute(args, exec) {
+            const q = args;
+            // 写产物不允许猜测落点:宿主必须给出显式绝对会话工作目录,否则 fail closed
+            //(绝不回落 process.cwd()——那会把产物写进 Node 进程的偶然目录)
+            const cwd = sessionCwd(exec);
+            if (typeof cwd !== 'string' || cwd.trim() === '' || !isAbsolute(cwd)) {
+                const error = typeof cwd !== 'string' || cwd.trim() === ''
+                    ? '会话工作目录缺失:拒绝在未知目录写产物'
+                    : `会话工作目录必须是绝对路径:${cwd}`;
+                return JSON.parse(JSON.stringify({
+                    ok: false,
+                    error,
+                    hint: '产物只写到宿主会话的显式绝对工作目录(dsh 会话 header.cwd);本工具不猜测落点',
+                }));
+            }
+            const r = await generateItineraryArtifact({ title: q.title, itinerary: q.itinerary, fact_ids: q.fact_ids, basename: q.basename }, { stateRoot: config.stateRoot ?? '.', cwd });
+            const summary = r.ok
+                ? `已生成行程 HTML 产物(未写入任何整体「已验证」结论):${r.path}\n`
+                    + `投影事实 ${r.fact_ids.length} 条(全部来自当前注册表),文件 ${r.bytes} 字节。`
+                    + `${r.fact_ids.length === 0 ? '本次为空事实列表:文档明确为未核验计划。' : ''}`
+                    + '可用 gotry_artifacts_list / gotry_artifacts_read 再次查看。'
+                : `未生成产物(未写入任何文件):${r.error}`
+                    + `${r.errors?.length ? `\n${r.errors.slice(0, 8).map(e => `- ${e}`).join('\n')}` : ''}`
+                    + `${r.hint ? `\n修正提示:${r.hint}` : ''}`;
+            return JSON.parse(JSON.stringify({ ...r, summary }));
+        },
+        presentCall: args => ({ card: 'generic', title: `生成行程 HTML:${String(args.title ?? '')}`.slice(0, 80), kind: 'execute', rawInput: args }),
+        presentResult: (_args, value) => {
+            const r = value;
+            return {
+                card: 'generic',
+                title: r.ok ? `行程 HTML 已生成:${String(r.path ?? '').split('/').pop() ?? ''}` : '行程 HTML 未生成',
+                content: [{ type: 'text', text: r.ok ? `最终路径:${String(r.path ?? '')}(${r.bytes ?? 0} 字节)` : String(r.error ?? '') }],
+            };
+        },
+    }));
+    registerGuarded(defineTool({
+        name: 'gotry_itinerary_deck_render',
+        description: 'Generate a local, self-contained HTML itinerary DECK (slide-form, CSS scroll-snap paging, deterministic slide derivation) as a NEW file in the session working directory (never overwrites; '
+            + 'the file can then be listed/read with gotry_artifacts_list / gotry_artifacts_read). '
+            + 'Input: title, the explicit itinerary object { trip_start, trip_end, stays:[{place,check_in,check_out}], '
+            + 'od_segments:[{from,to,date,mode,legs}] } (same shape as gotry_itinerary_render; nights/budget fields are not accepted), '
+            + 'and fact_ids — the ids of already-recorded bookable facts to project as evidence. Facts are loaded ONLY from the session fact '
+            + 'registry (stateRoot bookable-facts log): caller-supplied fact objects are never accepted, and unknown/duplicate/over-limit ids are rejected. '
+            + 'An empty fact_ids array is legitimate and renders an explicitly unverified plan — this deck never carries an overall "verified" badge, '
+            + 'only per-fact bookability/tier/source labels. No Markdown-to-facts guessing, no date/night/budget arithmetic, no upstream queries. '
+            + 'Optional basename must match gotry-deck-<ASCII token>.html; when omitted a random name is generated. '
+            + 'The result returns the final absolute path.',
+        parameters: {
+            title: { type: 'string', required: true, description: 'deck 标题(作为封面 h1,原样转义)' },
+            itinerary: { type: 'object', additionalProperties: true, required: true, description: '结构化行程 { trip_start, trip_end, stays:[{place,check_in,check_out}], od_segments:[{from,to,date,mode,legs}] }; 不做夜数/预算/时间运算' },
+            fact_ids: { type: 'array', items: { type: 'string' }, required: true, description: '要投影的事实 id 数组(来自本会话 exact-date 工具结果登记的注册表);必填,空数组 = 明确未核验计划' },
+            basename: { type: 'string', description: '可选文件名,必须形如 gotry-deck-<ASCII token>.html;不传则用 crypto 随机名' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 800)) }],
+        },
+        async execute(args, exec) {
+            const q = args;
+            // 写产物不允许猜测落点:宿主必须给出显式绝对会话工作目录,否则 fail closed
+            //(绝不回落 process.cwd()——那会把产物写进 Node 进程的偶然目录)
+            const cwd = sessionCwd(exec);
+            if (typeof cwd !== 'string' || cwd.trim() === '' || !isAbsolute(cwd)) {
+                const error = typeof cwd !== 'string' || cwd.trim() === ''
+                    ? '会话工作目录缺失:拒绝在未知目录写产物'
+                    : `会话工作目录必须是绝对路径:${cwd}`;
+                return JSON.parse(JSON.stringify({
+                    ok: false,
+                    error,
+                    hint: '产物只写到宿主会话的显式绝对工作目录(dsh 会话 header.cwd);本工具不猜测落点',
+                }));
+            }
+            const r = await generateItineraryDeckArtifact({ title: q.title, itinerary: q.itinerary, fact_ids: q.fact_ids, basename: q.basename }, { stateRoot: config.stateRoot ?? '.', cwd });
+            const summary = r.ok
+                ? `已生成行程 deck 产物(未写入任何整体「已验证」结论):${r.path}\n`
+                    + `投影事实 ${r.fact_ids.length} 条(全部来自当前注册表),文件 ${r.bytes} 字节。`
+                    + `${r.fact_ids.length === 0 ? '本次为空事实列表:deck 明确为未核验计划。' : ''}`
+                    + '可用 gotry_artifacts_list / gotry_artifacts_read 再次查看。'
+                : `未生成产物(未写入任何文件):${r.error}`
+                    + `${r.errors?.length ? `\n${r.errors.slice(0, 8).map(e => `- ${e}`).join('\n')}` : ''}`
+                    + `${r.hint ? `\n修正提示:${r.hint}` : ''}`;
+            return JSON.parse(JSON.stringify({ ...r, summary }));
+        },
+        presentCall: args => ({ card: 'generic', title: `生成行程 deck:${String(args.title ?? '')}`.slice(0, 80), kind: 'execute', rawInput: args }),
+        presentResult: (_args, value) => {
+            const r = value;
+            return {
+                card: 'generic',
+                title: r.ok ? `行程 deck 已生成:${String(r.path ?? '').split('/').pop() ?? ''}` : '行程 deck 未生成',
+                content: [{ type: 'text', text: r.ok ? `最终路径:${String(r.path ?? '')}(${r.bytes ?? 0} 字节)` : String(r.error ?? '') }],
+            };
+        },
+    }));
+    registerGuarded(defineTool({
+        name: 'gotry_deck_export',
+        description: 'Export a local, self-contained HTML itinerary DECK as a shareable static bundle (NEW directory contents; never overwrites) into a host-provided target directory. '
+            + 'Writes three files at the target_dir top level, all basename-prefixed so multiple bundles can coexist in the same dir: '
+            + '`<basename>.html` (the rendered deck), `<basename>.manifest.json` (provenance: sha256, bytes, fact counts by kind, source tags, evidence-chain summary, exported_at, optional target_url), '
+            + 'and `<basename>.qr.svg` (real QR matrix — issue #569, encoding the target_url when provided, or a `local bundle; not yet hosted` marker when omitted). '
+            + 'Input: title, the explicit itinerary object { trip_start, trip_end, stays:[{place,check_in,check_out}], od_segments:[{from,to,date,mode,legs}] } (same shape as gotry_itinerary_render; nights/budget fields are not accepted), '
+            + 'fact_ids (loaded ONLY from the session fact registry), optional basename (default = random hex), optional target_url (recorded in manifest, used by QR when slice 3b lands). '
+            + 'target_dir must be an absolute directory path provided by the host (no fallback to process cwd). All three files use O_CREAT|O_EXCL — any pre-existing file at the target slot rejects the call with zero bytes written.',
+        parameters: {
+            title: { type: 'string', required: true, description: 'deck 标题(原样转义)' },
+            itinerary: { type: 'object', additionalProperties: true, required: true, description: '结构化行程 { trip_start, trip_end, stays:[{place,check_in,check_out}], od_segments:[{from,to,date,mode,legs}] }; 不做夜数/预算/时间运算' },
+            fact_ids: { type: 'array', items: { type: 'string' }, required: true, description: '事实 id 数组(来自本会话 exact-date 工具结果登记的注册表)' },
+            basename: { type: 'string', description: '可选 bundle stem,默认随机 hex;决定三件文件名(<basename>.html / manifest.json / qr.svg)' },
+            target_url: { type: 'string', description: '可选:目标托管 URL,写入 manifest;切片 3b QR 编码将引用此字段' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 800)) }],
+        },
+        async execute(args, exec) {
+            const q = args;
+            // 写产物不允许猜测落点:宿主必须给出显式绝对 target_dir,否则 fail closed
+            const targetDir = sessionCwd(exec);
+            if (typeof targetDir !== 'string' || targetDir.trim() === '' || !isAbsolute(targetDir)) {
+                const error = typeof targetDir !== 'string' || targetDir.trim() === ''
+                    ? 'target_dir 缺失:拒绝在未知目录写产物'
+                    : `target_dir 必须是绝对路径:${targetDir}`;
+                return JSON.parse(JSON.stringify({
+                    ok: false,
+                    error,
+                    hint: '产物只写到宿主会话的显式绝对工作目录(dsh 会话 header.cwd);本工具不猜测落点',
+                }));
+            }
+            const r = await generateItineraryDeckExport({ title: q.title, itinerary: q.itinerary, fact_ids: q.fact_ids, basename: q.basename, target_url: q.target_url }, { stateRoot: config.stateRoot ?? '.', targetDir });
+            const summary = r.ok
+                ? `已生成 deck 静态导出 bundle(target_dir):${r.target_dir}\n`
+                    + `三件文件:html=${r.files.html}\nmanifest=${r.files.manifest}\nqr.svg=${r.files.qr}(真矩阵,#569 切片 3b 落地;target_url 见 manifest.target_url)\n`
+                    + `总字节 ${r.bytes},投影事实 ${r.fact_ids.length} 条(全部来自当前注册表)。`
+                    + '可直接上传到任意静态托管(Vercel/Netlify/GH Pages)。'
+                : `未生成产物(未写入任何文件):${r.error}`
+                    + `${r.errors?.length ? `\n${r.errors.slice(0, 8).map(e => `- ${e}`).join('\n')}` : ''}`
+                    + `${r.hint ? `\n修正提示:${r.hint}` : ''}`;
+            return JSON.parse(JSON.stringify({ ...r, summary }));
+        },
+        presentCall: args => ({ card: 'generic', title: `导出 deck bundle:${String(args.title ?? '')}`.slice(0, 80), kind: 'execute', rawInput: args }),
+        presentResult: (_args, value) => {
+            const r = value;
+            return {
+                card: 'generic',
+                title: r.ok ? `deck bundle 已导出:${String(r.target_dir ?? '')}` : 'deck bundle 未导出',
+                content: [{ type: 'text', text: r.ok ? `三件文件:${r.files?.html ?? ''} / ${r.files?.manifest ?? ''} / ${r.files?.qr ?? ''}` : String(r.error ?? '') }],
+            };
+        },
+    }));
+    // ---- 产物事实闸(issue #46,ADR-19):含可下单事实的产物交付前必过 ----
+    // 每个航班号/时刻/机场/价格/政策断言必须回溯到本会话 exact-date 工具结果
+    // (bookable-facts 侧车,query_id 可重放);无法回溯即 blocked——不得宣称「已验证方案」。
+    registerGuarded(defineTool({
+        name: 'gotry_fact_gate',
+        description: 'Factuality gate for itinerary artifacts (issue #46): call BEFORE delivering any artifact that contains bookable facts '
+            + '(flight numbers, times, airports, prices, visa/entry policies). Every bookable claim in the markdown is checked against '
+            + 'the session fact registry (exact-date tool results recorded by gotry_flyai_search / gotry_session_search — hit AND miss). '
+            + 'Blocked when: a claimed flight is absent from the exact-date source (never backfill from route pages/history/adjacent dates); '
+            + 'route+date never queried; times contradict the snapshot; carrier→airport mapping conflicts (FD=DMK vs VZ=BKK are NOT interchangeable); '
+            + '「联程」without protected_connection=true; policy claims without 「截至 YYYY-MM-DD」; unconditional ✓ on unverified claims. '
+            + 'Optional itinerary object enables machine invariants (hotel_nights + onboard_nights = total nights, O&D segments vs flight legs, '
+            + 'budget floor ≥ sum of item minimums). verdict=blocked ⇒ fix or downgrade wording — never present as a verified plan.',
+        // D-30 第三刀(issue #112):query blob → 平铺 typed;markdown/path 二选一无公共 required
+        // → interpretArgs 容忍层;itinerary 保 object+additionalProperties:true(嵌套形状归一在闸内,
+        // #118 D-26 渲染原语切片再收紧),给模型「这是对象」的可见信号
+        parameters: {
+            markdown: { type: 'string', description: '产物全文;与 path 二选一' },
+            path: { type: 'string', description: '产物路径(artifacts_list 返回的);与 markdown 二选一' },
+            tripYear: { type: 'integer', description: '行程年份,如 2027(日期归一用)' },
+            itinerary: { type: 'object', additionalProperties: true, description: '结构化行程 { trip_start, trip_end, stays:[{place,check_in,check_out}], onboard_nights, od_segments:[{from,to,date,mode,legs}], budget_items:[{label,min_cny,max_cny}], claimed_floor_cny? }' },
+        },
+        output: {
+            schema: { type: 'json' },
+            render: (_args, value) => [{ type: 'text', text: String(value.summary ?? JSON.stringify(value).slice(0, 800)) }],
+        },
+        async execute(args, exec) {
+            const q = unwrapQuery(args, 'markdown');
+            const avMap = await loadAirlineAirportMap();
+            if (!avMap) {
+                return JSON.parse(JSON.stringify({ ok: false, summary: '航司机场映射缺失(data/airline-airports.json)——事实闸不可用,fail closed:产物不得宣称已验证' }));
+            }
+            let markdown = q.markdown;
+            if (!markdown && q.path) {
+                const r = await readArtifact({ stateRoot: config.stateRoot ?? '.', cwd: sessionCwd(exec), path: q.path });
+                if (!r.ok)
+                    return JSON.parse(JSON.stringify({ ok: false, summary: `产物读取失败:${String(r.error ?? '')}` }));
+                markdown = r.content;
+            }
+            if (!markdown)
+                return JSON.parse(JSON.stringify({ ok: false, summary: '需要 markdown(产物全文)或 path(产物路径)' }));
+            const itinerary = q.itinerary;
+            const registry = await loadFactRegistry(config.stateRoot ?? '.');
+            // 政策复核提醒桥接(issue #359):闸侧 opts.tripStart 与 renderer 同一传入
+            // 才能让合法 `renderPolicyFact(f, tripStart)` 行通过公开闸。已加载的
+            // itinerary.trip_start 是权威源(同次闸同时驱动 itineraryInvariants),不再
+            // 额外要求调用方传 opts.tripStart;空 itinerary/无 trip_start 即无提醒。
+            const tripStart = typeof itinerary?.trip_start === 'string' ? itinerary.trip_start : undefined;
+            const report = gateArtifact(markdown, registry, avMap, { trip_year: q.tripYear, itinerary, tripStart });
+            const lines = report.violations.slice(0, 20).map(v => `  L${v.line} [${v.kind}] ${v.detail}`);
+            const summary = report.verdict === 'pass'
+                ? `事实闸 PASS:${report.traceable}/${report.claims_checked} 可下单 claim 全部回溯到 exact-date 工具结果(query_id 可重放)——可宣称「已验证方案」。`
+                : `事实闸 BLOCKED(${report.violations.length} 违例,${report.traceable}/${report.claims_checked} claim 可回溯)——不得宣称「已验证方案」:\n${lines.join('\n')}\n修正路径:逐条改成 exact-date 源返回的事实,或降级为「未确认/当前不可售,到 D-xx 复核」;exact-date miss 的 route+date 不得用历史班期/相邻日期/航线页填充。`;
+            return JSON.parse(JSON.stringify({ ok: true, ...report, summary }));
+        },
+        presentCall: args => ({ card: 'generic', title: '产物事实闸', kind: 'execute', rawInput: args }),
+        presentResult: (_args, value) => {
+            const r = value;
+            return {
+                card: 'generic',
+                title: `事实闸:${r.verdict === 'pass' ? '✅ pass' : `⛔ blocked(${r.violations?.length ?? '?'})`}`,
+                content: [{ type: 'text', text: String(r.summary ?? '') }],
+            };
+        },
     }));
 }
-
-
-//# sourceURL=/Users/bytedance/work/gotry/ts/src/index.ts