@danceiny/gotry 0.2.0-rc.27 → 0.2.0-rc.28

package/README.md

@@ -153,7 +153,7 @@ Trust is structural, not promised:
 ## Project Status and Roadmap
 Current boundary: deterministic planning and evidence-bound read capabilities are available; booking and real-user acceptance remain outside the shipped claim. See the [architecture](docs/architecture.md) and [roadmap](docs/roadmap.md).
 
-**v0.0.1-rc.24** on npm (`latest`). Pre-1.0: the core loop works end to end; evaluation is still at deterministic contracts and validators, with no external scores or uplift claims. External W2A events are contract-only and inert; no real sensor bridge or consumer is active yet.
+**v0.2.0-rc.27** on npm (`latest`). Pre-1.0: the core loop works end to end; evaluation is still at deterministic contracts and validators, with no external scores or uplift claims. External W2A events are contract-only and inert; no real sensor bridge or consumer is active yet.
 
 **Working today**
 
@@ -209,7 +209,7 @@ Documents ship as bilingual pairs (`x.md` English + `x.zh-CN.md` 中文); diverg
 
 **Built with**: DeepSeek Harness 0.2.0-rc.2 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 · OpenFlights · TypeScript
 
-**Version baseline: `v0.0.1-rc.24` (npm `latest`).** Verification gates: `scripts/run-all-tests.sh`; release flow: `scripts/publish-npm.sh`.
+**Version baseline: `v0.2.0-rc.27` (npm `latest`).** Verification gates: `scripts/run-all-tests.sh`; release flow: `scripts/publish-npm.sh`.
 
 <a href="https://www.star-history.com/?repos=danceiny%2Fgotry&type=date&legend=top-left">
  <picture>

package/README.zh-CN.md

@@ -155,7 +155,7 @@ npx @danceiny/gotry "我想从深圳休整两天,预算 3000"   # headless 一
 ## 状态与路线图
 当前边界：确定性规划与有证据边界的只读能力已经可用；预订与真实用户验收仍不属于当前交付声明。见[架构权威文档](docs/architecture.zh-CN.md)与[路线图](docs/roadmap.zh-CN.md)。
 
-npm `latest`：**v0.0.1-rc.24**。未到 1.0：核心链路已端到端可用；评测仍停留在确定性合同与校验器阶段，无外部分数、无 uplift 声明。外部 W2A 事件仍是合同层、默认 inert；尚无真实 sensor 桥或 consumer 激活。
+npm `latest`：**v0.2.0-rc.27**。未到 1.0：核心链路已端到端可用；评测仍停留在确定性合同与校验器阶段，无外部分数、无 uplift 声明。外部 W2A 事件仍是合同层、默认 inert；尚无真实 sensor 桥或 consumer 激活。
 
 **今天可用**
 
@@ -211,7 +211,7 @@ AI agent：[`AGENTS.md`](AGENTS.zh-CN.md) 是绑定契约——入场先清扫
 
 **Built with**: DeepSeek Harness 0.2.0-rc.2 (root-pinned) · Cordis · Z3 (WASM) · loopx (pipx) · hotelbyte-cli · Agent-Reach v1.5.0 · OpenFlights · TypeScript
 
-**版本基线：`v0.0.1-rc.24`（npm `latest`）。** 验证闸：`scripts/run-all-tests.sh`；发布流程：`scripts/publish-npm.sh`。
+**版本基线：`v0.2.0-rc.27`（npm `latest`）。** 验证闸：`scripts/run-all-tests.sh`；发布流程：`scripts/publish-npm.sh`。
 
 <a href="https://www.star-history.com/?repos=danceiny%2Fgotry&type=date&legend=top-left">
  <picture>

package/bin/gotry-bootstrap.js

@@ -634,6 +634,42 @@ function probe(cmd, args, timeoutMs = 10_000) {
   })
 }
 
+/**
+ * 探测命令 stdout,失败(spawn 错误/非零退出/超时)返回 null。
+ * 在 'close' 而非 'exit' 结算:'exit' 触发时 stdout 管道可能还没读完,输出会丢成空串
+ * (与 ts/capabilities/doctor.ts 的 probeStdout 同一处修复,#622)。
+ */
+function probeStdout(cmd, args, timeoutMs = 10_000) {
+  return new Promise((resolve) => {
+    const child = spawn(cmd, args, { stdio: ['ignore', 'pipe', 'ignore'] })
+    let out = ''
+    let done = false
+    const timer = setTimeout(() => {
+      if (!done) { done = true; try { child.kill('SIGKILL') } catch { /* ignore */ } resolve(null) }
+    }, timeoutMs)
+    child.on('error', () => { if (!done) { done = true; clearTimeout(timer); resolve(null) } })
+    child.stdout?.on('data', (d) => { out += d.toString() })
+    child.on('close', (code) => { if (!done) { done = true; clearTimeout(timer); resolve(code === 0 ? out.trim() : null) } })
+  })
+}
+
+/**
+ * 按 `hbcli --json auth whoami` 的输出判凭证(hotelbyte-cli 三档 api_key/portal/customer 任一
+ * configured 即有效),不看退出码——whoami 没有凭证时也退 0,按退出码判会把「没登录」报成「凭证有效」(#623)。
+ * 与工具层 ts/capabilities/doctor.ts 同语义:输出不可解析(超旧版/异常)保守视为有效;取不到输出(null)视为未确认。
+ * 两处实现的一致性由 bootstrap-tests 的 CLI↔工具层对拍守住。
+ */
+function classifyHbcliWhoami(out) {
+  if (out === null) return { ok: false, customer: false }
+  try {
+    const w = JSON.parse(out)
+    const customer = !!w?.customer?.configured
+    return { ok: !!(w?.api_key?.configured || w?.portal?.configured || customer), customer }
+  } catch {
+    return { ok: true, customer: false }
+  }
+}
+
 const say = (s) => console.log(s)
 
 /** hbcli 最低版本(可用 GOTRY_MIN_HBCLI_VERSION 覆盖)。
@@ -664,7 +700,7 @@ async function hbcliVersion(bin) {
     const timer = setTimeout(() => { if (!done) { done = true; try { child.kill('SIGKILL') } catch { /* ignore */ } resolve(null) } }, 10_000)
     child.on('error', () => { if (!done) { done = true; clearTimeout(timer); resolve(null) } })
     child.stdout?.on('data', (d) => { out += d.toString() })
-    child.on('exit', (code) => { if (!done) { done = true; clearTimeout(timer); resolve(code === 0 ? parseVersion(out.trim()) : null) } })
+    child.on('close', (code) => { if (!done) { done = true; clearTimeout(timer); resolve(code === 0 ? parseVersion(out.trim()) : null) } })
   })
 }
 
@@ -872,8 +908,15 @@ async function doctorChecks() {
     if (v && !versionAtLeast(v, MIN_HBCLI_VERSION)) {
       items.push({ label: 'hbcli(酒店实时源)', ok: false, level: 'missing', detail: `版本过旧(v${v.join('.')} < v${MIN_HBCLI_VERSION})——trade.* / search/checkAvail 会 401(issue #142)`, fix: 'npm install -g staicli --registry=https://registry.npmjs.org/' })
     } else {
-      const whoami = await probe(hbBin === 'hbcli(PATH)' ? 'hbcli' : hbBin, ['auth', 'whoami'])
-      items.push({ label: 'hbcli(酒店实时源)', ok: whoami, level: whoami ? 'ok' : 'degraded', detail: whoami ? `已安装且凭证有效(${hbBin}, v${v ? v.join('.') : '?'})` : '二进制在,但凭证未配置/失效——酒店检索将降级静态包(非实时)', fix: whoami ? undefined : 'hbcli auth set-credentials --app-key hotelbyte_api_demo --app-secret hotelbyte_api_demo(快速试用沙箱;正式 key 向 HotelByte 申请)' })
+      // 凭证按 whoami 的 JSON 三档判定,不再看退出码(#623:whoami 无凭证也退 0,旧判法恒报「凭证有效」)
+      const cred = classifyHbcliWhoami(await probeStdout(hbBin === 'hbcli(PATH)' ? 'hbcli' : hbBin, ['--json', 'auth', 'whoami']))
+      items.push({
+        label: 'hbcli(酒店实时源)', ok: cred.ok, level: cred.ok ? 'ok' : 'degraded',
+        detail: cred.ok
+          ? `已安装且凭证有效(${hbBin}, v${v ? v.join('.') : '?'}${cred.customer ? ',customer 档在用(客户邮箱验证码登录)' : ''})`
+          : '二进制在,但凭证未配置/失效——酒店检索将降级静态包(非实时)',
+        fix: cred.ok ? undefined : 'hbcli auth customer-send-code --email you@mail.com 收码后 hbcli auth customer-login --email you@mail.com --code <收件码>(客户邮箱验证码登录,新邮箱即注册,需 npm staicli ≥ 0.0.4);B 端租户注册走 hbcli auth register(先 auth send-code);或 hbcli auth set-credentials --app-key hotelbyte_api_demo --app-secret hotelbyte_api_demo(快速试用沙箱;正式 key 向 HotelByte 申请)',
+      })
     }
   } else {
     items.push({ label: 'hbcli(酒店实时源)', ok: false, level: 'missing', detail: '未安装——酒店检索降级静态包(公开渠道估算,非实时,仅覆盖内置场景)', fix: 'npx @danceiny/gotry doctor --fix' })
@@ -1741,4 +1784,5 @@ export {
   classifyDoctorGap, buildOnboardingPlan, onboardingSkipReason,
   runOnboardingFix, promptOnboarding, renderClassifiedPlan, runOnboarding, orchestrateWebLaunch,
   doctorFixAutoSupported, platformAutoUnavailableReason, installerEnabled,
+  classifyHbcliWhoami,
 }

package/dist/capabilities/anything.js

@@ -19,6 +19,12 @@
  *   - miss: hbcli exit 0,但 candidates 为空(查无结果)
  *   - err:  hbcli exit ≠ 0 或超时(降级,降级产物 标 [实时API:hbcli-anything@error@ts])
  *
+ * 离线开关(issue #617;与会话通道 GOTRY_SESSION_LIVE 同形,方向相反以保持产品默认不变):
+ *   GOTRY_HBCLI_LIVE=0|false|off(不分大小写)→ 零 spawn、不碰凭据与后端,走同一条降级面
+ *   (verdict=error,证据标 [实时API:hbcli-anything@offline@ts]);未设或任何其他取值 = 与此前
+ *   完全一致(hbcli 可用即 live)。判定见 hbcliLiveEnabled;mock/dry-run harness(nightly-evidence --dry-run、
+ *   persona-sim、replay*)缺省把它置 0,operator 显式设置的值不覆盖。
+ *
  * 契约(与 hbcli/weather/opensky 同构,L4 不变量):
  *   - 永不抛错:网络/超时/解析失败一律降级返回;
  *   - 证据链标注:成功 [实时API:hbcli-anything@ts];失败 [实时API:hbcli-anything@error@ts];
@@ -84,6 +90,15 @@ function failureReason(r, cleanupError) {
         ? 'hbcli 未返回可判定结果(进程异常结束,本轮按降级处理)'
         : `hbcli 退出码 ${r.code},未返回可判定结果(本轮按降级处理)`) + suffix;
 }
+/**
+ * 实时 hbcli 通道是否开启(issue #617)。只有显式写 0 / false / off(不分大小写,忽略首尾空白)
+ * 才关闭;未设或任何其他取值都视为开启——终端用户依赖的实时源缺省不丢。调用时读取,
+ * 测试与 harness 可在进程内切换。
+ */
+export function hbcliLiveEnabled(env = process.env) {
+    const v = (env.GOTRY_HBCLI_LIVE ?? '').trim().toLowerCase();
+    return v !== '0' && v !== 'false' && v !== 'off';
+}
 /** Anything 通用搜索 — 任何搜索失败走降级;不抛错 */
 export async function anythingSearch(q) {
     const started = Date.now();
@@ -107,6 +122,17 @@ export async function anythingSearch(q) {
             latencyMs: 0, verdict: 'error', error: 'aborted by host signal',
         };
     }
+    // 离线开关:位置在入参校验与 pre-abort 之后,既有入参的既有结果/原因串逐字节不变;
+    // 关闭时与「未装配 hbcli」同形降级(ok:false / hbcli-anything-error / verdict:error + 人话原因,
+    // 无进程噪音,也不含 timeout 字样——效应层只重试 timeout 类),且不 spawn、不重试。
+    if (!hbcliLiveEnabled()) {
+        return {
+            ok: false, via: 'hbcli-anything-error',
+            evidence: `[实时API:hbcli-anything@offline@${ts}] GOTRY_HBCLI_LIVE switched off; live channel closed, zero spawn`,
+            latencyMs: Date.now() - started, verdict: 'error',
+            error: 'hbcli 实时通道已关闭(GOTRY_HBCLI_LIVE 离线开关;本轮按降级处理,未发起查询)',
+        };
+    }
     let r = { code: null, stdout: '', stderr: '', aborted: false, timedOut: false };
     for (let i = 0; i < candidates.length; i++) {
         r = await sh(candidates[i], args, { timeoutMs: q.timeoutMs ?? 12_000, env: process.env, signal: q.signal });

package/dist/capabilities/doctor.js

@@ -52,10 +52,17 @@ function probe(bin, args, timeoutMs = 8_000) {
         } });
     });
 }
-/** 探测命令 stdout(--version),失败返回 null */
-function probeStdout(bin, args, timeoutMs = 8_000) {
+/**
+ * 探测命令 stdout(--version),失败返回 null。
+ *
+ * 在 'close' 而非 'exit' 结算:'exit' 触发时 stdout 管道可能还没读完(Node 文档明言),
+ * 秒退进程的输出会丢成空串,而空串走「不可解析 = 保守视为有效」分支,把无凭证的 hbcli
+ * 报成 ok。'close' 在 stdio 全部关闭后才触发;超时仍由下方定时器兜底。
+ * `spawnImpl` 仅供测试注入假子进程以确定性复现「exit 先于 data」的次序。
+ */
+export function probeStdout(bin, args, timeoutMs = 8_000, spawnImpl = spawn) {
     return new Promise((resolveProbe) => {
-        const child = spawn(bin, args, { stdio: ['ignore', 'pipe', 'ignore'], env: process.env });
+        const child = spawnImpl(bin, args, { stdio: ['ignore', 'pipe', 'ignore'], env: process.env });
         let out = '';
         let done = false;
         const timer = setTimeout(() => {
@@ -74,7 +81,7 @@ function probeStdout(bin, args, timeoutMs = 8_000) {
             resolveProbe(null);
         } });
         child.stdout?.on('data', (d) => { out += d.toString(); });
-        child.on('exit', (code) => { if (!done) {
+        child.on('close', (code) => { if (!done) {
             done = true;
             clearTimeout(timer);
             resolveProbe(code === 0 ? out.trim() : null);

package/dist/capabilities/ground-transfer.js

@@ -13,14 +13,52 @@
  * layer. Cache, freshness, and fallback are isolated per direction so a
  * miss / error / stale / mismatch in one direction never borrows the
  * dynamic value of the other.
+ *
+ * A provider's OWN claims about its answer — declared `mode`, resolved
+ * origin/destination — are verified against the request whenever the provider
+ * makes them: a contradiction is refused with the conformance vocabulary
+ * (`mode_mismatch` / `direction_mismatch`) and falls back to the static estimate,
+ * so a transit duration is never bound as driving and a route between two other
+ * places is never bound as the airport transfer (issue #429 GAP-429-1/2). All
+ * three fields are OPTIONAL and absent means unverifiable: see
+ * `PublicMapDrivingRouteResult` for why absent is still accepted today.
+ *
+ * A provider failure becomes a `fallbackReason`, and `exposeGroundTransferEvidence`
+ * carries that text into the tool result and each matching verdict's
+ * `transfer_evidence`. It is therefore an EXPOSED surface: every provider-authored
+ * failure string passes through the shared `sanitizeFaultDetail` first, so markup,
+ * credential assignments and URLs from a provider response body can never reach it
+ * (issue #429 GAP-429-3). The historical 400-character bound and the historical
+ * empty-case wording are preserved, so existing `GROUND_TRANSFER_*` /
+ * `map_driving_route` reason strings are unchanged byte for byte.
  */
 import { ToolCallId } from '@deepseek-ai/dsh-llm';
+import { sanitizeFaultDetail } from './provider-detail-sanitize.js';
 export const GROUND_TRANSFER_MODE = 'driving';
 export const GROUND_TRANSFER_POSITION = 'destination';
 export const GROUND_TRANSFER_STATIC_MODE = 'taxi';
 export const GROUND_TRANSFER_STATIC_MODE_MISMATCH = 'ground_transfer_static_mode_mismatch';
 export const GROUND_TRANSFER_STATIC_PRICE_EVIDENCE = '[静态包:估算]';
 export const GROUND_TRANSFER_DEFAULT_MAX_AGE_S = 15 * 60;
+/**
+ * Refusal classifications for a provider that contradicts its own request. The
+ * two names are the #429 conformance gate's vocabulary verbatim
+ * (`RouteErrorCode`), reused here as the `<code>:<direction>:<detail>` reason
+ * prefix this module already uses for `map_driving_route_provider_error` and
+ * `stale_route_requery_error`. They are duplicated as literals on purpose: the
+ * gate must stay free of product callers, so nothing here imports it.
+ */
+export const GROUND_TRANSFER_ROUTE_MODE_MISMATCH = 'mode_mismatch';
+export const GROUND_TRANSFER_ROUTE_DIRECTION_MISMATCH = 'direction_mismatch';
+/**
+ * Tolerance for verifying a provider's echoed endpoint against the requested
+ * one: 1e-4 degrees ≈ 11 m of latitude. A provider legitimately snaps a
+ * coordinate to the nearest routable road node, so an exact string match would
+ * refuse honest answers; anything beyond this bound is a different place, not a
+ * snap. Deliberately tight — refusing falls back to the static estimate, which
+ * is the safe direction.
+ */
+export const GROUND_TRANSFER_ECHO_TOLERANCE_DEG = 1e-4;
 const GROUND_TRANSFER_CACHE_LIMIT = 32;
 function asRecord(value) {
     return value !== null && typeof value === 'object' && !Array.isArray(value)
@@ -49,6 +87,50 @@ function coordinatePair(value) {
 function coordinateText(value) {
     return `${String(value.longitude)},${String(value.latitude)}`;
 }
+/** Parse a canonical `"lon,lat"` text back into a validated coordinate. */
+function coordinateFromText(value) {
+    const parts = value.split(',');
+    if (parts.length !== 2)
+        return null;
+    const [longitudeText, latitudeText] = parts;
+    if (longitudeText.trim() === '' || latitudeText.trim() === '')
+        return null;
+    return coordinate({ longitude: Number(longitudeText), latitude: Number(latitudeText) });
+}
+/**
+ * Does a provider's echoed endpoint name the place that was requested?
+ *
+ * Compared within `GROUND_TRANSFER_ECHO_TOLERANCE_DEG` so a road-node snap still
+ * matches. An echo that cannot be parsed is NOT a match: present-but-unverifiable
+ * fails closed rather than being accepted as the requested pair.
+ */
+function sameEndpoint(echoed, requested) {
+    const left = coordinateFromText(echoed);
+    const right = coordinateFromText(requested);
+    if (left === null || right === null)
+        return false;
+    return Math.abs(left.longitude - right.longitude) <= GROUND_TRANSFER_ECHO_TOLERANCE_DEG
+        && Math.abs(left.latitude - right.latitude) <= GROUND_TRANSFER_ECHO_TOLERANCE_DEG;
+}
+/**
+ * Normalize one of the provider's OWN optional claims into a comparable string.
+ *
+ * Absent (`undefined` / `null`) stays absent — that is the wired driving tool and
+ * its behaviour is unchanged. A present-but-unusable value is NOT dropped: it is
+ * carried as a non-empty string so the enforcement below can refuse it, because
+ * silently dropping a contradicting claim is exactly the relabel this seam
+ * forbids. A `{ longitude, latitude }` object is accepted as the canonical text.
+ */
+function declaredClaim(value) {
+    if (value === undefined || value === null)
+        return undefined;
+    if (typeof value === 'string')
+        return value.trim() === '' ? '(blank)' : value.trim();
+    const asCoordinate = coordinate(value);
+    if (asCoordinate !== null)
+        return coordinateText(asCoordinate);
+    return typeof value === 'object' ? JSON.stringify(value) : String(value);
+}
 function cacheKey(direction) {
     return JSON.stringify({
         mode: GROUND_TRANSFER_MODE,
@@ -66,9 +148,33 @@ function nowMs(clock) {
 function asOf(clock) {
     return new Date(nowMs(clock)).toISOString();
 }
+/** Historical bound for an exposed provider failure string (unchanged). */
+const GROUND_TRANSFER_FAULT_DETAIL_MAX_CHARS = 400;
+/**
+ * Normalize a provider failure into an exposable label. The text reaches the tool
+ * result via `exposeGroundTransferEvidence`, so it is scrubbed of markup,
+ * credential assignments and URLs before anything else (#429 GAP-429-3); the
+ * historical length bound and empty-case wording are preserved.
+ */
 function safeErrorMessage(value) {
     const message = value instanceof Error ? value.message : String(value);
-    return message.replace(/[\r\n]+/g, ' ').trim().slice(0, 400) || 'unknown provider error';
+    return sanitizeFaultDetail(message, {
+        maxChars: GROUND_TRANSFER_FAULT_DETAIL_MAX_CHARS,
+        emptyPlaceholder: 'unknown provider error',
+    });
+}
+/** Bound for a provider-authored claim quoted inside a refusal reason. */
+const GROUND_TRANSFER_CLAIM_DETAIL_MAX_CHARS = 120;
+/**
+ * A provider's own claim (mode / echoed endpoint / provider id) is provider-authored
+ * text, and a refusal reason reaches the tool result via
+ * `exposeGroundTransferEvidence`. Quote it only through the shared sanitizer.
+ */
+function safeClaim(value) {
+    return sanitizeFaultDetail(value, {
+        maxChars: GROUND_TRANSFER_CLAIM_DETAIL_MAX_CHARS,
+        emptyPlaceholder: '(absent)',
+    });
 }
 function staticCache(status = 'bypass') {
     return { status, ageS: null, asOf: null };
@@ -189,14 +295,58 @@ function parseRouteResult(value) {
         // zero minutes into the solver.
         || (distanceM > 0 && durationS === 0))
         throw new Error('map_driving_route returned an invalid public result');
+    // The provider's own claims are CARRIED, never dropped: `routeClaimRefusal`
+    // below checks them when they exist. Absent stays absent (the wired driving
+    // tool sends none of the three), and re-parsing an already-parsed result is
+    // idempotent because the carried values are already canonical.
+    const declaredMode = declaredClaim(record['mode']);
+    const resolvedOrigin = declaredClaim(record['resolvedOrigin']);
+    const resolvedDestination = declaredClaim(record['resolvedDestination']);
     return {
         provider,
         distanceM,
         durationS,
         ...(typeof record['polyline'] === 'string' ? { polyline: record['polyline'] } : {}),
         ...(Array.isArray(record['steps']) ? { steps: record['steps'] } : {}),
+        ...(declaredMode !== undefined ? { mode: declaredMode } : {}),
+        ...(resolvedOrigin !== undefined ? { resolvedOrigin } : {}),
+        ...(resolvedDestination !== undefined ? { resolvedDestination } : {}),
     };
 }
+/**
+ * Verify the provider's OWN claims against the request for this direction, and
+ * return a typed refusal when one contradicts it (#429 GAP-429-1/2).
+ *
+ * ABSENT = UNVERIFIABLE, and absent is ACCEPTED — not because an unverified
+ * answer is as good as a verified one, but because the only wired provider (the
+ * registered `map_driving_route` tool) is driving by construction and echoes no
+ * origin/destination, so for it nothing changes byte for byte. Any future
+ * non-driving or address-resolving adapter must supply these fields; the #429
+ * conformance gate already refuses an adapter that does not.
+ *
+ * PRESENT and contradicting = REFUSAL. The caller falls back to the static
+ * transfer estimate with its original price label, so a mislabelled or
+ * misrouted answer never reaches the solver.
+ */
+function routeClaimRefusal(direction, request, route) {
+    if (route.mode !== undefined && route.mode !== GROUND_TRANSFER_MODE) {
+        return {
+            code: GROUND_TRANSFER_ROUTE_MODE_MISMATCH,
+            detail: `provider ${safeClaim(route.provider)} returned mode '${safeClaim(route.mode)}' for a '${GROUND_TRANSFER_MODE}' request; a declared mode is never relabelled as ${GROUND_TRANSFER_MODE}; static transfer preserved`,
+        };
+    }
+    const { resolvedOrigin, resolvedDestination } = route;
+    if (resolvedOrigin === undefined && resolvedDestination === undefined)
+        return null;
+    if ((resolvedOrigin !== undefined && !sameEndpoint(resolvedOrigin, request.origin))
+        || (resolvedDestination !== undefined && !sameEndpoint(resolvedDestination, request.destination))) {
+        return {
+            code: GROUND_TRANSFER_ROUTE_DIRECTION_MISMATCH,
+            detail: `provider ${safeClaim(route.provider)} resolved ${safeClaim(resolvedOrigin ?? '(absent)')}>${safeClaim(resolvedDestination ?? '(absent)')} but the ${direction.direction} request was ${request.origin}>${request.destination}; direction binding is verified against the response, not assumed from the request; static transfer preserved`,
+        };
+    }
+    return null;
+}
 function buildRouteFact(direction, route, clock, cache) {
     return {
         direction: direction.direction,
@@ -272,6 +422,23 @@ async function resolveDirection(direction, staticMinutes, provider, clock, cache
             execution: context.execution,
         });
         const route = parseRouteResult(raw);
+        const refusal = routeClaimRefusal(direction, requestForProvider, route);
+        if (refusal !== null) {
+            // Fail closed: no fact is built and nothing is written to the cache, so a
+            // refused answer can never be served later as a cache hit. The static
+            // minutes, price and `[静态包:估算]` label are left untouched.
+            return {
+                applied: false,
+                direction: direction.direction,
+                staticMinutes,
+                provenance: 'static-transfer-pack',
+                asOf: null,
+                freshness: 'fallback',
+                cache: staticCache(cached ? 'stale' : 'bypass'),
+                evidenceClass: 'static_transfer_estimate',
+                fallbackReason: `${refusal.code}:${direction.direction}:${refusal.detail}`,
+            };
+        }
         const cacheInfo = {
             status: cached ? 'requery' : 'miss',
             ageS: 0,

package/dist/capabilities/provider-detail-sanitize.js

@@ -0,0 +1,64 @@
+/**
+ * Provider fault-detail sanitizer (shared, pure, zero imports).
+ *
+ * A provider's failure text is a LABEL for operators, never a channel for a
+ * provider response body. Any string that may reach the evidence/verdict surface
+ * passes through `sanitizeFaultDetail` first: markup, credential assignments and
+ * URLs are redacted, whitespace is collapsed, and the result is length-bounded.
+ * `faultDetailLeak` is the mechanical check a gate (or a test) can run over a
+ * string that is about to be exposed.
+ *
+ * Extracted so that exactly one implementation serves both
+ * `ts/capabilities/route-provider-conformance.ts` (the #429 conformance gate,
+ * which re-exports it) and `ts/capabilities/ground-transfer.ts` (the live
+ * product path, issue #429 GAP-429-3 fix). Keeping it in its own file means the
+ * conformance gate itself stays free of product callers.
+ *
+ * Deliberately pure: zero imports, zero IO, zero network, zero clock.
+ *
+ * @module capabilities/provider-detail-sanitize
+ */
+/** Default bound for a provider fragment embedded in a gate refusal. */
+export const FAULT_DETAIL_MAX_CHARS = 120;
+const DETAIL_SCRUB_PATTERNS = [
+    { re: /<[^>]*>/g, label: 'markup' },
+    { re: /\b(?:cookie|set-cookie|authorization|api[_-]?key|token|secret|password|passwd|sid)\s*[:=]\s*\S+/gi, label: 'credential' },
+    { re: /\bbearer\s+[A-Za-z0-9._-]{8,}/gi, label: 'credential' },
+    { re: /https?:\/\/\S+/gi, label: 'url' },
+];
+/**
+ * Sanitize a provider fault detail.
+ *
+ * `maxChars` lets a caller keep its own historical bound (ground-transfer keeps
+ * 400 so no existing `fallbackReason` text changes); `emptyPlaceholder` lets a
+ * caller keep its own historical empty-case wording.
+ */
+export function sanitizeFaultDetail(detail, options) {
+    const maxChars = options?.maxChars ?? FAULT_DETAIL_MAX_CHARS;
+    const placeholder = options?.emptyPlaceholder ?? '(no detail)';
+    let text = typeof detail === 'string' ? detail : '';
+    for (const { re, label } of DETAIL_SCRUB_PATTERNS)
+        text = text.replace(re, `[${label}-redacted]`);
+    text = text.replace(/\s+/g, ' ').trim();
+    if (text.length > maxChars)
+        text = `${text.slice(0, maxChars - 1)}…`;
+    return text === '' ? placeholder : text;
+}
+/**
+ * Mechanical leak check for any string about to reach the evidence surface.
+ *
+ * Shape-only by design: it looks for provider-response-body tells (markup,
+ * credential assignments, URLs) and deliberately does NOT bound length — the
+ * length bound belongs to `sanitizeFaultDetail`, which caps the PROVIDER
+ * fragment, whereas a gate's own refusal explanation is host-authored prose and
+ * may legitimately be longer.
+ */
+export function faultDetailLeak(detail) {
+    if (/<[^>]*>/.test(detail))
+        return 'fault detail carries markup (a provider response body must never reach the evidence surface)';
+    if (/\b(?:cookie|authorization|api[_-]?key|token|secret|password|passwd|sid)\s*[:=]\s*\S+/i.test(detail))
+        return 'fault detail carries a credential assignment';
+    if (/https?:\/\//i.test(detail))
+        return 'fault detail carries a URL';
+    return null;
+}