@danceiny/gotry 0.2.0-rc.27 → 0.2.0-rc.28

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@danceiny/gotry",
-  "version": "0.2.0-rc.27",
+  "version": "0.2.0-rc.28",
   "description": "GoTry — 从出发到下一次出发的 AI 旅行 Agent(dsh 插件)。npm/源码入口共用锁定的 dsh runtime + README 安装路径。",
   "type": "module",
   "main": "ts/src/index.ts",

package/ts/capabilities/anything.ts

@@ -19,6 +19,12 @@
  *   - miss: hbcli exit 0,但 candidates 为空(查无结果)
  *   - err:  hbcli exit ≠ 0 或超时(降级,降级产物 标 [实时API:hbcli-anything@error@ts])
  *
+ * 离线开关(issue #617;与会话通道 GOTRY_SESSION_LIVE 同形,方向相反以保持产品默认不变):
+ *   GOTRY_HBCLI_LIVE=0|false|off(不分大小写)→ 零 spawn、不碰凭据与后端,走同一条降级面
+ *   (verdict=error,证据标 [实时API:hbcli-anything@offline@ts]);未设或任何其他取值 = 与此前
+ *   完全一致(hbcli 可用即 live)。判定见 hbcliLiveEnabled;mock/dry-run harness(nightly-evidence --dry-run、
+ *   persona-sim、replay*)缺省把它置 0,operator 显式设置的值不覆盖。
+ *
  * 契约(与 hbcli/weather/opensky 同构,L4 不变量):
  *   - 永不抛错:网络/超时/解析失败一律降级返回;
  *   - 证据链标注:成功 [实时API:hbcli-anything@ts];失败 [实时API:hbcli-anything@error@ts];
@@ -157,6 +163,16 @@ function failureReason(
     : `hbcli 退出码 ${r.code},未返回可判定结果(本轮按降级处理)`) + suffix
 }
 
+/**
+ * 实时 hbcli 通道是否开启(issue #617)。只有显式写 0 / false / off(不分大小写,忽略首尾空白)
+ * 才关闭;未设或任何其他取值都视为开启——终端用户依赖的实时源缺省不丢。调用时读取,
+ * 测试与 harness 可在进程内切换。
+ */
+export function hbcliLiveEnabled(env: Partial<Pick<NodeJS.ProcessEnv, 'GOTRY_HBCLI_LIVE'>> = process.env): boolean {
+  const v = (env.GOTRY_HBCLI_LIVE ?? '').trim().toLowerCase()
+  return v !== '0' && v !== 'false' && v !== 'off'
+}
+
 /** Anything 通用搜索 — 任何搜索失败走降级;不抛错 */
 export async function anythingSearch(q: AnythingQuery): Promise<AnythingResult> {
   const started = Date.now()
@@ -180,6 +196,17 @@ export async function anythingSearch(q: AnythingQuery): Promise<AnythingResult>
       latencyMs: 0, verdict: 'error', error: 'aborted by host signal',
     }
   }
+  // 离线开关:位置在入参校验与 pre-abort 之后,既有入参的既有结果/原因串逐字节不变;
+  // 关闭时与「未装配 hbcli」同形降级(ok:false / hbcli-anything-error / verdict:error + 人话原因,
+  // 无进程噪音,也不含 timeout 字样——效应层只重试 timeout 类),且不 spawn、不重试。
+  if (!hbcliLiveEnabled()) {
+    return {
+      ok: false, via: 'hbcli-anything-error',
+      evidence: `[实时API:hbcli-anything@offline@${ts}] GOTRY_HBCLI_LIVE switched off; live channel closed, zero spawn`,
+      latencyMs: Date.now() - started, verdict: 'error',
+      error: 'hbcli 实时通道已关闭(GOTRY_HBCLI_LIVE 离线开关;本轮按降级处理,未发起查询)',
+    }
+  }
   let r: Awaited<ReturnType<typeof spawnBounded>> = { code: null, stdout: '', stderr: '', aborted: false, timedOut: false }
   for (let i = 0; i < candidates.length; i++) {
     r = await sh(candidates[i]!, args, { timeoutMs: q.timeoutMs ?? 12_000, env: process.env, signal: q.signal })

package/ts/scripts/state-cli.ts

@@ -4,6 +4,8 @@
  *   migrate [root]                      one-shot 迁移:旧 JSON/JSONL → 账本 events
  *                                       (导入前自动快照到 gotry-state/pre-ledger-backup/)
  *   export [root]                       local-only:账本 → 旧文件名视图(红线 6:可见可导出;单向,不回流)
+ *                                       另含会话双区派生视图(P4-2):hot-context.jsonl /
+ *                                       notebook.json,从事件 fold 渲染——视图永不是写路径
  *   log [root] [--limit N]              事件账本尾部(append-only 审计面)
  *   stats [root]                        各面计数
  *   rebuild [root] [toSeq]              DROP 投影 → fold 重放(可截到 toSeq;账本/投影
@@ -48,6 +50,11 @@
 import { mkdirSync, renameSync, writeFileSync } from 'node:fs'
 import { dirname, join } from 'node:path'
 import { ensureLedger, ledgerDbPath, ledgerExists, openLedgerIfExists } from '../src/state-ledger.ts'
+import {
+  ZONE_EXPORT_HOT_FILE,
+  ZONE_EXPORT_NOTEBOOK_FILE,
+  readZoneExportViews,
+} from '../src/session-zone-ledger.ts'
 import { formatRepairPlan, loadEvidenceMappingFile, planLedgerRepair } from '../src/ledger-repair-plan.ts'
 import {
   applyLedgerRepair,
@@ -405,6 +412,17 @@ switch (cmd) {
     if (utility.length) atomicWrite(join(dir, 'memory-utility.jsonl'), utility.map(e => JSON.stringify(e)).join('\n') + '\n')
     const trips = ledger.readTrips()
     if (trips.length) atomicWrite(join(dir, 'trips.jsonl'), trips.map(e => JSON.stringify(e)).join('\n') + '\n')
+    // 会话双区派生视图(P4-2,design/session-dual-zone-memory-design.md §2):
+    // 从六个事件 kind 的确定性 fold 渲染;空分区不产生空文件(同既有视图纪律)。
+    // 日志触读上界即拒:导出残缺视图比不导出更坏(读者会当它是全量)。
+    const zone = readZoneExportViews(ledger)
+    if (!zone.ok) {
+      console.error(`${zone.code}: ${zone.detail}`)
+      process.exit(1)
+    }
+    const zoneViews = zone.views
+    if (zoneViews.hotContextJsonl) atomicWrite(join(dir, ZONE_EXPORT_HOT_FILE), zoneViews.hotContextJsonl)
+    if (zoneViews.notebookJson !== '[]') atomicWrite(join(dir, ZONE_EXPORT_NOTEBOOK_FILE), zoneViews.notebookJson)
     console.log(`视图已导出(单向,DB→文件;红线 6):${dir}/`)
     break
   }

package/ts/src/contracts.ts

@@ -76,11 +76,15 @@ export interface TripState {
 // ---- 求解结果(unified 求解器输出的契约化引用) ----------------------------------
 
 export interface SolveResult {
+  /** `solver_error` 存在时,`feasible: false` 只表示「没有产出可行解」,
+   *  **不表示「不可行」**(issue #620):那一轮求解器自己失败了,判定缺席。 */
   feasible: boolean
   money_cny?: number
   legs?: Array<Record<string, unknown> & { leg: string }>
   red_flags?: string[]
   unsat_core?: string[]
+  /** 求解器自身失败(非判定)。机器 token 只住 `code`,不进用户面「冲突」文案。 */
+  solver_error?: { code: string; message: string }
   suggestions?: Array<{ relax: string; money_cny?: number }>
   work_window_exclusions?: Array<{ segment: string; option: string; reason: string }>
   skeleton_notes?: string[]

package/ts/src/dsh-llm.ts

@@ -1,7 +1,8 @@
 /**
  * 真 LlmPort:OpenAI 兼容接口的 provider 中立适配器(DeepSeek/MiniMax-M2 实测)。
  * 零新依赖(node 内建 fetch)。环境变量:LLM_API_KEY/LLM_BASE_URL/LLM_MODEL
- * (兼容旧 DEEPSEEK_* 别名)。MiniMax-M2 是推理模型:输出带 <think> 块,
+ * (兼容旧 DEEPSEEK_* 别名);GOTRY_LLM_TIMEOUT_MS = 单次请求总预算(默认 300000ms,
+ * 非正整数忽略)。MiniMax-M2 是推理模型:输出带 <think> 块,
  * 必须先剥离再解析——JSON 藏在 think 里是常见失败模式。
  * 无 key 时抛出明确错误,replay-real 自动回退 mock(ADR-8)。
  * 责任铁律不变:本适配器只做翻译/润色/解释,判定与算术在确定性组件。
@@ -37,11 +38,100 @@ function emptyUsage(): LlmUsageTracker {
   return { calls: 0, inputTokens: 0, outputTokens: 0, inputCacheHitTokens: 0, inputCacheMissTokens: 0, responsesMissingUsage: 0 }
 }
 
-async function chat(messages: Array<{ role: 'system' | 'user' | 'assistant'; content: string }>, json: boolean, usage?: LlmUsageTracker): Promise<string> {
+/** 单次请求(连接→响应头→正文读完)的默认总预算:对推理模型足够宽松,只兜「连上了却永不应答」的卡死。 */
+export const DEFAULT_LLM_TIMEOUT_MS = 300_000
+/**
+ * 超时上限 = 2^31-1 ms(≈24.8 天)。Node 对更大的延迟会溢出并**悄悄改成 1ms**
+ * (TimeoutOverflowWarning),即「配得越大越立刻超时」——所以必须夹住,绝不原样透传。
+ */
+const MAX_LLM_TIMEOUT_MS = 2_147_483_647
+
+/**
+ * chat() 的请求级选项。timeoutMs 压过环境变量 GOTRY_LLM_TIMEOUT_MS;signal 由调用方持有并与
+ * 超时合并(AbortSignal.any)——任一先触发就终止本次请求,落成 LlmRequestError。
+ */
+export interface LlmRequestOptions {
+  timeoutMs?: number
+  signal?: AbortSignal
+}
+
+/** 只认十进制正整数(数值或纯数字串);其余(0/负数/小数/NaN/带单位/空串)一律 undefined——绝不退化成「无超时」。 */
+function parseTimeoutMs(raw: unknown): number | undefined {
+  const n = typeof raw === 'string' ? (/^\d+$/.test(raw.trim()) ? Number(raw.trim()) : Number.NaN) : raw
+  return typeof n === 'number' && Number.isSafeInteger(n) && n > 0 ? Math.min(n, MAX_LLM_TIMEOUT_MS) : undefined
+}
+
+/** 解析顺序:本次调用显式值 > 环境变量 GOTRY_LLM_TIMEOUT_MS(调用时取值,同 base()/model())> 默认值。 */
+export function resolveLlmTimeoutMs(callMs?: number): number {
+  return parseTimeoutMs(callMs) ?? parseTimeoutMs(process.env['GOTRY_LLM_TIMEOUT_MS']) ?? DEFAULT_LLM_TIMEOUT_MS
+}
+
+export type LlmRequestFailureCode = 'timeout' | 'aborted'
+
+/**
+ * chat() 请求被截断(超时 / 调用方取消)的类型化失败——不是挂起,也不会被吞。
+ * 与既有错误形态一致,而非另起一套:
+ *  - message 沿用本模块 `llm <kind>: <detail>` 约定(同 `llm 429: …`),只读 .message 的调用方
+ *    (nightly-evidence / persona-sim / time-eval --real)原样可用;
+ *  - name 取平台既有名 TimeoutError / AbortError(AbortSignal.timeout 与手动 abort 抛的同名),
+ *    persona-sim、channel-probe 等按 name 分类的代码零改动即可识别;
+ *  - cause 保留 fetch 抛出的原始错误(调用方自定义的 abort reason 也在其中)。
+ * HTTP 非 2xx(`llm <status>`)、DNS/连接重置、坏 JSON 仍是原样的普通 Error——只改写「被我们的 signal 终止」的失败。
+ */
+export class LlmRequestError extends Error {
+  readonly code: LlmRequestFailureCode
+  /** 本次生效的超时预算;仅 code === 'timeout' 有值 */
+  readonly timeoutMs: number | undefined
+
+  constructor(code: LlmRequestFailureCode, detail: string, options: { cause?: unknown; timeoutMs?: number } = {}) {
+    super(`llm ${code}: ${detail}`, options.cause === undefined ? undefined : { cause: options.cause })
+    this.name = code === 'timeout' ? 'TimeoutError' : 'AbortError'
+    this.code = code
+    this.timeoutMs = options.timeoutMs
+  }
+}
+
+interface ChatCompletion {
+  choices: Array<{ message: { content: string } }>
+  usage?: { prompt_tokens?: number; completion_tokens?: number; prompt_cache_hit_tokens?: number; prompt_cache_miss_tokens?: number }
+}
+
+/**
+ * 发一次请求并读完正文。**同一个 signal 贯穿 fetch 与 res.json()/res.text()**,所以超时覆盖整个请求
+ * (含「响应头已到、正文卡住」与「非 2xx 的错误正文卡住」),调用方取消同理。
+ * 只有「被我们的 signal 终止」才改写成 LlmRequestError;其余错误原样上抛。
+ */
+async function requestCompletion(
+  url: string,
+  init: { headers: Record<string, string>; body: string },
+  request: LlmRequestOptions,
+): Promise<{ ok: true; data: ChatCompletion } | { ok: false; status: number; text: string }> {
+  const timeoutMs = resolveLlmTimeoutMs(request.timeoutMs)
+  const timeout = AbortSignal.timeout(timeoutMs)
+  const signal = request.signal ? AbortSignal.any([request.signal, timeout]) : timeout
+  try {
+    const res = await fetch(url, { method: 'POST', headers: init.headers, body: init.body, signal })
+    if (!res.ok) return { ok: false, status: res.status, text: await res.text() }
+    return { ok: true, data: await res.json() as ChatCompletion }
+  } catch (error) {
+    if (!signal.aborted) throw error
+    // AbortSignal.any 的 reason 是最先触发的那个源的 reason:等于超时信号的 reason 即超时先到,否则是调用方取消
+    if (timeout.aborted && signal.reason === timeout.reason) {
+      throw new LlmRequestError('timeout', `no complete response within ${timeoutMs}ms (GOTRY_LLM_TIMEOUT_MS)`, { cause: error, timeoutMs })
+    }
+    throw new LlmRequestError('aborted', "request cancelled by the caller's AbortSignal", { cause: error })
+  }
+}
+
+async function chat(
+  messages: Array<{ role: 'system' | 'user' | 'assistant'; content: string }>,
+  json: boolean,
+  usage?: LlmUsageTracker,
+  request: LlmRequestOptions = {},
+): Promise<string> {
   const key = process.env['LLM_API_KEY'] ?? process.env['DEEPSEEK_API_KEY']
   if (!key) throw new Error('LLM_API_KEY 未设置(兼容 DEEPSEEK_API_KEY 别名)——真 LLM 路径不可用,请回退 mock(ADR-8)')
-  const res = await fetch(`${base()}/chat/completions`, {
-    method: 'POST',
+  const reply = await requestCompletion(`${base()}/chat/completions`, {
     headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${key}` },
     body: JSON.stringify({
       model: model(),
@@ -49,9 +139,9 @@ async function chat(messages: Array<{ role: 'system' | 'user' | 'assistant'; con
       ...(json ? { response_format: { type: 'json_object' } } : {}),
       temperature: json ? 0 : 0.7,
     }),
-  })
-  if (!res.ok) throw new Error(`llm ${res.status}: ${(await res.text()).slice(0, 300)}`)
-  const data = await res.json() as { choices: Array<{ message: { content: string } }>; usage?: { prompt_tokens?: number; completion_tokens?: number; prompt_cache_hit_tokens?: number; prompt_cache_miss_tokens?: number } }
+  }, request)
+  if (!reply.ok) throw new Error(`llm ${reply.status}: ${reply.text.slice(0, 300)}`)
+  const data = reply.data
   if (usage) {
     usage.calls += 1
     const u = data.usage
@@ -94,7 +184,11 @@ const SKELETON_SYSTEM = `你是行程骨架抽取器。从对话中抽取行程
 规则:每个跨城移动一段;锚点只放用户明说或必然的(如"当天到"→arriveByMin 23:59=1439);时刻用当日分钟。
 scenario 判定:「洱海/大理/千岛湖/太湖+选目的地」→erhai(候选集);「普吉/workation/远程办公+多城链」→workation(五段链);「云南/大理丽江」→yunnan;不确定→generic。只输出 JSON。`
 
-export function createOpenAICompatLlm(flightPackPath?: string, clock: () => Date = () => new Date()): LlmPort & { usage: LlmUsageTracker } {
+/**
+ * request:本端口每次 chat() 共用的请求级选项(timeoutMs / signal)。signal 是端口级取消——
+ * 调用方可借它在会话/批次截止时真正掐断在途请求,而不是放着它继续挂在 provider 上。
+ */
+export function createOpenAICompatLlm(flightPackPath?: string, clock: () => Date = () => new Date(), request: LlmRequestOptions = {}): LlmPort & { usage: LlmUsageTracker } {
   const pack = flightPackPath
   const usage = emptyUsage()
   const historyText = (h: Turn[]) => h.map(t => `${t.role === 'user' ? '用户' : '助手'}: ${t.text}`).join('\n')
@@ -107,6 +201,7 @@ export function createOpenAICompatLlm(flightPackPath?: string, clock: () => Date
         [{ role: 'system', content: FACTS_SYSTEM }, { role: 'user', content: `${anchorContext()}\n\n${historyText(history)}` }],
         true,
         usage,
+        request,
       )
       const obj = parseJsonBlock(out)
       if (!obj) return { assumptions: [] }
@@ -122,6 +217,7 @@ export function createOpenAICompatLlm(flightPackPath?: string, clock: () => Date
         [{ role: 'system', content: SKELETON_SYSTEM }, { role: 'user', content: `${context}\n\n${historyText(history)}` }],
         true,
         usage,
+        request,
       )
       const skeleton = parseJsonBlock(out)
       if (!skeleton || !Array.isArray(skeleton['segments']) || (skeleton['segments'] as unknown[]).length === 0) return null
@@ -147,7 +243,11 @@ export function createOpenAICompatLlm(flightPackPath?: string, clock: () => Date
           return { segments: [], note: 'erhai-candidates', budgetCny: 3000 } as unknown as JourneySpecTS
         }
         packSpec = parseFlightPackToSpec(JSON.parse(await readFile(packPath, 'utf-8')))
-      } catch {
+      } catch (e) {
+        // issue #620:数据包被 parse 边界拒收时,原因必须留痕——否则用户只看到
+        // 「骨架还不完整」,运维看不到是哪个包的哪个字段把求解面挡住了。
+        const err = e as Error & { code?: string }
+        console.error(`[gotry] extractSpec: 数据包不可用 ${packPath}(${err.code ?? 'parse_failed'}):`, (err.message ?? '').slice(0, 200))
         return null
       }
       const anchorsById = new Map<string, Record<string, unknown>>(
@@ -167,6 +267,7 @@ export function createOpenAICompatLlm(flightPackPath?: string, clock: () => Date
         [{ role: 'system', content: buildSlotSystem(anchor) }, { role: 'user', content: historyText(history) }],
         true,
         usage,
+        request,
       )
       const obj = parseJsonBlock(out)
       if (!obj) return null
@@ -180,6 +281,7 @@ export function createOpenAICompatLlm(flightPackPath?: string, clock: () => Date
          { role: 'user', content: `【${q.key}】${q.text}(为什么问:${q.why})` }],
         false,
         usage,
+        request,
       )
       return out.trim() || `【${q.key}】${q.text}`
     },

package/ts/src/index.ts

@@ -27,7 +27,19 @@ import { interpretArgs, type GotryObservation } from './tool-packet.ts'
 import { projectUtility } from './memory-utility.ts'
 import { pickNudgeWish, type WishPoolEntry } from './wish-pool.ts'
 import { resolveTimelineDate } from './travel-timeline.ts'
-import { ensureLedger, readCompanionsWithFallback, readMotivationWithFallback, readTripsWithFallback, readWishPoolWithFallback } from './state-ledger.ts'
+import { ensureLedger, openLedgerIfExists, readCompanionsWithFallback, readMotivationWithFallback, readTripsWithFallback, readWishPoolWithFallback } from './state-ledger.ts'
+import {
+  applyZoneNote,
+  bindZoneSession,
+  boundZoneSession,
+  isZoneObservableTool,
+  observeToolResult,
+  promoteWithRouting,
+  renderSessionZoneBrief,
+  resolveZoneSwitch,
+  zoneScopeOfExec,
+  zoneSessionRefFromExec,
+} from './session-zone-wiring.ts'
 import { isValidHomeCityPreference, resolveDefaultOrigin, type MergedProfile, type ProfilePatch } from './memory-capture.ts'
 import { applyPlanningWindow } from './loop.ts'
 import { buildTimeAnchor, type PlanningWindow } from './time-anchor.ts'
@@ -105,6 +117,8 @@ export interface Config {
   hbcliBin: string
   /** 账号会话检索总闸(RFC 支柱④「用户明示授权+随时可关」):ask=gotry_session_search 每会话每站点首次调用弹审批卡、会话内记住(默认);allow=用户已在配置明示预授权(直接放行);off=总闸关闭,直接拒绝 */
   sessionAccess: string
+  /** 会话双区记忆总闸(issue #255 P4-3):off=默认(缺省/未知值同样 fail-closed 关),接线完全惰性(零账本事件/读回空串/工具不注册);on=创始人本地启用 */
+  sessionZones?: string
   /** Owner-local benchmark environment bridge config; empty disables the bridge. */
   benchmarkEnvironmentConfigPath?: string
   /** Trusted absolute path of the installed `lavish-axi@0.1.67` package; empty disables the local Lavish Editor product tools. */
@@ -116,6 +130,7 @@ export const Config: z<Config> = z.object({
   timeoutMs: z.number().default(30_000),
   hbcliBin: z.string().default('hbcli'),
   sessionAccess: z.string().default('ask'),
+  sessionZones: z.string().default('off'),
   benchmarkEnvironmentConfigPath: z.string().default(''),
   lavishAxiPackageRoot: z.string().default(''),
 })
@@ -533,8 +548,11 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
 
   // 时间感知:注册动态变量,persona 里用 {{current_date}} 引用。
   // 每次 assemble 时取系统时钟——LLM 始终知道「今天是几号」。
+  // provider 收到本次组装的 AssembleContext(dsh-system-prompt 契约:
+  // `variable(name, provider: (context: AssembleContext) => string | undefined)`);
+  // `scope` 是不透明、按身份比较的 ScopeKey —— 分区读回据此分辨会话。
   const sp = (ctx as unknown as Record<string, unknown>)['systemPrompt'] as {
-    variable?: (name: string, provider: () => string) => void
+    variable?: (name: string, provider: (context?: { scope?: object }) => string) => void
   } | undefined
   sp?.variable?.('current_date', () => {
     const d = new Date()
@@ -551,6 +569,33 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
   // 渲染成紧凑 brief 注入 persona;为空 = 首访。与当轮说法冲突时以用户为准。
   sp?.variable?.('motivation_brief', () => renderMotivationBrief(config.stateRoot ?? '.'))
 
+  // 会话双区记忆读回(issue #255 P4-3,design/session-dual-zone-memory-design.md §5):
+  // 变量恒注册(persona 侧可随时引用),但总闸 off(默认)时恒返回空串 —— 接线惰性,
+  // 不建库、不读库、零事件;persona 模板本身不在本 PR 改动,因此开关 off 时注入面
+  // 输出逐字节不变。空串 = 首访/无活笔记(与 motivation_brief 同纪律)。
+  // 会话双区读回(issue #255 P4-3):**只在总闸 on 时注册**。
+  //  - 为什么是条件注册:默认关必须与 main **不可区分**——注入面多出一个变量名
+  //    就已经是可观测差异(§48 benchmark-environment-bridge-tests 的
+  //    「normal product mode keeps its prompt variables」逐项断言会红)。
+  //    出厂 persona(cordis.gotry-patch.yml)今天不引用本变量,所以条件注册安全。
+  //  - **后续约束**:创始人一旦把 `{{session_zone_brief}}` 写进出厂 persona,
+  //    本变量必须改为**无条件注册**(关闸时返回空串)——strict 插值下未注册的
+  //    引用会让整段 persona 渲染失败。那一步同时要改 §48 的变量清单断言、
+  //    persona-surface-guard-tests 的注入面清单与 benchmark-environment-bridge-e2e
+  //    的 CANONICAL_RAW_VARIABLES。
+  //  - 读回按**组装 scope** 取会话身份(dsh agent-loop 以 agent 对象为 ScopeKey,
+  //    与工具侧 exec.agent 同一身份):同一宿主进程里的两个会话因此读不到对方的
+  //    resource 层笔记(设计 §1.1);取不到 scope → 不出 resource 段(fail-closed)。
+  const zoneSwitch = resolveZoneSwitch(config.sessionZones)
+  if (zoneSwitch === 'on') {
+    sp?.variable?.('session_zone_brief', assembleContext => renderSessionZoneBrief({
+      ledger: openLedgerIfExists(config.stateRoot ?? '.'),
+      now: new Date().toISOString(),
+      sessionRef: boundZoneSession(assembleContext?.scope),
+      zoneSwitch,
+    }))
+  }
+
   // 通道路由卡(通道注册表生成,docs/design/tool-orchestration-design.md §2.1/D-8):
   // persona 检索条款只留行为契约,机/火/酒通道顺位与额度口径查卡——prose 教义
   // 变查表教义,注册表加通道卡片自动一致。
@@ -631,6 +676,29 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
     if (typeof t.execute === 'function') {
       t.execute = guardToolExecute(String(t.name), config.stateRoot ?? '.', t.execute as (args: never, exec: unknown) => never)
     }
+    // 工具观察捕获缝(issue #255 P4-3):总闸 on 且工具在闭集白名单内才包裹——
+    // off(默认)时 execute 一层不多包,行为逐字节不变。捕获只投影形状字段
+    // (verdict/条数/价格带),证据只走指针;捕获失败永不影响工具返回值。
+    if (zoneSwitch === 'on' && typeof t.execute === 'function' && isZoneObservableTool(t.name)) {
+      const inner = t.execute as (args: never, exec: unknown) => Promise<unknown>
+      const toolName = String(t.name)
+      t.execute = async (args: never, exec: unknown): Promise<unknown> => {
+        const result = await inner(args, exec)
+        try {
+          const sessionRef = zoneSessionRefFromExec(exec)
+          if (sessionRef) {
+            bindZoneSession(zoneScopeOfExec(exec), sessionRef)
+            observeToolResult(openLedgerIfExists(config.stateRoot ?? '.') ?? ensureLedger(config.stateRoot ?? '.'), {
+              tool: toolName,
+              result,
+              session_ref: sessionRef,
+              ts: new Date().toISOString(),
+            })
+          }
+        } catch { /* 记忆面永不把产品主路径带红 */ }
+        return result
+      }
+    }
     ctx.tools.register(t as unknown as ReturnType<typeof defineTool>)
   }
 
@@ -1156,6 +1224,111 @@ export function apply(ctx: Context, config: Config, seams: ApplyTestSeams = {}):
     presentCall: args => ({ card: 'generic', title: '记录旅行', kind: 'edit', rawInput: args }),
   }))
 
+  // 会话双区记忆工具面(issue #255 P4-3):**只在总闸 on 时注册**——off(默认)时
+  // 工具清单逐项不变,模型看不到任何分区入口(接线惰性的第一道)。
+  if (zoneSwitch === 'on') {
+    registerGuarded(defineTool({
+      name: 'gotry_session_zone_note',
+      description:
+        'Session working-zone memory (hot context, issue #255): capture a STRUCTURED fragment of what is still in play this session '
+        + '(destination / date window / party size / budget stance = intent tier, 24h; search shapes = resource tier, 30min), '
+        + 'revise it with optimistic CAS when the user corrects a detail, or drop it when it stops being true. '
+        + 'Payload must be typed slot-spec-family fields — NEVER raw conversation text, IDs, phone numbers, URLs or credentials '
+        + '(the write gate rejects those shapes). Evidence is a pointer (session + observation index), never content. '
+        + 'action="propose" only PROPOSES moving a note into the durable notebook: it writes NOTHING; the owner must confirm in their own words, '
+        + 'after which you call gotry_session_zone_promote with that quote. The model may never self-promote. '
+        + 'action="deny" records that the owner declined to remember it long-term (writes nothing; stop re-proposing it this session).',
+      parameters: {
+        action: { type: 'string', required: true, enum: ['capture', 'revise', 'drop', 'propose', 'deny'], description: 'capture=新片段入工作区;revise=CAS 修订(需 noteId+expectedRev);drop=更正即弃;propose=提议晋升(零写入);deny=owner 否决提议(零写入)' },
+        tier: { type: 'string', enum: ['resource', 'intent'], description: 'capture 必填:intent(目的地/日期/人数/预算立场,24h)或 resource(检索形态,30min)' },
+        kind: { type: 'string', enum: ['availability', 'price_band', 'destination', 'date_window', 'party_size', 'budget_stance'], description: 'capture 必填;revise 可选(改 kind)' },
+        payload: { type: 'object', additionalProperties: true, description: '结构化片段,如 { city: "大理" } / { start: "2026-11-01", end: "2026-11-05" };禁放原文/证件/电话/URL/凭证' },
+        noteId: { type: 'string', description: 'revise/drop/propose 的目标笔记 id' },
+        expectedRev: { type: 'integer', description: 'revise 的父 rev(必须等于当前 rev,否则 stale_rev 拒绝)' },
+        promoteKind: { type: 'string', enum: ['trip_fact', 'preference', 'constraint', 'lesson'], description: 'propose 时提议的持久条目类别' },
+      },
+      output: {
+        schema: { type: 'json' },
+        render: (_args, value) => [{ type: 'text', text: String((value as { summary?: string }).summary ?? '') }],
+      },
+      async execute(args, exec: unknown) {
+        const sessionRef = zoneSessionRefFromExec(exec)
+        if (!sessionRef) {
+          return { ok: false, code: 'bad_session', summary: '无会话身份(exec.agent.session.id 缺失):分区不记忆无主体的片段' } as never
+        }
+        bindZoneSession(zoneScopeOfExec(exec), sessionRef)
+        const r = applyZoneNote(ensureLedger(config.stateRoot), {
+          action: args.action as never,
+          ...(args.tier !== undefined ? { tier: args.tier } : {}),
+          ...(args.kind !== undefined ? { kind: args.kind } : {}),
+          ...(args.payload !== undefined ? { payload: args.payload as Record<string, unknown> } : {}),
+          ...(args.noteId !== undefined ? { noteId: args.noteId } : {}),
+          ...(args.expectedRev !== undefined ? { expectedRev: args.expectedRev } : {}),
+          ...(args.promoteKind !== undefined ? { promoteKind: args.promoteKind } : {}),
+          session_ref: sessionRef,
+          ts: new Date().toISOString(),
+        })
+        if (!r.ok) return { ok: false, code: r.code, summary: r.detail } as never
+        const summary = r.proposed
+          ? `已提议(未写入):${r.ask ?? ''}`
+          : `${r.action}${r.appended ? ' 已落账' : ' 幂等跳过'}${r.noteId ? `:${r.noteId.slice(0, 60)}` : ''}`
+        return { ok: true, action: r.action, appended: r.appended, note_id: r.noteId, requires_owner_confirm: r.requiresOwnerConfirm === true, summary } as never
+      },
+      presentCall: args => ({ card: 'generic', title: `会话记忆:${String(args.action ?? '')}`, kind: 'edit', rawInput: args }),
+    }))
+
+    registerGuarded(defineTool({
+      name: 'gotry_session_zone_promote',
+      description:
+        'Owner-confirmed promotion into the durable trip notebook (issue #255) — the ONLY write path into durable memory. '
+        + 'Requires ownerQuote: the user\'s OWN words confirming they want this remembered long-term; your own summary is not a confirmation. '
+        + 'Routing rule: a preference ALSO goes through the motivation-profile gate (pass motivation.{weights|hard|homeCity}), '
+        + 'a trip fact through the timeline gate (pass trip.{destination,start}), a companion constraint through the companion gate (pass companion.{label,constraints}). '
+        + 'Without the required routed payload the promotion is REJECTED — the notebook never becomes a parallel store for a fact that already has an owner. '
+        + 'Generic constraints and lessons live in the notebook itself. The notebook write and the routed gate write are one transaction: they cannot diverge.',
+      parameters: {
+        noteId: { type: 'string', required: true, description: '源工作区笔记 id(必须未过期)' },
+        kind: { type: 'string', required: true, enum: ['trip_fact', 'preference', 'constraint', 'lesson'], description: '持久条目类别' },
+        ownerQuote: { type: 'string', required: true, description: '用户本人确认要长期记住的原话(≤200 字;模型自述不算确认)' },
+        surface: { type: 'string', required: true, enum: ['user_reply', 'approval_card'], description: '确认表面:用户回复 或 审批卡' },
+        payload: { type: 'object', additionalProperties: true, description: '可选:覆盖源笔记载荷的结构化断言' },
+        motivation: { type: 'object', additionalProperties: true, description: 'preference 必填:{ weights?, hard?, homeCity? } 至少一项(经动机画像闸)' },
+        trip: { type: 'object', additionalProperties: true, description: 'trip_fact 必填:{ destination, start(YYYY-MM-DD), end?, companions? }(经时间线闸)' },
+        companion: { type: 'object', additionalProperties: true, description: '同行人约束必填:{ label, constraints:{ mobility?, health?, prefs? } }(经同行人闸)' },
+      },
+      output: {
+        schema: { type: 'json' },
+        render: (_args, value) => [{ type: 'text', text: String((value as { summary?: string }).summary ?? '') }],
+      },
+      async execute(args, exec: unknown) {
+        const sessionRef = zoneSessionRefFromExec(exec)
+        if (sessionRef) bindZoneSession(zoneScopeOfExec(exec), sessionRef)
+        const r = promoteWithRouting(ensureLedger(config.stateRoot), {
+          noteId: String(args.noteId ?? ''),
+          kind: String(args.kind ?? ''),
+          ownerQuote: String(args.ownerQuote ?? ''),
+          surface: String(args.surface ?? ''),
+          ...(args.payload !== undefined ? { payload: args.payload as Record<string, unknown> } : {}),
+          ...(args.motivation !== undefined ? { motivation: args.motivation as never } : {}),
+          ...(args.trip !== undefined ? { trip: args.trip as never } : {}),
+          ...(args.companion !== undefined ? { companion: args.companion as never } : {}),
+          ts: new Date().toISOString(),
+        })
+        if (!r.ok) return { ok: false, code: r.code, summary: r.detail } as never
+        const routed = r.routed ? `;并经 ${r.routed.authority} 闸${r.routed.applied ? '落地' : '幂等跳过'}` : ''
+        return {
+          ok: true,
+          appended: r.appended,
+          entry_id: r.entryId,
+          authority: r.authority,
+          routed: r.routed ? JSON.parse(JSON.stringify(r.routed)) as JsonObject : null,
+          summary: `${r.appended ? '已写入笔记本' : '笔记本幂等跳过'}${routed}`,
+        } as never
+      },
+      presentCall: args => ({ card: 'generic', title: '笔记本晋升(owner 确认)', kind: 'edit', rawInput: args }),
+    }))
+  }
+
   registerGuarded(defineTool({
     name: 'gotry_hotel_search',
     description: routed('gotry_hotel_search',

package/ts/src/loop.ts

@@ -238,13 +238,18 @@ function terminalOutcomeFromState(ticketId: string, state: TripState): AsyncTerm
     })
   }
 
+  // issue #620:求解器自身失败时既没有产物也没有判定——2 条不成立;但「做不到诚实说」
+  // 恰恰成立(我们明说了是引擎故障而非不可行),不靠 unsat_core 冒充自检通过。
+  const solverFailed = Boolean(state.solve.solver_error)
   return asyncTerminalOutcome(ticketId, {
     '1_承诺时间后必有明确产物': Boolean(state.solve.legs?.length || state.solve.verdicts?.length),
-    '2_产物通过自检清单': state.solve.feasible
-      ? (state.solve.legs?.every(l => (l as Record<string, unknown>)['energy_pct'] !== undefined) ?? false)
-      : Boolean(state.solve.unsat_core?.length),
+    '2_产物通过自检清单': solverFailed
+      ? false
+      : state.solve.feasible
+        ? (state.solve.legs?.every(l => (l as Record<string, unknown>)['energy_pct'] !== undefined) ?? false)
+        : Boolean(state.solve.unsat_core?.length),
     '3_待决问题全部是简单选择题': state.gates.every(g => g.id === 'budget' || g.options.length >= 2),
-    '4_做不到的诚实说': state.solve.feasible || Boolean(state.solve.suggestions?.length),
+    '4_做不到的诚实说': solverFailed || state.solve.feasible || Boolean(state.solve.suggestions?.length),
   })
 }
 
@@ -292,7 +297,12 @@ export function renderSolve(state: TripState): string {
   const s = state.solve
   if (!s) return '(无求解结果)'
   const lines: string[] = []
-  if (s.feasible) {
+  if (s.solver_error) {
+    // issue #620:求解器自己失败 ≠ 行程不可行。这里**不**说「不可行」、不列「冲突」,
+    // 也不把机器 token(solver_error.code)渲染给用户——它只在日志/证据里。
+    lines.push('**这轮没算出结论——求解器自身出错了,不是你的行程不可行**')
+    lines.push('- 我不把引擎故障说成「不可行」:这条已记录,修好或换候选形态(枚举)后重算')
+  } else if (s.feasible) {
     lines.push(`**方案可行,机票合计 ¥${s.money_cny}**`)
     // §7-1 issue #559 卡点 4:从 s.skeleton_notes 字符串编码里推断 unscaffolded 的 seg.id,
     // 不动 unified.ts/journey.ts(内核冻结面 #234),用户面给 ⚠ 前缀与「枢纽对未在骨架覆盖」补充。