@danceiny/gotry 0.2.0-rc.27 → 0.2.0-rc.28

package/dist/scripts/anything-tests.js

@@ -10,15 +10,25 @@
  *  6. 超时:fake hbcli hang — AbortError → verdict error + 不抛错
  *  7. 关键词为空:不调 hbcli — verdict error
  *  8. 缺 hbcli(spawn 失败):用户面是人话(不留 `(exit null)`/ENOENT 进程噪音)
+ *  9. 离线开关 GOTRY_HBCLI_LIVE=0|false|off(issue #617):计数 fake hbcli **零次**被调起,
+ *     返回既有降级面(与缺 hbcli 同形:ok:false / hbcli-anything-error / verdict:error + 人话原因);
+ *     含 PATH 解析的真实调用面(runTurn 的 PoI 探针不传 hbcliBin)
+ * 10. 开关未设或任何其他取值:行为与此前完全一致——fake 被调起,hit/miss/error 三值语义不变
+ * 11. 既有入参的既有结果在开关关闭时逐字节不变:空 keyword / pre-aborted 先于离线判定
+ *
+ * 本套件独占 GOTRY_HBCLI_LIVE:开头清掉外部值(`GOTRY_HBCLI_LIVE=0 ./scripts/run-all-tests.sh` 也不得改变 fake 断言),
+ * 结束还原。
  *
  * 运行: cd ts && npx tsx scripts/anything-tests.ts
  */
 import assert from 'node:assert/strict';
-import { mkdtemp, rm, writeFile } from 'node:fs/promises';
+import { mkdir, mkdtemp, readFile, rm, writeFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { join } from 'node:path';
 import { anythingSearch } from '../capabilities/anything.js';
 const tmp = await mkdtemp(join(tmpdir(), 'anything-test-'));
+const savedLive = process.env.GOTRY_HBCLI_LIVE;
+delete process.env.GOTRY_HBCLI_LIVE;
 try {
     async function fakeBin(name, behaviour) {
         const p = join(tmp, name);
@@ -144,8 +154,132 @@ while :; do sleep 5; done
     assert.ok(/hbcli/.test(r8.error), `原因须指明是 hbcli,实得:${r8.error}`);
     assert.ok(r8.evidence.includes('[实时API:hbcli-anything@error@'), '证据链 tag 形态不变');
     console.log(`8. 缺 hbcli → 人话降级 OK(${r8.error})`);
-    console.log('\nANYTHING TESTS: 8/8 OK(hbcli fake + wire 对齐 + 降级诚实)');
+    // ---- 9-11. 离线开关 GOTRY_HBCLI_LIVE(issue #617) -------------------------------------------
+    // 计数 fake:每被调起一次就往 calls.log 追加一行(只用 shell 内建,PATH 为空也能跑),再按 kind 回包。
+    const callsLog = join(tmp, 'calls.log');
+    const invocations = async () => {
+        try {
+            return (await readFile(callsLog, 'utf8')).split('\n').filter(Boolean).length;
+        }
+        catch {
+            return 0;
+        }
+    };
+    async function countedBin(name, kind, dir = tmp) {
+        const p = join(dir, name);
+        const reply = kind === 'hit'
+            ? `printf '%s' '{"candidates":[{"type":"city","matchScore":9,"region":{"id":"d1","name":{"zh":"大理市"}}}]}'`
+            : kind === 'miss'
+                ? `printf '%s' '{"candidates":[]}'`
+                : `printf 'hotelbe down\\n' >&2\nexit 1`;
+        await writeFile(p, `#!/bin/sh\nprintf 'call\\n' >> '${callsLog}'\n${reply}\n`, { mode: 0o755 });
+        return p;
+    }
+    async function withLive(value, body) {
+        const prev = process.env.GOTRY_HBCLI_LIVE;
+        if (value === undefined)
+            delete process.env.GOTRY_HBCLI_LIVE;
+        else
+            process.env.GOTRY_HBCLI_LIVE = value;
+        try {
+            return await body();
+        }
+        finally {
+            if (prev === undefined)
+                delete process.env.GOTRY_HBCLI_LIVE;
+            else
+                process.env.GOTRY_HBCLI_LIVE = prev;
+        }
+    }
+    const countedHit = await countedBin('hbcli-counted-hit', 'hit');
+    const countedMiss = await countedBin('hbcli-counted-miss', 'miss');
+    const countedFail = await countedBin('hbcli-counted-fail', 'fail');
+    // 9. 关闭:0/false/off(不分大小写、忽略首尾空白)→ 零 spawn + 既有降级面
+    for (const off of ['0', 'false', 'off', 'OFF', 'False', ' 0 ', ' off\n']) {
+        const before = await invocations();
+        const r9 = await withLive(off, () => anythingSearch({ keyword: '大理', hbcliBin: countedHit }));
+        assert.equal(await invocations(), before, `GOTRY_HBCLI_LIVE=${JSON.stringify(off)}:fake hbcli 必须被调起 0 次`);
+        assert.equal(r9.ok, false);
+        assert.equal(r9.via, 'hbcli-anything-error');
+        assert.equal(r9.verdict, 'error', '「没查」不得说成「查无」:走 error 降级面而非 miss');
+        assert.equal(r9.hits, undefined);
+        assert.deepEqual(Object.keys(r9).sort(), Object.keys(r8).sort(), '与缺 hbcli 降级同形(同一组字段)');
+        assert.match(r9.evidence, /^\[实时API:hbcli-anything@offline@[^\]]+\]/, `证据链应标 offline,实得:${r9.evidence}`);
+        assert.ok(r9.error && /hbcli/.test(r9.error) && /GOTRY_HBCLI_LIVE/.test(r9.error), `原因须说明 hbcli 通道被开关关闭,实得:${r9.error}`);
+        assert.ok(!/(exit null|ENOENT|spawn |timeout)/i.test(r9.error), `用户面不得出现进程噪音(也不得含 timeout:效应层只重试 timeout 类),实得:${r9.error}`);
+    }
+    // 9b. 真实调用面:不传 hbcliBin('hbcli' 由 PATH 解析,runTurn 的 PoI 探针即如此)。
+    //     未设开关的 positive control 证明 fake 确实可达——否则「零次」可能是空断言。
+    const pathBin = join(tmp, 'pathbin');
+    await mkdir(pathBin);
+    await countedBin('hbcli', 'hit', pathBin);
+    const savedPath = process.env.PATH;
+    const savedHome = process.env.HOME;
+    process.env.PATH = `${pathBin}:${savedPath ?? ''}`;
+    process.env.HOME = join(tmp, 'empty-home'); // 已知安装位回退落在空目录,碰不到开发机真实 hbcli
+    try {
+        const base = await invocations();
+        const control = await withLive(undefined, () => anythingSearch({ keyword: '大理' }));
+        assert.equal(control.verdict, 'hit', `positive control:未设开关时 PATH 上的 fake 应被调起,实得:${control.evidence}`);
+        assert.equal(await invocations(), base + 1, 'positive control 恰好调起一次');
+        const off = await withLive('0', () => anythingSearch({ keyword: '大理' }));
+        assert.equal(off.verdict, 'error');
+        assert.match(off.evidence, /@offline@/);
+        assert.equal(await invocations(), base + 1, 'GOTRY_HBCLI_LIVE=0:PATH 上的 hbcli 零次调起');
+    }
+    finally {
+        if (savedPath === undefined)
+            delete process.env.PATH;
+        else
+            process.env.PATH = savedPath;
+        if (savedHome === undefined)
+            delete process.env.HOME;
+        else
+            process.env.HOME = savedHome;
+    }
+    console.log('9. GOTRY_HBCLI_LIVE=0|false|off → 零 spawn + 既有降级面(显式 hbcliBin 与 PATH 解析两种调用面)OK');
+    // 10. 未设或任何其他取值 = 与此前完全一致:fake 被调起,hit/miss/error 三值语义不变
+    for (const on of [undefined, '1']) {
+        const before = await invocations();
+        const h = await withLive(on, () => anythingSearch({ keyword: '大理', hbcliBin: countedHit }));
+        const m = await withLive(on, () => anythingSearch({ keyword: 'nothing', hbcliBin: countedMiss }));
+        const f = await withLive(on, () => anythingSearch({ keyword: 'x', hbcliBin: countedFail }));
+        assert.equal(await invocations(), before + 3, `GOTRY_HBCLI_LIVE=${String(on)}:三只 fake 各被调起一次`);
+        assert.equal(h.verdict, 'hit');
+        assert.equal(h.hits[0].name, '大理市');
+        assert.match(h.evidence, /^\[实时API:hbcli-anything@\d{4}-/, 'hit 证据链形态不变');
+        assert.equal(m.verdict, 'miss');
+        assert.equal(m.hits.length, 0);
+        assert.equal(f.verdict, 'error');
+        assert.match(f.evidence, /^\[实时API:hbcli-anything@error@/, 'error 证据链形态不变(不是 offline)');
+        assert.equal(f.error, 'hbcli 报错:hotelbe down', '既有原因串逐字节不变');
+    }
+    // 非 0/false/off 的取值一律视为开启(与此前一致):空串/1/true/on/yes/no/disabled/00/任意字符串
+    for (const other of ['', 'true', 'on', 'yes', 'no', 'disabled', '00', 'maybe']) {
+        const before = await invocations();
+        const r = await withLive(other, () => anythingSearch({ keyword: '大理', hbcliBin: countedHit }));
+        assert.equal(r.verdict, 'hit', `GOTRY_HBCLI_LIVE=${JSON.stringify(other)} 不是关闭值,应保持 live,实得:${r.evidence}`);
+        assert.equal(await invocations(), before + 1);
+    }
+    console.log('10. 开关未设/其他取值 → 与此前一致(hit/miss/error 三值 + 既有原因串)OK');
+    // 11. 关闭时,既有入参的既有结果逐字节不变:空 keyword / pre-aborted 先于离线判定(两者本就零 spawn)
+    const before11 = await invocations();
+    const rEmpty = await withLive('0', () => anythingSearch({ keyword: '   ', hbcliBin: countedHit }));
+    assert.equal(rEmpty.error, 'keyword is required');
+    assert.match(rEmpty.evidence, /^\[实时API:hbcli-anything@error@[^\]]+\] keyword empty$/);
+    const preAborted = new AbortController();
+    preAborted.abort();
+    const rAbort = await withLive('0', () => anythingSearch({ keyword: '大理', hbcliBin: countedHit, signal: preAborted.signal }));
+    assert.equal(rAbort.error, 'aborted by host signal');
+    assert.match(rAbort.evidence, /^\[实时API:hbcli-anything@abort@[^\]]+\] pre-aborted, zero spawn$/);
+    assert.equal(await invocations(), before11, '两条既有降级路径均零 spawn');
+    console.log('11. 关闭态下空 keyword / pre-aborted 的既有结果不变 OK');
+    console.log('\nANYTHING TESTS: 11/11 OK(hbcli fake + wire 对齐 + 降级诚实 + #617 离线开关零 spawn)');
 }
 finally {
+    if (savedLive === undefined)
+        delete process.env.GOTRY_HBCLI_LIVE;
+    else
+        process.env.GOTRY_HBCLI_LIVE = savedLive;
     await rm(tmp, { recursive: true, force: true });
 }

package/dist/scripts/booking-copilot-dsh-warmer-proof.js

@@ -15,9 +15,12 @@ mkdirSync(markerDir, { recursive: true });
 const actualBin = pathToFileURL(join(dirname(fileURLToPath(import.meta.resolve('@deepseek-ai/dsh/package.json'))), 'lib/bin.js')).href;
 const gateBin = join(root, 'blocked-dsh.mjs');
 writeFileSync(gateBin, `
-import { existsSync, writeFileSync } from 'node:fs'
+import { existsSync, renameSync, writeFileSync } from 'node:fs'
 const marker = ${JSON.stringify(markerDir)} + '/gate-' + process.pid + '.json'
-writeFileSync(marker, JSON.stringify({ pid: process.pid, workerPid: process.ppid }))
+// Atomic publish: the proof parses each marker the moment the directory lists it, so a marker must never be visible half-written (writeFileSync creates the empty file first).
+const staging = ${JSON.stringify(root)} + '/gate-' + process.pid + '.staging'
+writeFileSync(staging, JSON.stringify({ pid: process.pid, workerPid: process.ppid }))
+renameSync(staging, marker)
 while (!existsSync(${JSON.stringify(releaseFile)})) await new Promise((resolve) => setTimeout(resolve, 10))
 const { runCli } = await import(${JSON.stringify(actualBin)})
 await runCli()

package/dist/scripts/bootstrap-tests.js

@@ -10,6 +10,7 @@
  *  4. GOTRY_SETUP_EXTENSION=0 单项跳过
  *  5. wizard --dry-run 与真实路径(probe 失败 exit 1)
  *  8. doctor 子命令:体检清单/LLM key 让渡/报告落盘(状态面回归)
+ * 24. hbcli 凭证判定(#623):CLI doctor 按 whoami 三档 JSON 判而非退出码,并与工具层 doctor 对拍同结论
  *
  * 不测真实安装(浏览器商店一键装已上架,扩展就位检测走 runHealthWatch 的回环端口)。
  * 运行: cd ts && npx tsx scripts/bootstrap-tests.ts
@@ -20,6 +21,7 @@ import { EventEmitter } from 'node:events';
 import { chmodSync, copyFileSync, existsSync, mkdirSync, mkdtempSync, readdirSync, readFileSync, rmSync, symlinkSync, writeFileSync } from 'node:fs';
 import { tmpdir } from 'node:os';
 import { join, dirname, delimiter } from 'node:path';
+import { runDoctorChecks } from '../capabilities/doctor.js';
 const repoRoot = join(import.meta.dirname, '..', '..');
 const bootstrap = join(repoRoot, 'bin', 'gotry-bootstrap.js');
 function runBootstrap(extraArgs, extraEnv, bootstrapPath = bootstrap) {
@@ -1476,4 +1478,72 @@ console.log('22. win32 platform boundary(hbcli/reach/sidebar → unavailable +
     }
 }
 console.log('23. result 通道排他写入(预存文件不被覆盖 + symlink 不跟随 victim,mode 0600 + flag wx)OK');
-console.log('BOOTSTRAP TESTS: 25/25 OK(扩展就位 + 跳过开关 / wizard --dry-run / wizard 真实 / 扩展分发通道 / doctor 体检面 / calendar setup 状态面 / 显式跳过 + auto 跳过 + 单项跳过 / 启动摘要 / sidebar 落盘状态复核 / onboarding 分类+计划+env opt-out+跳过原因+yes+partial-failure+幂等+prompt+CLI 跳过+--scan / 编排缝 orchestrateWebLaunch × 6 / prompt waiter failure deterministic process-group reap / waiter 原始错误 + cleanup timeout/failure handled / 临时安装包 spawned inner 21a TTY-eligible 真实 prompt→n→web + 摘要抑制 + 无残留 / 21b non-TTY 零 prompt / 21c POSIX 信号清理 SIGTERM→清 result+patch 目录 + 无残留子进程 / 21f yes-path installer 子树信号清理 / 21g yes-path timeout installer 子树清理 / 21d timeout 诊断 + 无残留 / 21e dsh-lifecycle 信号转发 / win32 平台边界 / result 通道排他写入)');
+// 24. hbcli 凭证判定(#623):`gotry doctor` 的 CLI 面按 `hbcli --json auth whoami` 的三档 JSON 判,不看退出码——
+//     whoami 没有凭证时也退 0,旧判法对「没登录」恒报「凭证有效」(rc.27 已发布版实测 14/14)。
+//     CLI(bin/gotry-bootstrap.js)与工具层(ts/capabilities/doctor.ts)是同一检查的两份实现,
+//     故同一份假 hbcli 夹具同时喂两边对拍:结论必须一致(漂移即红)。受控 PATH 只含 node 软链 + 假 hbcli,
+//     隔离 HOME,不碰真机 hbcli(开发机常把真 hbcli 装在 node 同目录)。
+{
+    const { classifyHbcliWhoami } = await import(bootstrap);
+    const allFalse = '{"env":"uat","api_key":{"configured":false},"portal":{"configured":false},"customer":{"configured":false}}';
+    const unit = (out) => classifyHbcliWhoami(out);
+    assert.deepEqual(unit(allFalse), { ok: false, customer: false }, '三档全 false → 未配置');
+    assert.deepEqual(unit(allFalse.replace('"customer":{"configured":false}', '"customer":{"configured":true}')), { ok: true, customer: true }, 'customer 档 → 有效且标注 customer');
+    assert.deepEqual(unit(allFalse.replace('"api_key":{"configured":false}', '"api_key":{"configured":true}')), { ok: true, customer: false }, 'api_key 档 → 有效');
+    assert.deepEqual(unit('not json'), { ok: true, customer: false }, '非 JSON(超旧版/异常)保守视为有效,与工具层同语义');
+    assert.deepEqual(unit(''), { ok: true, customer: false }, '空输出同属不可解析,保守视为有效');
+    assert.deepEqual(unit(null), { ok: false, customer: false }, '取不到输出(非零退出/超时/spawn 失败)→ 未确认');
+    const fakeHbcli = (whoamiArm) => `#!/bin/sh\ncase "$*" in\n  *--version*) echo '0.0.4';;\n  *version*) echo '0.0.4';;\n  *whoami*) ${whoamiArm};;\nesac\n`;
+    const cases = [
+        { name: 'allfalse', arm: `echo '${allFalse}'`, expect: 'degraded' },
+        { name: 'customer', arm: `echo '${allFalse.replace('"customer":{"configured":false}', '"customer":{"configured":true}')}'`, expect: 'ok', customer: true },
+        { name: 'apikey', arm: `echo '${allFalse.replace('"api_key":{"configured":false}', '"api_key":{"configured":true}')}'`, expect: 'ok' },
+        { name: 'plaintext', arm: `echo 'not json'`, expect: 'ok' },
+        { name: 'failing', arm: `echo boom >&2; exit 3`, expect: 'degraded' },
+    ];
+    const emptyRepo = mkdtempSync(join(tmpdir(), 'gotry-hbcli-parity-repo-'));
+    const prevPath = process.env.PATH;
+    try {
+        for (const c of cases) {
+            const root = mkdtempSync(join(tmpdir(), `gotry-hbcli-${c.name}-`));
+            try {
+                const binDir = join(root, 'bin');
+                const home = join(root, 'home');
+                mkdirSync(binDir);
+                mkdirSync(home);
+                symlinkSync(process.execPath, join(binDir, 'node'));
+                writeFileSync(join(binDir, 'hbcli'), fakeHbcli(c.arm), { mode: 0o755 });
+                // CLI 面
+                const cli = runBootstrap(['doctor'], { HOME: home, PATH: binDir, FLYAI_API_KEY: '' });
+                const line = cli.out.split('\n').find((l) => l.includes('hbcli(酒店实时源)'));
+                assert.ok(line, `${c.name}: CLI doctor 应输出 hbcli 行\n${cli.out}`);
+                const cliLevel = line.includes('已安装且凭证有效') ? 'ok' : line.includes('二进制在,但凭证未配置/失效') ? 'degraded' : 'other';
+                assert.equal(cliLevel, c.expect, `${c.name}: CLI doctor 的 hbcli 结论应为 ${c.expect}\n${line}`);
+                if (c.customer)
+                    assert.ok(line.includes('customer 档在用'), `${c.name}: CLI 应标注 customer 档在用\n${line}`);
+                // 工具层(同一夹具、同一受控 PATH)
+                process.env.PATH = binDir;
+                const tool = (await runDoctorChecks({ repoRoot: emptyRepo, homeDir: home, env: {} })).items.find((i) => i.id === 'hbcli');
+                process.env.PATH = prevPath;
+                assert.equal(tool.status, c.expect, `${c.name}: 工具层 doctor 的 hbcli 结论应为 ${c.expect},实际 ${tool.status}`);
+                assert.equal(cliLevel, tool.status, `${c.name}: CLI 与工具层必须同结论(两份实现不得漂移)`);
+            }
+            finally {
+                process.env.PATH = prevPath;
+                try {
+                    rmSync(root, { recursive: true, force: true });
+                }
+                catch { /* ignore */ }
+            }
+        }
+    }
+    finally {
+        process.env.PATH = prevPath;
+        try {
+            rmSync(emptyRepo, { recursive: true, force: true });
+        }
+        catch { /* ignore */ }
+    }
+}
+console.log('24. hbcli 凭证判定(CLI doctor 按 whoami 三档 JSON 判,不看退出码;与工具层 doctor 对拍 5 夹具同结论:全 false=degraded / customer·api_key=ok / 非 JSON=保守 ok / 非零退出=degraded)OK');
+console.log('BOOTSTRAP TESTS: 26/26 OK(扩展就位 + 跳过开关 / wizard --dry-run / wizard 真实 / 扩展分发通道 / doctor 体检面 / calendar setup 状态面 / 显式跳过 + auto 跳过 + 单项跳过 / 启动摘要 / sidebar 落盘状态复核 / onboarding 分类+计划+env opt-out+跳过原因+yes+partial-failure+幂等+prompt+CLI 跳过+--scan / 编排缝 orchestrateWebLaunch × 6 / prompt waiter failure deterministic process-group reap / waiter 原始错误 + cleanup timeout/failure handled / 临时安装包 spawned inner 21a TTY-eligible 真实 prompt→n→web + 摘要抑制 + 无残留 / 21b non-TTY 零 prompt / 21c POSIX 信号清理 SIGTERM→清 result+patch 目录 + 无残留子进程 / 21f yes-path installer 子树信号清理 / 21g yes-path timeout installer 子树清理 / 21d timeout 诊断 + 无残留 / 21e dsh-lifecycle 信号转发 / win32 平台边界 / result 通道排他写入 / hbcli 凭证判定 CLI↔工具层对拍)');

package/dist/scripts/city-scenario-tier-tests.js

@@ -0,0 +1,234 @@
+/**
+ * City × scenario tiering MECHANISM tests (issue #339 contract slice,
+ * SIMULATED-TRIGGER DRILL — fully offline, zero network, zero state).
+ *
+ * ⚠ Evidence label: `simulated_trigger_drill` / `fixture_contract`. #339's real
+ * trigger (reviewable real usage samples + an explicit scenario vocabulary and
+ * success metric) has NOT fired. Every registry used below is a TEST-ONLY shape
+ * probe constructed with `{ triggerFired: true }`; its city/scenario strings are
+ * deliberately meaningless placeholders (`city-a`, `scenario-x`) so that nothing
+ * here can be mistaken for a taxonomy. The product registry stays frozen EMPTY —
+ * #339 forbids fabricating a profile from fixtures.
+ *
+ * Sections:
+ *  A. Default-off proof: trigger frozen false, registry frozen empty in SOURCE,
+ *     admission refused before any validation, every resolution neutral.
+ *  B. Admission shape: mandatory provenance (evidence grade / real sample source /
+ *     ≥3 sample refs / reviewer / freeze instant) and retirement (condition +
+ *     review deadline postdating the freeze); each omission fail-closed.
+ *  C. Bounded modifier: integer ppm inside declared bounds; 0, negative,
+ *     out-of-range, float and non-numeric refused — no tier can annihilate a score.
+ *  D. Neutral fallback: unknown city, unknown scenario, conflicting evidence,
+ *     empty registry; a conflict elects no winner.
+ *  E. Ranking-only falsification: a modifier reorders but can NEVER remove a
+ *     candidate (incl. lower bound × zero semantic), the result exposes no filter
+ *     surface, and the mechanical no-hard-filter check passes.
+ *  F. Determinism + versioning: identical inputs → byte-identical output; ties keep
+ *     declaration order; a defective registry entry is refused, never clamped.
+ *
+ * Run (from ts/): npx tsx scripts/city-scenario-tier-tests.ts
+ */
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import { CITY_SCENARIO_TIER_REGISTRY, CITY_SCENARIO_TIER_SCHEMA, CITY_SCENARIO_TIER_TRIGGER_FIRED, TIER_APPLICATION_SURFACES, TIER_EVIDENCE_GRADES, TIER_KEY_MAX_CHARS, TIER_MIN_SAMPLE_REFS, TIER_MODIFIER_PPM_MAX, TIER_MODIFIER_PPM_MIN, TIER_MODIFIER_PPM_NEUTRAL, TIER_NEUTRAL_REASONS, TIER_SAMPLE_SOURCES, admitTierEntry, applyTierRanking, normalizeTierKey, resolveTier, tierRankingFilterViolation, } from '../src/city-scenario-tier.js';
+let passed = 0;
+function check(cond, msg) {
+    if (cond) {
+        passed++;
+        console.log(`  ok - ${msg}`);
+    }
+    else {
+        console.error(`  FAIL - ${msg}`);
+        process.exitCode = 1;
+    }
+}
+function expectRefusal(result, code, needle, msg) {
+    if (result.ok) {
+        check(false, `${msg} (expected refusal ${code}, got ok)`);
+        return;
+    }
+    check(result.code === code && result.detail.includes(needle), `${msg} (refused ${result.code}${result.code === code ? '' : ` ≠ ${code}`}, evidence contains "${needle}": ${result.detail.includes(needle)})`);
+}
+const FROZEN_AT = '2026-10-04T00:00:00.000Z';
+const REVIEW_BY = '2027-04-04T00:00:00.000Z';
+/** TEST-ONLY shape probe. The keys are meaningless placeholders, not a taxonomy. */
+function probeEntryInput(overrides = {}) {
+    return {
+        tier_id: 'probe-tier-1',
+        city_key: 'city-a',
+        scenario_key: 'scenario-x',
+        modifier_ppm: 1_100_000,
+        applies_to: 'ranking',
+        provenance: {
+            evidence_grade: 'controlled_replay',
+            sample_source: 'real_usage_sample',
+            sample_refs: ['sample-ref-1', 'sample-ref-2', 'sample-ref-3'],
+            reviewer: 'drill-reviewer',
+            frozen_at: FROZEN_AT,
+        },
+        retirement: { condition: 'withdraw if the controlled replay no longer reproduces the ordering', review_by: REVIEW_BY },
+        taxonomy_version: 'probe.v0',
+        ...overrides,
+    };
+}
+function admittedProbe(overrides = {}, registry = []) {
+    const r = admitTierEntry(probeEntryInput(overrides), { triggerFired: true, registry });
+    if (!r.ok)
+        throw new Error(`probe admission failed unexpectedly: ${r.code} ${r.detail}`);
+    return r.value;
+}
+// ---------------------------------------------------------------------------
+// A. Default-off proof
+// ---------------------------------------------------------------------------
+console.log('A. default-off: trigger frozen false, registry frozen EMPTY, nothing admitted');
+check(CITY_SCENARIO_TIER_TRIGGER_FIRED === false, '#339 trigger gate frozen false');
+check(CITY_SCENARIO_TIER_REGISTRY.length === 0, 'the runtime taxonomy registry is empty');
+check(CITY_SCENARIO_TIER_SCHEMA === 'gotry_city_scenario_tier.v1', 'the taxonomy schema id is versioned');
+const MODULE_SOURCE = readFileSync(join(fileURLToPath(new URL('.', import.meta.url)), '..', 'src', 'city-scenario-tier.ts'), 'utf8');
+check(MODULE_SOURCE.includes('export const CITY_SCENARIO_TIER_REGISTRY: readonly CityScenarioTierEntry[] = []'), 'the registry declaration is literally `= []` in source (no taxonomy content in code)');
+check(MODULE_SOURCE.includes('export const CITY_SCENARIO_TIER_TRIGGER_FIRED = false'), 'the trigger declaration is literally `= false` in source');
+expectRefusal(admitTierEntry(probeEntryInput()), 'trigger_not_fired', '不凭 fixture 造画像', 'with the default trigger, admission is refused before any validation');
+expectRefusal(admitTierEntry({ tier_id: '', city_key: '', scenario_key: '', modifier_ppm: -1, taxonomy_version: '' }), 'trigger_not_fired', '#339 trigger has not fired', 'even a wholly invalid entry is refused by the trigger gate first (pre-trigger refusal precedes validation)');
+const defaultResolution = resolveTier({ cityKey: 'any-city', scenarioKey: 'any-scenario' });
+check(defaultResolution.ok && defaultResolution.value.status === 'neutral' && defaultResolution.value.modifier_ppm === TIER_MODIFIER_PPM_NEUTRAL, 'with the default trigger every pair resolves to the neutral modifier ×1.0');
+check(defaultResolution.ok && defaultResolution.value.status === 'neutral' && defaultResolution.value.reason === 'trigger_not_fired', 'the neutral reason is trigger_not_fired, stated rather than implied');
+check(TIER_MODIFIER_PPM_NEUTRAL === 1_000_000, 'the neutral modifier is exactly ×1.0');
+check(TIER_NEUTRAL_REASONS.length === 5 && TIER_NEUTRAL_REASONS.includes('conflicting_evidence'), 'the neutral-reason set is closed and names conflicting evidence');
+// ---------------------------------------------------------------------------
+// B. Admission shape (mandatory provenance + retirement)
+// ---------------------------------------------------------------------------
+console.log('B. admission shape: provenance and retirement are mandatory per tier');
+const admitted = admitTierEntry(probeEntryInput(), { triggerFired: true, registry: [] });
+check(admitted.ok && admitted.value.schema === CITY_SCENARIO_TIER_SCHEMA && admitted.value.taxonomy_version === 'probe.v0', 'a complete probe entry is admitted and carries its schema + taxonomy version');
+check(admitted.ok && admitted.value.applies_to === 'ranking' && TIER_APPLICATION_SURFACES.length === 1, 'the only application surface is `ranking` (there is no hard-filter surface)');
+check(admitted.ok && admitted.value.provenance.sample_refs.length === 3 && admitted.value.retirement.review_by === REVIEW_BY, 'provenance sample refs and the retirement deadline are preserved');
+expectRefusal(admitTierEntry(probeEntryInput({ provenance: undefined }), { triggerFired: true }), 'provenance_required', 'a tier without a stated evidence source is not evidence', 'missing provenance refused');
+expectRefusal(admitTierEntry(probeEntryInput({ retirement: undefined }), { triggerFired: true }), 'retirement_required', 'a tier that cannot expire is not evidence', 'missing retirement refused');
+expectRefusal(admitTierEntry(probeEntryInput({ provenance: { ...probeEntryInput().provenance, sample_source: 'fixture' } }), { triggerFired: true }), 'closed_set', '不凭 fixture 造画像', 'a fixture-sourced sample is refused by name (#339 red line)');
+check(TIER_SAMPLE_SOURCES.length === 1 && TIER_SAMPLE_SOURCES[0] === 'real_usage_sample', 'the admitted sample-source set has exactly one member: real_usage_sample');
+expectRefusal(admitTierEntry(probeEntryInput({ provenance: { ...probeEntryInput().provenance, evidence_grade: 'vibes' } }), { triggerFired: true }), 'closed_set', TIER_EVIDENCE_GRADES[0], 'an evidence grade outside the RFC S2 ordering is refused');
+expectRefusal(admitTierEntry(probeEntryInput({ provenance: { ...probeEntryInput().provenance, sample_refs: ['only-one'] } }), { triggerFired: true }), 'provenance_required', 'a single anecdote is not a tier', `fewer than ${TIER_MIN_SAMPLE_REFS} sample refs refused`);
+expectRefusal(admitTierEntry(probeEntryInput({ provenance: { ...probeEntryInput().provenance, reviewer: '' } }), { triggerFired: true }), 'provenance_required', 'reviewer', 'a tier with no accountable reviewer refused');
+expectRefusal(admitTierEntry(probeEntryInput({ provenance: { ...probeEntryInput().provenance, frozen_at: '2026-10-04' } }), { triggerFired: true }), 'bad_ts', 'date-only', 'a date-only freeze instant refused');
+expectRefusal(admitTierEntry(probeEntryInput({ retirement: { condition: '', review_by: REVIEW_BY } }), { triggerFired: true }), 'retirement_required', 'retirement.condition', 'an empty retirement condition refused');
+expectRefusal(admitTierEntry(probeEntryInput({ retirement: { condition: 'c', review_by: FROZEN_AT } }), { triggerFired: true }), 'retirement_required', 'must postdate', 'a review deadline that does not postdate the freeze refused');
+expectRefusal(admitTierEntry(probeEntryInput({ applies_to: 'hard_filter' }), { triggerFired: true }), 'closed_set', 'memory never enters a hard filter', 'applies_to = hard_filter refused by name');
+expectRefusal(admitTierEntry(probeEntryInput({ taxonomy_version: '' }), { triggerFired: true }), 'binding_incomplete', 'taxonomy_version', 'an unversioned tier refused');
+expectRefusal(admitTierEntry(probeEntryInput({ tier_id: '  ' }), { triggerFired: true }), 'binding_incomplete', 'tier_id', 'a blank tier id refused');
+expectRefusal(admitTierEntry(probeEntryInput({ city_key: '' }), { triggerFired: true }), 'bad_key', 'must not be blank', 'a blank city key refused (blank ≠ unknown)');
+expectRefusal(admitTierEntry(probeEntryInput({ scenario_key: 'x'.repeat(TIER_KEY_MAX_CHARS + 1) }), { triggerFired: true }), 'bad_key', 'never prose', 'an over-long scenario key refused');
+const oneEntry = [admittedProbe()];
+expectRefusal(admitTierEntry(probeEntryInput({ tier_id: 'probe-tier-2' }), { triggerFired: true, registry: oneEntry }), 'duplicate_tier', 'conflicting evidence, not an additional tier', 'a second tier for the same (city, scenario) pair is refused at admission');
+expectRefusal(admitTierEntry(probeEntryInput({ city_key: 'city-b' }), { triggerFired: true, registry: oneEntry }), 'duplicate_tier', 'already exists', 'a duplicate tier_id refused');
+// ---------------------------------------------------------------------------
+// C. Bounded modifier
+// ---------------------------------------------------------------------------
+console.log('C. bounded modifier: declared [min,max], lower bound > 0 by design');
+check(TIER_MODIFIER_PPM_MIN > 0 && TIER_MODIFIER_PPM_MIN < TIER_MODIFIER_PPM_NEUTRAL && TIER_MODIFIER_PPM_MAX > TIER_MODIFIER_PPM_NEUTRAL, 'bounds straddle neutral and the lower bound is strictly positive');
+check(admitTierEntry(probeEntryInput({ modifier_ppm: TIER_MODIFIER_PPM_MIN }), { triggerFired: true }).ok, 'the lower bound itself is admissible (inclusive)');
+check(admitTierEntry(probeEntryInput({ modifier_ppm: TIER_MODIFIER_PPM_MAX }), { triggerFired: true }).ok, 'the upper bound itself is admissible (inclusive)');
+expectRefusal(admitTierEntry(probeEntryInput({ modifier_ppm: 0 }), { triggerFired: true }), 'modifier_bounds', 'never annihilate a candidate', 'a zero modifier is refused (it would annihilate a candidate score)');
+expectRefusal(admitTierEntry(probeEntryInput({ modifier_ppm: -1_000_000 }), { triggerFired: true }), 'modifier_bounds', 'outside the declared bounds', 'a negative modifier refused');
+expectRefusal(admitTierEntry(probeEntryInput({ modifier_ppm: TIER_MODIFIER_PPM_MIN - 1 }), { triggerFired: true }), 'modifier_bounds', 'outside the declared bounds', 'one ppm below the lower bound refused');
+expectRefusal(admitTierEntry(probeEntryInput({ modifier_ppm: TIER_MODIFIER_PPM_MAX + 1 }), { triggerFired: true }), 'modifier_bounds', 'outside the declared bounds', 'one ppm above the upper bound refused');
+expectRefusal(admitTierEntry(probeEntryInput({ modifier_ppm: 1_100_000.5 }), { triggerFired: true }), 'modifier_bounds', 'ppm integers are exact', 'a fractional ppm refused');
+expectRefusal(admitTierEntry(probeEntryInput({ modifier_ppm: '1100000' }), { triggerFired: true }), 'modifier_bounds', 'must be an integer ppm', 'a string modifier refused');
+expectRefusal(admitTierEntry(probeEntryInput({ modifier_ppm: Number.NaN }), { triggerFired: true }), 'modifier_bounds', 'must be an integer ppm', 'NaN modifier refused');
+// ---------------------------------------------------------------------------
+// D. Neutral fallback, never a guess
+// ---------------------------------------------------------------------------
+console.log('D. neutral fallback: unknown city / unknown scenario / conflicting evidence');
+const probeRegistry = [admittedProbe()];
+const hit = resolveTier({ cityKey: 'city-a', scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true });
+check(hit.ok && hit.value.status === 'hit' && hit.value.modifier_ppm === 1_100_000, 'a known (city, scenario) pair resolves to its bounded modifier');
+check(hit.ok && hit.value.status === 'hit' && hit.value.explanation.includes('retire when:'), 'a hit explains itself and surfaces its retirement condition');
+check(hit.ok && hit.value.status === 'hit' && hit.value.evidence_grade === 'controlled_replay' && hit.value.taxonomy_version === 'probe.v0', 'a hit carries the evidence grade and taxonomy version');
+const unknownCity = resolveTier({ cityKey: 'city-zz', scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true });
+check(unknownCity.ok && unknownCity.value.status === 'neutral' && unknownCity.value.reason === 'unknown_city' && unknownCity.value.modifier_ppm === TIER_MODIFIER_PPM_NEUTRAL, 'unknown city → neutral ×1.0 with reason unknown_city');
+check(unknownCity.ok && unknownCity.value.status === 'neutral' && unknownCity.value.explanation.includes('never guessed from a neighbour'), 'the unknown-city fallback states that no neighbour is substituted');
+const unknownScenario = resolveTier({ cityKey: 'city-a', scenarioKey: 'scenario-zz' }, { registry: probeRegistry, triggerFired: true });
+check(unknownScenario.ok && unknownScenario.value.status === 'neutral' && unknownScenario.value.reason === 'unknown_scenario', 'unknown scenario → neutral ×1.0 with reason unknown_scenario');
+const emptyRegistry = resolveTier({ cityKey: 'city-a', scenarioKey: 'scenario-x' }, { registry: [], triggerFired: true });
+check(emptyRegistry.ok && emptyRegistry.value.status === 'neutral' && emptyRegistry.value.reason === 'empty_registry', 'empty registry → neutral ×1.0, not a zero weight');
+/** Conflicting registry built by bypassing the admission duplicate guard (a defective registry). */
+const conflicting = [
+    admittedProbe({ tier_id: 'probe-conflict-a', modifier_ppm: 1_100_000 }),
+    admittedProbe({ tier_id: 'probe-conflict-b', modifier_ppm: 900_000 }),
+];
+const conflict = resolveTier({ cityKey: 'city-a', scenarioKey: 'scenario-x' }, { registry: conflicting, triggerFired: true });
+check(conflict.ok && conflict.value.status === 'neutral' && conflict.value.reason === 'conflicting_evidence' && conflict.value.modifier_ppm === TIER_MODIFIER_PPM_NEUTRAL, 'conflicting evidence → neutral ×1.0, no winner elected');
+check(conflict.ok && conflict.value.status === 'neutral' && conflict.value.conflicting_tier_ids.join(',') === 'probe-conflict-a,probe-conflict-b', 'the conflict surfaces both tier ids for diagnosis (without choosing)');
+check(conflict.ok && conflict.value.tier_id === null, 'a neutral resolution never reports a tier id');
+check(normalizeTierKey(' City-A ', 'k').ok, 'keys normalize: trim + lowercase');
+const n1 = normalizeTierKey('  City   A ', 'k');
+const n2 = normalizeTierKey('city a', 'k');
+check(n1.ok && n2.ok && n1.value === n2.value, 'whitespace collapse + case folding are deterministic and agree');
+const caseHit = resolveTier({ cityKey: 'CITY-A', scenarioKey: ' Scenario-X ' }, { registry: probeRegistry, triggerFired: true });
+check(caseHit.ok && caseHit.value.status === 'hit', 'a case/whitespace variant of a known key still hits (normalization, not fuzzy matching)');
+expectRefusal(resolveTier({ cityKey: '   ', scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true }), 'bad_key', 'must not be blank', 'a blank city key is a caller error, not a silent neutral');
+expectRefusal(resolveTier({ cityKey: 42, scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true }), 'bad_key', 'must be a string', 'a non-string key is a caller error');
+// ---------------------------------------------------------------------------
+// E. Ranking-only falsification
+// ---------------------------------------------------------------------------
+console.log('E. FALSIFICATION: a modifier may reorder, it can NEVER remove a candidate');
+const candidates = [
+    { id: 'cand-boosted', cityKey: 'city-a', semantic: 0.50 },
+    { id: 'cand-plain-1', cityKey: 'city-b', semantic: 0.54 },
+    { id: 'cand-plain-2', cityKey: 'city-c', semantic: 0.10 },
+    { id: 'cand-zero', cityKey: 'city-a', semantic: 0 },
+];
+const neutralRank = applyTierRanking(candidates, { scenarioKey: 'scenario-x' });
+check(neutralRank.ok && neutralRank.value.length === candidates.length, 'default (trigger off): all candidates survive');
+check(neutralRank.ok && neutralRank.value.map(r => r.id).join(',') === 'cand-plain-1,cand-boosted,cand-plain-2,cand-zero', 'default ordering is pure semantic order (every modifier neutral)');
+check(neutralRank.ok && neutralRank.value.every(r => r.modifier_ppm === TIER_MODIFIER_PPM_NEUTRAL && r.tier_id === null), 'default: every row carries the neutral modifier and no tier id');
+check(neutralRank.ok && tierRankingFilterViolation(candidates, neutralRank.value) === null, 'the mechanical no-hard-filter check passes for the default ranking');
+const boostedRank = applyTierRanking(candidates, { scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true });
+check(boostedRank.ok && boostedRank.value.map(r => r.id).join(',') === 'cand-boosted,cand-plain-1,cand-plain-2,cand-zero', 'a ×1.1 tier REORDERS: 0.50×1.1 = 0.55 overtakes the plain 0.54');
+check(boostedRank.ok && boostedRank.value.length === candidates.length, 'reordering preserves the candidate count exactly');
+check(boostedRank.ok && tierRankingFilterViolation(candidates, boostedRank.value) === null, 'the mechanical no-hard-filter check passes for the reordered ranking');
+check(boostedRank.ok && boostedRank.value.every(r => candidates.some(c => c.id === r.id && c.semantic === r.semantic)), 'every row preserves its original semantic score (the unmodified ranking is always recoverable)');
+check(boostedRank.ok && (boostedRank.value.find(r => r.id === 'cand-boosted')?.explanation ?? '').includes('probe-tier-1'), 'the applied bias is disclosed per candidate (ranking-disclosure precedent)');
+/** The most hostile admissible tier: the lower bound applied to a zero semantic score. */
+const minTier = [admittedProbe({ tier_id: 'probe-min', modifier_ppm: TIER_MODIFIER_PPM_MIN })];
+const minRank = applyTierRanking(candidates, { scenarioKey: 'scenario-x' }, { registry: minTier, triggerFired: true });
+check(minRank.ok && minRank.value.length === candidates.length, 'FALSIFICATION: even the lower-bound modifier removes nobody (count unchanged)');
+check(minRank.ok && minRank.value.some(r => r.id === 'cand-zero' && r.score === 0), 'FALSIFICATION: a zero-semantic candidate scores 0 and is still PRESENT (score 0 ≠ removal)');
+check(minRank.ok && tierRankingFilterViolation(candidates, minRank.value) === null, 'FALSIFICATION: the no-hard-filter check passes at the hostile bound');
+check(minRank.ok && !Object.keys(minRank.value[0]).some(k => /exclud|filter|drop|reject|threshold/i.test(k)), 'the ranked row shape exposes no exclude/filter/drop/threshold field (no filter surface exists)');
+let everPresent = true;
+for (let semantic = 0; semantic <= 10; semantic++) {
+    for (const registry of [[], probeRegistry, minTier]) {
+        const probe = applyTierRanking([{ id: 'solo', cityKey: 'city-a', semantic: semantic / 10 }], { scenarioKey: 'scenario-x' }, { registry, triggerFired: true });
+        if (!probe.ok || probe.value.length !== 1 || probe.value[0].id !== 'solo')
+            everPresent = false;
+    }
+}
+check(everPresent, 'FALSIFICATION battery: across 11 semantic scores × 3 registries the candidate is never dropped');
+expectRefusal(applyTierRanking([{ id: '', cityKey: 'city-a', semantic: 1 }], { scenarioKey: 'scenario-x' }), 'bad_candidate', 'non-empty id', 'a blank candidate id refused');
+expectRefusal(applyTierRanking([{ id: 'a', cityKey: 'city-a', semantic: Number.NaN }], { scenarioKey: 'scenario-x' }), 'bad_candidate', 'must be finite', 'a non-finite semantic score refused');
+expectRefusal(applyTierRanking([{ id: 'a', cityKey: 'city-a', semantic: -0.5 }], { scenarioKey: 'scenario-x' }), 'bad_candidate', 'would invert every modifier', 'a NEGATIVE semantic score is refused: the contract is multiplicative, so a boost would demote it');
+expectRefusal(applyTierRanking([{ id: 'ok', cityKey: 'city-b', semantic: 0.5 }, { id: 'neg', cityKey: 'city-a', semantic: -1 }], { scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true }), 'bad_candidate', 'must be non-negative', 'one negative candidate refuses the whole ranking (no partial ordering over inverted semantics)');
+check(applyTierRanking([{ id: 'zero', cityKey: 'city-a', semantic: 0 }], { scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true }).ok, 'zero is admissible (it is the boundary, not a negative)');
+check(applyTierRanking([{ id: 'negzero', cityKey: 'city-a', semantic: -0 }], { scenarioKey: 'scenario-x' }).ok, 'negative zero is admissible (it equals zero, not below it)');
+expectRefusal(applyTierRanking([{ id: 'a', cityKey: 'city-a', semantic: 1 }, { id: 'a', cityKey: 'city-b', semantic: 2 }], { scenarioKey: 'scenario-x' }), 'bad_candidate', 'duplicate candidate id', 'duplicate candidate ids refused (ranking inputs are a set)');
+check(tierRankingFilterViolation(candidates, []) !== null, 'the mechanical check CATCHES a dropped-candidate violation (the check itself is falsifiable)');
+check(tierRankingFilterViolation(candidates, (neutralRank.ok ? neutralRank.value : []).slice(0, 3)) !== null, 'the mechanical check catches a partial drop');
+// ---------------------------------------------------------------------------
+// F. Determinism + versioning
+// ---------------------------------------------------------------------------
+console.log('F. determinism, stable ties, defective registry refused');
+const runA = applyTierRanking(candidates, { scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true });
+const runB = applyTierRanking(candidates, { scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true });
+check(runA.ok && runB.ok && JSON.stringify(runA.value) === JSON.stringify(runB.value), 'identical inputs produce byte-identical output (deterministic)');
+const ties = [
+    { id: 'tie-1', cityKey: 'city-b', semantic: 0.4 },
+    { id: 'tie-2', cityKey: 'city-c', semantic: 0.4 },
+    { id: 'tie-3', cityKey: 'city-d', semantic: 0.4 },
+];
+const tieRank = applyTierRanking(ties, { scenarioKey: 'scenario-x' }, { registry: probeRegistry, triggerFired: true });
+check(tieRank.ok && tieRank.value.map(r => r.id).join(',') === 'tie-1,tie-2,tie-3', 'ties keep declaration order (stable sort)');
+const defective = [{ ...admittedProbe(), modifier_ppm: 5_000_000 }];
+expectRefusal(resolveTier({ cityKey: 'city-a', scenarioKey: 'scenario-x' }, { registry: defective, triggerFired: true }), 'modifier_bounds', 'never clamped silently', 'a defective registry entry is refused at read time, never clamped silently');
+expectRefusal(applyTierRanking(candidates, { scenarioKey: 'scenario-x' }, { registry: defective, triggerFired: true }), 'modifier_bounds', 'defective registry entry', 'ranking propagates the defective-registry refusal instead of degrading');
+console.log(`\nCITY-SCENARIO TIER MECHANISM TESTS (#339, simulated_trigger_drill / fixture_contract; registry stays EMPTY): ${passed} pass${process.exitCode ? ', FAIL' : ' (all green)'}`);

package/dist/scripts/doctor-tests.js

@@ -15,15 +15,17 @@
  *  11. rejected/cancelled + unavailable 通道:零执行 + 结构化 verdict='approval-denied'
  *  12. user-action 项绝不安装;scope 过滤只考虑 items 范围内 id
  *  13. tool-level gotry_doctor 注册 + observable chain(diagnose → repair)
+ *  14. hbcli whoami 三档解析;14b. probeStdout 在 stdio 关闭(close)后结算,exit 先于 data 不丢输出
  *
  * 运行: cd ts && npx tsx scripts/doctor-tests.ts
  */
 import assert from 'node:assert/strict';
+import { EventEmitter } from 'node:events';
 import { existsSync } from 'node:fs';
 import { mkdtemp, mkdir, writeFile, rm, readFile } from 'node:fs/promises';
 import { tmpdir } from 'node:os';
 import { dirname, join } from 'node:path';
-import { runDoctorChecks, renderDoctorReportMd, nodeOk, scopeKeyFor, createRepairApprovalGate, runDoctorRepair } from '../capabilities/doctor.js';
+import { runDoctorChecks, renderDoctorReportMd, nodeOk, probeStdout, scopeKeyFor, createRepairApprovalGate, runDoctorRepair } from '../capabilities/doctor.js';
 import { endpointFingerprint, maskFlyaiKey, resolveFlyaiEndpoint, sha256Hex, writeFlyaiVerification } from '../capabilities/flyai-config.js';
 import { apply } from '../src/index.js';
 const tmp = await mkdtemp(join(tmpdir(), 'gotry-doctor-test-'));
@@ -561,4 +563,38 @@ console.log('13. tool-level gotry_doctor 注册 + observable chain(diagnose→re
     }
 }
 console.log('14. hbcli whoami 三档解析(未配置=degraded+注册指引 / customer 档=ok)OK');
+// 14b. probeStdout 必须等 stdio 关闭('close')再结算,不能在 'exit' 结算:
+//      Node 文档明言 'exit' 触发时 stdout 可能还没读完。秒退的 whoami 子进程若 exit 先于 data,
+//      输出丢成空串,空串走「不可解析=保守视为有效」分支,把无凭证 hbcli 报成 ok
+//      (Node 22 CI 偶发红 14 的 degraded 断言,与被测 PR 无关)。注入假子进程,确定性复现该次序。
+{
+    const fakeSpawn = (script) => (() => {
+        const child = new EventEmitter();
+        child.stdout = new EventEmitter();
+        child.kill = () => true;
+        setImmediate(() => script(child, child.stdout));
+        return child;
+    });
+    const whoami = '{"env":"uat","api_key":{"configured":false},"portal":{"configured":false},"customer":{"configured":true}}';
+    const probe = (impl, timeoutMs = 1_000) => probeStdout('hbcli', ['--json', 'auth', 'whoami'], timeoutMs, impl);
+    assert.equal(await probe(fakeSpawn((child, stdout) => {
+        child.emit('exit', 0, null); // exit 先到,管道数据尚未送达
+        stdout.emit('data', Buffer.from(`${whoami}\n`));
+        child.emit('close', 0, null); // stdio 关闭后才 close
+    })), whoami, 'exit 先于 stdout data 时,输出必须完整返回(旧实现在 exit 结算,得到空串)');
+    assert.equal(await probe(fakeSpawn((child, stdout) => {
+        stdout.emit('data', Buffer.from('{"a":'));
+        stdout.emit('data', Buffer.from('1}\n'));
+        child.emit('exit', 0, null);
+        child.emit('close', 0, null);
+    })), '{"a":1}', '多段 data 拼接后 trim');
+    assert.equal(await probe(fakeSpawn((child, stdout) => {
+        child.emit('exit', 2, null);
+        stdout.emit('data', Buffer.from('boom'));
+        child.emit('close', 2, null);
+    })), null, '非零退出码一律 null(无论输出)');
+    assert.equal(await probe(fakeSpawn((child) => { child.emit('error', new Error('spawn ENOENT')); })), null, 'spawn error → null');
+    assert.equal(await probe(fakeSpawn(() => { }), 50), null, '子进程不结束 → 超时 null,不悬挂');
+}
+console.log('14b. probeStdout 在 stdio 关闭后结算(exit 先于 data 不丢输出 / 非零退出 null / error null / 超时 null)OK');
 console.log('doctor-tests: 全部通过');