@danceiny/gotry 0.2.0-rc.27 → 0.2.0-rc.29

package/dist/src/dsh-llm.js

@@ -1,7 +1,8 @@
 /**
  * 真 LlmPort:OpenAI 兼容接口的 provider 中立适配器(DeepSeek/MiniMax-M2 实测)。
  * 零新依赖(node 内建 fetch)。环境变量:LLM_API_KEY/LLM_BASE_URL/LLM_MODEL
- * (兼容旧 DEEPSEEK_* 别名)。MiniMax-M2 是推理模型:输出带 <think> 块,
+ * (兼容旧 DEEPSEEK_* 别名);GOTRY_LLM_TIMEOUT_MS = 单次请求总预算(默认 300000ms,
+ * 非正整数忽略)。MiniMax-M2 是推理模型:输出带 <think> 块,
  * 必须先剥离再解析——JSON 藏在 think 里是常见失败模式。
  * 无 key 时抛出明确错误,replay-real 自动回退 mock(ADR-8)。
  * 责任铁律不变:本适配器只做翻译/润色/解释,判定与算术在确定性组件。
@@ -17,12 +18,73 @@ const base = () => (process.env['LLM_BASE_URL'] ?? process.env['DEEPSEEK_BASE_UR
 function emptyUsage() {
     return { calls: 0, inputTokens: 0, outputTokens: 0, inputCacheHitTokens: 0, inputCacheMissTokens: 0, responsesMissingUsage: 0 };
 }
-async function chat(messages, json, usage) {
+/** 单次请求(连接→响应头→正文读完)的默认总预算:对推理模型足够宽松,只兜「连上了却永不应答」的卡死。 */
+export const DEFAULT_LLM_TIMEOUT_MS = 300_000;
+/**
+ * 超时上限 = 2^31-1 ms(≈24.8 天)。Node 对更大的延迟会溢出并**悄悄改成 1ms**
+ * (TimeoutOverflowWarning),即「配得越大越立刻超时」——所以必须夹住,绝不原样透传。
+ */
+const MAX_LLM_TIMEOUT_MS = 2_147_483_647;
+/** 只认十进制正整数(数值或纯数字串);其余(0/负数/小数/NaN/带单位/空串)一律 undefined——绝不退化成「无超时」。 */
+function parseTimeoutMs(raw) {
+    const n = typeof raw === 'string' ? (/^\d+$/.test(raw.trim()) ? Number(raw.trim()) : Number.NaN) : raw;
+    return typeof n === 'number' && Number.isSafeInteger(n) && n > 0 ? Math.min(n, MAX_LLM_TIMEOUT_MS) : undefined;
+}
+/** 解析顺序:本次调用显式值 > 环境变量 GOTRY_LLM_TIMEOUT_MS(调用时取值,同 base()/model())> 默认值。 */
+export function resolveLlmTimeoutMs(callMs) {
+    return parseTimeoutMs(callMs) ?? parseTimeoutMs(process.env['GOTRY_LLM_TIMEOUT_MS']) ?? DEFAULT_LLM_TIMEOUT_MS;
+}
+/**
+ * chat() 请求被截断(超时 / 调用方取消)的类型化失败——不是挂起,也不会被吞。
+ * 与既有错误形态一致,而非另起一套:
+ *  - message 沿用本模块 `llm <kind>: <detail>` 约定(同 `llm 429: …`),只读 .message 的调用方
+ *    (nightly-evidence / persona-sim / time-eval --real)原样可用;
+ *  - name 取平台既有名 TimeoutError / AbortError(AbortSignal.timeout 与手动 abort 抛的同名),
+ *    persona-sim、channel-probe 等按 name 分类的代码零改动即可识别;
+ *  - cause 保留 fetch 抛出的原始错误(调用方自定义的 abort reason 也在其中)。
+ * HTTP 非 2xx(`llm <status>`)、DNS/连接重置、坏 JSON 仍是原样的普通 Error——只改写「被我们的 signal 终止」的失败。
+ */
+export class LlmRequestError extends Error {
+    code;
+    /** 本次生效的超时预算;仅 code === 'timeout' 有值 */
+    timeoutMs;
+    constructor(code, detail, options = {}) {
+        super(`llm ${code}: ${detail}`, options.cause === undefined ? undefined : { cause: options.cause });
+        this.name = code === 'timeout' ? 'TimeoutError' : 'AbortError';
+        this.code = code;
+        this.timeoutMs = options.timeoutMs;
+    }
+}
+/**
+ * 发一次请求并读完正文。**同一个 signal 贯穿 fetch 与 res.json()/res.text()**,所以超时覆盖整个请求
+ * (含「响应头已到、正文卡住」与「非 2xx 的错误正文卡住」),调用方取消同理。
+ * 只有「被我们的 signal 终止」才改写成 LlmRequestError;其余错误原样上抛。
+ */
+async function requestCompletion(url, init, request) {
+    const timeoutMs = resolveLlmTimeoutMs(request.timeoutMs);
+    const timeout = AbortSignal.timeout(timeoutMs);
+    const signal = request.signal ? AbortSignal.any([request.signal, timeout]) : timeout;
+    try {
+        const res = await fetch(url, { method: 'POST', headers: init.headers, body: init.body, signal });
+        if (!res.ok)
+            return { ok: false, status: res.status, text: await res.text() };
+        return { ok: true, data: await res.json() };
+    }
+    catch (error) {
+        if (!signal.aborted)
+            throw error;
+        // AbortSignal.any 的 reason 是最先触发的那个源的 reason:等于超时信号的 reason 即超时先到,否则是调用方取消
+        if (timeout.aborted && signal.reason === timeout.reason) {
+            throw new LlmRequestError('timeout', `no complete response within ${timeoutMs}ms (GOTRY_LLM_TIMEOUT_MS)`, { cause: error, timeoutMs });
+        }
+        throw new LlmRequestError('aborted', "request cancelled by the caller's AbortSignal", { cause: error });
+    }
+}
+async function chat(messages, json, usage, request = {}) {
     const key = process.env['LLM_API_KEY'] ?? process.env['DEEPSEEK_API_KEY'];
     if (!key)
         throw new Error('LLM_API_KEY 未设置(兼容 DEEPSEEK_API_KEY 别名)——真 LLM 路径不可用,请回退 mock(ADR-8)');
-    const res = await fetch(`${base()}/chat/completions`, {
-        method: 'POST',
+    const reply = await requestCompletion(`${base()}/chat/completions`, {
         headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${key}` },
         body: JSON.stringify({
             model: model(),
@@ -30,10 +92,10 @@ async function chat(messages, json, usage) {
             ...(json ? { response_format: { type: 'json_object' } } : {}),
             temperature: json ? 0 : 0.7,
         }),
-    });
-    if (!res.ok)
-        throw new Error(`llm ${res.status}: ${(await res.text()).slice(0, 300)}`);
-    const data = await res.json();
+    }, request);
+    if (!reply.ok)
+        throw new Error(`llm ${reply.status}: ${reply.text.slice(0, 300)}`);
+    const data = reply.data;
     if (usage) {
         usage.calls += 1;
         const u = data.usage;
@@ -75,7 +137,11 @@ const SKELETON_SYSTEM = `你是行程骨架抽取器。从对话中抽取行程
 输出 JSON:{"scenario":"erhai|workation|yunnan|generic","segments":[{"id":"f1","role":"choice|fixed","route":"HKG->HKT","dateHint":"2026-07-18","anchors":{"arriveByMin":885}}]}
 规则:每个跨城移动一段;锚点只放用户明说或必然的(如"当天到"→arriveByMin 23:59=1439);时刻用当日分钟。
 scenario 判定:「洱海/大理/千岛湖/太湖+选目的地」→erhai(候选集);「普吉/workation/远程办公+多城链」→workation(五段链);「云南/大理丽江」→yunnan;不确定→generic。只输出 JSON。`;
-export function createOpenAICompatLlm(flightPackPath, clock = () => new Date()) {
+/**
+ * request:本端口每次 chat() 共用的请求级选项(timeoutMs / signal)。signal 是端口级取消——
+ * 调用方可借它在会话/批次截止时真正掐断在途请求,而不是放着它继续挂在 provider 上。
+ */
+export function createOpenAICompatLlm(flightPackPath, clock = () => new Date(), request = {}) {
     const pack = flightPackPath;
     const usage = emptyUsage();
     const historyText = (h) => h.map(t => `${t.role === 'user' ? '用户' : '助手'}: ${t.text}`).join('\n');
@@ -84,7 +150,7 @@ export function createOpenAICompatLlm(flightPackPath, clock = () => new Date())
     const anchorContext = () => `时间锚点卡:\n${buildTimeAnchor(clock()).card}`;
     return {
         async extractFacts(history) {
-            const out = await chat([{ role: 'system', content: FACTS_SYSTEM }, { role: 'user', content: `${anchorContext()}\n\n${historyText(history)}` }], true, usage);
+            const out = await chat([{ role: 'system', content: FACTS_SYSTEM }, { role: 'user', content: `${anchorContext()}\n\n${historyText(history)}` }], true, usage, request);
             const obj = parseJsonBlock(out);
             if (!obj)
                 return { assumptions: [] };
@@ -96,7 +162,7 @@ export function createOpenAICompatLlm(flightPackPath, clock = () => new Date())
         async extractSpec(history, state) {
             // 架构(ADR-10):LLM 只产骨架与锚点;班次数据永远来自能力层(数据包/未来实时API)
             const context = `${anchorContext()}\n已断言日历:${JSON.stringify(state.calendar.assertedWeekdays)}\nprofile:${JSON.stringify(state.profile)}`;
-            const out = await chat([{ role: 'system', content: SKELETON_SYSTEM }, { role: 'user', content: `${context}\n\n${historyText(history)}` }], true, usage);
+            const out = await chat([{ role: 'system', content: SKELETON_SYSTEM }, { role: 'user', content: `${context}\n\n${historyText(history)}` }], true, usage, request);
             const skeleton = parseJsonBlock(out);
             if (!skeleton || !Array.isArray(skeleton['segments']) || skeleton['segments'].length === 0)
                 return null;
@@ -126,7 +192,11 @@ export function createOpenAICompatLlm(flightPackPath, clock = () => new Date())
                 }
                 packSpec = parseFlightPackToSpec(JSON.parse(await readFile(packPath, 'utf-8')));
             }
-            catch {
+            catch (e) {
+                // issue #620:数据包被 parse 边界拒收时,原因必须留痕——否则用户只看到
+                // 「骨架还不完整」,运维看不到是哪个包的哪个字段把求解面挡住了。
+                const err = e;
+                console.error(`[gotry] extractSpec: 数据包不可用 ${packPath}(${err.code ?? 'parse_failed'}):`, (err.message ?? '').slice(0, 200));
                 return null;
             }
             const anchorsById = new Map(skeleton['segments'].map(s => [String(s['id'] ?? ''), (s['anchors'] ?? {})]));
@@ -142,7 +212,7 @@ export function createOpenAICompatLlm(flightPackPath, clock = () => new Date())
         async extractSlots(history, now) {
             // now 可注入(评测固定锚点);过期判定在 flagExpiredSlots(代码层),模型只管逐字抽取
             const anchor = buildTimeAnchor(now ?? clock());
-            const out = await chat([{ role: 'system', content: buildSlotSystem(anchor) }, { role: 'user', content: historyText(history) }], true, usage);
+            const out = await chat([{ role: 'system', content: buildSlotSystem(anchor) }, { role: 'user', content: historyText(history) }], true, usage, request);
             const obj = parseJsonBlock(out);
             if (!obj)
                 return null;
@@ -152,7 +222,7 @@ export function createOpenAICompatLlm(flightPackPath, clock = () => new Date())
         },
         async polishQuestion(q) {
             const out = await chat([{ role: 'system', content: '把旅行规划的追问润色得更自然,保留全部信息(含为什么问),一两句话,不要加表情。' },
-                { role: 'user', content: `【${q.key}】${q.text}(为什么问:${q.why})` }], false, usage);
+                { role: 'user', content: `【${q.key}】${q.text}(为什么问:${q.why})` }], false, usage, request);
             return out.trim() || `【${q.key}】${q.text}`;
         },
         usage,

package/dist/src/index.js

@@ -24,7 +24,8 @@ import { interpretArgs } from './tool-packet.js';
 import { projectUtility } from './memory-utility.js';
 import { pickNudgeWish } from './wish-pool.js';
 import { resolveTimelineDate } from './travel-timeline.js';
-import { ensureLedger, readCompanionsWithFallback, readMotivationWithFallback, readTripsWithFallback } from './state-ledger.js';
+import { ensureLedger, openLedgerIfExists, readCompanionsWithFallback, readMotivationWithFallback, readTripsWithFallback } from './state-ledger.js';
+import { applyZoneNote, bindZoneSession, boundZoneSession, isZoneObservableTool, observeToolResult, promoteWithRouting, renderSessionZoneBrief, resolveZoneSwitch, zoneScopeOfExec, zoneSessionRefFromExec, } from './session-zone-wiring.js';
 import { isValidHomeCityPreference, resolveDefaultOrigin } from './memory-capture.js';
 import { applyPlanningWindow } from './loop.js';
 import { buildTimeAnchor } from './time-anchor.js';
@@ -84,6 +85,7 @@ export const Config = z.object({
     timeoutMs: z.number().default(30_000),
     hbcliBin: z.string().default('hbcli'),
     sessionAccess: z.string().default('ask'),
+    sessionZones: z.string().default('off'),
     benchmarkEnvironmentConfigPath: z.string().default(''),
     lavishAxiPackageRoot: z.string().default(''),
 });
@@ -450,6 +452,9 @@ export function apply(ctx, config, seams = {}) {
     }
     // 时间感知:注册动态变量,persona 里用 {{current_date}} 引用。
     // 每次 assemble 时取系统时钟——LLM 始终知道「今天是几号」。
+    // provider 收到本次组装的 AssembleContext(dsh-system-prompt 契约:
+    // `variable(name, provider: (context: AssembleContext) => string | undefined)`);
+    // `scope` 是不透明、按身份比较的 ScopeKey —— 分区读回据此分辨会话。
     const sp = ctx['systemPrompt'];
     sp?.variable?.('current_date', () => {
         const d = new Date();
@@ -464,6 +469,32 @@ export function apply(ctx, config, seams = {}) {
     // 模型都是盲的、重新访谈——「回访规划时长降 ≥50%」不可能成立。这里把画像
     // 渲染成紧凑 brief 注入 persona;为空 = 首访。与当轮说法冲突时以用户为准。
     sp?.variable?.('motivation_brief', () => renderMotivationBrief(config.stateRoot ?? '.'));
+    // 会话双区记忆读回(issue #255 P4-3,design/session-dual-zone-memory-design.md §5):
+    // 变量恒注册(persona 侧可随时引用),但总闸 off(默认)时恒返回空串 —— 接线惰性,
+    // 不建库、不读库、零事件;persona 模板本身不在本 PR 改动,因此开关 off 时注入面
+    // 输出逐字节不变。空串 = 首访/无活笔记(与 motivation_brief 同纪律)。
+    // 会话双区读回(issue #255 P4-3):**只在总闸 on 时注册**。
+    //  - 为什么是条件注册:默认关必须与 main **不可区分**——注入面多出一个变量名
+    //    就已经是可观测差异(§48 benchmark-environment-bridge-tests 的
+    //    「normal product mode keeps its prompt variables」逐项断言会红)。
+    //    出厂 persona(cordis.gotry-patch.yml)今天不引用本变量,所以条件注册安全。
+    //  - **后续约束**:创始人一旦把 `{{session_zone_brief}}` 写进出厂 persona,
+    //    本变量必须改为**无条件注册**(关闸时返回空串)——strict 插值下未注册的
+    //    引用会让整段 persona 渲染失败。那一步同时要改 §48 的变量清单断言、
+    //    persona-surface-guard-tests 的注入面清单与 benchmark-environment-bridge-e2e
+    //    的 CANONICAL_RAW_VARIABLES。
+    //  - 读回按**组装 scope** 取会话身份(dsh agent-loop 以 agent 对象为 ScopeKey,
+    //    与工具侧 exec.agent 同一身份):同一宿主进程里的两个会话因此读不到对方的
+    //    resource 层笔记(设计 §1.1);取不到 scope → 不出 resource 段(fail-closed)。
+    const zoneSwitch = resolveZoneSwitch(config.sessionZones);
+    if (zoneSwitch === 'on') {
+        sp?.variable?.('session_zone_brief', assembleContext => renderSessionZoneBrief({
+            ledger: openLedgerIfExists(config.stateRoot ?? '.'),
+            now: new Date().toISOString(),
+            sessionRef: boundZoneSession(assembleContext?.scope),
+            zoneSwitch,
+        }));
+    }
     // 通道路由卡(通道注册表生成,docs/design/tool-orchestration-design.md §2.1/D-8):
     // persona 检索条款只留行为契约,机/火/酒通道顺位与额度口径查卡——prose 教义
     // 变查表教义,注册表加通道卡片自动一致。
@@ -537,6 +568,30 @@ export function apply(ctx, config, seams = {}) {
         if (typeof t.execute === 'function') {
             t.execute = guardToolExecute(String(t.name), config.stateRoot ?? '.', t.execute);
         }
+        // 工具观察捕获缝(issue #255 P4-3):总闸 on 且工具在闭集白名单内才包裹——
+        // off(默认)时 execute 一层不多包,行为逐字节不变。捕获只投影形状字段
+        // (verdict/条数/价格带),证据只走指针;捕获失败永不影响工具返回值。
+        if (zoneSwitch === 'on' && typeof t.execute === 'function' && isZoneObservableTool(t.name)) {
+            const inner = t.execute;
+            const toolName = String(t.name);
+            t.execute = async (args, exec) => {
+                const result = await inner(args, exec);
+                try {
+                    const sessionRef = zoneSessionRefFromExec(exec);
+                    if (sessionRef) {
+                        bindZoneSession(zoneScopeOfExec(exec), sessionRef);
+                        observeToolResult(openLedgerIfExists(config.stateRoot ?? '.') ?? ensureLedger(config.stateRoot ?? '.'), {
+                            tool: toolName,
+                            result,
+                            session_ref: sessionRef,
+                            ts: new Date().toISOString(),
+                        });
+                    }
+                }
+                catch { /* 记忆面永不把产品主路径带红 */ }
+                return result;
+            };
+        }
         ctx.tools.register(t);
     };
     // Issue #443: register the five local editor tools only from trusted host
@@ -1055,6 +1110,110 @@ export function apply(ctx, config, seams = {}) {
         },
         presentCall: args => ({ card: 'generic', title: '记录旅行', kind: 'edit', rawInput: args }),
     }));
+    // 会话双区记忆工具面(issue #255 P4-3):**只在总闸 on 时注册**——off(默认)时
+    // 工具清单逐项不变,模型看不到任何分区入口(接线惰性的第一道)。
+    if (zoneSwitch === 'on') {
+        registerGuarded(defineTool({
+            name: 'gotry_session_zone_note',
+            description: 'Session working-zone memory (hot context, issue #255): capture a STRUCTURED fragment of what is still in play this session '
+                + '(destination / date window / party size / budget stance = intent tier, 24h; search shapes = resource tier, 30min), '
+                + 'revise it with optimistic CAS when the user corrects a detail, or drop it when it stops being true. '
+                + 'Payload must be typed slot-spec-family fields — NEVER raw conversation text, IDs, phone numbers, URLs or credentials '
+                + '(the write gate rejects those shapes). Evidence is a pointer (session + observation index), never content. '
+                + 'action="propose" only PROPOSES moving a note into the durable notebook: it writes NOTHING; the owner must confirm in their own words, '
+                + 'after which you call gotry_session_zone_promote with that quote. The model may never self-promote. '
+                + 'action="deny" records that the owner declined to remember it long-term (writes nothing; stop re-proposing it this session).',
+            parameters: {
+                action: { type: 'string', required: true, enum: ['capture', 'revise', 'drop', 'propose', 'deny'], description: 'capture=新片段入工作区;revise=CAS 修订(需 noteId+expectedRev);drop=更正即弃;propose=提议晋升(零写入);deny=owner 否决提议(零写入)' },
+                tier: { type: 'string', enum: ['resource', 'intent'], description: 'capture 必填:intent(目的地/日期/人数/预算立场,24h)或 resource(检索形态,30min)' },
+                kind: { type: 'string', enum: ['availability', 'price_band', 'destination', 'date_window', 'party_size', 'budget_stance'], description: 'capture 必填;revise 可选(改 kind)' },
+                payload: { type: 'object', additionalProperties: true, description: '结构化片段,如 { city: "大理" } / { start: "2026-11-01", end: "2026-11-05" };禁放原文/证件/电话/URL/凭证' },
+                noteId: { type: 'string', description: 'revise/drop/propose 的目标笔记 id' },
+                expectedRev: { type: 'integer', description: 'revise 的父 rev(必须等于当前 rev,否则 stale_rev 拒绝)' },
+                promoteKind: { type: 'string', enum: ['trip_fact', 'preference', 'constraint', 'lesson'], description: 'propose 时提议的持久条目类别' },
+            },
+            output: {
+                schema: { type: 'json' },
+                render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
+            },
+            async execute(args, exec) {
+                const sessionRef = zoneSessionRefFromExec(exec);
+                if (!sessionRef) {
+                    return { ok: false, code: 'bad_session', summary: '无会话身份(exec.agent.session.id 缺失):分区不记忆无主体的片段' };
+                }
+                bindZoneSession(zoneScopeOfExec(exec), sessionRef);
+                const r = applyZoneNote(ensureLedger(config.stateRoot), {
+                    action: args.action,
+                    ...(args.tier !== undefined ? { tier: args.tier } : {}),
+                    ...(args.kind !== undefined ? { kind: args.kind } : {}),
+                    ...(args.payload !== undefined ? { payload: args.payload } : {}),
+                    ...(args.noteId !== undefined ? { noteId: args.noteId } : {}),
+                    ...(args.expectedRev !== undefined ? { expectedRev: args.expectedRev } : {}),
+                    ...(args.promoteKind !== undefined ? { promoteKind: args.promoteKind } : {}),
+                    session_ref: sessionRef,
+                    ts: new Date().toISOString(),
+                });
+                if (!r.ok)
+                    return { ok: false, code: r.code, summary: r.detail };
+                const summary = r.proposed
+                    ? `已提议(未写入):${r.ask ?? ''}`
+                    : `${r.action}${r.appended ? ' 已落账' : ' 幂等跳过'}${r.noteId ? `:${r.noteId.slice(0, 60)}` : ''}`;
+                return { ok: true, action: r.action, appended: r.appended, note_id: r.noteId, requires_owner_confirm: r.requiresOwnerConfirm === true, summary };
+            },
+            presentCall: args => ({ card: 'generic', title: `会话记忆:${String(args.action ?? '')}`, kind: 'edit', rawInput: args }),
+        }));
+        registerGuarded(defineTool({
+            name: 'gotry_session_zone_promote',
+            description: 'Owner-confirmed promotion into the durable trip notebook (issue #255) — the ONLY write path into durable memory. '
+                + 'Requires ownerQuote: the user\'s OWN words confirming they want this remembered long-term; your own summary is not a confirmation. '
+                + 'Routing rule: a preference ALSO goes through the motivation-profile gate (pass motivation.{weights|hard|homeCity}), '
+                + 'a trip fact through the timeline gate (pass trip.{destination,start}), a companion constraint through the companion gate (pass companion.{label,constraints}). '
+                + 'Without the required routed payload the promotion is REJECTED — the notebook never becomes a parallel store for a fact that already has an owner. '
+                + 'Generic constraints and lessons live in the notebook itself. The notebook write and the routed gate write are one transaction: they cannot diverge.',
+            parameters: {
+                noteId: { type: 'string', required: true, description: '源工作区笔记 id(必须未过期)' },
+                kind: { type: 'string', required: true, enum: ['trip_fact', 'preference', 'constraint', 'lesson'], description: '持久条目类别' },
+                ownerQuote: { type: 'string', required: true, description: '用户本人确认要长期记住的原话(≤200 字;模型自述不算确认)' },
+                surface: { type: 'string', required: true, enum: ['user_reply', 'approval_card'], description: '确认表面:用户回复 或 审批卡' },
+                payload: { type: 'object', additionalProperties: true, description: '可选:覆盖源笔记载荷的结构化断言' },
+                motivation: { type: 'object', additionalProperties: true, description: 'preference 必填:{ weights?, hard?, homeCity? } 至少一项(经动机画像闸)' },
+                trip: { type: 'object', additionalProperties: true, description: 'trip_fact 必填:{ destination, start(YYYY-MM-DD), end?, companions? }(经时间线闸)' },
+                companion: { type: 'object', additionalProperties: true, description: '同行人约束必填:{ label, constraints:{ mobility?, health?, prefs? } }(经同行人闸)' },
+            },
+            output: {
+                schema: { type: 'json' },
+                render: (_args, value) => [{ type: 'text', text: String(value.summary ?? '') }],
+            },
+            async execute(args, exec) {
+                const sessionRef = zoneSessionRefFromExec(exec);
+                if (sessionRef)
+                    bindZoneSession(zoneScopeOfExec(exec), sessionRef);
+                const r = promoteWithRouting(ensureLedger(config.stateRoot), {
+                    noteId: String(args.noteId ?? ''),
+                    kind: String(args.kind ?? ''),
+                    ownerQuote: String(args.ownerQuote ?? ''),
+                    surface: String(args.surface ?? ''),
+                    ...(args.payload !== undefined ? { payload: args.payload } : {}),
+                    ...(args.motivation !== undefined ? { motivation: args.motivation } : {}),
+                    ...(args.trip !== undefined ? { trip: args.trip } : {}),
+                    ...(args.companion !== undefined ? { companion: args.companion } : {}),
+                    ts: new Date().toISOString(),
+                });
+                if (!r.ok)
+                    return { ok: false, code: r.code, summary: r.detail };
+                const routed = r.routed ? `;并经 ${r.routed.authority} 闸${r.routed.applied ? '落地' : '幂等跳过'}` : '';
+                return {
+                    ok: true,
+                    appended: r.appended,
+                    entry_id: r.entryId,
+                    authority: r.authority,
+                    routed: r.routed ? JSON.parse(JSON.stringify(r.routed)) : null,
+                    summary: `${r.appended ? '已写入笔记本' : '笔记本幂等跳过'}${routed}`,
+                };
+            },
+            presentCall: args => ({ card: 'generic', title: '笔记本晋升(owner 确认)', kind: 'edit', rawInput: args }),
+        }));
+    }
     registerGuarded(defineTool({
         name: 'gotry_hotel_search',
         description: routed('gotry_hotel_search', 'Search hotels via hotelbyte-cli (real-time when hbcli credentials exist, falls back to the static pack with explicit evidence tagging). '
@@ -1501,7 +1660,7 @@ export function apply(ctx, config, seams = {}) {
         description: 'Productized login bootstrap for the account session channel (call this when gotry_session_search returns needs-login — the user never needs a terminal). ' + 'AUTO-DETECTION FIRST: it reads ticket-cookie NAMES before anything else — if the user already logged in (on the external site) it confirms instantly WITHOUT opening any page. '
             + 'OPENS the site login entry in the USER\'S OWN Chrome (foreground tab, left open for the user) and waits for the user to finish logging in on the external site. '
             + 'GoTry NEVER collects, stores, or transmits credentials: no passwords, no SMS codes, no cookie values — it only checks the boolean fact "already logged in" (reads cookie NAMES only, zero values). '
-            + 'Transport: the GoTry Session Bridge browser extension (one-time install, ZERO Chrome system dialogs). '
+            + 'Transport: the Stai Travel Bridge browser extension (one-time install, ZERO Chrome system dialogs). '
             + `verdict logged-in (tickets detected) | pending (login tab opened, user not done yet — offer to re-check later) | needs-extension (one-time extension install: the verdict surfaces the Chrome Web Store installUrl as a clickable link for dsh UI to render — installation is a browser concern, not gotry's). `
             + 'Evidence [会话:<site>-login@ts].',
         // D-30 第三刀(issue #112):query blob → 平铺 typed;全字段可选 → interpretArgs 容忍层
@@ -1521,7 +1680,7 @@ export function apply(ctx, config, seams = {}) {
                 : r.verdict === 'pending'
                     ? `登录入口已在你的 Chrome 打开;请在弹出的标签页里正常登录携程(登录由你在官网完成,不属于 gotry)。完成后说一声"继续",我再确认。gotry 只检查"是否已登录",永不收集你的账号信息。${r.evidence}`
                     : r.verdict === 'needs-extension'
-                        ? `需要一次性安装 GoTry Session Bridge 浏览器扩展:这是浏览器的事,gotry 不弹面板不开剪贴板——请直接在 Chrome 应用商店一键装(add-to-chrome 自动更新)。storeUrl=${EXTENSION_STORE_URL}. 装好即生效,装完后告诉我「重试」即可。${r.evidence}`
+                        ? `需要一次性安装 Stai Travel Bridge 浏览器扩展:这是浏览器的事,gotry 不弹面板不开剪贴板——请直接在 Chrome 应用商店一键装(add-to-chrome 自动更新)。storeUrl=${EXTENSION_STORE_URL}. 装好即生效,装完后告诉我「重试」即可。${r.evidence}`
                         : r.verdict === 'needs-attach'
                             ? `cdp 车道需要一次性开启你 Chrome 的远程调试开关:在你的 Chrome 地址栏打开 chrome://inspect/#remote-debugging 并打开开关,然后说一声"重试"(默认走扩展车道,无需此步)。${r.evidence}`
                             : `登录引导未完成:${r.error ?? '未知原因'} ${r.evidence}`;
@@ -1536,7 +1695,7 @@ export function apply(ctx, config, seams = {}) {
                 : r.verdict === 'pending'
                     ? '等待你在携程页面完成登录'
                     : needsExt
-                        ? '🧩 需装 GoTry Session Bridge 扩展(浏览器商店一键装,自动更新)'
+                        ? '🧩 需装 Stai Travel Bridge 扩展(浏览器商店一键装,自动更新)'
                         : r.verdict ?? '降级';
             const content = [{ type: 'text', text: String(value.summary ?? '') }];
             // needs-extension:把商店 URL 渲成可点链接(浏览器自己当安装器,gotry 不插手)
@@ -1550,7 +1709,7 @@ export function apply(ctx, config, seams = {}) {
         name: 'gotry_session_search',
         description: routed('gotry_session_search', 'Search on the USER\'S OWN browser session (Ctrip kind="flight"(default)/"hotel"; 12306 kind="train" — public query face, no login needed). '
             + 'Consent gate: the FIRST call in a session asks the user via the runtime approval card; once granted it holds for the session, a refusal revokes it for the session (no repeat prompting). '
-            + 'Transport: GoTry Session Bridge browser extension (one-time install) — the agent side never talks to Chrome debugging, ZERO system dialogs; read-only by construction (the extension never issues requests; it only passively forwards the site\'s own search responses; agent NEVER touches credentials/captcha; on captcha it stops and returns challenged). '
+            + 'Transport: Stai Travel Bridge browser extension (one-time install) — the agent side never talks to Chrome debugging, ZERO system dialogs; read-only by construction (the extension never issues requests; it only passively forwards the site\'s own search responses; agent NEVER touches credentials/captcha; on captcha it stops and returns challenged). '
             + 'kind="flight": from/to 中文城市名 + date YYYY-MM-DD — sniffs the site search API for structured options. Evidence [会话:ctrip-flight@ts]. '
             + 'kind="hotel": to=目的地中文, cityId? = the numeric city= in a hotels.ctrip.com list URL (web-search it when the destination is outside the built-in city table), checkIn?/checkOut? (YYYY-MM-DD), adults?; hotel prices are the user\'s real logged-in prices. Evidence [会话:ctrip-hotel@ts]. '
             + 'kind="dida": Dida supplier-portal realtime hotel rates on the employee\'s own logged-in session (hotel-be portal integration line) — no from/to needed; the portal find page\'s own requests are sniffed passively. Rates carry ratePlanId/referenceNo for the server-side booking chain. Evidence [会话:dida-portal@ts]. '
@@ -1729,7 +1888,7 @@ export function apply(ctx, config, seams = {}) {
                 : r.verdict === 'needs-login'
                     ? '需登录'
                     : needsExt
-                        ? '🧩 需装 GoTry Session Bridge 扩展(浏览器商店一键装,自动更新)'
+                        ? '🧩 需装 Stai Travel Bridge 扩展(浏览器商店一键装,自动更新)'
                         : r.verdict ?? '降级';
             const content = [{ type: 'text', text: String(value.summary ?? '') }];
             if (needsExt && r.installUrl)
@@ -2013,7 +2172,7 @@ export function apply(ctx, config, seams = {}) {
     // 统一的状态入口来「显示状态 + 引导补装」,而不是在 not-installed 里各自摸索)----
     registerGuarded(defineTool({
         name: 'gotry_doctor',
-        description: 'Check optional-dependency health for ALL gotry tools (read-only by default). Coverage: GoTry Session Bridge extension / Agent Reach (.venv) / hbcli (hotel realtime) / FlyAI key + recent trial-quota exhaustion time / dsh-calendar mount state / dsh-better-sidebar / dsh-map-tools / dsh-tool-ask-user. '
+        description: 'Check optional-dependency health for ALL gotry tools (read-only by default). Coverage: Stai Travel Bridge extension / Agent Reach (.venv) / hbcli (hotel realtime) / FlyAI key + recent trial-quota exhaustion time / dsh-calendar mount state / dsh-better-sidebar / dsh-map-tools / dsh-tool-ask-user. '
             + 'Call this when ANY gotry tool returns not-installed / needs-setup, when the user asks 「体检/依赖状态/工具为什么不可用」, or BEFORE leaning on a channel for a plan. '
             + 'Returns per-item status (ok/degraded/missing) with exact fix commands. '
             + 'Action=diagnose (default): pure read-only — never installs anything, only renders the report. '

package/dist/src/loop.js

@@ -161,13 +161,18 @@ function terminalOutcomeFromState(ticketId, state) {
             '4_做不到的诚实说': false,
         });
     }
+    // issue #620:求解器自身失败时既没有产物也没有判定——2 条不成立;但「做不到诚实说」
+    // 恰恰成立(我们明说了是引擎故障而非不可行),不靠 unsat_core 冒充自检通过。
+    const solverFailed = Boolean(state.solve.solver_error);
     return asyncTerminalOutcome(ticketId, {
         '1_承诺时间后必有明确产物': Boolean(state.solve.legs?.length || state.solve.verdicts?.length),
-        '2_产物通过自检清单': state.solve.feasible
-            ? (state.solve.legs?.every(l => l['energy_pct'] !== undefined) ?? false)
-            : Boolean(state.solve.unsat_core?.length),
+        '2_产物通过自检清单': solverFailed
+            ? false
+            : state.solve.feasible
+                ? (state.solve.legs?.every(l => l['energy_pct'] !== undefined) ?? false)
+                : Boolean(state.solve.unsat_core?.length),
         '3_待决问题全部是简单选择题': state.gates.every(g => g.id === 'budget' || g.options.length >= 2),
-        '4_做不到的诚实说': state.solve.feasible || Boolean(state.solve.suggestions?.length),
+        '4_做不到的诚实说': solverFailed || state.solve.feasible || Boolean(state.solve.suggestions?.length),
     });
 }
 export function isComplex(state) {
@@ -207,7 +212,13 @@ export function renderSolve(state) {
     if (!s)
         return '(无求解结果)';
     const lines = [];
-    if (s.feasible) {
+    if (s.solver_error) {
+        // issue #620:求解器自己失败 ≠ 行程不可行。这里**不**说「不可行」、不列「冲突」,
+        // 也不把机器 token(solver_error.code)渲染给用户——它只在日志/证据里。
+        lines.push('**这轮没算出结论——求解器自身出错了,不是你的行程不可行**');
+        lines.push('- 我不把引擎故障说成「不可行」:这条已记录,修好或换候选形态(枚举)后重算');
+    }
+    else if (s.feasible) {
         lines.push(`**方案可行,机票合计 ¥${s.money_cny}**`);
         // §7-1 issue #559 卡点 4:从 s.skeleton_notes 字符串编码里推断 unscaffolded 的 seg.id,
         // 不动 unified.ts/journey.ts(内核冻结面 #234),用户面给 ⚠ 前缀与「枢纽对未在骨架覆盖」补充。