@danceiny/gotry 0.2.0-rc.31 → 0.2.0-rc.33

package/dist/capabilities/hbcli.js

@@ -65,6 +65,24 @@ async function attemptHbcli(bin, args, opts) {
         }
         catch { /* 非 JSON 输出,留给调用方处理 */ }
     }
+    // CLI exit status describes the process, not the API verdict. hbcli can exit
+    // zero with an API error envelope (for example an unconfigured supplier pool).
+    const code = result?.code;
+    const invalid = result === null;
+    const upstreamFailure = code !== undefined && code !== 0 && code !== '0';
+    if (invalid || upstreamFailure) {
+        const msg = result?.msg
+            ?? result?.message;
+        const detail = code === 300010002 || code === '300010002'
+            ? '当前账号没有可用供应商；库存查询未完成'
+            : typeof msg === 'string' ? msg.slice(0, 200) : 'API request failed';
+        return {
+            via: 'hbcli-error', exitCode: 0, result: null,
+            evidence: `[实时API:hbcli@error@${ts}]`,
+            stdout: r.stdout.slice(0, 2000), latencyMs,
+            error: invalid ? 'failed to parse hbcli output as JSON' : `hbcli upstream code ${String(code)}: ${detail}`,
+        };
+    }
     return {
         via: 'hbcli-realtime', exitCode: 0, result,
         evidence: `[实时API:hbcli@${ts}]`,
@@ -138,7 +156,7 @@ export async function searchHotels(query, opts = {}) {
         hbArgs.push('--check-out', query.checkOut);
     if (query.adults)
         hbArgs.push('--room-occupancies', JSON.stringify([{ adultCount: query.adults, childrenAges: [] }]));
-    const live = await callHbcliJson(hbArgs, opts);
+    let live = await callHbcliJson(hbArgs, opts);
     // 取消立即结束:不读静态包、不产出命中/无结果/估算,也不计上游故障
     if (opts.signal?.aborted || /abort/i.test(live.error ?? '')) {
         const ts = new Date().toISOString();
@@ -149,6 +167,15 @@ export async function searchHotels(query, opts = {}) {
             latencyMs: live.latencyMs, error: `aborted by host signal${cleanupError}`, summary: `酒店「${query.destination}」检索已取消,未产生事实`,
         };
     }
+    const list = live.result?.list;
+    if (live.via === 'hbcli-realtime' && (!Array.isArray(list)
+        || list.some(item => item === null || typeof item !== 'object' || Array.isArray(item)))) {
+        live = {
+            ...live, via: 'hbcli-error', result: null,
+            evidence: `[实时API:hbcli@error@${new Date().toISOString()}]`,
+            error: 'invalid hotel-list response: expected list array of hotels; inventory not observed',
+        };
+    }
     if (live.via === 'hbcli-realtime') {
         // summary 即模型面(render 只透 summary):必须自带紧凑数据行 + 证据链,
         // 否则模型只看到「实时返回」占位一句话(issue #195 实锤)。
@@ -247,7 +274,7 @@ export async function checkAvail(query, opts = {}) {
  * ~/.staicli/credentials.json)——hbcli 侧 customer 档是最低优先级凭据(无
  * portal/API-key 凭据时才生效),登录不劫持既有凭据。本层不透出 token 值
  * (CLI 只回 token_saved,凭据留在 CLI 仓内,不进 gotry 会话/日志)。
- * auth 命令族要求 hbcli 带 register 支持(npm 0.0.4 起;0.0.3 报 unknown
+ * auth 命令族要求 hbcli 带 register 支持(官方原生 0.0.4 起;0.0.3 报 unknown
  * command,经 hbcli-error 面优雅失败)。
  */
 export async function customerSendCode(email, opts = {}) {

package/dist/capabilities/resilience.js

@@ -108,7 +108,7 @@ export async function withRetry(fn, policy, onBackoff) {
 export class CircuitBreaker {
     o;
     consecutiveFailures = 0;
-    openedAt = 0;
+    openedAt = null;
     generation = 0;
     nextTokenId = 0;
     probeToken = null;
@@ -122,9 +122,9 @@ export class CircuitBreaker {
         return (this.o.now ?? Date.now)();
     }
     state() {
-        if (this.openedAt > 0 && this.now() - this.openedAt >= this.o.openMs)
+        if (this.openedAt !== null && this.now() - this.openedAt >= this.o.openMs)
             return 'half-open';
-        if (this.openedAt > 0)
+        if (this.openedAt !== null)
             return 'open';
         return 'closed';
     }
@@ -134,7 +134,7 @@ export class CircuitBreaker {
         if (s === 'closed')
             return { allowed: true, state: s, token: this.makeToken(false) };
         if (s === 'open')
-            return { allowed: false, state: s };
+            return { allowed: false, state: s, retryAfterMs: Math.max(0, Math.min(this.o.openMs, this.o.openMs - (this.now() - this.openedAt))) };
         // half-open:单探测语义——已有探测在途拒其余并发
         if (this.probeToken)
             return { allowed: false, state: s };
@@ -158,7 +158,7 @@ export class CircuitBreaker {
         if (!this.owns(token))
             return;
         this.consecutiveFailures = 0;
-        this.openedAt = 0;
+        this.openedAt = null;
         if (token?.probe === true || (!token && this.probeToken !== null)) {
             this.probeToken = null;
             this.generation += 1;
@@ -171,7 +171,7 @@ export class CircuitBreaker {
         if (token?.probe === true || (!token && this.probeToken !== null))
             this.probeToken = null;
         this.consecutiveFailures += 1;
-        if (this.openedAt > 0 || this.consecutiveFailures >= this.threshold()) {
+        if (this.openedAt !== null || this.consecutiveFailures >= this.threshold()) {
             this.openedAt = this.now();
             this.generation += 1;
         }

package/dist/capabilities/session/adapters/ctrip-flight.js

@@ -6,23 +6,58 @@
  *     (schema 实测 2026-08-28,见 data-sources.md §8)
  * 只读:适配器不含任何提交/预订语义;URL 直开即零 DOM 交互。
  */
-/** 城市三字码表(小起步集;词表外 unresolved 逐字保留,不做开放式猜测——ADR-12 同款边界) */
-const CITY_CODES = {
+import { resolveCtripFlightCity, cityResolutionHint } from '../ctrip-city.js';
+/**
+ * 离线起步缓存;未命中由编排层查询供应商城市数据(ctrip-city.ts),不推断航线覆盖。
+ * 码表只做性能优化,不在主链路上(显式码/供应商解析是正路)。
+ * 实测校准(2026-10-14):香港=hkg/迪拜=dxb 经 list 页实证——合法组合 HTTP 200 且
+ * title 含航线名(「中国香港(HKG)到迪拜(阿联酋)(DXB)机票预订」),非法组合 302 跳
+ * international/search(该 200/302 判别式即真数据校准手段)。
+ */
+export const CITY_CODES = {
     上海: 'sha', 北京: 'bjs', 广州: 'can', 深圳: 'szx', 成都: 'ctu', 昆明: 'kmg',
     大理: 'dlu', 丽江: 'ljg', 西安: 'sia', 杭州: 'hgh', 三亚: 'syx', 厦门: 'xmn',
     重庆: 'cqg', 青岛: 'taa', 长沙: 'csx', 武汉: 'wuh', 南京: 'nkg', 郑州: 'cgo',
     贵阳: 'kwe', 桂林: 'kwl', 西双版纳: 'jhg', 香格里拉: 'dig',
+    香港: 'hkg', 迪拜: 'dxb',
 };
-export function buildEntryUrl(from, to, depDate) {
+/** Resolve unknown names against current supplier metadata before inventory navigation. */
+export async function resolveFlightEntryUrl(from, to, depDate, codes = {}, resolve = resolveCtripFlightCity, backDate) {
+    if (!/^\d{4}-\d{2}-\d{2}$/.test(depDate))
+        return { ok: false, unresolved: [depDate], error: '出发日期需要 YYYY-MM-DD' };
+    for (const c of [codes.fromCode, codes.toCode])
+        if (c !== undefined && !/^[a-z]{3}$/i.test(c))
+            return { ok: false, error: '城市／机场码必须是三个英文字母' };
+    const resolveCode = async (name, explicit) => {
+        const known = explicit ?? (/^[a-z]{3}$/i.test(name.trim()) ? name.trim() : undefined);
+        if (known)
+            return { code: known };
+        const result = await resolve(name);
+        return result.ok ? { code: result.city.code } : { error: cityResolutionHint(name, result) };
+    };
+    const [origin, destination] = await Promise.all([resolveCode(from, codes.fromCode), resolveCode(to, codes.toCode)]);
+    if (!origin.code || !destination.code)
+        return { ok: false, unresolved: [!origin.code ? from : '', !destination.code ? to : ''].filter(Boolean), error: [origin.error, destination.error].filter(Boolean).join('；') };
+    return buildEntryUrl(from, to, depDate, { fromCode: origin.code, toCode: destination.code }, backDate);
+}
+export function buildEntryUrl(from, to, depDate, codes = {}, backDate) {
     const unresolved = [];
-    const fromCode = CITY_CODES[from];
-    const toCode = CITY_CODES[to];
+    // 显式码优先(形状合格才采纳),词表只是缓存——任何城市都可经显式码成行。
+    const fromCode = codes.fromCode === undefined ? CITY_CODES[from.trim()] : /^[a-z]{3}$/i.test(codes.fromCode) ? codes.fromCode.toLowerCase() : undefined;
+    const toCode = codes.toCode === undefined ? CITY_CODES[to.trim()] : /^[a-z]{3}$/i.test(codes.toCode) ? codes.toCode.toLowerCase() : undefined;
     if (!fromCode)
         unresolved.push(from);
     if (!toCode)
         unresolved.push(to);
-    if (unresolved.length > 0 || !/^\d{4}-\d{2}-\d{2}$/.test(depDate)) {
-        return { ok: false, unresolved: unresolved.length > 0 ? unresolved : [depDate] };
+    const badDate = !/^\d{4}-\d{2}-\d{2}$/.test(depDate)
+        || (backDate !== undefined && (!/^\d{4}-\d{2}-\d{2}$/.test(backDate) || backDate <= depDate));
+    if (unresolved.length > 0 || badDate) {
+        return { ok: false, unresolved: unresolved.length > 0 ? unresolved : [badDate ? (backDate !== undefined && backDate <= depDate ? backDate : depDate) : depDate], ...(backDate !== undefined && backDate <= depDate ? { error: `回程(${backDate})须晚于去程(${depDate})` } : {}) };
+    }
+    // 往返形状(2026-10-14 GUI URL 教师实测定稿):round-{code}0-{code}0?depdate=去_回&cabin=y_s
+    // ——此前 roundtrip-{3字码}?depdate&retdate 的猜测形状实测 302,已废弃。
+    if (backDate) {
+        return { ok: true, url: `https://flights.ctrip.com/online/list/round-${fromCode}0-${toCode}0?depdate=${depDate}_${backDate}&cabin=y_s&adult=1&child=0&infant=0` };
     }
     return { ok: true, url: `https://flights.ctrip.com/online/list/oneway-${fromCode}-${toCode}?depdate=${depDate}` };
 }

package/dist/capabilities/session/adapters/ctrip-hotel.js

@@ -13,10 +13,11 @@
  * 只读:适配器不含任何提交/预订语义;URL 直开即零 DOM 交互;ReadGuard 对酒店
  * 页面照常生效(下单/支付面 URL 仍被物理拦截)。
  */
-/** 城市码表(**实测校准 2026-09-03**:每条 id 均经 hotels.ctrip.com list 页
+import { resolveCtripHotelCity, hotelResolutionHint } from '../ctrip-city.js';
+/** 离线兼容缓存(**实测校准 2026-09-03**:每条 id 均经 hotels.ctrip.com list 页
  * <title> 验证——探测法曾纠出 104=平遥县(传猜成都)等 5 处错猜,表内只收
  * 验证过的 id;词表外 unresolved 逐字保留,调用方可显式传 cityId 覆盖) */
-const HOTEL_CITY_CODES = {
+export const HOTEL_CITY_CODES = {
     上海: '2', 北京: '1', 广州: '32', 深圳: '30', 成都: '28',
     杭州: '17', 南京: '12', 苏州: '14', 无锡: '13', 扬州: '15', 镇江: '16',
     青岛: '7', 厦门: '25', 珠海: '31', 三亚: '43', 海口: '42',
@@ -24,10 +25,22 @@ const HOTEL_CITY_CODES = {
     贵阳: '38', 拉萨: '41', 乌鲁木齐: '39', 太原: '105', 长春: '158', 南通: '82',
     敦煌: '11', 舟山: '19', 张家界: '27', 黄山市: '23', 九江: '24', 武夷山: '26',
     迪拜: '220',
+    // Verified against the official list page and its displayed destination/date
+    // controls on 2026-10-07; https://hotels.ctrip.com/hotels/list?city=5
+    哈尔滨: '5',
 };
+export async function resolveHotelEntryUrl(q, resolve = resolveCtripHotelCity) {
+    if (q.cityId !== undefined)
+        return buildHotelEntryUrl(q);
+    const result = await resolve(q.to, q.country);
+    if (!result.ok)
+        return { ok: false, unresolved: [q.to], error: hotelResolutionHint(q.to, result) };
+    return buildHotelEntryUrl({ ...q, cityId: result.city.id });
+}
 export function buildHotelEntryUrl(q) {
     const unresolved = [];
-    const cityId = String(q.cityId ?? '').trim() || HOTEL_CITY_CODES[q.to.trim()];
+    const candidate = q.cityId === undefined ? HOTEL_CITY_CODES[q.to.trim()] : String(q.cityId).trim();
+    const cityId = candidate && /^[1-9]\d{0,9}$/.test(candidate) ? candidate : undefined;
     if (!cityId)
         unresolved.push(q.to);
     if (unresolved.length > 0) {
@@ -220,3 +233,39 @@ export function parseCtripHotelList(body, opts = {}) {
     walk(raw, 0, new Set());
     return out;
 }
+/** Only an explicit empty hotel array proves a miss; parser failure proves nothing. */
+export function classifyCtripHotelList(body) {
+    let raw;
+    try {
+        raw = JSON.parse(body);
+    }
+    catch {
+        return { shape: 'malformed', hotels: [] };
+    }
+    const envelope = raw;
+    if (envelope?.success === false || envelope?.ok === false
+        || (envelope?.code !== undefined && envelope.code !== 0 && envelope.code !== '0')
+        || /^(failure|error)$/i.test(String(envelope?.ResponseStatus?.Ack ?? ''))) {
+        return { shape: 'unrecognized', hotels: [] };
+    }
+    const hotels = parseCtripHotelList(body);
+    if (hotels.length > 0)
+        return { shape: 'parsed', hotels };
+    let emptyList = false;
+    let unparsedItems = false;
+    const inspectHotelLists = (node, depth) => {
+        if (depth > 12 || node === null || typeof node !== 'object')
+            return;
+        for (const [key, value] of Object.entries(node)) {
+            if (['hotelList', 'hotelMatchInfos'].includes(key) && Array.isArray(value)) {
+                if (value.length === 0)
+                    emptyList = true;
+                else
+                    unparsedItems = true;
+            }
+            inspectHotelLists(value, depth + 1);
+        }
+    };
+    inspectHotelLists(raw, 0);
+    return { shape: emptyList && !unparsedItems ? 'recognized-empty' : 'unrecognized', hotels: [] };
+}

package/dist/capabilities/session/bridge-ledger.js

@@ -16,6 +16,14 @@
  * (活动上下文,非权威事实)经 POST /v1/session/bridge/events 上行落账;
  * idem_key 部分唯一索引(WHERE NOT NULL)让重试幂等:同 key 重发不重复落行。
  *
+ * AaaS A2(#674,威胁 S-5):组织维度。作业/客户端/节律/事件各行都属于恰好一个组织
+ * (`organization` 列,缺省 `local` = 今天的单车道);客户端主键 (organization, client_id)、
+ * 节律主键 (organization, site)、事件幂等唯一索引 (organization, idem_key);
+ * 按作业 id 的更新与查询一律再带组织条件。组织永远是调用方(队列按自己的条目、
+ * 接缝解出的调用者)传入的参数,**绝不来自回包体或请求头**;每个方法先用
+ * assertOrganizationId 校验,非法组织在碰库之前就被拒。旧库(无组织列)在打开时原地迁移,
+ * 既有行归 `local`,迁移是单向的(迁移后旧版本二进制的节律/客户端写会失败)。
+ *
  * 红线继承:本账本只存**控制状态**(job 元数据/回包/节律/客户端能力清单/事件流水),
  * 协议面不存在 cookie 值字段(extension-tests §38 红线断言),账本亦零凭据落库。
  *
@@ -25,6 +33,7 @@
 import Database from 'better-sqlite3';
 import { mkdirSync } from 'node:fs';
 import { dirname, isAbsolute, join } from 'node:path';
+import { assertOrganizationId } from '../../src/tenant-state/ids.js';
 /** 站点节律冷却(毫秒):与 capabilities/session-search.ts 的 MIN_INTERVAL_MS 同口径 30s;导出仅测试/文档锚点 */
 export const BRIDGE_SITE_COOLDOWN_MS = 30_000;
 /** stateRoot 可相对可绝对(与 state-ledger.stateDirOf 同款解析) */
@@ -35,9 +44,27 @@ function stateDirOf(stateRoot) {
 export function bridgeLedgerDbPath(stateRoot) {
     return join(stateDirOf(stateRoot), 'bridge.db');
 }
-const SCHEMA = `
+// 主键含组织的两张表:建表与「旧库重建」共用同一份列定义,两处不会漂移
+const CLIENTS_COLUMNS = `(
+  organization TEXT NOT NULL DEFAULT 'local',
+  client_id TEXT NOT NULL,
+  origin TEXT NOT NULL,
+  capabilities_json TEXT NOT NULL DEFAULT '[]',
+  last_seen_at INTEGER NOT NULL,
+  login_sites_json TEXT NOT NULL DEFAULT '[]',
+  PRIMARY KEY (organization, client_id)
+)`;
+const PACING_COLUMNS = `(
+  organization TEXT NOT NULL DEFAULT 'local',
+  site TEXT NOT NULL,
+  last_hit_at INTEGER NOT NULL,
+  cooldown_until INTEGER NOT NULL DEFAULT 0,
+  PRIMARY KEY (organization, site)
+)`;
+const TABLES = `
 CREATE TABLE IF NOT EXISTS bridge_jobs (
   id TEXT PRIMARY KEY,
+  organization TEXT NOT NULL DEFAULT 'local',
   kind TEXT NOT NULL,
   site TEXT NOT NULL,
   payload_json TEXT NOT NULL,
@@ -51,24 +78,14 @@ CREATE TABLE IF NOT EXISTS bridge_jobs (
   created_at INTEGER NOT NULL,
   updated_at INTEGER NOT NULL
 );
-CREATE INDEX IF NOT EXISTS bridge_jobs_status ON bridge_jobs(status);
 
-CREATE TABLE IF NOT EXISTS bridge_clients (
-  client_id TEXT PRIMARY KEY,
-  origin TEXT NOT NULL,
-  capabilities_json TEXT NOT NULL DEFAULT '[]',
-  last_seen_at INTEGER NOT NULL,
-  login_sites_json TEXT NOT NULL DEFAULT '[]'
-);
+CREATE TABLE IF NOT EXISTS bridge_clients ${CLIENTS_COLUMNS};
 
-CREATE TABLE IF NOT EXISTS bridge_pacing (
-  site TEXT PRIMARY KEY,
-  last_hit_at INTEGER NOT NULL,
-  cooldown_until INTEGER NOT NULL DEFAULT 0
-);
+CREATE TABLE IF NOT EXISTS bridge_pacing ${PACING_COLUMNS};
 
 CREATE TABLE IF NOT EXISTS bridge_events (
   seq INTEGER PRIMARY KEY AUTOINCREMENT,
+  organization TEXT NOT NULL DEFAULT 'local',
   ts INTEGER NOT NULL,
   client_id TEXT NOT NULL,
   kind TEXT NOT NULL,
@@ -77,13 +94,62 @@ CREATE TABLE IF NOT EXISTS bridge_events (
   payload_json TEXT NOT NULL,
   idem_key TEXT
 );
-CREATE UNIQUE INDEX IF NOT EXISTS bridge_events_idem_key
-  ON bridge_events(idem_key) WHERE idem_key IS NOT NULL;
 `;
+// 索引在迁移之后建:旧库的 bridge_events 在迁移前还没有 organization 列
+const INDEXES = `
+CREATE INDEX IF NOT EXISTS bridge_jobs_status ON bridge_jobs(status);
+CREATE UNIQUE INDEX IF NOT EXISTS bridge_events_org_idem_key
+  ON bridge_events(organization, idem_key) WHERE idem_key IS NOT NULL;
+`;
+const ORGANIZATION_TABLES = ['bridge_jobs', 'bridge_clients', 'bridge_pacing', 'bridge_events'];
+function hasOrganizationColumn(db, table) {
+    return db.pragma(`table_info(${table})`).some((column) => column.name === 'organization');
+}
+/**
+ * 旧库(组织维度之前)原地迁移:jobs/events 加列,clients/pacing 因主键含组织而重建;
+ * 既有行一律归 `local`。整段在一个 IMMEDIATE 事务里,拿到写锁后重新判定哪些表还需要迁移
+ * (并发打开同一个库的另一连接可能已迁完),所以幂等且无半迁移状态。
+ */
+function migrateOrganizationDimension(db) {
+    const pending = () => ORGANIZATION_TABLES.filter((table) => !hasOrganizationColumn(db, table));
+    if (pending().length > 0)
+        migrateTables(db, pending);
+    // The single-column unique index on idem_key of the legacy schema would make two organizations' identical keys refuse each
+    // other (the per-organization one replaces it). An older binary recreates it every time it opens the file, so a file that
+    // went new, old, new has nothing left to migrate and still holds it. Drop it on every open (a no-op when absent).
+    if (hasIndex(db, 'bridge_events_idem_key'))
+        db.transaction(() => { db.exec('DROP INDEX IF EXISTS bridge_events_idem_key'); }).immediate();
+}
+function hasIndex(db, name) {
+    return db.prepare("SELECT 1 FROM sqlite_master WHERE type='index' AND name=?").get(name) !== undefined;
+}
+function migrateTables(db, pending) {
+    db.transaction(() => {
+        for (const table of pending()) {
+            if (table === 'bridge_jobs' || table === 'bridge_events') {
+                db.exec(`ALTER TABLE ${table} ADD COLUMN organization TEXT NOT NULL DEFAULT 'local'`);
+                continue;
+            }
+            db.exec(`ALTER TABLE ${table} RENAME TO ${table}__legacy`);
+            if (table === 'bridge_clients') {
+                db.exec(`CREATE TABLE bridge_clients ${CLIENTS_COLUMNS}`);
+                db.exec(`INSERT INTO bridge_clients (organization, client_id, origin, capabilities_json, last_seen_at, login_sites_json)
+          SELECT 'local', client_id, origin, capabilities_json, last_seen_at, login_sites_json FROM bridge_clients__legacy`);
+            }
+            else {
+                db.exec(`CREATE TABLE bridge_pacing ${PACING_COLUMNS}`);
+                db.exec(`INSERT INTO bridge_pacing (organization, site, last_hit_at, cooldown_until)
+          SELECT 'local', site, last_hit_at, cooldown_until FROM bridge_pacing__legacy`);
+            }
+            db.exec(`DROP TABLE ${table}__legacy`);
+        }
+    }).immediate();
+}
 /**
  * SQLite 落地的桥作业账本(实现 extension-bridge.BridgeJobStore 契约)。
  * 所有写方法单语句/单事务同步提交;调用方(extension-bridge)负责失败兜底
  * (write-before-submit 的 INSERT 失败 = 提交失败,fail-closed 不入队)。
+ * 组织是每个方法的第一个参数且必填:漏传是编译错误,不是静默落进 `local`。
  */
 export class BridgeLedgerStore {
     dbPath;
@@ -95,62 +161,79 @@ export class BridgeLedgerStore {
         mkdirSync(dirname(dbPath), { recursive: true });
         this.db = new Database(dbPath);
         this.db.pragma('journal_mode = WAL');
+        // Opening a legacy file needs the write lock once (migration, index changes). A rolling deploy can have the old process
+        // writing through it, so the open waits longer than a normal write does and then drops back.
+        this.db.pragma('busy_timeout = 30000');
+        this.db.exec(TABLES);
+        migrateOrganizationDimension(this.db);
+        this.db.exec(INDEXES);
         this.db.pragma('busy_timeout = 5000');
-        this.db.exec(SCHEMA);
     }
     /** write-before-submit:入队前先落 queued(提交失败 = 调用方不得派发) */
-    insertQueuedJob(job, timeoutAt) {
+    insertQueuedJob(organization, job, timeoutAt) {
+        const org = assertOrganizationId(organization);
         const ts = this.now();
-        this.db.prepare(`INSERT INTO bridge_jobs (id, kind, site, payload_json, status, timeout_at, attempts, created_at, updated_at)
-       VALUES (@id, @kind, @site, @payload, 'queued', @timeoutAt, 0, @ts, @ts)`).run({ id: job.jobId, kind: job.kind, site: job.site, payload: JSON.stringify(job), timeoutAt, ts });
+        this.db.prepare(`INSERT INTO bridge_jobs (id, organization, kind, site, payload_json, status, timeout_at, attempts, created_at, updated_at)
+       VALUES (@id, @organization, @kind, @site, @payload, 'queued', @timeoutAt, 0, @ts, @ts)`).run({ id: job.jobId, organization: org, kind: job.kind, site: job.site, payload: JSON.stringify(job), timeoutAt, ts });
     }
     /** 领取(/jobs 派发与 dispatchToParked 两处):claimed + 领取者 + attempts 递增 */
-    markClaimed(jobId, claim) {
+    markClaimed(organization, jobId, claim) {
+        const org = assertOrganizationId(organization);
         const ts = this.now();
         this.db.prepare(`UPDATE bridge_jobs
        SET status='claimed', claimed_by_client=@client, claimed_origin=@origin, claimed_at=@ts, attempts=attempts+1, updated_at=@ts
-       WHERE id=@id`).run({ id: jobId, client: claim.clientId ?? null, origin: claim.origin, ts });
+       WHERE id=@id AND organization=@organization`).run({ id: jobId, organization: org, client: claim.clientId ?? null, origin: claim.origin, ts });
     }
-    markResolved(jobId, result) {
-        this.db.prepare(`UPDATE bridge_jobs SET status='resolved', result_json=@result, updated_at=@ts WHERE id=@id`).run({ id: jobId, result: JSON.stringify(result), ts: this.now() });
+    markResolved(organization, jobId, result) {
+        const org = assertOrganizationId(organization);
+        this.db.prepare(`UPDATE bridge_jobs SET status='resolved', result_json=@result, updated_at=@ts WHERE id=@id AND organization=@organization`).run({ id: jobId, organization: org, result: JSON.stringify(result), ts: this.now() });
     }
-    markUnresolved(jobId, note) {
+    markUnresolved(organization, jobId, note) {
+        const org = assertOrganizationId(organization);
         const result = note ? JSON.stringify({ ok: false, reason: note.reason }) : null;
-        this.db.prepare(`UPDATE bridge_jobs SET status='unresolved', result_json=@result, updated_at=@ts WHERE id=@id`).run({ id: jobId, result, ts: this.now() });
+        this.db.prepare(`UPDATE bridge_jobs SET status='unresolved', result_json=@result, updated_at=@ts WHERE id=@id AND organization=@organization`).run({ id: jobId, organization: org, result, ts: this.now() });
     }
-    markVoid(jobId) {
-        this.db.prepare(`UPDATE bridge_jobs SET status='void', updated_at=@ts WHERE id=@id`).run({ id: jobId, ts: this.now() });
+    markVoid(organization, jobId) {
+        const org = assertOrganizationId(organization);
+        this.db.prepare(`UPDATE bridge_jobs SET status='void', updated_at=@ts WHERE id=@id AND organization=@organization`).run({ id: jobId, organization: org, ts: this.now() });
     }
     /**
      * 孤儿回包落库(对账面):未知 jobId 的回包内容以 status='unresolved' 保留。
-     *  - 无行(纯未知/探测回包):插 kind 取回包自报(缺省 'orphan'),site='unknown';
+     *  - 无行(纯未知/探测回包):插 kind 取回包自报(缺省 'orphan'),site='unknown',归调用方组织;
      *  - 已 resolved:迟到回包不覆盖已决结果(幂等,首次裁决为准);
-     *  - unresolved/void:补 result_json——作废/超时后扩展其实跑完了,留证供对账。
+     *  - unresolved/void:补 result_json——作废/超时后扩展其实跑完了,留证供对账;
+     *  - 该 jobId 已属于**另一个组织**:拒绝(抛错,零写入)。队列在调用前就按组织拦下并答
+     *    与未知作业完全一样的 404,这里是第二道防线。
      */
-    recordOrphanResult(jobId, result) {
-        const existing = this.getJob(jobId);
+    recordOrphanResult(organization, jobId, result) {
+        const org = assertOrganizationId(organization);
+        const existing = this.db.prepare(`SELECT organization, status FROM bridge_jobs WHERE id=@id`).get({ id: jobId });
         const ts = this.now();
         const resultJson = JSON.stringify(result);
         if (!existing) {
-            this.db.prepare(`INSERT INTO bridge_jobs (id, kind, site, payload_json, status, result_json, attempts, created_at, updated_at)
-         VALUES (@id, @kind, 'unknown', '{}', 'unresolved', @result, 0, @ts, @ts)`).run({ id: jobId, kind: result.kind ?? 'orphan', result: resultJson, ts });
+            this.db.prepare(`INSERT INTO bridge_jobs (id, organization, kind, site, payload_json, status, result_json, attempts, created_at, updated_at)
+         VALUES (@id, @organization, @kind, 'unknown', '{}', 'unresolved', @result, 0, @ts, @ts)`).run({ id: jobId, organization: org, kind: result.kind ?? 'orphan', result: resultJson, ts });
             return;
         }
+        if (existing.organization !== org)
+            throw new Error('bridge-job-organization-mismatch');
         if (existing.status === 'resolved')
             return;
-        this.db.prepare(`UPDATE bridge_jobs SET status='unresolved', result_json=@result, updated_at=@ts WHERE id=@id`).run({ id: jobId, result: resultJson, ts });
+        this.db.prepare(`UPDATE bridge_jobs SET status='unresolved', result_json=@result, updated_at=@ts WHERE id=@id AND organization=@organization`).run({ id: jobId, organization: org, result: resultJson, ts });
     }
     /** bridge_clients upsert:/jobs 轮询体(clientId + capabilities)到达即刷新,login_sites 保序合并 */
-    upsertClient(clientId, origin, capabilities) {
+    upsertClient(organization, clientId, origin, capabilities) {
+        const org = assertOrganizationId(organization);
         const ts = this.now();
-        this.db.prepare(`INSERT INTO bridge_clients (client_id, origin, capabilities_json, last_seen_at, login_sites_json)
-       VALUES (@clientId, @origin, @caps, @ts, '[]')
-       ON CONFLICT(client_id) DO UPDATE SET
-         origin=excluded.origin, capabilities_json=excluded.capabilities_json, last_seen_at=excluded.last_seen_at`).run({ clientId, origin, caps: JSON.stringify([...capabilities]), ts });
+        this.db.prepare(`INSERT INTO bridge_clients (organization, client_id, origin, capabilities_json, last_seen_at, login_sites_json)
+       VALUES (@organization, @clientId, @origin, @caps, @ts, '[]')
+       ON CONFLICT(organization, client_id) DO UPDATE SET
+         origin=excluded.origin, capabilities_json=excluded.capabilities_json, last_seen_at=excluded.last_seen_at`).run({ organization: org, clientId, origin, caps: JSON.stringify([...capabilities]), ts });
     }
     /** cookie-names 命中票据名(名字级)→ 该客户端在该站点持有登录态 */
-    recordClientLoginSite(clientId, site) {
-        const row = this.db.prepare(`SELECT login_sites_json FROM bridge_clients WHERE client_id=?`).get(clientId);
+    recordClientLoginSite(organization, clientId, site) {
+        const org = assertOrganizationId(organization);
+        const row = this.db.prepare(`SELECT login_sites_json FROM bridge_clients WHERE organization=@organization AND client_id=@clientId`).get({ organization: org, clientId });
         if (!row)
             return;
         let sites;
@@ -162,57 +245,75 @@ export class BridgeLedgerStore {
         }
         const merged = new Set(Array.isArray(sites) ? sites.filter((s) => typeof s === 'string') : []);
         merged.add(site);
-        this.db.prepare(`UPDATE bridge_clients SET login_sites_json=@sites WHERE client_id=@clientId`).run({ clientId, sites: JSON.stringify([...merged]) });
+        this.db.prepare(`UPDATE bridge_clients SET login_sites_json=@sites WHERE organization=@organization AND client_id=@clientId`).run({ organization: org, clientId, sites: JSON.stringify([...merged]) });
     }
-    /** 站点导航类作业提交/领取:记命中时刻并把冷却推到 now+30s(不回退既有冷却) */
-    noteSiteHit(site) {
+    /** 站点导航类作业提交/领取:记命中时刻并把冷却推到 now+30s(不回退既有冷却);节律按 组织+站点 */
+    noteSiteHit(organization, site) {
+        const org = assertOrganizationId(organization);
         const ts = this.now();
-        this.db.prepare(`INSERT INTO bridge_pacing (site, last_hit_at, cooldown_until) VALUES (@site, @ts, @until)
-       ON CONFLICT(site) DO UPDATE SET last_hit_at=excluded.last_hit_at, cooldown_until=MAX(cooldown_until, excluded.cooldown_until)`).run({ site, ts, until: ts + BRIDGE_SITE_COOLDOWN_MS });
+        this.db.prepare(`INSERT INTO bridge_pacing (organization, site, last_hit_at, cooldown_until) VALUES (@organization, @site, @ts, @until)
+       ON CONFLICT(organization, site) DO UPDATE SET last_hit_at=excluded.last_hit_at, cooldown_until=MAX(cooldown_until, excluded.cooldown_until)`).run({ organization: org, site, ts, until: ts + BRIDGE_SITE_COOLDOWN_MS });
     }
     /** 超时结算冷却:claimed 超时的导航作业——站点可能已被打,只推冷却,不虚构 last_hit_at */
-    applyCooldown(site) {
+    applyCooldown(organization, site) {
+        const org = assertOrganizationId(organization);
         const ts = this.now();
-        this.db.prepare(`INSERT INTO bridge_pacing (site, last_hit_at, cooldown_until) VALUES (@site, @ts, @until)
-       ON CONFLICT(site) DO UPDATE SET cooldown_until=MAX(cooldown_until, excluded.cooldown_until)`).run({ site, ts, until: ts + BRIDGE_SITE_COOLDOWN_MS });
+        this.db.prepare(`INSERT INTO bridge_pacing (organization, site, last_hit_at, cooldown_until) VALUES (@organization, @site, @ts, @until)
+       ON CONFLICT(organization, site) DO UPDATE SET cooldown_until=MAX(cooldown_until, excluded.cooldown_until)`).run({ organization: org, site, ts, until: ts + BRIDGE_SITE_COOLDOWN_MS });
     }
-    pacingOf(site) {
-        const row = this.db.prepare(`SELECT last_hit_at, cooldown_until FROM bridge_pacing WHERE site=?`).get(site);
+    pacingOf(organization, site) {
+        const org = assertOrganizationId(organization);
+        const row = this.db.prepare(`SELECT last_hit_at, cooldown_until FROM bridge_pacing WHERE organization=@organization AND site=@site`).get({ organization: org, site });
         return row ? { lastHitAt: row.last_hit_at, cooldownUntil: row.cooldown_until } : null;
     }
     /**
      * 事件上行落账(批次 B):seq 由 AUTOINCREMENT 分配,ts 取服务端落账时刻
      * (clientTs 是扩展侧时钟,仅参与形状校验不入列——服务端时钟才是账本唯一时间轴)。
-     * 幂等:idem_key 非空且已存在 → 不重复落行,返回 false(由调用方计入 rejected);
-     * idem_key 为 NULL 的行不参与去重,多行共存(部分唯一索引)。
-     * 同进程同步 API,check-then-insert 对本连接原子。
+     * 幂等:idem_key 非空且**同组织**已存在 → 不重复落行,返回 false(由调用方计入 rejected);
+     * 不同组织可以复用同一个 idem_key,互不去重。idem_key 为 NULL 的行不参与去重,多行共存
+     * (部分唯一索引)。同进程同步 API,check-then-insert 对本连接原子。
      */
-    insertEvent(ev) {
+    insertEvent(organization, ev) {
+        const org = assertOrganizationId(organization);
         if (ev.idem_key !== null) {
-            const dup = this.db.prepare(`SELECT 1 FROM bridge_events WHERE idem_key=?`).get(ev.idem_key);
+            const dup = this.db.prepare(`SELECT 1 FROM bridge_events WHERE organization=@organization AND idem_key=@idem`).get({ organization: org, idem: ev.idem_key });
             if (dup)
                 return false;
         }
-        this.db.prepare(`INSERT INTO bridge_events (ts, client_id, kind, site, subject, payload_json, idem_key)
-       VALUES (@ts, @clientId, @kind, @site, @subject, @payload, @idem)`).run({ ts: this.now(), clientId: ev.client_id, kind: ev.kind, site: ev.site, subject: ev.subject, payload: ev.payload_json, idem: ev.idem_key });
+        this.db.prepare(`INSERT INTO bridge_events (organization, ts, client_id, kind, site, subject, payload_json, idem_key)
+       VALUES (@organization, @ts, @clientId, @kind, @site, @subject, @payload, @idem)`).run({ organization: org, ts: this.now(), clientId: ev.client_id, kind: ev.kind, site: ev.site, subject: ev.subject, payload: ev.payload_json, idem: ev.idem_key });
         return true;
     }
-    /** 事件流水读面(测试/对账):按 seq 升序 */
-    listEvents() {
-        return this.db.prepare(`SELECT seq, ts, client_id, kind, site, subject, payload_json, idem_key FROM bridge_events ORDER BY seq`).all();
+    /** 事件流水读面(测试/对账):某组织的行,按 seq 升序 */
+    listEvents(organization) {
+        const org = assertOrganizationId(organization);
+        return this.db.prepare(`SELECT seq, organization, ts, client_id, kind, site, subject, payload_json, idem_key FROM bridge_events WHERE organization=@organization ORDER BY seq`).all({ organization: org });
     }
+    /** 全部组织的未终态作业(开机恢复按行还原所属组织) */
     listPendingJobs() {
-        return this.db.prepare(`SELECT id, kind, site, payload_json, status, claimed_by_client, claimed_origin, timeout_at, attempts
+        return this.db.prepare(`SELECT id, organization, kind, site, payload_json, status, claimed_by_client, claimed_origin, timeout_at, attempts
        FROM bridge_jobs WHERE status IN ('queued','claimed')`).all();
     }
+    /** 按 jobId 读行(任何组织;测试/对账口径,行里带 organization)。调用方有组织时用 getJobForOrganization */
     getJob(jobId) {
         return this.db.prepare(`SELECT * FROM bridge_jobs WHERE id=?`).get(jobId) ?? null;
     }
-    getClient(clientId) {
-        return this.db.prepare(`SELECT * FROM bridge_clients WHERE client_id=?`).get(clientId) ?? null;
+    getJobForOrganization(organization, jobId) {
+        const org = assertOrganizationId(organization);
+        return this.db.prepare(`SELECT * FROM bridge_jobs WHERE id=@id AND organization=@organization`).get({ id: jobId, organization: org }) ?? null;
+    }
+    /** 该 jobId 属于哪个组织(账本里没有这行 = null);队列用它认出「别的组织的作业」 */
+    organizationOfJob(jobId) {
+        const row = this.db.prepare(`SELECT organization FROM bridge_jobs WHERE id=?`).get(jobId);
+        return row ? row.organization : null;
+    }
+    getClient(organization, clientId) {
+        const org = assertOrganizationId(organization);
+        return this.db.prepare(`SELECT * FROM bridge_clients WHERE organization=@organization AND client_id=@clientId`).get({ organization: org, clientId }) ?? null;
     }
-    listPacing() {
-        return this.db.prepare(`SELECT site, last_hit_at, cooldown_until FROM bridge_pacing ORDER BY site`).all();
+    listPacing(organization) {
+        const org = assertOrganizationId(organization);
+        return this.db.prepare(`SELECT organization, site, last_hit_at, cooldown_until FROM bridge_pacing WHERE organization=@organization ORDER BY site`).all({ organization: org });
     }
     close() {
         this.db.close();