@gracker/smartperfetto 1.0.13

package/skills/composite/anr_analysis.skill.yaml

@@ -0,0 +1,889 @@
+# SPDX-License-Identifier: AGPL-3.0-or-later
+# Copyright (C) 2024-2026 Gracker (Chris)
+# This file is part of SmartPerfetto. See LICENSE for details.
+
+# =============================================================================
+# ANR 分析 v3.0（组合 Skill）- 基于三篇专业文章重构
+# =============================================================================
+# 核心原则：
+# 1. 先定性再定量 - 首先判断是系统问题还是应用问题
+# 2. 分类处理 - 不同 ANR 类型使用不同分析路径
+# 3. 优雅降级 - 数据缺失时仍能完成部分分析
+#
+# ANR 类型：
+# - INPUT_DISPATCHING_TIMEOUT: 输入超时（5s 无响应）
+# - BROADCAST_OF_INTENT: 广播超时（前台10s/后台60s）
+# - EXECUTING_SERVICE: 服务执行超时（前台20s/后台200s）
+# - CONTENT_PROVIDER_NOT_RESPONDING: ContentProvider 超时
+# - NO_FOCUSED_WINDOW: 无焦点窗口（特殊情况）
+#
+# 分析流程：
+# 1. 系统健康检查 → 判断系统 vs 应用问题
+# 2. ANR 概览 → 分类统计
+# 3. 逐个 ANR 详细分析 → 主线程状态/Binder/死锁
+# 4. 诊断规则 → 自动识别问题模式
+# 5. AI 总结 → 专业根因分析
+
+name: anr_analysis
+version: "1.0"
+type: composite
+category: app_lifecycle
+tier: S
+
+meta:
+  display_name: "ANR 分析"
+  description: "检测和分析应用程序无响应 (ANR) 事件"
+  icon: "error"
+  tags: [anr, freeze, composite]
+
+triggers:
+  keywords:
+    zh: [ANR, 无响应, 卡死, 超时, 广播超时, 输入超时, 服务超时, 应用无响应]
+    en: [ANR, not responding, timeout, broadcast timeout, input timeout, application hang]
+  patterns:
+    - ".*ANR.*"
+    - ".*无响应.*"
+    - ".*timeout.*"
+    - ".*卡死.*"
+
+prerequisites:
+  modules:
+    - android.anrs
+    - android.binder
+    - android.memory.lmk
+
+inputs:
+  - name: process_name
+    type: string
+    required: false
+    description: "目标进程名，留空分析所有 ANR"
+  - name: package
+    type: string
+    required: false
+    description: "应用包名（process_name 的别名）"
+  - name: anr_type
+    type: string
+    required: false
+    description: "ANR 类型过滤"
+  - name: multi_anr_threshold
+    type: number
+    required: false
+    default: 3
+    description: "多 ANR 系统级问题阈值"
+  - name: multi_anr_span_seconds
+    type: number
+    required: false
+    default: 10
+    description: "多 ANR 时间窗口（秒）"
+  - name: io_wait_threshold_ms
+    type: number
+    required: false
+    default: 500
+    description: "IO 等待告警阈值（ms）"
+  - name: enable_lock_probe
+    type: boolean
+    required: false
+    default: true
+    description: "是否启用锁等待探针（futex/mutex）"
+  - name: lock_contention_futex_p95_critical_ms
+    type: number
+    required: false
+    default: 20
+    description: "Futex P95 严重锁竞争阈值（ms）"
+  - name: lock_contention_mutex_p95_warning_ms
+    type: number
+    required: false
+    default: 10
+    description: "Mutex P95 锁等待告警阈值（ms）"
+
+steps:
+  # ============================================================================
+  # 第零阶段：提取 ANR 上下文（供后续步骤复用）
+  # ============================================================================
+
+  - id: init_cpu_topology
+    type: skill
+    name: "初始化 CPU 拓扑"
+    skill: cpu_topology_view
+    display:
+      level: hidden
+    optional: true
+
+  - id: get_anr_context
+    type: skill
+    name: "提取 ANR 上下文"
+    skill: anr_context_in_range
+    params:
+      process_name: "${process_name}"
+      package: "${package}"
+    save_as: anr_ctx
+    display:
+      level: hidden
+    optional: true
+
+  # ============================================================================
+  # 第一阶段：系统健康检查（先定性）
+  # ============================================================================
+
+  # Step 1.1: 检测 ANR 是否存在
+  - id: anr_detection
+    type: atomic
+    name: "ANR 检测"
+    display:
+      level: key
+      layer: overview
+      title: "ANR 检测"
+      columns:
+        - name: total_anr_count
+          label: "ANR 总数"
+          type: number
+        - name: affected_process_count
+          label: "受影响进程数"
+          type: number
+        - name: first_anr_ts
+          label: "首次 ANR"
+          type: timestamp
+          clickAction: navigate_timeline
+        - name: last_anr_ts
+          label: "末次 ANR"
+          type: timestamp
+          clickAction: navigate_timeline
+        - name: anr_span_seconds
+          label: "时间跨度(秒)"
+          type: number
+          format: compact
+    synthesize:
+      role: overview
+      fields:
+        - key: total_anr_count
+          label: ANR 总数
+        - key: affected_process_count
+          label: 受影响进程数
+        - key: anr_span_seconds
+          label: ANR 时间跨度
+          format: "{{value}} 秒"
+      insights:
+        - condition: "total_anr_count === 0"
+          template: "未检测到 ANR 事件"
+        - condition: "total_anr_count > 0 && total_anr_count <= 3"
+          template: "检测到 {{total_anr_count}} 个 ANR 事件，影响 {{affected_process_count}} 个进程"
+        - condition: "total_anr_count > 3"
+          template: "⚠️ 检测到 {{total_anr_count}} 个 ANR，可能是系统级问题"
+    sql: |
+      SELECT
+        COUNT(*) as total_anr_count,
+        COUNT(DISTINCT process_name) as affected_process_count,
+        MIN(ts) as first_anr_ts,
+        MAX(ts) as last_anr_ts,
+        ROUND((MAX(ts) - MIN(ts)) / 1e9, 2) as anr_span_seconds
+      FROM android_anrs
+      WHERE (process_name GLOB '${process_name}*' OR process_name GLOB '${package}*' OR ('${process_name}' = '' AND '${package}' = ''))
+        AND (anr_type = '${anr_type}' OR '${anr_type}' = '')
+    save_as: detection
+    optional: true
+    on_empty: "未检测到 ANR 事件。请确认 Trace 包含 ANR 数据。"
+
+  # Step 1.2: 系统 CPU 负载（判断系统繁忙程度）
+  - id: system_cpu_health
+    type: atomic
+    name: "系统 CPU 健康状况"
+    display:
+      level: key
+      layer: overview
+      title: "系统 CPU 状况"
+      columns:
+        - name: core_type
+          label: "核心类型"
+          type: string
+        - name: core_count
+          label: "核心数"
+          type: number
+        - name: total_active_ms
+          label: "活跃时间"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: avg_util_pct
+          label: "平均利用率"
+          type: percentage
+          format: percentage
+        - name: status
+          label: "状态"
+          type: string
+    synthesize:
+      role: overview
+      fields:
+        - key: core_type
+          label: 核心类型
+        - key: avg_util_pct
+          label: 平均利用率
+          format: "{{value}}%"
+        - key: status
+          label: 状态
+      insights:
+        - condition: "status === 'overloaded'"
+          template: "⚠️ {{core_type}} 核心过载 ({{avg_util_pct}}%)，系统繁忙"
+        - condition: "status === 'busy'"
+          template: "{{core_type}} 核心较忙 ({{avg_util_pct}}%)"
+        - condition: "status === 'normal'"
+          template: "{{core_type}} 核心负载正常 ({{avg_util_pct}}%)"
+    sql: |
+      WITH cpu_info AS (
+        SELECT cpu_id as cpu, core_type
+        FROM _cpu_topology
+      ),
+      cpu_time AS (
+        SELECT
+          ss.cpu,
+          COALESCE(c.core_type, 'unknown') as core_type,
+          SUM(
+            CASE
+              WHEN ss.ts < ${anr_ctx.data[0].anr_ts} AND ss.ts + ss.dur > ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+              THEN MIN(ss.ts + ss.dur, ${anr_ctx.data[0].anr_ts}) - MAX(ss.ts, ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns})
+              ELSE 0
+            END
+          ) as active_ns
+        FROM sched_slice ss
+        LEFT JOIN cpu_info c ON ss.cpu = c.cpu
+        WHERE ss.ts < ${anr_ctx.data[0].anr_ts}
+          AND ss.ts + ss.dur > ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+        GROUP BY ss.cpu
+      ),
+      totals AS (
+        SELECT
+          core_type,
+          COUNT(*) as core_count,
+          SUM(active_ns) as total_active_ns,
+          ${anr_ctx.data[0].timeout_ns} as window_ns
+        FROM cpu_time
+        GROUP BY core_type
+      )
+      SELECT
+        core_type,
+        core_count,
+        ROUND(total_active_ns / 1e6, 2) as total_active_ms,
+        ROUND(100.0 * total_active_ns / (window_ns * core_count), 1) as avg_util_pct,
+        CASE
+          WHEN 100.0 * total_active_ns / (window_ns * core_count) > 90 THEN 'overloaded'
+          WHEN 100.0 * total_active_ns / (window_ns * core_count) > 70 THEN 'busy'
+          ELSE 'normal'
+        END as status
+      FROM totals
+      ORDER BY core_type DESC
+    save_as: cpu_health
+    condition: detection.data[0]?.total_anr_count > 0
+    optional: true
+
+  # Step 1.3: 系统内存压力检测（LMK 事件）
+  - id: memory_pressure
+    type: atomic
+    name: "内存压力检测"
+    display:
+      level: detail
+      layer: list
+      title: "内存压力"
+      columns:
+        - name: oom_score_adj
+          label: "OOM Score"
+          type: number
+        - name: kill_count
+          label: "Kill 次数"
+          type: number
+          format: compact
+        - name: killed_processes
+          label: "被杀进程"
+          type: string
+    sql: |
+      SELECT
+        oom_score_adj,
+        COUNT(*) as kill_count,
+        GROUP_CONCAT(DISTINCT process_name) as killed_processes
+      FROM android_lmk_events
+      WHERE ts >= ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+        AND ts <= ${anr_ctx.data[0].anr_ts}
+      GROUP BY oom_score_adj
+      ORDER BY kill_count DESC
+    save_as: memory_pressure
+    condition: detection.data[0]?.total_anr_count > 0
+    optional: true
+
+  # Step 1.4: IO 负载检测
+  - id: io_load
+    type: atomic
+    name: "IO 负载检测"
+    display:
+      level: detail
+      layer: list
+      title: "IO 负载"
+      columns:
+        - name: process_name
+          label: "进程名"
+          type: string
+        - name: io_wait_ms
+          label: "IO 等待"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: io_wait_count
+          label: "等待次数"
+          type: number
+          format: compact
+    sql: |
+      WITH io_states AS (
+        SELECT
+          p.name as process_name,
+          SUM(CASE WHEN ts.state = 'D' THEN ts.dur ELSE 0 END) as io_wait_ns,
+          COUNT(CASE WHEN ts.state = 'D' THEN 1 END) as io_wait_count
+        FROM thread_state ts
+        JOIN thread t ON ts.utid = t.utid
+        JOIN process p ON t.upid = p.upid
+        WHERE ts.ts >= ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+          AND ts.ts < ${anr_ctx.data[0].anr_ts}
+          AND ts.state = 'D'
+        GROUP BY p.name
+      )
+      SELECT
+        process_name,
+        ROUND(io_wait_ns / 1e6, 2) as io_wait_ms,
+        io_wait_count
+      FROM io_states
+      WHERE io_wait_ns > 10000000  -- > 10ms
+      ORDER BY io_wait_ns DESC
+      LIMIT 10
+    save_as: io_load
+    condition: detection.data[0]?.total_anr_count > 0
+    optional: true
+
+  # Step 1.4b: 锁等待分布（性能专家探针）
+  # 使用 ANR 前 timeout 窗口，定位 futex/mutex 竞争是否是主因。
+  - id: futex_wait_probe
+    type: skill
+    name: "ANR 锁等待探针"
+    skill: futex_wait_distribution
+    params:
+      package: "${package || process_name || anr_ctx.data?.[0]?.process_name || ''}"
+      start_ts: "${anr_ctx.data?.[0]?.anr_ts != null && anr_ctx.data?.[0]?.timeout_ns != null ? (Number(anr_ctx.data[0].anr_ts) - Number(anr_ctx.data[0].timeout_ns)) : null}"
+      end_ts: "${anr_ctx.data?.[0]?.anr_ts ?? null}"
+    display:
+      level: detail
+      layer: list
+      title: "ANR 窗口锁等待分布（专家探针）"
+      columns:
+        - name: wait_type
+          label: "等待类型"
+          type: string
+        - name: events
+          label: "事件数"
+          type: number
+        - name: avg_wait_ms
+          label: "平均等待"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: p95_wait_ms
+          label: "P95 等待"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: max_wait_ms
+          label: "最大等待"
+          type: duration
+          format: duration_ms
+          unit: ms
+    save_as: lock_waits
+    condition: "detection.data[0]?.total_anr_count > 0 && enable_lock_probe !== false"
+    optional: true
+
+  # Step 1.5: 系统冻结检测（所有应用都卡住）
+  - id: system_freeze_check
+    type: atomic
+    name: "系统冻结检测"
+    display:
+      level: key
+      layer: overview
+      title: "系统冻结检测"
+      columns:
+        - name: total_apps
+          label: "检测应用数"
+          type: number
+        - name: frozen_apps
+          label: "冻结应用数"
+          type: number
+        - name: frozen_pct
+          label: "冻结占比"
+          type: percentage
+          format: percentage
+        - name: freeze_verdict
+          label: "判定"
+          type: string
+        - name: system_server_running_pct
+          label: "system_server 运行占比"
+          type: percentage
+          format: percentage
+        - name: system_server_frozen
+          label: "system_server 冻结"
+          type: boolean
+    sql: |
+      WITH app_activity AS (
+        SELECT
+          p.name as process_name,
+          SUM(CASE WHEN ts.state = 'Running' THEN ts.dur ELSE 0 END) as running_ns,
+          SUM(ts.dur) as total_ns
+        FROM thread_state ts
+        JOIN thread t ON ts.utid = t.utid
+        JOIN process p ON t.upid = p.upid
+        WHERE ts.ts >= ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+          AND ts.ts < ${anr_ctx.data[0].anr_ts}
+          AND t.tid = p.pid  -- 主线程
+          AND (
+            COALESCE(p.uid, 0) >= 10000
+            OR p.name = 'system_server'
+            OR p.name = 'com.android.systemui'
+          )
+        GROUP BY p.name
+      ),
+      freeze_eval AS (
+        SELECT
+          process_name,
+          100.0 * running_ns / NULLIF(total_ns, 0) as running_pct
+        FROM app_activity
+      )
+      SELECT
+        COUNT(*) as total_apps,
+        SUM(CASE WHEN running_pct < 5 THEN 1 ELSE 0 END) as frozen_apps,
+        ROUND(100.0 * SUM(CASE WHEN running_pct < 5 THEN 1 ELSE 0 END) /
+              NULLIF(COUNT(*), 0), 1) as frozen_pct,
+        MAX(CASE WHEN process_name = 'system_server' THEN ROUND(running_pct, 1) END) as system_server_running_pct,
+        MAX(CASE WHEN process_name = 'system_server' AND running_pct < 5 THEN 1 ELSE 0 END) as system_server_frozen,
+        CASE
+          WHEN MAX(CASE WHEN process_name = 'system_server' AND running_pct < 5 THEN 1 ELSE 0 END) = 1
+            THEN 'system_server_freeze'
+          WHEN 100.0 * SUM(CASE WHEN running_pct < 5 THEN 1 ELSE 0 END) /
+               NULLIF(COUNT(*), 0) > 50 THEN 'system_freeze'
+          ELSE 'app_specific'
+        END as freeze_verdict
+      FROM freeze_eval
+    save_as: freeze_check
+    condition: detection.data[0]?.total_anr_count > 0
+    optional: true
+
+  # ============================================================================
+  # 第二阶段：ANR 分类统计
+  # ============================================================================
+
+  # Step 2.1: ANR 概览统计（按类型分组）
+  - id: anr_overview
+    type: atomic
+    name: "ANR 概览统计"
+    display:
+      level: key
+      layer: overview
+      title: "ANR 概览"
+      columns:
+        - name: anr_type
+          label: "ANR 类型"
+          type: string
+        - name: anr_count
+          label: "数量"
+          type: number
+          format: compact
+        - name: affected_processes
+          label: "受影响进程"
+          type: string
+        - name: avg_anr_dur_ms
+          label: "平均超时时长"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: default_timeout_ms
+          label: "默认超时"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: type_display
+          label: "类型说明"
+          type: string
+        - name: quick_hint
+          label: "快速提示"
+          type: string
+    synthesize:
+      role: overview
+      fields:
+        - key: anr_type
+          label: ANR 类型
+        - key: anr_count
+          label: 数量
+        - key: type_display
+          label: 类型说明
+        - key: avg_anr_dur_ms
+          label: 平均超时时长
+          format: "{{value}} ms"
+      insights:
+        - condition: "anr_type === 'INPUT_DISPATCHING_TIMEOUT'"
+          template: "输入超时 {{anr_count}} 次：主线程 5 秒未响应"
+        - condition: "anr_type === 'BROADCAST_OF_INTENT'"
+          template: "广播超时 {{anr_count}} 次：BroadcastReceiver 处理超时"
+        - condition: "anr_type === 'EXECUTING_SERVICE'"
+          template: "服务超时 {{anr_count}} 次：Service 生命周期方法超时"
+    sql: |
+      SELECT
+        anr_type,
+        COUNT(*) AS anr_count,
+        GROUP_CONCAT(DISTINCT process_name) AS affected_processes,
+        ROUND(AVG(anr_dur_ms), 2) AS avg_anr_dur_ms,
+        ROUND(AVG(default_anr_dur_ms), 2) AS default_timeout_ms,
+        CASE anr_type
+          WHEN 'INPUT_DISPATCHING_TIMEOUT' THEN '输入超时 (5s无响应)'
+          WHEN 'BROADCAST_OF_INTENT' THEN '广播超时 (前台10s/后台60s)'
+          WHEN 'EXECUTING_SERVICE' THEN '服务执行超时 (前台20s/后台200s)'
+          WHEN 'CONTENT_PROVIDER_NOT_RESPONDING' THEN 'ContentProvider 超时'
+          WHEN 'NO_FOCUSED_WINDOW' THEN '无焦点窗口'
+          ELSE anr_type
+        END as type_display,
+        CASE anr_type
+          WHEN 'INPUT_DISPATCHING_TIMEOUT' THEN '检查主线程是否在处理耗时操作'
+          WHEN 'BROADCAST_OF_INTENT' THEN '检查 BroadcastReceiver.onReceive() 是否耗时'
+          WHEN 'EXECUTING_SERVICE' THEN '检查 Service 生命周期方法是否耗时'
+          WHEN 'CONTENT_PROVIDER_NOT_RESPONDING' THEN '检查 ContentProvider 查询是否耗时'
+          WHEN 'NO_FOCUSED_WINDOW' THEN '检查 Window 焦点获取是否异常'
+          ELSE '检查主线程阻塞原因'
+        END as quick_hint
+      FROM android_anrs
+      WHERE (process_name GLOB '${process_name}*' OR process_name GLOB '${package}*' OR ('${process_name}' = '' AND '${package}' = ''))
+        AND (anr_type = '${anr_type}' OR '${anr_type}' = '')
+      GROUP BY anr_type
+      ORDER BY anr_count DESC
+    save_as: overview
+    condition: detection.data[0]?.total_anr_count > 0
+
+  # Step 2.2: ANR 事件列表（用于迭代分析）
+  - id: get_anr_events
+    type: atomic
+    name: "获取 ANR 事件列表"
+    display:
+      level: key
+      layer: list
+      title: "ANR 事件列表"
+      columns:
+        - name: error_id
+          label: "Error ID"
+          type: number
+        - name: process_name
+          label: "进程名"
+          type: string
+        - name: pid
+          label: "PID"
+          type: number
+        - name: anr_type
+          label: "ANR 类型"
+          type: string
+        - name: anr_dur_ms
+          label: "超时时长"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: anr_ts
+          label: "ANR 时间"
+          type: timestamp
+          clickAction: navigate_timeline
+        - name: perfetto_start
+          label: "区间开始"
+          type: timestamp
+          clickAction: navigate_range
+          durationColumn: timeout_ns
+        - name: type_display
+          label: "类型"
+          type: string
+        - name: subject_preview
+          label: "摘要"
+          type: string
+    synthesize:
+      role: list
+      groupBy:
+        field: anr_type
+        label: ANR 类型
+        aggregations:
+          - type: count
+            label: 数量
+          - type: avg
+            field: anr_dur_ms
+            label: 平均耗时
+      fields:
+        - key: process_name
+          label: 进程名
+        - key: type_display
+          label: 类型
+        - key: anr_dur_ms
+          label: 超时时长
+          format: "{{value}} ms"
+    sql: |
+      SELECT
+        error_id,
+        process_name,
+        pid,
+        anr_type,
+        ROUND(anr_dur_ms, 2) as anr_dur_ms,
+        ROUND(default_anr_dur_ms, 2) as timeout_ms,
+        printf('%d', ts) as anr_ts,
+        printf('%d', CAST(default_anr_dur_ms * 1e6 AS INTEGER)) as timeout_ns,
+        intent,
+        component,
+        SUBSTR(subject, 1, 150) AS subject_preview,
+        -- Perfetto 跳转参数
+        printf('%d', CAST(ts - default_anr_dur_ms * 1e6 AS INTEGER)) as perfetto_start,
+        printf('%d', ts) as perfetto_end,
+        CASE anr_type
+          WHEN 'INPUT_DISPATCHING_TIMEOUT' THEN '输入超时'
+          WHEN 'BROADCAST_OF_INTENT' THEN '广播超时'
+          WHEN 'EXECUTING_SERVICE' THEN '服务超时'
+          WHEN 'CONTENT_PROVIDER_NOT_RESPONDING' THEN 'CP超时'
+          WHEN 'NO_FOCUSED_WINDOW' THEN '无焦点窗口'
+          ELSE anr_type
+        END as type_display
+      FROM android_anrs
+      WHERE (process_name GLOB '${process_name}*' OR process_name GLOB '${package}*' OR ('${process_name}' = '' AND '${package}' = ''))
+        AND (anr_type = '${anr_type}' OR '${anr_type}' = '')
+      ORDER BY ts ASC
+    save_as: anr_events
+    condition: detection.data[0]?.total_anr_count > 0
+
+  # Step 2.3: Top CPU 进程（ANR 期间）
+  - id: top_cpu_processes
+    type: atomic
+    name: "Top CPU 进程"
+    display:
+      level: detail
+      layer: list
+      title: "ANR 期间 Top CPU 进程"
+      columns:
+        - name: process_name
+          label: "进程名"
+          type: string
+        - name: cpu_ms
+          label: "CPU 时间"
+          type: duration
+          format: duration_ms
+          unit: ms
+        - name: cpu_pct
+          label: "CPU 占比"
+          type: percentage
+          format: percentage
+    sql: |
+      SELECT
+        p.name as process_name,
+        ROUND(SUM(
+          CASE
+            WHEN ss.ts < ${anr_ctx.data[0].anr_ts} AND ss.ts + ss.dur > ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+            THEN MIN(ss.ts + ss.dur, ${anr_ctx.data[0].anr_ts}) - MAX(ss.ts, ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns})
+            ELSE 0
+          END
+        ) / 1e6, 2) as cpu_ms,
+        ROUND(100.0 * SUM(
+          CASE
+            WHEN ss.ts < ${anr_ctx.data[0].anr_ts} AND ss.ts + ss.dur > ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+            THEN MIN(ss.ts + ss.dur, ${anr_ctx.data[0].anr_ts}) - MAX(ss.ts, ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns})
+            ELSE 0
+          END
+        ) / ${anr_ctx.data[0].timeout_ns}, 1) as cpu_pct
+      FROM sched_slice ss
+      JOIN thread t ON ss.utid = t.utid
+      JOIN process p ON t.upid = p.upid
+      WHERE ss.ts < ${anr_ctx.data[0].anr_ts}
+        AND ss.ts + ss.dur > ${anr_ctx.data[0].anr_ts} - ${anr_ctx.data[0].timeout_ns}
+      GROUP BY p.name
+      ORDER BY cpu_ms DESC
+      LIMIT 15
+    save_as: top_processes
+    condition: detection.data[0]?.total_anr_count > 0
+    optional: true
+
+  # ============================================================================
+  # 第三阶段：逐个 ANR 详细分析
+  # ============================================================================
+
+  - id: analyze_anr_events
+    type: iterator
+    name: "ANR 事件详细分析"
+    display:
+      level: key
+      layer: deep
+      title: "ANR 深度分析"
+    synthesize:
+      role: clusters
+      clusterBy:
+        field: anr_type
+        label: ANR 类型
+      fields:
+        - key: process_name
+          label: 进程名
+        - key: anr_type
+          label: 类型
+        - key: main_thread_state
+          label: 主线程状态
+        - key: blocking_reason
+          label: 阻塞原因
+      insights:
+        - template: "ANR 事件详细分析，按类型分组"
+    source: anr_events
+    item_skill: anr_detail
+    item_params:
+      anr_ts: anr_ts
+      timeout_ns: timeout_ns
+      process_name: process_name
+      pid: pid
+      anr_type: anr_type
+      anr_dur_ms: anr_dur_ms
+      perfetto_start: perfetto_start
+      perfetto_end: perfetto_end
+    condition: detection.data[0]?.total_anr_count > 0
+
+  # ============================================================================
+  # 第四阶段：诊断规则
+  # ============================================================================
+
+  - id: anr_diagnosis
+    type: diagnostic
+    name: "ANR 诊断"
+    display:
+      level: key
+      layer: overview
+      title: "问题诊断"
+    synthesize:
+      role: conclusion
+      fields:
+        - key: diagnosis
+          label: 诊断结论
+        - key: severity
+          label: 严重程度
+        - key: confidence
+          label: 置信度
+      insights:
+        - condition: "severity === 'critical'"
+          template: "🔴 严重问题：{{diagnosis}}"
+        - condition: "severity === 'warning'"
+          template: "🟡 警告：{{diagnosis}}"
+        - template: "ANR 诊断：{{diagnosis}}"
+    inputs: [detection, cpu_health, memory_pressure, io_load, lock_waits, freeze_check, overview, anr_events, top_processes]
+    rules:
+      # === 系统级问题判定 ===
+
+      # system_server 冻结（系统服务自身无调度）
+      - condition: "freeze_check.data[0]?.freeze_verdict === 'system_server_freeze'"
+        severity: critical
+        diagnosis: "system_server 运行占比仅 ${freeze_check.data[0].system_server_running_pct}%（疑似系统服务冻结）"
+        confidence: high
+        suggestions:
+          - "这是系统级问题，优先排查 system_server 调度阻塞"
+          - "检查 Binder 死锁、IO 堵塞和内核锁等待"
+          - "结合内核调度与系统服务线程栈定位阻塞点"
+
+      # 系统冻结（多个应用同时卡住）
+      - condition: "freeze_check.data[0]?.freeze_verdict === 'system_freeze'"
+        severity: critical
+        diagnosis: "系统级冻结：${freeze_check.data[0].frozen_apps}/${freeze_check.data[0].total_apps} 个应用主线程几乎无运行"
+        confidence: high
+        suggestions:
+          - "这是系统级问题，非单个应用问题"
+          - "检查系统服务是否正常"
+          - "检查是否有内核级阻塞（内存/IO/锁）"
+
+      # 多个 ANR 同时发生
+      - condition: "detection.data[0]?.total_anr_count > (multi_anr_threshold || 3) && detection.data[0]?.anr_span_seconds < (multi_anr_span_seconds || 10)"
+        severity: critical
+        diagnosis: "短时间内发生 ${detection.data[0].total_anr_count} 个 ANR，间隔仅 ${detection.data[0].anr_span_seconds}s"
+        confidence: high
+        suggestions:
+          - "多个 ANR 集中发生通常指向系统级问题"
+          - "检查系统是否过载或有资源争抢"
+
+      # 内存压力导致
+      - condition: "memory_pressure.data?.length > 0"
+        severity: critical
+        diagnosis: "ANR 期间发生 LMK 杀进程，系统内存压力大"
+        confidence: high
+        suggestions:
+          - "内存不足导致系统繁忙，影响应用响应"
+          - "检查内存占用大户"
+          - "考虑减少内存使用"
+
+      # CPU 过载
+      - condition: "cpu_health.data?.find(r => r.status === 'overloaded')"
+        severity: critical
+        diagnosis: "CPU ${cpu_health.data.find(r => r.status === 'overloaded').core_type} 核过载 (${cpu_health.data.find(r => r.status === 'overloaded').avg_util_pct}%)"
+        confidence: high
+        suggestions:
+          - "CPU 资源严重不足"
+          - "检查后台进程 CPU 占用"
+          - "top_processes 显示的进程可能是罪魁祸首"
+
+      # IO 阻塞
+      - condition: "io_load.data[0]?.io_wait_ms > (io_wait_threshold_ms || 500)"
+        severity: warning
+        diagnosis: "进程 ${io_load.data[0].process_name} IO 等待 ${io_load.data[0].io_wait_ms}ms"
+        confidence: medium
+        suggestions:
+          - "大量 IO 等待可能影响系统响应"
+          - "检查是否有大量文件/数据库操作"
+
+      # Futex/Mutex 锁竞争
+      - condition: "(lock_waits?.data?.find(r => r.wait_type === 'futex')?.p95_wait_ms || 0) > (lock_contention_futex_p95_critical_ms || 20)"
+        severity: critical
+        diagnosis: "ANR 窗口 Futex P95 等待 ${lock_waits.data.find(r => r.wait_type === 'futex').p95_wait_ms}ms，存在明显锁竞争"
+        confidence: high
+        suggestions:
+          - "优先排查主线程相关锁的持锁时长和锁顺序"
+          - "避免在锁内执行 Binder/IO/数据库操作"
+          - "缩小临界区并降低共享写竞争"
+
+      - condition: "(lock_waits?.data?.find(r => r.wait_type === 'mutex')?.p95_wait_ms || 0) > (lock_contention_mutex_p95_warning_ms || 10)"
+        severity: warning
+        diagnosis: "ANR 窗口 Mutex P95 等待 ${lock_waits.data.find(r => r.wait_type === 'mutex').p95_wait_ms}ms，锁等待偏高"
+        confidence: medium
+        suggestions:
+          - "按热点函数重构锁粒度，降低串行化路径"
+          - "评估是否可用无锁队列或分段锁替换"
+
+      # === 应用级问题判定 ===
+
+      # 输入超时
+      - condition: "overview.data?.find(r => r.anr_type === 'INPUT_DISPATCHING_TIMEOUT')"
+        severity: critical
+        diagnosis: "输入事件超时 (INPUT_DISPATCHING_TIMEOUT)"
+        confidence: high
+        suggestions:
+          - "主线程 5 秒未处理输入事件"
+          - "检查主线程是否执行耗时操作"
+          - "检查是否有 Binder 调用阻塞"
+
+      # 广播超时
+      - condition: "overview.data?.find(r => r.anr_type === 'BROADCAST_OF_INTENT')"
+        severity: critical
+        diagnosis: "广播处理超时 (BROADCAST_OF_INTENT)"
+        confidence: high
+        suggestions:
+          - "BroadcastReceiver.onReceive() 执行超时"
+          - "前台广播超时时间为 10 秒"
+          - "将耗时操作移到 Service 或 IntentService"
+
+      # 服务超时
+      - condition: "overview.data?.find(r => r.anr_type === 'EXECUTING_SERVICE')"
+        severity: critical
+        diagnosis: "服务执行超时 (EXECUTING_SERVICE)"
+        confidence: high
+        suggestions:
+          - "Service 生命周期方法执行超时"
+          - "前台服务超时时间为 20 秒"
+          - "检查 onCreate/onStartCommand/onBind 是否耗时"
+
+      # ContentProvider 超时
+      - condition: "overview.data?.find(r => r.anr_type === 'CONTENT_PROVIDER_NOT_RESPONDING')"
+        severity: critical
+        diagnosis: "ContentProvider 超时 (CONTENT_PROVIDER_NOT_RESPONDING)"
+        confidence: high
+        suggestions:
+          - "ContentProvider 查询或操作超时"
+          - "检查数据库查询是否耗时"
+          - "考虑使用异步查询"
+
+output:
+  format: structured