@harrylabsj/kiwi-merchant-cloud 0.12.0

package/app/agent/kernel.js

@@ -0,0 +1,1616 @@
+/**
+ * Copyright 2026 harrylabsj
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+import { createAgentSession, createExtensionRuntime, ModelRuntime, SettingsManager, } from "@earendil-works/pi-coding-agent";
+import { existsSync, readFileSync, rmSync } from "node:fs";
+import path from "node:path";
+import { fileURLToPath } from "node:url";
+import { ensureAgentPaths, openAgentDatabase } from "./agent-db.js";
+import { HandoffEventStore, HandoffIdempotencyStore, foldCandidateLifecycle, deliveryState, recordLaunch, recordOpenEvidence, } from "../handoff/index.js";
+import { buildBuyerTools } from "./buyer/buyer-tools.js";
+import { TaskScheduler } from "./buyer/scheduler.js";
+import { BuyerTaskStore } from "./buyer/task-store.js";
+import { SupplierScheduler } from "./supplier/scheduler.js";
+import { SupplierRelationshipStore } from "./supplier/store.js";
+import { TrustRecordStore } from "../trust/records/index.js";
+import { buildMemoryTools } from "./chat-tools.js";
+import { AGENT_MODES, DEFAULT_AGENT_MODE, isAgentMode } from "./mode.js";
+import { WriteApprovalCandidateStore, executeApprovedCandidate, } from "./merchant/action-candidate.js";
+import { buildMerchantTools } from "./merchant/merchant-tools.js";
+import { publicCandidatePreview } from "./merchant/merchant-enrichment.js";
+import { DefaultMerchantIntelligenceBackend } from "./merchant/intelligence/default-backend.js";
+import { emitHostEvent, sanitizeHostEventData, SerializedEventSink } from "./host/events.js";
+import { fenceModelPayload } from "./context/fencing.js";
+import { groundingReads } from "./context/grounding.js";
+import { MERCHANT_GROUNDING_RULES, merchantGroundingContext } from "./merchant/merchant-grounding.js";
+import { SkillRegistry } from "./skills/registry.js";
+import { buildSkillTools } from "./skills/tools.js";
+import { DeterministicNegotiationRunner } from "../operator/runner.js";
+import { MemoryStore } from "./memory/store.js";
+import { MemoryError } from "./memory/types.js";
+import { PrivateVault } from "./memory/vault.js";
+import { AgentSessionError, openMainSessionManager, validateSessionLog, } from "./session.js";
+import { registerCatalogAgent } from "../discovery/catalog-source/register.js";
+import { KiwiCatalogSource } from "../discovery/catalog-source/kiwi-source.js";
+import { baseSystemPrompt, combineDynamicBriefing, renderMemoryBriefing } from "./system-prompt.js";
+export const MAIN_SESSION_ID = "main";
+/** 审查 P2-I：autopilot 对网关权威门持续拒绝的消息——连续失败上限与冷却窗口。 */
+export const AUTOPILOT_MAX_SUBMIT_FAILURES = 3;
+export const AUTOPILOT_STALL_COOLDOWN_MS = 10 * 60 * 1000;
+/**
+ * 把一轮 A2A 磋商结果写入 MemoryStore（episode namespace，active 无需人工确认）：
+ * 持久上下文，`/why` 可查、跨重启可恢复。buyer 工具经 recordNegotiation 回调复用。
+ */
+async function rememberNegotiation(store, input) {
+    const summary = [
+        `A2A 磋商完成：negotiation ${input.negotiationId}，商家 ${input.catalogAgentId}`,
+        `，${input.quantity} 件 ${input.sku}，报价 ${input.offerPriceMinor === undefined ? "?" : (input.offerPriceMinor / 100).toFixed(2)} 元/件`,
+        `，条件价（量≥100）${input.dealPriceMinor === undefined ? "?" : (input.dealPriceMinor / 100).toFixed(2)} 元/件`,
+        input.agreementId !== undefined ? `，agreement ${input.agreementId}` : "",
+    ].join("");
+    const outcome = store.remember({
+        namespace: "episode",
+        key: `a2a-negotiation:${input.negotiationId}`,
+        value: {
+            kind: "a2a_negotiation",
+            negotiation_id: input.negotiationId,
+            catalog_agent_id: input.catalogAgentId,
+            sku: input.sku,
+            quantity: input.quantity,
+            offer_price_minor: input.offerPriceMinor,
+            deal_price_minor: input.dealPriceMinor,
+            agreement_id: input.agreementId,
+        },
+        source_kind: "observed",
+        sensitivity: "normal",
+        confidence: 1,
+        explicit_user_statement: false,
+        evidence: {
+            source_type: "import",
+            source_ref: input.negotiationId,
+            summary,
+        },
+        actor: "system",
+    });
+    return outcome.kind === "conflict" ? outcome.existing.memory_id : outcome.memory.memory_id;
+}
+const PRIVATE_TOOL_RESULT_NAMES = new Set(["view_private_thresholds"]);
+export function toolResultSummary(toolName, result) {
+    if (PRIVATE_TOOL_RESULT_NAMES.has(toolName))
+        return "工具调用已完成。";
+    if (result !== null && typeof result === "object") {
+        const content = result.content;
+        if (Array.isArray(content)) {
+            const text = content
+                .filter((item) => item !== null && typeof item === "object" &&
+                item.type === "text" &&
+                typeof item.text === "string")
+                .map((item) => item.text)
+                .join("\n")
+                .trim();
+            if (text !== "")
+                return text.slice(0, 1_000);
+        }
+    }
+    return "工具调用已完成。";
+}
+/** Bridge AgentSession events into the optional host protocol. */
+function attachSessionHostEvents(session, emitEvent) {
+    return session.subscribe(async (event) => {
+        if (event.type === "message_update" && event.assistantMessageEvent.type === "text_delta") {
+            if (event.assistantMessageEvent.delta !== "") {
+                await emitEvent("text_delta", { text: event.assistantMessageEvent.delta });
+            }
+            return;
+        }
+        if (event.type === "tool_execution_start") {
+            await emitEvent("tool_call", {
+                tool: event.toolName,
+                call_id: event.toolCallId,
+                input: event.args,
+            });
+            return;
+        }
+        if (event.type === "tool_execution_update") {
+            await emitEvent("ui_partial", {
+                tool: event.toolName,
+                call_id: event.toolCallId,
+                partial: event.partialResult,
+            });
+            return;
+        }
+        if (event.type === "tool_execution_end") {
+            await emitEvent("tool_result", {
+                tool: event.toolName,
+                call_id: event.toolCallId,
+                status: event.isError ? "error" : "ok",
+                summary: toolResultSummary(event.toolName, event.result),
+            });
+        }
+    });
+}
+/** The owner's own Restricted memory values (Vault). Owner-only by isolation. */
+function listRestrictedValues(store) {
+    const out = [];
+    for (const m of store.listMemories({ sensitivity: "restricted" })) {
+        if (m.vault_ref === undefined)
+            continue;
+        try {
+            out.push({ key: m.key, value: store.openVaultValue(m.vault_ref) });
+        }
+        catch {
+            // data key unavailable on this run: skip rather than crash the read
+        }
+    }
+    return out;
+}
+/**
+ * Map a buyer task's intent/constraints into negotiation hints so the
+ * autonomous loop counters toward the user's actual goal ("买 2 个、预算 120、
+ * 砍到 100") instead of the profile defaults.
+ */
+function taskNegotiationHints(store, task) {
+    const hints = {};
+    if (task.intent.quantity !== undefined)
+        hints.quantity_cap = task.intent.quantity;
+    if (task.intent.target_unit_price !== undefined) {
+        hints.buyer_target_unit_price = task.intent.target_unit_price;
+    }
+    if (task.constraints.max_unit_price !== undefined) {
+        hints.buyer_max_unit_price = task.constraints.max_unit_price;
+    }
+    try {
+        const budget = store.resolveBudget(task.constraints);
+        if (budget !== undefined)
+            hints.buyer_max_total_price = budget;
+    }
+    catch {
+        // vault unavailable this run: fall back to the profile budget
+    }
+    return hints;
+}
+const COMMANDS_HELP = `/memory [preferences|private]  查看记忆概览 / 学习到的偏好 / 私密资料字段与状态
+/forget <memory-id|描述>   删除记忆（tombstone + 审计）
+/correct <memory-id> <新内容>  修正记忆（保留前后版本审计）
+/confirm <memory-id>       人工确认候选记忆生效（硬约束/敏感记忆必须人工确认）
+/private                   查看你自己的私密阈值明文（成本/底价，仅你可见，勿写入对外消息）
+/why                       说明最近的回答使用了哪些记忆
+/mode [manual|supervised|autopilot] [confirm]  查看或切换写操作审批模式
+/pending                   列出等待批准的写操作候选
+/approve <candidate-id>    批准并执行一个写操作候选（重新校验前置状态）
+/reject <candidate-id>     驳回一个写操作候选（绝不执行）
+/profile <file.yaml>      加载并切换另一个 agent profile（buyer/merchant 等）
+/register --agent-card-url <url> [--catalog <url>] [--domain <d>]
+                          把本 merchant 注册进 agent catalog（buyer 发现用）
+/help                      本帮助
+/quit                      退出`;
+/**
+ * Build a ModelRuntime for callers that only supply legacy provider objects
+ * (tests / fake chat models): providers are registered natively so their
+ * streamFn and static model lists stay authoritative.
+ */
+async function buildModelRuntime(options) {
+    const runtime = await ModelRuntime.create({ refreshOnCreate: false });
+    for (const provider of options.providers ?? []) {
+        runtime.registerNativeProvider(provider);
+    }
+    return runtime;
+}
+/**
+ * §18.1 对位：0.87 的 AgentSession 没有 harness 时代的 per-session
+ * streamOptions 注入口，profile 的 prompt_cache_retention 只能在
+ * ModelRuntime 边界补齐——包装 streamSimple，为未显式指定 cacheRetention
+ * 的请求补上 profile 值（compaction 等的显式取值不受影响）。
+ */
+function withPromptCacheRetention(runtime, retention) {
+    if (retention === undefined)
+        return runtime;
+    const original = runtime.streamSimple.bind(runtime);
+    runtime.streamSimple = (model, context, options) => original(model, context, {
+        ...options,
+        cacheRetention: options?.cacheRetention ?? retention,
+    });
+    return runtime;
+}
+/** 读会话 JSONL 中最后一条模型记录（model_change 或 assistant 消息的 provider/model）。 */
+function sessionLastModel(file) {
+    let last;
+    try {
+        for (const line of readFileSync(file, "utf-8").split("\n")) {
+            if (line.trim() === "")
+                continue;
+            let entry;
+            try {
+                entry = JSON.parse(line);
+            }
+            catch {
+                continue;
+            }
+            if (entry.type === "model_change" &&
+                typeof entry.provider === "string" &&
+                typeof entry.modelId === "string") {
+                last = { provider: entry.provider, modelId: entry.modelId };
+            }
+            else if (entry.type === "message" &&
+                entry.message !== null &&
+                typeof entry.message === "object") {
+                const m = entry.message;
+                if (m.role === "assistant" &&
+                    typeof m.provider === "string" &&
+                    typeof m.model === "string") {
+                    last = { provider: m.provider, modelId: m.model };
+                }
+            }
+        }
+    }
+    catch {
+        // 读不了就当作没有历史，不重置。
+    }
+    return last;
+}
+export class AgentKernel {
+    profile;
+    principal;
+    paths;
+    db;
+    store;
+    session;
+    briefing;
+    /** 统一时钟（构造注入或墙钟；与 open() 的 clock 闭包同源语义）。 */
+    clock;
+    chain = Promise.resolve();
+    shutdownRequested = false;
+    closed = false;
+    taskStore;
+    scheduler;
+    /** M1：Buyer-owned supplier pull scheduler（buyer 角色构造；与 TaskScheduler 同一 tick 链）。 */
+    supplierScheduler;
+    approvals;
+    /** v0.7.0 KTH：handoff 存储（open() 构造，buyer 角色注入）。 */
+    handoffRuntime;
+    commerceClient;
+    merchantClient;
+    broker;
+    merchantIntelligence;
+    /** Optional host event projection; it never owns business state. */
+    emitEvent;
+    /** Removes the optional AgentHarness stream bridge during kernel shutdown. */
+    unsubscribeSessionEvents;
+    /** Shared mutable mode ref (tools read it via a getter before the kernel exists). */
+    modeRef = { value: DEFAULT_AGENT_MODE };
+    /** Live execution hooks for pending candidates (v0.3.0-C /approve). */
+    pendingHooks;
+    /** Current conversation-turn id, shared with the remember tool (evidence dedup §9.3). */
+    turnId;
+    turnSeq = 0;
+    /** Negotiation conversations that reached consensus — the auto-follow must never re-open them. */
+    settledNegotiations = new Set();
+    // 审查 P3：settled 集合只进不出（每共识会话一条 key 永驻内存）。网关已
+    // 处理的消息不会再进 pending，旧 key 只防极端回滚重放——FIFO 上限截断
+    // （超出后仅影响极端场景下的一次多余重新计数，幂等无商业效果）。
+    static SETTLED_MAX_KEYS = 2000;
+    markSettled(key) {
+        this.settledNegotiations.add(key);
+        if (this.settledNegotiations.size > AgentKernel.SETTLED_MAX_KEYS) {
+            // Set 迭代序 = 插入序：从最旧开始删除
+            for (const oldest of this.settledNegotiations) {
+                this.settledNegotiations.delete(oldest);
+                if (this.settledNegotiations.size <= AgentKernel.SETTLED_MAX_KEYS)
+                    break;
+            }
+        }
+    }
+    // 审查 P2-I：被网关权威门持续拒绝的消息（failClaim 后回 pending 队首，
+    // 确定性决策每次 tick 重新 claim → 同一拒绝）——无退避会每 tick 无限
+    // claim→fail 并饿死队尾 live 消息。连续失败达上限后进入冷却窗口，
+    // 窗口内跳过，窗口后允许一次重试；成功/共识时清除。
+    stalledNegotiations = new Map();
+    constructor(options) {
+        this.profile = options.profile;
+        this.paths = options.paths;
+        this.clock = options.now ?? (() => new Date().toISOString());
+        this.db = options.db;
+        this.store = options.store;
+        this.principal = options.principal;
+        this.session = options.session;
+        if (options.taskStore !== undefined)
+            this.taskStore = options.taskStore;
+        if (options.scheduler !== undefined)
+            this.scheduler = options.scheduler;
+        if (options.supplierScheduler !== undefined)
+            this.supplierScheduler = options.supplierScheduler;
+        if (options.approvals !== undefined)
+            this.approvals = options.approvals;
+        if (options.handoffRuntime !== undefined)
+            this.handoffRuntime = options.handoffRuntime;
+        if (options.commerceClient !== undefined)
+            this.commerceClient = options.commerceClient;
+        if (options.merchantClient !== undefined)
+            this.merchantClient = options.merchantClient;
+        if (options.broker !== undefined)
+            this.broker = options.broker;
+        if (options.merchantIntelligence !== undefined)
+            this.merchantIntelligence = options.merchantIntelligence;
+        this.emitEvent = options.emitEvent;
+        this.unsubscribeSessionEvents = options.unsubscribeSessionEvents;
+        if (options.modeRef !== undefined)
+            this.modeRef = options.modeRef;
+        this.pendingHooks = options.pendingHooks ?? new Map();
+        this.turnId = options.turnId;
+    }
+    static async open(options) {
+        const paths = options.paths ?? ensureAgentPaths(options.profile.agent_id);
+        // 会话来自不同模型（如 fake→deepseek）时重置：旧模型的消息会让新模型首轮
+        // 产生空响应（模型没有返回任何文本）。模型变更 = 新的对话历史。
+        if (options.model !== undefined && existsSync(paths.mainSession)) {
+            // 先验证完整日志，避免损坏行被 sessionLastModel 跳过后直接删除旧会话。
+            try {
+                validateSessionLog(paths.mainSession);
+            }
+            catch (e) {
+                throw new AgentSessionError(`cannot open main session ${paths.mainSession}: ${e instanceof Error ? e.message : String(e)} (failing closed)`);
+            }
+            const sessionModel = sessionLastModel(paths.mainSession);
+            if (sessionModel !== undefined &&
+                (sessionModel.provider !== options.model.provider ||
+                    sessionModel.modelId !== options.model.id)) {
+                rmSync(paths.mainSession, { force: true });
+            }
+        }
+        const db = openAgentDatabase(paths.db);
+        const vault = options.vault ?? new PrivateVault();
+        const store = new MemoryStore({ db, vault, ...(options.now ? { now: options.now } : {}) });
+        const principal = store.ensurePrincipal({
+            principal_id: options.profile.agent_id,
+            owner_id: options.profile.owner_id,
+            role: options.profile.role,
+        });
+        store.bindPrincipal(principal.principal_id);
+        let mainSessionManager;
+        try {
+            mainSessionManager = openMainSessionManager(paths, paths.dir, options.eventSessionId ?? MAIN_SESSION_ID);
+        }
+        catch (err) {
+            db.close(); // never leak the SQLite handle on a fail-closed open
+            throw err;
+        }
+        // Buyer capability pack (v0.3.0-B): task store + scheduler + tools.
+        // All clocks are normalized to UTC ISO (SQLite compares timestamps
+        // lexicographically; mixed offsets would silently break due checks).
+        const clock = () => new Date(Date.parse((options.now ?? (() => new Date().toISOString()))())).toISOString();
+        const modeRef = { value: options.mode ?? DEFAULT_AGENT_MODE };
+        const pendingHooks = new Map();
+        const turnId = { current: MAIN_SESSION_ID };
+        const registerPendingHooks = (id, hooks) => {
+            pendingHooks.set(id, hooks);
+        };
+        const hostSequence = { value: 0 };
+        const hostSink = options.eventSink === undefined ? undefined : new SerializedEventSink(options.eventSink);
+        const emitEvent = options.eventSink === undefined
+            ? undefined
+            : async (type, data) => {
+                hostSequence.value += 1;
+                await emitHostEvent(hostSink, {
+                    eventId: `host-${hostSequence.value}`,
+                    sessionId: options.eventSessionId ?? MAIN_SESSION_ID,
+                    sequence: hostSequence.value,
+                    type,
+                    occurredAt: clock(),
+                    data: sanitizeHostEventData(type, data),
+                });
+            };
+        const approvals = new WriteApprovalCandidateStore({
+            db,
+            principalId: principal.principal_id,
+            now: clock,
+        });
+        const registerPending = (id, hooks) => {
+            registerPendingHooks(id, hooks);
+            const candidate = approvals.get(id);
+            void emitEvent?.("candidate_update", {
+                candidate_id: id,
+                status: candidate?.status ?? "pending_approval",
+                preview: publicCandidatePreview(candidate),
+            });
+        };
+        // Execution hooks are deliberately process-local. Invalidate durable
+        // candidates before wiring tools so a restarted kernel never exposes a
+        // /pending item that its /approve path cannot execute.
+        approvals.expireForRecovery();
+        let taskStore;
+        let scheduler;
+        let supplierScheduler;
+        let buyerTools = [];
+        let merchantTools = [];
+        let merchantSkillTools = [];
+        let merchantIntelligence;
+        const merchantSkillRegistry = options.profile.role === "merchant" &&
+            options.profile.merchant_experience?.enabled === true &&
+            options.profile.merchant_experience.skills === true
+            ? SkillRegistry.fromDir(path.resolve(path.dirname(fileURLToPath(import.meta.url)), "../../skills/merchant"), "merchant")
+            : new SkillRegistry([]);
+        merchantSkillTools = buildSkillTools(merchantSkillRegistry);
+        let handoffRuntime;
+        if (options.profile.role === "buyer" && options.connector !== undefined) {
+            taskStore = new BuyerTaskStore({
+                db,
+                principalId: principal.principal_id,
+                now: clock,
+                vault,
+            });
+            scheduler = new TaskScheduler({
+                store: taskStore,
+                connectors: [options.connector],
+                now: clock,
+                // CD #28：配置 catalog 时调度器定时重搜同样 catalog-first。
+                ...(options.catalog !== undefined
+                    ? { catalogSource: new KiwiCatalogSource({ baseUrl: options.catalog }) }
+                    : {}),
+            });
+            // M1：Buyer-owned supplier pull scheduler（pull-relationship §7.1/§8）。
+            // 与 TaskScheduler 同一 DB、同一 tick 串行链；catalogSource 不可得时仍可
+            // 做 Agent Card / UCP Profile 直拉（容错：可选依赖缺省不阻塞构造）。
+            // trustStore 落 agent data dir（trust/ 子目录，首次观察时创建）。
+            // 同一 store 也注入 buyer 工具：RFQ 成功后的 supplier_save_suggested
+            // 本地建议要查已有关系（§13 M0）。
+            const supplierStore = new SupplierRelationshipStore({
+                db,
+                principalId: principal.principal_id,
+                now: clock,
+            });
+            supplierScheduler = new SupplierScheduler({
+                store: supplierStore,
+                now: clock,
+                ...(options.catalog !== undefined
+                    ? { catalogSource: new KiwiCatalogSource({ baseUrl: options.catalog }) }
+                    : {}),
+                trustStore: new TrustRecordStore({ dir: path.dirname(paths.db), now: clock }),
+                ...(options.allowLoopback === true ? { allowLoopback: true } : {}),
+            });
+            // v0.7.0 KTH：handoff 存储（Ledger 事件 + 执行幂等）落在 agent data dir，
+            // 注入 buyer 工具（handoff_agreement 工具挂载）。
+            const handoffDir = path.dirname(paths.db);
+            const handoffLedger = new HandoffEventStore({ dir: handoffDir, now: clock });
+            const handoffIdempotency = new HandoffIdempotencyStore({ dir: handoffDir, now: clock });
+            handoffRuntime = { ledger: handoffLedger, idempotency: handoffIdempotency };
+            buyerTools = buildBuyerTools({
+                store: taskStore,
+                connector: options.connector,
+                profile: options.profile,
+                ...(options.commerceClient !== undefined ? { commerceClient: options.commerceClient } : {}),
+                ...(options.broker !== undefined ? { broker: options.broker } : {}),
+                ...(options.catalog !== undefined
+                    ? {
+                        catalog: options.catalog,
+                        // CD #27 wiring：buyer kernel 配置 catalog 时注入 KiwiCatalogSource，
+                        // search_listings / shortlist_listing 工具才挂载（历史教训：工具
+                        // 只在测试里可达，运行时从未注入——dead code）。
+                        catalogSource: new KiwiCatalogSource({ baseUrl: options.catalog }),
+                    }
+                    : {}),
+                approvals,
+                mode: () => modeRef.value,
+                registerPending,
+                now: clock,
+                recordNegotiation: (input) => rememberNegotiation(store, input),
+                handoff: { ledger: handoffLedger, idempotency: handoffIdempotency },
+                supplierStore,
+            });
+        }
+        else if (options.profile.role === "merchant" &&
+            options.merchantClient !== undefined &&
+            options.broker !== undefined) {
+            if (options.profile.merchant_experience?.enabled === true &&
+                options.profile.merchant_experience.intelligence !== false) {
+                merchantIntelligence = new DefaultMerchantIntelligenceBackend({
+                    merchant_id: principal.owner_id,
+                    data_dir: path.dirname(paths.db),
+                    // 口径修复（V2 阶段二遗留核查）：presentation enrich 以
+                    // context.principalId 作为商家读取键（merchant_id 口径），backend 的
+                    // principal 校验键必须同口径——用 agent_id 会让 digest/catalog 展示
+                    // 在真实商家 profile（agent_id ≠ owner_id）下必然校验失败/读空。
+                    principal_id: principal.owner_id,
+                    merchant_client: options.merchantClient,
+                    approvals,
+                    ...(options.merchantAnalyticsSource !== undefined
+                        ? { analytics_source: options.merchantAnalyticsSource }
+                        : {}),
+                    now: clock,
+                });
+            }
+            merchantTools = buildMerchantTools({
+                profile: options.profile,
+                merchantClient: options.merchantClient,
+                // Negotiation token (commerceClient) is optional: absent → 磋商工具
+                // fail closed，目录/库存只读与审批式写工具照常可用（见 §15.3/§15.4）。
+                ...(options.commerceClient !== undefined ? { commerceClient: options.commerceClient } : {}),
+                broker: options.broker,
+                principalId: principal.principal_id,
+                approvals,
+                mode: () => modeRef.value,
+                registerPending,
+                now: clock,
+                privateValues: () => listRestrictedValues(store),
+                ...(merchantIntelligence !== undefined ? { intelligence: merchantIntelligence } : {}),
+                ...(emitEvent !== undefined ? { emitEvent } : {}),
+                // 商家 A2A 节点 ledger 基础目录（<dataDir>/a2a）——LedgerStore 会再拼
+                // /ledger 到 <dataDir>/a2a/ledger，list_a2a_negotiations 用。
+                a2aLedgerDir: path.join(path.dirname(paths.db), "a2a"),
+            });
+        }
+        const base = baseSystemPrompt(options.profile, principal, merchantSkillRegistry.names.length > 0 ? merchantSkillRegistry : undefined);
+        let briefing;
+        // §18.1 对位：0.87 的请求超时走 settings（providerRetry.timeoutMs /
+        // httpIdleTimeoutMs），kernel 侧另有 Promise.race 兜底。inMemory 设置避免
+        // 读写用户 ~/.pi/agent 的全局配置。
+        const settingsManager = SettingsManager.inMemory({
+            retry: {
+                provider: {
+                    timeoutMs: options.profile.runtime.turn_timeout_seconds * 1000,
+                },
+            },
+            httpIdleTimeoutMs: options.profile.runtime.turn_timeout_seconds * 1000,
+        });
+        const modelRuntime = withPromptCacheRetention(options.modelRuntime ?? (await buildModelRuntime(options)), options.profile.merchant_experience?.prompt_cache_retention);
+        const kiwiTools = [
+            ...buildMemoryTools(store, { turnId: () => turnId.current }),
+            ...buyerTools,
+            ...merchantTools,
+            ...merchantSkillTools,
+        ];
+        const customTools = kiwiTools.map((tool) => ({
+            name: tool.name,
+            label: tool.label,
+            description: tool.description,
+            parameters: tool.parameters,
+            // 0.87 harness declares six execute parameters (toolContext/invocation/
+            // context trailing); every kiwi tool implements only (id, params), so
+            // the adapter forwards exactly those two.
+            execute: async (toolCallId, params) => tool.execute(toolCallId, params),
+        }));
+        const { session: agentSession } = await createAgentSession({
+            cwd: paths.dir,
+            model: options.model,
+            modelRuntime: modelRuntime,
+            settingsManager,
+            sessionManager: mainSessionManager.manager,
+            customTools,
+            noTools: "builtin",
+            resourceLoader: {
+                getExtensions: () => ({ extensions: [], errors: [], runtime: createExtensionRuntime() }),
+                getSkills: () => ({ skills: [], diagnostics: [] }),
+                getPrompts: () => ({ prompts: [], diagnostics: [] }),
+                getThemes: () => ({ themes: [], diagnostics: [] }),
+                getAgentsFiles: () => ({ agentsFiles: [] }),
+                // 每次 rebuild 都会读取：briefing setter 改字段后由下一 turn 生效。
+                getSystemPrompt: () => (briefing === undefined ? base : `${base}\n\n${briefing}`),
+                getSystemPromptSource: () => undefined,
+                getAppendSystemPrompt: () => [],
+                getAppendSystemPromptSources: () => [],
+                extendResources: () => { },
+                reload: async () => { },
+            },
+            ...(options.thinkingLevel !== undefined ? { thinkingLevel: options.thinkingLevel } : {}),
+        });
+        const unsubscribeSessionEvents = emitEvent === undefined
+            ? undefined
+            : attachSessionHostEvents(agentSession, emitEvent);
+        const kernel = new AgentKernel({
+            profile: options.profile,
+            paths,
+            db,
+            store,
+            principal,
+            session: agentSession,
+            approvals,
+            ...(handoffRuntime !== undefined ? { handoffRuntime } : {}),
+            modeRef,
+            pendingHooks,
+            turnId,
+            now: clock,
+            ...(taskStore !== undefined ? { taskStore } : {}),
+            ...(scheduler !== undefined ? { scheduler } : {}),
+            ...(supplierScheduler !== undefined ? { supplierScheduler } : {}),
+            ...(options.commerceClient !== undefined ? { commerceClient: options.commerceClient } : {}),
+            ...(options.merchantClient !== undefined ? { merchantClient: options.merchantClient } : {}),
+            ...(options.broker !== undefined ? { broker: options.broker } : {}),
+            ...(merchantIntelligence !== undefined ? { merchantIntelligence } : {}),
+            emitEvent,
+            ...(unsubscribeSessionEvents !== undefined ? { unsubscribeSessionEvents } : {}),
+        });
+        kernel.briefingSetter = (value) => {
+            briefing = value;
+        };
+        return kernel;
+    }
+    briefingSetter = () => undefined;
+    /**
+     * v0.7.0 KTH：handoff 运行态摘要（/handoff 命令用）——候选生命周期 +
+     * 交付观察状态，从 Ledger 事件投影（#17 用户可见目标与摘要、#18 可审计）。
+     */
+    get handoffSummary() {
+        if (this.handoffRuntime === undefined)
+            return { enabled: false };
+        const candidates = [];
+        const handoffs = [];
+        for (const negotiationId of this.handoffRuntime.ledger.listNegotiations()) {
+            const events = this.handoffRuntime.ledger.events(negotiationId).map((event) => this.handoffRuntime.ledger.resolvePayload(event));
+            const seenCandidates = new Set();
+            const seenHandoffs = new Set();
+            for (const event of events) {
+                if (event.handoff_candidate_id !== undefined &&
+                    !seenCandidates.has(event.handoff_candidate_id)) {
+                    seenCandidates.add(event.handoff_candidate_id);
+                    const lifecycle = foldCandidateLifecycle(events.filter((e) => e.handoff_candidate_id === event.handoff_candidate_id));
+                    const candidateEvents = events.filter((e) => e.handoff_candidate_id === event.handoff_candidate_id);
+                    const created = candidateEvents.find((e) => e.event_kind === "handoff_candidate_created");
+                    const embedded = created?.outcome.kind === "ok"
+                        ? created.outcome.result?.candidate
+                        : undefined;
+                    candidates.push({
+                        candidate_id: event.handoff_candidate_id,
+                        negotiation_id: negotiationId,
+                        lifecycle: lifecycle ?? "UNKNOWN",
+                        destination_type: typeof embedded?.destination_type === "string" ? embedded.destination_type : "?",
+                        destination_ref: typeof embedded?.destination_ref === "string" ? embedded.destination_ref : "?",
+                        display_summary: (() => {
+                            const summary = embedded?.display_summary;
+                            return {
+                                merchant: typeof summary?.merchant === "string" ? summary.merchant : "?",
+                                summary: typeof summary?.summary === "string" ? summary.summary : "?",
+                            };
+                        })(),
+                    });
+                }
+                if (event.handoff_id !== undefined && !seenHandoffs.has(event.handoff_id)) {
+                    seenHandoffs.add(event.handoff_id);
+                    handoffs.push({
+                        handoff_id: event.handoff_id,
+                        delivery: deliveryState(events.filter((e) => e.handoff_id === event.handoff_id)) ?? "?",
+                    });
+                }
+            }
+        }
+        return { enabled: true, candidates, handoffs };
+    }
+    /** 模拟 OS/browser/deep-link handler 启动（LAUNCHED；不证明页面加载）。 */
+    async launchHandoff(handoffId, negotiationId) {
+        if (this.handoffRuntime === undefined)
+            return "Handoff 未启用。";
+        const events = this.handoffRuntime.ledger.events(negotiationId).map((event) => this.handoffRuntime.ledger.resolvePayload(event));
+        const handoffEvents = events.filter((e) => e.handoff_id === handoffId);
+        if (handoffEvents.length === 0)
+            return `未知 handoff ${handoffId}（negotiation ${negotiationId}）。`;
+        const candidateId = handoffEvents[0]?.handoff_candidate_id;
+        if (candidateId === undefined)
+            return "handoff 事件缺少候选引用。";
+        const candidateEvents = events.filter((e) => e.handoff_candidate_id === candidateId);
+        const created = candidateEvents.find((e) => e.event_kind === "handoff_candidate_created");
+        const embedded = created?.outcome.kind === "ok"
+            ? created.outcome.result?.candidate
+            : undefined;
+        if (embedded === undefined)
+            return "候选文档缺失，无法启动。";
+        const { validateHandoffCandidate } = await import("../handoff/index.js");
+        const candidate = validateHandoffCandidate(embedded);
+        recordLaunch({
+            ledger: this.handoffRuntime.ledger,
+            candidate,
+            handoff_id: handoffId,
+            identity: {
+                sender_identity: candidate.buyer_identity_ref,
+                counterparty_identity: candidate.merchant_identity_ref,
+                actor: "buyer",
+            },
+            capability: {
+                capability: "com.harrylabsj.kiwi.shopping.negotiation",
+                protocol_version: "1.0",
+            },
+            now: this.clock,
+        });
+        return `handoff ${handoffId} 已启动（LAUNCHED）——不证明页面加载。`;
+    }
+    /** 本地回调证据：handoff-open 演示（OPENED_CONFIRMED 证据门，KTH §9）。 */
+    async confirmHandoffOpened(handoffId, negotiationId) {
+        if (this.handoffRuntime === undefined)
+            return "Handoff 未启用。";
+        const events = this.handoffRuntime.ledger.events(negotiationId).map((event) => this.handoffRuntime.ledger.resolvePayload(event));
+        const handoffEvents = events.filter((e) => e.handoff_id === handoffId);
+        if (handoffEvents.length === 0)
+            return `未知 handoff ${handoffId}（negotiation ${negotiationId}）。`;
+        const candidateId = handoffEvents[0]?.handoff_candidate_id;
+        if (candidateId === undefined)
+            return "handoff 事件缺少候选引用。";
+        const created = events
+            .filter((e) => e.handoff_candidate_id === candidateId)
+            .find((e) => e.event_kind === "handoff_candidate_created");
+        const embedded = created?.outcome.kind === "ok"
+            ? created.outcome.result?.candidate
+            : undefined;
+        if (embedded === undefined)
+            return "候选文档缺失，无法确认。";
+        const { validateHandoffCandidate } = await import("../handoff/index.js");
+        const candidate = validateHandoffCandidate(embedded);
+        recordOpenEvidence({
+            ledger: this.handoffRuntime.ledger,
+            candidate,
+            handoff_id: handoffId,
+            identity: {
+                sender_identity: candidate.buyer_identity_ref,
+                counterparty_identity: candidate.merchant_identity_ref,
+                actor: "buyer",
+            },
+            capability: {
+                capability: "com.harrylabsj.kiwi.shopping.negotiation",
+                protocol_version: "1.0",
+            },
+            now: this.clock,
+            evidence: { kind: "local_callback", handoff_id: handoffId, at: this.clock() },
+        });
+        return `handoff ${handoffId} 已确认打开（OPENED_CONFIRMED，evidence=local_callback）。`;
+    }
+    get memoryStore() {
+        return this.store;
+    }
+    /** Buyer task store (undefined for merchant kernels). */
+    get buyerTasks() {
+        return this.taskStore;
+    }
+    /** WriteApprovalCandidate approval store (both roles; undefined only if unopened). */
+    get actionCandidates() {
+        return this.approvals;
+    }
+    /** Current runtime write-approval mode (design §16). */
+    getMode() {
+        return this.modeRef.value;
+    }
+    /**
+     * Change the runtime mode. Switching INTO autopilot requires an explicit
+     * `confirm` — the same fail-closed rule as the operator control plane
+     * (operator control-plane design §8).
+     */
+    setMode(mode, options) {
+        if (!isAgentMode(mode)) {
+            return { ok: false, error: `未知模式：${String(mode)}（可选 ${AGENT_MODES.join("/")}）` };
+        }
+        if (this.modeRef.value === mode)
+            return { ok: true };
+        if (mode === "autopilot" && options?.confirmed !== true) {
+            return { ok: false, error: "切换到 autopilot 需要显式确认：/mode autopilot confirm" };
+        }
+        this.modeRef.value = mode;
+        return { ok: true };
+    }
+    /** Pending WriteApprovalCandidates awaiting /approve (fail closed on expiry). */
+    listPendingApprovals() {
+        if (this.approvals === undefined)
+            return [];
+        const pending = this.approvals.listPending(); // 内部 expireDue：过期候选已标记 expired
+        // 清理已终结候选的执行钩子闭包（评审项 P3-5）：expired/superseded/
+        // executed/rejected 后的 hooks 不再需要，防内存无界增长。
+        const live = new Set(pending.map((c) => c.candidate_id));
+        for (const id of [...this.pendingHooks.keys()]) {
+            if (!live.has(id))
+                this.pendingHooks.delete(id);
+        }
+        return pending;
+    }
+    /** 释放候选执行钩子闭包（评审项 P3-5；候选生命周期终结后调用）。 */
+    releasePending(candidateId) {
+        this.pendingHooks.delete(candidateId);
+    }
+    /**
+     * Approve + execute a pending WriteApprovalCandidate. Execution re-reads the
+     * preconditions and re-hashes them (§16): a stale or expired approval is
+     * superseded, never executed. A candidate left over from a previous process
+     * (no live execution hooks) is expired, matching operator-plane recovery.
+     */
+    approveCandidate(candidateId) {
+        // Serialized with all other kernel work. Note: slash handlers run INSIDE
+        // the kernel chain, so they call approveCandidateInner directly to avoid
+        // a nested-enqueue deadlock.
+        return this.enqueue(() => this.approveCandidateInner(candidateId));
+    }
+    /** Approval execution without re-enqueueing (callers must already be serialized). */
+    async approveCandidateInner(candidateId) {
+        if (this.approvals === undefined) {
+            throw new MemoryError("validation", "审批存储不可用");
+        }
+        const candidate = this.approvals.get(candidateId);
+        if (candidate === undefined) {
+            throw new MemoryError("validation", `未知审批候选 ${candidateId}`);
+        }
+        const report = async (result) => {
+            const current = this.approvals?.get(candidateId);
+            await this.emitEvent?.("candidate_update", {
+                candidate_id: candidateId,
+                status: current?.status ?? result.candidate.status,
+                preview: publicCandidatePreview(current ?? result.candidate),
+            });
+            return result;
+        };
+        // manual 模式语义（评审项 P3-3）：manual = advice only（never executes）。
+        // routeWriteCandidate 在 manual 分支仍注册执行钩子（供 /pending 显示与
+        // /revise 重算），但批准路径必须拒绝——此前 /approve 绕过模式直接执行，
+        // 与 operator 平面分叉（controller 对 advice_only 候选明确拒绝批准：
+        // "manual 模式只提供建议，不自动提交"）。
+        if (this.getMode() === "manual") {
+            return report({
+                kind: "not_approvable",
+                candidate,
+                reason: "manual 模式只提供建议，不自动执行（/approve 拒绝 advice-only 候选）",
+            });
+        }
+        const hooks = this.pendingHooks.get(candidateId);
+        if (hooks === undefined) {
+            // Cross-restart recovery (design §18.3): without live hooks the
+            // candidate cannot be re-validated against the current marketplace.
+            if (candidate.status === "expired") {
+                this.releasePending(candidateId);
+                return report({ kind: "expired", candidate });
+            }
+            if (candidate.status !== "pending_approval" && candidate.status !== "approved") {
+                this.releasePending(candidateId);
+                return report({
+                    kind: "not_approvable",
+                    candidate,
+                    reason: `候选 ${candidateId} 状态为 ${candidate.status}，不可批准。`,
+                });
+            }
+            const expired = this.approvals.expireCandidate(candidateId);
+            this.releasePending(candidateId);
+            return report({ kind: "expired", candidate: expired });
+        }
+        this.approvals.markApproved(candidateId);
+        const outcome = await executeApprovedCandidate(this.approvals, candidateId, hooks);
+        // 无论结果（executed / stale=superseded / expired），候选生命周期已终结，
+        // 执行钩子不再需要——释放闭包防泄漏（评审项 P3-5）。
+        if (outcome.kind !== "not_approvable") {
+            this.releasePending(candidateId);
+        }
+        return report(outcome);
+    }
+    /** Reject a pending/advice-only WriteApprovalCandidate. Never executes. */
+    rejectCandidate(candidateId) {
+        if (this.approvals === undefined)
+            return { ok: false, error: "审批存储不可用" };
+        const candidate = this.approvals.get(candidateId);
+        if (candidate === undefined)
+            return { ok: false, error: `未知审批候选 ${candidateId}` };
+        if (candidate.status !== "pending_approval" && candidate.status !== "approved") {
+            return { ok: false, error: `候选 ${candidateId} 状态为 ${candidate.status}，不可驳回` };
+        }
+        this.approvals.reject(candidateId);
+        this.releasePending(candidateId);
+        void this.emitEvent?.("candidate_update", {
+            candidate_id: candidateId,
+            status: this.approvals.get(candidateId)?.status ?? "rejected",
+            preview: publicCandidatePreview(this.approvals.get(candidateId)),
+        });
+        return { ok: true };
+    }
+    /**
+     * Run one scheduler tick (buyer kernels only): due wakeups, tracking-rule
+     * checks and notifications, all derived from the database (restart-safe).
+     * Serialized with everything else the kernel does.
+     */
+    schedulerTick(budget = {}) {
+        return this.enqueue(async () => {
+            // 惰性过期清扫（评审项 L1）：到期未执行的 handoff 候选落 expired 事件，
+            // TUI /handoff 不再永久显示"从未获批/从未执行"。
+            this.handoffRuntime?.ledger.sweepExpiredCandidates(this.clock());
+            // 审查 P3：交付域同样清扫——DELIVERED/LAUNCHED 打开时限过期落
+            // handoff_expired（此前该事件全仓无生产者，"过期未打开"不可观测）。
+            this.handoffRuntime?.ledger.sweepExpiredHandoffs(this.clock());
+            const empty = {
+                checked_rules: 0,
+                requests_used: 0,
+                notifications: [],
+                tasks_searched: [],
+                tasks_expired: [],
+                errors: [],
+            };
+            const result = this.scheduler === undefined ? empty : await this.scheduler.tick(budget);
+            // M1：供应商关系 pull tick 走同一 kernel 串行链，共享请求预算；
+            // supplier tick 失败不影响 task tick 结果（错误进 supplier.errors）。
+            if (this.supplierScheduler !== undefined) {
+                const totalBudget = budget.max_requests ?? 20;
+                result.supplier = await this.supplierScheduler.tick({
+                    max_requests: Math.max(0, totalBudget - result.requests_used),
+                });
+            }
+            return result;
+        });
+    }
+    /** 惰性过期清扫入口（/handoff 渲染前调用；幂等，可重复调）。 */
+    sweepHandoffCandidates() {
+        if (this.handoffRuntime === undefined)
+            return 0;
+        return this.handoffRuntime.ledger.sweepExpiredCandidates(this.clock());
+    }
+    /**
+     * Autonomous negotiation follow-up (autopilot only): if this agent has a
+     * pending negotiation message, drive ONE deterministic turn to handle it.
+     * The deterministic decision negotiates within the profile's HardPolicy
+     * (buyer budget / merchant floor+discount) and auto-submits through the
+     * gateway gate — no per-turn human and no LLM tool-loop fragility. Escalated
+     * (out-of-rule) decisions park for a human. Returns a progress line for the
+     * chat, or undefined when there is nothing to do.
+     */
+    negotiationAutoTick() {
+        // 与 schedulerTick 同级：整个 tick 必须进 kernel 串行链（enqueue）。此前
+        // 被 chat-tui 定时器直接调用，可与最长 turn_timeout 的模型回合并发操作
+        // 同一 pending conversation（双路同时 claim/提交同一磋商）。
+        return this.enqueue(async () => this.negotiationAutoTickUnlocked());
+    }
+    async negotiationAutoTickUnlocked() {
+        if (this.modeRef.value !== "autopilot")
+            return undefined;
+        if (this.commerceClient === undefined)
+            return undefined;
+        // Skip conversations already settled/at-consensus BEFORE claiming — the
+        // stateless deterministic decision would otherwise re-counter the same
+        // offer forever and re-open settled negotiations every tick.
+        let pending;
+        try {
+            pending = await this.commerceClient.listPendingMessages();
+        }
+        catch {
+            return undefined;
+        }
+        const settledKey = (message) => `${message.conversation_id}:${message.message_id}`;
+        // 审查 P2-I：冷却窗口内的消息跳过（连续失败达上限后暂停自动处理）。
+        const stalled = this.stalledNegotiations;
+        const isStalled = (message) => {
+            const entry = stalled.get(settledKey(message));
+            // 达到连续失败上限才进入冷却（上限前的失败继续重试计数）
+            if (entry === undefined || entry.attempts < AUTOPILOT_MAX_SUBMIT_FAILURES)
+                return false;
+            const sinceMs = Date.parse(entry.since);
+            const nowMs = Date.parse(this.clock());
+            if (!Number.isFinite(sinceMs) || !Number.isFinite(nowMs))
+                return false;
+            return nowMs - sinceMs < AUTOPILOT_STALL_COOLDOWN_MS;
+        };
+        if (pending.every((m) => this.settledNegotiations.has(settledKey(m)) || isStalled(m))) {
+            return undefined;
+        }
+        // Never let an abandoned/settled message at the head of the pending list
+        // starve a live message behind it. Skip by the composite
+        // (conversation_id, message_id) key, never by bare message_id: message ids
+        // are per-conversation, so a settled message must not suppress a live
+        // message in another conversation that happens to share the same id.
+        // A new message in the same conversation has a different key and remains
+        // eligible.
+        const settledKeys = new Set(this.settledNegotiations);
+        const stalledKeys = new Set([...stalled.entries()]
+            .filter(([, entry]) => {
+            if (entry.attempts < AUTOPILOT_MAX_SUBMIT_FAILURES)
+                return false;
+            const sinceMs = Date.parse(entry.since);
+            const nowMs = Date.parse(this.clock());
+            return (Number.isFinite(sinceMs) &&
+                Number.isFinite(nowMs) &&
+                nowMs - sinceMs < AUTOPILOT_STALL_COOLDOWN_MS);
+        })
+            .map(([key]) => key));
+        // Buyer: negotiate toward the linked task's goal (quantity / target unit
+        // price / budget) instead of the profile defaults.
+        let hints;
+        const firstPending = pending.find((m) => !settledKeys.has(settledKey(m)) && !stalledKeys.has(settledKey(m)));
+        if (firstPending !== undefined &&
+            this.profile.role === "buyer" &&
+            this.taskStore !== undefined) {
+            const link = this.taskStore.linkByConversation(firstPending.conversation_id);
+            if (link !== undefined) {
+                const task = this.taskStore.getTask(link.task_id);
+                if (task !== undefined)
+                    hints = taskNegotiationHints(this.taskStore, task);
+            }
+        }
+        const runner = new DeterministicNegotiationRunner(this.profile, this.commerceClient);
+        const prepared = await runner
+            .prepare({
+            ...(hints !== undefined ? { hints } : {}),
+            ...(settledKeys.size > 0 || stalledKeys.size > 0
+                ? { skipKeys: new Set([...settledKeys, ...stalledKeys]) }
+                : {}),
+        })
+            .catch(() => undefined);
+        if (prepared === undefined)
+            return undefined;
+        const convId = prepared.binding.conversation_id;
+        // Termination: STOP when the counterpart just accepted our offer — report
+        // the consensus once and never re-open this conversation.
+        if (prepared.counterpart_action === "accept_nonbinding") {
+            this.markSettled(settledKey(prepared.binding));
+            // 审查 BUG-08：对方已接受 = 本消息已处理——以 completeClaim 权威结算
+            // （此前 abandon 释放 claim 允许重领，进程内存 settled 集合重启即失，
+            // 消息再次进入处理产生重复 claim/快照/共识通知）。
+            await runner.complete(prepared).catch(() => undefined);
+            return `已达成共识（对方接受非绑定报价），磋商结束，不再继续。`;
+        }
+        if (this.settledNegotiations.has(settledKey(prepared.binding))) {
+            await runner.abandon(prepared, "negotiation already settled").catch(() => undefined);
+            return undefined;
+        }
+        const outcome = await runner.submit(prepared).catch(() => undefined);
+        if (outcome === undefined)
+            return "磋商处理失败（网关异常），下一轮自动重试。";
+        const bindingKey = settledKey(prepared.binding);
+        // 审查 P2-I：权威门确定性拒绝（settlement failed）→ 连续失败计数；
+        // 达上限进入冷却窗口（窗口内跳过、窗口后重试一次），并清空"已结算"
+        // 误记——被拒消息绝不进 settled 集合（那是共识终态语义）。
+        if (outcome.settlement === "failed") {
+            const prev = stalled.get(bindingKey);
+            const attempts = (prev?.attempts ?? 0) + 1;
+            if (attempts >= AUTOPILOT_MAX_SUBMIT_FAILURES) {
+                stalled.set(bindingKey, { since: this.clock(), attempts });
+                return (`已自动处理 ${convId}：连续 ${attempts} 次被网关拒绝` +
+                    `（${outcome.policy_result.public_reason}），暂停自动处理 ` +
+                    `${AUTOPILOT_STALL_COOLDOWN_MS / 60_000} 分钟（可手动 /approve 或改策略后重试）。`);
+            }
+            stalled.set(bindingKey, { since: this.clock(), attempts });
+        }
+        else {
+            // 成功/已共识：清除冷却记录
+            stalled.delete(bindingKey);
+        }
+        // Our own non-binding acceptance ends the negotiation.
+        if (prepared.decision.action === "accept_nonbinding") {
+            this.markSettled(bindingKey);
+        }
+        const counterpart = prepared.counterpart_message !== undefined
+            ? `对方：「${prepared.counterpart_message.slice(0, 60)}」`
+            : "";
+        const proposal = prepared.decision.proposal;
+        const offer = proposal !== undefined
+            ? `，出价 ${proposal.unit_price}${proposal.currency ?? ""}×${proposal.quantity}`
+            : "";
+        const sent = prepared.decision.public_message !== ""
+            ? `；已发「${prepared.decision.public_message.slice(0, 60)}」`
+            : "";
+        const detail = outcome.settlement === "failed" ? `（${outcome.policy_result.public_reason}）` : "";
+        return (`已自动处理 ${convId}：${counterpart} → ` +
+            `${prepared.decision.action}${offer} = ${outcome.policy_result.result}${sent}${detail}`);
+    }
+    get isShutdownRequested() {
+        return this.shutdownRequested;
+    }
+    /** Serialize all kernel work — one message, command or event at a time. */
+    enqueue(work) {
+        const next = this.chain.then(work);
+        this.chain = next.catch(() => undefined);
+        return next;
+    }
+    /**
+     * Handle one user input line: slash commands run deterministically;
+     * anything else goes to the model with a per-turn memory briefing.
+     */
+    /**
+     * 把一段上下文注入会话（不触发模型回复）：`/negotiate` 等确定性动作的结果
+     * 写入 session（user 角色、带「系统记录」标记），下一轮用户提问时模型能看到
+     * （消除"两个脑"）。
+     */
+    async injectContext(text) {
+        // 0.87：走 sessionManager 纯入列（不触发模型），下轮 prompt 时进入
+        // buildSessionProjection。appendMessage 已被消毒包装拦截 thinking。
+        this.session.sessionManager.appendMessage({
+            role: "user",
+            content: `[系统记录] ${text}`,
+            timestamp: Date.now(),
+        });
+        this.session.refreshContext();
+    }
+    async runMerchantGroundingRead(read) {
+        await this.emitEvent?.("grounding_started", {
+            rule: read.tool,
+            tool: read.tool,
+            reason: read.reason,
+        });
+        try {
+            let payload;
+            if (read.tool === "get_business_snapshot" && this.merchantIntelligence !== undefined) {
+                payload = await this.merchantIntelligence.getBusinessSnapshot({ merchant_id: this.principal.owner_id });
+            }
+            else if (read.tool === "get_negotiation_digest" && this.merchantIntelligence !== undefined) {
+                payload = await this.merchantIntelligence.getNegotiationDigest({
+                    merchant_id: this.principal.owner_id,
+                    status: "active",
+                    limit: 20,
+                });
+            }
+            else if (read.tool === "get_pending_actions" && this.merchantIntelligence !== undefined) {
+                payload = await this.merchantIntelligence.getPendingActions();
+            }
+            else if (read.tool === "get_catalog_health" && this.merchantIntelligence !== undefined) {
+                payload = await this.merchantIntelligence.getCatalogHealth({ merchant_id: this.principal.owner_id });
+            }
+            else if (read.tool === "get_human_review_queue" && this.merchantClient !== undefined) {
+                payload = await this.merchantClient.getHumanReviewQueue(this.principal.owner_id);
+            }
+            else if (read.tool === "list_catalog_products" && this.merchantClient !== undefined) {
+                payload = await this.merchantClient.listProducts(this.principal.owner_id);
+            }
+            else {
+                throw new Error("grounding dependency is unavailable");
+            }
+            await this.emitEvent?.("grounding_completed", {
+                rule: read.tool,
+                tool: read.tool,
+                status: "ok",
+            });
+            return [
+                `[Grounding · ${read.reason}]`,
+                fenceModelPayload(read.tool === "get_negotiation_digest" ? "a2a_message" : "merchant_api", payload, { maxChars: this.profile.merchant_experience?.max_external_context_chars ?? 12_000 }),
+            ].join("\n");
+        }
+        catch {
+            await this.emitEvent?.("grounding_completed", {
+                rule: read.tool,
+                tool: read.tool,
+                status: "error",
+                retryable: true,
+            });
+            return `[Grounding · ${read.reason}] 当前权威读取不可用，不要把缺失数据当作零值。`;
+        }
+    }
+    /** Run at most two deterministic, read-only merchant grounding reads per turn. */
+    async merchantGrounding(text) {
+        if (this.profile.role !== "merchant" ||
+            this.profile.merchant_experience?.enabled !== true ||
+            this.profile.merchant_experience.grounding === false) {
+            return undefined;
+        }
+        const reads = groundingReads(MERCHANT_GROUNDING_RULES, merchantGroundingContext(this.profile, text), 2);
+        if (reads.length === 0)
+            return undefined;
+        return (await Promise.all(reads.map((read) => this.runMerchantGroundingRead(read)))).join("\n\n");
+    }
+    /**
+     * 把一轮 A2A 磋商结果写入记忆（episode namespace，active 无需人工确认）：
+     * 持久上下文，`/why` 可查、跨重启可恢复。
+     */
+    recordNegotiation(input) {
+        return rememberNegotiation(this.store, input);
+    }
+    handleUserText(text) {
+        return this.enqueue(async () => {
+            if (this.closed)
+                throw new MemoryError("validation", "kernel is closed");
+            if (text.startsWith("/")) {
+                return await this.handleSlash(text);
+            }
+            const startedAt = Date.now();
+            await this.emitEvent?.("message", { role: "user", text });
+            const memories = this.store.retrieve({
+                session_id: MAIN_SESSION_ID,
+                purpose: "clarify",
+                text,
+            });
+            const memoryBriefing = renderMemoryBriefing(memories);
+            const groundingBriefing = await this.merchantGrounding(text);
+            this.briefingSetter(combineDynamicBriefing([memoryBriefing, groundingBriefing]));
+            // Advance the turn id so several remember calls inside this one turn
+            // dedup into a single evidence piece (§9.3).
+            this.turnId.current = `${MAIN_SESSION_ID}:${++this.turnSeq}`;
+            try {
+                // 0.87：session.prompt 返回 void；assistant 文本从事件流收集。
+                let reply = "";
+                const collect = (event) => {
+                    if (event.type === "message_end" &&
+                        event.message?.role === "assistant" &&
+                        Array.isArray(event.message.content)) {
+                        const text = event.message.content
+                            .filter((b) => b.type === "text")
+                            .map((b) => b.text ?? "")
+                            .join("");
+                        if (text !== "")
+                            reply = text;
+                    }
+                };
+                const unsubscribe = this.session.subscribe(collect);
+                const timeoutMs = this.profile.runtime.turn_timeout_seconds * 1000;
+                let timer;
+                const timeout = new Promise((resolve) => {
+                    timer = setTimeout(() => resolve("timeout"), timeoutMs);
+                });
+                try {
+                    const outcome = await Promise.race([
+                        this.session.prompt(text).then(() => "done"),
+                        timeout,
+                    ]);
+                    if (outcome === "timeout") {
+                        await this.session.abort();
+                        await this.session.waitForIdle();
+                        reply = "";
+                        await this.emitEvent?.("error", {
+                            code: "model_turn_timeout",
+                            message: `model turn exceeded ${this.profile.runtime.turn_timeout_seconds}s`,
+                            retryable: true,
+                        });
+                    }
+                }
+                finally {
+                    if (timer !== undefined)
+                        clearTimeout(timer);
+                    unsubscribe();
+                }
+                // §18.1: a model failure (throw OR empty response) must leave the
+                // conversation and TUI intact.
+                if (reply === "") {
+                    await this.emitEvent?.("error", {
+                        code: "empty_model_response",
+                        message: "model returned an empty response",
+                        retryable: true,
+                    });
+                    return {
+                        text: "暂时没能给出有效回复——当前目录里可能没有匹配的商品或商家，也可能是这条需求还不够具体。补充品牌、型号或预算范围后再问我一次即可。",
+                        quit: false,
+                    };
+                }
+                await this.emitEvent?.("message", { role: "assistant", text: reply });
+                return { text: reply, quit: false };
+            }
+            catch (err) {
+                await this.emitEvent?.("error", {
+                    code: "model_turn_failed",
+                    message: err instanceof Error ? err.message : String(err),
+                    retryable: true,
+                });
+                return {
+                    text: `模型处理失败：${err instanceof Error ? err.message : String(err)}。对话状态未改变，请重试。`,
+                    quit: false,
+                };
+            }
+            finally {
+                await this.emitEvent?.("turn_complete", {
+                    elapsed_ms: Date.now() - startedAt,
+                    stop_reason: "complete",
+                });
+                this.briefingSetter(undefined);
+            }
+        });
+    }
+    async handleSlash(input) {
+        const [command = "", ...rest] = input.trim().split(/\s+/);
+        const arg = rest.join(" ").trim();
+        try {
+            switch (command) {
+                case "/memory":
+                    return { text: this.renderMemory(arg), quit: false };
+                case "/forget":
+                    return { text: this.handleForget(arg), quit: false };
+                case "/correct":
+                    return { text: this.handleCorrect(arg), quit: false };
+                case "/confirm":
+                    return { text: this.handleConfirm(arg), quit: false };
+                case "/private":
+                    return { text: this.renderPrivate(), quit: false };
+                case "/why":
+                    return { text: this.renderWhy(), quit: false };
+                case "/mode":
+                    return { text: this.handleMode(arg), quit: false };
+                case "/pending":
+                    return { text: this.renderPending(), quit: false };
+                case "/approve":
+                    return { text: await this.handleApprove(arg), quit: false };
+                case "/reject":
+                    return { text: this.handleReject(arg), quit: false };
+                case "/register":
+                    return { text: await this.handleRegister(arg), quit: false };
+                case "/help":
+                    return { text: COMMANDS_HELP, quit: false };
+                case "/quit":
+                    this.shutdownRequested = true;
+                    return { text: "正在安全退出…", quit: true };
+                default:
+                    return { text: `未知命令 ${command}，输入 /help 查看命令。`, quit: false };
+            }
+        }
+        catch (err) {
+            const message = err instanceof MemoryError ? err.message : String(err);
+            return { text: `命令失败：${message}`, quit: false };
+        }
+    }
+    // ---- slash command implementations ---------------------------------------
+    renderMemory(arg) {
+        if (arg === "preferences") {
+            const prefs = this.store.listMemories({ namespace: "preference" });
+            if (prefs.length === 0)
+                return "[记忆] 还没有学习到的偏好。";
+            const lines = prefs.map((m) => `  · ${m.memory_id} [${m.status}] ${m.key}（置信度 ${m.confidence} · ${m.source_kind} · 证据 ${m.evidence_count}）`);
+            return ["[记忆] 学习到的偏好（候选需确认后才生效）:", ...lines].join("\n");
+        }
+        if (arg === "private") {
+            const restricted = this.store.listMemories({ sensitivity: "restricted" });
+            const privates = this.store.listMemories({ sensitivity: "private" });
+            const lines = ["[记忆] 私密资料（只显示字段名与状态，不回显明文）:"];
+            if (restricted.length === 0 && privates.length === 0) {
+                lines.push("  （暂无）");
+            }
+            for (const m of restricted) {
+                lines.push(`  · ${m.memory_id} [${m.status}] ${m.key}（restricted · Vault 加密保存）`);
+            }
+            for (const m of privates) {
+                lines.push(`  · ${m.memory_id} [${m.status}] ${m.key}（private）`);
+            }
+            return lines.join("\n");
+        }
+        const items = this.store.listMemories({});
+        if (items.length === 0)
+            return "[记忆] 还没有任何记忆。";
+        const lines = items.map((m) => {
+            const pending = m.status === "candidate" ? " · 待确认" : "";
+            return `  · ${m.memory_id} [${m.status}] ${m.namespace}/${m.key}（置信度 ${m.confidence}${pending}）`;
+        });
+        return [`[记忆] 共 ${items.length} 条（candidate/active/needs_review）:`, ...lines].join("\n");
+    }
+    findMemoryForForget(arg) {
+        if (arg.startsWith("mem_")) {
+            const item = this.store.getMemory(arg);
+            return item ?? `找不到记忆 ${arg}`;
+        }
+        const needle = arg.toLowerCase();
+        const matches = this.store.listMemories({}).filter((m) => m.key.toLowerCase().includes(needle));
+        if (matches.length === 0)
+            return `找不到与「${arg}」匹配的记忆`;
+        if (matches.length > 1) {
+            const lines = matches.map((m) => `  · ${m.memory_id} ${m.key}`);
+            return [`「${arg}」匹配到多条记忆，请用 memory-id 指定:`, ...lines].join("\n");
+        }
+        return matches[0];
+    }
+    handleForget(arg) {
+        if (arg === "")
+            return "用法：/forget <memory-id|描述>";
+        const target = this.findMemoryForForget(arg);
+        if (typeof target === "string")
+            return target;
+        this.store.forgetMemory(target.memory_id, "user", "via /forget");
+        return `[记忆] 已遗忘 ${target.memory_id}（${target.key}），不再用于任何回答。`;
+    }
+    handleCorrect(arg) {
+        const splitAt = arg.indexOf(" ");
+        if (splitAt <= 0)
+            return "用法：/correct <memory-id> <新内容>";
+        const memoryId = arg.slice(0, splitAt).trim();
+        const raw = arg.slice(splitAt + 1).trim();
+        if (raw === "")
+            return "用法：/correct <memory-id> <新内容>";
+        let value;
+        try {
+            value = JSON.parse(raw);
+        }
+        catch {
+            value = raw;
+        }
+        const memory = this.store.correctMemory(memoryId, { value }, "user", "via /correct");
+        return `[记忆] 已修正 ${memory.memory_id}（版本 ${memory.version}），旧值保留在审计事件中。`;
+    }
+    /** Owner-only reveal of Restricted (Vault) values — never echoed to a buyer. */
+    renderPrivate() {
+        const values = listRestrictedValues(this.store);
+        if (values.length === 0)
+            return "[私有] 暂无私密阈值记忆。";
+        return [
+            "[私有] 你的私密阈值（仅你可见；绝不要把它们写进对外消息或报价）:",
+            ...values.map((v) => `  · ${v.key} = ${v.value}`),
+        ].join("\n");
+    }
+    /** Human-only promotion of a candidate (design §10.1): constraints and
+     * restricted values require /confirm before they take effect. */
+    handleConfirm(arg) {
+        if (arg === "")
+            return "用法：/confirm <memory-id>";
+        if (!arg.startsWith("mem_")) {
+            return "请用 memory-id 指定（/memory 可查看候选的 id）。";
+        }
+        const memory = this.store.confirmMemory(arg, "user");
+        return `[记忆] 已确认 ${memory.memory_id}（${memory.key}），现在生效。`;
+    }
+    renderWhy() {
+        const { entries } = this.store.explainLastRetrieval(MAIN_SESSION_ID);
+        if (entries.length === 0) {
+            return "[记忆] 最近的回答没有使用任何记忆。";
+        }
+        const lines = entries.map((e) => `  · ${e.memory_id} ${e.namespace}/${e.key}（用途 ${e.purpose} · 精度 ${e.redaction_level} · 置信度 ${e.confidence}）`);
+        return ["[记忆] 最近一轮回答使用了以下记忆:", ...lines].join("\n");
+    }
+    // ---- write-approval slash commands (design §16) ---------------------------
+    handleMode(arg) {
+        if (arg === "") {
+            return `[模式] 当前写操作审批模式：${this.getMode()}（manual/supervised/autopilot；autopilot 需 confirm）`;
+        }
+        const [target, confirm] = arg.split(/\s+/);
+        const result = this.setMode(target, { confirmed: confirm === "confirm" });
+        if (!result.ok)
+            return `[模式] ${result.error ?? "切换失败"}`;
+        return `[模式] 已切换到 ${this.getMode()}。写操作将按新模式路由（supervised 需 /approve）。`;
+    }
+    renderPending() {
+        const pending = this.listPendingApprovals();
+        if (pending.length === 0) {
+            return "[审批] 当前没有等待批准且仍可执行的写操作候选。候选在重启后会自动失效；如需继续，请重新生成候选。";
+        }
+        const lines = pending.map((c, i) => {
+            const args = JSON.stringify(c.arguments);
+            const task = c.task_id === undefined ? "" : ` task=${c.task_id}`;
+            return `  ${i + 1}. ${c.candidate_id} [${c.risk}] ${c.tool}${task}（截止 ${c.expires_at}）args=${args.slice(0, 80)}`;
+        });
+        return [
+            "[审批] 等待批准的写操作候选（/approve <编号|id> 批准；/approve all 全部批准；/reject <编号|id> 驳回）:",
+            ...lines,
+        ].join("\n");
+    }
+    /** 把写操作执行结果渲染成操作者可读语言，而非原始 JSON。
+     *  优先用工具自带的自然语言 summary/text；否则给一行精简要点（不 dump
+     *  内部 id/明细）。 */
+    renderApprovalOutput(output) {
+        const summary = output.summary;
+        if (typeof summary === "string" && summary.trim() !== "")
+            return summary.trim();
+        const text = output.text;
+        if (typeof text === "string" && text.trim() !== "")
+            return text.trim();
+        const bits = [];
+        if (typeof output.ok === "boolean")
+            bits.push(output.ok ? "成功" : "失败");
+        if (typeof output.status === "string")
+            bits.push(`状态 ${output.status}`);
+        if (typeof output.negotiation_id === "string")
+            bits.push(`磋商 ${output.negotiation_id}`);
+        if (typeof output.agreement_id === "string")
+            bits.push(`协议 ${output.agreement_id}`);
+        if (typeof output.error === "string")
+            bits.push(`原因: ${output.error}`);
+        return bits.length > 0 ? bits.join("，") : JSON.stringify(output).slice(0, 200);
+    }
+    async handleApprove(arg) {
+        if (arg === "")
+            return "用法：/approve <编号|id|all>";
+        const trimmed = arg.trim();
+        if (trimmed === "all") {
+            const pending = this.listPendingApprovals();
+            const outcomes = [];
+            for (const c of pending) {
+                const r = await this.approveCandidateInner(c.candidate_id);
+                const note = r.kind === "stale" || r.kind === "not_approvable" ? `（${r.reason}）` : "";
+                outcomes.push(`${c.tool}: ${r.kind}${note}`);
+            }
+            return `[审批] 已处理 ${outcomes.length} 个候选：\n${outcomes.map((o) => `  · ${o}`).join("\n")}`;
+        }
+        const id = this.resolveApprovalId(trimmed);
+        if (id === undefined) {
+            return `[审批] 未知审批候选 ${trimmed}（用 /pending 看编号，或输入完整 id/唯一前缀）。`;
+        }
+        try {
+            // Already inside the kernel chain (handleUserText enqueues handleSlash);
+            // calling approveCandidate would re-enqueue and deadlock.
+            const result = await this.approveCandidateInner(id);
+            if (result.kind === "executed") {
+                return `[审批] 候选 ${id} 已执行。\n${this.renderApprovalOutput(result.output)}`;
+            }
+            if (result.kind === "stale") {
+                return `[审批] 候选 ${id} 已失效（${result.reason}），未执行；请重新生成候选。`;
+            }
+            if (result.kind === "expired") {
+                return `[审批] 候选 ${id} 已过期，未执行。`;
+            }
+            return `[审批] 候选 ${id} 无法执行：${result.reason}`;
+        }
+        catch (err) {
+            return `[审批] 命令失败：${err instanceof Error ? err.message : String(err)}`;
+        }
+    }
+    handleReject(arg) {
+        if (arg === "")
+            return "用法：/reject <编号|id>";
+        const id = this.resolveApprovalId(arg.trim());
+        if (id === undefined) {
+            return `[审批] 未知审批候选 ${arg.trim()}（用 /pending 看编号，或输入完整 id/唯一前缀）。`;
+        }
+        const result = this.rejectCandidate(id);
+        if (!result.ok)
+            return `[审批] ${result.error ?? "驳回失败"}`;
+        return `[审批] 候选 ${id} 已驳回，绝不会执行。`;
+    }
+    /**
+     * `/register`：把本 merchant 注册进 agent catalog（buyer 据此发现）。
+     * 用法：/register --agent-card-url <url> [--catalog <url>] [--domain <d>]
+     * agent-card-url 可来自 `kiwi agent serve` 的 A2A server（缺省 env KIWI_AGENT_CARD_URL）。
+     * catalog 缺省 env KIWI_CATALOG_URL 或 http://127.0.0.1:8600。
+     */
+    async handleRegister(arg) {
+        const flagValue = (flag) => {
+            const idx = arg.indexOf(flag);
+            if (idx === -1)
+                return undefined;
+            const rest = arg.slice(idx + flag.length).trim();
+            const word = rest.split(/\s+/)[0] ?? "";
+            return word !== "" && !word.startsWith("--") ? word : undefined;
+        };
+        const agentCardUrl = flagValue("--agent-card-url") ?? process.env.KIWI_AGENT_CARD_URL;
+        if (agentCardUrl === undefined) {
+            return ("需要 merchant A2A server 的 agent card URL。先运行 `kiwi agent serve --profile <merchant>`，" +
+                "然后 /register --agent-card-url http://127.0.0.1:9000/.well-known/agent-card.json" +
+                "（或设置环境变量 KIWI_AGENT_CARD_URL）。");
+        }
+        const catalog = flagValue("--catalog") ?? process.env.KIWI_CATALOG_URL ?? "http://127.0.0.1:8600";
+        const safeAgentId = this.profile.agent_id.replace(/[^a-z0-9-]/gi, "-").toLowerCase();
+        const domain = flagValue("--domain") ?? process.env.KIWI_CATALOG_DOMAIN ?? `merchant-${safeAgentId}.local`;
+        const ucpProfileUrl = agentCardUrl.replace(/\/agent-card\.json$/, "/ucp");
+        try {
+            const result = await registerCatalogAgent({
+                catalogBaseUrl: catalog,
+                domain,
+                agentCardUrl,
+                ucpProfileUrl: ucpProfileUrl !== agentCardUrl ? ucpProfileUrl : undefined,
+                merchantId: this.profile.agent_id,
+                ownerTokenSecret: process.env.KIWI_CATALOG_OWNER_TOKEN_SECRET,
+            });
+            return `[注册] 已注册到 agent catalog ${catalog}：${result.catalogAgentId ?? "?"}（status=${result.status ?? "?"}）。buyer 可经 catalog 发现本 merchant。`;
+        }
+        catch (err) {
+            return `[注册] 失败（A2A server 仍在运行）：${err instanceof Error ? err.message : String(err)}`;
+        }
+    }
+    /**
+     * Resolve a user-facing approval target: a /pending index, an exact id, or a
+     * UNIQUE prefix of a pending candidate (LLM flows truncate long UUIDs).
+     * Ambiguous prefixes and out-of-range indices stay rejected.
+     */
+    resolveApprovalId(input) {
+        if (this.approvals === undefined)
+            return undefined;
+        const pending = this.approvals.listPending();
+        // 只把纯十进制当序号（评审项：Number("0x10")=16、Number("1e2")=100 会
+        // 把进制/科学计数法输入解析成序号索引，误批非预期的候选）。
+        const n = /^\d+$/.test(input) ? Number(input) : Number.NaN;
+        if (Number.isInteger(n) && n >= 1 && n <= pending.length) {
+            return pending[n - 1]?.candidate_id;
+        }
+        const exact = this.approvals.get(input);
+        if (exact !== undefined)
+            return exact.candidate_id;
+        const matches = pending.filter((c) => c.candidate_id.startsWith(input));
+        return matches.length === 1 ? matches[0]?.candidate_id : undefined;
+    }
+    // ---- lifecycle ------------------------------------------------------------
+    /** Flush the session and close the database. Idempotent. */
+    async close() {
+        if (this.closed)
+            return;
+        this.closed = true;
+        // 等 enqueue 链（评审项 L4）：排队中的工具调用/命令/scheduler tick 全部
+        // 落定后再关库——此前只等模型 harness 空闲，排队中的后续 work 在
+        // db.close() 之后仍会执行（/profile 切换旧 kernel 的空窗），行为未定义。
+        try {
+            await this.chain;
+        }
+        catch {
+            // 链上错误已各自 catch（this.chain 赋值时 catch），此处仅确保等待完成。
+        }
+        try {
+            await this.session.waitForIdle();
+        }
+        catch {
+            // best-effort flush; closing the store is what must not be skipped
+        }
+        this.unsubscribeSessionEvents?.();
+        this.db.close();
+    }
+}
+//# sourceMappingURL=kernel.js.map