@itpay/cli 2.1.22 → 2.1.33

package/dist/src/commands/services.js

@@ -9,6 +9,7 @@ import { ensureIdeImageAttach } from "../render/ide.js";
 import { buildCheckoutHandoff, shouldPrepareLocalCheckoutImage } from "./checkout_handoff.js";
 import { localizeCardURL, normalizeCardLocale } from "../render/locale.js";
 import { buildAgentChatHandoff } from "../render/markdown.js";
+import { refundStateEnvelope } from "./refund.js";
 import { decodeRailCatalogJourneys } from "./rail_catalog.js";
 import { platformKeyForHost } from "../render/plan.js";
 import { renderTerminalQR } from "../render/qr.js";
@@ -17,7 +18,7 @@ import { renderTerminalQR } from "../render/qr.js";
 // The server alone decides service version, quota and provider credentials.
 const RAIL_PROGRESSIVE_FEATURES = ["rail.progressive.v2"];
 import { buildCheckoutQRPlan } from "./buy.js";
-import { appendFeedbackPostmortemInstruction, CommandContractError, isTerminalServiceExecutionStatus, writeCommandEnvelope, } from "./guidance.js";
+import { appendFeedbackPostmortemInstruction, CommandContractError, isTerminalServiceExecutionStatus, writeCommandEnvelope, shellArgument, plainValueLines, } from "./guidance.js";
 // AUTH04: record the pause point of each Service Execution so a later
 // `itpay auth login` can resume the SAME task. Ids/stage/resume command only —
 // no chat content, PII or credentials. Best-effort: journaling never breaks
@@ -33,26 +34,27 @@ function journalTaskState(serviceExecutionID, envelope, env) {
     }
 }
 const serviceActionStatuses = new Set(["pending", "approved", "rejected", "expired", "cancelled"]);
+const RAIL_ENDPOINT_BRIEF = "查询前先留下2–4行端点理解摘要：两端各指哪里、是车站/行政范围/具体地点、依据及未确定事实，再说明日期/人数/时限与Exact/Smart选择。对话或现有route-brief.txt二选一；已有摘要沿用，只更新变化项。含义不清先澄清，定位待核验不等于含义不清；勿凭字尾猜类型。";
 const RAIL_SERVICE_GUIDANCE = {
     "itpay-rail-exact": {
-        when_to_use: "已知可信站对时先用本服务核验直达；城市需求可先形成有依据的站对假设。只覆盖这一站对，不代表全城市最优。完整流程：itpay docs show rail-booking --json。",
+        when_to_use: "已知可信站对时先用本服务核验直达；城市需求可先形成有依据的站对假设。只覆盖这一站对，不代表全城市最优。只有明确可靠路线知识可直接用；大概率判断先短查，受阻且清晰双站可Exact核验。查询前记录两端含义、类别、依据、未知事实和Exact/Smart选择；格式见已读rail-booking。",
         input_fields: [
-            { name: "origin", required: true, description: "出发火车站名（如'古镇'），不能是城市或地址", example: "古镇" },
-            { name: "destination", required: true, description: "到达火车站名（如'广州南'）", example: "广州南" },
-            { name: "travel_date", required: true, description: "出行日期 YYYY-MM-DD；字段名必须是 travel_date，'date' 等别名无效", example: "2026-09-19" },
+            { name: "origin", required: true, description: "已核实出发铁路站完整名称，不能以同名站代替区域", example: "<已核实出发站>" },
+            { name: "destination", required: true, description: "已核实到达铁路站完整名称", example: "<已核实到达站>" },
+            { name: "travel_date", required: true, description: "出行日期 YYYY-MM-DD；字段名必须是 travel_date，'date' 等别名无效", example: "<用户日期 YYYY-MM-DD>" },
         ],
-        input_example: { origin: "古镇", destination: "广州南", travel_date: "2026-09-19" },
+        input_example: { origin: "<已核实出发站名>", destination: "<已核实到达站名>", travel_date: "<用户出行日期 YYYY-MM-DD>" },
         notes: [
             "本服务只接受这三个字段，多传字段会被供应商拒绝",
-            "查询为空只说明这一已解析站对；如原意仍需更多覆盖，可验证另一可信站对或使用 Smart",
+            "查询为空只说明这一已解析站对；允许中转可用Smart保持双站；改变用户指定站须先取得同意",
         ],
     },
     "itpay-rail-smart": {
-        when_to_use: "需要广泛站点比较、中转或具体地址接驳时使用；有可信站对且只需先核验直达可用 Exact。完整流程：itpay docs show rail-booking --json。",
+        when_to_use: "需要广泛站点比较、中转或具体地址接驳时使用；有可信站对且只需先核验直达可用 Exact。只有明确可靠路线知识可直接用；大概率判断先短查，受阻且清晰双站可Exact核验。查询前记录两端含义、类别、依据、未知事实和Exact/Smart选择；格式见已读rail-booking。",
         input_fields: [
-            { name: "origin", required: true, description: "出发地：已知最完整的位置名或区域（城市/区县/地址均可）", example: "中山古镇" },
-            { name: "destination", required: true, description: "目的地：与 origin 同样的位置规则", example: "广州南" },
-            { name: "travel_date", required: true, description: "出行日期 YYYY-MM-DD；字段名必须是 travel_date", example: "2026-09-19" },
+            { name: "origin", required: true, description: "出发地：已知最完整的位置名或区域（城市/区县/地址均可）", example: "<原始完整地点>" },
+            { name: "destination", required: true, description: "目的地：与 origin 同样的位置规则", example: "<已核实到达站>" },
+            { name: "travel_date", required: true, description: "出行日期 YYYY-MM-DD；字段名必须是 travel_date", example: "<用户日期 YYYY-MM-DD>" },
         ],
         optional_fields: [
             { name: "origin_city", description: "出发地城市提示，辅助位置解析" },
@@ -60,20 +62,84 @@ const RAIL_SERVICE_GUIDANCE = {
             { name: "origin_location", description: "已知坐标对象（高德 GCJ-02）" },
             { name: "destination_location", description: "目的地坐标对象" },
             { name: "depart_after", description: "不早于该时间出发" },
+            { name: "depart_before", description: "不晚于该时间出发" },
             { name: "arrive_before", description: "不晚于该时间到达" },
+            { name: "user_query", description: "旅行需求原话，最多4096 UTF-8字节；时间等明确条件仍填写对应结构化字段" },
+            { name: "seat_preferences", description: "已确认的席别代码数组，不填写旅客身份" },
             { name: "priority", enum: "balanced|fastest|cheapest|safest|flexible", description: "方案偏好" },
+            { name: "duration_basis", enum: "rail|door_to_door", description: "最快默认按铁路全程含换乘；明确要求且接驳证据完整时可按门到门" },
             { name: "max_transfers", description: "允许中转次数，0-2" },
             { name: "passengers", description: "成人乘客整数 1-5；不填写身份资料" },
         ],
-        input_example: { origin: "上海", destination: "长沙", travel_date: "2026-10-06", arrive_before: "15:00", priority: "fastest", passengers: 1 },
+        input_example: { origin: "<用户出发地点>", destination: "<用户目的地>", travel_date: "<用户出行日期 YYYY-MM-DD>", priority: "fastest", passengers: 1 },
         notes: [
             "位置有歧义时会进入位置确认步骤，请用户选定后继续同一执行",
             "推荐结果含每趟车的席别与余票；购票在后续受保护流程完成",
         ],
     },
 };
-function railServiceGuidance(serviceID) {
-    return RAIL_SERVICE_GUIDANCE[serviceID];
+function railServiceGuidance(serviceID, schema) {
+    const guidance = RAIL_SERVICE_GUIDANCE[serviceID];
+    if (serviceID !== "itpay-rail-smart" || !guidance)
+        return guidance;
+    const properties = schema?.properties;
+    if (!properties?.endpoints)
+        return properties?.origin && properties?.destination ? guidance : undefined;
+    return {
+        ...guidance,
+        input_fields: [
+            { name: "endpoints", required: true, description: "origin/destination 各填完整text；类别有依据时填kind(area/place/station)。仅对象含义明确、类别确实待核验时可省略kind；完整名称合法，坐标可选，不靠省略kind猜城市" },
+            { name: "travel_date", required: true, description: "用户出行日期 YYYY-MM-DD" },
+        ],
+        optional_fields: (guidance.optional_fields ?? []).filter((field) => !["origin_city", "destination_city", "origin_location", "destination_location"].includes(field.name)).concat([
+            { name: "reuse_from", description: "同 owner 的已保存 Exact result_item_id 或 Smart snapshot_id；端点/日期新查询可复用有效事实" },
+        ]).filter(field => properties[field.name] !== undefined),
+        input_example: { endpoints: { origin: { kind: "place", text: "<用户原始完整具体地点>" }, destination: { kind: "area", text: "<用户原始完整行政范围>" } }, travel_date: "<用户出行日期 YYYY-MM-DD>" },
+        notes: ["仅用当前 input_schema 支持的端点写法；不要与旧 origin/destination 混用", "唯一地点直接解析；真实候选只确认有歧义一端；地图等待按可续用状态恢复，终态有新证据才用返回新查询模板，无动作则停止"],
+    };
+}
+// Generate only declared required fields and preserve safe known query facts.
+// Authorization and passenger identity are never synthesized into templates.
+function serviceInputTemplate(schema, known = {}) {
+    const properties = schema.properties;
+    if (properties?.endpoints && !properties.origin && !properties.destination && !known.endpoints && (typeof known.origin === "string" || typeof known.destination === "string")) {
+        known = { ...known, endpoints: { origin: { text: known.origin }, destination: { text: known.destination } } };
+    }
+    if (properties?.travel_date && !known.travel_date && typeof known.date === "string")
+        known = { ...known, travel_date: known.date };
+    const result = {};
+    for (const field of new Set([...requiredInputFields(schema), ...Object.keys(known).filter(field => properties?.[field] !== undefined)])) {
+        const rule = properties?.[field] ?? {};
+        if (field === "accept_non_guaranteed") {
+            result[field] = false;
+            continue;
+        }
+        if (rule.type === "object") {
+            const value = known[field];
+            result[field] = serviceInputTemplate(rule, value && typeof value === "object" && !Array.isArray(value) ? value : {});
+        }
+        else if (known[field] !== undefined && (rule.type === undefined || rule.type === "array" && Array.isArray(known[field]) || rule.type === "string" && typeof known[field] === "string" || rule.type === "boolean" && typeof known[field] === "boolean" || ["integer", "number"].includes(String(rule.type)) && typeof known[field] === "number"))
+            result[field] = known[field];
+        else if (rule.const !== undefined)
+            result[field] = rule.const;
+        else if (rule.default !== undefined)
+            result[field] = rule.default;
+        else if (Array.isArray(rule.enum) && rule.enum.length)
+            result[field] = rule.enum[0];
+        else if (rule.type === "integer" || rule.type === "number")
+            result[field] = typeof rule.minimum === "number" ? rule.minimum : 1;
+        else if (rule.type === "boolean")
+            result[field] = false;
+        else if (rule.type === "array")
+            result[field] = [];
+        else
+            result[field] = `<${field}>`;
+    }
+    for (const field of ["kind", "text", "station_code", "poi_id", "adcode", "location", "travel_date", "passengers", "priority", "user_query", "depart_after", "depart_before", "arrive_by", "arrive_before", "seat_preferences", "max_transfers", "duration_basis"]) {
+        if (properties?.[field] && known[field] !== undefined)
+            result[field] = known[field];
+    }
+    return result;
 }
 const WORKFLOW_STEP_GUIDANCE = {
     input: { meaning: "输入校验", hint: "核对本服务的输入契约和服务端错误码；本执行的输入不能凭猜测修复" },
@@ -87,22 +153,6 @@ const WORKFLOW_STEP_GUIDANCE = {
     recommend: { meaning: "方案推荐", hint: "查看已保存候选和实际推荐失败原因；不要无原因放宽条件" },
     delivery: { meaning: "交付", hint: "读取当前执行状态；已有订单或付款状态不明时先核实，不重建" },
 };
-function failedWorkflowStep(steps, errorCode) {
-    if (!steps)
-        return undefined;
-    for (const [step, status] of Object.entries(steps)) {
-        if (status === "failure" && step !== "failure")
-            return step;
-    }
-    // Only a backend-recorded condition_unmet proves a false branch routed to failure.
-    if (errorCode === "condition_unmet") {
-        for (const [step, status] of Object.entries(steps)) {
-            if (status === "false" && step !== "failure")
-                return step;
-        }
-    }
-    return undefined;
-}
 export async function runServicesStart(backend, serviceID, options = {}) {
     const host = options.host ?? "terminal";
     const response = await backend.startServiceExecution({
@@ -115,18 +165,23 @@ export async function runServicesStart(backend, serviceID, options = {}) {
         },
     });
     if (response.workflow_entry) {
-        const guidance = railServiceGuidance(serviceID);
+        const guidance = railServiceGuidance(serviceID, response.workflow_entry.input_schema);
+        if (serviceID === "itpay-rail-smart" && !guidance) {
+            writeCommandEnvelope({ status: "contract_unavailable", result: { service_execution_id: response.execution.service_execution_id, service_id: serviceID }, instruction: "当前执行缺少可用输入合同；只读取一次同执行合同，仍缺失则报告系统缺口并停止，不猜旧Smart写法。", next: { command: `itpay services get ${response.execution.service_execution_id} --json`, reason: "读取当前执行锁定的输入合同一次" }, recovery: [] }, options);
+            return;
+        }
         writeCommandEnvelope({
             status: "input_required",
             result: { service_execution_id: response.execution.service_execution_id, service_id: serviceID, input_schema: response.workflow_entry.input_schema, ...(guidance ? { guidance } : {}) },
-            instruction: guidance ? "按 result.guidance 逐项填写输入（when_to_use 说明本服务适用场景、input_fields 是必填契约、input_example 可直接照抄），然后继续同一服务执行。不要臆造字段名。" : "根据服务声明填写输入，然后继续同一服务执行。",
+            instruction: guidance ? RAIL_ENDPOINT_BRIEF + "按 result.guidance 逐项填写输入（when_to_use 说明本服务适用场景、input_fields 是必填契约、input_example 是待填示意，必须替换用户真实值），然后继续同一服务执行。不要臆造字段名。" : "根据服务声明填写输入，然后继续同一服务执行。",
             next: null,
             interaction: {
                 schema_version: "itpay.interaction.v1",
                 stage: "input_required",
                 input_template: {
                     command: `itpay services run ${serviceID} --execution ${response.execution.service_execution_id} --input-json <file> --json`,
-                    required_input: ["file"],
+                    input: guidance?.input_example ?? serviceInputTemplate(response.workflow_entry.input_schema),
+                    required_input: ["file", ...requiredInputFields(response.workflow_entry.input_schema)],
                     executable: false,
                 },
             },
@@ -192,18 +247,29 @@ function locationConfirmationEnvelope(executionID, capabilityID, input, confirma
     input = (confirmation.input ?? input);
     const endpoints = (confirmation.endpoints ?? []);
     const choices = Object.fromEntries(endpoints.map((endpoint) => [endpoint.side, "<用户选择的候选 id>"]));
+    const missing = endpoints.filter((endpoint) => !endpoint.candidates?.length);
+    const reason = missing[0]?.reason?.toUpperCase();
+    const instruction = missing.length
+        ? reason === "STATION_LOCATION_EVIDENCE_REQUIRED"
+            ? "尚未查票。车站身份已知，但 Smart 缺少该站地理坐标证据；请说明此系统缺口。若用户仅要双站直达，可按原站名使用 Exact；不要要求用户换站。"
+            : reason === "ADDRESS_REQUIRED" || reason === "ADMINISTRATIVE_AREA_UNRESOLVED"
+                ? "尚未查票。先用已有上下文、地图或浏览补该端地点证据；含义仍不清且影响范围才问用户一个关键问题。保留另一端和原条件；只有返回完整新查询模板且已有新证据才另查，没有模板则停止，不猜旧执行输入。"
+                : reason === "COORDINATE_IDENTITY_UNVERIFIED" || reason === "COORDINATE_NAME_MISMATCH"
+                    ? "尚未查票。提交的地点名称和坐标尚未得到一致证据；请核实该端点的真实名称或位置，保留另一端，不要把坐标声明当成人工确认。"
+                    : "尚未查票。地点证据不足；说明返回的原因与受影响端，先补真实证据，不改kind绕过、不把外部故障当用户歧义。当前无候选确认或完整新查询模板则停止。"
+        : "尚未查票。仅向用户确认真实地点歧义，展示候选名称、地址和高德链接。具体住宅仍是目的地，附近车站只作候选；不得把选地点改成锁车站。用户选择后保留原输入，回到同一服务。";
     return {
         status: "location_confirmation_required",
         result: { service_execution_id: executionID, query: input, location_confirmation: confirmation },
-        instruction: "尚未查票。仅向用户确认 endpoints 中有歧义的地点，展示真实候选名称、地址和高德链接。不要自行选择候选、把区域改成车站或重复调用原查询。用户选择后保留原输入，带 location_confirmation 回到同一服务。没有候选时请用户补充已知城市或准确地名，再使用修正输入查询。",
+        instruction,
         next: null,
-        ...(confirmation.can_resume ? {
+        ...(confirmation.can_resume && !missing.length && endpoints.length ? {
             interaction: {
                 schema_version: "itpay.interaction.v1",
                 stage: "location_confirmation_required",
                 input_template: {
-                    command: `itpay services invoke ${executionID} --capability ${capabilityID}${formatInputOptions({ ...input,
-                        location_confirmation: { plan_id: confirmation.plan_id, token: confirmation.token, choices } })} --json`,
+                    command: `itpay services invoke ${executionID} --capability ${capabilityID} --input-json <地点确认.json> --json`,
+                    input: { ...input, location_confirmation: { plan_id: confirmation.plan_id, token: confirmation.token, choices } },
                     required_input: ["choices"],
                     executable: false,
                 },
@@ -218,11 +284,13 @@ function requiredInputFields(schema) {
 }
 function locationInputInstruction(schema) {
     const properties = schema?.properties;
+    if (properties?.endpoints)
+        return " " + RAIL_ENDPOINT_BRIEF + " 两端分别填写 endpoints.origin/destination 的完整text；有类别依据就填kind，只有对象含义明确而类别待核验时可省略。区域保留范围、精确车站仅在目录验证后锁定。不要混用旧 origin/destination、手填锁站或伪造坐标。唯一地点会自动解析；只有真实多候选才让用户选返回的候选 id，地图失败应按当前执行恢复。";
     if (!properties?.origin_location || !properties?.destination_location)
         return "";
     if (!properties.location_confirmation)
-        return " 地点保留用户已知最完整名称或城市范围；不要编造坐标或把城市改成同名车站。坐标及其他可选字段严格按当前 input_schema 提交。";
-    return " 地点输入：先向用户说明本服务接受两个地点或城市范围。已有可信高德 GCJ-02 坐标时，可用 --input 'origin_location={\"lng\":113.0,\"lat\":23.0,\"coordinate_system\":\"gcj02\",\"source\":\"amap\"}'（数值必须替换为真实查询结果，destination_location 同理）；没有地图能力时，直接传用户已知最完整的 origin/destination，可附 origin_city/destination_city。不要编造坐标、补猜地址或把深圳等城市改成深圳站；精确站查须明确站名。用户只给城市、县或镇就保留区域意图，不追问门牌。明确地点由服务自动解析；只有返回 location_confirmation 才展示候选名称、地址和高德链接，等待用户选择，禁止自行选第一项。";
+        return " " + RAIL_ENDPOINT_BRIEF + " 地点保留用户已知最完整名称或城市范围；不要编造坐标或把城市改成同名车站。坐标及其他可选字段严格按当前 input_schema 提交。";
+    return " " + RAIL_ENDPOINT_BRIEF + " 地点输入：保留两个地点或城市范围。已有可信高德 GCJ-02 坐标时，可用 --input 'origin_location={\"lng\":113.0,\"lat\":23.0,\"coordinate_system\":\"gcj02\",\"source\":\"amap\"}'（数值必须替换为真实查询结果，destination_location 同理）；没有地图能力时，直接传用户已知最完整的 origin/destination，可附 origin_city/destination_city。不要编造坐标、补猜地址或把深圳等城市改成深圳站；精确站查须明确站名。用户只给城市、县或镇就保留区域意图，不追问门牌。明确地点由服务自动解析；只有返回 location_confirmation 才展示候选名称、地址和高德链接，等待用户选择，禁止自行选第一项。";
 }
 export async function runServicesInvoke(backend, config, serviceExecutionID, capabilityID, input, options = {}) {
     const readModel = await backend.getServiceExecution(serviceExecutionID);
@@ -235,13 +303,9 @@ export async function runServicesInvoke(backend, config, serviceExecutionID, cap
     }
     const missingInput = missingRequiredInput(requestedCapability.input_schema, input);
     if (missingInput.length > 0) {
-        const correctedInput = { ...input };
-        for (const field of missingInput)
-            correctedInput[field] = "<value>";
-        throw new CommandContractError("capability_input_invalid", `missing required capability input: ${missingInput.join(", ")}`, "补齐 required_input 后重试同一个 execution；本次没有调用 Provider。", [{
-                command: `itpay services invoke ${serviceExecutionID} --capability ${capabilityID}${formatInputOptions(correctedInput)} --json`,
-                reason: "提交完整 capability 输入",
-            }]);
+        throw new CommandContractError("capability_input_invalid", `missing required capability input: ${missingInput.join(", ")}`, "只补缺失字段到小JSON文件，再提交同一执行；本次尚未调用供应商。", [], { schema_version: "itpay.interaction.v1", stage: "input_required",
+            input_template: { command: `itpay services invoke ${serviceExecutionID} --capability ${capabilityID} --input-json <file> --json`,
+                required_input: ["file", ...missingInput], executable: false } });
     }
     const idempotencyKey = await operationID(config, `service.invoke:${serviceExecutionID}:${capabilityID}:${stableInput(input)}`);
     let response;
@@ -294,9 +358,16 @@ function invokedEnvelope(response, requestedCapability, capabilities, input) {
         ...(quota ? { quota } : {}),
     };
     const preview = response.invocation?.safe_result_preview;
+    const notices = Array.isArray(preview?.notices) ? preview.notices.map((notice) => {
+        if (!notice || typeof notice !== "object" || !("code" in notice) || !("message" in notice) || typeof notice.message !== "string")
+            return notice;
+        if (!["RAIL_TRANSFER_SCOPE_LIMIT", "RAIL_TRANSFER_SEARCH_INCOMPLETE"].includes(String(notice.code)))
+            return notice;
+        return { ...notice, message: notice.message.replace(/可按主要枢纽分段查询[。；]?/g, "") };
+    }) : preview?.notices;
     if (!response.effective_quota?.exhausted && preview?.search_status === "LOCATION_CONFIRMATION_REQUIRED" && preview.location_confirmation) {
         return { value: locationConfirmationEnvelope(response.execution.service_execution_id, requestedCapability.capability_id, input, preview.location_confirmation),
-            plainResult: [JSON.stringify(preview.location_confirmation)] };
+            plainResult: plainValueLines(preview.location_confirmation) };
     }
     if (typeof preview?.catalog_total === "number") {
         baseResult.catalog = {
@@ -304,7 +375,7 @@ function invokedEnvelope(response, requestedCapability, capabilities, input) {
             recommendation: preview.recommendation,
             decision_source: preview.decision_source,
             coverage: preview.coverage,
-            notices: preview.notices,
+            notices,
             search_status: preview.search_status,
             searched_scope: preview.searched_scope,
             effective_policy_hash: preview.effective_policy_hash,
@@ -321,15 +392,15 @@ function invokedEnvelope(response, requestedCapability, capabilities, input) {
     let instruction = items.length > 0
         ? "用编号、名称和可公开字段向用户说明候选；若候选列表已满足目标就停止。只有用户明确选择并希望继续时，才提交对应编号；不要向用户提及 safe_payload、Execution 或内部 ID。"
         : `没有找到与“${queryText(input)}”匹配的结果。向用户展示本次为 0 个结果并停止。不要修改、缩短或猜测其他输入；只有用户明确提供新输入后，才能启动新的查询。`;
-    if (items.length === 0 && Array.isArray(preview?.notices)) {
-        const railNotice = preview.notices.find((notice) => {
+    if (items.length === 0 && Array.isArray(notices)) {
+        const railNotice = notices.find((notice) => {
             if (!notice || typeof notice !== "object")
                 return false;
             const value = notice;
             return ["RAIL_TRANSFER_SCOPE_LIMIT", "RAIL_TRANSFER_SEARCH_INCOMPLETE"].includes(String(value.code)) && typeof value.message === "string";
         });
         if (railNotice)
-            instruction = `向用户展示官方提示：${railNotice.message} 不要断言该行程必须多次中转或没有车。等待用户选择分段查询的起终点，不自动更换输入或重试。`;
+            instruction = `向用户展示官方提示：${railNotice.message} 说明本次已查范围和未完成原因，按服务端提供的当前动作恢复；不能据此断言没有车，不默认扩大范围或让用户另选分段站点。`;
     }
     let next = null;
     if (items.length > 0 && baseResult.catalog) {
@@ -375,13 +446,6 @@ function invokedEnvelope(response, requestedCapability, capabilities, input) {
         ? {
             schema_version: "itpay.interaction.v1",
             stage: "query_results_ready",
-            by_goal: {
-                compare: { action: "present_options", max_options: 3, stop_after_presentation: true },
-                prepare_checkout: {
-                    action: "select_under_user_rules_then_prepare",
-                    requires: ["current_delegation", "eligible_current_selection", "owner_permits_next_step"],
-                },
-            },
             input_template: {
                 command: `itpay services action ${response.execution.service_execution_id} --action select_candidate --actor-type human --status approved --candidate <rank> --json`,
                 required_input: ["rank"],
@@ -397,40 +461,7 @@ function invokedEnvelope(response, requestedCapability, capabilities, input) {
     };
 }
 function serviceResultPlainLines(result) {
-    const lines = [
-        `service_execution_id: ${String(result.service_execution_id)}`,
-        `capability_id: ${String(result.capability_id)}`,
-    ];
-    const items = result.items;
-    const query = result.query;
-    if (query) {
-        for (const [key, value] of Object.entries(query))
-            lines.push(`${key}: ${String(value)}`);
-    }
-    if (items.length === 0)
-        lines.push("results: 0");
-    const catalog = result.catalog;
-    if (catalog?.resolved_locations)
-        lines.push(`resolved_locations: ${JSON.stringify(catalog.resolved_locations)}`);
-    if (catalog?.journey_summary) {
-        for (const key of ["journey_summary", "train_services", "journeys"]) {
-            lines.push(`${key}: ${JSON.stringify(catalog[key])}`);
-        }
-    }
-    if (result.quota)
-        lines.push(`quota: ${JSON.stringify(result.quota)}`);
-    if (result.checkout)
-        lines.push(`checkout: ${JSON.stringify(result.checkout)}`);
-    if (items.length > 0) {
-        lines.push("items:");
-        for (const item of items) {
-            lines.push(`  ${item.rank}. ${item.title}`);
-            for (const [key, value] of Object.entries(item.safe_payload)) {
-                lines.push(`     ${key}: ${typeof value === "string" ? value : JSON.stringify(value)}`);
-            }
-        }
-    }
-    return lines;
+    return plainValueLines(result);
 }
 function queryText(input) {
     const value = Object.values(input).find((item) => typeof item === "string" && item.trim() !== "");
@@ -524,11 +555,6 @@ function formatInputOptions(input) {
         : ` --input ${shellArgument(`${key}=${typeof value === "object" && value !== null ? JSON.stringify(value) : String(value)}`)}`)
         .join("");
 }
-function shellArgument(value) {
-    if (/^[\p{L}\p{N}._:=/-]+$/u.test(value))
-        return value;
-    return `'${value.replaceAll("'", `'"'"'`)}'`;
-}
 export async function runServicesAction(backend, serviceExecutionID, actionType, input, options = {}) {
     const selection = await resolveCandidateSelection(backend, serviceExecutionID, actionType, options);
     const request = {
@@ -553,10 +579,13 @@ export async function runServicesAction(backend, serviceExecutionID, actionType,
     catch (error) {
         if (error instanceof HttpError && ["booking_review_invalid", "booking_review_changed", "booking_review_locked"].includes(error.code)) {
             throw new CommandContractError(error.code, error.message, error.code === "booking_review_invalid"
-                ? "确认输入与当前草稿不符。重新读取同一booking的review模板，席别使用返回的代码，不填显示名或猜新值。若仅修正代码写法，且车次、实际席别、人数、价格及条款等已确认内容未变，可沿用用户已有明确确认后提交；草稿实质变化或缺少真实同意时，先请用户确认变化内容。"
+                ? "确认输入与当前草稿不符。使用返回 interaction.input_template.input 当前review模板，席别使用返回的代码，不填显示名或猜新值。若仅修正代码写法，且车次、实际席别、人数、价格及条款等已确认内容未变，可沿用用户已有明确确认后提交；草稿实质变化或缺少真实同意时，先请用户确认变化内容。"
                 : error.code === "booking_review_changed"
-                    ? "草稿版本已变化；重新读取同一booking的当前review与revision，经用户核对后再提交。"
-                    : "当前购买已有付款尝试；读取同一booking及订单状态，不创建新订单或重做付款。", [{ command: `itpay services next ${serviceExecutionID} --json`, reason: "读取同一booking的当前状态与review" }]);
+                    ? "草稿版本已变化；使用同一booking的当前review模板。仅技术修正且车次、实际席别、人数、价格及条款未变时沿用已有明确同意；实质变化或缺少真实同意才补确认。"
+                    : "当前购买已有付款尝试；读取同一booking及订单状态，不创建新订单或重做付款。", error.payload?.review ? [] : [{ command: `itpay services next ${serviceExecutionID} --json`, reason: "读取同一booking的当前状态与review" }], error.payload?.review?.input_template ? {
+                schema_version: "itpay.interaction.v1", stage: "booking_review_required",
+                input_template: { command: `itpay services action ${serviceExecutionID} --action ${actionType} --actor-type human --status approved --input-json <file> --json`, input: error.payload?.review.input_template, required_input: ["file"], executable: false },
+            } : undefined, { service_execution_id: serviceExecutionID, review: error.payload?.review, input_errors: error.payload?.input_errors });
         }
         throw error;
     }
@@ -674,13 +703,10 @@ export async function runServicesCheckout(backend, config, serviceExecutionID, c
         const lockedInput = options.lockedInput ?? {};
         const missingInput = missingRequiredInput(capability.input_schema, lockedInput);
         if (missingInput.length > 0 && !readModel.workflow_entry && readModel.execution.next_action !== "create_checkout") {
-            throw new CommandContractError("capability_input_invalid", `missing required capability input: ${missingInput.join(", ")}`, "补齐付费 capability 的 required_input；本次没有创建 quote、Checkout 或订单。", [{ command: checkoutCommand(serviceExecutionID, capability, lockedInput), reason: "提交完整且会被锁定的服务输入" }]);
+            throw new CommandContractError("capability_input_invalid", `missing required capability input: ${missingInput.join(", ")}`, "补齐付费 capability 的 required_input；本次没有创建 quote、Checkout 或订单。", [], { schema_version: "itpay.interaction.v1", stage: "input_required", input_template: { command: checkoutCommand(serviceExecutionID, capability, lockedInput), required_input: missingInput, executable: false } });
         }
         if (capability.delivery_email_required && readModel.workflow_entry?.capability_id !== capability.capability_id && String(deliveryContact.email ?? "").trim() === "") {
-            throw new CommandContractError("delivery_email_required", "delivery email is required before creating this service checkout", "该 capability 的交付链接会发送到用户邮箱；先向用户说明用途并询问邮箱，不要代填。", [{
-                    command: `itpay services checkout ${serviceExecutionID} --capability ${capability.capability_id}${formatInputOptions(lockedInput)} --email <email> --json`,
-                    reason: "使用用户提供的邮箱创建 Checkout",
-                }]);
+            throw new CommandContractError("delivery_email_required", "delivery email is required before creating this service checkout", "该 capability 的交付链接会发送到用户邮箱；先向用户说明用途并询问邮箱，不要代填。", [], { schema_version: "itpay.interaction.v1", stage: "input_required", input_template: { command: `itpay services checkout ${serviceExecutionID} --capability ${capability.capability_id}${formatInputOptions(lockedInput)} --email <email> --json`, required_input: ["email"], executable: false } });
         }
     }
     const response = await backend.createServiceExecutionCheckout(serviceExecutionID, {
@@ -697,19 +723,25 @@ export async function runServicesCheckout(backend, config, serviceExecutionID, c
     const cardURL = localizeCardURL(absolutePublicURL(config.baseURL, checkout.card_url ?? fallbackCardURL(config.baseURL, checkoutID, displayToken)), locale);
     const cardPNGURL = localizeCardURL(absolutePublicURL(config.baseURL, checkout.card_png_url ?? checkout.qr_png_url ?? fallbackCardPNGURL(config.baseURL, checkoutID, displayToken)), locale);
     let itineraryTitle;
+    let itinerary;
     try {
         const booking = await backend.getServiceExecution(serviceExecutionID);
         if (booking.execution.service_id === "itpay-rail-booking") {
-            const leg = booking.rail_booking?.legs?.[0];
             const review = booking.workflow?.human_action?.context?.review;
-            const reviewLeg = Array.isArray(review?.legs) ? review.legs[0] : undefined;
-            const facts = leg ?? reviewLeg;
-            if (facts) {
-                itineraryTitle = [facts.travel_date, facts.train_code,
-                    facts.from ?? facts.from_station,
-                    "→", facts.to ?? facts.to_station,
-                    facts.seat_name ?? facts.seat_type_name]
-                    .filter((value) => typeof value === "string" && value.length > 0).join(" ");
+            const presentation = await backend.getCheckoutPresentation(checkoutID, displayToken);
+            const quote = presentation.rail_quote;
+            const facts = quote?.legs ?? booking.rail_booking?.legs ?? (Array.isArray(review?.legs) ? review.legs : []);
+            const legs = facts.filter(value => value && typeof value === "object").map(value => {
+                const leg = value;
+                return { travel_date: leg.travel_date, train_code: leg.train_code,
+                    from_station: leg.from || leg.from_station || `站点代码 ${String(leg.from_station_code ?? "未知")}（名称暂缺）`,
+                    to_station: leg.to || leg.to_station || `站点代码 ${String(leg.to_station_code ?? "未知")}（名称暂缺）`,
+                    departure: leg.departure ?? leg.departure_time, arrival: leg.arrival ?? leg.arrival_time,
+                    arrival_days: leg.arrival_days, seat_name: leg.seat_name || leg.seat_type_name || `席别代码 ${String(leg.seat_type ?? "未知")}（名称暂缺）` };
+            });
+            if (legs.length) {
+                itinerary = { legs, passengers: quote?.passengers ?? review?.passengers ?? null, purchase_unit: "journey" };
+                itineraryTitle = legs.map(leg => [leg.train_code, leg.from_station, "->", leg.to_station].filter(value => typeof value === "string" && value.length).join(" ")).join(" / ");
             }
         }
     }
@@ -717,6 +749,7 @@ export async function runServicesCheckout(backend, config, serviceExecutionID, c
         // Checkout already exists; a display-only title lookup cannot hide its official handoff.
     }
     const plan = buildCheckoutQRPlan({
+        localSimulation: backend.localSimulation,
         host,
         checkoutID,
         checkoutURL,
@@ -763,13 +796,11 @@ export async function runServicesCheckout(backend, config, serviceExecutionID, c
         });
     }
     const envelope = buildServicesCheckoutEnvelope(response, checkoutURL, plan, options.agentType, options.target);
-    const plainResult = [
-        `service_execution_id: ${response.binding.service_execution_id}`,
-        `checkout_id: ${checkoutID}`,
-        `capability_id: ${checkoutCapabilityID(response, capabilityID)}`,
-        `locked_input: ${JSON.stringify(response.locked_input)}`,
-        `amount: ${formatMoney(checkout.checkout.amount_minor, checkout.checkout.currency)}`,
-    ];
+    if (itinerary) {
+        envelope.result = { ...envelope.result, itinerary };
+        envelope.instruction = "整程一次付款，各段分别出票；展示入口不等于付款，付款成功不等于全部出票。" + envelope.instruction;
+    }
+    const plainResult = plainValueLines(envelope.result);
     if (!options.jsonOutput && platform === "terminal") {
         plainResult.push("qr:", await renderTerminalQR(checkoutURL, options.qrFormat ?? "terminal"));
     }
@@ -789,14 +820,14 @@ export async function runServicesQuote(backend, serviceExecutionID, capabilityID
         model.allowed_actions?.some((action) => action.type === "prepare_quote" && action.capability_id === capabilityID);
     const missingInput = missingRequiredInput(capability.input_schema, input);
     if (missingInput.length > 0 && !selectionBacked && model.workflow_entry?.capability_id !== capability.capability_id) {
-        throw new CommandContractError("capability_input_invalid", `missing required capability input: ${missingInput.join(", ")}`, "补齐付费 capability 输入；本次没有创建 Quote、Cart 或 Checkout。", [{ command: quoteCommand(serviceExecutionID, capability, input), reason: "提交完整且会被锁定的输入" }]);
+        throw new CommandContractError("capability_input_invalid", `missing required capability input: ${missingInput.join(", ")}`, "补齐付费 capability 输入；本次没有创建 Quote、Cart 或 Checkout。", [], { schema_version: "itpay.interaction.v1", stage: "input_required", input_template: { command: quoteCommand(serviceExecutionID, capability, input), required_input: missingInput, executable: false } });
     }
     const deliveryContact = {
         ...(options.deliveryContact ?? {}),
         ...(options.email ? { email: options.email } : {}),
     };
     if (capability.delivery_email_required && model.workflow_entry?.capability_id !== capability.capability_id && String(deliveryContact.email ?? "").trim() === "") {
-        throw new CommandContractError("delivery_email_required", "delivery email is required before preparing this service quote", "交付链接会发送到用户邮箱；说明用途并询问邮箱，不要代填。", [{ command: quoteCommand(serviceExecutionID, capability, input), reason: "使用用户提供的邮箱创建报价" }]);
+        throw new CommandContractError("delivery_email_required", "delivery email is required before preparing this service quote", "交付链接会发送到用户邮箱；说明用途并询问邮箱，不要代填。", [], { schema_version: "itpay.interaction.v1", stage: "input_required", input_template: { command: quoteCommand(serviceExecutionID, capability, input), required_input: ["email"], executable: false } });
     }
     const quote = await backend.prepareServiceQuote(serviceExecutionID, {
         capability_id: capabilityID,
@@ -865,18 +896,12 @@ export async function runServicesGet(backend, serviceExecutionID, options = {})
         ...(nextState.interaction ? { interaction: nextState.interaction } : {}),
         ...(nextState.communication ? { communication: nextState.communication } : {}),
         ...(nextState.handoff ? { handoff: nextState.handoff } : {}),
-        recovery: nextState.recovery,
+        recovery: nextState.recovery.filter(action => action.command !== `itpay services get ${serviceExecutionID} --json`),
     };
     writeCommandEnvelope(envelope, {
         ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
         ...(options.output ? { output: options.output } : {}),
-        plainResult: [
-            `service_execution_id: ${execution.service_execution_id}`,
-            `service_id: ${execution.service_id}`,
-            `state: ${execution.status}/${execution.phase}`,
-            ...(execution.current_capability_id ? [`current_capability_id: ${execution.current_capability_id}`] : []),
-            ...timeline.map((event) => `${event.sequence}. ${event.step} ${event.status}/${event.phase} ${event.occurred_at}`),
-        ],
+        plainResult: plainValueLines(envelope.result),
     });
 }
 function shouldWaitForServiceResult(model) {
@@ -905,8 +930,6 @@ export async function runServicesNext(backend, serviceExecutionID, options = {})
         envelope.next = { command: `itpay services next ${serviceExecutionID} --timeout 120 --json`, reason: "稍后继续等待同一任务；不重新提交查询" };
     }
     journalTaskState(serviceExecutionID, envelope, options.env ?? process.env);
-    if (response.rail_booking)
-        envelope.result = { ...envelope.result, rail_booking: response.rail_booking };
     writeCommandEnvelope(envelope, {
         ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
         ...(options.output ? { output: options.output } : {}),
@@ -922,25 +945,25 @@ export async function runServicesPage(backend, serviceExecutionID, resultItemID,
     if (!Number.isInteger(limit) || limit < 1 || limit > 20) {
         throw new CommandContractError("limit_invalid", "--limit must be an integer from 1 to 20", "limit 必须是 1 到 20 的整数；本次未读取服务端分页。", [{ command: `itpay services page ${serviceExecutionID} ${resultItemID} --offset ${offset} --json`, reason: "用默认页大小重试" }]);
     }
-    const response = await backend.getServiceExecutionResultItemPage(serviceExecutionID, resultItemID, offset, limit);
+    const response = await backend.getServiceExecutionResultItemPage(serviceExecutionID, resultItemID, offset, limit, limit === 1 ? undefined : "summary");
     const page = response.page;
     const container = (page.result ?? page);
     const exactCandidate = limit === 1 && Array.isArray(container.candidates) && container.candidates.length === 1
         ? container.candidates[0] : undefined;
     if (exactCandidate && typeof exactCandidate.train_code === "string" && Array.isArray(exactCandidate.seats)) {
         const offer = exactCandidate.booking_offer;
+        const { booking_offer: _bookingOffer, ...candidateFacts } = exactCandidate;
         const seats = exactCandidate.seats.filter((seat) => seat.purchase_supported === true);
-        const seat = seats[0];
         writeCommandEnvelope({
             status: "exact_train_detail",
             result: {
                 service_execution_id: serviceExecutionID, result_item_id: resultItemID, result_offset: offset,
-                candidate: exactCandidate,
+                candidate: candidateFacts,
                 ...(offer?.service_id && offer.selection_token ? { booking_template: {
                         command: `itpay services run ${offer.service_id} --input-json <file> --json`,
                         executable: false, required_input: ["file", "passengers", "seat_type"],
                         seat_choices: seats.map((choice) => ({ seat_type: choice.seat_type, seat_name: choice.seat_name })),
-                        input_example: { selection: { token: offer.selection_token, ...(typeof seat?.seat_type === "string" ? { seat_type: seat.seat_type } : {}) }, passengers: 1 },
+                        input_example: { selection: { token: offer.selection_token, seat_type: "<用户授权席别对应代码>" }, passengers: "<真实人数>" },
                     } } : {}),
             },
             instruction: offer?.selection_token
@@ -949,7 +972,7 @@ export async function runServicesPage(backend, serviceExecutionID, resultItemID,
             next: null, recovery: [],
         }, { ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
             ...(options.output ? { output: options.output } : {}),
-            plainResult: [`${exactCandidate.train_code} ${exactCandidate.from_station ?? ""} → ${exactCandidate.to_station ?? ""}`] });
+        });
         return;
     }
     // rail.progressive.v2 saved pages key journeys/journey_page; legacy result
@@ -968,9 +991,13 @@ export async function runServicesPage(backend, serviceExecutionID, resultItemID,
             offset: catalogPage.offset ?? offset,
             limit: catalogPage.limit ?? limit,
             total: catalogPage.total ?? candidates.length,
+            requested_limit: limit,
+            truncated_reason: container.journey_page?.truncated_reason ?? null,
             count: catalogPage.count ?? candidates.length,
             next_offset: nextOffset,
-            page,
+            ...(journeys.length ? { journeys: journeys.map(value => compactRailJourney(value, serviceExecutionID, resultItemID)) }
+                : candidates.some(value => typeof value === "object" && value !== null && "train_code" in value)
+                    ? { candidates: candidates.map((value, index) => exactTrainRow(value, serviceExecutionID, resultItemID, (catalogPage.offset ?? offset) + index)) } : { page }),
         },
         instruction: "读取的是已保存结果的同版本分页，不重新查询、不消耗额度。先读完所需页，再合并回答用户；不要逐页播报。",
         next: nextOffset !== null
@@ -986,11 +1013,7 @@ export async function runServicesPage(backend, serviceExecutionID, resultItemID,
     writeCommandEnvelope(envelope, {
         ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
         ...(options.output ? { output: options.output } : {}),
-        plainResult: candidates.map((candidate) => {
-            const c = candidate;
-            const title = typeof c.title === "string" ? c.title : JSON.stringify(c);
-            return `${title}`;
-        }),
+        plainResult: plainValueLines(envelope.result),
     });
 }
 export async function runServicesList(backend, options = {}) {
@@ -1005,6 +1028,7 @@ export async function runServicesList(backend, options = {}) {
         status: execution.status,
         phase: execution.phase,
         updated_at: execution.updated_at,
+        reader: { command: `itpay services next ${execution.service_execution_id} --json`, reason: "读取这笔已有服务" },
     }));
     const latest = executions[0];
     const envelope = {
@@ -1013,7 +1037,7 @@ export async function runServicesList(backend, options = {}) {
         instruction: executions.length === 1
             ? "只有一条可恢复记录；继续读取同一笔服务。"
             : latest
-                ? "用服务和状态说明这些可恢复记录；多个结果必须让用户选择。"
+                ? "按原任务中已明确的执行ID读取对应reader；只有无法确定属于哪一笔任务时才询问用户。"
                 : "当前设备没有可恢复的 Service Execution；先读取已发布目录，不要猜测 ID。",
         next: executions.length === 1
             ? { command: `itpay services next ${latest.service_execution_id} --json`, reason: "继续唯一可恢复的服务" }
@@ -1025,51 +1049,91 @@ export async function runServicesList(backend, options = {}) {
     writeCommandEnvelope(envelope, {
         ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
         ...(options.output ? { output: options.output } : {}),
-        plainResult: executions.map((execution) => `${execution.service_execution_id}: ${execution.service_id} ${execution.status}/${execution.phase} updated=${execution.updated_at}`),
     });
 }
+// Bound the final qualified output by whole saved rows; the cursor follows the emitted rows.
+function writeSavedRailPage(envelope, options, key, offset, continuation) {
+    const result = envelope.result ?? {};
+    const rows = result[key];
+    if (!Array.isArray(rows))
+        throw new Error("saved page has no rows");
+    const bound = (offset === 0 ? 12 : 32) * 1024;
+    const render = (output) => writeCommandEnvelope(envelope, { ...options, output });
+    if (!options.all) {
+        for (;;) {
+            let text = "";
+            render(value => { text += value; });
+            if (Buffer.byteLength(text, "utf8") <= bound)
+                break;
+            if (rows.length <= 1) {
+                throw new CommandContractError("saved_row_too_large", "saved row exceeds the readable page limit", "这条已保存记录超过当前页面大小；事实仍保留，请读取该条详情。", rows[0]?.detail?.command ? [rows[0].detail] : []);
+            }
+            rows.pop();
+            result.truncated_reason = "cli_output_byte_budget";
+            result.count = rows.length;
+            if (key === "trains")
+                result.read_count = rows.length;
+            result.next_offset = offset + rows.length;
+            envelope.next = continuation(offset + rows.length);
+        }
+    }
+    writeCommandEnvelope(envelope, options);
+}
 export async function runServicesReadResult(backend, serviceExecutionID, options = {}) {
     if (!options.snapshot && !options.journey) {
         const model = await backend.getServiceExecution(serviceExecutionID);
         if (model.execution.service_id === "itpay-rail-exact") {
             const item = (model.current_result_items?.length ? model.current_result_items : model.result_items)?.[0];
             if (!item) {
+                const preview = model.provider_invocations.at(-1)?.safe_result_preview;
+                const template = exactSmartTemplate(preview?.resolved_station_pair, serviceExecutionID);
+                if (template && preview?.catalog_total === 0) {
+                    writeCommandEnvelope({ status: "no_result", result: { service_execution_id: serviceExecutionID,
+                            scope: "station_pair", resolved_station_pair: preview.resolved_station_pair,
+                            total: 0, smart_template: template },
+                        instruction: "这一站对的成功观测为0条，不代表附近区域无车。若用户允许中转或原需求范围更广，保留原始区域/地点意图并沿 smart_template 引用本次事实；只要直达时不要自动转中转。",
+                        next: null, recovery: [] }, { ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
+                        ...(options.output ? { output: options.output } : {}) });
+                    return;
+                }
                 await runServicesNext(backend, serviceExecutionID, options);
                 return;
             }
             const rows = [];
-            let offset = 0;
+            const startOffset = options.offset ?? 0;
+            const limit = options.limit ?? 20;
+            if (!Number.isInteger(startOffset) || startOffset < 0 || !Number.isInteger(limit) || limit < 1 || limit > 20) {
+                throw new CommandContractError("page_invalid", "offset must be non-negative and limit 1-20", "页码无效；请按返回的 next.command 读取。", []);
+            }
+            let offset = startOffset;
             let total = 0;
             let resolvedStationPair;
-            let nextOffset = 0;
-            while (nextOffset !== null && rows.length < 100) {
-                const response = await backend.getServiceExecutionResultItemPage(serviceExecutionID, item.service_capability_result_item_id, offset, 20);
+            let nextOffset = startOffset;
+            do {
+                const response = await backend.getServiceExecutionResultItemPage(serviceExecutionID, item.service_capability_result_item_id, offset, limit);
                 const container = (response.page.result ?? response.page);
                 const candidates = Array.isArray(container.candidates) ? container.candidates : [];
                 resolvedStationPair ??= container.resolved_station_pair;
-                rows.push(...candidates.map((value, index) => ({
-                    ...compactExactTrain(value),
-                    result_item_id: item.service_capability_result_item_id,
-                    result_offset: offset + index,
-                    detail: { command: `itpay services page ${serviceExecutionID} ${item.service_capability_result_item_id} --offset ${offset + index} --limit 1 --json`,
-                        reason: "读取此车次的当前席别与服务端购买凭据" },
-                })));
+                rows.push(...candidates.map((value, index) => exactTrainRow(value, serviceExecutionID, item.service_capability_result_item_id, offset + index)));
                 const page = (container.catalog_page ?? {});
                 total = typeof container.catalog_total === "number" ? container.catalog_total : Math.max(total, rows.length);
                 nextOffset = typeof page.next_offset === "number" && page.next_offset > offset ? page.next_offset : null;
                 offset = nextOffset ?? offset;
-            }
-            writeCommandEnvelope({
+            } while (options.all && nextOffset !== null);
+            writeSavedRailPage({
                 status: "ready",
                 result: { service_execution_id: serviceExecutionID, scope: "station_pair", resolved_station_pair: resolvedStationPair,
-                    total, read_count: rows.length,
+                    total, offset: startOffset, count: rows.length, read_count: rows.length,
+                    ...(exactSmartTemplate(resolvedStationPair, serviceExecutionID, item.service_capability_result_item_id)
+                        ? { smart_template: exactSmartTemplate(resolvedStationPair, serviceExecutionID, item.service_capability_result_item_id) } : {}),
                     trains: rows, ...(nextOffset !== null ? { next_offset: nextOffset } : {}) },
                 instruction: "这是同一已保存站对的车次行。按用户时限、席别和人数筛选；零条仅代表这一站对。纯比较答复后结束；已有购票委托则执行所选行 detail.command 读取当前席别、库存和购买凭据。",
-                next: nextOffset !== null ? { command: `itpay services page ${serviceExecutionID} ${item.service_capability_result_item_id} --offset ${nextOffset} --limit 20 --json`, reason: "继续读取同一结果的剩余车次" } : null,
+                next: nextOffset !== null ? { command: `itpay services read-result ${serviceExecutionID} --offset ${nextOffset} --limit ${limit} --json`, reason: "继续读取同一结果的剩余车次" } : null,
                 recovery: [],
             }, { ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
                 ...(options.output ? { output: options.output } : {}),
-                plainResult: rows.map((row) => `${row.train_code} ${row.from_station} ${row.departure} → ${row.to_station} ${row.arrival}`) });
+                all: Boolean(options.all),
+            }, "trains", startOffset, next => ({ command: `itpay services read-result ${serviceExecutionID} --offset ${next} --limit ${limit} --json`, reason: "读取同一保存结果的下一页" }));
             return;
         }
     }
@@ -1080,49 +1144,88 @@ export async function runServicesReadResult(backend, serviceExecutionID, options
     // rail.planning catalog read: --snapshot returns compact rows for the
     // committed rail.catalog.v3; journey detail remains available separately.
     if (options.snapshot && !options.journey) {
-        const committed = await backend.getRailPlanningCatalog(serviceExecutionID, options.snapshot);
-        const catalog = committed.catalog;
-        // The committed catalog may ship shared_rows.v1 positional rows — decode
-        // the summary through the column legend; an unknown encoding is an
-        // explicit upgrade error, never an empty catalog.
-        const decoded = catalog
-            ? decodeRailCatalogJourneys(catalog)
-            : { journeys: [], packed: false };
-        const journeys = decoded.journeys.map((journey) => ({ ...journey,
-            detail: { command: `itpay services read-result ${serviceExecutionID} --snapshot ${committed.snapshot_id} --journey ${journey.ref} --json`,
-                reason: "读取同一已保存快照的此行程完整购票条件" },
-        }));
-        const counts = (catalog?.counts ?? {});
-        const journeyCount = journeys.length || Number(counts?.combinations ?? 0);
-        writeCommandEnvelope({
+        const offset = options.offset ?? 0;
+        const limit = options.limit ?? 3;
+        if (!Number.isInteger(offset) || offset < 0 || !Number.isInteger(limit) || limit < 1 || limit > 20) {
+            throw new CommandContractError("page_invalid", "offset must be non-negative and limit 1-20", "目录页码无效；请按返回的 next.command 读取。", []);
+        }
+        const journeys = [];
+        let nextOffset = offset;
+        let total = 0;
+        let truncatedReason = null;
+        let qualificationCounts;
+        let planID;
+        let queryRevision;
+        while (nextOffset !== null) {
+            let response;
+            try {
+                response = await backend.getServiceExecutionResultItemPage(serviceExecutionID, options.snapshot, nextOffset, limit, "summary");
+            }
+            catch (error) {
+                if (error instanceof HttpError && error.code === "result_not_pageable") {
+                    const committed = await backend.getRailPlanningCatalog(serviceExecutionID, options.snapshot);
+                    decodeRailCatalogJourneys(committed.catalog);
+                }
+                throw error;
+            }
+            if (response.snapshot_id !== options.snapshot)
+                throw new Error("saved page snapshot changed");
+            planID = response.plan_id;
+            queryRevision = response.query_revision;
+            const container = (response.page.result ?? response.page);
+            const page = container.journey_page;
+            const rows = Array.isArray(container.journeys) ? container.journeys : [];
+            total = typeof page?.total === "number" ? page.total : rows.length;
+            qualificationCounts = page?.qualification_counts ?? qualificationCounts;
+            truncatedReason = page?.truncated_reason ?? truncatedReason;
+            journeys.push(...rows.map((card) => compactRailJourney(card, serviceExecutionID, options.snapshot)));
+            const following = page?.next_offset;
+            if (typeof following === "number" && following <= nextOffset)
+                throw new Error("saved page cursor did not advance");
+            nextOffset = typeof following === "number" ? following : null;
+            if (!options.all)
+                break;
+        }
+        writeSavedRailPage({
             status: "ready",
             result: {
                 service_execution_id: serviceExecutionID,
-                plan_id: committed.plan_id,
-                snapshot_id: committed.snapshot_id,
-                query_revision: committed.query_revision,
-                coverage: catalog?.coverage,
-                calculation_scope: catalog?.request_summary,
-                total: journeyCount,
+                plan_id: planID,
+                snapshot_id: options.snapshot,
+                query_revision: queryRevision,
+                total,
+                qualification_counts: qualificationCounts,
+                requested_limit: limit,
+                truncated_reason: truncatedReason,
+                offset,
+                count: journeys.length,
+                next_offset: nextOffset,
                 journeys,
             },
-            instruction: "这是同一已保存快照的紧凑行程目录。按用户问题筛选全部 journeys 并一次回答；未计入接驳或未知费用不能当免费。需要购票详情时执行所选行 detail.command；价格和余票仍须购买前实时报价。",
-            next: null,
+            instruction: qualificationCounts === undefined
+                ? "此历史快照没有完整资格计数；线路仅供核对铁路事实，不能据此认定可购买。沿同快照 detail.command 查看详情。"
+                : qualificationCounts.eligible === 0
+                    ? `查到 ${total} 个时刻组合，当前 0 条满足购票资格。请读取诊断线路的 detail.command 查看具体原因；修改条件须依据用户意愿。`
+                    : `已查范围内合格时刻组合 ${qualificationCounts.eligible}；本次展示 ${journeys.length} 个方案（首屏优先既有主方案/代表，计数不是中转通道数）。最快/低价须按对应方案和比较范围说明；未全范围排序只能说已读方案中。更多条件优先同快照调整偏好或沿 next 有序读所需页，不随机翻页、不无条件读完组合。未知费用不能当免费；detail.command 读取席别和整程购买条件，购买前实时报价。`,
+            next: nextOffset === null ? null : { command: `itpay services read-result ${serviceExecutionID} --snapshot ${options.snapshot} --offset ${nextOffset} --limit ${limit} --json`, reason: "仅当前问题还需未读线路时继续；已有合格完整结果可答复或按委托继续" },
             recovery: [],
         }, {
             ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
             ...(options.output ? { output: options.output } : {}),
-            plainResult: journeys.length > 0
-                ? [
-                    `${journeyCount} combinations:`,
-                    ...journeys.map((j) => `${j.defaultLayer === "backup" ? "[备选] " : "[主选择] "}${j.ref}  ${j.route}  ${j.rides?.map((r) => `${r.train_code} ${r.departure}–${r.arrival}`).join(" / ") ?? ""}`),
-                ]
-                : [`catalog: ${committed.snapshot_id} (no combinations)`],
-        });
+            all: Boolean(options.all),
+        }, "journeys", offset, next => ({ command: `itpay services read-result ${serviceExecutionID} --snapshot ${options.snapshot} --offset ${next} --limit ${limit} --json`, reason: "仅当前问题还需未读线路时继续；已有合格完整结果可答复或按委托继续" }));
         return;
     }
     if (options.journey) {
         const detail = await backend.getRailJourneyDetail(serviceExecutionID, options.journey, options.snapshot);
+        const planOffset = options.offset ?? 0;
+        const planLimit = options.limit ?? 3;
+        if (!Number.isInteger(planOffset) || planOffset < 0 || !Number.isInteger(planLimit) || planLimit < 1 || planLimit > 20) {
+            throw new CommandContractError("page_invalid", "offset must be non-negative and limit 1-20", "席别方案页码无效；请按返回的 next.command 读取。", []);
+        }
+        const plans = detail.journey.ticket_plans ?? [];
+        const selected = options.all ? plans : plans.slice(planOffset, planOffset + planLimit);
+        const nextOffset = !options.all && planOffset + selected.length < plans.length ? planOffset + selected.length : null;
         writeCommandEnvelope({
             status: "ready",
             result: {
@@ -1130,10 +1233,13 @@ export async function runServicesReadResult(backend, serviceExecutionID, options
                 plan_id: detail.plan_id,
                 snapshot_id: detail.snapshot_id,
                 query_revision: detail.query_revision,
-                journey: detail.journey,
+                journey: compactRailJourney(detail.journey, serviceExecutionID, detail.snapshot_id),
+                ticket_plan_total: plans.length,
+                ticket_plan_offset: planOffset,
+                ticket_plans: selected.map(plan => compactRailTicketPlan(plan, detail.journey.qualification_status === "eligible")),
             },
-            instruction: "展示该 journey 的完整明细（车次、分段、席别报价、接驳估计与风险标注）。rail_payable 只是该行程当前可购报价的参考价，不是锁价；下单前须走受保护 Checkout 收集乘车人。用户已明确委托按规则代选时用 select_delegated；用户亲自选定该行程时用 select_user_chosen，不能把 Agent 选择记作人类动作。",
-            next: null,
+            instruction: "同一线路的完整车次与席别方案。已有所需席别和有效凭据即可按真实委托继续；只需比较则答复并停止，需要其他席别才读下一页。使用所选 ticket_plan 的整程 booking_template：一个 booking、统一报价、一个官方付款入口，各段分别出票，无联合锁票或接续保证。未返回整程模板时不能拼不同方案的腿或退回逐腿付款，按同一执行恢复。身份资料只在受保护 Checkout 页面填写。",
+            next: nextOffset === null ? null : { command: `itpay services read-result ${serviceExecutionID} --snapshot ${detail.snapshot_id} --journey ${options.journey} --offset ${nextOffset} --limit ${planLimit} --json`, reason: "仅需要其他席别时读取；已满足用户条件则停止翻页" },
             ...(detail.journey?.booking_support === "single_leg" ? { interaction: {
                     schema_version: "itpay.interaction.v1", stage: "query_results_ready",
                     select_user_chosen: `itpay services action ${serviceExecutionID} --action select_journey --actor-type human --status approved --input journey_id=${detail.journey.journey_id} --json`,
@@ -1143,7 +1249,6 @@ export async function runServicesReadResult(backend, serviceExecutionID, options
         }, {
             ...(options.jsonOutput !== undefined ? { jsonOutput: options.jsonOutput } : {}),
             ...(options.output ? { output: options.output } : {}),
-            plainResult: servicesNextPlainResult(detail.journey),
         });
         return;
     }
@@ -1163,6 +1268,24 @@ export async function runServicesReadResult(backend, serviceExecutionID, options
         plainResult: servicesNextPlainResult(envelope.result),
     });
 }
+function exactSmartTemplate(pair, executionID, resultItemID) {
+    if (!pair || typeof pair !== "object")
+        return null;
+    const value = pair;
+    if (!["origin_name", "origin_code", "destination_name", "destination_code", "travel_date"].every((key) => typeof value[key] === "string" && value[key]))
+        return null;
+    return { executable: false, verified_station_pair: value,
+        instruction: "已核验站对是复用事实，不是完整用户查询。仅用户明确锁站才填 kind=station；区域/地点从原始需求填回，保留真实人数、时限和偏好，不默认为一人。",
+        command: "itpay services run itpay-rail-smart --input-json <原始需求.json> --json",
+        required_input: ["endpoints", "passengers", "用户时限与偏好"],
+        input_example: { endpoints: { origin: { text: "<原始出发行政范围/地点/用户指定站>" }, destination: { text: "<原始到达行政范围/地点/用户指定站>" } },
+            travel_date: value.travel_date, passengers: "<真实人数>", reuse_from: { execution_id: executionID,
+                ...(resultItemID ? { result_item_id: resultItemID } : {}) } } };
+}
+function exactTrainRow(candidate, executionID, itemID, offset) {
+    return { ...compactExactTrain(candidate), result_item_id: itemID, result_offset: offset,
+        detail: { command: `itpay services page ${executionID} ${itemID} --offset ${offset} --limit 1 --json`, reason: "读取此车次席别与服务端购买模板" } };
+}
 function compactExactTrain(candidate) {
     const seats = Array.isArray(candidate.seats) ? candidate.seats : [];
     return {
@@ -1200,6 +1323,8 @@ function railBookingEnvelope(model) {
         leg_index: leg.leg_index,
         state: leg.state,
         issued: leg.issued,
+        ...(leg.error_code ? { error_code: leg.error_code } : {}),
+        arrival_days: leg.arrival_days ?? 0,
         ...(leg.details_pending ? { details_pending: true } : {}),
         ...(leg.supplier_state ? { supplier_state: leg.supplier_state } : {}),
         ...(leg.train_code ? { train_code: leg.train_code } : {}),
@@ -1214,16 +1339,15 @@ function railBookingEnvelope(model) {
     const result = {
         service_execution_id: execution.service_execution_id,
         ...(orderID ? { order_id: orderID } : {}),
-        rail: { state: rail.state, issued_legs: rail.issued_legs, legs },
-        ...(model.workflow ? { workflow: model.workflow } : {}),
+        rail: { state: rail.state, issued_legs: rail.issued_legs, total_legs: rail.legs.length, message: rail.message, legs },
     };
-    if (rail.state === "issued") {
+    if (rail.state === "issued" && rail.issued_legs === rail.legs.length && rail.legs.length > 0) {
         const detailsPending = rail.legs.some((leg) => leg.details_pending);
         return {
             status: "issued",
-            result,
+            result: { ...result, ...(orderID ? { aftercare: { command: `itpay order ${orderID} --json`, when: "仅用户请求核对订单或售后时" } } : {}) },
             instruction: `告诉用户：车票已出票，座位以实际出票为准，平台不提供 12306 票号，可在订单页核对行程。不要在对话中索要乘车人身份信息。${detailsPending ? "部分席位信息未能同步，请前往 12306 核对行程；不要重复购买。" : ""}`,
-            next: orderID ? { command: `itpay order ${orderID} --json`, reason: "查看订单及退款入口" } : null,
+            next: null,
             recovery: [],
         };
     }
@@ -1231,7 +1355,7 @@ function railBookingEnvelope(model) {
         return {
             status: "manual_review",
             result,
-            instruction: "告诉用户：付款已确认，订单需要人工核对；请勿重复付款或重新下单，已出票的车票会保留。不要承诺退款结果或时效。",
+            instruction: `告诉用户：付款已确认，已出票 ${rail.issued_legs}/${rail.legs.length}，其余需要人工核对；请勿重复付款或重新下单，已出票的车票会保留。未知结果先对账，退款按对应段处理，不承诺整笔退款或时效。`,
             next: orderID ? { command: `itpay order ${orderID} --json`, reason: "查看同一订单当前状态" } : null,
             recovery: [],
         };
@@ -1244,7 +1368,7 @@ function railBookingEnvelope(model) {
         return {
             status: "issuing",
             result,
-            instruction: "告诉用户：付款已确认，后台正在出票；付款成功不代表已出票，请勿重复购买或再次付款。稍后只读取同一任务。",
+            instruction: `告诉用户：付款已确认，已出票 ${rail.issued_legs}/${rail.legs.length}，后台继续处理；付款成功不代表整程出票，请勿重复购买或再次付款。稍后只读取同一任务。`,
             next: { command: `itpay services next ${execution.service_execution_id} --json`, reason: "稍后读取同一出票任务" },
             recovery: [],
         };
@@ -1257,7 +1381,111 @@ function railBookingEnvelope(model) {
         recovery: [],
     };
 }
-function railJourneySummary(card, serviceExecutionID) {
+function compactRailJourney(card, serviceExecutionID, snapshotID) {
+    if (!card.journey_id)
+        throw new Error("saved journey has no stable ID");
+    const rides = (card.rides ?? []).map((ride) => ({
+        train_code: ride.train_code ?? (Array.isArray(ride.train_codes) ? ride.train_codes.join("/") : null),
+        from_station: ride.from_station ?? null, from_station_code: ride.from_station_code ?? null,
+        departure: ride.departure ?? null, to_station: ride.to_station ?? null,
+        to_station_code: ride.to_station_code ?? null, arrival: ride.arrival ?? null,
+        ...(typeof ride.wait_minutes === "number" ? { wait_minutes: ride.wait_minutes } : {}),
+        ...(typeof ride.minimum_connection_minutes === "number" ? { required_buffer_minutes: ride.minimum_connection_minutes } : {}),
+        ...(ride.same_run === true ? { same_run: true } : {}),
+    }));
+    const offer = card.representative_offer;
+    const metrics = card.representative_metrics;
+    const ticketSeats = (offer?.ticket_offers ?? []).map((raw) => ({
+        leg_index: raw.leg_index, seat_type: raw.seat_type, seat_name: raw.seat_name,
+        availability: raw.availability_text, remaining: raw.inventory_exact === true ? raw.remaining : null,
+    }));
+    const railwayTime = (value) => {
+        if (typeof value !== "string")
+            return NaN;
+        const time = value.replace(" ", "T");
+        return Date.parse(/(?:Z|[+-]\d{2}:\d{2})$/.test(time) ? time : `${time}Z`);
+    };
+    const start = railwayTime(rides[0]?.departure);
+    const end = railwayTime(rides.at(-1)?.arrival);
+    return {
+        journey_ref: card.journey_id,
+        ...(card.profile_refs?.balanced ? { profile_ref: card.profile_refs.balanced } : {}),
+        default_layer: card.default_layer ?? "main",
+        ...(card.backup_reason ? { backup_reason: card.backup_reason } : {}),
+        ...(card.backup_baseline_min != null ? { backup_baseline_min: card.backup_baseline_min } : {}),
+        ...(card.backup_delta_min != null ? { backup_delta_min: card.backup_delta_min } : {}),
+        route: card.route_text ?? (card.route_names ?? card.route ?? []).join("→"),
+        rides,
+        ...(card.booking_support === "single_leg" && card.qualification_status === "eligible" && card.booking_offer ? {
+            booking_template: { command: `itpay services run ${card.booking_offer.service_id} --input-json <购票.json> --json`, executable: false,
+                seat_choices: ticketSeats.map(seat => ({ seat_type: seat.seat_type, seat_name: seat.seat_name })),
+                input_example: { selection: { token: card.booking_offer.selection_token, seat_type: "<返回席别代码>" }, passengers: card.passengers ?? offer?.ticket_offers?.[0]?.passengers ?? "<真实人数>" },
+                required_input: ["file", "真实席别选择及人数"] },
+        } : {}),
+        ...(ticketSeats.length ? { seats: ticketSeats } : {}),
+        ticket_plan_refs: (card.ticket_plans ?? []).map(plan => plan.ticket_plan_ref),
+        transfer_wait_minutes: card.transfer_wait_minutes ?? [],
+        ground_summary: card.ground_summary ?? null,
+        passengers: card.passengers ?? offer?.ticket_offers?.[0]?.passengers ?? null,
+        availability: card.availability ?? "unknown",
+        qualification_status: card.qualification_status ?? "unknown",
+        ...(card.qualification_reasons?.length ? { qualification_reasons: card.qualification_reasons } : {}),
+        ...(offer ? { rail_payable_fen: offer.rail_payable_minor, currency: offer.currency } : { rail_payable_fen: null }),
+        estimated_trip_total: metrics?.estimated_total_cost ?? null,
+        cost_basis: metrics?.cost_basis ?? "unknown",
+        duration_basis: metrics?.duration_basis ?? "unknown",
+        timezone: "Asia/Shanghai",
+        ...(card.risk_notes?.length ? { risk_notes: card.risk_notes } : {}),
+        rail_duration_minutes: Number.isFinite(start) && Number.isFinite(end) && end >= start ? Math.round((end - start) / 60000) : null,
+        ...(card.observed_at ? { observed_at: card.observed_at } : {}),
+        detail: { command: `itpay services read-result ${serviceExecutionID} --snapshot ${snapshotID} --journey ${card.journey_id} --json`,
+            reason: card.qualification_status === "eligible" ? "读取此完整线路的席别、报价和购买条件" : "读取此线路的铁路事实和不可购买原因" },
+    };
+}
+function compactRailTicketPlan(raw, journeyEligible) {
+    const legs = Array.isArray(raw.legs) ? raw.legs : [];
+    const seats = Array.isArray(raw.seat_offers) ? raw.seat_offers : [];
+    const tickets = Array.isArray(raw.ticket_offers) ? raw.ticket_offers : [];
+    return {
+        ticket_plan_ref: raw.ticket_plan_ref,
+        passengers: raw.passenger_count ?? (Array.isArray(raw.ticket_offers) ? raw.ticket_offers[0]?.passengers : null) ?? null,
+        purchase_support: raw.purchase_support ?? "none",
+        qualification_status: raw.qualification_status ?? "unknown",
+        qualification_reasons: raw.qualification_reasons ?? [],
+        rail_amount_fen: raw.rail_amount_fen ?? null,
+        service_fee_fen: raw.service_fee_fen ?? null,
+        price_verified: raw.rail_amount_verified === true,
+        ...(journeyEligible && raw.qualification_status === "eligible" && raw.booking_input && typeof raw.booking_input === "object" ? {
+            booking_template: { command: "itpay services run itpay-rail-booking --input-json <journey.json> --json", executable: false, ticket_plan_ref: raw.ticket_plan_ref, input_example: raw.booking_input, required_input: ["file", "passengers"] },
+        } : {}),
+        legs: legs.map((leg, index) => ({
+            leg_index: index,
+            travel_date: leg.travel_date ?? tickets.find(ticket => ticket.leg_index === index)?.travel_date ?? null,
+            ...(() => {
+                const ticket = tickets.find(ticket => ticket.leg_index === index) ?? (tickets[index]?.leg_index === undefined ? tickets[index] : undefined);
+                const offer = ticket?.booking_offer;
+                return legs.length === 1 && offer?.service_id && offer.selection_token && journeyEligible && raw.qualification_status === "eligible" ? {
+                    booking_template: { command: `itpay services run ${offer.service_id} --input-json <购票.json> --json`, executable: false,
+                        ticket_plan_ref: raw.ticket_plan_ref, leg_index: index,
+                        seat_choices: [{ seat_type: ticket?.seat_type, seat_name: ticket?.seat_name }],
+                        input_example: { selection: { token: offer.selection_token, seat_type: ticket?.seat_type ?? "<该方案席别代码>" },
+                            passengers: ticket?.passengers ?? raw.passenger_count ?? "<真实人数>" },
+                        required_input: ["file", "真实人数", "该方案席别代码"],
+                    },
+                } : legs.length > 1 ? {} : { booking_unavailable: "本段没有当前可用的服务端凭据；不能猜代码或例行重查。保留快照，按当前执行的恢复动作处理；过期凭据需真实新验证。" };
+            })(),
+            train_code: leg.train_code ?? null,
+            from_station: leg.from_station ?? null, from_station_code: leg.from_station_code ?? null,
+            departure: leg.departure ?? null,
+            to_station: leg.to_station ?? null, to_station_code: leg.to_station_code ?? null,
+            arrival: leg.arrival ?? null,
+            seats: (seats[index] ?? []).map((seat) => ({ seat_type: seat.seat_type, seat_name: seat.seat_name,
+                availability: seat.availability_text, remaining: seat.inventory_exact === true ? seat.remaining : null,
+                unit_fare_fen: seat.fare_minor, eligible: seat.eligible === true })),
+        })),
+    };
+}
+function railJourneySummary(card, serviceExecutionID, snapshotID) {
     const rides = Array.isArray(card.rides) ? card.rides : [];
     const trains = rides.map((ride) => ride.train_code).filter(Boolean);
     const first = rides[0];
@@ -1266,6 +1494,7 @@ function railJourneySummary(card, serviceExecutionID) {
     const metrics = card.representative_metrics;
     return {
         journey_id: card.journey_id,
+        ...(snapshotID ? (() => { const detail = compactRailJourney(card, serviceExecutionID, snapshotID); return { rides: detail.rides, seats: detail.seats, default_layer: detail.default_layer, detail: detail.detail, ...(detail.booking_template ? { booking_template: detail.booking_template } : {}) }; })() : {}),
         route: (card.route_names?.length ? card.route_names : card.route ?? []).join("→"),
         ...(trains.length ? { trains } : {}),
         ...(first?.departure || last?.arrival ? { time: `${first?.departure ?? ""}–${last?.arrival ?? ""}` } : {}),
@@ -1294,29 +1523,6 @@ function railJourneySummary(card, serviceExecutionID) {
                 select_delegated: `itpay services action ${serviceExecutionID} --action select_journey --actor-type agent --status approved --input journey_id=${card.journey_id} --input selection_mode=delegated --json`,
             }
             : {}),
-        ...(card.booking_offer
-            ? {
-                booking_offer: card.booking_offer,
-                booking_template: {
-                    command: `itpay services run ${card.booking_offer.service_id} --input-json <file> --json`,
-                    required_input: ["file"],
-                    executable: false,
-                    seat_choices: (card.representative_offer?.ticket_offers ?? []).map((offer) => ({
-                        seat_type: offer.seat_type,
-                        seat_name: offer.seat_name,
-                    })).filter((seat) => typeof seat.seat_type === "string"),
-                    input_example: {
-                        selection: {
-                            token: card.booking_offer.selection_token,
-                            ...(typeof card.representative_offer?.ticket_offers?.[0]?.seat_type === "string"
-                                ? { seat_type: card.representative_offer.ticket_offers[0].seat_type }
-                                : {}),
-                        },
-                        passengers: card.passengers ?? 1,
-                    },
-                },
-            }
-            : {}),
     };
 }
 // rail.progressive.v2 read projection: committed snapshots only; polling never
@@ -1328,11 +1534,19 @@ function railPlanningEnvelope(model) {
     const expansion = plan.search?.expansion_status ?? "running";
     const counts = plan.search?.counts;
     const journeys = [plan.recommendation, ...(plan.alternatives ?? [])].filter(Boolean);
-    const cards = journeys.map((card) => railJourneySummary(card, se));
+    const hasEligible = typeof counts?.journeys_eligible === "number"
+        ? counts.journeys_eligible > 0 : journeys.length > 0;
+    const changedScopeHint = plan.query_input && !/supplier|provider|dispatch|map|amap|permission/.test(plan.search?.reason ?? "")
+        ? "若原条件锁定车站，可提议仅放宽一端到原站周边；有已核实地点证据才建议具体站，不能说肯定有票。先询问用户是否接受该端范围变化；同意后按new_query_template开新查询，未同意则保持原站。"
+        : /supplier|provider|dispatch|map|amap|permission/.test(plan.search?.reason ?? "")
+            ? "依赖故障按原恢复动作处理，不通过换站掩盖故障。"
+            : "如需改变端点，先取得真实范围变更同意，再按正式铁路指南保留原条件发起新查询。";
+    const cards = journeys.filter(card => card.journey_id !== plan.recommendation?.journey_id)
+        .map((card) => railJourneySummary(card, se, plan.catalog_snapshot_id ?? plan.snapshot_id));
     // Journey counts come from the committed catalog — real combination counts,
     // never seat-row counts. Transfer buckets follow the verified transfer_count.
     const journeyMix = counts && (counts.journeys_total ?? 0) > 0
-        ? `${counts.journeys_total}个铁路组合（直达${counts.journeys_direct ?? 0}/1中转${counts.journeys_one_transfer ?? 0}/2中转${counts.journeys_multi_transfer ?? 0}）`
+        ? `已保存${counts.journeys_total}个具体车次时刻组合，其中${counts.journeys_eligible ?? "未知"}条当前满足铁路资格（直达${counts.journeys_direct ?? 0}/1中转${counts.journeys_one_transfer ?? 0}/2中转${counts.journeys_multi_transfer ?? 0}；这些不是不同站序的数量）`
         : "";
     const pairProgress = counts && (counts.pairs_total ?? 0) > 0
         ? `已检查${counts.pairs_checked ?? 0}/${counts.pairs_total}个附近站对`
@@ -1352,6 +1566,7 @@ function railPlanningEnvelope(model) {
         rail_planning: {
             readiness: plan.readiness,
             query_revision: plan.query_revision,
+            ...(plan.query_input ? { endpoints: plan.query_input.endpoints } : {}),
             snapshot_id: plan.snapshot_id,
             expansion_status: expansion,
             ...(plan.search?.phase ? { phase: plan.search.phase } : {}),
@@ -1365,67 +1580,24 @@ function railPlanningEnvelope(model) {
             ...(plan.search?.poll_after_ms ? { poll_after_ms: plan.search.poll_after_ms } : {}),
             ...(plan.result_not_updated ? { result_not_updated: true } : {}),
             ...(counts ? { counts } : {}),
-            ...(plan.budgets ? { budgets: plan.budgets } : {}),
             ...(plan.coverage ? { coverage: plan.coverage } : {}),
         },
         ...(plan.notices?.length ? { notices: plan.notices } : {}),
-        ...(plan.recommendation ? { recommendation: railJourneySummary(plan.recommendation, se) } : {}),
+        ...(plan.recommendation ? { recommendation: railJourneySummary(plan.recommendation, se, plan.catalog_snapshot_id ?? plan.snapshot_id) } : {}),
         ...(cards.length ? { journeys: cards } : {}),
         ...(plan.snapshot_id ? { full_result: { command: `itpay services read-result ${se} --snapshot ${plan.snapshot_id} --json`, meaning: "读取已保存的完整目录；推荐和journeys仅是摘要" } } : {}),
+        ...(!hasEligible && ["paused", "complete", "expired"].includes(expansion) && plan.query_input && plan.catalog_snapshot_id ? { new_query_template: {
+                command: "itpay services run itpay-rail-smart --input-json <file> --json",
+                executable: false,
+                input_example: { ...plan.query_input, reuse_from: { execution_id: se, snapshot_id: plan.catalog_snapshot_id } },
+                meaning: "先取得真实范围变更同意，再复制完整input_example，仅改获准端。换具体站用station及匹配名称/站码；考虑原站周边用place及原站名，删除station_code，经正常地点解析或使用已核实POI/坐标；只有明确同意整个市才用area及完整行政名，删除POI/坐标/站码。日期、人数、时限及偏好保持；新执行不改变旧查询或订单。引用仅限同owner未过期事实，跨owner拒绝；日期变更不复用旧库存。",
+            } } : {}),
         ...(plan.available_actions?.length ? { available_actions: plan.available_actions } : {}),
     };
     const nextPoll = {
         command: `itpay services next ${se} --timeout 120${plan.snapshot_id ? ` --since-snapshot ${plan.snapshot_id}` : ""} --json`,
         reason: "仍需更多结果时有界等待同一规划（不触发供应商调用）",
     };
-    // Two-goal interaction contract (spec 03 §2): the local Agent picks compare
-    // or prepare_checkout from full context — the envelope teaches both branches
-    // so a delegated purchase keeps moving and a comparison never buys.
-    const bookable = journeys.find((card) => card.booking_support === "single_leg" && card.booking_offer);
-    const queryResultsInteraction = journeys.length > 0
-        ? {
-            schema_version: "itpay.interaction.v1",
-            stage: "query_results_ready",
-            by_goal: {
-                compare: { action: "present_options", max_options: 3, stop_after_presentation: true },
-                prepare_checkout: {
-                    action: "select_under_user_rules_then_prepare",
-                    recipe: "rail.selected-to-checkout.v1",
-                    requires: ["current_delegation", "eligible_current_selection", "owner_permits_next_step"],
-                    ...(bookable
-                        ? {
-                            steps: [
-                                "按用户明确规则在 journeys 中选择合格者（卡片 select_delegated 提交 agent 委托选择；人类亲自选择用 select_user_chosen）",
-                                `用所选卡片的 booking_template 写 owner-only 临时输入（selection token + 席别 + 人数，不含身份信息），运行 itpay services run itpay-rail-booking --input-json <file> --json`,
-                                "owner 要求聊天 review 时一次合并补齐必要字段，真实确认后提交原 workflow:confirm_booking；不得伪造 accept",
-                                `确认后恢复同一购买执行：itpay services run itpay-rail-booking --execution <实际ID> --json，沿用有界等待与受保护 Checkout`,
-                            ],
-                        }
-                        : { unavailable: "当前结果无可整段购买映射；分别说明各段风险，不得合成原子联程。" }),
-                },
-            },
-        }
-        : undefined;
-    const queryResultsCommunication = journeys.length > 0
-        ? {
-            schema_version: "itpay.communication.v1",
-            status_line: expansion === "paused"
-                ? "首批结果已就绪，扩展搜索已暂停等待用户决定"
-                : "查询结果就绪",
-            recommended_reason: plan.recommendation?.explanation?.[0],
-            human_steps: [
-                "compare：比较首选与最多两个备选后告知取舍",
-                "prepare_checkout：委托仍在时确认所选，继续官方确认页",
-                "姓名、证件、手机号只在受保护 Checkout 页填写",
-            ],
-            next_expectation: "compare：用户选定其一；prepare_checkout：委托仍在时继续到官方确认入口，人完成review与付款",
-            must_convey: [
-                "推荐与备选的时间/费用/便利性取舍",
-                "金额为查询时参考价，下单前须核验",
-                "姓名、证件、手机号只在受保护网页填写",
-            ],
-        }
-        : undefined;
     switch (expansion) {
         case "complete":
             if (plan.search?.reason === "ground_evidence_required") {
@@ -1435,18 +1607,30 @@ function railPlanningEnvelope(model) {
                     next: null, recovery: [],
                 };
             }
+            if (!hasEligible && !plan.result_not_updated) {
+                return {
+                    status: "no_result", result,
+                    instruction: `本次已查询范围内没有当前合格线路。原因以 notices、coverage 和 search.reason 为准；缺票、接续失败、依赖故障或未覆盖范围不能改说成没有车。已有铁路事实可从 full_result 读取。${changedScopeHint}后续使用 available_actions 中与用户意图一致的动作。`,
+                    next: null, recovery: [],
+                };
+            }
             return {
                 status: "ready",
                 result,
                 // §7.3: the lead line carries real combination counts bucketed by
                 // verified transfer count — seat rows never inflate the journey count.
-                instruction: `${journeyMix ? `本次共${journeyMix}（席别不重复计数）。` : ""}${plan.search?.reason === "budget_exhausted" ? "本次查询已达到上限，以下是已查到的方案，搜索范围尚未全部核验。" : "本轮规划已完成。"}推荐和journeys是摘要；追问其他车次先读取 full_result 的已保存完整目录。compare：解释首选及最多两个有意义备选的时间/费用/便利性取舍后等待用户选择。prepare_checkout：用户已明确委托按规则选择时，按 interaction.recipe 选合格者并继续到官方确认页，不再次问是否下单；身份、review和最终付款边界仍然生效。乘车人身份信息不在此收集，后续购买走受保护 Checkout。`,
+                instruction: `${plan.result_not_updated ? "快照没有更新，空增量不表示目录为空。" : ""}${hasEligible && journeys.length === 0 ? `已保存${counts?.journeys_eligible ?? "若干"}条合格线路，执行 full_result.command 读取。` : ""}${journeyMix ? `本次共${journeyMix}（席别不重复计数）。` : ""}${plan.search?.reason === "budget_exhausted" ? "本次查询已达到上限，以下是已查到的方案，搜索范围尚未全部核验。" : "本轮规划已完成。"}推荐和journeys是摘要；追问其他车次先读取 full_result 的已保存完整目录。比较需求说明首选与备选取舍后结束；已有明确代选委托则沿合格线路详情继续，只补缺失的真实同意，身份信息仍在官方页面填写。`,
                 next: null,
-                ...(queryResultsInteraction ? { interaction: queryResultsInteraction } : {}),
-                ...(queryResultsCommunication ? { communication: queryResultsCommunication } : {}),
                 recovery: [],
             };
         case "paused": {
+            if (plan.search?.reason === "legacy_plan_requires_new_search") {
+                return {
+                    status: "awaiting_input", result,
+                    instruction: "这次规划使用旧算法快照，当前版本已暂停后续查询。已保存的结果仍可读取；若需继续覆盖未查范围，请按原出行条件发起一项新的 Smart 查询。不要把旧快照解释为新版完整结果。",
+                    next: null, recovery: [],
+                };
+            }
             // §7.1 case 1: usable directs committed while ranked scope remains. The
             // message must carry real counts, and expansion is a user choice — the
             // Agent must not treat "expandable" as consent already given.
@@ -1469,7 +1653,7 @@ function railPlanningEnvelope(model) {
             // §7.1 case 3 on a recoverable pause: unverified scope is named with real
             // counts, and the phrasing never implies the whole nearby range ran.
             const partialPause = !directHint && counts && (counts.pairs_total ?? 0) > (counts.pairs_checked ?? 0)
-                ? `目前找到${counts.journeys_total ?? 0}个可选组合；还有${(counts.pairs_total ?? 0) - (counts.pairs_checked ?? 0)}个站对/部分中转路径未核验。以下是已确认结果，不能据此断定没有其它走法。`
+                ? `已保存${counts.journeys_total ?? 0}个具体车次时刻组合，其中${counts.journeys_eligible ?? "未知"}条当前满足铁路资格；还有${(counts.pairs_total ?? 0) - (counts.pairs_checked ?? 0)}个站对/部分中转路径未核验。以下是已确认结果，不能据此断定没有其它走法。`
                 : "";
             // §S5: a dispatch whose outcome is unknown pauses for reconciliation —
             // the message names the state, never rephrases it as a normal pause or
@@ -1487,21 +1671,29 @@ function railPlanningEnvelope(model) {
             return {
                 status: "awaiting_input",
                 result,
-                instruction: `${modelDegradedHint}${failedPairsHint}${directHint}${transferHint}${partialPause}规划已发布首批结果并暂停扩展：展示现有卡片与 available_actions，等待用户意图（${expandHint}）。ready 后 next 为空表示向用户汇报并等待，不是永远没有更多。compare：解释首选及最多两个备选后等待；prepare_checkout：委托仍在且选项合格时按 interaction.recipe 继续到官方确认入口，不再次问是否下单。`,
+                instruction: `${modelDegradedHint}${failedPairsHint}${directHint}${transferHint}${partialPause}${hasEligible ? "规划已发布可用结果并暂停扩展：展示现有卡片与 available_actions" : `当前已查范围尚未找到合格线路，搜索已暂停；未查范围与故障以coverage/notices为准，不是完整无解。${changedScopeHint}展示 available_actions`}，等待用户意图（${expandHint}）。ready 后 next 为空表示向用户汇报并等待，不是永远没有更多。比较需求说明首选与备选取舍后结束；已有代选委托且选项合格时沿详情继续到必要确认与官方入口。`,
                 next: null,
-                ...(queryResultsInteraction ? { interaction: queryResultsInteraction } : {}),
-                ...(queryResultsCommunication ? { communication: queryResultsCommunication } : {}),
                 recovery: [],
             };
         }
         case "failed":
         case "cancelled":
         case "expired": {
+            if (expansion === "failed" && !plan.snapshot_id &&
+                ["address_required", "administrative_area_unresolved", "station_location_evidence_required", "coordinate_identity_unverified", "coordinate_name_mismatch", "endpoint_adcode_name_conflict", "endpoint_station_name_code_conflict", "endpoint_poi_name_conflict"].includes(plan.search?.reason ?? "")) {
+                return {
+                    status: "awaiting_input", result,
+                    instruction: plan.search?.reason === "station_location_evidence_required"
+                        ? "尚未查票。车站身份明确，但 Smart 缺少必要地理证据；这是系统证据缺口，不要求用户换站。若双锁站仅需直达，可使用 Exact。"
+                        : "尚未查票。受影响端点的名称、归属或坐标尚不能一致确认；只补正该端点的真实信息，保留其余条件，不把此次失败说成无车。",
+                    next: null, recovery: [],
+                };
+            }
             // §7.1 case 3: when scope was only partially verified the honest wording
             // is "N confirmed + X pairs unverified" — never the case-2 phrasing that
             // implies the whole nearby range was checked.
             const partial = counts && (counts.pairs_total ?? 0) > (counts.pairs_checked ?? 0)
-                ? `目前找到${counts.journeys_total ?? 0}个可选组合；还有${(counts.pairs_total ?? 0) - (counts.pairs_checked ?? 0)}个站对/部分中转路径未核验。以下是已确认结果，不能据此断定没有其它走法。`
+                ? `已保存${counts.journeys_total ?? 0}个具体车次时刻组合，其中${counts.journeys_eligible ?? "未知"}条当前满足铁路资格；还有${(counts.pairs_total ?? 0) - (counts.pairs_checked ?? 0)}个站对/部分中转路径未核验。以下是已确认结果，不能据此断定没有其它走法。`
                 : "";
             // §S5: a processing failure with a committed catalog is "saved N
             // verified combinations, later expansion/recommend incomplete" — the
@@ -1539,17 +1731,6 @@ function railPlanningEnvelope(model) {
                 result,
                 instruction: `${modelDegradedHint}${manualExpansion}${transferHint}${failedPairsHint}规划进行中：已提交的卡片可先向用户展示比较；稍后按 next 增量轮询同一执行（since-snapshot 命中时负载会被压缩，但阶段与计数仍返回最新值）。不要重新发起查询。`,
                 next: nextPoll,
-                communication: {
-                    schema_version: "itpay.communication.v1",
-                    status_line: transferSearching && !manualExpansion
-                        ? "直达范围暂未找到可用方案，中转组合仍在搜索"
-                        : "规划进行中，已确认的方案可先向用户展示",
-                    next_expectation: "按 next 增量轮询同一执行；不重新发起查询",
-                    must_convey: [
-                        "当前是进行中的部分结果，不代表最终答复",
-                        ...(failedPairsHint ? ["部分站对尚未查明，不能说'没有车'"] : []),
-                    ],
-                },
                 recovery: [],
             };
         }
@@ -1594,34 +1775,25 @@ function terminalExecutionEnvelope(model) {
         ],
     };
 }
+const RAIL_LOCATION_EVIDENCE_REASONS = new Set(["endpoint_kind_conflict", "place_identity_uncertain", "endpoint_adcode_name_conflict", "endpoint_poi_name_conflict", "endpoint_station_name_code_conflict", "location_evidence_required", "coordinate_name_mismatch", "area_scope_too_broad", "address_required", "administrative_area_unresolved", "station_location_evidence_required", "coordinate_identity_unverified"]);
+const RAIL_QUOTE_FAILURE_GUIDANCE = {
+    quote_source_unavailable: "实时车票数据暂不可用；保留原选择，稍后按用户意愿重新核验，不创建替代订单。",
+    quote_train_changed: "所选车次的时刻或运行信息已变化；向用户说明并征询是否重新查票。",
+    quote_seat_changed: "所选席别已变化；向用户说明并征询新的席别选择。",
+    quote_seat_unavailable: "所选席别当前无足够余票；告知用户并由其决定是否换方案。",
+    quote_refresh_expired: "实时报价过程超时；保留原选择，不把旧价当可付款价格。",
+};
 function servicesNextEnvelope(model) {
     const execution = model.execution;
     const currentDelivery = model.current_delivery ?? model.delivery_bindings.at(-1);
     const lockedRefund = model.refunds.find((refund) => refund.access_locked);
     if (lockedRefund) {
-        const terminal = lockedRefund.status === "succeeded";
-        return {
-            status: "delivery_locked",
-            result: {
-                service_execution_id: execution.service_execution_id,
-                access_locked: true,
-                refund: {
-                    refund_request_id: lockedRefund.refund_request_id,
-                    status: lockedRefund.status,
-                },
-            },
-            instruction: terminal
-                ? "告诉用户退款已由 ItPay 确认成功，原交付永久关闭。Agent 停止读取和跟踪，不再创建授权。"
-                : "告诉用户退款仍在处理，原交付已按政策冻结。然后读取同一退款的权威状态；Agent 不读取交付、不创建授权或重复申请。",
-            next: terminal ? null : {
-                command: `itpay refund get ${lockedRefund.refund_request_id} --json`,
-                reason: "读取退款权威状态",
-            },
-            recovery: [],
-        };
+        const refundState = refundStateEnvelope(lockedRefund, "delivery_locked");
+        return { ...refundState, result: { ...refundState.result, service_execution_id: execution.service_execution_id, refund: { refund_request_id: lockedRefund.refund_request_id, status: lockedRefund.status, ...(lockedRefund.failure_class ? { failure_class: lockedRefund.failure_class } : {}) } },
+            next: refundState.next ? { command: `itpay refund get ${lockedRefund.refund_request_id} --json`, reason: "读取同一退款权威状态" } : null };
     }
     const latestRun = model.execution_requests?.filter((request) => request.execution_kind === "service.execution.run").at(-1);
-    if (latestRun && ["pending", "started"].includes(latestRun.status)) {
+    if (latestRun && ["pending", "started"].includes(latestRun.status) && model.workflow?.status !== "failed") {
         return {
             status: "running",
             result: { service_execution_id: execution.service_execution_id, execution_request_id: latestRun.execution_request_id },
@@ -1633,7 +1805,7 @@ function servicesNextEnvelope(model) {
     // A terminal execution wins over the rail read model: a failed, cancelled,
     // or refunded run must not render as still issuing. Completed executions
     // keep the rail view so issued seats stay visible.
-    if (model.rail_booking && isTerminalServiceExecutionStatus(execution.status) && !["completed", "delivery_completed"].includes(execution.status)) {
+    if (model.rail_booking && model.workflow?.human_action?.context?.quote_recovery !== true && isTerminalServiceExecutionStatus(execution.status) && !["completed", "delivery_completed"].includes(execution.status)) {
         const terminal = terminalExecutionEnvelope(model);
         if (terminal)
             return terminal;
@@ -1653,10 +1825,57 @@ function servicesNextEnvelope(model) {
     }
     if (model.workflow_entry && !["completed", "delivery"].includes(model.workflow?.status ?? "")) {
         const id = execution.service_execution_id;
+        const workflowReason = model.workflow?.failure?.reason_code ?? model.workflow?.error_code;
         const paymentVerified = model.payment_bindings.some((binding) => binding.status === "payment_verified") || model.checkout_bindings.some((binding) => binding.status === "payment_verified");
         const state = model.workflow?.status === "payment" && paymentVerified ? "running" : model.workflow?.status ?? "input_required";
-        if (state === "failed" && ["login_required", "rate_limited"].includes(model.workflow?.error_code ?? "")) {
-            const login = model.workflow?.error_code === "login_required";
+        if (["quota_paused", "failed"].includes(state) && !RAIL_LOCATION_EVIDENCE_REASONS.has(workflowReason ?? "") && (model.workflow?.dependency ||
+            /^amap_/.test(workflowReason ?? ""))) {
+            const dependency = model.workflow?.dependency;
+            const resumable = state === "quota_paused" && dependency?.retryable === true;
+            return {
+                status: "dependency_unavailable",
+                result: { service_execution_id: id, service_id: execution.service_id, reason: workflowReason, failure: model.workflow?.failure, affected_endpoint: model.workflow?.failure?.endpoint ?? dependency?.endpoint, ...(dependency ? { dependency } : {}) },
+                instruction: resumable
+                    ? "地图服务暂时限流。保留原条件及已解析端点；到 retry_at 后执行下一步，继续同一任务，不重新提交地点。"
+                    : "地图服务本轮未完成解析，这是外部依赖故障，不要求用户换地址或自行找坐标。有界尝试已结束；保留原条件及已有结果，交由服务维护方处理该错误。",
+                next: resumable ? { command: `itpay services run ${execution.service_id} --execution ${id} --json`, reason: "等待所示恢复时间后继续同一执行" } : null,
+                recovery: [],
+            };
+        }
+        if (state === "failed" && RAIL_LOCATION_EVIDENCE_REASONS.has(workflowReason ?? "")) {
+            const code = workflowReason;
+            const affected = model.workflow?.failure?.endpoint ?? model.workflow?.dependency?.endpoint;
+            const query = model.workflow?.query_input ?? {};
+            const endpoints = query.endpoints && typeof query.endpoints === "object" ? query.endpoints : {};
+            const stationPair = [endpoints.origin, endpoints.destination].every(endpoint => endpoint?.kind === "station" && typeof endpoint.text === "string" && endpoint.text.trim() && typeof endpoint.station_code === "string" && /^[A-Z]{3}$/.test(endpoint.station_code));
+            if (code === "station_location_evidence_required") {
+                const exactInput = stationPair && typeof query.travel_date === "string" ? { origin: endpoints.origin.text, destination: endpoints.destination.text, travel_date: query.travel_date } : undefined;
+                return { status: "system_evidence_required", result: { service_execution_id: id, service_id: execution.service_id, reason: code, affected_endpoint: affected, failure: model.workflow?.failure, query,
+                        ...(exactInput ? { new_query_template: { command: "itpay services run itpay-rail-exact --input-json <双锁站直达.json> --json", input: exactInput, executable: false, required_input: ["file"], instruction: "当前明确双锁站可核验直达；Exact只覆盖这一站对，仍按原人数、时限和偏好核对结果。" } } : {}) },
+                    instruction: "尚未查票。车站身份已知，但Smart缺车站坐标证据；这是系统证据缺口，不要求用户填技术坐标或换站。" + (exactInput ? "当前双锁站可按完整模板另用Exact核验直达，原需求见query。" : "本路线Smart暂受系统证据限制，当前无可执行恢复；停止并交由维护方补证据。"), next: null, recovery: [] };
+            }
+            if (affected !== "origin" && affected !== "destination")
+                return { status: "input_evidence_required", result: { service_execution_id: id, reason: code, failed_step: model.workflow?.failure?.step_id, failure: model.workflow?.failure, query }, instruction: "地点问题未明确受影响侧，当前无可提交修正模板；保留原需求，停止并核对服务端事实，不猜另一端或坐标。", next: null, recovery: [] };
+            const properties = model.workflow_entry.input_schema.properties;
+            if (!properties?.endpoints && properties?.[affected] === undefined)
+                return { status: "contract_unavailable", result: { service_execution_id: id, reason: code, failed_step: model.workflow?.failure?.step_id, failure: model.workflow?.failure, query }, instruction: "旧查询已终止，当前锁定合同缺少可用地点字段；保留原需求并停止，不猜新旧模板或隐藏字段。", next: null, recovery: [] };
+            const input = { ...Object.fromEntries(Object.entries(query).filter(([key]) => properties?.[key] !== undefined)), ...serviceInputTemplate(model.workflow_entry.input_schema, query) };
+            const identityConflict = ["endpoint_kind_conflict", "endpoint_adcode_name_conflict", "endpoint_poi_name_conflict", "endpoint_station_name_code_conflict", "coordinate_name_mismatch"].includes(code);
+            const replacement = code === "area_scope_too_broad" ? { kind: "area", text: "<受影响端的市县镇完整名称>" } : { ...(endpoints[affected]?.kind ? { kind: endpoints[affected].kind } : {}), text: code === "coordinate_identity_unverified" ? "<已核实与地点身份一致的完整地址或地点名>" : "<已补充行政归属的完整地址或地点名>" };
+            const endpointContract = properties?.endpoints !== undefined && (query.endpoints !== undefined || !properties.origin || !properties.destination);
+            if (endpointContract)
+                input.endpoints = { ...endpoints, [affected]: replacement };
+            else {
+                input[affected] = replacement.text;
+                delete input[`${affected}_location`];
+            }
+            const originalPlace = endpoints[affected]?.text ?? query[affected];
+            return { status: "awaiting_input", result: { service_execution_id: id, service_id: execution.service_id, reason: code, failed_step: model.workflow?.failure?.step_id, classification: "location_evidence_required", affected_endpoint: affected, original_place: originalPlace, ...(model.workflow?.failure?.resolved_scope ? { resolved_scope: model.workflow.failure.resolved_scope } : {}), failure: model.workflow?.failure, query,
+                    new_query_template: { command: `itpay services run ${execution.service_id} --input-json <补全原始需求.json> --json`, input, executable: false, required_input: ["file", endpointContract ? `endpoints.${affected}.text` : affected], ...(endpointContract ? { correction_fields: ["text", "kind", "poi_id", "location"].filter(field => { const side = properties?.endpoints?.properties?.[affected]; return !!side?.properties?.[field]; }) } : {}), instruction: "旧执行输入已锁定；补真实地点后将完整input写入JSON文件，按此命令提交新查询，保留另一端、日期、人数和所有原约束。" } },
+                instruction: `旧执行已终止，尚未查票。${identityConflict ? "名称、类别或位置证据存在冲突；先核实返回原因，不能修改kind绕过。" : "完整地点名称合法，但尚缺唯一身份证据；可先用地图或浏览短查，不要求必填门牌或坐标。"}新证据确定类别且原意未变可纠正kind；改变目的地或扩大范围须先取得真实同意。保留原地点及范围；${affected === "origin" ? "出发端" : "到达端"}原文见original_place。有新证据后只补充${affected === "origin" ? "出发端" : "到达端"}${code === "area_scope_too_broad" ? "的市县镇范围" : code === "coordinate_identity_unverified" ? "的已核实地点身份；已移除未核实坐标，不猜坐标" : "的完整地点和行政归属"}。使用当前完整new_query_template；不能在旧执行伪造修改，也不能直接提交占位符。`, next: null, recovery: [] };
+        }
+        if (state === "failed" && ["login_required", "rate_limited"].includes(workflowReason ?? "")) {
+            const login = workflowReason === "login_required";
             return {
                 status: login ? "login_required" : "rate_limited",
                 result: { service_execution_id: id, service_id: execution.service_id },
@@ -1677,7 +1896,7 @@ function servicesNextEnvelope(model) {
                 recovery: [resume],
             };
         }
-        if (state === "human_action" && model.workflow?.human_action) {
+        if ((state === "human_action" || (state === "failed" && model.workflow?.human_action?.context?.quote_recovery === true)) && model.workflow?.human_action) {
             const action = model.workflow.human_action;
             const requiredFields = requiredInputFields(action.input_schema);
             const rawPlaces = action.context?.places;
@@ -1694,29 +1913,43 @@ function servicesNextEnvelope(model) {
                     return {
                         side,
                         status: place?.resolution_status,
+                        ...(place?.resolution_reason ? { reason: place.resolution_reason } : {}),
                         ...(place?.resolution_status === "resolved"
-                            ? { resolved_place: { name: name(place), location: place.location } }
+                            ? { resolved_place: { name: name(place), address: place.formatted_address, location: place.location } }
                             : {}),
                         ...(candidates.length
-                            ? { candidates: candidates.slice(0, 5).map((item) => ({ name: name(item), location: item.location })) }
+                            ? { candidates: candidates.slice(0, 3).map((item, index) => ({ id: item.id ?? `${side}_${index + 1}`, name: name(item), address: item.formatted_address, type: item.poi_type ?? item.type, location: item.location })) }
                             : {}),
                     };
                 });
                 return {
                     status: "confirmation_required",
-                    result: { service_execution_id: id, service_id: execution.service_id, human_action: action,
-                        required_fields: requiredFields, sides },
-                    instruction: "向用户展示 sides 中 status=needs_confirmation 一端的候选（名称+坐标），请用户选定后按 required_fields 逐项各传一个 --input：名称取候选 name，坐标取候选 location 的 [lng,lat]；已 resolved 的一端把其 resolved_place 原样填入。继续同一执行，不重新查询；这一步不是购买确认。",
+                    result: { service_execution_id: id, service_id: execution.service_id,
+                        human_action: { action_type: action.action_type, input_schema: action.input_schema },
+                        required_fields: requiredFields, sides, query: model.workflow?.query_input,
+                        ...(sides.some(side => side.status !== "resolved" && !side.candidates?.length && ["ADDRESS_REQUIRED", "ADMINISTRATIVE_AREA_UNRESOLVED"].includes(side.reason ?? "")) ? {
+                            new_query_template: { command: `itpay services run ${execution.service_id} --input-json <补全原始需求.json> --json`, executable: false,
+                                input: serviceInputTemplate(model.workflow_entry.input_schema, model.workflow?.query_input ?? {}),
+                                required_input: ["补缺失端点", "保留原始日期人数时限偏好及已确认端点"], instruction: "原执行锁定输入；补全原需求后用新查询，不提交不存在的候选。" },
+                        } : {}) },
+                    instruction: sides.some(side => side.status !== "resolved" && !side.candidates?.length)
+                        ? locationConfirmationEnvelope(id, "", {}, { endpoints: sides.filter(side => side.status !== "resolved") }).instruction
+                        : requiredFields.includes("choices")
+                            ? "尚未查票。仅向用户展示有真实歧义端点的候选编号、名称、行政地址与类型（内部 id 仅用于回填，不展示给人）；用户选定后，把各未解析端点的候选 id 放入 choices 对象，继续同一执行。已解析端点无需再选；不得替用户决定，也不是购买确认。"
+                            : "向用户展示有歧义一端的候选；按 required_fields 填写真实选择，已解析一端保留原值。继续同一执行；这不是购买确认。",
                     next: null,
-                    interaction: {
-                        schema_version: "itpay.interaction.v1",
-                        stage: "location_confirmation_required",
-                        input_template: {
-                            command: `itpay services action ${id} --action ${action.action_type} --actor-type human --status approved${requiredFields.map((field) => ` --input ${field}=<值>`).join("")} --json`,
-                            required_input: requiredFields,
-                            executable: false,
-                        },
-                    },
+                    ...(sides.some(side => side.status !== "resolved" && !side.candidates?.length) ? {} : { interaction: {
+                            schema_version: "itpay.interaction.v1",
+                            stage: "location_confirmation_required",
+                            input_template: {
+                                command: requiredFields.includes("choices")
+                                    ? `itpay services action ${id} --action ${action.action_type} --actor-type human --status approved --input-json <地点确认.json> --json`
+                                    : `itpay services action ${id} --action ${action.action_type} --actor-type human --status approved${requiredFields.map((field) => ` --input ${field}=<值>`).join("")} --json`,
+                                input: { choices: Object.fromEntries(sides.filter(side => side.candidates?.length).map(side => [side.side, "<所选候选id>"])) },
+                                required_input: requiredFields,
+                                executable: false,
+                            },
+                        } }),
                     recovery: [],
                 };
             }
@@ -1731,25 +1964,25 @@ function servicesNextEnvelope(model) {
                     ? review.requirements_remaining
                     : undefined;
                 return {
-                    status: "booking_review_required",
-                    result: { service_execution_id: id, service_id: execution.service_id, human_action: action,
-                        required_fields: requiredFields,
+                    status: state === "failed" ? "quote_recovery_required" : "booking_review_required",
+                    result: { service_execution_id: id, service_id: execution.service_id, review, ...(state === "failed" ? { failure: model.workflow?.failure } : {}),
+                        action_type: action.action_type, required_fields: requiredFields,
                         ...(requirementsRemaining ? { requirements_remaining: requirementsRemaining } : {}) },
                     ...(reviewURL ? { handoff: { url: reviewURL, kind: "booking_review" } } : {}),
-                    instruction: reviewURL
-                        ? "已在 handoff.url 提供官方行程确认页，请用户在该页核对行程、席别与座位偏好并确认；页面打开请求不代表用户已确认。该页失效或用户更愿在对话中确认时，仍可按下述 input_template 一次合并提交。乘客姓名/证件等身份信息不在此提交，仍走受保护 Checkout 页。"
-                        : "向用户展示 context.review 中的行程（legs）与可选席别/座位偏好词表（seat_options），并明确告知：座位偏好仅为请求、不保证分配（对应 notice_version 文案须经用户同意）。这是购买前的合并确认：把乘客人数、席别与每位乘客的座位偏好一次问清，然后按 required_fields 组装完整 JSON 对象，经 --input-json <file> 提交——draft_revision 必须等于服务端当前值，被拒绝（booking_review_changed）时重新读取后重试。未得真实确认不得提交，不能暗设 accept_non_guaranteed。乘客姓名/证件等身份信息不在此提交，仍走受保护 Checkout 页。",
+                    instruction: `${state === "failed" ? `${typeof model.workflow?.failure?.affected_leg === "number" ? `第${model.workflow.failure.affected_leg + 1}段` : ""}报价失败：${RAIL_QUOTE_FAILURE_GUIDANCE[model.workflow?.failure?.reason_code ?? ""] ?? "报价核验未完成。"} 当前无完整报价、无付款入口。按用户意愿有界地重新核验一次同一购买；复制下方当前确认模板，未变条款沿用真实同意，价格/车次/席别/人数/条款变化须确认差异。无票或车次变化时先让用户决定，不能自动换路线。支付尝试后不得修订。 ` : ""}${reviewURL ? "官方确认页见 handoff.url，打开不等于确认；沿用已知人数和席别。" : "当前草稿见 review。"} 对照对话只补缺失选择或真实条款同意；无字母偏好自动分配，不默认问字母。仅代码修正且车次、实际席别、人数、价格及条款不变，沿用已有明确确认；实质变化只核对变化。复制 interaction.input_template.input；自动分配使用该对象数组，不传 null 或字符串。只有用户本人已接受当前条款，才把 accept_non_guaranteed 改为 true；选车或委托选票不等于条款同意，false是未同意保护而非模板错误。缺同意时仅用 review.consent_question 问一次；没有该文案时说明座位/卧铺偏好可能自动分配，并按当前notice补整程条款。已有充分同意且条件不变则不再问。身份信息只在官方 Checkout 页填写。`,
                     next: null,
                     interaction: {
                         schema_version: "itpay.interaction.v1",
                         stage: "booking_review_required",
                         input_template: {
                             command: `itpay services action ${id} --action ${action.action_type} --actor-type human --status approved --input-json <file> --json`,
-                            required_input: requiredFields.length > 0 ? requiredFields : ["file"],
+                            required_input: ["file", ...requiredFields],
+                            input: review.input_template && typeof review.input_template === "object"
+                                ? review.input_template : serviceInputTemplate(action.input_schema ?? {}, review),
                             executable: false,
                         },
                     },
-                    recovery: [{ command: `itpay services next ${id} --json`, reason: "重新读取当前 draft_revision 后重试" }],
+                    recovery: [],
                 };
             }
             return {
@@ -1775,35 +2008,33 @@ function servicesNextEnvelope(model) {
             command = `itpay services checkout ${id} --json`;
         // input_required: the resume command needs a real file path — expose it as
         // a non-executable input_template, not a fake `next.command`.
+        const guidance = railServiceGuidance(execution.service_id, model.workflow_entry?.input_schema);
         const inputTemplate = state === "input_required"
             ? {
                 command: `itpay services run ${execution.service_id} --execution ${id} --input-json <file> --json`,
-                required_input: ["file"],
+                input: serviceInputTemplate(model.workflow_entry?.input_schema ?? {}, Object.keys(model.workflow?.query_input ?? {}).length ? (model.workflow?.query_input ?? {}) : guidance?.input_example ?? {}),
+                required_input: ["file", ...requiredInputFields(model.workflow_entry?.input_schema)],
                 executable: false,
             }
             : undefined;
-        const guidance = railServiceGuidance(execution.service_id);
-        const failedStep = recovery ? failedWorkflowStep(model.workflow?.steps, model.workflow?.error_code) : undefined;
+        if (state === "input_required" && execution.service_id === "itpay-rail-smart" && !guidance) {
+            return { status: "contract_unavailable", result: { service_execution_id: id, service_id: execution.service_id }, instruction: "当前锁定合同缺失；读取一次同执行合同后仍缺失就停止，不猜新旧输入结构。", next: { command: `itpay services get ${id} --json`, reason: "获取锁定合同一次" }, recovery: [] };
+        }
+        const failedStep = recovery ? model.workflow?.failure?.step_id : undefined;
         const failedStepGuidance = failedStep ? WORKFLOW_STEP_GUIDANCE[failedStep] : undefined;
         const failedInvocation = recovery
             ? [...model.provider_invocations].reverse().find((item) => typeof item.status === "string" && item.status.startsWith("failed"))
             : undefined;
         const providerErrorCode = typeof failedInvocation?.error_code === "string" && failedInvocation.error_code ? failedInvocation.error_code : undefined;
-        const quoteFailure = execution.service_id === "itpay-rail-booking" ? {
-            quote_source_unavailable: "实时车票数据暂不可用；保留原选择，稍后按用户意愿重新核验，不创建替代订单。",
-            quote_train_changed: "所选车次的时刻或运行信息已变化；向用户说明并征询是否重新查票。",
-            quote_seat_changed: "所选席别已变化；向用户说明并征询新的席别选择。",
-            quote_seat_unavailable: "所选席别当前无足够余票；告知用户并由其决定是否换方案。",
-            quote_refresh_expired: "实时报价过程超时；保留原选择，不把旧价当可付款价格。",
-        }[providerErrorCode ?? ""] : undefined;
-        const failureCode = providerErrorCode ?? model.workflow?.error_code;
+        const quoteFailure = execution.service_id === "itpay-rail-booking" ? RAIL_QUOTE_FAILURE_GUIDANCE[(model.workflow?.failure?.reason_code === "workflow_failed" ? providerErrorCode : model.workflow?.failure?.reason_code) ?? providerErrorCode ?? ""] : undefined;
+        const failureCode = model.workflow?.failure?.reason_code === "workflow_failed" && providerErrorCode && RAIL_QUOTE_FAILURE_GUIDANCE[providerErrorCode] ? providerErrorCode : model.workflow?.failure?.reason_code ?? providerErrorCode ?? model.workflow?.error_code;
         const failedInstruction = recovery
             ? quoteFailure
-                ? quoteFailure
+                ? `${typeof model.workflow?.failure?.affected_leg === "number" ? `第${model.workflow.failure.affected_leg + 1}段报价失败。` : ""}${quoteFailure} 当前整程未取得完整有效报价，没有付款入口；保留同一购买和未变化的选择，当前没有可提交恢复动作，停止；需要用户决定或系统处理，不能靠反复 get/next 重新报价，不能收取其余段款项或重复创建购买。`
                 : failedStepGuidance
                     ? `执行在「${failedStepGuidance.meaning}」步失败${failureCode ? `（错误码：${failureCode}）` : ""}：${failedStepGuidance.hint}。先核对原因和当前执行状态，不要盲目重放。`
                     : state === "failed"
-                        ? `执行已失败${failureCode ? `（错误码：${failureCode}）` : ""}且不可续用；核对服务端原因、订单与付款事实后再决定下一步。`
+                        ? `执行已失败${failureCode ? `（错误码：${failureCode}）` : ""}且不可续用；${execution.service_id === "itpay-rail-booking" || paymentVerified ? "核对服务端原因、订单与付款事实" : "保留原地点和约束，核对服务端原因；当前没有可执行恢复则停止，不重复读取终态"}后再决定下一步。`
                         : "执行未完成，请按步骤错误处理；不要重建执行或重复调用。"
             : undefined;
         return {
@@ -1811,7 +2042,9 @@ function servicesNextEnvelope(model) {
             result: {
                 service_execution_id: id,
                 service_id: execution.service_id,
-                workflow: model.workflow,
+                workflow_state: state,
+                ...(model.workflow ? { current_step: model.workflow.current_step, workflow_revision: model.workflow.revision } : {}),
+                ...(model.workflow?.failure ? { failure: model.workflow.failure } : {}),
                 ...(state === "input_required" ? { input_schema: model.workflow_entry.input_schema } : {}),
                 ...(guidance && state === "input_required" ? { guidance } : {}),
                 ...(failedStep ? { failed_step: failedStep, ...(failedStepGuidance ? { failed_step_meaning: failedStepGuidance.meaning } : {}) } : {}),
@@ -1824,10 +2057,10 @@ function servicesNextEnvelope(model) {
                     ? (model.workflow?.human_action?.context?.review
                         ? "服务已到付款步骤，可直接 Checkout 付款；如需调整席别/座位偏好，先用 confirm_booking 动作修订（会重新报价并锁定新价），完成后再付款。"
                         : "服务已到付款步骤，使用现有 Checkout 完成扫码付款。")
-                    : guidance
-                        ? "按 result.guidance 的字段契约填写输入后继续同一服务执行；不要臆造字段名。"
+                    : state === "input_required" && guidance
+                        ? RAIL_ENDPOINT_BRIEF + "按 result.guidance 的字段契约填写输入后继续同一服务执行；不要臆造字段名。"
                         : "继续读取同一执行；缺少输入时按服务声明补齐。"),
-            next: recovery ? null : { command, reason: "继续当前流程" },
+            next: recovery || inputTemplate ? null : { command, reason: "继续当前流程" },
             ...(inputTemplate || (state === "payment" && model.workflow?.human_action?.context?.review) ? {
                 interaction: {
                     schema_version: "itpay.interaction.v1",
@@ -1842,7 +2075,7 @@ function servicesNextEnvelope(model) {
                     } : {}),
                 },
             } : {}),
-            recovery: recovery && state === "failed"
+            recovery: recovery && state === "failed" && !["itpay-rail-exact", "itpay-rail-smart"].includes(execution.service_id)
                 ? [{ command: `itpay services get ${id} --json`, reason: "核对本执行的错误、结果和付款事实" }]
                 : [],
         };
@@ -1869,11 +2102,14 @@ function servicesNextEnvelope(model) {
             status: total > 0 ? "result_ready" : "no_result",
             result: { service_execution_id: execution.service_execution_id, scope: "station_pair",
                 resolved_station_pair: container?.resolved_station_pair, total,
-                result_item_id: item.service_capability_result_item_id },
+                result_item_id: item.service_capability_result_item_id,
+                trains: Array.isArray(container?.candidates) ? container.candidates.slice(0, 3).map((value, index) => exactTrainRow(value, execution.service_execution_id, item.service_capability_result_item_id, index)) : [],
+                ...(exactSmartTemplate(container?.resolved_station_pair, execution.service_execution_id, item.service_capability_result_item_id)
+                    ? { smart_template: exactSmartTemplate(container?.resolved_station_pair, execution.service_execution_id, item.service_capability_result_item_id) } : {}) },
             instruction: total > 0
                 ? "直达站对结果已保存。执行 next.command 一次读取紧凑车次行，按用户条件筛选；若只需比较，答复后结束；已有购票委托则读取所选行详情。"
                 : "这一已解析站对返回 0 条；不代表全城无车。若原需求需要更广覆盖，可核验另一可信站对或 Smart。",
-            next: { command: `itpay services read-result ${execution.service_execution_id} --json`, reason: "读取这一已保存站对的完整紧凑结果" },
+            next: { command: `itpay services read-result ${execution.service_execution_id} --json`, reason: "读取这一保存站对的紧凑分页；按返回的续页覆盖所需范围" },
             recovery: [],
         };
     }
@@ -2089,21 +2325,7 @@ function grantedResultEnvelope(response, orderID) {
     };
 }
 function servicesNextPlainResult(result) {
-    const lines = [];
-    for (const [key, value] of Object.entries(result)) {
-        if (key === "items" && Array.isArray(value)) {
-            lines.push("items:");
-            for (const item of value) {
-                lines.push(`  ${item.rank}. ${item.title}`);
-                for (const [field, fieldValue] of Object.entries(item.safe_payload)) {
-                    lines.push(`     ${field}: ${typeof fieldValue === "string" ? fieldValue : JSON.stringify(fieldValue)}`);
-                }
-            }
-            continue;
-        }
-        lines.push(`${key}: ${typeof value === "string" ? value : JSON.stringify(value)}`);
-    }
-    return lines;
+    return plainValueLines(result);
 }
 export async function runServicesEvents(backend, serviceExecutionID, options = {}) {
     const afterSequence = options.afterSequence ?? 0;
@@ -2134,11 +2356,8 @@ export async function runServicesEvents(backend, serviceExecutionID, options = {
             returned_count: events.length,
             events,
         },
-        instruction: "事件仅用于诊断；不要从事件重放业务步骤，回到 services next 获取当前动作。",
-        next: {
-            command: `itpay services next ${serviceExecutionID} --json`,
-            reason: "恢复正常服务流程",
-        },
+        instruction: "这是已保存的诊断事件；事件不代表车票结果，也不授权重放业务步骤。已读完所需诊断时停止；实际任务沿先前返回的当前动作继续。",
+        next: null,
         recovery: events.length === limit && events.length > 0
             ? [{
                     command: `itpay services events ${serviceExecutionID} --after-sequence ${events.at(-1).sequence} --limit ${limit} --json`,
@@ -2214,7 +2433,7 @@ function buildServicesCheckoutEnvelope(response, checkoutURL, plan, agentType, t
             service_execution_id: response.binding.service_execution_id,
             checkout_id: checkout.checkout.checkout_id,
             capability_id: checkoutCapabilityID(response),
-            locked_input: response.locked_input,
+            items: plan.orderItems ?? [],
             amount,
             ...(checkout.checkout.expires_at ? {
                 // The shared server-owned payable deadline D: refreshing the page or
@@ -2331,16 +2550,35 @@ export async function runServicesRun(backend, config, serviceID, input, options
         await runServicesNext(backend, id, options);
     }
     catch (cause) {
+        if (cause instanceof HttpError && cause.code === "capability_input_invalid") {
+            const schema = cause.payload?.input_schema;
+            const executionID = cause.payload?.service_execution_id ?? id;
+            throw new CommandContractError(cause.code, cause.message, "Agent按当前模板自行修正错误字段和JSON层级，保留已有摘要的端点含义及原地点/日期/人数，不重复研究或事后补写冒充查询前摘要；不要向用户询问技术字段。只有真实业务歧义才问人；使用返回的执行身份恢复，未创建时用原服务。", schema ? [] : [{ command: executionID ? `itpay services get ${executionID} --json` : "itpay catalog list --json", reason: "获取当前锁定合同；仍缺合同则停止，不猜旧写法" }], schema ? { schema_version: "itpay.interaction.v1", stage: "input_required", input_template: {
+                    command: `itpay services run ${serviceID}${executionID ? ` --execution ${executionID}` : ""} --input-json <file> --json`,
+                    input: serviceInputTemplate(schema, input), required_input: ["file", ...requiredInputFields(schema)], executable: false,
+                } } : undefined, { service_id: serviceID, ...(executionID ? { service_execution_id: executionID } : {}), execution_created: cause.payload?.execution_created ?? Boolean(executionID), ...(typeof cause.payload?.provider_called === "boolean" ? { provider_called: cause.payload.provider_called } : {}), input_errors: cause.payload?.input_errors ?? [cause.message], ...(schema ? { input_schema: schema } : {}) });
+        }
+        if (cause instanceof HttpError && ["invalid_selection", "selection_wrong_buyer"].includes(cause.code ?? "")) {
+            const reason = cause.payload?.reason;
+            const inputInvalid = reason === "input_constraint_invalid";
+            throw new CommandContractError(cause.code, cause.message, inputInvalid ? "输入违反当前完整计划约束。读取原查询的完整购买模板，修正人数、完整段数和顺序；不要追加未声明字段或拆单。"
+                : cause.code === "selection_wrong_buyer" ? "当前身份无权使用这份购买凭据。停止；不要切换身份绕过，也不展示其他买家资料。"
+                    : reason === "stored_selection_inconsistent" ? "服务端凭据与已存目录不一致，补参数无法修复。停止购买并提供诊断标识 stored_selection_inconsistent；不猜字段、不重新创建购买。"
+                        : "购买凭据未通过校验，原因尚未确定且没有安全自动恢复。停止，不把推测报成原因或追加隐藏字段。", inputInvalid ? [{ command: "itpay services list --json", reason: "定位原查询并读取当前完整购买模板" }, { command: "itpay docs show rail-booking --json", reason: "读取正式输入约束" }] : [], undefined, { service_id: serviceID, ...(id ? { service_execution_id: id } : {}), ...(reason ? { reason } : {}), execution_created: Boolean(id) });
+        }
+        if (cause instanceof HttpError && ["rail_journey_selection_required", "rail_selection_expired"].includes(cause.code ?? "")) {
+            throw new CommandContractError(cause.code, cause.message, "整程必须使用原查询当前完整 ticket plan 的 selections 模板；手填 legs 只兼容单腿。选择过期时说明缺少当前有效凭据，按用户决定取得完整方案，不拆单、不拼腿、不擅自换站或日期。", [{ command: "itpay services list --json", reason: "找回原查询并读取其完整方案模板" }, { command: "itpay docs show rail-booking --json", reason: "读取正式整程输入合同" }], undefined, { service_id: serviceID, ...(id ? { service_execution_id: id } : {}) });
+        }
         if (cause instanceof HttpError && cause.code === "rail_seat_code_invalid" && id) {
             throw new CommandContractError(cause.code, cause.message, "席别必须使用原查询 booking_template.seat_choices 中与名称对应的代码，不能填“二等座”等显示名。用原 selection token 与真实人数修正输入，继续同一booking execution；若只是代码写法修正且车次、席别名称、人数等购买条件未变，沿用用户已给的确认，不再重复询问。", [{ command: `itpay services next ${id} --json`, reason: "读取同一booking当前状态后修正输入" }]);
         }
         if (cause instanceof CommandContractError || cause instanceof HttpError || cause instanceof DeviceLockBusyError || cause instanceof DeviceStateError)
             throw cause;
-        if (cause instanceof HttpTransportError && !id) {
-            throw new CommandContractError("workflow_start_outcome_unknown", cause.message, "创建服务执行时没有收到完整响应。先查询当前身份可见的执行；不要直接重跑并创建替代执行。", [{ command: "itpay services list --json", reason: "查找可能已经创建的服务执行" }]);
+        if (!id) {
+            throw new CommandContractError("workflow_start_outcome_unknown", cause instanceof Error ? cause.message : "service creation outcome unknown", "创建服务执行时没有收到完整响应。先查询当前身份可见的执行；不要直接重跑并创建替代执行。", [{ command: "itpay services list --json", reason: "查找可能已经创建的服务执行" }]);
         }
         if (cause instanceof HttpTransportError)
-            throw cause;
-        throw new CommandContractError("workflow_run_failed", cause instanceof Error ? cause.message : "workflow run failed", "保留当前执行并按错误处理，不要重复创建服务执行。", [{ command: `itpay services run ${serviceID} --execution ${id} --json`, reason: "恢复同一执行" }]);
+            throw new CommandContractError("workflow_outcome_unknown", cause.message, "未收到完整响应；只读同一执行的权威事实，不重放写操作或创建替代执行。", [{ command: `itpay services next ${id} --json`, reason: "核对同一执行" }]);
+        throw new CommandContractError("workflow_run_failed", cause instanceof Error ? cause.message : "workflow run failed", "保留当前执行并按错误处理，不要重复创建服务执行。", [{ command: `itpay services next ${id} --json`, reason: "读取同一执行的当前事实与恢复动作" }]);
     }
 }