agentworkshop 0.8.5 → 0.8.6

package/server/services/workshop/agents/node-bindings.repo.ts

@@ -2,9 +2,10 @@
  * AgentNodeBindingRepo —— Agent ↔ 工业对象绑定持久化(agent-node-bindings.json)。
  *
  * 一个绑定 = 某 Channel 内的 Agent 对某个工业对象的授权:
- *   - kind: 'daq' = 可查询数采; 'recipe' = 可操作配方(参数写入+下发;nodeId 字段存 recipeId);
- *     'dcw' = (已废弃)直写数控节点 —— 新绑定一律拒绝,存量绑定仅保留只读可见性,
- *     写路径在工具层全部收敛到 recipe(权限模型 v2:Agent 不直碰节点,只碰配方)。
+ *   - kind: 'daq' = 可查询数采; 'recipe' = 配方操作权(参数写入+下发+版本;nodeId 字段存 recipeId);
+ *     'dcw' = 点位写授权(2026-10-28 恢复,非直写入口):对活动配方的 trial/apply,
+ *     覆盖集 ⊆ 节点绑定面即放行;直写工具(param_control/dcw_control)仍恒拒,
+ *     写路径 100% 收敛在配方管道(权限模型 v2)。
  *   - mode: 'auto' = 工具调用自动执行; 'manual' = 每次执行需用户批准(可附备注)
  */
 

package/server/services/workshop/agents/node-delegation.ts

@@ -4,8 +4,10 @@
  * 语义:lead 把**自己已绑定**的 DAQ/DCW 节点授权给同 Channel 的 worker:
  *   - 节点必须是 leader 本人已有绑定的节点(权限不可超越授予者,hard rule);
  *   - 目标必须是同 Channel 的启用 worker(不能授给 lead 自己/其他频道成员);
- *   - 绑定逐 (nodeId, kind) 复制 leader 的 kind/tuning;mode 缺省随 leader,
- *     显式传 mode 可覆盖(auto↔manual 均允许 —— mode 只决定是否走 HITL,不放大节点面);
+ *   - 绑定逐 (nodeId, kind) 复制 leader 的 kind/tuning;mode 缺省 **manual**
+ *     (不继承 leader 的 auto);显式 mode=auto 等于摘掉该 worker 的逐次人工审批闸门,
+ *     必须同时携带 confirm:true,并落审计(2026-10-28 审查 B-P1-3:此前委派可无
+ *     confirm/无审计把 manual 抬成 auto,与 REST 面刻意的不变式矛盾);
  *   - 委派产生的绑定带 grantedByAgentId/grantedAt 溯源;撤销时 leader 只能撤
  *     「自己授予的」或「自己也持有的」绑定。
  * 校验全部 fail-closed:任何节点不满足 → 整单拒绝并列出明细,不做部分授予。
@@ -13,6 +15,7 @@
 import { AppError, ErrorCodes } from '../../../utils/errors'
 import { getAgentNodeBindingRepo, type AgentNodeBinding, type AgentNodeBindingMode, type AgentNodeBindingKind } from './node-bindings.repo'
 import { getToolApprovals } from './tool-approvals'
+import { recordOps } from '../ops/ops'
 
 export interface DelegationMember {
   id: string
@@ -27,6 +30,8 @@ export interface DelegationGrantInput {
   nodeIds: string[]
   members: DelegationMember[]
   mode?: AgentNodeBindingMode
+  /** mode=auto 的风险确认(严格 === true;与 REST bindings PATCH 同语义) */
+  confirm?: unknown
 }
 
 export interface DelegationPlanItem {
@@ -73,6 +78,8 @@ export function planDelegation(input: DelegationGrantInput): DelegationPlan {
   const missing: string[] = []
   const grants: DelegationPlanItem[] = []
   const seen = new Set<string>()
+  const repoForExisting = getAgentNodeBindingRepo()
+  const autoWithoutConfirm: string[] = []
   for (const nodeId of nodeIds) {
     if (seen.has(nodeId)) continue
     seen.add(nodeId)
@@ -82,10 +89,20 @@ export function planDelegation(input: DelegationGrantInput): DelegationPlan {
       continue
     }
     for (const h of held) {
+      // mode 缺省 = manual(安全侧)。旧实现 `input.mode ?? h.mode` 会让 lead 的 auto
+      // 静默下放给 worker,且没有 confirm 与审计 —— 委派面成了摘闸门的旁路。
+      const targetMode: AgentNodeBindingMode = input.mode ?? 'manual'
+      const existing = repoForExisting.find(targetAgentId, nodeId, h.kind)
+      if (targetMode === 'auto' && existing?.mode !== 'auto') {
+        if (input.confirm !== true) {
+          autoWithoutConfirm.push(nodeId)
+          continue
+        }
+      }
       grants.push({
         nodeId,
         kind: h.kind,
-        mode: input.mode ?? h.mode,
+        mode: targetMode,
         tuning: h.tuning ? { ...h.tuning } : undefined,
       })
     }
@@ -93,16 +110,44 @@ export function planDelegation(input: DelegationGrantInput): DelegationPlan {
   if (missing.length) {
     throw new AppError(403, 'DELEGATION_NOT_OWNED', `以下节点不在 lead 的绑定面内,拒绝授予(权限不可超越授予者):${missing.join('、')}`)
   }
+  if (autoWithoutConfirm.length) {
+    throw new AppError(400, 'DELEGATION_MODE_CONFIRM_REQUIRED',
+      `授予 auto 模式将摘除 worker 对这些节点的逐次人工审批闸门,需显式风险确认:`
+      + `请在参数中携带 confirm: true(布尔)。涉及节点:${autoWithoutConfirm.join('、')}。`
+      + `未做任何授权变更;如需保留人工审批,请改用 mode=manual(缺省值)。`)
+  }
   return { targetAgentId, grants }
 }
 
 /** 执行授予:按计划逐条落库(已存在的绑定更新 mode/溯源,不重复建行) */
 export function applyDelegation(plan: DelegationPlan, leaderAgentId: string): AgentNodeBinding[] {
   const repo = getAgentNodeBindingRepo()
-  return plan.grants.map((g) => {
+  const out = plan.grants.map((g) => {
     const binding = repo.bind(plan.targetAgentId, g.nodeId, g.kind, g.mode, g.tuning, { grantedByAgentId: leaderAgentId })
     return binding
   })
+  // B-P1-3:auto 授予必须留痕(与 REST bindings PATCH 的 binding.mode 审计同口径)
+  const autoGrants = out.filter(b => b.mode === 'auto')
+  if (autoGrants.length > 0) {
+    recordOps({
+      actor: leaderAgentId,
+      actorName: `lead(${leaderAgentId})`,
+      actorKind: 'agent',
+      action: 'binding.mode',
+      kind: 'system',
+      summary: `委派授予 auto 控制模式:${autoGrants.map(b => `${b.kind}:${b.nodeId}`).join('、')}`,
+      targetKind: 'agent_node_binding',
+      targetId: autoGrants[0]!.id,
+      detail: {
+        targetAgentId: plan.targetAgentId,
+        grantedByAgentId: leaderAgentId,
+        grants: autoGrants.map(b => ({ bindingId: b.id, nodeId: b.nodeId, kind: b.kind, mode: b.mode })),
+        confirm: true,
+        source: 'team_grant_nodes',
+      },
+    })
+  }
+  return out
 }
 
 export interface DelegationRevokeInput {

package/server/services/workshop/agents/tool-approvals.ts

@@ -14,6 +14,7 @@ import { sendHitlNote } from '../runtime/platform-notice'
 import { notifyLineOperators } from '../runtime/line-notify'
 import { getDcwController } from '../dcw/dcw-controller'
 import { recordRecipeOpAnchor } from '../dcw/recipe-op-anchor'
+import { assertRecipeOperation } from './industrial/recipe-gate'
 
 export interface ToolApproval {
   id: string
@@ -312,6 +313,28 @@ class ToolApprovalService {
       }
       catch { /* 配方已删除 → 无参数节点可清理 */ }
     }
+    else if (binding.kind === 'dcw') {
+      // 2026-10-28 节点级写授权:收回点位授权后,在飞的配方审批单按当前覆盖集重新判定 ——
+      // 覆盖失效即按拒收敛(收回即失活)。仍被其余节点绑定/配方绑定完整覆盖的审批保留,
+      // 不做过度撤销。
+      for (const entry of [...this.pending.values()]) {
+        if (entry.approval.agentId !== agentId) continue
+        const nodeRef = entry.approval.nodeId
+        const recipeId = nodeRef.startsWith('recipe:')
+          ? nodeRef.slice('recipe:'.length)
+          : nodeRef.startsWith('recipe-propose:') ? nodeRef.slice('recipe-propose:'.length) : ''
+        if (!recipeId) continue
+        const recipe = getDcwController().listRecipes().find(r => r.id === recipeId)
+        if (!recipe) continue
+        const payload = entry.approval.payload as { op?: string, params?: Array<{ nodeId?: string }> } | undefined
+        const op = payload?.op === 'update' || payload?.op === 'rollback' || payload?.op === 'trial'
+          ? payload.op
+          : 'dispatch'
+        const target = (payload?.params ?? []).map(p => String(p.nodeId ?? '')).filter(Boolean)
+        const gate = assertRecipeOperation(agentId, recipe, op, target.length > 0 ? target : undefined)
+        if (!gate.ok) n += this.cancelPendingFor(agentId, nodeRef)
+      }
+    }
     return n
   }
 

package/server/services/workshop/agents/tool-reference-spec.ts

@@ -42,6 +42,9 @@ export interface ToolVerifySpec {
   nodeLists?: string[]
   /** 深路径节点引用(如 'params[].node_id' / 'packages[].params[].node_id') */
   deepNodeRefs?: string[]
+  /** 深路径节点引用,要求落在**写授权面** W(a)=dcw 绑定节点 ∪ 绑定配方参数节点
+   *  (2026-10-28 节点级写授权:配方 trial/update 的 params[].node_id) */
+  writeNodeRefs?: string[]
   /** 链式引用(dataset_id/job_id/model_id/plan_id/scene_id/binding_id/run_id/recommendation_id) */
   chained?: ToolChainRule[]
   /** 只读工具:节点只要归属可读产线即可引用(与频道绑线只读扩权同口径;写工具不得开启) */

package/server/services/workshop/daq/bus/mqtt.adapter.ts

@@ -35,6 +35,8 @@ export class MqttQueueAdapter implements DaqQueuePort {
   private consumers = new Set<DaqConsumer>()
   published = 0
   received = 0
+  /** topic 与 payload.nodeId 不一致而丢弃的帧数(S13 身份校验) */
+  identityMismatch = 0
   /** 断连窗口未发布计数(仪表可见的队列层丢弃) */
   lostCount = 0
   /** 断连离线缓冲(重连后按原序补发;带上限防内存无限涨) */
@@ -82,6 +84,16 @@ export class MqttQueueAdapter implements DaqQueuePort {
     this.client.on('message', (topic, payload) => {
       try {
         const env = JSON.parse(payload.toString()) as DaqSampleEnvelope
+        // 2026-10-28(S13):topic 的 nodeId 与 payload.nodeId 必须一致 ——
+        // 否则任何能发布到 broker 的进程都能冒充任意节点注入样本。
+        const topicNode = String(topic ?? '').split('/')[2] ?? ''
+        if (topicNode && env.nodeId && topicNode !== env.nodeId) {
+          this.identityMismatch++
+          if (this.identityMismatch <= 5 || this.identityMismatch % 100 === 0) {
+            log.warn(`[daq-mqtt] 丢弃身份不一致帧:topic=${topic} payload.nodeId=${env.nodeId}(累计 ${this.identityMismatch})`)
+          }
+          return
+        }
         this.received++
         for (const fn of this.consumers) fn(env)
       }

package/server/services/workshop/daq/daq-controller/crud.ts

@@ -6,7 +6,7 @@ import { DaqControllerRuntimeControl } from './runtime-control'
 import type { DaqCreateInput, DaqPatchInput } from './types'
 import { AppError, ErrorCodes } from '../../../../utils/errors'
 import { DaqNode } from '../daq-node'
-import { daqKeyFromRef, normalizeDataTransform } from '../../../../../shared/daq-protocol'
+import { daqKeyFromRef, normalizeDataTransform, stripMaskedSecrets } from '../../../../../shared/daq-protocol'
 import { findDaqTemplate } from '../daq-templates'
 import { getDaqHostPorts } from '../host-ports'
 import { requireDriverKind } from '../drivers'
@@ -31,7 +31,7 @@ export abstract class DaqControllerCrud extends DaqControllerRuntimeControl {
       templateRef: input.templateRef,
       name: input.name ?? (tpl ? `${tpl.name} ${String(seq).padStart(2, '0')}` : (input.driver && input.driver !== 'mock' ? `${input.driver.toUpperCase()} 通道` : undefined)),
       driver: input.driver ? requireDriverKind(input.driver) : undefined,
-      driverConfig: input.driverConfig ?? {},
+      driverConfig: stripMaskedSecrets(input.driverConfig ?? {}),
       transform: normalizeDataTransform(input.transform),
       enabled: input.enabled,
       intervalMs: input.intervalMs == null ? null : Math.max(this.minIntervalMs, Math.min(60_000, Math.round(input.intervalMs))),
@@ -61,7 +61,9 @@ export abstract class DaqControllerCrud extends DaqControllerRuntimeControl {
     if (!node) throw Object.assign(new Error(`数采节点不存在: ${id}`), { status: 404 })
     if (patch.name !== undefined) node.name = patch.name
     if (patch.driver !== undefined) node.driver = requireDriverKind(patch.driver)
-    if (patch.driverConfig !== undefined) node.driverConfig = { ...node.driverConfig, ...patch.driverConfig }
+    // P0-2(2026-10-28 审查):GET 投影的 `******` 可能是整包 PATCH 回来的回显,
+    // 入口单点剔除,绝不让掩码覆盖真实凭据(新明文照常写入)。
+    if (patch.driverConfig !== undefined) node.driverConfig = { ...node.driverConfig, ...stripMaskedSecrets(patch.driverConfig) }
     if (patch.transform !== undefined) {
       if (patch.transform.kind === 'linear' && (!Number.isFinite(Number(patch.transform.scale)) || Number(patch.transform.scale) === 0)) {
         throw new AppError(400, ErrorCodes.VALIDATION_ERROR, '标定系数 scale 必须为非零数字(物理值 = scale × PLC值 + offset)')

package/server/services/workshop/daq/daq-controller/ingest.ts

@@ -12,6 +12,7 @@ import { findDaqTemplate } from '../daq-templates'
 import { getDaqHostPorts } from '../host-ports'
 import { getDaqQueue } from '../bus'
 import { tsdbRowOf } from './tsdb-row'
+import type { DaqFrameSample } from '../drivers'
 
 export abstract class DaqControllerIngest extends DaqControllerPush {
   /** 生产面:样本帧入队 */
@@ -20,6 +21,28 @@ export abstract class DaqControllerIngest extends DaqControllerPush {
     this.producedCount++
   }
 
+  /**
+   * 外部推送帧的统一后处理入口(2026-10-28 审查 A-P1-3)。
+   *
+   * 轮询采样 / 被动订阅 / 外部 ingest 三条生产路径必须共用同一 sink 管线:
+   * 模板 processor(thumbnail/deriveMetric/qualityGate)→ 图像落对象存储 → 服务端
+   * 计算 sha256/size。外部调用方只提供原始 blob 或点列,绝不信任其自报指标与指纹;
+   * 否则"完全相同链路"的承诺不成立(缩略图缺失、质量门被绕过、派生指标为空)。
+   */
+  async processExternalFrame(
+    node: DaqNode,
+    raw:
+      | { kind: 'vector', points: number[], metrics?: Record<string, number> }
+      | { kind: 'image', blob: Buffer, mime: string, width?: number, height?: number, metrics?: Record<string, number> },
+    atMs: number,
+  ): Promise<{ frame: NonNullable<DaqSampleEnvelope['frame']> } | null> {
+    // 外部推送未必携带像素尺寸;缺省记 0(未知),不阻断落库与缩略图生成
+    const frame: DaqFrameSample['frame'] = raw.kind === 'image'
+      ? { ...raw, width: raw.width ?? 0, height: raw.height ?? 0 }
+      : raw
+    return this.processFrameSample(node, frame, atMs)
+  }
+
   /** 消费面:样本入网关管线(状态派生已在 runtime 完成)。
    *  allowPublish = 通过该节点 WS 下发节拍门控;入库/遥测回写不受门控(每帧必达)。 */
   /**

package/server/services/workshop/daq/daq-controller/push.ts

@@ -23,6 +23,25 @@ import { log } from './helpers'
 /** 订阅失败后的重试退避(避免 sweep 每 250ms 打一次 broker) */
 const PUSH_RETRY_BACKOFF_MS = 5_000
 
+/** 停线缓存值的最大补种年龄(超过视为无关,等设备新报文) */
+export const RETAINED_SEED_MAX_AGE_MS = 600_000
+
+/**
+ * 停线补种计划(纯函数,便于单测;A-P1-2)。
+ *
+ * retained-only 设备在停线期间只发过一条状态,开跑后需把缓存值补种一次。补种的
+ * **时间戳必须是补种时刻**(now):用缓存到达时刻会被运行时乱序游标判 late 丢弃
+ * (上一批样本已推进游标),而 runSeeded 又已置真 → 整批零数据。
+ */
+export function retainedSeedPlan(
+  bind: { runSeeded: boolean, lastValue: number | null, lastAt: number },
+  now: number,
+): { value: number, atMs: number } | null {
+  if (bind.runSeeded || bind.lastValue == null) return null
+  if (now - bind.lastAt > RETAINED_SEED_MAX_AGE_MS) return null
+  return { value: bind.lastValue, atMs: now }
+}
+
 interface PushBinding {
   stop: () => void | Promise<void>
   /** 订阅参数指纹(节点 topic/host/jsonPath 变更 → 重建订阅) */
@@ -308,13 +327,15 @@ export abstract class DaqControllerPush extends DaqControllerState {
         continue
       }
       // 新批次开跑:把停线期间缓存的最近值补种一次(retained-only 设备整批只有这一条状态;
-      // 时间戳=消息到达时刻,超过 10 分钟的旧值不补,等新报文)
+      // 超过 10 分钟的旧缓存不补,等新报文)
       if (bind.runId !== run.runId) {
         bind.runId = run.runId
         bind.runSeeded = false
       }
-      if (!bind.runSeeded && bind.lastValue != null && (now - bind.lastAt) <= 600_000) {
-        this.publishPushValue(node, bind.lastValue, bind.lastAt || now)
+      if (!bind.runSeeded && bind.lastValue != null && (now - bind.lastAt) <= RETAINED_SEED_MAX_AGE_MS) {
+        // 2026-10-28 审查 A-P1-2:补种时间戳 = 补种时刻(见 retainedSeedPlan 注释)。
+        const seed = retainedSeedPlan(bind, now)
+        if (seed) this.publishPushValue(node, seed.value, seed.atMs)
         bind.runSeeded = true
         if (node.lastError) node.lastError = null
       }

package/server/services/workshop/daq/daq-controller/runtime-control.ts

@@ -10,6 +10,7 @@ import { getObjectStore } from '../objectstore'
 import { getTsdb } from '../storage'
 import { listPluginDrivers } from '../drivers'
 import { startAlarmEscalator } from '../alarm-notify'
+import { AppError } from '../../../../utils/errors'
 
 export abstract class DaqControllerRuntimeControl extends DaqControllerFrames {
   /** 后端能力自描述(meta 用) */
@@ -20,6 +21,11 @@ export abstract class DaqControllerRuntimeControl extends DaqControllerFrames {
   // ---------- 控制器全局 ----------
 
   startAll(): AepDaqControllerState {
+    // S10:后端明确降级时禁止开采(手动 resume 也不能绕过启动屏障)
+    const infra = (globalThis as unknown as { __daqInfraStatus?: () => { degraded: boolean, warning?: string } }).__daqInfraStatus?.()
+    if (infra?.degraded) {
+      throw new AppError(409, 'DAQ_INFRA_DEGRADED', `数采基础设施降级,禁止启动采集:${infra.warning ?? '后端不可用'}。请先修复后端或调用 /api/workshop/daq/infra/reconnect。`)
+    }
     this.running = true
     this.ensureLoop()
     startAlarmEscalator() // S5:升级通知扫描器(懒启动,进程内单例)

package/server/services/workshop/daq/daq-controller/sweep-alarms.ts

@@ -118,6 +118,8 @@ export abstract class DaqControllerSweepAlarms extends DaqControllerIngest {
     const payload = {
       id, nodeId: node.id, nodeName: node.name, metric,
       value, rule, threshold, escalation: 0, createdAt,
+      // S14:告警帧必须带产线归属,否则 scene-events 会当作"线无关"广播给所有 peer
+      lineId: node.lineId || null,
     }
     this.broadcast?.('daq.alarm', payload)
     notifyAlarm(payload)
@@ -143,7 +145,7 @@ export abstract class DaqControllerSweepAlarms extends DaqControllerIngest {
 
   /** alarm 恢复沿:广播恢复(报警保持 open 待人工 ack) */
   protected handleAlarmRecover(node: DaqNode, value: number): void {
-    this.broadcast?.('daq.alarm.changed', { nodeId: node.id, nodeName: node.name, recovered: true, value, at: new Date().toISOString() })
+    this.broadcast?.('daq.alarm.changed', { nodeId: node.id, nodeName: node.name, recovered: true, value, at: new Date().toISOString(), lineId: node.lineId || null })
   }
 
   /** 报警确认(HITL 闭环的人为一步;幂等:已确认返回 false) */

package/server/services/workshop/daq/daq-controller/tsdb-twin.ts

@@ -11,6 +11,7 @@ import { TSDB_WRITE_RETRIES, log } from './helpers'
 import { findDaqTemplate } from '../daq-templates'
 import { getDaqHostPorts } from '../host-ports'
 import { getTsdb } from '../storage'
+import { getDcwNodeRepo } from '../../dcw/dcw-node.repo'
 
 export abstract class DaqControllerTsdbTwin extends DaqControllerSweepAlarms {
   /** 网关消费泵:队列帧按节点分发回其运行时(乱序防御/状态派生/下发门控在 runtime)。
@@ -131,11 +132,30 @@ export abstract class DaqControllerTsdbTwin extends DaqControllerSweepAlarms {
   /** 遥测 WS 推送(1s/设备节流):孪生状态/遥测事件化直推,前端全量轮询降级为断线兜底 */
   protected twinPushAt = new Map<string, number>()
 
+  /** 孪生绑定节点所属产线(唯一时返回;多线/未绑定 → null,保持全局语义) */
+  private twinLineId(twinId: string): string | null {
+    try {
+      const lines = new Set<string>()
+      for (const n of this.repo.all()) {
+        if (n.lineId && (n.deviceIds ?? []).includes(twinId)) lines.add(n.lineId)
+      }
+      for (const n of getDcwNodeRepo().all()) {
+        if (n.lineId && (n.deviceIds ?? []).includes(twinId)) lines.add(n.lineId)
+      }
+      return lines.size === 1 ? [...lines][0]! : null
+    }
+    catch { return null }
+  }
+
   protected pushTwinTelemetry(twinId: string): void {
     const now = Date.now()
     if (now - (this.twinPushAt.get(twinId) ?? 0) < 1000) return
     this.twinPushAt.set(twinId, now)
     const payload = getDaqHostPorts()?.telemetry.scenePayload(twinId)
-    if (payload) this.broadcast?.('device.updated', payload)
+    if (payload) {
+      // S14:补产线归属,让 scene-events 按 peer 可见集过滤;唯一产线才补,多线保持全局
+      const lineId = this.twinLineId(twinId)
+      this.broadcast?.('device.updated', lineId ? { ...(payload as object), lineId } : payload)
+    }
   }
 }

package/server/services/workshop/daq/daq-node.repo.ts

@@ -23,17 +23,20 @@ function load(): { nodes: DaqNode[], migrated: number } {
     let migrated = 0
     const nodes = (parsed as Record<string, unknown>[]).map((r) => {
       const node = DaqNode.fromRow(r)
-      // P0-5 启动迁移:旧命名归一(modbus→modbus-tcp 等);无法归一的未知 kind
-      // 降级 mock 并打标(fail-visible,不砖启动)—— 该节点采样路径显式失败待重配。
+      // P0-5 启动迁移:旧命名归一(modbus→modbus-tcp 等)。
+      // S11(2026-10-28):未知 kind 保留原名并显式标记不可用,**绝不降级 mock** ——
+      // 真实节点被悄悄换成假数据会污染训练/质量链;采样由 resolveDaqDriver 显式失败。
       if (r.driver != null) {
         const m = migrateDriverKind(String(r.driver))
-        if (m.kind !== node.driver) {
+        if (m.unknown) {
+          node.driver = m.kind
+          migrated++
+          node.lastError = `驱动「${String(r.driver)}」未注册 —— 已拒绝采样,请安装对应驱动插件或重新配置节点驱动`
+          log.warn(`[daq] 节点 ${node.id}(${node.name}) 驱动「${String(r.driver)}」未注册,已拒绝采样(不降级 mock)`)
+        }
+        else if (m.kind !== node.driver) {
           node.driver = m.kind
           migrated++
-          if (m.downgraded) {
-            node.lastError = `驱动「${String(r.driver)}」未注册,已降级 mock —— 请重新配置节点驱动后重采`
-            log.warn(`[daq] 节点 ${node.id}(${node.name}) 驱动「${String(r.driver)}」未注册,已降级 mock`)
-          }
         }
       }
       return node

package/server/services/workshop/daq/daq-node.ts

@@ -211,6 +211,8 @@ export class DaqNode {
       value: this.value,
       state: this.state,
       lastAt: this.lastAt,
+      // S11:驱动不可用/采样失败原因必须随快照落盘,否则重启即丢、UI 无从解释
+      lastError: this.lastError,
       createdAt: this.createdAt,
     }
   }

package/server/services/workshop/daq/daq-runtime.ts

@@ -11,6 +11,7 @@
 
 import { applyTransform } from '../../../../shared/daq-protocol'
 import { classifyCommError, type DaqFrameSample } from './drivers'
+import { ingestFutureSkewMs } from './ingest-policy'
 import type { DaqNode } from './daq-node'
 import type { DaqSampleEnvelope } from './bus/queue-port'
 
@@ -45,7 +46,7 @@ export interface DaqRuntimeHost {
 }
 
 /** onSample 结果(网关据此计指标) */
-export type ConsumeVerdict = 'late' | 'ok' | 'unknown-node'
+export type ConsumeVerdict = 'late' | 'future' | 'ok' | 'unknown-node'
 
 export class DaqNodeRuntime {
   /** 采样时点(epoch ms;-Inf = 立即到期) */
@@ -157,6 +158,9 @@ export class DaqNodeRuntime {
   onSample(env: DaqSampleEnvelope): ConsumeVerdict {
     const node = this.node
     const tsMs = Date.parse(env.at)
+    // 2026-10-28(S12):未来时间戳必须拒绝且**不推进游标** —— 否则一条未来样本会把
+    // lastIngestAt 推到未来,之后所有实时样本被判 late 静默丢弃。
+    if (tsMs && tsMs > Date.now() + ingestFutureSkewMs()) return 'future'
     // 乱序防御(broker 多投递者场景):迟到帧直接丢弃
     if (tsMs && tsMs <= this.lastIngestAt) return 'late'
     this.lastIngestAt = tsMs
@@ -165,7 +169,11 @@ export class DaqNodeRuntime {
     // 指标阈值告警在网关 ingestFrame 按模板 metrics 规则边沿判定,这里只做
     // 节点活跃度/展示值更新 + WS 下发节拍门控。
     if (env.frame) {
-      node.state = 'ok'
+      // 2026-10-28 审查 A-P1-1:帧只负责"活性"(offline→ok)。指标阈值告警是跨帧持续态,
+      // 旧代码每帧无条件置 ok,会把 ingestFrame 刚判出的 alarm 立即抹掉,告警面板
+      // (metricStates)与节点态直接矛盾。warn/alarm 的进入与恢复由网关
+      // evaluateMetricAlarms 的边沿语义独占,此处不得改写。
+      if (node.state === 'offline') node.state = 'ok'
       node.touchReading(env.value, env.at)
       const pubMs = Math.max(0, Math.min(PUBLISH_INTERVAL_MAX, node.publishIntervalMs ?? this.host.defaults().publishIntervalMs))
       const now = Date.now()

package/server/services/workshop/daq/drivers/modbus-tcp.ts

@@ -162,14 +162,17 @@ export function decodeRegisters(data: number[], dataType: string, byteOrder: str
     const raw = data[0] ?? 0
     return dataType === 'int16' ? (raw << 16) >> 16 : raw
   }
-  // 字节序约定(寄存器字 w0=[A B], w1=[C D],float32 内存字节序按 4 字节解):
-  //   big = ABCD(w0 高字在前,w0/w1 各自大端) —— Modbus 标准大端,最常用
-  //   little = DCBA(全小端:w1 字节反转在前)
-  //   wordSwap = CDAB(字交换:每字内部仍大端,低字在前)
+  // 字节序约定(值字节 A B C D = MSB..LSB;寄存器字 w0/w1 各按"高字节在前"读):
+  //   big      = ABCD → w0=[A B], w1=[C D] —— Modbus 标准大端,最常用
+  //   wordSwap = CDAB → w0=[C D], w1=[A B](仅交换字序)
+  //   little   = DCBA → w0=[D C], w1=[B A](整 32 位小端:每字字节反转 + 字序反转)
+  // 2026-10-28 审查 P0-1:旧 little 分支实际解出 BADC(与注释 DCBA、写侧 encodeWords
+  // 均不一致),真实 DCBA/CDAB 设备会静默读成 1e-41 量级错值。三序现与
+  // dcw/drivers/shared.ts:encodeWords 严格互逆,并与 UI 目录标签同义。
   const hi = (x: number) => (x >> 8) & 0xFF
   const lo = (x: number) => x & 0xFF
   let b: number[]
-  if (byteOrder === 'little') b = [hi(data[1]!), lo(data[1]!), hi(data[0]!), lo(data[0]!)].reverse()
+  if (byteOrder === 'little') b = [lo(data[1]!), hi(data[1]!), lo(data[0]!), hi(data[0]!)]
   else if (byteOrder === 'wordSwap') b = [hi(data[1]!), lo(data[1]!), hi(data[0]!), lo(data[0]!)]
   else b = [hi(data[0]!), lo(data[0]!), hi(data[1]!), lo(data[1]!)]
   const buf = Buffer.from(b)

package/server/services/workshop/daq/drivers/registry.ts

@@ -85,14 +85,15 @@ export function requireDriverKind(kind: string): DaqDriverKind {
 }
 
 /**
- * 启动迁移:磁盘遗留 kind 别名归一;无法归一的未知 kind 降级 mock 并打标
- * (fail-visible,不砖启动 —— 由 daq-node.repo load() 调用,该节点采样路径显式失败待重配)。
+ * 启动迁移:磁盘遗留 kind 别名归一。
+ * 2026-10-28(S11):未知 kind **不再降级为 mock**(真实节点被悄悄换成假数据是工业高危默认);
+ * 保留原 kind,由 resolveDaqDriver 的 unavailableDaqDriver 显式拒绝采样,等插件注册/人工重配。
  */
-export function migrateDriverKind(kind: string): { kind: DaqDriverKind, downgraded: boolean } {
+export function migrateDriverKind(kind: string): { kind: DaqDriverKind, downgraded: boolean, unknown?: boolean } {
   if (kind === 'modbus') return { kind: 'modbus-tcp', downgraded: false }
   if (kind === 'rtu' || kind === 'modbus-rtu-tcp') return { kind: 'modbus-rtu', downgraded: false }
   if (kind in REGISTRY || pluginRegistry().has(kind)) return { kind: kind as DaqDriverKind, downgraded: false }
-  return { kind: 'mock', downgraded: true }
+  return { kind: kind as DaqDriverKind, downgraded: false, unknown: true }
 }
 
 /**

package/server/services/workshop/daq/infra.ts

@@ -109,6 +109,19 @@ export function daqInfraStatus(): DaqInfraStatus {
   return { ...state().status }
 }
 
+/**
+ * 后端装配失败(S10):端口探测通过但 TSDB/队列/对象存储 init 失败时,
+ * 必须把状态显式置为 degraded —— 否则 30s 自动重连永不触发,采样会写进占位后端。
+ */
+export function markDaqInfraFailure(err: unknown): void {
+  const s = state().status
+  s.degraded = true
+  s.lastCheckAt = new Date().toISOString()
+  s.lastError = err instanceof Error ? err.message : String(err)
+  s.warning = `数采后端初始化失败,已降级并停采:${s.lastError}`
+  log.error('[daq-infra]', s.warning)
+}
+
 /** 运行配置快照(启动插件装配时写入;重连端点复用) */
 export function daqInfraConfig(): DaqInfraConfig {
   return state().cfg

package/server/services/workshop/daq/ingest-policy.ts

@@ -29,11 +29,34 @@ export function isWideBackfillWindow(env: Record<string, string | undefined> = p
   return ingestBackfillWindowMs(env) > WIDE_WINDOW_THRESHOLD_MS
 }
 
-/** 时间点是否在允许窗内 */
+/** 时间点是否在允许窗内(旧口径:双向 ±window;新代码请用 ingestTimeVerdict) */
 export function withinBackfillWindow(atMs: number, now: number, windowMs: number): boolean {
   return Number.isFinite(atMs) && Math.abs(atMs - now) <= windowMs
 }
 
+/** 未来时间戳容忍度(ms):缺省 60s;env AW_DAQ_INGEST_FUTURE_SKEW_MS 可调,钳 0..1h */
+export function ingestFutureSkewMs(env: Record<string, string | undefined> = process.env): number {
+  const raw = Number(env.AW_DAQ_INGEST_FUTURE_SKEW_MS)
+  if (!Number.isFinite(raw) || raw < 0) return 60_000
+  return Math.min(raw, 3600_000)
+}
+
+export type IngestTimeVerdict = 'ok' | 'future' | 'out-of-window'
+
+/**
+ * 时间戳方向判定(2026-10-28 S12):
+ *  - 未来超过 skew → future(必须拒绝;否则单条未来样本会把该节点 lastIngestAt 推到未来,
+ *    之后所有实时样本被判 late 丢弃,最长持续到墙钟追上);
+ *  - 过去超过回填窗 → out-of-window;
+ *  - 其余 ok。
+ */
+export function ingestTimeVerdict(atMs: number, now: number, windowMs: number, skewMs: number): IngestTimeVerdict {
+  if (!Number.isFinite(atMs)) return 'out-of-window'
+  if (atMs > now + skewMs) return 'future'
+  if (now - atMs > windowMs) return 'out-of-window'
+  return 'ok'
+}
+
 /** 推送鉴权模式判定(纯函数便于单测):token 已配置 → 校验头;未配置 → 会话+产线权限 */
 export function ingestAuthMode(input: { configuredToken?: string, providedToken?: string }): 'token' | 'token-mismatch' | 'session' {
   if (input.configuredToken) {

package/server/services/workshop/daq/storage/timescale.adapter.ts

@@ -229,17 +229,56 @@ export class TimescaleAdapter implements TsdbPort {
       return out
     }
     const { rows } = await this.pool.query(
-      `SELECT node_id, ts, value FROM daq_samples WHERE ${whereSql} ORDER BY ts ASC LIMIT $${params.length + 1}`,
+      `SELECT node_id, ts, value, state, ingested_at FROM daq_samples WHERE ${whereSql} ORDER BY ts ASC LIMIT $${params.length + 1}`,
       [...params, limit],
     )
-    for (const r of rows as Array<{ node_id: string, ts: string, value: number }>) {
+    for (const r of rows as Array<{ node_id: string, ts: string, value: number, state: string | null, ingested_at: string | number | null }>) {
       const list = out.get(String(r.node_id)) ?? []
-      list.push({ at: tsToMs(r.ts), value: Number(r.value) })
+      // D-P1-1(2026-10-28 审查):state/ingested_at 与 sqlite 同口径返回;
+      // 否则生产后端上的坏点清洗(cleanPoints)与入库水位判定是静默空操作。
+      list.push({
+        at: tsToMs(r.ts),
+        value: Number(r.value),
+        state: String(r.state ?? 'ok'),
+        ...(r.ingested_at == null ? {} : { ingestedAt: Number(r.ingested_at) }),
+      })
       out.set(String(r.node_id), list)
     }
     return out
   }
 
+  /**
+   * 逐节点 raw 分页(D-P1-1,2026-10-28 审查:此前后端缺 queryTaggedPage,
+   * 训练/导出在 Timescale 上退化为 query() 截断)。
+   * 语义与 sqlite.adapter 完全一致:稳定 ASC、游标严格大于 afterTs、每页限额、
+   * done=false 时 nextCursor = 本页最后 at。
+   */
+  async queryTaggedPage(nodeId: string, q: import('./tsdb-port').TsdbPageQuery = {}): Promise<import('./tsdb-port').TsdbPage> {
+    if (!this.pool) return { nodeId, points: [], nextCursor: null, done: true }
+    const limit = Math.max(1, Math.min(q.limit ?? 5000, 500_000))
+    const from = Math.max(q.fromMs ?? 0, (q.afterTs ?? -1) + 1)
+    const to = q.toMs ?? Date.now()
+    const withState = q.withState !== false
+    const args = [nodeId, new Date(from).toISOString(), new Date(to).toISOString(), limit]
+    const rows = withState
+      ? (await this.pool.query(
+          'SELECT ts, value, state, ingested_at FROM daq_samples WHERE node_id = $1 AND ts >= $2 AND ts <= $3 ORDER BY ts ASC LIMIT $4',
+          args,
+        )).rows
+      : (await this.pool.query(
+          'SELECT ts, value FROM daq_samples WHERE node_id = $1 AND ts >= $2 AND ts <= $3 ORDER BY ts ASC LIMIT $4',
+          args,
+        )).rows
+    const points = (rows as Array<{ ts: string, value: number, state?: string | null, ingested_at?: string | number | null }>).map(r => ({
+      at: tsToMs(r.ts),
+      value: Number(r.value),
+      ...(withState ? { state: String(r.state ?? 'ok') } : {}),
+      ...(r.ingested_at == null ? {} : { ingestedAt: Number(r.ingested_at) }),
+    }))
+    const done = points.length < limit
+    return { nodeId, points, nextCursor: done ? null : points[points.length - 1]?.at ?? null, done }
+  }
+
   async latest(): Promise<Map<string, DaqSampleRow>> {
     const out = new Map<string, DaqSampleRow>()
     if (!this.pool) return out