agentworkshop 0.8.8 → 0.9.0

package/server/services/workshop/aml/ontology-learning.ts

@@ -0,0 +1,143 @@
+/**
+ * 本体学习闭环(科学探索计划 P6,docs/plans/2026-11-02-scientific-exploration-plan.md):
+ *  - backfillInterventionEvidence:干预台账的判定(效应/CI/MDE/欠功效/混杂)回灌 ontology_evidence,
+ *    以 intervention_events.id 为 source_ref(可追溯、幂等:同一干预不重复登记);
+ *  - resolveCouplingFromOntology:供 P5 通道 B 查询"该 actuator→target 有没有耦合路径",
+ *    三值返回:true=有边;false=已发布本体存在但明确无边;null=未发布本体(unknown,不拦)。
+ * 只追加证据,**不改本体版本**(版本变更仍走 draft→approve→publish 人工链)。
+ */
+import { createHash } from 'node:crypto'
+import { getOntologyRepo } from '../ontology/repo'
+import type { InterventionEventRow } from './intervention-ledger'
+
+function hashOf(s: string): string {
+  return createHash('sha256').update(s).digest('hex').slice(0, 32)
+}
+
+/** 干预判定 → 证据等级(观测证据,不是人工断言) */
+function evidenceLevelOf(verdict: string): string {
+  if (verdict === 'identifiable_effect' || verdict === 'no_resolvable_effect') return 'observed'
+  if (verdict === 'underpowered' || verdict === 'confounded') return 'observed_weak'
+  return 'observed_unassessed'
+}
+
+export interface BackfillResult {
+  appended: boolean
+  reason: string
+  evidenceId?: string
+  ontologyId?: string
+}
+
+/**
+ * 回灌一次干预判定到本体证据账本(targetKind=relation,targetKey=`src->dst`)。
+ * 幂等:source_ref = 干预 id,已存在同 sourceRef 的行则跳过。
+ */
+export function backfillInterventionEvidence(event: InterventionEventRow): BackfillResult {
+  if (!event.targetNodeId) return { appended: false, reason: '干预无 targetNodeId(非判读路径),不登记耦合证据' }
+  if (event.verdict === 'pending' || event.verdict === 'unassessed') {
+    return { appended: false, reason: `判定 ${event.verdict} 未收口,不登记证据` }
+  }
+  const repo = getOntologyRepo()
+  const version = repo.latestPublishedForLine(event.lineId)
+  if (!version) return { appended: false, reason: '该产线无已发布本体,证据暂存于干预台账(发布后可按台账回填)' }
+  const targetKey = `${event.nodeId}->${event.targetNodeId}`
+  const existing = repo.listEvidence(version.id, { targetKind: 'relation', targetKey, limit: 500 })
+  if (existing.some(e => e.sourceRef === event.id)) {
+    return { appended: false, reason: '已登记(幂等跳过)', ontologyId: version.id }
+  }
+  const id = `ev-intv-${event.id}`
+  const detail = {
+    interventionId: event.id,
+    verdict: event.verdict,
+    effect: event.effect,
+    ciLow: event.ciLow,
+    ciHigh: event.ciHigh,
+    mde: event.mde,
+    fromValue: event.fromValue,
+    toValue: event.toValue,
+    path: event.path,
+    ts: event.ts,
+    note: event.verdict === 'no_resolvable_effect'
+      ? '窗口充分的负结论:该步幅下无可分辨效应(不是失败)'
+      : event.verdict === 'underpowered'
+        ? '欠功效:当前步幅/窗长不足,不能据此判定有无耦合'
+        : event.verdict === 'confounded'
+          ? '被混杂:档位与时间不可分,不能据此判定有无耦合'
+          : '效应可分辨(CI 不含 0)',
+  }
+  repo.appendEvidence({
+    id,
+    ontologyId: version.id,
+    targetKind: 'relation',
+    targetKey,
+    level: evidenceLevelOf(event.verdict),
+    sourceType: 'intervention',
+    sourceRef: event.id,
+    sourceRefHash: hashOf(JSON.stringify(detail)),
+    detailJson: JSON.stringify(detail),
+    createdBy: event.actor || 'system',
+    createdAt: new Date().toISOString(),
+  })
+  return { appended: true, reason: '已登记', evidenceId: id, ontologyId: version.id }
+}
+
+export interface OntologyCouplingResolution {
+  /** true=存在耦合路径;false=本体明确无路径;null=未声明/无已发布本体 */
+  hasCouplingPath: boolean | null
+  evidence: string[]
+  ontologyId?: string
+  version?: number
+  /** 该耦合的证据支持/否证计数(来自 intervention 回灌) */
+  supportCount: number
+  refuteCount: number
+}
+
+/**
+ * P5 通道 B:查询已发布本体里 control→target 的耦合路径。
+ * 关系匹配:predicate ∈ influences/actuates 且 src/dst 命中(节点 id → 语义绑定 entity_key 兜底)。
+ * 有已发布版本但找不到边 → hasCouplingPath=false(明确断言"无路径",这是可证伪的一等事实)。
+ */
+export function resolveCouplingFromOntology(lineId: string, controlNodeId: string, targetNodeId: string): OntologyCouplingResolution {
+  const repo = getOntologyRepo()
+  const version = repo.latestPublishedForLine(lineId)
+  if (!version) return { hasCouplingPath: null, evidence: [], supportCount: 0, refuteCount: 0 }
+  const keyOf = (kind: 'dcw' | 'daq', nodeId: string): string[] => {
+    const keys = [nodeId]
+    try {
+      for (const b of repo.listBindingsByTarget(kind, nodeId)) if (b.entityKey) keys.push(String(b.entityKey))
+    }
+    catch { /* 绑定表不可读 → 仅按节点 id 匹配 */ }
+    return keys
+  }
+  const srcs = keyOf('dcw', controlNodeId)
+  const dsts = keyOf('daq', targetNodeId)
+  const relations = repo.listRelations(version.id, version.version)
+  // 注意:repo 把 predicate 列映射为关系对象的 kind 字段(不是 predicate)
+  const hits = relations.filter(r => (r.kind === 'influences' || r.kind === 'actuates')
+    && srcs.includes(String(r.srcKey)) && dsts.includes(String(r.dstKey)))
+  const targetKey = `${controlNodeId}->${targetNodeId}`
+  const ledger = repo.listEvidence(version.id, { targetKind: 'relation', targetKey, limit: 500 })
+  const verdictOf = (detailJson: string): string | undefined => {
+    try {
+      return (JSON.parse(detailJson) as { verdict?: string }).verdict
+    }
+    catch {
+      return undefined
+    }
+  }
+  const supportCount = ledger.filter(e => verdictOf(e.detailJson) === 'identifiable_effect').length
+  const refuteCount = ledger.filter(e => verdictOf(e.detailJson) === 'no_resolvable_effect').length
+  const evidence = [
+    ...hits.map(h => `relation ${h.kind}:${h.srcKey}→${h.dstKey}(${h.status})`),
+    ...(supportCount ? [`干预证据支持 ${supportCount} 次(效应可分辨)`] : []),
+    ...(refuteCount ? [`干预证据否证 ${refuteCount} 次(无可分辨效应)`] : []),
+  ]
+  return {
+    hasCouplingPath: hits.length > 0,
+    evidence,
+    ontologyId: version.id,
+    version: version.version,
+    supportCount,
+    refuteCount,
+  }
+}

package/server/services/workshop/aml/twin/cross-check.ts

@@ -0,0 +1,176 @@
+/**
+ * 下发前双通道互审(科学探索计划 P5,docs/plans/2026-11-02-scientific-exploration-plan.md):
+ *  - 通道 A(模型):AML 代理模型对拟下发 Δ 的稳态增益(ARX 用阶跃仿真;无模型 = unknown);
+ *  - 通道 B(本体/机理):已发布本体的 actuator→target 耦合断言(有路径/明确无路径/无声明)。
+ * 三值逻辑,只有**确证冲突**才拦(unknown 不拦 —— 缺证据不是反证):
+ *   A 有效应 & B 明确无路径 → conflict(自动模式拒;人工模式必须写明理由)
+ *   A 无效应 & B 断言有路径   → conflict(同规则)
+ *   UQ 拒收(OOD/覆盖率低)    → require_human(auto 模式下拒)
+ *   可辨识性欠功效/混杂       → allow_with_warning(卡片写明"当前步幅不构成可分辨干预")
+ * 输出科学载荷(审批卡自动填):效应估计/CI/MDE/动作覆盖/证据边/可证伪方式。
+ */
+import { arxStepResponseGain, type ArxArtifactLike, type ActionCoverage } from '../action-coverage'
+
+export interface ModelChannelInput {
+  /** null = 无可用模型/工件不支持 */
+  artifact: ArxArtifactLike | null
+  targetNodeId: string
+  /** UQ/OOD 结论(来自 uq-ood.evaluateEnsemble;无模型时省略) */
+  uq?: { accepted: boolean, rejectCode?: string }
+}
+
+export interface OntologyChannelInput {
+  /** true=存在 actuator→target 耦合路径;false=本体**明确断言无耦合**;null=本体未声明(unknown) */
+  hasCouplingPath: boolean | null
+  /** 支撑边/证据的人类可读摘要(进审批卡) */
+  evidence: string[]
+}
+
+export interface IdentifiabilityInputSummary {
+  verdict: string
+  effect?: number | null
+  ciLow?: number | null
+  ciHigh?: number | null
+  mde?: number | null
+}
+
+export interface ScientificPayload {
+  controlNodeId: string
+  targetNodeId: string
+  proposedDelta: number
+  /** 模型侧预测的稳态变化(物理单位;unknown → null) */
+  modelEffect: number | null
+  modelConverged: boolean
+  ontologyHasCouplingPath: boolean | null
+  identifiabilityVerdict: string | null
+  effectEstimate: number | null
+  ciLow: number | null
+  ciHigh: number | null
+  mde: number | null
+  actionCoverage: Pick<ActionCoverage, 'distinctLevels' | 'collinearityWithTime' | 'monolithicSequence'> | null
+  evidenceEdges: string[]
+  /** 该结论的可证伪方式(机器可读 + 人读) */
+  falsificationMethod: string
+}
+
+export type CrossCheckDecision = 'allow' | 'allow_with_warning' | 'require_human' | 'reject'
+
+export interface CrossCheckResult {
+  decision: CrossCheckDecision
+  conflicts: string[]
+  warnings: string[]
+  payload: ScientificPayload
+}
+
+export interface CrossCheckInput {
+  controlNodeId: string
+  targetNodeId: string
+  proposedDelta: number
+  /** 自动模式下冲突/需人审是否直接拒(auto=true 时 require_human → reject) */
+  auto: boolean
+  model?: ModelChannelInput
+  ontology?: OntologyChannelInput
+  identifiability?: IdentifiabilityInputSummary
+  actionCoverage?: ActionCoverage
+  /** 判定"有效应"的增益下限(物理单位/单位Δ);缺省 1e-9 */
+  minGain?: number
+}
+
+/**
+ * 三值互审判定(纯函数)。冲突判据:
+ *  - 模型通道:converged 且 |gain×Δ| > minGain → 认为模型预测"有效应";
+ *    否则(收敛但增益≈0)→ 预测"无效应";未收敛/无模型 → unknown(不参与冲突)
+ *  - 本体通道:hasCouplingPath true/false/null
+ * 只有 (有效应 & 明确无路径) 或 (无效应 & 明确有路径) 才 conflict。
+ */
+export function evaluateCrossCheck(input: CrossCheckInput): CrossCheckResult {
+  const minGain = input.minGain ?? 1e-9
+  const conflicts: string[] = []
+  const warnings: string[] = []
+
+  let modelEffect: number | null = null
+  let modelConverged = false
+  let modelHasEffect: boolean | null = null
+  if (input.model?.artifact) {
+    const sensitivity = arxStepResponseGain(input.model.artifact, input.controlNodeId)
+    if (sensitivity) {
+      modelConverged = sensitivity.converged
+      if (sensitivity.converged) {
+        const gain = sensitivity.gains[input.model.targetNodeId]
+        if (typeof gain === 'number' && Number.isFinite(gain)) {
+          modelEffect = gain * input.proposedDelta
+          modelHasEffect = Math.abs(gain) > minGain
+        }
+      }
+    }
+  }
+
+  const onto = input.ontology ?? { hasCouplingPath: null, evidence: [] }
+  if (modelHasEffect === true && onto.hasCouplingPath === false) {
+    conflicts.push(`模型预测有效应(Δy≈${modelEffect?.toPrecision(4)})但本体明确断言 ${input.controlNodeId}→${input.targetNodeId} 无耦合路径`)
+  }
+  if (modelHasEffect === false && onto.hasCouplingPath === true) {
+    conflicts.push(`模型预测无可分辨效应但本体断言存在耦合路径(${onto.evidence[0] ?? '无证据摘要'}):模型可能未学到该动作维度,先查 G6 动作覆盖`)
+  }
+  if (input.model?.uq && !input.model.uq.accepted) {
+    warnings.push(`模型 UQ/OOD 未通过(${input.model.uq.rejectCode ?? 'unknown'}):预测不可作为下发依据`)
+    if (input.auto) conflicts.push('UQ/OOD 未通过,自动模式拒绝;请转人工审批或先补充标定')
+  }
+
+  const v = input.identifiability
+  if (v && (v.verdict === 'UNDERPOWERED' || v.verdict === 'CONFOUNDED')) {
+    warnings.push(`可辨识性 ${v.verdict}:当前步幅/窗口不足以分辨效应${v.mde != null ? `(MDE=${v.mde.toPrecision(3)})` : ''};卡片请写明"不构成可分辨干预"`)
+  }
+
+  const coverage = input.actionCoverage
+  const payload: ScientificPayload = {
+    controlNodeId: input.controlNodeId,
+    targetNodeId: input.targetNodeId,
+    proposedDelta: input.proposedDelta,
+    modelEffect,
+    modelConverged,
+    ontologyHasCouplingPath: onto.hasCouplingPath,
+    identifiabilityVerdict: v?.verdict ?? null,
+    effectEstimate: v?.effect ?? null,
+    ciLow: v?.ciLow ?? null,
+    ciHigh: v?.ciHigh ?? null,
+    mde: v?.mde ?? null,
+    actionCoverage: coverage
+      ? { distinctLevels: coverage.distinctLevels, collinearityWithTime: coverage.collinearityWithTime, monolithicSequence: coverage.monolithicSequence }
+      : null,
+    evidenceEdges: onto.evidence,
+    falsificationMethod: buildFalsificationMethod(input, modelHasEffect),
+  }
+
+  let decision: CrossCheckDecision
+  if (conflicts.length > 0) decision = input.auto ? 'reject' : 'require_human'
+  else if (warnings.length > 0) decision = input.auto ? 'require_human' : 'allow_with_warning'
+  else decision = 'allow'
+  if (decision === 'require_human' && input.auto) decision = 'reject'
+
+  return { decision, conflicts, warnings, payload }
+}
+
+/** 可证伪方式:写清楚"什么结果会推翻这次下发" */
+export function buildFalsificationMethod(input: CrossCheckInput, modelHasEffect: boolean | null): string {
+  const delta = input.proposedDelta
+  const parts = [
+    `若响应窗(≥3 个主导扰动周期)内 ${input.targetNodeId} 的变化量在 95% CI 内不含 0 且方向与模型预测(${modelHasEffect === true ? '有' : modelHasEffect === false ? '无' : '未知'}效应)不一致,则本次因果断言被否证`,
+    `比较基准 = 干预前同长窗口;置信区间用 bootstrap(种子固定可复现)`,
+    `Δ控制=${delta} 的效应若小于 MDE,结论只能记为"不可辨识",不得外推`,
+  ]
+  if (input.ontology?.hasCouplingPath === false) parts.push('本体无耦合断言与实测有效应冲突时,以实测为准并回灌本体证据(需人工确认版本)')
+  return parts.join(';')
+}
+
+/** 审批卡人读段落(与 payload 同源;detail 文本 + 结构化载荷双通道) */
+export function scientificPayloadLines(payload: ScientificPayload): string[] {
+  const fmt = (x: number | null): string => (x != null && Number.isFinite(x) ? x.toPrecision(4) : '—')
+  return [
+    `[科学依据] 模型预测:${payload.modelEffect == null ? '无可用模型(unknown)' : `Δy≈${fmt(payload.modelEffect)}${payload.modelConverged ? '' : '(未收敛)'}`}`,
+    `[科学依据] 本体耦合:${payload.ontologyHasCouplingPath == null ? '未声明' : payload.ontologyHasCouplingPath ? `存在路径(${payload.evidenceEdges.slice(0, 2).join(' / ') || '无证据摘要'})` : '明确无耦合路径'}`,
+    `[科学依据] 可辨识性:${payload.identifiabilityVerdict ?? '未评估'}${payload.mde != null ? `;MDE=${fmt(payload.mde)}` : ''}${payload.effectEstimate != null ? `;上次效应 ${fmt(payload.effectEstimate)} CI[${fmt(payload.ciLow)}, ${fmt(payload.ciHigh)}]` : ''}`,
+    payload.actionCoverage ? `[科学依据] 动作覆盖:水平 ${payload.actionCoverage.distinctLevels} 个,时间共线 |r|=${payload.actionCoverage.collinearityWithTime.toFixed(3)}${payload.actionCoverage.monolithicSequence ? '(纯阶梯,与时间不可分)' : ''}` : null,
+    `[可证伪] ${payload.falsificationMethod}`,
+  ].filter((x): x is string => x != null)
+}

package/server/services/workshop/daq/daq-controller/contracts.ts

@@ -6,6 +6,7 @@
  *
  * 契约成员:
  *   drainFrames  → 由 frames.ts 实现
+ *   daqPushRearm  → 由 push.ts 实现(R-2:driverConfig 变更清退避+重建订阅)
  *   emitController  → 由 views.ts 实现
  *   emitNodeChanged  → 由 views.ts 实现
  *   evictFrames  → 由 frames.ts 实现
@@ -25,6 +26,8 @@ import type { DaqNode } from '../daq-node'
 
 export abstract class DaqControllerContracts {
   protected abstract drainFrames(): DaqFrameRow[]
+  /** R-2:driverConfig 变更后调用 —— 清该节点推送重试退避并立即对账订阅(对齐轮询路径 rearm 语义) */
+  protected abstract daqPushRearm(nodeId: string): void
   protected abstract emitController(): void
   protected abstract emitNodeChanged(op: AepDaqNodeChange['op'], node: DaqNode | null): void
   protected abstract evictFrames(keepLast: number): number

package/server/services/workshop/daq/daq-controller/crud.ts

@@ -63,7 +63,11 @@ export abstract class DaqControllerCrud extends DaqControllerRuntimeControl {
     if (patch.driver !== undefined) node.driver = requireDriverKind(patch.driver)
     // P0-2(2026-10-28 审查):GET 投影的 `******` 可能是整包 PATCH 回来的回显,
     // 入口单点剔除,绝不让掩码覆盖真实凭据(新明文照常写入)。
-    if (patch.driverConfig !== undefined) node.driverConfig = { ...node.driverConfig, ...stripMaskedSecrets(patch.driverConfig) }
+    let driverConfigChanged = false
+    if (patch.driverConfig !== undefined) {
+      node.driverConfig = { ...node.driverConfig, ...stripMaskedSecrets(patch.driverConfig) }
+      driverConfigChanged = true
+    }
     if (patch.transform !== undefined) {
       if (patch.transform.kind === 'linear' && (!Number.isFinite(Number(patch.transform.scale)) || Number(patch.transform.scale) === 0)) {
         throw new AppError(400, ErrorCodes.VALIDATION_ERROR, '标定系数 scale 必须为非零数字(物理值 = scale × PLC值 + offset)')
@@ -95,7 +99,13 @@ export abstract class DaqControllerCrud extends DaqControllerRuntimeControl {
       rearm = true
     }
     if (rearm) this.runtimes.get(id)?.rearm() // 元数据变更即刻生效(独立运行时节拍重置)
-    if (patch.posX !== undefined) node.posX = patch.posX
+    // R-2(2026-11-01):driverConfig 变更与轮询路径 rearm 对齐 —— 清推送订阅重试
+    // 退避并即刻对账订阅。旧行为:退避(map 值)跨 driverConfig 变更存续,broker
+    // 长时间死亡后修好配置仍要等满退避窗(实测"Mqtt 拒连后修配置必须重建节点");
+    // 现在改配置 = 立即放弃旧退避,下一拍 syncPushBindings 按新指纹重建订阅;
+    // 同时驱逐该 broker 的死连接(池条目在 broker 长期死亡后可能处于僵尸态,
+    // mqtt.js 重连循环不再推进 —— 驱逐让下一次订阅全新建连)。
+    if (driverConfigChanged) this.daqPushRearm(id)
     if (patch.posZ !== undefined) node.posZ = patch.posZ
     if (patch.lineId !== undefined) {
       const lid = String(patch.lineId)

package/server/services/workshop/daq/daq-controller/push.ts

@@ -196,6 +196,28 @@ export abstract class DaqControllerPush extends DaqControllerState {
     catch { /* 已停 */ }
   }
 
+  /** R-2(2026-11-01):driverConfig 变更 → 清退避 + 回收订阅,下一拍按新指纹重建。
+   *  与轮询路径 PATCH→rearm 语义对齐:改配置 = 立即放弃旧退避,绝不"修好配置还要
+   *  等满退避窗"(实测 broker 长期死亡后修正 endpoint,热修被迫重建节点)。 */
+  protected daqPushRearm(nodeId: string): void {
+    this.pushRetryAt.delete(nodeId)
+    void this.stopPushBinding(nodeId)
+    // 死连接驱逐:broker 长期死亡后池内条目可能处于僵尸态(mqtt.js 重连循环不再推进
+    // 且永不自愈,实测"重建节点才恢复"的真实根因)。这里按节点当前 broker 键驱逐,
+    // 下一次订阅(本拍 syncPushBindings)全新建连,彻底摆脱僵尸条目。
+    try {
+      const node = this.repo.byId(nodeId)
+      const drv = node ? resolveDaqDriver(node.driver) : null
+      if (node && drv && typeof drv.evictPoolConn === 'function') drv.evictPoolConn(node.driverConfig ?? {})
+    }
+    catch { /* 驱逐失败不阻断对账:退避已清,退避窗后自然重试 */ }
+    // 立即对账一次(不等 250ms 扫描):改配置即刻生效的最后一环。
+    try {
+      this.syncPushBindings()
+    }
+    catch { /* 对账异常由 sweep 的 guardStep 兜底 */ }
+  }
+
   /** 停止全部订阅(网关停止/进程退出) */
   async stopAllPushBindings(): Promise<void> {
     const ids = [...this.pushBindings.keys()]

package/server/services/workshop/daq/drivers/mqtt.ts

@@ -128,6 +128,29 @@ function brokerUrl(cfg: Record<string, unknown>): string {
   return `mqtt${secure ? 's' : ''}://${String(cfg.host)}:${Number(cfg.port ?? 1883)}`
 }
 
+/** R-2(2026-11-01):按配置驱逐池内连接(尽力而为)。
+ *  broker 长期死亡后,池内条目可能处于僵尸态:mqtt.js 重连循环不再推进、connected 恒
+ *  false、节点侧每次订阅快速失败 —— 此前唯一的恢复手段是重建节点(整条订阅随新节点
+ *  全新建连)。这里主动 end(true) 并从池移除,下一次订阅全新建连,热修 endpoint 即刻生效。
+ *  仅驱逐"当前未连接"的条目:连接健康的条目绝不碰(不影响其他共享该 broker 的节点)。 */
+export function evictMqttPoolConn(cfg: Record<string, unknown>): boolean {
+  try {
+    const key = safeMqttKey(cfg)
+    const conn = mqttPool.get(key)
+    if (!conn) return false
+    if (conn.connected) return false // 健康连接不驱逐
+    mqttPool.delete(key)
+    try {
+      conn.client.end(true)
+    }
+    catch { /* 已死 */ }
+    return true
+  }
+  catch {
+    return false
+  }
+}
+
 /** 订阅单 topic(SUBACK 等待;5s 超时;重连时由 connect 事件重放) */
 async function subscribeTopic(conn: MqttConn, topic: string, qos: number): Promise<void> {
   await new Promise<void>((resolve, reject) => {
@@ -457,6 +480,11 @@ export const mqttDaqDriver: DaqDriver = {
     return `${safeMqttKey(c)}|topic=${String(c.topic ?? '')}|qos=${Number(c.qos ?? 1)}|${decode}`
   },
 
+  /** R-2:驱逐未连接的僵尸池条目(健康连接绝不碰);修复配置后下次订阅全新建连 */
+  evictPoolConn(driverConfig) {
+    return evictMqttPoolConn(driverConfig)
+  },
+
   async sample({ driverConfig, signalKind, ctx }) {
     const topic = String(driverConfig.topic ?? '')
     if (!topic) throw new Error('缺少主题 topic')

package/server/services/workshop/daq/drivers/shared.ts

@@ -89,4 +89,10 @@ export interface DaqDriver {
    * 避免改密码/换主题后仍挂在旧连接上。缺省由控制器按常见字段拼一个保守指纹。
    */
   fingerprint?(driverConfig: Record<string, unknown>): string
+  /**
+   * 可选:按 driverConfig 驱逐池内死连接(R-2)。控制器在 driverConfig 变更后调用,
+   * 让"broker 长期死亡后修好配置"立即全新建连,不必重建节点。实现应只驱逐未连接的
+   * 僵尸条目(健康连接绝不碰),无池化驱动的实现可不提供。
+   */
+  evictPoolConn?(driverConfig: Record<string, unknown>): boolean
 }

package/server/services/workshop/db/database/open.ts

@@ -88,6 +88,8 @@ export function initWorkshopDb(db: DatabaseSync): void {
   migrateAgentTokenGraceColumns(db)
   // v33(2026-10-28):频道执行模式列(observe/manual/auto;NULL 按 auto 中性生效,零行为变化)
   migrateChannelExecutionModeColumn(db)
+  // P3-4(2026-11-01):steer 失败重投上限 —— messages.attempts 列(重投 +1,≥3 → dead)
+  migrateAddColumn(db, 'messages', 'attempts', 'INTEGER NOT NULL DEFAULT 0')
   // v32(ONT):Profile 冻结本体引用摘要(缺省 [] = 无本体约束域;只前滚,不回填)
   migrateAddColumn(db, 'optimizer_profiles', 'ontology_refs_json', 'TEXT NOT NULL DEFAULT \'[]\'')
   seedDefaultWorkshopData(db)

package/server/services/workshop/db/database/rows.ts

@@ -289,7 +289,10 @@ export interface MessageRow {
   role: string
   partsJson: string
   metadataJson: string
-  state: 'pending' | 'consuming' | 'consumed'
+  /** P3-4:'dead' = 重投次数达上限(3),永不再投递(审计可见) */
+  state: 'pending' | 'consuming' | 'consumed' | 'dead'
+  /** P3-4:steer 失败重投计数(requeue 时 +1) */
+  attempts: number
   createdAt: string
   consumedAt: string | null
 }

package/server/services/workshop/db/database/schema.ts

@@ -53,7 +53,8 @@ CREATE TABLE IF NOT EXISTS messages (
   role          TEXT NOT NULL,                -- 'ROLE_USER' | 'ROLE_AGENT'
   parts_json    TEXT NOT NULL,
   metadata_json TEXT NOT NULL DEFAULT '{}',   -- x-aw-target-agent / x-aw-task-kind
-  state         TEXT NOT NULL DEFAULT 'pending',  -- pending|consuming|consumed
+  state         TEXT NOT NULL DEFAULT 'pending',  -- pending|consuming|consumed|dead(P3-4:重投达上限)
+  attempts      INTEGER NOT NULL DEFAULT 0,       -- P3-4:steer 失败重投计数(requeue +1)
   created_at    TEXT NOT NULL,
   consumed_at   TEXT
 );
@@ -1183,7 +1184,42 @@ CREATE TABLE IF NOT EXISTS ontology_rule_traces (
   row_hash         TEXT NOT NULL DEFAULT '',
   created_at       TEXT NOT NULL
 );
-CREATE INDEX IF NOT EXISTS idx_ontology_traces_version ON ontology_rule_traces(ontology_id, version, created_at DESC);`
+CREATE INDEX IF NOT EXISTS idx_ontology_traces_version ON ontology_rule_traces(ontology_id, version, created_at DESC);
+
+-- v34(科学探索计划 P2,2026-11-02):干预台账 —— 所有治理下发(manual/agent/recipe/rollback)
+-- 在 dcw write() 唯一咽喉单点入册,一行一次真实下发;verdict 由 aml/identifiability 引擎回填。
+-- 拒绝路径沿 recordOps 审计(dcw.write.rejected),不入本表(只记已受理下发)。
+CREATE TABLE IF NOT EXISTS intervention_events (
+  id               TEXT PRIMARY KEY,
+  ts               TEXT NOT NULL,                   -- 下发受理时刻(ISO)
+  line_id          TEXT NOT NULL DEFAULT '',
+  node_id          TEXT NOT NULL,
+  node_name        TEXT NOT NULL DEFAULT '',
+  from_value       REAL,
+  to_value         REAL,
+  actual_value     REAL,                            -- 回读证实值(readback-verified 时)
+  ack              TEXT NOT NULL DEFAULT '',        -- readback-verified|transport-ack|unverified
+  path             TEXT NOT NULL DEFAULT '',        -- manual|agent|recipe|rollback
+  actor            TEXT NOT NULL DEFAULT '',
+  actor_name       TEXT NOT NULL DEFAULT '',
+  channel_id       TEXT NOT NULL DEFAULT '',
+  approval_id      TEXT,
+  recipe_run_id    TEXT,
+  hypothesis       TEXT NOT NULL DEFAULT '',
+  target_node_id   TEXT,                            -- 判读目标(带判读上下文的路径写入)
+  criterion_json   TEXT,                            -- {metric, op, threshold, mde} 机器可读判据
+  settle_ms        INTEGER,                         -- 判读窗长
+  verdict          TEXT NOT NULL DEFAULT 'pending', -- pending|unassessed|identifiable_effect|no_resolvable_effect|underpowered|confounded
+  effect           REAL,
+  ci_low           REAL,
+  ci_high          REAL,
+  mde              REAL,
+  verdict_json     TEXT,
+  created_at       TEXT NOT NULL,
+  updated_at       TEXT NOT NULL
+);
+CREATE INDEX IF NOT EXISTS idx_intervention_events_node ON intervention_events(node_id, ts DESC);
+CREATE INDEX IF NOT EXISTS idx_intervention_events_line ON intervention_events(line_id, ts DESC);`
 
 // ===== 默认种子数据(首轮初始化注入;owner NULL = 公共资源,所有登录用户只读共享) =====
 

package/server/services/workshop/db/message.repo.ts

@@ -7,7 +7,7 @@ import type { DatabaseSync } from 'node:sqlite'
 import type { MessageRow } from './database'
 
 const COLS
-  = 'id, channel_id AS channelId, task_id AS taskId, from_agent_id AS fromAgentId, to_agent_id AS toAgentId, role, parts_json AS partsJson, metadata_json AS metadataJson, state, created_at AS createdAt, consumed_at AS consumedAt'
+  = 'id, channel_id AS channelId, task_id AS taskId, from_agent_id AS fromAgentId, to_agent_id AS toAgentId, role, parts_json AS partsJson, metadata_json AS metadataJson, state, attempts, created_at AS createdAt, consumed_at AS consumedAt'
 
 export interface MessageCreateInput {
   /** 落库 id;缺省生成。A2A 入队时传发送方 messageId,保证 API 返回 id 与历史 id 一致 */
@@ -43,10 +43,16 @@ export function createMessageRepo(db: DatabaseSync) {
     `UPDATE messages SET state = 'consumed', consumed_at = ? WHERE id = ?`,
   )
   const resetConsumingStmt = db.prepare(
-    `UPDATE messages SET state = 'pending' WHERE state = 'consuming'`,
+    // P3-4:崩溃恢复重投不复活 dead(重投上限是持久判定,重启不洗白)
+    `UPDATE messages SET state = 'pending' WHERE state = 'consuming' AND attempts < 3`,
   )
   const requeueStmt = db.prepare(
-    `UPDATE messages SET state = 'pending' WHERE id = ? AND state = 'consuming'`,
+    // P3-4(2026-11-01):重投计数上限 —— attempts+1,达 3 次不再回 pending(→ dead)。
+    // steer 对忙碌 Agent 的重投之前无上限:坏消息(解析必炸/超长)会在
+    // "认领→steer 失败→回 pending"里无限循环,每 250ms 吃掉一个调度拍。
+    `UPDATE messages SET attempts = attempts + 1,
+       state = CASE WHEN attempts + 1 >= 3 THEN 'dead' ELSE 'pending' END
+     WHERE id = ? AND state = 'consuming'`,
   )
   const consumePendingByTaskStmt = db.prepare(
     `UPDATE messages SET state = 'consumed', consumed_at = ? WHERE task_id = ? AND state = 'pending'`,
@@ -78,6 +84,7 @@ export function createMessageRepo(db: DatabaseSync) {
         partsJson: JSON.stringify(input.parts),
         metadataJson: JSON.stringify(input.metadata ?? {}),
         state: 'pending',
+        attempts: 0,
         createdAt: now,
         consumedAt: null,
       }

package/server/services/workshop/dcw/dcw-controller/write-audit.ts

@@ -9,6 +9,7 @@ import { emitDcwWrite } from '@/server/services/workshop/plugins/host.mjs'
 import { getActiveLineRun } from '../line-run'
 import { opsActorKindOf } from './helpers'
 import { recordOps } from '../../ops/ops'
+import { recordIntervention } from '../../aml/intervention-ledger'
 
 /** 同节点写入去重节流表(eng+10s 窗内视为同一次下发的重试回执) */
 export const opsWriteMemo = new Map<string, { eng: number, at: number }>()
@@ -18,7 +19,7 @@ export function recordDcwWriteOps(args: {
   node: { name: string, unit?: string, lineId: string }
   eng: number
   prevValue: number | null
-  outcome: { ok: boolean, message: string }
+  outcome: { ok: boolean, message: string, ack?: string, readback?: number | null }
   src: DcwWriteSource
   meta?: DcwWriteMeta
   recipeRunId: string | null
@@ -46,4 +47,23 @@ export function recordDcwWriteOps(args: {
   })
   // 插件钩子:写控 ACK 观察(与运维入册同点同去重节流)
   emitDcwWrite({ nodeId: args.id, name: args.node.name, eng: args.eng, prevValue: args.prevValue, ok: args.outcome.ok, source: args.src, lineId: args.node.lineId ?? '', at: new Date().toISOString() })
+  // v34 干预台账(科学探索计划 P2):全路径单点入册(与运维日志同点同去重节流)。
+  // 只记已受理下发;拒绝路径沿上方 recordOps 的 dcw.write.rejected 审计,不入台账。
+  // recordIntervention 内部自吞异常(台账失败绝不改变写结果语义)。
+  recordIntervention({
+    nodeId: args.id,
+    nodeName: args.node.name,
+    lineId: args.node.lineId ?? '',
+    fromValue: args.prevValue,
+    toValue: args.eng,
+    actualValue: args.outcome.readback != null && Number.isFinite(Number(args.outcome.readback)) ? Number(args.outcome.readback) : null,
+    ack: args.outcome.ack ?? '',
+    path: args.src,
+    actor: args.meta?.actor ?? 'user',
+    actorName: args.meta?.actorName ?? '',
+    channelId: args.meta?.channelId ?? '',
+    approvalId: args.meta?.approvalId ?? null,
+    recipeRunId: args.recipeRunId,
+    hypothesis: args.meta?.hypothesis ?? '',
+  })
 }