e10-ebuilder-prototype 0.5.5 → 0.5.7

package/dist/host-ledger.d.ts

@@ -0,0 +1,23 @@
+import type { Store } from './store.js';
+import type { TaskState } from './model.js';
+type Worker = {
+    taskId: string;
+    token: string;
+    kind: 'page' | 'form';
+    pageId: string;
+    startedAt: string;
+    nativeName?: string;
+    outcome?: string;
+    endedAt?: string;
+};
+type Ledger = {
+    schema: 1;
+    workers: Worker[];
+};
+export declare function readHostLedger(store: Store): Promise<Ledger | undefined>;
+export declare function parseHostEvents(raw: string): any[];
+/** Called only under the existing coordinator lock. A missing event never means exit. */
+export declare function updateHostLedger(store: Store, state: TaskState, events: any[]): Promise<Ledger>;
+export declare function activeHostWorkers(store: Store): Promise<Worker[] | undefined>;
+export declare function parseHostActiveTokens(value: string): string[];
+export {};

package/dist/host-ledger.js

@@ -0,0 +1,183 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { atomicJson, CaptureError } from './common.js';
+const filename = (store) => path.join(store.meta, 'host-workers.json');
+const identity = (v) => typeof v === 'string' && /^[a-zA-Z0-9_-]{1,128}$/.test(v);
+const nativeName = (v) => typeof v === 'string' &&
+    v.length <= 256 &&
+    /^(?:e10-[a-f0-9-]{36}(?:-[0-9]+)?|(?:页面|表单)-[\p{L}\p{N}_-]+)$/u.test(v);
+export async function readHostLedger(store) {
+    let value;
+    try {
+        value = JSON.parse(await fs.readFile(filename(store), 'utf8'));
+    }
+    catch (e) {
+        if (e.code === 'ENOENT')
+            return;
+        throw new CaptureError('HOST_LEDGER_INVALID', '后台任务登记文件损坏，不能按空列表释放名额');
+    }
+    if (value?.schema !== 1 ||
+        !Array.isArray(value.workers) ||
+        value.workers.some((w) => !identity(w.taskId) ||
+            !identity(w.token) ||
+            !['page', 'form'].includes(w.kind) ||
+            typeof w.pageId !== 'string' ||
+            !Number.isFinite(Date.parse(w.startedAt)) ||
+            (w.endedAt !== undefined &&
+                (!Number.isFinite(Date.parse(w.endedAt)) ||
+                    !['completed', 'failed', 'cancelled'].includes(w.outcome)))) ||
+        new Set(value.workers.map((w) => w.taskId)).size !== value.workers.length ||
+        new Set(value.workers.map((w) => w.token)).size !== value.workers.length)
+        throw new CaptureError('HOST_LEDGER_INVALID', '后台任务登记无效，不能释放名额');
+    return value;
+}
+export function parseHostEvents(raw) {
+    let events;
+    try {
+        events = JSON.parse(raw);
+    }
+    catch {
+        throw new CaptureError('ARGUMENT_INVALID', '--host-events 需要 JSON 数组');
+    }
+    if (Array.isArray(events))
+        events = events.map((event) => {
+            if (event?.event !== 'started' || event.receipt === undefined)
+                return event;
+            // Copy the native spawn response intact. Never pair parallel responses by order.
+            const receipt = event.receipt;
+            const names = typeof receipt === 'string' ? [...receipt.matchAll(/^name: ([^\r\n]+)\r?$/gm)] : [];
+            const ids = typeof receipt === 'string'
+                ? [...receipt.matchAll(/^task_id: ([a-zA-Z0-9_-]{1,128})\r?$/gm)]
+                : [];
+            if (typeof receipt !== 'string' ||
+                receipt.length > 16000 ||
+                !receipt.startsWith('Spawned successfully.') ||
+                names.length !== 1 ||
+                !nativeName(names[0][1]) ||
+                ids.length !== 1)
+                throw new CaptureError('HOST_START_RECEIPT_INVALID', '需要含唯一 name 和 task_id 的完整原生后台启动回执；同步结果不能登记');
+            const renames = [
+                ...receipt.matchAll(/^Note: requested name "([^"]+)" was already in use \(or reserved for the team leader\)\. Renamed to "([^"]+)"\. Use this name when addressing the teammate via SendMessage\.\r?$/gm),
+            ];
+            if (renames.length > 1 ||
+                [...receipt.matchAll(/^Note: requested name /gm)].length !== renames.length ||
+                (renames.length === 1 &&
+                    (!nativeName(renames[0][1]) ||
+                        renames[0][2] !== names[0][1] ||
+                        !/^-(?:[2-9]|[1-9][0-9]+)$/.test(names[0][1].slice(renames[0][1].length)) ||
+                        !names[0][1].startsWith(renames[0][1]))))
+                throw new CaptureError('HOST_START_RECEIPT_INVALID', '原生重名回执不一致，拒绝登记');
+            const requestedName = renames[0]?.[1] || names[0][1];
+            const legacyToken = /^e10-([a-f0-9-]{36})$/.exec(requestedName)?.[1];
+            if ((legacyToken && event.token !== undefined && event.token !== legacyToken) ||
+                (event.taskId !== undefined && event.taskId !== ids[0][1]))
+                throw new CaptureError('HOST_IDENTITY_MISMATCH', '手工身份与原生启动回执不一致，拒绝登记；不要改写回执');
+            return {
+                event: 'started',
+                taskId: ids[0][1],
+                token: legacyToken || event.token,
+                nativeName: names[0][1],
+                requestedName,
+            };
+        });
+    if (!Array.isArray(events) ||
+        events.length > 100 ||
+        events.some((e) => !e ||
+            !['started', 'terminal'].includes(e.event) ||
+            !identity(e.taskId) ||
+            (e.event === 'started'
+                ? (e.token === undefined ? !nativeName(e.requestedName) : !identity(e.token)) ||
+                    (e.nativeName !== undefined && !nativeName(e.nativeName)) ||
+                    (e.requestedName !== undefined && !nativeName(e.requestedName))
+                : e.token !== undefined && !identity(e.token)) ||
+            (e.event === 'terminal' &&
+                (e.executionEnded !== true || !['completed', 'failed', 'cancelled'].includes(e.outcome)))))
+        throw new CaptureError('ARGUMENT_INVALID', '启动需要原生 receipt（兼容 taskId/token）；终态需要 taskId、outcome 和 executionEnded:true 的宿主确认');
+    return events;
+}
+/** Called only under the existing coordinator lock. A missing event never means exit. */
+export async function updateHostLedger(store, state, events) {
+    events = parseHostEvents(JSON.stringify(events));
+    const ledger = (await readHostLedger(store)) || { schema: 1, workers: [] };
+    // Read each allocation once per transaction, even for a whole batch of starts.
+    const allocations = events.some((e) => e.event === 'started')
+        ? (await Promise.all([
+            ...(state.pages || []).map((p) => ({ kind: 'page', id: p.id })),
+            ...(state.formPages || []).map((p) => ({ kind: 'form', id: p.id })),
+        ].map(async (item) => {
+            const result = await store.htmlResult(item.id, item.kind);
+            return result && ['running', 'succeeded'].includes(result.status)
+                ? [{ ...item, result }]
+                : [];
+        }))).flat()
+        : [];
+    for (const event of events) {
+        const old = ledger.workers.find((w) => w.taskId === event.taskId);
+        if (event.event === 'started' && event.requestedName) {
+            const matches = [];
+            if (old &&
+                (old.nativeName === event.nativeName || event.requestedName === `e10-${old.token}`))
+                matches.push(old);
+            for (const { result: r } of allocations) {
+                if (!matches.some((m) => m.token === r.token) &&
+                    (event.requestedName === r.dispatchName || event.requestedName === `e10-${r.token}`))
+                    matches.push(r);
+            }
+            if (matches.length !== 1)
+                throw new CaptureError('HOST_TOKEN_STALE', '原生名称必须唯一对应当前已分配任务；不要按顺序猜 token');
+            if (event.token !== undefined && event.token !== matches[0].token)
+                throw new CaptureError('HOST_IDENTITY_MISMATCH', '手工 token 与原生名称不匹配，拒绝登记');
+            event.token = matches[0].token;
+        }
+        if (old && event.token !== undefined && old.token !== event.token)
+            throw new CaptureError('HOST_IDENTITY_MISMATCH', 'taskId 与 token 不匹配，拒绝更新');
+        if (event.event === 'terminal') {
+            if (!old)
+                throw new CaptureError('HOST_WORKER_UNKNOWN', '未登记的 taskId 不能释放名额');
+            if (old.endedAt && old.outcome !== event.outcome)
+                throw new CaptureError('HOST_TERMINAL_CONFLICT', '重复终态的 outcome 不一致');
+            old.endedAt ||= new Date().toISOString();
+            old.outcome = event.outcome;
+        }
+        else if (!old) {
+            if (ledger.workers.some((w) => w.token === event.token))
+                throw new CaptureError('HOST_DUPLICATE_WRITER', '同一 token 已登记其他原生任务');
+            const allocation = allocations.find(({ result }) => result.token === event.token);
+            const target = allocation
+                ? {
+                    taskId: event.taskId,
+                    token: event.token,
+                    kind: allocation.kind,
+                    pageId: allocation.id,
+                    startedAt: new Date().toISOString(),
+                    ...(event.nativeName ? { nativeName: event.nativeName } : {}),
+                }
+                : undefined;
+            if (!target)
+                throw new CaptureError('HOST_TOKEN_STALE', '只能登记当前已分配的 HTML token');
+            if (ledger.workers.filter((w) => !w.endedAt).length >= state.settings.concurrency)
+                throw new CaptureError('HOST_CAPACITY_EXCEEDED', '原生任务数已达到并发上限');
+            ledger.workers.push(target);
+        }
+    }
+    await atomicJson(filename(store), ledger);
+    return ledger;
+}
+export async function activeHostWorkers(store) {
+    return (await readHostLedger(store))?.workers.filter((w) => !w.endedAt);
+}
+export function parseHostActiveTokens(value) {
+    let tokens;
+    try {
+        tokens = JSON.parse(value);
+    }
+    catch {
+        throw new CaptureError('ARGUMENT_INVALID', '--host-active-tokens 需要 JSON 字符串数组');
+    }
+    if (!Array.isArray(tokens) ||
+        tokens.length > 100 ||
+        tokens.some((token) => typeof token !== 'string' || !/^[a-zA-Z0-9_-]{1,128}$/.test(token)) ||
+        new Set(tokens).size !== tokens.length)
+        throw new CaptureError('ARGUMENT_INVALID', '--host-active-tokens 需要不重复的有效令牌数组');
+    return tokens;
+}

package/dist/host-watch.d.ts

@@ -0,0 +1,102 @@
+import type { Store } from './store.js';
+import type { TaskState } from './model.js';
+/** Local evidence only. A quiet file, ready receipt or timeout never proves native exit. */
+export declare function observeHost(store: Store, state: TaskState, tokens: string[]): Promise<{
+    slots: ({
+        token: string;
+        htmlStatus: string;
+        checkReason: string;
+        reviewSubmitted: boolean;
+        kind?: undefined;
+        pageId?: undefined;
+        name?: undefined;
+        lastLocalActivityAt?: undefined;
+        localIdleMs?: undefined;
+    } | {
+        token: string;
+        kind: "page" | "form";
+        pageId: string;
+        name: string;
+        htmlStatus: "running" | "succeeded" | "failed" | "pending";
+        reviewSubmitted: boolean;
+        lastLocalActivityAt: string;
+        localIdleMs: number;
+        checkReason: string | undefined;
+    })[];
+    observationState: string;
+    reconcile: ({
+        token: string;
+        htmlStatus: string;
+        checkReason: string;
+        reviewSubmitted: boolean;
+        kind?: undefined;
+        pageId?: undefined;
+        name?: undefined;
+        lastLocalActivityAt?: undefined;
+        localIdleMs?: undefined;
+    } | {
+        token: string;
+        kind: "page" | "form";
+        pageId: string;
+        name: string;
+        htmlStatus: "running" | "succeeded" | "failed" | "pending";
+        reviewSubmitted: boolean;
+        lastLocalActivityAt: string;
+        localIdleMs: number;
+        checkReason: string | undefined;
+    })[];
+}>;
+/** One bounded background process. No auth, Chrome, queue lock or state mutations. */
+export declare function watchHost(store: Store, options: {
+    activeTokens: string[];
+    afterState?: string;
+    watchMs?: number;
+}): Promise<{
+    reason: string;
+    elapsedMs: number;
+    next: string;
+    releasesSlots: boolean;
+    slots: ({
+        token: string;
+        htmlStatus: string;
+        checkReason: string;
+        reviewSubmitted: boolean;
+        kind?: undefined;
+        pageId?: undefined;
+        name?: undefined;
+        lastLocalActivityAt?: undefined;
+        localIdleMs?: undefined;
+    } | {
+        token: string;
+        kind: "page" | "form";
+        pageId: string;
+        name: string;
+        htmlStatus: "running" | "succeeded" | "failed" | "pending";
+        reviewSubmitted: boolean;
+        lastLocalActivityAt: string;
+        localIdleMs: number;
+        checkReason: string | undefined;
+    })[];
+    observationState: string;
+    reconcile: ({
+        token: string;
+        htmlStatus: string;
+        checkReason: string;
+        reviewSubmitted: boolean;
+        kind?: undefined;
+        pageId?: undefined;
+        name?: undefined;
+        lastLocalActivityAt?: undefined;
+        localIdleMs?: undefined;
+    } | {
+        token: string;
+        kind: "page" | "form";
+        pageId: string;
+        name: string;
+        htmlStatus: "running" | "succeeded" | "failed" | "pending";
+        reviewSubmitted: boolean;
+        lastLocalActivityAt: string;
+        localIdleMs: number;
+        checkReason: string | undefined;
+    })[];
+}>;

package/dist/host-watch.js

@@ -0,0 +1,112 @@
+import fs from 'node:fs/promises';
+import path from 'node:path';
+import { setTimeout as delay } from 'node:timers/promises';
+import { CaptureError, digest, mapLimit } from './common.js';
+import { navigationKey } from './menus.js';
+/** Local evidence only. A quiet file, ready receipt or timeout never proves native exit. */
+export async function observeHost(store, state, tokens) {
+    const targets = [
+        ...(state.pages || []).map((p) => ({ ...p, kind: 'page' })),
+        ...(state.menuRequired ? state.formPages || [] : []).map((p) => ({
+            ...p,
+            kind: 'form',
+        })),
+    ];
+    const receipts = await mapLimit(targets, 8, async (p) => ({
+        item: p,
+        receipt: await store.htmlResult(p.id, p.kind),
+    }));
+    const byToken = new Map(receipts.filter((p) => p.receipt).map((p) => [p.receipt.token, p]));
+    const now = Date.now();
+    const slots = await Promise.all(tokens.map(async (token) => {
+        const matched = byToken.get(token);
+        if (!matched?.receipt)
+            return {
+                token,
+                htmlStatus: 'unknown',
+                checkReason: 'unknown-reservation',
+                reviewSubmitted: false,
+            };
+        const { receipt: r, item } = matched;
+        const dir = path.join(store.meta, 'html-drafts', r.token);
+        const draft = path.join(dir, `${item.kind === 'form' ? navigationKey(r.id) : r.id}.html`);
+        const reviewPath = path.join(dir, 'review', 'host-review.json');
+        const [draftStat, reviewStat, review] = await Promise.all([
+            fs.stat(draft).catch(() => null),
+            fs.stat(reviewPath).catch(() => null),
+            fs
+                .readFile(reviewPath, 'utf8')
+                .then(JSON.parse)
+                .catch(() => null),
+        ]);
+        const reviewSubmitted = review?.schema === 1 &&
+            review.token === token &&
+            review.pageId === r.id &&
+            review.kind === item.kind;
+        const lastLocalActivityMs = Math.max(Date.parse(r.startedAt) || 0, Date.parse(r.finishedAt || '') || 0, draftStat?.mtimeMs || 0, reviewStat?.mtimeMs || 0);
+        const localIdleMs = Math.max(0, Math.floor(now - lastLocalActivityMs));
+        return {
+            token,
+            kind: item.kind,
+            pageId: r.id,
+            name: item.name,
+            htmlStatus: r.status,
+            reviewSubmitted,
+            lastLocalActivityAt: new Date(lastLocalActivityMs).toISOString(),
+            localIdleMs,
+            checkReason: r.status !== 'running'
+                ? 'html-terminal-native-unconfirmed'
+                : reviewSubmitted
+                    ? 'review-submitted-native-unconfirmed'
+                    : localIdleMs >= 300_000
+                        ? 'no-local-progress-five-minutes'
+                        : localIdleMs >= 180_000
+                            ? 'no-local-progress-three-minutes'
+                            : undefined,
+        };
+    }));
+    // Draft edits alone do not wake the model; handoffs, terminal receipts and stalled
+    // progress do. Sort tokens so changes in coordinator ordering are not new events.
+    const observationState = digest(JSON.stringify([...slots]
+        .sort((a, b) => a.token.localeCompare(b.token))
+        .map(({ token, htmlStatus, reviewSubmitted, checkReason }) => ({
+        token,
+        htmlStatus,
+        reviewSubmitted,
+        checkReason,
+    }))));
+    return { slots, observationState, reconcile: slots.filter((slot) => slot.checkReason) };
+}
+/** One bounded background process. No auth, Chrome, queue lock or state mutations. */
+export async function watchHost(store, options) {
+    const watchMs = options.watchMs ?? 60_000;
+    if (!Number.isInteger(watchMs) || watchMs < 1 || watchMs > 60_000)
+        throw new CaptureError('ARGUMENT_INVALID', '--watch-ms 范围 1..60000');
+    if (options.afterState !== undefined && !/^[a-f0-9]{64}$/.test(options.afterState))
+        throw new CaptureError('ARGUMENT_INVALID', '--after-state 需要 observationState 摘要');
+    const started = performance.now();
+    let baseline = options.afterState;
+    for (;;) {
+        const observation = await observeHost(store, await store.load(), options.activeTokens);
+        const elapsedMs = Math.round(performance.now() - started);
+        const reason = !options.activeTokens.length
+            ? 'no-active-workers'
+            : baseline !== undefined && observation.observationState !== baseline
+                ? 'local-state-changed'
+                : baseline === undefined && observation.reconcile.length
+                    ? 'native-check-required'
+                    : elapsedMs >= watchMs
+                        ? 'native-status-deadline'
+                        : undefined;
+        if (reason)
+            return {
+                ...observation,
+                reason,
+                elapsedMs,
+                next: options.activeTokens.length ? 'reconcile-native-host' : 'html next',
+                releasesSlots: false,
+            };
+        baseline = observation.observationState;
+        await delay(Math.min(1000, Math.max(1, watchMs - elapsedMs)));
+    }
+}

package/dist/html-handoff.d.ts

@@ -7,6 +7,7 @@ export declare function readyHtml(store: Store, state: TaskState, pageId: string
     pageId: string;
     receiptPath: string;
     next: string;
+    instruction: string;
     frozen: boolean;
 }>;
 /** Called only by the coordinator under the queue lock. Each acceptance is durable. */

package/dist/html-handoff.js

@@ -29,7 +29,25 @@ async function evidence(store, state, pageId, token, kind) {
         }
         inspections.push({ width, sha256: await fileDigest(filename) });
     }
-    return { directory, sourceSha256, inspections };
+    const interactionPath = path.join(directory, 'interaction.json');
+    const interaction = await fs
+        .readFile(interactionPath, 'utf8')
+        .then(JSON.parse)
+        .catch((error) => {
+        if (error.code === 'ENOENT')
+            return undefined;
+        throw new CaptureError('HTML_INTERACTION_REQUIRED', '交互回执损坏，需要重跑');
+    });
+    if (interaction && (!interaction.ok || interaction.sourceSha256 !== sourceSha256))
+        throw new CaptureError('HTML_INTERACTION_REQUIRED', '已有交互检查失败或草稿已变化，需要对当前草稿重跑');
+    return {
+        directory,
+        sourceSha256,
+        inspections,
+        interaction: interaction
+            ? { sha256: await fileDigest(interactionPath), steps: interaction.results.length }
+            : undefined,
+    };
 }
 /** The worker attests its review; this is not an independent visual quality score. */
 export async function readyHtml(store, state, pageId, token, kind, summary) {
@@ -44,10 +62,19 @@ export async function readyHtml(store, state, pageId, token, kind, summary) {
         token,
         sourceSha256: proof.sourceSha256,
         inspections: proof.inspections,
+        interaction: proof.interaction,
         summary: summary.trim(),
         reviewedAt: new Date().toISOString(),
     });
-    return { ok: true, kind, pageId, receiptPath, next: 'notify-coordinator', frozen: true };
+    return {
+        ok: true,
+        kind,
+        pageId,
+        receiptPath,
+        next: 'finish-worker',
+        instruction: '回执已落盘；只作简短最终回复并结束，不再调用工具（包括 SendMessage、TaskList、TaskUpdate）或等待其它任务。协调者等待原生执行终态。',
+        frozen: true,
+    };
 }
 /** Called only by the coordinator under the queue lock. Each acceptance is durable. */
 export async function acceptReadyHtml(store, state) {
@@ -71,6 +98,7 @@ export async function acceptReadyHtml(store, state) {
                 receipt.pageId !== result.id ||
                 receipt.kind !== kind ||
                 receipt.sourceSha256 !== proof.sourceSha256 ||
+                JSON.stringify(receipt.interaction) !== JSON.stringify(proof.interaction) ||
                 JSON.stringify(receipt.inspections) !== JSON.stringify(proof.inspections) ||
                 typeof receipt.summary !== 'string' ||
                 !receipt.summary.trim() ||

package/dist/html-inspect.d.ts

@@ -2,6 +2,6 @@ import { launchChrome } from './capture.js';
 import type { Store } from './store.js';
 import type { TaskState } from './model.js';
 /** One host call and at most one owned Chrome for the required form viewports. */
-export declare function inspectHtmlViewports(store: Store, state: TaskState, pageId: string, token: string, kind?: 'page' | 'form', width?: number): Promise<any>;
+export declare function inspectHtmlViewports(store: Store, state: TaskState, pageId: string, token: string, kind?: 'page' | 'form', width?: number, repairReason?: string): Promise<any>;
 /** Deterministic local rendering, never a visual similarity assertion or model call. */
-export declare function inspectHtml(store: Store, state: TaskState, pageId: string, token: string, kind?: 'page' | 'form', width?: number, sharedChrome?: () => Promise<Awaited<ReturnType<typeof launchChrome>>>): Promise<any>;
+export declare function inspectHtml(store: Store, state: TaskState, pageId: string, token: string, kind?: 'page' | 'form', width?: number, sharedChrome?: () => Promise<Awaited<ReturnType<typeof launchChrome>>>, repairReason?: string): Promise<any>;

package/dist/html-inspect.js

@@ -1,20 +1,22 @@
 import fs from 'node:fs/promises';
 import path from 'node:path';
-import { pathToFileURL } from 'node:url';
+import { loadOfflinePage } from './offline-render.js';
 import { bounded, CaptureError, digest, fileDigest, atomicJson } from './common.js';
 import { launchChrome } from './capture.js';
 import { prepareHtml } from './html.js';
+import { reviewRevision, validateRepairReason } from './html-review-budget.js';
 /** One host call and at most one owned Chrome for the required form viewports. */
-export async function inspectHtmlViewports(store, state, pageId, token, kind = 'page', width) {
+export async function inspectHtmlViewports(store, state, pageId, token, kind = 'page', width, repairReason) {
+    validateRepairReason(repairReason);
     if (kind === 'page' || width !== undefined)
-        return inspectHtml(store, state, pageId, token, kind, width);
+        return inspectHtml(store, state, pageId, token, kind, width, undefined, repairReason);
     let chrome;
     const started = Date.now();
     try {
         const getChrome = async () => (chrome ??= await launchChrome());
         const inspections = [];
         for (const w of [1440, 390])
-            inspections.push(await inspectHtml(store, state, pageId, token, kind, w, getChrome));
+            inspections.push(await inspectHtml(store, state, pageId, token, kind, w, getChrome, repairReason));
         if (new Set(inspections.map((r) => r.sourceSha256)).size !== 1)
             throw new CaptureError('HTML_REVIEW_STALE', '两种视口校对期间草稿发生变化，请重新校对');
         return {
@@ -30,7 +32,8 @@ export async function inspectHtmlViewports(store, state, pageId, token, kind = '
     }
 }
 /** Deterministic local rendering, never a visual similarity assertion or model call. */
-export async function inspectHtml(store, state, pageId, token, kind = 'page', width, sharedChrome) {
+export async function inspectHtml(store, state, pageId, token, kind = 'page', width, sharedChrome, repairReason) {
+    validateRepairReason(repairReason);
     const prepared = await prepareHtml(store, state, pageId, token, kind);
     const viewport = {
         width: width ?? (kind === 'page' ? prepared.png.width : 1440),
@@ -42,7 +45,7 @@ export async function inspectHtml(store, state, pageId, token, kind = 'page', wi
     await fs.mkdir(directory, { recursive: true });
     const receiptPath = path.join(directory, `inspection-${viewport.width}.json`);
     const sourceSha256 = digest(prepared.bytes);
-    const key = digest(JSON.stringify({ version: 3, sourceSha256, input: prepared.png.sha256, viewport }));
+    const key = digest(JSON.stringify({ version: 4, sourceSha256, input: prepared.png.sha256, viewport }));
     const old = await fs
         .readFile(receiptPath, 'utf8')
         .then(JSON.parse)
@@ -53,14 +56,15 @@ export async function inspectHtml(store, state, pageId, token, kind = 'page', wi
         if (valid.length && valid.every(Boolean))
             return { ...old, reused: true, receiptPath };
     }
+    const reviewBudget = await reviewRevision(directory, sourceSha256, repairReason);
     const started = Date.now();
     const errors = new Set();
     const runtimeErrors = [];
     const runtimeErrorDetails = [];
     const screenshots = [];
+    let fixedBehavior;
     const previewPath = path.join(directory, 'preview.html');
     await fs.writeFile(previewPath, prepared.bytes, { mode: 0o600 });
-    const previewUrl = pathToFileURL(previewPath).href;
     const sourceLines = prepared.bytes.toString('utf8').split(/\r?\n/);
     const chrome = await (sharedChrome ? sharedChrome() : launchChrome());
     try {
@@ -70,52 +74,18 @@ export async function inspectHtml(store, state, pageId, token, kind = 'page', wi
             serviceWorkers: 'block',
         });
         try {
-            await context.route('**/*', async (route) => {
-                if (route.request().url() === previewUrl || /^(data:|about:)/.test(route.request().url()))
-                    await route.continue();
-                else {
-                    errors.add('页面尝试访问外部或旁路资源');
-                    await route.abort();
-                }
-            });
             const page = await context.newPage();
             try {
-                // Capture browser source locations, including parse errors without a JS stack.
-                await page.addInitScript(() => {
-                    ;
-                    window.__E10_INSPECTION_ERRORS__ = [];
-                    addEventListener('error', (event) => {
-                        const errors = window.__E10_INSPECTION_ERRORS__;
-                        if (errors.length < 10 && event.message)
-                            errors.push({
-                                message: event.message.slice(0, 500),
-                                url: event.filename,
-                                line: event.lineno,
-                                column: event.colno,
-                            });
-                    });
-                });
-                page.on('pageerror', (error) => {
-                    errors.add('页面存在 JavaScript 运行错误');
-                    if (runtimeErrors.length < 10)
-                        runtimeErrors.push(`${error.name}: ${error.message}`.slice(0, 500));
-                });
-                page.on('websocket', () => errors.add('页面尝试建立网络连接'));
                 await bounded((async () => {
-                    await page.goto(previewUrl, { waitUntil: 'load', timeout: 10000 });
-                    if (kind === 'form') {
-                        try {
-                            await page.waitForFunction(() => window.__E10_FORM_READY__ === true ||
-                                window.__E10_INSPECTION_ERRORS__?.length > 0, undefined, { timeout: 10000 });
-                        }
-                        catch (error) {
-                            if (!(error instanceof Error) || error.name !== 'TimeoutError')
-                                throw error;
-                        }
-                        if (!(await page.evaluate(() => window.__E10_FORM_READY__ === true)))
-                            errors.add('表单未完成初始化，检查脚本错误及 __E10_FORM_READY__ 设置');
-                    }
-                    await page.evaluate(() => document.fonts.ready);
+                    const rendered = await loadOfflinePage(page, previewPath, kind === 'form');
+                    for (const error of rendered.errors)
+                        errors.add(error);
+                    runtimeErrors.push(...rendered.runtimeErrors);
+                    if (kind === 'form')
+                        fixedBehavior = await page.evaluate(() => ({
+                            initialized: window.__E10_FORM_BEHAVIOR__?.initialized === true,
+                            limitations: (window.__E10_FORM_BEHAVIOR__?.limitations || []).slice(0, 40),
+                        }));
                     const layout = await page.evaluate(() => ({
                         height: Math.max(document.documentElement.scrollHeight, document.body.scrollHeight),
                         width: Math.max(document.documentElement.scrollWidth, document.body.scrollWidth),
@@ -149,7 +119,7 @@ export async function inspectHtml(store, state, pageId, token, kind = 'page', wi
                     }
                     const browserErrors = await page.evaluate(() => window.__E10_INSPECTION_ERRORS__ || []);
                     for (const error of browserErrors.slice(0, 10)) {
-                        if (error.url !== previewUrl || !Number.isInteger(error.line) || error.line < 1)
+                        if (error.url !== rendered.url || !Number.isInteger(error.line) || error.line < 1)
                             continue;
                         runtimeErrorDetails.push({
                             message: String(error.message).slice(0, 500),
@@ -185,9 +155,11 @@ export async function inspectHtml(store, state, pageId, token, kind = 'page', wi
         errors: [...errors],
         runtimeErrors,
         runtimeErrorDetails,
+        fixedBehavior,
         elapsedMs: Date.now() - started,
         reviewedAt: new Date().toISOString(),
         visual: 'host-review-required',
+        reviewBudget,
     };
     await atomicJson(receiptPath, receipt);
     return { ...receipt, reused: false, receiptPath };