mslxdff 0.1.174 → 0.1.176

package/src/chat-pipeline/auto-race.js

@@ -3,6 +3,7 @@ import { injectReasoningContent } from "../reasoning.js";
 import { runHook } from "../plugins.js";
 import { errMsg } from "../routes/helpers.js";
 import { withOutputFloor } from "./empty-turn.js";
+import { classifyTerminalUpstream, readVerdictText, terminalShortcircuitOff } from "./terminal-verdict.js";
 import { handleLocalRelay } from "../routes/chat/local-handler.js";
 import { handleExhaustedAll } from "../routes/chat/exhausted-handler.js";
 
@@ -123,9 +124,33 @@ export async function runAutoRace(ctx, deps = {}) {
   const triedSet = new Set(raceModels);
   order = order.filter((m) => !triedSet.has(m));
   if (!order.length) {
+    // 并发竞速全挂时也要认终局判决（判据见 terminal-verdict.js）：否则「上游 6s 就把话说死」在这条出口
+    // 换成 502 "all concurrent candidates failed"，serial-trial 那条短路救不到它——同一失败模式的另一条命
+    // （`auto` 是 chat 门缺省路径，冷启动无 prior-success 且 >1 可用候选时必走竞速）。
+    // 走到这里 order 已空（没有下一候选可换）、组员也不在这条路上，所以本段只改「客户端看到什么」：
+    // 挑第一条能定终局的失败，把它的**原响应**交给 exhaustedAll 透传（原状态码 + 原字节 + 原头）。
+    let terminalLast = null;
+    if (!terminalShortcircuitOff()) {
+      for (const r of results) {
+        const v = r.status === "fulfilled" ? r.value : null;
+        if (!v || v.ok || v.allowlist || !v.res) continue;
+        const txt = await readVerdictText(v.res);
+        if (!txt.trim()) continue; // 读不到正文一律不判终局（保守回退「照跑收场」的旧行为）
+        const verdict = classifyTerminalUpstream(v.status, txt);
+        if (!verdict.terminal) continue;
+        evt("upstream-terminal", { reqId, model: v.model, status: v.status, kind: verdict.kind, marker: verdict.marker, peersSkipped: true, via: "auto-race" });
+        logError(v.model, v.status, `upstream ${v.status} body=${txt.replace(/\s+/g, " ").slice(0, 300)} · 终局判决 ${verdict.kind}（auto 竞速收场直发原文）`);
+        terminalLast = { model: v.model, upstream: v.res, status: v.status, message: txt.replace(/\s+/g, " ").slice(0, 400) || `upstream ${v.status}`, terminal: verdict.kind };
+        break;
+      }
+    }
     const failedStatuses = results.map((r) => (r.status === "fulfilled" ? r.value?.status : null)).filter((s) => Number.isInteger(s));
     const lastStatus = failedStatuses[failedStatuses.length - 1] || failedStatuses[0] || 502;
-    const last = { model: raceModels[0] || requested, status: lastStatus, message: "all concurrent candidates failed" };
+    // 竞速出口的取证与串行一致：状态码、原响应、同名回显头（客户端只看得到这一个面）
+    if (terminalLast && !res.headersSent && typeof res?.setHeader === "function") {
+      try { res.setHeader("x-mslxdff-terminal", terminalLast.terminal); } catch {}
+    }
+    const last = terminalLast || { model: raceModels[0] || requested, status: lastStatus, message: "all concurrent candidates failed" };
     await exhaustedAll({ res, body, lastErr: last, order: raceModels, requested, handlerCtx: { ...handlerCtx, reqId, startedAt }, evt, logCall, mark, perf0, stages });
     return { done: true };
   }

package/src/chat-pipeline/index.js

@@ -1,132 +1,132 @@
-import { performance } from "node:perf_hooks";
-import { analyzePolicy } from "./policy.js";
-import { createEngine } from "./engine.js";
-import { runHook } from "../plugins.js";
-import { isFreeModel } from "../models.js";
-import { clientIp, summarizePrompt } from "../routes/helpers.js";
-import { formatTimeline } from "../timeline.js";
-import { summarizeRequest, shouldTraceModel } from "../model-trace.js";
-import { apiKindOf } from "../api-kind.js";
-
-/**
- * ChatPipeline 深模块门面 — 对外 execute(req) 单一 inlet
- * 内部组合 Policy→Engine：解析 header/model → 产 order → 委托 engine 执行
- * gateway 仅薄适配：readBody + request:received hook + 调 execute
- */
-export function createChatPipeline({ upstream, auto, logs, peers, groups, bus, token, plugins, maxHops } = {}) {
-  const engine = createEngine();
-
-  async function execute({ req, res } = {}) {
-    const startedAt = Date.now();
-    const reqId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
-    // 入站协议门（chat|responses|messages|other）：全场只在这里判一次，之后随 handlerCtx 透传；
-    // 各日志写点不得再各自匹配路径（第二份判定迟早漂移）—— 见 src/api-kind.js
-    const api = apiKindOf(req);
-    const perf0 = performance.now();
-    const stages = [];
-    const mark = (name) => stages.push([name, Math.round(performance.now() - perf0)]);
-
-    const policy = analyzePolicy({ headers: req?.headers || {}, body: req?.body || {} });
-    const { requested, useAuto, autoProvider, lockModel, hops, shareKeys, workbuddyUid, aliasInfo } = policy;
-    mark("parsed");
-    if (aliasInfo) { try { res?.setHeader?.("x-mslxdff-alias", aliasInfo); } catch {} }
-    // mslxdff/ 前缀或 alias 命中时，把 body.model 改写为还原后的模型（与原 gateway 语义一致）
-    const timeline = { direct: [], peers: [], retries: 0, retryResult: null, result: null };
-    if (aliasInfo && req?.body && req.body.model !== requested) {
-      req.body = { ...req.body, model: requested };
-    }
-
-    // 事件/日志帮手先于 order 推导声明：evt 在 auto-scope 分支即被使用，
-    // 声明置后会让 useAuto && autoProvider 的请求在 TDZ 上崩（线上 -chat 回退路径）
-    const logCall = (model, status) => logs?.appendCall({ reqId, api, model, auto: useAuto, status, durationMs: Date.now() - startedAt, stream: Boolean(req?.body?.stream), stages });
-    const logError = (model, status, message) => logs?.appendError({ reqId, api, model, auto: useAuto, status, message, stages });
-    const evt = (type, data) => {
-      const entry = { ts: Date.now(), reqId, type, ...data, api, model: data.model ?? requested, auto: useAuto, durationMs: Date.now() - startedAt, stages: [...stages] };
-      const traceModel = entry.model || requested;
-      if (shouldTraceModel(type)) {
-        // Note: 模型日志只投影安全字段，不能把含 prompt 的 entry 原样下传 — 见 .agents/notes/implemented/feature/2026-09-25-model-trace-log.md
-        const safeTraceData = { ...entry };
-        if (safeTraceData.prompt !== undefined) delete safeTraceData.prompt;
-        logs?.appendModelTrace?.(traceModel, { type, reqId, model: traceModel, data: safeTraceData, request: type === "request" ? summarizeRequest(req?.body) : null, totalMs: entry.durationMs });
-      }
-      if (type === "peer-forward") timeline.peers.push({ peer: entry.peer, ok: entry.ok === true, status: entry.status, latencyMs: entry.latencyMs, message: entry.message || entry.error || "" });
-      if (type === "upstream-done" || type === "upstream-error") timeline.direct.push({ status: entry.status, reason: entry.message || entry.error || "" });
-      if (type === "peer-error") {
-        const known = timeline.peers.find((p) => p.peer === entry.peer);
-        if (known) { known.ok = false; known.status = entry.status ?? known.status; known.message = entry.message || entry.error || known.message; }
-        else timeline.peers.push({ peer: entry.peer, ok: false, status: entry.status, message: entry.message || entry.error || "" });
-      }
-      if (type === "empty-turn-retry") timeline.retries += 1;
-      // 空转重试必须交代结局：只记次数的话，"重试后救回来"和"重试到死"在日志里长得一模一样
-      if (type === "empty-turn-recovered") timeline.retryResult = "ok";
-      if (type === "empty-turn-exhausted") timeline.retryResult = timeline.retryResult || "lost";
-      if (type === "result" || (type === "client-response" && !timeline.result)) {
-        timeline.result = { status: entry.status, detail: entry.detail || null };
-        try { logs?.appendTimeline?.(formatTimeline({ reqId, model: entry.model || requested, ...timeline, totalMs: Date.now() - startedAt })); } catch {}
-      }
-      if (bus) bus.emit(entry);
-      logs?.appendEvent?.(entry);
-    };
-    const done = (info) => {
-      if (!plugins?.length) return;
-      runHook(plugins, "request:completed", { reqId, requested, useAuto, hops, stream: Boolean(req?.body?.stream), durationMs: Date.now() - startedAt, ...info }).catch(() => {});
-    };
-
-    // order 推导 + plugin model:select 可改
-    // 语义：指定模型 = 死锁单模型（本机→组员同款，挂了就报挂，不兜其他 picks）；只有 auto 才轮 picks
-    // x-mslxdff-auto-provider 头可把 auto 候选限定到单供应商（opencode=裸 id 免费池），-chat 默认带
-    let order;
-    if (lockModel) order = [requested];
-    else if (useAuto) {
-      let cands = auto ? await auto.candidates() : [""];
-      if (autoProvider) {
-        const before = cands.length;
-        cands = cands.filter((m) => (autoProvider === "opencode"
-          ? !String(m).includes("/") && isFreeModel(m)
-          : String(m).startsWith(`${autoProvider}/`)));
-        evt("auto-scope", { reqId, provider: autoProvider, before, after: cands.length });
-      }
-      order = cands;
-    } else {
-      if (auto && requested) { try { await auto.candidatesFor(requested); } catch {} }
-      order = [requested];
-    }
-    if (!order.length) order = [""];
-    const canFallback = order.length > 1;
-    const canForwardPeers = Boolean(peers) && hops < (maxHops ?? 3);
-    mark("ordered");
-
-    const reqIp = clientIp(req); // 一次解析两处用：request 事件的 ip 字段 + 回路语料的 clientIp（routes/helpers.js 取 x-forwarded-for 首段）
-    evt("request", { reqId, hops, ip: reqIp, stream: Boolean(req?.body?.stream), prompt: summarizePrompt(req?.body), rawModel: policy.rawModel, requested, lockModel: lockModel || null });
-    if (aliasInfo) evt("alias", { reqId, alias: aliasInfo, rawModel: policy.rawModel, requested });
-    if (Object.keys(shareKeys).length) evt("share-keys", { reqId, providers: Object.keys(shareKeys) });
-    evt("ordered", { reqId, order, canFallback, canForwardPeers, useAuto, statuses: auto?.statuses?.() ?? null });
-
-    if (plugins?.length && !lockModel) {
-      const sel = await runHook(plugins, "model:select", { reqId, requested, useAuto, order: [...order], hops, stream: Boolean(req?.body?.stream) });
-      if (sel.changed && Array.isArray(sel.value) && sel.value.length) {
-        order = sel.value.filter(Boolean);
-        if (!order.length) order = [requested];
-        evt("plugin-hook", { reqId, hook: "model:select", applied: true, order: [...order] });
-      }
-      for (const e of sel.errors) evt("plugin-hook-error", { reqId, hook: "model:select", plugin: e.plugin, error: e.error });
-    }
-
-    // 客户端会话标识（opencode 插件 chat.headers 注入）→ 透传上游做粘性路由/缓存亲和；
-    // 无头时由 upstream.js 按对话首两条消息哈希兜底（不再每请求随机）
-    const clientSession = String(req?.headers?.["x-session-affinity"] || req?.headers?.["x-session-id"] || "").trim() || null;
-    const handlerCtx = { reqId, api, model: null, body: req?.body, hops, peers, plugins, evt, logError, logCall, logs, workbuddyUid, sessionId: clientSession, clientIp: reqIp };
-    if (clientSession) evt("client-session", { reqId, sessionId: clientSession.slice(0, 24) });
-
-    await engine.run({
-      reqId, startedAt, req, res, body: req?.body, policy,
-      useAuto, lockModel, requested, hops,
-      canFallback, canForwardPeers,
-      perf0, stages, mark, evt, logCall, logError, done, handlerCtx,
-      auto, upstream, peers, groups, bus, token, plugins, logs,
-      order,
-    });
-  }
-
-  return { execute, _policy: analyzePolicy, _engine: engine };
+import { performance } from "node:perf_hooks";
+import { analyzePolicy } from "./policy.js";
+import { createEngine } from "./engine.js";
+import { runHook } from "../plugins.js";
+import { isFreeModel } from "../models.js";
+import { clientIp, summarizePrompt } from "../routes/helpers.js";
+import { formatTimeline } from "../timeline.js";
+import { summarizeRequest, shouldTraceModel } from "../model-trace.js";
+import { apiKindOf } from "../api-kind.js";
+
+/**
+ * ChatPipeline 深模块门面 — 对外 execute(req) 单一 inlet
+ * 内部组合 Policy→Engine：解析 header/model → 产 order → 委托 engine 执行
+ * gateway 仅薄适配：readBody + request:received hook + 调 execute
+ */
+export function createChatPipeline({ upstream, auto, logs, peers, groups, bus, token, plugins, maxHops } = {}) {
+  const engine = createEngine();
+
+  async function execute({ req, res } = {}) {
+    const startedAt = Date.now();
+    const reqId = `${Date.now().toString(36)}-${Math.random().toString(36).slice(2, 6)}`;
+    // 入站协议门（chat|responses|messages|other）：全场只在这里判一次，之后随 handlerCtx 透传；
+    // 各日志写点不得再各自匹配路径（第二份判定迟早漂移）—— 见 src/api-kind.js
+    const api = apiKindOf(req);
+    const perf0 = performance.now();
+    const stages = [];
+    const mark = (name) => stages.push([name, Math.round(performance.now() - perf0)]);
+
+    const policy = analyzePolicy({ headers: req?.headers || {}, body: req?.body || {} });
+    const { requested, useAuto, autoProvider, lockModel, hops, shareKeys, workbuddyUid, aliasInfo } = policy;
+    mark("parsed");
+    if (aliasInfo) { try { res?.setHeader?.("x-mslxdff-alias", aliasInfo); } catch {} }
+    // mslxdff/ 前缀或 alias 命中时，把 body.model 改写为还原后的模型（与原 gateway 语义一致）
+    const timeline = { direct: [], peers: [], retries: 0, retryResult: null, result: null };
+    if (aliasInfo && req?.body && req.body.model !== requested) {
+      req.body = { ...req.body, model: requested };
+    }
+
+    // 事件/日志帮手先于 order 推导声明：evt 在 auto-scope 分支即被使用，
+    // 声明置后会让 useAuto && autoProvider 的请求在 TDZ 上崩（线上 -chat 回退路径）
+    const logCall = (model, status) => logs?.appendCall({ reqId, api, model, auto: useAuto, status, durationMs: Date.now() - startedAt, stream: Boolean(req?.body?.stream), stages });
+    const logError = (model, status, message) => logs?.appendError({ reqId, api, model, auto: useAuto, status, message, stages });
+    const evt = (type, data) => {
+      const entry = { ts: Date.now(), reqId, type, ...data, api, model: data.model ?? requested, auto: useAuto, durationMs: Date.now() - startedAt, stages: [...stages] };
+      const traceModel = entry.model || requested;
+      if (shouldTraceModel(type)) {
+        // Note: 模型日志只投影安全字段，不能把含 prompt 的 entry 原样下传 — 见 .agents/notes/implemented/feature/2026-09-25-model-trace-log.md
+        const safeTraceData = { ...entry };
+        if (safeTraceData.prompt !== undefined) delete safeTraceData.prompt;
+        logs?.appendModelTrace?.(traceModel, { type, reqId, model: traceModel, data: safeTraceData, request: type === "request" ? summarizeRequest(req?.body) : null, totalMs: entry.durationMs });
+      }
+      if (type === "peer-forward") timeline.peers.push({ peer: entry.peer, ok: entry.ok === true, status: entry.status, latencyMs: entry.latencyMs, message: entry.message || entry.error || "" });
+      if (type === "upstream-done" || type === "upstream-error") timeline.direct.push({ status: entry.status, reason: entry.message || entry.error || "" });
+      if (type === "peer-error") {
+        const known = timeline.peers.find((p) => p.peer === entry.peer);
+        if (known) { known.ok = false; known.status = entry.status ?? known.status; known.message = entry.message || entry.error || known.message; }
+        else timeline.peers.push({ peer: entry.peer, ok: false, status: entry.status, message: entry.message || entry.error || "" });
+      }
+      if (type === "empty-turn-retry") timeline.retries += 1;
+      // 空转重试必须交代结局：只记次数的话，"重试后救回来"和"重试到死"在日志里长得一模一样
+      if (type === "empty-turn-recovered") timeline.retryResult = "ok";
+      if (type === "empty-turn-exhausted") timeline.retryResult = timeline.retryResult || "lost";
+      if (type === "result" || (type === "client-response" && !timeline.result)) {
+        timeline.result = { status: entry.status, detail: entry.detail || null };
+        try { logs?.appendTimeline?.(formatTimeline({ reqId, model: entry.model || requested, ...timeline, totalMs: Date.now() - startedAt })); } catch {}
+      }
+      if (bus) bus.emit(entry);
+      logs?.appendEvent?.(entry);
+    };
+    const done = (info) => {
+      if (!plugins?.length) return;
+      runHook(plugins, "request:completed", { reqId, requested, useAuto, hops, stream: Boolean(req?.body?.stream), durationMs: Date.now() - startedAt, ...info }).catch(() => {});
+    };
+
+    // order 推导 + plugin model:select 可改
+    // 语义：指定模型 = 死锁单模型（本机→组员同款，挂了就报挂，不兜其他 picks）；只有 auto 才轮 picks
+    // x-mslxdff-auto-provider 头可把 auto 候选限定到单供应商（opencode=裸 id 免费池），-chat 默认带
+    let order;
+    if (lockModel) order = [requested];
+    else if (useAuto) {
+      let cands = auto ? await auto.candidates() : [""];
+      if (autoProvider) {
+        const before = cands.length;
+        cands = cands.filter((m) => (autoProvider === "opencode"
+          ? !String(m).includes("/") && isFreeModel(m)
+          : String(m).startsWith(`${autoProvider}/`)));
+        evt("auto-scope", { reqId, provider: autoProvider, before, after: cands.length });
+      }
+      order = cands;
+    } else {
+      if (auto && requested) { try { await auto.candidatesFor(requested); } catch {} }
+      order = [requested];
+    }
+    if (!order.length) order = [""];
+    const canFallback = order.length > 1;
+    const canForwardPeers = Boolean(peers) && hops < (maxHops ?? 3);
+    mark("ordered");
+
+    const reqIp = clientIp(req); // 一次解析两处用：request 事件的 ip 字段 + 回路语料的 clientIp（routes/helpers.js 取 x-forwarded-for 首段）
+    evt("request", { reqId, hops, ip: reqIp, stream: Boolean(req?.body?.stream), prompt: summarizePrompt(req?.body), rawModel: policy.rawModel, requested, lockModel: lockModel || null });
+    if (aliasInfo) evt("alias", { reqId, alias: aliasInfo, rawModel: policy.rawModel, requested });
+    if (Object.keys(shareKeys).length) evt("share-keys", { reqId, providers: Object.keys(shareKeys) });
+    evt("ordered", { reqId, order, canFallback, canForwardPeers, useAuto, statuses: auto?.statuses?.() ?? null });
+
+    if (plugins?.length && !lockModel) {
+      const sel = await runHook(plugins, "model:select", { reqId, requested, useAuto, order: [...order], hops, stream: Boolean(req?.body?.stream) });
+      if (sel.changed && Array.isArray(sel.value) && sel.value.length) {
+        order = sel.value.filter(Boolean);
+        if (!order.length) order = [requested];
+        evt("plugin-hook", { reqId, hook: "model:select", applied: true, order: [...order] });
+      }
+      for (const e of sel.errors) evt("plugin-hook-error", { reqId, hook: "model:select", plugin: e.plugin, error: e.error });
+    }
+
+    // 客户端会话标识（opencode 插件 chat.headers 注入）→ 透传上游做粘性路由/缓存亲和；
+    // 无头时由 upstream.js 按对话首两条消息哈希兜底（不再每请求随机）
+    const clientSession = String(req?.headers?.["x-session-affinity"] || req?.headers?.["x-session-id"] || "").trim() || null;
+    const handlerCtx = { reqId, api, model: null, body: req?.body, hops, peers, plugins, evt, logError, logCall, logs, workbuddyUid, sessionId: clientSession, clientIp: reqIp };
+    if (clientSession) evt("client-session", { reqId, sessionId: clientSession.slice(0, 24) });
+
+    await engine.run({
+      reqId, startedAt, req, res, body: req?.body, policy,
+      useAuto, lockModel, requested, hops,
+      canFallback, canForwardPeers,
+      perf0, stages, mark, evt, logCall, logError, done, handlerCtx,
+      auto, upstream, peers, groups, bus, token, plugins, logs,
+      order,
+    });
+  }
+
+  return { execute, _policy: analyzePolicy, _engine: engine };
 }

package/src/chat-pipeline/policy.js

@@ -1,84 +1,84 @@
-import { normalizeModel } from "../reasoning.js";
-import { isAutoModel } from "../auto.js";
-import { parseHops } from "../routes/helpers.js";
-import { parseShareKeysHeader, SHARE_KEYS_HEADER } from "../providers/share-keys.js";
-import { normalizeFullId, getModelAlias } from "../providers/model-id.js";
-
-/**
- * PolicyStage 纯函数 — 解析 model 别名 / 白名单前置 / header 透传
- * 零网络副作用，输入 headers+body，输出 PolicyResult
- */
-export function analyzePolicy({ headers = {}, body = {} } = {}) {
-  const hops = parseHops(headers["x-mslxdff-hops"] || headers["X-Mslxdff-Hops"] || "");
-  const shareKeys = parseShareKeysHeader(headers[SHARE_KEYS_HEADER] || headers["x-mslxdff-share-keys"] || "");
-  const workbuddyUid = (headers["x-mslxdff-workbuddy-uid"] || headers["x-workbuddy-uid"] || "").toString().trim();
-  const lockModel = (headers["x-mslxdff-model-lock"] || headers["X-Mslxdff-Model-Lock"] || "").toString();
-  // auto 范围限定：x-mslxdff-auto-provider: opencode → auto 候选只留该供应商（opencode=裸 id 免费池）
-  const autoProvider = (headers["x-mslxdff-auto-provider"] || headers["X-Mslxdff-Auto-Provider"] || "").toString().trim().toLowerCase() || null;
-  const rawModel = body.model || "";
-
-  let normalizedRequested = normalizeModel(lockModel || rawModel || "");
-  // [1m] 后缀回退（Claude Desktop 1M 条目 / Claude Code 1M 记法，ADR-0056）：alias 直查未命中时
-  // 剥去尾部 [1m] 再查一次。仅用于本次查找——不回写、不注册 alias，未命中路径逐字不变（design D2）。
-  // 两个 alias 查找点（首轮 + mslxdff/ 前缀二段）共用同一回退，否则 `mslxdff/<槽位>[1m]` 不等价（评审 1 P1）。
-  const resolveAlias = (id) => {
-    const hit = getModelAlias(id);
-    if (hit) return hit;
-    return /\[1m\]$/i.test(id) ? getModelAlias(id.replace(/\[1m\]$/i, "")) : null;
-  };
-  let aliasResolved = resolveAlias(normalizedRequested);
-  if (aliasResolved) {
-    normalizedRequested = aliasResolved;
-  }
-  let requested = normalizedRequested;
-  let aliasInfo = null;
-
-  if (requested.startsWith("mslxdff/")) {
-    const rawPart = requested.slice("mslxdff/".length);
-    aliasInfo = `${requested} -> ${rawPart} (mslxdff provider stripped)`;
-    requested = rawPart;
-    const alias2 = resolveAlias(requested);
-    if (alias2) {
-      aliasInfo = `${rawModel} -> ${alias2} (mslxdff + alias)`;
-      requested = alias2;
-    }
-  } else if (aliasResolved) {
-    // 非 mslxdff 的 dash 形态已在首轮 aliasResolved 处理
-    aliasInfo = aliasResolved !== (lockModel || rawModel) ? `${rawModel} -> ${aliasResolved} (alias)` : null;
-    if (!aliasInfo) aliasInfo = null;
-  }
-
-  // workbuddy <uid>:model 形式的 uid 钉死在 normalizeFullId 侧处理，这里透传原始 requested
-  // 若 requested 含 workbuddy/ 前缀且含 :，则尝试提取 uid
-  let extractedUid = workbuddyUid;
-  if (!extractedUid && requested.startsWith("workbuddy/") && requested.includes(":")) {
-    const after = requested.slice("workbuddy/".length);
-    const uidPart = after.split(":")[0];
-    if (uidPart) extractedUid = uidPart;
-  }
-
-  const useAuto = isAutoModel(requested);
-
-  // 对 workbuddy 前缀的 model，做 normalizeFullId 归一（剥 uid 供上游）
-  // 但保留 requested 为完整带前缀形态，供 serial-trial 做 ViaRoute 判定与组员路由
-  let normalizedForUpstream = requested;
-  try {
-    const norm = normalizeFullId(requested);
-    if (norm && norm.raw) normalizedForUpstream = norm.raw ? `${norm.provider ? norm.provider + "/" : ""}${norm.raw}` : requested;
-  } catch {}
-
-  return {
-    rawModel,
-    requested,
-    normalizedRequested,
-    normalizedForUpstream,
-    aliasInfo,
-    useAuto,
-    autoProvider,
-    shareKeys,
-    workbuddyUid: extractedUid,
-    lockModel,
-    hops,
-    bodyModel: body.model || null,
-  };
-}
+import { normalizeModel } from "../reasoning.js";
+import { isAutoModel } from "../auto.js";
+import { parseHops } from "../routes/helpers.js";
+import { parseShareKeysHeader, SHARE_KEYS_HEADER } from "../providers/share-keys.js";
+import { normalizeFullId, getModelAlias } from "../providers/model-id.js";
+
+/**
+ * PolicyStage 纯函数 — 解析 model 别名 / 白名单前置 / header 透传
+ * 零网络副作用，输入 headers+body，输出 PolicyResult
+ */
+export function analyzePolicy({ headers = {}, body = {} } = {}) {
+  const hops = parseHops(headers["x-mslxdff-hops"] || headers["X-Mslxdff-Hops"] || "");
+  const shareKeys = parseShareKeysHeader(headers[SHARE_KEYS_HEADER] || headers["x-mslxdff-share-keys"] || "");
+  const workbuddyUid = (headers["x-mslxdff-workbuddy-uid"] || headers["x-workbuddy-uid"] || "").toString().trim();
+  const lockModel = (headers["x-mslxdff-model-lock"] || headers["X-Mslxdff-Model-Lock"] || "").toString();
+  // auto 范围限定：x-mslxdff-auto-provider: opencode → auto 候选只留该供应商（opencode=裸 id 免费池）
+  const autoProvider = (headers["x-mslxdff-auto-provider"] || headers["X-Mslxdff-Auto-Provider"] || "").toString().trim().toLowerCase() || null;
+  const rawModel = body.model || "";
+
+  let normalizedRequested = normalizeModel(lockModel || rawModel || "");
+  // [1m] 后缀回退（Claude Desktop 1M 条目 / Claude Code 1M 记法，ADR-0056）：alias 直查未命中时
+  // 剥去尾部 [1m] 再查一次。仅用于本次查找——不回写、不注册 alias，未命中路径逐字不变（design D2）。
+  // 两个 alias 查找点（首轮 + mslxdff/ 前缀二段）共用同一回退，否则 `mslxdff/<槽位>[1m]` 不等价（评审 1 P1）。
+  const resolveAlias = (id) => {
+    const hit = getModelAlias(id);
+    if (hit) return hit;
+    return /\[1m\]$/i.test(id) ? getModelAlias(id.replace(/\[1m\]$/i, "")) : null;
+  };
+  let aliasResolved = resolveAlias(normalizedRequested);
+  if (aliasResolved) {
+    normalizedRequested = aliasResolved;
+  }
+  let requested = normalizedRequested;
+  let aliasInfo = null;
+
+  if (requested.startsWith("mslxdff/")) {
+    const rawPart = requested.slice("mslxdff/".length);
+    aliasInfo = `${requested} -> ${rawPart} (mslxdff provider stripped)`;
+    requested = rawPart;
+    const alias2 = resolveAlias(requested);
+    if (alias2) {
+      aliasInfo = `${rawModel} -> ${alias2} (mslxdff + alias)`;
+      requested = alias2;
+    }
+  } else if (aliasResolved) {
+    // 非 mslxdff 的 dash 形态已在首轮 aliasResolved 处理
+    aliasInfo = aliasResolved !== (lockModel || rawModel) ? `${rawModel} -> ${aliasResolved} (alias)` : null;
+    if (!aliasInfo) aliasInfo = null;
+  }
+
+  // workbuddy <uid>:model 形式的 uid 钉死在 normalizeFullId 侧处理，这里透传原始 requested
+  // 若 requested 含 workbuddy/ 前缀且含 :，则尝试提取 uid
+  let extractedUid = workbuddyUid;
+  if (!extractedUid && requested.startsWith("workbuddy/") && requested.includes(":")) {
+    const after = requested.slice("workbuddy/".length);
+    const uidPart = after.split(":")[0];
+    if (uidPart) extractedUid = uidPart;
+  }
+
+  const useAuto = isAutoModel(requested);
+
+  // 对 workbuddy 前缀的 model，做 normalizeFullId 归一（剥 uid 供上游）
+  // 但保留 requested 为完整带前缀形态，供 serial-trial 做 ViaRoute 判定与组员路由
+  let normalizedForUpstream = requested;
+  try {
+    const norm = normalizeFullId(requested);
+    if (norm && norm.raw) normalizedForUpstream = norm.raw ? `${norm.provider ? norm.provider + "/" : ""}${norm.raw}` : requested;
+  } catch {}
+
+  return {
+    rawModel,
+    requested,
+    normalizedRequested,
+    normalizedForUpstream,
+    aliasInfo,
+    useAuto,
+    autoProvider,
+    shareKeys,
+    workbuddyUid: extractedUid,
+    lockModel,
+    hops,
+    bodyModel: body.model || null,
+  };
+}

package/src/chat-pipeline/serial-trial.js

@@ -13,6 +13,7 @@ import { shouldUseGroupForModel, isHardLocalOnly, isKeyProviderDirectOnly } from
 import { summarizeRequest, upstreamEcho } from "../model-trace.js";
 import { isEmptyTurnError } from "../routes/chat/relay-pipeline.js";
 import { emptyRetryCfg, emptyRaiseCap, withRaisedMaxTokens, withOutputFloor, emptyNudgeCfg, withEmptyNudge, computeNextDelay, emptyTurnBudgetMs, emptyTurnMinRaiseTo } from "./empty-turn.js";
+import { classifyTerminalUpstream, readVerdictText, terminalShortcircuitOff } from "./terminal-verdict.js";
 
 const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
 
@@ -141,18 +142,44 @@ export async function runSerialTrial(ctx, deps = {}) {
           return json(res, 403, errBody);
         }
         if (auto) await auto.recordError(model, { status: upRes.status });
-        // 读失败响应体（clone 不影响后续 relay 转发原响应；1s 上限防流式错误体拖慢）
+        // 读失败响应体（clone 不影响后续 relay 转发原响应；1s 上限防流式错误体拖慢）。
+        // 两份文本分工写死：`upRaw` 喂判据（≤4KB，反向护栏不能被 400 字摘要喂不到——多 provider 明细体
+        // 如 OpenRouter 的 `metadata.raw[]` 会把 rate limit 排在 model not found 之后），`upBody` 供日志摘要。
+        let upRaw = "";
         let upBody = "";
-        try {
-          upBody = String(await Promise.race([
-            upRes.clone().text(),
-            new Promise((r) => { const t = setTimeout(() => r(""), 1000); t.unref?.(); }),
-          ])).replace(/\s+/g, " ").slice(0, 400);
-        } catch {}
+        upRaw = await readVerdictText(upRes);
+        upBody = upRaw.replace(/\s+/g, " ").slice(0, 400);
         const upMsg = upBody || `upstream ${upRes.status}`;
         lastErr = { model, upstream: upRes, status: upRes.status, message: upMsg };
-        logError(model, upRes.status, `upstream ${upRes.status}${upBody ? ` body=${upBody.slice(0, 300)}` : ""}`);
+        // 终局判决短路（判据与现网取证见 terminal-verdict.js）：上游把「这个模型你别想用」——免费层身份
+        // 闸门 / 模型 id 不存在——写死在错误里时，换组员撞的是同一堵墙（实测组员回同一条 FreeTierError），
+        // 接力只会把 6s 的真相拖成 70s 的 502 "peers failed"。逃生阀 MSLXDFF_TERMINAL_SHORTCIRCUIT=0。
+        const verdict = classifyTerminalUpstream(upRes.status, upRaw);
+        const terminalOn = verdict.terminal && !terminalShortcircuitOff();
+        // 一行话把「判决」与「原文」一起落 errors.log（不分两行：同一发失败在 errors.log 里只该有一条）
+        logError(model, upRes.status, `upstream ${upRes.status}${upBody ? ` body=${upBody.slice(0, 300)}` : ""}${terminalOn ? ` · 终局判决 ${verdict.kind}（跳过组员接力）` : ""}`);
         evt("upstream-error", { reqId, model, status: upRes.status, message: upMsg.slice(0, 300), timing: upRes._t ?? null, ...upstreamEcho(upRes) });
+        if (terminalOn) {
+          evt("upstream-terminal", { reqId, model, status: upRes.status, kind: verdict.kind, marker: verdict.marker, peersSkipped: true });
+          // ASCII 具名头。**不**复用 x-mslxdff-notice：那头的既定语义是「已被别的模型代答」（与
+          // x-mslxdff-fallback 成组，src/routes/fallback.js:27-39），拿它报「没代答、直接拒」会把按头
+          // 判是否换模型的下游 UI 读反。头值只填 ASCII 枚举，中文留在 evt/logError/timeline（文件是 UTF-8）。
+          try { if (!res.headersSent && typeof res.setHeader === "function") res.setHeader("x-mslxdff-terminal", verdict.kind); } catch {}
+          if (canFallback && idx < order.length - 1) {
+            // 判决只对**这个模型**成立 → 换下一候选。这里刻意不挂 upstream：这条 Response 的 body 没被
+            // 消费，挂在 lastErr 上带到收场会白占连接（收场只 relay 最后一发），故直接 cancel 后只留文本。
+            lastErr = { model, upstream: null, status: upRes.status, message: upMsg, terminal: verdict.kind };
+            try { const cx = upRes.body?.cancel?.(); if (cx && typeof cx.catch === "function") cx.catch(() => {}); } catch {}
+            evt("fallback", { reqId, from: model, to: order[idx + 1] ?? null, reason: `terminal ${verdict.kind}: ${upMsg.slice(0, 80)}` });
+            continue candidate;
+          }
+          // 收场交回既有出口：exhaustedLocal 见 lastErr.upstream 会 relay **原响应**（原状态码 + 原字节 +
+          // 原头），并自带 logCall / result / client-response / talk 语料落盘。自己 json() 反而劣化：
+          // 只能给被截到 400 字的二手摘要、JSON.parse 失败时退成字符串 error（SDK 读 err.error.message
+          // 拿到 undefined），且 SSE 已 flush 时 helpers 的 in-band 错误帧会把对象写成 [object Object]。
+          await exhaustedLocal({ res, body, lastErr, order, handlerCtx: { ...handlerCtx, model, reqId }, evt, logCall, mark, perf0, stages, done, requested, useAuto });
+          return { done: true };
+        }
         upRes = null;
         break;
       }