oasis_test_v2 2.2.71 → 2.2.73

package/dist/index.js

@@ -845,6 +845,18 @@ var init_runtime = __esm({
   }
 });
 
+// ../contract/src/runtime-allocation.ts
+var RUNTIME_FAULT_PROBE_MAX_INTERVAL_MS, RUNTIME_FAULT_PROBE_MAX_TOTAL_MS, RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT, RUNTIME_ALLOCATION_MAX_ATTEMPTS;
+var init_runtime_allocation = __esm({
+  "../contract/src/runtime-allocation.ts"() {
+    "use strict";
+    RUNTIME_FAULT_PROBE_MAX_INTERVAL_MS = 30 * 6e4;
+    RUNTIME_FAULT_PROBE_MAX_TOTAL_MS = 6 * 60 * 6e4;
+    RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT = 60;
+    RUNTIME_ALLOCATION_MAX_ATTEMPTS = 3;
+  }
+});
+
 // ../contract/src/handle-passthrough.ts
 function makePassthroughProxy(spec) {
   const overrides = spec.overrides ?? {};
@@ -2260,6 +2272,7 @@ var init_src = __esm({
     init_storage();
     init_avatar();
     init_runtime();
+    init_runtime_allocation();
     init_handle_passthrough();
     init_parse_extra_args();
     init_daemon_package();
@@ -6688,22 +6701,28 @@ function readCodexTokenCountLine(line2) {
     ...total ? { total } : {}
   };
 }
+function readCodexTurnContextModel(line2) {
+  if (!line2 || line2.indexOf("turn_context") === -1) return void 0;
+  let o;
+  try {
+    o = JSON.parse(line2);
+  } catch {
+    return void 0;
+  }
+  if (o?.type !== "turn_context") return void 0;
+  return typeof o.payload?.model === "string" && o.payload.model ? o.payload.model : void 0;
+}
 function parseCodexModel(lines) {
   let model;
-  for (const line2 of lines) {
-    if (!line2 || line2.indexOf("turn_context") === -1) continue;
-    let o;
-    try {
-      o = JSON.parse(line2);
-    } catch {
-      continue;
-    }
-    if (o?.type === "turn_context" && typeof o.payload?.model === "string" && o.payload.model) {
-      model = o.payload.model;
-    }
-  }
+  for (const line2 of lines) model = readCodexTurnContextModel(line2) ?? model;
   return model;
 }
+function pickCodexModel(sources) {
+  for (const candidate of [sources.rollout, sources.thread, sources.requested]) {
+    if (typeof candidate === "string" && candidate.trim().length > 0) return candidate;
+  }
+  return void 0;
+}
 function codexSessionsRoot() {
   const candidates = [];
   const ch = process.env["CODEX_HOME"];
@@ -7031,7 +7050,7 @@ function codexTurnErrorMessage(value2) {
   const detail = typeof error2?.additionalDetails === "string" ? error2.additionalDetails.trim() : "";
   return [summary, detail].filter(Boolean).join("\n").slice(0, 4e3);
 }
-var import_node_child_process7, import_node_crypto9, fs8, os6, path10, readline2, CODEX_BLOCKED_FLAGS, CODEX_ARGV_PROMPT_MAX_BYTES, CodexRolloutUsageTail, CODEX_APP_SERVER_BLOCKED_FLAGS, CodexAdapter;
+var import_node_child_process7, import_node_crypto9, fs8, os6, path10, readline2, CODEX_BLOCKED_FLAGS, CODEX_ARGV_PROMPT_MAX_BYTES, CodexRolloutLineTail, CodexRolloutUsageTail, CodexRolloutModelTail, CODEX_APP_SERVER_BLOCKED_FLAGS, CodexAdapter;
 var init_codex = __esm({
   "../adapters/src/codex/index.ts"() {
     "use strict";
@@ -7069,25 +7088,21 @@ var init_codex = __esm({
       // Multica 实证：codex --listen stdio:// 是 daemon↔CLI 传输协议；改会断链
     ]);
     CODEX_ARGV_PROMPT_MAX_BYTES = 1e5;
-    CodexRolloutUsageTail = class {
-      constructor(file, sinceMs) {
+    CodexRolloutLineTail = class {
+      constructor(file) {
         this.file = file;
-        this.sinceMs = sinceMs;
       }
       offset = 0;
       rest = "";
-      acc = { input: 0, cacheRead: 0, cacheWrite: 0, output: 0 };
-      saw = false;
-      /** 读新追加的行，返回当前窗内累计；还没有任何窗内轮次返回 undefined。读失败抛给调用方（调用方吞）。 */
-      poll() {
+      /** 读新追加的整行逐行回调；文件被截短时先回调 onReset 再从头读。读失败抛给调用方（调用方吞）。 */
+      read(onLine, onReset) {
         const fd = fs8.openSync(this.file, "r");
         try {
           const size = fs8.fstatSync(fd).size;
           if (size < this.offset) {
             this.offset = 0;
             this.rest = "";
-            this.saw = false;
-            this.acc.input = this.acc.cacheRead = this.acc.cacheWrite = this.acc.output = 0;
+            onReset?.();
           }
           if (size > this.offset) {
             const buf = Buffer.alloc(size - this.offset);
@@ -7096,19 +7111,62 @@ var init_codex = __esm({
             const text7 = this.rest + buf.subarray(0, n).toString("utf8");
             const lines = text7.split("\n");
             this.rest = lines.pop() ?? "";
-            for (const line2 of lines) {
-              const row = readCodexTokenCountLine(line2);
-              if (!row?.turn || !Number.isFinite(row.ts) || row.ts < this.sinceMs) continue;
-              addCodexBuckets(this.acc, row.turn);
-              this.saw = true;
-            }
+            for (const line2 of lines) onLine(line2);
           }
         } finally {
           fs8.closeSync(fd);
         }
+      }
+    };
+    CodexRolloutUsageTail = class {
+      constructor(file, sinceMs) {
+        this.file = file;
+        this.sinceMs = sinceMs;
+        this.tail = new CodexRolloutLineTail(file);
+      }
+      tail;
+      acc = { input: 0, cacheRead: 0, cacheWrite: 0, output: 0 };
+      saw = false;
+      lastModel;
+      /** 截至目前读到的**最后一条** `turn_context` 模型（与终值的 {@link parseCodexModel} 同判据）。 */
+      get model() {
+        return this.lastModel;
+      }
+      /** 读新追加的行，返回当前窗内累计；还没有任何窗内轮次返回 undefined。读失败抛给调用方（调用方吞）。 */
+      poll() {
+        this.tail.read((line2) => {
+          const model = readCodexTurnContextModel(line2);
+          if (model) this.lastModel = model;
+          const row = readCodexTokenCountLine(line2);
+          if (!row?.turn || !Number.isFinite(row.ts) || row.ts < this.sinceMs) return;
+          addCodexBuckets(this.acc, row.turn);
+          this.saw = true;
+        }, () => {
+          this.saw = false;
+          this.lastModel = void 0;
+          this.acc.input = this.acc.cacheRead = this.acc.cacheWrite = this.acc.output = 0;
+        });
         return this.saw ? usageFromBuckets(this.acc) : void 0;
       }
     };
+    CodexRolloutModelTail = class {
+      constructor(file) {
+        this.file = file;
+        this.tail = new CodexRolloutLineTail(file);
+      }
+      tail;
+      lastModel;
+      /** 追读新行，返回截至目前**最后一条** `turn_context` 记的模型。读失败抛给调用方（调用方吞）。 */
+      poll() {
+        this.tail.read((line2) => {
+          const model = readCodexTurnContextModel(line2);
+          if (model) this.lastModel = model;
+        }, () => {
+          this.lastModel = void 0;
+        });
+        return this.lastModel;
+      }
+    };
     CODEX_APP_SERVER_BLOCKED_FLAGS = /* @__PURE__ */ new Map([
       ["app-server", "boolean"],
       ["--stdio", "boolean"],
@@ -7169,7 +7227,12 @@ var init_codex = __esm({
             // 只能从 resume 的响应里取（同上实测）。取不到它就读不到实际模型。
             rolloutPath: void 0,
             // thread/start / thread/resume 响应里 codex 报的线程模型：rollout 读不到时的兜底。
-            threadModel: void 0
+            threadModel: void 0,
+            // 运行中检查点的模型来源（Bug 0227）：增量追读会话卷里逐轮记的实际模型。卷路径就位后才建。
+            rolloutModelTail: void 0,
+            rolloutModel: void 0,
+            // 上一次报出去的用量指纹：只在用量真的变了的那一拍才去碰磁盘（runningUsage 每条协议消息都被调到）。
+            lastUsageKey: ""
           }),
           initialCommand: () => ({
             jsonrpc: "2.0",
@@ -7311,14 +7374,14 @@ ${task}` : task;
           },
           runtimeSessionId: (state) => state.threadId,
           exitExtras: (state) => {
-            let model;
+            let fromRollout;
             if (state.rolloutPath) {
               try {
-                model = parseCodexModel(fs8.readFileSync(state.rolloutPath, "utf8").split("\n"));
+                fromRollout = parseCodexModel(fs8.readFileSync(state.rolloutPath, "utf8").split("\n"));
               } catch {
               }
             }
-            model ??= state.threadModel ?? resolvedModel2;
+            const model = pickCodexModel({ rollout: fromRollout ?? state.rolloutModel, thread: state.threadModel, requested: resolvedModel2 });
             const usage = codexRunUsage(state.usageByTurn, state.runTurnIds);
             return {
               ...usage ? { usage } : {},
@@ -7331,7 +7394,18 @@ ${task}` : task;
           runningUsage: (state) => {
             const usage = codexRunUsage(state.usageByTurn, state.runTurnIds);
             if (!usage) return void 0;
-            const model = state.threadModel ?? resolvedModel2;
+            const key2 = JSON.stringify(usage);
+            if (key2 !== state.lastUsageKey) {
+              state.lastUsageKey = key2;
+              if (state.rolloutPath) {
+                state.rolloutModelTail ??= new CodexRolloutModelTail(state.rolloutPath);
+                try {
+                  state.rolloutModel = state.rolloutModelTail.poll() ?? state.rolloutModel;
+                } catch {
+                }
+              }
+            }
+            const model = pickCodexModel({ rollout: state.rolloutModel, thread: state.threadModel, requested: resolvedModel2 });
             return { usage, ...model ? { model } : {} };
           },
           async append(input, state, send) {
@@ -7563,7 +7637,7 @@ ${task}` : task;
             const key2 = usage ? JSON.stringify(usage) : "";
             if (!usage || key2 === lastUsageKey) return;
             lastUsageKey = key2;
-            const model = job.model ?? this.opts.model;
+            const model = pickCodexModel({ rollout: usageTail.model, requested: job.model ?? this.opts.model });
             for (const cb of usageCheckpointCbs) cb({ usage, ...model ? { model } : {} });
           } catch {
           }
@@ -7615,7 +7689,7 @@ ${task}` : task;
           clearTimeout(timer);
           const resumeSessionId = job.resumeRuntimeSession ? job.runtimeSessionId : void 0;
           const telemetry = scanCodexTelemetry(dir, startedAtMs, codexSessionsRoot(), job.runtimeSessionId);
-          const model = telemetry.model ?? job.model ?? this.opts.model;
+          const model = pickCodexModel({ rollout: telemetry.model, requested: job.model ?? this.opts.model });
           const runtimeSessionId = telemetry.sessionId ?? resumeSessionId;
           const sawStreamError = streamErrorMessages.length > 0;
           const isError = !killReason && (code2 !== 0 || sawStreamError);
@@ -136709,7 +136783,7 @@ var init_bus = __esm({
           notify: (ids2, payload2) => this.io.notify(ids2, payload2)
         };
         let ok3 = true;
-        let failureReason = null;
+        let failureReason2 = null;
         for (const h of handlers) {
           const effectKey = `${h.name}#effect`;
           if (record9.appliedAt && await this.store.transaction((tx) => tx.isHandlerDone(record9.seq, effectKey))) {
@@ -136732,7 +136806,7 @@ var init_bus = __esm({
               await this.store.transaction((tx) => tx.deferEvent(record9.seq, "applied", lastErr, this.retryAt()));
               return false;
             }
-            failureReason = lastErr;
+            failureReason2 = lastErr;
           } else {
             await this.store.transaction(async (tx) => {
               if (buffered.length) await tx.appendEvents(buffered.map((b2) => ({
@@ -136751,7 +136825,7 @@ var init_bus = __esm({
             });
           }
         }
-        await this.store.transaction((tx) => tx.markEvent(record9.seq, "done", failureReason, this.clock.now()));
+        await this.store.transaction((tx) => tx.markEvent(record9.seq, "done", failureReason2, this.clock.now()));
         return ok3;
       }
       /* ═══════════════════════ scan：唯一的调度入口 ═══════════════════════ */
@@ -142279,7 +142353,10 @@ var init_dispatcher = __esm({
        * 画板只服务于「产界面」，评审/回复/收口回到能真正读写、能投票的通用运行时。
        */
       async resolveBindingFor(spec) {
-        const binding = await this.opts.resolveBinding?.(spec.actor) ?? void 0;
+        const binding = await this.opts.resolveBinding?.(spec.actor, {
+          ...spec.artifactId ? { unitOfWork: spec.artifactId } : {},
+          action: spec.action
+        }) ?? void 0;
         if (binding && spec.action !== "produce" && binding.runtimeKind === CANVAS_RUNTIME_KIND) {
           return { ...binding, runtimeKind: NON_PRODUCE_FALLBACK_RUNTIME_KIND };
         }
@@ -165111,9 +165188,24 @@ var init_live_chat = __esm({
         }
         if (turn.status === "running") {
           turn.cancelCause = "user";
-          try {
-            turn.handle.kill();
-          } catch {
+          const sendKill = turn.handle.sendKill;
+          if (typeof sendKill === "function") {
+            let sent = false;
+            try {
+              sent = sendKill.call(turn.handle);
+            } catch {
+            }
+            if (!sent) {
+              try {
+                turn.handle.cancelLocally?.();
+              } catch {
+              }
+            }
+          } else {
+            try {
+              turn.handle.kill();
+            } catch {
+            }
           }
         }
         return { stopped: true };
@@ -213390,6 +213482,9 @@ ${composed}`;
                     kill: () => {
                       void session.kill?.();
                     },
+                    // Bug 0232：把「帧送没送出去 / 就地收尾」这对出口透到注册表，`/stop` 才判得了。
+                    // 条件透传不是省事：上层按「方法在不在」分流，本地 adapter 没有这条就该没有。
+                    ...typeof session.sendKill === "function" ? { sendKill: () => session.sendKill(), cancelLocally: () => session.cancelLocally?.() ?? false } : {},
                     // ADR-0093 chat 道：把插入能力透到注册表，POST …/append 才有得调。
                     ...typeof session.appendInput === "function" ? { appendInput: (input) => session.appendInput(input) } : {},
                     get canAppendInput() {
@@ -215320,6 +215415,7 @@ var init_memory_registry_store = __esm({
       agentPrefs = /* @__PURE__ */ new Map();
       teams = /* @__PURE__ */ new Map();
       bindings = /* @__PURE__ */ new Map();
+      runtimeCandidates = /* @__PURE__ */ new Map();
       runtimeConfigs = /* @__PURE__ */ new Map();
       runtimeModelOverrides = /* @__PURE__ */ new Map();
       // key: ${runtimeId}::${modelId}
@@ -215421,6 +215517,28 @@ var init_memory_registry_store = __esm({
       async listBindings() {
         return [...this.bindings.values()].map((b2) => ({ ...b2 }));
       }
+      /* 候选 runtime（ADR 0616）：与 PG 实现同一套语义——按 ord 升序读、整份替换、同 (node,kind) 去重。 */
+      async listRuntimeCandidates(actorId) {
+        return (this.runtimeCandidates.get(actorId) ?? []).map((c) => ({ ...c }));
+      }
+      async replaceRuntimeCandidates(actorId, candidates) {
+        const seen = /* @__PURE__ */ new Set();
+        const rows = [];
+        for (const c of candidates) {
+          const key2 = `${c.nodeId}::${c.runtimeKind}`;
+          const model = typeof c.model === "string" && c.model.trim() ? c.model.trim() : null;
+          const existing = rows.findIndex((r) => `${r.nodeId}::${r.runtimeKind}` === key2);
+          if (existing >= 0) {
+            rows[existing] = { ...rows[existing], model };
+            continue;
+          }
+          seen.add(key2);
+          rows.push({ actorId, nodeId: c.nodeId, runtimeKind: c.runtimeKind, model, ord: rows.length });
+        }
+        if (rows.length === 0) this.runtimeCandidates.delete(actorId);
+        else this.runtimeCandidates.set(actorId, rows);
+        return rows.map((c) => ({ ...c }));
+      }
       async upsertRuntimeConfig(c) {
         this.runtimeConfigs.set(c.runtimeId, { ...c });
       }
@@ -216136,7 +216254,9 @@ function systemHandoffFor(run, checkpoint = null, effects2 = []) {
     // 与 PG 触发器同口径（2026-08-18）：risks / verificationGaps 只装业务语义的东西。会话怎么死的
     // 已在 summary 的 reason= 段里，不再冒充成「交付物的风险」；「没有断点」也不是「验证缺口」。
     risks: pendingEffects || failedEffects ? [`external effects: pending=${pendingEffects}, failed=${failedEffects}`] : [],
-    nextActions: structuredClone(checkpoint?.pendingSteps ?? []),
+    // 与 PG 触发器同口径（2026-09-23）：nextActions 是「下游怎么用这份成果」，不拿 pendingSteps
+    //（执行人自己没做完的活）兜底——兜底会让下游交接出现 `[next] 提交并结案` 这种假的「上游建议」。
+    nextActions: [],
     verificationGaps: [],
     userHandoff: null,
     createdAt: run.endedAt ?? run.updatedAt ?? (/* @__PURE__ */ new Date()).toISOString()
@@ -222577,6 +222697,20 @@ var init_company_scoped_registry = __esm({
       async getBinding(actorId) {
         return await this.assertScoped(actorId, "getBinding") ? this.base.getBinding(actorId) : null;
       }
+      /* 候选 runtime（ADR 0616）：与 binding 同一道租户闸——越界读回空、越界写抛。
+      
+           刻意**不**按 `this.base` 有没有这两个方法来决定自己有没有（那样得写成类字段，而类字段的初始化
+           早于构造参数属性赋值，`this.base` 在那一刻还是 undefined）。底座没实现时：读回空、写抛一句
+           指名道姓的错——比静默丢掉一份候选清单强。 */
+      async listRuntimeCandidates(actorId) {
+        if (!this.base.listRuntimeCandidates) return [];
+        return await this.assertScoped(actorId, "listRuntimeCandidates") ? this.base.listRuntimeCandidates(actorId) : [];
+      }
+      async replaceRuntimeCandidates(actorId, candidates) {
+        await this.requireScoped(actorId, "replaceRuntimeCandidates");
+        if (!this.base.replaceRuntimeCandidates) throw new Error("\u5F53\u524D\u767B\u8BB0\u5B58\u50A8\u5B9E\u73B0\u4E0D\u652F\u6301\u5019\u9009\u8FD0\u884C\u65F6\uFF08replaceRuntimeCandidates \u672A\u5B9E\u73B0\uFF09");
+        return this.base.replaceRuntimeCandidates(actorId, candidates);
+      }
       async listBindings() {
         const [all2, ids2] = await Promise.all([this.base.listBindings(), this.scopeIds()]);
         const actors = [];
@@ -224789,9 +224923,15 @@ function createUsageLedgerResolver(deps) {
     return chatCid ? { runId: stable, store: await deps.storeFor(chatCid) } : null;
   };
 }
+function hasModelName(model) {
+  return typeof model === "string" && model.trim().length > 0;
+}
+function frameTokenTotal(usage) {
+  return (usage.inputTokens ?? 0) + (usage.outputTokens ?? 0) + (usage.cacheReadTokens ?? 0) + (usage.cacheCreationTokens ?? 0);
+}
 async function backfillRunModel(target, run, model, warn) {
-  if (!model || model.trim().length === 0) return;
-  if (run.effectiveModel && run.effectiveModel.trim().length > 0) return;
+  if (!hasModelName(model)) return;
+  if (hasModelName(run.effectiveModel)) return;
   try {
     await target.store.updateRun(target.runId, { effectiveModel: model, modelSource: "runtime" });
   } catch (err) {
@@ -224808,6 +224948,13 @@ function createUsageLedgerFrameHandler(deps) {
     settledDispatch.add(dispatchId);
     if (settledDispatch.size > 1e4) settledDispatch.delete(settledDispatch.values().next().value);
   };
+  const modelless = /* @__PURE__ */ new Set();
+  const notedModelless = (runId) => {
+    if (modelless.has(runId)) return true;
+    modelless.add(runId);
+    if (modelless.size > 1e4) modelless.delete(modelless.values().next().value);
+    return false;
+  };
   return async (msg) => {
     if (!RUNTIME_START_FRAME_TYPES.has(msg.type)) return;
     const dispatchId = msg.dispatchId;
@@ -224850,6 +224997,12 @@ function createUsageLedgerFrameHandler(deps) {
         warn(`[usage-ledger] session_usage dispatch=${dispatchId} usageSeq=${String(msg.usageSeq)} \u975E\u6CD5\uFF0C\u4E22\u5F03`);
         return;
       }
+      if (!hasModelName(msg.model) && !hasModelName(run.effectiveModel)) {
+        const tokens2 = frameTokenTotal(msg.usage);
+        if (tokens2 > 0 && !notedModelless(target.runId)) {
+          warn(`[usage-ledger] session_usage dispatch=${dispatchId} \u2192 run ${target.runId} \u5E26\u7740 ${tokens2} \u4E2A token \u5374\u6CA1\u6709\u6A21\u578B\u540D\uFF08run \u884C\u4E5F\u662F\u7A7A\u7684\uFF09\uFF0C\u8FD9\u6BB5\u7528\u91CF\u53EA\u80FD\u5F52\u8FDB\u300C\u672A\u77E5\u6A21\u578B\u300D`);
+        }
+      }
       await target.store.recordUsagePoint({
         runId: target.runId,
         seq: msg.usageSeq,
@@ -225722,6 +225875,8 @@ function wireRecoveredChatTurn(deps) {
     kill: () => {
       void handle.kill();
     },
+    // Bug 0232：重挂的轮一样会被人点停止、一样可能撞上节点够不着——同一对出口原样透传。
+    ...typeof handle.sendKill === "function" ? { sendKill: () => handle.sendKill(), cancelLocally: () => handle.cancelLocally?.() ?? false } : {},
     // ADR-0093 chat 道：重挂的轮同样能被插入——否则「serve 重启过」会变成一条人看不见的能力差异。
     // **整份透传**（2026-09-17）：此前只转 `text`，插话链路要的消费回执（`requireConsumptionReceipt`）、
     // 幂等键（`clientMessageKey`）与附件（`files` / `binaryFiles`）全被剥掉——runtime 照样读到了正文，
@@ -228318,6 +228473,32 @@ var init_service5 = __esm({
       listBindings() {
         return this.opts.store.listBindings();
       }
+      /* ---------- 候选 runtime（ADR 0616） ---------- */
+      /** 按 `ord` 升序。底座没实现（旧存储实现）→ 空清单，等于「只有主绑定」。 */
+      listRuntimeCandidates(actorId) {
+        return this.opts.store.listRuntimeCandidates?.(actorId) ?? Promise.resolve([]);
+      }
+      /**
+       * 整份替换候选清单（加 / 删 / 排序在界面上是同一个动作）。返回写后的整份。
+       *
+       * 校验放在这里而不是路由：候选是「派到哪」的事实源，写进去的 `(nodeId, runtimeKind)`
+       * 必须真的存在于这家公司的名册上——否则分配那一侧只会在几个月后的某次主机故障里，
+       * 报一句「节点不存在」然后把活挂住，而错是在写入那一刻犯的。
+       */
+      async replaceRuntimeCandidates(actorId, candidates, by) {
+        if (!this.opts.store.replaceRuntimeCandidates) {
+          throw new Error("\u5F53\u524D\u767B\u8BB0\u5B58\u50A8\u5B9E\u73B0\u4E0D\u652F\u6301\u5019\u9009\u8FD0\u884C\u65F6");
+        }
+        const saved = await this.opts.store.replaceRuntimeCandidates(actorId, candidates);
+        await this.audit({
+          kind: "binding_change",
+          actorId,
+          by,
+          at: this.now(),
+          detail: { candidates: saved.map((c) => ({ nodeId: c.nodeId, runtimeKind: c.runtimeKind, model: c.model ?? null })) }
+        });
+        return saved;
+      }
       /** 派单接缝的真实现：替换第零步假实现，第三部分代码零改动（决策 0001） */
       resolveBinding() {
         return async (actorId) => {
@@ -230767,6 +230948,42 @@ function actorsDomain(opts) {
       );
       return { status: 201, body: cfg };
     });
+    router.get("/api/actors/:id/runtime-candidates", async (req) => {
+      const { service } = await resolveCtx(req.auth.companyId);
+      return { status: 200, body: { items: await service.listRuntimeCandidates(req.params.id) } };
+    });
+    router.put("/api/actors/:id/runtime-candidates", async (req) => {
+      const { service } = await resolveCtx(req.auth.companyId);
+      const actorId = req.params.id;
+      if (!await service.getActor(actorId)) throw new ApiError(404, "NOT_FOUND", "\u6CA1\u6709\u8FD9\u4E2A\u5458\u5DE5");
+      const raw = req.body?.candidates;
+      if (!Array.isArray(raw)) throw new ApiError(400, "BAD_REQUEST", "candidates \u5FC5\u987B\u662F\u6570\u7EC4");
+      if (raw.length > 20) throw new ApiError(400, "BAD_REQUEST", "\u5019\u9009\u8FD0\u884C\u65F6\u6700\u591A 20 \u6761");
+      const candidates = [];
+      for (const item of raw) {
+        const c = item;
+        if (typeof c.nodeId !== "string" || !c.nodeId.trim()) throw new ApiError(400, "BAD_REQUEST", "\u6BCF\u6761\u5019\u9009\u90FD\u8981\u6709 nodeId");
+        if (typeof c.runtimeKind !== "string" || !c.runtimeKind.trim()) throw new ApiError(400, "BAD_REQUEST", "\u6BCF\u6761\u5019\u9009\u90FD\u8981\u6709 runtimeKind");
+        if (c.model !== void 0 && c.model !== null && typeof c.model !== "string") {
+          throw new ApiError(400, "BAD_REQUEST", "model \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u6216 null\uFF08null = \u8DDF\u968F\u8BE5 runtime \u9ED8\u8BA4\uFF09");
+        }
+        candidates.push({
+          nodeId: c.nodeId.trim(),
+          runtimeKind: c.runtimeKind.trim(),
+          ...c.model === void 0 ? {} : { model: typeof c.model === "string" ? c.model : null }
+        });
+      }
+      if (opts.resolveNodeTenancy) {
+        for (const c of candidates) {
+          const facts = await opts.resolveNodeTenancy(c.nodeId).catch(() => null) ?? null;
+          const foreign = foreignNodeBlock(facts, req.auth.companyId);
+          if (foreign) throw new ApiError(400, "NODE_NOT_IN_COMPANY", foreign);
+          if (!facts) throw new ApiError(400, "NODE_NOT_FOUND", `\u627E\u4E0D\u5230\u8282\u70B9 ${c.nodeId}`);
+        }
+      }
+      const items = await service.replaceRuntimeCandidates(actorId, candidates, req.auth.actor);
+      return { status: 200, body: { items } };
+    });
     router.get("/api/actors/:id/config/versions", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listConfigVersions(req.params.id) } };
@@ -242816,7 +243033,7 @@ var init_runtime_activity = __esm({
 
 // ../server/src/node-health.ts
 function deriveNodeHealth(input) {
-  const staleMs = input.staleMs ?? 9e4;
+  const staleMs = input.staleMs ?? NODE_HEARTBEAT_STALE_MS;
   const maxFail = input.maxConsecutiveFailures ?? 3;
   const cf = input.snapshot?.consecutiveFailures ?? 0;
   const heartbeatFresh = input.lastHeartbeatMs !== void 0 && input.now - input.lastHeartbeatMs < staleMs;
@@ -242875,7 +243092,7 @@ function describeNodeFault(f2, now = Date.now()) {
     `\u5728\u90A3\u4E4B\u524D\uFF0C\u91CD\u8BD5\u3001\u6362\u4EBA\u3001\u6539\u5185\u5BB9\u90FD\u4E0D\u4F1A\u8BA9\u5B83\u53D8\u597D\u3002`
   ].join("");
 }
-var NodeHealthTracker;
+var NodeHealthTracker, NODE_HEARTBEAT_STALE_MS;
 var init_node_health = __esm({
   "../server/src/node-health.ts"() {
     "use strict";
@@ -242917,6 +243134,7 @@ var init_node_health = __esm({
         this.onChange?.();
       }
     };
+    NODE_HEARTBEAT_STALE_MS = 9e4;
   }
 });
 
@@ -242952,6 +243170,15 @@ async function resolveRuntimeModels(deps, runtimeId) {
 }
 function nodesDomain(deps) {
   const quotaByNode = /* @__PURE__ */ new Map();
+  void deps.nodeStore.listRuntimeQuotas().then((rows) => {
+    for (const row of rows) {
+      if (row.runtimeKind !== "codex" && row.runtimeKind !== "claude-code") continue;
+      const list2 = quotaByNode.get(row.nodeId) ?? [];
+      list2.push({ kind: row.runtimeKind, status: row.status, checkedAt: row.checkedAt, windows: row.windows, ...row.retryAt ? { retryAt: row.retryAt } : {} });
+      quotaByNode.set(row.nodeId, list2);
+    }
+    if (rows.length > 0) console.log(`[nodes] \u989D\u5EA6\u6C34\u5408\uFF1A\u4ECE\u5E93\u91CC\u8BFB\u56DE ${rows.length} \u6761\u8FD0\u884C\u65F6\u989D\u5EA6`);
+  }).catch((err) => console.warn(`[nodes] \u989D\u5EA6\u6C34\u5408\u5931\u8D25\uFF08\u7167\u65E7\u7B49\u4E0B\u4E00\u6B21\u91C7\u96C6\uFF09\uFF1A${err instanceof Error ? err.message : String(err)}`));
   const UPDATE_TIMEOUT_MS = 15e4;
   const nodeUpdates = /* @__PURE__ */ new Map();
   function runtimeInfoOf(r) {
@@ -243052,7 +243279,9 @@ function nodesDomain(deps) {
       if (msg.type !== "runtime_quotas") return;
       const daemon = hub.connectedDaemons().find((d) => d.daemonId === daemonId);
       if (!daemon) return;
-      quotaByNode.set(daemonId, sanitizeRuntimeQuotas(msg.quotas).filter((q2) => daemon.meta.adapters.includes(q2.kind)));
+      const quotas = sanitizeRuntimeQuotas(msg.quotas).filter((q2) => daemon.meta.adapters.includes(q2.kind));
+      quotaByNode.set(daemonId, quotas);
+      void nodeStore.saveRuntimeQuotas(daemonId, quotas.map((q2) => ({ ...q2, nodeId: daemonId, runtimeKind: q2.kind }))).catch((err) => console.warn(`[nodes] \u989D\u5EA6\u843D\u5E93\u5931\u8D25(node=${daemonId})\uFF1A${err instanceof Error ? err.message : String(err)}`));
     });
     hub.addMessageListener(async (daemonId, msg) => {
       if (msg.type !== "hello") return;
@@ -243204,6 +243433,10 @@ function nodesDomain(deps) {
           ...sourceIpById.get(n.id) ? { sourceIp: sourceIpById.get(n.id) } : {},
           ...n.name ? { name: n.name } : {},
           ...updateStatus ? { updateStatus } : {},
+          /* 并发上限与当前在跑数（ADR 0616 D2）：`maxConcurrent` 只在真设过时带这一格——
+             缺省就是「未设置 = 不限制」，带一个 null 进去会让前端不得不再判一次。 */
+          ...n.maxConcurrent != null ? { maxConcurrent: n.maxConcurrent } : {},
+          activeRunCount,
           ...lastDisconnectedAt || lastReconnectedAt ? {
             connection: {
               ...lastDisconnectedAt ? { lastDisconnectedAt } : {},
@@ -243403,6 +243636,24 @@ function nodesDomain(deps) {
       deps.onStatusChange?.();
       return { status: 200, body: { ok: true, name } };
     });
+    router.put("/api/nodes/:nodeId/max-concurrent", async (req) => {
+      const nodeId = req.params["nodeId"];
+      if (!nodeId) return { status: 400, body: { error: "missing nodeId" } };
+      const forbidden = await forbidUnlessOrgManager(req, "\u8BBE\u7F6E\u8282\u70B9\u5E76\u53D1\u4E0A\u9650");
+      if (forbidden) return forbidden;
+      const scope2 = req.auth.companyId !== void 0 ? { companyId: req.auth.companyId } : void 0;
+      const node2 = (await deps.nodeStore.listNodes(scope2)).find((n) => n.id === nodeId);
+      if (!node2) return { status: 404, body: { error: "NODE_NOT_FOUND", message: "\u8282\u70B9\u4E0D\u5B58\u5728\u6216\u4E0D\u5C5E\u4E8E\u5F53\u524D\u7EC4\u7EC7" } };
+      const raw = req.body ?? {};
+      const value2 = raw.maxConcurrent;
+      if (value2 !== null && value2 !== void 0 && !(Number.isSafeInteger(value2) && value2 >= 0 && value2 <= 1e3)) {
+        return { status: 400, body: { error: "BAD_REQUEST", message: "maxConcurrent \u5FC5\u987B\u662F 0\u20131000 \u7684\u6574\u6570\uFF0C\u6216 null\uFF08\u4E0D\u9650\u5236\uFF09" } };
+      }
+      const limit = value2 === void 0 || value2 === null ? null : value2;
+      await deps.nodeStore.setNodeMaxConcurrent(nodeId, limit);
+      deps.onStatusChange?.();
+      return { status: 200, body: { ok: true, maxConcurrent: limit } };
+    });
     router.delete("/api/nodes/:nodeId", async (req) => {
       const nodeId = req.params["nodeId"];
       if (!nodeId) return { status: 400, body: { error: "missing nodeId" } };
@@ -243624,6 +243875,353 @@ var init_runtime_drift = __esm({
   }
 });
 
+// ../server/src/domains/runtime-allocation/allocate.ts
+function runtimeTargetKey(target) {
+  return `${target.nodeId}::${target.runtimeKind}`;
+}
+function idlenessOf(node2) {
+  const limit = node2.maxConcurrent;
+  if (limit === null || limit === void 0) return 1;
+  if (limit <= 0) return 0;
+  return Math.max(0, 1 - node2.activeRunCount / limit);
+}
+function atCapacity(node2) {
+  const limit = node2.maxConcurrent;
+  if (limit === null || limit === void 0) return false;
+  return node2.activeRunCount >= limit;
+}
+function quotaDerateFactor(quota) {
+  if (!quota || quota.status !== "ok" || quota.windows.length === 0) return { factor: 1 };
+  const worst = Math.max(...quota.windows.map((w2) => w2.usedPercent));
+  if (worst <= RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT) return { factor: 1, worstUsedPercent: worst };
+  const remaining = Math.max(0, 100 - worst);
+  return { factor: remaining / (100 - RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT), worstUsedPercent: worst };
+}
+function faultFromQuota(target, quota, now) {
+  if (!quota) return null;
+  const base = { nodeId: target.nodeId, runtimeKind: target.runtimeKind, markedAt: quota.checkedAt, attempts: 0 };
+  if (quota.status === "unauthenticated") {
+    return { ...base, reason: "unauthenticated", awaitingManual: true, detail: "\u8FD0\u884C\u65F6\u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u9700\u8981\u5728\u8BE5\u673A\u5668\u4E0A\u91CD\u65B0\u767B\u5F55" };
+  }
+  if (quota.status === "rate_limited") {
+    return {
+      ...base,
+      reason: "quota-exhausted",
+      awaitingManual: false,
+      ...quota.retryAt ? { nextProbeAt: quota.retryAt } : {},
+      detail: "provider \u62A5\u9650\u6D41/\u989D\u5EA6\u8017\u5C3D"
+    };
+  }
+  if (quota.status !== "ok") return null;
+  const exhausted = quota.windows.filter((w2) => w2.usedPercent >= 100);
+  if (exhausted.length === 0) return null;
+  const resets = exhausted.map((w2) => w2.resetsAt).filter((v2) => Boolean(v2)).sort();
+  const latest = resets.at(-1);
+  return {
+    ...base,
+    reason: "quota-exhausted",
+    awaitingManual: false,
+    ...latest && Date.parse(latest) > now ? { nextProbeAt: latest } : {},
+    detail: `\u989D\u5EA6\u5DF2\u7528\u6EE1\uFF08${exhausted.map((w2) => `${w2.bucket} ${Math.round(w2.usedPercent)}%`).join("\u3001")}\uFF09`
+  };
+}
+function faultIsBlocking(fault, now) {
+  if (fault.awaitingManual) return true;
+  if (!fault.nextProbeAt) return true;
+  return Date.parse(fault.nextProbeAt) > now;
+}
+function failureReason(rejections) {
+  if (rejections.length === 0) return "no-candidates";
+  const causes = new Set(rejections.map((r) => r.cause));
+  if (causes.size === 1) {
+    const only = [...causes][0];
+    if (only === "at-capacity") return "all-at-capacity";
+    if (only === "already-tried") return "all-tried";
+    return "all-faulted";
+  }
+  const faultLike = /* @__PURE__ */ new Set(["node-unknown", "node-offline", "runtime-missing", "faulted"]);
+  if ([...causes].every((c) => faultLike.has(c))) return "all-faulted";
+  return "mixed";
+}
+function allocateRuntime(input, now = Date.now()) {
+  const rejections = [];
+  const eligible = [];
+  for (const candidate of input.candidates) {
+    const key2 = runtimeTargetKey(candidate);
+    const node2 = input.nodes.get(candidate.nodeId);
+    const nodeName = node2?.displayName?.trim() || candidate.nodeId;
+    const reject = (cause, detail) => rejections.push({ nodeId: candidate.nodeId, runtimeKind: candidate.runtimeKind, nodeName, cause, ...detail ? { detail } : {} });
+    if (input.alreadyTried?.has(key2)) {
+      reject("already-tried", input.triedDetail?.get(key2) ?? "\u672C\u6B21\u5DF2\u8BD5\u8FC7\u5E76\u5931\u8D25");
+      continue;
+    }
+    if (!node2) {
+      reject("node-unknown", "\u8282\u70B9\u4E0D\u5B58\u5728\u3001\u5DF2\u5220\u9664\uFF0C\u6216\u4E0D\u5C5E\u4E8E\u5F53\u524D\u516C\u53F8");
+      continue;
+    }
+    if (!node2.online) {
+      reject("node-offline", "\u8282\u70B9\u5F53\u524D\u79BB\u7EBF");
+      continue;
+    }
+    if (!node2.runtimeKinds.includes(candidate.runtimeKind)) {
+      reject("runtime-missing", "\u8BE5\u673A\u5668\u4E0A\u6CA1\u6709\u8FD9\u4E2A\u8FD0\u884C\u65F6\uFF08\u672A\u88C5\u597D\u3001\u5DF2\u5378\u8F7D\u6216\u672A\u4E0A\u62A5\uFF09");
+      continue;
+    }
+    const fault = input.faults?.get(key2) ?? faultFromQuota(candidate, input.quotas?.get(key2), now);
+    if (fault && faultIsBlocking(fault, now)) {
+      reject("faulted", `${fault.reason}${fault.detail ? `\uFF1A${fault.detail}` : ""}${fault.awaitingManual ? "\uFF08\u7B49\u4EBA\u5DE5\u6062\u590D\uFF09" : ""}`);
+      continue;
+    }
+    if (atCapacity(node2)) {
+      reject("at-capacity", `\u5728\u8DD1 ${node2.activeRunCount} / \u4E0A\u9650 ${node2.maxConcurrent}`);
+      continue;
+    }
+    eligible.push(candidate);
+  }
+  if (eligible.length === 0) return { ok: false, reason: failureReason(rejections), rejections };
+  const primary = eligible.find((c) => c.primary);
+  const rank = (candidate) => {
+    const node2 = input.nodes.get(candidate.nodeId);
+    const idleness = idlenessOf(node2);
+    const { factor, worstUsedPercent } = quotaDerateFactor(input.quotas?.get(runtimeTargetKey(candidate)));
+    return {
+      candidate,
+      nodeName: node2.displayName?.trim() || candidate.nodeId,
+      idleness,
+      quotaFactor: factor,
+      weight: idleness * factor,
+      ...worstUsedPercent !== void 0 ? { worstQuotaUsedPercent: worstUsedPercent } : {}
+    };
+  };
+  if (primary) {
+    const ranked2 = [rank(primary)];
+    return { ok: true, chosen: primary, nodeName: ranked2[0].nodeName, source: "primary", ranked: ranked2, rejections };
+  }
+  const ranked = eligible.map(rank).sort((a, b2) => b2.weight - a.weight || a.candidate.ord - b2.candidate.ord || a.candidate.nodeId.localeCompare(b2.candidate.nodeId) || a.candidate.runtimeKind.localeCompare(b2.candidate.runtimeKind));
+  const top = ranked[0];
+  return { ok: true, chosen: top.candidate, nodeName: top.nodeName, source: "candidate", ranked, rejections };
+}
+function canRetryAllocation(attempt) {
+  return attempt < RUNTIME_ALLOCATION_MAX_ATTEMPTS;
+}
+function describeAllocationChoice(result) {
+  const head = result.source === "primary" ? `\u9009\u4E2D\u4E3B\u8FD0\u884C\u65F6 ${result.nodeName} \xB7 ${result.chosen.runtimeKind}` : `\u4E3B\u8FD0\u884C\u65F6\u4E0D\u53EF\u7528\uFF0C\u6309\u6743\u91CD\u9009\u4E2D ${result.nodeName} \xB7 ${result.chosen.runtimeKind}`;
+  const detail = result.ranked.map((r) => {
+    const quota = r.worstQuotaUsedPercent === void 0 ? "\u65E0\u989D\u5EA6\u6570\u636E" : `\u989D\u5EA6\u5DF2\u7528 ${Math.round(r.worstQuotaUsedPercent)}%`;
+    return `${r.nodeName}\xB7${r.candidate.runtimeKind} \u6743\u91CD ${r.weight.toFixed(2)}\uFF08\u7A7A\u95F2\u5EA6 ${r.idleness.toFixed(2)} \xD7 \u989D\u5EA6\u7CFB\u6570 ${r.quotaFactor.toFixed(2)}\uFF0C${quota}\uFF09`;
+  }).join("\uFF1B");
+  const skipped = result.rejections.length > 0 ? `\uFF1B\u6392\u9664 ${result.rejections.map((r) => `${r.nodeName}\xB7${r.runtimeKind}(${r.cause})`).join("\u3001")}` : "";
+  return `${head}\u3002${detail}${skipped}`;
+}
+var init_allocate = __esm({
+  "../server/src/domains/runtime-allocation/allocate.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
+// ../server/src/domains/runtime-allocation/errors.ts
+function describeRejections(rejections) {
+  return rejections.map((r) => `${r.nodeName} \xB7 ${r.runtimeKind}\uFF08${CAUSE_TEXT[r.cause]}${r.detail ? `\uFF1A${r.detail}` : ""}\uFF09`).join("\uFF1B");
+}
+function requireAllocation(result, who) {
+  if (result.ok) return result;
+  const subject = who?.actorName?.trim() ? `\u300C${who.actorName.trim()}\u300D` : "\u8FD9\u4F4D Agent";
+  const what = who?.what?.trim() ? `${who.what.trim()}\uFF1A` : "";
+  const detail = describeRejections(result.rejections);
+  if (result.reason === "no-candidates") {
+    throw new RuntimeAllocationError(
+      "RUNTIME_ALLOCATION_NO_CANDIDATES",
+      `${what}${subject}\u6CA1\u6709\u53EF\u7528\u7684\u8FD0\u884C\u65F6\u76EE\u6807\uFF1A\u65E2\u6CA1\u6709\u4E3B\u8FD0\u884C\u65F6\u7ED1\u5B9A\uFF0C\u4E5F\u6CA1\u6709\u914D\u7F6E\u5019\u9009\u8FD0\u884C\u65F6\u3002\u8BF7\u5728\u5458\u5DE5\u8BE6\u60C5\u9875\u7684\u300C\u9ED8\u8BA4\u8FD0\u884C\u914D\u7F6E\u300D\u91CC\u7ED1\u5B9A\u4E00\u4E2A\u8FD0\u884C\u65F6\uFF0C\u6216\u52A0\u4E00\u6761\u5019\u9009\u8FD0\u884C\u65F6\u3002`,
+      result.rejections
+    );
+  }
+  if (result.reason === "all-at-capacity") {
+    throw new RuntimeAllocationError(
+      "RUNTIME_ALLOCATION_ALL_AT_CAPACITY",
+      `${what}${subject}\u7684\u8FD0\u884C\u65F6\u5168\u90E8\u5DF2\u5230\u5E76\u53D1\u4E0A\u9650\uFF0C\u672C\u6B21\u6CA1\u6709\u6D3E\u51FA\uFF1A${detail}\u3002\u8BF7\u7B49\u5F53\u524D\u4F1A\u8BDD\u8DD1\u5B8C\uFF0C\u6216\u5728\u8FD0\u884C\u65F6\u7BA1\u7406\u9875\u628A\u8FD9\u4E9B\u8282\u70B9\u7684\u5E76\u53D1\u4E0A\u9650\u8C03\u9AD8\u3002`,
+      result.rejections,
+      503
+    );
+  }
+  throw new RuntimeAllocationError(
+    "RUNTIME_ALLOCATION_ALL_UNAVAILABLE",
+    `${what}${subject}\u7684\u8FD0\u884C\u65F6\u76EE\u524D\u90FD\u4E0D\u53EF\u7528\uFF0C\u672C\u6B21\u6CA1\u6709\u6D3E\u51FA\uFF1A${detail}\u3002\u8BF7\u786E\u8BA4\u90A3\u4E9B\u673A\u5668\u5F00\u7740\u3001\u8282\u70B9\u7A0B\u5E8F\u5728\u8FD0\u884C\u3001\u8FD0\u884C\u65F6\u5DF2\u767B\u5F55\u4E14\u989D\u5EA6\u672A\u8017\u5C3D\uFF1B\u6216\u5728\u5458\u5DE5\u8BE6\u60C5\u9875\u52A0\u4E00\u6761\u522B\u7684\u5019\u9009\u8FD0\u884C\u65F6\u3002`,
+    result.rejections,
+    result.reason === "all-tried" ? 409 : 503
+  );
+}
+var RuntimeAllocationError, CAUSE_TEXT;
+var init_errors6 = __esm({
+  "../server/src/domains/runtime-allocation/errors.ts"() {
+    "use strict";
+    RuntimeAllocationError = class extends Error {
+      constructor(code2, message, rejections, status = 409) {
+        super(message);
+        this.code = code2;
+        this.rejections = rejections;
+        this.status = status;
+        this.name = "RuntimeAllocationError";
+      }
+    };
+    CAUSE_TEXT = {
+      "node-unknown": "\u8282\u70B9\u4E0D\u53EF\u7528",
+      "node-offline": "\u8282\u70B9\u79BB\u7EBF",
+      "runtime-missing": "\u673A\u5668\u4E0A\u6CA1\u6709\u8FD9\u4E2A\u8FD0\u884C\u65F6",
+      faulted: "\u6807\u8BB0\u4E3A\u6545\u969C",
+      "at-capacity": "\u5DF2\u5230\u5E76\u53D1\u4E0A\u9650",
+      "already-tried": "\u672C\u8F6E\u5DF2\u8BD5\u8FC7\u5E76\u5931\u8D25"
+    };
+  }
+});
+
+// ../server/src/domains/runtime-allocation/service.ts
+function isRuntimeClassFailure(reason, errorMessage2) {
+  if (reason === "server-unreachable" || reason === "rate-limit" || reason === "auth-error") return true;
+  if (reason === "error" && errorMessage2?.startsWith("\u8FD9\u4E00\u8F6E\u6CA1\u80FD\u5728\u8282\u70B9\u4E0A\u542F\u52A8\uFF1A")) return true;
+  return false;
+}
+function createRuntimeAllocator(ports) {
+  const units = /* @__PURE__ */ new Map();
+  const log3 = ports.log ?? ((line2) => console.log(line2));
+  const sweep = (nowMs) => {
+    for (const [key2, state] of units) if (nowMs - state.updatedAtMs > UNIT_STATE_TTL_MS) units.delete(key2);
+  };
+  const stateOf = (unitOfWork, nowMs) => {
+    sweep(nowMs);
+    const existing = units.get(unitOfWork);
+    if (existing) return existing;
+    const fresh = { tried: /* @__PURE__ */ new Map(), updatedAtMs: nowMs };
+    units.set(unitOfWork, fresh);
+    return fresh;
+  };
+  const flatten = (binding, candidates, primary) => {
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
+    const head = primary ?? (binding?.nodeId && binding.runtimeKind && binding.status === "active" ? { nodeId: binding.nodeId, runtimeKind: binding.runtimeKind, model: null } : null);
+    if (head) {
+      out.push({ nodeId: head.nodeId, runtimeKind: head.runtimeKind, primary: true, ord: -1, model: head.model ?? null });
+      seen.add(runtimeTargetKey(head));
+    }
+    for (const c of candidates) {
+      const key2 = runtimeTargetKey(c);
+      if (seen.has(key2)) continue;
+      seen.add(key2);
+      out.push({ nodeId: c.nodeId, runtimeKind: c.runtimeKind, primary: false, ord: c.ord, model: c.model ?? null });
+    }
+    return out;
+  };
+  const gather = async (actorId, primary) => {
+    const [binding, candidateRows, nodeStates, faultRows, quotaRows] = await Promise.all([
+      ports.primaryBinding(actorId).catch(() => null),
+      ports.candidates(actorId).catch(() => []),
+      ports.nodeStates(),
+      ports.faults().catch(() => []),
+      ports.quotas().catch(() => [])
+    ]);
+    return {
+      candidates: flatten(binding, candidateRows, primary),
+      nodes: new Map(nodeStates.map((n) => [n.nodeId, n])),
+      faults: new Map(faultRows.map((f2) => [runtimeTargetKey(f2), f2])),
+      quotas: new Map(quotaRows.map((q2) => [runtimeTargetKey(q2), q2]))
+    };
+  };
+  return {
+    /** 跑一次分配但**不抛错**（给需要自己决定怎么呈现失败的调用方，比如要落一条失败卡的那条路）。 */
+    async tryAllocate(input) {
+      const now = input.now ?? Date.now();
+      const state = stateOf(input.unitOfWork, now);
+      const gathered = await gather(input.actorId, input.primary);
+      return allocateRuntime({
+        candidates: gathered.candidates,
+        nodes: gathered.nodes,
+        faults: gathered.faults,
+        quotas: gathered.quotas,
+        alreadyTried: new Set(state.tried.keys()),
+        triedDetail: state.tried
+      }, now);
+    },
+    /**
+     * 分配，选不出就抛 {@link RuntimeAllocationError}（经 `requireAllocation` 那一处——日后接排队改那里）。
+     * 成功时记下「这件活这次派到哪」，供 {@link noteFailure} 回报。
+     */
+    async allocateFor(input) {
+      const now = input.now ?? Date.now();
+      const state = stateOf(input.unitOfWork, now);
+      const actorName = await ports.actorName?.(input.actorId).catch(() => null) ?? null;
+      if (!canRetryAllocation(state.tried.size)) {
+        const tried = [...state.tried.entries()].map(([key2, detail]) => {
+          const [nodeId, runtimeKind] = key2.split("::");
+          return { nodeId, runtimeKind, nodeName: nodeId, cause: "already-tried", detail };
+        });
+        throw new RuntimeAllocationError(
+          "RUNTIME_ALLOCATION_ALL_UNAVAILABLE",
+          `${input.what ? `${input.what}\uFF1A` : ""}${actorName ? `\u300C${actorName}\u300D` : "\u8FD9\u4F4D Agent"}\u7684\u8FD0\u884C\u65F6\u5DF2\u8FDE\u7EED\u6362\u4E86 ${RUNTIME_ALLOCATION_MAX_ATTEMPTS} \u6B21\u90FD\u6CA1\u8DD1\u8D77\u6765\uFF0C\u4E0D\u518D\u81EA\u52A8\u91CD\u8BD5\uFF1A${tried.map((t) => `${t.nodeName} \xB7 ${t.runtimeKind}\uFF08${t.detail}\uFF09`).join("\uFF1B")}\u3002\u8BF7\u5148\u4FEE\u597D\u5176\u4E2D\u4E00\u53F0\u673A\u5668\uFF0C\u6216\u5728\u5458\u5DE5\u8BE6\u60C5\u9875\u52A0\u4E00\u6761\u522B\u7684\u5019\u9009\u8FD0\u884C\u65F6\u540E\u91CD\u65B0\u53D1\u8D77\u3002`,
+          tried
+        );
+      }
+      const result = requireAllocation(
+        await this.tryAllocate({ actorId: input.actorId, unitOfWork: input.unitOfWork, ...input.primary !== void 0 ? { primary: input.primary } : {}, now }),
+        { actorName, ...input.what ? { what: input.what } : {} }
+      );
+      const attempt = state.tried.size + 1;
+      state.lastAssigned = { nodeId: result.chosen.nodeId, runtimeKind: result.chosen.runtimeKind };
+      state.updatedAtMs = now;
+      const explanation = describeAllocationChoice(result);
+      log3(`[runtime-alloc] ${input.unitOfWork} \u7B2C ${attempt} \u6B21\uFF1A${explanation}`);
+      return {
+        binding: { actorId: input.actorId, nodeId: result.chosen.nodeId, runtimeKind: result.chosen.runtimeKind, status: "active" },
+        model: result.chosen.model ?? null,
+        source: result.source,
+        attempt,
+        explanation
+      };
+    },
+    /**
+     * 这件活在上次分给它的那个目标上**因 runtime/节点原因**失败了。下一次 `allocateFor` 会排除它。
+     *
+     * 返回 false = 这条失败不算 runtime/节点的错（agent 自己干砸了），什么都没记。
+     */
+    noteFailure(input) {
+      if (!isRuntimeClassFailure(input.reason, input.errorMessage)) return false;
+      const now = input.now ?? Date.now();
+      const state = units.get(input.unitOfWork);
+      const target = input.target ?? state?.lastAssigned;
+      if (!state || !target) return false;
+      const detail = input.errorMessage?.trim() || String(input.reason ?? "runtime \u5931\u8D25");
+      state.tried.set(runtimeTargetKey(target), detail.slice(0, 200));
+      state.updatedAtMs = now;
+      log3(`[runtime-alloc] ${input.unitOfWork} \u5728 ${target.nodeId} \xB7 ${target.runtimeKind} \u4E0A\u5931\u8D25\uFF08${detail.slice(0, 80)}\uFF09\u2192 \u4E0B\u4E00\u8F6E\u6362\u5019\u9009`);
+      return true;
+    },
+    /**
+     * 这件活这一轮**不是因为 runtime/节点**结束的（跑成了、agent 自己干砸了、被停了）→ 丢掉整条失败链。
+     *
+     * 这是重试上限只对「连着换机器都没跑起来」生效的机制：正常派发一次就清一次，
+     * 所以一个长命的工单节点不会因为派过很多次而撞上上限。
+     */
+    noteSettled(unitOfWork) {
+      units.delete(unitOfWork);
+    },
+    /** 只给测试与诊断用：这件活当前失败链的账。 */
+    inspect(unitOfWork) {
+      const s2 = units.get(unitOfWork);
+      if (!s2) return null;
+      return { failures: s2.tried.size, tried: [...s2.tried.keys()], ...s2.lastAssigned ? { lastAssigned: s2.lastAssigned } : {} };
+    }
+  };
+}
+var UNIT_STATE_TTL_MS;
+var init_service7 = __esm({
+  "../server/src/domains/runtime-allocation/service.ts"() {
+    "use strict";
+    init_src();
+    init_allocate();
+    init_errors6();
+    UNIT_STATE_TTL_MS = 2 * 60 * 6e4;
+  }
+});
+
 // ../server/src/domains/types/index.ts
 function typesDomain(deps) {
   const adminOf = async (companyId) => {
@@ -243747,6 +244345,10 @@ var init_node_store = __esm({
     MemoryNodeStore = class {
       nodes = /* @__PURE__ */ new Map();
       runtimes = /* @__PURE__ */ new Map();
+      /** 故障标记，键 = `${nodeId}::${runtimeKind}`（与 `runtimeTargetKey` 同一个键形状）。 */
+      faults = /* @__PURE__ */ new Map();
+      /** 落库额度，键同上。 */
+      quotas = /* @__PURE__ */ new Map();
       async upsertNode(node2) {
         this.nodes.set(node2.id, { ...this.nodes.get(node2.id), ...node2 });
       }
@@ -243859,6 +244461,27 @@ var init_node_store = __esm({
         }
         return { nodeDeleted: false };
       }
+      /* ---------- 运行时分配（ADR 0616） ---------- */
+      async setNodeMaxConcurrent(nodeId, limit) {
+        const n = this.nodes.get(nodeId);
+        if (n) n.maxConcurrent = limit;
+      }
+      async upsertRuntimeFault(fault) {
+        this.faults.set(`${fault.nodeId}::${fault.runtimeKind}`, { ...fault });
+      }
+      async clearRuntimeFault(nodeId, runtimeKind) {
+        return this.faults.delete(`${nodeId}::${runtimeKind}`);
+      }
+      async listRuntimeFaults(filter) {
+        return [...this.faults.values()].filter((f2) => filter?.nodeId ? f2.nodeId === filter.nodeId : true).filter((f2) => filter?.companyId ? this.nodes.get(f2.nodeId)?.companyId === filter.companyId : true).map((f2) => ({ ...f2 }));
+      }
+      async saveRuntimeQuotas(nodeId, quotas) {
+        for (const key2 of [...this.quotas.keys()]) if (key2.startsWith(`${nodeId}::`)) this.quotas.delete(key2);
+        for (const q2 of quotas) this.quotas.set(`${q2.nodeId}::${q2.runtimeKind}`, { ...q2 });
+      }
+      async listRuntimeQuotas(filter) {
+        return [...this.quotas.values()].filter((q2) => filter?.nodeId ? q2.nodeId === filter.nodeId : true).filter((q2) => filter?.companyId ? this.nodes.get(q2.nodeId)?.companyId === filter.companyId : true).map((q2) => ({ ...q2 }));
+      }
     };
     FileNodeStore = class _FileNodeStore extends MemoryNodeStore {
       constructor(file) {
@@ -243871,15 +244494,19 @@ var init_node_store = __esm({
           const snap = JSON.parse(fs26.readFileSync(file, "utf8"));
           for (const n of snap.nodes ?? []) s2.nodes.set(n.id, n);
           for (const r of snap.runtimes ?? []) s2.runtimes.set(r.id, r);
+          for (const f2 of snap.faults ?? []) s2.faults.set(`${f2.nodeId}::${f2.runtimeKind}`, f2);
+          for (const q2 of snap.quotas ?? []) s2.quotas.set(`${q2.nodeId}::${q2.runtimeKind}`, q2);
         } catch {
-          fs26.writeFileSync(file, JSON.stringify({ nodes: [], runtimes: [] }, null, 2));
+          fs26.writeFileSync(file, JSON.stringify({ nodes: [], runtimes: [], faults: [], quotas: [] }, null, 2));
         }
         return s2;
       }
       flush() {
         fs26.writeFileSync(this.file, JSON.stringify({
           nodes: [...this.nodes.values()],
-          runtimes: [...this.runtimes.values()]
+          runtimes: [...this.runtimes.values()],
+          faults: [...this.faults.values()],
+          quotas: [...this.quotas.values()]
         }, null, 2));
       }
       async upsertNode(node2) {
@@ -243943,6 +244570,25 @@ var init_node_store = __esm({
         this.flush();
         return r;
       }
+      // ⚠ 同上：并发上限、故障标记、额度三类写入漏了 override 就只活在内存，重启回到「没上限、没故障、
+      // 没额度数据」——而那三件事恰恰都是「重启不能丢」才有意义。
+      async setNodeMaxConcurrent(nodeId, limit) {
+        await super.setNodeMaxConcurrent(nodeId, limit);
+        this.flush();
+      }
+      async upsertRuntimeFault(fault) {
+        await super.upsertRuntimeFault(fault);
+        this.flush();
+      }
+      async clearRuntimeFault(nodeId, runtimeKind) {
+        const r = await super.clearRuntimeFault(nodeId, runtimeKind);
+        if (r) this.flush();
+        return r;
+      }
+      async saveRuntimeQuotas(nodeId, quotas) {
+        await super.saveRuntimeQuotas(nodeId, quotas);
+        this.flush();
+      }
     };
   }
 });
@@ -245216,7 +245862,7 @@ function compactModelChunks(rows) {
   return out;
 }
 var EVENT_PAGE_LIMIT, MODEL_CHUNK_COMPACT_WINDOW_MS, MODEL_CHUNK_RAW_MULTIPLIER, TraceService;
-var init_service7 = __esm({
+var init_service8 = __esm({
   "../server/src/domains/trace/service.ts"() {
     "use strict";
     init_sink();
@@ -245992,9 +246638,9 @@ function createTraceDomain(opts) {
 var init_trace2 = __esm({
   "../server/src/domains/trace/index.ts"() {
     "use strict";
-    init_service7();
+    init_service8();
     init_routes9();
-    init_service7();
+    init_service8();
     init_routes9();
     init_read_scope();
     init_sink();
@@ -246223,7 +246869,7 @@ function renderResumePack(pack) {
     if (cp) lines.push(`- Recoverability: ${cp.recoverability}`);
     if (done.length > 0) lines.push(`- \u4E0A\u4E00\u8D9F\u5DF2\u5B8C\u6210\u7684\u6B65\u9AA4\uFF1A${done.join("\u3001")}`);
     for (const ref2 of durable) {
-      lines.push(`  - durable: ${ref2.kind}:${ref2.id}${ref2.version ? `@${ref2.version}` : ""}${ref2.label ? ` \u2014 ${ref2.label}` : ""}`);
+      lines.push(`  - durable: ${renderRefId(ref2)}${ref2.version ? `@${ref2.version}` : ""}${ref2.label ? ` \u2014 ${ref2.label}` : ""}`);
     }
     if (cp && cp.pendingSteps.length > 0) {
       for (const step of cp.pendingSteps) lines.push(`  - pending: ${step}`);
@@ -246268,6 +246914,11 @@ function parseResumePackSnapshot(content3) {
     return null;
   }
 }
+function renderRefId(ref2) {
+  const kind = ref2.kind.trim();
+  const id = ref2.id.trim();
+  return kind && !id.startsWith(`${kind}:`) ? `${kind}:${id}` : id;
+}
 function renderWorkVersion(work) {
   const current = work.currentWorkId ?? "none";
   const delivered = work.acceptedWorkId ?? "none";
@@ -246365,20 +247016,29 @@ function renderCoordinatorView(view, taskBackground) {
       `- Actor: ${node2.actorId ?? "unassigned"}; role: ${node2.role ?? "unassigned"}`
     );
     if (node2.dependsOn.length > 0) lines.push(`- Depends on: ${node2.dependsOn.join(", ")}`);
-    if (node2.conclusion?.trim()) lines.push(`- Conclusion: ${node2.conclusion.trim()}`);
+    if (node2.conclusion?.trim()) {
+      lines.push(node2.work.acceptedWorkId ? `- Conclusion (delivered ${node2.work.acceptedWorkId}): ${node2.conclusion.trim()}` : `- Conclusion: ${node2.conclusion.trim()}`);
+    }
     if (node2.recoverySource) {
       const source = node2.recoverySource;
       lines.push(
         `- Recovery source: Attempt ${source.recoveredFromAttempt.attemptNo ?? "?"} \u2192 Attempt ${source.currentAttempt.attemptNo ?? "?"}`
       );
       if (source.recoveryCheckpoint) {
-        lines.push(`  - Recovery checkpoint: #${source.recoveryCheckpoint.seq} (${source.recoveryCheckpoint.recoverability})`);
+        lines.push(
+          `  - Recovery checkpoint: #${source.recoveryCheckpoint.seq} (${source.recoveryCheckpoint.recoverability}) from Attempt ${source.recoveredFromAttempt.attemptNo ?? "?"}`
+        );
         for (const step of source.recoveryCheckpoint.pendingSteps) lines.push(`    - Recovery pending: ${step}`);
       }
-      if (source.recoveryHandoff?.producedBy === "agent") {
-        lines.push(`  - Recovery Agent handoff: ${source.recoveryHandoff.summary}`);
-      } else if (source.recoveryHandoff?.producedBy === "system_reconstructed") {
-        lines.push(`  - Recovery system reconstruction (not an Agent conclusion): ${source.recoveryHandoff.summary}`);
+      if (source.recoveryHandoff) {
+        const handoffFrom = source.recoveryHandoff.attemptId === source.recoveredFromAttempt.id ? `Attempt ${source.recoveredFromAttempt.attemptNo ?? "?"}` : `attempt ${source.recoveryHandoff.attemptId}`;
+        if (source.recoveryHandoff.producedBy === "agent") {
+          lines.push(`  - Recovery Agent handoff (${handoffFrom}): ${source.recoveryHandoff.summary}`);
+        } else if (source.recoveryHandoff.producedBy === "system_reconstructed") {
+          lines.push(
+            `  - Recovery system reconstruction (${handoffFrom}, not an Agent conclusion): ${source.recoveryHandoff.summary}`
+          );
+        }
       }
       for (const risk of source.recoveryHandoff?.risks ?? []) lines.push(`    - Recovery risk: ${risk}`);
     }
@@ -246388,11 +247048,12 @@ function renderCoordinatorView(view, taskBackground) {
     }
     if (node2.handoffProducer === "agent" && node2.summary.trim() && !sameCoordinatorText(node2.summary, node2.conclusion)) {
       lines.push(`- Technical notes: ${node2.summary}`);
-    } else if (node2.handoffProducer === "system_reconstructed" && node2.summary.startsWith("[system_reconstructed]")) {
+    } else if (node2.handoffProducer === "system_reconstructed" && node2.summary.startsWith("[system_reconstructed]") && node2.status !== "succeeded") {
       lines.push(`- Execution diagnostic: ${node2.summary}`);
     }
     for (const output of node2.changedOutputs) {
-      lines.push(`  - Durable output: ${output.kind}:${output.id}${output.version ? `@${output.version}` : ""}`);
+      if (!output.version) continue;
+      lines.push(`  - Durable output: ${renderRefId(output)}@${output.version}`);
     }
     const openItems = [
       ...node2.unresolvedIssues.map((value2) => `[unresolved] ${value2}`),
@@ -246512,7 +247173,7 @@ function stateFromAttempt(attempt, handoff, checkpoint, now, stalledAfterMs, ope
   return "failed";
 }
 var import_node_crypto64, BLOCKING_STATES, HANDOFF_OUTCOMES2, RESUME_EXTERNAL_EFFECT_LIMIT, RESUME_SNAPSHOT_PREFIX, RESUME_SNAPSHOT_SUFFIX, ExecutionContinuityService;
-var init_service8 = __esm({
+var init_service9 = __esm({
   "../server/src/domains/execution-continuity/service.ts"() {
     "use strict";
     init_src();
@@ -247171,7 +247832,7 @@ function nodeCoordinatorFactsFromSnapshot(snapshot) {
       state: currentWorkId === null ? "not_started" : currentWork ? workState(currentWork, hasOutput(currentWork, artifactCountByWork.get(currentWork.id) ?? 0)) : "unavailable"
     };
     const accepted = node2.latestAcceptId ? workById.get(node2.latestAcceptId) : void 0;
-    const conclusion = accepted?.conclusion?.trim() || snapshot.works.filter((work2) => work2.nodeId === node2.id && work2.status === "success" && work2.conclusion?.trim()).sort((a, b2) => a.createdAt.localeCompare(b2.createdAt)).at(-1)?.conclusion?.trim();
+    const conclusion = accepted?.conclusion?.trim();
     const sealed = node2.cancelledAt ? { reason: node2.sealReason ?? "cancelled", at: node2.cancelledAt } : null;
     out[node2.id] = {
       work,
@@ -247332,8 +247993,8 @@ var init_execution_continuity2 = __esm({
   "../server/src/domains/execution-continuity/index.ts"() {
     "use strict";
     init_routes10();
-    init_service8();
-    init_service8();
+    init_service9();
+    init_service9();
     init_routes10();
     init_handoff_work_bridge();
     init_upstream_handoff_input();
@@ -250420,7 +251081,7 @@ function appendSourceNote(brief, automation, source, atIso) {
 \u672C\u5DE5\u5355\u7531\u81EA\u52A8\u5316\u300C${automation.name}\u300D\u4E8E ${atIso} \u89E6\u53D1\uFF08\u6765\u6E90\uFF1A${source}\uFF09\u3002\u5F00\u5DE5\u540E\u8BF7\u628A\u5DE5\u5355\u6807\u9898\u6539\u6210\u51C6\u786E\u53CD\u6620\u5B9E\u9645\u5DE5\u4F5C\u7684\u63CF\u8FF0\u3002`;
 }
 var import_node_crypto66, DATE_TOKEN, AutomationsService, EVENT_RETRY_BASE_MS, EVENT_RETRY_MAX_MS, EVENT_RETRY_MAX_ATTEMPTS, eventAttempts, eventLastAttemptAt, eventLastError, CHAT_REPLY_MAX;
-var init_service9 = __esm({
+var init_service10 = __esm({
   "../server/src/domains/automations/service.ts"() {
     "use strict";
     import_node_crypto66 = require("node:crypto");
@@ -252155,7 +252816,7 @@ var init_routes11 = __esm({
     init_src();
     init_templates();
     init_router();
-    init_service9();
+    init_service10();
     init_projection2();
     init_scheduler();
     init_registry3();
@@ -252270,10 +252931,10 @@ function createAutomationsDomain(opts) {
 var init_automations = __esm({
   "../server/src/domains/automations/index.ts"() {
     "use strict";
-    init_service9();
+    init_service10();
     init_webhook();
     init_routes11();
-    init_service9();
+    init_service10();
     init_routes11();
     init_projection2();
     init_webhook();
@@ -253089,6 +253750,32 @@ var init_daemon_adapter = __esm({
           }
         }
       }
+      /**
+       * Bug 0232：**就地**收尾一次派发——用户点了停止、而 kill 帧送不出去（节点 socket 非 OPEN）时用。
+       *
+       * 走的是和「服务端自判死」完全同一个 {@link settle}，所以三件必须做的事一次做齐：
+       * 兑现在途的插话等待者、触发 exitCbs（本轮收口、释放 `chat_session_turns` 的槽、输入框解冻）、
+       * 把 dispatchId 记进 `settledDispatchIds`。
+       *
+       * 为什么这样不会造出两个 agent 一起跑（防双跑的三道防线都是现成的）：
+       *  1. 节点上的会话进程自己有看门狗——连不上服务端超过 `SESSION_LIMITS.suicideAfterUnreachableMs`
+       *     （5 分钟）就自尽（`packages/cli/src/daemon/session-process.ts`）；
+       *  2. 契约上钉着不变式 `suicideAfterUnreachableMs ≤ reapGraceMs`，服务端判死必然发生在它自尽之后；
+       *  3. 它要是在这之前连回来了，hub 的三级认领（`daemon-hub.ts` 的 `judgeSession`）第一级就命中
+       *     `settledDispatchIds` → 判 `settled` → 下发 `evict` → 会话 `selfTerminate("evicted")`。
+       * 所以僵尸的存活时间是 `min(网络恢复时间, 5 分钟)`，这个窗口自己会关。
+       *
+       * 归因不在这里写：`cancelCause` 在点停止那一刻就由 `LiveChatRegistry.stop` 写成了 `user`，
+       * 收尾时读出来，页面照旧显示「用户停止了输出」。
+       *
+       * @returns true = 确由这次调用收的尾；false = 这次派发不在在途表里（已收尾 / 不归本 adapter 管）。
+       */
+      cancelLocally(dispatchId, errorMessage2 = "\u7528\u6237\u505C\u6B62\uFF08\u8282\u70B9\u79BB\u7EBF\uFF0C\u672A\u7B49\u5230\u9000\u51FA\u5E27\uFF09") {
+        const entry = this.pending.get(dispatchId);
+        if (!entry || entry.exited) return false;
+        this.settle(dispatchId, { code: null, reason: "cancelled", errorMessage: errorMessage2 });
+        return true;
+      }
       /** 当前在途（未退出）会话数；传 runtimeKind 时收窄到单个 runtime 实例。 */
       activeRunCount(nodeId, runtimeKind) {
         let n = 0;
@@ -253338,14 +254025,18 @@ var init_daemon_adapter = __esm({
         const appendTimeoutMs = this.appendTimeoutMs;
         const sessionReadyWaitMs = this.sessionReadyWaitMs;
         const confirm = (key2) => this.confirmInputReceipt(nodeId, dispatchId, key2);
+        const sendKill = () => routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+        const cancelLocally = () => this.cancelLocally(dispatchId);
         return {
           id: dispatchId,
           get supportsLiveProtocol() {
             return entry.supportsLiveProtocol;
           },
           async kill() {
-            routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+            sendKill();
           },
+          sendKill,
+          cancelLocally,
           onExit(cb) {
             if (entry.exited) cb(entry.exited);
             else entry.exitCbs.push(cb);
@@ -253430,6 +254121,8 @@ var init_daemon_adapter = __esm({
         const appendTimeoutMs = this.appendTimeoutMs;
         const sessionReadyWaitMs = this.sessionReadyWaitMs;
         const confirm = (key2) => this.confirmInputReceipt(nodeId, dispatchId, key2);
+        const sendKill = () => routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+        const cancelLocally = () => this.cancelLocally(dispatchId);
         return {
           id: dispatchId,
           stashDroppedFrames: stashed.droppedFrames ?? 0,
@@ -253437,8 +254130,10 @@ var init_daemon_adapter = __esm({
             return entry.supportsLiveProtocol;
           },
           async kill() {
-            routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+            sendKill();
           },
+          sendKill,
+          cancelLocally,
           onExit(cb) {
             if (entry.exited) cb(entry.exited);
             else entry.exitCbs.push(cb);
@@ -255608,6 +256303,18 @@ var init_postgres_registry = __esm({
         status       text NOT NULL             -- active | paused
       )`);
         await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".actor_runtime_candidates (
+        actor_id     text NOT NULL,
+        node_id      text NOT NULL,
+        runtime_kind text NOT NULL,
+        model        text,
+        ord          integer NOT NULL,
+        updated_at   timestamptz NOT NULL,
+        updated_by   text NOT NULL,
+        PRIMARY KEY (actor_id, node_id, runtime_kind)
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS actor_runtime_candidates_actor_ord_idx ON "${s2}".actor_runtime_candidates (actor_id, ord)`);
+        await pool.query(`
       CREATE TABLE IF NOT EXISTS "${s2}".connectors (
         id          text PRIMARY KEY,
         name        text NOT NULL,
@@ -255965,6 +256672,49 @@ var init_postgres_registry = __esm({
         const r = await this.pool.query(`SELECT * FROM ${this.s}.actor_bindings ORDER BY actor_id`);
         return r.rows.map((row) => ({ actorId: row.actor_id, nodeId: row.node_id, runtimeKind: row.runtime_kind, status: row.status }));
       }
+      /* ---------- 候选 runtime（ADR 0616） ---------- */
+      async listRuntimeCandidates(actorId) {
+        const r = await this.pool.query(
+          // 第二、三排序键让同 ord 的存量脏数据也有**确定**次序——分配算法的定序是全序的，
+          // 读侧若随机返回，那句「为什么选了它」下一次就解释不了同一件事。
+          `SELECT actor_id, node_id, runtime_kind, model, ord FROM ${this.s}.actor_runtime_candidates
+       WHERE actor_id = $1 ORDER BY ord, node_id, runtime_kind`,
+          [actorId]
+        );
+        return r.rows.map((row) => ({
+          actorId: row.actor_id,
+          nodeId: row.node_id,
+          runtimeKind: row.runtime_kind,
+          model: row.model ?? null,
+          ord: Number(row.ord)
+        }));
+      }
+      async replaceRuntimeCandidates(actorId, candidates, by) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const updatedBy = by ?? "actor:system:registry";
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          await client.query(`DELETE FROM ${this.s}.actor_runtime_candidates WHERE actor_id = $1`, [actorId]);
+          for (const [i, c] of candidates.entries()) {
+            const model = typeof c.model === "string" && c.model.trim() ? c.model.trim() : null;
+            await client.query(
+              `INSERT INTO ${this.s}.actor_runtime_candidates (actor_id, node_id, runtime_kind, model, ord, updated_at, updated_by)
+           VALUES ($1,$2,$3,$4,$5,$6,$7)
+           ON CONFLICT (actor_id, node_id, runtime_kind) DO UPDATE SET model=$4, ord=$5, updated_at=$6, updated_by=$7`,
+              [actorId, c.nodeId, c.runtimeKind, model, i, now, updatedBy]
+            );
+          }
+          await client.query("COMMIT");
+        } catch (err) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw err;
+        } finally {
+          client.release();
+        }
+        return this.listRuntimeCandidates(actorId);
+      }
       /* ---------- Runtime 默认配置 ---------- */
       async upsertRuntimeConfig(c) {
         await this.pool.query(
@@ -259317,7 +260067,18 @@ var init_postgres_trace = __esm({
           (generated_handoff_id, NEW.id, COALESCE(NEW.job_key, NEW.trigger_ref, 'attempt:' || NEW.id), NEW.part,
            'system_reconstructed', mapped_outcome,
            reconstructed_summary, NEW.output_refs, '[]'::jsonb, reconstructed_risks,
-           COALESCE(latest_pending, '[]'::jsonb), reconstructed_gaps, NULL,
+           -- \u2605 2026-09-23\uFF1Anext_actions \u4E0D\u518D\u7528 checkpoint \u7684 pendingSteps \u515C\u5E95\u3002
+           --
+           -- \u8FD9\u4E00\u680F\u7684\u8BED\u4E49\u662F\u300C\u4E0B\u6E38\u600E\u4E48\u7528\u8FD9\u4EFD\u6210\u679C\u300D\uFF08TASK.md \u539F\u6587\uFF1A--next\uFF1A\u4E0B\u6E38\u5982\u4F55\u4F7F\u7528\u6210\u679C\uFF0C\u4E0D\u662F\u4F60\u5269\u4F59
+           -- \u6CA1\u505A\u7684\u5DE5\u4F5C\uFF09\uFF0C\u800C pendingSteps \u6070\u6070\u662F\u6267\u884C\u4EBA\u81EA\u5DF1\u6CA1\u505A\u5B8C\u7684\u6D3B\u3002\u515C\u5E95\u7684\u540E\u679C\uFF1A\u7EBF\u4E0A 114 \u4EFD\u4EA4\u4ED8\u8BB0\u5F55
+           -- \u91CC 106 \u4EFD\u5E26 next\uFF0C\u5176\u4E2D 59 \u4EFD\u662F conclude / \u63D0\u4EA4\u5E76\u7ED3\u6848 \u8FD9\u7C7B\u81EA\u7559\u5F85\u529E\uFF0C\u8FD8\u88AB\u4E0B\u6E38\u4EA4\u63A5\u7684\u7ED3\u5C3E\u53E5
+           -- \u58F0\u660E\u6210\u300C\u4EE5\u4E0A\u5F00\u653E\u9879\u662F\u4E0A\u6E38\u6267\u884C\u4EBA\u4EA4\u4F5C\u4E1A\u65F6\u81EA\u5DF1\u5199\u7684\u300D\u2014\u2014\u4E00\u53E5\u5047\u8BDD\uFF08\u5B9E\u8BC1\uFF1Aws:wo-2481b4cb \u7684\u4E0B\u6E38
+           -- \u300C\u8C03\u7814\u62A5\u544A\u300D\u6536\u5230\u7684 _HANDOFF.md \u53EA\u6709\u4E00\u884C - [next] \u63D0\u4EA4\u5E76\u7ED3\u6848\uFF09\u3002\u6539\u6210\u7A7A\u4E4B\u540E\uFF0C\u8FD9\u4E00\u680F\u8981\u4E48\u662F
+           -- \u6267\u884C\u4EBA propose --next \u4EB2\u624B\u5199\u7684\uFF0C\u8981\u4E48\u6CA1\u6709\u3002
+           --
+           -- pendingSteps \u4E0D\u4F1A\u56E0\u6B64\u4E22\u5931\uFF1A\u4E2D\u65AD\u7EED\u8DD1\u8BFB\u7684\u662F checkpoint \u672C\u8EAB\uFF08RESUME.md\uFF09\uFF0C\u534F\u8C03\u8005\u89C6\u56FE\u5BF9
+           -- running/stalled/blocked/failed \u8282\u70B9\u5355\u72EC\u6E32\u67D3 Pending \u884C\uFF08progress \u6BB5\uFF09\uFF0C\u4E24\u5904\u90FD\u4E0D\u8BFB\u8FD9\u4E00\u680F\u3002
+           '[]'::jsonb, reconstructed_gaps, NULL,
            COALESCE(NEW.ended_at, NEW.updated_at, NEW.started_at))
         -- \u2605 2026-08-17\uFF1A\u7EC8\u6001\u91CD\u5EFA\u4ECE\u300C\u6574\u884C\u8986\u76D6\u300D\u6539\u6210\u300C**\u53EA\u586B\u7A7A**\u300D\u3002
         --
@@ -265097,7 +265858,7 @@ var init_postgres_delegations = __esm({
 });
 
 // ../storage/src/postgres-nodes.ts
-var import_node_crypto75, ident13, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToRuntime;
+var import_node_crypto75, ident13, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToFault, rowToQuota, rowToRuntime;
 var init_postgres_nodes = __esm({
   "../storage/src/postgres-nodes.ts"() {
     "use strict";
@@ -265147,6 +265908,33 @@ var init_postgres_nodes = __esm({
         await pool.query(`CREATE UNIQUE INDEX IF NOT EXISTS node_runtimes_company_id_uq ON "${s2}".node_runtimes (company_id, id)`);
         await pool.query(`CREATE INDEX IF NOT EXISTS node_runtimes_company_node_idx ON "${s2}".node_runtimes (company_id, node_id)`);
         await pool.query(`CREATE INDEX IF NOT EXISTS node_runtimes_company_status_idx ON "${s2}".node_runtimes (company_id, status)`);
+        await pool.query(`ALTER TABLE "${s2}".nodes ADD COLUMN IF NOT EXISTS max_concurrent integer`);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".node_runtime_faults (
+        node_id         text NOT NULL REFERENCES "${s2}".nodes(id) ON DELETE CASCADE,
+        runtime_kind    text NOT NULL,
+        company_id      text,
+        reason          text NOT NULL,
+        detail          text,
+        marked_at       timestamptz NOT NULL,
+        attempts        integer NOT NULL DEFAULT 0,
+        next_probe_at   timestamptz,
+        awaiting_manual boolean NOT NULL DEFAULT false,
+        PRIMARY KEY (node_id, runtime_kind)
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS node_runtime_faults_company_idx ON "${s2}".node_runtime_faults (company_id)`);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".node_runtime_quotas (
+        node_id      text NOT NULL REFERENCES "${s2}".nodes(id) ON DELETE CASCADE,
+        runtime_kind text NOT NULL,
+        company_id   text,
+        status       text NOT NULL,
+        checked_at   timestamptz NOT NULL,
+        retry_at     timestamptz,
+        windows      jsonb NOT NULL DEFAULT '[]'::jsonb,
+        PRIMARY KEY (node_id, runtime_kind)
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS node_runtime_quotas_company_idx ON "${s2}".node_runtime_quotas (company_id)`);
         return new _PostgresNodeStore(pool, schema);
       }
       async upsertNode(n) {
@@ -265300,6 +266088,95 @@ var init_postgres_nodes = __esm({
         }
         return { nodeDeleted: false };
       }
+      /* ---------- 运行时分配（ADR 0616）：并发上限 / 故障标记 / 落库额度 ---------- */
+      async setNodeMaxConcurrent(nodeId, limit) {
+        await this.pool.query(`UPDATE ${this.s}.nodes SET max_concurrent=$2 WHERE id=$1`, [nodeId, limit]);
+      }
+      async upsertRuntimeFault(fault) {
+        await this.pool.query(
+          // company_id 从 node 行继承（node 是唯一事实源，同 upsertRuntime 的兜底），任何调用方都绕不过去。
+          `INSERT INTO ${this.s}.node_runtime_faults
+         (node_id, runtime_kind, company_id, reason, detail, marked_at, attempts, next_probe_at, awaiting_manual)
+       VALUES ($1,$2,(SELECT company_id FROM ${this.s}.nodes WHERE id=$1),$3,$4,$5,$6,$7,$8)
+       ON CONFLICT (node_id, runtime_kind) DO UPDATE SET
+         company_id = COALESCE(EXCLUDED.company_id, ${this.s}.node_runtime_faults.company_id),
+         reason=EXCLUDED.reason, detail=EXCLUDED.detail, marked_at=EXCLUDED.marked_at,
+         attempts=EXCLUDED.attempts, next_probe_at=EXCLUDED.next_probe_at, awaiting_manual=EXCLUDED.awaiting_manual`,
+          [
+            fault.nodeId,
+            fault.runtimeKind,
+            fault.reason,
+            fault.detail ?? null,
+            fault.markedAt,
+            fault.attempts,
+            fault.nextProbeAt ?? null,
+            fault.awaitingManual
+          ]
+        );
+      }
+      async clearRuntimeFault(nodeId, runtimeKind) {
+        const r = await this.pool.query(
+          `DELETE FROM ${this.s}.node_runtime_faults WHERE node_id=$1 AND runtime_kind=$2`,
+          [nodeId, runtimeKind]
+        );
+        return (r.rowCount ?? 0) > 0;
+      }
+      async listRuntimeFaults(filter) {
+        const where = [];
+        const args = [];
+        if (filter?.nodeId) {
+          args.push(filter.nodeId);
+          where.push(`node_id = $${args.length}`);
+        }
+        if (filter?.companyId) {
+          args.push(filter.companyId);
+          where.push(`company_id = $${args.length}`);
+        }
+        const r = await this.pool.query(
+          `SELECT * FROM ${this.s}.node_runtime_faults${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY node_id, runtime_kind`,
+          args
+        );
+        return r.rows.map(rowToFault);
+      }
+      async saveRuntimeQuotas(nodeId, quotas) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          await client.query(`DELETE FROM ${this.s}.node_runtime_quotas WHERE node_id=$1`, [nodeId]);
+          for (const q2 of quotas) {
+            await client.query(
+              `INSERT INTO ${this.s}.node_runtime_quotas
+             (node_id, runtime_kind, company_id, status, checked_at, retry_at, windows)
+           VALUES ($1,$2,(SELECT company_id FROM ${this.s}.nodes WHERE id=$1),$3,$4,$5,$6::jsonb)`,
+              [nodeId, q2.runtimeKind, q2.status, q2.checkedAt, q2.retryAt ?? null, JSON.stringify(q2.windows ?? [])]
+            );
+          }
+          await client.query("COMMIT");
+        } catch (err) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw err;
+        } finally {
+          client.release();
+        }
+      }
+      async listRuntimeQuotas(filter) {
+        const where = [];
+        const args = [];
+        if (filter?.nodeId) {
+          args.push(filter.nodeId);
+          where.push(`node_id = $${args.length}`);
+        }
+        if (filter?.companyId) {
+          args.push(filter.companyId);
+          where.push(`company_id = $${args.length}`);
+        }
+        const r = await this.pool.query(
+          `SELECT * FROM ${this.s}.node_runtime_quotas${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY node_id, runtime_kind`,
+          args
+        );
+        return r.rows.map(rowToQuota);
+      }
     };
     PostgresNodeTokenStore = class _PostgresNodeTokenStore {
       constructor(pool, schema) {
@@ -265342,7 +266219,28 @@ var init_postgres_nodes = __esm({
       nodeVersion: row.node_version,
       status: row.status,
       lastSeenAt: new Date(row.last_seen_at).toISOString(),
-      enrolledAt: new Date(row.enrolled_at).toISOString()
+      enrolledAt: new Date(row.enrolled_at).toISOString(),
+      // 只在库里真有值时带上这一格：`undefined` 与 `null` 在 `exactOptionalPropertyTypes` 下不等价，
+      // 而判据只认「有没有上限」——带一个 null 进去会让下游不得不再判一次。
+      ...row.max_concurrent != null ? { maxConcurrent: Number(row.max_concurrent) } : {}
+    });
+    rowToFault = (row) => ({
+      nodeId: row.node_id,
+      runtimeKind: row.runtime_kind,
+      reason: row.reason,
+      ...row.detail ? { detail: row.detail } : {},
+      markedAt: new Date(row.marked_at).toISOString(),
+      attempts: Number(row.attempts ?? 0),
+      ...row.next_probe_at ? { nextProbeAt: new Date(row.next_probe_at).toISOString() } : {},
+      awaitingManual: Boolean(row.awaiting_manual)
+    });
+    rowToQuota = (row) => ({
+      nodeId: row.node_id,
+      runtimeKind: row.runtime_kind,
+      status: row.status,
+      checkedAt: new Date(row.checked_at).toISOString(),
+      ...row.retry_at ? { retryAt: new Date(row.retry_at).toISOString() } : {},
+      windows: Array.isArray(row.windows) ? row.windows : []
     });
     rowToRuntime = (row) => ({
       id: row.id,
@@ -268544,6 +269442,16 @@ var init_cutover_aware_registry = __esm({
       async listBindings() {
         return (await this.orgStore()).listBindings();
       }
+      // 候选 runtime（ADR 0616）：与 binding 同一侧（组织面）；底座没实现就退化成「没有候选」。
+      async listRuntimeCandidates(actorId) {
+        const store = await this.orgStore();
+        return store.listRuntimeCandidates ? store.listRuntimeCandidates(actorId) : [];
+      }
+      async replaceRuntimeCandidates(actorId, candidates) {
+        const store = await this.orgStoreForWrite();
+        if (!store.replaceRuntimeCandidates) throw new Error("\u5F53\u524D\u767B\u8BB0\u5B58\u50A8\u5B9E\u73B0\u4E0D\u652F\u6301\u5019\u9009\u8FD0\u884C\u65F6\uFF08replaceRuntimeCandidates \u672A\u5B9E\u73B0\uFF09");
+        return store.replaceRuntimeCandidates(actorId, candidates);
+      }
       async upsertRuntimeConfig(...args) {
         return (await this.orgStoreForWrite()).upsertRuntimeConfig(...args);
       }
@@ -274267,6 +275175,7 @@ __export(src_exports2, {
   MemoryWriteConflictError: () => MemoryWriteConflictError,
   MirrorEngine: () => MirrorEngine,
   MissingCompanyContextError: () => MissingCompanyContextError,
+  NODE_HEARTBEAT_STALE_MS: () => NODE_HEARTBEAT_STALE_MS,
   NPM_PROBE_TIMEOUT_MS: () => NPM_PROBE_TIMEOUT_MS,
   NdjsonOplogStore: () => NdjsonOplogStore,
   NodeHealthTracker: () => NodeHealthTracker,
@@ -274296,6 +275205,7 @@ __export(src_exports2, {
   RolesAdminService: () => RolesAdminService,
   Router: () => Router,
   RunSettlementFunnel: () => RunSettlementFunnel,
+  RuntimeAllocationError: () => RuntimeAllocationError,
   RuntimeStartMarker: () => RuntimeStartMarker,
   SERVER_PING: () => SERVER_PING,
   SHARED_GRAPH_BODY: () => SHARED_GRAPH_BODY,
@@ -274319,6 +275229,7 @@ __export(src_exports2, {
   actorStats: () => actorStats,
   actorsDomain: () => actorsDomain,
   agentDefaultRuntimeForNewSession: () => agentDefaultRuntimeForNewSession,
+  allocateRuntime: () => allocateRuntime,
   answerFallbackReason: () => answerFallbackReason,
   appendChatMessageOnce: () => appendChatMessageOnce,
   applyBuiltinSkillVariants: () => applyBuiltinSkillVariants,
@@ -274329,6 +275240,7 @@ __export(src_exports2, {
   assertCreatableVariable: () => assertCreatableVariable,
   assistantRowRecovery: () => assistantRowRecovery,
   assistantsDomain: () => assistantsDomain,
+  atCapacity: () => atCapacity,
   automationsDomain: () => automationsDomain,
   backfillOrgModel: () => backfillOrgModel,
   backfillOrgModelOnStartup: () => backfillOrgModelOnStartup,
@@ -274361,6 +275273,7 @@ __export(src_exports2, {
   buildWorkorderSummaries: () => buildWorkorderSummaries,
   builtinSkillToFiles: () => builtinSkillToFiles,
   canAnnounceRuntimeSwitch: () => canAnnounceRuntimeSwitch,
+  canRetryAllocation: () => canRetryAllocation,
   chatBroadcastEnabledFromEnv: () => chatBroadcastEnabledFromEnv,
   chatDelegationEnabledFromEnv: () => chatDelegationEnabledFromEnv,
   chatDispatchScope: () => chatDispatchScope,
@@ -274428,6 +275341,7 @@ __export(src_exports2, {
   createRegistryAuditSink: () => createRegistryAuditSink,
   createReworkHandoffInputResolver: () => createReworkHandoffInputResolver,
   createRunSettlementWiring: () => createRunSettlementWiring,
+  createRuntimeAllocator: () => createRuntimeAllocator,
   createSkillMarketClientFromEnv: () => createSkillMarketClientFromEnv,
   createSpawnMutex: () => createSpawnMutex,
   createTokenIssuer: () => createTokenIssuer,
@@ -274452,8 +275366,10 @@ __export(src_exports2, {
   deliverDelegationReturn: () => deliverDelegationReturn,
   deliverWorkorderBroadcast: () => deliverWorkorderBroadcast,
   deriveNodeHealth: () => deriveNodeHealth,
+  describeAllocationChoice: () => describeAllocationChoice,
   describeAttachmentsForAppend: () => describeAttachmentsForAppend,
   describeNodeFault: () => describeNodeFault,
+  describeRejections: () => describeRejections,
   deterministicKnowledgePlan: () => deterministicKnowledgePlan,
   deterministicUuid: () => deterministicUuid,
   digestOf: () => digestOf2,
@@ -274480,6 +275396,8 @@ __export(src_exports2, {
   fallbackTurnId: () => fallbackTurnId,
   fastPathFallbackReason: () => fastPathFallbackReason,
   fastPathQualityReason: () => fastPathQualityReason,
+  faultFromQuota: () => faultFromQuota,
+  faultIsBlocking: () => faultIsBlocking,
   fenceDispatch: () => fenceDispatch,
   fetchLatestNpmVersion: () => fetchLatestNpmVersion,
   fetchSkillFromSource: () => fetchSkillFromSource,
@@ -274495,6 +275413,7 @@ __export(src_exports2, {
   hashPassword: () => hashPassword,
   hideDeleted: () => hideDeleted,
   humanSubmitSourceRunId: () => humanSubmitSourceRunId,
+  idlenessOf: () => idlenessOf,
   isActiveCoordinatorAgent: () => isActiveCoordinatorAgent,
   isCompanyCrossTenantPath: () => isCompanyCrossTenantPath,
   isCoordinatorAgentName: () => isCoordinatorAgentName,
@@ -274513,6 +275432,7 @@ __export(src_exports2, {
   isNodeHealthy: () => isNodeHealthy,
   isOperatorRequest: () => isOperatorRequest,
   isRunTerminalStatus: () => isRunTerminalStatus,
+  isRuntimeClassFailure: () => isRuntimeClassFailure,
   isRuntimeDrifted: () => isRuntimeDrifted,
   isRuntimeRunReader: () => isRuntimeRunReader,
   isSealedKnowledgeSnapshotContent: () => isSealedKnowledgeSnapshotContent,
@@ -274609,6 +275529,7 @@ __export(src_exports2, {
   providerKnowledgeHash: () => providerKnowledgeHash,
   providerRoundTripKnowledgeHash: () => providerRoundTripKnowledgeHash,
   publishMarker: () => publishMarker,
+  quotaDerateFactor: () => quotaDerateFactor,
   readCredentialAuditLog: () => readCredentialAuditLog,
   readLocalPack: () => readLocalPack,
   readRegisteredToolVersions: () => readRegisteredToolVersions,
@@ -274646,6 +275567,7 @@ __export(src_exports2, {
   repairSubmissionDelivery: () => repairSubmissionDelivery,
   repairSubmissionDeliveryAcrossCompanies: () => repairSubmissionDeliveryAcrossCompanies,
   replaceModelPriceCacheForTest: () => replaceModelPriceCacheForTest,
+  requireAllocation: () => requireAllocation,
   requiresKnowledgePlanner: () => requiresKnowledgePlanner,
   resendSender: () => resendSender,
   resetBuildInfoCacheForTest: () => resetBuildInfoCacheForTest,
@@ -274669,6 +275591,7 @@ __export(src_exports2, {
   runtimeConnectionStatus: () => runtimeConnectionStatus,
   runtimeDriftBlock: () => runtimeDriftBlock,
   runtimeSwitchedNotice: () => runtimeSwitchedNotice,
+  runtimeTargetKey: () => runtimeTargetKey,
   safeAttachmentName: () => safeAttachmentName,
   sanitizeSkillDir: () => sanitizeSkillDir,
   scanFrontmatterEntries: () => scanFrontmatterEntries,
@@ -274804,6 +275727,9 @@ var init_src11 = __esm({
     init_coordinator_runs();
     init_usage_read();
     init_runtime_drift();
+    init_allocate();
+    init_errors6();
+    init_service7();
     init_runtime_status();
     init_runtime_tenancy();
     init_types4();
@@ -275179,6 +276105,7 @@ var import_node_crypto91 = require("node:crypto");
 
 // ../cli/src/serve.ts
 init_src11();
+init_src11();
 init_chat_cancel_attribution();
 init_src();
 init_src11();
@@ -280163,6 +281090,59 @@ async function startServe(opts) {
     return (await ctx.service.latestConfig(actorId))?.model ?? null;
   };
   agentDefaultRuntimeResolvers = { resolveBinding: resolveCompanyBinding, resolveActorModel: resolveAgentConfiguredModel };
+  const runtimeAllocators = /* @__PURE__ */ new Map();
+  const runtimeAllocatorFor = (companyId) => {
+    const hit = runtimeAllocators.get(companyId);
+    if (hit) return hit;
+    const allocator = createRuntimeAllocator({
+      // 主绑定与候选清单都**按公司解析**：全局 registry 对已切 `actor-config` 的公司是一份冻结旧镜像
+      //（理由与 `resolveCompanyBinding` 文件头同源）。
+      primaryBinding: (actorId) => resolveCompanyBinding(companyId, actorId),
+      candidates: async (actorId) => {
+        const registry2 = (await getEngine(companyId)).registry;
+        return registry2.listRuntimeCandidates ? registry2.listRuntimeCandidates(actorId) : [];
+      },
+      nodeStates: async () => {
+        const [nodes, runtimes] = await Promise.all([
+          nodeStore.listNodes({ companyId }),
+          nodeStore.listRuntimes(void 0, { companyId })
+        ]);
+        return nodes.filter((n) => n.status !== "deleted").map((n) => ({
+          nodeId: n.id,
+          // 报名称不报 id（ADR 0612）：节点名 → 主机名 → 万不得已才是 id。
+          displayName: n.name?.trim() || n.hostname || n.id,
+          /**
+           * 「在线」只取**可达性**：长连接在 + 心跳新鲜。刻意**不用** `healthOfNode(...).healthy`
+           * ——那个判据还叠了「连败 ≥ 3 次」这一档软不健康。
+           *
+           * 为什么不叠：委派子会话此前走的是 `bindingRuntimeState`（在线 + 上报了这个 adapter），
+           * 连败次数根本不参与。把它叠进来，一台**还连着、还能跑**但最近连败过三次的机器会被分配
+           * 排除掉，而这个员工要是没配候选，那一轮就从「照旧派出去」变成当场 503 —— 拿一个新功能
+           * 去掐掉一条本来能走的路。
+           *
+           * 连败这类「机器看着在、但活总是挂」的判断归**故障标记**（ADR 0616 D8，第 2 批）：
+           * 它会写进 `node_runtime_faults`，那时分配读的是故障行，粒度是 (节点, runtime) 而不是整台机器，
+           * 也带得上「下次什么时候再试」。工单派发那条路的 `checkDispatchable` 仍按原样拦连败节点，
+           * 与改动前逐字相同。
+           */
+          online: (hub?.connectedDaemons() ?? []).some((d) => d.daemonId === n.id) && (() => {
+            const seen = hub?.lastSeenAt(n.id);
+            return seen !== void 0 && Date.now() - seen < NODE_HEARTBEAT_STALE_MS;
+          })(),
+          /* 机器上有什么 runtime：漂移行（登记表有、机器探测不到）不算有——判据同 `runtimeDriftBlock`。
+             `presentOnMachine` 缺省（还没对账过的旧行）一律当作正常，与那道闸逐字一致。 */
+          runtimeKinds: runtimes.filter((r) => r.nodeId === n.id && r.presentOnMachine !== false).map((r) => r.kind),
+          maxConcurrent: n.maxConcurrent ?? null,
+          activeRunCount: activeRunCountOf(n.id)
+        }));
+      },
+      faults: () => nodeStore.listRuntimeFaults({ companyId }),
+      quotas: () => nodeStore.listRuntimeQuotas({ companyId }),
+      actorName: async (actorId) => (await (await actors.resolveCtx(companyId)).service.getActor(actorId).catch(() => null))?.name ?? null
+    });
+    runtimeAllocators.set(companyId, allocator);
+    return allocator;
+  };
   if (pgPool) {
     const pinPool = pgPool;
     void (async () => {
@@ -281412,6 +282392,7 @@ async function startServe(opts) {
         const priorChatSession = chatSessionId && turnChatStore ? await turnChatStore.getSession(chatSessionId) : null;
         let binding;
         let runtimeTargetSource = "actor_binding";
+        let allocatedModelOverride;
         if (stableDispatch) {
           binding = { actorId, ...stableDispatch.target, status: "active" };
         } else {
@@ -281438,14 +282419,42 @@ async function startServe(opts) {
               }
             });
           } catch (e) {
-            if (e instanceof SessionRuntimeOverrideError) throw new ApiError(e.status, e.code, e.message);
-            throw e;
+            if (e instanceof SessionRuntimeOverrideError) {
+              if (!delegatedChildTurn) throw new ApiError(e.status, e.code, e.message);
+              console.log(`[runtime-alloc] \u59D4\u6D3E\u5B50\u4F1A\u8BDD\u9489\u4F4F\u7684\u76EE\u6807\u4E0D\u53EF\u7528\uFF08${e.code}\uFF09\uFF0C\u4EA4\u7ED9\u5206\u914D\u6311\u5019\u9009`);
+              resolved = null;
+            } else throw e;
           }
-          if (!resolved) {
+          if (!resolved && !delegatedChildTurn) {
             throw new ApiError(409, "ACTOR_BINDING_MISSING", `\u8FD9\u4F4D Agent \u8FD8\u6CA1\u6709\u7ED1\u5B9A\u8FD0\u884C\u65F6\uFF0C\u8BF7${chatRebindHint("\u7ED1\u5B9A\u4E00\u4E2A\u53EF\u7528\u7684\u8FD0\u884C\u65F6")}\u540E\u518D\u53D1`);
           }
-          binding = resolved.binding;
-          runtimeTargetSource = resolved.source;
+          binding = resolved?.binding ?? { actorId, nodeId: "", runtimeKind: "", status: "active" };
+          runtimeTargetSource = resolved?.source ?? "actor_binding";
+          if (delegatedChildTurn) {
+            const pinned = sessionRuntimeOverride(priorChatSession);
+            const primary = resolved ? { nodeId: resolved.binding.nodeId, runtimeKind: resolved.binding.runtimeKind } : pinned ? { nodeId: pinned.nodeId, runtimeKind: pinned.runtimeKind } : null;
+            try {
+              const allocated = await runtimeAllocatorFor(runCompanyId).allocateFor({
+                actorId,
+                // 「同一件活」= 这条子会话。重试上限算在它头上，不与同一位专家的别条委派互相扣次数。
+                unitOfWork: `chat-session:${chatSessionId ?? artifactId}`,
+                what: "\u59D4\u6D3E\u5B50\u4F1A\u8BDD",
+                primary
+              });
+              if (allocated.binding.nodeId !== binding.nodeId || allocated.binding.runtimeKind !== binding.runtimeKind) {
+                binding = allocated.binding;
+                runtimeTargetSource = "session_override";
+                allocatedModelOverride = allocated.model ?? void 0;
+              }
+            } catch (e) {
+              if (e instanceof RuntimeAllocationError) throw new ApiError(e.status === 503 ? 503 : 409, e.code, e.message);
+              console.warn(`[runtime-alloc] \u59D4\u6D3E\u5B50\u4F1A\u8BDD\u5206\u914D\u5931\u8D25\uFF1A${String(e)}`);
+              if (!resolved) throw e;
+            }
+          }
+          if (!binding.nodeId || !binding.runtimeKind) {
+            throw new ApiError(409, "ACTOR_BINDING_MISSING", `\u8FD9\u4F4D Agent \u8FD8\u6CA1\u6709\u53EF\u7528\u7684\u8FD0\u884C\u65F6\uFF0C\u8BF7${chatRebindHint("\u7ED1\u5B9A\u4E00\u4E2A\u53EF\u7528\u7684\u8FD0\u884C\u65F6")}\u540E\u518D\u53D1`);
+          }
         }
         const requireDispatchNode = async (target) => {
           const targetNode = await nodeStore.getNode(target.nodeId);
@@ -281669,7 +282678,7 @@ async function startServe(opts) {
         };
         const provision = isolatedKnowledgeTurn ? { env: {}, wrapperPaths: [], requiredTools: [], requiredToolVersions: {}, connectorCreds: [], cleanup: async () => void 0 } : await buildActorProvision(actorService, actorId, chatDispatchScope(priorChatSession));
         const actorCtx = await buildActorContext(actorService, actorId).catch(() => null);
-        const sessionModel = configuredModel(sessionModelOverride);
+        const sessionModel = configuredModel(allocatedModelOverride !== void 0 ? allocatedModelOverride : sessionModelOverride);
         const actorConfiguredModel = isolatedBackground ? configuredModel(actorCtx?.config?.model) : void 0;
         const chatResolvedModel = sessionModel ?? actorConfiguredModel;
         const chatModel = chatResolvedModel ?? await registryStore.getRuntimeConfig(`runtime:${binding.nodeId}:${binding.runtimeKind}`).then((c) => configuredModel(c?.model)).catch(() => void 0);
@@ -281874,6 +282883,24 @@ async function startServe(opts) {
         const done = new Promise((resolve11, reject) => {
           handle.onExit((info) => {
             chatLiveSessions.delete(chatJobKey);
+            if (delegatedChildTurn) {
+              try {
+                const unitOfWork = `chat-session:${chatSessionId ?? artifactId}`;
+                const allocator = runtimeAllocatorFor(runCompanyId);
+                if (isRuntimeClassFailure(info.reason, info.errorMessage)) {
+                  allocator.noteFailure({
+                    unitOfWork,
+                    target: { nodeId: binding.nodeId, runtimeKind: binding.runtimeKind },
+                    ...info.reason ? { reason: info.reason } : {},
+                    ...info.errorMessage ? { errorMessage: info.errorMessage } : {}
+                  });
+                } else {
+                  allocator.noteSettled(unitOfWork);
+                }
+              } catch (err) {
+                console.warn(`[runtime-alloc] \u59D4\u6D3E\u5B50\u4F1A\u8BDD\u5931\u8D25\u56DE\u62A5\u51FA\u9519\uFF08\u4E0D\u5F71\u54CD\u6536\u5C3E\uFF09\uFF1A${String(err)}`);
+              }
+            }
             setTimeout(() => {
               chatRunByDispatch.delete(handle.id);
             }, 6e4).unref?.();
@@ -281944,6 +282971,9 @@ async function startServe(opts) {
           },
           done,
           kill: () => handle.kill(),
+          // Bug 0232：`kill()` 报不了帧的去向（契约钉死 `Promise<void>`），这一对能。
+          // 条件透传：本地 adapter 的句柄没有这条，上层按「方法在不在」分流回老行为。
+          ...typeof handle.sendKill === "function" ? { sendKill: () => handle.sendKill(), cancelLocally: () => handle.cancelLocally?.() ?? false } : {},
           // ADR-0093 对话追加（chat 道）：透传底层句柄的 appendInput。runtime 不原生支持时 handle 上
           // 压根没这个方法，这里也就不给——server 据此让插入入口置灰，而不是让人按下去才发现不行。
           // 不带 interrupt：人插一句话走回合边界排队，不作废在飞回合（那是 produce 道 ADR-0094 的语义）。
@@ -282317,6 +283347,18 @@ async function startServe(opts) {
               const mapping = dispatchToWork.get(msg.dispatchId);
               const exitBus = mapping ? busForCompany(mapping.companyId) ?? busForWorkorder(mapping.workorderId) : null;
               if (mapping && exitBus) {
+                if (mapping.artifactId && mapping.companyId) {
+                  const allocator = runtimeAllocatorFor(mapping.companyId);
+                  if (isRuntimeClassFailure(msg.info.reason, msg.info.errorMessage)) {
+                    allocator.noteFailure({
+                      unitOfWork: mapping.artifactId,
+                      ...msg.info.reason ? { reason: msg.info.reason } : {},
+                      ...msg.info.errorMessage ? { errorMessage: msg.info.errorMessage } : {}
+                    });
+                  } else {
+                    allocator.noteSettled(mapping.artifactId);
+                  }
+                }
                 await exitBus.submit({
                   companyId: "",
                   workorderId: mapping.workorderId,
@@ -282776,7 +283818,8 @@ async function startServe(opts) {
           try {
             result = replyIssueId ? await bridge.replyWork(rev.artifactId, rev.author, replyIssueId, ledgerId) : await bridge.produce(rev.artifactId, rev.author, workId, ledgerId, opts2?.resumeEligible, opts2?.protocolRecovery?.round);
           } catch (err) {
-            void dispatchLedgerFor(companyId).then((l) => l.close(ledgerId, { outcome: "failed", reason: `dispatch error: ${err instanceof Error ? err.message : String(err)}` })).catch(ledgerWarn("close(error)"));
+            const reason = err instanceof RuntimeAllocationError ? err.message : `dispatch error: ${err instanceof Error ? err.message : String(err)}`;
+            void dispatchLedgerFor(companyId).then((l) => l.close(ledgerId, { outcome: "failed", reason })).catch(ledgerWarn("close(error)"));
             console.log(`[new-engine] dispatchWork ${workId} \u6D3E\u53D1\u5F02\u5E38\uFF1A${String(err)} \u2192 \u7F6E work failed`);
             const failBus = busForCompany(companyId);
             if (failBus) {
@@ -282791,7 +283834,7 @@ async function startServe(opts) {
                   semanticsVersion: 3,
                   dispatchId: ledgerId,
                   outcome: "failed",
-                  detail: { reason: `dispatch error: ${err instanceof Error ? err.message : String(err)}` }
+                  detail: { reason }
                 }
               });
             }
@@ -282802,6 +283845,9 @@ async function startServe(opts) {
             dispatchToWork.set(result.dispatchId, {
               workId,
               workorderId: wid,
+              // ★ ADR 0616：运行时分配按「同一件活」记失败链，工单这条路的单位就是这个节点（artifactId）。
+              // 退出帧上只有 dispatchId，所以必须在这里记下来——否则失败时不知道该把哪条链标上。
+              artifactId: rev.artifactId,
               // ★ 记下归属公司：session_started / session_exited / 收口漏斗都据它把事件投回**这一家**的 bus。
               companyId,
               ...delivery ? { nodeId: delivery.nodeId } : {}
@@ -283075,7 +284121,27 @@ async function startServe(opts) {
         }),
         serverUrl: localUrl,
         serverUrlFor: (ctx) => serverUrlForBinding(ctx.binding),
-        resolveBinding: async (actorId) => (await runActors()).service.resolveBinding()(actorId),
+        /**
+         * ★ ADR 0616：工单节点派活（produce / review / integrate / reply）的目标由**运行时分配**决定，
+         * 不再直接读那条主绑定。两个触发时机都落在这里：
+         *
+         *  ① 开一个新会话时 —— 每次 spawn 前跑一次分配（排除故障与满并发、主可用就选主）。
+         *  ② 上一轮因 runtime/节点原因失败时 —— `session_exited` 那边已经把失败目标记进这件活的
+         *     失败链，这一次分配会自动换到另一个候选；连着换满 `RUNTIME_ALLOCATION_MAX_ATTEMPTS` 次
+         *     仍起不来就抛错（由 `dispatchWork` 的 catch 落成 work failed，原文带机器名与原因）。
+         *
+         * 没带 `ctx.unitOfWork` 的调用（`executorSignature` 只要一个指纹）退回旧路：那条路不该
+         * 消耗一次分配尝试，更不该因为「所有候选都试过了」而抛错——指纹算不出来只会退化，不该阻断。
+         */
+        resolveBinding: async (actorId, ctx) => {
+          if (!ctx?.unitOfWork) return (await runActors()).service.resolveBinding()(actorId);
+          const resolved = await runtimeAllocatorFor(companyId).allocateFor({
+            actorId,
+            unitOfWork: ctx.unitOfWork,
+            what: "\u5DE5\u5355\u8282\u70B9\u6D3E\u6D3B"
+          });
+          return resolved.binding;
+        },
         prepareReadonlyInputs: async ({ actor, artifactType, binding, codeRepo, pinnedRevisions }) => {
           let prepared = null;
           try {
@@ -284481,7 +285547,7 @@ ${nodeFault}` : "");
     const zbEnabled = opts.zeroOutputBreaker?.enabled ?? !zbDisabledByEnv;
     const zbIntervalMs = opts.zeroOutputBreaker?.intervalMs ?? 3e4;
     const zbWindowMs = opts.zeroOutputBreaker?.windowMs ?? (envInt("OASIS_ZERO_OUTPUT_BREAKER_WINDOW_MIN") ?? 30) * 6e4;
-    const zbThreshold = opts.zeroOutputBreaker?.threshold ?? envInt("OASIS_ZERO_OUTPUT_BREAKER_N") ?? 5;
+    const zbThreshold = opts.zeroOutputBreaker?.threshold ?? envInt("OASIS_ZERO_OUTPUT_BREAKER_N") ?? 20;
     const zbCostThresholdMicros = opts.zeroOutputBreaker?.costThresholdMicros ?? (envInt("OASIS_ZERO_OUTPUT_BREAKER_COST_USD") ?? 0) * 1e6;
     if (zbEnabled && zbIntervalMs > 0 && (zbThreshold > 0 || zbCostThresholdMicros > 0)) {
       const zbActions = /* @__PURE__ */ new Set(["produce", "review"]);
@@ -289687,7 +290753,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.71" ? "2.2.71" : "dev";
+var CLI_VERSION = "2.2.73" ? "2.2.73" : "dev";
 function apiHeaders(token, company) {
   const headers = {
     authorization: `Bearer ${token}`,
@@ -293493,7 +294559,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.71" : "dev";
+var PKG_VERSION = true ? "2.2.73" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;