oasis_test_v2 2.2.72 → 2.2.73

package/dist/index.js

@@ -845,6 +845,18 @@ var init_runtime = __esm({
   }
 });
 
+// ../contract/src/runtime-allocation.ts
+var RUNTIME_FAULT_PROBE_MAX_INTERVAL_MS, RUNTIME_FAULT_PROBE_MAX_TOTAL_MS, RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT, RUNTIME_ALLOCATION_MAX_ATTEMPTS;
+var init_runtime_allocation = __esm({
+  "../contract/src/runtime-allocation.ts"() {
+    "use strict";
+    RUNTIME_FAULT_PROBE_MAX_INTERVAL_MS = 30 * 6e4;
+    RUNTIME_FAULT_PROBE_MAX_TOTAL_MS = 6 * 60 * 6e4;
+    RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT = 60;
+    RUNTIME_ALLOCATION_MAX_ATTEMPTS = 3;
+  }
+});
+
 // ../contract/src/handle-passthrough.ts
 function makePassthroughProxy(spec) {
   const overrides = spec.overrides ?? {};
@@ -2260,6 +2272,7 @@ var init_src = __esm({
     init_storage();
     init_avatar();
     init_runtime();
+    init_runtime_allocation();
     init_handle_passthrough();
     init_parse_extra_args();
     init_daemon_package();
@@ -136770,7 +136783,7 @@ var init_bus = __esm({
           notify: (ids2, payload2) => this.io.notify(ids2, payload2)
         };
         let ok3 = true;
-        let failureReason = null;
+        let failureReason2 = null;
         for (const h of handlers) {
           const effectKey = `${h.name}#effect`;
           if (record9.appliedAt && await this.store.transaction((tx) => tx.isHandlerDone(record9.seq, effectKey))) {
@@ -136793,7 +136806,7 @@ var init_bus = __esm({
               await this.store.transaction((tx) => tx.deferEvent(record9.seq, "applied", lastErr, this.retryAt()));
               return false;
             }
-            failureReason = lastErr;
+            failureReason2 = lastErr;
           } else {
             await this.store.transaction(async (tx) => {
               if (buffered.length) await tx.appendEvents(buffered.map((b2) => ({
@@ -136812,7 +136825,7 @@ var init_bus = __esm({
             });
           }
         }
-        await this.store.transaction((tx) => tx.markEvent(record9.seq, "done", failureReason, this.clock.now()));
+        await this.store.transaction((tx) => tx.markEvent(record9.seq, "done", failureReason2, this.clock.now()));
         return ok3;
       }
       /* ═══════════════════════ scan：唯一的调度入口 ═══════════════════════ */
@@ -142340,7 +142353,10 @@ var init_dispatcher = __esm({
        * 画板只服务于「产界面」，评审/回复/收口回到能真正读写、能投票的通用运行时。
        */
       async resolveBindingFor(spec) {
-        const binding = await this.opts.resolveBinding?.(spec.actor) ?? void 0;
+        const binding = await this.opts.resolveBinding?.(spec.actor, {
+          ...spec.artifactId ? { unitOfWork: spec.artifactId } : {},
+          action: spec.action
+        }) ?? void 0;
         if (binding && spec.action !== "produce" && binding.runtimeKind === CANVAS_RUNTIME_KIND) {
           return { ...binding, runtimeKind: NON_PRODUCE_FALLBACK_RUNTIME_KIND };
         }
@@ -165172,9 +165188,24 @@ var init_live_chat = __esm({
         }
         if (turn.status === "running") {
           turn.cancelCause = "user";
-          try {
-            turn.handle.kill();
-          } catch {
+          const sendKill = turn.handle.sendKill;
+          if (typeof sendKill === "function") {
+            let sent = false;
+            try {
+              sent = sendKill.call(turn.handle);
+            } catch {
+            }
+            if (!sent) {
+              try {
+                turn.handle.cancelLocally?.();
+              } catch {
+              }
+            }
+          } else {
+            try {
+              turn.handle.kill();
+            } catch {
+            }
           }
         }
         return { stopped: true };
@@ -213451,6 +213482,9 @@ ${composed}`;
                     kill: () => {
                       void session.kill?.();
                     },
+                    // Bug 0232：把「帧送没送出去 / 就地收尾」这对出口透到注册表，`/stop` 才判得了。
+                    // 条件透传不是省事：上层按「方法在不在」分流，本地 adapter 没有这条就该没有。
+                    ...typeof session.sendKill === "function" ? { sendKill: () => session.sendKill(), cancelLocally: () => session.cancelLocally?.() ?? false } : {},
                     // ADR-0093 chat 道：把插入能力透到注册表，POST …/append 才有得调。
                     ...typeof session.appendInput === "function" ? { appendInput: (input) => session.appendInput(input) } : {},
                     get canAppendInput() {
@@ -215381,6 +215415,7 @@ var init_memory_registry_store = __esm({
       agentPrefs = /* @__PURE__ */ new Map();
       teams = /* @__PURE__ */ new Map();
       bindings = /* @__PURE__ */ new Map();
+      runtimeCandidates = /* @__PURE__ */ new Map();
       runtimeConfigs = /* @__PURE__ */ new Map();
       runtimeModelOverrides = /* @__PURE__ */ new Map();
       // key: ${runtimeId}::${modelId}
@@ -215482,6 +215517,28 @@ var init_memory_registry_store = __esm({
       async listBindings() {
         return [...this.bindings.values()].map((b2) => ({ ...b2 }));
       }
+      /* 候选 runtime（ADR 0616）：与 PG 实现同一套语义——按 ord 升序读、整份替换、同 (node,kind) 去重。 */
+      async listRuntimeCandidates(actorId) {
+        return (this.runtimeCandidates.get(actorId) ?? []).map((c) => ({ ...c }));
+      }
+      async replaceRuntimeCandidates(actorId, candidates) {
+        const seen = /* @__PURE__ */ new Set();
+        const rows = [];
+        for (const c of candidates) {
+          const key2 = `${c.nodeId}::${c.runtimeKind}`;
+          const model = typeof c.model === "string" && c.model.trim() ? c.model.trim() : null;
+          const existing = rows.findIndex((r) => `${r.nodeId}::${r.runtimeKind}` === key2);
+          if (existing >= 0) {
+            rows[existing] = { ...rows[existing], model };
+            continue;
+          }
+          seen.add(key2);
+          rows.push({ actorId, nodeId: c.nodeId, runtimeKind: c.runtimeKind, model, ord: rows.length });
+        }
+        if (rows.length === 0) this.runtimeCandidates.delete(actorId);
+        else this.runtimeCandidates.set(actorId, rows);
+        return rows.map((c) => ({ ...c }));
+      }
       async upsertRuntimeConfig(c) {
         this.runtimeConfigs.set(c.runtimeId, { ...c });
       }
@@ -222640,6 +222697,20 @@ var init_company_scoped_registry = __esm({
       async getBinding(actorId) {
         return await this.assertScoped(actorId, "getBinding") ? this.base.getBinding(actorId) : null;
       }
+      /* 候选 runtime（ADR 0616）：与 binding 同一道租户闸——越界读回空、越界写抛。
+      
+           刻意**不**按 `this.base` 有没有这两个方法来决定自己有没有（那样得写成类字段，而类字段的初始化
+           早于构造参数属性赋值，`this.base` 在那一刻还是 undefined）。底座没实现时：读回空、写抛一句
+           指名道姓的错——比静默丢掉一份候选清单强。 */
+      async listRuntimeCandidates(actorId) {
+        if (!this.base.listRuntimeCandidates) return [];
+        return await this.assertScoped(actorId, "listRuntimeCandidates") ? this.base.listRuntimeCandidates(actorId) : [];
+      }
+      async replaceRuntimeCandidates(actorId, candidates) {
+        await this.requireScoped(actorId, "replaceRuntimeCandidates");
+        if (!this.base.replaceRuntimeCandidates) throw new Error("\u5F53\u524D\u767B\u8BB0\u5B58\u50A8\u5B9E\u73B0\u4E0D\u652F\u6301\u5019\u9009\u8FD0\u884C\u65F6\uFF08replaceRuntimeCandidates \u672A\u5B9E\u73B0\uFF09");
+        return this.base.replaceRuntimeCandidates(actorId, candidates);
+      }
       async listBindings() {
         const [all2, ids2] = await Promise.all([this.base.listBindings(), this.scopeIds()]);
         const actors = [];
@@ -225804,6 +225875,8 @@ function wireRecoveredChatTurn(deps) {
     kill: () => {
       void handle.kill();
     },
+    // Bug 0232：重挂的轮一样会被人点停止、一样可能撞上节点够不着——同一对出口原样透传。
+    ...typeof handle.sendKill === "function" ? { sendKill: () => handle.sendKill(), cancelLocally: () => handle.cancelLocally?.() ?? false } : {},
     // ADR-0093 chat 道：重挂的轮同样能被插入——否则「serve 重启过」会变成一条人看不见的能力差异。
     // **整份透传**（2026-09-17）：此前只转 `text`，插话链路要的消费回执（`requireConsumptionReceipt`）、
     // 幂等键（`clientMessageKey`）与附件（`files` / `binaryFiles`）全被剥掉——runtime 照样读到了正文，
@@ -228400,6 +228473,32 @@ var init_service5 = __esm({
       listBindings() {
         return this.opts.store.listBindings();
       }
+      /* ---------- 候选 runtime（ADR 0616） ---------- */
+      /** 按 `ord` 升序。底座没实现（旧存储实现）→ 空清单，等于「只有主绑定」。 */
+      listRuntimeCandidates(actorId) {
+        return this.opts.store.listRuntimeCandidates?.(actorId) ?? Promise.resolve([]);
+      }
+      /**
+       * 整份替换候选清单（加 / 删 / 排序在界面上是同一个动作）。返回写后的整份。
+       *
+       * 校验放在这里而不是路由：候选是「派到哪」的事实源，写进去的 `(nodeId, runtimeKind)`
+       * 必须真的存在于这家公司的名册上——否则分配那一侧只会在几个月后的某次主机故障里，
+       * 报一句「节点不存在」然后把活挂住，而错是在写入那一刻犯的。
+       */
+      async replaceRuntimeCandidates(actorId, candidates, by) {
+        if (!this.opts.store.replaceRuntimeCandidates) {
+          throw new Error("\u5F53\u524D\u767B\u8BB0\u5B58\u50A8\u5B9E\u73B0\u4E0D\u652F\u6301\u5019\u9009\u8FD0\u884C\u65F6");
+        }
+        const saved = await this.opts.store.replaceRuntimeCandidates(actorId, candidates);
+        await this.audit({
+          kind: "binding_change",
+          actorId,
+          by,
+          at: this.now(),
+          detail: { candidates: saved.map((c) => ({ nodeId: c.nodeId, runtimeKind: c.runtimeKind, model: c.model ?? null })) }
+        });
+        return saved;
+      }
       /** 派单接缝的真实现：替换第零步假实现，第三部分代码零改动（决策 0001） */
       resolveBinding() {
         return async (actorId) => {
@@ -230849,6 +230948,42 @@ function actorsDomain(opts) {
       );
       return { status: 201, body: cfg };
     });
+    router.get("/api/actors/:id/runtime-candidates", async (req) => {
+      const { service } = await resolveCtx(req.auth.companyId);
+      return { status: 200, body: { items: await service.listRuntimeCandidates(req.params.id) } };
+    });
+    router.put("/api/actors/:id/runtime-candidates", async (req) => {
+      const { service } = await resolveCtx(req.auth.companyId);
+      const actorId = req.params.id;
+      if (!await service.getActor(actorId)) throw new ApiError(404, "NOT_FOUND", "\u6CA1\u6709\u8FD9\u4E2A\u5458\u5DE5");
+      const raw = req.body?.candidates;
+      if (!Array.isArray(raw)) throw new ApiError(400, "BAD_REQUEST", "candidates \u5FC5\u987B\u662F\u6570\u7EC4");
+      if (raw.length > 20) throw new ApiError(400, "BAD_REQUEST", "\u5019\u9009\u8FD0\u884C\u65F6\u6700\u591A 20 \u6761");
+      const candidates = [];
+      for (const item of raw) {
+        const c = item;
+        if (typeof c.nodeId !== "string" || !c.nodeId.trim()) throw new ApiError(400, "BAD_REQUEST", "\u6BCF\u6761\u5019\u9009\u90FD\u8981\u6709 nodeId");
+        if (typeof c.runtimeKind !== "string" || !c.runtimeKind.trim()) throw new ApiError(400, "BAD_REQUEST", "\u6BCF\u6761\u5019\u9009\u90FD\u8981\u6709 runtimeKind");
+        if (c.model !== void 0 && c.model !== null && typeof c.model !== "string") {
+          throw new ApiError(400, "BAD_REQUEST", "model \u5FC5\u987B\u662F\u5B57\u7B26\u4E32\u6216 null\uFF08null = \u8DDF\u968F\u8BE5 runtime \u9ED8\u8BA4\uFF09");
+        }
+        candidates.push({
+          nodeId: c.nodeId.trim(),
+          runtimeKind: c.runtimeKind.trim(),
+          ...c.model === void 0 ? {} : { model: typeof c.model === "string" ? c.model : null }
+        });
+      }
+      if (opts.resolveNodeTenancy) {
+        for (const c of candidates) {
+          const facts = await opts.resolveNodeTenancy(c.nodeId).catch(() => null) ?? null;
+          const foreign = foreignNodeBlock(facts, req.auth.companyId);
+          if (foreign) throw new ApiError(400, "NODE_NOT_IN_COMPANY", foreign);
+          if (!facts) throw new ApiError(400, "NODE_NOT_FOUND", `\u627E\u4E0D\u5230\u8282\u70B9 ${c.nodeId}`);
+        }
+      }
+      const items = await service.replaceRuntimeCandidates(actorId, candidates, req.auth.actor);
+      return { status: 200, body: { items } };
+    });
     router.get("/api/actors/:id/config/versions", async (req) => {
       const { service } = await resolveCtx(req.auth.companyId);
       return { status: 200, body: { items: await service.listConfigVersions(req.params.id) } };
@@ -242898,7 +243033,7 @@ var init_runtime_activity = __esm({
 
 // ../server/src/node-health.ts
 function deriveNodeHealth(input) {
-  const staleMs = input.staleMs ?? 9e4;
+  const staleMs = input.staleMs ?? NODE_HEARTBEAT_STALE_MS;
   const maxFail = input.maxConsecutiveFailures ?? 3;
   const cf = input.snapshot?.consecutiveFailures ?? 0;
   const heartbeatFresh = input.lastHeartbeatMs !== void 0 && input.now - input.lastHeartbeatMs < staleMs;
@@ -242957,7 +243092,7 @@ function describeNodeFault(f2, now = Date.now()) {
     `\u5728\u90A3\u4E4B\u524D\uFF0C\u91CD\u8BD5\u3001\u6362\u4EBA\u3001\u6539\u5185\u5BB9\u90FD\u4E0D\u4F1A\u8BA9\u5B83\u53D8\u597D\u3002`
   ].join("");
 }
-var NodeHealthTracker;
+var NodeHealthTracker, NODE_HEARTBEAT_STALE_MS;
 var init_node_health = __esm({
   "../server/src/node-health.ts"() {
     "use strict";
@@ -242999,6 +243134,7 @@ var init_node_health = __esm({
         this.onChange?.();
       }
     };
+    NODE_HEARTBEAT_STALE_MS = 9e4;
   }
 });
 
@@ -243034,6 +243170,15 @@ async function resolveRuntimeModels(deps, runtimeId) {
 }
 function nodesDomain(deps) {
   const quotaByNode = /* @__PURE__ */ new Map();
+  void deps.nodeStore.listRuntimeQuotas().then((rows) => {
+    for (const row of rows) {
+      if (row.runtimeKind !== "codex" && row.runtimeKind !== "claude-code") continue;
+      const list2 = quotaByNode.get(row.nodeId) ?? [];
+      list2.push({ kind: row.runtimeKind, status: row.status, checkedAt: row.checkedAt, windows: row.windows, ...row.retryAt ? { retryAt: row.retryAt } : {} });
+      quotaByNode.set(row.nodeId, list2);
+    }
+    if (rows.length > 0) console.log(`[nodes] \u989D\u5EA6\u6C34\u5408\uFF1A\u4ECE\u5E93\u91CC\u8BFB\u56DE ${rows.length} \u6761\u8FD0\u884C\u65F6\u989D\u5EA6`);
+  }).catch((err) => console.warn(`[nodes] \u989D\u5EA6\u6C34\u5408\u5931\u8D25\uFF08\u7167\u65E7\u7B49\u4E0B\u4E00\u6B21\u91C7\u96C6\uFF09\uFF1A${err instanceof Error ? err.message : String(err)}`));
   const UPDATE_TIMEOUT_MS = 15e4;
   const nodeUpdates = /* @__PURE__ */ new Map();
   function runtimeInfoOf(r) {
@@ -243134,7 +243279,9 @@ function nodesDomain(deps) {
       if (msg.type !== "runtime_quotas") return;
       const daemon = hub.connectedDaemons().find((d) => d.daemonId === daemonId);
       if (!daemon) return;
-      quotaByNode.set(daemonId, sanitizeRuntimeQuotas(msg.quotas).filter((q2) => daemon.meta.adapters.includes(q2.kind)));
+      const quotas = sanitizeRuntimeQuotas(msg.quotas).filter((q2) => daemon.meta.adapters.includes(q2.kind));
+      quotaByNode.set(daemonId, quotas);
+      void nodeStore.saveRuntimeQuotas(daemonId, quotas.map((q2) => ({ ...q2, nodeId: daemonId, runtimeKind: q2.kind }))).catch((err) => console.warn(`[nodes] \u989D\u5EA6\u843D\u5E93\u5931\u8D25(node=${daemonId})\uFF1A${err instanceof Error ? err.message : String(err)}`));
     });
     hub.addMessageListener(async (daemonId, msg) => {
       if (msg.type !== "hello") return;
@@ -243286,6 +243433,10 @@ function nodesDomain(deps) {
           ...sourceIpById.get(n.id) ? { sourceIp: sourceIpById.get(n.id) } : {},
           ...n.name ? { name: n.name } : {},
           ...updateStatus ? { updateStatus } : {},
+          /* 并发上限与当前在跑数（ADR 0616 D2）：`maxConcurrent` 只在真设过时带这一格——
+             缺省就是「未设置 = 不限制」，带一个 null 进去会让前端不得不再判一次。 */
+          ...n.maxConcurrent != null ? { maxConcurrent: n.maxConcurrent } : {},
+          activeRunCount,
           ...lastDisconnectedAt || lastReconnectedAt ? {
             connection: {
               ...lastDisconnectedAt ? { lastDisconnectedAt } : {},
@@ -243485,6 +243636,24 @@ function nodesDomain(deps) {
       deps.onStatusChange?.();
       return { status: 200, body: { ok: true, name } };
     });
+    router.put("/api/nodes/:nodeId/max-concurrent", async (req) => {
+      const nodeId = req.params["nodeId"];
+      if (!nodeId) return { status: 400, body: { error: "missing nodeId" } };
+      const forbidden = await forbidUnlessOrgManager(req, "\u8BBE\u7F6E\u8282\u70B9\u5E76\u53D1\u4E0A\u9650");
+      if (forbidden) return forbidden;
+      const scope2 = req.auth.companyId !== void 0 ? { companyId: req.auth.companyId } : void 0;
+      const node2 = (await deps.nodeStore.listNodes(scope2)).find((n) => n.id === nodeId);
+      if (!node2) return { status: 404, body: { error: "NODE_NOT_FOUND", message: "\u8282\u70B9\u4E0D\u5B58\u5728\u6216\u4E0D\u5C5E\u4E8E\u5F53\u524D\u7EC4\u7EC7" } };
+      const raw = req.body ?? {};
+      const value2 = raw.maxConcurrent;
+      if (value2 !== null && value2 !== void 0 && !(Number.isSafeInteger(value2) && value2 >= 0 && value2 <= 1e3)) {
+        return { status: 400, body: { error: "BAD_REQUEST", message: "maxConcurrent \u5FC5\u987B\u662F 0\u20131000 \u7684\u6574\u6570\uFF0C\u6216 null\uFF08\u4E0D\u9650\u5236\uFF09" } };
+      }
+      const limit = value2 === void 0 || value2 === null ? null : value2;
+      await deps.nodeStore.setNodeMaxConcurrent(nodeId, limit);
+      deps.onStatusChange?.();
+      return { status: 200, body: { ok: true, maxConcurrent: limit } };
+    });
     router.delete("/api/nodes/:nodeId", async (req) => {
       const nodeId = req.params["nodeId"];
       if (!nodeId) return { status: 400, body: { error: "missing nodeId" } };
@@ -243706,6 +243875,353 @@ var init_runtime_drift = __esm({
   }
 });
 
+// ../server/src/domains/runtime-allocation/allocate.ts
+function runtimeTargetKey(target) {
+  return `${target.nodeId}::${target.runtimeKind}`;
+}
+function idlenessOf(node2) {
+  const limit = node2.maxConcurrent;
+  if (limit === null || limit === void 0) return 1;
+  if (limit <= 0) return 0;
+  return Math.max(0, 1 - node2.activeRunCount / limit);
+}
+function atCapacity(node2) {
+  const limit = node2.maxConcurrent;
+  if (limit === null || limit === void 0) return false;
+  return node2.activeRunCount >= limit;
+}
+function quotaDerateFactor(quota) {
+  if (!quota || quota.status !== "ok" || quota.windows.length === 0) return { factor: 1 };
+  const worst = Math.max(...quota.windows.map((w2) => w2.usedPercent));
+  if (worst <= RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT) return { factor: 1, worstUsedPercent: worst };
+  const remaining = Math.max(0, 100 - worst);
+  return { factor: remaining / (100 - RUNTIME_QUOTA_DERATE_THRESHOLD_PERCENT), worstUsedPercent: worst };
+}
+function faultFromQuota(target, quota, now) {
+  if (!quota) return null;
+  const base = { nodeId: target.nodeId, runtimeKind: target.runtimeKind, markedAt: quota.checkedAt, attempts: 0 };
+  if (quota.status === "unauthenticated") {
+    return { ...base, reason: "unauthenticated", awaitingManual: true, detail: "\u8FD0\u884C\u65F6\u767B\u5F55\u5DF2\u5931\u6548\uFF0C\u9700\u8981\u5728\u8BE5\u673A\u5668\u4E0A\u91CD\u65B0\u767B\u5F55" };
+  }
+  if (quota.status === "rate_limited") {
+    return {
+      ...base,
+      reason: "quota-exhausted",
+      awaitingManual: false,
+      ...quota.retryAt ? { nextProbeAt: quota.retryAt } : {},
+      detail: "provider \u62A5\u9650\u6D41/\u989D\u5EA6\u8017\u5C3D"
+    };
+  }
+  if (quota.status !== "ok") return null;
+  const exhausted = quota.windows.filter((w2) => w2.usedPercent >= 100);
+  if (exhausted.length === 0) return null;
+  const resets = exhausted.map((w2) => w2.resetsAt).filter((v2) => Boolean(v2)).sort();
+  const latest = resets.at(-1);
+  return {
+    ...base,
+    reason: "quota-exhausted",
+    awaitingManual: false,
+    ...latest && Date.parse(latest) > now ? { nextProbeAt: latest } : {},
+    detail: `\u989D\u5EA6\u5DF2\u7528\u6EE1\uFF08${exhausted.map((w2) => `${w2.bucket} ${Math.round(w2.usedPercent)}%`).join("\u3001")}\uFF09`
+  };
+}
+function faultIsBlocking(fault, now) {
+  if (fault.awaitingManual) return true;
+  if (!fault.nextProbeAt) return true;
+  return Date.parse(fault.nextProbeAt) > now;
+}
+function failureReason(rejections) {
+  if (rejections.length === 0) return "no-candidates";
+  const causes = new Set(rejections.map((r) => r.cause));
+  if (causes.size === 1) {
+    const only = [...causes][0];
+    if (only === "at-capacity") return "all-at-capacity";
+    if (only === "already-tried") return "all-tried";
+    return "all-faulted";
+  }
+  const faultLike = /* @__PURE__ */ new Set(["node-unknown", "node-offline", "runtime-missing", "faulted"]);
+  if ([...causes].every((c) => faultLike.has(c))) return "all-faulted";
+  return "mixed";
+}
+function allocateRuntime(input, now = Date.now()) {
+  const rejections = [];
+  const eligible = [];
+  for (const candidate of input.candidates) {
+    const key2 = runtimeTargetKey(candidate);
+    const node2 = input.nodes.get(candidate.nodeId);
+    const nodeName = node2?.displayName?.trim() || candidate.nodeId;
+    const reject = (cause, detail) => rejections.push({ nodeId: candidate.nodeId, runtimeKind: candidate.runtimeKind, nodeName, cause, ...detail ? { detail } : {} });
+    if (input.alreadyTried?.has(key2)) {
+      reject("already-tried", input.triedDetail?.get(key2) ?? "\u672C\u6B21\u5DF2\u8BD5\u8FC7\u5E76\u5931\u8D25");
+      continue;
+    }
+    if (!node2) {
+      reject("node-unknown", "\u8282\u70B9\u4E0D\u5B58\u5728\u3001\u5DF2\u5220\u9664\uFF0C\u6216\u4E0D\u5C5E\u4E8E\u5F53\u524D\u516C\u53F8");
+      continue;
+    }
+    if (!node2.online) {
+      reject("node-offline", "\u8282\u70B9\u5F53\u524D\u79BB\u7EBF");
+      continue;
+    }
+    if (!node2.runtimeKinds.includes(candidate.runtimeKind)) {
+      reject("runtime-missing", "\u8BE5\u673A\u5668\u4E0A\u6CA1\u6709\u8FD9\u4E2A\u8FD0\u884C\u65F6\uFF08\u672A\u88C5\u597D\u3001\u5DF2\u5378\u8F7D\u6216\u672A\u4E0A\u62A5\uFF09");
+      continue;
+    }
+    const fault = input.faults?.get(key2) ?? faultFromQuota(candidate, input.quotas?.get(key2), now);
+    if (fault && faultIsBlocking(fault, now)) {
+      reject("faulted", `${fault.reason}${fault.detail ? `\uFF1A${fault.detail}` : ""}${fault.awaitingManual ? "\uFF08\u7B49\u4EBA\u5DE5\u6062\u590D\uFF09" : ""}`);
+      continue;
+    }
+    if (atCapacity(node2)) {
+      reject("at-capacity", `\u5728\u8DD1 ${node2.activeRunCount} / \u4E0A\u9650 ${node2.maxConcurrent}`);
+      continue;
+    }
+    eligible.push(candidate);
+  }
+  if (eligible.length === 0) return { ok: false, reason: failureReason(rejections), rejections };
+  const primary = eligible.find((c) => c.primary);
+  const rank = (candidate) => {
+    const node2 = input.nodes.get(candidate.nodeId);
+    const idleness = idlenessOf(node2);
+    const { factor, worstUsedPercent } = quotaDerateFactor(input.quotas?.get(runtimeTargetKey(candidate)));
+    return {
+      candidate,
+      nodeName: node2.displayName?.trim() || candidate.nodeId,
+      idleness,
+      quotaFactor: factor,
+      weight: idleness * factor,
+      ...worstUsedPercent !== void 0 ? { worstQuotaUsedPercent: worstUsedPercent } : {}
+    };
+  };
+  if (primary) {
+    const ranked2 = [rank(primary)];
+    return { ok: true, chosen: primary, nodeName: ranked2[0].nodeName, source: "primary", ranked: ranked2, rejections };
+  }
+  const ranked = eligible.map(rank).sort((a, b2) => b2.weight - a.weight || a.candidate.ord - b2.candidate.ord || a.candidate.nodeId.localeCompare(b2.candidate.nodeId) || a.candidate.runtimeKind.localeCompare(b2.candidate.runtimeKind));
+  const top = ranked[0];
+  return { ok: true, chosen: top.candidate, nodeName: top.nodeName, source: "candidate", ranked, rejections };
+}
+function canRetryAllocation(attempt) {
+  return attempt < RUNTIME_ALLOCATION_MAX_ATTEMPTS;
+}
+function describeAllocationChoice(result) {
+  const head = result.source === "primary" ? `\u9009\u4E2D\u4E3B\u8FD0\u884C\u65F6 ${result.nodeName} \xB7 ${result.chosen.runtimeKind}` : `\u4E3B\u8FD0\u884C\u65F6\u4E0D\u53EF\u7528\uFF0C\u6309\u6743\u91CD\u9009\u4E2D ${result.nodeName} \xB7 ${result.chosen.runtimeKind}`;
+  const detail = result.ranked.map((r) => {
+    const quota = r.worstQuotaUsedPercent === void 0 ? "\u65E0\u989D\u5EA6\u6570\u636E" : `\u989D\u5EA6\u5DF2\u7528 ${Math.round(r.worstQuotaUsedPercent)}%`;
+    return `${r.nodeName}\xB7${r.candidate.runtimeKind} \u6743\u91CD ${r.weight.toFixed(2)}\uFF08\u7A7A\u95F2\u5EA6 ${r.idleness.toFixed(2)} \xD7 \u989D\u5EA6\u7CFB\u6570 ${r.quotaFactor.toFixed(2)}\uFF0C${quota}\uFF09`;
+  }).join("\uFF1B");
+  const skipped = result.rejections.length > 0 ? `\uFF1B\u6392\u9664 ${result.rejections.map((r) => `${r.nodeName}\xB7${r.runtimeKind}(${r.cause})`).join("\u3001")}` : "";
+  return `${head}\u3002${detail}${skipped}`;
+}
+var init_allocate = __esm({
+  "../server/src/domains/runtime-allocation/allocate.ts"() {
+    "use strict";
+    init_src();
+  }
+});
+
+// ../server/src/domains/runtime-allocation/errors.ts
+function describeRejections(rejections) {
+  return rejections.map((r) => `${r.nodeName} \xB7 ${r.runtimeKind}\uFF08${CAUSE_TEXT[r.cause]}${r.detail ? `\uFF1A${r.detail}` : ""}\uFF09`).join("\uFF1B");
+}
+function requireAllocation(result, who) {
+  if (result.ok) return result;
+  const subject = who?.actorName?.trim() ? `\u300C${who.actorName.trim()}\u300D` : "\u8FD9\u4F4D Agent";
+  const what = who?.what?.trim() ? `${who.what.trim()}\uFF1A` : "";
+  const detail = describeRejections(result.rejections);
+  if (result.reason === "no-candidates") {
+    throw new RuntimeAllocationError(
+      "RUNTIME_ALLOCATION_NO_CANDIDATES",
+      `${what}${subject}\u6CA1\u6709\u53EF\u7528\u7684\u8FD0\u884C\u65F6\u76EE\u6807\uFF1A\u65E2\u6CA1\u6709\u4E3B\u8FD0\u884C\u65F6\u7ED1\u5B9A\uFF0C\u4E5F\u6CA1\u6709\u914D\u7F6E\u5019\u9009\u8FD0\u884C\u65F6\u3002\u8BF7\u5728\u5458\u5DE5\u8BE6\u60C5\u9875\u7684\u300C\u9ED8\u8BA4\u8FD0\u884C\u914D\u7F6E\u300D\u91CC\u7ED1\u5B9A\u4E00\u4E2A\u8FD0\u884C\u65F6\uFF0C\u6216\u52A0\u4E00\u6761\u5019\u9009\u8FD0\u884C\u65F6\u3002`,
+      result.rejections
+    );
+  }
+  if (result.reason === "all-at-capacity") {
+    throw new RuntimeAllocationError(
+      "RUNTIME_ALLOCATION_ALL_AT_CAPACITY",
+      `${what}${subject}\u7684\u8FD0\u884C\u65F6\u5168\u90E8\u5DF2\u5230\u5E76\u53D1\u4E0A\u9650\uFF0C\u672C\u6B21\u6CA1\u6709\u6D3E\u51FA\uFF1A${detail}\u3002\u8BF7\u7B49\u5F53\u524D\u4F1A\u8BDD\u8DD1\u5B8C\uFF0C\u6216\u5728\u8FD0\u884C\u65F6\u7BA1\u7406\u9875\u628A\u8FD9\u4E9B\u8282\u70B9\u7684\u5E76\u53D1\u4E0A\u9650\u8C03\u9AD8\u3002`,
+      result.rejections,
+      503
+    );
+  }
+  throw new RuntimeAllocationError(
+    "RUNTIME_ALLOCATION_ALL_UNAVAILABLE",
+    `${what}${subject}\u7684\u8FD0\u884C\u65F6\u76EE\u524D\u90FD\u4E0D\u53EF\u7528\uFF0C\u672C\u6B21\u6CA1\u6709\u6D3E\u51FA\uFF1A${detail}\u3002\u8BF7\u786E\u8BA4\u90A3\u4E9B\u673A\u5668\u5F00\u7740\u3001\u8282\u70B9\u7A0B\u5E8F\u5728\u8FD0\u884C\u3001\u8FD0\u884C\u65F6\u5DF2\u767B\u5F55\u4E14\u989D\u5EA6\u672A\u8017\u5C3D\uFF1B\u6216\u5728\u5458\u5DE5\u8BE6\u60C5\u9875\u52A0\u4E00\u6761\u522B\u7684\u5019\u9009\u8FD0\u884C\u65F6\u3002`,
+    result.rejections,
+    result.reason === "all-tried" ? 409 : 503
+  );
+}
+var RuntimeAllocationError, CAUSE_TEXT;
+var init_errors6 = __esm({
+  "../server/src/domains/runtime-allocation/errors.ts"() {
+    "use strict";
+    RuntimeAllocationError = class extends Error {
+      constructor(code2, message, rejections, status = 409) {
+        super(message);
+        this.code = code2;
+        this.rejections = rejections;
+        this.status = status;
+        this.name = "RuntimeAllocationError";
+      }
+    };
+    CAUSE_TEXT = {
+      "node-unknown": "\u8282\u70B9\u4E0D\u53EF\u7528",
+      "node-offline": "\u8282\u70B9\u79BB\u7EBF",
+      "runtime-missing": "\u673A\u5668\u4E0A\u6CA1\u6709\u8FD9\u4E2A\u8FD0\u884C\u65F6",
+      faulted: "\u6807\u8BB0\u4E3A\u6545\u969C",
+      "at-capacity": "\u5DF2\u5230\u5E76\u53D1\u4E0A\u9650",
+      "already-tried": "\u672C\u8F6E\u5DF2\u8BD5\u8FC7\u5E76\u5931\u8D25"
+    };
+  }
+});
+
+// ../server/src/domains/runtime-allocation/service.ts
+function isRuntimeClassFailure(reason, errorMessage2) {
+  if (reason === "server-unreachable" || reason === "rate-limit" || reason === "auth-error") return true;
+  if (reason === "error" && errorMessage2?.startsWith("\u8FD9\u4E00\u8F6E\u6CA1\u80FD\u5728\u8282\u70B9\u4E0A\u542F\u52A8\uFF1A")) return true;
+  return false;
+}
+function createRuntimeAllocator(ports) {
+  const units = /* @__PURE__ */ new Map();
+  const log3 = ports.log ?? ((line2) => console.log(line2));
+  const sweep = (nowMs) => {
+    for (const [key2, state] of units) if (nowMs - state.updatedAtMs > UNIT_STATE_TTL_MS) units.delete(key2);
+  };
+  const stateOf = (unitOfWork, nowMs) => {
+    sweep(nowMs);
+    const existing = units.get(unitOfWork);
+    if (existing) return existing;
+    const fresh = { tried: /* @__PURE__ */ new Map(), updatedAtMs: nowMs };
+    units.set(unitOfWork, fresh);
+    return fresh;
+  };
+  const flatten = (binding, candidates, primary) => {
+    const out = [];
+    const seen = /* @__PURE__ */ new Set();
+    const head = primary ?? (binding?.nodeId && binding.runtimeKind && binding.status === "active" ? { nodeId: binding.nodeId, runtimeKind: binding.runtimeKind, model: null } : null);
+    if (head) {
+      out.push({ nodeId: head.nodeId, runtimeKind: head.runtimeKind, primary: true, ord: -1, model: head.model ?? null });
+      seen.add(runtimeTargetKey(head));
+    }
+    for (const c of candidates) {
+      const key2 = runtimeTargetKey(c);
+      if (seen.has(key2)) continue;
+      seen.add(key2);
+      out.push({ nodeId: c.nodeId, runtimeKind: c.runtimeKind, primary: false, ord: c.ord, model: c.model ?? null });
+    }
+    return out;
+  };
+  const gather = async (actorId, primary) => {
+    const [binding, candidateRows, nodeStates, faultRows, quotaRows] = await Promise.all([
+      ports.primaryBinding(actorId).catch(() => null),
+      ports.candidates(actorId).catch(() => []),
+      ports.nodeStates(),
+      ports.faults().catch(() => []),
+      ports.quotas().catch(() => [])
+    ]);
+    return {
+      candidates: flatten(binding, candidateRows, primary),
+      nodes: new Map(nodeStates.map((n) => [n.nodeId, n])),
+      faults: new Map(faultRows.map((f2) => [runtimeTargetKey(f2), f2])),
+      quotas: new Map(quotaRows.map((q2) => [runtimeTargetKey(q2), q2]))
+    };
+  };
+  return {
+    /** 跑一次分配但**不抛错**（给需要自己决定怎么呈现失败的调用方，比如要落一条失败卡的那条路）。 */
+    async tryAllocate(input) {
+      const now = input.now ?? Date.now();
+      const state = stateOf(input.unitOfWork, now);
+      const gathered = await gather(input.actorId, input.primary);
+      return allocateRuntime({
+        candidates: gathered.candidates,
+        nodes: gathered.nodes,
+        faults: gathered.faults,
+        quotas: gathered.quotas,
+        alreadyTried: new Set(state.tried.keys()),
+        triedDetail: state.tried
+      }, now);
+    },
+    /**
+     * 分配，选不出就抛 {@link RuntimeAllocationError}（经 `requireAllocation` 那一处——日后接排队改那里）。
+     * 成功时记下「这件活这次派到哪」，供 {@link noteFailure} 回报。
+     */
+    async allocateFor(input) {
+      const now = input.now ?? Date.now();
+      const state = stateOf(input.unitOfWork, now);
+      const actorName = await ports.actorName?.(input.actorId).catch(() => null) ?? null;
+      if (!canRetryAllocation(state.tried.size)) {
+        const tried = [...state.tried.entries()].map(([key2, detail]) => {
+          const [nodeId, runtimeKind] = key2.split("::");
+          return { nodeId, runtimeKind, nodeName: nodeId, cause: "already-tried", detail };
+        });
+        throw new RuntimeAllocationError(
+          "RUNTIME_ALLOCATION_ALL_UNAVAILABLE",
+          `${input.what ? `${input.what}\uFF1A` : ""}${actorName ? `\u300C${actorName}\u300D` : "\u8FD9\u4F4D Agent"}\u7684\u8FD0\u884C\u65F6\u5DF2\u8FDE\u7EED\u6362\u4E86 ${RUNTIME_ALLOCATION_MAX_ATTEMPTS} \u6B21\u90FD\u6CA1\u8DD1\u8D77\u6765\uFF0C\u4E0D\u518D\u81EA\u52A8\u91CD\u8BD5\uFF1A${tried.map((t) => `${t.nodeName} \xB7 ${t.runtimeKind}\uFF08${t.detail}\uFF09`).join("\uFF1B")}\u3002\u8BF7\u5148\u4FEE\u597D\u5176\u4E2D\u4E00\u53F0\u673A\u5668\uFF0C\u6216\u5728\u5458\u5DE5\u8BE6\u60C5\u9875\u52A0\u4E00\u6761\u522B\u7684\u5019\u9009\u8FD0\u884C\u65F6\u540E\u91CD\u65B0\u53D1\u8D77\u3002`,
+          tried
+        );
+      }
+      const result = requireAllocation(
+        await this.tryAllocate({ actorId: input.actorId, unitOfWork: input.unitOfWork, ...input.primary !== void 0 ? { primary: input.primary } : {}, now }),
+        { actorName, ...input.what ? { what: input.what } : {} }
+      );
+      const attempt = state.tried.size + 1;
+      state.lastAssigned = { nodeId: result.chosen.nodeId, runtimeKind: result.chosen.runtimeKind };
+      state.updatedAtMs = now;
+      const explanation = describeAllocationChoice(result);
+      log3(`[runtime-alloc] ${input.unitOfWork} \u7B2C ${attempt} \u6B21\uFF1A${explanation}`);
+      return {
+        binding: { actorId: input.actorId, nodeId: result.chosen.nodeId, runtimeKind: result.chosen.runtimeKind, status: "active" },
+        model: result.chosen.model ?? null,
+        source: result.source,
+        attempt,
+        explanation
+      };
+    },
+    /**
+     * 这件活在上次分给它的那个目标上**因 runtime/节点原因**失败了。下一次 `allocateFor` 会排除它。
+     *
+     * 返回 false = 这条失败不算 runtime/节点的错（agent 自己干砸了），什么都没记。
+     */
+    noteFailure(input) {
+      if (!isRuntimeClassFailure(input.reason, input.errorMessage)) return false;
+      const now = input.now ?? Date.now();
+      const state = units.get(input.unitOfWork);
+      const target = input.target ?? state?.lastAssigned;
+      if (!state || !target) return false;
+      const detail = input.errorMessage?.trim() || String(input.reason ?? "runtime \u5931\u8D25");
+      state.tried.set(runtimeTargetKey(target), detail.slice(0, 200));
+      state.updatedAtMs = now;
+      log3(`[runtime-alloc] ${input.unitOfWork} \u5728 ${target.nodeId} \xB7 ${target.runtimeKind} \u4E0A\u5931\u8D25\uFF08${detail.slice(0, 80)}\uFF09\u2192 \u4E0B\u4E00\u8F6E\u6362\u5019\u9009`);
+      return true;
+    },
+    /**
+     * 这件活这一轮**不是因为 runtime/节点**结束的（跑成了、agent 自己干砸了、被停了）→ 丢掉整条失败链。
+     *
+     * 这是重试上限只对「连着换机器都没跑起来」生效的机制：正常派发一次就清一次，
+     * 所以一个长命的工单节点不会因为派过很多次而撞上上限。
+     */
+    noteSettled(unitOfWork) {
+      units.delete(unitOfWork);
+    },
+    /** 只给测试与诊断用：这件活当前失败链的账。 */
+    inspect(unitOfWork) {
+      const s2 = units.get(unitOfWork);
+      if (!s2) return null;
+      return { failures: s2.tried.size, tried: [...s2.tried.keys()], ...s2.lastAssigned ? { lastAssigned: s2.lastAssigned } : {} };
+    }
+  };
+}
+var UNIT_STATE_TTL_MS;
+var init_service7 = __esm({
+  "../server/src/domains/runtime-allocation/service.ts"() {
+    "use strict";
+    init_src();
+    init_allocate();
+    init_errors6();
+    UNIT_STATE_TTL_MS = 2 * 60 * 6e4;
+  }
+});
+
 // ../server/src/domains/types/index.ts
 function typesDomain(deps) {
   const adminOf = async (companyId) => {
@@ -243829,6 +244345,10 @@ var init_node_store = __esm({
     MemoryNodeStore = class {
       nodes = /* @__PURE__ */ new Map();
       runtimes = /* @__PURE__ */ new Map();
+      /** 故障标记，键 = `${nodeId}::${runtimeKind}`（与 `runtimeTargetKey` 同一个键形状）。 */
+      faults = /* @__PURE__ */ new Map();
+      /** 落库额度，键同上。 */
+      quotas = /* @__PURE__ */ new Map();
       async upsertNode(node2) {
         this.nodes.set(node2.id, { ...this.nodes.get(node2.id), ...node2 });
       }
@@ -243941,6 +244461,27 @@ var init_node_store = __esm({
         }
         return { nodeDeleted: false };
       }
+      /* ---------- 运行时分配（ADR 0616） ---------- */
+      async setNodeMaxConcurrent(nodeId, limit) {
+        const n = this.nodes.get(nodeId);
+        if (n) n.maxConcurrent = limit;
+      }
+      async upsertRuntimeFault(fault) {
+        this.faults.set(`${fault.nodeId}::${fault.runtimeKind}`, { ...fault });
+      }
+      async clearRuntimeFault(nodeId, runtimeKind) {
+        return this.faults.delete(`${nodeId}::${runtimeKind}`);
+      }
+      async listRuntimeFaults(filter) {
+        return [...this.faults.values()].filter((f2) => filter?.nodeId ? f2.nodeId === filter.nodeId : true).filter((f2) => filter?.companyId ? this.nodes.get(f2.nodeId)?.companyId === filter.companyId : true).map((f2) => ({ ...f2 }));
+      }
+      async saveRuntimeQuotas(nodeId, quotas) {
+        for (const key2 of [...this.quotas.keys()]) if (key2.startsWith(`${nodeId}::`)) this.quotas.delete(key2);
+        for (const q2 of quotas) this.quotas.set(`${q2.nodeId}::${q2.runtimeKind}`, { ...q2 });
+      }
+      async listRuntimeQuotas(filter) {
+        return [...this.quotas.values()].filter((q2) => filter?.nodeId ? q2.nodeId === filter.nodeId : true).filter((q2) => filter?.companyId ? this.nodes.get(q2.nodeId)?.companyId === filter.companyId : true).map((q2) => ({ ...q2 }));
+      }
     };
     FileNodeStore = class _FileNodeStore extends MemoryNodeStore {
       constructor(file) {
@@ -243953,15 +244494,19 @@ var init_node_store = __esm({
           const snap = JSON.parse(fs26.readFileSync(file, "utf8"));
           for (const n of snap.nodes ?? []) s2.nodes.set(n.id, n);
           for (const r of snap.runtimes ?? []) s2.runtimes.set(r.id, r);
+          for (const f2 of snap.faults ?? []) s2.faults.set(`${f2.nodeId}::${f2.runtimeKind}`, f2);
+          for (const q2 of snap.quotas ?? []) s2.quotas.set(`${q2.nodeId}::${q2.runtimeKind}`, q2);
         } catch {
-          fs26.writeFileSync(file, JSON.stringify({ nodes: [], runtimes: [] }, null, 2));
+          fs26.writeFileSync(file, JSON.stringify({ nodes: [], runtimes: [], faults: [], quotas: [] }, null, 2));
         }
         return s2;
       }
       flush() {
         fs26.writeFileSync(this.file, JSON.stringify({
           nodes: [...this.nodes.values()],
-          runtimes: [...this.runtimes.values()]
+          runtimes: [...this.runtimes.values()],
+          faults: [...this.faults.values()],
+          quotas: [...this.quotas.values()]
         }, null, 2));
       }
       async upsertNode(node2) {
@@ -244025,6 +244570,25 @@ var init_node_store = __esm({
         this.flush();
         return r;
       }
+      // ⚠ 同上：并发上限、故障标记、额度三类写入漏了 override 就只活在内存，重启回到「没上限、没故障、
+      // 没额度数据」——而那三件事恰恰都是「重启不能丢」才有意义。
+      async setNodeMaxConcurrent(nodeId, limit) {
+        await super.setNodeMaxConcurrent(nodeId, limit);
+        this.flush();
+      }
+      async upsertRuntimeFault(fault) {
+        await super.upsertRuntimeFault(fault);
+        this.flush();
+      }
+      async clearRuntimeFault(nodeId, runtimeKind) {
+        const r = await super.clearRuntimeFault(nodeId, runtimeKind);
+        if (r) this.flush();
+        return r;
+      }
+      async saveRuntimeQuotas(nodeId, quotas) {
+        await super.saveRuntimeQuotas(nodeId, quotas);
+        this.flush();
+      }
     };
   }
 });
@@ -245298,7 +245862,7 @@ function compactModelChunks(rows) {
   return out;
 }
 var EVENT_PAGE_LIMIT, MODEL_CHUNK_COMPACT_WINDOW_MS, MODEL_CHUNK_RAW_MULTIPLIER, TraceService;
-var init_service7 = __esm({
+var init_service8 = __esm({
   "../server/src/domains/trace/service.ts"() {
     "use strict";
     init_sink();
@@ -246074,9 +246638,9 @@ function createTraceDomain(opts) {
 var init_trace2 = __esm({
   "../server/src/domains/trace/index.ts"() {
     "use strict";
-    init_service7();
+    init_service8();
     init_routes9();
-    init_service7();
+    init_service8();
     init_routes9();
     init_read_scope();
     init_sink();
@@ -246609,7 +247173,7 @@ function stateFromAttempt(attempt, handoff, checkpoint, now, stalledAfterMs, ope
   return "failed";
 }
 var import_node_crypto64, BLOCKING_STATES, HANDOFF_OUTCOMES2, RESUME_EXTERNAL_EFFECT_LIMIT, RESUME_SNAPSHOT_PREFIX, RESUME_SNAPSHOT_SUFFIX, ExecutionContinuityService;
-var init_service8 = __esm({
+var init_service9 = __esm({
   "../server/src/domains/execution-continuity/service.ts"() {
     "use strict";
     init_src();
@@ -247429,8 +247993,8 @@ var init_execution_continuity2 = __esm({
   "../server/src/domains/execution-continuity/index.ts"() {
     "use strict";
     init_routes10();
-    init_service8();
-    init_service8();
+    init_service9();
+    init_service9();
     init_routes10();
     init_handoff_work_bridge();
     init_upstream_handoff_input();
@@ -250517,7 +251081,7 @@ function appendSourceNote(brief, automation, source, atIso) {
 \u672C\u5DE5\u5355\u7531\u81EA\u52A8\u5316\u300C${automation.name}\u300D\u4E8E ${atIso} \u89E6\u53D1\uFF08\u6765\u6E90\uFF1A${source}\uFF09\u3002\u5F00\u5DE5\u540E\u8BF7\u628A\u5DE5\u5355\u6807\u9898\u6539\u6210\u51C6\u786E\u53CD\u6620\u5B9E\u9645\u5DE5\u4F5C\u7684\u63CF\u8FF0\u3002`;
 }
 var import_node_crypto66, DATE_TOKEN, AutomationsService, EVENT_RETRY_BASE_MS, EVENT_RETRY_MAX_MS, EVENT_RETRY_MAX_ATTEMPTS, eventAttempts, eventLastAttemptAt, eventLastError, CHAT_REPLY_MAX;
-var init_service9 = __esm({
+var init_service10 = __esm({
   "../server/src/domains/automations/service.ts"() {
     "use strict";
     import_node_crypto66 = require("node:crypto");
@@ -252252,7 +252816,7 @@ var init_routes11 = __esm({
     init_src();
     init_templates();
     init_router();
-    init_service9();
+    init_service10();
     init_projection2();
     init_scheduler();
     init_registry3();
@@ -252367,10 +252931,10 @@ function createAutomationsDomain(opts) {
 var init_automations = __esm({
   "../server/src/domains/automations/index.ts"() {
     "use strict";
-    init_service9();
+    init_service10();
     init_webhook();
     init_routes11();
-    init_service9();
+    init_service10();
     init_routes11();
     init_projection2();
     init_webhook();
@@ -253186,6 +253750,32 @@ var init_daemon_adapter = __esm({
           }
         }
       }
+      /**
+       * Bug 0232：**就地**收尾一次派发——用户点了停止、而 kill 帧送不出去（节点 socket 非 OPEN）时用。
+       *
+       * 走的是和「服务端自判死」完全同一个 {@link settle}，所以三件必须做的事一次做齐：
+       * 兑现在途的插话等待者、触发 exitCbs（本轮收口、释放 `chat_session_turns` 的槽、输入框解冻）、
+       * 把 dispatchId 记进 `settledDispatchIds`。
+       *
+       * 为什么这样不会造出两个 agent 一起跑（防双跑的三道防线都是现成的）：
+       *  1. 节点上的会话进程自己有看门狗——连不上服务端超过 `SESSION_LIMITS.suicideAfterUnreachableMs`
+       *     （5 分钟）就自尽（`packages/cli/src/daemon/session-process.ts`）；
+       *  2. 契约上钉着不变式 `suicideAfterUnreachableMs ≤ reapGraceMs`，服务端判死必然发生在它自尽之后；
+       *  3. 它要是在这之前连回来了，hub 的三级认领（`daemon-hub.ts` 的 `judgeSession`）第一级就命中
+       *     `settledDispatchIds` → 判 `settled` → 下发 `evict` → 会话 `selfTerminate("evicted")`。
+       * 所以僵尸的存活时间是 `min(网络恢复时间, 5 分钟)`，这个窗口自己会关。
+       *
+       * 归因不在这里写：`cancelCause` 在点停止那一刻就由 `LiveChatRegistry.stop` 写成了 `user`，
+       * 收尾时读出来，页面照旧显示「用户停止了输出」。
+       *
+       * @returns true = 确由这次调用收的尾；false = 这次派发不在在途表里（已收尾 / 不归本 adapter 管）。
+       */
+      cancelLocally(dispatchId, errorMessage2 = "\u7528\u6237\u505C\u6B62\uFF08\u8282\u70B9\u79BB\u7EBF\uFF0C\u672A\u7B49\u5230\u9000\u51FA\u5E27\uFF09") {
+        const entry = this.pending.get(dispatchId);
+        if (!entry || entry.exited) return false;
+        this.settle(dispatchId, { code: null, reason: "cancelled", errorMessage: errorMessage2 });
+        return true;
+      }
       /** 当前在途（未退出）会话数；传 runtimeKind 时收窄到单个 runtime 实例。 */
       activeRunCount(nodeId, runtimeKind) {
         let n = 0;
@@ -253435,14 +254025,18 @@ var init_daemon_adapter = __esm({
         const appendTimeoutMs = this.appendTimeoutMs;
         const sessionReadyWaitMs = this.sessionReadyWaitMs;
         const confirm = (key2) => this.confirmInputReceipt(nodeId, dispatchId, key2);
+        const sendKill = () => routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+        const cancelLocally = () => this.cancelLocally(dispatchId);
         return {
           id: dispatchId,
           get supportsLiveProtocol() {
             return entry.supportsLiveProtocol;
           },
           async kill() {
-            routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+            sendKill();
           },
+          sendKill,
+          cancelLocally,
           onExit(cb) {
             if (entry.exited) cb(entry.exited);
             else entry.exitCbs.push(cb);
@@ -253527,6 +254121,8 @@ var init_daemon_adapter = __esm({
         const appendTimeoutMs = this.appendTimeoutMs;
         const sessionReadyWaitMs = this.sessionReadyWaitMs;
         const confirm = (key2) => this.confirmInputReceipt(nodeId, dispatchId, key2);
+        const sendKill = () => routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+        const cancelLocally = () => this.cancelLocally(dispatchId);
         return {
           id: dispatchId,
           stashDroppedFrames: stashed.droppedFrames ?? 0,
@@ -253534,8 +254130,10 @@ var init_daemon_adapter = __esm({
             return entry.supportsLiveProtocol;
           },
           async kill() {
-            routeToSession(hub, nodeId, dispatchId, { type: "kill", dispatchId });
+            sendKill();
           },
+          sendKill,
+          cancelLocally,
           onExit(cb) {
             if (entry.exited) cb(entry.exited);
             else entry.exitCbs.push(cb);
@@ -255705,6 +256303,18 @@ var init_postgres_registry = __esm({
         status       text NOT NULL             -- active | paused
       )`);
         await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".actor_runtime_candidates (
+        actor_id     text NOT NULL,
+        node_id      text NOT NULL,
+        runtime_kind text NOT NULL,
+        model        text,
+        ord          integer NOT NULL,
+        updated_at   timestamptz NOT NULL,
+        updated_by   text NOT NULL,
+        PRIMARY KEY (actor_id, node_id, runtime_kind)
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS actor_runtime_candidates_actor_ord_idx ON "${s2}".actor_runtime_candidates (actor_id, ord)`);
+        await pool.query(`
       CREATE TABLE IF NOT EXISTS "${s2}".connectors (
         id          text PRIMARY KEY,
         name        text NOT NULL,
@@ -256062,6 +256672,49 @@ var init_postgres_registry = __esm({
         const r = await this.pool.query(`SELECT * FROM ${this.s}.actor_bindings ORDER BY actor_id`);
         return r.rows.map((row) => ({ actorId: row.actor_id, nodeId: row.node_id, runtimeKind: row.runtime_kind, status: row.status }));
       }
+      /* ---------- 候选 runtime（ADR 0616） ---------- */
+      async listRuntimeCandidates(actorId) {
+        const r = await this.pool.query(
+          // 第二、三排序键让同 ord 的存量脏数据也有**确定**次序——分配算法的定序是全序的，
+          // 读侧若随机返回，那句「为什么选了它」下一次就解释不了同一件事。
+          `SELECT actor_id, node_id, runtime_kind, model, ord FROM ${this.s}.actor_runtime_candidates
+       WHERE actor_id = $1 ORDER BY ord, node_id, runtime_kind`,
+          [actorId]
+        );
+        return r.rows.map((row) => ({
+          actorId: row.actor_id,
+          nodeId: row.node_id,
+          runtimeKind: row.runtime_kind,
+          model: row.model ?? null,
+          ord: Number(row.ord)
+        }));
+      }
+      async replaceRuntimeCandidates(actorId, candidates, by) {
+        const now = (/* @__PURE__ */ new Date()).toISOString();
+        const updatedBy = by ?? "actor:system:registry";
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          await client.query(`DELETE FROM ${this.s}.actor_runtime_candidates WHERE actor_id = $1`, [actorId]);
+          for (const [i, c] of candidates.entries()) {
+            const model = typeof c.model === "string" && c.model.trim() ? c.model.trim() : null;
+            await client.query(
+              `INSERT INTO ${this.s}.actor_runtime_candidates (actor_id, node_id, runtime_kind, model, ord, updated_at, updated_by)
+           VALUES ($1,$2,$3,$4,$5,$6,$7)
+           ON CONFLICT (actor_id, node_id, runtime_kind) DO UPDATE SET model=$4, ord=$5, updated_at=$6, updated_by=$7`,
+              [actorId, c.nodeId, c.runtimeKind, model, i, now, updatedBy]
+            );
+          }
+          await client.query("COMMIT");
+        } catch (err) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw err;
+        } finally {
+          client.release();
+        }
+        return this.listRuntimeCandidates(actorId);
+      }
       /* ---------- Runtime 默认配置 ---------- */
       async upsertRuntimeConfig(c) {
         await this.pool.query(
@@ -265205,7 +265858,7 @@ var init_postgres_delegations = __esm({
 });
 
 // ../storage/src/postgres-nodes.ts
-var import_node_crypto75, ident13, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToRuntime;
+var import_node_crypto75, ident13, PostgresNodeStore, PostgresNodeTokenStore, rowToNode, rowToFault, rowToQuota, rowToRuntime;
 var init_postgres_nodes = __esm({
   "../storage/src/postgres-nodes.ts"() {
     "use strict";
@@ -265255,6 +265908,33 @@ var init_postgres_nodes = __esm({
         await pool.query(`CREATE UNIQUE INDEX IF NOT EXISTS node_runtimes_company_id_uq ON "${s2}".node_runtimes (company_id, id)`);
         await pool.query(`CREATE INDEX IF NOT EXISTS node_runtimes_company_node_idx ON "${s2}".node_runtimes (company_id, node_id)`);
         await pool.query(`CREATE INDEX IF NOT EXISTS node_runtimes_company_status_idx ON "${s2}".node_runtimes (company_id, status)`);
+        await pool.query(`ALTER TABLE "${s2}".nodes ADD COLUMN IF NOT EXISTS max_concurrent integer`);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".node_runtime_faults (
+        node_id         text NOT NULL REFERENCES "${s2}".nodes(id) ON DELETE CASCADE,
+        runtime_kind    text NOT NULL,
+        company_id      text,
+        reason          text NOT NULL,
+        detail          text,
+        marked_at       timestamptz NOT NULL,
+        attempts        integer NOT NULL DEFAULT 0,
+        next_probe_at   timestamptz,
+        awaiting_manual boolean NOT NULL DEFAULT false,
+        PRIMARY KEY (node_id, runtime_kind)
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS node_runtime_faults_company_idx ON "${s2}".node_runtime_faults (company_id)`);
+        await pool.query(`
+      CREATE TABLE IF NOT EXISTS "${s2}".node_runtime_quotas (
+        node_id      text NOT NULL REFERENCES "${s2}".nodes(id) ON DELETE CASCADE,
+        runtime_kind text NOT NULL,
+        company_id   text,
+        status       text NOT NULL,
+        checked_at   timestamptz NOT NULL,
+        retry_at     timestamptz,
+        windows      jsonb NOT NULL DEFAULT '[]'::jsonb,
+        PRIMARY KEY (node_id, runtime_kind)
+      )`);
+        await pool.query(`CREATE INDEX IF NOT EXISTS node_runtime_quotas_company_idx ON "${s2}".node_runtime_quotas (company_id)`);
         return new _PostgresNodeStore(pool, schema);
       }
       async upsertNode(n) {
@@ -265408,6 +266088,95 @@ var init_postgres_nodes = __esm({
         }
         return { nodeDeleted: false };
       }
+      /* ---------- 运行时分配（ADR 0616）：并发上限 / 故障标记 / 落库额度 ---------- */
+      async setNodeMaxConcurrent(nodeId, limit) {
+        await this.pool.query(`UPDATE ${this.s}.nodes SET max_concurrent=$2 WHERE id=$1`, [nodeId, limit]);
+      }
+      async upsertRuntimeFault(fault) {
+        await this.pool.query(
+          // company_id 从 node 行继承（node 是唯一事实源，同 upsertRuntime 的兜底），任何调用方都绕不过去。
+          `INSERT INTO ${this.s}.node_runtime_faults
+         (node_id, runtime_kind, company_id, reason, detail, marked_at, attempts, next_probe_at, awaiting_manual)
+       VALUES ($1,$2,(SELECT company_id FROM ${this.s}.nodes WHERE id=$1),$3,$4,$5,$6,$7,$8)
+       ON CONFLICT (node_id, runtime_kind) DO UPDATE SET
+         company_id = COALESCE(EXCLUDED.company_id, ${this.s}.node_runtime_faults.company_id),
+         reason=EXCLUDED.reason, detail=EXCLUDED.detail, marked_at=EXCLUDED.marked_at,
+         attempts=EXCLUDED.attempts, next_probe_at=EXCLUDED.next_probe_at, awaiting_manual=EXCLUDED.awaiting_manual`,
+          [
+            fault.nodeId,
+            fault.runtimeKind,
+            fault.reason,
+            fault.detail ?? null,
+            fault.markedAt,
+            fault.attempts,
+            fault.nextProbeAt ?? null,
+            fault.awaitingManual
+          ]
+        );
+      }
+      async clearRuntimeFault(nodeId, runtimeKind) {
+        const r = await this.pool.query(
+          `DELETE FROM ${this.s}.node_runtime_faults WHERE node_id=$1 AND runtime_kind=$2`,
+          [nodeId, runtimeKind]
+        );
+        return (r.rowCount ?? 0) > 0;
+      }
+      async listRuntimeFaults(filter) {
+        const where = [];
+        const args = [];
+        if (filter?.nodeId) {
+          args.push(filter.nodeId);
+          where.push(`node_id = $${args.length}`);
+        }
+        if (filter?.companyId) {
+          args.push(filter.companyId);
+          where.push(`company_id = $${args.length}`);
+        }
+        const r = await this.pool.query(
+          `SELECT * FROM ${this.s}.node_runtime_faults${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY node_id, runtime_kind`,
+          args
+        );
+        return r.rows.map(rowToFault);
+      }
+      async saveRuntimeQuotas(nodeId, quotas) {
+        const client = await this.pool.connect();
+        try {
+          await client.query("BEGIN");
+          await client.query(`DELETE FROM ${this.s}.node_runtime_quotas WHERE node_id=$1`, [nodeId]);
+          for (const q2 of quotas) {
+            await client.query(
+              `INSERT INTO ${this.s}.node_runtime_quotas
+             (node_id, runtime_kind, company_id, status, checked_at, retry_at, windows)
+           VALUES ($1,$2,(SELECT company_id FROM ${this.s}.nodes WHERE id=$1),$3,$4,$5,$6::jsonb)`,
+              [nodeId, q2.runtimeKind, q2.status, q2.checkedAt, q2.retryAt ?? null, JSON.stringify(q2.windows ?? [])]
+            );
+          }
+          await client.query("COMMIT");
+        } catch (err) {
+          await client.query("ROLLBACK").catch(() => {
+          });
+          throw err;
+        } finally {
+          client.release();
+        }
+      }
+      async listRuntimeQuotas(filter) {
+        const where = [];
+        const args = [];
+        if (filter?.nodeId) {
+          args.push(filter.nodeId);
+          where.push(`node_id = $${args.length}`);
+        }
+        if (filter?.companyId) {
+          args.push(filter.companyId);
+          where.push(`company_id = $${args.length}`);
+        }
+        const r = await this.pool.query(
+          `SELECT * FROM ${this.s}.node_runtime_quotas${where.length ? ` WHERE ${where.join(" AND ")}` : ""} ORDER BY node_id, runtime_kind`,
+          args
+        );
+        return r.rows.map(rowToQuota);
+      }
     };
     PostgresNodeTokenStore = class _PostgresNodeTokenStore {
       constructor(pool, schema) {
@@ -265450,7 +266219,28 @@ var init_postgres_nodes = __esm({
       nodeVersion: row.node_version,
       status: row.status,
       lastSeenAt: new Date(row.last_seen_at).toISOString(),
-      enrolledAt: new Date(row.enrolled_at).toISOString()
+      enrolledAt: new Date(row.enrolled_at).toISOString(),
+      // 只在库里真有值时带上这一格：`undefined` 与 `null` 在 `exactOptionalPropertyTypes` 下不等价，
+      // 而判据只认「有没有上限」——带一个 null 进去会让下游不得不再判一次。
+      ...row.max_concurrent != null ? { maxConcurrent: Number(row.max_concurrent) } : {}
+    });
+    rowToFault = (row) => ({
+      nodeId: row.node_id,
+      runtimeKind: row.runtime_kind,
+      reason: row.reason,
+      ...row.detail ? { detail: row.detail } : {},
+      markedAt: new Date(row.marked_at).toISOString(),
+      attempts: Number(row.attempts ?? 0),
+      ...row.next_probe_at ? { nextProbeAt: new Date(row.next_probe_at).toISOString() } : {},
+      awaitingManual: Boolean(row.awaiting_manual)
+    });
+    rowToQuota = (row) => ({
+      nodeId: row.node_id,
+      runtimeKind: row.runtime_kind,
+      status: row.status,
+      checkedAt: new Date(row.checked_at).toISOString(),
+      ...row.retry_at ? { retryAt: new Date(row.retry_at).toISOString() } : {},
+      windows: Array.isArray(row.windows) ? row.windows : []
     });
     rowToRuntime = (row) => ({
       id: row.id,
@@ -268652,6 +269442,16 @@ var init_cutover_aware_registry = __esm({
       async listBindings() {
         return (await this.orgStore()).listBindings();
       }
+      // 候选 runtime（ADR 0616）：与 binding 同一侧（组织面）；底座没实现就退化成「没有候选」。
+      async listRuntimeCandidates(actorId) {
+        const store = await this.orgStore();
+        return store.listRuntimeCandidates ? store.listRuntimeCandidates(actorId) : [];
+      }
+      async replaceRuntimeCandidates(actorId, candidates) {
+        const store = await this.orgStoreForWrite();
+        if (!store.replaceRuntimeCandidates) throw new Error("\u5F53\u524D\u767B\u8BB0\u5B58\u50A8\u5B9E\u73B0\u4E0D\u652F\u6301\u5019\u9009\u8FD0\u884C\u65F6\uFF08replaceRuntimeCandidates \u672A\u5B9E\u73B0\uFF09");
+        return store.replaceRuntimeCandidates(actorId, candidates);
+      }
       async upsertRuntimeConfig(...args) {
         return (await this.orgStoreForWrite()).upsertRuntimeConfig(...args);
       }
@@ -274375,6 +275175,7 @@ __export(src_exports2, {
   MemoryWriteConflictError: () => MemoryWriteConflictError,
   MirrorEngine: () => MirrorEngine,
   MissingCompanyContextError: () => MissingCompanyContextError,
+  NODE_HEARTBEAT_STALE_MS: () => NODE_HEARTBEAT_STALE_MS,
   NPM_PROBE_TIMEOUT_MS: () => NPM_PROBE_TIMEOUT_MS,
   NdjsonOplogStore: () => NdjsonOplogStore,
   NodeHealthTracker: () => NodeHealthTracker,
@@ -274404,6 +275205,7 @@ __export(src_exports2, {
   RolesAdminService: () => RolesAdminService,
   Router: () => Router,
   RunSettlementFunnel: () => RunSettlementFunnel,
+  RuntimeAllocationError: () => RuntimeAllocationError,
   RuntimeStartMarker: () => RuntimeStartMarker,
   SERVER_PING: () => SERVER_PING,
   SHARED_GRAPH_BODY: () => SHARED_GRAPH_BODY,
@@ -274427,6 +275229,7 @@ __export(src_exports2, {
   actorStats: () => actorStats,
   actorsDomain: () => actorsDomain,
   agentDefaultRuntimeForNewSession: () => agentDefaultRuntimeForNewSession,
+  allocateRuntime: () => allocateRuntime,
   answerFallbackReason: () => answerFallbackReason,
   appendChatMessageOnce: () => appendChatMessageOnce,
   applyBuiltinSkillVariants: () => applyBuiltinSkillVariants,
@@ -274437,6 +275240,7 @@ __export(src_exports2, {
   assertCreatableVariable: () => assertCreatableVariable,
   assistantRowRecovery: () => assistantRowRecovery,
   assistantsDomain: () => assistantsDomain,
+  atCapacity: () => atCapacity,
   automationsDomain: () => automationsDomain,
   backfillOrgModel: () => backfillOrgModel,
   backfillOrgModelOnStartup: () => backfillOrgModelOnStartup,
@@ -274469,6 +275273,7 @@ __export(src_exports2, {
   buildWorkorderSummaries: () => buildWorkorderSummaries,
   builtinSkillToFiles: () => builtinSkillToFiles,
   canAnnounceRuntimeSwitch: () => canAnnounceRuntimeSwitch,
+  canRetryAllocation: () => canRetryAllocation,
   chatBroadcastEnabledFromEnv: () => chatBroadcastEnabledFromEnv,
   chatDelegationEnabledFromEnv: () => chatDelegationEnabledFromEnv,
   chatDispatchScope: () => chatDispatchScope,
@@ -274536,6 +275341,7 @@ __export(src_exports2, {
   createRegistryAuditSink: () => createRegistryAuditSink,
   createReworkHandoffInputResolver: () => createReworkHandoffInputResolver,
   createRunSettlementWiring: () => createRunSettlementWiring,
+  createRuntimeAllocator: () => createRuntimeAllocator,
   createSkillMarketClientFromEnv: () => createSkillMarketClientFromEnv,
   createSpawnMutex: () => createSpawnMutex,
   createTokenIssuer: () => createTokenIssuer,
@@ -274560,8 +275366,10 @@ __export(src_exports2, {
   deliverDelegationReturn: () => deliverDelegationReturn,
   deliverWorkorderBroadcast: () => deliverWorkorderBroadcast,
   deriveNodeHealth: () => deriveNodeHealth,
+  describeAllocationChoice: () => describeAllocationChoice,
   describeAttachmentsForAppend: () => describeAttachmentsForAppend,
   describeNodeFault: () => describeNodeFault,
+  describeRejections: () => describeRejections,
   deterministicKnowledgePlan: () => deterministicKnowledgePlan,
   deterministicUuid: () => deterministicUuid,
   digestOf: () => digestOf2,
@@ -274588,6 +275396,8 @@ __export(src_exports2, {
   fallbackTurnId: () => fallbackTurnId,
   fastPathFallbackReason: () => fastPathFallbackReason,
   fastPathQualityReason: () => fastPathQualityReason,
+  faultFromQuota: () => faultFromQuota,
+  faultIsBlocking: () => faultIsBlocking,
   fenceDispatch: () => fenceDispatch,
   fetchLatestNpmVersion: () => fetchLatestNpmVersion,
   fetchSkillFromSource: () => fetchSkillFromSource,
@@ -274603,6 +275413,7 @@ __export(src_exports2, {
   hashPassword: () => hashPassword,
   hideDeleted: () => hideDeleted,
   humanSubmitSourceRunId: () => humanSubmitSourceRunId,
+  idlenessOf: () => idlenessOf,
   isActiveCoordinatorAgent: () => isActiveCoordinatorAgent,
   isCompanyCrossTenantPath: () => isCompanyCrossTenantPath,
   isCoordinatorAgentName: () => isCoordinatorAgentName,
@@ -274621,6 +275432,7 @@ __export(src_exports2, {
   isNodeHealthy: () => isNodeHealthy,
   isOperatorRequest: () => isOperatorRequest,
   isRunTerminalStatus: () => isRunTerminalStatus,
+  isRuntimeClassFailure: () => isRuntimeClassFailure,
   isRuntimeDrifted: () => isRuntimeDrifted,
   isRuntimeRunReader: () => isRuntimeRunReader,
   isSealedKnowledgeSnapshotContent: () => isSealedKnowledgeSnapshotContent,
@@ -274717,6 +275529,7 @@ __export(src_exports2, {
   providerKnowledgeHash: () => providerKnowledgeHash,
   providerRoundTripKnowledgeHash: () => providerRoundTripKnowledgeHash,
   publishMarker: () => publishMarker,
+  quotaDerateFactor: () => quotaDerateFactor,
   readCredentialAuditLog: () => readCredentialAuditLog,
   readLocalPack: () => readLocalPack,
   readRegisteredToolVersions: () => readRegisteredToolVersions,
@@ -274754,6 +275567,7 @@ __export(src_exports2, {
   repairSubmissionDelivery: () => repairSubmissionDelivery,
   repairSubmissionDeliveryAcrossCompanies: () => repairSubmissionDeliveryAcrossCompanies,
   replaceModelPriceCacheForTest: () => replaceModelPriceCacheForTest,
+  requireAllocation: () => requireAllocation,
   requiresKnowledgePlanner: () => requiresKnowledgePlanner,
   resendSender: () => resendSender,
   resetBuildInfoCacheForTest: () => resetBuildInfoCacheForTest,
@@ -274777,6 +275591,7 @@ __export(src_exports2, {
   runtimeConnectionStatus: () => runtimeConnectionStatus,
   runtimeDriftBlock: () => runtimeDriftBlock,
   runtimeSwitchedNotice: () => runtimeSwitchedNotice,
+  runtimeTargetKey: () => runtimeTargetKey,
   safeAttachmentName: () => safeAttachmentName,
   sanitizeSkillDir: () => sanitizeSkillDir,
   scanFrontmatterEntries: () => scanFrontmatterEntries,
@@ -274912,6 +275727,9 @@ var init_src11 = __esm({
     init_coordinator_runs();
     init_usage_read();
     init_runtime_drift();
+    init_allocate();
+    init_errors6();
+    init_service7();
     init_runtime_status();
     init_runtime_tenancy();
     init_types4();
@@ -275287,6 +276105,7 @@ var import_node_crypto91 = require("node:crypto");
 
 // ../cli/src/serve.ts
 init_src11();
+init_src11();
 init_chat_cancel_attribution();
 init_src();
 init_src11();
@@ -280271,6 +281090,59 @@ async function startServe(opts) {
     return (await ctx.service.latestConfig(actorId))?.model ?? null;
   };
   agentDefaultRuntimeResolvers = { resolveBinding: resolveCompanyBinding, resolveActorModel: resolveAgentConfiguredModel };
+  const runtimeAllocators = /* @__PURE__ */ new Map();
+  const runtimeAllocatorFor = (companyId) => {
+    const hit = runtimeAllocators.get(companyId);
+    if (hit) return hit;
+    const allocator = createRuntimeAllocator({
+      // 主绑定与候选清单都**按公司解析**：全局 registry 对已切 `actor-config` 的公司是一份冻结旧镜像
+      //（理由与 `resolveCompanyBinding` 文件头同源）。
+      primaryBinding: (actorId) => resolveCompanyBinding(companyId, actorId),
+      candidates: async (actorId) => {
+        const registry2 = (await getEngine(companyId)).registry;
+        return registry2.listRuntimeCandidates ? registry2.listRuntimeCandidates(actorId) : [];
+      },
+      nodeStates: async () => {
+        const [nodes, runtimes] = await Promise.all([
+          nodeStore.listNodes({ companyId }),
+          nodeStore.listRuntimes(void 0, { companyId })
+        ]);
+        return nodes.filter((n) => n.status !== "deleted").map((n) => ({
+          nodeId: n.id,
+          // 报名称不报 id（ADR 0612）：节点名 → 主机名 → 万不得已才是 id。
+          displayName: n.name?.trim() || n.hostname || n.id,
+          /**
+           * 「在线」只取**可达性**：长连接在 + 心跳新鲜。刻意**不用** `healthOfNode(...).healthy`
+           * ——那个判据还叠了「连败 ≥ 3 次」这一档软不健康。
+           *
+           * 为什么不叠：委派子会话此前走的是 `bindingRuntimeState`（在线 + 上报了这个 adapter），
+           * 连败次数根本不参与。把它叠进来，一台**还连着、还能跑**但最近连败过三次的机器会被分配
+           * 排除掉，而这个员工要是没配候选，那一轮就从「照旧派出去」变成当场 503 —— 拿一个新功能
+           * 去掐掉一条本来能走的路。
+           *
+           * 连败这类「机器看着在、但活总是挂」的判断归**故障标记**（ADR 0616 D8，第 2 批）：
+           * 它会写进 `node_runtime_faults`，那时分配读的是故障行，粒度是 (节点, runtime) 而不是整台机器，
+           * 也带得上「下次什么时候再试」。工单派发那条路的 `checkDispatchable` 仍按原样拦连败节点，
+           * 与改动前逐字相同。
+           */
+          online: (hub?.connectedDaemons() ?? []).some((d) => d.daemonId === n.id) && (() => {
+            const seen = hub?.lastSeenAt(n.id);
+            return seen !== void 0 && Date.now() - seen < NODE_HEARTBEAT_STALE_MS;
+          })(),
+          /* 机器上有什么 runtime：漂移行（登记表有、机器探测不到）不算有——判据同 `runtimeDriftBlock`。
+             `presentOnMachine` 缺省（还没对账过的旧行）一律当作正常，与那道闸逐字一致。 */
+          runtimeKinds: runtimes.filter((r) => r.nodeId === n.id && r.presentOnMachine !== false).map((r) => r.kind),
+          maxConcurrent: n.maxConcurrent ?? null,
+          activeRunCount: activeRunCountOf(n.id)
+        }));
+      },
+      faults: () => nodeStore.listRuntimeFaults({ companyId }),
+      quotas: () => nodeStore.listRuntimeQuotas({ companyId }),
+      actorName: async (actorId) => (await (await actors.resolveCtx(companyId)).service.getActor(actorId).catch(() => null))?.name ?? null
+    });
+    runtimeAllocators.set(companyId, allocator);
+    return allocator;
+  };
   if (pgPool) {
     const pinPool = pgPool;
     void (async () => {
@@ -281520,6 +282392,7 @@ async function startServe(opts) {
         const priorChatSession = chatSessionId && turnChatStore ? await turnChatStore.getSession(chatSessionId) : null;
         let binding;
         let runtimeTargetSource = "actor_binding";
+        let allocatedModelOverride;
         if (stableDispatch) {
           binding = { actorId, ...stableDispatch.target, status: "active" };
         } else {
@@ -281546,14 +282419,42 @@ async function startServe(opts) {
               }
             });
           } catch (e) {
-            if (e instanceof SessionRuntimeOverrideError) throw new ApiError(e.status, e.code, e.message);
-            throw e;
+            if (e instanceof SessionRuntimeOverrideError) {
+              if (!delegatedChildTurn) throw new ApiError(e.status, e.code, e.message);
+              console.log(`[runtime-alloc] \u59D4\u6D3E\u5B50\u4F1A\u8BDD\u9489\u4F4F\u7684\u76EE\u6807\u4E0D\u53EF\u7528\uFF08${e.code}\uFF09\uFF0C\u4EA4\u7ED9\u5206\u914D\u6311\u5019\u9009`);
+              resolved = null;
+            } else throw e;
           }
-          if (!resolved) {
+          if (!resolved && !delegatedChildTurn) {
             throw new ApiError(409, "ACTOR_BINDING_MISSING", `\u8FD9\u4F4D Agent \u8FD8\u6CA1\u6709\u7ED1\u5B9A\u8FD0\u884C\u65F6\uFF0C\u8BF7${chatRebindHint("\u7ED1\u5B9A\u4E00\u4E2A\u53EF\u7528\u7684\u8FD0\u884C\u65F6")}\u540E\u518D\u53D1`);
           }
-          binding = resolved.binding;
-          runtimeTargetSource = resolved.source;
+          binding = resolved?.binding ?? { actorId, nodeId: "", runtimeKind: "", status: "active" };
+          runtimeTargetSource = resolved?.source ?? "actor_binding";
+          if (delegatedChildTurn) {
+            const pinned = sessionRuntimeOverride(priorChatSession);
+            const primary = resolved ? { nodeId: resolved.binding.nodeId, runtimeKind: resolved.binding.runtimeKind } : pinned ? { nodeId: pinned.nodeId, runtimeKind: pinned.runtimeKind } : null;
+            try {
+              const allocated = await runtimeAllocatorFor(runCompanyId).allocateFor({
+                actorId,
+                // 「同一件活」= 这条子会话。重试上限算在它头上，不与同一位专家的别条委派互相扣次数。
+                unitOfWork: `chat-session:${chatSessionId ?? artifactId}`,
+                what: "\u59D4\u6D3E\u5B50\u4F1A\u8BDD",
+                primary
+              });
+              if (allocated.binding.nodeId !== binding.nodeId || allocated.binding.runtimeKind !== binding.runtimeKind) {
+                binding = allocated.binding;
+                runtimeTargetSource = "session_override";
+                allocatedModelOverride = allocated.model ?? void 0;
+              }
+            } catch (e) {
+              if (e instanceof RuntimeAllocationError) throw new ApiError(e.status === 503 ? 503 : 409, e.code, e.message);
+              console.warn(`[runtime-alloc] \u59D4\u6D3E\u5B50\u4F1A\u8BDD\u5206\u914D\u5931\u8D25\uFF1A${String(e)}`);
+              if (!resolved) throw e;
+            }
+          }
+          if (!binding.nodeId || !binding.runtimeKind) {
+            throw new ApiError(409, "ACTOR_BINDING_MISSING", `\u8FD9\u4F4D Agent \u8FD8\u6CA1\u6709\u53EF\u7528\u7684\u8FD0\u884C\u65F6\uFF0C\u8BF7${chatRebindHint("\u7ED1\u5B9A\u4E00\u4E2A\u53EF\u7528\u7684\u8FD0\u884C\u65F6")}\u540E\u518D\u53D1`);
+          }
         }
         const requireDispatchNode = async (target) => {
           const targetNode = await nodeStore.getNode(target.nodeId);
@@ -281777,7 +282678,7 @@ async function startServe(opts) {
         };
         const provision = isolatedKnowledgeTurn ? { env: {}, wrapperPaths: [], requiredTools: [], requiredToolVersions: {}, connectorCreds: [], cleanup: async () => void 0 } : await buildActorProvision(actorService, actorId, chatDispatchScope(priorChatSession));
         const actorCtx = await buildActorContext(actorService, actorId).catch(() => null);
-        const sessionModel = configuredModel(sessionModelOverride);
+        const sessionModel = configuredModel(allocatedModelOverride !== void 0 ? allocatedModelOverride : sessionModelOverride);
         const actorConfiguredModel = isolatedBackground ? configuredModel(actorCtx?.config?.model) : void 0;
         const chatResolvedModel = sessionModel ?? actorConfiguredModel;
         const chatModel = chatResolvedModel ?? await registryStore.getRuntimeConfig(`runtime:${binding.nodeId}:${binding.runtimeKind}`).then((c) => configuredModel(c?.model)).catch(() => void 0);
@@ -281982,6 +282883,24 @@ async function startServe(opts) {
         const done = new Promise((resolve11, reject) => {
           handle.onExit((info) => {
             chatLiveSessions.delete(chatJobKey);
+            if (delegatedChildTurn) {
+              try {
+                const unitOfWork = `chat-session:${chatSessionId ?? artifactId}`;
+                const allocator = runtimeAllocatorFor(runCompanyId);
+                if (isRuntimeClassFailure(info.reason, info.errorMessage)) {
+                  allocator.noteFailure({
+                    unitOfWork,
+                    target: { nodeId: binding.nodeId, runtimeKind: binding.runtimeKind },
+                    ...info.reason ? { reason: info.reason } : {},
+                    ...info.errorMessage ? { errorMessage: info.errorMessage } : {}
+                  });
+                } else {
+                  allocator.noteSettled(unitOfWork);
+                }
+              } catch (err) {
+                console.warn(`[runtime-alloc] \u59D4\u6D3E\u5B50\u4F1A\u8BDD\u5931\u8D25\u56DE\u62A5\u51FA\u9519\uFF08\u4E0D\u5F71\u54CD\u6536\u5C3E\uFF09\uFF1A${String(err)}`);
+              }
+            }
             setTimeout(() => {
               chatRunByDispatch.delete(handle.id);
             }, 6e4).unref?.();
@@ -282052,6 +282971,9 @@ async function startServe(opts) {
           },
           done,
           kill: () => handle.kill(),
+          // Bug 0232：`kill()` 报不了帧的去向（契约钉死 `Promise<void>`），这一对能。
+          // 条件透传：本地 adapter 的句柄没有这条，上层按「方法在不在」分流回老行为。
+          ...typeof handle.sendKill === "function" ? { sendKill: () => handle.sendKill(), cancelLocally: () => handle.cancelLocally?.() ?? false } : {},
           // ADR-0093 对话追加（chat 道）：透传底层句柄的 appendInput。runtime 不原生支持时 handle 上
           // 压根没这个方法，这里也就不给——server 据此让插入入口置灰，而不是让人按下去才发现不行。
           // 不带 interrupt：人插一句话走回合边界排队，不作废在飞回合（那是 produce 道 ADR-0094 的语义）。
@@ -282425,6 +283347,18 @@ async function startServe(opts) {
               const mapping = dispatchToWork.get(msg.dispatchId);
               const exitBus = mapping ? busForCompany(mapping.companyId) ?? busForWorkorder(mapping.workorderId) : null;
               if (mapping && exitBus) {
+                if (mapping.artifactId && mapping.companyId) {
+                  const allocator = runtimeAllocatorFor(mapping.companyId);
+                  if (isRuntimeClassFailure(msg.info.reason, msg.info.errorMessage)) {
+                    allocator.noteFailure({
+                      unitOfWork: mapping.artifactId,
+                      ...msg.info.reason ? { reason: msg.info.reason } : {},
+                      ...msg.info.errorMessage ? { errorMessage: msg.info.errorMessage } : {}
+                    });
+                  } else {
+                    allocator.noteSettled(mapping.artifactId);
+                  }
+                }
                 await exitBus.submit({
                   companyId: "",
                   workorderId: mapping.workorderId,
@@ -282884,7 +283818,8 @@ async function startServe(opts) {
           try {
             result = replyIssueId ? await bridge.replyWork(rev.artifactId, rev.author, replyIssueId, ledgerId) : await bridge.produce(rev.artifactId, rev.author, workId, ledgerId, opts2?.resumeEligible, opts2?.protocolRecovery?.round);
           } catch (err) {
-            void dispatchLedgerFor(companyId).then((l) => l.close(ledgerId, { outcome: "failed", reason: `dispatch error: ${err instanceof Error ? err.message : String(err)}` })).catch(ledgerWarn("close(error)"));
+            const reason = err instanceof RuntimeAllocationError ? err.message : `dispatch error: ${err instanceof Error ? err.message : String(err)}`;
+            void dispatchLedgerFor(companyId).then((l) => l.close(ledgerId, { outcome: "failed", reason })).catch(ledgerWarn("close(error)"));
             console.log(`[new-engine] dispatchWork ${workId} \u6D3E\u53D1\u5F02\u5E38\uFF1A${String(err)} \u2192 \u7F6E work failed`);
             const failBus = busForCompany(companyId);
             if (failBus) {
@@ -282899,7 +283834,7 @@ async function startServe(opts) {
                   semanticsVersion: 3,
                   dispatchId: ledgerId,
                   outcome: "failed",
-                  detail: { reason: `dispatch error: ${err instanceof Error ? err.message : String(err)}` }
+                  detail: { reason }
                 }
               });
             }
@@ -282910,6 +283845,9 @@ async function startServe(opts) {
             dispatchToWork.set(result.dispatchId, {
               workId,
               workorderId: wid,
+              // ★ ADR 0616：运行时分配按「同一件活」记失败链，工单这条路的单位就是这个节点（artifactId）。
+              // 退出帧上只有 dispatchId，所以必须在这里记下来——否则失败时不知道该把哪条链标上。
+              artifactId: rev.artifactId,
               // ★ 记下归属公司：session_started / session_exited / 收口漏斗都据它把事件投回**这一家**的 bus。
               companyId,
               ...delivery ? { nodeId: delivery.nodeId } : {}
@@ -283183,7 +284121,27 @@ async function startServe(opts) {
         }),
         serverUrl: localUrl,
         serverUrlFor: (ctx) => serverUrlForBinding(ctx.binding),
-        resolveBinding: async (actorId) => (await runActors()).service.resolveBinding()(actorId),
+        /**
+         * ★ ADR 0616：工单节点派活（produce / review / integrate / reply）的目标由**运行时分配**决定，
+         * 不再直接读那条主绑定。两个触发时机都落在这里：
+         *
+         *  ① 开一个新会话时 —— 每次 spawn 前跑一次分配（排除故障与满并发、主可用就选主）。
+         *  ② 上一轮因 runtime/节点原因失败时 —— `session_exited` 那边已经把失败目标记进这件活的
+         *     失败链，这一次分配会自动换到另一个候选；连着换满 `RUNTIME_ALLOCATION_MAX_ATTEMPTS` 次
+         *     仍起不来就抛错（由 `dispatchWork` 的 catch 落成 work failed，原文带机器名与原因）。
+         *
+         * 没带 `ctx.unitOfWork` 的调用（`executorSignature` 只要一个指纹）退回旧路：那条路不该
+         * 消耗一次分配尝试，更不该因为「所有候选都试过了」而抛错——指纹算不出来只会退化，不该阻断。
+         */
+        resolveBinding: async (actorId, ctx) => {
+          if (!ctx?.unitOfWork) return (await runActors()).service.resolveBinding()(actorId);
+          const resolved = await runtimeAllocatorFor(companyId).allocateFor({
+            actorId,
+            unitOfWork: ctx.unitOfWork,
+            what: "\u5DE5\u5355\u8282\u70B9\u6D3E\u6D3B"
+          });
+          return resolved.binding;
+        },
         prepareReadonlyInputs: async ({ actor, artifactType, binding, codeRepo, pinnedRevisions }) => {
           let prepared = null;
           try {
@@ -284589,7 +285547,7 @@ ${nodeFault}` : "");
     const zbEnabled = opts.zeroOutputBreaker?.enabled ?? !zbDisabledByEnv;
     const zbIntervalMs = opts.zeroOutputBreaker?.intervalMs ?? 3e4;
     const zbWindowMs = opts.zeroOutputBreaker?.windowMs ?? (envInt("OASIS_ZERO_OUTPUT_BREAKER_WINDOW_MIN") ?? 30) * 6e4;
-    const zbThreshold = opts.zeroOutputBreaker?.threshold ?? envInt("OASIS_ZERO_OUTPUT_BREAKER_N") ?? 5;
+    const zbThreshold = opts.zeroOutputBreaker?.threshold ?? envInt("OASIS_ZERO_OUTPUT_BREAKER_N") ?? 20;
     const zbCostThresholdMicros = opts.zeroOutputBreaker?.costThresholdMicros ?? (envInt("OASIS_ZERO_OUTPUT_BREAKER_COST_USD") ?? 0) * 1e6;
     if (zbEnabled && zbIntervalMs > 0 && (zbThreshold > 0 || zbCostThresholdMicros > 0)) {
       const zbActions = /* @__PURE__ */ new Set(["produce", "review"]);
@@ -289795,7 +290753,7 @@ async function waitForCommandAuthorization(base, headers, draftId, fallback) {
     }
   }
 }
-var CLI_VERSION = "2.2.72" ? "2.2.72" : "dev";
+var CLI_VERSION = "2.2.73" ? "2.2.73" : "dev";
 function apiHeaders(token, company) {
   const headers = {
     authorization: `Bearer ${token}`,
@@ -293601,7 +294559,7 @@ function shimScript() {
 }
 
 // src/index.ts
-var PKG_VERSION = true ? "2.2.72" : "dev";
+var PKG_VERSION = true ? "2.2.73" : "dev";
 var LOCAL_BIN = localBin();
 var NPM_PREFIX = npmPrefix();
 var INSTANCE = DEFAULT_INSTANCE;