chore: initial project import

backend/probe/Directory.Build.props

@@ -0,0 +1,17 @@
+<Project>
+  <Import Project="$([MSBuild]::GetPathOfFileAbove('Directory.Build.props', '$(MSBuildThisFileDirectory)../'))" />
+  <PropertyGroup>
+    <OptimizationPreference>Size</OptimizationPreference>
+    <UseSystemResourceKeys>true</UseSystemResourceKeys>
+    <StackTraceSupport>false</StackTraceSupport>
+    <IlcFoldIdenticalMethodBodies>true</IlcFoldIdenticalMethodBodies>
+    <EventSourceSupport>false</EventSourceSupport>
+    <DebuggerSupport>false</DebuggerSupport>
+    <HttpActivityPropagationSupport>false</HttpActivityPropagationSupport>
+    <ServerGarbageCollection>false</ServerGarbageCollection>
+    <ConcurrentGarbageCollection>false</ConcurrentGarbageCollection>
+  </PropertyGroup>
+  <ItemGroup>
+    <AdditionalFiles Include="$(MSBuildThisFileDirectory)../BannedSymbols.Node.txt" />
+  </ItemGroup>
+</Project>

backend/probe/README.md

@@ -0,0 +1,46 @@
+# Monitor Probe
+
+Probe 是网络测量的发起端，通常运行在家宽或其他需要观测的网络出口。它连接 Agent、执行线路任务，并把本端采集的原始数据交给 Agent 汇总上报。Probe 不直接连接 Backend，也不提供远程命令或文件管理功能。
+
+## 工作流程
+
+```text
+Backend ──任务与节点列表──> Agent <──测量会话──> Probe
+                              │                     │
+                              └──汇总并上报数据 <───┘
+```
+
+Probe 使用面板生成的 `probe.json` 读取自身身份、首次连接用的 Agent 地址和本地测试限制。成功连接后，Agent 会同步可用节点列表；Probe 将列表缓存到同目录的 `agents.json`。`probe.json` 含私钥，请限制文件访问权限，不要提交到版本控制。
+
+## 构建
+
+需要 .NET SDK 10。为应用 `backend/global.json` 的 SDK 设置，请从 `backend/` 目录构建：
+
+```sh
+cd backend
+dotnet build probe/src/Monitor.Probe -c Release
+```
+
+发布 NativeAOT 程序需要对应平台的 C/C++ 工具链；`<RID>` 应与构建环境和目标平台匹配：
+
+```sh
+dotnet publish probe/src/Monitor.Probe -c Release -r <RID> -p:PublishAot=true
+```
+
+也可在仓库根目录运行 `bash scripts/publish.sh probe <RID>`，再使用 `scripts/package.sh probe <RID>` 生成部署包。支持平台和安装流程见 [`../../docs/deployment.md`](../../docs/deployment.md)。
+
+## 配置与运行
+
+在管理端创建 Probe 并下载一次性身份配置，将文件保存为目标机上的 `/etc/monitor/probe.json`。随后运行：
+
+```sh
+monitor-probe --config /etc/monitor/probe.json
+```
+
+不传 `--config` 时默认读取 `/etc/monitor/probe.json`。配置中的 `limits` 是本地硬上限，Backend 无法远程放宽；路由器等低性能设备可调低测试码率和包速率，避免 Probe 自身成为测量瓶颈。部署时可使用仓库的 `packaging/` 文件和安装脚本。
+
+## 设计说明
+
+- Probe 只执行编译进程序的测量模块。它不认识 Backend，不落盘测量数据，也不能执行命令或自行更新。
+- 测量模块由 `backend/shared/Monitor.Measurement/` 与 Agent 共用；Probe 负责发起连接、调度任务和记录本端数据。
+- 测量模型和协议细节见 [`../../docs/measurement.md`](../../docs/measurement.md) 与 [`../../docs/protocol.md`](../../docs/protocol.md)；整体架构见 [`../../docs/architecture.md`](../../docs/architecture.md)。

backend/probe/src/Monitor.Probe/Link/AgentConnection.cs

@@ -0,0 +1,428 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Sockets;
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Identity;
+using Fleet.Link;
+using Fleet.Rpc;
+using Monitor.Measurement;
+using Monitor.Protocol;
+
+namespace Monitor.Probe;
+
+/// <summary>所有连接共用的东西。</summary>
+public sealed record ConnectionEnv(NodeIdentity Identity, string ProbeId, ProbeLimits Limits, AgentDirectory Directory, MonoClock Clock, TimeProvider Time, INodeLog Log);
+
+/// <summary>
+/// 与一个 Agent 的点对点会话：认证握手 → 同步时钟 → 取 Agent 列表 → 按 Agent 下发的 <c>line_task_set</c> 运行角色 →
+/// 每 10 秒把已完成的行切成列块放进发件箱 → 响应按需测试的阶段。会话断开时所有角色停止（凭据属于会话），按退避重连。
+/// 会话内的所有状态（套接字、发件箱、角色）随会话一起创建和释放。
+/// </summary>
+public sealed class AgentConnection
+{
+    private static readonly TimeSpan s_flushInterval = TimeSpan.FromSeconds(ProtocolLimits.ChunkSeconds);
+    private static readonly TimeSpan s_clockInterval = TimeSpan.FromSeconds(30);
+    private static readonly RpcRouter<ConnectionSession> s_router = BuildRouter();
+
+    private readonly ConnectionEnv _env;
+    private volatile ConnectionSession? _session;
+
+    public AgentConnection(BootstrapAgent endpoint, ConnectionEnv env)
+    {
+        Endpoint = endpoint;
+        _env = env;
+    }
+
+    public BootstrapAgent Endpoint { get; }
+
+    public bool IsConnected => _session is not null;
+
+    public int RoleCount => _session?.RoleCount ?? 0;
+
+    public long ClockOffsetUs => _session?.Clock.OffsetUs ?? 0;
+
+    public async Task RunAsync(CancellationToken ct)
+    {
+        var backoff = new Backoff(TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(20));
+        while (!ct.IsCancellationRequested)
+        {
+            try
+            {
+                string reason = await RunOnceAsync(backoff, ct);
+                _env.Log.Warn("agent session ended", ("agent", Endpoint.AgentId), ("err", reason));
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                return;
+            }
+            catch (Exception ex) when (ex is IOException or System.Net.Sockets.SocketException or InvalidOperationException or System.Security.Authentication.AuthenticationException or OperationCanceledException or FormatException)
+            {
+                _env.Log.Warn("agent connection failed", ("agent", Endpoint.AgentId), ("err", ex.Message));
+            }
+
+            try
+            {
+                await Task.Delay(backoff.Next(), _env.Time, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+        }
+    }
+
+    private async Task<string> RunOnceAsync(Backoff backoff, CancellationToken ct)
+    {
+        (PeerSessionInfo info, TlsFrameTransport transport) = await PeerConnector.ConnectAsync(
+            Endpoint.Host, Endpoint.TcpPort, Convert.FromBase64String(Endpoint.Spki), _env.Identity, _env.ProbeId, ProbeApp.Version, 8 << 20, _env.Time, ct);
+        var remote = (IPEndPoint)info.Remote!;
+        var data = new DataSession(info.Credentials.SessionIdValue, info.Credentials.Key);
+        using var udp = new UdpMux(new SingleSession(data), null, _env.Clock, new DataPlaneCounters(), _env.Log, remote.AddressFamily == AddressFamily.InterNetworkV6 ? IPAddress.IPv6Any : IPAddress.Any, []);
+        udp.Bind();
+        var outbox = new Outbox(8 << 20);
+        var clock = new ClockEstimator();
+        var shipper = new FragmentShipper(outbox, new NodeId(Endpoint.AgentId), new ProbeId(_env.ProbeId), clock, _env.Time);
+        var blockEnv = new BlockEnv
+        {
+            Clock = _env.Clock,
+            Log = _env.Log,
+            Session = () => data,
+            Udp = udp,
+            PeerAddress = remote.Address,
+            PeerSpkiSha256 = Convert.FromBase64String(Endpoint.Spki),
+            Fragments = shipper,
+            MaxPacketsPerSecond = _env.Limits.MaxTotalPps,
+            MaxBulkMbps = _env.Limits.MaxTestMbps,
+        };
+        var session = new ConnectionSession(blockEnv, clock, outbox, _env);
+        var rpc = new RpcSession<ConnectionSession>(transport, s_router, session, _env.Time);
+        rpc.OnBinary = (_, _) => ValueTask.CompletedTask;
+
+        using CancellationTokenSource cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        Task run = rpc.RunAsync(cts.Token);
+        Task receive = udp.RunAsync(cts.Token);
+        Task pump = PumpAsync(rpc, outbox, cts.Token);
+        try
+        {
+            // 先同步时钟（块头里要带偏移），再取 Agent 列表；Agent 随后推送线路任务集
+            await SyncClockAsync(rpc, clock, rounds: 5, cts.Token);
+            backoff.Reset();
+            _session = session;
+            _env.Log.Info("agent session up", ("agent", Endpoint.AgentId), ("offset_us", clock.OffsetUs));
+            await RefreshDirectoryAsync(rpc, cts.Token);
+            Task maintenance = MaintainAsync(rpc, session, clock, cts.Token);
+            Task finished = await Task.WhenAny(run, receive, pump, maintenance);
+            await cts.CancelAsync();
+            await Task.WhenAll(Quiet(run), Quiet(receive), Quiet(pump), Quiet(maintenance));
+            return finished == run ? "closed by the agent" : "session task failed";
+        }
+        finally
+        {
+            _session = null;
+            await cts.CancelAsync();
+            await session.StopAllAsync();
+            await Quiet(run);
+            await Quiet(receive);
+            await Quiet(pump);
+            await rpc.DisposeAsync();
+        }
+    }
+
+    private static async Task Quiet(Task task)
+    {
+        try
+        {
+            await task;
+        }
+        catch (Exception ex) when (ex is OperationCanceledException or IOException or ObjectDisposedException or System.Net.Sockets.SocketException or InvalidOperationException)
+        {
+            // 会话结束时的正常噪声
+        }
+    }
+
+    private static async Task PumpAsync(RpcSession<ConnectionSession> rpc, Outbox outbox, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            byte[] frame = await outbox.TakeNextAsync(2 << 20, ct);
+            await rpc.SendBinaryAsync(frame, ct);
+        }
+    }
+
+    private async Task SyncClockAsync(RpcSession<ConnectionSession> rpc, ClockEstimator clock, int rounds, CancellationToken ct)
+    {
+        for (int i = 0; i < rounds; i++)
+        {
+            long sent = _env.Clock.NowUs();
+            Result<ClockResult> reply = await rpc.RequestAsync(MonitorMethods.Clock, new ClockParams { ProbeMonoUs = sent }, MonitorJsonContext.Default.ClockParams, MonitorJsonContext.Default.ClockResult, ct);
+            if (reply.TryGet(out ClockResult? value, out _))
+            {
+                clock.Add(sent, value.AgentMonoUs, _env.Clock.NowUs());
+            }
+        }
+    }
+
+    private async Task RefreshDirectoryAsync(RpcSession<ConnectionSession> rpc, CancellationToken ct)
+    {
+        Result<ProbeAgentsResult> list = await rpc.RequestAsync(
+            MonitorMethods.ProbeAgents, new ProbeAgentsParams { HaveVersion = _env.Directory.Version }, MonitorJsonContext.Default.ProbeAgentsParams, MonitorJsonContext.Default.ProbeAgentsResult, ct);
+        if (list.TryGet(out ProbeAgentsResult? agents, out FleetError? error))
+        {
+            _env.Directory.Apply(agents);
+        }
+        else
+        {
+            _env.Log.Warn("could not fetch the agent list", ("agent", Endpoint.AgentId), ("err", error.Code));
+        }
+    }
+
+    /// <summary>切块（每 10 秒）和时钟同步（每 30 秒）。</summary>
+    private async Task MaintainAsync(RpcSession<ConnectionSession> rpc, ConnectionSession session, ClockEstimator clock, CancellationToken ct)
+    {
+        using var flush = new PeriodicTimer(s_flushInterval, _env.Time);
+        long lastClockUs = _env.Clock.NowUs();
+        while (await flush.WaitForNextTickAsync(ct))
+        {
+            session.FlushLineBlocks();
+            if (_env.Clock.NowUs() - lastClockUs >= s_clockInterval.TotalMicroseconds)
+            {
+                lastClockUs = _env.Clock.NowUs();
+                await SyncClockAsync(rpc, clock, rounds: 1, ct);
+            }
+        }
+    }
+
+    private static RpcRouter<ConnectionSession> BuildRouter() =>
+        new RpcRouter<ConnectionSession>()
+            .On(
+                FleetMethods.StateSync,
+                FleetRpcContext.Default.StateSyncParams,
+                FleetRpcContext.Default.StateSyncResult,
+                async (session, sync, _) =>
+                {
+                    var result = new StateSyncResult { AppliedVersion = sync.Version };
+                    if (sync.Type == LineTaskSet.StateType)
+                    {
+                        LineTaskSet? set = sync.Doc.Deserialize(MonitorJsonContext.Default.LineTaskSet);
+                        if (set is null)
+                        {
+                            return Result<StateSyncResult>.Fail(FleetErrors.InvalidParams, "line_task_set could not be parsed");
+                        }
+
+                        result.Rejected.AddRange(await session.ApplyAsync(set));
+                    }
+
+                    return Result<StateSyncResult>.Ok(result);
+                })
+            .On(
+                MonitorMethods.TestPhase,
+                MonitorJsonContext.Default.TestPhaseStartParams,
+                MonitorJsonContext.Default.TestPhaseStartResult,
+                (session, start, _) => ValueTask.FromResult(Result<TestPhaseStartResult>.Ok(new TestPhaseStartResult { Accepted = session.StartPhase(start) })))
+            .On(
+                MonitorMethods.TestPhaseEnd,
+                MonitorJsonContext.Default.TestPhaseEndParams,
+                MonitorJsonContext.Default.TestPhaseEndResult,
+                async (session, end, ct) => Result<TestPhaseEndResult>.Ok(new TestPhaseEndResult { Fragments = await session.EndPhaseAsync(end, ct) }))
+            .OnNotify(
+                MonitorMethods.TestAbort,
+                MonitorJsonContext.Default.TestAbortParams,
+                async (session, abort, _) => await session.AbortAsync(abort.TestId))
+            .OnNotify(
+                MonitorMethods.ProbeAgentsChanged,
+                MonitorJsonContext.Default.ProbeAgentsResult,
+                (session, list, _) =>
+                {
+                    session.Env.Directory.Apply(list);
+                    return ValueTask.CompletedTask;
+                })
+            .OnNotify(
+                FleetMethods.OutboxAck,
+                FleetRpcContext.Default.OutboxAckParams,
+                (session, ack, _) =>
+                {
+                    session.Outbox.Acknowledge(ack.Ids.Concat(ack.Duplicates).Select(Guid.Parse));
+                    return ValueTask.CompletedTask;
+                });
+}
+
+/// <summary>一次会话内的运行状态：线路任务的积木、按需测试的阶段。方法由路由器在单个入站队列里顺序调用。</summary>
+public sealed class ConnectionSession
+{
+    private const int MaxBlocks = 16;
+
+    private readonly object _gate = new();
+    private readonly Dictionary<string, RunningBlock> _lineBlocks = [];
+    private readonly ConcurrentDictionary<uint, PhaseState> _phases = new();
+
+    public ConnectionSession(BlockEnv blockEnv, ClockEstimator clock, Outbox outbox, ConnectionEnv env)
+    {
+        BlockEnv = blockEnv;
+        Clock = clock;
+        Outbox = outbox;
+        Env = env;
+    }
+
+    public BlockEnv BlockEnv { get; }
+
+    public ClockEstimator Clock { get; }
+
+    public Outbox Outbox { get; }
+
+    public ConnectionEnv Env { get; }
+
+    public int RoleCount
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _lineBlocks.Count;
+            }
+        }
+    }
+
+    /// <summary>调和线路任务：参数没有变化的积木继续运行，其余启动或停止。返回被拒绝的任务（不认识的 Kind、参数非法、超过上限）。</summary>
+    public async Task<List<RejectedItem>> ApplyAsync(LineTaskSet set)
+    {
+        var rejected = new List<RejectedItem>();
+        var wanted = new Dictionary<string, BlockSpec>();
+        foreach (LineTask task in set.Tasks)
+        {
+            BlockSpec? spec = BlockCatalog.ProbeKinds.Contains(task.Kind)
+                ? BlockSpec.Create(task.Kind, task.Params, task.StreamId, task.Port, new FragmentScope(task.Id, null, null))
+                : null;
+            if (spec is null)
+            {
+                rejected.Add(new RejectedItem { Id = task.Id.Value, Reason = BlockCatalog.ProbeKinds.Contains(task.Kind) ? "invalid_params" : "unsupported" });
+            }
+            else if (wanted.Count >= MaxBlocks)
+            {
+                rejected.Add(new RejectedItem { Id = task.Id.Value, Reason = "budget_exceeded" });
+            }
+            else
+            {
+                wanted[task.Id.Value] = spec;
+            }
+        }
+
+        var stopped = new List<RunningBlock>();
+        lock (_gate)
+        {
+            foreach ((string id, RunningBlock running) in _lineBlocks.ToList())
+            {
+                if (!wanted.TryGetValue(id, out BlockSpec? spec) || spec.Signature != running.Signature)
+                {
+                    stopped.Add(running);
+                    _lineBlocks.Remove(id);
+                }
+            }
+
+            foreach ((string id, BlockSpec spec) in wanted)
+            {
+                if (!_lineBlocks.ContainsKey(id))
+                {
+                    _lineBlocks[id] = RunningBlock.Start(BlockCatalog.Find(spec.KindId)!.Dialer(BlockEnv, spec), spec.Signature);
+                }
+            }
+        }
+
+        // 被停止的积木把已经稳定的行交出去（刚发出、还在等回复的行不交：它们不是丢失，只是没有等到）
+        foreach (RunningBlock running in stopped)
+        {
+            await running.StopAsync();
+            running.Block.Flush(FlushMode.Settled);
+        }
+
+        return rejected;
+    }
+
+    public void FlushLineBlocks()
+    {
+        List<RunningBlock> blocks;
+        lock (_gate)
+        {
+            blocks = [.. _lineBlocks.Values];
+        }
+
+        foreach (RunningBlock running in blocks)
+        {
+            running.Block.Flush(FlushMode.Settled);
+        }
+    }
+
+    /// <summary>按需测试的一个阶段：起对应的拨号方积木（单向数据流是接收端）。超过本地上限（或不认识）则拒绝。</summary>
+    public bool StartPhase(TestPhaseStartParams start)
+    {
+        string? direction = start.Params.TryGetValue("direction", out System.Text.Json.JsonElement d) ? d.GetString() : null;
+        if (_phases.ContainsKey(start.StreamId) || !BlockCatalog.ProbeKinds.Contains(start.Kind) || BlockCatalog.Find(start.Kind)!.Supports(direction) is false)
+        {
+            return false;
+        }
+
+        if (start.Kind == "udp_train")
+        {
+            double mbps = start.Params["mbps"].GetDouble();
+            long size = start.Params["size"].GetInt64();
+            long pps = (long)(mbps * 1_000_000 / 8 / Math.Max(1, size));
+            if (mbps > Env.Limits.MaxTestMbps || pps > Env.Limits.MaxTotalPps)
+            {
+                return false;
+            }
+        }
+
+        BlockSpec? spec = BlockSpec.Create(start.Kind, start.Params, start.StreamId, start.Port, new FragmentScope(null, start.TestId, start.Phase));
+        if (spec is null)
+        {
+            return false;
+        }
+
+        _phases[start.StreamId] = new PhaseState(start.TestId, start.Kind, RunningBlock.Start(BlockCatalog.Find(start.Kind)!.Dialer(BlockEnv, spec), spec.Signature));
+        return true;
+    }
+
+    /// <summary>阶段结束：收尾、交出列块，返回块数。</summary>
+    public async Task<int> EndPhaseAsync(TestPhaseEndParams end, CancellationToken ct)
+    {
+        if (!_phases.TryRemove(end.StreamId, out PhaseState? phase))
+        {
+            return 0;
+        }
+
+        // 最后一批包（单向数据流）、最后几个回显的回复还在途中
+        await Task.Delay(TimeSpan.FromMilliseconds(phase.Kind == "udp_train" ? 200 : 300), BlockEnv.Time, ct);
+        await phase.Running.StopAsync();
+        return phase.Running.Block.Flush(FlushMode.All, end.SentCount);
+    }
+
+    public async Task AbortAsync(TestId test)
+    {
+        foreach ((uint stream, PhaseState phase) in _phases.ToList())
+        {
+            if (phase.Test == test && _phases.TryRemove(stream, out _))
+            {
+                await phase.Running.StopAsync();
+            }
+        }
+    }
+
+    public async Task StopAllAsync()
+    {
+        List<RunningBlock> blocks;
+        lock (_gate)
+        {
+            blocks = [.. _lineBlocks.Values];
+            _lineBlocks.Clear();
+        }
+
+        blocks.AddRange(_phases.Values.Select(p => p.Running));
+        _phases.Clear();
+        foreach (RunningBlock running in blocks)
+        {
+            await running.StopAsync();
+        }
+    }
+
+    private sealed record PhaseState(TestId Test, string Kind, RunningBlock Running);
+}

backend/probe/src/Monitor.Probe/Link/AgentDirectory.cs

@@ -0,0 +1,105 @@
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Hosting;
+using Monitor.Protocol;
+
+namespace Monitor.Probe;
+
+/// <summary>
+/// Probe 要连接的 Agent 列表。Probe 不认识 Backend：列表先取自 <c>probe.json</c> 的 bootstrap（或上一次保存的 <c>agents.json</c>），
+/// 连上任意一个 Agent 之后，由它代为向 Backend 查询（<c>monitor.probe.agents</c>），之后的变化由 Agent 推送（<c>agents_changed</c>）。
+/// 列表变化时用 <see cref="ConfigStore"/> 写回 <c>agents.json</c>（这是配置，不是测量数据；只在变化时写，保护路由器的闪存）。
+/// </summary>
+public sealed class AgentDirectory
+{
+    public const string FileName = "agents.json";
+
+    private readonly object _gate = new();
+    private readonly ConfigStore _store;
+    private readonly INodeLog _log;
+    private List<BootstrapAgent> _agents;
+    private long _version;
+
+    public AgentDirectory(ConfigStore store, string configDirectory, ProbeFile file, INodeLog log)
+    {
+        _store = store;
+        _log = log;
+        _agents = [.. file.Bootstrap];
+        string cache = Path.Combine(configDirectory, FileName);
+        if (File.Exists(cache))
+        {
+            try
+            {
+                AgentsCache saved = NodeConfig.Load(cache, ProbeConfigContext.Default.AgentsCache);
+                if (saved.Agents.Count > 0)
+                {
+                    _agents = saved.Agents;
+                    _version = saved.Version;
+                }
+            }
+            catch (Exception ex) when (ex is IOException or InvalidDataException or JsonException or InvalidOperationException)
+            {
+                _log.Warn("agents.json is unreadable, using the bootstrap list", ("err", ex.Message));
+            }
+        }
+    }
+
+    /// <summary>列表变化（调和连接）。</summary>
+    public event Action? Changed;
+
+    public long Version
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _version;
+            }
+        }
+    }
+
+    public IReadOnlyList<BootstrapAgent> Agents
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return [.. _agents];
+            }
+        }
+    }
+
+    /// <summary>应用 Agent 转来的列表。版本不比当前新的忽略（乱序到达的旧推送）。</summary>
+    public void Apply(ProbeAgentsResult result)
+    {
+        var next = result.Agents.Select(a => new BootstrapAgent { AgentId = a.AgentId.Value, Host = a.Host, TcpPort = a.TcpPort, Spki = a.Spki }).ToList();
+        lock (_gate)
+        {
+            if (result.Version < _version || (result.Version == _version && Same(next, _agents)))
+            {
+                return;
+            }
+
+            _version = result.Version;
+            _agents = next;
+        }
+
+        try
+        {
+            _store.Write(FileName, JsonSerializer.SerializeToUtf8Bytes(new AgentsCache { Version = result.Version, Agents = next }, ProbeConfigContext.Default.AgentsCache));
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            _log.Warn("could not save agents.json", ("err", ex.Message));
+        }
+
+        _log.Info("agent list updated", ("version", result.Version), ("agents", next.Count));
+        Changed?.Invoke();
+    }
+
+    private static bool Same(List<BootstrapAgent> a, List<BootstrapAgent> b) =>
+        a.Count == b.Count && a.Zip(b).All(p => Equal(p.First, p.Second));
+
+    public static bool Equal(BootstrapAgent a, BootstrapAgent b) =>
+        a.AgentId == b.AgentId && a.Host == b.Host && a.TcpPort == b.TcpPort && a.Spki == b.Spki;
+}

backend/probe/src/Monitor.Probe/Link/Support.cs

@@ -0,0 +1,87 @@
+using System.Text.Json;
+using Fleet.Core;
+using Fleet.Link;
+using Monitor.Measurement;
+using Monitor.Protocol;
+
+namespace Monitor.Probe;
+
+/// <summary>
+/// 估计 Agent 单调时钟 − Probe 单调时钟：每次 <c>monitor.clock</c> 往返取中点，在最近 8 次里取往返最短的一次
+/// （往返越短，对称性假设的误差越小）。Probe 的列块头里带着这个偏移，Backend 据此对齐两端的时间戳。
+/// </summary>
+public sealed class ClockEstimator
+{
+    private const int Window = 8;
+
+    private readonly object _gate = new();
+    private readonly Queue<(long RoundTripUs, long OffsetUs)> _samples = new();
+
+    public long OffsetUs { get; private set; }
+
+    public bool HasEstimate { get; private set; }
+
+    public void Add(long sendUs, long agentUs, long receiveUs)
+    {
+        lock (_gate)
+        {
+            _samples.Enqueue((receiveUs - sendUs, agentUs - ((sendUs + receiveUs) / 2)));
+            while (_samples.Count > Window)
+            {
+                _samples.Dequeue();
+            }
+
+            OffsetUs = _samples.MinBy(s => s.RoundTripUs).OffsetUs;
+            HasEstimate = true;
+        }
+    }
+}
+
+/// <summary>
+/// 把 Probe 一侧的行交给这个 Agent：补全块头 → 编码 → 放进会话的发件箱（通道 17，至少一次，有界）。
+/// 发件箱的内容在连接断开重连之后重发；发件箱满了丢弃最旧的。
+/// </summary>
+public sealed class FragmentShipper : IFragmentSink
+{
+    private readonly Outbox _outbox;
+    private readonly NodeId _agent;
+    private readonly ProbeId _probe;
+    private readonly ClockEstimator _clock;
+    private readonly TimeProvider _time;
+
+    public FragmentShipper(Outbox outbox, NodeId agent, ProbeId probe, ClockEstimator clock, TimeProvider time)
+    {
+        _outbox = outbox;
+        _agent = agent;
+        _probe = probe;
+        _clock = clock;
+        _time = time;
+    }
+
+    public void Ship(string kind, FragmentScope scope, IReadOnlyList<RawStream> streams, IReadOnlyDictionary<string, JsonElement>? parameters, long startUtcMs, int durationMs, int port)
+    {
+        var header = new RawChunkHeader
+        {
+            ChunkId = ChunkId.New(_time),
+            Kind = kind,
+            TaskId = scope.Task,
+            TestId = scope.Test,
+            Phase = scope.Phase,
+            AgentId = _agent,
+            ProbeId = _probe,
+            Port = port,
+            StartUtcMs = startUtcMs,
+            DurationMs = Math.Max(1, durationMs),
+            Clock = new ChunkClock { ProbeOffsetUs = _clock.OffsetUs },
+        };
+        if (parameters is not null)
+        {
+            foreach ((string key, JsonElement value) in parameters)
+            {
+                header.Params[key] = value;
+            }
+        }
+
+        _outbox.Enqueue(MonitorChannels.ColumnBlock, header.ChunkId.Value, RawChunkCodec.Encode(new RawChunk(header, streams)));
+    }
+}

backend/probe/src/Monitor.Probe/Monitor.Probe.csproj

@@ -0,0 +1,14 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <AssemblyName>monitor-probe</AssemblyName>
+    <RootNamespace>Monitor.Probe</RootNamespace>
+    <IsAotCompatible>true</IsAotCompatible>
+  </PropertyGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="Monitor.Backend.Tests" />
+    <ProjectReference Include="..\..\..\fleet\src\Fleet.Link\Fleet.Link.csproj" />
+    <ProjectReference Include="..\..\..\fleet\src\Fleet.Hosting\Fleet.Hosting.csproj" />
+    <ProjectReference Include="..\..\..\shared\Monitor.Measurement\Monitor.Measurement.csproj" />
+  </ItemGroup>
+</Project>

backend/probe/src/Monitor.Probe/ProbeApp.cs

@@ -0,0 +1,154 @@
+using Fleet.Core;
+using Fleet.Hosting;
+using Fleet.Identity;
+using Monitor.Measurement;
+
+namespace Monitor.Probe;
+
+/// <summary>
+/// Probe 的组装点：Agent 列表 → 每个 Agent 一个连接（认证、重连、角色）。没有全局状态，测试可以在同一进程里启动多个。
+/// 列表变化时只调和连接：新增的建立，移除的断开，地址或证书指纹变化的重建，其余不受影响。
+/// </summary>
+public sealed class ProbeApp : IDisposable
+{
+    public const string Version = "0.1.0";
+
+    private readonly ConnectionEnv _env;
+    private readonly Dictionary<string, Running> _connections = [];
+    private readonly SemaphoreSlim _changed = new(0);
+    private readonly INodeLog _log;
+
+    public ProbeApp(ProbeFile file, string configDirectory, TimeProvider time, INodeLog log)
+    {
+        _log = log;
+        var directory = new AgentDirectory(new ConfigStore(configDirectory), configDirectory, file, log);
+        NodeIdentity identity = NodeIdentity.FromPkcs8(Convert.FromBase64String(file.PrivateKey));
+        _env = new ConnectionEnv(identity, file.ProbeId, file.Limits, directory, new MonoClock(time), time, log);
+        directory.Changed += () => _changed.Release();
+    }
+
+    public AgentDirectory Directory => _env.Directory;
+
+    /// <summary>某个 Agent 的会话是否已经建立（测试和状态查看用）。</summary>
+    public bool IsConnected(string agentId)
+    {
+        lock (_connections)
+        {
+            return _connections.TryGetValue(agentId, out Running? running) && running.Connection.IsConnected;
+        }
+    }
+
+    public AgentConnection? Connection(string agentId)
+    {
+        lock (_connections)
+        {
+            return _connections.TryGetValue(agentId, out Running? running) ? running.Connection : null;
+        }
+    }
+
+    public async Task RunAsync(CancellationToken ct)
+    {
+        if (_env.Directory.Agents.Count == 0)
+        {
+            _log.Warn("no agents known yet: probe.json has an empty bootstrap list");
+        }
+
+        try
+        {
+            while (!ct.IsCancellationRequested)
+            {
+                await ReconcileAsync(_env.Directory.Agents, ct);
+                await _changed.WaitAsync(ct);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // 停止
+        }
+        finally
+        {
+            await ReconcileAsync([], CancellationToken.None);
+        }
+    }
+
+    public void Dispose()
+    {
+        _env.Identity.Dispose();
+        _changed.Dispose();
+    }
+
+    private async Task ReconcileAsync(IReadOnlyList<BootstrapAgent> agents, CancellationToken ct)
+    {
+        var wanted = agents.ToDictionary(a => a.AgentId);
+        var stopped = new List<Running>();
+        lock (_connections)
+        {
+            foreach ((string id, Running running) in _connections.ToList())
+            {
+                if (!wanted.TryGetValue(id, out BootstrapAgent? endpoint) || !AgentDirectory.Equal(endpoint, running.Connection.Endpoint))
+                {
+                    stopped.Add(running);
+                    _connections.Remove(id);
+                }
+            }
+        }
+
+        foreach (Running running in stopped)
+        {
+            await running.StopAsync();
+        }
+
+        if (ct.IsCancellationRequested)
+        {
+            return;
+        }
+
+        lock (_connections)
+        {
+            foreach ((string id, BootstrapAgent endpoint) in wanted)
+            {
+                if (!_connections.ContainsKey(id))
+                {
+                    _connections[id] = Running.Start(new AgentConnection(endpoint, _env));
+                }
+            }
+        }
+    }
+
+    private sealed class Running : IDisposable
+    {
+        private readonly CancellationTokenSource _cts = new();
+        private Task _run = Task.CompletedTask;
+
+        private Running(AgentConnection connection)
+        {
+            Connection = connection;
+        }
+
+        public AgentConnection Connection { get; }
+
+        public static Running Start(AgentConnection connection)
+        {
+            var running = new Running(connection);
+            running._run = Task.Run(() => connection.RunAsync(running._cts.Token), CancellationToken.None);
+            return running;
+        }
+
+        public async Task StopAsync()
+        {
+            await _cts.CancelAsync();
+            try
+            {
+                await _run.WaitAsync(TimeSpan.FromSeconds(10));
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or TimeoutException)
+            {
+                // 没有及时退出：不再等
+            }
+
+            Dispose();
+        }
+
+        public void Dispose() => _cts.Dispose();
+    }
+}

backend/probe/src/Monitor.Probe/ProbeConfig.cs

@@ -0,0 +1,65 @@
+using System.Text.Json.Serialization;
+
+namespace Monitor.Probe;
+
+/// <summary>
+/// <c>probe.json</c>：面板 <c>POST /api/admin/probe/identity</c> 生成的文件（只能下载一次）。
+/// <c>limits</c> 是本地硬上限，面板无法修改；在路由器上建议调低，避免 Probe 自己的 CPU 成为瓶颈、反过来影响测量。
+/// </summary>
+public sealed class ProbeFile
+{
+    [JsonPropertyName("probe_id")]
+    public string ProbeId { get; set; } = "";
+
+    /// <summary>PKCS#8，base64。</summary>
+    [JsonPropertyName("private_key")]
+    public string PrivateKey { get; set; } = "";
+
+    /// <summary>首次连接用的 Agent；连上之后以 <c>agents.json</c>（最新的列表）为准。</summary>
+    [JsonPropertyName("bootstrap")]
+    public List<BootstrapAgent> Bootstrap { get; set; } = [];
+
+    [JsonPropertyName("limits")]
+    public ProbeLimits Limits { get; set; } = new();
+}
+
+public sealed class BootstrapAgent
+{
+    [JsonPropertyName("agent_id")]
+    public string AgentId { get; set; } = "";
+
+    [JsonPropertyName("host")]
+    public string Host { get; set; } = "";
+
+    [JsonPropertyName("tcp_port")]
+    public int TcpPort { get; set; }
+
+    /// <summary>Agent 的 TLS 证书指纹（SHA-256，base64）。</summary>
+    [JsonPropertyName("spki")]
+    public string Spki { get; set; } = "";
+}
+
+public sealed class ProbeLimits
+{
+    /// <summary>按需测试里单个阶段允许的最大码率（Mbit/s）。</summary>
+    [JsonPropertyName("max_test_mbps")]
+    public double MaxTestMbps { get; set; } = 100;
+
+    /// <summary>按需测试里单个阶段允许的最大包速率。</summary>
+    [JsonPropertyName("max_total_pps")]
+    public long MaxTotalPps { get; set; } = 20_000;
+}
+
+[JsonSerializable(typeof(ProbeFile))]
+[JsonSerializable(typeof(AgentsCache))]
+public sealed partial class ProbeConfigContext : JsonSerializerContext;
+
+/// <summary><c>agents.json</c>：最近一次从 Agent 同步到的列表（配置，不是测量数据）。</summary>
+public sealed class AgentsCache
+{
+    [JsonPropertyName("version")]
+    public long Version { get; set; }
+
+    [JsonPropertyName("agents")]
+    public List<BootstrapAgent> Agents { get; set; } = [];
+}

backend/probe/src/Monitor.Probe/Program.cs

@@ -0,0 +1,50 @@
+using Fleet.Core;
+using Fleet.Hosting;
+using Monitor.Probe;
+
+TimeProvider time = TimeProvider.System;
+INodeLog log = new ConsoleNodeLog(time);
+
+if (PlatformCheck.VerifyCrypto() is { } problem)
+{
+    log.Error("startup failed", ("err", problem));
+    return 1;
+}
+
+string configPath = "/etc/monitor/probe.json";
+for (int i = 0; i < args.Length - 1; i++)
+{
+    if (args[i] == "--config")
+    {
+        configPath = args[i + 1];
+    }
+}
+
+ProbeFile file;
+try
+{
+    file = NodeConfig.Load(configPath, ProbeConfigContext.Default.ProbeFile);
+    if (file.ProbeId.Length == 0 || file.PrivateKey.Length == 0)
+    {
+        throw new InvalidOperationException("probe.json needs probe_id and private_key (download it from the panel: POST /api/admin/probe/identity)");
+    }
+}
+catch (Exception ex) when (ex is IOException or InvalidDataException or InvalidOperationException or System.Text.Json.JsonException)
+{
+    log.Error("startup failed", ("err", ex.Message));
+    return 1;
+}
+
+string directory = Path.GetDirectoryName(Path.GetFullPath(configPath))!;
+try
+{
+    using var app = new ProbeApp(file, directory, time, log);
+    await ServiceShell.RunAsync(app.RunAsync, log);
+}
+catch (Exception ex) when (ex is FormatException or System.Security.Cryptography.CryptographicException)
+{
+    log.Error("startup failed", ("err", "private_key is not a valid PKCS#8 key: " + ex.Message));
+    return 1;
+}
+
+return 0;

backend/probe/tests/Monitor.Probe.Tests/Monitor.Probe.Tests.csproj

@@ -0,0 +1,13 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <OutputType>Exe</OutputType>
+    <IsPackable>false</IsPackable>
+  </PropertyGroup>
+  <ItemGroup>
+    <PackageReference Include="xunit.v3" />
+    <ProjectReference Include="..\..\src\Monitor.Probe\Monitor.Probe.csproj" />
+  </ItemGroup>
+  <ItemGroup>
+    <Using Include="Xunit" />
+  </ItemGroup>
+</Project>

backend/probe/tests/Monitor.Probe.Tests/ProbeTests.cs

@@ -0,0 +1,87 @@
+using Fleet.Core;
+using Fleet.Hosting;
+using Monitor.Protocol;
+
+namespace Monitor.Probe.Tests;
+
+public sealed class ProbeTests
+{
+    [Fact]
+    public void ClockEstimator_UsesTheSampleWithTheShortestRoundTrip()
+    {
+        var clock = new ClockEstimator();
+        Assert.False(clock.HasEstimate);
+
+        // Offset 1000 with a 50 ms round trip, offset 5000 with a 2 ms round trip (symmetry assumption is far better here)
+        clock.Add(sendUs: 0, agentUs: 25_000 + 1000, receiveUs: 50_000);
+        clock.Add(sendUs: 100_000, agentUs: 101_000 + 5000, receiveUs: 102_000);
+        Assert.True(clock.HasEstimate);
+        Assert.Equal(5000, clock.OffsetUs);
+
+        // Slow samples do not displace the good one
+        clock.Add(sendUs: 200_000, agentUs: 300_000, receiveUs: 400_000);
+        Assert.Equal(5000, clock.OffsetUs);
+    }
+
+    private static string NewDirectory()
+    {
+        string path = Path.Combine(Path.GetTempPath(), "probe-tests-" + Guid.NewGuid().ToString("N"));
+        Directory.CreateDirectory(path);
+        return path;
+    }
+
+    private static ProbeAgentsResult List(long version, params string[] ids) => new()
+    {
+        Version = version,
+        Agents = [.. ids.Select(id => new AgentEndpoint { AgentId = new NodeId(id), Host = id + ".example", TcpPort = 7443, Spki = "c3BraQ==" })],
+    };
+
+    [Fact]
+    public void AgentDirectory_StartsFromBootstrap_IgnoresStaleLists_PersistsChanges_AndReloadsThem()
+    {
+        string directory = NewDirectory();
+        try
+        {
+            var file = new ProbeFile { ProbeId = "prb_x", Bootstrap = [new BootstrapAgent { AgentId = "agt_boot", Host = "boot.example", TcpPort = 7443, Spki = "c3BraQ==" }] };
+            var directoryA = new AgentDirectory(new ConfigStore(directory), directory, file, NullNodeLog.Instance);
+            int changes = 0;
+            directoryA.Changed += () => changes++;
+            Assert.Equal(["agt_boot"], directoryA.Agents.Select(a => a.AgentId));
+
+            directoryA.Apply(List(5, "agt_1", "agt_2"));
+            Assert.Equal(1, changes);
+            Assert.Equal(["agt_1", "agt_2"], directoryA.Agents.Select(a => a.AgentId));
+
+            directoryA.Apply(List(4, "agt_old")); // out-of-order older push
+            directoryA.Apply(List(5, "agt_1", "agt_2")); // same version and content
+            Assert.Equal(1, changes);
+            Assert.Equal(5, directoryA.Version);
+
+            // The next start uses the saved list, not the bootstrap one
+            var directoryB = new AgentDirectory(new ConfigStore(directory), directory, file, NullNodeLog.Instance);
+            Assert.Equal(["agt_1", "agt_2"], directoryB.Agents.Select(a => a.AgentId));
+            Assert.Equal(5, directoryB.Version);
+        }
+        finally
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+    }
+
+    [Fact]
+    public void AgentDirectory_FallsBackToBootstrap_WhenTheSavedFileIsCorrupt()
+    {
+        string directory = NewDirectory();
+        try
+        {
+            new ConfigStore(directory).Write(AgentDirectory.FileName, "{ not json"u8.ToArray());
+            var file = new ProbeFile { Bootstrap = [new BootstrapAgent { AgentId = "agt_boot", Host = "h", TcpPort = 1, Spki = "AA==" }] };
+            var loaded = new AgentDirectory(new ConfigStore(directory), directory, file, NullNodeLog.Instance);
+            Assert.Equal(["agt_boot"], loaded.Agents.Select(a => a.AgentId));
+        }
+        finally
+        {
+            Directory.Delete(directory, recursive: true);
+        }
+    }
+}