refactor!: rename the project from Monitor to MoShiro

Namespaces, assemblies, projects and directories, the solution, binaries,
images, systemd units, config paths, environment variables, protocol method
names, the media type and the raw chunk magic all move to MoShiro/moshiro.
Existing data and deployments are not compatible and must be recreated.
Also fix the architecture tests after the solution layout change and make
the update tests independent of their order.

backend/shared/MoShiro.Measurement/Blocks/BlockBase.cs

@@ -0,0 +1,105 @@
+using System.Net;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>积木的公共部分：环境、参数、把行切成列块交出去。</summary>
+public abstract class BlockBase : IBlock
+{
+    protected BlockBase(BlockEnv env, BlockSpec spec)
+    {
+        Env = env;
+        Spec = spec;
+    }
+
+    public virtual long Produced => 0;
+
+    protected BlockEnv Env { get; }
+
+    protected BlockSpec Spec { get; }
+
+    public abstract Task RunAsync(CancellationToken ct);
+
+    public virtual int Flush(FlushMode mode, long peerProduced = 0) => 0;
+
+    public virtual RowStore? Records(string streamName) => null;
+
+    protected IPEndPoint PeerEndpoint(int port) => new(Env.PeerAddress!, port);
+
+    /// <summary>交出一个流的行；起点和时长取自时间列 <paramref name="timeColumn"/> 的首尾（本侧的单调时钟，微秒）。</summary>
+    protected void Ship(RawStream stream, string timeColumn, IReadOnlyList<RawStream>? extra = null, IReadOnlyDictionary<string, System.Text.Json.JsonElement>? parameters = null)
+    {
+        RawColumn? time = stream.Find(timeColumn);
+        long first = stream.Count > 0 && time is not null ? time.Values[0] : Env.Clock.NowUs();
+        long last = stream.Count > 0 && time is not null ? time.Values[stream.Count - 1] : first;
+        List<RawStream> streams = [stream];
+        if (extra is not null)
+        {
+            streams.AddRange(extra);
+        }
+
+        Env.Fragments!.Ship(Spec.KindId, Spec.Scope, streams, parameters ?? Spec.Params.Values, Env.Clock.UtcMsAt(first), (int)((last - first) / 1000), Spec.Port);
+    }
+
+    /// <summary>什么也不做、一直等到取消（监听方里不需要自己运行逻辑的积木）。</summary>
+    protected async Task WaitUntilCancelledAsync(CancellationToken ct)
+    {
+        try
+        {
+            await Task.Delay(Timeout.InfiniteTimeSpan, Env.Time, ct);
+        }
+        catch (OperationCanceledException)
+        {
+            // 被停止
+        }
+    }
+}
+
+/// <summary>
+/// 拨号方作为行的主导方时记录的行：行按键（序号）追加，回复到达时按键回填列，到点把已经稳定的行从游标处切下来交出去。
+/// 环形缓冲被覆盖的行（交出太慢）直接跳过。
+/// </summary>
+internal sealed class DriverLog
+{
+    private readonly object _gate = new();
+    private long _cursor;
+
+    public DriverLog(StreamSpec spec, Side driver, int capacity)
+    {
+        Store = new RowStore(spec, driver, capacity);
+        Spec = spec;
+    }
+
+    public RowStore Store { get; }
+
+    public StreamSpec Spec { get; }
+
+    public long Count => Store.NextKey;
+
+    /// <summary>取出游标之后已经稳定的行：<paramref name="settled"/> 为 null 或 <paramref name="all"/> 时取全部。</summary>
+    public RawStream? Take(Func<long, bool>? settled, bool all, int maxRows = int.MaxValue)
+    {
+        long from;
+        long to;
+        lock (_gate)
+        {
+            from = _cursor;
+            to = from;
+            long end = Store.NextKey;
+            while (to < end && to - from < maxRows && (all || settled is null || !Store.Contains(to) || settled(to)))
+            {
+                to++;
+            }
+
+            if (to == from)
+            {
+                return null;
+            }
+
+            _cursor = to;
+        }
+
+        RawStream stream = Store.Cut(from, to, includeKey: Spec.Key is not null);
+        return stream.Count == 0 ? null : stream;
+    }
+}

backend/shared/MoShiro.Measurement/Blocks/BlockCatalog.cs

@@ -0,0 +1,45 @@
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>
+/// 一种采集方法（Kind）的两个角色：拨号方（Probe）和监听方（Agent），以及它能不能作为目标任务（Agent 自己探测一个地址，没有对端）运行。
+/// 积木只按机制命名、只产生原始列，不知道上层的方案或协议。
+/// </summary>
+public sealed record BlockPair(
+    string Kind,
+    Func<BlockEnv, BlockSpec, IBlock> Dialer,
+    Func<BlockEnv, BlockSpec, IBlock>? Listener,
+    bool RunsAsTarget = false,
+    bool OnDemandOnly = false,
+    IReadOnlyList<string>? Directions = null)
+{
+    /// <summary>这个 Kind 支持 <paramref name="direction"/> 吗（没有 <c>direction</c> 参数的 Kind 传 null）。</summary>
+    public bool Supports(string? direction) => Directions is null || direction is null || Directions.Contains(direction);
+}
+
+/// <summary>
+/// 积木目录：新增一种采集方法 = 在 <see cref="Kinds"/> 里加一条声明，在这里加一行，实现它的两个角色。Probe 和 Agent 同时获得。
+/// hello 里上报的 capabilities、本地预算检查的支持列表都从这里推出来，不再手写。
+/// </summary>
+public static class BlockCatalog
+{
+    public static readonly IReadOnlyList<BlockPair> All =
+    [
+        new("udp_echo", (e, s) => new UdpEchoDialer(e, s), (e, s) => new UdpEchoListener(e, s)),
+        new("tcp_echo", (e, s) => new TcpEchoDialer(e, s), (e, s) => new TcpEchoListener(e, s)),
+        new("udp_train", (e, s) => new TrainDialer(e, s), (e, s) => new TrainListener(e, s), OnDemandOnly: true, Directions: ["rev"]),
+        new("tcp_bulk", (e, s) => new TcpBulkDialer(e, s), (e, s) => new TcpBulkListener(e, s), OnDemandOnly: true, Directions: ["fwd", "rev"]),
+        new("connect", (e, s) => new ConnectDialer(e, s), (e, s) => new IdleListener(e, s), RunsAsTarget: true),
+        new("hold", (e, s) => new HoldDialer(e, s), (e, s) => new TcpEchoListener(e, s, record: false)),
+        new("icmp_echo", (e, s) => new IcmpEchoSolo(e, s), null, RunsAsTarget: true),
+    ];
+
+    public static BlockPair? Find(string kind) => All.FirstOrDefault(p => p.Kind == kind);
+
+    /// <summary>这个构建的 Agent 能运行的 Kind（监听方，或目标任务）。</summary>
+    public static IReadOnlyList<string> AgentKinds { get; } = [.. All.Where(p => p.Listener is not null || p.RunsAsTarget).Select(p => p.Kind)];
+
+    /// <summary>这个构建的 Probe 能运行的 Kind（有监听方可以配对的拨号方）。</summary>
+    public static IReadOnlyList<string> ProbeKinds { get; } = [.. All.Where(p => p.Listener is not null).Select(p => p.Kind)];
+}

backend/shared/MoShiro.Measurement/Blocks/Bulk.cs

@@ -0,0 +1,277 @@
+using System.Net.Sockets;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>批量传输的收发循环（两端共用）。</summary>
+internal static class BulkIo
+{
+    private const int ChunkBytes = 16 * 1024;
+
+    /// <summary>
+    /// 发送：尽可能快，但不超过 <paramref name="mbps"/>（本地硬上限，防止把小机器的 CPU 和链路打满）。
+    /// 发送的数据是随机字节（避免被链路上的压缩或重复数据消除"优化"掉）。
+    /// </summary>
+    public static async Task SendAsync(Stream stream, double mbps, Action<int> onBytes, TimeProvider time, CancellationToken ct)
+    {
+        byte[] buffer = new byte[ChunkBytes];
+        Random.Shared.NextBytes(buffer);
+        double bytesPerSecond = mbps * 1_000_000 / 8;
+        long start = time.GetTimestamp();
+        long sent = 0;
+        while (!ct.IsCancellationRequested)
+        {
+            await stream.WriteAsync(buffer, ct);
+            sent += buffer.Length;
+            onBytes(buffer.Length);
+            if (bytesPerSecond > 0)
+            {
+                double ahead = (sent / bytesPerSecond) - time.GetElapsedTime(start).TotalSeconds;
+                if (ahead > 0.002)
+                {
+                    await Task.Delay(TimeSpan.FromSeconds(Math.Min(ahead, 0.05)), time, ct);
+                }
+            }
+        }
+    }
+
+    /// <summary>接收并丢弃，直到对端关闭或取消。</summary>
+    public static async Task ReceiveAsync(Stream stream, Action<int> onBytes, CancellationToken ct)
+    {
+        byte[] buffer = new byte[4 * ChunkBytes];
+        while (!ct.IsCancellationRequested)
+        {
+            int read = await stream.ReadAsync(buffer, ct);
+            if (read <= 0)
+            {
+                return;
+            }
+
+            onBytes(read);
+        }
+    }
+
+    public static bool IsExpected(Exception ex) =>
+        ex is OperationCanceledException or IOException or SocketException or ObjectDisposedException or System.Security.Authentication.AuthenticationException or InvalidOperationException;
+}
+
+/// <summary>
+/// 批量传输，拨号方（Probe）：开 <c>streams</c> 条 TCP 连接（可选 TLS），按 <c>direction</c> 发送（fwd）或接收（rev），持续 <c>duration_s</c>。
+/// 记录每个采样间隔每条连接的<b>累计字节数</b>（<c>bytes</c> 流，Probe 的时钟），Backend 据此求每个间隔的吞吐；
+/// 同时采样第一条连接自己这一侧的内核 <c>tcp_info</c>（多条连接的累计计数器不能混在同一个序列里求差）。
+/// 发送速率不超过本地上限 <see cref="BlockEnv.MaxBulkMbps"/>。
+/// </summary>
+public sealed class TcpBulkDialer : BlockBase
+{
+    private const int MaxRowsPerFragment = 40_000;
+
+    private readonly DriverLog _log;
+    private readonly TcpInfoRecorder _info;
+    private readonly int _ts;
+    private readonly int _conn;
+    private readonly int _bytes;
+    private long[] _counters = [];
+
+    public TcpBulkDialer(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        long expectedRows = spec.Int("streams") * spec.Int("duration_s") * Math.Max(1, 1000 / Math.Max(1, spec.Int("sample_ms")));
+        _log = new DriverLog(spec.Kind.FindStream("bytes")!, Side.Probe, (int)Math.Clamp(expectedRows + 256, 1024, 262_144));
+        _info = new TcpInfoRecorder(spec.Kind.FindStream("tcp_info")!, Side.Probe, env.Clock);
+        _ts = _log.Store.ColumnIndex("ts");
+        _conn = _log.Store.ColumnIndex("conn");
+        _bytes = _log.Store.ColumnIndex("bytes");
+    }
+
+    public override long Produced => _log.Count;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        int streams = (int)Spec.Int("streams");
+        bool send = Spec.Params.GetString("direction") == "fwd";
+        TimeSpan duration = TimeSpan.FromSeconds(Spec.Int("duration_s"));
+        TimeSpan sampleEvery = TimeSpan.FromMilliseconds(Spec.Int("sample_ms"));
+        _counters = new long[streams];
+
+        var links = new TcpLink?[streams];
+        try
+        {
+            await Task.WhenAll(Enumerable.Range(0, streams).Select(async i =>
+            {
+                try
+                {
+                    links[i] = await TcpLink.OpenAsync(Env, Spec.Port, Spec.Bool("tls"), Spec.StreamId, sendAuth: true, ct);
+                }
+                catch (Exception ex) when (BulkIo.IsExpected(ex))
+                {
+                    // 这条连接没有建起来：它的字节数一直是 0
+                }
+            }));
+
+            using var timeout = new CancellationTokenSource(duration, Env.Time);
+            using var run = CancellationTokenSource.CreateLinkedTokenSource(ct, timeout.Token);
+            var work = new List<Task>();
+            double perStream = Env.MaxBulkMbps / streams;
+            for (int i = 0; i < streams; i++)
+            {
+                if (links[i] is not { } link)
+                {
+                    continue;
+                }
+
+                int index = i;
+                work.Add(RunConnectionAsync(link.Stream, index, send, perStream, run.Token));
+            }
+
+            if (links.FirstOrDefault(l => l is not null) is { } first)
+            {
+                work.Add(_info.RunAsync(first.Socket, sampleEvery, run.Token));
+            }
+
+            Task sampler = SampleAsync(sampleEvery, run.Token);
+            await Task.WhenAll(work);
+            await run.CancelAsync();
+            await sampler;
+            Sample(); // 最后一个采样点
+        }
+        finally
+        {
+            foreach (TcpLink? link in links)
+            {
+                link?.Dispose();
+            }
+        }
+    }
+
+    public override int Flush(FlushMode mode, long peerProduced = 0)
+    {
+        int fragments = 0;
+        while (_log.Take(null, all: true, MaxRowsPerFragment) is { } stream)
+        {
+            RawStream kernel = _info.Rows.Drain(includeKey: false);
+            Ship(stream, "ts", kernel.Count > 0 ? [kernel] : null);
+            fragments++;
+        }
+
+        if (fragments == 0 && _info.Rows.Drain(includeKey: false) is { Count: > 0 } onlyKernel)
+        {
+            Ship(onlyKernel, "ts");
+            fragments++;
+        }
+
+        return fragments;
+    }
+
+    private async Task RunConnectionAsync(Stream stream, int index, bool send, double mbps, CancellationToken ct)
+    {
+        try
+        {
+            if (send)
+            {
+                await BulkIo.SendAsync(stream, mbps, n => Interlocked.Add(ref _counters[index], n), Env.Time, ct);
+            }
+            else
+            {
+                await BulkIo.ReceiveAsync(stream, n => Interlocked.Add(ref _counters[index], n), ct);
+            }
+        }
+        catch (Exception ex) when (BulkIo.IsExpected(ex))
+        {
+            // 时间到或者连接断开：计数停在这里
+        }
+    }
+
+    private async Task SampleAsync(TimeSpan every, CancellationToken ct)
+    {
+        using var timer = new PeriodicTimer(every, Env.Time);
+        try
+        {
+            while (await timer.WaitForNextTickAsync(ct))
+            {
+                Sample();
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // 阶段结束
+        }
+    }
+
+    private void Sample()
+    {
+        long now = Env.Clock.NowUs();
+        for (int i = 0; i < _counters.Length; i++)
+        {
+            long key = _log.Store.Append();
+            _log.Store.Set(key, _ts, now);
+            _log.Store.Set(key, _conn, i);
+            _log.Store.Set(key, _bytes, Interlocked.Read(ref _counters[i]));
+        }
+    }
+}
+
+/// <summary>
+/// 批量传输，监听方（Agent）：接受连接，<c>rev</c> 时向 Probe 发送（受本地码率上限约束），<c>fwd</c> 时接收并丢弃；
+/// 采样第一条连接自己这一侧的内核 <c>tcp_info</c>（Agent 的重传反映下行方向，代理场景里大流量走这个方向）。
+/// 连接在 <c>duration_s</c> 之后（加几秒余量）或阶段结束时关闭。
+/// </summary>
+public sealed class TcpBulkListener : BlockBase
+{
+    private readonly TcpInfoRecorder _info;
+    private CancellationToken _stop;
+    private int _sampled;
+
+    public TcpBulkListener(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        _info = new TcpInfoRecorder(spec.Kind.FindStream("tcp_info")!, Side.Agent, env.Clock);
+    }
+
+    public override RowStore? Records(string streamName) => streamName == "tcp_info" ? _info.Rows : null;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        _stop = ct;
+        Env.TcpListen!.Register(Spec.StreamId, HandleAsync);
+        try
+        {
+            await WaitUntilCancelledAsync(ct);
+        }
+        finally
+        {
+            Env.TcpListen.Unregister(Spec.StreamId);
+        }
+    }
+
+    private async Task HandleAsync(TcpConnection connection, CancellationToken acceptorToken)
+    {
+        using var timeout = new CancellationTokenSource(TimeSpan.FromSeconds(Spec.Int("duration_s") + 3), Env.Time);
+        using var linked = CancellationTokenSource.CreateLinkedTokenSource(acceptorToken, _stop, timeout.Token);
+        Task sampler = Task.CompletedTask;
+        if (Interlocked.CompareExchange(ref _sampled, 1, 0) == 0)
+        {
+            sampler = _info.RunAsync(connection.Socket, TimeSpan.FromMilliseconds(Spec.Int("sample_ms")), linked.Token);
+        }
+
+        try
+        {
+            if (Spec.Params.GetString("direction") == "rev")
+            {
+                await BulkIo.SendAsync(connection.Stream, Env.MaxBulkMbps / Math.Max(1, Spec.Int("streams")), _ => Env.Counters.PacketOut(), Env.Time, linked.Token);
+            }
+            else
+            {
+                await BulkIo.ReceiveAsync(connection.Stream, _ => Env.Counters.PacketIn(), linked.Token);
+            }
+        }
+        catch (Exception ex) when (BulkIo.IsExpected(ex))
+        {
+            // 时间到、阶段结束或对端关闭
+        }
+        finally
+        {
+            await linked.CancelAsync();
+            await sampler;
+        }
+    }
+}

backend/shared/MoShiro.Measurement/Blocks/Echo.cs

@@ -0,0 +1,383 @@
+using System.Net;
+using System.Net.Sockets;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>
+/// 回显积木的行表（拨号方，行的主导方）：发出时记 size、t1，回复到达时按序号回填 t4，到点把已经稳定的行切成列块。
+/// UDP 回显和 TCP 回显共用，列由 Kind 的 <c>msg</c> 流声明决定。
+/// </summary>
+internal sealed class EchoRows
+{
+    /// <summary>UDP：没有在这段时间内回来的包就是丢了。</summary>
+    public const long UdpGraceUs = 2_000_000;
+
+    /// <summary>
+    /// TCP 不会丢包，只会延迟（重传、队头阻塞）：一次几秒的中断之后，积压的回显会陆续回来，RTT 就是那几秒。
+    /// 如果像 UDP 那样等 2 秒就把没有回复的行当作丢失交出去，最严重的长尾反而成了"丢包"，RTT 里一点也看不到。
+    /// 所以 TCP 的行要等回复（或者连接真的断了——30 秒之后仍然没有回复才交出，t4 缺失）。
+    /// </summary>
+    public const long TcpGraceUs = 30_000_000;
+
+    private readonly DriverLog _log;
+    private readonly int _size;
+    private readonly int _t1;
+    private readonly int _t4;
+    private readonly long _graceUs;
+    private readonly bool _settleOnReply;
+
+    public EchoRows(KindSpec kind, int capacity, long graceUs, bool settleOnReply)
+    {
+        _graceUs = graceUs;
+        _settleOnReply = settleOnReply;
+        StreamSpec spec = kind.FindStream("msg")!;
+        _log = new DriverLog(spec, Side.Probe, capacity);
+        _size = _log.Store.ColumnIndex("size");
+        _t1 = _log.Store.ColumnIndex("t1");
+        _t4 = _log.Store.ColumnIndex("t4");
+    }
+
+    public long Count => _log.Count;
+
+    public uint Add(int size, long t1Us)
+    {
+        long key = _log.Store.Append();
+        _log.Store.Set(key, _size, size);
+        _log.Store.Set(key, _t1, t1Us);
+        return (uint)key;
+    }
+
+    public void Reply(uint seq, long t4Us)
+    {
+        if (_log.Store.Contains(seq) && !_log.Store.IsSet(seq, _t4))
+        {
+            _log.Store.Set(seq, _t4, t4Us);
+        }
+    }
+
+    public RawStream? Take(long nowUs, bool all) =>
+        _log.Take(
+            key => (_settleOnReply && _log.Store.IsSet(key, _t4)) || (_log.Store.TryGet(key, _t1, out long t1) && t1 <= nowUs - _graceUs),
+            all);
+}
+
+/// <summary>
+/// UDP 回显，拨号方（Probe）：按声明的速率发包，t1 在发出时记录，回复到达时回填 t4。回复丢失的行 t4 缺失（Agent 一侧再补 t2/t3）。
+/// </summary>
+public sealed class UdpEchoDialer : BlockBase
+{
+    private readonly EchoRows _rows;
+
+    public UdpEchoDialer(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        _rows = new EchoRows(spec.Kind, 16384, EchoRows.UdpGraceUs, settleOnReply: false);
+    }
+
+    public override long Produced => _rows.Count;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        UdpMux udp = Env.Udp!;
+        DataSession session = Env.Session() ?? throw new BlockFaultException("no data session");
+        IPEndPoint target = PeerEndpoint(Spec.Port);
+        int size = (int)Spec.Int("size");
+        byte[] packet = new byte[size];
+        udp.Register(Spec.StreamId, OnPacket);
+        try
+        {
+            using var timer = new PeriodicTimer(TimeSpan.FromSeconds(1.0 / Spec.Int("rate_hz")), Env.Time);
+            while (await timer.WaitForNextTickAsync(ct))
+            {
+                long t1 = Env.Clock.NowUs();
+                uint seq = _rows.Add(size, t1);
+                UdpPacket.Write(packet, new UdpHeader(UdpPacketType.EchoRequest, session.SessionId, Spec.StreamId, seq, t1), session.Key);
+                udp.Send(target, packet);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // 积木被停止
+        }
+        finally
+        {
+            udp.Unregister(Spec.StreamId);
+        }
+    }
+
+    public override int Flush(FlushMode mode, long peerProduced = 0)
+    {
+        RawStream? stream = _rows.Take(Env.Clock.NowUs(), mode == FlushMode.All);
+        if (stream is null)
+        {
+            return 0;
+        }
+
+        Ship(stream, "t1");
+        return 1;
+    }
+
+    private void OnPacket(in UdpDelivery delivery)
+    {
+        if (delivery.Header.Type == UdpPacketType.EchoReply)
+        {
+            _rows.Reply(delivery.Header.Seq, delivery.ReceiveUs);
+        }
+    }
+}
+
+/// <summary>UDP 回显，监听方（Agent）：校验后立即回复一个等长的包，记录 t2（到达）和 t3（回复发出），按序号留给合并。</summary>
+public sealed class UdpEchoListener : BlockBase
+{
+    private readonly RowStore _records;
+
+    public UdpEchoListener(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        _records = new RowStore(spec.Kind.FindStream("msg")!, Side.Agent, 32768);
+    }
+
+    public override RowStore? Records(string streamName) => streamName == "msg" ? _records : null;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        Env.Udp!.Register(Spec.StreamId, OnPacket);
+        try
+        {
+            await WaitUntilCancelledAsync(ct);
+        }
+        finally
+        {
+            Env.Udp.Unregister(Spec.StreamId);
+        }
+    }
+
+    private void OnPacket(in UdpDelivery delivery)
+    {
+        if (delivery.Header.Type != UdpPacketType.EchoRequest)
+        {
+            return; // Data：探活包，只用来保持 NAT 映射和让准入策略学到源地址
+        }
+
+        long t2 = delivery.ReceiveUs;
+        delivery.ReplyAs(UdpPacketType.EchoReply);
+        Span<long> row = [t2, Env.Clock.NowUs()];
+        _records.SetRow(delivery.Header.Seq, row);
+    }
+}
+
+/// <summary>
+/// TCP 回显，拨号方：一条常驻连接（可选 TLS）上按速率发小消息，回复按序到达。连接断开期间不发消息（没有连接不是丢包），
+/// 之后按退避重连；断开和重连本身由 connect/hold 记录。
+/// </summary>
+public sealed class TcpEchoDialer : BlockBase
+{
+    private readonly EchoRows _rows;
+    private readonly TcpInfoRecorder _info;
+
+    public TcpEchoDialer(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        _rows = new EchoRows(spec.Kind, 16384, EchoRows.TcpGraceUs, settleOnReply: true);
+        _info = new TcpInfoRecorder(spec.Kind.FindStream("tcp_info")!, Side.Probe, env.Clock);
+    }
+
+    public override long Produced => _rows.Count;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        var backoff = new Fleet.Core.Backoff(TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(30));
+        while (!ct.IsCancellationRequested)
+        {
+            try
+            {
+                using TcpLink link = await TcpLink.OpenAsync(Env, Spec.Port, Spec.Bool("tls"), Spec.StreamId, sendAuth: true, ct);
+                backoff.Reset();
+                await ExchangeAsync(link, ct);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                return;
+            }
+            catch (Exception ex) when (ex is SocketException or IOException or System.Security.Authentication.AuthenticationException or OperationCanceledException or InvalidDataException or InvalidOperationException)
+            {
+                // 连接失败或断开：退避之后重连
+            }
+
+            try
+            {
+                await Task.Delay(backoff.Next(), Env.Time, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+        }
+    }
+
+    public override int Flush(FlushMode mode, long peerProduced = 0)
+    {
+        RawStream? stream = _rows.Take(Env.Clock.NowUs(), mode == FlushMode.All);
+        RawStream kernel = _info.Rows.Drain(includeKey: false);
+        if (stream is null && kernel.Count == 0)
+        {
+            return 0;
+        }
+
+        // 内核采样（tcp_info）和回显行一起交出；只有采样没有回显行（例如连接刚断开）时单独交出
+        if (stream is null)
+        {
+            Ship(kernel, "ts");
+        }
+        else
+        {
+            Ship(stream, "t1", kernel.Count > 0 ? [kernel] : null);
+        }
+
+        return 1;
+    }
+
+    private async Task ExchangeAsync(TcpLink link, CancellationToken ct)
+    {
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        Task reader = ReadRepliesAsync(link.Stream, cts.Token);
+        Task writer = WriteRequestsAsync(link.Stream, cts.Token);
+        Task sampler = _info.RunAsync(link.Socket, TimeSpan.FromMilliseconds(Spec.Int("tcp_info_ms")), cts.Token);
+        await Task.WhenAny(reader, writer);
+        await cts.CancelAsync();
+        foreach (Task task in new[] { reader, writer, sampler })
+        {
+            try
+            {
+                await task;
+            }
+            catch (Exception ex) when (ex is OperationCanceledException or IOException or SocketException or ObjectDisposedException)
+            {
+                // 连接已经断开
+            }
+        }
+    }
+
+    private async Task WriteRequestsAsync(Stream stream, CancellationToken ct)
+    {
+        int min = (int)Spec.Int("min");
+        int max = (int)Spec.Int("max");
+        byte[] body = new byte[Math.Max(max, min)];
+        using var timer = new PeriodicTimer(TimeSpan.FromSeconds(1.0 / Spec.Int("rate_hz")), Env.Time);
+        while (await timer.WaitForNextTickAsync(ct))
+        {
+            int size = Math.Max(TcpWire.MinEchoBody, max > min ? Random.Shared.Next(min, max + 1) : min);
+            long t1 = Env.Clock.NowUs();
+            uint seq = _rows.Add(size, t1);
+            body.AsSpan(0, size).Clear();
+            TcpWire.WriteEchoBody(body, seq, t1);
+            await TcpWire.WriteMessageAsync(stream, body.AsMemory(0, size), ct);
+            await stream.FlushAsync(ct);
+        }
+    }
+
+    private async Task ReadRepliesAsync(Stream stream, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            byte[]? reply = await TcpWire.ReadMessageAsync(stream, ct);
+            if (reply is null)
+            {
+                return; // 对端关闭
+            }
+
+            long now = Env.Clock.NowUs();
+            if (TcpWire.TryReadEchoBody(reply, out uint seq, out _))
+            {
+                _rows.Reply(seq, now);
+            }
+        }
+    }
+}
+
+/// <summary>TCP 回显，监听方：逐条回显并记录 t2（读到）和 t3（回复发出）。保持（hold）的监听方也用它，只是不记录。</summary>
+public sealed class TcpEchoListener : BlockBase
+{
+    private readonly RowStore? _records;
+    private readonly TcpInfoRecorder? _info;
+
+    public TcpEchoListener(BlockEnv env, BlockSpec spec, bool record = true)
+        : base(env, spec)
+    {
+        _records = record ? new RowStore(spec.Kind.FindStream("msg")!, Side.Agent, 32768) : null;
+        _info = record ? new TcpInfoRecorder(spec.Kind.FindStream("tcp_info")!, Side.Agent, env.Clock) : null;
+    }
+
+    public override RowStore? Records(string streamName) => streamName switch
+    {
+        "msg" => _records,
+        "tcp_info" => _info?.Rows,
+        _ => null,
+    };
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        Env.TcpListen!.Register(Spec.StreamId, EchoAsync);
+        try
+        {
+            await WaitUntilCancelledAsync(ct);
+        }
+        finally
+        {
+            Env.TcpListen.Unregister(Spec.StreamId);
+        }
+    }
+
+    private async Task EchoAsync(TcpConnection connection, CancellationToken ct)
+    {
+        // 这条连接上 Agent 一侧套接字的内核采样（下行方向的重传、cwnd、srtt）
+        using var samplerCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        Task sampler = _info is null ? Task.CompletedTask : _info.RunAsync(connection.Socket, TimeSpan.FromMilliseconds(Spec.Int("tcp_info_ms")), samplerCts.Token);
+        try
+        {
+            await EchoLoopAsync(connection, ct);
+        }
+        finally
+        {
+            await samplerCts.CancelAsync();
+            await sampler;
+        }
+    }
+
+    private async Task EchoLoopAsync(TcpConnection connection, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            byte[]? body = await TcpWire.ReadMessageAsync(connection.Stream, ct);
+            if (body is null)
+            {
+                return;
+            }
+
+            long t2 = Env.Clock.NowUs();
+            Env.Counters.PacketIn();
+            if (!TcpWire.TryReadEchoBody(body, out uint seq, out _))
+            {
+                Env.Counters.DropInvalid();
+                return; // 协议错乱：关闭连接
+            }
+
+            if (Env.Admission is { } admission && !admission.AdmitMessage(connection.Session, connection.StreamId, t2))
+            {
+                Env.Counters.DropRateLimited();
+                continue;
+            }
+
+            long t3 = Env.Clock.NowUs();
+            await TcpWire.WriteMessageAsync(connection.Stream, body, ct);
+            await connection.Stream.FlushAsync(ct);
+            Env.Counters.PacketOut();
+            if (_records is not null)
+            {
+                Span<long> row = [t2, t3];
+                _records.SetRow(seq, row);
+            }
+        }
+    }
+}

backend/shared/MoShiro.Measurement/Blocks/Session.cs

@@ -0,0 +1,362 @@
+using System.Net.NetworkInformation;
+using System.Net.Sockets;
+using System.Security.Authentication;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>什么也不做的监听方：connect 的另一端就是 TCP 监听器本身（接受连接、认证失败就关闭），不需要积木，但需要占一个流编号。</summary>
+public sealed class IdleListener : BlockBase
+{
+    public IdleListener(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+    }
+
+    public override Task RunAsync(CancellationToken ct) => WaitUntilCancelledAsync(ct);
+}
+
+/// <summary>
+/// 反复建立连接（TCP，可选 TLS）并记录每个阶段的耗时和结果。结果编码与 Backend 的 <c>ConnectOutcome</c> 一致：
+/// 0 成功、1 超时、2 被重置或拒绝、3 TLS 告警、4 其他。拨号方是 Probe 时对端是 Agent（按指纹固定证书，建好连接即关闭）；
+/// 作为目标任务在 Agent 上运行时对端是任意地址（不校验证书，只测握手耗时）。
+/// </summary>
+public sealed class ConnectDialer : BlockBase
+{
+    private readonly DriverLog _log;
+    private readonly int _attempt;
+    private readonly int _ts;
+    private readonly int _tcp;
+    private readonly int _tls;
+    private readonly int _outcome;
+
+    public ConnectDialer(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        _log = new DriverLog(spec.Kind.FindStream("conn")!, Side.Probe, 1024);
+        _attempt = _log.Store.ColumnIndex("attempt");
+        _ts = _log.Store.ColumnIndex("ts");
+        _tcp = _log.Store.ColumnIndex("tcp_us");
+        _tls = _log.Store.ColumnIndex("tls_us");
+        _outcome = _log.Store.ColumnIndex("outcome");
+    }
+
+    public override long Produced => _log.Count;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        TimeSpan interval = TimeSpan.FromSeconds(60.0 / Spec.Int("per_minute"));
+        TimeSpan timeout = TimeSpan.FromMilliseconds(Spec.Int("timeout_ms"));
+        bool tls = Spec.Bool("tls");
+        try
+        {
+            while (!ct.IsCancellationRequested)
+            {
+                long start = Env.Clock.NowUs();
+                await AttemptAsync(tls, timeout, start, ct);
+                TimeSpan wait = interval - TimeSpan.FromMicroseconds(Env.Clock.NowUs() - start);
+                if (wait > TimeSpan.Zero)
+                {
+                    await Task.Delay(wait, Env.Time, ct);
+                }
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // 积木被停止
+        }
+    }
+
+    public override int Flush(FlushMode mode, long peerProduced = 0)
+    {
+        RawStream? stream = _log.Take(null, all: true);
+        if (stream is null)
+        {
+            return 0;
+        }
+
+        Ship(stream, "ts");
+        return 1;
+    }
+
+    private async Task AttemptAsync(bool tls, TimeSpan timeout, long startUs, CancellationToken ct)
+    {
+        using var timeoutCts = new CancellationTokenSource(timeout, Env.Time);
+        using CancellationTokenSource linked = CancellationTokenSource.CreateLinkedTokenSource(ct, timeoutCts.Token);
+        long tcpUs = 0;
+        long? tlsUs = null;
+        int outcome;
+        try
+        {
+            // 对端不需要认证首帧：只测量建立连接
+            using TcpLink link = await TcpLink.OpenAsync(Env, Spec.Port, tls, Spec.StreamId, sendAuth: false, linked.Token);
+            tcpUs = link.TcpUs;
+            tlsUs = link.TlsUs;
+            outcome = 0;
+        }
+        catch (OperationCanceledException) when (!ct.IsCancellationRequested)
+        {
+            outcome = 1;
+        }
+        catch (SocketException ex) when (ex.SocketErrorCode is SocketError.ConnectionRefused or SocketError.ConnectionReset)
+        {
+            outcome = 2;
+        }
+        catch (Exception ex) when (ex is AuthenticationException || ex.InnerException is AuthenticationException)
+        {
+            outcome = 3;
+        }
+        catch (Exception ex) when (ex is SocketException or IOException)
+        {
+            outcome = ex is IOException { InnerException: SocketException { SocketErrorCode: SocketError.ConnectionReset } } ? 2 : 4;
+        }
+
+        // 失败时 tcp_us/tls_us 缺失；成功时没有 TLS 则 tls_us 缺失
+        long key = _log.Store.Append();
+        _log.Store.Set(key, _attempt, key);
+        _log.Store.Set(key, _ts, startUs);
+        _log.Store.Set(key, _outcome, outcome);
+        if (outcome == 0)
+        {
+            _log.Store.Set(key, _tcp, tcpUs);
+            if (tlsUs is { } t)
+            {
+                _log.Store.Set(key, _tls, t);
+            }
+        }
+    }
+}
+
+/// <summary>
+/// 保持，拨号方：一条长时间保持的 TLS 连接，每隔 <c>heartbeat_s</c> 发一个心跳并等回复。记录打开、心跳、重置（连接意外中断）和关闭，
+/// 每一行带着连接已经存活的时间。连接中断之后按退避重连。监听方是不记录的 <see cref="TcpEchoListener"/>。
+/// </summary>
+public sealed class HoldDialer : BlockBase
+{
+    private const int Open = 0;
+    private const int Heartbeat = 1;
+    private const int Reset = 2;
+    private const int Close = 3;
+
+    private readonly DriverLog _log;
+    private readonly int _ts;
+    private readonly int _event;
+    private readonly int _lifetime;
+
+    public HoldDialer(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        _log = new DriverLog(spec.Kind.FindStream("hold")!, Side.Probe, 1024);
+        _ts = _log.Store.ColumnIndex("ts");
+        _event = _log.Store.ColumnIndex("event");
+        _lifetime = _log.Store.ColumnIndex("lifetime_ms");
+    }
+
+    public override long Produced => _log.Count;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        var backoff = new Fleet.Core.Backoff(TimeSpan.FromSeconds(1), TimeSpan.FromSeconds(30));
+        while (!ct.IsCancellationRequested)
+        {
+            long openedUs = 0;
+            bool opened = false;
+            try
+            {
+                using TcpLink link = await TcpLink.OpenAsync(Env, Spec.Port, tls: true, Spec.StreamId, sendAuth: true, ct);
+                openedUs = Env.Clock.NowUs();
+                opened = true;
+                backoff.Reset();
+                Record(Open, openedUs, openedUs);
+                await HoldAsync(link.Stream, openedUs, ct);
+            }
+            catch (OperationCanceledException) when (ct.IsCancellationRequested)
+            {
+                if (opened)
+                {
+                    Record(Close, Env.Clock.NowUs(), openedUs);
+                }
+
+                return;
+            }
+            catch (Exception ex) when (ex is SocketException or IOException or AuthenticationException or OperationCanceledException or InvalidDataException or InvalidOperationException)
+            {
+                if (opened)
+                {
+                    Record(Reset, Env.Clock.NowUs(), openedUs);
+                }
+            }
+
+            try
+            {
+                await Task.Delay(backoff.Next(), Env.Time, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+        }
+    }
+
+    public override int Flush(FlushMode mode, long peerProduced = 0)
+    {
+        RawStream? stream = _log.Take(null, all: true);
+        if (stream is null)
+        {
+            return 0;
+        }
+
+        Ship(stream, "ts");
+        return 1;
+    }
+
+    private async Task HoldAsync(Stream stream, long openedUs, CancellationToken ct)
+    {
+        using var cts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+        Task reader = ReadAsync(stream, openedUs, cts.Token);
+        Task writer = WriteAsync(stream, cts.Token);
+        Task finished = await Task.WhenAny(reader, writer);
+        await cts.CancelAsync();
+        try
+        {
+            await finished; // 连接中断时这里抛出，由调用方记录 Reset
+            if (!ct.IsCancellationRequested)
+            {
+                throw new IOException("the peer closed the connection");
+            }
+        }
+        finally
+        {
+            foreach (Task task in new[] { reader, writer })
+            {
+                try
+                {
+                    await task;
+                }
+                catch (Exception ex) when (ex is OperationCanceledException or IOException or SocketException or ObjectDisposedException)
+                {
+                    // 已经处理过
+                }
+            }
+        }
+    }
+
+    private async Task WriteAsync(Stream stream, CancellationToken ct)
+    {
+        byte[] body = new byte[TcpWire.MinEchoBody];
+        uint seq = 0;
+        using var timer = new PeriodicTimer(TimeSpan.FromSeconds(Spec.Int("heartbeat_s")), Env.Time);
+        while (await timer.WaitForNextTickAsync(ct))
+        {
+            TcpWire.WriteEchoBody(body, seq++, Env.Clock.NowUs());
+            await TcpWire.WriteMessageAsync(stream, body, ct);
+            await stream.FlushAsync(ct);
+        }
+    }
+
+    private async Task ReadAsync(Stream stream, long openedUs, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            byte[]? reply = await TcpWire.ReadMessageAsync(stream, ct);
+            if (reply is null)
+            {
+                return;
+            }
+
+            Record(Heartbeat, Env.Clock.NowUs(), openedUs);
+        }
+    }
+
+    private void Record(int eventCode, long nowUs, long openedUs)
+    {
+        long key = _log.Store.Append();
+        _log.Store.Set(key, _ts, nowUs);
+        _log.Store.Set(key, _event, eventCode);
+        _log.Store.Set(key, _lifetime, Math.Max(0, (nowUs - openedUs) / 1000));
+    }
+}
+
+/// <summary>
+/// ICMP 回显（只有一侧：Agent 对目标地址）：按速率发 ICMP 并记录发出和收到的时刻（本地时钟）；超时没有回复的行 t4 缺失。
+/// 没有对端，所以没有监听方；行交给 <see cref="BlockEnv.Fragments"/>（Agent 自己盖章上传）。
+/// </summary>
+public sealed class IcmpEchoSolo : BlockBase
+{
+    private readonly DriverLog _log;
+    private readonly int _seq;
+    private readonly int _size;
+    private readonly int _t1;
+    private readonly int _t4;
+
+    public IcmpEchoSolo(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        _log = new DriverLog(spec.Kind.FindStream("msg")!, Side.Probe, 1024);
+        _seq = _log.Store.ColumnIndex("seq");
+        _size = _log.Store.ColumnIndex("size");
+        _t1 = _log.Store.ColumnIndex("t1");
+        _t4 = _log.Store.ColumnIndex("t4");
+    }
+
+    public override long Produced => _log.Count;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        TimeSpan interval = TimeSpan.FromSeconds(1.0 / Spec.Int("rate_hz"));
+        int size = (int)Spec.Int("size");
+        byte[] payload = new byte[Math.Max(0, size - 28)];
+        using var ping = new Ping();
+        try
+        {
+            while (!ct.IsCancellationRequested)
+            {
+                long t1 = Env.Clock.NowUs();
+                long? t4 = null;
+                try
+                {
+                    PingReply reply = await ping.SendPingAsync(Env.PeerAddress!, TimeSpan.FromSeconds(2), payload, null, ct);
+                    if (reply.Status == IPStatus.Success)
+                    {
+                        t4 = Env.Clock.NowUs();
+                    }
+                }
+                catch (PingException)
+                {
+                    // 发送失败（例如本机没有路由）：记为丢失
+                }
+
+                long key = _log.Store.Append();
+                _log.Store.Set(key, _seq, key);
+                _log.Store.Set(key, _size, size);
+                _log.Store.Set(key, _t1, t1);
+                if (t4 is { } received)
+                {
+                    _log.Store.Set(key, _t4, received);
+                }
+
+                TimeSpan wait = interval - TimeSpan.FromMicroseconds(Env.Clock.NowUs() - t1);
+                if (wait > TimeSpan.Zero)
+                {
+                    await Task.Delay(wait, Env.Time, ct);
+                }
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // 积木被停止
+        }
+    }
+
+    public override int Flush(FlushMode mode, long peerProduced = 0)
+    {
+        RawStream? stream = _log.Take(null, all: true);
+        if (stream is null)
+        {
+            return 0;
+        }
+
+        Ship(stream, "t1");
+        return 1;
+    }
+}

backend/shared/MoShiro.Measurement/Blocks/Train.cs

@@ -0,0 +1,239 @@
+using System.Diagnostics;
+using System.Net;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>
+/// 单向数据流（UDP train），监听方（Agent，行的主导方）：按声明的码率均匀发包，发出的每个包 (seq, size, t_send) 记在按序号的记录里，
+/// Probe 的接收时刻之后按序号合并（没有到达的就是丢失）。发送在专用线程上完成，不占用线程池。
+/// 等不到对端的地址（5 秒内没有任何认证过的包）就以 <see cref="BlockFaultException"/> 结束。
+/// </summary>
+public sealed class TrainListener : BlockBase
+{
+    private static readonly TimeSpan s_endpointWait = TimeSpan.FromSeconds(5);
+
+    private readonly RowStore _records;
+    private long _sent;
+
+    public TrainListener(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        double pps = spec.Params.GetNumber("mbps") * 1_000_000 / 8 / Math.Max(1, spec.Int("size"));
+        _records = new RowStore(spec.Kind.FindStream("pkt")!, Side.Agent, (int)Math.Clamp(pps * spec.Int("duration_s") * 1.25, 1024, 4_000_000));
+    }
+
+    public override long Produced => Interlocked.Read(ref _sent);
+
+    public override RowStore? Records(string streamName) => streamName == "pkt" ? _records : null;
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        // Probe 开始前发来的探活包（Data）要被接受，准入策略才能据此学到它当前的源地址（NAT 映射）；它们本身没有内容
+        Env.Udp!.Register(Spec.StreamId, static (in UdpDelivery _) => { });
+        try
+        {
+            DataSession session = await WaitForPeerAsync(ct);
+            IPEndPoint target = session.UdpEndpoint!;
+            TimeSpan duration = TimeSpan.FromSeconds(Spec.Int("duration_s"));
+            var done = new TaskCompletionSource(TaskCreationOptions.RunContinuationsAsynchronously);
+            var thread = new Thread(() =>
+            {
+                try
+                {
+                    Send(session, target, duration, ct);
+                    done.SetResult();
+                }
+                catch (Exception ex)
+                {
+                    done.SetException(ex);
+                }
+            })
+            {
+                IsBackground = true,
+                Name = "udp-train",
+            };
+            thread.Start();
+            await done.Task;
+        }
+        finally
+        {
+            Env.Udp.Unregister(Spec.StreamId);
+        }
+    }
+
+    private async Task<DataSession> WaitForPeerAsync(CancellationToken ct)
+    {
+        DateTimeOffset deadline = Env.Time.GetUtcNow() + s_endpointWait;
+        while (true)
+        {
+            DataSession? session = Env.Session();
+            if (session?.UdpEndpoint is not null)
+            {
+                return session;
+            }
+
+            if (Env.Time.GetUtcNow() >= deadline)
+            {
+                throw new BlockFaultException("the peer's address is unknown");
+            }
+
+            await Task.Delay(TimeSpan.FromMilliseconds(50), Env.Time, ct);
+        }
+    }
+
+    private void Send(DataSession session, IPEndPoint target, TimeSpan duration, CancellationToken ct)
+    {
+        double packetsPerSecond = Spec.Params.GetNumber("mbps") * 1_000_000 / 8 / Spec.Int("size");
+        int size = (int)Spec.Int("size");
+        byte[] packet = new byte[size];
+        using var pause = new ManualResetEventSlim(false);
+        uint seq = 0;
+        long startTicks = Stopwatch.GetTimestamp();
+        long endTicks = startTicks + (long)(duration.TotalSeconds * Stopwatch.Frequency);
+        while (!ct.IsCancellationRequested)
+        {
+            long now = Stopwatch.GetTimestamp();
+            if (now >= endTicks)
+            {
+                break;
+            }
+
+            // 到目前为止应该发出的包数（均匀）：落后了就追，领先了就等；追赶的上限是 50 ms 的量，避免长时间停顿之后的突发
+            double elapsed = (now - startTicks) / (double)Stopwatch.Frequency;
+            long due = Math.Min((long)(elapsed * packetsPerSecond) + 1, seq + Math.Max(1, (long)(packetsPerSecond * 0.05)));
+            if (seq >= due)
+            {
+                // 离下一个包还早就让出 CPU（至少 1 ms 的粒度），临近了再自旋，保证发送间隔均匀
+                if ((seq / packetsPerSecond) - elapsed > 0.002)
+                {
+                    pause.Wait(1, ct);
+                }
+                else
+                {
+                    Thread.SpinWait(50);
+                }
+
+                continue;
+            }
+
+            for (; seq < due; seq++)
+            {
+                long sendUs = Env.Clock.NowUs();
+                UdpPacket.Write(packet, new UdpHeader(UdpPacketType.Data, session.SessionId, Spec.StreamId, seq, sendUs), session.Key);
+                Env.Udp!.Send(target, packet);
+                Span<long> row = [size, sendUs];
+                _records.SetRow(seq, row);
+                Interlocked.Exchange(ref _sent, seq + 1L);
+            }
+        }
+    }
+}
+
+/// <summary>
+/// 单向数据流，拨号方（Probe，行的跟随方）：接收，记录每个序号第一次到达的时刻（按序号索引，热路径不分配）；
+/// 序号超过本地包速率上限推算出的范围时忽略。阶段结束时按序号范围切成多个列块交给 Agent，每块不超过 <see cref="ProtocolLimits.MaxRecordsPerChunk"/> 的记录。
+/// 开始时先发几个探活包，让 Agent 学到我们当前的源地址（NAT 映射）再开始发送。
+/// </summary>
+public sealed class TrainDialer : BlockBase
+{
+    private const int PerFragment = 40_000;
+
+    private readonly RowStore _received;
+    private readonly RowStore _step;
+    private readonly int _tRecv;
+    private readonly long _maxSeq;
+    private long _startUs;
+    private long _endUs;
+
+    public TrainDialer(BlockEnv env, BlockSpec spec)
+        : base(env, spec)
+    {
+        double pps = spec.Params.GetNumber("mbps") * 1_000_000 / 8 / Math.Max(1, spec.Int("size"));
+        long seconds = Math.Max(1, spec.Int("duration_s"));
+        _maxSeq = Math.Max(1024, Math.Min((long)(pps * seconds * 1.25), env.MaxPacketsPerSecond * seconds * 3 / 2));
+        _received = new RowStore(spec.Kind.FindStream("pkt")!, Side.Probe, (int)_maxSeq);
+        _tRecv = _received.ColumnIndex("t_recv");
+        _step = new RowStore(spec.Kind.FindStream("step")!, Side.Probe, 16);
+    }
+
+    public override async Task RunAsync(CancellationToken ct)
+    {
+        UdpMux udp = Env.Udp!;
+        DataSession session = Env.Session() ?? throw new BlockFaultException("no data session");
+        _startUs = Env.Clock.NowUs();
+        udp.Register(Spec.StreamId, OnPacket);
+        try
+        {
+            byte[] hello = new byte[UdpPacket.MinBytes + 20];
+            IPEndPoint target = PeerEndpoint(Spec.Port);
+            for (uint seq = 0; seq < 3; seq++)
+            {
+                UdpPacket.Write(hello, new UdpHeader(UdpPacketType.Data, session.SessionId, Spec.StreamId, seq, Env.Clock.NowUs()), session.Key);
+                udp.Send(target, hello);
+            }
+
+            await WaitUntilCancelledAsync(ct);
+        }
+        finally
+        {
+            _endUs = Env.Clock.NowUs();
+            udp.Unregister(Spec.StreamId);
+        }
+    }
+
+    public override int Flush(FlushMode mode, long peerProduced = 0)
+    {
+        if (mode != FlushMode.All)
+        {
+            return 0;
+        }
+
+        long end = _endUs == 0 ? Env.Clock.NowUs() : _endUs;
+        long step = _step.Append();
+        _step.Set(step, _step.ColumnIndex("index"), 0);
+        _step.Set(step, _step.ColumnIndex("mbps"), (long)Spec.Params.GetNumber("mbps"));
+        _step.Set(step, _step.ColumnIndex("start_ts"), _startUs);
+        _step.Set(step, _step.ColumnIndex("end_ts"), end);
+
+        long total = Math.Min(peerProduced, _maxSeq);
+        int fragments = 0;
+        for (long from = 0; from < total || fragments == 0; from += PerFragment)
+        {
+            long to = Math.Min(from + PerFragment, total);
+            RawStream pkt = _received.Cut(from, to, includeKey: true);
+            var parameters = new Dictionary<string, System.Text.Json.JsonElement>(Spec.Params.Values)
+            {
+                [FragmentKeys.SeqFrom] = Number(from),
+                [FragmentKeys.SeqTo] = Number(to),
+            };
+            Env.Fragments!.Ship(
+                "udp_train",
+                Spec.Scope,
+                fragments == 0 ? [pkt, _step.Cut(0, 1, includeKey: false)] : [pkt],
+                parameters,
+                Env.Clock.UtcMsAt(_startUs),
+                (int)((end - _startUs) / 1000),
+                Spec.Port);
+            fragments++;
+            if (total == 0)
+            {
+                break;
+            }
+        }
+
+        return fragments;
+    }
+
+    private static System.Text.Json.JsonElement Number(long value) =>
+        System.Text.Json.JsonDocument.Parse(value.ToString(System.Globalization.CultureInfo.InvariantCulture)).RootElement.Clone();
+
+    private void OnPacket(in UdpDelivery delivery)
+    {
+        long seq = delivery.Header.Seq;
+        if (delivery.Header.Type == UdpPacketType.Data && seq < _maxSeq && !_received.IsSet(seq, _tRecv))
+        {
+            _received.Set(seq, _tRecv, delivery.ReceiveUs); // 只记第一次到达（重复的包不覆盖）
+        }
+    }
+}

backend/shared/MoShiro.Measurement/Core/Contracts.cs

@@ -0,0 +1,248 @@
+using System.Net;
+using System.Text.Json;
+using Fleet.Core;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>
+/// 数据面会话：<c>session_id</c> 和密钥（由点对点握手里的 ECDH 派生）。两端的数据面包都用它认证。
+/// Agent 的会话还带重放窗口等状态，所以是可以继承的。
+/// </summary>
+public class DataSession
+{
+    public DataSession(long sessionId, byte[] key)
+    {
+        SessionId = sessionId;
+        Key = key;
+    }
+
+    public long SessionId { get; }
+
+    public byte[] Key { get; }
+
+    /// <summary>对端最近一次通过认证的 UDP 源地址（监听方把单向数据发往这里；拨号方不需要）。</summary>
+    public virtual IPEndPoint? UdpEndpoint => null;
+
+    /// <summary>TCP 首帧的随机数只能用一次。拨号方不接受连接，所以默认放行。</summary>
+    public virtual bool UseNonce(ReadOnlySpan<byte> nonce) => true;
+}
+
+public interface IDataSessions
+{
+    DataSession? Find(long sessionId);
+}
+
+/// <summary>只有一个会话（拨号方：Probe 与某个 Agent 的会话）。</summary>
+public sealed class SingleSession : IDataSessions
+{
+    private readonly DataSession _session;
+
+    public SingleSession(DataSession session)
+    {
+        _session = session;
+    }
+
+    public DataSession? Find(long sessionId) => sessionId == _session.SessionId ? _session : null;
+}
+
+public enum Admission
+{
+    Accepted,
+    Invalid,
+    RateLimited,
+}
+
+/// <summary>
+/// 监听方的准入策略（安全边界）：重放窗口、令牌桶限速、源地址学习。积木本身不含任何策略；
+/// 拨号方不需要，只做 MAC 校验。任何一步失败都是静默丢弃并计数，不回复。
+/// </summary>
+public interface IAdmission
+{
+    /// <summary>UDP 包：<paramref name="source"/> 是认证通过的源地址（实现可以据此学习 NAT 重绑定）。</summary>
+    Admission AdmitPacket(DataSession session, in UdpHeader header, SocketAddress source, long nowUs);
+
+    /// <summary>TCP 回显的一条消息（只限速）。</summary>
+    bool AdmitMessage(DataSession session, uint streamId, long nowUs);
+}
+
+/// <summary>数据面计数（只有计数，没有主机信息）：用于心跳和面板上的节点状态。</summary>
+public sealed class DataPlaneCounters
+{
+    private long _packetsIn;
+    private long _packetsOut;
+    private long _invalid;
+    private long _rateLimited;
+
+    public long PacketsIn => Interlocked.Read(ref _packetsIn);
+
+    public long PacketsOut => Interlocked.Read(ref _packetsOut);
+
+    public long DroppedInvalid => Interlocked.Read(ref _invalid);
+
+    public long DroppedRateLimited => Interlocked.Read(ref _rateLimited);
+
+    public void PacketIn() => Interlocked.Increment(ref _packetsIn);
+
+    public void PacketOut() => Interlocked.Increment(ref _packetsOut);
+
+    public void DropInvalid() => Interlocked.Increment(ref _invalid);
+
+    public void DropRateLimited() => Interlocked.Increment(ref _rateLimited);
+}
+
+/// <summary>一个列块属于线路任务还是按需测试的某个阶段。</summary>
+public sealed record FragmentScope(TaskId? Task, TestId? Test, int? Phase);
+
+/// <summary>
+/// 积木交出一侧的行的地方。Probe：放进发给 Agent 的发件箱（列块）；Agent 自己运行的积木（目标任务）：直接盖章上传。
+/// </summary>
+public interface IFragmentSink
+{
+    void Ship(string kind, FragmentScope scope, IReadOnlyList<RawStream> streams, IReadOnlyDictionary<string, JsonElement>? parameters, long startUtcMs, int durationMs, int port);
+}
+
+public enum FlushMode
+{
+    /// <summary>只交出已经稳定的行（回显类等过宽限期的）。</summary>
+    Settled,
+
+    /// <summary>交出全部（阶段结束或角色停止）。</summary>
+    All,
+}
+
+/// <summary>积木无法继续（例如监听方等不到对端的地址）：由编排者决定整个测试怎么结束。</summary>
+public sealed class BlockFaultException : Exception
+{
+    public BlockFaultException(string message)
+        : base(message)
+    {
+    }
+}
+
+/// <summary>
+/// 一个运行中的积木角色。同一种采集方法的两端是一对角色（拨号方 = Probe，监听方 = Agent），写在同一个文件里，
+/// 共用包的构造、校验、行的记录；它们只产生<b>原始列</b>，不做任何统计，也不知道上层的方案或协议。
+/// </summary>
+public interface IBlock
+{
+    /// <summary>运行到取消（回显、保持）或到自己结束（单向数据流的发送端）。</summary>
+    Task RunAsync(CancellationToken ct);
+
+    /// <summary>
+    /// 拨号方把已完成的行切成列块交给 <see cref="IFragmentSink"/>，返回块数；监听方返回 0（它的行留在 <see cref="Records"/> 里等合并）。
+    /// <paramref name="peerProduced"/>：对端是行的主导方时，对端产生的行数（单向数据流的发送包数）。
+    /// </summary>
+    int Flush(FlushMode mode, long peerProduced = 0);
+
+    /// <summary>这一侧作为主导方产生的行数（发出的包数）。</summary>
+    long Produced { get; }
+
+    /// <summary>这一侧为合并保留的按键记录；没有则为 null。</summary>
+    RowStore? Records(string streamName);
+}
+
+/// <summary>运行一个积木所需的全部参数：Kind、已经校验并补全默认值的参数、流编号、端口、列块归属。</summary>
+public sealed class BlockSpec
+{
+    public BlockSpec(KindSpec kind, ParamValues parameters, uint streamId, int port, FragmentScope scope)
+    {
+        Kind = kind;
+        Params = parameters;
+        StreamId = streamId;
+        Port = port;
+        Scope = scope;
+    }
+
+    public KindSpec Kind { get; }
+
+    public ParamValues Params { get; }
+
+    public uint StreamId { get; }
+
+    public int Port { get; }
+
+    public FragmentScope Scope { get; }
+
+    public string KindId => Kind.Id;
+
+    public long Int(string name) => Params.GetInt(name);
+
+    public bool Bool(string name) => Params.GetBool(name);
+
+    /// <summary>参数或端口变化时调和器重启这个积木（不含流编号：Agent 的流编号每次重建都会重新分配）。</summary>
+    public string ConfigSignature => KindId + "|" + Port + "|" +
+        string.Join(',', Params.Values.OrderBy(p => p.Key, StringComparer.Ordinal).Select(p => p.Key + "=" + p.Value.GetRawText()));
+
+    /// <summary>参数、端口或流编号变化时重启：Probe 据此判断 Agent 下发的任务有没有变（Agent 重启后流编号会变）。</summary>
+    public string Signature => StreamId + "|" + ConfigSignature;
+
+    /// <summary>校验参数（补全默认值）后构造；Kind 不存在或参数非法返回 null。</summary>
+    public static BlockSpec? Create(string kindId, IReadOnlyDictionary<string, JsonElement> parameters, uint streamId, int port, FragmentScope scope)
+    {
+        KindSpec? kind = Kinds.Find(kindId);
+        if (kind is null)
+        {
+            return null;
+        }
+
+        ParamResolution resolved = ParamResolver.Resolve(kind.Params, parameters);
+        return resolved.IsValid ? new BlockSpec(kind, resolved.Values!, streamId, port, scope) : null;
+    }
+}
+
+/// <summary>积木运行的环境：时钟、套接字、对端地址、列块出口。拨号方和监听方各自组装自己用得到的部分。</summary>
+public sealed class BlockEnv
+{
+    public required MonoClock Clock { get; init; }
+
+    public required INodeLog Log { get; init; }
+
+    /// <summary>当前的数据面会话（拨号方固定；监听方是 Agent 当前的 Probe 会话，可能没有）。</summary>
+    public required Func<DataSession?> Session { get; init; }
+
+    public UdpMux? Udp { get; init; }
+
+    /// <summary>监听方的准入策略（限速等）；拨号方为 null。</summary>
+    public IAdmission? Admission { get; init; }
+
+    public DataPlaneCounters Counters { get; init; } = new();
+
+    /// <summary>监听方：接受 TCP 数据连接。</summary>
+    public TcpAcceptor? TcpListen { get; init; }
+
+    /// <summary>拨号方：对端（Agent，或目标任务的目标地址）。</summary>
+    public IPAddress? PeerAddress { get; init; }
+
+    /// <summary>拨号方：对端 TLS 证书的 SPKI 指纹；null 表示不校验证书（目标任务，目标是任意地址）。</summary>
+    public byte[]? PeerSpkiSha256 { get; init; }
+
+    /// <summary>拨号方：列块出口。</summary>
+    public IFragmentSink? Fragments { get; init; }
+
+    /// <summary>本地硬上限：批量传输（tcp_bulk）发送端的码率（Mbit/s）。批量传输会尽可能占满链路，这是防止把小机器打满的保险。</summary>
+    public double MaxBulkMbps { get; init; } = 100;
+
+    /// <summary>本地硬上限：单向数据流接收缓冲的包速率上界。</summary>
+    public long MaxPacketsPerSecond { get; init; } = 20_000;
+
+    public TimeProvider Time => Clock.Time;
+
+    /// <summary>同一套环境，但绑定到一个固定的数据面会话（Agent 为每个 Probe 会话各起一组监听方积木）。</summary>
+    public BlockEnv WithSession(DataSession session) =>
+        new()
+        {
+            Clock = Clock,
+            Log = Log,
+            Session = () => session,
+            Udp = Udp,
+            Admission = Admission,
+            Counters = Counters,
+            TcpListen = TcpListen,
+            PeerAddress = PeerAddress,
+            PeerSpkiSha256 = PeerSpkiSha256,
+            Fragments = Fragments,
+            MaxBulkMbps = MaxBulkMbps,
+            MaxPacketsPerSecond = MaxPacketsPerSecond,
+        };
+}

backend/shared/MoShiro.Measurement/Core/MonoClock.cs

@@ -0,0 +1,26 @@
+namespace MoShiro.Measurement;
+
+/// <summary>节点的单调时钟（微秒）：t1…t4、t_send、t_recv 都用它；Probe 和 Agent 各自一个，块头里的时钟锚点把它对应到 UTC。</summary>
+public sealed class MonoClock
+{
+    private readonly TimeProvider _time;
+
+    public MonoClock(TimeProvider time)
+    {
+        _time = time;
+    }
+
+    public TimeProvider Time => _time;
+
+    public long NowUs()
+    {
+        long ticks = _time.GetTimestamp();
+        // 先除后乘会丢精度，先乘再除在 64 位内不会溢出（频率通常是 1e9 或 1e7）
+        return (ticks / _time.TimestampFrequency * 1_000_000) + (ticks % _time.TimestampFrequency * 1_000_000 / _time.TimestampFrequency);
+    }
+
+    public ClockAnchor Anchor() => new(NowUs(), _time.GetUtcNow().ToUnixTimeMilliseconds());
+
+    /// <summary>单调时钟读数 <paramref name="thenUs"/> 对应的 UTC 毫秒（只用于块的粗略起点，精确时间由块头的时钟锚点换算）。</summary>
+    public long UtcMsAt(long thenUs) => _time.GetUtcNow().ToUnixTimeMilliseconds() - (Math.Max(0, NowUs() - thenUs) / 1000);
+}

backend/shared/MoShiro.Measurement/Core/RowStore.cs

@@ -0,0 +1,239 @@
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>
+/// 一侧记录的行：只含这一侧拥有的列（见 <see cref="StreamSpec.ColumnsOf"/>），按连接键（通常是 <c>seq</c>）索引的环形缓冲，
+/// 每列一个 long 数组，热路径不分配。Agent 用它记录 t2/t3 或发送行，等 Probe 的列块到达后按键合并；
+/// Probe 用它记录 t1/t4 或 t_recv，到点切成列块交出去。行被后来的键覆盖（环绕）就丢弃，这只会发生在一侧长时间没有交出行的时候。
+/// </summary>
+public sealed class RowStore
+{
+    private readonly object _gate = new();
+    private readonly StreamSpec _spec;
+    private readonly IReadOnlyList<ColumnSpec> _columns;
+    private readonly ColumnSpec? _keyColumn;
+    private readonly int _capacity;
+    private readonly long[] _keys;
+    private readonly long[][] _values;
+    private readonly bool[]?[] _valid;
+    private long _next;
+    private long _drained;
+
+    public RowStore(StreamSpec spec, Side owner, int capacity)
+    {
+        _spec = spec;
+        _columns = spec.ColumnsOf(owner);
+        _keyColumn = spec.Key is null ? null : spec.Columns.First(c => c.Name == spec.Key);
+        _capacity = Math.Max(16, capacity);
+        _keys = new long[_capacity];
+        Array.Fill(_keys, -1);
+        _values = new long[_columns.Count][];
+        _valid = new bool[]?[_columns.Count];
+        for (int i = 0; i < _columns.Count; i++)
+        {
+            _values[i] = new long[_capacity];
+            _valid[i] = _columns[i].Nullable ? new bool[_capacity] : null;
+        }
+    }
+
+    public string Name => _spec.Name;
+
+    /// <summary>下一个自动分配的键（也是已经追加的行数）。</summary>
+    public long NextKey
+    {
+        get
+        {
+            lock (_gate)
+            {
+                return _next;
+            }
+        }
+    }
+
+    public int ColumnIndex(string name)
+    {
+        for (int i = 0; i < _columns.Count; i++)
+        {
+            if (_columns[i].Name == name)
+            {
+                return i;
+            }
+        }
+
+        throw new ArgumentException($"column {name} is not recorded on this side of stream {_spec.Name}", nameof(name));
+    }
+
+    /// <summary>
+    /// 清空所有行。一个新的数据面会话开始时，监听方必须清掉上一个会话留下的记录：Probe 重启之后序号从 0 重新开始，
+    /// 旧会话里同一个序号的 t2/t3 还留着的话，会被当成新会话里这个包"上行已经到达"，真正的上行丢失就被算成了下行丢失。
+    /// </summary>
+    public void Clear()
+    {
+        lock (_gate)
+        {
+            Array.Fill(_keys, -1);
+            _next = 0;
+            _drained = 0;
+        }
+    }
+
+    /// <summary>取出上次取出之后追加的所有行（只用于两侧各自记录完整行的 union 流：每一行只交出一次）。</summary>
+    public RawStream Drain(bool includeKey)
+    {
+        lock (_gate)
+        {
+            RawStream rows = Cut(_drained, _next, includeKey);
+            _drained = _next;
+            return rows;
+        }
+    }
+
+    /// <summary>追加一行，键自动递增（从 0 开始，与 <c>seq</c> 一致）。</summary>
+    public long Append()
+    {
+        lock (_gate)
+        {
+            long key = _next++;
+            Claim(key);
+            return key;
+        }
+    }
+
+    public void Set(long key, int column, long value)
+    {
+        lock (_gate)
+        {
+            int slot = Claim(key);
+            _values[column][slot] = value;
+            if (_valid[column] is { } valid)
+            {
+                valid[slot] = true;
+            }
+        }
+    }
+
+    /// <summary>一次写入这一侧的所有列（顺序同 <see cref="StreamSpec.ColumnsOf"/>）。</summary>
+    public void SetRow(long key, ReadOnlySpan<long> values)
+    {
+        lock (_gate)
+        {
+            int slot = Claim(key);
+            for (int i = 0; i < _columns.Count; i++)
+            {
+                _values[i][slot] = values[i];
+                if (_valid[i] is { } valid)
+                {
+                    valid[slot] = true;
+                }
+            }
+        }
+    }
+
+    public bool Contains(long key)
+    {
+        lock (_gate)
+        {
+            return key >= 0 && _keys[(int)(key % _capacity)] == key;
+        }
+    }
+
+    /// <summary>读一个值；行不存在或该列没有设置（可空列）返回 false。</summary>
+    public bool TryGet(long key, int column, out long value)
+    {
+        lock (_gate)
+        {
+            int slot = (int)(key % _capacity);
+            value = 0;
+            if (key < 0 || _keys[slot] != key || (_valid[column] is { } valid && !valid[slot]))
+            {
+                return false;
+            }
+
+            value = _values[column][slot];
+            return true;
+        }
+    }
+
+    public bool IsSet(long key, int column) => TryGet(key, column, out _);
+
+    /// <summary>
+    /// 取出键在 [<paramref name="fromKey"/>, <paramref name="toKey"/>) 内、仍然存在的行（按键升序），不删除。
+    /// 列按声明顺序排列；<paramref name="includeKey"/> 时带上连接键那一列。
+    /// </summary>
+    public RawStream Cut(long fromKey, long toKey, bool includeKey)
+    {
+        lock (_gate)
+        {
+            var slots = new List<int>();
+            var keys = new List<long>();
+            for (long key = Math.Max(0, fromKey); key < toKey; key++)
+            {
+                int slot = (int)(key % _capacity);
+                if (_keys[slot] == key)
+                {
+                    slots.Add(slot);
+                    keys.Add(key);
+                }
+            }
+
+            var columns = new List<RawColumn>();
+            foreach (ColumnSpec spec in _spec.Columns)
+            {
+                if (includeKey && _keyColumn is not null && spec.Name == _keyColumn.Name)
+                {
+                    columns.Add(new RawColumn(spec.Name, spec.Type, spec.Enc, spec.Nullable, spec.Role, [.. keys], null));
+                    continue;
+                }
+
+                int index = -1;
+                for (int i = 0; i < _columns.Count; i++)
+                {
+                    if (_columns[i].Name == spec.Name)
+                    {
+                        index = i;
+                    }
+                }
+
+                if (index < 0)
+                {
+                    continue;
+                }
+
+                long[] values = new long[slots.Count];
+                bool[]? valid = spec.Nullable ? new bool[slots.Count] : null;
+                for (int r = 0; r < slots.Count; r++)
+                {
+                    values[r] = _values[index][slots[r]];
+                    if (valid is not null)
+                    {
+                        valid[r] = _valid[index]![slots[r]];
+                    }
+                }
+
+                columns.Add(new RawColumn(spec.Name, spec.Type, spec.Enc, spec.Nullable, spec.Role, values, valid));
+            }
+
+            return new RawStream(_spec.Name, slots.Count, columns);
+        }
+    }
+
+    private int Claim(long key)
+    {
+        int slot = (int)(key % _capacity);
+        if (_keys[slot] != key)
+        {
+            _keys[slot] = key;
+            for (int i = 0; i < _columns.Count; i++)
+            {
+                _values[i][slot] = 0;
+                if (_valid[i] is { } valid)
+                {
+                    valid[slot] = false;
+                }
+            }
+        }
+
+        return slot;
+    }
+}

backend/shared/MoShiro.Measurement/Core/RunningBlock.cs

@@ -0,0 +1,47 @@
+namespace MoShiro.Measurement;
+
+/// <summary>一个运行中的积木：自己的取消令牌和后台任务。Probe 和 Agent 共用。</summary>
+public sealed class RunningBlock : IDisposable
+{
+    private readonly CancellationTokenSource _cts = new();
+
+    private RunningBlock(IBlock block, string signature)
+    {
+        Block = block;
+        Signature = signature;
+        Completion = Task.CompletedTask;
+    }
+
+    public IBlock Block { get; }
+
+    /// <summary>参数、端口或流编号变化时调和器据此重启积木。</summary>
+    public string Signature { get; }
+
+    /// <summary>积木自己结束（单向数据流的发送端）或失败（<see cref="BlockFaultException"/>）时完成；被 <see cref="StopAsync"/> 停止时正常完成。</summary>
+    public Task Completion { get; private set; }
+
+    public static RunningBlock Start(IBlock block, string signature)
+    {
+        var running = new RunningBlock(block, signature);
+        running.Completion = Task.Run(() => block.RunAsync(running._cts.Token), CancellationToken.None);
+        return running;
+    }
+
+    /// <summary>停止积木并等它退出（最多 5 秒）。</summary>
+    public async Task StopAsync()
+    {
+        await _cts.CancelAsync();
+        try
+        {
+            await Completion.WaitAsync(TimeSpan.FromSeconds(5));
+        }
+        catch (Exception ex) when (ex is OperationCanceledException or TimeoutException or BlockFaultException)
+        {
+            // 没有及时退出或者已经失败：不再等
+        }
+
+        Dispose();
+    }
+
+    public void Dispose() => _cts.Dispose();
+}

backend/shared/MoShiro.Measurement/Execution/BudgetGuard.cs

@@ -0,0 +1,193 @@
+using System.Net;
+using System.Text.Json;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>节点的本地硬上限（写在本机配置里，Backend 无法修改）。</summary>
+public sealed class NodeLimits
+{
+    public double MaxTotalMbps { get; init; } = 1200;
+
+    public long MaxTotalPps { get; init; } = 20_000;
+
+    /// <summary>目标任务允许访问的网段；默认为空，即不开放任何目标任务。</summary>
+    public IReadOnlyList<string> AllowedTargetCidrs { get; init; } = [];
+
+    public int MaxConcurrentTests { get; init; } = 1;
+
+    /// <summary>任务参数里的 <c>port</c> 只能取这些端口（本机配置的 listen 列表）。</summary>
+    public IReadOnlyList<int> AllowedUdpPorts { get; init; } = [7443];
+
+    public IReadOnlyList<int> AllowedTcpPorts { get; init; } = [7444];
+}
+
+/// <summary>被拒绝的原因，用于 <c>rejected[]</c>：<c>unsupported</c>、<c>invalid_params</c>、<c>budget_exceeded</c>、<c>policy_denied</c>。</summary>
+public static class RejectReasons
+{
+    public const string Unsupported = "unsupported";
+    public const string InvalidParams = "invalid_params";
+    public const string BudgetExceeded = "budget_exceeded";
+    public const string PolicyDenied = "policy_denied";
+}
+
+public sealed record TaskDecision(bool Accepted, string? Reason, ParamValues? Resolved, KindSpec? Kind)
+{
+    public static TaskDecision Reject(string reason) => new(false, reason, null, null);
+}
+
+/// <summary>
+/// 本地硬上限检查：Backend 下发的任何参数都要先经过 <see cref="ParamResolver"/> 校验，再经过这里的本地上限检查，两道都不能省略。
+/// 持续任务按顺序累计码率和包速率，超出总预算的任务被拒绝（并给出原因），其余照常运行。
+/// </summary>
+public sealed class BudgetGuard
+{
+    private readonly NodeLimits _limits;
+    private readonly IReadOnlyCollection<string> _supportedKinds;
+    private readonly List<(IPAddress Network, int Prefix)> _cidrs = [];
+
+    public BudgetGuard(NodeLimits limits, IReadOnlyCollection<string> supportedKinds)
+    {
+        _limits = limits;
+        _supportedKinds = supportedKinds;
+        foreach (string cidr in limits.AllowedTargetCidrs)
+        {
+            if (TryParseCidr(cidr, out IPAddress? network, out int prefix))
+            {
+                _cidrs.Add((network, prefix));
+            }
+        }
+    }
+
+    /// <summary>检查一个任务；<paramref name="usedMbps"/> 和 <paramref name="usedPps"/> 是已经接受的任务占用的预算，接受之后会累加。</summary>
+    public TaskDecision Check(TaskSpec task, ref double usedMbps, ref long usedPps)
+    {
+        KindSpec? kind = Kinds.Find(task.Kind);
+        if (kind is null || !_supportedKinds.Contains(task.Kind))
+        {
+            return TaskDecision.Reject(RejectReasons.Unsupported);
+        }
+
+        ParamResolution resolved = ParamResolver.Resolve(kind.Params, task.Params);
+        if (!resolved.IsValid)
+        {
+            return TaskDecision.Reject(RejectReasons.InvalidParams);
+        }
+
+        if (task.Scope == "target")
+        {
+            if (!TargetAllowed(task.Target))
+            {
+                return TaskDecision.Reject(RejectReasons.PolicyDenied);
+            }
+        }
+        else if (!PortAllowed(kind, resolved.Values!))
+        {
+            return TaskDecision.Reject(RejectReasons.PolicyDenied);
+        }
+
+        double mbps = kind.BudgetBitsPerSecond(resolved.Values!) / 1_000_000.0;
+        long pps = EstimatePps(kind.Id, resolved.Values!);
+        if (usedMbps + mbps > _limits.MaxTotalMbps || usedPps + pps > _limits.MaxTotalPps)
+        {
+            return TaskDecision.Reject(RejectReasons.BudgetExceeded);
+        }
+
+        usedMbps += mbps;
+        usedPps += pps;
+        return new TaskDecision(true, null, resolved.Values, kind);
+    }
+
+    /// <summary>按需测试的一个阶段是否在本地上限之内（单独运行，不和持续任务累计）。</summary>
+    public TaskDecision CheckPhase(string kindId, IReadOnlyDictionary<string, JsonElement> parameters)
+    {
+        double mbps = 0;
+        long pps = 0;
+        return Check(new TaskSpec { Id = new TaskId("tsk_phase"), Scope = "line", Kind = kindId, Params = new Dictionary<string, JsonElement>(parameters) }, ref mbps, ref pps);
+    }
+
+    public bool TargetAllowed(string? target)
+    {
+        if (target is null)
+        {
+            return false;
+        }
+
+        string host = target;
+        if (IPEndPoint.TryParse(target, out IPEndPoint? endpoint))
+        {
+            host = endpoint.Address.ToString();
+        }
+
+        if (!IPAddress.TryParse(host, out IPAddress? address))
+        {
+            return false;
+        }
+
+        foreach ((IPAddress network, int prefix) in _cidrs)
+        {
+            if (InCidr(address, network, prefix))
+            {
+                return true;
+            }
+        }
+
+        return false;
+    }
+
+    private bool PortAllowed(KindSpec kind, ParamValues values)
+    {
+        if (!kind.Params.Any(p => p.Name == "port"))
+        {
+            return true;
+        }
+
+        int port = (int)values.GetInt("port");
+        return kind.Blocks.Transport == "udp" ? _limits.AllowedUdpPorts.Contains(port) : _limits.AllowedTcpPorts.Contains(port);
+    }
+
+    private static long EstimatePps(string kindId, ParamValues values) => kindId switch
+    {
+        "udp_echo" or "tcp_echo" => values.GetInt("rate_hz") * 2,
+        "icmp_echo" => values.GetInt("rate_hz") * 2,
+        "udp_train" => (long)(values.GetNumber("mbps") * 1_000_000 / 8 / Math.Max(1, values.GetInt("size"))),
+        "connect" => values.GetInt("per_minute") * 6 / 60,
+        _ => 1,
+    };
+
+    private static bool TryParseCidr(string text, out IPAddress network, out int prefix)
+    {
+        network = IPAddress.None;
+        prefix = 0;
+        int slash = text.IndexOf('/', StringComparison.Ordinal);
+        if (slash < 0 || !IPAddress.TryParse(text.AsSpan(0, slash), out IPAddress? parsed) || !int.TryParse(text.AsSpan(slash + 1), out prefix))
+        {
+            return false;
+        }
+
+        network = parsed;
+        return prefix >= 0 && prefix <= parsed.GetAddressBytes().Length * 8;
+    }
+
+    private static bool InCidr(IPAddress address, IPAddress network, int prefix)
+    {
+        byte[] a = address.GetAddressBytes();
+        byte[] n = network.GetAddressBytes();
+        if (a.Length != n.Length)
+        {
+            return false;
+        }
+
+        int bits = prefix;
+        for (int i = 0; i < a.Length && bits > 0; i++, bits -= 8)
+        {
+            int mask = bits >= 8 ? 0xFF : (0xFF << (8 - bits)) & 0xFF;
+            if ((a[i] & mask) != (n[i] & mask))
+            {
+                return false;
+            }
+        }
+
+        return true;
+    }
+}

backend/shared/MoShiro.Measurement/Merging/ChunkFinalizer.cs

@@ -0,0 +1,90 @@
+using System.Text.Json;
+using Fleet.Core;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>Agent 单调时钟（微秒）与 UTC（毫秒）的对应关系：块头里的时钟锚点。</summary>
+public readonly record struct ClockAnchor(long AgentMonoUs, long UtcMs);
+
+/// <summary>
+/// 给合并好的流盖章：生成完整的块头（任务/测试、参数快照、端口、时钟锚点、起止时间）。
+/// 起止时间由数据本身的时间戳换算得出，而不是取收到列块的时刻，所以不受 Probe 交付延迟的影响。
+/// </summary>
+public static class ChunkFinalizer
+{
+    public const int MaxDurationMs = 600_000;
+
+    public static RawChunk Finalize(
+        KindSpec spec,
+        RawChunk fragment,
+        IReadOnlyList<RawStream> streams,
+        NodeId agent,
+        ClockAnchor anchor,
+        IReadOnlyDictionary<string, JsonElement> resolvedParams,
+        int port,
+        ChunkId id)
+    {
+        RawChunkHeader source = fragment.Header;
+        long offsetUs = source.Clock.ProbeOffsetUs;
+        long min = long.MaxValue;
+        long max = long.MinValue;
+        foreach (RawStream stream in streams)
+        {
+            if (stream.Name == "tcp_info")
+            {
+                continue; // 这个流的时钟取决于 side 列，不参与起止时间的计算
+            }
+
+            foreach (RawColumn column in stream.Columns)
+            {
+                if (column.Role == ColumnRole.None)
+                {
+                    continue;
+                }
+
+                for (int i = 0; i < stream.Count; i++)
+                {
+                    if (!column.IsValid(i))
+                    {
+                        continue;
+                    }
+
+                    long utc = ToUtcMs(column.Values[i], column.Role, anchor, offsetUs);
+                    min = Math.Min(min, utc);
+                    max = Math.Max(max, utc);
+                }
+            }
+        }
+
+        long start = min == long.MaxValue ? anchor.UtcMs - source.DurationMs : min;
+        int duration = (int)Math.Clamp(Math.Max(source.DurationMs, min == long.MaxValue ? 0 : max - start), 1, MaxDurationMs);
+
+        var header = new RawChunkHeader
+        {
+            ChunkId = id,
+            Kind = spec.Id,
+            TaskId = source.TaskId,
+            TestId = source.TestId,
+            Phase = source.Phase,
+            AgentId = agent,
+            ProbeId = source.ProbeId,
+            Target = null,
+            Params = new Dictionary<string, JsonElement>(resolvedParams),
+            Port = port,
+            Direction = source.Direction,
+            StartUtcMs = start,
+            DurationMs = duration,
+            Partial = false,
+            Clock = new ChunkClock { AgentMonoUs = anchor.AgentMonoUs, UtcMs = anchor.UtcMs, ProbeOffsetUs = offsetUs },
+        };
+        return new RawChunk(header, streams);
+    }
+
+    public static long ToUtcMs(long value, ColumnRole role, ClockAnchor anchor, long probeOffsetUs)
+    {
+        long agentUs = role == ColumnRole.TsProbe ? value + probeOffsetUs : value;
+        long delta = agentUs - anchor.AgentMonoUs;
+        return anchor.UtcMs + (delta >= 0 ? delta / 1000 : -((-delta + 999) / 1000));
+    }
+}

backend/shared/MoShiro.Measurement/Merging/FragmentMerger.cs

@@ -0,0 +1,225 @@
+using System.Text.Json;
+using Fleet.Core;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>Agent 一侧为合并保留的按键记录（由正在运行的积木提供）。</summary>
+public interface IRecordSource
+{
+    RowStore? Records(uint streamId, string streamName);
+}
+
+/// <summary>
+/// 把 Probe 一侧的列块（一个只带 Probe 列的 RawChunk）与 Agent 一侧的记录合并成完整的行。合并完全由 Kind 的 <see cref="StreamSpec"/> 声明驱动：
+/// <list type="bullet">
+/// <item><description>声明了连接键、两侧都有列：按键连接。主导方是 Probe（回显）时行取自列块，Agent 的列按键补上，缺失就是缺失（上行丢失）；
+/// 主导方是 Agent（单向数据流）时行取自 Agent 的记录（按列块头里的序号范围），Probe 的列按键补上，缺失就是缺失（丢失）。</description></item>
+/// <item><description>没有连接键，或者只有主导方一侧有列：原样透传，只按声明的列顺序重排。</description></item>
+/// </list>
+/// 合并之后的流按声明的列顺序排列，所以 Backend 的分析层不需要知道这些列是谁记录的；新增一种记录流不需要写合并代码。
+/// </summary>
+public static class FragmentMerger
+{
+    public static Result<IReadOnlyList<RawStream>> Merge(KindSpec spec, RawChunk fragment, uint streamId, IRecordSource records)
+    {
+        var streams = new List<RawStream>();
+        foreach (RawStream stream in fragment.Streams)
+        {
+            StreamSpec? streamSpec = spec.FindStream(stream.Name);
+            if (streamSpec is null)
+            {
+                return Result<IReadOnlyList<RawStream>>.Fail(MoShiroErrors.ValidationFailed, $"stream {stream.Name} is not declared by {spec.Id}");
+            }
+
+            Result<RawStream> merged = Join(streamSpec, stream, fragment.Header, records.Records(streamId, stream.Name));
+            if (!merged.TryGet(out RawStream? value, out FleetError? error))
+            {
+                return Result<IReadOnlyList<RawStream>>.Fail(error);
+            }
+
+            streams.Add(value);
+        }
+
+        // 两侧各自记录完整行的流：Probe 的列块里没有它（例如 Probe 在不支持内核采样的平台上）时，Agent 自己的行也要交出去
+        foreach (StreamSpec union in spec.Streams.Where(s => s.Union && fragment.Find(s.Name) is null))
+        {
+            RawStream? own = records.Records(streamId, union.Name)?.Drain(includeKey: false);
+            if (own is { Count: > 0 })
+            {
+                streams.Add(Conform(union, own));
+            }
+        }
+
+        return Result<IReadOnlyList<RawStream>>.Ok(streams);
+    }
+
+    private static Result<RawStream> Join(StreamSpec spec, RawStream probe, RawChunkHeader header, RowStore? agent)
+    {
+        if (spec.Union)
+        {
+            return Result<RawStream>.Ok(Concatenate(spec, probe, agent));
+        }
+
+        IReadOnlyList<ColumnSpec> probeColumns = spec.ColumnsOf(Side.Probe);
+        IReadOnlyList<ColumnSpec> agentColumns = spec.ColumnsOf(Side.Agent);
+        if (spec.Key is null || (spec.Driver == Side.Probe && agentColumns.Count == 0))
+        {
+            return Result<RawStream>.Ok(Conform(spec, probe));
+        }
+
+        RawColumn? key = probe.Find(spec.Key);
+        if (key is null || probeColumns.Any(c => probe.Find(c.Name) is null))
+        {
+            return Result<RawStream>.Fail(MoShiroErrors.ValidationFailed, $"a fragment of stream {spec.Name} needs the columns {string.Join(", ", new[] { spec.Key }.Concat(probeColumns.Select(c => c.Name)))}");
+        }
+
+        return spec.Driver == Side.Probe ? JoinOnProbeRows(spec, probe, key, agent) : JoinOnAgentRows(spec, probe, key, header, agent);
+    }
+
+    private static Result<RawStream> JoinOnProbeRows(StreamSpec spec, RawStream probe, RawColumn key, RowStore? agent)
+    {
+        int n = probe.Count;
+        var columns = new List<RawColumn>(spec.Columns.Count);
+        foreach (ColumnSpec column in spec.Columns)
+        {
+            long[] values = new long[n];
+            bool[] valid = new bool[n];
+            if (column.Name == spec.Key)
+            {
+                key.Values.AsSpan(0, n).CopyTo(values);
+                Array.Fill(valid, true);
+            }
+            else if (spec.OwnerOf(column) == Side.Probe)
+            {
+                RawColumn source = probe.Find(column.Name)!;
+                for (int i = 0; i < n; i++)
+                {
+                    values[i] = source.Values[i];
+                    valid[i] = source.IsValid(i);
+                }
+            }
+            else if (agent is not null)
+            {
+                int index = agent.ColumnIndex(column.Name);
+                for (int i = 0; i < n; i++)
+                {
+                    valid[i] = agent.TryGet(key.Values[i], index, out values[i]);
+                }
+            }
+
+            columns.Add(new RawColumn(column.Name, column.Type, column.Enc, column.Nullable, column.Role, values, column.Nullable ? valid : null));
+        }
+
+        return Result<RawStream>.Ok(new RawStream(spec.Name, n, columns));
+    }
+
+    private static Result<RawStream> JoinOnAgentRows(StreamSpec spec, RawStream probe, RawColumn key, RawChunkHeader header, RowStore? agent)
+    {
+        if (!TryGetRange(header, out uint from, out uint to))
+        {
+            return Result<RawStream>.Fail(MoShiroErrors.ValidationFailed, $"a fragment of stream {spec.Name} must declare its sequence range");
+        }
+
+        // 行取自 Agent 的记录：范围内发出过的每一个包都有一行，Probe 没有报告到达的就是丢失
+        RawStream rows = agent?.Cut(from, to, includeKey: true) ?? new RawStream(spec.Name, 0, []);
+        var arrived = new Dictionary<long, int>();
+        for (int i = 0; i < probe.Count; i++)
+        {
+            arrived.TryAdd(key.Values[i], i); // 重复的包只算第一次
+        }
+
+        int n = rows.Count;
+        var columns = new List<RawColumn>(spec.Columns.Count);
+        foreach (ColumnSpec column in spec.Columns)
+        {
+            long[] values = new long[n];
+            bool[] valid = new bool[n];
+            RawColumn? own = rows.Find(column.Name);
+            if (own is not null)
+            {
+                own.Values.AsSpan(0, n).CopyTo(values);
+                for (int i = 0; i < n; i++)
+                {
+                    valid[i] = own.IsValid(i);
+                }
+            }
+            else if (probe.Find(column.Name) is { } source)
+            {
+                RawColumn keys = rows.Find(spec.Key!)!;
+                for (int i = 0; i < n; i++)
+                {
+                    if (arrived.TryGetValue(keys.Values[i], out int row) && source.IsValid(row))
+                    {
+                        values[i] = source.Values[row];
+                        valid[i] = true;
+                    }
+                }
+            }
+
+            columns.Add(new RawColumn(column.Name, column.Type, column.Enc, column.Nullable, column.Role, values, column.Nullable ? valid : null));
+        }
+
+        return Result<RawStream>.Ok(new RawStream(spec.Name, n, columns));
+    }
+
+    /// <summary>
+    /// 两侧各自记录完整行的流（例如各自套接字的内核采样）：Probe 的行（列块里）加上 Agent 自己新记录的行，按声明的列顺序拼接。
+    /// 每一行里有一列标明它属于哪一侧，所以不需要连接。
+    /// </summary>
+    private static RawStream Concatenate(StreamSpec spec, RawStream probe, RowStore? agent)
+    {
+        RawStream own = Conform(spec, probe);
+        RawStream? extra = agent?.Drain(includeKey: false);
+        if (extra is null || extra.Count == 0)
+        {
+            return own;
+        }
+
+        int n = own.Count + extra.Count;
+        var columns = new List<RawColumn>(spec.Columns.Count);
+        foreach (ColumnSpec column in spec.Columns)
+        {
+            RawColumn a = own.Find(column.Name)!;
+            RawColumn b = extra.Find(column.Name)!;
+            long[] values = new long[n];
+            bool[] valid = new bool[n];
+            for (int i = 0; i < own.Count; i++)
+            {
+                values[i] = a.Values[i];
+                valid[i] = a.IsValid(i);
+            }
+
+            for (int i = 0; i < extra.Count; i++)
+            {
+                values[own.Count + i] = b.Values[i];
+                valid[own.Count + i] = b.IsValid(i);
+            }
+
+            columns.Add(new RawColumn(column.Name, column.Type, column.Enc, column.Nullable, column.Role, values, column.Nullable ? valid : null));
+        }
+
+        return new RawStream(spec.Name, n, columns);
+    }
+
+    /// <summary>按声明的列顺序重排；Probe 一侧已经是完整的行时不改变内容。</summary>
+    private static RawStream Conform(StreamSpec spec, RawStream stream)
+    {
+        var columns = new List<RawColumn>(spec.Columns.Count);
+        foreach (ColumnSpec column in spec.Columns)
+        {
+            RawColumn? existing = stream.Find(column.Name);
+            columns.Add(existing ?? new RawColumn(column.Name, column.Type, column.Enc, column.Nullable, column.Role, new long[stream.Count], column.Nullable ? new bool[stream.Count] : null));
+        }
+
+        return new RawStream(stream.Name, stream.Count, columns);
+    }
+
+    public static bool TryGetRange(RawChunkHeader header, out uint from, out uint to)
+    {
+        from = 0;
+        to = 0;
+        return header.Params.TryGetValue(FragmentKeys.SeqFrom, out JsonElement f) && f.TryGetUInt32(out from)
+            && header.Params.TryGetValue(FragmentKeys.SeqTo, out JsonElement t) && t.TryGetUInt32(out to) && to >= from;
+    }
+}

backend/shared/MoShiro.Measurement/MoShiro.Measurement.csproj

@@ -0,0 +1,10 @@
+<Project Sdk="Microsoft.NET.Sdk">
+  <PropertyGroup>
+    <IsAotCompatible>true</IsAotCompatible>
+  </PropertyGroup>
+  <ItemGroup>
+    <InternalsVisibleTo Include="MoShiro.Measurement.Tests" />
+    <AdditionalFiles Include="$(MSBuildThisFileDirectory)../../BannedSymbols.Node.txt" />
+    <ProjectReference Include="..\MoShiro.Protocol\MoShiro.Protocol.csproj" />
+  </ItemGroup>
+</Project>

backend/shared/MoShiro.Measurement/Net/Tcp.cs

@@ -0,0 +1,337 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Security;
+using System.Net.Sockets;
+using System.Security.Authentication;
+using System.Security.Cryptography;
+using System.Security.Cryptography.X509Certificates;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>拨号方的一条数据面 TCP 连接（已经完成 TLS 和首帧认证）。</summary>
+public sealed class TcpLink : IDisposable
+{
+    private readonly TcpClient _client;
+
+    private TcpLink(TcpClient client, Stream stream, long tcpUs, long? tlsUs)
+    {
+        _client = client;
+        Socket = client.Client;
+        Stream = stream;
+        TcpUs = tcpUs;
+        TlsUs = tlsUs;
+    }
+
+    public Stream Stream { get; }
+
+    /// <summary>底层套接字（内核采样用）。</summary>
+    public Socket Socket { get; }
+
+    public long TcpUs { get; }
+
+    public long? TlsUs { get; }
+
+    /// <summary>
+    /// 连接 → （TLS）→ 认证首帧。<paramref name="sendAuth"/> 为 false 时只测量建立连接的耗时（connect）。
+    /// 对端证书按 <see cref="BlockEnv.PeerSpkiSha256"/> 固定；没有指纹（目标任务，目标是任意地址）就只测握手耗时、不校验证书。
+    /// 失败时抛出 <see cref="SocketException"/>、<see cref="AuthenticationException"/>、<see cref="IOException"/> 或超时的 <see cref="OperationCanceledException"/>。
+    /// </summary>
+    public static async Task<TcpLink> OpenAsync(BlockEnv env, int port, bool tls, uint streamId, bool sendAuth, CancellationToken ct)
+    {
+        var client = new TcpClient { NoDelay = true };
+        try
+        {
+            long start = env.Clock.NowUs();
+            await client.ConnectAsync(env.PeerAddress!, port, ct);
+            long tcpUs = env.Clock.NowUs() - start;
+            Stream stream = client.GetStream();
+            long? tlsUs = null;
+            if (tls)
+            {
+                long tlsStart = env.Clock.NowUs();
+                byte[]? pin = env.PeerSpkiSha256;
+#pragma warning disable CA5359 // 没有指纹时只测量握手耗时（目标任务的目标是任意地址）
+                var ssl = new SslStream(stream, false, (_, certificate, _, _) => pin is null || (certificate is not null && Pinned(certificate, pin)));
+#pragma warning restore CA5359
+                await ssl.AuthenticateAsClientAsync(new SslClientAuthenticationOptions { TargetHost = env.PeerAddress!.ToString() }, ct);
+                stream = ssl;
+                tlsUs = env.Clock.NowUs() - tlsStart;
+            }
+
+            if (sendAuth)
+            {
+                DataSession session = env.Session() ?? throw new InvalidOperationException("no data session");
+                byte[] auth = new byte[TcpWire.AuthBytes];
+                Span<byte> nonce = stackalloc byte[TcpWire.NonceBytes];
+                RandomNumberGenerator.Fill(nonce);
+                TcpWire.WriteAuth(auth, session.SessionId, streamId, nonce, session.Key);
+                await stream.WriteAsync(auth, ct);
+            }
+
+            return new TcpLink(client, stream, tcpUs, tlsUs);
+        }
+        catch
+        {
+            client.Dispose();
+            throw;
+        }
+    }
+
+    public void Dispose()
+    {
+        Stream.Dispose();
+        _client.Dispose();
+    }
+
+    private static bool Pinned(X509Certificate certificate, byte[] expected)
+    {
+        X509Certificate2 full = certificate as X509Certificate2 ?? X509CertificateLoader.LoadCertificate(certificate.GetRawCertData());
+        return CryptographicOperations.FixedTimeEquals(SHA256.HashData(full.PublicKey.ExportSubjectPublicKeyInfo()), expected);
+    }
+}
+
+/// <summary>监听方收到的一条已经认证的数据面 TCP 连接。</summary>
+public sealed class TcpConnection
+{
+    public TcpConnection(Stream stream, Socket socket, DataSession session, uint streamId)
+    {
+        Stream = stream;
+        Socket = socket;
+        Session = session;
+        StreamId = streamId;
+    }
+
+    public Stream Stream { get; }
+
+    /// <summary>底层套接字（内核采样用）。</summary>
+    public Socket Socket { get; }
+
+    public DataSession Session { get; }
+
+    public uint StreamId { get; }
+}
+
+public delegate Task TcpResponder(TcpConnection connection, CancellationToken ct);
+
+/// <summary>
+/// 监听方的 TCP 数据面：每个端口一个监听器。连接的第一个字节是 0x16 就先做 TLS（节点自己的证书），否则直接是明文。
+/// 随后是认证首帧（<c>"MN" | ver | session_id | stream_id | nonce | mac</c>，随机数只能用一次），通过之后交给按 <c>stream_id</c> 登记的处理函数。
+/// 首帧在限定时间内没有到达或者校验失败，直接关闭连接并计数。
+/// </summary>
+public sealed class TcpAcceptor
+{
+    private static readonly TimeSpan s_authTimeout = TimeSpan.FromSeconds(5);
+
+    private readonly IPAddress _bind;
+    private readonly IReadOnlyList<int> _ports;
+    private readonly X509Certificate2 _certificate;
+    private readonly IDataSessions _sessions;
+    private readonly DataPlaneCounters _counters;
+    private readonly ConcurrentDictionary<uint, TcpResponder> _handlers = new();
+    private readonly List<TcpListener> _listeners = [];
+
+    public TcpAcceptor(IPAddress bind, IReadOnlyList<int> ports, X509Certificate2 certificate, IDataSessions sessions, DataPlaneCounters counters)
+    {
+        _bind = bind;
+        _ports = ports;
+        _certificate = certificate;
+        _sessions = sessions;
+        _counters = counters;
+    }
+
+    public IReadOnlyList<int> BoundPorts { get; private set; } = [];
+
+    public void Register(uint streamId, TcpResponder handler) => _handlers[streamId] = handler;
+
+    public void Unregister(uint streamId) => _handlers.TryRemove(streamId, out _);
+
+    /// <summary>开始监听（端口被占用等错误在这里抛出）。</summary>
+    public void Bind()
+    {
+        var bound = new List<int>();
+        foreach (int port in _ports)
+        {
+            var listener = new TcpListener(_bind, port);
+            listener.Start(128);
+            _listeners.Add(listener);
+            bound.Add(((IPEndPoint)listener.LocalEndpoint).Port);
+        }
+
+        BoundPorts = bound;
+    }
+
+    public async Task RunAsync(CancellationToken ct)
+    {
+        try
+        {
+            await Task.WhenAll(_listeners.Select(l => AcceptLoopAsync(l, ct)));
+        }
+        finally
+        {
+            foreach (TcpListener listener in _listeners)
+            {
+                listener.Stop();
+            }
+        }
+    }
+
+    private async Task AcceptLoopAsync(TcpListener listener, CancellationToken ct)
+    {
+        while (!ct.IsCancellationRequested)
+        {
+            TcpClient client;
+            try
+            {
+                client = await listener.AcceptTcpClientAsync(ct);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+            catch (SocketException)
+            {
+                continue;
+            }
+
+            _ = Task.Run(() => HandleAsync(client, ct), CancellationToken.None);
+        }
+    }
+
+    private async Task HandleAsync(TcpClient client, CancellationToken ct)
+    {
+        using (client)
+        {
+            client.NoDelay = true;
+            try
+            {
+                Stream stream = client.GetStream();
+                using var authCts = CancellationTokenSource.CreateLinkedTokenSource(ct);
+                authCts.CancelAfter(s_authTimeout);
+
+                byte[] first = new byte[1];
+                if (await stream.ReadAsync(first, authCts.Token) != 1)
+                {
+                    return;
+                }
+
+                stream = new PrefixedStream(stream, first[0]);
+                if (first[0] == 0x16)
+                {
+                    var ssl = new SslStream(stream, leaveInnerStreamOpen: false);
+                    await ssl.AuthenticateAsServerAsync(new SslServerAuthenticationOptions { ServerCertificate = _certificate }, authCts.Token);
+                    stream = ssl;
+                }
+
+                byte[] auth = new byte[TcpWire.AuthBytes];
+                await stream.ReadExactlyAsync(auth, authCts.Token);
+                if (!TcpWire.TryParseAuth(auth, out long sessionId, out uint streamId, out ReadOnlySpan<byte> nonce)
+                    || _sessions.Find(sessionId) is not { } session
+                    || !_handlers.TryGetValue(streamId, out TcpResponder? handler)
+                    || !TcpWire.VerifyAuth(auth, session.Key)
+                    || !session.UseNonce(nonce))
+                {
+                    _counters.DropInvalid();
+                    return;
+                }
+
+                await handler(new TcpConnection(stream, client.Client, session, streamId), ct);
+            }
+            catch (Exception ex) when (ex is IOException or SocketException or OperationCanceledException or ObjectDisposedException or AuthenticationException or InvalidDataException or EndOfStreamException)
+            {
+                // 连接被对端关闭、超时或者格式错误：直接结束这个连接
+            }
+        }
+    }
+
+    /// <summary>把已经读出的第一个字节放回流的开头（用于探测是 TLS 还是明文）。</summary>
+    private sealed class PrefixedStream : Stream
+    {
+        private readonly Stream _inner;
+        private byte? _prefix;
+
+        public PrefixedStream(Stream inner, byte prefix)
+        {
+            _inner = inner;
+            _prefix = prefix;
+        }
+
+        public override bool CanRead => true;
+
+        public override bool CanSeek => false;
+
+        public override bool CanWrite => true;
+
+        public override long Length => throw new NotSupportedException();
+
+        public override long Position
+        {
+            get => throw new NotSupportedException();
+            set => throw new NotSupportedException();
+        }
+
+        public override void Flush() => _inner.Flush();
+
+        public override Task FlushAsync(CancellationToken cancellationToken) => _inner.FlushAsync(cancellationToken);
+
+        public override int Read(byte[] buffer, int offset, int count) => Read(buffer.AsSpan(offset, count));
+
+        public override int Read(Span<byte> buffer)
+        {
+            if (buffer.IsEmpty)
+            {
+                return 0;
+            }
+
+            if (_prefix is { } prefix)
+            {
+                buffer[0] = prefix;
+                _prefix = null;
+                return 1;
+            }
+
+            return _inner.Read(buffer);
+        }
+
+        public override ValueTask<int> ReadAsync(Memory<byte> buffer, CancellationToken cancellationToken = default)
+        {
+            if (buffer.IsEmpty)
+            {
+                return ValueTask.FromResult(0);
+            }
+
+            if (_prefix is { } prefix)
+            {
+                buffer.Span[0] = prefix;
+                _prefix = null;
+                return ValueTask.FromResult(1);
+            }
+
+            return _inner.ReadAsync(buffer, cancellationToken);
+        }
+
+        public override Task<int> ReadAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken) => ReadAsync(buffer.AsMemory(offset, count), cancellationToken).AsTask();
+
+        public override long Seek(long offset, SeekOrigin origin) => throw new NotSupportedException();
+
+        public override void SetLength(long value) => throw new NotSupportedException();
+
+        public override void Write(byte[] buffer, int offset, int count) => _inner.Write(buffer, offset, count);
+
+        public override void Write(ReadOnlySpan<byte> buffer) => _inner.Write(buffer);
+
+        public override ValueTask WriteAsync(ReadOnlyMemory<byte> buffer, CancellationToken cancellationToken = default) => _inner.WriteAsync(buffer, cancellationToken);
+
+        public override Task WriteAsync(byte[] buffer, int offset, int count, CancellationToken cancellationToken) => _inner.WriteAsync(buffer, offset, count, cancellationToken);
+
+        protected override void Dispose(bool disposing)
+        {
+            if (disposing)
+            {
+                _inner.Dispose();
+            }
+
+            base.Dispose(disposing);
+        }
+    }
+}

backend/shared/MoShiro.Measurement/Net/TcpInfo.cs

@@ -0,0 +1,118 @@
+using System.Buffers.Binary;
+using System.Net.Sockets;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>内核对一条 TCP 连接的采样（Linux <c>TCP_INFO</c>）。</summary>
+public readonly record struct TcpInfoSample(long SrttUs, long RttVarUs, long Cwnd, long TotalRetrans, long SegsOut, long BytesAcked);
+
+/// <summary>
+/// 读 Linux 的 <c>TCP_INFO</c>：通过 <see cref="Socket.GetRawSocketOption(int, int, Span{byte})"/>，不需要 P/Invoke（NativeAOT、glibc 和 musl 都一样）。
+/// 缓冲区先清零，并且只读内核实际返回的长度之内的字段：老内核返回的结构更短，缺的字段是 0，而不是垃圾值。
+/// 其他平台返回 false（没有这一类采样，指标在对应窗口里就是没有数据）。
+/// </summary>
+public static class TcpInfo
+{
+    private const int SolTcp = 6;
+    private const int TcpInfoOption = 11;
+
+    // struct tcp_info 的偏移（include/uapi/linux/tcp.h）：8 字节的状态位之后是 u32 字段；total_retrans 之后是对齐到 8 字节的 u64 字段
+    private const int RttOffset = 68;
+    private const int RttVarOffset = 72;
+    private const int SndCwndOffset = 80;
+    private const int TotalRetransOffset = 100;
+    private const int BytesAckedOffset = 120;
+    private const int SegsOutOffset = 136;
+
+    /// <summary>读到 <c>segs_out</c> 为止（内核 ≥ 4.2）。</summary>
+    public const int Length = SegsOutOffset + 4;
+
+    public static bool Supported => OperatingSystem.IsLinux();
+
+    public static bool TrySample(Socket socket, out TcpInfoSample sample)
+    {
+        sample = default;
+        if (!Supported)
+        {
+            return false;
+        }
+
+        try
+        {
+            Span<byte> buffer = stackalloc byte[Length];
+            buffer.Clear();
+            int returned = socket.GetRawSocketOption(SolTcp, TcpInfoOption, buffer);
+            if (returned < RttVarOffset + 4)
+            {
+                return false;
+            }
+
+            ReadOnlySpan<byte> info = buffer[..Math.Min(returned, Length)];
+            sample = new TcpInfoSample(
+                U32(info, RttOffset),
+                U32(info, RttVarOffset),
+                U32(info, SndCwndOffset),
+                U32(info, TotalRetransOffset),
+                U32(info, SegsOutOffset),
+                U64(info, BytesAckedOffset));
+            return true;
+        }
+        catch (Exception ex) when (ex is SocketException or ObjectDisposedException or PlatformNotSupportedException)
+        {
+            return false;
+        }
+    }
+
+    private static long U32(ReadOnlySpan<byte> info, int offset) => offset + 4 <= info.Length ? BinaryPrimitives.ReadUInt32LittleEndian(info[offset..]) : 0;
+
+    private static long U64(ReadOnlySpan<byte> info, int offset) => offset + 8 <= info.Length ? (long)BinaryPrimitives.ReadUInt64LittleEndian(info[offset..]) : 0;
+}
+
+/// <summary>
+/// 一条连接上周期性的内核采样（<c>tcp_info</c> 流）：每个采样一行 (ts, side, srtt, rttvar, cwnd, retrans_total, segs_out, bytes_acked)。
+/// 两端各采样自己的套接字：Probe 的重传反映上行方向，Agent 的重传反映下行方向（代理场景里大流量走这个方向）。
+/// 累计计数器在 Backend 按 side 分别求差。
+/// </summary>
+public sealed class TcpInfoRecorder
+{
+    private readonly MonoClock _clock;
+    private readonly long _side;
+
+    public TcpInfoRecorder(StreamSpec spec, Side side, MonoClock clock)
+    {
+        Rows = new RowStore(spec, side, 4096);
+        _clock = clock;
+        _side = side == Side.Probe ? 0 : 1;
+    }
+
+    public RowStore Rows { get; }
+
+    /// <summary>每隔 <paramref name="interval"/> 采样一次，直到取消或套接字不可用（连接断开）。</summary>
+    public async Task RunAsync(Socket socket, TimeSpan interval, CancellationToken ct)
+    {
+        if (!TcpInfo.Supported)
+        {
+            return;
+        }
+
+        try
+        {
+            using var timer = new PeriodicTimer(interval, _clock.Time);
+            while (await timer.WaitForNextTickAsync(ct))
+            {
+                if (!TcpInfo.TrySample(socket, out TcpInfoSample s))
+                {
+                    return;
+                }
+
+                long key = Rows.Append();
+                Rows.SetRow(key, [_clock.NowUs(), _side, s.SrttUs, s.RttVarUs, s.Cwnd, s.TotalRetrans, s.SegsOut, s.BytesAcked]);
+            }
+        }
+        catch (OperationCanceledException)
+        {
+            // 连接结束
+        }
+    }
+}

backend/shared/MoShiro.Measurement/Net/UdpMux.cs

@@ -0,0 +1,216 @@
+using System.Collections.Concurrent;
+using System.Net;
+using System.Net.Sockets;
+using Fleet.Core;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>一个通过校验的 UDP 包，交给按 <c>stream_id</c> 登记的处理函数。处理函数在接收循环里同步执行，不能阻塞。</summary>
+public readonly ref struct UdpDelivery
+{
+    private readonly Span<byte> _packet;
+    private readonly Socket _socket;
+    private readonly SocketAddress _source;
+    private readonly DataPlaneCounters _counters;
+
+    internal UdpDelivery(UdpHeader header, Span<byte> packet, long receiveUs, DataSession session, Socket socket, SocketAddress source, DataPlaneCounters counters)
+    {
+        Header = header;
+        _packet = packet;
+        ReceiveUs = receiveUs;
+        Session = session;
+        _socket = socket;
+        _source = source;
+        _counters = counters;
+    }
+
+    public UdpHeader Header { get; }
+
+    public ReadOnlySpan<byte> Packet => _packet;
+
+    /// <summary>包到达的时刻（本节点的单调时钟，微秒）：从接收返回的那一刻取，不含校验的耗时。</summary>
+    public long ReceiveUs { get; }
+
+    public DataSession Session { get; }
+
+    /// <summary>
+    /// 原地回复：同样的长度，只把 type 改成 <paramref name="type"/> 并重新计算 MAC，发回请求的实际源地址。
+    /// 回复与请求等长，所以监听方不能被当成放大器。发送失败（源地址已经不可达）不抛出。
+    /// </summary>
+    public void ReplyAs(UdpPacketType type)
+    {
+        _packet[3] = (byte)type;
+        UdpPacket.Seal(_packet, Session.Key);
+        try
+        {
+            _socket.SendTo(_packet, SocketFlags.None, _source);
+            _counters.PacketOut();
+        }
+        catch (SocketException)
+        {
+            // 回复丢失由对端的缺失体现
+        }
+    }
+}
+
+public delegate void UdpHandler(in UdpDelivery delivery);
+
+/// <summary>
+/// UDP 数据面：一个或多个套接字，按 <c>stream_id</c> 把包分发给积木。校验顺序：长度、magic、version、type →
+/// 流和会话都存在 → MAC → （监听方）<see cref="IAdmission"/>（重放窗口、限速）。任何一步失败都静默丢弃并计数，不回复。
+/// 接收循环只做校验和分发，不分配对象。两端共用这一份代码：Agent 监听多个端口并带准入策略，Probe 每个 Agent 一个临时端口。
+/// </summary>
+public sealed class UdpMux : IDisposable
+{
+    private const int WindowsUdpConnReset = -1744830452; // SIO_UDP_CONNRESET
+
+    private readonly IDataSessions _sessions;
+    private readonly IAdmission? _admission;
+    private readonly MonoClock _clock;
+    private readonly DataPlaneCounters _counters;
+    private readonly INodeLog _log;
+    private readonly IPAddress _bind;
+    private readonly IReadOnlyList<int> _ports;
+    private readonly List<Socket> _sockets = [];
+    private readonly ConcurrentDictionary<uint, UdpHandler> _handlers = new();
+
+    /// <param name="ports">要监听的端口（0 表示由系统分配）；空表示一个临时端口。</param>
+    public UdpMux(IDataSessions sessions, IAdmission? admission, MonoClock clock, DataPlaneCounters counters, INodeLog log, IPAddress bind, IReadOnlyList<int> ports)
+    {
+        _sessions = sessions;
+        _admission = admission;
+        _clock = clock;
+        _counters = counters;
+        _log = log;
+        _bind = bind;
+        _ports = ports.Count == 0 ? [0] : ports;
+    }
+
+    public IReadOnlyList<int> BoundPorts { get; private set; } = [];
+
+    public DataPlaneCounters Counters => _counters;
+
+    /// <summary>绑定套接字（端口被占用等错误在这里抛出）。</summary>
+    public void Bind()
+    {
+        var bound = new List<int>();
+        foreach (int port in _ports)
+        {
+            var socket = new Socket(_bind.AddressFamily, SocketType.Dgram, ProtocolType.Udp) { ReceiveBufferSize = 4 << 20, SendBufferSize = 4 << 20 };
+            if (_bind.AddressFamily == AddressFamily.InterNetworkV6)
+            {
+                socket.DualMode = true;
+            }
+
+            if (OperatingSystem.IsWindows())
+            {
+                // Windows 上对一个已关闭的端口发送之后，下一次接收会抛 ConnectionReset：关掉这个行为
+                socket.IOControl(WindowsUdpConnReset, [0], null);
+            }
+
+            socket.Bind(new IPEndPoint(_bind, port));
+            bound.Add(((IPEndPoint)socket.LocalEndPoint!).Port);
+            _sockets.Add(socket);
+        }
+
+        BoundPorts = bound;
+    }
+
+    public void Register(uint streamId, UdpHandler handler) => _handlers[streamId] = handler;
+
+    public void Unregister(uint streamId) => _handlers.TryRemove(streamId, out _);
+
+    /// <summary>从第一个套接字发出一个已经封好的包。发送失败（没有路由、缓冲区满）不抛出：丢包本身就是测量结果。</summary>
+    public void Send(EndPoint to, ReadOnlySpan<byte> packet)
+    {
+        try
+        {
+            _sockets[0].SendTo(packet, SocketFlags.None, to);
+            _counters.PacketOut();
+        }
+        catch (SocketException)
+        {
+            // 记为丢失
+        }
+    }
+
+    public async Task RunAsync(CancellationToken ct)
+    {
+        try
+        {
+            await Task.WhenAll(_sockets.Select(s => ReceiveLoopAsync(s, ct)));
+        }
+        catch (ObjectDisposedException)
+        {
+            // 套接字已释放：停止
+        }
+    }
+
+    public void Dispose()
+    {
+        foreach (Socket socket in _sockets)
+        {
+            socket.Dispose();
+        }
+    }
+
+    private async Task ReceiveLoopAsync(Socket socket, CancellationToken ct)
+    {
+        byte[] buffer = new byte[UdpPacket.MaxBytes + 64];
+        var source = new SocketAddress(socket.AddressFamily);
+        while (!ct.IsCancellationRequested)
+        {
+            int length;
+            try
+            {
+                length = await socket.ReceiveFromAsync(buffer.AsMemory(), SocketFlags.None, source, ct);
+            }
+            catch (OperationCanceledException)
+            {
+                return;
+            }
+            catch (ObjectDisposedException)
+            {
+                return;
+            }
+            catch (SocketException ex)
+            {
+                // 个别错误（例如对端的 ICMP 不可达）不能让接收循环退出
+                _log.Warn("udp receive failed", ("err", ex.SocketErrorCode));
+                continue;
+            }
+
+            Dispatch(socket, buffer, length, source, _clock.NowUs());
+        }
+    }
+
+    private void Dispatch(Socket socket, byte[] buffer, int length, SocketAddress source, long receiveUs)
+    {
+        _counters.PacketIn();
+        Span<byte> packet = buffer.AsSpan(0, length);
+        if (!UdpPacket.TryParseHeader(packet, out UdpHeader header)
+            || !_handlers.TryGetValue(header.StreamId, out UdpHandler? handler)
+            || _sessions.Find(header.SessionId) is not { } session
+            || !UdpPacket.VerifyMac(packet, session.Key))
+        {
+            _counters.DropInvalid();
+            return;
+        }
+
+        if (_admission is not null)
+        {
+            switch (_admission.AdmitPacket(session, header, source, receiveUs))
+            {
+                case Admission.Invalid:
+                    _counters.DropInvalid();
+                    return;
+                case Admission.RateLimited:
+                    _counters.DropRateLimited();
+                    return;
+            }
+        }
+
+        handler(new UdpDelivery(header, packet, receiveUs, session, socket, source, _counters));
+    }
+}

backend/shared/MoShiro.Measurement/Platform/PlatformDetector.cs

@@ -0,0 +1,81 @@
+using System.Runtime.InteropServices;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>
+/// 读出本机的系统名和架构，只用于在面板上展示。故意只取粗粒度的信息：
+/// 「Debian 12」「Windows 11」「x64」，不读主机名、内核版本、CPU 型号。
+/// </summary>
+public static class PlatformDetector
+{
+    public static PlatformInfo Detect()
+    {
+        PlatformInfo info = Detect(File.Exists("/etc/os-release") ? File.ReadAllLines("/etc/os-release") : []);
+        info.Version = Empty(BuildInfo.Version);
+        info.Tag = Empty(BuildInfo.Tag);
+        info.Commit = Empty(BuildInfo.Commit);
+        info.BuiltAt = Empty(BuildInfo.BuiltAt);
+        return info;
+    }
+
+    private static string? Empty(string value) => value.Length == 0 ? null : value;
+
+    /// <summary>`osRelease` 是 /etc/os-release 的各行（Linux 之外不用）。拆出来是为了好测。</summary>
+    internal static PlatformInfo Detect(IEnumerable<string> osRelease)
+    {
+        string arch = RuntimeInformation.OSArchitecture switch
+        {
+            Architecture.X64 => "x64",
+            Architecture.Arm64 => "arm64",
+            Architecture.Arm => "arm",
+            Architecture.X86 => "x86",
+            var other => other.ToString().ToLowerInvariant(),
+        };
+
+        if (OperatingSystem.IsWindows())
+        {
+            // Windows 11 的版本号还是 10.0，靠内部版本号（22000 起）区分
+            string name = Environment.OSVersion.Version.Build >= 22000 ? "Windows 11" : "Windows 10";
+            return new PlatformInfo { Os = "windows", Name = name, Arch = arch };
+        }
+
+        if (OperatingSystem.IsMacOS())
+        {
+            return new PlatformInfo { Os = "macos", Name = "macOS", Arch = arch };
+        }
+
+        if (OperatingSystem.IsLinux())
+        {
+            return new PlatformInfo { Os = "linux", Name = LinuxName(osRelease), Arch = arch };
+        }
+
+        return new PlatformInfo { Os = "other", Name = null, Arch = arch };
+    }
+
+    /// <summary>从 os-release 里取发行版名字和主版本：「Debian GNU/Linux 12 (bookworm)」→「Debian 12」，「OpenWrt 24.10.0」→「OpenWrt 24.10」。</summary>
+    internal static string LinuxName(IEnumerable<string> osRelease)
+    {
+        var values = new Dictionary<string, string>(StringComparer.Ordinal);
+        foreach (string line in osRelease)
+        {
+            int eq = line.IndexOf('=', StringComparison.Ordinal);
+            if (eq > 0)
+            {
+                values[line[..eq].Trim()] = line[(eq + 1)..].Trim().Trim('"', '\'');
+            }
+        }
+
+        string name = values.GetValueOrDefault("NAME") ?? values.GetValueOrDefault("ID") ?? "Linux";
+        name = name.Replace(" GNU/Linux", string.Empty, StringComparison.Ordinal).Trim();
+        string? version = values.GetValueOrDefault("VERSION_ID");
+        if (string.IsNullOrEmpty(version))
+        {
+            return name;
+        }
+
+        // 只留 主.次：Alpine 的 3.22.1、OpenWrt 的 24.10.0 都截成两段；Debian 的 12 本来就一段
+        string[] parts = version.Split('.');
+        return $"{name} {string.Join('.', parts.Take(2))}";
+    }
+}

backend/shared/MoShiro.Measurement/Update/UpdateBridge.cs

@@ -0,0 +1,100 @@
+using System.Text;
+using System.Text.Json;
+using Fleet.Core;
+using MoShiro.Protocol;
+
+namespace MoShiro.Measurement;
+
+/// <summary>
+/// 节点进程和宿主机更新器之间的文件交换（容器里 <c>/etc/moshiro</c>，也就是数据目录）：
+/// 节点把面板发来的清单和签名写进 <c>update/</c>，把「更新」请求写成 <c>update/apply.request</c>；更新器验签并更新，状态由宿主更新器写在只读挂载的 <c>update-status/status.json</c>。
+/// 节点进程不执行任何命令，也不信任清单的内容（验签在宿主机上）。没有安装更新器时目录写不了或没人读，调用只是返回 false。
+/// </summary>
+public sealed class UpdateBridge
+{
+    private const int MaxManifestBytes = 4096;
+    private const int MaxSignatureBytes = 512;
+    private const int MaxStatusBytes = 4096;
+
+    private readonly string _updateDirectory;
+    private readonly string _statusFile;
+    private readonly Action<string, byte[]> _write;
+    private readonly INodeLog _log;
+
+    /// <param name="write">写数据目录里的文件（相对路径，原子替换）：由节点传入 <c>ConfigStore.Write</c>——常驻进程里只有它可以写文件。</param>
+    public UpdateBridge(string dataDirectory, Action<string, byte[]> write, INodeLog log)
+    {
+        _updateDirectory = Path.Combine(dataDirectory, "update");
+        _statusFile = Path.Combine(dataDirectory, "update-status", "status.json");
+        _write = write;
+        _log = log;
+    }
+
+    /// <summary>放下面板发来的清单和签名（和已有的一样就不动，免得每次重连都惊动更新器）。先写清单、后写签名：更新器监视的是签名文件。</summary>
+    public bool WriteOffer(UpdateOfferParams offer)
+    {
+        byte[] manifest = Encoding.UTF8.GetBytes(offer.Manifest);
+        byte[] signature = Encoding.UTF8.GetBytes(offer.Signature);
+        if (manifest.Length is 0 or > MaxManifestBytes || signature.Length is 0 or > MaxSignatureBytes)
+        {
+            _log.Warn("ignoring an update offer of an unexpected size");
+            return false;
+        }
+
+        try
+        {
+            string manifestPath = Path.Combine(_updateDirectory, "offer.manifest");
+            string signaturePath = Path.Combine(_updateDirectory, "offer.sig");
+            if (Same(manifestPath, manifest) && Same(signaturePath, signature))
+            {
+                return true;
+            }
+
+            _write("update/offer.manifest", manifest);
+            _write("update/offer.sig", signature);
+            _log.Info("update offer received");
+            return true;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            _log.Warn("could not store the update offer (is the updater installed?)", ("err", ex.Message));
+            return false;
+        }
+    }
+
+    /// <summary>请求更新：写一个空的 <c>apply.request</c>（更新器验签通过、清单更新才会真的动手）。</summary>
+    public bool RequestApply()
+    {
+        try
+        {
+            _write("update/apply.request", []);
+            _log.Info("update requested");
+            return true;
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException)
+        {
+            _log.Warn("could not request the update (is the updater installed?)", ("err", ex.Message));
+            return false;
+        }
+    }
+
+    /// <summary>更新器的状态；没有安装更新器、文件不存在或内容不对时返回 null。</summary>
+    public UpdateStatus? ReadStatus()
+    {
+        try
+        {
+            if (!File.Exists(_statusFile) || new FileInfo(_statusFile).Length > MaxStatusBytes)
+            {
+                return null;
+            }
+
+            return JsonSerializer.Deserialize(File.ReadAllBytes(_statusFile), MoShiroJsonContext.Default.UpdateStatus);
+        }
+        catch (Exception ex) when (ex is IOException or UnauthorizedAccessException or JsonException)
+        {
+            return null;
+        }
+    }
+
+    private static bool Same(string path, byte[] content) => File.Exists(path) && File.ReadAllBytes(path).AsSpan().SequenceEqual(content);
+}