feat(overlay): 覆盖网络线序①–⑮ 代码与测试产物入库

覆盖网络线累积产物（此前只在工作区、未入版本库）：
- 新增 relay 子系统 src/net/relay/**（wire/duplex/server/client/dialer/switcher/directory/identity/keys/placement/network/addr-override/main/index）
- 新增 src/worker/relay-tunnel.ts、src/web/routes/overlay.ts
- 新增观测/演练脚本 overlay-probe、overlay-failover-drill、overlay-keyring、overlay-holepunch、overlay-jitter、overlay-wan、overlay-relaykey-add、relay-mem-calibrate
- 新增测试 12 个（relay / relay-failover / remote-spawner / instance-port / overlay-{network,auth,bootstrap,identity} / remote-user-fs 等）

验收基线：npm test = 162 pass / 0 fail / 1 skip；--scene all = 12 PASS / 0 SKIP / 0 FAIL；overlay-probe = 12/12

test/reachability.test.mjs

@@ -47,8 +47,9 @@ test('parseReachability → agentBaseUrl 对现网两行是往返恒等的', ()
     assert.equal(toEndpoint(reach), h.endpoint, `${h.hostId} toEndpoint 不一致`)
     assert.equal(reach.scheme, 'http')
     assert.deepEqual(
-      { hostId: reach.hostId, via: reach.via, address: reach.address },
-      { hostId: h.hostId, via: h.via, address: h.endpoint.slice('http://'.length) },
+      { hostId: reach.hostId, networkId: reach.networkId, via: reach.via, address: reach.address },
+      // 裸 hostId ⇒ 落运维网（P0-3 的过渡期兼容：旧调用方一个字都不用改）
+      { hostId: h.hostId, networkId: 'ops', via: h.via, address: h.endpoint.slice('http://'.length) },
     )
   }
 })
@@ -56,6 +57,7 @@ test('parseReachability → agentBaseUrl 对现网两行是往返恒等的', ()
 test('parseReachability：https / 裸 host:port / 尾斜杠 三种兼容面', () => {
   assert.deepEqual(parseReachability('h', 'https://a.example:8443', 'x'), {
     hostId: 'h',
+    networkId: 'ops',
     via: 'x',
     address: 'a.example:8443',
     scheme: 'https',
@@ -63,6 +65,7 @@ test('parseReachability：https / 裸 host:port / 尾斜杠 三种兼容面', ()
   // 没写 scheme ⇒ 按 http（与 fetch 的补全行为一致）
   assert.deepEqual(parseReachability('h', '10.0.0.5:19000', 'x'), {
     hostId: 'h',
+    networkId: 'ops',
     via: 'x',
     address: '10.0.0.5:19000',
     scheme: 'http',
@@ -91,6 +94,7 @@ test('LocalRendezvous：命中给 local，未命中回 undefined 不抛', async
   assert.equal(rv.dialTarget(), '(direct)')
   assert.deepEqual(await rv.resolve('w-47'), {
     hostId: 'w-47',
+    networkId: 'ops',
     via: VIA_LOCAL,
     address: '127.0.0.1:19100',
     scheme: 'http',
@@ -124,3 +128,49 @@ test('RendezvousRegistry：按 via 取实现', () => {
   assert.equal(reg.get('relay:backbone-1'), undefined)
   assert.deepEqual(reg.ids().sort(), [VIA_LOCAL, VIA_MANAGER_SSH].sort())
 })
+
+// ── S2 验收判据 ────────────────────────────────────────────────────────────
+// 「迁移前 `agentUrl`」必须 **逐条逐字等于** 「迁移后 `resolve()` 的结果」。
+// 这里把 `hostsProvider` 的真实接线原样复刻一遍（先读 via → 选实现 → 解析 → 拼基址），
+// 两条数据用现网实测值写死 ⇒ **不靠肉眼、不靠人工比对**。
+test('S2：via → Rendezvous → Reachability 后取址与旧 agentUrl 逐条相等', async () => {
+  // 现网 `dsh_hosts` 真实两行（2026-09-16 实测；`via` = 回填后的目标值）
+  const rows = LIVE_HOSTS.map((h) => ({ id: h.hostId, endpoint: h.endpoint, via: h.via }))
+  // P0-3：控制面的键 = **逻辑名**（现网全在 `ops` ⇒ 与裸 id 等价）
+  const nameOf = (h) => `ops/${h.id}`
+
+  const hostAddresses = new Map()
+  const rendezvous = new RendezvousRegistry([
+    new LocalRendezvous((id) => hostAddresses.get(id)),
+    new ManagerSshRendezvous({ target: 'ssh://[email protected]:32022', addressOf: (id) => hostAddresses.get(id) }),
+  ])
+  // hostsProvider 第一遍：同步地址表
+  for (const row of rows) {
+    hostAddresses.set(nameOf(row), parseReachability(nameOf(row), row.endpoint, row.via).address)
+  }
+
+  for (const row of rows) {
+    const impl = rendezvous.get(row.via) ?? rendezvous.get(VIA_MANAGER_SSH)
+    assert.notEqual(impl, undefined, `${row.id} 的 via=${row.via} 必须能选到实现`)
+    const reach = await impl.resolve(nameOf(row))
+    assert.notEqual(reach, undefined, `${row.id} 必须能解析出可达性`)
+    assert.equal(reach.via, row.via, `${row.id} 解析后 via 变了`)
+    assert.equal(reach.hostId, row.id, `${row.id} 解析出的 hostId 必须是**裸** id`)
+    assert.equal(reach.networkId, 'ops', `${row.id} 解析出的网络段必须是 ops`)
+    // 判据：新路径拼出来的基址 == 旧路径直接用的 endpoint
+    assert.equal(agentBaseUrlOf({ hostId: row.id, reachability: reach }), row.endpoint, `${row.id} 取址变了`)
+    assert.equal(agentBaseUrlOf({ hostId: row.id, agentUrl: row.endpoint }), row.endpoint, `${row.id} 旧路径变了`)
+  }
+})
+
+test('S2：via 认不出来 ⇒ 回退 manager-ssh，不抛（过渡期要能跑）', async () => {
+  const hostAddresses = new Map([['w-x', '10.0.0.9:19000']])
+  const rendezvous = new RendezvousRegistry([
+    new LocalRendezvous((id) => hostAddresses.get(id)),
+    new ManagerSshRendezvous({ target: '', addressOf: (id) => hostAddresses.get(id) }),
+  ])
+  const impl = rendezvous.get('relay:not-deployed-yet') ?? rendezvous.get(VIA_MANAGER_SSH)
+  const reach = await impl.resolve('w-x')
+  assert.equal(reach.via, VIA_MANAGER_SSH)
+  assert.equal(agentBaseUrlOf({ hostId: 'w-x', reachability: reach }), 'http://10.0.0.9:19000')
+})