@@ -1,6 +1,6 @@
 [package]
 name = "mega2"
-version = "0.41.3"
+version = "0.41.4"
 edition = "2024"
 license = "MIT OR Apache-2.0"
 description = "Monorepo engine and Git hosting server for AI agents: trunk-based storage, Git Smart HTTP, Git LFS, OCI registry, and Agent Session Capture"
 
@@ -706,7 +706,7 @@
 ### Task BB-02: 共享 smoke runner 库
 
 **Task type:** `implementation`  
-**Lifecycle / Acceptance:** `pending` / （空）  
+**Lifecycle / Acceptance:** `in-progress` / `remote-pending`（v0.41.4；Codex R2 PASS；C 组 2023 测试通过；待 Release 与 D 组 `docker` job）  
 **Description:** 新建 `scripts/lib/smoke-runner.sh`（`run_case`、`optin_case`、`print_summary`、`redact`、`finish`）实现 ADR-BB-04 §3/§4 的输出与退出码契约，并附自测 `scripts/lib/smoke-runner.selftest.sh`（桩 case 覆盖各退出码路径）。唯一行为轴：smoke 输出 / 退出码契约。  
 **Out of scope:** 迁移既有脚本（ADR-BB-01，永久非目标于本计划）；libra 作用域文档（BB-05）；域脚本（BB-10 / BB-30 / BB-50）。  
 **Current evidence:**
 
@@ -0,0 +1,70 @@
+#!/usr/bin/env bash
+# Self-test for scripts/lib/smoke-runner.sh: exercises every exit-code path
+# with stub cases and prints one `selftest ok:` line per assertion.
+set -euo pipefail
+LIB="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)/smoke-runner.sh"
+tmp=$(mktemp -d)
+trap 'rm -rf "$tmp"' EXIT
+
+stub() {
+    cat > "$tmp/stub.sh" <<STUB
+#!/usr/bin/env bash
+source "$LIB"
+smoke_init "selftest"
+ok() { true; }
+bad() { false; }
+$1
+finish
+STUB
+}
+
+expect_rc() {
+    local want="$1" label="$2" rc=0
+    shift 2
+    "$@" > "$tmp/out.txt" 2>&1 || rc=$?
+    if [ "$rc" -ne "$want" ]; then
+        echo "selftest FAIL: $label (exit $rc, want $want)" >&2
+        cat "$tmp/out.txt" >&2
+        exit 1
+    fi
+}
+
+last_line_is() {
+    [ "$(tail -n 1 "$tmp/out.txt")" = "$1" ] || {
+        echo "selftest FAIL: last line is '$(tail -n 1 "$tmp/out.txt")', want '$1'" >&2
+        exit 1
+    }
+}
+
+stub 'run_case "a" ok; run_case "b" ok; skip_case "s" "not here"'
+expect_rc 0 "all pass" env -u MEGA2_SMOKE_CASE bash "$tmp/stub.sh"
+last_line_is 'selftest smoke storage_only summary: 2 passed, 0 failed (1 skipped)'
+grep -A1 -x '==> s' "$tmp/out.txt" | grep -qx 'SKIP: s (not here)'
+echo "selftest ok: all PASS exits 0"
+
+stub 'failing_then_ok() { false; true; }; run_case "a" ok; run_case "b" failing_then_ok'
+expect_rc 1 "one fail" env -u MEGA2_SMOKE_CASE bash "$tmp/stub.sh"
+grep -qx 'FAIL: b' "$tmp/out.txt"
+echo "selftest ok: any FAIL exits 1"
+
+stub 'run_case "a" ok'
+expect_rc 2 "unmatched" env MEGA2_SMOKE_CASE="nope" bash "$tmp/stub.sh"
+last_line_is 'selftest smoke storage_only summary: 0 passed, 0 failed (0 skipped)'
+echo "selftest ok: unmatched MEGA2_SMOKE_CASE exits 2"
+
+stub 'optin_case "o" SELFTEST_SWITCH ok; skip_case "s" "not here"'
+expect_rc 2 "opt-in named without switch" env -u SELFTEST_SWITCH MEGA2_SMOKE_CASE="o" bash "$tmp/stub.sh"
+last_line_is 'selftest smoke storage_only summary: 0 passed, 0 failed (0 skipped)'
+expect_rc 2 "skip_case named" env MEGA2_SMOKE_CASE="s" bash "$tmp/stub.sh"
+last_line_is 'selftest smoke storage_only summary: 0 passed, 0 failed (0 skipped)'
+echo "selftest ok: named opt-in without switch exits 2"
+
+stub 'run_case "a" ok; run_case "b" bad; optin_case "o" SELFTEST_SWITCH ok; skip_case "s" "not here"'
+expect_rc 0 "filtered summary" env -u SELFTEST_SWITCH MEGA2_SMOKE_CASE="a" bash "$tmp/stub.sh"
+last_line_is 'selftest smoke storage_only summary: 1 passed, 0 failed (0 skipped)'
+echo "selftest ok: summary counts only executed cases"
+
+# shellcheck source=scripts/lib/smoke-runner.sh disable=SC1091
+out=$(printf 'url http://x:%s@h/r?sig=abc\n' 'a+b.c' | (source "$LIB"; redact 'a+b.c'))
+[ "$out" = 'url http://x:***@h/r?***' ]
+echo "selftest ok: redact replaces the token and strips URL queries"
@@ -0,0 +1,130 @@
+#!/usr/bin/env bash
+# Shared case runner for the plan-20261001 storage-only smoke scripts
+# (oci_client / artifacts / libra). Contract: ADR-BB-04 §3/§4.
+#
+#   source scripts/lib/smoke-runner.sh
+#   smoke_init "oci client"            # summary label
+#   require_tools curl jq             # exit 2 when a tool is missing
+#   run_case "OCI ping" case_ping      # default-stack case
+#   optin_case "OCI x (none)" MEGA2_SMOKE_AUTH_NONE case_x
+#   skip_case "OCI y" "reason"         # registered but not runnable here
+#   finish                             # summary + exit code
+#
+# Case functions run in a subshell with `set -e` in effect, so any failing
+# command fails the case (no `|| return 1` bookkeeping needed).
+#
+# Output: `==> <case>`, then `PASS: <case>` / `FAIL: <case>` /
+# `SKIP: <case> (<reason>)`; last line
+# `<label> smoke storage_only summary: <N> passed, <M> failed (<K> skipped)`.
+# Exit: 0 = no failure (and, when MEGA2_SMOKE_CASE is set, that case passed);
+# 1 = any failure; 2 = unmatched MEGA2_SMOKE_CASE, missing tool, or a named
+# opt-in case whose switch is not set. Cases filtered out by MEGA2_SMOKE_CASE
+# are not counted.
+
+SMOKE_LABEL=""
+SMOKE_CASE_FILTER="${MEGA2_SMOKE_CASE:-}"
+SMOKE_CASE_HIT=0
+SMOKE_PASS=0
+SMOKE_FAIL=0
+SMOKE_SKIP=0
+
+smoke_init() {
+    SMOKE_LABEL="$1"
+}
+
+# smoke_die <message>: exit 2; the summary stays the last line of output.
+smoke_die() {
+    echo "ERROR: $*" >&2
+    print_summary
+    exit 2
+}
+
+require_tools() {
+    local tool
+    for tool in "$@"; do
+        command -v "$tool" >/dev/null 2>&1 || smoke_die "required tool not found: $tool"
+    done
+}
+
+# smoke_selected <name>: true when the case should be considered at all.
+smoke_selected() {
+    [ -z "$SMOKE_CASE_FILTER" ] || [ "$SMOKE_CASE_FILTER" = "$1" ]
+}
+
+run_case() {
+    local name="$1" fn="$2" rc=0 had_errexit=0
+    smoke_selected "$name" || return 0
+    SMOKE_CASE_HIT=1
+    echo "==> $name"
+    # Not inside an `if`/`||` condition: that would disable `set -e` in the
+    # case body and let `false; true` pass.
+    case $- in *e*) had_errexit=1 ;; esac
+    set +e
+    ( set -e; "$fn" )
+    rc=$?
+    if [ "$had_errexit" -eq 1 ]; then set -e; fi
+    if [ "$rc" -eq 0 ]; then
+        SMOKE_PASS=$((SMOKE_PASS + 1))
+        echo "PASS: $name"
+    else
+        SMOKE_FAIL=$((SMOKE_FAIL + 1))
+        echo "FAIL: $name" >&2
+    fi
+}
+
+# skip_case <name> <reason>: a registered case that cannot run in this
+# environment. Counted as skipped; naming it in MEGA2_SMOKE_CASE exits 2.
+skip_case() {
+    local name="$1" reason="$2"
+    smoke_selected "$name" || return 0
+    SMOKE_CASE_HIT=1
+    if [ -n "$SMOKE_CASE_FILTER" ]; then
+        smoke_die "case '$name' requested but cannot run: $reason"
+    fi
+    SMOKE_SKIP=$((SMOKE_SKIP + 1))
+    echo "==> $name"
+    echo "SKIP: $name ($reason)"
+}
+
+# optin_case <name> <switch-var> <fn>: runs only when ${switch-var}=1.
+optin_case() {
+    local name="$1" switch="$2" fn="$3"
+    smoke_selected "$name" || return 0
+    SMOKE_CASE_HIT=1
+    if [ "${!switch:-0}" != "1" ]; then
+        if [ -n "$SMOKE_CASE_FILTER" ]; then
+            smoke_die "opt-in case '$name' requested but $switch=1 is not set"
+        fi
+        SMOKE_SKIP=$((SMOKE_SKIP + 1))
+        echo "==> $name"
+        echo "SKIP: $name ($switch not set)"
+        return 0
+    fi
+    run_case "$name" "$fn"
+}
+
+print_summary() {
+    echo "$SMOKE_LABEL smoke storage_only summary: $SMOKE_PASS passed, $SMOKE_FAIL failed ($SMOKE_SKIP skipped)"
+}
+
+# require_case_filter_hit: exit 2 when MEGA2_SMOKE_CASE matched no case.
+require_case_filter_hit() {
+    if [ -n "$SMOKE_CASE_FILTER" ] && [ "$SMOKE_CASE_HIT" -eq 0 ]; then
+        smoke_die "MEGA2_SMOKE_CASE did not match any case: $SMOKE_CASE_FILTER"
+    fi
+}
+
+finish() {
+    require_case_filter_hit
+    print_summary
+    if [ "$SMOKE_FAIL" -gt 0 ]; then
+        exit 1
+    fi
+    exit 0
+}
+
+# redact <token>: stdin -> stdout with the literal token replaced by *** and
+# every URL query removed (signed URLs carry credentials in the query).
+redact() {
+    TOK="${1:-}" perl -pe 'BEGIN{$t=$ENV{TOK}} s/\Q$t\E/***/g if length $t; s{(https?://[^\s"?]+)\?[^\s"]*}{$1?***}g'
+}