Intelligent toy multi-model adaptation and routing scheduling method, system, device and medium

Abstract

The application discloses a smart toy multi-model adaptation and routing scheduling method, relates to the technical field of smart toy heterogeneous model service scheduling, constructs a toy interaction constraint object, executes safety privacy and model capability hard gating according to the model capability confirmed by contract testing, determines a target model and a backup chain in combination with scene operation snapshots, a first compliant executable response, migration cost and hysteresis conditions; aggregates flow fragments into candidate semantic units, assigns a channel logic serial number after inspection, writes into a prepared and transaction outbox record, and promotes a continuous confirmed prefix confirmation water level according to a start execution confirmation; when a recoverable service fault occurs, unconfirmed records are reserved, a migratable session snapshot is constructed according to the assigned water level and the confirmation water level, overlapping semantics are removed and continuous generation is carried out from unoccupied logical positions, so that repeated output and action execution are reduced. The application also discloses a corresponding system, an electronic device and a storage medium.

Description

Technical Field

[0001] This invention relates to the field of service scheduling technology for heterogeneous models of intelligent toys, specifically to methods, systems, devices, and media for multi-model adaptation and routing scheduling of intelligent toys. Background Technology

[0002] Existing smart toys typically use a terminal for voice activation and image capture, along with some simple preprocessing. They then call upon cloud-based language models, speech models, or multimodal models, converting the results into text, audio, facial expressions, or gestures. To ensure compatibility with different vendors, an interface adapter is usually set up to select the model service based on request type, response latency, node load, or historical success rate.

[0003] US Patent 12236193B1 discloses an automatic large language model selection technology in a cloud computing environment. This technology involves a model selection system receiving a request from an application service, using a classification model to determine the request's type, then selecting the corresponding model from multiple candidate large language models based on the classification result, and finally returning the selection result to the application service. The classification model accepts a text request and outputs a preset category, while the candidate models have pre-established relationships with each category, and different requests are distributed to the appropriate model. The key to this solution is how to achieve model selection and invocation through request classification.

[0004] The aforementioned technologies can select the appropriate model based on the request category, but problems still exist in interactive scenarios with continuous, multi-turn, and multi-output channels in smart toys: different model interfaces differ in input modality, context capacity, support for streaming formats, action fields, error codes, and data reception range. Selecting solely based on request category or performance metrics cannot determine the actual usability of the selected model on the current interface link. Children's content safety, parental authorization, privacy upload scope, and action execution conditions are irreplaceable. Comparing them uniformly with metrics such as latency and load may lead to nodes with good performance metrics but not meeting constraints being selected. The first character or token returned by the model may also be semantically incomplete, unable to be played or executed directly, making it difficult to reflect the actual response time on the toy's end. When the model stream is interrupted and switches to the next node, it may be unable to distinguish between content that has been output, content that has not been confirmed, or content that has not yet been generated, leading to problems such as repeated speech, replayed facial expressions, or repeated actions.

[0005] Therefore, existing technologies still need to consider how to balance the effectiveness of model selection, the consistency of terminal response, and the continuity of fault switching in the context of continuous interaction among multiple models. Summary of the Invention

[0006] (a) Technical problems to be solved To address the shortcomings of existing technologies, this invention provides a method, system, device, and medium for multi-model adaptation and routing scheduling of intelligent toys. It determines the target model and backup chain by combining scenario runtime snapshots, the first compliant executable response, migration costs, and hysteresis conditions. It aggregates stream segments into candidate semantic units, assigns channel logical sequence numbers after inspection, and writes them into the prepared and transaction sender records. It advances the confirmation water level of continuously confirmed prefixes based on the start of execution confirmation. In the event of a recoverable service failure, it constructs a migrateable session snapshot based on the assigned and confirmed water levels, eliminates overlapping semantics, and continues to generate from unoccupied logical positions to reduce duplicate output and action execution. This invention solves the technical problems described in the background art.

[0007] (II) Technical Solution To achieve the above objectives, the present invention provides the following technical solution: The multi-model adaptation and routing scheduling method for intelligent toys is executed by the scheduling system: Construct request objects and interaction constraint objects, and execute security and privacy hard gating and model capability hard gating in sequence based on the tested and confirmed model capability contract; If no qualified candidate is found, output local security content. If a qualified candidate is found, estimate the first compliant executable response based on the scenario snapshot, and determine the target model and backup chain by combining migration cost and hysteresis conditions. Aggregate target model stream fragments into candidate semantic units; if the check passes, assign a channel logical sequence number and atomically write it to the prepared record and transaction sender box record; if it fails, do not occupy a sequence number; advance the confirmation level of consecutive confirmed prefixes based on the start of execution confirmation; In the event of a recoverable service failure, unconfirmed prepared records are retained, a migrated session snapshot is constructed based on the allocation level and confirmation level, the system switches to a standby model that is re-gated by hard gating, overlapping semantics are removed, and sequence numbers are reassigned from the idle logical positions after the allocation level.

[0008] Furthermore, the model capability contract is generated after the adapter instance submits the capability summary and version fingerprint; the adapter and the capability contract server issue preset test vectors to verify unified request encoding, stream event conversion, standard error normalization and measurement caliber conversion respectively; When the test passes, a valid capability bit is written and the corresponding capability path is opened; when the test fails, an invalid capability bit is written and allocation stops. When the version fingerprint changes, the original valid capability bit is revoked and the test is re-tested; when there is no change, the original valid capability bit is maintained.

[0009] Furthermore, the security and privacy hard gating checks the child safety policy, parental authorization status, privacy upload scope, and allowed execution locations in sequence; the model capability hard gating checks the input modality, context capacity, stream event transformation, target output channel, action capability, adapter self-test status, service availability status, and single request budget in sequence. If any applicable item is missing, has an inconsistent version, is in an unknown state, or fails the check, the corresponding model is excluded and a reason code is output. If all applicable items pass, the model is added to the qualified candidate set.

[0010] Furthermore, scenario runtime snapshots are organized into scenario buckets based on model version, request modality, security level, network category, target output channel, and confirmation criteria; the observation period for the first compliant and executable response begins when the unified request gateway fully receives the request and ends when the first standardized flow event completes aggregation, inspection, submission, and delivery and obtains confirmation to begin execution. When an execution start confirmation is obtained, it is written to the scene bucket corresponding to the confirmation type. When only a receive confirmation is obtained, the receive confirmation is used as the proxy endpoint and written to the scene bucket of another confirmation type.

[0011] Furthermore, after the candidate semantic unit check passes, the next logical sequence number is assigned after the allocation watermark of the corresponding output channel, and the allocation watermark is advanced, the prepared record is written, the transaction sender box record is written, and the payload summary and strategy version are saved in the same persistent transaction; the persistent transaction does not take effect if any write fails; after obtaining the start execution confirmation, it is updated to confirmed, and the confirmation watermark is only advanced along the consecutive confirmed prefixes, and the subsequent confirmed does not cross the gap of the previous one.

[0012] A multi-model adaptation and routing scheduling system for intelligent toys, including: A unified request gateway and a context construction server are used. The unified request gateway receives interaction requests, and the context construction server forms a unified request object and a toy interaction constraint object based on the interaction requests. The adapter and capability contract server and the scenario runtime snapshot store store scenario runtime snapshots corresponding to model version, request modality, network type, output channel and confirmation caliber. The system includes a dual-layer gating processor and a routing scheduler. The dual-layer gating processor executes security and privacy hard gating and model capability hard gating sequentially based on the toy interaction constraint object and the model capability contract. If no qualified candidate set is formed, it generates a local security response instruction. If a qualified candidate set is formed, the routing scheduler determines the target model and backup chain based on the scene runtime snapshot, session migration cost, and hysteresis condition. The system also includes a standard stream event processor and a security and executability checker. The standard stream event processor aggregates the stream fragments returned by the target model into candidate semantic units, and the security and executability checker performs security and executability checks on the candidate semantic units. The commit and session state storage includes a transaction sender box, a commit state record area, and a migrated session snapshot area. When the candidate semantic unit check passes, the commit and session state storage allocates a channel logical sequence number and atomically writes it to the prepared record and the transaction sender box record. When the candidate semantic unit check fails, no channel logical sequence number is allocated, and the confirmation water level corresponding to the continuously confirmed prefix is ​​advanced according to the start of execution confirmation. The fault rollback controller retains unconfirmed prepared records when a recoverable service failure occurs in the target model. It constructs a migrated session snapshot based on the allocation level, confirmation level, and session state. It controls the generation of candidate semantic units from the backup model through security and privacy hard gating and model capability hard gating, removes semantics that overlap with existing records, and continues to allocate channel logical sequence numbers from unoccupied logical positions after the allocation level. The observation feedback server updates the scenario running snapshot based on the start execution confirmation, model failure state, and duplication suppression results.

[0013] An electronic device includes a processor, a memory, a communication bus, a network interface, and an input / output interface. The processor is connected to the memory, the network interface, and the input / output interface via the communication bus. The memory stores a computer program, and when the computer program is executed by the processor, the processor: Construct a unified request object and a toy interaction constraint object, and execute security and privacy hard gating and model capability hard gating based on the model capability contract confirmed by contract testing; When no qualified candidate set is formed, a local security response instruction is generated. When a qualified candidate set is formed, the target model and backup chain are determined based on the scenario runtime snapshot, session migration cost, and hysteresis condition. The stream fragments returned by the target model are aggregated into candidate semantic units. Safety and executability checks are performed on the candidate semantic units. If the check passes, a channel logical sequence number is assigned and atomically written to the prepared record and the transaction sender box record. If the check fails, a channel logical sequence number is not assigned, and the confirmation level corresponding to the continuous confirmed prefix is ​​advanced according to the start of execution confirmation. When the target model experiences a recoverable service failure, unconfirmed prepared records are retained. A migrated session snapshot is constructed based on the allocation level, confirmation level, and session state. A backup model that has passed the security and privacy hard gating and model capability hard gating is selected. Overlapping semantics are removed, and channel logical sequence numbers are continued to be allocated from the unoccupied logical positions after the allocation level. Update the scenario runtime snapshot based on the start confirmation, model fault status, and repetition suppression results.

[0014] A non-transitory computer-readable storage medium having a computer program stored thereon, which, when executed by a processor, causes the processor to: Construct a unified request object and a toy interaction constraint object, and execute security and privacy hard gating and model capability hard gating in sequence according to the model capability contract confirmed by contract testing; When no qualified candidate set is formed, a local security response instruction is generated. When a qualified candidate set is formed, the target model and backup chain are determined based on the scenario runtime snapshot, session migration cost, and hysteresis condition. Aggregate the stream fragments returned by the target model to form candidate semantic units. Perform safety and executability checks on the candidate semantic units. If the check passes, assign a channel logical sequence number and atomically write it to the prepared record and the transaction sender box record. If the check fails, do not assign a channel logical sequence number and advance the confirmation water level corresponding to the continuous confirmed prefix according to the start of execution confirmation. When the target model experiences a recoverable service failure, the unconfirmed prepared records are retained. A migrated session snapshot is constructed based on the allocation level, confirmation level, and session state. The system switches to a backup model that has passed the security and privacy hard gating and model capability hard gating again. Overlapping semantics are removed, and channel logical sequence numbers are continued to be allocated from the unoccupied logical positions after the allocation level. Update the scenario runtime snapshot based on the start confirmation, model fault status, and repetition suppression results.

[0015] (III) Beneficial Effects This invention provides a method, system, device, and medium for multi-model adaptation and routing scheduling of intelligent toys, which has the following beneficial effects: The capability contracts of the model are generated through contract testing. When the adapter version or field mapping changes, the original capability state is revoked and re-verified. This ensures that the use of callable capabilities is based on the actual protocol conversion results, reducing call exceptions caused by inconsistencies in stream event conversion and error normalization.

[0016] Security and privacy hard gating and model capability hard gating are executed sequentially. Only models that meet all applicable conditions are allowed to perform soft comparisons (i.e., latency, load, and resource consumption cannot compensate for missing conditions such as child safety, parental authorization, privacy scope, execution location, and model capability). The first executable response that meets the requirements is used as the routing criterion. Request reception, model generation, semantic aggregation, security checks, event submission, and terminal execution are all placed in an observation chain to prevent the first segment with incomplete semantics or that is not executable from becoming a valid response.

[0017] Only after the candidate semantic unit check passes will the channel logical sequence number be assigned and the allocation water level be atomically written, along with the prepared records and transaction sender records. After obtaining the start of execution confirmation, the confirmation water level is advanced only along the consecutive confirmed prefixes to prevent failed content from occupying the water level and subsequent confirmations from crossing the gaps of the preceding sequence.

[0018] When a recoverable failure occurs in the model stream, records that have been allocated but not confirmed are retained. Based on the double watermark and the session state, a transferable session snapshot is constructed, and the output of the backup model is compared with the overlap, so that new content continues to be allocated in positions that have never been occupied, thereby reducing the risk of repeated execution of voice, facial expressions, and actions. Attached Figure Description

[0019] Figure 1 This is a schematic diagram of the edge-side autonomous routing deployment and interaction boundary of the present invention; Figure 2 This is a schematic diagram illustrating the cloud-based centralized routing and device-side execution gate deployment and interaction boundary of the present invention; Figure 3 This is a schematic diagram illustrating the decoupled deployment and event exchange based on a message bus according to the present invention; Figure 4 This is a schematic diagram of the overall architecture and data control flow of the multi-model heterogeneous adaptation and routing scheduling system for smart toys according to the present invention; Figure 5 This is a flowchart of the intelligent toy multi-model adaptation and routing scheduling method of the present invention; Figure 6 This is a flowchart of the adapter contract self-test and capability contract generation process of the present invention; Figure 7 This is a schematic diagram of the dual-layer hard gating and hysteresis routing with session migration cost of the present invention; Figure 8 This is the timing diagram of the first compliant and executable response latency of this invention; Figure 9 This is a schematic diagram illustrating the standard flow event aggregation, inspection, and dual-level water level propulsion in this invention. Figure 10This is a timing diagram of the model flow fault switching and recovery from the submission boundary in this invention; Figure 11 This is a diagram showing the relationship between snapshot bucketing and observation feedback updates in the scenario of this invention. Figure 12 This is a diagram showing the global abnormal state, security degradation, and recovery state transitions of this invention. Figure 13 This is a schematic diagram of the hardware structure of the electronic device of the present invention; Figure 14 This is a diagram illustrating the multi-output channel dependency barrier and idempotent execution relationship of the present invention. Detailed Implementation

[0020] The technical solutions of the embodiments of the present invention will be clearly and completely described below with reference to the accompanying drawings. Obviously, the described embodiments are only some embodiments of the present invention, and not all embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those skilled in the art without creative effort are within the scope of protection of the present invention.

[0021] Please see Figures 1-14 This invention provides a method, system, device, and medium for multi-model adaptation and routing scheduling of smart toys. It is designed for smart toys with voice, image, facial expression, or action interaction capabilities. After completing voice wake-up, sound or image acquisition, and necessary on-device preprocessing, the smart toy terminal can call upon language models, speech models, and multimodal models located locally on the toy, at the home edge node, at the operational edge node, or in the cloud, and convert the model output into voice, facial expression, or action. Different model services differ in authentication fields, message roles, context boundaries, input / output modalities, streaming event formats, action intent expressions, error codes, and measurement standards. Simply performing field conversion or routing based on latency, cost, and load makes it difficult to verify the true usability of the adapter's claimed capabilities, and also makes it difficult to ensure that constraints such as child safety, parental authorization, privacy upload scope, permitted execution locations, and action safety levels are not negated by soft scoring.

[0022] In continuous interactive scenarios, the first character fragment or token returned by the manufacturer usually has not yet formed a complete playable statement, audio frame, facial expression resource, or action instruction, and may not have completed child-friendly content checks. Therefore, it cannot directly represent the moment when the child actually hears the sound, sees the expression, or the toy begins to move. If the model with the highest instantaneous score is selected in each round, it will also cause repeated context transmission, character state reconstruction, and incomplete event migration. If a backup model is called directly from the beginning after the model stream is interrupted, repeated playback, repeated display, or repeated execution of actions may occur.

[0023] The technical problem to be solved by this implementation is to establish a continuous processing chain under the conditions that the smart toy terminal, edge node and multiple heterogeneous model service nodes participate in the interaction, and the network status, model load, device status and policy version change, from the formation of interaction request constraints, model capability verification, candidate model hard gating, routing of the first compliant executable response, session migration hysteresis, submission of normative flow events, fault continuation and even the callback of observation parameters. This ensures that security and privacy conditions are not relaxed by soft scoring, that the model routing results are associated with the actual execution time of the toy terminal, and that fault switching can identify confirmed prefixes by the confirmation level of each output channel, determine the starting position of new events by the allocation level, and continue in the unoccupied logical position while retaining the allocated but unconfirmed records.

[0024] like Figures 1 to 3 As shown, each processing entity can be deployed according to different logical boundaries. Figure 1 The edge-side autonomous routing implementation shown places the context construction server 130, capability contract memory 142, scene runtime snapshot memory 150, dual-layer gating processor 160, route scheduling processor 170, transaction sending box 211, commit status record area 212 and fault rollback controller 220 on the edge side or end side, and the remote service side provides model service cluster 180 and observation feedback server 230. Figure 2 The cloud-based centralized routing and device-side execution gate implementation shown in the figure completes the request access, capability contract verification, gating, routing, standard flow processing and first execution check in the cloud. The smart toy terminal 110 retains the end-side processor 113, voice output component 115, expression display component 116, action execution component 117 and sensor feedback unit 118, and returns the start execution confirmation with the device-side execution gate. Figure 3 The message bus decoupling implementation shown exchanges requests, gating results, routing results, vendor stream fragments, specification events, and acknowledgment status via message bus 250. The above boundaries only indicate the logical deployment location of the processing entities and do not limit the specific physical device form or communication middleware product.

[0025] like Figure 4 As shown, the multi-model heterogeneous adaptation and routing scheduling system for smart toys provided in this embodiment includes a smart toy terminal 110, a unified request gateway 120, a context construction server 130, an adapter and capability contract server 140, a scene runtime snapshot memory 150, a two-layer gating processor 160, a routing scheduling processor 170, a model service cluster 180, a specification flow event processor 190, a security and executability checker 200, a submission and session state memory 210, a fault rollback controller 220, an observation feedback server 230, a policy configuration terminal 240, and a message bus 250.

[0026] The smart toy terminal 110 sends authorized data, device status, and session status to the unified request gateway 120; the context construction server 130 generates unified request objects and toy interaction constraint objects; the adapter and capability contract server 140 provides capabilities that have passed the contract test; the scenario runtime snapshot storage 150 provides runtime status corresponding to model version, request modality, network category, output channel, and confirmation caliber; the dual-layer gating processor 160 first filters out models that do not meet the requirements of child safety, authorization, privacy, location, and capability, and then the routing scheduling processor 170 selects the target model and backup chain from the qualified candidates based on the latency of the first compliant executable response, service status, load, resource consumption, and session migration cost.

[0027] The vendor stream fragments returned by the model service cluster 180 are not directly sent to the toy client. Instead, after being aggregated into candidate semantic units by the standard stream event processor 190, they are checked by the security and executability checker 200 and then assigned channel logical sequence numbers by the commit and session state storage 210 and written into the transaction record. When the toy client returns an acknowledgment after starting a broadcast, display, or initiation action, the acknowledgment level of each output channel can be advanced. In the event of a recoverable service failure, the fault rollback controller 220 saves the allocated but unacknowledged records and constructs a migrated session snapshot based on the allocation level, acknowledgment level, and session state. The backup model continues to be generated from the unoccupied position. The observation feedback server 230 updates the running snapshot used for subsequent routing based on the actual execution acknowledgments, failures, and duplication suppression results.

[0028] It should be noted that: the toy interaction constraint object is used to describe the conditions that cannot be relaxed by routing scoring in this round of interaction and the scenario information required for routing (at least including request modality, target output channel, session identifier, round identifier, role identifier, child safety policy and version, parental authorization status, privacy level, allowed execution location, end-side processing capability, network category, context length, response budget, and action security level). It is independent of the model request text and runs through multiple processing nodes before model invocation, event submission, and failover, so that each node uses the same policy version and authorization caliber. The unified request object is a standardized request that is received by all adapter instances, including standardized message roles, text content, audio references, image references or end-side feature references, tool invocation constraints, action intent constraints, streaming tags, sampling parameters, and link tracing identifiers, etc. It only carries the data that the toy interaction constraint object allows to be transmitted. For example, the original audio payload will not be carried only when the recognized text is allowed to be uploaded to the cloud, thereby isolating the toy business structure and the manufacturer's private fields.

[0029] A model capability contract represents the actual, invoked capabilities of a model service node after verification. It includes at least: model and adapter versions, supported input modalities and output channels, context capacity, streaming event types, action intent capabilities, execution location, allowed data formats, authentication and metering methods, source of child-friendly content capabilities, field mapping capabilities, and contract self-check status. Capability bits are written based on the results of contract testing, not directly obtained from the provider; capabilities that have not passed field mapping, streaming conversion, error normalization, or metering conversion tests are invalid.

[0030] A scenario runtime snapshot is a set of runtime states formed for a specific model version and use case. It records at least the latency of the first compliant executable response, end-to-end completion latency, success status, queue load, connection load, resource consumption, service failure, security failure, circuit breaker status, data freshness, and confidence level. Snapshots are stored in buckets according to model version, request modality, security level, network type, target output channel, and confirmation criteria. When the model version or confirmation criteria change, the previous bucket is not directly reused. If there are insufficient samples, the snapshot will fall back to the adjacent scenario in a pre-defined order and the confidence level will be reduced.

[0031] The first compliant and executable response refers to the first event in which the model fragment has completed vendor protocol parsing, semantic aggregation, child-friendly content checks, and target channel integrity checks, and is idempotently received by the toy end and returns a confirmation to begin execution. For the voice channel, confirmation is the start of outputting a complete text or audio frame; for the facial expression channel, confirmation is the loading of resources and completion of display buffer switching; and for the action channel, confirmation is the acceptance of action parameters and entry into the startup state. When the device can only return a confirmation of receipt, the confirmation is used as the endpoint of the proxy, and the proxy's caliber and the actual execution caliber are statistically analyzed separately.

[0032] Vendor stream fragments refer to the original or preliminarily parsed fragments received by the adapter from the model service node. They do not have direct submission qualifications, but only carry the source fragment sequence number and stream call round information.

[0033] The standard stream event processor aggregates segments according to the output channel to form candidate semantic units: text or speech units are formed based on sentence end, pause, synthesis segmentation boundary and buffer limit; audio units are a group of complete frames that are temporally continuous and encoded the same; facial expression units have at least a resource identifier and a persistence state; action units have at least an action identifier, parameter set and execution prerequisites, etc.

[0034] A canonical flow event is a submitable event formed after candidate semantic units have passed security and executability checks. It includes at least the session identifier, round identifier, flow call round, output channel, channel logical sequence number, semantic unit identifier, event type, payload, source model, security status, executable status, delivery status, action identifier, dependency barrier identifier, and link tracing identifier. Vendor-native fragment sequence numbers are only used for tracing, while platform channel logical sequence numbers are used for delivery, confirmation, deduplication, and fault recovery.

[0035] Each output channel maintains an allocation watermark and an acknowledgment watermark. The allocation watermark represents the maximum logical sequence number already occupied by the channel; the acknowledgment watermark represents the maximum logical sequence number continuously obtained from the start sequence number for execution acknowledgment. The allocation watermark advances when a safe and executable semantic unit is written to the commit record, and the acknowledgment watermark advances when the toy returns to the start of execution acknowledgment and there are no gaps in the preceding sequence. Allocated sequence numbers are not reassigned to other payloads even if delivery fails. In this embodiment, the commit boundary is jointly determined by the continuous acknowledged prefix defined by the acknowledgment watermark and the upper bound of occupied sequence numbers defined by the allocation watermark; new events after a failover continue to request sequence numbers from unoccupied logical positions after the allocation watermark, rather than reusing already allocated but unacknowledged sequence numbers after the acknowledgment watermark.

[0036] The "Ready" state indicates that the canonical flow event has obtained a logical sequence number and been associated with the delivery record in the transaction sender's mailbox, but has not yet received a downstream confirmation to begin execution. The "Confirmed" state indicates that the canonical flow event has been delivered to the corresponding output component, and the toy terminal has returned a confirmation to begin execution or an equivalent acceptance confirmation for the same commit key. Ready records can be repeatedly delivered using the same commit key and the same payload. The toy terminal returns the original result for the same key and the same payload, and refuses execution and reports a conflict for the same key but a different payload. Therefore, the "Confirmed" state is formed after the output component receives the event and begins execution, and does not replace the execution confirmation with the internal processing state before the event reaches the output component.

[0037] Migrative session snapshots are recovery objects formed based on persistent state when a model call is interrupted or a model is switched. They include at least the confirmed canonical message, role identifier, security policy version, round identifier, current stream call round, allocation and confirmation watermarks for each output channel, unconfirmed prepared records, confirmed semantic units, payload summary or offset, uncommitted semantics, unconfirmed action states, and source model. Migrated content remains subject to privacy restrictions and prohibited original audio or images will not be reinstated after fault recovery.

[0038] The stable round identifier used in the same round of toy interaction will generate an incrementing stream call round when the main model or the backup model is called in each round. When the backup model starts to output, the fragments that are returned late by the original model will be isolated because they have older stream call rounds and will not be added to the current buffer to be submitted, so as to avoid cross-writing of different model streams.

[0039] Dependency barriers are used to represent the execution order between different output channels. For example, they may require voice events to be confirmed before action events, or require facial expression events and voice events to be ready before release. Dependency barriers are control attributes within the normalized flow of events and do not constitute independent hardware components. A loop-free check is performed before writing cross-channel sequence relationships; if a newly added cross-channel sequence relationship may form a cycle, the writing of the new cross-channel sequence relationship is rejected, and the related action is either not executed, the voice is converted to independent output, or a local security response is initiated. Figure 14 As shown, voice, facial expression, and motion channels that are independent can be delivered and confirmed separately, while motion events that are dependent are released after the confirmation conditions of the preceding channel are met.

[0040] Two layers of hard gating are applied before any soft scoring: the first layer concerns child safety, parental authorization, privacy limits, and permitted execution locations; the second layer concerns input modality, context capacity, target output channel, streaming event transformation, action capabilities and adapter self-checks, service availability status, and individual request budget. Except for clearly inapplicable cases, all other missing fields, version inconsistencies, or unknown status are treated as failures, maintaining hard constraints in the absence of a qualified model, and outputting locally safe content.

[0041] The session migration cost includes the overhead of context transfer, role and security state transitions, uncommitted event handling, and model format conversion incurred when using a candidate model to replace the current model. Hysteresis is used to prevent excessive switching due to short-term load changes or a single delay. Switching only occurs when the current model still meets the hard gate requirement, provided that the overall gain of the candidate model is large enough to cover the migration cost and hysteresis requirements. If the current model loses its hard gate qualification or fails, the hold condition can be skipped, but the target model needs to pass the hard gate again.

[0042] Security failures include content non-compliance, insufficient authorization, privacy mismatch, actions not on the whitelist, or actions with out-of-bounds parameters; service failures include timeouts, rate limiting, connection interruptions, authentication errors, protocol parsing errors, and server unavailability. The original payload from a security failure will not be re-delivered as is, nor will it directly increase the service unavailability count; however, service failures will consume retry budget and update the circuit breaker status. The two types of failures are logged separately to avoid improving service metrics by lowering security standards.

[0043] like Figure 4 As shown, the intelligent toy terminal 110 includes a microphone 111, an image acquisition device 112, an edge processor 113, an edge communication module 114, a voice output component 115, an expression display component 116, an action execution component 117, a sensor feedback unit 118, and a local secure content storage 119. The edge processor 113 is connected to the microphone 111, the image acquisition device 112, the edge communication module 114, the voice output component 115, the expression display component 116, the action execution component 117, and the sensor feedback unit 118.

[0044] like Figure 4 As shown, the child's voice collected in microphone 111 is converted into a digital audio stream and sent to the edge processor 113; when the parent consents to visual interaction, the image acquisition device 112 acquires images or video frames. The edge processor 113 can be one or more processors with capabilities such as audio encoding and decoding, image preprocessing, storage management, and network protocol processing. It performs wake word detection, endpoint detection, noise reduction, or local speech recognition on the audio, and performs image cropping, occlusion, or feature extraction. It also decides whether to send the original payload, recognize text, or use edge features according to a privacy policy.

[0045] like Figure 4 As shown, the edge communication module 114 connects to the unified request gateway 120 via a wired or wireless network and is responsible for request sending, acknowledgment reception, disconnection buffering, and link status reporting. The voice output component 115 may include an audio decoding buffer, a digital-to-analog converter circuit, and a speaker; the facial expression display component 116 may include a display controller, a frame buffer, and a display panel; the motion execution component 117 may include a motion controller, a drive circuit, and one or more actuators; the sensing feedback unit 118 may include position, speed, current, posture, or contact status sensors to confirm whether the motion execution component 117 has entered the target state. The local secure content memory 119 stores preset neutral prompts, offline greetings, network fault prompts, and alternative content for motion-disabled states. When the unified request gateway 120 is unreachable, no model passes through the hard gate, or the motion execution component 117 enters a secure lock, the edge processor 113 reads the corresponding content from the local secure content memory 119 and drives the voice output component 115 or the facial expression display component 116 to output, without relaxing the privacy upload scope or motion security conditions.

[0046] For the intelligent toy terminal 110, depending on the different forms of the product, only a voice interaction component can be set, or image acquisition, expression display and action execution components can be added. If no corresponding input / output channel is set, it will be marked as unsuitable in the toy interaction constraint object, and the dual-layer gating processor 160 will exclude the model path that requires corresponding hardware feedback. This replacement will not affect privacy trimming, local security response and submission confirmation mechanism.

[0047] like Figure 4 As shown, the unified request gateway 120 is connected to the end-side communication module 114, the context construction server 130, and the message bus 250. After receiving a toy request, the unified request gateway 120 verifies the device identifier, request length, session identifier, round identifier, policy version, and request integrity, and assigns a link tracing identifier to each request. For duplicate requests with the same device, session, and round, the unified request gateway 120 returns an existing acceptance status and does not repeatedly initiate model calls. The context construction server 130 receives requests forwarded by the unified request gateway 120, security policies and authorization status provided by the policy configuration terminal 240, and network and actuator status reported by the smart toy terminal 110. The context construction server 130 forms a unified request object and a toy interaction constraint object, and writes both as the same transaction record to the message bus 250, enabling the dual-layer gating processor 160, the routing scheduling processor 170, and the security and executability checker 200 to read the same policy version.

[0048] The policy configuration terminal 240 provides child safety policies, parental authorizations, privacy scopes, and policy versions to the context construction server 130, the two-layer gating processor 160, the security and executability checker 200, and the observation feedback server 230. The message bus 250 can carry requests, gating results, routing results, vendor stream fragments, committable events, and acknowledgment statuses using publish-subscribe, queue delivery, or in-process event distribution methods; when using direct calls, it can be replaced by equivalent inter-process or intra-process call chains.

[0049] like Figure 4 As shown, the adapter and capability contract server 140 includes an adapter instance 141 and a capability contract storage 142. Each adapter instance 141 is connected to one or more model service nodes in the model service cluster 180 and performs operations such as unified request encoding, vendor stream fragment parsing, standard error conversion, and metering conversion. The capability contract storage 142 is used to store the capability bits and contract version fingerprints of each model service node and its corresponding adapter version.

[0050] like Figure 6In the process, after adapter instance 141 starts up or its version changes, it first sends a capability summary and version fingerprint to adapter and capability contract server 140. Then, adapter and capability contract server 140 issues pre-set test vectors to verify unified request encoding, stream event conversion, standard error normalization, and metering conversion, and compares the actual output results with the expected contract. If the test is successful, the status value of the capability bit is 1 to indicate that it is valid and can be allocated to capability contract memory 142; otherwise, it cannot be allocated to the corresponding capability path (i.e., the status value is 0), and no new requests are allocated to the corresponding path. When the heartbeat version fingerprint of adapter instance 141 changes, adapter and capability contract server 140 will revoke the previous capability bit and repeat the above steps until the new contract version passes, and then provide a valid capability bit to dual-layer gating processor 160 and routing scheduling processor 170.

[0051] This contract handshake enables the two-layer gating processor 160 to use verified streaming output capabilities, action capabilities, and error handling capabilities, instead of directly using the supplier's capability claims. If a model service node claims to have an action intent, but the adapter instance 141 cannot convert its action field into a canonical action event, the action capability bit is invalid, thereby preventing incomplete action parameters from entering the action execution component 117.

[0052] By mapping adapter version fingerprints, test vectors, and valid capability bits, it is possible to determine whether the protocol conversion chain is truly available before the model is invoked. When the adapter version or field mapping changes, the old capability bits are revoked, which helps to prevent the old contract from continuing to allocate requests to model service nodes whose formats have changed.

[0053] like Figure 4 In this system, the scene runtime snapshot storage 150 is connected to the adapter and capability contract server 140, the routing scheduler 170, and the observation feedback server 230, respectively. The scene runtime snapshot storage 150 can be implemented using persistent key-value storage, relational storage, or time-series storage, and is divided into scene buckets according to model version, request modality, security level, network type, output channel, and confirmation criteria.

[0054] like Figure 4As shown, the dual-layer gating processor 160 receives the toy interaction constraint object, the model capability contract, and the scene runtime snapshot, and performs first-layer security and privacy gating and second-layer model capability gating according to a fixed priority order; the dual-layer gating processor 160 outputs a qualified candidate set and a standard reason code for each excluded model. The routing and scheduling processor 170 only calculates the soft utility for the qualified candidate set and does not accept the soft score results of the excluded models.

[0055] like Figure 4 As shown, the routing scheduler 170 is connected to the model service cluster 180, the submission and session state storage 210, and the fault rollback controller 220. The routing scheduler 170 determines the target model and backup chain based on the first compliant executable response latency estimate, operational health, queue load, connection load, resource consumption, risk status, and session migration cost. After determining the target model, the routing scheduler 170 writes the current round call lease into the submission and session state storage 210. The call lease uses the session identifier and round identifier as keys, limiting only one stream call round to have primary write eligibility at any given time. The model service cluster 180 includes a first model service node 181, a second model service node 182, and a third model service node 183. Each model service node can be located locally on the toy, at the home edge, on the operational edge, or in the cloud, and its authentication method, input fields, streaming return format, and capability range can differ. The number of nodes mentioned above is for illustrative purposes only; in practice, two or more model service nodes can be configured.

[0056] like Figure 4 As shown, after the standard stream event processor 190 receives the vendor stream fragment output by the adapter instance 141, it writes it to the pending buffer according to the session identifier, round identifier, stream call round and output channel and generates a candidate semantic unit; after the security and executability checker 200 receives the candidate semantic unit and the current state of the toy interaction constraint object and the smart toy terminal 110, it outputs the status of pass, rejection or waiting for completion.

[0057] like Figure 4 As shown, the commit and session state storage 210 includes a transaction sender box 211, a commit state record area 212, and a portable session snapshot area 213. The transaction sender box 211 stores prepared records to be sent to the smart toy terminal 110; the commit state record area 212 stores the allocation level, acknowledgment level, commit key, payload summary, and acknowledgment status for each channel; and the portable session snapshot area 213 stores the session state required for failover.

[0058] like Figure 4As described above, the fault rollback controller 220 monitors the model's call status, adapter status, delivery status, and backup chain status. If a model connection times out, is rate-limited, returns a protocol error, or other recoverable service fails, the fault rollback controller 220 stops receiving new fragments of that flow call round, maintains the previously prepared records, and reads the recovery status from the migrated session snapshot area 213. The observation feedback server 230 associates gating, routing, model flow, checks, submissions, execution confirmations, and fault information based on the link tracing identifier, and updates the scene bucket corresponding to the scene runtime snapshot storage 150.

[0059] The aforementioned gateway, constructor, contract, gating, routing, stream event, inspection, fallback, and observation feedback entities can be deployed on the same computing device or split into multiple service processes. Regardless of the deployment method, the transaction sender box 211 and the commit status record area 212 maintain an atomic write relationship, and only one valid stream call round is allowed to generate a new committable event in the same session and round.

[0060] In all the accompanying drawings, the component names corresponding to the reference numerals shall be consistent with the uniform names in this specification; to improve the readability of the drawings, only reference numerals are shown in some boxes, wherein reference numerals 130, 160 and 210 respectively represent the context construction server, the two-layer gating processor and the submission and session state storage, and showing only reference numerals does not indicate new or different processing entities.

[0061] like Figure 5 As shown, in step S101, the edge processor 113 first reads the current input and device status from the microphone 111, image acquisition device 112, sensor feedback unit 118, and local session cache. The edge processor 113 simultaneously reads parental authorization, privacy level, and allowed output channels, and performs privacy trimming before the data leaves the smart toy terminal 110. When the privacy policy prohibits the upload of original audio, the edge processor 113 deletes the original audio from the request to be sent, retaining only the edge-recognized text, voice activity range, or permitted acoustic features; when the privacy policy prohibits the upload of original images but allows the upload of visual features, the edge processor 113 only sends the target area features or structured recognition results; when the corresponding edge capability is unavailable and the original data is not allowed to be uploaded, the edge processor 113 does not generate a cloud request, but instead reads alternative content from the local secure content storage 119.

[0062] like Figure 5As shown, upon receiving a request, the unified request gateway 120 first checks the device identifier, session identifier, policy version, request time, and whether it is a duplicate request. If a session identifier is missing, the request is the first access, and the unified request gateway 120 will create a new session identifier. If a session exists, the existing session identifier is used, and a new round identifier is assigned. If it is a duplicate request in the same round, the unified request gateway 120 reuses the previous processing records and does not call the model service node again. Then, the context construction server 130 writes the standardized message roles, allowed data references, tool constraints, action constraints, and streaming tags into the unified request object. At the same time, it writes the request modality, target output channel, role identifier, security policy version, authorization status, privacy level, allowed execution location, endpoint capabilities, network category, context length, first-response budget, and action security level into the toy interaction constraint object.

[0063] For example, when a child asks a question, if the parent only allows the recognition of clouds in the text, the edge processor 113 will send the recognized text and network status but not the original audio. The context construction server 130 sets the input modality to text, the target output channel to speech, and does not allow the upload of original audio. Even if a model can accept audio as input and its performance metrics are good, it will not accept the audio that is prohibited from being uploaded.

[0064] like Figure 5 As shown, when the authorization field is missing, the policy version expires, or the policy configuration terminal 240 is temporarily unavailable, the context construction server 130 adopts the most recent conservative policy that is still valid; when no valid policy exists, the original audio and original image upload permissions are set to prohibited, the action output channel is set to disabled, and only the local security response is retained. This processing ensures that policy exceptions will not translate into expanding the data upload scope or opening the action channel.

[0065] In one implementation, as... Figure 4 In the case shown, the edge processor 113 does not perform complete speech recognition, but only generates an irreversible acoustic representation and hands it over to the model service node that satisfies the data morphology capability bit for processing; at this time, the toy interaction constraint object will mark the input modality as edge acoustic feature, and the dual-layer gating processor 160 only retains the candidate model whose feature format is explicitly defined in the model capability contract.

[0066] like Figure 5 and Figure 6As shown, in step S102, the adapter and the capability contract server 140 read the model capability contract that matches the current unified request object. Before registering the model capability contract, the adapter instance 141 must accept at least the following types of requests: plain text requests, requests with context, streaming voice output requests, action intent requests, requests with missing fields, timeouts, rate limiting, authentication exceptions, protocol exceptions, security denials, and metering conversion tests.

[0067] like Figure 6 As shown, in the unified request encoding test, adapter instance 141 and adapter and capability contract server 140 compare whether the message role, context, modal reference, action restriction, and streaming tag of the unified request object are all completely written into the vendor request; in the streaming event test, adapter instance 141 and adapter and capability contract server 140 check whether the vendor fragment is converted into a standard fragment with source fragment number, output channel, and event type; in the error test, adapter instance 141 converts vendor-specific errors into standard error categories such as timeout, rate limiting, authentication, protocol, security, or unavailability.

[0068] like Figure 6 As shown, the adapter and capability contract server 140 also perform version binding on the capability contract: when the model version, adapter version, or field mapping rules change, the original capability contract is not directly inherited to the new version, but is only written to the valid capability bits after the corresponding test vector passes. This can prevent the old adapter from still being recognized as having available streaming capabilities by the routing scheduler 170 after the model supplier changes the streaming event format.

[0069] like Figure 11 As shown, the scene runtime snapshot storage 150 reads the precise scene bucket based on the current model version, input modality, security level, network type, target output channel, and confirmation caliber. If the precise scene bucket meets the preset valid conditions, the observation distribution, confidence level, and data freshness are directly provided; if the data in the precise scene bucket is insufficient, the network type, request length range, or security level granularity are relaxed in a preset order, but the model version and output confirmation caliber cannot be crossed, and a low confidence penalty is added for each scene rollback.

[0070] like Figure 11 As shown, when a cold-start model or a new version of the model does not generate a valid scene snapshot, the scene runtime snapshot storage 150 sets a conservative latency estimate and a low-confidence state, rather than interpreting the missing data as zero latency or a fault-free situation. It will only switch to scene statistics after the observation feedback server 230 has written actual records that meet the preset quantity and freshness requirements. Figure 7As shown in step S103, the dual-layer gating processor 160 checks the candidate models in a fixed order: the first layer needs to comply with the child safety policy, parental authorization, privacy upload scope, and allowed execution location; the second layer needs to be able to support the current input modality, context length, streaming event transformation, target output channel, and the required actions, and the adapter self-test is valid, the service is not circuit-broken, and the resource budget for a single request is acceptable.

[0071] Only if all conditions are met can a request be included in the qualified candidate set. If any of them fail, the subsequent soft comparison is stopped and an independent reason code is output. If there is no action in the request, the action gating is treated as an inapplicable item; if there is an action, information such as the action safety level, the status of the action execution component 117, and the status of the sensor feedback unit 118 are also read.

[0072] For example, in the diagram, the first model service node 181 and the second model service node 182 are both allowed to accept text input and output audio streams; however, the third model service node 183 can only accept raw audio or its execution location does not meet the current privacy conditions, so the third model service node 183 is excluded. Even if the historical call latency of the third model service node 183 is very small, the routing scheduler 170 will not receive its soft utility.

[0073] like Figure 7 As shown, when the qualified candidate set E is empty, the dual-gating processor 160 sends the reason for no qualified candidate to the edge processor 113. The edge processor 113 reads the prompt corresponding to the reason type from the local secure content memory 119 and maintains the original privacy and security conditions unchanged. If only the action channel has no qualified candidate, but the voice channel can still be executed, the action channel is closed and the voice output is retained; if there are no qualified candidates for voice, facial expression, and action, a local security prompt is output.

[0074] like Figure 7 , Figure 9 and Figure 14 As shown, the safety policy version in the toy interaction constraint object is fixed at the start of the round. Before the first specification flow event is submitted and before each action event is submitted, the safety and executability checker 200 re-verifies the policy version. If a parent revokes action authorization during model generation, candidate action units that have not yet been assigned action logic numbers are rejected; action records that have been assigned but not yet executed are frozen and will not be released with the old authorization.

[0075] Two-layer gating can be implemented using a rule engine, conditional branches, or short-circuit comparisons of capability and constraint bits. Regardless of the implementation, each gating item retains a traceable cause code, and unknown states must not be allowed by default. Security and privacy gating and capability gating must not be incorporated into a comprehensive score that can be compensated for by latency, cost, or load.

[0076] like Figure 7 , Figure 8 and Figure 11 As shown, in step S104, before model invocation, the routing scheduling processor 170 reads historical observations from scenario buckets that match the current model version, request modality, security level, network category, output channel, and confirmation caliber to obtain the first compliant executable response latency estimate for each qualified candidate model. During estimation, recent and high-confidence data from the same scenario are prioritized; when samples are insufficient, data is outdated, or only a fallback scenario can be used, conservative values ​​are adopted and risk markers are added, and missing data is not interpreted as zero latency or optimal state.

[0077] The first actual observation of a compliant and executable response in this round begins from the moment the unified request gateway 120 fully receives the request, until the first standardized flow event completes aggregation, inspection, submission, and delivery, and is confirmed by the target output channel to begin execution. This period simultaneously includes gateway processing, gating, routing, waiting for the first fragment of the model, semantic aggregation, security and executability checks, network delivery, and waiting for the toy client to start. The toy client can only return a receipt confirmation, using the receipt confirmation as the proxy endpoint, and separately records the channel residual between receipt and actual execution.

[0078] The routing scheduler processor 170 translates the initial compliant executable response latency, service health, queue and connection load, resource consumption, and risk status onto a comparable scale: lower latency, load, and resource consumption are better, as are higher success rates and availability; if a metric is missing, has an outlier boundary, or the data is not fresh enough, a conservative result is used. Each soft metric is weighted according to the current interaction scenario and penalized for risks arising from low confidence, half-open probing, data expiration, or connection anomalies. Child safety, authorization, privacy, location, and capability conditions are not included in the weighting process.

[0079] When the current session is already using a certain model, the routing scheduler 170 simultaneously considers the context transmission volume, role and security state transition volume, uncommitted event processing volume, and source-target format differences required for switching, and sets hysteresis requirements to suppress short-term fluctuations. If the current model can still pass through the hard gate, only if the comprehensive advantage of the candidate model is large enough to cover the migration overhead and hysteresis requirements will it be eligible for the main call. If the current model loses its hard gate eligibility, or the adapter fails or enters a fault state, other qualified candidates can be selected immediately, but the contract version, hard gate result, and circuit breaker status still need to be rechecked during the switch.

[0080] For example, such as Figure 7 As shown, in the second round of interaction within the same session, the current model is the second model service node 182. The first model service node 181 gains slightly higher base utility due to the reduction in short-term queues, but when the migration cost and hysteresis resulting from context migration, role state, and uncommitted events exceed the utility gain, the routing scheduler 170 continues to use the second model service node 182. This reduces the network and computational resources consumed by repeatedly transmitting contexts, repeatedly constructing role constraints, and re-establishing model connections.

[0081] like Figure 7 As shown, once the target model is determined, the routing scheduler 170 generates an ordered backup chain based on the qualified candidate ranking, concurrent tokens, number of connections, and model limits. Weighted round-robin, least connections, or consistent hashing are only used for secondary allocation within the qualified candidates and must not alter the double-layer hardgate result or session switching conditions.

[0082] like Figure 7 Before the routing scheduler 170 initiates a model call, it first writes a call lease and the first stream call round to the submission and session state memory 210. If, due to network retransmission, the unified request gateway 120 submits the same session and the same round again, the routing scheduler 170 can read the existing call lease and will not create a second parallel main call. This prevents the situation where two model streams simultaneously write to the same round due to repeated startup. Hard gating results, soft comparison results, session migration costs, and hysteresis judgments are applied to candidate models in sequence. This order allows security, authorization, privacy, and model capabilities to first form an uncompensated candidate boundary, and then the priority within qualified candidates is determined by operating metrics to avoid low latency or low resource consumption masking problems where hard conditions are not met.

[0083] like Figure 9As shown, in step S105, the routing scheduler 170 assigns a stable round identifier to the current interaction and allocates a flow call round to the target model call. The adapter instance 141 converts the unified request object and the allowed migration session state into a vendor request, attaches an idempotent request identifier, and then calls the target model service node. For each vendor flow fragment returned by the model service node, the adapter instance 141 first records the source fragment sequence number. The source fragment sequence number can be the vendor's native sequence number; if the vendor does not provide a sequence number, the arrival sequence number generated by the adapter instance 141 within a single connection can be used. The source fragment sequence number is only used for tracing and is not used as the delivery sequence number for the toy end.

[0084] like Figure 9 As shown, the standard stream event processor 190 writes vendor stream segments into the processing buffer according to the output channel. For text or speech channels, the standard stream event processor 190 forms candidate semantic units based on sentence end boundaries, pause boundaries, speech synthesis segmentation boundaries, and buffer limits; for audio channels, it forms candidate semantic units from complete frames with consistent encoding parameters and continuous time; for expression channels, it waits for resource identifiers, display modes, and persistence states to be complete; for action channels, it waits for action identifiers, target parameters, speed or persistence parameters, and execution prerequisites to be complete.

[0085] like Figure 9 As shown, the security and executability checker 200 performs channel-specific checks on candidate semantic units. In addition to checking the current content, text and voice candidate units can also read the tail context of the previously submitted semantic unit and the head content of the current candidate unit to prevent non-compliant content from being split into adjacent segments and bypassing the check. Audio candidate units need to be checked for frame integrity, encoding parameters, and playback buffer requirements; facial expression candidate units need to be checked for the existence of resource identifiers, the availability of display components, and whether persistent states are allowed; action candidate units need to be checked for action whitelists, parameter ranges, action mutual exclusion relationships, the current state of action execution component 117, and feedback from sensor feedback unit 118.

[0086] like Figure 9As shown, when the check result is "waiting for completion," the candidate semantic unit remains in the buffer without being assigned a logical sequence number. When the check result is "reject," only the candidate unit identifier, rejection reason, and source model are recorded; the allocation level is not advanced. When the check result is "pass," the canonical stream event processor 190 requests the commit and session state memory 210 to allocate a channel logical sequence number. After the check passes, the commit and session state memory 210 allocate the next unused logical sequence number after the current allocation level of the corresponding output channel, and advance the allocation level, write the ready state, write the transaction sender mailbox delivery record, and save the canonical payload summary and policy version within the same persistent transaction. If any action fails, the entire transaction is ineffective. The commit key is jointly determined by the session, round, output channel, and logical sequence number; the action effect key is jointly determined by the session, round, and action identifier. The former is used for event delivery deduplication, and the latter is used to prevent the same action from being executed again when the model is recovered or the confirmation is lost.

[0087] like Figure 9 As shown, the transaction sender box 211 releases records in the logical sequence number order within the same channel. If a previous logical sequence number has not yet been acknowledged, the next logical sequence number remains in a waiting state. After receiving an event, the smart toy terminal 110's edge processor 113 first checks the commit key and payload digest. If the commit key does not appear, the payload is written to the local queue of the corresponding output component; if the commit key has appeared and the payload digest matches, the original acknowledgment result is returned; if the commit key has appeared but the payload digest does not match, the event is rejected and a state conflict is reported.

[0088] like Figure 9 As shown, after the voice output component 115 starts outputting the first audio frame, the expression display component 116 completes the frame buffer switching, or the action execution component 117 accepts and initiates the action, the end-side processor 113 returns to start execution confirmation. The submission and session state memory 210 updates the corresponding record to confirmed. The confirmation level only advances when all consecutive logical sequence numbers starting from the current confirmation level are confirmed; if a later sequence number is confirmed earlier, the record can be saved as confirmed first, but the confirmation level does not exceed the previous gap. For example, if the voice channel has been allocated five logical sequence numbers and the confirmation level is at the third sequence number, the fourth and fifth sequence numbers are still occupied by the original records. Even if the fifth event is confirmed first, the confirmation level cannot exceed the unconfirmed fourth event; when the fourth event needs to be resubmitted, the original submission key and original payload are still used, and the toy end returns the previous result without repeating the broadcast.

[0089] like Figure 9 and Figure 14As shown, when voice, facial expressions, and actions are independent, each channel maintains its own allocation and confirmation levels. Locking an action channel will not block the voice channel. When sequential dependencies exist, the normalized flow event processor 190 writes dependency barrier identifiers to the relevant events. Before adding a new barrier relationship, the normalized flow event processor 190 performs a loop-free check based on existing dependency edges; only after the preceding channel is confirmed does the transaction sender box 211 release the subsequent channel events.

[0090] For example, such as Figure 9 and Figure 14 As shown, when the same semantic unit requires the announcement "Please remove your hand" before performing a mechanical reset action, the voice event and the action event share a dependency barrier. The action event is released only after the voice event receives confirmation of start or completion. If the action execution component 117 is in a locked state, the action event is rejected, but the voice event can still be output, thereby avoiding a single global level causing unrelated channels to stagnate together.

[0091] like Figure 14 As shown, the transaction sender 211 first delivers events in the ready state to the corresponding output components; after the voice output component 115, expression display component 116, or action execution component 117 receives the events and enters the start execution state, the end-side processor 113 generates an execution confirmation, and the submission status record area 212 then updates the corresponding record to confirmed. When the action channel sets the action effect key check, the check, together with the submission key and payload summary check, is used to identify repetitive actions without changing the order of delivery, then start execution, and then confirmation.

[0092] like Figure 10 As described above, if a timeout occurs in the target model during the streaming output process, or if there is a rate limit, connection interruption, or recoverable protocol error, the fault rollback controller 220 will no longer receive new candidate semantic units for this streaming call round, and will read the allocation level, confirmation level, unconfirmed prepared records, confirmed semantic unit identifier, specification load summary or offset, role status, security policy version, and incomplete semantics of each channel to construct a migrated session snapshot.

[0093] like Figure 10 As shown, the prepared records in the original transaction sender box 211 retain their original logical sequence number and original payload, and continue to be delivered with priority. The fault rollback controller 220 must not delete unconfirmed prepared records and then assign their sequence numbers to the standby model output. Taking a voice channel allocation level of 5 and a confirmation level of 3 as an example, new non-overlapping semantic units generated by the standby model can only be requested starting from logical sequence number 6, while logical sequence numbers 4 and 5 are still occupied by the original records.

[0094] like Figure 10As shown, the fault rollback controller 220 rereads the capability contract version, hard-gate result, and circuit breaker status of the standby model at the moment of switching. If the standby model does not meet the current policy version or the adapter version changes, the model is skipped and the next standby model is checked. After the check, the routing scheduler 170 generates a new flow call round for the standby call and converts the migrated session snapshot into a recovery context acceptable to the standby model. After the standby model returns a candidate semantic unit, the canonical flow event processor 190 compares its semantic unit identifier, canonical payload summary, text offset, audio frame fingerprint, or action identifier with the acknowledged and unacknowledged records. Content that overlaps with the original record is not assigned a new logical sequence number; content that does not overlap and passes the security and executability checks obtains a new sequence number from the current assigned watermark. Fragments returned late by the original model are isolated because the flow call round is older and do not enter the current buffer.

[0095] like Figure 10 As shown, if confirmation cannot be obtained even after recording within the preset delivery boundary, the fault rollback controller 220 freezes the corresponding channel. If the channel is an action channel, the action execution component 117 is in a safety lock state; if it is a voice channel, the edge processor 113 stops waiting for content from the cloud and outputs a local safety warning message. Already occupied logical sequence numbers will not be reused due to downgrading.

[0096] Figure 10 The recovery starting point shown is based on the allocation water level. If the allocation water level is 5 and the confirmation water level is 3 when the fault occurs, then logic numbers 4 and 5 will continue to maintain the original prepared records and original loads; after the backup model output is compared by overlap, the new content will be allocated starting from logic number 6 at the earliest. Even if subsequent events return to confirmation first, they cannot cause the confirmation water level to exceed the confirmation gap formed by logic numbers 4 or 5.

[0097] like Figure 12 In this context, content non-compliance, insufficient authorization, privacy mismatch, or out-of-bounds action parameters constitute security failures. In the event of a security failure, the original payload will not be re-delivered by the same model or a backup model. Instead, without changing the hardware, a qualified model can be requested to generate new secure content, or local secure content can be directly output. Timeouts, rate limiting, connection interruptions, and protocol anomalies constitute service failures. Service failures consume retry budget and update the circuit breaker status of the model service node.

[0098] like Figure 5 and Figure 11As shown, in step S106, the observation feedback server 230 associates the unified request gateway 120, the two-layer gating processor 160, the routing scheduling processor 170, the adapter instance 141, the standard flow event processor 190, the submission and session state storage 210, and the records generated by the smart toy terminal 110 with the link tracing identifier.

[0099] like Figure 8 and Figure 11 As shown, the observation feedback server 230 will record at least the estimated latency of the first compliant executable response before the model call, the arrival time of the first fragment of the vendor, the formation time of the first candidate semantic unit, the check passed, the time when it is ready to write, the time when the toy receives the data, the time when execution starts and is confirmed, and the final completion time. These time points can be used to distinguish whether the latency comes from model generation, fragment fragmentation, semantic aggregation, security check, network delivery, or toy execution buffer.

[0100] like Figure 9 , Figure 10 and Figure 14 As shown, the observation feedback server 230 also records the changes in the allocated water level and confirmed water level for each channel, the number of times the record has been prepared for re-delivery, the loss of confirmation, the suppression of duplicate events, the deduplication of actions, the switching of backup models, the discarding of old stream segments, and the barrier waiting status. When duplicate broadcasts or action replays occur, the observation feedback server 230 locates the specific node in the candidate unit aggregation, logical sequence number allocation, transaction mailbox delivery, toy end idempotent records, or fault recovery overlapping comparison based on the link tracing identifier.

[0101] like Figure 11 As shown, after the model call is completed, the observation feedback server 230 writes the actual observation values ​​of this round into the corresponding scene bucket, and does not use the execution results that have not yet occurred in this round before model selection. When the model version changes, the adapter version changes, or the confirmation criteria changes, the observation feedback server 230 creates a new scene bucket or reduces the confidence of the old bucket.

[0102] The observation feedback server 230 updates its configuration based on the source of the deviation: missing fields or stream event conversion errors are used to correct contract mappings and capability bits; incorrect hard gate access or exclusion is used to correct field sources, gating order, and missing value strategies; latency estimation deviations are used to correct scene bucketing, statistical windows, boundaries, and low confidence penalties; excessive switching is used to correct migration costs and hysteresis requirements; duplicate output is used to correct fragment aggregation, logical sequence numbers, double watermarks, payload summaries, and idempotent records; and fault switching anomalies are used to correct error classification, retry budgets, circuit breaker states, and backup re-verification conditions. Each soft parameter adjustment is limited to a pre-defined allowable range and a single change amount, generating a new policy version. Child safety, parental authorization, privacy scope, and capability hard gates cannot be relaxed using soft parameters; only field mappings, capabilities, and version correspondences can be corrected. The new policy uses the same type of request, the same model endpoints, and the same fault conditions for regression. In the event of security gating degradation, double watermark anomalies, or deterioration of duplicate output, it reverts to the previous version or reduces the adjustment amount before verification.

[0103] like Figure 4 , Figure 5 , Figure 7 and Figure 8 As shown, in the first round of interaction, the child uses microphone 111 to ask questions. The edge processor 113 performs local speech recognition, and under the parental control policy, only the recognized text is uploaded to the cloud, not the original audio. The ultimate goal is the voice output component 115. After receiving the recognized text, the unified request gateway 120 generates a unified request object and a toy interaction constraint object by the context construction server 130.

[0104] like Figure 7 As shown in the example, since the first model service node 181 and the second model service node 182 have passed through two hard gates, and the data reception form or execution location of the third model service node 183 does not meet the privacy requirements, it is excluded; the routing scheduler 170 selects the second model service node 182 based on the scenario running snapshot, the first compliant executable response estimate and the connection status, and writes the first model service node 181 to the backup chain.

[0105] like Figure 9In the process, when the first short segment returned by the second model service node 182 does not constitute a broadcastable semantic unit, the standard stream event processor 190 will retain this segment in the buffer. When the next segment arrives, it forms a complete candidate semantic unit. After being checked and passed by the security and executability checker 200, the voice channel logical sequence number 1 is obtained and written into the prepared record. At this time, the voice output component 115 starts broadcasting and returns confirmation. The submission status record area 212 pushes the voice channel confirmation level to 1. The observation feedback server 230 records this moment as the end point of the first compliant and executable response in this round.

[0106] like Figure 7 As shown, the second round of interaction still takes place within the same session. At this time, the basic utility of the first model service node 181 is slightly higher than that of the second model service node 182, but its gain does not exceed the context migration cost and the scenario hysteresis. Therefore, the routing scheduler 170 continues to use the second model service node 182; the role identifier, security policy version and the confirmed context do not need to be converted to another model.

[0107] like Figure 9 , Figure 10 and Figure 14 As shown, in the third round of interaction, voice, facial expressions, and actions are output simultaneously. At this time, the second model service node 182 has generated voice logic numbers 1 to 5, and the confirmation level is 3. Logic numbers 4 and 5 are in a ready state, and then the model connection is disconnected. The fault rollback controller 220 retains the original records of logic numbers 4 and 5 and constructs a migrateable session snapshot, switching to the first model service node 181. Overlapping semantic units generated by the first model service node 181 are discarded by the normalized flow event processor 190, and new semantic units are allocated starting from logic number 6. Action events related to voice logic number 6 are only released after the voice event is confirmed, thereby maintaining the sequential relationship between voice, facial expressions, and actions and preventing the already broadcast content and initiated actions from being executed again.

[0108] like Figure 1 As shown, the context construction server 130, capability contract storage 142, scene runtime snapshot storage 150, dual-layer gating processor 160, routing scheduling processor 170, transaction sender box 211, commit status record area 212, and fault rollback controller 220 can be deployed on the edge gateway or edge processor 113 at home. In the cloud, they mainly provide model services and some observation storage. The policy configuration terminal 240 synchronizes the child safety policy, parental authorization, and privacy scope to the edge side. The original audio or original image will only leave the home network after the local privacy gating allows it.

[0109] The edge side stores the latest model latency, home network status, and toy-side execution confirmation. When computing resources are limited, models meeting the initial budget can be selected from the hard-gate candidates and sorted by load and resource consumption without affecting the definition of the first compliant executable response or session migration hysteresis. The transaction sender box 211 and commit status record area 212 are positioned close to the output component, allowing confirmation to be completed based on locally prepared records even during brief cloud connection interruptions. If a cloud model failure occurs, the system can switch to a local model or output local secure content.

[0110] like Figure 2 In this system, the unified request gateway 120, context construction server 130, adapter and capability contract server 140, scene runtime snapshot storage 150, dual-layer gating processor 160, and routing scheduling processor 170 are all located in the cloud, while the edge processor 113 is equipped with a lightweight execution agent. It performs the first check (children's content, resource identification, and action rules) in the cloud, and then reads information such as voice buffer, facial expression resources, busy / idle status of action execution components, and sensor feedback at the edge execution gate. Only after passing through the second execution gate can it return to confirm the start of execution.

[0111] The cloud-based maintenance platform maintains channel logical sequence numbers, while the client-side maintains idempotent records for submission keys and action effect keys. When resubmitting the same prepared record in the cloud, the client returns the original confirmation result; if the payload digest corresponding to the same submission key is different, execution is rejected, and a status check is performed. Model fault recovery involves constructing a migrated session snapshot in the cloud, but the already executed state is based on the client-side idempotent records and actual execution confirmations.

[0112] like Figure 3 and Figure 9 As shown, each processing unit can exchange requests, gating results, routing results, vendor stream fragments, committable events, and acknowledgment status via message bus 250. Committable messages are partitioned by session identifier, round identifier, and output channel. Only candidate semantic units that pass security and executability checks enter the committable partition; rejected units only enter the audit log and do not occupy a channel logical position. Message partition offsets can be directly used as channel logical sequence numbers or mapped one-to-one with logical sequence numbers; the most recently written offset represents the allocation level, and the maximum offset of consecutive acknowledgments at the toy end represents the acknowledgment level. After a consumer failure restart, messages are read from after the acknowledgment level; allocated but unacknowledged messages retain their original offset and payload. Migrationable session snapshots are written to the status messages saved by session, and the standby adapter reads them to create a new stream call round.

[0113] like Figure 12As shown, the global operating state includes at least power-on initialization, conservative mode, normal interaction, communication degradation, model failure, restricted detection, action locking, submission status verification, local security response, and recovery verification. The fault rollback controller 220 triggers state transitions based on communication, model, execution, submission status, and policy version; the policy configuration terminal 240 provides policy conditions, and the observation feedback server 230 provides verification results. Security failures do not result in the original non-compliant payload being re-deployed; service failures, within the retry budget, involve retrying, circuit breaking, or standby switching. Figure 12 The main state transitions are represented by global state boxes. Limited probes can be executed as an internal recovery sub-state after a model failure; no separate state box is shown in the diagram. Upon entering limited probe mode, the routing scheduler 170 allocates a limited number of probe requests to the recovery node, and enters recovery verification only after successful probe detection, meeting latency requirements, and confirming contract version consistency.

[0114] like Figure 12 As shown, when the end-side communication module 114 fails to receive confirmation from the unified request gateway 120 for a continuous period of time, or when the link status changes from available to unavailable, the end-side processor 113 stops uploading new raw data, freezes action requests that have not yet been sent, and reads offline content from the local secure content storage 119.

[0115] like Figure 12 As shown, standard flow events that have been received on the end side and entered the execution state continue to be completed according to the local idempotent record; cloud-prepared records that have not yet been received are retained in the transaction sender box 211. After the link is restored, the end-side communication module 114 first sends the session identifier, round identifier, the submission keys of each channel that have been received, and the most recent execution confirmation, and then receives the missing records to avoid rebroadcasting from the start of the current round after the connection is restored.

[0116] The recovery conditions are that the end-side communication module 114 and the unified request gateway 120 complete a two-way handshake, the policy versions are consistent, and the status verification is completed. Before the status verification, the action execution component 117 remains locked.

[0117] like Figure 10 and Figure 12 As shown, when the model service node times out, the connection is lost, or a rate-limiting error is returned, the fault rollback controller 220 records the exception as a service failure, stops the current flow call round from generating new candidate semantic units, and reads the backup chain. Figure 10 As shown, if the prepared record is not confirmed, it will continue to be resubmitted using the original commit key; the standby model only generates incomplete semantics. Before switching to the standby model, the capability contract version, hard-gate result, and circuit breaker status are rechecked. When the standby chain is exhausted, the fault rollback controller 220 freezes the relevant channels and notifies the end-side processor 113 to output local security content.

[0118] After the model service node recovers, it enters a restricted probe state, and the routing scheduler 170 only allocates a preset number of probe requests; the normal candidate state is restored only after the probe meets the success and latency conditions.

[0119] like Figure 12 As shown, when an action request requires feedback on position, attitude, current, or contact status, and the sensing feedback unit 118 has no data, the data is outside the physical range, or multiple sensing quantities contradict each other, the edge processor 113 marks the action execution status as unknown. For example... Figure 7 As shown, an unknown action execution status prevents the action gating from passing. Action candidate units that have been formed but not yet assigned a logical sequence number are rejected; action records that are in a ready state but have not yet started execution are frozen. Voice or facial expression channels that are not dependent on this action can continue to be released.

[0120] The recovery condition is that the sensing feedback unit 118 returns valid and consistent data within a preset continuous sampling period, and the end-side processor 113 confirms the actuator's zero position or current position. Before recovery, the locking is not released by regenerating motion commands solely based on the model.

[0121] like Figure 9 , Figure 12 and Figure 14 As shown, when the action execution component 117 receives an action event but does not return to confirm the start of execution within the preset confirmation period, the commit status record area 212 keeps the corresponding record as ready, and the transaction sender box 211 resubmits the event using the same action effect key.

[0122] like Figure 12 and Figure 14 As shown, after the re-investment budget is exceeded, the edge processor 113 will stop subsequent events in the motion channel, disable the motion driver or maintain the motion controller's safe hold state, and send the exception to the fault rollback controller 220; if the voice event and the motion event are associated through a dependency barrier, the voice output component 115 can output a fault prompt, but the motion event will not be released. The motion execution component 117 needs to return a clear idle state, and the sensor feedback unit 118 needs to confirm that the actuator is not in a dangerous position. Furthermore, an authorized reset request will release the motion channel lock. Figure 12 As shown, when the speed, angle, duration, and resource identifier of an action exceed the range jointly defined by the toy interaction constraint object and the capability contract, the safety and executability checker 200 rejects the candidate semantic unit and executes it directly without truncating the parameters.

[0123] like Figure 6 and Figure 7As shown, when the field / event type or unit of measurement returned by adapter instance 141 is different from the current capability contract version, the adapter and capability contract server 140 revoke the corresponding capability bit, and the dual-layer gating processor 160 removes the model corresponding to the adapter and performs contract retesting. For cases where soft scoring boundaries, weights, or hysteresis parameters exceed limits, the observation feedback server 230 can project them to a preset allowable range; however, for security, privacy, action capabilities, and policy version fields, they are changed to pass without parameter projection.

[0124] like Figure 9 and Figure 12 As shown, when the end-side communication module 114 or adapter instance 141 detects a data frame verification failure, it discards the corrupted frame and requests a retransmission using the same request identifier. When consecutive verification failures reach a preset boundary, the link is marked as unreliable, and the process switches to a local security response or an alternative communication path.

[0125] like Figure 9 As shown, when vendor stream fragments are out of order, the standard stream event processor 190 temporarily stores them based on the source fragment sequence number and the stream call round. Missing fragments are re-aggregated after arriving within a preset waiting boundary; if a complete semantic unit cannot be formed even after exceeding the waiting boundary, the buffer unit is marked as incomplete and no logical sequence number is assigned. When a fragment from an old stream call round arrives after the standby model has already started outputting, the standard stream event processor 190 directly isolates the fragment and does not insert it into the current stream even if its source fragment sequence number is smaller.

[0126] like Figure 9 and Figure 12 As shown, the commit and session state storage 210 continuously checks that the acknowledgment level of each channel must not exceed the allocation level, and checks whether the prepared records are complete, whether the same logical sequence number corresponds to only one payload summary, and whether the acknowledgment level crosses the unacknowledgment gap. If any inconsistency occurs, the allocation of new sequence numbers for that channel is stopped. During state recovery, the logical sequence number set is reconstructed from the transaction sender box 211 and the commit state record area 212, and the acknowledgment level is re-determined based on the records that are continuously in the acknowledged state starting from the starting sequence number. The allocation level is determined using the largest existing logical sequence number. If a unique reconstruction is not possible, the channel remains frozen and local safe content is output, without forcibly recovering by reusing old sequence numbers.

[0127] like Figure 10 and Figure 12 As shown, when the unified request gateway 120 repeatedly submits the same session and the same round, or when multiple routing scheduler processor 170 instances attempt to initiate a model call simultaneously, the submission and session state storage 210, based on the call lease, only allows one instance to obtain the current flow call round.

[0128] In cases where no call lease is obtained: the existing target model and processing status are read, and a second main stream is not created; when the call lease expires, the takeover instance will first determine whether the original stream has a heartbeat, whether there are new prepared records, and whether a backup stream call round has been generated. Only after confirming that the original call has failed will the takeover operation be performed. This avoids the situation where two sets of logical sequence numbers compete for space in the same round due to gateway retransmission, service restart, or scheduler concurrency.

[0129] like Figure 12 As shown, when the intelligent toy terminal 110 receives a physical emergency stop signal, an action drive overcurrent signal, an abnormal collision signal, or a software emergency stop signal generated by the end-side processor 113, the action execution component 117 immediately stops accepting new action events and enters a safety holding state. Figure 9 and Figure 14 As shown, action candidate units that have not yet been assigned a sequence number are rejected; actions that have been assigned but not yet executed are marked as frozen and their original sequence numbers are not reused; actions that have already started execution are stopped by the action execution component 117 according to the local safety braking logic. The voice output component 115 can output an emergency stop prompt, and the facial expression display component 116 can display the safety status.

[0130] Recovery requires confirmation from the sensor feedback unit 118 that the actuator has stopped and the motion controller has returned to a safe position, and a reset command must be issued by the authorized entity. Simply receiving an output from the cloud model indicating that it will continue moving is insufficient to deactivate the emergency stop.

[0131] like Figure 12 and Figure 13 As shown, after the smart toy terminal 110 or cloud computing device is powered on again, it first loads the most recently persisted session state, commit key record, allocation level, confirmation level, policy version and adapter contract version, and then opens the model call and action channel.

[0132] like Figure 10 and Figure 12 As shown, if there are unconfirmed prepared records in the commit status record area 212, the transaction sender box 211 will be restored first, and the idempotent record of the toy end will be checked without directly creating a new logical sequence number. When the capability contract version cannot be confirmed, the policy version does not exist, or the water level cannot be rebuilt, the dual-layer gating processor 160 will keep the cloud model candidate and action channel disabled, and the edge processor 113 will only allow local security content to be output. Only after the contract retest, policy synchronization, status check, and executor self-check are completed will the system switch from conservative mode to normal interactive mode.

[0133] In the above embodiments, such as Figure 5As shown, this embodiment also provides a multi-model heterogeneous adaptation and routing scheduling device for smart toys: it includes an interaction context construction module, a contract and snapshot acquisition module, a two-layer hard gating module, a routing scheduling module, a stream event submission and recovery module, and an observation feedback module. The interaction context construction module corresponds to step S101, and is used to receive requests, device status, authorization, and policy status, and perform integrity verification and privacy trimming to obtain a unified request object and toy interaction constraint object; the contract and snapshot acquisition module corresponds to step S102, and is used to read running snapshots that have been tested and confirmed to have model capabilities and match the current scenario.

[0134] Specifically: the dual-layer hard gating module corresponds to step S103, which checks the child's safety, authorization, privacy, execution location, and model capabilities before the soft comparison; the routing and scheduling module corresponds to step S104, which estimates the first compliant executable response, compares qualified candidates, and evaluates migration costs and hysteresis requirements to determine the target model and backup chain; the stream event commit and recovery module corresponds to step S105, which aggregates fragments, checks candidate semantic units, assigns logical sequence numbers after passing the checks, maintains double watermarks and transaction sender boxes, and constructs a migrateable session snapshot in case of failure; the observation feedback module corresponds to step S106, which updates the scenario runtime snapshot and policy version, etc. These modules can be set in the same process or encapsulated into multiple services / containers / threads / function libraries or hardware logic units.

[0135] like Figure 13 As shown, this embodiment also provides an electronic device 300, including a processor 310, a memory 320, a communication bus 330, a network interface 340, and an input / output interface 350. The processor 310 is connected to other components via the communication bus 330; the memory 320 includes a non-volatile storage area for storing programs and persistent states, and a volatile storage area for storing running requests, stream segments, and candidate semantic units; the network interface 340 is used to exchange requests, model streams, submission events, and confirmation information with the intelligent toy terminal 110, the model service cluster 180, and the policy configuration terminal 240.

[0136] When the computer program in memory 320 is executed by processor 310, steps S101 to S106 are implemented, including constructing a unified request object and a toy interaction constraint object, verifying the capability contract, obtaining a scene runtime snapshot, executing two-layer hard gating, implementing hysteresis routing with migration costs, aggregating and checking vendor flow segments, maintaining allocation and confirmation levels, switching from a migrated session snapshot to a standby model, and updating the runtime snapshot and policy version based on the actual execution results. Electronic device 300 can be implemented as a cloud server, edge server, home gateway, smart toy terminal computing motherboard, or a computing cluster composed of multiple nodes.

[0137] This embodiment also provides a non-transitory computer-readable storage medium storing a computer program. When the program is executed by a processor, it implements steps S101 to S106, as well as the channel dual-water level submission, idempotent delivery, and cross-model fault recovery processes. The storage medium may include flash memory, erasable memory, solid-state memory, magnetic media, or optical media; the program may be divided into access request, contract testing, gating, routing, stream events, transaction mailbox, fault recovery, and feedback procedures, and is executed by the same processor or multiple processing nodes.

[0138] The above description is merely a specific embodiment of this application, but the scope of protection of this application is not limited thereto. Any variations or substitutions that can be easily conceived by those skilled in the art within the scope of the technology disclosed in this application should be included within the scope of protection of this application. Therefore, the scope of protection of this application should be determined by the scope of the claims.

Claims

1. A method for multi-model adaptation and routing scheduling of intelligent toys, executed by a scheduling system, characterized in that: include: Construct a unified request object and a toy interaction constraint object, and execute security and privacy hard gating and model capability hard gating in sequence based on the model capability contract confirmed by contract testing; If no qualified candidate is found, output local security content. If a qualified candidate is found, estimate the first compliant executable response based on the scenario snapshot, and determine the target model and backup chain by combining migration cost and hysteresis conditions. Aggregate target model stream fragments into candidate semantic units; when the check passes, allocate a channel logical sequence number after the allocation water level of the corresponding output channel, and advance the allocation water level, atomically write the prepared record and the transaction sender box record in the same persistent transaction, save the payload summary and policy version. If any write fails, the persistent transaction will not take effect, and the sequence number will not be occupied when the check fails. Based on the confirmation level of the consecutive confirmed prefixes, the subsequent confirmed ones do not exceed the gap of the previous ones; the confirmation of the start of execution includes: the voice output component receives at least one of the complete playable text and the complete audio frame and starts outputting; the expression display component loads the target resources and completes the display buffer switching; the action execution component receives the action parameters and enters the action start state. In the event of a recoverable service failure, unconfirmed prepared records are retained. A migrated session snapshot is constructed based on the allocation level and confirmation level. The system switches to a backup model that has been re-gated by hard gating, eliminates overlapping semantics, and continues to allocate sequence numbers from the idle logical positions after the allocation level. The backup model is invoked using an incremental stream call round, and its output is compared with the confirmed and unconfirmed records. Overlapping content is not assigned a new sequence number, while non-overlapping content is allocated from after the allocation level. Late fragments of the original model are isolated.

2. The intelligent toy multi-model adaptation and routing scheduling method according to claim 1, characterized in that: The model capability contract is generated after the adapter instance submits a capability summary and version fingerprint; The adapter and the capability contract server issue preset test vectors to verify unified request encoding, stream event conversion, standard error normalization and metering conversion respectively. When the test passes, a valid capability bit is written and the corresponding capability path is opened; when the test fails, an invalid capability bit is written and allocation stops. When the version fingerprint changes, the original valid capability bit is revoked and the test is re-tested; when there is no change, the original valid capability bit is maintained.

3. The intelligent toy multi-model adaptation and routing scheduling method according to claim 2, characterized in that: The security and privacy hard gating checks the child safety policy, parental authorization status, privacy upload scope, and allowed execution locations in sequence; the model capability hard gating checks the input modality, context capacity, stream event transformation, target output channel, action capability, adapter self-test status, service availability status, and single request budget in sequence. If any applicable item is missing, has an inconsistent version, is in an unknown state, or fails the check, the corresponding model is excluded and a reason code is output. If all applicable items pass, the model is added to the qualified candidate set.

4. The intelligent toy multi-model adaptation and routing scheduling method according to claim 1, characterized in that: Scene snapshots are organized into scene buckets based on model version, request modality, security level, network type, target output channel, and confirmation criteria; The observation period for the first compliant and executable response begins when the unified request gateway fully receives the request and ends when the first canonical flow event completes aggregation, inspection, submission, and delivery and obtains confirmation to begin execution. When an execution start confirmation is obtained, it is written to the scene bucket corresponding to the confirmation type. When only a receive confirmation is obtained, the receive confirmation is used as the proxy endpoint and written to the scene bucket of another confirmation type.

5. The intelligent toy multi-model adaptation and routing scheduling method according to claim 4, characterized in that: The scene snapshot prioritizes reading the scene bucket that perfectly matches the current scene; when the scene bucket data is insufficient, the network category, request length range and security level granularity are relaxed in turn and the confidence level is reduced, without crossing the model version and confirmation criteria. When the cold start model and the new version model have not formed an effective scenario bucket, a conservative response delay and a low confidence state are set. After the preset sample size and data freshness conditions are met, the model switches to the corresponding scenario statistics. If the conditions are not met, the conservative response delay and low confidence state are maintained.

6. The intelligent toy multi-model adaptation and routing scheduling method according to claim 5, characterized in that: The migration cost is determined based on the amount of context to be migrated, the amount of roles and security states, the amount of uncommitted events, and the differences in the source target format. When the current model is still subject to hard gating for security and privacy and hard gating for model capabilities, if the overall advantage of the candidate model exceeds the sum of the migration cost and the hysteresis condition, the model is switched to the candidate model; otherwise, the current model is maintained. If the current model fails at least one of the following states: hard gating, adapter failure, or service failure, the hold decision is cancelled, and the capability contract, hard gating, and circuit breaker status checks are re-executed for the next candidate model.

7. The intelligent toy multi-model adaptation and routing scheduling method according to claim 6, characterized in that: The migrateable session snapshot includes confirmed specification messages, role identifiers, security policy versions, round identifiers, stream call rounds, allocation and confirmation levels for each output channel, unconfirmed prepared records, confirmed semantic units, payload summaries, uncommitted semantics, and unconfirmed action statuses.

8. The intelligent toy multi-model adaptation and routing scheduling method according to claim 7, characterized in that: The voice channel, facial expression channel, and action channel maintain allocation and confirmation levels respectively; when there is a cross-channel sequential relationship, a dependency barrier flag is written into the normalized flow event, and a loop-free check is performed before writing; when the loop-free check passes, the preceding channel releases the subsequent channel event after obtaining the start execution confirmation; When the loop-free verification fails, the cross-channel sequence relationship is not written and a preset degradation process is executed. The preset degradation process includes at least one of the following: related action events are not executed, voice events are released independently, and local security response is entered. The action channel lock does not block the voice channel that is not dependent.

9. The intelligent toy multi-model adaptation and routing scheduling method according to claim 1, characterized in that: After the candidate semantic unit passes the check, a standard flow event is formed. The standard flow event includes session identifier, round identifier, flow call round, output channel, channel logical sequence number, semantic unit identifier, event type, payload, source model, security status, executable status, delivery status, action identifier, dependency barrier identifier, and link tracing identifier. The target model stream segment carries the source segment sequence number and the stream call round. The source segment sequence number is only used for tracing the source, while the channel logic sequence number is used for delivery, confirmation, deduplication, and fault recovery.

10. The intelligent toy multi-model adaptation and routing scheduling method according to claim 9, characterized in that: The submit key is determined by the session identifier, round identifier, output channel, and channel logical sequence number; the action effect key is determined by the session identifier, round identifier, and action identifier. After receiving the standard stream event, the intelligent toy terminal checks the commit key and payload digest. If the commit key does not appear, the payload is written to the local queue of the corresponding output component. If the commit key has appeared and the payload digest is consistent, the original confirmation result is returned. If the commit key has appeared but the payload digest is inconsistent, execution is rejected and a state conflict is reported.

11. The intelligent toy multi-model adaptation and routing scheduling method according to claim 10, characterized in that: The intelligent toy terminal can return to the confirmation when execution begins and use this confirmation. The intelligent toy terminal can only return to the confirmation when receiving confirmation and use the confirmation as a proxy confirmation. The terminal processor records the channel residual between reception and actual execution. The two types of confirmation are associated with different confirmation calibers.

12. The intelligent toy multi-model adaptation and routing scheduling method according to claim 11, characterized in that: The observation and feedback server records the request reception time, the arrival time of the first fragment from the manufacturer, the formation time of the candidate semantic unit, the check passed, the ready to write time, the toy end reception time, the start of execution confirmation time, and the final completion time according to the link tracing identifier. It also records the allocation level, confirmation level, number of re-drops, confirmation loss, duplication suppression, action deduplication, backup model switching, old stream fragment isolation, and barrier waiting status. A new scene bucket is created when any of the model version, adapter version, or confirmation criteria changes; otherwise, it is written to the original scene bucket.

13. A multi-model adaptation and routing scheduling system for intelligent toys, characterized in that, include: A unified request gateway and a context construction server are used. The unified request gateway receives interaction requests, and the context construction server forms a unified request object and a toy interaction constraint object based on the interaction requests. The adapter and capability contract server and the scenario runtime snapshot store store scenario runtime snapshots corresponding to model version, request modality, network type, output channel and confirmation caliber. The dual-layer gating processor and the routing scheduler processor execute security and privacy hard gating and model capability hard gating sequentially according to the toy interaction constraint object and the model capability contract. When no qualified candidate set is formed, a local security response instruction is generated. When a qualified candidate set is formed, the routing scheduler processor determines the target model and backup chain according to the scene running snapshot, session migration cost and hysteresis condition. The standard stream event processor aggregates the stream fragments returned by the target model into candidate semantic units, and the safety and executability checker performs safety and executability checks on the candidate semantic units. The commit and session state storage includes a transaction sender box, a commit state record area, and a migrated session snapshot area. When a candidate semantic unit check passes, the commit and session state storage allocates a channel logical sequence number after the allocation watermark of the corresponding output channel, and advances the allocation watermark, atomically writes the prepared record and the transaction sender box record, and saves the payload summary and policy version in the same persistent transaction. If any write fails, the persistent transaction is ineffective. If a candidate semantic unit check fails, no channel logical sequence number is allocated, and the confirmation watermark corresponding to the consecutive confirmed prefixes is advanced according to the start execution confirmation. The subsequent confirmed sequence does not exceed the gap of the previous sequence. The start execution confirmation includes: the voice output component receiving at least one of the complete playable text and the complete audio frame and starting output; the expression display component loading the target resource and completing the display buffer switching; and the action execution component receiving action parameters and entering the action start state. The fault rollback controller retains unconfirmed prepared records when the target model experiences a recoverable service failure. It constructs a migrated session snapshot based on the allocation level, confirmation level, and session state. It controls the backup model to generate candidate semantic units in incremental stream call rounds through security and privacy hard gating and model capability hard gating. It compares the output with confirmed and unconfirmed records, removes semantics that overlap with existing records, and continues to allocate channel logical sequence numbers from unoccupied logical positions after the allocation level. It also isolates late fragments of the original model. The observation feedback server updates the scene running snapshot based on the start confirmation, model fault status, and repetition suppression results.

14. An electronic device, characterized in that, It includes a processor, memory, communication bus, network interface, and input / output interface. The processor is connected to the memory, network interface, and input / output interface via the communication bus. The memory stores the computer program. When the computer program is executed by the processor, it causes the processor to: Construct a unified request object and a toy interaction constraint object, and execute security and privacy hard gating and model capability hard gating based on the model capability contract confirmed by contract testing; When no qualified candidate set is formed, a local security response instruction is generated. When a qualified candidate set is formed, the target model and backup chain are determined based on the scenario runtime snapshot, session migration cost, and hysteresis condition. The stream fragments returned by the target model are aggregated into candidate semantic units. Safety and executability checks are performed on the candidate semantic units. If the check passes, a channel logical sequence number is assigned after the allocation level of the corresponding output channel, and the allocation level is advanced in the same persistent transaction. Prepared records and transaction outgoing records are atomically written, and payload summary and policy version are saved. If any write fails, the persistent transaction is not effective. If the check fails, a channel logical sequence number is not assigned, and the confirmation level corresponding to the consecutive confirmed prefix is ​​advanced according to the start execution confirmation. The subsequent confirmed level does not exceed the gap of the previous level. The start execution confirmation includes: the voice output component receiving at least one of the complete playable text and the complete audio frame and starting output; the expression display component loading the target resources and completing the display buffer switching; and the action execution component receiving action parameters and entering the action start state. When the target model experiences a recoverable service failure, unconfirmed prepared records are retained. A migrated session snapshot is constructed based on the allocation level, confirmation level, and session state. A backup model that has passed the security and privacy hard gating and model capability hard gating is selected. Candidate semantic units are generated with an incremental number of stream call rounds, and their output is compared with confirmed and unconfirmed records to eliminate overlapping semantics. Channel logical sequence numbers are then allocated from the unoccupied logical positions after the allocation level, and late fragments of the original model are isolated. Update the scenario runtime snapshot based on the start confirmation, model fault status, and repetition suppression results.

15. A non-transitory computer-readable storage medium having a computer program stored thereon, characterized in that, When a computer program is executed by a processor, it causes the processor to: Construct a unified request object and a toy interaction constraint object, and execute security and privacy hard gating and model capability hard gating in sequence according to the model capability contract confirmed by contract testing; When no qualified candidate set is formed, a local security response instruction is generated. When a qualified candidate set is formed, the target model and backup chain are determined based on the scenario runtime snapshot, session migration cost, and hysteresis condition. The stream fragments returned by the target model are aggregated to form candidate semantic units. Safety and executability checks are performed on the candidate semantic units. If the check passes, a channel logical sequence number is assigned after the allocation level of the corresponding output channel, and the allocation level is advanced within the same persistent transaction. Prepared records and transaction outgoing mail records are atomically written, and payload summaries and policy versions are saved. If any write fails, the persistent transaction is ineffective. If the check fails, a channel logical sequence number is not assigned, and the confirmation level corresponding to consecutive confirmed prefixes is advanced based on the start execution confirmation. Subsequent confirmed confirmations do not exceed the gaps of preceding confirmations. The start execution confirmation includes: the voice output component receiving at least one of complete playable text and complete audio frames and starting output; the expression display component loading target resources and completing display buffer switching; and the action execution component receiving action parameters and entering the action start state. When the target model experiences a recoverable service failure, unconfirmed prepared records are retained. A migrated session snapshot is constructed based on the allocation level, confirmation level, and session state. The system switches to a backup model that has passed security and privacy hard gating and model capability hard gating again. Candidate semantic units are generated with incremental stream call rounds, and their output is compared with confirmed and unconfirmed records to eliminate overlapping semantics. Channel logical sequence numbers are then allocated from unoccupied logical positions after the allocation level, and late fragments of the original model are isolated. Update the scenario runtime snapshot based on the start confirmation, model fault status, and repetition suppression results.

Images