@lob-ox/core-darwin-x64 0.0.8 → 0.0.10

package/core.cjs

@@ -998,8 +998,6 @@ var require_brand = __commonJS({
     var CLI_SHIM_NAMES = ["lobox", "lobox.cmd", "lobox.ps1"];
     var GUI_BIN_NAMES = ["lobox-shell", "lobox-shell.exe"];
     var PROC_MATCH_GUARD = SHARED.proc.matchGuard;
-    var PROC_MATCH_GUI = "lobox-shell";
-    var PROC_MATCH_GUI_RE = "lobox-shell(\\.exe)?";
     var BRIDGE_MSG_KERNEL_UPDATE_REQUEST = SHARED.bridge.msgKernelUpdateRequest;
     var BRIDGE_MSG_KERNEL_UPDATE_RESULT = SHARED.bridge.msgKernelUpdateResult;
     var BRIDGE_MSG_KERNEL_UPDATE_PROGRESS = SHARED.bridge.msgKernelUpdateProgress;
@@ -1016,9 +1014,7 @@ var require_brand = __commonJS({
     var EVENT_HARNESS_REMOTE_TOKEN_CHANGED = "harness_remote_token_changed";
     var EVENT_LAN_HARNESS_TOKEN_UPDATED = "lan_harness_token_updated";
     var EVENT_UPGRADE_STOPPING_HARNESS = "upgrade_stopping_harness";
-    var EVENT_SHELL_UPDATE_PENDING = "shell_update_pending";
     var EVENT_SHELL_UPDATE_CHECKED = "shell_update_checked";
-    var EVENT_SHELL_RESTART_REQUESTED = "shell_restart_requested";
     var SYSTEMD_TEMPLATE_ASIDE_SUFFIX = ".disabled-by-lobox-";
     function corePackageName(tag) {
       return NPM_SCOPE + "/" + CORE_PKG_PREFIX + tag;
@@ -1120,8 +1116,6 @@ var require_brand = __commonJS({
       CLI_SHIM_NAMES,
       GUI_BIN_NAMES,
       PROC_MATCH_GUARD,
-      PROC_MATCH_GUI,
-      PROC_MATCH_GUI_RE,
       BRIDGE_MSG_KERNEL_UPDATE_REQUEST,
       BRIDGE_MSG_KERNEL_UPDATE_RESULT,
       BRIDGE_MSG_KERNEL_UPDATE_PROGRESS,
@@ -1138,9 +1132,7 @@ var require_brand = __commonJS({
       EVENT_HARNESS_REMOTE_TOKEN_CHANGED,
       EVENT_LAN_HARNESS_TOKEN_UPDATED,
       EVENT_UPGRADE_STOPPING_HARNESS,
-      EVENT_SHELL_UPDATE_PENDING,
       EVENT_SHELL_UPDATE_CHECKED,
-      EVENT_SHELL_RESTART_REQUESTED,
       SYSTEMD_TEMPLATE_ASIDE_SUFFIX,
       corePackageName,
       stateRoot: stateRoot2,
@@ -1312,14 +1304,11 @@ var require_config = __commonJS({
       };
     }
     var BASE_DEFAULTS = {
-      // 守卫监控节拍（进程存活只由 child 的 exit/close 事件与平台 pidlookup 判定，见 app/main/*）。
       tickIntervalMs: 5e3,
-      // 启动窗口（秒）：spawn 后 startsecs 内退出 ⇒ 记一次「启动失败」；活过 startsecs 后退出 ⇒ 正常重启，不计失败。
       startsecs: 10,
-      // 唯一一条限流：startupFailWindowMs 内「启动失败」达 startupFailBurst 次 ⇒ phase=FAILED，停止自动重启，等人工重试。
-      // 不变量：startupFailWindowMs > startupFailBurst × startsecs×1000（60s > 5×10s）；同一规则按域参数化，实例域见 domains/instance/state-machine.js。
       startupFailWindowMs: 6e4,
       startupFailBurst: 5,
+      restart: { windowMs: 6e4, burst: 5, baseDelayMs: 2e3, maxDelayMs: 6e4 },
       stopGraceMs: 1e4,
       portReleaseWaitMs: 1e4,
       apiHost: "127.0.0.1",
@@ -1347,7 +1336,6 @@ var require_config = __commonJS({
       initialCheckDelayMs: 2e4,
       upgradeTimeoutMs: 6e5,
       installCommandTemplate: ["npm", "install", "-g", "{pkg}@{version}"],
-      // apiAccessKey：非回环须带 Authorization: Bearer <key> 或 ?access_key=<key>，回环豁免；不配置则 LAN 受 RFC1918 约束、FRP 仍强制 remoteToken。
       apiAccessKey: null,
       closeAction: "hide",
       externalBrowser: null
@@ -1483,7 +1471,7 @@ var require_version = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     function guardVersion() {
-      if (true) return String("0.0.8");
+      if (true) return String("0.0.10");
       try {
         return JSON.parse(fs2.readFileSync(path2.join(__dirname, "..", "..", "package.json"), "utf8")).version || "unknown";
       } catch {
@@ -1822,28 +1810,38 @@ var require_field_tables = __commonJS({
 var require_phase = __commonJS({
   "src/app/state/phase.js"(exports2, module2) {
     "use strict";
+    var ENTRY_TO_LEGACY = {
+      stopped: "STOPPED",
+      installing: "INSTALLING",
+      starting: "STARTING",
+      running: "RUNNING",
+      draining: "STOPPING",
+      failed: "FAILED"
+    };
+    var LEGACY_TO_ENTRY = {
+      STOPPED: "stopped",
+      INSTALLING: "installing",
+      STARTING: "starting",
+      RUNNING: "running",
+      STOPPING: "draining",
+      FAILED: "failed",
+      OBSERVED: "stopped",
+      RESTARTING: "starting",
+      BACKOFF: "failed"
+    };
+    function entryToLegacyPhase(ph) {
+      return ENTRY_TO_LEGACY[ph] || "STOPPED";
+    }
     function legacyToEntryPhase(ph) {
-      return {
-        STOPPED: "stopped",
-        STARTING: "starting",
-        RUNNING: "running",
-        FAILED: "failed",
-        OBSERVED: "stopped",
-        RESTARTING: "starting",
-        BACKOFF: "failed"
-      }[ph] || "stopped";
+      return LEGACY_TO_ENTRY[ph] || "stopped";
     }
-    function entryToLegacyPhase(ph) {
-      return {
-        stopped: "STOPPED",
-        starting: "STARTING",
-        running: "RUNNING",
-        failed: "FAILED",
-        restarting: "STARTING",
-        backoff: "FAILED"
-      }[ph] || "STOPPED";
+    function isKnownEntry(ph) {
+      return Object.prototype.hasOwnProperty.call(ENTRY_TO_LEGACY, ph);
+    }
+    function isKnownLegacy(ph) {
+      return Object.prototype.hasOwnProperty.call(LEGACY_TO_ENTRY, ph);
     }
-    module2.exports = { legacyToEntryPhase, entryToLegacyPhase };
+    module2.exports = { entryToLegacyPhase, legacyToEntryPhase, isKnownEntry, isKnownLegacy };
   }
 });
 
@@ -2290,7 +2288,6 @@ var require_decide = __commonJS({
           return {
             phase,
             desired: d.state().desired(),
-            // 端口视角（不是存活判据）：只喂孤儿接管/占用分支。
             portUp: d.portUp() === true,
             childAlive: childAlive(d.mChild()),
             adoptedAlive: adoptedAlive(d.mAdoptPid()),
@@ -2302,7 +2299,6 @@ var require_decide = __commonJS({
             manualRestart: d.manualRestart() === true,
             spawnBlocked: !!(d.mSpawnBlockedUntil() && now < d.mSpawnBlockedUntil()),
             startDeadlinePassed: startDeadlinePassed(startDeadline, now),
-            // STARTING 且没有存活进程/没记启动窗口 = 已判定重启，等端口释放落点。
             restartInFlight: phase === "STARTING" && startDeadline === null,
             restartDue: d.mRestartAt() === null || now >= d.mRestartAt(),
             crashHalted: d.crashHalted() === true,
@@ -4138,13 +4134,6 @@ var require_alloc = __commonJS({
           this._releaseAlloc();
         }
       }
-      /**
-       * Lease I1：把"检查"与"置位"放在**同一个同步块**内。
-       *
-       * 修前：`while (r._allocLock) { await sleep(10); } r._allocLock = true;`
-       * —— 检查与置位之间隔着 await，两个并发 claimSlot 可同时观察到 false 并都置 true（真 TOCTOU）。
-       * 现在用 Lease.acquireSync 做同步 test-and-set；未取得则由调用方退避重试。
-       */
       async _acquireAlloc() {
         const r = this._registry;
         let waited = 0;
@@ -4171,7 +4160,6 @@ var require_alloc = __commonJS({
           }
         }
       }
-      // 跨进程分配锁 best-effort：获取超时返回 null 并继续（fail-open 有界，登记后复检是第二道防线）。
       async _acquireXLock() {
         const f = String(this._registry._file || "") + ".alloc.lock";
         const deadline = Date.now() + XLOCK_TIMEOUT_MS;
@@ -5047,320 +5035,138 @@ var require_policies = __commonJS({
   }
 });
 
-// src/domains/shell/core.js
-var require_core3 = __commonJS({
-  "src/domains/shell/core.js"(exports2, module2) {
-    "use strict";
-    var BRAND2 = require_brand();
-    var DEFAULTS = {
-      enabled: true,
-      intervalMs: 2e4,
-      graceMs: 9e4,
-      updateGraceMs: 3e5,
-      maxRestarts: 5,
-      windowMs: 18e5,
-      phaseMaxAgeMs: 6e5,
-      // 壳进程判据的**唯一来源**是跨语言单源（brand.js#PROC_MATCH_GUI，与 brand.rs 同名同值）：
-      //   此处再写一份字面量 = 改名漏一处 ⇒ pgrep 找不到壳（watchdog 反复拉起/双实例），或杀错进程。
-      procPattern: BRAND2.PROC_MATCH_GUI
-    };
-    var HEADLESS_FLAGS = Object.freeze([
-      "--shell-update-plan",
-      "--core-plan",
-      "--node-plan",
-      "--mirror-plan",
-      "--env-plan",
-      "--service-plan",
-      "--platform-matrix",
-      "--run-guard",
-      "--watchdog"
-    ]);
-    var HEADLESS_RE = new RegExp(HEADLESS_FLAGS.join("|"));
-    var SHELL_PROC_RE = new RegExp(BRAND2.PROC_MATCH_GUI_RE);
-    function isShellProcess(proc) {
-      const c = String(proc && proc.cmdline || "");
-      if (HEADLESS_RE.test(c)) return false;
-      return SHELL_PROC_RE.test(c);
-    }
-    function decide(i) {
-      const c = i.config || {};
-      if (i.alive > 0) return { action: "alive", reason: "\u58F3\u5728\u8FD0\u884C" };
-      if (i.absentForMs === null || i.absentForMs === void 0) {
-        return { action: "record", reason: "\u9996\u6B21\u89C2\u5BDF\u5230\u58F3\u7F3A\u5931\uFF0C\u5F00\u59CB\u8BA1\u65F6" };
-      }
-      const needMs = i.expectedAbsence ? c.updateGraceMs || DEFAULTS.updateGraceMs : c.graceMs || DEFAULTS.graceMs;
-      if (i.absentForMs < needMs) {
-        return { action: "wait", reason: i.expectedAbsence ? "\u58F3\u5904\u4E8E\u9884\u671F\u7F3A\u5E2D\uFF08\u66F4\u65B0/\u91CD\u542F\uFF09" : "\u672A\u8FBE\u5BBD\u9650\u671F", needMs };
-      }
-      if (!i.sessionAvailable) {
-        return { action: "skip", reason: "\u65E0\u56FE\u5F62\u4F1A\u8BDD\uFF08\u6CE8\u9500/\u7EAF\u7EC8\u7AEF\uFF09\uFF0C\u62C9\u8D77 GUI \u5FC5\u5931\u8D25" };
-      }
-      if ((i.restartsInWindow || 0) >= (c.maxRestarts || DEFAULTS.maxRestarts)) {
-        return { action: "skip", reason: "\u7A97\u53E3\u5185\u62C9\u8D77\u6B21\u6570\u5DF2\u8FBE\u4E0A\u9650\uFF0C\u505C\u6B62\u91CD\u8BD5\uFF08\u9632\u98CE\u66B4\uFF09" };
-      }
-      if (!i.hasExe) {
-        return { action: "skip", reason: "\u65E0\u6CD5\u5B9A\u4F4D\u58F3\u53EF\u6267\u884C\u6587\u4EF6\uFF08identity.json \u672A\u8BB0\u5F55 exe\uFF09" };
-      }
-      return { action: "restart", reason: "\u58F3\u7F3A\u5931\u4E14\u5DF2\u8FC7\u5BBD\u9650\u671F", needMs };
-    }
-    function isUpdatePhase(phase) {
-      const p = String(phase || "");
-      return p === "restarting" || p.indexOf("shell-update") === 0;
-    }
-    function exeFromCmdline(cmdline) {
-      const s = String(cmdline || "").trim();
-      if (!s) return null;
-      if (s.startsWith('"')) {
-        const end = s.indexOf('"', 1);
-        return end > 1 ? s.slice(1, end) : null;
-      }
-      return s.split(/\s+/)[0] || null;
-    }
-    function deriveState(id, journal) {
-      const j = journal || {};
-      if (!j.to) return { state: "idle", reason: "\u65E0\u8FDB\u884C\u4E2D\u7684\u66F4\u65B0", journal: j, identity: id };
-      const cur = id && id.version ? String(id.version) : null;
-      if (cur && cur === j.to && id && id.phase === "ready") {
-        const next = j.confirmed === true ? j : Object.assign({}, j, { confirmed: true });
-        return { state: "confirmed", version: cur, reason: "\u58F3\u5DF2\u5065\u5EB7\u8FD0\u884C\u65B0\u7248\u672C", journal: next, identity: id };
-      }
-      return {
-        state: "pending",
-        target: j.to,
-        current: cur,
-        reason: cur === j.to ? "\u7B49\u5F85\u58F3\u4E0A\u62A5\u5C31\u7EEA" : "\u7B49\u5F85\u58F3\u91CD\u542F\u5230\u65B0\u7248\u672C",
-        journal: j,
-        identity: id
-      };
-    }
-    module2.exports = { DEFAULTS, isShellProcess, decide, isUpdatePhase, exeFromCmdline, deriveState, HEADLESS_FLAGS };
-  }
-});
-
-// src/domains/shell/watchdog.js
-var require_watchdog = __commonJS({
-  "src/domains/shell/watchdog.js"(exports2, module2) {
+// src/app/control/synchrony.js
+var require_synchrony = __commonJS({
+  "src/app/control/synchrony.js"(exports2, module2) {
     "use strict";
-    var { DEFAULTS, decide, isShellProcess, isUpdatePhase } = require_core3();
-    function createShellWatchdog(deps) {
-      const o = deps || {};
-      const shell = o.shell;
-      const pidlookup = o.pidlookup;
-      const desktop = o.desktop;
-      const logger = o.logger || console;
-      const events = o.events || null;
-      const config = o.config || {};
-      const now = o.now || (() => Date.now());
-      const procPattern = config.shellProcPattern || DEFAULTS.procPattern;
-      let missingSince = null;
-      let restarts = [];
-      let busy = false;
-      let lastSkipReason = null;
-      let everSawAlive = false;
-      let expectedSince = null;
-      let phaseStale = false;
-      let phaseStaleWarned = false;
-      let journalStale = false;
-      let journalStaleWarned = false;
-      const log = (m) => {
-        try {
-          logger.info && logger.info("[shell-watchdog] " + m);
-        } catch {
-        }
-      };
-      const warn = (m) => {
-        try {
-          logger.warn && logger.warn("[shell-watchdog] " + m);
-        } catch {
-        }
-      };
-      function shellProcs() {
-        let procs = [];
-        try {
-          procs = pidlookup.pgrepList(procPattern) || [];
-        } catch {
-          procs = [];
-        }
-        return procs.filter(isShellProcess);
+    var BeatScheduler = class {
+      constructor(opts) {
+        opts = opts || {};
+        this.logger = opts.logger || null;
+        this._beats = /* @__PURE__ */ new Map();
+        this._timer = null;
+        this._intervalMs = opts.intervalMs || 5e3;
+        this._seq = 0;
+        this._ticking = false;
+        this._stopping = false;
+        this.onBeatDone = null;
       }
-      function updatePhaseTracking(t) {
-        let phase = "";
-        try {
-          const id = shell.identity();
-          phase = String(id && id.phase || "");
-        } catch {
-        }
-        const inUpdate = isUpdatePhase(phase);
-        if (!inUpdate) {
-          expectedSince = null;
-          phaseStale = false;
-          phaseStaleWarned = false;
-          return;
-        }
-        if (expectedSince === null) expectedSince = t;
-        const maxAge = config.shellWatchdogPhaseMaxAgeMs || DEFAULTS.phaseMaxAgeMs;
-        phaseStale = t - expectedSince >= maxAge;
-        if (phaseStale && !phaseStaleWarned) {
-          phaseStaleWarned = true;
-          warn("identity.phase \u505C\u7559\u8FC7\u4E45\uFF08" + Math.round((t - expectedSince) / 1e3) + "s > " + Math.round(maxAge / 1e3) + "s\uFF09\uFF0C\u5224\u5B9A\u4E3A\u9648\u65E7\uFF1B\u4E0D\u518D\u5EF6\u957F\u5BBD\u9650");
-        }
+      register(name, fn, opts) {
+        if (typeof fn !== "function") throw new Error("beat " + name + " \u9700\u8981 fn");
+        opts = opts || {};
+        const every = opts.every === Infinity ? Infinity : Math.max(1, Number(opts.every) || 1);
+        const firstDelayMs = typeof opts.firstDelayMs === "number" && opts.firstDelayMs >= 0 ? opts.firstDelayMs : null;
+        const firstTicks = firstDelayMs !== null ? Math.max(0, Math.ceil(firstDelayMs / this._intervalMs)) : 0;
+        this._beats.set(name, {
+          fn,
+          every,
+          firstTicks,
+          timeoutMs: typeof opts.timeoutMs === "number" && opts.timeoutMs > 0 ? opts.timeoutMs : 0,
+          _seqSeen: 0,
+          _lastSeq: null,
+          _fired: false
+        });
+        return this;
       }
-      function updateJournalTracking(t) {
-        let j = null;
-        try {
-          j = shell.readJournal && shell.readJournal();
-        } catch {
-        }
-        if (!j || !j.to || j.confirmed) {
-          journalStale = false;
-          journalStaleWarned = false;
-          return;
-        }
-        const t0 = Date.parse(String(j.startedAt || ""));
-        if (!Number.isFinite(t0)) {
-          journalStale = false;
-          return;
-        }
-        const maxAge = config.shellWatchdogPhaseMaxAgeMs || DEFAULTS.phaseMaxAgeMs;
-        journalStale = t - t0 >= maxAge;
-        if (journalStale && !journalStaleWarned) {
-          journalStaleWarned = true;
-          warn("\u66F4\u65B0\u8D26\u672C\u672A\u786E\u8BA4\u5DF2\u8D85 " + Math.round((t - t0) / 1e3) + "s\uFF08> " + Math.round(maxAge / 1e3) + "s\uFF09\uFF0C\u5224\u5B9A\u4E3A\u9648\u65E7\uFF1B\u4E0D\u518D\u636E\u6B64\u5EF6\u957F\u5BBD\u9650");
-        }
+      unregister(name) {
+        this._beats.delete(name);
+        return this;
       }
-      function expectedAbsence() {
-        let phase = "";
-        try {
-          const id = shell.identity();
-          phase = String(id && id.phase || "");
-        } catch {
-        }
-        const inUpdate = isUpdatePhase(phase);
-        if (inUpdate && !phaseStale) return true;
-        try {
-          const j = shell.readJournal && shell.readJournal();
-          if (j && j.to && !j.confirmed) return !journalStale;
-        } catch {
-        }
-        return false;
+      has(name) {
+        return this._beats.has(name);
       }
-      function exePath() {
-        if (config.shellExePath) return config.shellExePath;
+      async withLock(fn) {
+        if (this._ticking || this._stopping) return { __skipped: "busy" };
+        this._ticking = true;
         try {
-          const id = shell.identity();
-          return id && id.exe || null;
-        } catch {
-          return null;
+          return await fn();
+        } finally {
+          this._ticking = false;
         }
       }
-      async function tick() {
-        if (config.shellWatchdog === false) return { skipped: "disabled" };
-        if (busy) return { skipped: "busy" };
-        busy = true;
+      async tick() {
+        if (this._ticking || this._stopping) return { skipped: true, done: [], errors: [] };
+        this._ticking = true;
+        const done = [];
+        const errors = [];
+        const iv = this._intervalMs;
         try {
-          const t = now();
-          const procs = shellProcs();
-          const alive = procs.length;
-          if (alive > 0 && typeof o.onShellAlive === "function") {
+          this._seq++;
+          for (const [name, b] of this._beats) {
+            b._seqSeen++;
+            if (b.every === Infinity) {
+              if (b._fired || b._seqSeen <= b.firstTicks) continue;
+              b._fired = true;
+            } else {
+              if (b._seqSeen <= b.firstTicks) continue;
+              if (b._lastSeq !== null && this._seq - b._lastSeq < b.every) continue;
+              b._lastSeq = this._seq;
+            }
+            let p;
             try {
-              o.onShellAlive();
-            } catch {
+              p = Promise.resolve(b.fn());
+            } catch (e) {
+              errors.push(name + ":" + (e && e.message));
+              continue;
             }
-          }
-          if (typeof o.halted === "function" && o.halted()) {
-            lastSkipReason = "\u4F1A\u8BDD\u9000\u51FA\u4E2D/\u7528\u6237\u5DF2\u9000\u51FA\uFF08\u4E0D\u62C9\u8D77\uFF09";
-            return { skipped: "halted", reason: lastSkipReason };
-          }
-          if (alive > 0 && !everSawAlive) {
-            everSawAlive = true;
-            log("\u5DF2\u89C2\u6D4B\u5230\u684C\u9762\u58F3\u5728\u8FD0\u884C\uFF08pid=" + procs[0].pid + "\uFF09");
-          }
-          const absentForMs = alive > 0 ? null : missingSince === null ? null : t - missingSince;
-          updatePhaseTracking(t);
-          updateJournalTracking(t);
-          const expected = absentForMs === null ? false : expectedAbsence();
-          const exe = exePath();
-          restarts = restarts.filter((x) => t - x < (config.shellWatchdogWindowMs || DEFAULTS.windowMs));
-          const d = decide({
-            alive,
-            absentForMs,
-            expectedAbsence: expected,
-            sessionAvailable: desktop.sessionAvailable(),
-            restartsInWindow: restarts.length,
-            hasExe: !!exe,
-            config: {
-              graceMs: config.shellWatchdogGraceMs || DEFAULTS.graceMs,
-              updateGraceMs: config.shellWatchdogUpdateGraceMs || DEFAULTS.updateGraceMs,
-              maxRestarts: config.shellWatchdogMaxRestarts || DEFAULTS.maxRestarts
+            if (b.timeoutMs && b.timeoutMs > 0) {
+              p = Promise.race([p, new Promise((res) => {
+                const t = setTimeout(() => res({ __beatTimeout: true }), b.timeoutMs);
+                if (t.unref) t.unref();
+              })]);
             }
-          });
-          if (d.action === "alive") {
-            missingSince = null;
-            lastSkipReason = null;
-            return { alive };
-          }
-          if (d.action === "record") {
-            missingSince = t;
-            log("\u684C\u9762\u58F3\u7F3A\u5931\uFF0C\u5F00\u59CB\u8BA1\u65F6\uFF08\u5BBD\u9650 " + Math.round((config.shellWatchdogGraceMs || DEFAULTS.graceMs) / 1e3) + "s\uFF09");
-            return { absent: true };
-          }
-          if (d.action === "wait") {
-            lastSkipReason = d.reason + "\uFF08" + Math.round(absentForMs / 1e3) + "s/" + Math.round(d.needMs / 1e3) + "s\uFF09";
-            return { waiting: d.reason };
-          }
-          if (d.action === "skip") {
-            if (lastSkipReason !== d.reason) {
-              lastSkipReason = d.reason;
-              warn("\u4E0D\u62C9\u8D77\u684C\u9762\u58F3\uFF1A" + d.reason);
+            try {
+              const r = await p;
+              if (r && r.__beatTimeout) {
+                errors.push(name + ":timeout");
+                if (this.logger && this.logger.warn) this.logger.warn("[beat] " + name + " \u8D85\u8FC7 " + b.timeoutMs + "ms\uFF0C\u5DF2\u8DF3\u8FC7\u672C\u62CD\uFF08\u9632\u505C\u6446\uFF09");
+              } else {
+                done.push(name);
+              }
+            } catch (e) {
+              errors.push(name + ":" + (e && e.message));
+              if (this.logger && this.logger.warn) this.logger.warn("[beat] " + name + ": " + (e && e.message));
             }
-            return { skipped: d.reason };
-          }
-          restarts.push(t);
-          const r = await shell.restartShell({
-            exePath: exe,
-            procPattern,
-            shouldAbort: typeof o.halted === "function" ? () => o.halted() : void 0
-          });
-          if (r && r.ok) {
-            if (events) events.append("shell_watchdog_restart", { pid: r.pid, exe: r.exe, absentMs: absentForMs });
-            log("\u684C\u9762\u58F3\u7F3A\u5931 " + Math.round(absentForMs / 1e3) + "s\uFF0C\u5DF2\u62C9\u8D77 pid=" + r.pid + " exe=" + r.exe);
-            missingSince = null;
-          } else {
-            if (events) events.append("shell_watchdog_restart_failed", { error: r && r.error || "\u672A\u77E5", absentMs: absentForMs });
-            warn("\u62C9\u8D77\u684C\u9762\u58F3\u5931\u8D25\uFF1A" + (r && r.error || "\u672A\u77E5"));
           }
-          return { restarted: !!(r && r.ok), error: r && r.error || null };
-        } catch (e) {
-          warn("\u76D1\u63A7\u5F02\u5E38\uFF1A" + (e && e.message || e));
-          return { error: e && e.message || String(e) };
         } finally {
-          busy = false;
+          this._ticking = false;
+        }
+        if (this.onBeatDone) {
+          try {
+            await this.onBeatDone({ done, errors });
+          } catch (e) {
+            if (this.logger && this.logger.warn) this.logger.warn("[beat] onBeatDone: " + (e && e.message));
+          }
         }
+        return { done, errors };
       }
-      function status() {
-        const t = now();
-        let session = { available: null, reason: null };
-        try {
-          session = desktop.describe();
-        } catch {
+      start(intervalMs) {
+        this._intervalMs = intervalMs || this._intervalMs;
+        this._stopping = false;
+        if (this._timer) clearInterval(this._timer);
+        const self = this;
+        this._timer = setInterval(() => {
+          self.tick();
+        }, this._intervalMs);
+        if (this._timer && typeof this._timer.unref === "function") this._timer.unref();
+        return this;
+      }
+      stop() {
+        this._stopping = true;
+        if (this._timer) {
+          clearInterval(this._timer);
+          this._timer = null;
         }
-        return {
-          enabled: config.shellWatchdog !== false,
-          intervalMs: config.shellWatchdogIntervalMs || DEFAULTS.intervalMs,
-          graceMs: config.shellWatchdogGraceMs || DEFAULTS.graceMs,
-          updateGraceMs: config.shellWatchdogUpdateGraceMs || DEFAULTS.updateGraceMs,
-          maxRestarts: config.shellWatchdogMaxRestarts || DEFAULTS.maxRestarts,
-          absentForMs: missingSince === null ? null : t - missingSince,
-          restartsInWindow: restarts.filter((x) => t - x < (config.shellWatchdogWindowMs || DEFAULTS.windowMs)).length,
-          everSawAlive,
-          lastSkipReason,
-          session,
-          expectedAbsence: expectedAbsence()
-        };
       }
-      return { tick, status, intervalMs: config.shellWatchdogIntervalMs || DEFAULTS.intervalMs };
-    }
-    module2.exports = { createShellWatchdog };
+      resume() {
+        this._stopping = false;
+      }
+      clear() {
+        this._beats.clear();
+        this.stop();
+      }
+    };
+    module2.exports = { BeatScheduler };
   }
 });
 
@@ -5465,7 +5271,6 @@ var require_capability_profile = __commonJS({
     "use strict";
     var linux = {
       sandboxLaunch: true,
-      // 服务管理器一律走产品自身的进程管理（不借 systemd）⇒ 无 cgroup 强制，如实为 supervise。
       sandboxEnforcement: "supervise",
       pidAdoption: true,
       processTreeKill: true,
@@ -7092,7 +6897,7 @@ var require_portable = __commonJS({
       if (!pid || !Array.isArray(anchors) || !anchors.length) return false;
       const cmd2 = pidlookup.readCmdline(pid);
       if (!cmd2) return false;
-      return anchors.some((a) => a && cmd2.indexOf(String(a)) !== -1);
+      return anchors.every((a) => a && cmd2.indexOf(String(a)) !== -1);
     }
     var portOf = (o) => {
       const p = Number(o && o.port);
@@ -7135,15 +6940,6 @@ var require_portable = __commonJS({
       kind: "portable",
       supportsUnits: false,
       supportsTransient: true,
-      /**
-       * 能力协商（根因 B 修法；与 router 域 `supports(cap)` 同一范式，下沉到平台层）。
-       *
-       * 判据来源：capability-profile.js 的 sandboxEnforcement —— 三平台均为 'supervise'
-       * （= 产品自身监控，**无 cgroup 级强制**）。此前该字段全仓 0 处查询，
-       * 于是 governor 在"限额根本无法生效"的前提下仍判违规并重启 ⇒ 永动机（P0）。
-       *
-       * 调用方（governor）必须先问后处置：不支持限额 ⇒ 只观测，绝不重启。
-       */
       supports(cap) {
         if (cap === "treeKill") return true;
         if (cap === "limits") return false;
@@ -7185,11 +6981,6 @@ var require_portable = __commonJS({
         }
         return true;
       },
-      // 审计 P0-I5：原实现在 Windows 上用 Atomics.wait（nap）**同步冻结事件循环**做轮询、且 SIGKILL 兜底分支
-      // 调用的 taskkill 完全异步不 await ⇒ 停止"无法确认"（常返回 false），进而实例仍被标 RUNNING、
-      // upgrade.js 在上个进程仍占端口时继续重装 ⇒ 与端口预检撞车回滚（正是 upgrade.js 想防的故障）。
-      // 修复：改为 async，用 real-timer 轮询（不阻塞事件循环），并等待 taskkill 真正结束（有界 10s，与 process.js killTree 同），
-      // 给足停止窗口再判定；仍超时再报 false（如实，不再假成功）。timeoutMs 仍被 STOP_WAIT_CAP_MS 截断（与调用方意图无关）。
       async stopUnit(unit, o) {
         const opts = o || {};
         const ours = findOurs(opts);
@@ -7296,19 +7087,6 @@ var require_portable = __commonJS({
         }
         return false;
       },
-      /**
-       * 单元是否活跃 —— 返回 Outcome 三态（根因 A 修法）。
-       *
-       * 此前返回 null 表示"未知"，而调用方 instance/ops.js:67 用 `active !== false` 判，
-       * 于是 null（未知）被当成"仍活跃" ⇒ removeInstance 把未知报成删除成功（P0）。
-       *
-       * 关键修正：**无 anchors 时不得把"有人在监听"当成"我们的实例在跑"**。
-       * 端口是共享事实、不是身份（与 monitor.js#matchesAnchors 同一条判据）；
-       * 缺锚点即无从验证身份 ⇒ 如实返回 unknown，由调用方决定（升级校验须失败并回滚）。
-       *
-       * 兼容：既有调用方若直接判真假，Outcome 对象恒为真值，行为同"true"，不会静默反转；
-       *      但显式判据（isOk/isFail/isUnknown）才能区分三态——见 shared/outcome.js。
-       */
       isUnitActive(unit, o) {
         const opts = o || {};
         if (findOurs(opts)) return OUTCOME.OK;
@@ -7332,7 +7110,6 @@ var require_portable = __commonJS({
       transientUnitFile() {
         return null;
       },
-      // 审计 P0-I5：随 stopUnit 改为 async，cleanTransient 也须 await（不得再用 === false 同步判）。
       async cleanTransient(unit, o) {
         const opts = o || {};
         const errors = [];
@@ -7371,7 +7148,6 @@ var require_service = __commonJS({
         kind: UNSUPPORTED_KIND,
         supportsUnits: false,
         supportsTransient: false,
-        // 能力协商：与 portable 同类，未知平台一律不支持（保持方法集一致）。
         supports() {
           return false;
         },
@@ -8295,6 +8071,122 @@ var require_os = __commonJS({
   }
 });
 
+// src/platform/contract/pm-client.js
+var require_pm_client = __commonJS({
+  "src/platform/contract/pm-client.js"(exports2, module2) {
+    "use strict";
+    var fs2 = require("node:fs");
+    var path2 = require("node:path");
+    var http2 = require("node:http");
+    var stateRoot2 = require_state_root();
+    var pidlookup = require_pidlookup();
+    var FILE_NAME = "guard-mgmt.json";
+    var SUPPORTED_SCHEMA = 1;
+    var HOST = "127.0.0.1";
+    var TIMEOUT_MS = 1500;
+    var unavailableHook = null;
+    function setUnavailableHook(fn) {
+      unavailableHook = typeof fn === "function" ? fn : null;
+    }
+    function file() {
+      return path2.join(stateRoot2.supervisorDir(), FILE_NAME);
+    }
+    function pidAlive2(pid) {
+      if (!Number.isInteger(pid) || pid <= 0) return false;
+      return pidlookup.probeAlive(pid) === "alive";
+    }
+    function endpoint() {
+      let text;
+      try {
+        text = fs2.readFileSync(file(), "utf8");
+      } catch {
+        return null;
+      }
+      let j;
+      try {
+        j = JSON.parse(text);
+      } catch {
+        return null;
+      }
+      if (!j || typeof j !== "object" || j.schema !== SUPPORTED_SCHEMA) return null;
+      const port = Number(j.port);
+      if (!Number.isInteger(port) || port <= 0 || port > 65535) return null;
+      if (!pidAlive2(Number(j.pid))) return null;
+      return { port, host: typeof j.host === "string" && j.host ? j.host : HOST };
+    }
+    function post(route, payload) {
+      const ep = endpoint();
+      if (!ep) {
+        if (unavailableHook) {
+          try {
+            unavailableHook(route);
+          } catch {
+          }
+        }
+        return false;
+      }
+      let body;
+      try {
+        body = JSON.stringify(payload || {});
+      } catch {
+        return false;
+      }
+      const req = http2.request(
+        {
+          host: ep.host,
+          port: ep.port,
+          path: route,
+          method: "POST",
+          headers: { "content-type": "application/json", "content-length": Buffer.byteLength(body) },
+          timeout: TIMEOUT_MS
+        },
+        (res) => {
+          res.resume();
+        }
+      );
+      req.on("timeout", () => {
+        try {
+          req.destroy();
+        } catch {
+        }
+      });
+      req.on("error", () => {
+      });
+      try {
+        req.end(body);
+        return true;
+      } catch {
+        return false;
+      }
+    }
+    module2.exports = {
+      FILE_NAME,
+      SUPPORTED_SCHEMA,
+      file,
+      endpoint,
+      setUnavailableHook,
+      register(desc) {
+        return post("/pm/register", desc);
+      },
+      setDesired(id, desired) {
+        return post("/pm/set-desired", { id, desired });
+      },
+      onPhase(id, phase) {
+        return post("/pm/on-phase", { id, phase });
+      },
+      recordExit(id, code, signal, startupFailure) {
+        return post("/pm/record-exit", { id, code, signal, startup_failure: startupFailure === true });
+      },
+      requestRestart(id) {
+        return post("/pm/request-restart", { id });
+      },
+      resetBackoff(id) {
+        return post("/pm/reset-backoff", { id });
+      }
+    };
+  }
+});
+
 // src/app/assembly/bootstrap.js
 var require_bootstrap = __commonJS({
   "src/app/assembly/bootstrap.js"(exports2, module2) {
@@ -8305,11 +8197,20 @@ var require_bootstrap = __commonJS({
     var path2 = require("node:path");
     var fs2 = require("node:fs");
     var ports = require_ports().shared;
-    var { createShellWatchdog } = require_watchdog();
     var pidlook = require_pidlookup();
+    var { BeatScheduler } = require_synchrony();
     var platform = require_os();
     var ENV_FORM_STARTUP_DELAY_MS = 3e3;
     function _bootstrap(host) {
+      try {
+        require_pm_client().setUnavailableHook((route) => {
+          try {
+            host.events.append("pm_endpoint_unavailable", { route });
+          } catch {
+          }
+        });
+      } catch {
+      }
       try {
         host.events.append("guard_started", {
           pid: process.pid,
@@ -8330,39 +8231,55 @@ var require_bootstrap = __commonJS({
         routerAutostart: host.config.routerAutostart === true,
         routerMode: null,
         updateCheck: null,
-        shellWatchdog: null,
         lastRefresh: null
       };
-      host.tick();
-      host._timer = host.managedObjects ? null : setInterval(() => host.tick(), host.config.tickIntervalMs);
+      host._startupFacts.bootAt = Date.now();
+      host._startupFacts.updateCheck = host._startupFacts.updateCheck || null;
+      if (!host._beatScheduler) host._beatScheduler = new BeatScheduler({ logger: host.logger, intervalMs: host.config.tickIntervalMs || 5e3 });
+      const beat = host._beatScheduler;
+      const tickMs = host.config.tickIntervalMs || 5e3;
+      beat.unregister("main");
+      beat.unregister("heartbeat");
+      beat.unregister("instance-supervise");
+      beat.unregister("upgrade-check");
+      beat.register("main", () => host.tick(), { every: 1 });
+      beat.register("heartbeat", () => {
+        if (host.managedObjects) return host.managedObjects.heartbeat(tickMs);
+        return host.tick();
+      }, { every: 1, timeoutMs: Math.max(3e4, tickMs * 12) });
+      beat.register("instance-supervise", async () => {
+        if (!host.instances) return;
+        try {
+          for (const inst of host.instances.all()) {
+            if (inst.domain === "native") continue;
+            host.instances.supervise && host.instances.supervise(inst.id);
+          }
+        } catch (e) {
+        }
+        try {
+          host.instances.governSweep && host.instances.governSweep();
+        } catch (e) {
+        }
+      }, { every: 1 });
+      if (host.config.updateCheckEnabled !== false) {
+        const checkDelayMs2 = host.config.initialCheckDelayMs || 2e4;
+        const checkIntervalMs2 = Math.max(1, Math.round((host.config.updateCheckIntervalMs || 36e5) / tickMs));
+        beat.register("upgrade-check", () => {
+          try {
+            host.nativeManager.checkUpdate();
+          } catch (e) {
+          }
+        }, { every: checkIntervalMs2, firstDelayMs: checkDelayMs2 });
+      }
+      beat.tick();
+      beat.start(tickMs);
+      host._timer = null;
+      host._heartbeatTimer = null;
+      host._upgradeTimer = null;
+      host._initialCheckTimer = null;
       host._lastHeartbeatAt = Date.now();
       host._heartbeatStalls = 0;
       host._heartbeatBeat = host._heartbeatBeat || 0;
-      const heartbeatIv = host.config.tickIntervalMs || 5e3;
-      host._heartbeatTimer = setInterval(() => {
-        if (host._heartbeatBusy) return;
-        host._heartbeatBusy = true;
-        const iv = heartbeatIv;
-        const beat = ++host._heartbeatBeat;
-        host._lastHeartbeatAt = Date.now();
-        const objCount = host.managedObjects && typeof host.managedObjects.count === "function" ? host.managedObjects.count() : 1;
-        const stallMs = Math.max(3e4, iv * 12, objCount * 6 * iv + iv);
-        const guard = setTimeout(() => {
-          if (host._heartbeatBusy && beat === host._heartbeatBeat) {
-            host._heartbeatBusy = false;
-            host._heartbeatStalls++;
-            if (host.logger && host.logger.warn) {
-              host.logger.warn("[heartbeat] \u5355\u62CD\u8D85\u8FC7 " + stallMs + "ms \u672A\u7ED3\u7B97\uFF0C\u5F3A\u5236\u91CA\u653E\u9632\u505C\u6446\uFF08\u7B2C " + host._heartbeatStalls + " \u6B21\uFF09");
-            }
-          }
-        }, stallMs);
-        if (guard && typeof guard.unref === "function") guard.unref();
-        Promise.resolve(host.managedObjects ? host.managedObjects.heartbeat(iv) : null).catch(() => {
-        }).finally(() => {
-          clearTimeout(guard);
-          if (beat === host._heartbeatBeat) host._heartbeatBusy = false;
-        });
-      }, heartbeatIv);
       if (host.lanDaemonEnabled()) {
         host._syncLanState();
         const lrt = host._ensureLanRuntime(true);
@@ -8372,7 +8289,6 @@ var require_bootstrap = __commonJS({
         });
         host.lan.syncFrpc();
       }
-      if (!host.managedObjects) host.instances.startTimer(host.config.tickIntervalMs || 5e3);
       if (!host.lanDaemonEnabled()) {
         for (const inst of host.instances.all()) {
           if (inst.remoteMode === "lan" || inst.remoteMode === "wan") host.lan.syncProxy(inst).catch(() => {
@@ -8436,22 +8352,6 @@ var require_bootstrap = __commonJS({
         initialDelayMs: checkDelayMs,
         intervalMs: checkIntervalMs
       };
-      if (host.config.updateCheckEnabled !== false) {
-        host._initialCheckTimer = setTimeout(() => {
-          host.nativeManager.checkUpdate();
-        }, checkDelayMs);
-        host._upgradeTimer = setInterval(() => {
-          host.nativeManager.checkUpdate();
-        }, checkIntervalMs);
-      }
-      try {
-        host._startShellWatchdog();
-      } catch (e) {
-        if (host.logger && host.logger.warn) {
-          host.logger.warn("[shell-watchdog] \u542F\u52A8\u5F02\u5E38\uFF08\u4E0D\u5F71\u54CD\u5B88\u536B\u4E3B\u5FAA\u73AF\uFF09: " + (e && e.message || e));
-        }
-      }
-      host._startupFacts.shellWatchdog = !!host.shellWatchdog;
       const envTimer = setTimeout(() => {
         try {
           host._refreshEnvironmentForm();
@@ -8496,41 +8396,6 @@ var require_bootstrap = __commonJS({
         return null;
       });
     }
-    function _startShellWatchdog(host) {
-      if (host.config.shellWatchdog === false) {
-        host.logger.info && host.logger.info("[shell-watchdog] \u5DF2\u6309\u914D\u7F6E\u7981\u7528");
-        return;
-      }
-      try {
-        host.shellWatchdog = createShellWatchdog({
-          shell: host.shellDomain,
-          pidlookup: pidlook,
-          desktop: platform.desktop,
-          logger: host.logger,
-          events: host.events,
-          config: host.config,
-          halted: () => host._shellExitIntended(),
-          onShellAlive: () => {
-            if (!host._shellHalted) return;
-            if (host._stopping) return;
-            if (host._sessionHalting && host._sessionHalting()) return;
-            host._shellHalted = false;
-            try {
-              host.writeState(true);
-            } catch {
-            }
-          }
-        });
-        host._shellWatchdogTimer = setInterval(() => {
-          Promise.resolve(host.shellWatchdog.tick()).catch(() => {
-          });
-        }, host.shellWatchdog.intervalMs);
-        if (host._shellWatchdogTimer.unref) host._shellWatchdogTimer.unref();
-        host.logger.info && host.logger.info("[shell-watchdog] \u5DF2\u542F\u7528\uFF08\u5468\u671F " + Math.round(host.shellWatchdog.intervalMs / 1e3) + "s\uFF09");
-      } catch (e) {
-        host.logger.warn && host.logger.warn("[shell-watchdog] \u521D\u59CB\u5316\u5931\u8D25\uFF08\u4E0D\u5F71\u54CD\u5B88\u536B\uFF09: " + (e && e.message || e));
-      }
-    }
     function _registerFixedPorts(host) {
       ports.register("dsh-main", host.config.targetPort);
       ports.registerSole("supervisor-api", host.config.apiPort);
@@ -8559,7 +8424,7 @@ var require_bootstrap = __commonJS({
         }
       }
     }
-    module2.exports = { _bootstrap, _startShellWatchdog, _registerFixedPorts, _bindNativeDshCommand, _refreshEnvironmentForm };
+    module2.exports = { _bootstrap, _registerFixedPorts, _bindNativeDshCommand, _refreshEnvironmentForm };
   }
 });
 
@@ -8615,14 +8480,17 @@ var require_api_rebind = __commonJS({
         });
         server.listen(host.config.apiPort, host.config.apiHost, () => {
           bind._tries = 0;
+          const bound = server.address();
+          const realPort = bound && Number.isInteger(bound.port) ? bound.port : host.config.apiPort;
           host.api = server;
+          if (realPort !== host.config.apiPort) host.config.apiPort = realPort;
           try {
-            portsShared.registerSole("supervisor-api", host.config.apiPort);
+            portsShared.registerSole("supervisor-api", realPort);
           } catch (e) {
             host.logger.warn("ports.registerSole(supervisor-api) \u5931\u8D25: " + (e && e.message || e));
           }
-          host.events.append("api_listening", { host: host.config.apiHost, port: host.config.apiPort });
-          host.logger.info("api listening on " + host.config.apiHost + ":" + host.config.apiPort);
+          host.events.append("api_listening", { host: host.config.apiHost, port: realPort });
+          host.logger.info("api listening on " + host.config.apiHost + ":" + realPort);
         });
       };
       bind._tries = 0;
@@ -8644,19 +8512,21 @@ var require_api_rebind = __commonJS({
           host.logger.error("api error: " + (err ? err.message : String(err)));
         });
         server.listen(port, host.config.apiHost, () => {
+          const bound = server.address();
+          const realPort = bound && Number.isInteger(bound.port) ? bound.port : port;
           host.api = server;
           const prev = host.config.apiPort;
-          if (port !== prev) {
-            host.config.apiPort = port;
-            if (host.configPath) host.persistConfigPatch({ apiPort: port });
+          if (realPort !== prev) {
+            host.config.apiPort = realPort;
+            if (host.configPath) host.persistConfigPatch({ apiPort: realPort });
           }
           try {
-            portsShared.registerSole("supervisor-api", port);
+            portsShared.registerSole("supervisor-api", realPort);
           } catch (e) {
             host.logger.warn("ports.registerSole(supervisor-api) \u5931\u8D25: " + e.message);
           }
-          host.events.append("api_listening", { host: host.config.apiHost, port });
-          host.logger.info("api listening on " + host.config.apiHost + ":" + port);
+          host.events.append("api_listening", { host: host.config.apiHost, port: realPort });
+          host.logger.info("api listening on " + host.config.apiHost + ":" + realPort);
         });
         return server;
       };
@@ -10099,14 +9969,10 @@ var require_shutdown = __commonJS({
       host.events.append("guard_exit", {});
       host.logger.info("guard shutting down");
       host.writeState(true);
-      if (host._timer) clearInterval(host._timer);
-      if (host._heartbeatTimer) clearInterval(host._heartbeatTimer);
+      if (host._beatScheduler) host._beatScheduler.stop();
       if (host._killTimer) clearTimeout(host._killTimer);
       if (host._adoptKillTimer) clearTimeout(host._adoptKillTimer);
       abortInflightNpm(host, "guard-shutdown");
-      if (host._initialCheckTimer) clearTimeout(host._initialCheckTimer);
-      if (host._upgradeTimer) clearInterval(host._upgradeTimer);
-      if (host._shellWatchdogTimer) clearInterval(host._shellWatchdogTimer);
       if (host.api) {
         try {
           host.api.close();
@@ -10151,37 +10017,10 @@ var require_shutdown = __commonJS({
       } catch (e) {
         host.logger.warn && host.logger.warn("shutdownAll persist shellHalted: " + e.message);
       }
-      if (host._shellWatchdogTimer) {
-        clearInterval(host._shellWatchdogTimer);
-        host._shellWatchdogTimer = null;
-      }
-      if (host._heartbeatTimer) {
-        clearInterval(host._heartbeatTimer);
-        host._heartbeatTimer = null;
-      }
-      if (host._timer) {
-        clearInterval(host._timer);
-        host._timer = null;
-      }
-      if (host._initialCheckTimer) {
-        clearTimeout(host._initialCheckTimer);
-        host._initialCheckTimer = null;
-      }
-      if (host._upgradeTimer) {
-        clearInterval(host._upgradeTimer);
-        host._upgradeTimer = null;
-      }
-      if (host._killTimer) {
-        clearTimeout(host._killTimer);
-        host._killTimer = null;
-      }
-      if (host._adoptKillTimer) {
-        clearTimeout(host._adoptKillTimer);
-        host._adoptKillTimer = null;
-      }
       host.logger.info("[session] \u9000\u51FA\u6D41\u7A0B\u5F00\u59CB\uFF1A\u505C\u6B62\u5168\u90E8\u88AB\u7BA1\u5BF9\u8C61\u2026");
       host.events && host.events.append("shutdown_all", {});
       abortInflightNpm(host, "session-exit");
+      if (host._beatScheduler) host._beatScheduler.stop();
       host._stopMainDsh();
       await host._stopAllSandboxes();
       const stopDaemon = async (kind) => {
@@ -10417,6 +10256,12 @@ var require_instance_adapter = __commonJS({
           } catch (e) {
             d.logger() && d.logger().warn && d.logger().warn("sandbox setPhase: " + (e && e.message || e));
           }
+          try {
+            const rc = Number(inst.state && inst.state.restartCount) || 0;
+            if (entry.restartCount !== rc) d.managedObjects().setRestartCount(entry.id, rc);
+          } catch (e) {
+            d.logger() && d.logger().warn && d.logger().warn("sandbox setRestartCount: " + (e && e.message || e));
+          }
         }
       }
     };
@@ -11034,6 +10879,7 @@ var require_process2 = __commonJS({
     var native = require_command();
     var BRAND2 = require_brand();
     var { findManagedDshPort, applyMainPort } = require_port_rederive();
+    var pmClient = require_pm_client();
     var DEPS = /* @__PURE__ */ new WeakMap();
     var HELPERS = [
       "MissingNotified",
@@ -11089,7 +10935,6 @@ var require_process2 = __commonJS({
           const d = depsOf(this);
           return native.nativeCommand(d.config(), d.pluginManager());
         },
-        // 启动窗口（毫秒）：唯一的时间常量，spawn 时落成 startDeadline，窗口内退出即「启动失败」。
         startWindowMs() {
           const d = depsOf(this);
           const secs = Number(d.config().startsecs);
@@ -11169,6 +11014,7 @@ var require_process2 = __commonJS({
             errBuf.flush();
             if (d.mChild() !== child) return;
             d.events().append(BRAND2.EVENT_HARNESS_EXITED, { code, signal, phase: d.state().phase() });
+            pmClient.recordExit("main", code, signal, d.state().phase() === "STARTING");
             d.mSetChild(null);
             if (d.stopping()) return;
             if (d.state().desired() !== "running") return;
@@ -11178,6 +11024,7 @@ var require_process2 = __commonJS({
               const why = code !== null ? String(code) : "sig" + signal;
               const inStartup = phase === "STARTING";
               if (inStartup || d.state().guardian()) {
+                pmClient.requestRestart("main");
                 d.beginRestart("exit:" + why, { startupFailure: inStartup });
               } else {
                 d.writeCrashHalted(true);
@@ -11254,8 +11101,6 @@ var require_process2 = __commonJS({
           d.tokenService().scheduleCapture("main");
           d.state().write();
         },
-        // 重启：活过 startsecs 后退出（或人工重启）⇒ 正常重启，不记启动失败；窗口内退出 ⇒ 记一次启动失败并由限流裁决。
-        // 相位只有 STARTING / RUNNING / FAILED：重启=回到 STARTING（下一次 spawn 会开新的 startsecs 窗口）。
         _beginRestart(reason, opts) {
           const d = depsOf(this);
           const manual = !!(opts && opts.manual);
@@ -11396,7 +11241,6 @@ var require_signals = __commonJS({
             return null;
           }
         },
-        // 归属凭据：spawn 与 adopt 两条取得所有权的路线都要写；落盘走 writeAtomic + 0600。
         _writeMainOwner(dshPid, port) {
           const d = depsOf(this);
           try {
@@ -11452,7 +11296,6 @@ var require_signals = __commonJS({
             }
           }, d.config().stopGraceMs));
         },
-        // 代际 gen 保护共享的 _adoptKillTimer 槽位：定时器只在「本代仍是当前代」时置空。
         _killAdopted(pid) {
           const d = depsOf(this);
           const gen = (d.readAdoptKillGen() || 0) + 1;
@@ -11517,7 +11360,35 @@ var require_guardian = __commonJS({
       }
       return { start, count, tripped: count >= burst };
     }
-    module2.exports = { shouldGuard, bumpStartupFailure };
+    function makeBudget(cfg) {
+      const windowMs = cfg && Number(cfg.windowMs) > 0 ? Number(cfg.windowMs) : 6e4;
+      const burst = cfg && Number(cfg.burst) >= 1 ? Number(cfg.burst) : 5;
+      let state = { start: null, count: 0 };
+      const self = {
+        windowMs,
+        burst,
+        get count() {
+          return state.count;
+        },
+        get tripped() {
+          return state.count >= burst;
+        },
+        note(startupFailure) {
+          if (startupFailure === false || startupFailure == null) {
+            return { tripped: false, count: state.count, halted: false };
+          }
+          const dec = bumpStartupFailure(state, Date.now(), { windowMs, burst });
+          state.start = dec.start;
+          state.count = dec.count;
+          return { tripped: dec.tripped, count: state.count, halted: dec.tripped };
+        },
+        reset() {
+          state = { start: null, count: 0 };
+        }
+      };
+      return self;
+    }
+    module2.exports = { shouldGuard, bumpStartupFailure, makeBudget };
   }
 });
 
@@ -11526,6 +11397,7 @@ var require_startup_throttle = __commonJS({
   "src/app/main/startup-throttle.js"(exports2, module2) {
     "use strict";
     var guardian = require_guardian();
+    var pmClient = require_pm_client();
     var DEPS = /* @__PURE__ */ new WeakMap();
     function depsOf(host) {
       let d = DEPS.get(host);
@@ -11565,8 +11437,6 @@ var require_startup_throttle = __commonJS({
     }
     module2.exports = {
       methods: {
-        // 唯一一条限流：startupFailWindowMs 内「启动窗口内退出」达 startupFailBurst 次 ⇒ phase=FAILED。
-        // 到点即停自动重启：不排队、不退避、不指数等待；恢复的唯一入口是人工重试（_retryStartupFailure）。
         _noteStartupFailure() {
           const d = depsOf(this);
           const windowMs = d.config().startupFailWindowMs || 6e4;
@@ -11591,11 +11461,11 @@ var require_startup_throttle = __commonJS({
           );
           return { failed: true, count: dec.count };
         },
-        // 手动重试入口：清计数后回到 STARTING（随后由 STARTING 分支重新 spawn，新的 startsecs 窗口）。
         _retryStartupFailure() {
           const d = depsOf(this);
           d.mSetStartupFailWindowStart(null);
           d.mSetStartupFailCount(0);
+          pmClient.resetBackoff("main");
           d.events().append("startup_retry", {});
           d.logger().warn("\u542F\u52A8\u5931\u8D25\u8BA1\u6570\u5DF2\u6E05\u96F6\uFF1A\u4EBA\u5DE5\u91CD\u8BD5\uFF0C\u56DE\u5230 STARTING");
           return { ok: true };
@@ -12145,8 +12015,6 @@ var require_runtime2 = __commonJS({
             spawnEnv: () => ({ DSH_SUPERVISOR_CONFIG: cfgPath }),
             logger: d.logger(),
             events: d.events(),
-            // `this` 是宿主（本方法经 host._daemonLifecycle(kind) 调用）；箭头函数捕获它。
-            // 此前写作 host._exitIntended()，而 host 只存在于 depsOf(host) 形参作用域 ⇒ 延迟回调求值时 ReferenceError。
             exitIntended: () => this._exitIntended()
           });
           return lc[kind];
@@ -13014,7 +12882,7 @@ var require_credential = __commonJS({
 });
 
 // src/domains/relay/core.js
-var require_core4 = __commonJS({
+var require_core3 = __commonJS({
   "src/domains/relay/core.js"(exports2, module2) {
     "use strict";
     var crypto = require("node:crypto");
@@ -13042,14 +12910,52 @@ var require_core4 = __commonJS({
       }
       return null;
     }
-    function upstreamPath(rawUrl) {
-      try {
-        const u = new URL(rawUrl, "http://127.0.0.1");
-        if (u.searchParams.has("token")) u.searchParams.delete("token");
-        return u.pathname + (u.searchParams.toString() ? "?" + u.searchParams.toString() : "");
-      } catch {
-        return rawUrl || "/";
+    function stripGateTokenAndPreserve(rawUrl) {
+      if (!rawUrl) return "/";
+      let url = rawUrl;
+      const hashIdx = url.indexOf("#");
+      if (hashIdx >= 0) url = url.slice(0, hashIdx);
+      const qIdx = url.indexOf("?");
+      const path2 = qIdx >= 0 ? url.slice(0, qIdx) : url;
+      if (qIdx < 0) return path2 || "/";
+      const query = url.slice(qIdx + 1);
+      if (!query) return path2 || "/";
+      const kept = [];
+      for (const pair of query.split("&")) {
+        if (!pair) {
+          kept.push(pair);
+          continue;
+        }
+        const eq = pair.indexOf("=");
+        const rawKey = eq >= 0 ? pair.slice(0, eq) : pair;
+        let key = rawKey;
+        try {
+          key = decodeURIComponent(rawKey);
+        } catch {
+        }
+        if (key === "token") continue;
+        kept.push(pair);
       }
+      const out = path2 || "/";
+      return kept.length ? out + "?" + kept.join("&") : out;
+    }
+    function upstreamPath(rawUrl) {
+      return stripGateTokenAndPreserve(rawUrl);
+    }
+    var POLYFILL_SCRIPT = `<script>
+if (typeof crypto.randomUUID !== 'function') {
+  crypto.randomUUID = function () {
+    var b = crypto.getRandomValues(new Uint8Array(16));
+    b[6] = (b[6] & 0x0f) | 0x40;
+    b[8] = (b[8] & 0x3f) | 0x80;
+    var h = '';
+    for (var i = 0; i < 16; i++) h += (i === 4 || i === 6 || i === 8 || i === 12 ? '-' : '') + ('0' + b[i].toString(16)).slice(-2);
+    return h;
+  };
+}
+</script>`;
+    function redactLogPath(rawUrl) {
+      return rawUrl ? stripGateTokenAndPreserve(rawUrl) : "";
     }
     function lanGateCookieValue(token, salt) {
       const t = String(token == null ? "" : token);
@@ -13057,23 +12963,6 @@ var require_core4 = __commonJS({
       if (!t || !s) return "";
       return crypto.createHash("sha256").update(s + "\n" + t).digest("hex");
     }
-    function hasValidToken(req, token, salt, mode) {
-      if (!token) return normalizeRemoteMode(mode) === "lan";
-      const url = new URL(req.url, "http://localhost");
-      const queryToken = url.searchParams.get("token");
-      if (queryToken && safeEqual(queryToken, token)) return true;
-      const cookies = req.headers.cookie || "";
-      const m = LAN_COOKIE_RE.exec(cookies);
-      if (m) {
-        try {
-          const want = lanGateCookieValue(token, salt);
-          return !!want && safeEqual(decodeURIComponent(m[1]), want);
-        } catch {
-          return false;
-        }
-      }
-      return false;
-    }
     function tokenGateDecision(req, token, salt, mode) {
       if (!token) return normalizeRemoteMode(mode) === "lan" ? { ok: true } : { ok: false, unauthorized: true };
       const url = new URL(req.url, "http://localhost");
@@ -13096,27 +12985,22 @@ var require_core4 = __commonJS({
       }
       return { ok: false, unauthorized: true };
     }
-    var POLYFILL_SCRIPT = `<script>
-if (typeof crypto.randomUUID !== 'function') {
-  crypto.randomUUID = function () {
-    var b = crypto.getRandomValues(new Uint8Array(16));
-    b[6] = (b[6] & 0x0f) | 0x40;
-    b[8] = (b[8] & 0x3f) | 0x80;
-    var h = '';
-    for (var i = 0; i < 16; i++) h += (i === 4 || i === 6 || i === 8 || i === 12 ? '-' : '') + ('0' + b[i].toString(16)).slice(-2);
-    return h;
-  };
-}
-</script>`;
-    function redactLogPath(rawUrl) {
-      if (!rawUrl) return "";
-      try {
-        const u = new URL(rawUrl, "http://127.0.0.1");
-        if (u.searchParams.has("token")) u.searchParams.delete("token");
-        return u.pathname + (u.searchParams.toString() ? "?" + u.searchParams.toString() : "");
-      } catch {
-        return String(rawUrl || "").replace(/[?&]token=[^&]*/, "");
+    function hasValidToken(req, token, salt, mode) {
+      if (!token) return normalizeRemoteMode(mode) === "lan";
+      const url = new URL(req.url, "http://localhost");
+      const queryToken = url.searchParams.get("token");
+      if (queryToken && safeEqual(queryToken, token)) return true;
+      const cookies = req.headers.cookie || "";
+      const m = LAN_COOKIE_RE.exec(cookies);
+      if (m) {
+        try {
+          const want = lanGateCookieValue(token, salt);
+          return !!want && safeEqual(decodeURIComponent(m[1]), want);
+        } catch {
+          return false;
+        }
       }
+      return false;
     }
     function buildFrpcToml(settings, instances) {
       const s = settings || {};
@@ -13147,8 +13031,6 @@ if (typeof crypto.randomUUID !== 'function') {
       return {
         serverAddr: String(j.serverAddr !== void 0 ? j.serverAddr : cur.serverAddr).trim(),
         serverPort: Number(j.serverPort) || cur.serverPort,
-        // authToken：null/undefined 归一为空串（frpc 遇空串不写 auth.token，避免 String(null)==="null" 被当成共享密钥）；
-        //   非空串统一 trim，与 serverAddr 同口径。
         authToken: j.authToken === void 0 ? cur.authToken : j.authToken == null ? "" : String(j.authToken).trim(),
         user: String(j.user || cur.user || "dsh")
       };
@@ -13231,7 +13113,7 @@ if (typeof crypto.randomUUID !== 'function') {
 var require_lan2 = __commonJS({
   "src/app/domain-actions/lan.js"(exports2, module2) {
     "use strict";
-    var { validateWanAccess, generateRemoteToken } = require_core4();
+    var { validateWanAccess, generateRemoteToken } = require_core3();
     var { remoteTokenStrength } = require_credential();
     var BRAND2 = require_brand();
     function lanModule(deps) {
@@ -13598,13 +13480,6 @@ var require_env = __commonJS({
               } catch {
                 return null;
               }
-            })(),
-            shellWatchdog: (() => {
-              try {
-                return this.shellWatchdog && typeof this.shellWatchdog.status === "function" ? this.shellWatchdog.status() : null;
-              } catch {
-                return null;
-              }
             })()
           };
         },
@@ -13819,7 +13694,6 @@ var require_versions = __commonJS({
           }
           return dir;
         },
-        // 同步 spawn 会冻结事件循环，消费方含 HTTP 路径，故 git 子进程异步执行。
         async guardVersionLocal() {
           const d = depsOf(this);
           const root = d.vcsRoot();
@@ -13876,7 +13750,6 @@ var require_access = __commonJS({
           const cfg = this.config || {};
           return { configured: !!cfg.apiAccessKey, host: cfg.apiHost || void 0 };
         },
-        // 清空密钥必须同时回关 LAN（apiHost→127.0.0.1）：只清 key 不动 apiHost 会留下「绑定 0.0.0.0 且零认证」的暴露窗口。
         setAccessKey(key) {
           try {
             const cfg = this.config || {};
@@ -14787,7 +14660,6 @@ var require_pool2 = __commonJS({
         this._backfillAt.delete(id);
         this.clear(id);
       }
-      // journalctl 同步查询会冻结生命周期 tick 的事件循环，故 journal 档非阻塞发射（见 capture.js）。
       capture(id) {
         const src = this._sources.get(id);
         if (!src) return null;
@@ -15104,6 +14976,35 @@ var require_npm = __commonJS({
   }
 });
 
+// src/domains/shell/core.js
+var require_core4 = __commonJS({
+  "src/domains/shell/core.js"(exports2, module2) {
+    "use strict";
+    function isUpdatePhase(phase) {
+      const p = String(phase || "");
+      return p === "restarting" || p.indexOf("shell-update") === 0;
+    }
+    function deriveState(id, journal) {
+      const j = journal || {};
+      if (!j.to) return { state: "idle", reason: "\u65E0\u8FDB\u884C\u4E2D\u7684\u66F4\u65B0", journal: j, identity: id };
+      const cur = id && id.version ? String(id.version) : null;
+      if (cur && cur === j.to && id && id.phase === "ready") {
+        const next = j.confirmed === true ? j : Object.assign({}, j, { confirmed: true });
+        return { state: "confirmed", version: cur, reason: "\u58F3\u5DF2\u5065\u5EB7\u8FD0\u884C\u65B0\u7248\u672C", journal: next, identity: id };
+      }
+      return {
+        state: "pending",
+        target: j.to,
+        current: cur,
+        reason: cur === j.to ? "\u7B49\u5F85\u58F3\u4E0A\u62A5\u5C31\u7EEA" : "\u7B49\u5F85\u58F3\u91CD\u542F\u5230\u65B0\u7248\u672C",
+        journal: j,
+        identity: id
+      };
+    }
+    module2.exports = { isUpdatePhase, deriveState };
+  }
+});
+
 // src/domains/shell/journal.js
 var require_journal = __commonJS({
   "src/domains/shell/journal.js"(exports2, module2) {
@@ -15112,7 +15013,7 @@ var require_journal = __commonJS({
     var fs2 = require("node:fs");
     var path2 = require("node:path");
     var { writeAtomic } = require_fs();
-    var { deriveState } = require_core3();
+    var { deriveState } = require_core4();
     function shellDir() {
       return stateRoot2.shellDir();
     }
@@ -15191,116 +15092,6 @@ var require_journal = __commonJS({
   }
 });
 
-// src/domains/shell/restart.js
-var require_restart = __commonJS({
-  "src/domains/shell/restart.js"(exports2, module2) {
-    "use strict";
-    var spawnOS = require_spawn();
-    var pidlook = require_pidlookup();
-    var BRAND2 = require_brand();
-    var { identity } = require_journal();
-    var { exeFromCmdline, isShellProcess } = require_core3();
-    var { semverCompare } = require_version2();
-    var SHELL_RELEASE_PKG = "@lob-ox/shell-release";
-    async function checkUpdate(dist, opts) {
-      const id = identity();
-      const installed = id && id.version ? String(id.version) : null;
-      if (!dist || typeof dist.fetchLatestVersion !== "function") {
-        return { ok: false, installed, latest: null, updateAvailable: false, error: "\u5206\u53D1\u670D\u52A1\u672A\u521D\u59CB\u5316" };
-      }
-      try {
-        const latest = await dist.fetchLatestVersion(SHELL_RELEASE_PKG, "npm", { authoritative: (opts && opts.authoritative) === true });
-        if (!latest) {
-          return { ok: false, installed, latest: null, updateAvailable: false, error: "\u672A\u67E5\u8BE2\u5230\u58F3\u53D1\u5E03\u7248\u672C\uFF08\u53EF\u80FD\u5C1A\u672A\u53D1\u5E03\uFF09" };
-        }
-        const updateAvailable = Boolean(installed && semverCompare(latest, installed) > 0);
-        return { ok: true, installed, latest, updateAvailable };
-      } catch (e) {
-        return { ok: false, installed, latest: null, updateAvailable: false, error: e && e.message || String(e) };
-      }
-    }
-    async function restartShell(opts) {
-      const o = opts || {};
-      const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
-      const pattern = o.procPattern || BRAND2.PROC_MATCH_GUI;
-      let procs = [];
-      try {
-        procs = pidlook.pgrepList(pattern) || [];
-      } catch {
-        procs = [];
-      }
-      procs = procs.filter((p) => isShellProcess(p));
-      const exe = procs.length ? exeFromCmdline(procs[0].cmdline) : o.exePath || null;
-      if (!exe) return { ok: false, error: "\u65E0\u6CD5\u5B9A\u4F4D\u684C\u9762\u58F3\u53EF\u6267\u884C\u6587\u4EF6\uFF08\u58F3\u672A\u8FD0\u884C\u4E14\u672A\u63D0\u4F9B exePath\uFF09" };
-      const killed = [];
-      for (const p of procs) {
-        try {
-          process.kill(p.pid, "SIGTERM");
-          killed.push(p.pid);
-        } catch {
-        }
-      }
-      const waitGone = async (ms) => {
-        const deadline = Date.now() + ms;
-        while (Date.now() < deadline) {
-          const alive = procs.some((p) => {
-            try {
-              return pidlook.isAlive(p.pid);
-            } catch {
-              return false;
-            }
-          });
-          if (!alive) return true;
-          await sleep(200);
-        }
-        return !procs.some((p) => {
-          try {
-            return pidlook.isAlive(p.pid);
-          } catch {
-            return false;
-          }
-        });
-      };
-      let gone = await waitGone(o.graceMs || 6e3);
-      if (!gone) {
-        for (const p of procs) {
-          try {
-            process.kill(p.pid, "SIGKILL");
-          } catch {
-          }
-        }
-        gone = await waitGone(2e3);
-      }
-      if (!gone) {
-        return { ok: false, error: "\u65E7\u58F3\u8FDB\u7A0B\u672A\u80FD\u5728\u8D85\u65F6\u5185\u9000\u51FA\uFF0C\u5DF2\u653E\u5F03\u91CD\u542F\uFF08\u907F\u514D\u53CC\u5B9E\u4F8B\uFF09", killed };
-      }
-      if (typeof o.shouldAbort === "function") {
-        try {
-          if (o.shouldAbort()) return { ok: false, aborted: true, error: "\u4F1A\u8BDD\u5DF2\u9000\u51FA/\u9000\u51FA\u4E2D\uFF0C\u5DF2\u653E\u5F03\u62C9\u8D77\u684C\u9762\u58F3", killed };
-        } catch {
-        }
-      }
-      try {
-        const child = spawnOS.detachedIgnored(exe, [], { env: process.env });
-        child.on("error", (e) => {
-          try {
-            if (o.events && o.events.append) o.events.append("shell_restart_spawn_error", { exe, error: e && e.message || String(e) });
-          } catch {
-          }
-        });
-        child.unref();
-        if (!child.pid) {
-          return { ok: false, error: "\u62C9\u8D77\u65B0\u58F3\u5931\u8D25\uFF1A\u5B50\u8FDB\u7A0B\u672A\u542F\u52A8\uFF08" + exe + " \u4E0D\u5B58\u5728\u6216\u4E0D\u53EF\u6267\u884C\uFF09", killed };
-        }
-        return { ok: true, restarted: true, killed, pid: child.pid, exe };
-      } catch (e) {
-        return { ok: false, error: "\u62C9\u8D77\u65B0\u58F3\u5931\u8D25: " + (e && e.message || e), killed };
-      }
-    }
-    module2.exports = { SHELL_RELEASE_PKG, checkUpdate, restartShell };
-  }
-});
-
 // src/domains/shell/index.js
 var require_shell = __commonJS({
   "src/domains/shell/index.js"(exports2, module2) {
@@ -15314,8 +15105,7 @@ var require_shell = __commonJS({
       health,
       status
     } = require_journal();
-    var { SHELL_RELEASE_PKG, checkUpdate, restartShell } = require_restart();
-    module2.exports = { status, evaluate, health, markPending, identity, readJournal, shellDir, checkUpdate, restartShell, SHELL_RELEASE_PKG };
+    module2.exports = { status, evaluate, health, markPending, identity, readJournal, shellDir };
   }
 });
 
@@ -15618,8 +15408,6 @@ var require_intents = __commonJS({
         if (this._pending.has(intent)) this._pending.delete(intent);
         return p;
       }
-      // W5：生产零调用，仅 session-lifecycle-test.js 用于「模拟重启后内存态为空」的夹具。
-      // 保留（它是一个合理的测试缝），不视为待删死代码。
       clear() {
         this._pending.clear();
       }
@@ -15806,7 +15594,6 @@ var require_core5 = __commonJS({
             routerAutostart: s.routerAutostart,
             routerMode: s.routerMode,
             updateCheck: s.updateCheck,
-            shellWatchdog: s.shellWatchdog,
             lastRefresh: s.lastRefresh
           };
         }
@@ -15864,12 +15651,10 @@ var require_core5 = __commonJS({
       host._upgradeHold = false;
       host._upgradeHoldSince = null;
       host._timer = null;
+      host._beatScheduler = null;
       host._heartbeatBusy = false;
       host._killTimer = null;
       host._adoptKillTimer = null;
-      host._initialCheckTimer = null;
-      host._upgradeTimer = null;
-      host._shellWatchdogTimer = null;
       host._lastOccupiedWarn = 0;
       host._lastMainPortRederive = 0;
       host._lastPortUp = false;
@@ -17127,11 +16912,21 @@ var require_instance_lifecycle = __commonJS({
 });
 
 // src/domains/router/providers/restart.js
-var require_restart2 = __commonJS({
+var require_restart = __commonJS({
   "src/domains/router/providers/restart.js"(exports2, module2) {
     "use strict";
     var { INSTANCE_STATES } = require_model2();
     var ports = require_ports().shared;
+    var { makeBudget } = require_guardian();
+    var PROXY_INSTANCE_THROTTLE = { windowMs: 10 * 60 * 1e3, burst: 5 };
+    function budgetFor(inst) {
+      if (!inst) return makeBudget(PROXY_INSTANCE_THROTTLE);
+      if (!inst._restartBudget) inst._restartBudget = makeBudget(PROXY_INSTANCE_THROTTLE);
+      return inst._restartBudget;
+    }
+    function resetBudget(inst) {
+      if (inst) inst._restartBudget = makeBudget(PROXY_INSTANCE_THROTTLE);
+    }
     function createRestartOrchestrator(deps) {
       const d = deps || {};
       const { startInstance, waitHealthy, isAlive, logger } = d;
@@ -17165,8 +16960,8 @@ var require_restart2 = __commonJS({
       }
       return { respawn };
     }
-    async function runReconcile(provider, allowStop) {
-      const out = { started: [], stopped: [], desired: [] };
+    async function runReconcileThrottled(provider, allowStop) {
+      const out = { started: [], stopped: [], desired: [], throttled: [] };
       const desired = provider.desiredRunningAccounts();
       const list = desired.list || [];
       out.desired = list.map((a) => a.keyId);
@@ -17175,12 +16970,25 @@ var require_restart2 = __commonJS({
         const inst = provider.instanceOf(acc);
         if (!inst || inst.pid || inst.startingPromise) continue;
         if (inst.status === INSTANCE_STATES.DEAD && !inst.pid) inst.status = INSTANCE_STATES.COLD;
+        const b = budgetFor(inst);
+        if (b.tripped) {
+          inst._throttled = true;
+          out.throttled.push(acc.keyId);
+          continue;
+        }
+        inst._throttled = false;
+        const wasRunning = !!inst.pid;
         try {
           const r = await provider.startInstance(inst);
+          const startupFailure = !r.ok || !wasRunning && !inst.pid;
+          b.note(startupFailure);
           if (r && r.ok) {
             await provider._waitHealthy(inst).catch(() => {
             });
             out.started.push(acc.keyId);
+            if (b.tripped && provider.logger && provider.logger.warn) {
+              provider.logger.warn("[reconcile] \u5B9E\u4F8B\u542F\u52A8\u53CD\u590D\u5931\u8D25\u5DF2\u8FBE\u4E0A\u9650 key=" + (acc.maskedKey || acc.keyId) + "\uFF0C\u505C\u6B62\u81EA\u52A8\u62C9\u8D77\uFF08\u7B49\u4EBA\u5DE5/\u7A97\u53E3\u8FC7\u671F\uFF09");
+            }
             if (provider.logger && provider.logger.info) {
               const role = desired.active && acc.keyId === desired.active.keyId ? "\u5728\u7528" : "\u9884\u70ED";
               provider.logger.info("[reconcile] \u62C9\u8D77\u5B9E\u4F8B key=" + acc.maskedKey + "\uFF08" + role + "\uFF09");
@@ -17189,8 +16997,8 @@ var require_restart2 = __commonJS({
         } catch {
         }
       }
-      if (!allowStop) return out;
       for (const inst of (provider.instances || []).slice()) {
+        if (!allowStop) break;
         if (!inst.pid) {
           if (!desiredIds.has(inst.keyId) && inst.port) {
             try {
@@ -17235,7 +17043,7 @@ var require_restart2 = __commonJS({
         }
       }
       if (provider._reconcileBusy) return provider._reconcileBusy;
-      const p = runReconcile(provider, allowStop);
+      const p = runReconcileThrottled(provider, allowStop);
       provider._reconcileBusy = p;
       try {
         return await p;
@@ -17248,7 +17056,60 @@ var require_restart2 = __commonJS({
       reconcileInstances(provider).catch(() => {
       });
     }
-    module2.exports = { createRestartOrchestrator, runReconcile, reconcileInstances, reconcileNow };
+    module2.exports = { createRestartOrchestrator, runReconcileThrottled, reconcileInstances, reconcileNow, budgetFor, resetBudget, PROXY_INSTANCE_THROTTLE };
+  }
+});
+
+// src/app/control/process-lifecycle.js
+var require_process_lifecycle = __commonJS({
+  "src/app/control/process-lifecycle.js"(exports2, module2) {
+    "use strict";
+    var procOS = require_process();
+    var pidlook = require_pidlookup();
+    var DEFAULTS = {
+      stopGraceMs: 9e3,
+      portFreeTimeoutMs: 5e3
+    };
+    function sleep(ms) {
+      return new Promise((r) => setTimeout(r, ms));
+    }
+    function isForeignOnPort(port, ownPid) {
+      if (!Number.isInteger(port) || port <= 0) return false;
+      const p = pidlook.findListeningPid(port);
+      return p !== null && p !== ownPid;
+    }
+    async function waitPortFree(port, timeoutMs) {
+      const dl = Date.now() + (timeoutMs || DEFAULTS.portFreeTimeoutMs);
+      while (Date.now() < dl) {
+        if (pidlook.findListeningPid(port) === null) return true;
+        await sleep(150);
+      }
+      return pidlook.findListeningPid(port) === null;
+    }
+    async function stopProcess(opts) {
+      const o = Object.assign({}, DEFAULTS, opts || {});
+      const pid = typeof o.pid === "number" ? o.pid : null;
+      const port = typeof o.port === "number" ? o.port : null;
+      const ownGroup = !!o.ownGroup;
+      if (pid && pid > 0) {
+        procOS.killTree(pid, "SIGTERM", void 0, ownGroup ? { ownGroup: true } : void 0);
+      }
+      const dl = Date.now() + o.stopGraceMs;
+      while (Date.now() < dl) {
+        const alive = pid ? pidlook.isAlive ? pidlook.isAlive(pid) : false : false;
+        if (!alive) break;
+        await sleep(150);
+      }
+      if (port) {
+        if (isForeignOnPort(port, pid)) {
+          return { ok: false, stopped: false, foreign: true };
+        }
+        const free = await waitPortFree(port, o.portFreeTimeoutMs);
+        if (!free) return { ok: false, stopped: false, portBusy: true };
+      }
+      return { ok: true, stopped: true };
+    }
+    module2.exports = { ProcessLifecycle: { stopProcess, waitPortFree, isForeignOnPort, DEFAULTS } };
   }
 });
 
@@ -17395,6 +17256,7 @@ var require_probe5 = __commonJS({
     var carrier = require_carrier();
     var procOS = require_process();
     var { INSTANCE_STATES } = require_model2();
+    var { ProcessLifecycle } = require_process_lifecycle();
     var { getQuotaStrategy } = require_quota_strategies();
     var { quotaOverallStatus } = require_quota();
     var { cachedPkgBin, ensurePkgCached } = require_pkg_cache();
@@ -17423,7 +17285,7 @@ var require_probe5 = __commonJS({
             if (provider.logger && provider.logger.warn) provider.logger.warn("[proxy-instance] \u91CD\u542F\u5E78\u5B58\u8005\u5F03\u7528\u91CD\u62C9 pid=" + boundPid + " port=" + inst.port + "\uFF08stdio \u5F52\u5C5E\u65E7\u4EE3\uFF0C\u7981 adopt\uFF09");
             if (provider.events) provider.events.append("proxy_instance_survivor_reclaimed", { app: provider.proxyAppId, port: inst.port, pid: boundPid, reason: "restart-survivor-stdio-unsafe" });
             try {
-              procOS.killTree(boundPid, "SIGKILL");
+              ProcessLifecycle.stopProcess({ pid: boundPid, port: inst.port });
             } catch {
             }
             const dl = Date.now() + 3e3;
@@ -17613,7 +17475,7 @@ var require_probe5 = __commonJS({
               if (provider.logger && provider.logger.warn) provider.logger.warn("[proxy-instance] \u751F\u547D\u5468\u671F\u76D1\u63A7\uFF1A\u5B9E\u4F8B\u65E0\u54CD\u5E94\uFF08\u7591\u4F3C\u5361\u6B7B\uFF09key=" + inst.maskedKey + " port=" + inst.port + " pid=" + inst.pid + " fails=" + inst._monitorFails + "\uFF0Ckill \u91CD\u62C9");
               if (provider.events) provider.events.append("proxy_instance_hang_restart", { app: provider.proxyAppId, port: inst.port, pid: inst.pid, fails: inst._monitorFails });
               try {
-                procOS.killTree(inst.pid, "SIGKILL", void 0, { ownGroup: true });
+                ProcessLifecycle.stopProcess({ pid: inst.pid, port: inst.port });
               } catch {
               }
               inst.pid = null;
@@ -17768,7 +17630,8 @@ var require_process_pool = __commonJS({
   "src/domains/router/providers/process-pool.js"(exports2, module2) {
     "use strict";
     var life = require_instance_lifecycle();
-    var restart = require_restart2();
+    var restart = require_restart();
+    var { resetBudget } = restart;
     var probe = require_probe5();
     var pool = require_pool3();
     var pidlook = require_pidlookup();
@@ -17901,6 +17764,10 @@ var require_process_pool = __commonJS({
           }
           inst._restartAt = Date.now() + 12e4;
           inst._restartPending = null;
+          try {
+            resetBudget(inst);
+          } catch {
+          }
           if (this.logger && this.logger.warn) this.logger.warn("[proxy-instance] \u5B9E\u4F8B\u91CD\u542F key=" + inst.maskedKey + " port=" + inst.port + " reason=" + reason);
           const hadPid = !!inst.pid;
           try {
@@ -18020,7 +17887,7 @@ var require_proxy = __commonJS({
     var { npxLauncher } = require_npx_forms();
     var { buildCommand } = require_command2();
     var probe = require_probe5();
-    var restart = require_restart2();
+    var restart = require_restart();
     var pool = require_pool3();
     var life = require_instance_lifecycle();
     var ProxyProvider = class extends withProcessPool(ProviderBase) {
@@ -18384,7 +18251,6 @@ var require_proxy_apps = __commonJS({
         healthPath: "/health",
         modelPath: "/v1/models",
         upstream: "https://api.commandcode.ai",
-        // keyEnv 是密钥注入的唯一 env 名（绝不进 cmdline）；其余 env/超时一律不注入，跑上游默认配置。
         keyEnv: "CC_API_KEY",
         repo: "thaolaptrinh/commandcode-api-proxy",
         registry: "commandcode-api-proxy",
@@ -19092,16 +18958,6 @@ var require_usage = __commonJS({
         if (!this._dirty) return;
         this._writeTotals();
       }
-      /**
-       * 根因 E：缓存**新鲜度**与**可写性**两维度正交，不得耦合。
-       *
-       * 修前：`if (this.totals && this._canPersist()) return this.totals;`
-       * —— 闸门关闭（daemon 模式下 setPersistEnabled(false)）时该条件恒假 ⇒ 每次 recordUsage
-       * 都重新读盘，而 _writeTotals 又因闸门关闭直接 return ⇒ 磁盘不变、内存增量被下次 load 覆盖
-       * ⇒ **用量计数被永久吞掉**。
-       *
-       * 现在：load 只看内存缓存是否存在（新鲜度）；是否落盘由 _writeTotals 单独决定（可写性）。
-       */
       load() {
         if (this.totals) return this.totals;
         let t;
@@ -20138,6 +19994,7 @@ var require_scheduler2 = __commonJS({
     function createScheduler(deps) {
       const d = deps || {};
       const state = d.state;
+      const beat = d.beatScheduler || null;
       const logger = d.logger || null;
       const refreshProxyUpdateInfo = d.refreshProxyUpdateInfo || (() => Promise.resolve());
       const refreshOfficialUsageAll = d.refreshOfficialUsageAll || (() => Promise.resolve());
@@ -20153,6 +20010,27 @@ var require_scheduler2 = __commonJS({
         });
         ensureProxyInstances().catch(() => {
         });
+        if (beat) {
+          beat.unregister("router-maint");
+          beat.unregister("router-lifecycle");
+          beat.unregister("router-pricing");
+          beat.register("router-maint", () => {
+            refreshProxyUpdateInfo().catch(() => {
+            });
+            probeIfDue();
+            ensureProxyInstances().catch(() => {
+            });
+          }, { every: Math.max(1, Math.round(3e5 / (d.tickMs || 5e3))) });
+          beat.register("router-lifecycle", () => {
+            monitorInstanceHealth().catch(() => {
+            });
+          }, { every: Math.max(1, Math.round(3e4 / (d.tickMs || 5e3))) });
+          beat.register("router-pricing", () => {
+            refreshOfficialPricingAll().catch(() => {
+            });
+          }, { every: Math.max(1, Math.round(216e5 / (d.tickMs || 5e3))) });
+          return;
+        }
         if (state.maintTimer) clearInterval(state.maintTimer);
         state.maintTimer = setInterval(() => {
           refreshProxyUpdateInfo().catch(() => {
@@ -20174,6 +20052,12 @@ var require_scheduler2 = __commonJS({
         }), 6 * 3600 * 1e3);
       }
       function stop() {
+        if (beat) {
+          beat.unregister("router-maint");
+          beat.unregister("router-lifecycle");
+          beat.unregister("router-pricing");
+          return;
+        }
         if (state.maintTimer) {
           clearInterval(state.maintTimer);
           state.maintTimer = null;
@@ -20702,6 +20586,8 @@ var require_router3 = __commonJS({
     var RouterService = class {
       constructor(opts) {
         this.config = opts.config;
+        this._beatScheduler = opts.beatScheduler || null;
+        this._beatTickMs = opts.tickMs || opts.config && opts.config.tickIntervalMs || 5e3;
         this.dist = opts.dist || null;
         this.logger = opts.logger || console;
         this.events = opts.events || null;
@@ -20763,6 +20649,8 @@ var require_router3 = __commonJS({
           state,
           store: this.store,
           logger: this.logger,
+          beatScheduler: this._beatScheduler,
+          tickMs: this._beatTickMs,
           refreshProxyUpdateInfo: () => this.refreshProxyUpdateInfo(),
           refreshOfficialUsageAll: () => this.refreshOfficialUsageAll(),
           refreshOfficialPricingAll: () => this.refreshOfficialPricingAll()
@@ -21340,7 +21228,6 @@ var require_model3 = __commonJS({
           allocation: inst.state ? inst.state.allocation || null : null,
           usage: inst.state ? inst.state.usage || null : null,
           restartCount: inst.state ? inst.state.restartCount || 0 : 0,
-          // 启动失败限流（唯一一条规则）的可见量：窗口内计数 / 固定端口释放等待落点。
           startupFailCount: inst.state ? inst.state.startupFailCount || 0 : 0,
           restartAt: inst.state ? inst.state.restartAt || null : null,
           lastFailure: inst.state ? inst.state.lastFailure || null : null,
@@ -21423,12 +21310,6 @@ var require_store5 = __commonJS({
       _stripLegacyStateKeys(inst) {
         if (inst.state && Object.prototype.hasOwnProperty.call(inst.state, "version")) delete inst.state.version;
       }
-      /**
-       * 隔离损坏文件。
-       * Lease I2：隔离前**再次校验版本戳**——若自读取失败以来文件已被他人更新，
-       * 说明它不是损坏 ⇒ 放弃隔离（修前会直接 rename 掉这个更新的文件并把实例列表清空，即全量静默丢失）。
-       * 且保留可回溯副本：先复制再改名，不直接丢弃。
-       */
       _quarantineCorrupt(err) {
         let locked = false;
         try {
@@ -22669,25 +22550,7 @@ var require_ops2 = __commonJS({
         store.save();
         return { ok: true, instance: inst };
       }
-      function startTimer(intervalMs) {
-        if (timer) clearInterval(timer);
-        timer = setInterval(() => {
-          for (const inst of store.instances) {
-            if (inst.domain === "native") continue;
-            try {
-              lifecycle.supervise(inst.id);
-            } catch (e) {
-              logger.warn && logger.warn("[" + inst.id + "] supervise \u5931\u8D25: " + (e && e.message));
-            }
-          }
-          try {
-            lifecycle.governSweep();
-          } catch (e) {
-            logger.warn && logger.warn("governSweep: " + (e && e.message));
-          }
-        }, intervalMs || 5e3);
-      }
-      return { list, addInstance, removeInstance, updateInstance, startTimer };
+      return { list, addInstance, removeInstance, updateInstance };
     }
     module2.exports = { createOps };
   }
@@ -22910,7 +22773,6 @@ var require_instance = __commonJS({
       map(fn) {
         return this._store.instances.map(fn);
       }
-      // 能力判定读平台表（有副作用）⇒ 从 governor 取，不经 pure 的 sandbox.js。
       get sandboxSupported() {
         return governor.sandboxSupported(this._sandboxSupportedOverride);
       }
@@ -22998,9 +22860,6 @@ var require_instance = __commonJS({
       upgradeStatus(id) {
         return this._upgrade.upgradeStatus(id);
       }
-      startTimer(ms) {
-        return this._ops.startTimer(ms);
-      }
       sandboxRoot(inst) {
         return sandbox.root(this.instancesRoot, inst);
       }
@@ -23898,23 +23757,14 @@ var require_process_spec = __commonJS({
     function defaultSpec() {
       return {
         runtime: null,
-        // 解释器（如 node）；为 null 表示 bin 可直接执行
         bin: null,
-        // 可执行文件或入口脚本
         subcommand: null,
-        // 子命令（如 'web' / 'plugin'）
         args: [],
-        // 用户参数
         port: null,
-        // --port 值（一等公民，不再各处拼装）
         patchFile: null,
-        // 插件 overlay（一等公民，不再事后 splice）
         storeDir: null,
-        // pnpm --store-dir
         install: false,
-        // 是否安装类操作（决定是否注入安全标志）
         extraFlags: []
-        // 其他固定标志
       };
     }
     function validate(spec) {
@@ -24124,7 +23974,7 @@ var require_cli = __commonJS({
 });
 
 // src/domains/plugin/restart.js
-var require_restart3 = __commonJS({
+var require_restart2 = __commonJS({
   "src/domains/plugin/restart.js"(exports2, module2) {
     "use strict";
     function targetRunning(ctx, target) {
@@ -24165,7 +24015,7 @@ var require_restart3 = __commonJS({
           log("\u91CD\u542F\u5B9E\u4F8B\u300C" + (target.name || target.id) + "\u300D\u4F7F\u63D2\u4EF6\u53D8\u66F4\u751F\u6548\u2026");
           if (ctx.events) ctx.events.append("plugin_restart_started", { name: target.name || target.id, target: target.id, kind });
           try {
-            ctx.instances.stopInstance(target.id);
+            await ctx.instances.stopInstance(target.id);
           } catch (e) {
             log("\u505C\u6B62\u5B9E\u4F8B\u5931\u8D25: " + e.message);
           }
@@ -24189,28 +24039,25 @@ var require_restart3 = __commonJS({
           return true;
         }
         if (target.kind === "native") {
-          if (!targetRunning(ctx, target)) {
-            log("\u539F\u751F DSH \u672A\u8FD0\u884C\uFF1A\u63D2\u4EF6\u53D8\u66F4\u5C06\u5728\u4E0B\u6B21\u542F\u52A8\u65F6\u751F\u6548");
+          const nr = ctx.onNativeRestart;
+          if (typeof nr !== "function") {
+            log("\u539F\u751F DSH \u672A\u914D\u7F6E\u91CD\u542F\u56DE\u8C03\uFF1A\u63D2\u4EF6\u53D8\u66F4\u5C06\u5728\u4E0B\u6B21\u542F\u52A8\u65F6\u751F\u6548");
             return false;
           }
-          if (typeof ctx.onNativeRestart === "function") {
-            let rr;
-            try {
-              rr = ctx.onNativeRestart();
-            } catch (e) {
-              log("\u539F\u751F DSH \u91CD\u542F\u8BF7\u6C42\u5931\u8D25: " + e.message);
-              return false;
-            }
-            if (rr && rr.ok === false) {
-              log("\u539F\u751F DSH \u91CD\u542F\u8BF7\u6C42\u672A\u751F\u6548\uFF1A" + (rr && rr.error || "unknown"));
-              return false;
-            }
-            log("\u5DF2\u8BF7\u6C42\u91CD\u542F\u539F\u751F DSH \u4F7F\u63D2\u4EF6\u53D8\u66F4\u751F\u6548");
-            if (ctx.events) ctx.events.append("plugin_restart_done", { name: "\u539F\u751F\u5B9E\u4F8B", target: "native", kind, via: "supervisor" });
-            return true;
+          let rr;
+          try {
+            rr = ctx.onNativeRestart();
+          } catch (e) {
+            log("\u539F\u751F DSH \u91CD\u542F\u8BF7\u6C42\u5931\u8D25: " + e.message);
+            return false;
           }
-          log("\u63D0\u793A\uFF1A\u539F\u751F DSH \u9700\u91CD\u542F\u540E\u63D2\u4EF6\u53D8\u66F4\u751F\u6548\uFF08\u5F53\u524D\u672A\u914D\u7F6E\u81EA\u52A8\u91CD\u542F\uFF09");
-          return false;
+          if (rr && rr.ok === false) {
+            log("\u539F\u751F DSH \u91CD\u542F\u8BF7\u6C42\u672A\u751F\u6548\uFF1A" + (rr && rr.error || "unknown"));
+            return false;
+          }
+          log("\u5DF2\u8BF7\u6C42\u91CD\u542F\u539F\u751F DSH \u4F7F\u63D2\u4EF6\u53D8\u66F4\u751F\u6548");
+          if (ctx.events) ctx.events.append("plugin_restart_done", { name: "\u539F\u751F\u5B9E\u4F8B", target: "native", kind, via: "supervisor" });
+          return true;
         }
         return false;
       } catch (e) {
@@ -24784,7 +24631,7 @@ var require_plugin = __commonJS({
     var store = require_store6();
     var targets = require_targets();
     var cli = require_cli();
-    var restart = require_restart3();
+    var restart = require_restart2();
     var { createJobs } = require_jobs();
     var { createLayers } = require_layers();
     var ops = require_ops3();
@@ -24902,7 +24749,8 @@ var require_managed_object = __commonJS({
       "sandbox-instance": { label: "\u6C99\u7BB1\u5B9E\u4F8B", startable: true, guardable: true },
       "router-daemon": { label: "\u667A\u80FD\u8DEF\u7531 daemon", startable: true, guardable: true },
       "lan-daemon": { label: "\u8FDC\u7A0B\u63A7\u5236 daemon", startable: true, guardable: true },
-      plugin: { label: "\u63D2\u4EF6\uFF08\u805A\u5408\uFF09", startable: false, guardable: false }
+      plugin: { label: "\u63D2\u4EF6\uFF08\u805A\u5408\uFF09", startable: false, guardable: false },
+      shell: { label: "\u684C\u9762\u58F3", startable: false, guardable: false }
     };
     var _customKinds = {};
     function kindMeta(kind) {
@@ -25034,9 +24882,17 @@ var require_registry4 = __commonJS({
     var path2 = require("node:path");
     var { writeAtomic } = require_fs();
     var { DESIRED, MANAGED_KINDS, kindMeta, registerKind: registerManagedKind, createEntry, normalizeOwnership } = require_managed_object();
+    var { legacyToEntryPhase } = require_phase();
     var PHASES = ["stopped", "installing", "starting", "running", "draining", "failed"];
-    var LEGACY_PHASES = { backoff: "failed", restarting: "starting" };
     var { runHeartbeat } = require_heartbeat();
+    var pmClient = require_pm_client();
+    var configDefaults = require_config();
+    var RESTART_FALLBACK = { windowMs: 6e4, burst: 5 };
+    var restartDefaults = () => {
+      const r = configDefaults && configDefaults.restart;
+      if (r && Number.isFinite(r.windowMs) && Number.isFinite(r.burst)) return { windowMs: r.windowMs, burst: r.burst };
+      return RESTART_FALLBACK;
+    };
     var ManagedRegistry = class {
       constructor(opts) {
         this.file = opts && opts.file;
@@ -25082,7 +24938,8 @@ var require_registry4 = __commonJS({
           try {
             if (!o || !kindMeta(o.kind)) continue;
             const e = createEntry({ kind: o.kind, id: o.id, name: o.name, desired: o.desired, ownership: o.ownership });
-            if (PHASES.includes(LEGACY_PHASES[o.phase] || o.phase)) e.phase = LEGACY_PHASES[o.phase] || o.phase;
+            const np = legacyToEntryPhase(o.phase);
+            if (PHASES.includes(np)) e.phase = np;
             if (Number.isInteger(o.restartCount) && o.restartCount >= 0) e.restartCount = o.restartCount;
             if (o.startupFailWindowStart === null || typeof o.startupFailWindowStart === "number") e.startupFailWindowStart = o.startupFailWindowStart;
             if (Number.isInteger(o.startupFailCount) && o.startupFailCount >= 0) e.startupFailCount = o.startupFailCount;
@@ -25150,8 +25007,6 @@ var require_registry4 = __commonJS({
         const i = this._objects.indexOf(e);
         if (i >= 0) this._objects.splice(i, 1);
       }
-      // 自定义 kind 扩展点：零调用但刻意保留（见 managed-object.js 的说明）——
-      // 它是「新增受管对象类型」的唯一入口，删除等于永久关闭扩展能力。
       registerKind(kind, meta) {
         registerManagedKind(kind, meta);
         return this;
@@ -25171,6 +25026,8 @@ var require_registry4 = __commonJS({
         this._syncPortsOwner(e, true);
         this._save();
         this._event("managed_object_registered", { kind: e.kind, id: e.id, name: e.name });
+        const rd = restartDefaults();
+        pmClient.register({ id: e.id, spawn_cmd: [], restart_window_ms: rd.windowMs, restart_burst: rd.burst });
         return e;
       }
       update(id, patch) {
@@ -25180,6 +25037,7 @@ var require_registry4 = __commonJS({
         if (p.desired !== void 0) {
           if (!DESIRED.includes(p.desired)) return { ok: false, error: "\u975E\u6CD5 desired: " + p.desired };
           e.desired = p.desired;
+          pmClient.setDesired(e.id, p.desired);
         }
         if (p.name !== void 0) e.name = String(p.name || e.id);
         if (p.ownership !== void 0) {
@@ -25211,6 +25069,7 @@ var require_registry4 = __commonJS({
         this._drop(e);
         this._save();
         this._event("managed_object_removed", { kind: e.kind, id: e.id });
+        pmClient.setDesired(e.id, "stopped");
         return { ok: true };
       }
       _releasePort(port, ownerId) {
@@ -25255,6 +25114,17 @@ var require_registry4 = __commonJS({
         };
         return e;
       }
+      setRestartCount(id, n) {
+        const e = this.get(id);
+        if (!e) return null;
+        const v = typeof n === "number" && n >= 0 ? Math.floor(n) : 0;
+        if (e.restartCount !== v) {
+          e.restartCount = v;
+          this._event("managed_object_restart_count", { kind: e.kind, id: e.id, count: v });
+          this._save();
+        }
+        return e;
+      }
       setPhase(id, p) {
         const e = this.get(id);
         if (!e) return null;
@@ -25264,6 +25134,7 @@ var require_registry4 = __commonJS({
           e.lastTransitionAt = (/* @__PURE__ */ new Date()).toISOString();
           this._event("managed_object_phase", { kind: e.kind, id: e.id, phase: p });
           this._save();
+          pmClient.onPhase(e.id, p);
         }
         return e;
       }
@@ -26106,7 +25977,6 @@ var require_installer = __commonJS({
       _manifest() {
         return manifest.read(this);
       }
-      // W5：生产零调用，仅 native-test.js 使用（写 manifest 的夹具入口）。保留为测试缝。
       _saveManifest(m) {
         return manifest.save(this, m);
       }
@@ -26423,6 +26293,8 @@ var require_domains = __commonJS({
       }
       host.router = new RouterService({
         config: host.config,
+        beatScheduler: host._beatScheduler,
+        tickMs: host.config.tickIntervalMs || 5e3,
         providerFile: path2.join(swDir, "providers.json"),
         usageTotalsFile: path2.join(swDir, "router-usage-totals.json"),
         logger: host.logger,
@@ -26444,7 +26316,6 @@ var require_domains = __commonJS({
         tasks: host.tasks,
         tokenService: host.tokenService,
         dshBin: host.config.command && host.config.command[1] ? host.config.command[1] : "dsh",
-        // 实例域限流参数：与主链同一条规则、按域参数化（窗口 600s > 5 × 30s 启动窗口）；单源取自域常量。
         throttle: THROTTLE_DEFAULTS
       });
       host.instances.load();
@@ -26561,7 +26432,6 @@ var require_adapters = __commonJS({
           kind: "lan",
           name: "\u8FDC\u7A0B\u63A7\u5236",
           logger,
-          // start 的结果必须来自真实执行：reconcile/syncFrpc 各自如实返回 ok，任一失败即 ok:false（此前恒 true）。
           start: async () => {
             try {
               const rec = await lan.reconcile();
@@ -26809,7 +26679,7 @@ var require_lifecycle3 = __commonJS({
         return send(200, { sessionState: sup.sessionState ? sup.sessionState() : "unknown" });
       }
       if (req.method === "POST" && pathname === "/session/stop") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -26832,7 +26702,7 @@ var require_lifecycle3 = __commonJS({
           return lc ? send(200, lc.snapshot()) : send(404, { error: "\u6A21\u5757\u672A\u6CE8\u518C: " + id });
         }
         if (req.method === "POST" && action) {
-          if (!originAllowed(req, sup.config.apiPort)) {
+          if (!originAllowed(req)) {
             req.resume();
             return send(403, { ok: false, error: "cross-origin request rejected" });
           }
@@ -26937,7 +26807,7 @@ var require_native = __commonJS({
         });
       }
       if (req.method === "POST" && pathname === "/native/check-update") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -26945,7 +26815,7 @@ var require_native = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/native/install") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -26963,7 +26833,7 @@ var require_native = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/native/upgrade") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -26984,7 +26854,7 @@ var require_native = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/native/uninstall") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -26993,7 +26863,7 @@ var require_native = __commonJS({
         return send(202, { ok: true, accepted: true, state: "uninstalling" });
       }
       if (req.method === "POST" && pathname === "/native/settings") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27055,14 +26925,14 @@ var require_guard = __commonJS({
       }
       if (req.method === "POST" && pathname === "/guard/version/check") {
         req.resume();
-        if (!originAllowed(req, sup.config.apiPort)) return send(403, { ok: false, error: "cross-origin request rejected" });
+        if (!originAllowed(req)) return send(403, { ok: false, error: "cross-origin request rejected" });
         return sup.guardVersionCheck().then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "GET" && pathname === "/autostart") {
         return send(200, sup.autostartStatus());
       }
       if (req.method === "POST" && pathname === "/autostart") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27083,7 +26953,7 @@ var require_guard = __commonJS({
         return send(200, sup.lanPanelStatus());
       }
       if (req.method === "POST" && pathname === "/settings/lan") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27104,7 +26974,7 @@ var require_guard = __commonJS({
         return send(200, sup.accessKeyStatus());
       }
       if (req.method === "POST" && pathname === "/settings/access-key") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27126,7 +26996,7 @@ var require_guard = __commonJS({
         return send(200, sup.closeActionStatus());
       }
       if (req.method === "POST" && pathname === "/settings/close-action") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27147,7 +27017,7 @@ var require_guard = __commonJS({
         return send(200, sup.externalBrowserStatus());
       }
       if (req.method === "POST" && pathname === "/settings/external-browser") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27169,7 +27039,7 @@ var require_guard = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/shutdown") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27184,7 +27054,7 @@ var require_guard = __commonJS({
         return;
       }
       if (req.method === "GET" && pathname === "/self-update/status") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27210,14 +27080,14 @@ var require_guard = __commonJS({
         });
       }
       if (req.method === "GET" && pathname === "/env/dsh") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
         return send(200, sup.dshenvStatus());
       }
       if (req.method === "GET" && pathname === "/env/status") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27227,7 +27097,7 @@ var require_guard = __commonJS({
         return sup.nodeLtsStatus().then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "GET" && pathname === "/env/environment") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27235,7 +27105,7 @@ var require_guard = __commonJS({
         return Promise.resolve(force ? environment.refresh({ persist: true, force: true }) : environment.form()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: "\u73AF\u5883\u8868\u5355\u88C5\u914D\u5931\u8D25\uFF1A" + (e && e.message || e) }));
       }
       if (req.method === "GET" && pathname === "/env/environment/last") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27246,7 +27116,7 @@ var require_guard = __commonJS({
           req.resume();
           return send(403, { ok: false, error: "\u4EC5\u5185\u6838\u6240\u5728\u673A\u5668\u53EF\u8BF7\u5185\u6838\u8C03\u8D77\u6D4F\u89C8\u5668\uFF0C\u8BF7\u590D\u5236\u6216\u81EA\u884C\u6253\u5F00\u8BE5\u5730\u5740" });
         }
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27291,7 +27161,7 @@ var require_router4 = __commonJS({
         return Promise.resolve(sup.routerStatusView()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, running: false, error: e && e.message || String(e) }));
       }
       if (req.method === "POST" && pathname.startsWith("/router/")) {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27308,7 +27178,7 @@ var require_router4 = __commonJS({
         return Promise.resolve(sup.routerProviders()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "POST" && pathname === "/router/providers/add") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27327,7 +27197,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/login/start") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27335,7 +27205,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/login/wait") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27352,7 +27222,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/update/check") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27360,7 +27230,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/proxy/update/apply") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27379,7 +27249,7 @@ var require_router4 = __commonJS({
         return Promise.resolve(sup.routerApi().proxyUpdateStatus(u.searchParams.get("appId") || "")).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "POST" && pathname === "/router/providers/proxy/key") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27394,7 +27264,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/proxy/select") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27409,7 +27279,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/proxy/key/remove") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27424,7 +27294,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/keys/set") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27440,7 +27310,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/remove") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27455,7 +27325,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/key/use") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27471,7 +27341,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/account/discard") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27486,7 +27356,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/refresh") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27502,7 +27372,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/activate") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27518,7 +27388,7 @@ var require_router4 = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/router/providers/deactivate") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27568,7 +27438,7 @@ var require_plugins = __commonJS({
         return send(200, sup.pluginManager.installStatus(u.searchParams.get("job")));
       }
       if (req.method === "POST" && pathname.startsWith("/plugins/")) {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, { ok: false, error: "cross-origin request rejected" });
         }
@@ -27644,7 +27514,7 @@ var require_dist = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/dist/registry/set") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27663,7 +27533,7 @@ var require_dist = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/dist/registry/refresh") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27671,7 +27541,7 @@ var require_dist = __commonJS({
         return;
       }
       if (req.method === "POST" && pathname === "/dist/registry/probe") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27742,6 +27612,112 @@ var require_exchange = __commonJS({
   }
 });
 
+// src/platform/security/identity.js
+var require_identity2 = __commonJS({
+  "src/platform/security/identity.js"(exports2, module2) {
+    "use strict";
+    var { normalizeRemoteAddress, isLoopbackAddress } = require_ip();
+    function socketIsLoopback(req) {
+      return isLoopbackAddress(req && req.socket && req.socket.remoteAddress);
+    }
+    function identify(req) {
+      return {
+        remote: normalizeRemoteAddress(req && req.socket && req.socket.remoteAddress),
+        loopback: socketIsLoopback(req)
+      };
+    }
+    module2.exports = { identify };
+  }
+});
+
+// src/api/identity.js
+var require_identity3 = __commonJS({
+  "src/api/identity.js"(exports2, module2) {
+    "use strict";
+    var { normalizeRemoteAddress, isLoopbackAddress, isPrivateIpv4 } = require_ip();
+    var { identify } = require_identity2();
+    module2.exports = {
+      identify,
+      normalizeRemoteAddress,
+      isPrivateIpv4,
+      isLoopbackAddress
+    };
+  }
+});
+
+// src/api/security.js
+var require_security = __commonJS({
+  "src/api/security.js"(exports2, module2) {
+    "use strict";
+    var crypto = require("node:crypto");
+    var { isPrivateIpv4 } = require_identity3();
+    var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
+    function isLocalOrLanHost(h) {
+      if (!h) return false;
+      const s = String(h).toLowerCase();
+      if (LOOPBACK_HOSTS.has(s)) return true;
+      const bare = s.startsWith("[") && s.endsWith("]") ? s.slice(1, -1) : s;
+      if (bare === "::1") return true;
+      return isPrivateIpv4(bare);
+    }
+    function isShellOrigin(protocol, hostname) {
+      const h = String(hostname || "").toLowerCase();
+      if (protocol === "tauri:") return h === "localhost" || /(^|\.)tauri\.localhost$/.test(h);
+      if (protocol === "http:" || protocol === "https:") return h === "tauri.localhost";
+      return false;
+    }
+    function normalizeHostname(h) {
+      const s = String(h || "").toLowerCase();
+      return s.startsWith("[") && s.endsWith("]") ? s.slice(1, -1) : s;
+    }
+    function originAllowed(req, apiPort) {
+      const host = req.headers.host;
+      if (!host) return false;
+      let hostname = "";
+      {
+        const m = /^(\[[^\]]+\]|[^:]+)(?::\d+)?$/.exec(String(host).trim());
+        hostname = m ? m[1] : String(host).trim();
+        if (!isLocalOrLanHost(hostname)) return false;
+      }
+      const o = req.headers.origin;
+      if (!o) return true;
+      try {
+        const u = new URL(o);
+        if (isShellOrigin(u.protocol, u.hostname)) return true;
+        if (!isLocalOrLanHost(u.hostname)) return false;
+        if (host && normalizeHostname(u.hostname) !== normalizeHostname(hostname)) return false;
+        const port = u.port === "" ? u.protocol === "https:" ? "443" : "80" : u.port;
+        return port === String(apiPort);
+      } catch {
+        return false;
+      }
+    }
+    function safeKeyEqual(a, b) {
+      const ha = crypto.createHash("sha256").update(String(a || "")).digest();
+      const hb = crypto.createHash("sha256").update(String(b || "")).digest();
+      return crypto.timingSafeEqual(ha, hb);
+    }
+    function requestHasAccessKey(req, key) {
+      if (!key) return true;
+      const ah = req.headers.authorization;
+      if (typeof ah === "string" && ah.startsWith("Bearer ") && safeKeyEqual(ah.slice(7), key)) return true;
+      try {
+        const q = new URL(req.url, "http://localhost").searchParams.get("access_key");
+        if (q && safeKeyEqual(q, key)) return true;
+      } catch {
+      }
+      return false;
+    }
+    function liveApiPort(server, sup) {
+      const live = server && typeof server.address === "function" ? server.address() : null;
+      if (live && Number.isInteger(live.port) && live.port > 0) return live.port;
+      const cfg = sup && sup.config && sup.config.apiPort;
+      return Number.isInteger(cfg) ? cfg : null;
+    }
+    module2.exports = { originAllowed, isLocalOrLanHost, isShellOrigin, requestHasAccessKey, liveApiPort };
+  }
+});
+
 // src/api/domains/instances.js
 var require_instances = __commonJS({
   "src/api/domains/instances.js"(exports2, module2) {
@@ -27749,6 +27725,7 @@ var require_instances = __commonJS({
     var execPath = require_exec_path();
     var crypto = require("node:crypto");
     var { bootstrapDshCookie } = require_exchange();
+    var { liveApiPort } = require_security();
     var OPEN_WEB_CODES = /* @__PURE__ */ new Map();
     var OPEN_WEB_CODE_TTL_MS = 3e4;
     function _sweepExpiredOpenWebCodes() {
@@ -27782,16 +27759,16 @@ var require_instances = __commonJS({
       return (sup.instances.list() || []).find((x) => x.id === id) || null;
     }
     function handleOpen(ctx) {
-      const { sup, req, res, identity, originAllowed, tokOf } = ctx;
+      const { sup, req, res, identity, originAllowed, tokOf, server } = ctx;
       const url = new URL(req.url, "http://localhost");
-      const apiPort = sup.config.apiPort;
+      const apiPort = liveApiPort(server, sup);
       const code = url.searchParams.get("code");
       const deny = (status, msg) => {
         res.writeHead(status, { "Content-Type": "text/plain; charset=utf-8" });
         res.end(msg);
       };
       if (!identity.loopback) return deny(403, "\u4EC5\u5141\u8BB8\u672C\u673A\u8BBF\u95EE");
-      if (!originAllowed(req, apiPort)) return deny(403, "origin not allowed");
+      if (!originAllowed(req)) return deny(403, "origin not allowed");
       const rec = consumeOpenWebCode(code);
       if (!rec) return deny(code ? 400 : 404, code ? "\u6388\u6743\u7801\u65E0\u6548\u6216\u5DF2\u8FC7\u671F" : "\u7F3A\u5C11\u6388\u6743\u7801");
       const it = findInstanceOrMain(sup, rec.id);
@@ -27857,7 +27834,7 @@ var require_instances = __commonJS({
       return sharedErr + "\uFF1B" + FORMS + "\uFF1B\u9700\u8981\u5176\u5B83\u53EF\u6267\u884C\u8BF7\u8D70\u63D2\u4EF6\u5B89\u88C5\u901A\u9053";
     }
     function handle(ctx) {
-      const { sup, req, res, pathname, identity, send, collectBody, originAllowed, tokOf, browser } = ctx;
+      const { sup, req, res, pathname, identity, send, collectBody, originAllowed, tokOf, browser, server } = ctx;
       function openInSystemBrowser(url) {
         return browser.openBrowser(url, { logger: sup.logger });
       }
@@ -27884,7 +27861,7 @@ var require_instances = __commonJS({
         return render();
       }
       if (req.method === "POST" && pathname.startsWith("/instances/")) {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -27921,7 +27898,7 @@ var require_instances = __commonJS({
                 if (!it) return send(404, { ok: false, error: "\u5B9E\u4F8B\u4E0D\u5B58\u5728" });
                 if (!(Number(it.port) > 0)) return send(400, { ok: false, error: "\u975E\u6CD5\u7AEF\u53E3" });
                 const code = issueOpenWebCode(j.id);
-                const url = "http://127.0.0.1:" + sup.config.apiPort + "/open?code=" + code;
+                const url = "http://127.0.0.1:" + (liveApiPort(server, sup) || sup.config.apiPort) + "/open?code=" + code;
                 return Promise.resolve(openInSystemBrowser(url)).then((r) => {
                   if (!r.ok) dropOpenWebCode(code);
                   return send(r.ok ? 200 : 500, r);
@@ -27966,7 +27943,7 @@ var require_relay = __commonJS({
         return Promise.resolve(sup.listLan()).then((r) => send(200, r)).catch((e) => send(500, { ok: false, error: e.message }));
       }
       if (req.method === "POST" && pathname.startsWith("/remote/")) {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -28029,7 +28006,7 @@ var require_shell2 = __commonJS({
         }
       }
       if (req.method === "POST" && pathname === "/shell/health") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -28046,28 +28023,8 @@ var require_shell2 = __commonJS({
           }
         });
       }
-      if (req.method === "POST" && pathname === "/shell/update-pending") {
-        if (!originAllowed(req, sup.config.apiPort)) {
-          req.resume();
-          return send(403, {});
-        }
-        return collectBody(req, res, 8192, (body) => {
-          let j = {};
-          try {
-            j = body ? JSON.parse(body) : {};
-          } catch {
-          }
-          try {
-            const rec = shell.markPending(j.from || null, j.to || null);
-            if (sup.events) sup.events.append(BRAND2.EVENT_SHELL_UPDATE_PENDING, { from: rec.from, to: rec.to });
-            return send(200, { ok: true, journal: rec });
-          } catch (e) {
-            return send(500, { ok: false, error: e.message });
-          }
-        });
-      }
       if (req.method === "POST" && pathname === "/shell/check-update") {
-        if (!originAllowed(req, sup.config.apiPort)) {
+        if (!originAllowed(req)) {
           req.resume();
           return send(403, {});
         }
@@ -28079,23 +28036,6 @@ var require_shell2 = __commonJS({
           return send(200, r);
         }).catch((e) => send(500, { ok: false, error: e.message }));
       }
-      if (req.method === "POST" && pathname === "/shell/restart") {
-        if (!originAllowed(req, sup.config.apiPort)) {
-          req.resume();
-          return send(403, {});
-        }
-        if (typeof sup._sessionHalting === "function" && sup._sessionHalting()) {
-          req.resume();
-          return send(409, { ok: false, error: "\u4F1A\u8BDD\u5DF2\u9000\u51FA/\u9000\u51FA\u4E2D\uFF0C\u62D2\u7EDD\u91CD\u542F\u684C\u9762\u58F3" });
-        }
-        req.resume();
-        return Promise.resolve(shell.restartShell({
-          shouldAbort: () => typeof sup._sessionHalting === "function" && sup._sessionHalting()
-        })).then((r) => {
-          if (sup.events) sup.events.append(BRAND2.EVENT_SHELL_RESTART_REQUESTED, { ok: r.ok, killed: r.killed || [], pid: r.pid || null });
-          return send(r.ok ? 200 : 500, r);
-        }).catch((e) => send(500, { ok: false, error: e.message }));
-      }
       if (req.method === "GET" || req.method === "POST") return send(404, { error: "not found", path: pathname });
       return send(405, { error: "method not allowed" });
     }
@@ -28259,106 +28199,6 @@ var require_static = __commonJS({
   }
 });
 
-// src/platform/security/identity.js
-var require_identity2 = __commonJS({
-  "src/platform/security/identity.js"(exports2, module2) {
-    "use strict";
-    var { normalizeRemoteAddress, isLoopbackAddress } = require_ip();
-    function socketIsLoopback(req) {
-      return isLoopbackAddress(req && req.socket && req.socket.remoteAddress);
-    }
-    function identify(req) {
-      return {
-        remote: normalizeRemoteAddress(req && req.socket && req.socket.remoteAddress),
-        loopback: socketIsLoopback(req)
-      };
-    }
-    module2.exports = { identify };
-  }
-});
-
-// src/api/identity.js
-var require_identity3 = __commonJS({
-  "src/api/identity.js"(exports2, module2) {
-    "use strict";
-    var { normalizeRemoteAddress, isLoopbackAddress, isPrivateIpv4 } = require_ip();
-    var { identify } = require_identity2();
-    module2.exports = {
-      identify,
-      normalizeRemoteAddress,
-      isPrivateIpv4,
-      isLoopbackAddress
-    };
-  }
-});
-
-// src/api/security.js
-var require_security = __commonJS({
-  "src/api/security.js"(exports2, module2) {
-    "use strict";
-    var crypto = require("node:crypto");
-    var { isPrivateIpv4 } = require_identity3();
-    var LOOPBACK_HOSTS = /* @__PURE__ */ new Set(["localhost", "127.0.0.1", "[::1]", "::1"]);
-    function isLocalOrLanHost(h) {
-      if (!h) return false;
-      const s = String(h).toLowerCase();
-      if (LOOPBACK_HOSTS.has(s)) return true;
-      const bare = s.startsWith("[") && s.endsWith("]") ? s.slice(1, -1) : s;
-      if (bare === "::1") return true;
-      return isPrivateIpv4(bare);
-    }
-    function isShellOrigin(protocol, hostname) {
-      const h = String(hostname || "").toLowerCase();
-      if (protocol === "tauri:") return h === "localhost" || /(^|\.)tauri\.localhost$/.test(h);
-      if (protocol === "http:" || protocol === "https:") return h === "tauri.localhost";
-      return false;
-    }
-    function normalizeHostname(h) {
-      const s = String(h || "").toLowerCase();
-      return s.startsWith("[") && s.endsWith("]") ? s.slice(1, -1) : s;
-    }
-    function originAllowed(req, apiPort) {
-      const host = req.headers.host;
-      if (!host) return false;
-      let hostname = "";
-      {
-        const m = /^(\[[^\]]+\]|[^:]+)(?::\d+)?$/.exec(String(host).trim());
-        hostname = m ? m[1] : String(host).trim();
-        if (!isLocalOrLanHost(hostname)) return false;
-      }
-      const o = req.headers.origin;
-      if (!o) return true;
-      try {
-        const u = new URL(o);
-        if (isShellOrigin(u.protocol, u.hostname)) return true;
-        if (!isLocalOrLanHost(u.hostname)) return false;
-        if (host && normalizeHostname(u.hostname) !== normalizeHostname(hostname)) return false;
-        const port = u.port === "" ? u.protocol === "https:" ? "443" : "80" : u.port;
-        return port === String(apiPort);
-      } catch {
-        return false;
-      }
-    }
-    function safeKeyEqual(a, b) {
-      const ha = crypto.createHash("sha256").update(String(a || "")).digest();
-      const hb = crypto.createHash("sha256").update(String(b || "")).digest();
-      return crypto.timingSafeEqual(ha, hb);
-    }
-    function requestHasAccessKey(req, key) {
-      if (!key) return true;
-      const ah = req.headers.authorization;
-      if (typeof ah === "string" && ah.startsWith("Bearer ") && safeKeyEqual(ah.slice(7), key)) return true;
-      try {
-        const q = new URL(req.url, "http://localhost").searchParams.get("access_key");
-        if (q && safeKeyEqual(q, key)) return true;
-      } catch {
-      }
-      return false;
-    }
-    module2.exports = { originAllowed, isLocalOrLanHost, isShellOrigin, requestHasAccessKey };
-  }
-});
-
 // src/api/transport/server.js
 var require_server = __commonJS({
   "src/api/transport/server.js"(exports2, module2) {
@@ -28368,7 +28208,7 @@ var require_server = __commonJS({
     var { collectBody } = require_body();
     var { serveStatic } = require_static();
     var { identify } = require_identity3();
-    var { originAllowed, requestHasAccessKey, isShellOrigin } = require_security();
+    var { originAllowed, requestHasAccessKey, isShellOrigin, liveApiPort } = require_security();
     var browserExit = require_browser();
     var environmentExit = require_environment();
     function safeFail(res, err, where) {
@@ -28391,7 +28231,7 @@ var require_server = __commonJS({
     function createServer(sup, deps) {
       const browser = deps && deps.browser || browserExit;
       const environment = deps && deps.environment || environmentExit;
-      return http2.createServer((req, res) => {
+      const server = http2.createServer((req, res) => {
         const shellOrigin = (() => {
           const o = req.headers.origin;
           if (!o) return null;
@@ -28421,6 +28261,7 @@ var require_server = __commonJS({
           return "";
         };
         const identity = identify(req);
+        const originAllowedLive = (req2) => originAllowed(req2, liveApiPort(server, sup));
         const accessKey = sup && sup.config && sup.config.apiAccessKey || null;
         if (!identity.loopback && req.method !== "OPTIONS" && (!accessKey || !requestHasAccessKey(req, accessKey))) {
           res.writeHead(401, { "Content-Type": "application/json" });
@@ -28458,7 +28299,7 @@ var require_server = __commonJS({
         } catch (e) {
           return send(400, { error: "bad request encoding" });
         }
-        const ctx = { sup, req, res, pathname: decodedPathname, identity, send, collectBody, originAllowed, tokOf, browser, environment };
+        const ctx = { sup, req, res, pathname: decodedPathname, identity, send, collectBody, originAllowed: originAllowedLive, tokOf, browser, environment, server };
         for (const d of API_DOMAINS) {
           if (d.owns(pathname)) {
             try {
@@ -28484,6 +28325,7 @@ var require_server = __commonJS({
         }
         return send(405, { error: "method not allowed" });
       });
+      return server;
     }
     module2.exports = { createServer };
   }
@@ -28503,7 +28345,7 @@ var require_api = __commonJS({
 var require_session = __commonJS({
   "src/domains/relay/session.js"(exports2, module2) {
     "use strict";
-    var { cookieByName } = require_core4();
+    var { cookieByName } = require_core3();
     var { bootstrapDshCookie } = require_exchange();
     function createSession(opts) {
       const o = opts || {};
@@ -28645,7 +28487,7 @@ var require_tunnel = __commonJS({
   "src/domains/relay/tunnel.js"(exports2, module2) {
     "use strict";
     var net = require("node:net");
-    var { isTrustedSource, hasValidToken, upstreamPath } = require_core4();
+    var { isTrustedSource, hasValidToken, upstreamPath } = require_core3();
     function buildRawRequest(req, authority, cookie) {
       let raw = req.method + " " + upstreamPath(req.url) + " HTTP/1.1\r\n";
       for (const [k, v] of Object.entries(req.headers)) {
@@ -28731,7 +28573,7 @@ var require_proxy2 = __commonJS({
     "use strict";
     var http2 = require("node:http");
     var crypto = require("node:crypto");
-    var { isTrustedSource, tokenGateDecision, backoffGate, upstreamPath, redactLogPath, normalizeRemoteMode, POLYFILL_SCRIPT } = require_core4();
+    var { isTrustedSource, tokenGateDecision, backoffGate, upstreamPath, redactLogPath, normalizeRemoteMode, POLYFILL_SCRIPT } = require_core3();
     var { createSession } = require_session();
     var { createTunnelHandler } = require_tunnel();
     var HTML_INJECT_MAX_BYTES = 2 * 1024 * 1024;
@@ -28756,7 +28598,7 @@ var require_proxy2 = __commonJS({
         }
       };
     }
-    function pipeWithHold(ur, res, clientReqPath, logger) {
+    function pipeWithHold(ur, res, clientReqLog, logger) {
       let clientGone = false;
       const log = (lv, msg) => {
         if (logger && logger[lv]) {
@@ -28805,7 +28647,7 @@ var require_proxy2 = __commonJS({
       return headers;
     }
     function handleUpstream(ur, res, clientReqPath, onStatus, logger) {
-      const clientReqLog2 = redactLogPath(clientReqPath);
+      const clientReqLog = redactLogPath(clientReqPath);
       if (onStatus) onStatus(ur.statusCode);
       const h = { ...ur.headers };
       const isHtml = String(h["content-type"] || "").includes("text/html");
@@ -28817,7 +28659,7 @@ var require_proxy2 = __commonJS({
       }
       res.writeHead(ur.statusCode || 502, h);
       if (!isHtml) {
-        pipeWithHold(ur, res, clientReqPath, logger);
+        pipeWithHold(ur, res, clientReqLog, logger);
         return;
       }
       const chunks = [];
@@ -28851,7 +28693,7 @@ var require_proxy2 = __commonJS({
           chunks.push(c);
           return;
         }
-        log("HTML \u8D85\u4E0A\u9650 " + HTML_INJECT_MAX_BYTES + "B\uFF08\u5DF2\u6536 " + total + "B\uFF09\uFF0C\u653E\u5F03 polyfill \u6CE8\u5165\u6309\u6D41\u900F\u4F20 " + (clientReqLog2 || ""));
+        log("HTML \u8D85\u4E0A\u9650 " + HTML_INJECT_MAX_BYTES + "B\uFF08\u5DF2\u6536 " + total + "B\uFF09\uFF0C\u653E\u5F03 polyfill \u6CE8\u5165\u6309\u6D41\u900F\u4F20 " + (clientReqLog || ""));
         const selfForward = !ur.readableEnded;
         switchToPassThrough();
         if (selfForward) res.write(c);
@@ -29031,14 +28873,8 @@ var require_ports3 = __commonJS({
       return registry.claimSlot(segment, owner, {
         preferred: o.preferred,
         bindingPreferred: !!o.bindingPreferred,
-        // RL-4：跨账本防撞。router caller 不传 reservedPorts（分配器跳过该检查，行为不变）；
-        // 仅 relay 传入 router 账本已占端口，free-scan/preferred-claim 跳过 ⇒ 不会抢 router 的端口。
         reservedPorts: reservedPorts || void 0,
         onBindingLost: o.onBindingLost,
-        // 审计 RL-3：reclaimCmdMark 必须出现在 relay daemon 的真实命令行里，否则 pgrepList 永远匹配不到 ⇒ 回收是死代码。
-        // relay daemon 经 runtime.js 以 `node .../domains/relay/daemon.js -c <cfg>` 拉起（scripts.js:8），
-        // 命令行含 `domains/relay/daemon.js`（与 process.js#reclaimOrphans 用的 _cmdMarks 同源），故此处用同一标记。
-        // configPath 为空时 fail-closed 不回收：宁可留占用走冲突分支，也不按 cmdMark 误杀同名进程（reclaimByCmdMark 内部也已要求 cfgStr 必填）。
         reclaimCmdMark: "domains/relay/daemon.js",
         reclaimCfg: o.configPath || "",
         waitMs: 8e3
@@ -29237,7 +29073,7 @@ var require_frp = __commonJS({
     var path2 = require("node:path");
     var spawnOS = require_spawn();
     var { writeAtomic } = require_fs();
-    var { buildFrpcToml, validateFrpServerSettings } = require_core4();
+    var { buildFrpcToml, validateFrpServerSettings } = require_core3();
     var { frpPlatformTag, download, installFrpc } = require_frp_install();
     var FrpManager = class {
       constructor(opts) {
@@ -29681,7 +29517,7 @@ var require_ops5 = __commonJS({
     var managed = require_managed();
     var portsvc = require_ports3();
     var { FrpManager } = require_frp();
-    var { normalizeRemoteMode, validateWanAccess, normalizeFrpSettings, validateFrpServerSettings, projectRemoteView } = require_core4();
+    var { normalizeRemoteMode, validateWanAccess, normalizeFrpSettings, validateFrpServerSettings, projectRemoteView } = require_core3();
     var reconcile = require_reconcile();
     var lanServers = require_lan_servers();
     function applyRelayToken(host, existing, want) {