@shgroup/dsh-serenity-hooks 1.39.2 → 1.39.3

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-serenity-hooks",
-  "version": "1.39.2",
+  "version": "1.39.3",
   "main": "lib/index.js",
   "description": "宁静号 ACC harness（Native Cordis 插件）：给 DSH 装一个「AI 工作区」——11 个工具（container_fs/container_trajectory/dashboard/container_git/msm/praxis/handyman/localstore/container_admin/im-bridge/acc-diag；后两个按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫）+ 轨迹日志与原地重建 + 网页登录入口/微信桥/子角色/对外问答页/trajectory 唤醒注册表。适配 DSH 0.1.5-rc.2（deepseek-ai/deepseek-harness）。",
   "engines": {

package/lib/index.js

@@ -2,11 +2,12 @@ import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { a as hostSettings, c as hostWebServer, i as hostSessions, n as hostInjected, o as hostSubagents, r as hostService, s as hostWeb, t as hostAgents } from "./access-fiehjxV6.js";
 import { a as findSerenityRoot, c as matchBlacklist, d as readCccName$1, f as readExclusiveTools, h as resolveInside, i as findGitRoot, l as pathInside, n as SAFE_MODE_MARKER, o as isSafeModeOn, p as readHandymanConfig, r as classifyPath, s as loadSerenityConfig, t as DEFAULT_SERENITY_CONFIG_PATHS, u as readBlacklist } from "./ccc-NlLr_sxy.js";
 import { i as cccRootForExec, n as agentCwdFor, o as listCccs, r as cccRootForCwd, t as NO_CCC_FROM_AGENT_CWD } from "./ccc-roots-Bd_SjEs7.js";
-import { C as localFileStamp, S as isoLocal, _ as sessionsRoot, a as DEFAULT_SESSION_SCOPE, b as summarize, c as createSession, d as getActiveSessionInfo, f as listSessions, g as sessionEvents$1, h as resolveSessionByTitle, i as resolveSessionTrajectoryLabel, l as extractSessionMdPathFromText, m as readActiveSessionMd, o as TRAJECTORY_ACTIONS, p as parseSessionContextFromEvents, r as readLastBound, s as clearActiveSessionInfo, t as appendBound, u as findSession, v as setActiveSessionInfo, x as useSession, y as showSession } from "./trajectory-bound-OyuNkn6e.js";
+import { C as useSession, S as summarize, T as localFileStamp, _ as resolveSessionByTitle, a as resolveSessionTrajectoryLabel, b as setActiveSessionInfo, c as TRAJECTORY_ACTIONS, d as extractSessionMdPathFromText, f as findSession, g as readActiveSessionMd, h as parseSessionContextFromEvents, i as readLastBound, l as clearActiveSessionInfo, m as listSessions, o as supersedeOtherBindings, p as getActiveSessionInfo, r as pruneMissingBindings, s as DEFAULT_SESSION_SCOPE, t as appendBound, u as createSession, v as sessionEvents$1, w as isoLocal, x as showSession, y as sessionsRoot } from "./trajectory-bound-B9o_4CMF.js";
 import { a as readWeixinCredential, c as weixinInboundDir, d as LOCALSTORE_SCOPES, f as checkLocalstoreGitCompliance, g as runLocalStore, h as readStore, i as matchWeixinRoute, l as weixinSessionIdFor, m as readGitTrack, n as extractWeixinText, o as readWeixinSettings, p as localstorePath, r as hasVoiceItem, s as sanitizeFileName$1, t as extractWeixinMedia } from "./weixin-route-B2ajFypI.js";
 import { a as readSkiffRoles, c as roleMsmWhitelist, d as systemPromptSource, f as trajectorySubset, i as isSkiffSessionId, l as roleToolWhitelist, n as buildSkiffBasePrompt, o as resolveRoleSystemPrompt, r as createRolePromptReader, s as resolveSkiffKind } from "./skiff-role-CEHL5cek.js";
 import { a as unregisterSkiffSession$1, i as skiffSessionSnapshot$1, n as skiffRoleFor$1, r as skiffSessionInfo$1, t as registerSkiffSession$1 } from "./skiff-registry-FTjoWQTQ.js";
-import { a as WAKE_CATCH_UP_MS, i as registerDisposer, n as sendToTrajectory, o as addWake, r as wakeSchedulerState, s as listWakes, t as registerWakeScheduler } from "./wake-scheduler-D0HDjEO8.js";
+import { r as sessionsRootDir, t as hasSessionLogById } from "./session-cleanup-BtkSmry8.js";
+import { a as WAKE_CATCH_UP_MS, i as registerDisposer, n as sendToTrajectory, o as addWake, r as wakeSchedulerState, s as listWakes, t as registerWakeScheduler } from "./wake-scheduler-CCpCk-7r.js";
 import { a as FACE_PORTS, c as MECHANISM_PORTS, i as ACP_HTTP_PORT, l as SKIFF_DEBUG_PORT, n as registerSettingsSection, o as GATEWAY_PORT, s as MAIN_WEB_PORT, t as readSimpleSettings, u as WEIXIN_SEND_PORT } from "./settings-section-DMDUoQum.js";
 import { a as markdownToPlainText, c as sendTyping, i as getUpdates, l as sniffImageExt, n as downloadMedia, o as sendFileMessage, r as getConfig, s as sendTextMessage, t as TypingStatus } from "./weixin-api-CtFYm53S.js";
 import z from "@deepseek-ai/schemastery";
@@ -3285,6 +3286,13 @@ function createTrajectoryTool(ctx) {
 						context: active.context
 					};
 					if (advisory) out.advisory = advisory;
+					if (dsh) {
+						const selfId = String(dsh.header?.id ?? "");
+						const superseded = supersedeOtherBindings(root, info?.dirName ?? targetDirName, selfId === "" ? /* @__PURE__ */ new Set() : /* @__PURE__ */ new Set([selfId]));
+						if (superseded.length > 0) out.supersededBindings = superseded;
+						const pruned = pruneMissingBindings(root, (id) => !hasSessionLogById(sessionsRootDir(), id));
+						if (pruned.length > 0) out.prunedBindings = pruned;
+					}
 					return out;
 				}
 				case "rebuild": {
@@ -3340,7 +3348,7 @@ function createTrajectoryTool(ctx) {
 							"✓ 已即时投递",
 							`  · ${res.detail}`,
 							"  · 语义：**不排队** —— 目标正在跑轮次则**当场注入当前轮**（steer），空闲则立即起一轮（followup）。",
-							"  · ⚠️ 回执只到「已注入/已入队」——**不表示**目标已执行或已答复。判\"目标真的动了\"须看它自己的 SESSION.md（文件级判据）。"
+							"  · ⚠️ 回执只到「已注入 / 已起轮」——**不表示**目标已执行或已答复。判\"目标真的动了\"须看它自己的 SESSION.md（文件级判据）。"
 						].join("\n")
 					};
 				}
@@ -7029,7 +7037,7 @@ function registerStatusApi(ctx, opts = {}) {
 					const id = s.id ?? s.header?.id;
 					if (id) liveIds.add(id);
 				}
-				const { sessionsRootDir, collectEligibleSessions, performCleanup, cutoffDaysAgo } = await import("./session-cleanup-B6IHZgww.js");
+				const { sessionsRootDir, collectEligibleSessions, performCleanup, cutoffDaysAgo } = await import("./session-cleanup-BtkSmry8.js").then((n) => n.n);
 				const root = sessionsRootDir();
 				if (req.method === "GET") {
 					const { candidates } = performCleanup(root, cutoffDaysAgo(days), liveIds, { dryRun: true });

package/lib/{session-cleanup-B6IHZgww.js → session-cleanup-BtkSmry8.js}

@@ -1,3 +1,4 @@
+import { t as __exportAll } from "./rolldown-runtime-D7D4PA-g.js";
 import { join } from "node:path";
 import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
 //#region src/session-cleanup.ts
@@ -19,6 +20,16 @@ import { existsSync, readdirSync, rmSync, statSync } from "node:fs";
 *
 * 本模块纯逻辑（零 ctx 依赖）：传入 sessionsRoot + liveIds，可单测。
 */
+var session_cleanup_exports = /* @__PURE__ */ __exportAll({
+	collectEligibleSessions: () => collectEligibleSessions,
+	cutoffDaysAgo: () => cutoffDaysAgo,
+	findSessionLog: () => findSessionLog,
+	hasSessionLogById: () => hasSessionLogById,
+	performCleanup: () => performCleanup,
+	sessionLogArtifacts: () => sessionLogArtifacts,
+	sessionLogBytesById: () => sessionLogBytesById,
+	sessionsRootDir: () => sessionsRootDir
+});
 /** DSH 会话 root：env DSH_HOME → ~/.dsh（config-ops globalConfigPath 同款推导） */
 function sessionsRootDir() {
 	const dshHome = process.env.DSH_HOME ?? join(process.env.HOME ?? "", ".dsh");
@@ -142,9 +153,61 @@ function performCleanup(root, cutoffMs, liveIds = /* @__PURE__ */ new Set(), opt
 function dirOf(logPath) {
 	return logPath.slice(0, logPath.lastIndexOf("/")) || logPath;
 }
+/**
+* 某一 dsh 会话（目录名 / 会话 id）的**当前世代日志体积**（字节）。
+*
+* 为什么要它（S142 §0y「旧会话累积 ⇒ dsh 内存崩溃」，所有者令）：
+*   · 宿主恢复/继续一条会话必须**重放全部事件**（`scanLog` → `materializeAppendBatch`）
+*     ⇒ **代价 ∝ 日志体积**；
+*   · 实测（`_tmp/measure-session-load.mjs`，照宿主 `scanZstdFrames` 复刻）：
+*     一条 **72.2 MB**（zstd）的日志 = 35 559 个 frame / 252.6 MB 文本 / 62 680 条事件，
+*     **光是读一遍峰值 RSS +1 175 MB**（探针什么都不保留）；
+*   · 而宿主的解析缓存 `COLD_LOG_MEMO_MAX_ENTRIES = 2` 是**按条数限、不按字节限**的
+*     （`dsh-session-persistence-jsonl/lib/index.js:2175`）⇒ 两条巨日志 = 上限内。
+* 🔴 **在本函数之前，ACC 侧没有任何地方知道"绑定的这条会话日志多大"——这个信号根本不存在。**
+* 这是"靠 agent 自觉 rebuild 不够"的机制层原因（keeper 的 K 量的是**模型上下文**，压缩后回落；
+* 而**日志文件只增不减** ⇒ rebuild 提醒永远不会因为"日志 72 MB"触发）。
+*
+* 只认会话目录（含任意世代日志）；返回**最高世代**的日志（= 宿主 `findLog` 选中的当前世代）。
+* 未命中 / 不可读 → null（非错误，调用方按"未知"处理）。
+* @param root - DSH 会话 root（{@link sessionsRootDir}）
+* @param sessionId - 会话目录名（`.bindings.json` 的键，含 `session-` 前缀）或裸 id
+* @returns 字节数 + 日志绝对路径；未命中 → null
+*/
+function sessionLogBytesById(root, sessionId) {
+	if (sessionId === "" || !existsSync(root)) return null;
+	const dirName = sessionId.startsWith("session-") ? sessionId : `session-${sessionId}`;
+	for (const project of readdirSync(root, { withFileTypes: true })) {
+		if (!project.isDirectory()) continue;
+		const log = findSessionLog(join(root, project.name, dirName));
+		if (log === null) continue;
+		try {
+			return {
+				bytes: statSync(log).size,
+				path: log
+			};
+		} catch {
+			return null;
+		}
+	}
+	return null;
+}
+/**
+* **(c) 绑定一致性兜底**的判据：某会话的日志**是否仍在磁盘上**。
+*
+* 🔴 **fail-closed**：sessions root 本身不存在时**一律返回 true（当作"在"）**——
+* 否则换 `DSH_HOME` / 换机器会让"全部绑定看起来都悬空"，进而误清整张绑定表。
+* 只有"root 在、而这个会话目录确实不在"才算悬空。
+* @param sessionRoot - DSH 会话 root（{@link sessionsRootDir}）
+* @param sessionId - 会话目录名（`.bindings.json` 的键）或裸 id
+*/
+function hasSessionLogById(sessionRoot, sessionId) {
+	if (!existsSync(sessionRoot)) return true;
+	return sessionLogBytesById(sessionRoot, sessionId) !== null;
+}
 /** 便捷：默认 N 天前为 cutoff（供 API/调用方） */
 function cutoffDaysAgo(days, nowMs = Date.now()) {
 	return nowMs - days * DAY_MS;
 }
 //#endregion
-export { cutoffDaysAgo, performCleanup, sessionsRootDir };
+export { session_cleanup_exports as n, sessionsRootDir as r, hasSessionLogById as t };

package/lib/session-cleanup.d.ts

@@ -73,6 +73,41 @@ export declare function performCleanup(root: string, cutoffMs: number, liveIds?:
     candidates: CandidateSession[];
     result: CleanupResult | null;
 };
+/**
+ * 某一 dsh 会话（目录名 / 会话 id）的**当前世代日志体积**（字节）。
+ *
+ * 为什么要它（S142 §0y「旧会话累积 ⇒ dsh 内存崩溃」，所有者令）：
+ *   · 宿主恢复/继续一条会话必须**重放全部事件**（`scanLog` → `materializeAppendBatch`）
+ *     ⇒ **代价 ∝ 日志体积**；
+ *   · 实测（`_tmp/measure-session-load.mjs`，照宿主 `scanZstdFrames` 复刻）：
+ *     一条 **72.2 MB**（zstd）的日志 = 35 559 个 frame / 252.6 MB 文本 / 62 680 条事件，
+ *     **光是读一遍峰值 RSS +1 175 MB**（探针什么都不保留）；
+ *   · 而宿主的解析缓存 `COLD_LOG_MEMO_MAX_ENTRIES = 2` 是**按条数限、不按字节限**的
+ *     （`dsh-session-persistence-jsonl/lib/index.js:2175`）⇒ 两条巨日志 = 上限内。
+ * 🔴 **在本函数之前，ACC 侧没有任何地方知道"绑定的这条会话日志多大"——这个信号根本不存在。**
+ * 这是"靠 agent 自觉 rebuild 不够"的机制层原因（keeper 的 K 量的是**模型上下文**，压缩后回落；
+ * 而**日志文件只增不减** ⇒ rebuild 提醒永远不会因为"日志 72 MB"触发）。
+ *
+ * 只认会话目录（含任意世代日志）；返回**最高世代**的日志（= 宿主 `findLog` 选中的当前世代）。
+ * 未命中 / 不可读 → null（非错误，调用方按"未知"处理）。
+ * @param root - DSH 会话 root（{@link sessionsRootDir}）
+ * @param sessionId - 会话目录名（`.bindings.json` 的键，含 `session-` 前缀）或裸 id
+ * @returns 字节数 + 日志绝对路径；未命中 → null
+ */
+export declare function sessionLogBytesById(root: string, sessionId: string): {
+    bytes: number;
+    path: string;
+} | null;
+/**
+ * **(c) 绑定一致性兜底**的判据：某会话的日志**是否仍在磁盘上**。
+ *
+ * 🔴 **fail-closed**：sessions root 本身不存在时**一律返回 true（当作"在"）**——
+ * 否则换 `DSH_HOME` / 换机器会让"全部绑定看起来都悬空"，进而误清整张绑定表。
+ * 只有"root 在、而这个会话目录确实不在"才算悬空。
+ * @param sessionRoot - DSH 会话 root（{@link sessionsRootDir}）
+ * @param sessionId - 会话目录名（`.bindings.json` 的键）或裸 id
+ */
+export declare function hasSessionLogById(sessionRoot: string, sessionId: string): boolean;
 /** 便捷：默认 N 天前为 cutoff（供 API/调用方） */
 export declare function cutoffDaysAgo(days: number, nowMs?: number): number;
 export {};

package/lib/{trajectory-bound-OyuNkn6e.js → trajectory-bound-B9o_4CMF.js}

@@ -644,6 +644,7 @@ function listBoundSessionIds(root, dirName) {
 	for (const [id, raw] of Object.entries(file.sessions)) {
 		const rec = asBoundRecord(raw);
 		if (!rec || rec.dirName !== dirName) continue;
+		if (rec.supersededAt !== void 0) continue;
 		hits.push({
 			id,
 			at: typeof rec.at === "number" ? rec.at : 0
@@ -652,6 +653,82 @@ function listBoundSessionIds(root, dirName) {
 	return hits.sort((a, b) => b.at - a.at).map((h) => h.id);
 }
 /**
+* **(b) 同一 trajectory 多 live 会话的机械守卫**（S142 §0y，所有者 2026-09-18 裁「b 做」）。
+*
+* 把绑定到 `dirName` 的**其它**会话 id 标记为 `supersededAt` —— **保留记录**（沿革/正向查询不丢），
+* 只切断"**唤醒还会找到它**"这条路。语义上即"解绑"，且**不动那个会话本身**（它仍可被人工使用）。
+*
+* 为什么必须有机制（R↓）：`.bindings.json` 的语义是"latest-wins 覆盖**本条会话记录**"，
+* 对**同一 trajectory 的其它会话**没有任何约束 ⇒ 多代会话自然堆积（实测 S142 4 代 / S185 2 代），
+* 而 `acquireWakeAgent` 是"遍历全部绑定 id、任一条 live 就用它"——**两条 live 都能被选中**。
+*
+* @param root CCC 根
+* @param dirName 目标 trajectory 目录名
+* @param keepIds 保留（不标记）的会话 id 集合——通常是"当前正在 use 的这条"
+* @returns **实际被标记**的会话 id（升序稳定；供调用方如实报告，未标记任何一条 → `[]`）
+*/
+function supersedeOtherBindings(root, dirName, keepIds) {
+	const path = join(root, BINDINGS_REL_PATH);
+	const file = readBindingsFile(path);
+	const marked = [];
+	const at = Date.now();
+	for (const [id, raw] of Object.entries(file.sessions)) {
+		const rec = asBoundRecord(raw);
+		if (!rec || rec.dirName !== dirName) continue;
+		if (keepIds.has(id) || rec.supersededAt !== void 0) continue;
+		rec.supersededAt = at;
+		file.sessions[id] = rec;
+		marked.push(id);
+	}
+	if (marked.length === 0) return [];
+	try {
+		writeBindingsFile(path, file);
+	} catch {
+		return [];
+	}
+	return marked.sort();
+}
+/**
+* **(c) 绑定一致性兜底**（S142 §0y，所有者 2026-09-18 裁「c 也算个兜底」）：
+* 删除指向**已不存在**的 dsh 会话的绑定记录。
+*
+* 为什么需要：`.bindings.json` **只增不清**，而 DSH 会话目录会被
+* `session-cleanup`（本仓既有机制）物理删除 ⇒ 表里必然残留**悬空 id**。
+* 悬空记录本身无害，但它会**污染反向索引**（`listBoundSessionIds` 是唤醒选人的唯一入口），
+* 让"这条轨迹到底还有没有可用会话"变得不可判。
+*
+* 🔴 **安全性由调用方的判据负责**（本函数是纯函数，不认识文件系统）：
+* `isMissing` 必须是 **fail-closed** 的（读不到 ⇒ 返回 false = "不当作缺失"），
+* 见 `hasSessionLogById`。判据写错会**清掉整张表**，故此处刻意不提供默认实现。
+*
+* @param root CCC 根
+* @param isMissing 判据：该会话 id 是否**确认**已不存在（false = 保留）
+* @returns 被删除的会话 id（升序稳定；未删任何一条 → `[]`）
+*/
+function pruneMissingBindings(root, isMissing) {
+	const path = join(root, BINDINGS_REL_PATH);
+	const file = readBindingsFile(path);
+	const removed = [];
+	for (const id of Object.keys(file.sessions)) {
+		let missing;
+		try {
+			missing = isMissing(id);
+		} catch {
+			continue;
+		}
+		if (!missing) continue;
+		delete file.sessions[id];
+		removed.push(id);
+	}
+	if (removed.length === 0) return [];
+	try {
+		writeBindingsFile(path, file);
+	} catch {
+		return [];
+	}
+	return removed.sort();
+}
+/**
 * 写入绑定（latest-wins 覆盖该会话记录）。
 *
 * 绑定持久化尽力而为：无法定位 CCC 根 / 无会话 id / 写盘失败 → 返回 false，不阻断主流程。
@@ -680,4 +757,4 @@ function appendBound(session, action, rec) {
 	}
 }
 //#endregion
-export { localFileStamp as C, isoLocal as S, localIdStamp as T, sessionsRoot as _, DEFAULT_SESSION_SCOPE as a, summarize as b, createSession as c, getActiveSessionInfo as d, listSessions as f, sessionEvents as g, resolveSessionByTitle as h, resolveSessionTrajectoryLabel as i, extractSessionMdPathFromText as l, readActiveSessionMd as m, listBoundSessionIds as n, TRAJECTORY_ACTIONS as o, parseSessionContextFromEvents as p, readLastBound as r, clearActiveSessionInfo as s, appendBound as t, findSession as u, setActiveSessionInfo as v, localHuman as w, useSession as x, showSession as y };
+export { useSession as C, localIdStamp as D, localHuman as E, summarize as S, localFileStamp as T, resolveSessionByTitle as _, resolveSessionTrajectoryLabel as a, setActiveSessionInfo as b, TRAJECTORY_ACTIONS as c, extractSessionMdPathFromText as d, findSession as f, readActiveSessionMd as g, parseSessionContextFromEvents as h, readLastBound as i, clearActiveSessionInfo as l, listSessions as m, listBoundSessionIds as n, supersedeOtherBindings as o, getActiveSessionInfo as p, pruneMissingBindings as r, DEFAULT_SESSION_SCOPE as s, appendBound as t, createSession as u, sessionEvents as v, isoLocal as w, showSession as x, sessionsRoot as y };

package/lib/trajectory-bound.d.ts

@@ -31,6 +31,17 @@ interface SessionBoundRecord {
     action: SessionBoundAction;
     at: number;
     note?: string;
+    /**
+     * **(b) 已被取代标记**（S142 §0y，所有者 2026-09-18 裁「b 做」）。
+     *
+     * 语义：这条绑定**仍然存在**（沿革不丢、正向 `readLastBound` 仍能查到"我曾属于哪条轨迹"），
+     * 但**不再作为唤醒候选**（{@link listBoundSessionIds} 过滤掉）——这正是"解绑"的机械形态。
+     *
+     * 为什么需要（实证）：`.bindings.json` 只增不清——实测 S142 名下挂 **4 代**、S185 挂 **2 代**，
+     * 同一 trajectory 因此可以有**两条 live 会话**：各持一份完整上下文（内存翻倍）
+     * 且**都在写同一批文件**（双写者）。
+     */
+    supersededAt?: number;
 }
 /** 绑定文件相对 CCC 根的路径 */
 export declare const BINDINGS_REL_PATH = "AGENT_SESSIONS/.bindings.json";
@@ -73,6 +84,40 @@ export declare function resolveSessionTrajectoryLabel(session: unknown, scope: s
  * @returns 会话 id 列表（最新绑定在前）；无绑定 → `[]`
  */
 export declare function listBoundSessionIds(root: string, dirName: string): string[];
+/**
+ * **(b) 同一 trajectory 多 live 会话的机械守卫**（S142 §0y，所有者 2026-09-18 裁「b 做」）。
+ *
+ * 把绑定到 `dirName` 的**其它**会话 id 标记为 `supersededAt` —— **保留记录**（沿革/正向查询不丢），
+ * 只切断"**唤醒还会找到它**"这条路。语义上即"解绑"，且**不动那个会话本身**（它仍可被人工使用）。
+ *
+ * 为什么必须有机制（R↓）：`.bindings.json` 的语义是"latest-wins 覆盖**本条会话记录**"，
+ * 对**同一 trajectory 的其它会话**没有任何约束 ⇒ 多代会话自然堆积（实测 S142 4 代 / S185 2 代），
+ * 而 `acquireWakeAgent` 是"遍历全部绑定 id、任一条 live 就用它"——**两条 live 都能被选中**。
+ *
+ * @param root CCC 根
+ * @param dirName 目标 trajectory 目录名
+ * @param keepIds 保留（不标记）的会话 id 集合——通常是"当前正在 use 的这条"
+ * @returns **实际被标记**的会话 id（升序稳定；供调用方如实报告，未标记任何一条 → `[]`）
+ */
+export declare function supersedeOtherBindings(root: string, dirName: string, keepIds: ReadonlySet<string>): string[];
+/**
+ * **(c) 绑定一致性兜底**（S142 §0y，所有者 2026-09-18 裁「c 也算个兜底」）：
+ * 删除指向**已不存在**的 dsh 会话的绑定记录。
+ *
+ * 为什么需要：`.bindings.json` **只增不清**，而 DSH 会话目录会被
+ * `session-cleanup`（本仓既有机制）物理删除 ⇒ 表里必然残留**悬空 id**。
+ * 悬空记录本身无害，但它会**污染反向索引**（`listBoundSessionIds` 是唤醒选人的唯一入口），
+ * 让"这条轨迹到底还有没有可用会话"变得不可判。
+ *
+ * 🔴 **安全性由调用方的判据负责**（本函数是纯函数，不认识文件系统）：
+ * `isMissing` 必须是 **fail-closed** 的（读不到 ⇒ 返回 false = "不当作缺失"），
+ * 见 `hasSessionLogById`。判据写错会**清掉整张表**，故此处刻意不提供默认实现。
+ *
+ * @param root CCC 根
+ * @param isMissing 判据：该会话 id 是否**确认**已不存在（false = 保留）
+ * @returns 被删除的会话 id（升序稳定；未删任何一条 → `[]`）
+ */
+export declare function pruneMissingBindings(root: string, isMissing: (sessionId: string) => boolean): string[];
 /**
  * 写入绑定（latest-wins 覆盖该会话记录）。
  *

package/lib/{wake-scheduler-D0HDjEO8.js → wake-scheduler-CCpCk-7r.js}

@@ -1,6 +1,6 @@
 import { r as hostService, t as hostAgents } from "./access-fiehjxV6.js";
 import { o as listCccs } from "./ccc-roots-Bd_SjEs7.js";
-import { S as isoLocal, T as localIdStamp, _ as sessionsRoot, n as listBoundSessionIds, u as findSession, w as localHuman } from "./trajectory-bound-OyuNkn6e.js";
+import { D as localIdStamp, E as localHuman, f as findSession, n as listBoundSessionIds, w as isoLocal, y as sessionsRoot } from "./trajectory-bound-B9o_4CMF.js";
 import { t as readSimpleSettings } from "./settings-section-DMDUoQum.js";
 import { basename, dirname, join } from "node:path";
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from "node:fs";
@@ -572,6 +572,7 @@ function wakeSchedulerState() {
 * @param root CCC 根
 * @param dirName 目标 trajectory 目录名
 * @returns 命中返回 agent 与取得方式（how 进 lastResult，便于诊断）；未命中返回原因
+*   （原因带 `notReady` = **环境未就绪**而非投递失败，调用方**不得**据此记一次失败）
 */
 async function acquireWakeAgent(ctx, root, dirName) {
 	const agents = hostAgents(ctx);
@@ -586,7 +587,10 @@ async function acquireWakeAgent(ctx, root, dirName) {
 	if (ids.length > 0) {
 		const sc = hostService(ctx, "sessionController");
 		const resolved = sc?.resolveAgent;
-		if (typeof resolved !== "function") return { error: `目标会话未加载且 sessionController 不可用（headless profile？）——绑定 id: ${ids[0]}` };
+		if (typeof resolved !== "function") return {
+			error: `宿主尚未就绪：目标会话未加载，且 sessionController 服务此刻不可用（重启后的启动窗口，或本进程确实无该服务）——绑定 id: ${ids[0]}`,
+			notReady: true
+		};
 		const id = ids[0];
 		try {
 			const out = await resolved.call(sc, id);
@@ -631,7 +635,8 @@ async function deliverWake(ctx, root, entry) {
 	const acquired = await acquireWakeAgent(ctx, root, target.dirName);
 	if ("error" in acquired) return {
 		ok: false,
-		detail: acquired.error
+		detail: acquired.error,
+		notReady: acquired.notReady === true
 	};
 	try {
 		acquired.agent.followup(createUserMessage({
@@ -811,6 +816,10 @@ async function runWakeTick(ctx) {
 		}
 		for (const e of due) {
 			const res = await deliverWake(ctx, root, e);
+			if (res.notReady) {
+				log.push(`· ${root}: ${e.id} → 跳过（宿主服务未就绪，下个 tick 再试；不计失败）`);
+				continue;
+			}
 			updateWake(root, e.id, {
 				state: res.ok ? "delivered" : "pending",
 				attempts: e.attempts + 1,

package/lib/wake-scheduler.d.ts

@@ -14,7 +14,8 @@
  *     → 回退：live 会话标题匹配
  *  3. agent：**live 优先**（`ctx.agents.get`）→ 冷会话走 `ctx.sessionController.resolveAgent`
  *     （宿主实现：live 优先 + resume 去重 + 由会话元数据恢复 preset）
- *     → `sessionController` 缺席（headless profile）⇒ 仅投递 live 目标，**不静默**
+ *     → `sessionController` 缺席 ⇒ 仅投递 live 目标，**不静默**（v1.39.3：**归为"环境未就绪"**
+ *       而非"投递失败"，见 `WakeDeliveryResult.notReady` —— 启动那一拍早于懒服务就绪是常态）
  *  4. 投递：`agent.followup(...)`（"Queue an ordinary follow-up turn and wake the driver"）
  *
  * 守卫（I-4 默认 + v1.34 S-1 解耦）：全局 `wakeSchedulerEnabled`（**缺省开**；**不再**回退旧键
@@ -28,6 +29,19 @@ import { type WakeEntry } from './wake-registry.js';
 interface WakeDeliveryResult {
     ok: boolean;
     detail: string;
+    /**
+     * 🔴 **环境未就绪**（不是投递失败）——只有一种情形：目标需要**冷载入**，而宿主此刻**还没把
+     * 懒服务 `sessionController` 供上来**（典型 = `dsh web` 刚重启：时钟武装时**立刻跑一次 tick**，
+     * 那一拍早于懒服务就绪、也早于会话恢复）。
+     *
+     * 为什么要把它和"真失败"分开（2026-09-17 实测，S142 §0t）：
+     * 旧实现把这一情形当成投递失败写进条目 ⇒ ① `attempts` 无端 +1 ② `lastResult` 留下一条
+     * **误导性错误**（原文猜"headless profile？"，而真因是**重启窗口**，属**假陈述**）
+     * ③ 注册表/面板里出现"失败的投递"，**每次 restart 都必然复现**——一个**假告警发生器**
+     * （所有者 2026-09-17 就是被它引来的）。而消息**从未丢失**：下一个 tick 就投成功了。
+     * ⇒ 判据：**"宿主服务还没起来"不是投递结果**，不得计入条目。
+     */
+    notReady?: boolean;
 }
 /**
  * 调度器**进程态**（诊断用，模块级 = 进程级，正是诊断对象）。

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.39.2",
+  "version": "1.39.3",
   "description": "宁静号 ACC harness（Native Cordis 插件）——给 DeepSeek Harness 装一个「AI 工作区」：11 个工具（container_fs/container_trajectory/dashboard/container_git/msm/praxis/handyman/localstore/container_admin/im-bridge/acc-diag）+ 机械约束（安全模式/工作区围墙/密钥守卫/对外输出守卫）+ 工作日志与原地重建 + 网页登录入口/微信桥/子角色/对外问答页/trajectory 唤醒注册表。适配 DSH 0.1.5-rc.2。",
   "license": "MIT",
   "repository": {