@shgroup/dsh-serenity-hooks 1.76.0 → 1.77.1

package/lib/index.js

@@ -4,7 +4,8 @@ import { _ as resolveInside, a as findSerenityRoot$1, c as matchBlacklist, d as
 import { A as sessionsRoot, B as localFileStamp, C as namingTitleFor, D as readTrajectoryUid, E as readActiveSessionMd, F as useSession, H as localIdStamp, I as TRAJECTORY_FILENAME, L as TRAJECTORY_LEGACY_FILENAMES, M as showSession, N as summarize, O as resolveSessionByTitle, P as trajectoryDescOf, R as readTrajectoryFile, S as listSessions, T as parseTrajectoryCode, V as localHuman, _ as extractSessionMdPathFromText, a as readTrajectoryConstraintAt, c as registerTrajectorySession$1, d as COGNITIVE_TRAJECTORY_ACTIONS, f as DEFAULT_SESSION_SCOPE, g as createSession, h as clearActiveSessionInfo, j as setActiveSessionInfo, k as sessionEvents$1, l as trajectoryDirNameForSession, m as archiveSession, n as isTrajectoryConstrained, o as readTrajectoryConstraintByCode, p as UID_FILENAME, r as listTrajectoryConstraints, s as trajectoryConstraintForSession, t as TRAJECTORY_CONSTRAINT_FILENAME, u as unregisterTrajectorySession$1, v as findSession, w as parseSessionContextFromEvents, x as listActiveTrajectories, y as getActiveSessionInfo, z as isoLocal } from "./profile-DplLGGqo.js";
 import { _ as runLocalStore, a as readFeishuCredential, d as weixinSessionIdForTrajectory, f as LOCALSTORE_SCOPES, g as readStore, h as readGitTrack, i as matchWeixinRoute, l as sanitizeFileName$1, m as localstorePath, n as extractWeixinText, o as readWeixinCredential, p as checkLocalstoreGitCompliance, r as hasVoiceItem, s as readWeixinSettings, t as extractWeixinMedia, u as weixinInboundDir } from "./route-COOFLTpU.js";
 import { a as buildTrajectoryBasePrompt, c as createProfilePromptReader, d as resolveConstraintSystemPrompt, f as ACC_VERSION, i as TRAJECTORY_CONSTRAINT_HINT, l as profileMsmWhitelist, n as readSimpleSettings, o as constraintCognitiveTrajectory, p as findPackageRoot, r as registerSettingsSection, s as constraintSystemPromptSource, u as profileToolWhitelist } from "./settings-f9WZXcgi.js";
-import { a as pruneMissingBindings, c as setBindingStore, i as listBoundSessionIds, n as PLUGIN_SOURCE, o as readLastBound, r as appendBound, s as resolveSessionCognitiveTrajectoryLabel, t as ACC_MESSAGE_KIND } from "./message-source-C_Zd2vJh.js";
+import { a as listBoundSessionIds, i as carrierState, n as PLUGIN_SOURCE, o as readLastBound, r as appendBound, s as resolveSessionCognitiveTrajectoryLabel, t as ACC_MESSAGE_KIND } from "./message-source-CYa8LbbM.js";
+import { n as hasSessionLogById, r as sessionsRootDir } from "./cleanup-C-92qnDs.js";
 import { REGISTERED_TOOLS } from "./invariant.js";
 import { c as sendTextMessage, i as getUpdates, l as sendTyping, n as downloadMedia, o as markdownToPlainText, r as getConfig, s as sendFileMessage, t as TypingStatus, u as sniffImageExt } from "./ilink-BMk2w2KY.js";
 import { a as registerImAccountImpl, i as normalizeAccountChannel, n as getImAccountImpl, r as imAccountChannels } from "./accounts-BHQbakUh.js";
@@ -9595,215 +9596,6 @@ function createCheapWorkerTool(ctx) {
 	});
 }
 //#endregion
-//#region src/trajectory/cleanup.ts
-/**
-* trajectory/cleanup.ts — DSH 平台旧会话自动清理（v1.29，S142 需求③）
-*
-* 背景（实证）：DSH 会话物理存储 = `$DSH_HOME/sessions/`（缺省 ~/.dsh/sessions；
-* base bundle cordis.patch.yml root: dshHomePath('sessions')）。磁盘布局：
-*   <root>/--<project-slug>--/<encoded-session-id>/session[.vN].jsonl(.zstd)
-* **世代（v1.31.13 补）**：宿主自 DSH 0.1.5 起按世代写文件，且迁移**保留源文件**
-* ⇒ 一个会话目录常见 v0 与 v3 两个文件并存。本模块用 `sessionLogArtifacts()` 统一枚举世代。
-* DSH **无删除会话 API**（PersistenceCoordinator 仅 create/append/load/inspect/borrow，
-* 无 delete/purge；workspace archiveSession 只加归档集不删文件）——物理删除只能直接
-* 删文件。删除后一致性（利好）：sessionPersistence.list() = readdir 扫描磁盘现存 →
-* 物理删后 list 不再返回；WorkspaceRegistry 下次启动重建 header index 自动消失。
-*
-* 方案（S142 用户拍板）：lastActive 基准 + 手动触发 + 不过滤不归档直接物理删；
-* 安全底线 = live 会话保护跳过（删正在运行的会话 = 灾难）。
-*
-* 本模块纯逻辑（零 ctx 依赖）：传入 sessionsRoot + liveIds，可单测。
-*/
-var cleanup_exports = /* @__PURE__ */ __exportAll({
-	collectEligibleSessions: () => collectEligibleSessions,
-	cutoffDaysAgo: () => cutoffDaysAgo,
-	findSessionLog: () => findSessionLog,
-	hasSessionLogById: () => hasSessionLogById,
-	performCleanup: () => performCleanup,
-	sessionLogArtifacts: () => sessionLogArtifacts,
-	sessionLogBytesById: () => sessionLogBytesById,
-	sessionsRootDir: () => sessionsRootDir
-});
-/** DSH 会话 root：env DSH_HOME → ~/.dsh（config-ops globalConfigPath 同款推导） */
-function sessionsRootDir() {
-	const dshHome = process.env.DSH_HOME ?? join(process.env.HOME ?? "", ".dsh");
-	return join(dshHome, "sessions");
-}
-/** 一天的毫秒数 */
-const DAY_MS = 864e5;
-/**
-* 扫描 sessions root，列出可清理候选：
-* - 递归 `<root>/<project>/<session-id>/session.jsonl(.zstd)`（任意深度下找 *session* 文件）
-* - 过滤 live（liveIds 集合）——安全底线
-* - 过滤 lastActive >= cutoffMs（最后活动未达阈值 → 保留）
-* root 不存在/为空 → 返回 []（非错误）。
-*/
-function collectEligibleSessions(root, cutoffMs, liveIds = /* @__PURE__ */ new Set()) {
-	if (!existsSync(root)) return [];
-	const out = [];
-	for (const project of readdirSync(root, { withFileTypes: true })) {
-		if (!project.isDirectory()) continue;
-		const projectPath = join(root, project.name);
-		for (const entry of readdirSync(projectPath, { withFileTypes: true })) {
-			if (!entry.isDirectory()) continue;
-			const dirPath = join(projectPath, entry.name);
-			const artifacts = sessionLogArtifacts(dirPath);
-			if (artifacts.length === 0) continue;
-			const log = findSessionLog(dirPath);
-			if (log === null) continue;
-			if (liveIds.has(entry.name)) continue;
-			let mtime = Number.NEGATIVE_INFINITY;
-			for (const artifact of artifacts) try {
-				mtime = Math.max(mtime, statSync(artifact.path).mtimeMs);
-			} catch {}
-			if (!Number.isFinite(mtime)) continue;
-			if (mtime >= cutoffMs) continue;
-			out.push({
-				id: entry.name,
-				project: project.name,
-				logPath: log,
-				lastActiveMs: mtime
-			});
-		}
-	}
-	return out;
-}
-/**
-* 会话日志文件名识别：`session.jsonl` / `session.jsonl.zstd`（= **v0 世代**）/
-* `session.v<N>.jsonl[.zstd]`（= 第 N 世代，DSH 0.1.5 起按世代写文件）。
-* 出处：`@deepseek-ai/dsh-session-persistence-jsonl` 的 `parseSessionFormatLogFilename` 同款形态。
-*/
-const SESSION_LOG_RE = /^session(?:\.v(\d+))?\.jsonl(\.zstd)?$/;
-/**
-* 列出会话目录下的**全部日志世代**，按代递增排序（同代内 `.jsonl` 在前、`.zstd` 在后 = 后者更代表"当前书写格式"）。
-*
-* 为什么需要（R↓，v1.31.13 修复）：宿主自 0.1.5 起改成**按世代写文件**，且迁移**保留源文件**
-* ⇒ 同一会话常见 `session.jsonl.zstd`（v0）与 `session.v3.jsonl.zstd`（v3）**并存**。
-* 旧实现只认前两个名字 → 新格式会话对本模块**完全不可见**（静默 no-op：清理永远不生效、磁盘只涨）。
-*/
-function sessionLogArtifacts(sessionDirPath) {
-	let names;
-	try {
-		names = readdirSync(sessionDirPath);
-	} catch {
-		return [];
-	}
-	const out = [];
-	for (const name of names) {
-		const m = SESSION_LOG_RE.exec(name);
-		if (m === null) continue;
-		out.push({
-			name,
-			generation: m[1] === void 0 ? 0 : Number(m[1]),
-			path: join(sessionDirPath, name)
-		});
-	}
-	return out.sort((a, b) => a.generation - b.generation || (a.name.endsWith(".zstd") ? 1 : 0) - (b.name.endsWith(".zstd") ? 1 : 0));
-}
-/**
-* 在会话目录下找 session 日志文件；无 → null。
-* 多世代并存时返回**最高世代**（= 宿主 `findLog` 选中的当前世代；旧行为对单文件目录完全一致）。
-*/
-function findSessionLog(sessionDirPath) {
-	const artifacts = sessionLogArtifacts(sessionDirPath);
-	const latest = artifacts[artifacts.length - 1];
-	return latest === void 0 ? null : latest.path;
-}
-/**
-* 执行清理（用户拍板：直接物理删，不过滤不归档；dryRun 预览不删）。
-* 删除 = rmSync 整个会话目录（recursive + force）。失败逐个记 errors 不中断。
-*/
-function performCleanup(root, cutoffMs, liveIds = /* @__PURE__ */ new Set(), opts = {}) {
-	const candidates = collectEligibleSessions(root, cutoffMs, liveIds);
-	if (opts.dryRun) return {
-		candidates,
-		result: null
-	};
-	const result = {
-		deleted: [],
-		errors: []
-	};
-	for (const c of candidates) {
-		const dir = dirOf(c.logPath);
-		try {
-			rmSync(dir, {
-				recursive: true,
-				force: true
-			});
-			result.deleted.push(c.id);
-		} catch (e) {
-			result.errors.push({
-				id: c.id,
-				reason: e.message
-			});
-		}
-	}
-	return {
-		candidates,
-		result
-	};
-}
-/** 从日志路径取会话目录（父目录） */
-function dirOf(logPath) {
-	return logPath.slice(0, logPath.lastIndexOf("/")) || logPath;
-}
-/**
-* 某一 dsh 会话（目录名 / 会话 id）的**当前世代日志体积**（字节）。
-*
-* 为什么要它（S142 §0y「旧会话累积 ⇒ dsh 内存崩溃」，所有者令）：
-*   · 宿主恢复/继续一条会话必须**重放全部事件**（`scanLog` → `materializeAppendBatch`）
-*     ⇒ **代价 ∝ 日志体积**；
-*   · 实测（`_tmp/measure-session-load.mjs`，照宿主 `scanZstdFrames` 复刻）：
-*     一条 **72.2 MB**（zstd）的日志 = 35 559 个 frame / 252.6 MB 文本 / 62 680 条事件，
-*     **光是读一遍峰值 RSS +1 175 MB**（探针什么都不保留）；
-*   · 而宿主的解析缓存 `COLD_LOG_MEMO_MAX_ENTRIES = 2` 是**按条数限、不按字节限**的
-*     （`dsh-session-persistence-jsonl/lib/index.js:2175`）⇒ 两条巨日志 = 上限内。
-* 🔴 **在本函数之前，ACC 侧没有任何地方知道"绑定的这条会话日志多大"——这个信号根本不存在。**
-* 这是"靠 agent 自觉 rebuild 不够"的机制层原因（keeper 的 K 量的是**模型上下文**，压缩后回落；
-* 而**日志文件只增不减** ⇒ rebuild 提醒永远不会因为"日志 72 MB"触发）。
-*
-* 只认会话目录（含任意世代日志）；返回**最高世代**的日志（= 宿主 `findLog` 选中的当前世代）。
-* 未命中 / 不可读 → null（非错误，调用方按"未知"处理）。
-* @param root - DSH 会话 root（{@link sessionsRootDir}）
-* @param sessionId - 会话目录名（`.bindings.json` 的键，含 `session-` 前缀）或裸 id
-* @returns 字节数 + 日志绝对路径；未命中 → null
-*/
-function sessionLogBytesById(root, sessionId) {
-	if (sessionId === "" || !existsSync(root)) return null;
-	const dirName = sessionId.startsWith("session-") ? sessionId : `session-${sessionId}`;
-	for (const project of readdirSync(root, { withFileTypes: true })) {
-		if (!project.isDirectory()) continue;
-		const log = findSessionLog(join(root, project.name, dirName));
-		if (log === null) continue;
-		try {
-			return {
-				bytes: statSync(log).size,
-				path: log
-			};
-		} catch {
-			return null;
-		}
-	}
-	return null;
-}
-/**
-* **(c) 绑定一致性兜底**的判据：某会话的日志**是否仍在磁盘上**。
-*
-* 🔴 **fail-closed**：sessions root 本身不存在时**一律返回 true（当作"在"）**——
-* 否则换 `DSH_HOME` / 换机器会让"全部绑定看起来都悬空"，进而误清整张绑定表。
-* 只有"root 在、而这个会话目录确实不在"才算悬空。
-* @param sessionRoot - DSH 会话 root（{@link sessionsRootDir}）
-* @param sessionId - 会话目录名（`.bindings.json` 的键）或裸 id
-*/
-function hasSessionLogById(sessionRoot, sessionId) {
-	if (!existsSync(sessionRoot)) return true;
-	return sessionLogBytesById(sessionRoot, sessionId) !== null;
-}
-/** 便捷：默认 N 天前为 cutoff（供 API/调用方） */
-function cutoffDaysAgo(days, nowMs = Date.now()) {
-	return nowMs - days * DAY_MS;
-}
-//#endregion
 //#region src/wake/registry.ts
 /**
 * wake/registry.ts — 认知轨迹唤醒注册表（D58，S142 2026-09-13）
@@ -11912,6 +11704,21 @@ async function sendToCognitiveTrajectory(ctx, root, target, message, sender) {
 	let createdNote = "";
 	if ("error" in acquired) {
 		if (!acquired.notReady && acquired.noBinding === true) {
+			const carrier = carrierState(root, t.dirName, (id) => {
+				if (hostAgents(ctx)?.get?.(id)) return true;
+				try {
+					return hasSessionLogById(sessionsRootDir(), id);
+				} catch {
+					return true;
+				}
+			});
+			if (carrier.state !== "never") {
+				const why = carrier.state === "occupied" ? `该轨迹曾经由会话 ${carrier.sessionId} 承载，而它此刻不在了` : `该轨迹当前由会话 ${carrier.sessionId} 承载`;
+				return {
+					ok: false,
+					detail: `${t.dirName}：${why} ⇒ **拒绝自动新建载体**（一条轨迹至多一个载体）。\n  · 要让它重新跑起来：把那个会话恢复，或用 cognitive_trajectory rebuild 换代（显式 takeover）。\n  · 不明所以就先 cognitive_trajectory show ${t.dirName} 看它的交代文件。`
+				};
+			}
 			acquired = await createAndBindTarget(ctx, root, t.dirName);
 			if ("error" in acquired) return {
 				ok: false,
@@ -12781,50 +12588,41 @@ function createCognitiveTrajectoryTool(ctx) {
 	return defineTool({
 		name: "cognitive_trajectory",
 		description: [
-			"cognitive_trajectory — one cognitive trajectory: its persistent body (SESSION.md) + its timeline.",
-			"A cognitive trajectory is NOT the conversation: SESSION.md is the durable body and never moves;",
-			"the dsh conversation is only its rebuildable carrier (Ship of Theseus — the carrier is replaced, the cognitive trajectory continues).",
-			"IDENTITY: every trajectory has a CODE — the fixed-position segment of its directory name (YYYY-MM-DD--<code>[--<desc>]).",
-			"The code IS the trajectory's unique identifier, and you can choose it at creation time with create --id.",
-			"A COGNITIVE TRAJECTORY HAS NO LIFECYCLE — it does not complete, close, or expire, and age never counts against it;",
-			"it PERMANENTLY EXISTS. The only thing that ever changes is WHERE it is stored: archive moves it out of the active list",
-			"without touching a single byte of its directory or SESSION.md. There is no reverse action — to restore one, use container_fs mv.",
-			"ACTIONS, grouped by EFFECT (read the grouping before picking one):",
+			"A COGNITIVE TRAJECTORY is a durable body (SESSION.md) that outlives every conversation carrying it.",
+			"AXIOM 1 — THE TRAJECTORY IS THE SUBJECT; THE CONVERSATION IS ITS CARRIER. Rebuilding the carrier replaces the conversation and leaves SESSION.md byte-identical.",
+			"AXIOM 2 — A TRAJECTORY HAS NO LIFECYCLE. It never completes, closes, or expires, and age never counts against it. The only thing that changes is WHERE it is stored: archive moves it out of the active list without touching its directory.",
+			"AXIOM 3 — IDENTITY IS THE CODE: the fixed-position segment of the directory name `YYYY-MM-DD--<code>[--<desc>]`. The code (not the summary, not the title) is the unique identifier, and create --id lets you choose it.",
+			"DOES NOT: this tool never deletes a trajectory, never edits SESSION.md content, and never schedules recurring work (that is cro-guide).",
+			"ENTITIES. TRAJECTORY = a directory under AGENT_SESSIONS/ holding SESSION.md. CARRIER = a dsh session bound to it. BINDING DECLARATION = the file `<trajectory>/current.dsh_session_bind` — ONE FILE PER TRAJECTORY, a single slot, never a table.",
+			"IMMUTABLE 1 — ONE SESSION BELONGS TO AT MOST ONE TRAJECTORY, FOR LIFE. use refuses to move a session that already carries a different trajectory. There is NO --force override (retired 2026-10-20; passing it returns a refusal explaining why). To give another trajectory a carrier, open a new session.",
+			"IMMUTABLE 2 — ONE TRAJECTORY HAS AT MOST ONE CURRENT CARRIER, and THE BINDING DECLARATION IS THE ONLY TRUTH. If several dsh sessions happen to be open, only the one named in the declaration carries the trajectory; the others are simply unbound. Never infer a binding from \"a session looks active\".",
+			"IMMUTABLE 3 — A DECLARATION WHOSE SESSION NO LONGER EXISTS COUNTS AS UNBOUND. No cleanup is ever required, and a stale declaration is deliberately left in place: it records who carried this trajectory last.",
+			"ACTIONS, GROUPED BY EFFECT — read the grouping before choosing, because it answers \"does this change what I am bound to?\":",
 			"(A) LIFECYCLE — changes which cognitive trajectory THIS conversation is bound to:",
-			"list (inventory + stats + anomaly marks) / show (read one SESSION.md) / create (make a NEW cognitive trajectory) /",
-			"use (bind THIS conversation to an existing cognitive trajectory; inline integrity check — silent when fine, problems reported as hints, never errors) /",
-			"rebuild (clear-and-rebuild THIS conversation in place) /",
-			"archive (move a trajectory into the archived area so it leaves the active list; one-way, never overwrites, and its content is left byte-identical).",
-			"(B) DELIVERY — sends ONE message to ANOTHER cognitive trajectory; your own binding is unchanged:",
-			"send-now (deliver RIGHT NOW) / send-later (deliver at ONE future instant).",
-			"(C) REFERENCE — cro-guide (how to give THIS cognitive trajectory its own program that decides when it should be woken).",
+			"list (inventory + stats) / show (read one SESSION.md) / create (make a NEW trajectory) / use (bind THIS conversation) / rebuild (clear-and-rebuild THIS conversation in place) / archive (move a trajectory out of the active list; one-way, never overwrites).",
+			"(B) DELIVERY — sends ONE message to ANOTHER trajectory; your own binding is unchanged: send-now (right now) / send-later (one future instant).",
+			"(C) REFERENCE — cro-guide: how to give a trajectory its own program that decides when it should be woken.",
 			"HOW TO CHOOSE (a rule, not a guess):",
-			"not yet bound + starting new work ⇒ create — with no prior binding it activates immediately, so the new cognitive trajectory has a carrier at once.",
-			"already bound + recording a separate future line ⇒ create — it does NOT steal your binding (you stay on the current cognitive trajectory);",
-			"activate the new one when you want it by sending it a message.",
-			"want THIS conversation to move to another cognitive trajectory ⇒ use (refuses when it would orphan the current binding; --force overrides).",
-			"want to poke another cognitive trajectory ⇒ send-now. Its target needs NO prior setup:",
-			"if the target has no live dsh session, one is created and bound automatically, and your message is injected into it.",
-			"RECEIPTS (read no more than is written): send-now returns a synchronous receipt meaning exactly \"injected / turn started\" —",
-			"NEVER \"the target ran or replied\"; to prove the target actually moved, read its SESSION.md.",
-			"It never queues behind the current turn: a busy target is steered mid-turn (read in the CURRENT turn), an idle target starts a turn at once.",
+			"not yet bound + starting new work ⇒ create (with no prior binding it activates immediately, so the new trajectory has a carrier at once).",
+			"already bound + recording a SEPARATE future line ⇒ create (it does NOT steal your binding; activate the new one later by send-now).",
+			"want THIS conversation to move ⇒ use. It refuses if this session already carries another trajectory (IMMUTABLE 1) — that refusal is the design, not an error to work around.",
+			"want to make another trajectory act ⇒ send-now. The target needs no prior setup: if it has no live session, one is created and bound automatically, and your message is injected.",
+			"RECEIPTS (read no more than is written): send-now returns a synchronous receipt meaning exactly \"injected / turn started\" — NEVER \"the target ran or replied\". To prove the target actually moved, read its SESSION.md.",
+			"send-now never queues behind the current turn: a busy target is steered mid-turn (read in the CURRENT turn), an idle target starts a turn at once.",
 			"send-later is fire-and-forget by design: no receipt, no recall, no panel.",
-			"ASYMMETRY (deliberate — the two differ in whether a missing target is normal): send-now creates a target on demand,",
-			"because sending to a never-used cognitive trajectory is a legitimate intent; send-later does NOT,",
-			"because scheduling for a cognitive trajectory that has never existed is almost always a mistyped name — auto-creating would hide that error behind an empty cognitive trajectory.",
-			"PARAMETERS: create requires --desc <desc> [--id <code>] [--goal] or --issue <ticket> (exactly one) plus --summary (≤20 chars).",
-			"use requires --summary (≤20 chars) and may pass --force to switch away from the currently-bound cognitive trajectory.",
-			"rebuild requires --summary (next-phase summary ≤20 chars) + optional --note (task focus for the rebuilt self).",
-			"send-later requires target (a code or AGENT_SESSIONS dir name) + at (RFC3339 or +30m/+2h) + message.",
-			"send-now requires target + message.",
-			"AUTHORIZATION (read this before creating anything): creating a cognitive trajectory or a dsh carrier costs real work,",
-			"and both are meant to serve a human intent — not to be spawned speculatively. Call create only when the user asked for",
-			"a new line of work (or confirmed it), never to \"tidy up\" or to pre-provision something nobody requested.",
-			"send-now creating a missing carrier on demand is likewise acceptable ONLY for a delivery the user actually wants made;",
-			"it is not a way to start work nobody asked for. When in doubt, ask the user instead of creating.",
-			"⚠️ This is a behavioral rule, not a mechanical gate: nothing stops a careless call. Treat it as etiquette with a cost.",
-			"uid: READS a legacy TRAJECTORY-UID only — setting one is retired (codes replaced it). Use create --id instead.",
-			"The summary is appended to the dsh session title (S###-YYYY-MM-DD-<summary>); the code and date stay server-derived unless you pass --id."
+			"ASYMMETRY (deliberate): send-now may create a missing carrier; send-later NEVER does. Scheduling for a trajectory that never existed is almost always a mistyped name, and auto-creating would hide that error.",
+			"CARRIER GUARD: send-now auto-creates a carrier ONLY for a trajectory that has never had one. If a declaration exists but its session is gone, it refuses and says so — one trajectory keeps one carrier. Two independent gates can refuse: (a) the declared session cannot be resolved at all; (b) it existed and is now gone.",
+			"PARAMETERS: create needs --desc <desc> [--id <code>] [--goal], OR --issue <ticket> (exactly one), PLUS --summary (≤20 chars).",
+			"use needs --name + --summary (≤20 chars). --force is ACCEPTED BUT REFUSED (retired): it exists only to explain why.",
+			"rebuild needs --summary (next-phase, ≤20 chars) + optional --note (≤200 chars, task focus for the rebuilt self).",
+			"send-now needs target + message. send-later needs target + at (RFC3339 with timezone, or +30m / +2h) + message.",
+			"target/name accept a code (S### or custom), a full AGENT_SESSIONS directory name, or a fuzzy keyword.",
+			"AUTHORIZATION (read before creating anything): create and send-now both cost real work and must serve a human intent. Call create only when the user asked for a new line of work (or confirmed it) — never to \"tidy up\" or pre-provision what nobody requested. When in doubt, ask instead of creating. This is a behavioral rule, not a mechanical gate: treat it as etiquette with a cost.",
+			"uid: READS a legacy TRAJECTORY-UID only. Setting one is retired — a trajectory's code is its identity now; use create --id <code>.",
+			"summary is appended to the dsh session title as <code>-<date>-<summary>; the code and date stay server-derived unless you pass --id.",
+			"SELF-DECLARATION MANUAL — how to write your own charter (PROMPT.md), declare yourself resident",
+			"(trajectory.json `resident.serves`), or restrict yourself (tool/model whitelists):",
+			"container_admin config docs trajectory-self. Read it before changing any file in your own directory."
 		].join(" "),
 		parameters: {
 			action: {
@@ -12832,11 +12630,11 @@ function createCognitiveTrajectoryTool(ctx) {
 				enum: [...COGNITIVE_TRAJECTORY_ACTIONS],
 				required: true,
 				description: [
-					"Subcommand — grouped by effect.",
+					"Subcommand — grouped by effect (see Tier 3 of the description).",
 					"LIFECYCLE (changes THIS conversation's binding):",
-					"list (inventory + stats + anomaly marks) / show (a code, dir name, or fuzzy keyword) /",
-					"create (new cognitive trajectory; --id sets its code. Activates itself when you have no binding, otherwise leaves your binding untouched and tells you how to activate it) /",
-					"use (activate context for THIS conversation; inline integrity check — pass silent, problems reported as hints, not errors) /",
+					"list (inventory + stats) / show (a code, dir name, or fuzzy keyword) /",
+					"create (new trajectory; --id sets its code. Activates itself when you have no binding, otherwise leaves your binding untouched and tells you how to activate it) /",
+					"use (activate context for THIS conversation; refuses if this session already carries another trajectory — no override) /",
 					"rebuild (clear-and-rebuild current conversation — requires --summary + optional --note) /",
 					"archive (move a trajectory to the archived area; one-way, refuses to overwrite, content untouched — --dryRun previews).",
 					"DELIVERY (sends one message to ANOTHER cognitive trajectory; your binding is unchanged):",
@@ -12879,7 +12677,7 @@ function createCognitiveTrajectoryTool(ctx) {
 			},
 			force: {
 				type: "boolean",
-				description: "use: allow switching away from the currently-bound cognitive trajectory (binding guard override)"
+				description: "use: RETIRED (2026-10-20) — one session belongs to one cognitive trajectory for life, so switching is refused unconditionally. The flag is still ACCEPTED so that an old call gets an explanation instead of an \"unknown argument\" error; it never overrides the guard."
 			},
 			dryRun: {
 				type: "boolean",
@@ -12895,7 +12693,7 @@ function createCognitiveTrajectoryTool(ctx) {
 			},
 			message: {
 				type: "string",
-				description: "send-later/send-now: the single message delivered to the target cognitive trajectory. send-now may create and bind a carrier when the target has no live session — acceptable only for a delivery the user actually wants made (user-intent-driven), not for speculatively starting work."
+				description: "send-later/send-now: the single message delivered to the target cognitive trajectory. send-now may create and bind a carrier ONLY when the target has never had one — acceptable only for a delivery the user actually wants made (user-intent-driven), never for speculatively starting work."
 			}
 		},
 		output: {
@@ -12958,22 +12756,16 @@ function createCognitiveTrajectoryTool(ctx) {
 					if (!targetEntry) throw new Error(`Session not found: "${args.name}". Use "list" to see available sessions.`);
 					const targetDirName = targetEntry.dirName;
 					const currentDir = currentBoundDirName(exec, scope);
-					const switching = currentDir !== null && targetDirName !== currentDir;
-					const force = args.force === true;
-					if (switching && !force) throw new Error(`Session is bound to ${currentDir}. Switching to ${targetDirName} would orphan the current cognitive trajectory. Re-run with --force to switch (or close the current session first).`);
+					if (currentDir !== null && targetDirName !== currentDir) throw new Error(`这个会话已经承载认知轨迹「${currentDir}」，不能改宗到「${targetDirName}」。\n一个会话终身只属于一条认知轨迹（2026-10-20 裁决，--force 已退役）。\n要继续用「${currentDir}」⇒ 不用任何操作；要给「${targetDirName}」开一个载体 ⇒ 新建一条会话再 use。`);
 					const active = useSession(root, args.name, scope);
 					const info = getActiveSessionInfo(scope);
 					if (info) renameDshSessionForActive(ctx, exec, info, args.summary);
 					const dsh = agentDshSession(exec);
-					if (dsh && info) {
-						const prevBound = readLastBound(dsh);
-						appendBound(dsh, switching && prevBound ? "switch" : "activate", {
-							dirName: info.dirName,
-							mdPath: info.mdPath,
-							sessionId: info.sessionId,
-							...switching ? { note: "forced switch" } : {}
-						});
-					}
+					if (dsh && info) appendBound(dsh, "activate", {
+						dirName: info.dirName,
+						mdPath: info.mdPath,
+						sessionId: info.sessionId
+					});
 					const advisory = advisoryHint(targetEntry.dirName, join(targetEntry.path, "SESSION.md"));
 					const out = {
 						dir: active.dir,
@@ -12981,10 +12773,6 @@ function createCognitiveTrajectoryTool(ctx) {
 						context: active.context
 					};
 					if (advisory) out.advisory = advisory;
-					if (dsh) {
-						const pruned = pruneMissingBindings(root, (id) => !hasSessionLogById(sessionsRootDir(), id));
-						if (pruned.length > 0) out.prunedBindings = pruned;
-					}
 					return out;
 				}
 				case "rebuild": {
@@ -13170,36 +12958,52 @@ const localstoreTool = defineTool({
 });
 //#endregion
 //#region src/tools/trajectory-constraint-admin.ts
-/** 轨迹约束 定义教程：概念 ／ `trajectory.json` schema ／ 双白名单 ／ 轨迹纪律 ／ 微信路由 */
-const TRAJECTORY_CONSTRAINT_GUIDE = `═══ 轨迹约束 Guide (2026-10-19 redesigned) ═══
+/**
+* 轨迹约束 定义教程：**只讲「限制面」**（约束面 / 双白名单 / 纪律参与项 / 路由）。
+*
+* 🔴 2026-10-20 拆分（owner 裁 Q2）：本章原先同时承载「描述自己」与「限制自己」。
+* 两者读者与前提不同 —— **描述自己是所有轨迹的常态，限制自己才是特例** ——
+* 故「章程 / 常驻 / 三个载体」已移入 `config docs trajectory-self`。
+* ⛔ **本文件不再重复那份内容**（一个内容一个正文入口，v1.75.0 指针纪律）。
+*/
+const TRAJECTORY_CONSTRAINT_GUIDE = `═══ 轨迹约束 Guide（限制面；2026-10-20 split）═══
 
 **A 轨迹约束 IS a cognitive trajectory — the one whose directory contains \`${TRAJECTORY_CONSTRAINT_FILENAME}\`.**
 That is the whole rule. No role table, no name registry: put the file there and the trajectory
 becomes a 轨迹约束; delete it and it goes back to being an ordinary trajectory (takes effect at once).
 
+⚠️ **本章只讲"限制自己"。** 想写章程（PROMPT.md）或声明常驻（resident）?
+   → \`container_admin config docs trajectory-self\`（那是**所有轨迹**都用得上的自述手册）。
+
   AGENT_SESSIONS/<YYYY-MM-DD--<code>--<desc>>/
     ├─ SESSION.md      ← its persistent body (this IS the workspace — nothing is auto-created)
-    ├─ PROMPT.md       ← its charter (trajectory-level prompt; all trajectories may have one)
+    ├─ PROMPT.md       ← its charter (see trajectory-self; NOT copied here)
     ├─ ${TRAJECTORY_CONSTRAINT_FILENAME}          ← its declaration (this file is what makes it a 轨迹约束)
     └─ continuous-re-occurrence.ts  ← optional CRO program (spawned, never imported)
 
   The older names ${TRAJECTORY_LEGACY_FILENAMES.map((n) => `\`${n}\``).join(" / ")} are still READ
   (the family is checked in that order) — writing goes to \`${TRAJECTORY_FILENAME}\` only.
 
-── ${TRAJECTORY_CONSTRAINT_FILENAME} schema ──
+── ${TRAJECTORY_CONSTRAINT_FILENAME} schema（限制面部分）──
   {
     "model": "provider/model",          // optional; falls back to cheap-worker.defaultModel
     "tools": ["read","grep","msm",...], // non-MSM toolbar whitelist — anything not listed is REMOVED from the schema
     "msms":  ["msm-a","msm-b"],         // MSM whitelist — msm exec may only run these; register/deregister always refused
     "cognitiveTrajectory": { "session": true, "keeper": true, "rebuild": true },  // defaults TRUE (see below)
-    "systemPromptFile": ".opencode/skiff/<role>.md",  // relative to CCC root, hot-reloads on save
-    "systemPrompt": "...",                            // inline fallback; systemPromptFile wins when both are set
-    "uid": "my-handle",                 // optional legacy alias (read-only; the code is the identity now)
     "cro": { "host": "<machine name>" } // optional: which machine may run this trajectory's CRO program
   }
 
+  ⚠️ 提示词**不在这里**（新形态）：写 \`PROMPT.md\` 即可，**所有轨迹**都适用。
+     旧字段 \`systemPromptFile\` / \`systemPrompt\` 属**兼容期**形态，仍在读、但不再推荐；
+     两者同时存在时 \`PROMPT.md\` 让位规则见 \`trajectory/prompt.ts\`（此处不重复）。
+
+  ⚠️ **只想声明常驻、不想限制自己**：只写 \`"resident"\` 字段、**不写 tools/msms**。
+     空白名单 = **不收窄任何工具面**（见下方"两个默认"）—— 但请注意你仍因此"成为轨迹约束"，
+     只是没有实际限制。
+
 ── Two whitelists, both default-deny ──
   - \`tools: []\` + non-empty \`msms\` = pure-MSM 轨迹约束 (the usual knowledge-QA shape)
+  - 空 \`tools\` + 空 \`msms\` = **无限制**（普通行为；常驻自述用的就是这一格）
   - non-empty \`msms\` ⇒ the \`msm\` tool is added automatically (the only entry point for MSMs)
   - anything outside both lists is invisible in the schema, not merely rejected at call time
 
@@ -13208,8 +13012,8 @@ becomes a 轨迹约束; delete it and it goes back to being an ordinary trajecto
   its own body, so \`session\`/\`keeper\`/\`rebuild\` all default to true. Set false explicitly only
   when you deliberately want that participation off.
 
-── WeChat routing: user → trajectory code ──
-  \`weixin.routes\`: \`[{ "user": "<wx id or *>", "trajectory": "<code>" }]\`
+── IM routing: user → trajectory code（微信 / 飞书同一张表）──
+  \`im.routes\`: \`[{ "user": "<channel user id or *>", "trajectory": "<code>" }]\`
   A route pointing at a code with no such trajectory is a hard error (the message is NOT delivered).
   A trajectory WITHOUT \`${TRAJECTORY_CONSTRAINT_FILENAME}\` is still a legal target — it is just an ordinary trajectory.
 
@@ -13217,7 +13021,9 @@ becomes a 轨迹约束; delete it and it goes back to being an ordinary trajecto
   Everything is read live: saving \`${TRAJECTORY_CONSTRAINT_FILENAME}\` takes effect on the next turn, no restart.
     (The prompt FILE hot-reloads by mtime; the JSON itself is re-read every turn.)
   After editing, run container_admin config apply for an explicit validation + confirmation pass.
-  Skill loading is always available to 轨迹约束 sessions (skills are not whitelisted — they are read-only knowledge).`;
+  Skill loading is always available to 轨迹约束 sessions (skills are not whitelisted — they are read-only knowledge).
+
+  写完之后怎么验 → container_admin config docs trajectory-self 的「写完之后怎么验」段（同一套判据，不复制）。`;
 /** 校验当前 CCC 的 轨迹约束面：msms 均已注册 ／ model ∈ cheap-worker.models ／ 提示词非空 */
 function validateTrajectoryConstraint(root) {
 	const profiles = listTrajectoryConstraints(root);
@@ -13297,6 +13103,81 @@ function applyTrajectoryConstraint(root) {
 		note: `constraints are read live from each trajectory's ${TRAJECTORY_CONSTRAINT_FILENAME} — they take effect on the next turn (no restart); ${TRAJECTORY_CONSTRAINT_HINT}`
 	};
 }
+/**
+* 一章的全文。
+*
+* ⚠️ 本函数是**纯常量拼接**（无 IO、无 ctx）：手册正文不随容器状态变化，
+* 唯一随状态变的东西（"我现在是不是轨迹约束"）由 `config list` 回答，不写进正文。
+*/
+const TRAJECTORY_SELF_GUIDE = [
+	"═══ 一条认知轨迹如何描述自己（self-declaration guide）═══",
+	"",
+	"这份手册回答一件事：**我（某条认知轨迹）想给自己做设定时，该写进哪个文件、怎么写、怎么验。**",
+	"",
+	`── 三个载体：想改哪件事，就写进哪个文件 ──
+
+  <trajectory>/SESSION.md     ← 我的**身体**（认知轨迹本体；持久、永不移动）
+  <trajectory>/PROMPT.md      ← 我的**章程**（我是谁、按什么工作；**所有轨迹都可以有**）
+  <trajectory>/trajectory.json ← 我的**声明**（结构化字段；有它才成为"轨迹约束"，见下）
+
+  ⚠️ 三者主语相同（都是这条轨迹）、生命周期相同（随 git 走）、写入频率相同（人偶尔改）
+  ⇒ 这正是它们**该分开而不该合并**的理由：每一项都对应一种**不同的意图**。`,
+	"",
+	`── PROMPT.md：我的章程（推荐所有轨迹都写）──
+
+  写什么：我这名认知轨迹的**身份与工作方式** —— 我负责什么、我的判断依据是什么、
+          我的边界在哪、我怎么跟其他轨迹协作。
+  谁读它：**只有绑定在我身上的会话**读到它（作为系统提示词的一个独立段）。
+  何时生效：**保存即生效**（按 mtime 热重载，无需重启、无需 rebuild）。
+  没有它会怎样：不报错。我拿到的是 ACC 的通用身份 —— 普通轨迹的常态，不是缺陷。
+
+  ⚠️ 与 SESSION.md 的分工（别写重了）：
+     SESSION.md = **发生了什么**（日志、决策、当前状态）
+     PROMPT.md  = **我是谁、怎么工作**（章程；很少改，改了就改变行为）`,
+	"",
+	`── 常驻：自己声明"欢迎别人来麻烦我"（trajectory.json 的 resident 字段）──
+
+  🔴 先排除一个误解：**常驻不是资源状态**。
+     它不是"永不休眠"、不是"常驻内存"、不是"不许销毁我的会话"。
+     一条轨迹**永远存在**（没有生命周期），常驻与否都不改变这一点。
+
+  那它是什么：**我对自己用途的公开声明** —— "我在这儿、我擅长什么、欢迎来麻烦我"。
+     别的轨迹要找人干活时，先查这份名单，而不是靠猜谁可能懂。
+
+  写法：
+    { "resident": { "serves": "一句话说清我擅长什么、能帮上什么忙" } }
+
+  ⚠️ 两个门槛，缺一不可：
+     ① 写了 \`resident\` ⇒ 我进得了别人的候选名单（**可被发现**）
+     ② \`serves\` 非空 ⇒ 别人读了这句话能判断"这事是不是该找你"（**可被判断**）
+     只写半个（有字段、没 serves）等于把自己挂上去却不说能干什么 —— 那比不写更坏，
+     因为别人会来问，然后发现问错了人。
+
+  谁能看见：通过 cognitive_trajectory 的常驻名单动作按需查询。
+     **它不进系统提示词**（不占每个请求的 token）—— 只在有人真的要找人时才读。
+     这是 owner 2026-10-20 的裁决：说明类信息按需取，不常驻在上下文里。`,
+	"",
+	`── 想限制自己（白名单 / 模型 / 纪律参与项）──
+
+  写 \`trajectory.json\` 即成为**轨迹约束**（判据是**文件存在**，不是某个字段存在）。
+  删掉它 ⇒ 当场退回普通轨迹。
+
+  ⚠️ 一个必须知道的连带后果：**写 trajectory.json 会把我变成受约束的轨迹**。
+     所以如果你只想"描述自己"（章程、常驻），**不需要**建这个文件 ——
+     章程走 PROMPT.md；常驻字段确实也在这个文件里，但**只写 resident、不写 tools/msms**
+     时，白名单为空 = 不收窄任何工具面（见下一章"两个默认"）。
+
+  schema、双白名单、纪律参与项的完整说明 → container_admin config docs trajectory-constraint`,
+	"",
+	`── 写完之后怎么验（别只看文档，要能机械判定）──
+
+  章程生效了吗    改 PROMPT.md 后**在同一会话里**看下一轮的系统提示词段是否变化（保存即生效）
+  我是轨迹约束吗  container_admin config list  —— 我的编码出现在列表里即成立
+  配置合法吗      container_admin config validate  —— msms 均已注册 / model 在可用表里 / 提示词非空
+  常驻被看见了吗  cognitive_trajectory 的常驻名单动作 —— 我出现在名单里，且 serves 可读
+
+  ⚠️ 以上四项都是**读取当前真实状态**，不是"保存成功"的回执。保存成功 ≠ 生效（本仓反复踩过）。`
+].join("\n");
 //#endregion
 //#region src/tools/container-admin.ts
 /**
@@ -13439,9 +13320,14 @@ const DOCS_CHAPTERS = [
 		summary: "CCC 配置全表——9 段各是什么、怎么填、填错会怎样（.opencode/serenity.json）",
 		render: () => CCC_CONFIG_REFERENCE
 	},
+	{
+		id: "trajectory-self",
+		summary: "一条轨迹怎么描述自己——章程 PROMPT.md ／ 常驻声明（resident.serves）／ 三个载体的分工 ＋ 写完怎么验",
+		render: () => TRAJECTORY_SELF_GUIDE
+	},
 	{
 		id: "trajectory-constraint",
-		summary: "轨迹约束：一条轨迹怎么被约束（trajectory.json 的 schema ＋ 双白名单）",
+		summary: "轨迹约束（只讲限制面）：trajectory.json 的双白名单 ／ 模型 ／ 纪律参与项 ／ IM 路由",
 		render: () => TRAJECTORY_CONSTRAINT_GUIDE
 	}
 ];
@@ -13453,7 +13339,7 @@ const DOCS_CHAPTERS = [
 function createContainerAdminTool(ctx) {
 	return defineTool({
 		name: "container_admin",
-		description: "Container administration (the ship's maintenance bay — one entry for managing the CCC): config — CCC configuration: docs (usage-manual index) / docs <chapter> (one chapter in full) / view (current values) + 轨迹约束 (guide/validate/apply/list); msm — MSM registry management (register/deregister/check quality DC-M1~M4) + manuals (guide dev manual / catalog ACC capability directory / ccc-config CCC configuration reference). Execution of registered MSMs belongs to the msm tool; this tool manages the container.",
+		description: "Container administration (the ship's maintenance bay — one entry for managing the CCC): config — CCC configuration: docs (usage-manual index) / docs <chapter> (one chapter in full) / view (current values) + 轨迹约束 (guide/validate/apply/list); msm — MSM registry management (register/deregister/check quality DC-M1~M4) + manuals (guide dev manual / catalog ACC capability directory / ccc-config CCC configuration reference). TRAJECTORY SELF-DOCS: a cognitive trajectory describing ITSELF — charter (PROMPT.md) / resident declaration / self-restriction (whitelists) ⇒ config docs trajectory-self; the restriction side only ⇒ config docs trajectory-constraint. Execution of registered MSMs belongs to the msm tool; this tool manages the container.",
 		parameters: {
 			domain: {
 				type: "string",
@@ -16343,7 +16229,7 @@ function registerStatusApi(ctx, opts = {}) {
 					const id = s.id ?? s.header?.id;
 					if (id) liveIds.add(id);
 				}
-				const { sessionsRootDir, collectEligibleSessions, performCleanup, cutoffDaysAgo } = await Promise.resolve().then(() => cleanup_exports);
+				const { sessionsRootDir, collectEligibleSessions, performCleanup, cutoffDaysAgo } = await import("./cleanup-C-92qnDs.js").then((n) => n.t);
 				const root = sessionsRootDir();
 				if (req.method === "GET") {
 					const { candidates } = performCleanup(root, cutoffDaysAgo(days), liveIds, { dryRun: true });
@@ -18402,7 +18288,6 @@ async function queueRebuild(ctx, opts) {
 	const boundRec = {
 		dirName: basename(dirname(mdPath)),
 		mdPath,
-		sessionId: sessionName.startsWith("S") ? sessionName : void 0,
 		note: "rebuild queued"
 	};
 	appendBound(session, "rebuild", boundRec);
@@ -25189,11 +25074,9 @@ function apply(ctx, config) {
 	(async () => {
 		try {
 			const domain = await openBindingDomain(ctx);
-			setBindingStore(bindingStore(domain));
+			bindingStore(domain);
 			if (!domain) console.log("[serenity-hooks] §0L 存储域不可用 → 绑定继续走 CCC 内 .bindings.json（向前兼容回落）");
-		} catch {
-			setBindingStore(null);
-		}
+		} catch {}
 	})();
 	if (config.tools) {
 		ctx.tools.register(ccFsTool);