@shgroup/dsh-serenity-hooks 1.77.0 → 1.77.1

package/dsh.plugin.json

@@ -1,6 +1,6 @@
 {
   "id": "dsh-serenity-hooks",
-  "version": "1.77.0",
+  "version": "1.77.1",
   "main": "lib/index.js",
   "description": "宁静号 ACC harness（Native Cordis 插件）：给 DSH 装一个「AI 工作区」——14 个工具（container_fs/cognitive_trajectory/dashboard/container_git/msm/praxis/ontology/serenity-skill-creator/cheap-worker/localstore/container_admin；另三个 im-bridge/acc-diag/diagram 按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫）+ 认知轨迹日志与原地重建 + 网页登录入口/IM 桥/认知轨迹唤醒注册表。轨迹声明 = 轨迹目录下的 trajectory.json（约束面 + 旧标识 uid + CRO 机器绑定 cro.host；旧名 trajectory-constraint.json / skiff.json 仍在读取族里）；轨迹提示词 = 轨迹目录下的 PROMPT.md（一条轨迹「是谁、按什么章程工作」，所有轨迹通用，追加在容器层与质量层之后，不替换它们）。适配 DSH 0.1.7-rc.1 / 0.2.0-rc.1 / 0.2.1-rc.1（三档，deepseek-ai/deepseek-harness）。",
   "engines": {

package/lib/index.js

@@ -12588,50 +12588,41 @@ function createCognitiveTrajectoryTool(ctx) {
 	return defineTool({
 		name: "cognitive_trajectory",
 		description: [
-			"cognitive_trajectory — one cognitive trajectory: its persistent body (SESSION.md) + its timeline.",
-			"A cognitive trajectory is NOT the conversation: SESSION.md is the durable body and never moves;",
-			"the dsh conversation is only its rebuildable carrier (Ship of Theseus — the carrier is replaced, the cognitive trajectory continues).",
-			"IDENTITY: every trajectory has a CODE — the fixed-position segment of its directory name (YYYY-MM-DD--<code>[--<desc>]).",
-			"The code IS the trajectory's unique identifier, and you can choose it at creation time with create --id.",
-			"A COGNITIVE TRAJECTORY HAS NO LIFECYCLE — it does not complete, close, or expire, and age never counts against it;",
-			"it PERMANENTLY EXISTS. The only thing that ever changes is WHERE it is stored: archive moves it out of the active list",
-			"without touching a single byte of its directory or SESSION.md. There is no reverse action — to restore one, use container_fs mv.",
-			"ACTIONS, grouped by EFFECT (read the grouping before picking one):",
+			"A COGNITIVE TRAJECTORY is a durable body (SESSION.md) that outlives every conversation carrying it.",
+			"AXIOM 1 — THE TRAJECTORY IS THE SUBJECT; THE CONVERSATION IS ITS CARRIER. Rebuilding the carrier replaces the conversation and leaves SESSION.md byte-identical.",
+			"AXIOM 2 — A TRAJECTORY HAS NO LIFECYCLE. It never completes, closes, or expires, and age never counts against it. The only thing that changes is WHERE it is stored: archive moves it out of the active list without touching its directory.",
+			"AXIOM 3 — IDENTITY IS THE CODE: the fixed-position segment of the directory name `YYYY-MM-DD--<code>[--<desc>]`. The code (not the summary, not the title) is the unique identifier, and create --id lets you choose it.",
+			"DOES NOT: this tool never deletes a trajectory, never edits SESSION.md content, and never schedules recurring work (that is cro-guide).",
+			"ENTITIES. TRAJECTORY = a directory under AGENT_SESSIONS/ holding SESSION.md. CARRIER = a dsh session bound to it. BINDING DECLARATION = the file `<trajectory>/current.dsh_session_bind` — ONE FILE PER TRAJECTORY, a single slot, never a table.",
+			"IMMUTABLE 1 — ONE SESSION BELONGS TO AT MOST ONE TRAJECTORY, FOR LIFE. use refuses to move a session that already carries a different trajectory. There is NO --force override (retired 2026-10-20; passing it returns a refusal explaining why). To give another trajectory a carrier, open a new session.",
+			"IMMUTABLE 2 — ONE TRAJECTORY HAS AT MOST ONE CURRENT CARRIER, and THE BINDING DECLARATION IS THE ONLY TRUTH. If several dsh sessions happen to be open, only the one named in the declaration carries the trajectory; the others are simply unbound. Never infer a binding from \"a session looks active\".",
+			"IMMUTABLE 3 — A DECLARATION WHOSE SESSION NO LONGER EXISTS COUNTS AS UNBOUND. No cleanup is ever required, and a stale declaration is deliberately left in place: it records who carried this trajectory last.",
+			"ACTIONS, GROUPED BY EFFECT — read the grouping before choosing, because it answers \"does this change what I am bound to?\":",
 			"(A) LIFECYCLE — changes which cognitive trajectory THIS conversation is bound to:",
-			"list (inventory + stats + anomaly marks) / show (read one SESSION.md) / create (make a NEW cognitive trajectory) /",
-			"use (bind THIS conversation to an existing cognitive trajectory; inline integrity check — silent when fine, problems reported as hints, never errors) /",
-			"rebuild (clear-and-rebuild THIS conversation in place) /",
-			"archive (move a trajectory into the archived area so it leaves the active list; one-way, never overwrites, and its content is left byte-identical).",
-			"(B) DELIVERY — sends ONE message to ANOTHER cognitive trajectory; your own binding is unchanged:",
-			"send-now (deliver RIGHT NOW) / send-later (deliver at ONE future instant).",
-			"(C) REFERENCE — cro-guide (how to give THIS cognitive trajectory its own program that decides when it should be woken).",
+			"list (inventory + stats) / show (read one SESSION.md) / create (make a NEW trajectory) / use (bind THIS conversation) / rebuild (clear-and-rebuild THIS conversation in place) / archive (move a trajectory out of the active list; one-way, never overwrites).",
+			"(B) DELIVERY — sends ONE message to ANOTHER trajectory; your own binding is unchanged: send-now (right now) / send-later (one future instant).",
+			"(C) REFERENCE — cro-guide: how to give a trajectory its own program that decides when it should be woken.",
 			"HOW TO CHOOSE (a rule, not a guess):",
-			"not yet bound + starting new work ⇒ create — with no prior binding it activates immediately, so the new cognitive trajectory has a carrier at once.",
-			"already bound + recording a separate future line ⇒ create — it does NOT steal your binding (you stay on the current cognitive trajectory);",
-			"activate the new one when you want it by sending it a message.",
-			"want THIS conversation to move to another cognitive trajectory ⇒ use (refuses when it would orphan the current binding; --force overrides).",
-			"want to poke another cognitive trajectory ⇒ send-now. Its target needs NO prior setup:",
-			"if the target has no live dsh session, one is created and bound automatically, and your message is injected into it.",
-			"RECEIPTS (read no more than is written): send-now returns a synchronous receipt meaning exactly \"injected / turn started\" —",
-			"NEVER \"the target ran or replied\"; to prove the target actually moved, read its SESSION.md.",
-			"It never queues behind the current turn: a busy target is steered mid-turn (read in the CURRENT turn), an idle target starts a turn at once.",
+			"not yet bound + starting new work ⇒ create (with no prior binding it activates immediately, so the new trajectory has a carrier at once).",
+			"already bound + recording a SEPARATE future line ⇒ create (it does NOT steal your binding; activate the new one later by send-now).",
+			"want THIS conversation to move ⇒ use. It refuses if this session already carries another trajectory (IMMUTABLE 1) — that refusal is the design, not an error to work around.",
+			"want to make another trajectory act ⇒ send-now. The target needs no prior setup: if it has no live session, one is created and bound automatically, and your message is injected.",
+			"RECEIPTS (read no more than is written): send-now returns a synchronous receipt meaning exactly \"injected / turn started\" — NEVER \"the target ran or replied\". To prove the target actually moved, read its SESSION.md.",
+			"send-now never queues behind the current turn: a busy target is steered mid-turn (read in the CURRENT turn), an idle target starts a turn at once.",
 			"send-later is fire-and-forget by design: no receipt, no recall, no panel.",
-			"ASYMMETRY (deliberate — the two differ in whether a missing target is normal): send-now creates a target on demand,",
-			"because sending to a never-used cognitive trajectory is a legitimate intent; send-later does NOT,",
-			"because scheduling for a cognitive trajectory that has never existed is almost always a mistyped name — auto-creating would hide that error behind an empty cognitive trajectory.",
-			"PARAMETERS: create requires --desc <desc> [--id <code>] [--goal] or --issue <ticket> (exactly one) plus --summary (≤20 chars).",
-			"use requires --summary (≤20 chars) and may pass --force to switch away from the currently-bound cognitive trajectory.",
-			"rebuild requires --summary (next-phase summary ≤20 chars) + optional --note (task focus for the rebuilt self).",
-			"send-later requires target (a code or AGENT_SESSIONS dir name) + at (RFC3339 or +30m/+2h) + message.",
-			"send-now requires target + message.",
-			"AUTHORIZATION (read this before creating anything): creating a cognitive trajectory or a dsh carrier costs real work,",
-			"and both are meant to serve a human intent — not to be spawned speculatively. Call create only when the user asked for",
-			"a new line of work (or confirmed it), never to \"tidy up\" or to pre-provision something nobody requested.",
-			"send-now creating a missing carrier on demand is likewise acceptable ONLY for a delivery the user actually wants made;",
-			"it is not a way to start work nobody asked for. When in doubt, ask the user instead of creating.",
-			"⚠️ This is a behavioral rule, not a mechanical gate: nothing stops a careless call. Treat it as etiquette with a cost.",
-			"uid: READS a legacy TRAJECTORY-UID only — setting one is retired (codes replaced it). Use create --id instead.",
-			"The summary is appended to the dsh session title (S###-YYYY-MM-DD-<summary>); the code and date stay server-derived unless you pass --id."
+			"ASYMMETRY (deliberate): send-now may create a missing carrier; send-later NEVER does. Scheduling for a trajectory that never existed is almost always a mistyped name, and auto-creating would hide that error.",
+			"CARRIER GUARD: send-now auto-creates a carrier ONLY for a trajectory that has never had one. If a declaration exists but its session is gone, it refuses and says so — one trajectory keeps one carrier. Two independent gates can refuse: (a) the declared session cannot be resolved at all; (b) it existed and is now gone.",
+			"PARAMETERS: create needs --desc <desc> [--id <code>] [--goal], OR --issue <ticket> (exactly one), PLUS --summary (≤20 chars).",
+			"use needs --name + --summary (≤20 chars). --force is ACCEPTED BUT REFUSED (retired): it exists only to explain why.",
+			"rebuild needs --summary (next-phase, ≤20 chars) + optional --note (≤200 chars, task focus for the rebuilt self).",
+			"send-now needs target + message. send-later needs target + at (RFC3339 with timezone, or +30m / +2h) + message.",
+			"target/name accept a code (S### or custom), a full AGENT_SESSIONS directory name, or a fuzzy keyword.",
+			"AUTHORIZATION (read before creating anything): create and send-now both cost real work and must serve a human intent. Call create only when the user asked for a new line of work (or confirmed it) — never to \"tidy up\" or pre-provision what nobody requested. When in doubt, ask instead of creating. This is a behavioral rule, not a mechanical gate: treat it as etiquette with a cost.",
+			"uid: READS a legacy TRAJECTORY-UID only. Setting one is retired — a trajectory's code is its identity now; use create --id <code>.",
+			"summary is appended to the dsh session title as <code>-<date>-<summary>; the code and date stay server-derived unless you pass --id.",
+			"SELF-DECLARATION MANUAL — how to write your own charter (PROMPT.md), declare yourself resident",
+			"(trajectory.json `resident.serves`), or restrict yourself (tool/model whitelists):",
+			"container_admin config docs trajectory-self. Read it before changing any file in your own directory."
 		].join(" "),
 		parameters: {
 			action: {
@@ -12639,11 +12630,11 @@ function createCognitiveTrajectoryTool(ctx) {
 				enum: [...COGNITIVE_TRAJECTORY_ACTIONS],
 				required: true,
 				description: [
-					"Subcommand — grouped by effect.",
+					"Subcommand — grouped by effect (see Tier 3 of the description).",
 					"LIFECYCLE (changes THIS conversation's binding):",
-					"list (inventory + stats + anomaly marks) / show (a code, dir name, or fuzzy keyword) /",
-					"create (new cognitive trajectory; --id sets its code. Activates itself when you have no binding, otherwise leaves your binding untouched and tells you how to activate it) /",
-					"use (activate context for THIS conversation; inline integrity check — pass silent, problems reported as hints, not errors) /",
+					"list (inventory + stats) / show (a code, dir name, or fuzzy keyword) /",
+					"create (new trajectory; --id sets its code. Activates itself when you have no binding, otherwise leaves your binding untouched and tells you how to activate it) /",
+					"use (activate context for THIS conversation; refuses if this session already carries another trajectory — no override) /",
 					"rebuild (clear-and-rebuild current conversation — requires --summary + optional --note) /",
 					"archive (move a trajectory to the archived area; one-way, refuses to overwrite, content untouched — --dryRun previews).",
 					"DELIVERY (sends one message to ANOTHER cognitive trajectory; your binding is unchanged):",
@@ -12686,7 +12677,7 @@ function createCognitiveTrajectoryTool(ctx) {
 			},
 			force: {
 				type: "boolean",
-				description: "use: allow switching away from the currently-bound cognitive trajectory (binding guard override)"
+				description: "use: RETIRED (2026-10-20) — one session belongs to one cognitive trajectory for life, so switching is refused unconditionally. The flag is still ACCEPTED so that an old call gets an explanation instead of an \"unknown argument\" error; it never overrides the guard."
 			},
 			dryRun: {
 				type: "boolean",
@@ -12702,7 +12693,7 @@ function createCognitiveTrajectoryTool(ctx) {
 			},
 			message: {
 				type: "string",
-				description: "send-later/send-now: the single message delivered to the target cognitive trajectory. send-now may create and bind a carrier when the target has no live session — acceptable only for a delivery the user actually wants made (user-intent-driven), not for speculatively starting work."
+				description: "send-later/send-now: the single message delivered to the target cognitive trajectory. send-now may create and bind a carrier ONLY when the target has never had one — acceptable only for a delivery the user actually wants made (user-intent-driven), never for speculatively starting work."
 			}
 		},
 		output: {
@@ -12967,36 +12958,52 @@ const localstoreTool = defineTool({
 });
 //#endregion
 //#region src/tools/trajectory-constraint-admin.ts
-/** 轨迹约束 定义教程：概念 ／ `trajectory.json` schema ／ 双白名单 ／ 轨迹纪律 ／ 微信路由 */
-const TRAJECTORY_CONSTRAINT_GUIDE = `═══ 轨迹约束 Guide (2026-10-19 redesigned) ═══
+/**
+* 轨迹约束 定义教程：**只讲「限制面」**（约束面 / 双白名单 / 纪律参与项 / 路由）。
+*
+* 🔴 2026-10-20 拆分（owner 裁 Q2）：本章原先同时承载「描述自己」与「限制自己」。
+* 两者读者与前提不同 —— **描述自己是所有轨迹的常态，限制自己才是特例** ——
+* 故「章程 / 常驻 / 三个载体」已移入 `config docs trajectory-self`。
+* ⛔ **本文件不再重复那份内容**（一个内容一个正文入口，v1.75.0 指针纪律）。
+*/
+const TRAJECTORY_CONSTRAINT_GUIDE = `═══ 轨迹约束 Guide（限制面；2026-10-20 split）═══
 
 **A 轨迹约束 IS a cognitive trajectory — the one whose directory contains \`${TRAJECTORY_CONSTRAINT_FILENAME}\`.**
 That is the whole rule. No role table, no name registry: put the file there and the trajectory
 becomes a 轨迹约束; delete it and it goes back to being an ordinary trajectory (takes effect at once).
 
+⚠️ **本章只讲"限制自己"。** 想写章程（PROMPT.md）或声明常驻（resident）?
+   → \`container_admin config docs trajectory-self\`（那是**所有轨迹**都用得上的自述手册）。
+
   AGENT_SESSIONS/<YYYY-MM-DD--<code>--<desc>>/
     ├─ SESSION.md      ← its persistent body (this IS the workspace — nothing is auto-created)
-    ├─ PROMPT.md       ← its charter (trajectory-level prompt; all trajectories may have one)
+    ├─ PROMPT.md       ← its charter (see trajectory-self; NOT copied here)
     ├─ ${TRAJECTORY_CONSTRAINT_FILENAME}          ← its declaration (this file is what makes it a 轨迹约束)
     └─ continuous-re-occurrence.ts  ← optional CRO program (spawned, never imported)
 
   The older names ${TRAJECTORY_LEGACY_FILENAMES.map((n) => `\`${n}\``).join(" / ")} are still READ
   (the family is checked in that order) — writing goes to \`${TRAJECTORY_FILENAME}\` only.
 
-── ${TRAJECTORY_CONSTRAINT_FILENAME} schema ──
+── ${TRAJECTORY_CONSTRAINT_FILENAME} schema（限制面部分）──
   {
     "model": "provider/model",          // optional; falls back to cheap-worker.defaultModel
     "tools": ["read","grep","msm",...], // non-MSM toolbar whitelist — anything not listed is REMOVED from the schema
     "msms":  ["msm-a","msm-b"],         // MSM whitelist — msm exec may only run these; register/deregister always refused
     "cognitiveTrajectory": { "session": true, "keeper": true, "rebuild": true },  // defaults TRUE (see below)
-    "systemPromptFile": ".opencode/skiff/<role>.md",  // relative to CCC root, hot-reloads on save
-    "systemPrompt": "...",                            // inline fallback; systemPromptFile wins when both are set
-    "uid": "my-handle",                 // optional legacy alias (read-only; the code is the identity now)
     "cro": { "host": "<machine name>" } // optional: which machine may run this trajectory's CRO program
   }
 
+  ⚠️ 提示词**不在这里**（新形态）：写 \`PROMPT.md\` 即可，**所有轨迹**都适用。
+     旧字段 \`systemPromptFile\` / \`systemPrompt\` 属**兼容期**形态，仍在读、但不再推荐；
+     两者同时存在时 \`PROMPT.md\` 让位规则见 \`trajectory/prompt.ts\`（此处不重复）。
+
+  ⚠️ **只想声明常驻、不想限制自己**：只写 \`"resident"\` 字段、**不写 tools/msms**。
+     空白名单 = **不收窄任何工具面**（见下方"两个默认"）—— 但请注意你仍因此"成为轨迹约束"，
+     只是没有实际限制。
+
 ── Two whitelists, both default-deny ──
   - \`tools: []\` + non-empty \`msms\` = pure-MSM 轨迹约束 (the usual knowledge-QA shape)
+  - 空 \`tools\` + 空 \`msms\` = **无限制**（普通行为；常驻自述用的就是这一格）
   - non-empty \`msms\` ⇒ the \`msm\` tool is added automatically (the only entry point for MSMs)
   - anything outside both lists is invisible in the schema, not merely rejected at call time
 
@@ -13005,8 +13012,8 @@ becomes a 轨迹约束; delete it and it goes back to being an ordinary trajecto
   its own body, so \`session\`/\`keeper\`/\`rebuild\` all default to true. Set false explicitly only
   when you deliberately want that participation off.
 
-── WeChat routing: user → trajectory code ──
-  \`weixin.routes\`: \`[{ "user": "<wx id or *>", "trajectory": "<code>" }]\`
+── IM routing: user → trajectory code（微信 / 飞书同一张表）──
+  \`im.routes\`: \`[{ "user": "<channel user id or *>", "trajectory": "<code>" }]\`
   A route pointing at a code with no such trajectory is a hard error (the message is NOT delivered).
   A trajectory WITHOUT \`${TRAJECTORY_CONSTRAINT_FILENAME}\` is still a legal target — it is just an ordinary trajectory.
 
@@ -13014,7 +13021,9 @@ becomes a 轨迹约束; delete it and it goes back to being an ordinary trajecto
   Everything is read live: saving \`${TRAJECTORY_CONSTRAINT_FILENAME}\` takes effect on the next turn, no restart.
     (The prompt FILE hot-reloads by mtime; the JSON itself is re-read every turn.)
   After editing, run container_admin config apply for an explicit validation + confirmation pass.
-  Skill loading is always available to 轨迹约束 sessions (skills are not whitelisted — they are read-only knowledge).`;
+  Skill loading is always available to 轨迹约束 sessions (skills are not whitelisted — they are read-only knowledge).
+
+  写完之后怎么验 → container_admin config docs trajectory-self 的「写完之后怎么验」段（同一套判据，不复制）。`;
 /** 校验当前 CCC 的 轨迹约束面：msms 均已注册 ／ model ∈ cheap-worker.models ／ 提示词非空 */
 function validateTrajectoryConstraint(root) {
 	const profiles = listTrajectoryConstraints(root);
@@ -13094,6 +13103,81 @@ function applyTrajectoryConstraint(root) {
 		note: `constraints are read live from each trajectory's ${TRAJECTORY_CONSTRAINT_FILENAME} — they take effect on the next turn (no restart); ${TRAJECTORY_CONSTRAINT_HINT}`
 	};
 }
+/**
+* 一章的全文。
+*
+* ⚠️ 本函数是**纯常量拼接**（无 IO、无 ctx）：手册正文不随容器状态变化，
+* 唯一随状态变的东西（"我现在是不是轨迹约束"）由 `config list` 回答，不写进正文。
+*/
+const TRAJECTORY_SELF_GUIDE = [
+	"═══ 一条认知轨迹如何描述自己（self-declaration guide）═══",
+	"",
+	"这份手册回答一件事：**我（某条认知轨迹）想给自己做设定时，该写进哪个文件、怎么写、怎么验。**",
+	"",
+	`── 三个载体：想改哪件事，就写进哪个文件 ──
+
+  <trajectory>/SESSION.md     ← 我的**身体**（认知轨迹本体；持久、永不移动）
+  <trajectory>/PROMPT.md      ← 我的**章程**（我是谁、按什么工作；**所有轨迹都可以有**）
+  <trajectory>/trajectory.json ← 我的**声明**（结构化字段；有它才成为"轨迹约束"，见下）
+
+  ⚠️ 三者主语相同（都是这条轨迹）、生命周期相同（随 git 走）、写入频率相同（人偶尔改）
+  ⇒ 这正是它们**该分开而不该合并**的理由：每一项都对应一种**不同的意图**。`,
+	"",
+	`── PROMPT.md：我的章程（推荐所有轨迹都写）──
+
+  写什么：我这名认知轨迹的**身份与工作方式** —— 我负责什么、我的判断依据是什么、
+          我的边界在哪、我怎么跟其他轨迹协作。
+  谁读它：**只有绑定在我身上的会话**读到它（作为系统提示词的一个独立段）。
+  何时生效：**保存即生效**（按 mtime 热重载，无需重启、无需 rebuild）。
+  没有它会怎样：不报错。我拿到的是 ACC 的通用身份 —— 普通轨迹的常态，不是缺陷。
+
+  ⚠️ 与 SESSION.md 的分工（别写重了）：
+     SESSION.md = **发生了什么**（日志、决策、当前状态）
+     PROMPT.md  = **我是谁、怎么工作**（章程；很少改，改了就改变行为）`,
+	"",
+	`── 常驻：自己声明"欢迎别人来麻烦我"（trajectory.json 的 resident 字段）──
+
+  🔴 先排除一个误解：**常驻不是资源状态**。
+     它不是"永不休眠"、不是"常驻内存"、不是"不许销毁我的会话"。
+     一条轨迹**永远存在**（没有生命周期），常驻与否都不改变这一点。
+
+  那它是什么：**我对自己用途的公开声明** —— "我在这儿、我擅长什么、欢迎来麻烦我"。
+     别的轨迹要找人干活时，先查这份名单，而不是靠猜谁可能懂。
+
+  写法：
+    { "resident": { "serves": "一句话说清我擅长什么、能帮上什么忙" } }
+
+  ⚠️ 两个门槛，缺一不可：
+     ① 写了 \`resident\` ⇒ 我进得了别人的候选名单（**可被发现**）
+     ② \`serves\` 非空 ⇒ 别人读了这句话能判断"这事是不是该找你"（**可被判断**）
+     只写半个（有字段、没 serves）等于把自己挂上去却不说能干什么 —— 那比不写更坏，
+     因为别人会来问，然后发现问错了人。
+
+  谁能看见：通过 cognitive_trajectory 的常驻名单动作按需查询。
+     **它不进系统提示词**（不占每个请求的 token）—— 只在有人真的要找人时才读。
+     这是 owner 2026-10-20 的裁决：说明类信息按需取，不常驻在上下文里。`,
+	"",
+	`── 想限制自己（白名单 / 模型 / 纪律参与项）──
+
+  写 \`trajectory.json\` 即成为**轨迹约束**（判据是**文件存在**，不是某个字段存在）。
+  删掉它 ⇒ 当场退回普通轨迹。
+
+  ⚠️ 一个必须知道的连带后果：**写 trajectory.json 会把我变成受约束的轨迹**。
+     所以如果你只想"描述自己"（章程、常驻），**不需要**建这个文件 ——
+     章程走 PROMPT.md；常驻字段确实也在这个文件里，但**只写 resident、不写 tools/msms**
+     时，白名单为空 = 不收窄任何工具面（见下一章"两个默认"）。
+
+  schema、双白名单、纪律参与项的完整说明 → container_admin config docs trajectory-constraint`,
+	"",
+	`── 写完之后怎么验（别只看文档，要能机械判定）──
+
+  章程生效了吗    改 PROMPT.md 后**在同一会话里**看下一轮的系统提示词段是否变化（保存即生效）
+  我是轨迹约束吗  container_admin config list  —— 我的编码出现在列表里即成立
+  配置合法吗      container_admin config validate  —— msms 均已注册 / model 在可用表里 / 提示词非空
+  常驻被看见了吗  cognitive_trajectory 的常驻名单动作 —— 我出现在名单里，且 serves 可读
+
+  ⚠️ 以上四项都是**读取当前真实状态**，不是"保存成功"的回执。保存成功 ≠ 生效（本仓反复踩过）。`
+].join("\n");
 //#endregion
 //#region src/tools/container-admin.ts
 /**
@@ -13236,9 +13320,14 @@ const DOCS_CHAPTERS = [
 		summary: "CCC 配置全表——9 段各是什么、怎么填、填错会怎样（.opencode/serenity.json）",
 		render: () => CCC_CONFIG_REFERENCE
 	},
+	{
+		id: "trajectory-self",
+		summary: "一条轨迹怎么描述自己——章程 PROMPT.md ／ 常驻声明（resident.serves）／ 三个载体的分工 ＋ 写完怎么验",
+		render: () => TRAJECTORY_SELF_GUIDE
+	},
 	{
 		id: "trajectory-constraint",
-		summary: "轨迹约束：一条轨迹怎么被约束（trajectory.json 的 schema ＋ 双白名单）",
+		summary: "轨迹约束（只讲限制面）：trajectory.json 的双白名单 ／ 模型 ／ 纪律参与项 ／ IM 路由",
 		render: () => TRAJECTORY_CONSTRAINT_GUIDE
 	}
 ];
@@ -13250,7 +13339,7 @@ const DOCS_CHAPTERS = [
 function createContainerAdminTool(ctx) {
 	return defineTool({
 		name: "container_admin",
-		description: "Container administration (the ship's maintenance bay — one entry for managing the CCC): config — CCC configuration: docs (usage-manual index) / docs <chapter> (one chapter in full) / view (current values) + 轨迹约束 (guide/validate/apply/list); msm — MSM registry management (register/deregister/check quality DC-M1~M4) + manuals (guide dev manual / catalog ACC capability directory / ccc-config CCC configuration reference). Execution of registered MSMs belongs to the msm tool; this tool manages the container.",
+		description: "Container administration (the ship's maintenance bay — one entry for managing the CCC): config — CCC configuration: docs (usage-manual index) / docs <chapter> (one chapter in full) / view (current values) + 轨迹约束 (guide/validate/apply/list); msm — MSM registry management (register/deregister/check quality DC-M1~M4) + manuals (guide dev manual / catalog ACC capability directory / ccc-config CCC configuration reference). TRAJECTORY SELF-DOCS: a cognitive trajectory describing ITSELF — charter (PROMPT.md) / resident declaration / self-restriction (whitelists) ⇒ config docs trajectory-self; the restriction side only ⇒ config docs trajectory-constraint. Execution of registered MSMs belongs to the msm tool; this tool manages the container.",
 		parameters: {
 			domain: {
 				type: "string",

package/lib/tools/trajectory-constraint-admin.d.ts

@@ -13,7 +13,14 @@
  * 归属（D23）不变：ACC 提供机制（教程 + 校验 + 列表），**约束内容归 CCC**（写进 `trajectory-constraint.json`）。
  */
 import type { JsonValue } from '../kernel/json.js';
-/** 轨迹约束 定义教程：概念 ／ `trajectory.json` schema ／ 双白名单 ／ 轨迹纪律 ／ 微信路由 */
+/**
+ * 轨迹约束 定义教程：**只讲「限制面」**（约束面 / 双白名单 / 纪律参与项 / 路由）。
+ *
+ * 🔴 2026-10-20 拆分（owner 裁 Q2）：本章原先同时承载「描述自己」与「限制自己」。
+ * 两者读者与前提不同 —— **描述自己是所有轨迹的常态，限制自己才是特例** ——
+ * 故「章程 / 常驻 / 三个载体」已移入 `config docs trajectory-self`。
+ * ⛔ **本文件不再重复那份内容**（一个内容一个正文入口，v1.75.0 指针纪律）。
+ */
 export declare const TRAJECTORY_CONSTRAINT_GUIDE: string;
 /** 校验当前 CCC 的 轨迹约束面：msms 均已注册 ／ model ∈ cheap-worker.models ／ 提示词非空 */
 export declare function validateTrajectoryConstraint(root: string): JsonValue;

package/lib/tools/trajectory-self-docs.d.ts

@@ -0,0 +1,35 @@
+/**
+ * tools/trajectory-self-docs.ts — 「一条认知轨迹如何描述自己」的**手册正文**
+ *
+ * ## 为什么这一章单独存在（owner 2026-10-20 原话）
+ *
+ * > 「例如某个认知轨迹想设定自己是**常驻**的，想给自己做**轨迹约束**，
+ * >   这种**说明性的内容**有吗，在哪里，**这是很重要的内容**，
+ * >   是认知轨迹感知理解这些**边界的重要手册**」
+ *
+ * ⇒ 此前「描述自己」与「限制自己」被混成一章（`trajectory-constraint`），
+ *   而那两件事的**读者与前提完全不同**：
+ *
+ * | 面 | 谁需要 | 性质 |
+ * |---|---|---|
+ * | **描述自己**（我是谁、我擅长什么、我是否欢迎来麻烦我） | **所有轨迹** | 常态 |
+ * | **限制自己**（工具白名单、模型、MSM 白名单） | 只有需要限权的轨迹 | 特例 |
+ *
+ * ⇒ 把「描述」独立成章。**普通轨迹不必为了写一段自述而变成受约束的轨迹** ——
+ *   这是本章存在的**唯一理由**，也是 D173「常驻 = 自我声明」的落点。
+ *
+ * ## 归属（D23）
+ * 机制在 ACC（有哪些载体文件、字段叫什么、怎么被读、何时生效）；
+ * **内容在 CCC**（这条轨迹具体写什么 —— 它的章程与自述是它自己的知识）。
+ *
+ * ## 与 `trajectory-constraint` 章的分工（一个内容一个正文入口）
+ * 本章 = **声明面（我是什么）**；那一章 = **约束面（我被限成什么）**。
+ * 两章互指，但**不复制**对方正文（本仓 v1.75.0 的指针纪律）。
+ */
+/**
+ * 一章的全文。
+ *
+ * ⚠️ 本函数是**纯常量拼接**（无 IO、无 ctx）：手册正文不随容器状态变化，
+ * 唯一随状态变的东西（"我现在是不是轨迹约束"）由 `config list` 回答，不写进正文。
+ */
+export declare const TRAJECTORY_SELF_GUIDE: string;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@shgroup/dsh-serenity-hooks",
-  "version": "1.77.0",
+  "version": "1.77.1",
   "description": "宁静号 ACC harness（Native Cordis 插件）——给 DeepSeek Harness 装一个「AI 工作区」：14 个工具（container_fs/cognitive_trajectory/dashboard/container_git/msm/praxis/ontology/serenity-skill-creator/cheap-worker/localstore/container_admin；另三个 im-bridge/acc-diag/diagram 按配置条件出现）+ 机械约束（安全模式/工作区围墙/密钥守卫/对外输出守卫）+ 认知轨迹日志与原地重建 + 网页登录入口/IM 桥/认知轨迹唤醒注册表。轨迹声明 = 轨迹目录下的 trajectory.json（约束面 + 旧标识 uid + CRO 机器绑定 cro.host；旧名 trajectory-constraint.json / skiff.json 仍在读取族里）；轨迹提示词 = 轨迹目录下的 PROMPT.md（一条轨迹「是谁、按什么章程工作」，所有轨迹通用，追加在容器层与质量层之后，不替换它们）。适配 DSH 0.1.7-rc.1 / 0.2.0-rc.1 / 0.2.1-rc.1（三档）。",
   "license": "MIT",
   "repository": {