mslxdff 0.1.209 → 0.1.211

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "mslxdff",
-  "version": "0.1.209",
+  "version": "0.1.211",
   "description": "测试项目，请勿使用。",
   "type": "module",
   "bin": {

package/src/cli/group-test-cli.js

@@ -60,6 +60,7 @@ export function renderGroupTest(r, { json = false } = {}) {
     upstream: "成员打上游失败",
   }[r.stage] || r.stage;
   console.log(`  ❌ 没通 — 断在：**${stageZh}**${r.httpStatus ? `（HTTP ${r.httpStatus}）` : ""}`);
+  if (r.relayVia) console.log(`     路径：组长 ${r.relayVia === "broadband" ? "经中继转发给成员" : "直连成员"}${r.memberStatus ? `（成员回报 HTTP ${r.memberStatus}）` : ""}`);
   if (r.error) console.log(`     原因：${String(r.error).slice(0, 300)}`);
   if (r.hint) console.log(`     下一步：${r.hint}`);
   process.exitCode = 1;

package/src/cli/group-test.js

@@ -102,10 +102,21 @@ export async function runGroupLinkTest({
   if (res.status !== 200) {
     const isFetchFail = /fetch failed/i.test(txt);
     const isRelay = String(target).startsWith("relay://");
-    return { status: "error", stage: "forward-failed", httpStatus: res.status, target, leaderUrl: lead.leaderUrl, group: groupName, ms, error: txt.slice(0, 300),
-      hint: isFetchFail && isRelay
-        ? "对 relay 成员，502 fetch failed 通常是**该成员自己的上游**打不通（组长只负责转发，不碰上游）。判据：同组其他 relay 成员若正常，即证是这一台的网络/上游问题，不是组长。也可能是该成员离线。"
-        : isFetchFail ? "组长直连该静态成员失败（它离线或端口不通）" : "" };
+    // 归因头（0.1.211+ 组长才有）：把「组长直连失败」与「宽带成员回报的失败」分开——
+    // 两者响应体可能都长成 {"error":"fetch failed"}，只有这个头能区分断在哪一跳。
+    const relayVia = res.headers?.get?.("x-mslxdff-relay-via") || "";
+    const memberStatus = res.headers?.get?.("x-mslxdff-relay-member-status") || "";
+    let hint;
+    if (relayVia === "broadband") {
+      hint = `组长已把请求转给该成员（宽带中继正常），失败发生在**成员那一跳**：成员执行自己的上游时抛错并把错原样回报（该成员侧 errors.log 有真正原因：连不上/DNS/超时）。判据：同组其他 relay 成员若正常，即证是这一台的网络/上游问题。`;
+    } else if (relayVia === "direct") {
+      hint = `组长是**直连**该成员失败的（它离线或端口不通）—— 不是中继链路问题。`;
+    } else if (isFetchFail && isRelay) {
+      hint = `对 relay 成员，502 fetch failed 通常是**该成员自己**打上游失败（组长只转发，不碰上游）。判据：同组其他 relay 成员若正常，即证是这一台的网络/上游问题。组长版本 <0.1.211 时无归因头，升级后可直接判「直连 or 中继」。`;
+    } else if (isFetchFail) {
+      hint = `组长直连该静态成员失败（它离线或端口不通）。`;
+    }
+    return { status: "error", stage: "forward-failed", httpStatus: res.status, target, leaderUrl: lead.leaderUrl, group: groupName, ms, error: txt.slice(0, 300), relayVia, memberStatus, hint };
   }
 
   let reply = null;

package/src/daemon.js

@@ -102,12 +102,26 @@ export function isPidAlive(pid) {
   }
 }
 
-export function stopDaemon({ reason = "stop", kill = process.kill, taskkill = spawnSync } = {}) {
+export function stopDaemon({ reason = "stop", kill = process.kill, taskkill = spawnSync, isAlive = isPidAlive } = {}) {
   const pid = readPid();
   if (!pid) return { stopped: false, reason: "no pid file" };
+  // 自杀护栏（最高优先级）：pid 文件里写着**本进程**时，杀它就是杀自己。
+  // 这不是假想情形 —— daemon 自己 `writePid(process.pid)`（server-lifecycle.js），而 `enableAutostart()`
+  // 会在 systemd 托管下被 daemon 自己调起（server-lifecycle 的 autostart 自检块）：systemd **系统** unit
+  // 的 daemon 去查 **user** unit 必然判「未启用」⇒ 走进 enableAutostart ⇒ stopDaemon ⇒ SIGTERM 自己
+  // ⇒ 优雅关停 exit 0 ⇒ systemd Restart=always 拉起 ⇒ 每 2.5 秒一轮的无限重启
+  //（真机 2026-10-19：0.1.209 + 系统 unit，每进程活 2~3s 被 SIGTERM；0.1.160 不炸只因当时
+  //  `enableAutostart` 里 import 路径写错、这段从未执行过，2026-10-17 c7bf8af 修正路径后暴露）。
+  if (pid === process.pid) {
+    try {
+      appendFileSync(logFile(), `[lifecycle] stopDaemon refused: pid file points at self (pid=${pid}, reason=${reason})\n`);
+    } catch {}
+    return { stopped: false, pid, reason: "self — pid 文件写的就是本进程，拒绝自杀" };
+  }
+
   // 杀者牌（验尸官的另一半证据）：动手前写、自带死者身份。只给在世者留牌——给尸体留牌
   // 会让下次验尸把"早已静默死亡"误判成"被本次杀死"。
-  const victimAlive = isPidAlive(pid);
+  const victimAlive = isAlive(pid);
   // 杀者留痕（写 daemon.log）：Windows 的 SIGTERM 是 TerminateProcess 强杀，被杀的 daemon
   // 在 JS 层收不到任何事件（无法自记），故由"杀者"记录调用方 pid——
   // 没有这行 = 非我方所杀（外部 taskkill/任务管理器/崩溃），配合最后一条 heartbeat 定位死亡时刻。

package/src/net-diag.js

@@ -0,0 +1,125 @@
+// 网络错误诊断 —— 把 undici 那句没头没尾的 `fetch failed` 展开成「哪种故障、打谁、卡在哪」。
+//
+// 为什么需要它：undici 抛 `TypeError: fetch failed` 时，真正的原因（ECONNREFUSED / ENOTFOUND /
+// headers timeout / TLS …）藏在 `err.cause`，再深一次还可能藏在 `cause.cause`。而 `errMsg()`
+// 只取 `err.message`，于是全链路日志里只剩 `fetch failed` —— 这正是「组员 B 回报 502 fetch failed、
+// 却谁也说不清它为什么打不到上游」的死因（member 侧 broadband execAndPost 原样把 errMsg 回给组长）。
+//
+// 本模块是纯函数、零依赖：把 err 连同 cause 链压成 { name, code, message, addr, syscall, summary }，
+// 让成员侧、组长侧、CLI 三处都能写同一口径的一句话。
+
+/** 检测 fetch 网络错误标志位的有序列表：先 code，再 name，再看 message。 */
+const KNOWN_CODES = new Set([
+  "ECONNREFUSED", "ENOTFOUND", "EAI_AGAIN", "ETIMEDOUT", "ECONNRESET", "EPIPE",
+  "ENETUNREACH", "EHOSTUNREACH", "EADDRNOTAVAIL", "ENETDOWN", "ECONNABORTED",
+  "UND_ERR_CONNECT_TIMEOUT", "UND_ERR_HEADERS_TIMEOUT", "UND_ERR_BODY_TIMEOUT",
+  "UND_ERR_SOCKET", "UND_ERR_CLOSED", "UND_ERR_ABORTED", "UND_ERR_RESPONSE_STATUS_CODE",
+  "CERT_HAS_EXPIRED", "ERR_TLS_CERT_ALTNAME_INVALID", "UNABLE_TO_VERIFY_LEAF_SIGNATURE",
+  "DEPTH_ZERO_SELF_SIGNED_CERT", "SELF_SIGNED_CERT_IN_CHAIN",
+]);
+
+/** code/name → 人话短语。查不到就回落成 code 本身。 */
+const CODE_ZH = {
+  ECONNREFUSED: "连接被拒绝",
+  ENOTFOUND: "DNS 解析失败",
+  EAI_AGAIN: "DNS 暂时失败",
+  ETIMEDOUT: "连接超时",
+  ECONNRESET: "连接被重置",
+  EPIPE: "管道已断开",
+  ENETUNREACH: "网络不可达",
+  EHOSTUNREACH: "主机不可达",
+  EADDRNOTAVAIL: "本地地址不可用（出口绑定失败）",
+  ECONNABORTED: "连接被中断",
+  UND_ERR_CONNECT_TIMEOUT: "建连超时",
+  UND_ERR_HEADERS_TIMEOUT: "等响应头超时",
+  UND_ERR_BODY_TIMEOUT: "读响应体超时",
+  UND_ERR_SOCKET: "socket 异常",
+  UND_ERR_CLOSED: "连接已被关闭",
+  UND_ERR_ABORTED: "请求被取消",
+  CERT_HAS_EXPIRED: "TLS 证书过期",
+  ERR_TLS_CERT_ALTNAME_INVALID: "TLS 证书域名不匹配",
+  UNABLE_TO_VERIFY_LEAF_SIGNATURE: "TLS 证书链无法验证",
+  DEPTH_ZERO_SELF_SIGNED_CERT: "TLS 自签证书",
+  SELF_SIGNED_CERT_IN_CHAIN: "TLS 证书链含自签证书",
+};
+
+/** 从一层的 err/cause 对象上读 code：优先 `.code`，其次 `.name`（undici 超时类常用 name）。 */
+function pickCode(node) {
+  if (!node) return "";
+  const c = node.code;
+  if (typeof c === "string" && c) return c;
+  const n = node.name;
+  if (typeof n === "string" && n && n !== "Error" && n !== "TypeError") return n;
+  return "";
+}
+
+/** 把 message 里可能带的 URL 提炼出来（`fetch failed to http://…` 少见，但 socket 错误常带地址）。 */
+function pickAddr(node) {
+  const a = node?.address || node?.host || node?.hostname;
+  if (typeof a === "string" && a) return a;
+  const m = /(?:https?:\/\/)?(\d{1,3}(?:\.\d{1,3}){3}(?::\d+)?)/.exec(String(node?.message || ""));
+  return m ? m[1] : "";
+}
+
+/**
+ * 把任意 thrown 值展开成诊断对象。
+ * @param {unknown} err
+ * @returns {{ name: string, code: string, message: string, addr: string, syscall: string, summary: string }}
+ */
+export function describeError(err) {
+  const chain = [];
+  let node = err;
+  for (let depth = 0; node && depth < 5; depth++) {
+    chain.push(node);
+    node = node.cause;
+  }
+  const first = chain[0] || {};
+  const name = String(first.name || "Error");
+
+  // 选定「有信息量」的那层：第一层带已知 code 的层；都没有就用最深的非空 code，再退回第一层。
+  let chosen = null;
+  for (const n of chain) {
+    const c = pickCode(n);
+    if (c && KNOWN_CODES.has(c)) { chosen = { node: n, code: c }; break; }
+  }
+  if (!chosen) {
+    for (let i = chain.length - 1; i >= 0; i--) {
+      const c = pickCode(chain[i]);
+      if (c) { chosen = { node: chain[i], code: c }; break; }
+    }
+  }
+  const code = chosen?.code || "";
+  const addr = pickAddr(chosen?.node || first);
+  const syscall = String(chosen?.node?.syscall || first.syscall || "");
+
+  // message 取「最深一条非空 message」—— 那通常是最贴近 syscall 的一句；都没有就用第一层。
+  let message = "";
+  for (let i = chain.length - 1; i >= 0; i--) {
+    const m = String(chain[i]?.message || "").trim();
+    if (m) { message = m; break; }
+  }
+  if (!message) message = String(first.message || err || "");
+
+  const zh = CODE_ZH[code] || "";
+  const parts = [];
+  parts.push(code ? `${code}${zh ? `（${zh}）` : ""}` : name);
+  if (addr) parts.push(`peer=${addr}`);
+  if (syscall) parts.push(`syscall=${syscall}`);
+  const head = parts.join(" ");
+  // message 已含 code 时不重复（如 "connect ECONNREFUSED …" 与 code=ECONNREFUSED）；
+  // 注意 code 为空时不能建空正则——空 pattern 匹配一切，会把 message 误判成冗余。
+  const redundant = code && new RegExp(escapeRegExp(code)).test(message);
+  const summary = message && message !== code && !redundant
+    ? `${head} — ${message}`
+    : head;
+  return { name, code, message, addr, syscall, summary };
+}
+
+/** 一句话诊断，供日志/回包直接用。 */
+export function describeErrorText(err) {
+  return describeError(err).summary;
+}
+
+function escapeRegExp(s) {
+  return String(s).replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+}

package/src/routes/groups-relay.js

@@ -161,6 +161,9 @@ export async function forwardHandler({ req, res, groups, bus, logs }) {
   if (!targetMember) return json(res, 404, { error: `target ${target} not found in group ${groupName}` });
   const isBb = targetMember.kind === "broadband" || String(targetMember.url).startsWith("relay://");
   if (!isBb) {
+    // 标记走直连：**在 fetch 之前**就设，这样直连失败（catch 里的 502）也带着它——
+    // 那正是最需要区分的一跳（组长直连该成员不通 vs 宽带成员回报失败，两者的 body 可能一模一样）。
+    res.setHeader("x-mslxdff-relay-via", "direct");
     try {
       const fwdBody = body.body || body;
       const r = await compatFetch(`${targetMember.url}/v1/chat/completions`, {
@@ -193,13 +196,18 @@ export async function forwardHandler({ req, res, groups, bus, logs }) {
   logs?.appendEvent?.(evtData);
   const staleMs = Number(process.env.MSLXDFF_BROADBAND_STALE_MS) > 0 ? Number(process.env.MSLXDFF_BROADBAND_STALE_MS) : 90_000;
   if (typeof targetMember.lastSeen === "number" && Date.now() - targetMember.lastSeen > staleMs) {
+    res.setHeader("x-mslxdff-relay-via", "broadband");
     return json(res, 502, { error: "broadband member stale (no heartbeat)" });
   }
+  // 标记走的是宽带中继：下游据此一眼分清「组长直连失败(502 fetch failed)」vs「宽带成员回报的失败」，
+  // 两者响应体可能都是 {"error":"fetch failed"}，只有这个头能区分（成员侧已把真实原因写进 errors.log）。
+  res.setHeader("x-mslxdff-relay-via", "broadband");
   try {
     const resultPromise = enqueueRelay({ group: groupName, target: targetMember.url, reqId, body: fwdBody, hops });
     const result = await resultPromise;
     if (result && typeof result.status === "number") {
       res.statusCode = result.status;
+      if (result.status >= 500) res.setHeader("x-mslxdff-relay-member-status", String(result.status));
       if (result.headers) for (const [k, v] of Object.entries(result.headers)) res.setHeader(k, v);
       if (result.body) {
         if (typeof result.body === "string") res.end(result.body);

package/src/runtime/bootstrap.js

@@ -35,7 +35,7 @@ export async function startDaemonMain(VERSION) {
   const { srv, bus } = await startServerLifecycle({ VERSION, ...ctx, logs });
   void srv;
   startGroupSync({ peers: ctx.peers, groups: ctx.groups, logs });
-  startBroadband({ token: ctx.token, upstream: ctx.upstream });
+  startBroadband({ token: ctx.token, upstream: ctx.upstream, logs });
 
   // 保热心跳：每 ≤120s 经 **chat 同池**访问每个组员(/health) + 每个 picks 供应商(preheat)，
   // 防「久未使用 → 首发 fetch failed / 上游冷启动」（现网 2026-10-18 16:16 三组员同时 fetch failed）。

package/src/runtime/broadband-stream.js

@@ -5,7 +5,7 @@ import { compatFetch } from "../compat.js";
  * 宽带 SSE 长连 — 单组成员订阅 + 指数退避重连 + ensure 定时器。
  * execAndPost / broadbandGroups 由 broadband.js 注入。
  */
-export function startBroadbandStream({ token, upstream, execAndPost, broadbandGroups }) {
+export function startBroadbandStream({ token, upstream, execAndPost, broadbandGroups, log = console.log }) {
   const streamManagers = new Map();
   const startStreamForGroup = (g) => {
     if (streamManagers.has(g.name)) return;
@@ -25,7 +25,7 @@ export function startBroadbandStream({ token, upstream, execAndPost, broadbandGr
         if (!res.ok) throw new Error(`stream ${res.status}`);
         if (!res.body) throw new Error("no body");
         attempts = 0;
-        console.log(`broadband relay: connected ${g.name} via ${g.leaderUrl} (SSE)`);
+        log(`broadband relay: connected ${g.name} via ${g.leaderUrl} (SSE)`);
         let buf = "";
         const decodeChunk = (c) => {
           if (typeof c === "string") return c;
@@ -50,8 +50,14 @@ export function startBroadbandStream({ token, upstream, execAndPost, broadbandGr
               try {
                 const parsed = JSON.parse(data);
                 const { reqId, body } = parsed;
-                if (reqId && body) execAndPost(g, reqId, body).catch(() => {});
-              } catch {}
+                // 不再 `.catch(()=>{})` 静默吞：execAndPost 内部已把执行/回传失败写 errors.log，
+                // 这里只兜底一句，防它真抛出（如 body 畸变）时整条 SSE 循环被吞掉无痕。
+                if (reqId && body) {
+                  execAndPost(g, reqId, body).catch((e) => log(`broadband exec ${g.name} req=${reqId}: failed — ${errMsg(e)}`));
+                }
+              } catch (e) {
+                log(`broadband stream ${g.name}: bad relay frame — ${errMsg(e)}`);
+              }
             }
           }
         }
@@ -59,7 +65,7 @@ export function startBroadbandStream({ token, upstream, execAndPost, broadbandGr
       } catch (err) {
         if (stopped) return;
         const msg = errMsg(err);
-        if (!String(msg).includes("abort") && !String(msg).includes("Abort")) console.log(`broadband stream ${g.name}: ${msg} — reconnecting`);
+        if (!String(msg).includes("abort") && !String(msg).includes("Abort")) log(`broadband stream ${g.name}: ${msg} — reconnecting`);
         attempts++;
         const delay = Math.min(30_000, 1000 * Math.pow(2, attempts - 1) + Math.random() * 500);
         await new Promise((r) => setTimeout(r, delay));
@@ -75,5 +81,5 @@ export function startBroadbandStream({ token, upstream, execAndPost, broadbandGr
   }, 10_000);
   ensureTimer.unref();
   const n = broadbandGroups().length;
-  console.log(n ? `broadband relay: stream (SSE) + ping 25s for ${n} group(s)` : "broadband relay: idle (0 group) — waiting for a group join, checked every 10s");
+  log(n ? `broadband relay: stream (SSE) + ping 25s for ${n} group(s)` : "broadband relay: idle (0 group) — waiting for a group join, checked every 10s");
 }

package/src/runtime/broadband.js

@@ -1,26 +1,30 @@
 import { loadGroupsJoined } from "../state.js";
 import { errMsg } from "../cli/util.js";
+import { describeErrorText } from "../net-diag.js";
 import { withOutputFloor } from "../chat-pipeline/empty-turn.js";
 import { startBroadbandStream } from "./broadband-stream.js";
 import { compatFetch, timeoutSignal } from "../compat.js";
 
 /**
- * 宽带中继 — poll 模式（heartbeat + poll）与 stream 模式分发。
- * stream 长连下沉 broadband-stream.js，本文件保留任务执行与降级分支。
- * 空组不再早退：加组后由 ensure（stream 10s / poll 每次读组）自动接上，无需重启 daemon。
- * // Note: 空组不早退与向导默认 broadband 的取舍 — 见 .agents/notes/implemented/feature/2026-09-16-mobile-broadband-join-wizard.md
+ * 造一个「成员侧执行 + 回传结果」的执行器（可注入依赖，便于单测）。
+ *
+ * 为什么要单独抽出来并**带日志**：成员 B 用 upstream.chat 打自己的上游失败时，原实现只造了个
+ * `{status:502, body:{"error":"fetch failed"}}` 回传组长，**本机一行日志都没留** —— 于是组长侧
+ * 看到 `502 fetch failed`、成员侧看到空日志，全链路都没人能说出 B 为什么打不到上游。
+ * 现在：执行抛错记 errors.log（带 cause 链诊断），上游返回 4xx/5xx 也记，回传失败同样记。
+ *
+ * @param {{ token: string, upstream: {chat: Function}, logs?: {appendError?: Function, appendEvent?: Function}, log?: Function, fetchImpl?: Function }} opts
+ * @returns {(g: {name: string, leaderUrl: string}, reqId: string, body: object) => Promise<void>}
  */
-export function startBroadband({ token, upstream }) {
-  const broadbandGroups = () => loadGroupsJoined().filter((g) => g.kind === "broadband" && g.leaderUrl);
-  const streamEnabled = (() => {
-    const v = process.env.MSLXDFF_BROADBAND_STREAM;
-    if (v === "0" || v === "false" || v === "off") return false;
-    return true;
-  })();
-  const execAndPost = async (g, reqId, body) => {
+export function createBroadbandExec({ token, upstream, logs, log = console.log, fetchImpl = compatFetch } = {}) {
+  const appendError = (entry) => { try { logs?.appendError?.(entry); } catch { /* 日志失败不拖垮执行 */ } };
+  const appendEvent = (entry) => { try { logs?.appendEvent?.(entry); } catch {} };
+  return async function execAndPost(g, reqId, body) {
     let result;
+    const t0 = Date.now();
+    const model = String(body?.model || "");
     const fl = withOutputFloor(body); // 首发输出额度托底：leader 转来的 body 不经 pipeline，成员侧自托（评审 P1）
-    if (fl !== body) console.log(`output-floor(broadband): req=${reqId} ${(body?.max_tokens ?? body?.max_completion_tokens)}→${(fl.max_tokens ?? fl.max_completion_tokens)}`);
+    if (fl !== body) log(`output-floor(broadband): req=${reqId} ${(body?.max_tokens ?? body?.max_completion_tokens)}→${(fl.max_tokens ?? fl.max_completion_tokens)}`);
     try {
       const upRes = await upstream.chat(fl);
       const ct = upRes.headers.get("content-type") || "";
@@ -40,33 +44,69 @@ export function startBroadband({ token, upstream }) {
         try { parsed = JSON.parse(txt); } catch { parsed = txt; }
         result = { status: upRes.status, headers: { "Content-Type": upRes.headers.get("content-type") || "application/json" }, body: typeof parsed === "string" ? parsed : JSON.stringify(parsed) };
       }
+      appendEvent({ ts: Date.now(), type: "broadband-task", reqId, group: g.name, model, status: result.status, ms: Date.now() - t0, chars: String(result.body || "").length });
+      if (result.status >= 400) {
+        // 成员成功连上上游、但上游回错 —— 也要留痕，否则组长只见状态码不知原因
+        const snippet = String(result.body || "").slice(0, 300);
+        log(`broadband task: ${g.name} req=${reqId} 成员上游返回 HTTP ${result.status} — ${snippet}`);
+        appendError({ api: "broadband", reqId, group: g.name, model, status: result.status, message: `组员执行上游返回 HTTP ${result.status}：${snippet}` });
+      }
     } catch (err) {
-      result = { status: 502, headers: { "Content-Type": "application/json" }, body: JSON.stringify({ error: errMsg(err) }) };
+      // 成员打自己上游**抛错**（连不上/DNS/超时/TLS）—— 这是 `502 fetch failed` 的真正来源，展开 cause 链
+      const diag = describeErrorText(err);
+      result = { status: 502, headers: { "Content-Type": "application/json" }, body: JSON.stringify({ error: diag }) };
+      log(`broadband task: ${g.name} req=${reqId} 成员打上游失败 — ${diag}`);
+      appendError({ api: "broadband", reqId, group: g.name, model, status: 502, message: `组员打上游请求抛错（成员侧失败，非组长）：${diag}` });
     }
     try {
-      await compatFetch(`${g.leaderUrl}/v1/groups/relay/result`, {
+      const r = await fetchImpl(`${g.leaderUrl}/v1/groups/relay/result`, {
         method: "POST",
-        headers: { "Content-Type": "application/json", "Authorization": `Bearer ${token}` },
+        headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
         body: JSON.stringify({ name: g.name, group: g.name, reqId, result }),
         signal: timeoutSignal(5000),
       });
-    } catch {}
+      if (!r.ok) {
+        const txt = await r.text().catch(() => "");
+        log(`broadband result post: ${g.name} req=${reqId} HTTP ${r.status} ${txt.slice(0, 120)}`);
+        appendError({ api: "broadband", reqId, group: g.name, status: r.status, message: `结果回传组长失败 HTTP ${r.status}：${txt.slice(0, 200)}` });
+      }
+    } catch (err) {
+      const diag = describeErrorText(err);
+      log(`broadband result post: ${g.name} req=${reqId} failed — ${diag}`);
+      appendError({ api: "broadband", reqId, group: g.name, status: 0, message: `结果回传组长请求抛错：${diag}` });
+    }
   };
+}
+
+/**
+ * 宽带中继 — poll 模式（heartbeat + poll）与 stream 模式分发。
+ * stream 长连下沉 broadband-stream.js，本文件保留任务执行与降级分支。
+ * 空组不再早退：加组后由 ensure（stream 10s / poll 每次读组）自动接上，无需重启 daemon。
+ * // Note: 空组不早退与向导默认 broadband 的取舍 — 见 .agents/notes/implemented/feature/2026-09-16-mobile-broadband-join-wizard.md
+ */
+export function startBroadband({ token, upstream, logs, log = console.log }) {
+  const broadbandGroups = () => loadGroupsJoined().filter((g) => g.kind === "broadband" && g.leaderUrl);
+  const streamEnabled = (() => {
+    const v = process.env.MSLXDFF_BROADBAND_STREAM;
+    if (v === "0" || v === "false" || v === "off") return false;
+    return true;
+  })();
+  const execAndPost = createBroadbandExec({ token, upstream, logs, log });
   const doHeartbeat = async () => {
     for (const g of broadbandGroups()) {
       try {
         const res = await compatFetch(`${g.leaderUrl}/v1/groups/relay/heartbeat`, {
           method: "POST",
-          headers: { "Content-Type": "application/json", "Authorization": `Bearer ${token}` },
+          headers: { "Content-Type": "application/json", Authorization: `Bearer ${token}` },
           body: JSON.stringify({ name: g.name, group: g.name }),
           signal: timeoutSignal(5000),
         });
         if (!res.ok) {
           const txt = await res.text().catch(() => "");
-          console.log(`broadband heartbeat ${g.name}: ${res.status} ${txt.slice(0, 100)}`);
+          log(`broadband heartbeat ${g.name}: ${res.status} ${txt.slice(0, 100)}`);
         }
       } catch (err) {
-        console.log(`broadband heartbeat ${g.name}: failed — ${errMsg(err)}`);
+        log(`broadband heartbeat ${g.name}: failed — ${errMsg(err)}`);
       }
     }
   };
@@ -86,7 +126,9 @@ export function startBroadband({ token, upstream }) {
           const { reqId, body } = item;
           await execAndPost(g, reqId, body);
         }
-      } catch {}
+      } catch (err) {
+        log(`broadband poll ${g.name}: failed — ${describeErrorText(err)}`);
+      }
     }
   };
   if (!streamEnabled) {
@@ -96,8 +138,8 @@ export function startBroadband({ token, upstream }) {
     const pollTimer = setInterval(doPoll, 1000);
     pollTimer.unref();
     const n = broadbandGroups().length;
-    console.log(n ? `broadband relay: heartbeat 30s + poll 1s for ${n} group(s) [poll mode]` : "broadband relay: idle (0 group) — waiting for a group join [poll mode]");
+    log(n ? `broadband relay: heartbeat 30s + poll 1s for ${n} group(s) [poll mode]` : "broadband relay: idle (0 group) — waiting for a group join [poll mode]");
     return;
   }
-  startBroadbandStream({ token, upstream, execAndPost, broadbandGroups });
+  startBroadbandStream({ token, upstream, execAndPost, broadbandGroups, log });
 }

package/src/runtime/proc-info.js

@@ -92,6 +92,17 @@ export function isDaemonArgv(argv) {
   return list.includes("--daemon") && list.some((a) => /(^|[\\/])mslxdff(\.js)?$/i.test(String(a)));
 }
 
+/**
+ * 是否跑在 systemd 托管下（system 或 user unit 都算）。
+ * 判据：systemd 给被管服务注入 `INVOCATION_ID`（每个 invocation 唯一）与 `JOURNAL_STREAM`（stdout 连接信息）。
+ * 为什么要问：托管时 supervisor 已保证单实例与重启策略，daemon 再自己「杀旧进程/杀端口占用者」是职责重叠，
+ * 会与 systemd 的拉起时序打架成死循环（真机 2026-10-19：0.1.209 + 系统 unit 每 2.5s 自杀一轮）。
+ * @returns {boolean}
+ */
+export function underSystemd(env = process.env) {
+  return Boolean(env.INVOCATION_ID || env.JOURNAL_STREAM);
+}
+
 /** 「已运行 6h12m」这种人话时长（取证日志用）。 */
 export function fmtAlive(sec) {
   if (!Number.isFinite(sec)) return "运行时长未知";

package/src/runtime/server-lifecycle.js

@@ -5,6 +5,7 @@ import { runHook } from "../plugins.js";
 import { effectiveHost, maxHopsValue } from "../cli/policy.js";
 import { fmtEvent } from "../cli/format.js";
 import { writePid } from "../daemon.js";
+import { underSystemd } from "./proc-info.js";
 
 /**
  * 服务生命周期 — router 装配 → server 创建/ready-EADDRINUSE 自愈 →
@@ -66,6 +67,13 @@ export async function startServerLifecycle({ VERSION, token, created, upstream,
     const msg = String(err?.message || err);
     const code = err?.code || "";
     if (code === "EADDRINUSE" || msg.includes("EADDRINUSE")) {
+      // systemd 托管下不许杀端口占用者：supervisor 保证单实例，去杀「占用者」是越权，且会与
+      // systemd 的拉起时序互杀成循环（报告的另一半）。非零退出，让 systemd 按 Restart/RestartSec
+      // 退避重试——这才是托管语义下正确的收口。
+      if (underSystemd()) {
+        console.error(`[lifecycle] EADDRINUSE on port ${resolvePort()} under systemd — exit(1), let systemd backoff-retry（不杀任何进程）`);
+        process.exit(1);
+      }
       console.log(`[lifecycle] EADDRINUSE on port ${resolvePort()} — freeing stale holder and retrying...`);
       try {
         const { execFile } = await import("node:child_process");
@@ -166,7 +174,13 @@ export async function startServerLifecycle({ VERSION, token, created, upstream,
   } catch {}
 
   // best-effort: ensure autostart on Linux (so daemon survives reboot/SSH disconnect without manual cmd)
-  if (process.platform === "linux" && !process.env.MSLXDFF_NO_AUTOSTART) {
+  // **systemd 托管下必须跳过**（2026-10-19 真机无限重启的根因）：
+  //  - 托管时 supervisor 已经保证单实例+开机自启，这里再 enable 一次多余；
+  //  - 本块查的是 **user** unit（`~/.config/systemd/user/mslxdff.service`），而 systemd **系统**
+  //    unit 托管的 daemon 查它必然得 enabled=false ⇒ 走 enableAutostart() ⇒ linuxEnable() ⇒ stopDaemon()。
+  //    那条路径里 pid 文件写的就是**本进程**，过去等于每 2.5s 自杀一次（见 daemon.js 的自杀护栏）。
+  // systemd 会给被管进程注入 INVOCATION_ID / JOURNAL_STREAM，判据可靠、无需用户配置。
+  if (process.platform === "linux" && !process.env.MSLXDFF_NO_AUTOSTART && !underSystemd()) {
     setTimeout(async () => {
       try {
         const { getAutostartStatus, enableAutostart } = await import("../autostart.js");