feat(channels): 非消息事件接入（notice 归一化 + 传入前审查，fail-safe 静默）与入站脱敏帧日志/日志轮转

- notice：adapter 归一化 seam + 结构化分类 + 净化（ANSI/控制/零宽/双向字符、200 runes 截断）
  + fail-safe 写死为「静默」（未装配审查/超时/失败 ⇒ 仅登记、不驱动 loop）
- 身份面零改动：notice 发送者恒 RoleSystem + SenderID=system
- 复用策略四的同一个审查模型（Options.Review），未另造第二套
- 入站帧脱敏 DEBUG（post_type/message_type/sub_type/self_id/user_id/sender_id/group_id/段类型/at 目标）
- ctrl.bat 启动前归档轮转（保留 20 份）+ bash 侧改追加（不再重启即截断）

scripts/ctrl.bat

@@ -16,6 +16,10 @@ rem    - single binary, run from the repo root (reads .env PORT / DATA_DIR ...)
 rem    - port comes from .env PORT, falls back to 10080
 rem    - log: %USERPROFILE%\cy.log (app logs to stderr);
 rem      stdout fallback: %USERPROFILE%\cy.stdout.log
+rem    - the previous run's logs are NEVER discarded: before each start they are
+rem      archived as <name>.<yyyyMMdd-HHmmss>.bak, newest %LOG_KEEP% kept. Needed
+rem      because Start-Process -RedirectStandard* OVERWRITES its target (PowerShell
+rem      has no append form), so every restart used to wipe the evidence in cy.log.
 rem    - pid file: %USERPROFILE%\.cyrene.pid, else detected from the port
 rem    - Start-Process -WindowStyle Hidden = detached start
 rem      (the ctrl.sh equivalent of "setsid nohup ... & disown")
@@ -41,6 +45,8 @@ if not exist "%APP_BIN%" set "APP_BIN=%USERPROFILE%\apps\cyrene\cyrene.exe"
 set "PID_FILE=%USERPROFILE%\.cyrene.pid"
 set "LOG_FILE=%USERPROFILE%\cy.log"
 set "STDOUT_FILE=%USERPROFILE%\cy.stdout.log"
+rem LOG_KEEP: how many archived logs to retain (one per start, oldest pruned first)
+set "LOG_KEEP=20"
 
 rem ---- port: .env PORT wins, fallback 10080 ----
 set "GW_PORT="
@@ -99,6 +105,7 @@ if not exist "%APP_BIN%" (
 )
 echo Starting cyrene -^> %APP_BIN%  ^(port %GW_PORT%^)
 cd /d "%REPO%" || exit /b 1
+call :rotate_logs
 powershell -NoProfile -Command "Start-Process -FilePath '%APP_BIN%' -WorkingDirectory '%REPO%' -RedirectStandardOutput '%STDOUT_FILE%' -RedirectStandardError '%LOG_FILE%' -WindowStyle Hidden"
 set /a TRIES=0
 :start_wait
@@ -222,3 +229,30 @@ if defined PORT_PID (
   >"%PID_FILE%" echo !PORT_PID!
 )
 exit /b 0
+
+rem rotate_logs: keep the previous run's log instead of letting it be overwritten.
+rem Start-Process -RedirectStandardOutput/-RedirectStandardError OVERWRITE their
+rem target (PowerShell has no append form), so without this every restart wiped
+rem cy.log -- i.e. each restart destroyed the evidence of the run before it.
+rem Archiving (not appending) also keeps the runs separable. Failures are ignored
+rem on purpose: a log we cannot archive must never block a start.
+:rotate_logs
+set "RUN_TS="
+for /f "usebackq delims=" %%T in (`powershell -NoProfile -Command "Get-Date -Format yyyyMMdd-HHmmss"`) do if not defined RUN_TS set "RUN_TS=%%T"
+if not defined RUN_TS set "RUN_TS=unknown%RANDOM%"
+if exist "%LOG_FILE%" move /y "%LOG_FILE%" "%LOG_FILE%.%RUN_TS%.bak" >nul 2>&1
+if exist "%STDOUT_FILE%" move /y "%STDOUT_FILE%" "%STDOUT_FILE%.%RUN_TS%.bak" >nul 2>&1
+call :prune_logs "%LOG_FILE%"
+call :prune_logs "%STDOUT_FILE%"
+exit /b 0
+
+rem prune_logs <base>: keep only the newest %LOG_KEEP% archives of <base>.
+rem Runs with %USERPROFILE% as the working directory so the bare names dir prints
+rem resolve (the repo may sit on another drive than %USERPROFILE%; pushd/popd then
+rem echo the directory, hence the >nul).
+:prune_logs
+set "PRUNE_BASE=%~1"
+pushd "%USERPROFILE%" >nul 2>&1 || exit /b 0
+for /f "skip=%LOG_KEEP% delims=" %%F in ('dir /b /o-d /a-d "%PRUNE_BASE%.*.bak" 2^>nul') do del /q "%%~F" >nul 2>&1
+popd >nul 2>&1
+exit /b 0

scripts/ctrl.sh

@@ -11,7 +11,9 @@
 # 说明：
 #   - 管理单个 cyrene 后端进程（单二进制）。llama-server / PG 若需一并管理，
 #     可另用 docker / scripts/dev-up.sh。
-#   - cyrene 在仓库根下运行（读 .env 的 PORT / DATA_DIR 等），日志写 ~/cy.log。
+#   - cyrene 在仓库根下运行（读 .env 的 PORT / DATA_DIR 等），日志**追加**写 ~/cy.log
+#     （重启不清空历史；Windows 侧 scripts\ctrl.bat 因 Start-Process 无法追加，改为
+#     按时间戳归档，见该脚本的注释）。
 #   - 用 setsid + nohup 脱离进程组，避免终端/后台 shell 超时误杀。
 set -euo pipefail
 
@@ -64,8 +66,10 @@ start() {
   echo "启动 cyrene → $APP_BIN (端口 $GW_PORT)"
   # setsid 只脱离会话，但 cyrene 仍是本 bash 的后台 job；脚本退出时 bash 会等待
   # 它结束，导致 restart 命令"挂起超时"。disown 把它从作业表剔除，脚本立即返回。
+  # 日志**追加**（>>）而不是覆盖（>）：重启不再截断上一轮日志——排障证据必须能跨重启
+  # 留存（「日志重启即清空」曾让一个线上问题无从取证）。
   cd "$REPO" || return 1
-  setsid nohup "$APP_BIN" > "$LOG_FILE" 2>&1 < /dev/null &
+  setsid nohup "$APP_BIN" >> "$LOG_FILE" 2>&1 < /dev/null &
   disown
   # 等待健康
   local i

scripts/dev-up.sh

@@ -65,7 +65,7 @@ if [ ! -f "$APP_BIN" ]; then
   go build -ldflags="-s -w" -trimpath -o "$APP_BIN" ./cmd/cyrene
 fi
 if ! curl -s --max-time 2 "http://127.0.0.1:$GW_PORT/api/v1/health" >/dev/null 2>&1; then
-  (cd "$REPO" && nohup "$APP_BIN" > "$HOME/cy.log" 2>&1 &)
+  (cd "$REPO" && nohup "$APP_BIN" >> "$HOME/cy.log" 2>&1 &)
   echo "  cyrene 已启动: http://localhost:$GW_PORT  (日志 $HOME/cy.log)"
 else
   echo "  cyrene 已在运行 (: $GW_PORT)，跳过"