feat: 公共平台最小化打扰(design/12 §6)——5条策略: 分级+轻思考+限流+审查剔噪

降噪A(策略一/二/五):
- channelbridge/light.go: 非owner分级门——小事件当系统消息登记(不进loop)、非owner轻响应(她判断回/不回,规则优先mention/关键词+轻LLM兜底fail-closed静默)
- backthink 触发降噪: SubjectSystemEvent 低价值不唤醒thinking(仅高价值/owner才think), iot/reminder不受影响
- quiet hours: 安静时段非owner无信号静默,被@才回(非硬性静默); config QUIET_START/END_HOUR 单源共用

限流B(策略三/四):
- adapter/flowgate.go: per-adapter 滑窗限流器+总上限+审查剔噪闸门(Admit两连:速率+上限/审查), owner私聊绕过
- channelbridge/flowgate.go: onMessage入站最前挂闸, 超限/被剔不占worker槽; 审查模型NewLLMReviewer复用model.Adapter(仅>80%阈值触发+跨分钟节流,失败回退FIFO,绝不判身份)
- config: ChannelAccount 加 GroupMsgPerMin(默认6)/MsgPerMin/MaxMessages(默认50), CHANNELS_JSON每账号, 向后兼容
- 被剔消息走OnRejected审计不静默丢

main wire接线: 加modelAdapter字段+Review注入(reviewFor nil-safe,无LLM回退FIFO)
全仓 go build/vet/test 绿(53包)+交叉编译, 零新依赖, 前端无涉

internal/services/backthink/backthink.go

@@ -104,10 +104,14 @@ type Config struct {
 }
 
 // ConfigFromBackground maps a config.BackgroundConfig (the source of the
-// heartbeat interval) into a backthink.Config, leaving the push/decide knobs at
-// their defaults for normalize to fill in.
+// heartbeat interval and the shared quiet-hours window) into a backthink.Config,
+// leaving the push/decide knobs at their defaults for normalize to fill in.
 func ConfigFromBackground(bg config.BackgroundConfig) Config {
-	return Config{IntervalSec: bg.IntervalSec}
+	return Config{
+		IntervalSec:    bg.IntervalSec,
+		QuietStartHour: bg.QuietStartHour,
+		QuietEndHour:   bg.QuietEndHour,
+	}
 }
 
 // Deps is the injected dependency set for a Backthink. Only Thinker and DB are
@@ -308,12 +312,40 @@ func (b *Backthink) subscribe(ctx context.Context) {
 }
 
 // onEvent is the bus handler for event-triggered thinking. It runs on the bus's
-// own worker goroutine, so it must not block on another subscriber.
+// own worker goroutine, so it must not block on another subscriber. It first
+// applies the minimal-disturbance gate (design/12 §6 策略一): a low-value system
+// event is downgraded to a registration-only record rather than waking a full
+// thinking pass, so platform/system noise cannot flood the thinker.
 func (b *Backthink) onEvent(ctx context.Context, e bus.Event) error {
-	b.think(ctx, triggerForEvent(e))
+	tr := triggerForEvent(e)
+	if !b.shouldThink(tr) {
+		b.log.Debug("backthink system event downgraded, no thinking",
+			"source", tr.Source, "summary", tr.Summary)
+		b.record(Record{
+			Trigger:    tr.Source,
+			At:         b.now(),
+			Conclusion: "system event: low value, not worth waking a thinking pass",
+			ShouldPush: false,
+			PushResult: PushResult{Route: RouteNone, Detail: "downgraded"},
+		})
+		return nil
+	}
+	b.think(ctx, tr)
 	return nil
 }
 
+// shouldThink gates event-triggered thinking (design/12 §6 策略一). On a public
+// platform a generic system event is low value, so only a high-importance
+// (owner-relevant) system event wakes a pass. IoT device updates and reminder
+// triggers are owner-relevant / high value and are never gated, so the productive
+// triggers stay fully functional.
+func (b *Backthink) shouldThink(tr Trigger) bool {
+	if tr.Source == SubjectSystemEvent {
+		return tr.Import >= ImportanceHigh
+	}
+	return true
+}
+
 // tickLoop is the heartbeat goroutine. It fires one thinking pass per tick and
 // exits when ctx is cancelled.
 func (b *Backthink) tickLoop(ctx context.Context) {

internal/services/backthink/backthink_test.go

@@ -136,6 +136,63 @@ func TestBackthink_EventTrigger_NoPush(t *testing.T) {
 	}
 }
 
+func TestBackthink_SystemEventLowValueDowngraded(t *testing.T) {
+	t.Parallel()
+	// design/12 §6 策略一: a low-value system event on a public platform does not
+	// wake a full thinking pass — it is downgraded to a registration-only record.
+	thinker := &mockThinker{text: "should not be called"}
+	bs := bus.New()
+	b, _ := newBackthink(t, Config{}, Deps{
+		Bus:     bs,
+		Thinker: thinker,
+		Now:     func() time.Time { return dayAt() },
+	})
+
+	b.Start(context.Background())
+	defer func() { _ = b.Stop(context.Background()) }()
+
+	if err := bs.Publish(context.Background(), SubjectSystemEvent, SystemEvent{Summary: "member joined"}); err != nil {
+		t.Fatalf("Publish: %v", err)
+	}
+
+	eventually(t, 2*time.Second, func() bool {
+		recs, _ := b.List(context.Background(), 10)
+		return len(recs) >= 1 && recs[0].Trigger == SubjectSystemEvent
+	})
+	if got := thinker.count(); got != 0 {
+		t.Fatalf("thinker calls = %d, want 0 (low-value system event downgraded)", got)
+	}
+	recs, _ := b.List(context.Background(), 10)
+	if recs[0].ShouldPush {
+		t.Fatalf("ShouldPush = true for a downgraded system event")
+	}
+	if recs[0].PushResult.Route != RouteNone {
+		t.Fatalf("PushResult.Route = %q, want %q", recs[0].PushResult.Route, RouteNone)
+	}
+}
+
+func TestBackthink_SystemEventHighValueThinks(t *testing.T) {
+	t.Parallel()
+	// A high-importance (owner-relevant) system event still wakes a thinking pass —
+	// the denoise gate only downgrades low-value noise (design/12 §6 策略一).
+	thinker := &mockThinker{text: "important notice"}
+	bs := bus.New()
+	b, _ := newBackthink(t, Config{}, Deps{
+		Bus:     bs,
+		Thinker: thinker,
+		Now:     func() time.Time { return dayAt() },
+	})
+
+	b.Start(context.Background())
+	defer func() { _ = b.Stop(context.Background()) }()
+
+	if err := bs.Publish(context.Background(), SubjectSystemEvent, SystemEvent{Summary: "owner tagged", Import: ImportanceHigh}); err != nil {
+		t.Fatalf("Publish: %v", err)
+	}
+
+	eventually(t, 2*time.Second, func() bool { return thinker.count() >= 1 })
+}
+
 func TestBackthink_List_NewestFirst(t *testing.T) {
 	t.Parallel()
 	thinker := &mockThinker{text: "nothing to report"}

internal/services/backthink/trigger.go

@@ -17,6 +17,17 @@ const (
 	SubjectSystemEvent = "system.event"
 )
 
+// SystemEvent is the optional typed payload a caller may publish to
+// SubjectSystemEvent to convey a system notice. Import defaults to Normal. Under
+// design/12 §6 策略一, a low-value system notice (a join/leave ping, generic
+// platform noise) is downgraded to a registration-only record and does not wake a
+// full thinking pass; only a high-importance (owner-relevant) system event thinks,
+// so a busy public platform cannot trigger a flood of expensive reflections.
+type SystemEvent struct {
+	Summary string
+	Import  Importance
+}
+
 // Trigger describes what woke a thinking pass: the source subsystem, a
 // human-readable summary and the event's estimated importance.
 type Trigger struct {
@@ -48,7 +59,14 @@ func triggerForEvent(e bus.Event) Trigger {
 	case SubjectReminderTrigger:
 		return Trigger{Source: e.Subject, Summary: e.Subject, Import: ImportanceHigh}
 	case SubjectSystemEvent:
-		return Trigger{Source: e.Subject, Summary: e.Subject, Import: ImportanceNormal}
+		tr := Trigger{Source: e.Subject, Summary: e.Subject, Import: ImportanceNormal}
+		if sy, ok := e.Payload.(SystemEvent); ok {
+			if sy.Summary != "" {
+				tr.Summary = sy.Summary
+			}
+			tr.Import = sy.Import
+		}
+		return tr
 	default:
 		return Trigger{Source: e.Subject, Summary: e.Subject, Import: ImportanceNormal}
 	}