fix: 卫生审计三处误报——指令冻结活跃度列名created_at→timestamp(死session误报8个),进程白名单+ocg_router/guard_monitor,stale_table非交易阈值48→72h覆盖周末

deploy/profile-scripts/system_hygiene_audit.py

@@ -51,6 +51,8 @@ PROCESS_WHITELIST = [
     'wechat_webhook.py', 'qq-poll', 'afw', 'mcp_server', 'uvicorn',
     'agentmemory', 'kimi_collect', 'mohe_knowledge_relay', 'wechat_watchdog',
     'todo_scanner', 'miner.py',
+    'ocg_router.py',        # 2026-08-24 OCG Router(:19878) 知微LLM命脉，合法常驻
+    'mofin_guard_monitor.py',  # 2026-08-24 知微消息合规监控，设计常驻(已systemd纳管)
 ]
 
 CORE_TABLES = [
@@ -328,7 +330,7 @@ def check_stale_sessions():
             try:
                 conn2 = _sq.connect(f"file:{state_db}?mode=ro", uri=True, timeout=10)
                 last_msg = conn2.execute(
-                    "SELECT MAX(created_at) FROM messages WHERE session_id=?",
+                    "SELECT MAX(timestamp) FROM messages WHERE session_id=?",
                     (r['id'],)).fetchone()[0]
                 conn2.close()
                 lm = last_msg or 0
@@ -354,13 +356,15 @@ def check_db_freshness():
         c = sqlite3.connect(os.path.join(DATA_DIR, 'mofin.db'), timeout=10)
         now = datetime.now()
         is_trading_time = now.weekday() < 5 and 9 <= now.hour <= 16
+        # 2026-08-24 周末豁免：非交易阈值需覆盖周末休市（周五17:00→周一09:30≈64.5h），
+        # 48h 导致周一早上必误报；真停滞会在下一交易时段被 4h 阈值抓住，不会漏
         for table, col, label in CORE_TABLES:
             try:
                 row = c.execute(f"SELECT MAX({col}) FROM {table}").fetchone()
                 if row and row[0]:
                     last = datetime.fromisoformat(str(row[0]).replace('Z', ''))
                     age_h = (now - last).total_seconds() / 3600
-                    threshold = 4 if is_trading_time else 48
+                    threshold = 4 if is_trading_time else 72  # 72h覆盖周末(2026-08-24)
                     if age_h > threshold:
                         issues.append({
                             'type': 'stale_table', 'table': table, 'label': label,