diff --git a/.doc/ops/CURRENT.md b/.doc/ops/CURRENT.md
index 06d314a5..89812c34 100644
--- a/.doc/ops/CURRENT.md
+++ b/.doc/ops/CURRENT.md
@@ -6,14 +6,14 @@
 ## 焦点
 
 1. **partial/deferred 全量收口**：W1 CI/E2E **done**；续 W2–W7；§7 四项决策已确认
-2. **运维**：nightly `DATA_DIR=dev` 已对齐；**进行中** KB 宿主机分层加载 / fail-closed（`fix/kb-host-auth-layered-load`）
+2. **运维**：nightly `DATA_DIR=dev` 已对齐；KB 宿主机分层加载 / fail-closed **done**（`fix/kb-host-auth-layered-load`）
 3. **红线**：禁止整支 merge FAV；不默认升 `MULTI_INTENT_PLAN_TIER=full`（升 `confirm` 须 W4 闭环后独立授权）；`SEMANTIC_SUMMARY_REPLACE` 不随 W2 开启；FAV live 顺序 staging→artifact→publication、每级观察窗证据驱动（下限 ≥7 天）、`FAV_DEGRADED_READ=false`；flag 默认 off；项目 143 只读
 
 ## 并行认领
 
 | owner | task | branch | worktree | mutex | status |
 |-------|------|--------|----------|-------|--------|
-| Cursor | 2026-09-17-kb-host-auth-fix | fix/kb-host-auth-layered-load | - | infra | in_progress |
+| Cursor | 2026-09-17-kb-host-auth-fix | fix/kb-host-auth-layered-load | - | infra | done |
 | Cursor | 2026-09-17-w1-ci-e2e-green-nightly | feature/w1-ci-e2e-green-nightly | - | ci | done |
 | Cline | 2026-09-16-partial-deferred-completion | docs/partial-deferred-completion-plan | - | architecture-docs | done |
 | Cursor | 2026-09-16-intent-plan-playwright-dual-tab | feature/intent-plan-cards-playwright | .worktrees/feature-intent-plan-cards-playwright | web | done |
@@ -111,7 +111,7 @@
 
 | holder | phase | since | scope | queue |
 |--------|-------|-------|-------|-------|
-| Cursor | merging | 2026-09-17 | fix/kb-host-auth-layered-load | - |
+| - | idle | - | - | - |
 
 **phase**: `idle` | `merging` | `smoke` | `e2e`
 
diff --git a/.doc/ops/short-term/2026-09-17-kb-host-auth-fix.md b/.doc/ops/short-term/2026-09-17-kb-host-auth-fix.md
index e920bf9a..44c3b893 100644
--- a/.doc/ops/short-term/2026-09-17-kb-host-auth-fix.md
+++ b/.doc/ops/short-term/2026-09-17-kb-host-auth-fix.md
@@ -1,6 +1,6 @@
 ---
 title: "修复 KB 宿主机错误口令与静默离线降级"
-status: in_progress
+status: done
 created: 2026-09-17
 updated: 2026-09-17
 owner: Cursor
@@ -33,16 +33,16 @@ mutex: infra
 
 1. [x] 分层 Load + 默认口令清空
 2. [x] NormalizeKBHostForRuntime
-3. [x] kb 客户端脱敏 + RequireOnline
+3. [x] kb 客户端脱敏 + RequireOnline（EnsureOnline；不 Fatalf）
 4. [x] health `kb_ready` + E2E/nightly 门禁
-5. [ ] 合入 `dev` 冒烟
+5. [x] 合入 `dev` 冒烟（rebuild + `/health` `kb_ready=true`）
 
 ## 验收标准
 
 - [x] `config.Load("")` 分层合并后口令来自根 `.env`（单测临时文件 + live 布尔校验）
-- [x] 宿主机 `shuimu-kb-shared` → `127.0.0.1`
+- [x] 宿主机 `shuimu-kb-shared` → `127.0.0.1`；容器内保留 compose DNS
 - [x] 错口令/空口令离线且日志无明文密码；`KB_ALLOW_OFFLINE=1` 可降级
-- [ ] 合 `dev` 后 `go test -short ./internal/config ./internal/kb` + health 冒烟
+- [x] 合 `dev` 后 short 测 PASS；dev rebuild 后 `kb_ready=true`，日志 `online=true dsn=...:***@shuimu-kb-shared...`，无 `shared_kb_secret_pass`
 
 ## 相关链接
 
@@ -52,3 +52,4 @@ mutex: infra
 ## 证据 / 备注
 
 根因：`Load` 优先单文件 `configs/.env.dev`（故意省略 `KB_DB_PASSWORD`），保留错误默认 `shared_kb_secret_pass`；Compose 本已分层，宿主机 `go test` 未对齐。
+合入后容器日志：`[kb] online=true dsn=postgres://regkb:***@shuimu-kb-shared:5432/regulations?sslmode=disable`；health `kb_ready=true`。
diff --git a/.doc/test-reports/2026-09-17-kb-host-auth-layered-load-test-report.md b/.doc/test-reports/2026-09-17-kb-host-auth-layered-load-test-report.md
index 479bdcba..73b97620 100644
--- a/.doc/test-reports/2026-09-17-kb-host-auth-layered-load-test-report.md
+++ b/.doc/test-reports/2026-09-17-kb-host-auth-layered-load-test-report.md
@@ -63,14 +63,27 @@ live kb host=127.0.0.1 port=5432 password_set=true
 - **实际输出**: `Online()==false`；包测试 PASS
 - **评价判定**: PASS（降级用例，非产品冒充在线）
 
+### 用例 E：dev 容器 rebuild 冒烟
+
+- **测试输入**: `./scripts/env-service.sh dev rebuild`；`curl -sf http://127.0.0.1:8080/health`
+- **实际输出**:
+```text
+{"status":"ok", ..., "kb_ready":true, "shared_kb_port":5432, "database_ready":true, ...}
+[kb] online=true dsn=postgres://regkb:***@shuimu-kb-shared:5432/regulations?sslmode=disable
+shared_kb_secret_pass 出现次数: 0
+```
+- **评价判定**: PASS
+- **性能与耗时**: rebuild ~14s；health 立即可用
+
 ## 六、 自动化测试套件汇总 (Test Suite Execution)
 
 ```text
-go test -short ./internal/config ./internal/kb
+go test -short ./internal/config ./internal/kb ./internal/server
 ok  	chat-agent-system/internal/config
 ok  	chat-agent-system/internal/kb
+ok  	chat-agent-system/internal/server
 ```
 
 ## 七、 测试结论与后续优化建议 (Conclusion & Next Steps)
 
-达到合并标准：配置 SSOT 与 Compose 分层对齐；E2E/nightly 预检 + `KB_REQUIRE_ONLINE` 避免静默离线冒充 PASS。后续可在试运行巡检中把 `kb_ready` 纳入 dashboard，但不必改 `/health` 的 HTTP 200 语义。
+达到合并标准：配置 SSOT 与 Compose 分层对齐；E2E/nightly 预检 + `EnsureOnline` 避免静默离线冒充 PASS；容器内 `kb_ready=true` 且 DSN 已脱敏。后续可在试运行巡检中把 `kb_ready` 纳入 dashboard，但不必改 `/health` 的 HTTP 200 语义。