diff --git a/vps-xray/tests/test-restart-schedule.sh b/vps-xray/tests/test-restart-schedule.sh
index f8a557f..928dfaa 100644
--- a/vps-xray/tests/test-restart-schedule.sh
+++ b/vps-xray/tests/test-restart-schedule.sh
@@ -197,6 +197,75 @@ is "remove 后 guard 消失"   "$([ -f "$GUARD_BIN" ] && echo yes || echo no)" "
 remove_restart_units
 is "重复 remove 返回 1" "$?" "1"
 
+echo "== guard 脚本行为 =="
+
+render_restart_units 7 04:00 Asia/Shanghai
+rm -f "$RESTART_STATE_FILE"
+: > "$SYSTEMCTL_LOG"
+
+# 无状态文件 → 首次必须执行
+out=$("$GUARD_BIN" 2>&1)
+is "首次执行重启"     "$(grep -c 'systemctl restart xray' "$SYSTEMCTL_LOG")" "1"
+is "首次写入时间戳"   "$([ -f "$RESTART_STATE_FILE" ] && echo yes)" "yes"
+
+# 刚重启过 → 必须跳过
+: > "$SYSTEMCTL_LOG"
+out=$("$GUARD_BIN" 2>&1)
+is "刚重启过则跳过"   "$(grep -c 'systemctl restart xray' "$SYSTEMCTL_LOG")" "0"
+is "跳过时有提示"     "$(echo "$out" | grep -c '跳过')" "1"
+
+# 距上次 6 天 → 仍未满 7 天，跳过
+echo "$(( $(date +%s) - 6 * 86400 ))" > "$RESTART_STATE_FILE"
+: > "$SYSTEMCTL_LOG"
+"$GUARD_BIN" > /dev/null 2>&1
+is "6 天不足 7 天则跳过" "$(grep -c 'systemctl restart xray' "$SYSTEMCTL_LOG")" "0"
+
+# 距上次 7 天差 100 秒 → 300 秒容差内，必须执行
+echo "$(( $(date +%s) - 7 * 86400 + 100 ))" > "$RESTART_STATE_FILE"
+: > "$SYSTEMCTL_LOG"
+"$GUARD_BIN" > /dev/null 2>&1
+is "容差内视为已满 7 天" "$(grep -c 'systemctl restart xray' "$SYSTEMCTL_LOG")" "1"
+
+# 距上次 7 天差 600 秒 → 超出容差，跳过
+echo "$(( $(date +%s) - 7 * 86400 + 600 ))" > "$RESTART_STATE_FILE"
+: > "$SYSTEMCTL_LOG"
+"$GUARD_BIN" > /dev/null 2>&1
+is "超出容差仍判不足" "$(grep -c 'systemctl restart xray' "$SYSTEMCTL_LOG")" "0"
+
+# 状态文件内容被写坏 → 按 0 处理，立即执行
+echo "garbage" > "$RESTART_STATE_FILE"
+: > "$SYSTEMCTL_LOG"
+"$GUARD_BIN" > /dev/null 2>&1
+is "状态文件非法时立即执行" "$(grep -c 'systemctl restart xray' "$SYSTEMCTL_LOG")" "1"
+is "非法内容被覆盖为数字" \
+   "$(grep -cE '^[0-9]+$' "$RESTART_STATE_FILE")" "1"
+
+# 每日模式：距上次 1 天即执行
+render_restart_units 1 04:00 Asia/Shanghai
+echo "$(( $(date +%s) - 86400 ))" > "$RESTART_STATE_FILE"
+: > "$SYSTEMCTL_LOG"
+"$GUARD_BIN" > /dev/null 2>&1
+is "N=1 时满一天即执行" "$(grep -c 'systemctl restart xray' "$SYSTEMCTL_LOG")" "1"
+
+# 时间戳先于重启写入：用一个必定失败的 systemctl 桩验证
+cat > "${STUB}/systemctl" << 'STUBEOF'
+#!/bin/sh
+echo "systemctl $*" >> "${SYSTEMCTL_LOG}"
+exit 1
+STUBEOF
+chmod 755 "${STUB}/systemctl"
+rm -f "$RESTART_STATE_FILE"
+: > "$SYSTEMCTL_LOG"
+"$GUARD_BIN" > /dev/null 2>&1
+is "重启失败时时间戳仍已写入" "$([ -s "$RESTART_STATE_FILE" ] && echo yes)" "yes"
+
+# 恢复正常桩，避免影响后续
+cat > "${STUB}/systemctl" << 'STUBEOF'
+#!/bin/sh
+echo "systemctl $*" >> "${SYSTEMCTL_LOG}"
+STUBEOF
+chmod 755 "${STUB}/systemctl"
+
 echo ""
 echo "通过 ${PASS}，失败 ${FAIL}"
 [ "$FAIL" -eq 0 ]