diff --git a/scripts/clean-test-traces.sh b/scripts/clean-test-traces.sh
new file mode 100755
index 0000000..c6af2e4
--- /dev/null
+++ b/scripts/clean-test-traces.sh
@@ -0,0 +1,18 @@
+#!/bin/bash
+# clean-test-traces.sh — 清理冒烟/测试账号在后台留下的全部痕迹(账号+会话+访问记录)
+# 在服务器上执行: ssh xyh@192.168.100.133 'bash -s' < scripts/clean-test-traces.sh
+# 每轮冒烟(SMOKE_USER模式)或手动验证后必须跑一次
+set -e
+sudo docker exec -i zhaopin-admin node - <<'EOF'
+const D = require("better-sqlite3");
+const db = new D("/data/admin/users.db");
+const marks = ["smoketest", "testsuper", "hr01", "t", "hr_debug", "dbg", "dbg_user", "时区测试"];
+const ph = marks.map(() => "?").join(",");
+const u = db.prepare(`SELECT COUNT(*) c FROM users WHERE username IN (${ph})`).get(...marks).c;
+const a = db.prepare(`SELECT COUNT(*) c FROM access_log WHERE username IN (${ph})`).get(...marks).c;
+db.prepare(`DELETE FROM sessions WHERE uid IN (SELECT id FROM users WHERE username IN (${ph}))`).run(...marks);
+db.prepare(`DELETE FROM users WHERE username IN (${ph})`).run(...marks);
+db.prepare(`DELETE FROM access_log WHERE username IN (${ph})`).run(...marks);
+console.log(`已清理: 账号${u}个, 访问记录${a}条`);
+console.log("现存账号:", JSON.stringify(db.prepare("SELECT username,role FROM users").all()));
+EOF