diff --git a/apps/desktop-shell/scripts/check-config.mjs b/apps/desktop-shell/scripts/check-config.mjs
index 70f049d73..45783267c 100644
--- a/apps/desktop-shell/scripts/check-config.mjs
+++ b/apps/desktop-shell/scripts/check-config.mjs
@@ -2635,7 +2635,7 @@ const requiredRustHostSnippets = [
   'window.history.replaceState',
   "window.addEventListener('popstate'",
   '__genarrativeDesktopHistoryIndex',
-  "console.warn('desktop navigation state sync failed', error)",
+  "console.warn('desktop navigation state sync failed')",
   'file.imageDropped',
   'normalize_desktop_drop_position',
   '.round().max(0.0) as i32',
@@ -2704,6 +2704,20 @@ const requiredRustHostSnippets = [
   'replay_state.complete(slot, response)',
 ];
 
+const desktopNavigationStateScriptBody = extractFunctionBody(
+  desktopShellNavigationSource,
+  'desktop_navigation_state_script',
+);
+if (
+  desktopNavigationStateScriptBody.includes(
+    "console.warn('desktop navigation state sync failed', error)",
+  )
+) {
+  throw new Error(
+    'desktop shell navigation state diagnostics must not log native error objects',
+  );
+}
+
 assertSameList(
   allowedTauriCommands,
   ['host_bridge_request'],
diff --git a/apps/desktop-shell/src-tauri/src/shell/navigation.rs b/apps/desktop-shell/src-tauri/src/shell/navigation.rs
index 8d0e4fee6..160d49e09 100644
--- a/apps/desktop-shell/src-tauri/src/shell/navigation.rs
+++ b/apps/desktop-shell/src-tauri/src/shell/navigation.rs
@@ -79,7 +79,7 @@ pub(crate) fn desktop_navigation_state_script() -> Result<String, serde_json::Er
             try {{
               originalReplaceState(stateWithIndex(window.history.state, currentIndex), '', window.location.href);
             }} catch (error) {{
-              console.warn('desktop navigation state sync failed', error);
+              console.warn('desktop navigation state sync failed');
             }}
           }};
 
@@ -393,7 +393,8 @@ mod tests {
         assert!(script.contains("(currentIndex > 0)"));
         assert!(script.contains("\\\"canGoBack\\\":true"));
         assert!(script.contains("\\\"canGoBack\\\":false"));
-        assert!(script.contains("console.warn('desktop navigation state sync failed', error)"));
+        assert!(script.contains("console.warn('desktop navigation state sync failed')"));
+        assert!(!script.contains("console.warn('desktop navigation state sync failed', error)"));
         assert!(script.contains("window.__GENARRATIVE_DESKTOP_NAVIGATION_STATE_INSTALLED__"));
     }
 }
diff --git a/docs/【前端架构】ExpoReactNative与Tauri宿主壳方案-2026-06-17.md b/docs/【前端架构】ExpoReactNative与Tauri宿主壳方案-2026-06-17.md
index 14b51f7f3..04a8da8ab 100644
--- a/docs/【前端架构】ExpoReactNative与Tauri宿主壳方案-2026-06-17.md
+++ b/docs/【前端架构】ExpoReactNative与Tauri宿主壳方案-2026-06-17.md
@@ -523,6 +523,8 @@ GameBridge 禁止：
 
 2026-06-20 追加：移动壳 HostBridge 能力失败诊断统一只记录稳定标签。Expo 壳的 badge、clipboard、haptics、navigation、network、notification 和 share 等 HostBridge 能力在捕获原生 SDK / WebView / 系统 API 异常时，只能向控制台输出 `mobile ... failed for <stage>` 这类固定阶段标签，不把原生 error 对象、native stack、平台错误码、文件路径或系统返回结构作为日志参数输出；HostBridge response 继续返回共享契约里的稳定 `host_error` / `cancelled` / `unsupported_capability` 等错误。移动壳 shell 层的 HostBridge message 注入、宿主事件注入、外链离壳、WebView 下载阻断、深链读取 / 拒绝、扫码权限请求和 H5 history 同步失败也按同一 label-only 口径记录；WebView 进程失败只记录失败窗口计数和固定阶段标签，不记录当前 H5 URL 或 query。`apps/mobile-shell/scripts/check-config.mjs` 会反查这些能力模块和 shell 层日志形式，避免后续为了排查方便把原生错误对象、WebView 事件或 H5 地址重新带进可分发移动壳日志。
 
+2026-06-20 追加：桌面壳注入到 H5 的 history 追踪脚本同样只记录稳定标签。Tauri 桌面壳的 `desktop_navigation_state_script` 在 H5 `replaceState` 同步失败时只输出 `desktop navigation state sync failed`，不把页面内 error 对象传给控制台；`apps/desktop-shell/scripts/check-config.mjs` 会拒绝恢复 `console.warn(..., error)` 形式，避免桌面 WebView 内脚本异常对象进入可分发壳诊断日志。
+
 2026-06-18 追加：微信 / Expo / Tauri 三端壳的生产源码和配置禁止出现 mock / fake / placeholder / stub / TODO / FIXME / 占位 / 模拟 / 伪造 / 未实现 / 临时 等脚手架或替身词；测试文件仍可使用 `vi.mock` 或等价测试替身。`apps/mobile-shell/scripts/check-config.mjs` 与 `apps/desktop-shell/scripts/check-config.mjs` 会扫描各自生产入口、配置和壳实现；移动壳 EAS / Expo config / Metro export smoke 脚本也属于可分发验收入口，必须纳入移动壳单端结构清单和替身词扫描。根级 `npm run check:native-shells` 会统一扫描 `miniprogram`、`apps/mobile-shell`、`apps/desktop-shell`、H5 HostBridge transport 和共享 HostBridge 契约生产源码，防止把临时替身或占位文案带进可分发壳。
 
 2026-06-19 追加：H5 HostBridge 真实调用链扫描改为自动发现。根级 `npm run check:native-shells` 会从 `src/` 生产文件里收集直接导入并调用真实宿主能力 facade 的文件，以及 `useHostLifecycleActive`、`useHostNetworkOnline`、`platformProfileHostClipboard` 等薄 wrapper 的消费者；新增 `reloadHostWebView`、`showHostLocalNotification`、`setHostAppBadgeCount`、`importHostTextFile`、`importHostImageFile`、`captureHostImageFile`、`subscribeHostImageDrop`、`readHostClipboardText`、`openHostExternalUrl` 等 H5 调用点时，不再手工维护单个扫描文件清单。登录与支付外链属于敏感跳转路径，`src/services/authService.ts` 和 `src/services/payment/paymentRedirect.ts` 额外列入必扫清单，防止后续绕回裸浏览器跳转却脱离 HostBridge 调用链门禁。H5 业务文件允许正常表单 `placeholder` 属性、业务占位图文案和真实兼容 / 故障语义中的“未实现”“临时”表述，但仍会拒绝 mock / fake / stub / TODO / FIXME / 模拟 / 伪造等替身痕迹。