fix(HEL-243): 当前账号可点击返回，避免切换死路

当前账号行原先只显示对号、不可点击，单账号时只能关网页。现改为整行继续使用且不重新签发会话，并带回切换前的业务页。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>
部署集成(HEL-241): 合入桌面登录门户返工 aef8a05（含 28px 底部缺口修复）
2026-08-29 20:44:18 +08:00 · 2026-08-29 20:09:41 +08:00 · 2026-08-29 20:04:22 +08:00 · 2026-08-29 19:21:13 +08:00 · 2026-08-29 17:34:50 +08:00 · 2026-08-29 16:01:54 +08:00
44 changed files with 4729 additions and 127 deletions
@@ -165,7 +165,32 @@ docker compose restart xiaobai-review
 docker compose down
 ```

-### 使用 Gitea 更新程序（推荐）
+### 镜像构建的唯一安全入口（2026-08 HEL-235 起）
+
+生产机 `192.168.200.11` 上的 `/opt/1panel/docker/compose/xiaobaifupan` 只是历史文件树：
+不是 Git 仓库、内容停在旧提交、与线上镜像不一致，且其 `compose.yaml` 会把构建结果打进
+`xiaobai-review:latest`。**禁止在该目录（或任何服务器工作树）里 `docker build` /
+`docker compose build`**，否则会把已上线功能悄悄打回旧版。
+
+唯一安全构建方式是在有仓库检出、能免密 SSH 到部署机的机器上运行：
+
+```bash
+tools/build_image.sh <提交号> <镜像tag>
+# 示例：tools/build_image.sh cefc86917d89 verify-hel235-cefc869
+```
+
+该脚本的行为约束：
+
+- 先 `git fetch`，再把提交号解析为完整 SHA，解析失败立即中止，绝不使用本地脏状态或服务器旧目录；
+- 构建前读取当前线上容器镜像的 `org.opencontainers.image.revision`，用 Git 祖先关系确认候选提交包含线上全部历史；落后 `main`、旁支或错误提交会直接退出，并打印线上提交、候选提交、文件差异和将丢失的提交；
+- 镜像 tag 必须以 `-<提交短号7位>` 结尾（如 `hel234-cefc869`），禁止 `latest`、`rollback-*`；
+- 通过 `git archive <提交> | ssh 部署机 docker build -` 流式构建，服务器上不存在构建用工作树；
+- 构建后回读镜像 label 里的 `org.opencontainers.image.revision`，与预期提交不一致则删除镜像并中止；
+- 每次构建在部署机 `~/xiaobai-build/BUILD_LOG.tsv` 留痕，可追溯每个镜像的来源提交。
+
+构建只产出镜像，不启动、不替换任何容器；换版用新 tag 起新容器，回滚用既有镜像 tag 重跑。
+
+### 使用 Gitea 更新程序（旧方式，生产机禁用）

 代码仓库为：

@@ -190,7 +215,9 @@ cd /opt/xiaobai-review
 `data/private-mentor-skills/` 复制到服务器项目的同名 `data` 目录，并保持目录仅由
 部署账号和容器运行用户读取。该内容不会通过 Gitea 同步。

-每次更新前先创建 SQLite 一致性备份，再拉取并重建容器：
+每次更新前先创建 SQLite 一致性备份，再拉取并重建容器（注意：`docker compose up -d --build`
+从服务器本地工作树构建，仅适用于来源可信的全新环境；生产机 `192.168.200.11` 禁用，
+请用 `tools/build_image.sh` 构建后换容器）：

 ```bash
 cd /opt/xiaobai-review
@@ -205,7 +232,10 @@ curl --fail http://127.0.0.1:8765/api/health
 数据库迁移会在新容器启动时自动执行。若 `git pull --ff-only` 提示本地代码有修改，
 先用 `git status` 查明原因，不要用强制重置覆盖 `.env` 或 `data`。

-### 不使用 Git 时更新
+### 不使用 Git 时更新（生产机禁用）
+
+`docker compose build` 会从服务器本地目录构建，来源提交不可追溯。生产机
+`192.168.200.11` 上禁止使用本节方式，一律改用上一节的 `tools/build_image.sh`。

 重新上传代码后执行：

@@ -18,6 +18,8 @@ TOKEN_PATTERN = re.compile(r"^[A-Za-z0-9_-]{20,128}$")
 USERNAME_PATTERN = re.compile(r"^[A-Za-z0-9_\-\u4e00-\u9fff]{3,30}$")
 SESSION_COOKIE = "xiaobai_session"
 SESSION_MAX_AGE = 30 * 24 * 60 * 60
+DEVICE_COOKIE = "xiaobai_device"
+DEVICE_MAX_AGE = 180 * 24 * 60 * 60


 def load_local_env() -> None:
@@ -2,6 +2,7 @@ from .m0001_adopt_legacy import MIGRATION as M0001_ADOPT_LEGACY
 from .m0002_job_runs import MIGRATION as M0002_JOB_RUNS
 from .m0003_llm_audit import MIGRATION as M0003_LLM_AUDIT
 from .m0004_mentor_notes import MIGRATION as M0004_MENTOR_NOTES
+from .m0005_account_switch_grants import MIGRATION as M0005_ACCOUNT_SWITCH_GRANTS
 from .runner import Migration, MigrationError, MigrationRunner

 MIGRATIONS = (
@@ -9,6 +10,7 @@ MIGRATIONS = (
    M0002_JOB_RUNS,
    M0003_LLM_AUDIT,
    M0004_MENTOR_NOTES,
+    M0005_ACCOUNT_SWITCH_GRANTS,
 )

 __all__ = ["MIGRATIONS", "Migration", "MigrationError", "MigrationRunner"]
@@ -0,0 +1,42 @@
+from __future__ import annotations
+
+import sqlite3
+
+from backend.database.migrations.runner import Migration
+
+
+def create_account_switch_grants(connection: sqlite3.Connection) -> None:
+    connection.execute(
+        """
+        CREATE TABLE IF NOT EXISTS account_switch_grants (
+            id INTEGER PRIMARY KEY AUTOINCREMENT,
+            device_hash TEXT NOT NULL,
+            user_id INTEGER NOT NULL,
+            granted_at TEXT NOT NULL,
+            last_used_at TEXT NOT NULL,
+            expires_at TEXT NOT NULL,
+            UNIQUE (device_hash, user_id),
+            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
+        )
+        """
+    )
+    connection.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_device
+        ON account_switch_grants(device_hash, last_used_at DESC)
+        """
+    )
+    connection.execute(
+        """
+        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_expiry
+        ON account_switch_grants(expires_at)
+        """
+    )
+
+
+MIGRATION = Migration(
+    version="0005",
+    name="create_account_switch_grants",
+    action=create_account_switch_grants,
+    signature="account-switch-grants:v1:device,user,granted,used,expires,unique",
+)
@@ -28,11 +28,11 @@ class AccountApplicationMixin:
    def update_membership(self, payload: dict[str, Any]) -> None:
        self.accounts.update_membership(payload)

-    def register_account(self, username: str, password: str) -> dict[str, Any]:
-        return self.accounts.register(username, password)
+    def register_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
+        return self.accounts.register(username, password, device_hash)

-    def login_account(self, username: str, password: str) -> dict[str, Any]:
-        return self.accounts.login(username, password)
+    def login_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
+        return self.accounts.login(username, password, device_hash)

    def change_password(self, current_password: str, new_password: str) -> None:
        self.accounts.change_password(current_password, new_password)
@@ -1,49 +1,108 @@
 from __future__ import annotations

 import json
+import secrets
 from http import HTTPStatus

+from backend.features.accounts.security import token_hash
+

 class AccountHttpMixin:
+    def _device_hash(self) -> str:
+        raw = self.device_token()
+        return token_hash(raw) if raw else ""
+
+    def _ensure_device_token(self) -> str:
+        return self.device_token() or secrets.token_urlsafe(32)
+
+    def _auth_success_headers(self, session_token: str, device_raw: str) -> list[tuple[str, str]]:
+        return [
+            ("Set-Cookie", self.session_cookie(session_token)),
+            ("Set-Cookie", self.device_cookie(device_raw)),
+        ]
+
+    def _send_authenticated_session(self, result: dict, status: HTTPStatus, device_raw: str) -> None:
+        self.send_json(
+            {
+                "ok": True,
+                "authenticated": True,
+                "user": result["user"],
+                "csrf_token": result["csrf_token"],
+            },
+            status,
+            self._auth_success_headers(result["session_token"], device_raw),
+        )
+
    def auth_register(self) -> None:
        try:
            body = self.read_json_body()
+            device_raw = self._ensure_device_token()
            result = self.application_service.register_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
+                token_hash(device_raw),
            )
-            self.send_json(
-                {
-                    "ok": True,
-                    "authenticated": True,
-                    "user": result["user"],
-                    "csrf_token": result["csrf_token"],
-                },
-                HTTPStatus.CREATED,
-                {"Set-Cookie": self.session_cookie(result["session_token"])},
-            )
+            self._send_authenticated_session(result, HTTPStatus.CREATED, device_raw)
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)

    def auth_login(self) -> None:
        try:
            body = self.read_json_body()
+            device_raw = self._ensure_device_token()
            result = self.application_service.login_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
+                token_hash(device_raw),
            )
-            self.send_json(
-                {
-                    "ok": True,
-                    "authenticated": True,
-                    "user": result["user"],
-                    "csrf_token": result["csrf_token"],
-                },
-                headers={"Set-Cookie": self.session_cookie(result["session_token"])},
-            )
+            self._send_authenticated_session(result, HTTPStatus.OK, device_raw)
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)

+    def auth_accounts(self) -> None:
+        current_user_id = None
+        if self.require_auth(send_error=False):
+            current_user_id = int(self.auth_user["id"])
+        payload = self.application_service.accounts.list_device_accounts(
+            self._device_hash(),
+            current_user_id,
+        )
+        self.send_json({"ok": True, **payload})
+
+    def auth_switch(self) -> None:
+        try:
+            body = self.read_json_body()
+            try:
+                user_id = int(body.get("user_id"))
+            except (TypeError, ValueError):
+                user_id = 0
+            device_raw = self.device_token()
+            result = self.application_service.accounts.switch_account(
+                token_hash(device_raw) if device_raw else "",
+                user_id,
+            )
+            self._send_authenticated_session(
+                result,
+                HTTPStatus.OK,
+                device_raw or self._ensure_device_token(),
+            )
+        except PermissionError as exc:
+            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
+        except (ValueError, json.JSONDecodeError) as exc:
+            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
+
+    def auth_forget(self) -> None:
+        try:
+            body = self.read_json_body()
+            try:
+                user_id = int(body.get("user_id"))
+            except (TypeError, ValueError):
+                user_id = 0
+            self.application_service.accounts.forget_account(self._device_hash(), user_id)
+        except (ValueError, json.JSONDecodeError):
+            pass
+        self.send_json({"ok": True})
+
    def auth_me(self) -> None:
        service = self.application_service
        if not self.require_auth(send_error=False):
@@ -55,6 +114,15 @@ class AccountHttpMixin:
                }
            )
            return
+        headers = None
+        if not self.device_token():
+            device_raw = secrets.token_urlsafe(32)
+            service.accounts.remember_account(
+                token_hash(device_raw),
+                int(self.auth_user["id"]),
+                fresh=True,
+            )
+            headers = [("Set-Cookie", self.device_cookie(device_raw))]
        self.send_json(
            {
                "ok": True,
@@ -66,15 +134,19 @@ class AccountHttpMixin:
                    "membership": service.membership(),
                },
                "csrf_token": str(self.auth_user["csrf_token"]),
-            }
+            },
+            headers=headers,
        )

    def auth_logout(self) -> None:
        raw_token = self.session_token()
+        user_id = int(getattr(self, "auth_user", {}).get("id") or 0)
        if raw_token:
-            from backend.features.accounts.security import token_hash
-
            self.application_service.database.delete_session(token_hash(raw_token))
+        self.application_service.accounts.revoke_current_device_grant(
+            self._device_hash(),
+            user_id,
+        )
        self.send_json(
            {"ok": True},
            headers={"Set-Cookie": self.session_cookie("", clear=True)},
@@ -234,3 +234,96 @@ class AccountRepositoryMixin:
                (user_id,),
            )
            return cursor.rowcount > 0
+
+    def cleanup_expired_switch_grants(self, now: str) -> int:
+        with self.connect() as connection:
+            cursor = connection.execute(
+                "DELETE FROM account_switch_grants WHERE expires_at <= ?",
+                (now,),
+            )
+        return int(cursor.rowcount)
+
+    def list_switch_grants(self, device_hash: str, now: str) -> list[dict[str, Any]]:
+        with self.connect() as connection:
+            rows = connection.execute(
+                """
+                SELECT u.id, u.username, u.role, u.llm_mode, u.membership_status,
+                       u.membership_plan, u.membership_starts_at, u.membership_expires_at,
+                       u.created_at, g.last_used_at, g.granted_at, g.expires_at
+                FROM account_switch_grants AS g
+                JOIN users AS u ON u.id = g.user_id
+                WHERE g.device_hash = ? AND g.expires_at > ?
+                ORDER BY g.last_used_at DESC, g.id DESC
+                """,
+                (device_hash, now),
+            ).fetchall()
+        return [dict(row) for row in rows]
+
+    def get_switch_grant(self, device_hash: str, user_id: int) -> dict[str, Any] | None:
+        with self.connect() as connection:
+            row = connection.execute(
+                """
+                SELECT device_hash, user_id, granted_at, last_used_at, expires_at
+                FROM account_switch_grants
+                WHERE device_hash = ? AND user_id = ?
+                """,
+                (device_hash, user_id),
+            ).fetchone()
+        return dict(row) if row else None
+
+    def upsert_switch_grant(
+        self,
+        device_hash: str,
+        user_id: int,
+        granted_at: str,
+        last_used_at: str,
+        expires_at: str,
+    ) -> None:
+        with self.connect() as connection:
+            connection.execute(
+                """
+                INSERT INTO account_switch_grants
+                    (device_hash, user_id, granted_at, last_used_at, expires_at)
+                VALUES (?, ?, ?, ?, ?)
+                ON CONFLICT(device_hash, user_id) DO UPDATE SET
+                    granted_at = excluded.granted_at,
+                    last_used_at = excluded.last_used_at,
+                    expires_at = excluded.expires_at
+                """,
+                (device_hash, user_id, granted_at, last_used_at, expires_at),
+            )
+
+    def prune_switch_grants(self, device_hash: str, keep: int) -> int:
+        with self.connect() as connection:
+            rows = connection.execute(
+                """
+                SELECT id FROM account_switch_grants
+                WHERE device_hash = ?
+                ORDER BY last_used_at DESC, id DESC
+                """,
+                (device_hash,),
+            ).fetchall()
+            extra = [int(row["id"]) for row in rows[keep:]]
+            if not extra:
+                return 0
+            connection.execute(
+                f"DELETE FROM account_switch_grants WHERE id IN ({','.join('?' * len(extra))})",
+                extra,
+            )
+        return len(extra)
+
+    def delete_switch_grant(self, device_hash: str, user_id: int) -> bool:
+        with self.connect() as connection:
+            cursor = connection.execute(
+                "DELETE FROM account_switch_grants WHERE device_hash = ? AND user_id = ?",
+                (device_hash, user_id),
+            )
+        return cursor.rowcount > 0
+
+    def delete_switch_grants_for_user(self, user_id: int) -> int:
+        with self.connect() as connection:
+            cursor = connection.execute(
+                "DELETE FROM account_switch_grants WHERE user_id = ?",
+                (user_id,),
+            )
+        return int(cursor.rowcount)
@@ -6,6 +6,9 @@ class AccountRoutesMixin:
        if parsed.path == "/api/auth/me":
            self.auth_me()
            return True
+        if parsed.path == "/api/auth/accounts":
+            self.auth_accounts()
+            return True
        return False

    def _handle_accounts_get(self, parsed) -> bool:
@@ -77,15 +77,22 @@ class AccountService:
        access = self.access_supplier() or self.database.user_access(self.current_user_id) or {}
        return self.membership_for_access(access)

-    def register(self, username: str, password: str) -> dict[str, Any]:
+    GRANT_SLIDE_DAYS = 30
+    GRANT_HARD_DAYS = 180
+    MAX_GRANTS_PER_DEVICE = 5
+    SWITCH_REAUTH_MESSAGE = "该账号需重新验证"
+
+    def register(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
        username = username.strip()
        self.validate_input(username, password)
        with self.auth_lock:
            salt, password_digest = hash_password(password)
            user = self.database.create_user(username, salt, password_digest)
-        return self.create_session(user)
+        result = self.create_session(user)
+        self.remember_account(device_hash, int(user["id"]), fresh=True)
+        return result

-    def login(self, username: str, password: str) -> dict[str, Any]:
+    def login(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
        username = username.strip()
        if not username or not password:
            raise ValueError("账号名和密码不能为空。")
@@ -96,7 +103,9 @@ class AccountService:
            str(user.get("password_hash") or ""),
        ):
            raise ValueError("账号名或密码不正确。")
-        return self.create_session(user)
+        result = self.create_session(user)
+        self.remember_account(device_hash, int(user["id"]), fresh=True)
+        return result

    def change_password(self, current_password: str, new_password: str) -> None:
        current_password = str(current_password or "")
@@ -112,6 +121,86 @@ class AccountService:
        salt, digest = hash_password(new_password)
        if not self.database.update_user_password(self.current_user_id, salt, digest):
            raise ValueError("账号不存在。")
+        self.database.delete_switch_grants_for_user(self.current_user_id)
+
+    @staticmethod
+    def _utc_now() -> datetime:
+        return datetime.now(timezone.utc)
+
+    @classmethod
+    def _iso(cls, value: datetime) -> str:
+        return value.isoformat(timespec="seconds")
+
+    def remember_account(self, device_hash: str, user_id: int, *, fresh: bool = False) -> None:
+        if not device_hash or user_id <= 0:
+            return
+        now = self._utc_now()
+        now_text = self._iso(now)
+        self.database.cleanup_expired_switch_grants(now_text)
+        existing = None if fresh else self.database.get_switch_grant(device_hash, user_id)
+        granted_at = parse_iso_datetime(existing["granted_at"]) if existing else now
+        if granted_at is None:
+            granted_at = now
+        expires = min(
+            now + timedelta(days=self.GRANT_SLIDE_DAYS),
+            granted_at + timedelta(days=self.GRANT_HARD_DAYS),
+        )
+        if not existing:
+            self.database.prune_switch_grants(device_hash, self.MAX_GRANTS_PER_DEVICE - 1)
+        self.database.upsert_switch_grant(
+            device_hash,
+            user_id,
+            self._iso(granted_at),
+            now_text,
+            self._iso(expires),
+        )
+
+    def list_device_accounts(
+        self, device_hash: str, current_user_id: int | None = None
+    ) -> dict[str, Any]:
+        if not device_hash:
+            return {"accounts": [], "current_user_id": current_user_id}
+        now_text = self._iso(self._utc_now())
+        self.database.cleanup_expired_switch_grants(now_text)
+        accounts = []
+        for row in self.database.list_switch_grants(device_hash, now_text):
+            accounts.append(
+                {
+                    "user_id": int(row["id"]),
+                    "username": str(row["username"]),
+                    "role": str(row.get("role") or "user"),
+                    "membership": self.membership_for_access(row),
+                    "last_used_at": str(row.get("last_used_at") or ""),
+                }
+            )
+        return {"accounts": accounts, "current_user_id": current_user_id}
+
+    def switch_account(self, device_hash: str, user_id: int) -> dict[str, Any]:
+        if not device_hash or user_id <= 0:
+            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
+        now = self._utc_now()
+        now_text = self._iso(now)
+        self.database.cleanup_expired_switch_grants(now_text)
+        grant = self.database.get_switch_grant(device_hash, user_id)
+        expires = parse_iso_datetime(grant.get("expires_at")) if grant else None
+        if not grant or not expires or expires <= now:
+            if grant:
+                self.database.delete_switch_grant(device_hash, user_id)
+            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
+        user = self.database.user_access(user_id)
+        if not user:
+            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
+        result = self.create_session(user)
+        self.remember_account(device_hash, user_id)
+        return result
+
+    def forget_account(self, device_hash: str, user_id: int) -> None:
+        if device_hash and user_id > 0:
+            self.database.delete_switch_grant(device_hash, user_id)
+
+    def revoke_current_device_grant(self, device_hash: str, user_id: int) -> None:
+        if device_hash and user_id > 0:
+            self.database.delete_switch_grant(device_hash, user_id)

    def create_session(self, user: dict[str, Any]) -> dict[str, Any]:
        session_token = secrets.token_urlsafe(32)
@@ -7,6 +7,8 @@ from urllib.parse import urlparse
 PUBLIC_POST_HANDLERS = {
    "/api/auth/register": "auth_register",
    "/api/auth/login": "auth_login",
+    "/api/auth/switch": "auth_switch",
+    "/api/auth/forget": "auth_forget",
 }

 AUTHENTICATED_POST_HANDLERS = {
@@ -9,7 +9,13 @@ from http.cookies import SimpleCookie
 from typing import Any
 from urllib.parse import unquote

-from backend.bootstrap.config import SESSION_COOKIE, SESSION_MAX_AGE, STATIC_DIR
+from backend.bootstrap.config import (
+    DEVICE_COOKIE,
+    DEVICE_MAX_AGE,
+    SESSION_COOKIE,
+    SESSION_MAX_AGE,
+    STATIC_DIR,
+)
 from backend.features.accounts.security import token_hash
 from backend.http.context import correlation_id
 from backend.http.errors import normalize_error_payload
@@ -21,15 +27,21 @@ class HttpTransportMixin:
    application_service: Any
    route_registry: Any

-    def session_token(self) -> str:
+    def cookie_value(self, name: str) -> str:
        cookie = SimpleCookie()
        try:
            cookie.load(self.headers.get("Cookie", ""))
        except Exception:
            return ""
-        morsel = cookie.get(SESSION_COOKIE)
+        morsel = cookie.get(name)
        return morsel.value if morsel else ""

+    def session_token(self) -> str:
+        return self.cookie_value(SESSION_COOKIE)
+
+    def device_token(self) -> str:
+        return self.cookie_value(DEVICE_COOKIE)
+
    def require_auth(self, send_error: bool = True) -> bool:
        raw_token = self.session_token()
        service = self.application_service
@@ -79,15 +91,18 @@ class HttpTransportMixin:
            return self.require_member()
        return True

-    def session_cookie(self, value: str, clear: bool = False) -> str:
-        max_age = 0 if clear else SESSION_MAX_AGE
-        cookie = (
-            f"{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
-        )
+    def _cookie_header(self, name: str, value: str, max_age: int) -> str:
+        cookie = f"{name}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
        if self.headers.get("X-Forwarded-Proto", "").lower() == "https":
            cookie += "; Secure"
        return cookie

+    def session_cookie(self, value: str, clear: bool = False) -> str:
+        return self._cookie_header(SESSION_COOKIE, value, 0 if clear else SESSION_MAX_AGE)
+
+    def device_cookie(self, value: str, clear: bool = False) -> str:
+        return self._cookie_header(DEVICE_COOKIE, value, 0 if clear else DEVICE_MAX_AGE)
+
    def read_json_body(self, allow_empty: bool = False) -> dict[str, Any]:
        length = int(self.headers.get("Content-Length", "0"))
        if length == 0 and allow_empty:
@@ -132,7 +147,7 @@ class HttpTransportMixin:
        self,
        payload: dict[str, Any],
        status: HTTPStatus = HTTPStatus.OK,
-        headers: dict[str, str] | None = None,
+        headers: dict[str, str] | list[tuple[str, str]] | tuple[tuple[str, str], ...] | None = None,
    ) -> None:
        request_id = getattr(self, "_correlation_id", "")
        if not request_id:
@@ -145,7 +160,8 @@ class HttpTransportMixin:
        self.send_header("Content-Length", str(len(content)))
        self.send_header("Cache-Control", "no-store")
        self.send_header("X-Request-ID", request_id)
-        for name, value in (headers or {}).items():
+        header_items = headers.items() if isinstance(headers, dict) else (headers or ())
+        for name, value in header_items:
            self.send_header(name, value)
        self.end_headers()
        self.wfile.write(content)
@@ -128,6 +128,20 @@
      "feature": "auction",
      "access": "authenticated"
    },
+    {
+      "method": "GET",
+      "path": "/api/auth/accounts",
+      "match": "exact",
+      "feature": "auth",
+      "access": "public"
+    },
+    {
+      "method": "POST",
+      "path": "/api/auth/forget",
+      "match": "exact",
+      "feature": "auth",
+      "access": "public"
+    },
    {
      "method": "POST",
      "path": "/api/auth/login",
@@ -156,6 +170,13 @@
      "feature": "auth",
      "access": "public"
    },
+    {
+      "method": "POST",
+      "path": "/api/auth/switch",
+      "match": "exact",
+      "feature": "auth",
+      "access": "public"
+    },
    {
      "method": "POST",
      "path": "/api/backfill",
@@ -10,10 +10,10 @@
  },
  "counts": {
    "primary_pages": 16,
-    "api_exact_paths": 53,
+    "api_exact_paths": 56,
    "api_prefixes": 0,
    "api_patterns": 11,
-    "database_tables": 36,
+    "database_tables": 37,
    "frontend_page_fragments": 12
  },
  "pages": [
@@ -96,10 +96,13 @@
      "/api/assistant/chat",
      "/api/assistant/messages",
      "/api/auction",
+      "/api/auth/accounts",
+      "/api/auth/forget",
      "/api/auth/login",
      "/api/auth/logout",
      "/api/auth/me",
      "/api/auth/register",
+      "/api/auth/switch",
      "/api/backfill",
      "/api/chart/intraday",
      "/api/dashboard",
@@ -189,6 +192,7 @@
    "assistant_messages",
    "heaven_readings",
    "job_runs",
+    "account_switch_grants",
    "schema_migrations"
  ],
  "background_job_methods": [
@@ -370,11 +374,11 @@
    }
  ],
  "css_layers": [
-    "/shared/tokens.css?v=20260820-3",
+    "/shared/tokens.css?v=20260829-hel240",
    "/shared/base.css?v=20260806-1",
-    "/shared/shell.css?v=20260827-hel183",
-    "/shared/auth.css?v=20260820-5",
-    "/shared/components/controls.css?v=20260827-hel183",
+    "/shared/shell.css?v=20260829-hel237",
+    "/shared/auth.css?v=20260829-hel240b",
+    "/shared/components/controls.css?v=20260829-hel237",
    "/shared/components/navigation.css?v=20260820-1",
    "/shared/components/cards.css?v=20260820-1",
    "/shared/components/tables.css?v=20260820-1",
@@ -461,8 +465,8 @@
    },
    {
      "path": "frontend/index.html",
-      "bytes": 48077,
-      "lines": 662
+      "bytes": 48254,
+      "lines": 664
    },
    {
      "path": "backend/features/screener/catalog.py",
@@ -551,8 +555,8 @@
    },
    {
      "path": "frontend/shared/session.js",
-      "bytes": 13176,
-      "lines": 293
+      "bytes": 13219,
+      "lines": 289
    },
    {
      "path": "frontend/shared/dashboard.js",
@@ -669,16 +673,16 @@
      "bytes": 5451,
      "lines": 118
    },
+    {
+      "path": "frontend/pages.config.js",
+      "bytes": 5385,
+      "lines": 130
+    },
    {
      "path": "frontend/pages/market/search.js",
      "bytes": 5384,
      "lines": 131
    },
-    {
-      "path": "frontend/pages.config.js",
-      "bytes": 5380,
-      "lines": 130
-    },
    {
      "path": "frontend/pages/auction/page.html",
      "bytes": 5350,
@@ -716,8 +720,8 @@
    },
    {
      "path": "backend/http/dispatch.py",
-      "bytes": 4118,
-      "lines": 115
+      "bytes": 4196,
+      "lines": 117
    },
    {
      "path": "frontend/shared/table.js",
@@ -734,16 +738,16 @@
      "bytes": 3369,
      "lines": 81
    },
+    {
+      "path": "frontend/app.js",
+      "bytes": 3337,
+      "lines": 95
+    },
    {
      "path": "frontend/pages/themes/page.html",
      "bytes": 3316,
      "lines": 55
    },
-    {
-      "path": "frontend/app.js",
-      "bytes": 3201,
-      "lines": 93
-    },
    {
      "path": "backend/features/market/insights_context.py",
      "bytes": 3175,
@@ -761,7 +765,7 @@
    },
    {
      "path": "backend/features/accounts/application.py",
-      "bytes": 2442,
+      "bytes": 2514,
      "lines": 63
    },
    {
@@ -849,6 +853,11 @@
      "bytes": 1143,
      "lines": 19
    },
+    {
+      "path": "backend/features/accounts/routes.py",
+      "bytes": 908,
+      "lines": 25
+    },
    {
      "path": "backend/features/popularity/routes.py",
      "bytes": 822,
@@ -859,11 +868,6 @@
      "bytes": 817,
      "lines": 23
    },
-    {
-      "path": "backend/features/accounts/routes.py",
-      "bytes": 803,
-      "lines": 22
-    },
    {
      "path": "backend/features/sentiment/routes.py",
      "bytes": 724,
@@ -25,8 +25,10 @@ async function initialize() {
  try {
    const session = await apiRequest("/api/auth/me");
    if (!session.authenticated) {
-      if (session.registration_required) selectAuthMode("register");
-      showAuthGate();
+      const params = new URLSearchParams();
+      if (session.registration_required) params.set("mode", "register");
+      const query = params.toString();
+      window.location.replace("/login/" + (query ? `?${query}` : ""));
      return;
    }
    await applyAuthenticatedSession(session);
@@ -24,7 +24,9 @@
    (() => {
      let theme = "light";
      try {
-        theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
+        const stored = localStorage.getItem("xiaobaiTheme");
+        if (stored === "dark" || stored === "light") theme = stored;
+        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
      } catch (_error) {
        theme = "light";
      }
@@ -32,11 +34,11 @@
      document.documentElement.style.colorScheme = theme;
    })();
  </script>
-  <link rel="stylesheet" href="/shared/tokens.css?v=20260820-3">
+  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-hel240">
  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
-  <link rel="stylesheet" href="/shared/shell.css?v=20260827-hel183">
-  <link rel="stylesheet" href="/shared/auth.css?v=20260820-5">
-  <link rel="stylesheet" href="/shared/components/controls.css?v=20260827-hel183">
+  <link rel="stylesheet" href="/shared/shell.css?v=20260829-hel237">
+  <link rel="stylesheet" href="/shared/auth.css?v=20260829-hel240b">
+  <link rel="stylesheet" href="/shared/components/controls.css?v=20260829-hel237">
  <link rel="stylesheet" href="/shared/components/navigation.css?v=20260820-1">
  <link rel="stylesheet" href="/shared/components/cards.css?v=20260820-1">
  <link rel="stylesheet" href="/shared/components/tables.css?v=20260820-1">
@@ -57,7 +59,7 @@
  <link rel="stylesheet" href="/pages/review/foundation.css?v=20260820-4">
 </head>
 <body>
-  <section id="authGate" class="auth-gate" aria-label="账号登录">
+  <section id="authGate" class="auth-gate" aria-label="账号登录" hidden>
    <div class="auth-shell">
      <div class="auth-brand">
        <div class="brand-mark" aria-hidden="true"><span class="brand-glyph">复</span></div>
@@ -0,0 +1,95 @@
+<!doctype html>
+<html lang="zh-CN">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="color-scheme" content="light dark">
+  <title>登录 · 小白复盘</title>
+  <script>
+    (() => {
+      let theme = "light";
+      try {
+        const stored = localStorage.getItem("xiaobaiTheme");
+        if (stored === "dark" || stored === "light") theme = stored;
+        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
+      } catch (_error) {
+        theme = "light";
+      }
+      document.documentElement.dataset.theme = theme;
+      document.documentElement.style.colorScheme = theme;
+    })();
+  </script>
+  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-hel240">
+  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
+  <link rel="stylesheet" href="/shared/auth.css?v=20260829-hel243">
+  <link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
+</head>
+<body class="login-portal">
+  <aside class="login-brand" aria-hidden="true">
+    <div class="login-brand-header">
+      <div class="login-brand-mark"><span class="login-brand-glyph">复</span></div>
+      <div class="login-brand-identity">
+        <p class="login-brand-name">小白复盘</p>
+        <p class="login-brand-subtitle">A股个人复盘工作台</p>
+      </div>
+    </div>
+    <div class="login-brand-copy">
+      <p class="login-brand-kicker">收盘之后 · 复盘开始</p>
+      <h1 class="login-brand-title">看懂情绪周期，把复盘变成下一次的先手。</h1>
+      <p class="login-brand-lead">情绪周期、涨停梯队、主题轮动、竞价、龙虎榜、人气榜、交易复盘，集中在一个安静的复盘空间。</p>
+    </div>
+    <div class="login-brand-market">
+      <svg class="login-brand-chart" viewBox="0 0 480 168" focusable="false">
+        <defs>
+          <linearGradient id="loginChartFade" x1="0" x2="0" y1="0" y2="1">
+            <stop offset="0%" stop-color="#d7e4ff" stop-opacity="0.18"></stop>
+            <stop offset="100%" stop-color="#d7e4ff" stop-opacity="0"></stop>
+          </linearGradient>
+        </defs>
+        <path class="login-chart-area" d="M8 118 C 52 108, 78 96, 112 102 S 168 128, 204 112 S 268 78, 312 86 S 372 118, 428 92 L 472 84 L 472 168 L 8 168 Z"></path>
+        <g class="login-candles">
+          <g class="is-up" transform="translate(36 0)"><line x1="8" y1="58" x2="8" y2="128"></line><rect x="2" y="72" width="12" height="40"></rect></g>
+          <g class="is-down" transform="translate(68 0)"><line x1="8" y1="64" x2="8" y2="132"></line><rect x="2" y="86" width="12" height="28"></rect></g>
+          <g class="is-up" transform="translate(100 0)"><line x1="8" y1="48" x2="8" y2="118"></line><rect x="2" y="60" width="12" height="44"></rect></g>
+          <g class="is-down" transform="translate(132 0)"><line x1="8" y1="70" x2="8" y2="136"></line><rect x="2" y="92" width="12" height="26"></rect></g>
+          <g class="is-up" transform="translate(164 0)"><line x1="8" y1="42" x2="8" y2="110"></line><rect x="2" y="54" width="12" height="38"></rect></g>
+          <g class="is-up" transform="translate(196 0)"><line x1="8" y1="36" x2="8" y2="98"></line><rect x="2" y="48" width="12" height="32"></rect></g>
+          <g class="is-down" transform="translate(228 0)"><line x1="8" y1="58" x2="8" y2="128"></line><rect x="2" y="78" width="12" height="36"></rect></g>
+          <g class="is-up" transform="translate(260 0)"><line x1="8" y1="40" x2="8" y2="104"></line><rect x="2" y="52" width="12" height="36"></rect></g>
+          <g class="is-down" transform="translate(292 0)"><line x1="8" y1="66" x2="8" y2="134"></line><rect x="2" y="88" width="12" height="30"></rect></g>
+          <g class="is-up" transform="translate(324 0)"><line x1="8" y1="44" x2="8" y2="112"></line><rect x="2" y="58" width="12" height="40"></rect></g>
+          <g class="is-down" transform="translate(356 0)"><line x1="8" y1="72" x2="8" y2="138"></line><rect x="2" y="96" width="12" height="24"></rect></g>
+          <g class="is-up" transform="translate(388 0)"><line x1="8" y1="38" x2="8" y2="108"></line><rect x="2" y="50" width="12" height="42"></rect></g>
+          <g class="is-up" transform="translate(420 0)"><line x1="8" y1="32" x2="8" y2="96"></line><rect x="2" y="44" width="12" height="34"></rect></g>
+        </g>
+        <path class="login-chart-line" d="M8 118 C 52 108, 78 96, 112 102 S 168 128, 204 112 S 268 78, 312 86 S 372 118, 428 92 L 472 84"></path>
+      </svg>
+      <dl class="login-brand-stats">
+        <div class="login-stat">
+          <dt>市场情绪</dt>
+          <dd>72 <span class="login-stat-tag">高热</span></dd>
+        </div>
+        <div class="login-stat">
+          <dt>涨停</dt>
+          <dd>63</dd>
+        </div>
+        <div class="login-stat">
+          <dt>跌停</dt>
+          <dd>4</dd>
+        </div>
+        <div class="login-stat login-stat-wide">
+          <dt>两市成交</dt>
+          <dd>1.02万亿</dd>
+        </div>
+      </dl>
+    </div>
+    <p class="login-brand-disclaimer">股市有风险，投资需谨慎 · 本工具仅供个人复盘学习使用</p>
+  </aside>
+  <main class="login-stage">
+    <button id="loginThemeToggle" class="login-theme-toggle" type="button">🌙 夜间</button>
+    <section class="login-card" id="loginCard" aria-live="polite"></section>
+  </main>
+  <script src="/shared/api.js?v=20260803-2"></script>
+  <script src="/login/page.js?v=20260829-hel243"></script>
+</body>
+</html>
@@ -0,0 +1,365 @@
+(function bootLoginPortal(global) {
+  "use strict";
+
+  const THEME_KEY = "xiaobaiTheme";
+  const api = global.XiaobaiAPI;
+  const card = document.querySelector("#loginCard");
+  const themeButton = document.querySelector("#loginThemeToggle");
+  const state = {
+    view: "first",
+    mode: "login",
+    accounts: [],
+    currentUserId: null,
+    loading: false,
+    confirmingId: null,
+    error: "",
+    username: "",
+    password: "",
+  };
+
+  function escapeHtml(value) {
+    return String(value ?? "").replace(/[&<>"']/g, (ch) => (
+      { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch]
+    ));
+  }
+
+  function preferredTheme() {
+    try {
+      const stored = global.localStorage.getItem(THEME_KEY);
+      if (stored === "dark" || stored === "light") return stored;
+    } catch (_error) {
+      // Fall through to the system preference.
+    }
+    return global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches
+      ? "dark"
+      : "light";
+  }
+
+  function applyTheme(theme, persist) {
+    const normalized = theme === "dark" ? "dark" : "light";
+    document.documentElement.dataset.theme = normalized;
+    document.documentElement.style.colorScheme = normalized;
+    themeButton.textContent = normalized === "dark" ? "☀ 日间" : "🌙 夜间";
+    themeButton.setAttribute("aria-label", normalized === "dark" ? "切换到日间模式" : "切换到夜间模式");
+    if (persist) {
+      try {
+        global.localStorage.setItem(THEME_KEY, normalized);
+      } catch (_error) {
+        // Theme still applies for the current page when storage is unavailable.
+      }
+    }
+  }
+
+  function setError(message) {
+    state.error = message || "";
+  }
+
+  function formatLastUsed(value) {
+    if (!value) return "";
+    const parsed = new Date(value);
+    if (Number.isNaN(parsed.getTime())) return "";
+    const now = new Date();
+    const hh = String(parsed.getHours()).padStart(2, "0");
+    const mm = String(parsed.getMinutes()).padStart(2, "0");
+    if (parsed.toDateString() === now.toDateString()) return `今天 ${hh}:${mm}`;
+    const yesterday = new Date(now);
+    yesterday.setDate(now.getDate() - 1);
+    if (parsed.toDateString() === yesterday.toDateString()) return `昨天 ${hh}:${mm}`;
+    return `${parsed.getMonth() + 1}月${parsed.getDate()}日`;
+  }
+
+  function chipsFor(account, current) {
+    const chips = [];
+    if (current) chips.push('<span class="login-chip login-chip-current">当前</span>');
+    if (account.role === "admin") chips.push('<span class="login-chip">管理员</span>');
+    if (account.membership?.subscribed) chips.push('<span class="login-chip login-chip-member">会员</span>');
+    else if (account.role !== "admin") chips.push('<span class="login-chip">普通用户</span>');
+    return chips.join("");
+  }
+
+  function returnPath() {
+    const raw = new URLSearchParams(global.location.search).get("next") || "";
+    if (!raw) return "/";
+    try {
+      const url = new URL(raw, global.location.origin);
+      if (url.origin !== global.location.origin) return "/";
+      const path = url.pathname || "/";
+      if (path === "/login" || path.startsWith("/login/")) return "/";
+      return `${path}${url.search}${url.hash}` || "/";
+    } catch (_error) {
+      return "/";
+    }
+  }
+
+  function enterApp() {
+    global.location.replace(returnPath());
+  }
+
+  function formMarkup(options) {
+    const registering = state.mode === "register";
+    const submitLabel = options.submitLabel
+      || (state.loading ? "正在登录..." : registering ? "注册并进入" : options.add ? "添加并进入" : "登录");
+    const lead = options.lead;
+    const hint = options.hint;
+    const invalid = state.error ? " is-invalid" : "";
+    return [
+      options.back
+        ? '<button class="login-back" type="button" data-login-action="picker">返回账号列表</button>'
+        : "",
+      `<h2 class="login-card-title">${escapeHtml(options.title)}</h2>`,
+      `<p class="login-card-lead">${escapeHtml(lead)}</p>`,
+      '<div class="login-tabs" role="tablist">',
+      `<button class="login-tab${state.mode === "login" ? " is-active" : ""}" type="button" data-auth-mode="login">登录</button>`,
+      `<button class="login-tab${state.mode === "register" ? " is-active" : ""}" type="button" data-auth-mode="register">注册</button>`,
+      "</div>",
+      '<form class="login-form" id="loginForm">',
+      `<label class="form-field"><span>账号名</span><input id="loginUsername" type="text" minlength="3" maxlength="30" autocomplete="username" placeholder="请输入账号名" value="${escapeHtml(state.username)}" required></label>`,
+      `<label class="form-field"><span>密码</span><input id="loginPassword" class="${invalid.trim()}" type="password" minlength="8" maxlength="128" autocomplete="${registering ? "new-password" : "current-password"}" placeholder="请输入密码" value="${escapeHtml(state.password)}" required></label>`,
+      `<label class="form-field" id="loginConfirmField"${registering ? "" : " hidden"}><span>确认密码</span><input id="loginPasswordConfirm" type="password" minlength="8" maxlength="128" autocomplete="new-password"${registering ? " required" : ""}></label>`,
+      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : '<p class="login-error" hidden></p>',
+      `<button class="button primary login-submit" type="submit"${state.loading ? " disabled" : ""}>`,
+      state.loading ? '<span class="login-spinner" aria-hidden="true"></span>' : "",
+      `<span>${escapeHtml(submitLabel)}</span></button>`,
+      "</form>",
+      `<p class="login-hint">${escapeHtml(hint)}</p>`,
+    ].join("");
+  }
+
+  function accountRow(account) {
+    const current = Number(account.user_id) === Number(state.currentUserId);
+    const confirming = Number(state.confirmingId) === Number(account.user_id);
+    const managing = state.view === "manage";
+    const classes = [
+      "login-account-row",
+      current ? "is-current" : "",
+      confirming ? "is-confirming" : "",
+      !managing ? "is-switchable" : "",
+    ].filter(Boolean).join(" ");
+    if (managing && confirming) {
+      return [
+        `<div class="${classes}" data-user-id="${account.user_id}">`,
+        `<p class="login-confirm-copy">移除「${escapeHtml(account.username)}」的本机记录？</p>`,
+        '<div class="login-confirm-actions">',
+        `<button class="button danger-button" type="button" data-forget-id="${account.user_id}">移除</button>`,
+        '<button class="button" type="button" data-login-action="cancel-forget">取消</button>',
+        "</div></div>",
+      ].join("");
+    }
+    const glyph = escapeHtml(String(account.username || "账").slice(0, 1));
+    const tone = Number(account.user_id || 0) % 4;
+    const used = formatLastUsed(account.last_used_at);
+    const action = managing
+      ? `<button class="login-account-remove" type="button" data-confirm-id="${account.user_id}" aria-label="移除 ${escapeHtml(account.username)}"><svg width="16" height="16" viewBox="0 0 16 16" aria-hidden="true"><path fill="currentColor" d="M6 2h4l.5 1H14v1H2V3h3.5L6 2zm1 4v6H6V6h1zm3 0v6H9V6h1zM3.5 5H13l-.7 8.2A1.5 1.5 0 0 1 10.81 14H5.19a1.5 1.5 0 0 1-1.49-1.8L3.5 5z"></path></svg></button>`
+      : current
+        ? '<span class="login-account-action"><span class="login-account-check" aria-hidden="true">✓</span>继续使用</span>'
+        : "";
+    const switchAttr = !managing && !current ? ` data-switch-id="${account.user_id}"` : "";
+    const resumeAttr = !managing && current ? ` data-resume-id="${account.user_id}"` : "";
+    return [
+      `<div class="${classes}" data-user-id="${account.user_id}"${switchAttr}${resumeAttr}>`,
+      `<span class="login-avatar tone-${tone}" aria-hidden="true">${glyph}</span>`,
+      '<div class="login-account-meta">',
+      '<div class="login-account-name">',
+      `<strong>${escapeHtml(account.username)}</strong>`,
+      chipsFor(account, current),
+      "</div>",
+      used ? `<span class="login-account-used">上次登录 ${escapeHtml(used)}</span>` : "",
+      "</div>",
+      action,
+      "</div>",
+    ].join("");
+  }
+
+  function pickerMarkup() {
+    const count = state.accounts.length;
+    const managing = state.view === "manage";
+    return [
+      managing
+        ? ""
+        : '<button class="login-back" type="button" data-login-action="resume">返回复盘</button>',
+      `<h2 class="login-card-title">${managing ? "管理账号记录" : "选择账号"}</h2>`,
+      `<p class="login-card-lead">${managing
+        ? "移除只删除这台电脑上的登录记录，不会注销账号"
+        : `这台电脑已记录 ${count} 个账号，点选即可进入，无需再次输入密码。`}</p>`,
+      managing
+        ? '<div class="login-manage-toolbar"><p class="login-manage-hint">点击右侧图标移除对应记录</p><button class="login-manage-done" type="button" data-login-action="picker">完成</button></div>'
+        : "",
+      `<div class="login-account-list">${state.accounts.map(accountRow).join("")}</div>`,
+      managing
+        ? ""
+        : '<button class="login-add" type="button" data-login-action="add">＋ 添加账号</button>',
+      managing
+        ? ""
+        : '<button class="login-manage" type="button" data-login-action="manage">管理已记录的账号</button>',
+      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : "",
+      managing
+        ? '<p class="login-privacy"><span class="login-lock" aria-hidden="true">🔒</span>移除后再次登录该账号需重新输入密码</p>'
+        : '<p class="login-privacy"><span class="login-lock" aria-hidden="true">🔒</span>账号记录仅保存在这台电脑的浏览器中</p>',
+    ].join("");
+  }
+
+  function render() {
+    card.classList.toggle("is-loading", state.loading);
+    if (state.view === "first" || state.view === "add") {
+      card.innerHTML = formMarkup({
+        title: state.view === "add" ? "添加账号" : "欢迎回来",
+        lead: state.view === "add" ? "登录另一个账号，添加后可随时一键切换" : "登录后进入你的复盘空间",
+        hint: state.view === "add"
+          ? "添加后账号会保存在这台电脑，方便随时切换。"
+          : "密码连续输错 5 次将锁定 10 分钟。还没有账号？切换到「注册」创建。",
+        add: state.view === "add",
+        back: state.view === "add",
+      });
+    } else {
+      card.innerHTML = pickerMarkup();
+    }
+    bindCard();
+  }
+
+  function bindCard() {
+    card.querySelectorAll("[data-auth-mode]").forEach((button) => {
+      button.addEventListener("click", () => {
+        state.mode = button.dataset.authMode === "register" ? "register" : "login";
+        setError("");
+        render();
+      });
+    });
+    card.querySelectorAll("[data-login-action]").forEach((button) => {
+      button.addEventListener("click", () => {
+        const action = button.dataset.loginAction;
+        if (action === "resume") {
+          resumeCurrentAccount();
+          return;
+        }
+        if (action === "picker") {
+          state.view = state.accounts.length ? "picker" : "first";
+          state.confirmingId = null;
+        } else if (action === "add") {
+          state.view = "add";
+          state.mode = "login";
+        } else if (action === "manage") {
+          state.view = "manage";
+        } else if (action === "cancel-forget") {
+          state.confirmingId = null;
+        }
+        setError("");
+        render();
+      });
+    });
+    card.querySelectorAll("[data-switch-id]").forEach((button) => {
+      button.addEventListener("click", () => switchAccount(Number(button.dataset.switchId)));
+    });
+    card.querySelectorAll("[data-resume-id]").forEach((button) => {
+      button.addEventListener("click", () => resumeCurrentAccount());
+    });
+    card.querySelectorAll("[data-confirm-id]").forEach((button) => {
+      button.addEventListener("click", (event) => {
+        event.stopPropagation();
+        state.confirmingId = Number(button.dataset.confirmId);
+        render();
+      });
+    });
+    card.querySelectorAll("[data-forget-id]").forEach((button) => {
+      button.addEventListener("click", () => forgetAccount(Number(button.dataset.forgetId)));
+    });
+    const form = card.querySelector("#loginForm");
+    if (form) form.addEventListener("submit", submitCredentials);
+  }
+
+  async function loadAccounts() {
+    const payload = await api.request("/api/auth/accounts");
+    state.accounts = payload.accounts || [];
+    state.currentUserId = payload.current_user_id ?? null;
+    const params = new URLSearchParams(global.location.search);
+    if (params.get("mode") === "register") state.mode = "register";
+    if (params.get("notice")) setError(params.get("notice"));
+    if (state.accounts.length) state.view = "picker";
+    else state.view = "first";
+  }
+
+  async function submitCredentials(event) {
+    event.preventDefault();
+    const username = document.querySelector("#loginUsername").value.trim();
+    const password = document.querySelector("#loginPassword").value;
+    state.username = username;
+    state.password = password;
+    if (state.mode === "register" && password !== document.querySelector("#loginPasswordConfirm").value) {
+      setError("两次输入的密码不一致。");
+      render();
+      return;
+    }
+    state.loading = true;
+    setError("");
+    render();
+    try {
+      await api.request(`/api/auth/${state.mode}`, "POST", { username, password });
+      enterApp();
+    } catch (error) {
+      state.loading = false;
+      setError(error.message || "账号操作失败");
+      render();
+    }
+  }
+
+  async function switchAccount(userId) {
+    state.loading = true;
+    setError("");
+    render();
+    try {
+      await api.request("/api/auth/switch", "POST", { user_id: userId });
+      enterApp();
+    } catch (error) {
+      state.loading = false;
+      setError(error.message || "该账号需重新验证");
+      render();
+    }
+  }
+
+  async function resumeCurrentAccount() {
+    state.loading = true;
+    setError("");
+    render();
+    try {
+      const session = await api.request("/api/auth/me");
+      const sessionUserId = session.user?.id;
+      const matches = Boolean(session.authenticated) && (
+        !state.currentUserId || Number(sessionUserId) === Number(state.currentUserId)
+      );
+      if (!matches) {
+        throw new Error("当前会话已失效，请重新登录");
+      }
+      enterApp();
+    } catch (error) {
+      state.loading = false;
+      setError(error.message || "当前会话已失效，请重新登录");
+      render();
+    }
+  }
+
+  async function forgetAccount(userId) {
+    try {
+      await api.request("/api/auth/forget", "POST", { user_id: userId });
+      state.accounts = state.accounts.filter((item) => Number(item.user_id) !== Number(userId));
+      state.confirmingId = null;
+      if (!state.accounts.length) state.view = "first";
+      setError("");
+      render();
+    } catch (error) {
+      setError(error.message || "移除失败");
+      render();
+    }
+  }
+
+  themeButton.addEventListener("click", () => {
+    applyTheme(document.documentElement.dataset.theme === "dark" ? "light" : "dark", true);
+  });
+  applyTheme(preferredTheme(), false);
+
+  loadAccounts()
+    .then(render)
+    .catch((error) => {
+      setError(error.message || "无法连接本地服务");
+      state.view = "first";
+      render();
+    });
+})(window);
@@ -3174,3 +3174,458 @@
  border-top: 1px solid var(--border);
  transform: translateY(calc(-1 * var(--m-keyboard-inset, 0px)));
 }
+
+.m-sys-lead {
+  margin: 8px 0 12px;
+  font-size: var(--font-size-label);
+  color: var(--text-secondary);
+  line-height: 1.5;
+}
+
+.m-sys-grid {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 8px;
+  margin: 0 0 12px;
+}
+
+.m-sys-grid div {
+  padding: 12px;
+  border-radius: 8px;
+  background: var(--surface-muted);
+}
+
+.m-sys-grid span {
+  display: block;
+  font-size: var(--font-size-label);
+  color: var(--text-tertiary);
+}
+
+.m-sys-grid strong {
+  display: block;
+  margin-top: 4px;
+  font-size: var(--font-size-body);
+  color: var(--text-primary);
+}
+
+.m-sys-home {
+  padding: 0 0 12px;
+  display: flex;
+  flex-direction: column;
+  gap: 8px;
+}
+
+.m-sys-body {
+  padding: 12px 12px 20px;
+  display: flex;
+  flex-direction: column;
+  gap: 12px;
+}
+
+.m-sys-home .m-card,
+.m-sys-body .m-card {
+  margin-left: 0;
+  margin-right: 0;
+}
+
+.m-sys-profile-card {
+  display: flex;
+  gap: 12px;
+  align-items: flex-start;
+  padding: 14px;
+}
+
+.m-sys-avatar {
+  flex: 0 0 auto;
+  width: 48px;
+  height: 48px;
+  border-radius: 50%;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  background: var(--action-soft);
+  color: var(--action);
+  font-size: var(--font-size-page-title);
+  font-weight: 600;
+}
+
+.m-sys-profile-card strong {
+  display: block;
+  font-size: var(--font-size-card-title);
+  color: var(--text-primary);
+}
+
+.m-sys-profile-meta {
+  margin: 4px 0 8px;
+  font-size: var(--font-size-caption);
+  color: var(--text-secondary);
+}
+
+.m-sys-badges {
+  display: flex;
+  flex-wrap: wrap;
+  gap: 6px;
+}
+
+.m-sys-badge {
+  display: inline-flex;
+  align-items: center;
+  height: 22px;
+  padding: 0 8px;
+  border-radius: 999px;
+  font-size: var(--font-size-aux);
+  font-weight: 600;
+  background: var(--surface-muted);
+  color: var(--text-secondary);
+}
+
+.m-sys-badge--admin {
+  background: var(--action-soft);
+  color: var(--action);
+}
+
+.m-sys-badge--ok {
+  background: var(--market-down-soft);
+  color: var(--market-down);
+}
+
+.m-sys-group-title {
+  margin: 4px 0 0;
+  font-size: var(--font-size-caption);
+  font-weight: 600;
+  color: var(--text-tertiary);
+}
+
+.m-sys-list {
+  padding: 0;
+  overflow: hidden;
+}
+
+.m-sys-row {
+  width: 100%;
+  display: flex;
+  align-items: center;
+  gap: 12px;
+  padding: 10px 12px;
+  border: 0;
+  background: transparent;
+  color: inherit;
+  text-align: left;
+  cursor: pointer;
+  -webkit-tap-highlight-color: transparent;
+}
+
+.m-sys-row + .m-sys-row {
+  border-top: 1px solid var(--border);
+}
+
+.m-sys-row:active {
+  background: var(--surface-hover);
+}
+
+.m-sys-row-icon {
+  flex: 0 0 auto;
+  width: 36px;
+  height: 36px;
+  border-radius: 10px;
+  display: inline-flex;
+  align-items: center;
+  justify-content: center;
+  background: var(--action-soft);
+  color: var(--action);
+}
+
+.m-sys-row--danger .m-sys-row-icon {
+  background: var(--market-up-soft);
+  color: var(--market-up);
+}
+
+.m-sys-row-body {
+  flex: 1;
+  min-width: 0;
+}
+
+.m-sys-row-body strong {
+  display: block;
+  font-size: var(--font-size-body);
+  font-weight: 600;
+  color: var(--text-primary);
+}
+
+.m-sys-row-body small {
+  display: block;
+  margin-top: 2px;
+  font-size: var(--font-size-caption);
+  color: var(--text-secondary);
+}
+
+.m-sys-row-chevron {
+  flex: 0 0 auto;
+  color: var(--text-tertiary);
+}
+
+.m-sys-foot {
+  margin: 8px 0 0;
+  text-align: center;
+  font-size: var(--font-size-caption);
+  color: var(--text-tertiary);
+}
+
+.m-sys-notice {
+  padding: 12px;
+  border-radius: 12px;
+  background: var(--surface-muted);
+}
+
+.m-sys-notice p {
+  margin: 0;
+  font-size: var(--font-size-label);
+  color: var(--text-secondary);
+  line-height: 1.55;
+}
+
+.m-sys-notice .m-sys-badges {
+  margin-top: 8px;
+}
+
+.m-sys-section {
+  padding: 12px;
+}
+
+.m-sys-section > strong,
+.m-sys-section-title {
+  display: block;
+  margin-bottom: 10px;
+  font-size: var(--font-size-card-title);
+  color: var(--text-primary);
+}
+
+.m-sys-hint {
+  margin: 8px 0 0;
+  font-size: var(--font-size-caption);
+  color: var(--text-tertiary);
+  line-height: 1.45;
+}
+
+.m-sys-status-list {
+  display: grid;
+  gap: 8px;
+}
+
+.m-sys-status-item {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 8px;
+  font-size: var(--font-size-body);
+  color: var(--text-primary);
+}
+
+.m-sys-dot {
+  width: 8px;
+  height: 8px;
+  border-radius: 50%;
+  background: var(--text-tertiary);
+}
+
+.m-sys-dot--ok {
+  background: var(--market-down);
+}
+
+.m-sys-switch-row {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  gap: 12px;
+}
+
+.m-sys-switch-row strong {
+  display: block;
+  font-size: var(--font-size-body);
+  margin-bottom: 0;
+}
+
+.m-btn-outline,
+.m-btn-outline-danger {
+  width: 100%;
+  height: 44px;
+  display: flex;
+  align-items: center;
+  justify-content: center;
+  gap: 8px;
+  border-radius: 8px;
+  background: var(--surface);
+  font-size: var(--font-size-body);
+  font-weight: 600;
+  cursor: pointer;
+  -webkit-tap-highlight-color: transparent;
+}
+
+.m-btn-outline {
+  border: 1px solid var(--action);
+  color: var(--action);
+}
+
+.m-btn-outline:active {
+  background: var(--action-soft);
+}
+
+.m-btn-outline-danger {
+  border: 1px solid var(--market-up);
+  color: var(--market-up);
+}
+
+.m-btn-outline-danger:active {
+  background: var(--market-up-soft);
+}
+
+.m-btn-outline:disabled,
+.m-btn-outline-danger:disabled {
+  opacity: 0.45;
+  cursor: default;
+  pointer-events: none;
+}
+
+.m-sys-model-card .m-sys-badges,
+.m-sys-user-row .m-sys-badges {
+  margin-top: 6px;
+}
+
+.m-sys-model-card {
+  display: flex;
+  align-items: flex-start;
+  justify-content: space-between;
+  gap: 8px;
+  width: 100%;
+  padding: 12px;
+  border: 0;
+  background: transparent;
+  text-align: left;
+  cursor: pointer;
+}
+
+.m-sys-model-card + .m-sys-model-card {
+  border-top: 1px solid var(--border);
+}
+
+.m-sys-model-card:active {
+  background: var(--surface-hover);
+}
+
+.m-sys-user-row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  padding: 12px;
+}
+
+.m-sys-user-row + .m-sys-user-row {
+  border-top: 1px solid var(--border);
+}
+
+.m-sys-user-row .m-btn-outline {
+  width: auto;
+  height: 32px;
+  padding: 0 12px;
+  flex: 0 0 auto;
+}
+
+.m-sys-pair {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 8px;
+}
+
+.m-sheet-root.is-dialog .m-sheet {
+  display: none;
+}
+
+.m-dialog {
+  position: absolute;
+  left: 50%;
+  top: 42%;
+  width: calc(100% - 48px);
+  max-width: 320px;
+  transform: translate(-50%, -46%) scale(0.96);
+  border-radius: 12px;
+  background: var(--surface);
+  box-shadow: var(--elevation-float);
+  padding: 18px 16px 14px;
+  z-index: 3;
+  opacity: 0;
+  transition: opacity var(--motion-enter) var(--ease-enter),
+              transform var(--motion-enter) var(--ease-enter);
+}
+
+.m-sheet-root.is-open .m-dialog {
+  opacity: 1;
+  transform: translate(-50%, -50%) scale(1);
+}
+
+.m-dialog h2 {
+  margin: 0 0 8px;
+  font-size: var(--font-size-card-title);
+  color: var(--text-primary);
+  text-align: center;
+}
+
+.m-dialog p {
+  margin: 0 0 16px;
+  font-size: var(--font-size-label);
+  color: var(--text-secondary);
+  line-height: 1.5;
+  text-align: center;
+}
+
+.m-dialog-actions {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 8px;
+}
+
+.m-dialog-actions .m-btn-outline,
+.m-dialog-actions .m-btn-outline-danger,
+.m-dialog-actions .m-btn-primary {
+  height: 40px;
+}
+
+.m-sys-sheet-actions {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 8px;
+  margin-top: 12px;
+}
+
+.m-sys-test-row {
+  display: flex;
+  align-items: center;
+  gap: 10px;
+  margin: 8px 0 12px;
+}
+
+.m-sys-test-row .m-btn-outline {
+  width: auto;
+  flex: 0 0 auto;
+  height: 36px;
+  padding: 0 12px;
+}
+
+.m-sys-test-row [data-model-test-status] {
+  flex: 1;
+  font-size: var(--font-size-caption);
+  color: var(--text-secondary);
+}
+
+.m-sys-hero {
+  padding: 14px;
+}
+
+.m-sys-hero strong {
+  display: block;
+  font-size: var(--font-size-page-title);
+  margin-bottom: 6px;
+}
+
+.m-page[data-page^="system/"] .m-card {
+  margin-bottom: 0;
+}
@@ -246,6 +246,29 @@ body {
  padding-top: 8px;
 }

+.m-auth-accounts {
+  display: grid;
+  gap: 8px;
+  margin-bottom: 16px;
+}
+
+.m-auth-account {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  min-height: 48px;
+  padding: 0 14px;
+  border: 1px solid var(--border);
+  border-radius: 10px;
+  background: var(--surface);
+  color: var(--text-primary);
+}
+
+.m-auth-account span {
+  color: var(--action);
+  font-size: var(--font-size-label);
+}
+
 .m-auth-brand {
  text-align: center;
  margin: 24px 0 20px;
@@ -313,7 +336,8 @@ body {
  color: var(--text-secondary);
 }

-.m-form-field input {
+.m-form-field input,
+.m-form-field select {
  height: 44px;
  padding: 0 12px;
  border: 1px solid var(--border-strong);
@@ -323,11 +347,20 @@ body {
  font-size: 14px;
 }

-.m-form-field input:focus {
+.m-form-field input:focus,
+.m-form-field select:focus {
  outline: none;
  border-color: var(--action);
 }

+.m-form-field input[type="checkbox"] {
+  width: 22px;
+  height: 22px;
+  padding: 0;
+  border: none;
+  background: transparent;
+}
+
 .m-auth-error {
  margin: 0 0 12px;
  padding: 10px 12px;
@@ -15,7 +15,9 @@
      (() => {
        let theme = "light";
        try {
-          theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
+          const stored = localStorage.getItem("xiaobaiTheme");
+          if (stored === "dark" || stored === "light") theme = stored;
+          else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
        } catch (_error) {
          theme = "light";
        }
@@ -5,10 +5,15 @@

  function readTheme() {
    try {
-      return global.localStorage.getItem(THEME_KEY) === "dark" ? "dark" : "light";
+      const stored = global.localStorage.getItem(THEME_KEY);
+      if (stored === "dark" || stored === "light") return stored;
    } catch (_error) {
      return "light";
    }
+    if (global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches) {
+      return "dark";
+    }
+    return "light";
  }

  function applyTheme(theme) {
@@ -187,9 +187,9 @@
    const dark = document.getElementById("m-app").dataset.theme === "dark";
    const toggle = document.querySelector("[data-theme-toggle]");
    if (toggle) toggle.setAttribute("aria-checked", dark ? "true" : "false");
-    const rowIcon = document.querySelector(".m-theme-row-icon");
+    const rowIcon = document.querySelector(".m-theme-row-icon, [data-theme-row-icon]");
    if (rowIcon) rowIcon.innerHTML = icon(dark ? "moon" : "sun");
-    const rowBodySmall = document.querySelector(".m-theme-row-body small");
+    const rowBodySmall = document.querySelector(".m-theme-row-body small, [data-theme-row-label]");
    if (rowBodySmall) rowBodySmall.textContent = dark ? "当前：夜间模式" : "当前：日间模式";
  }

@@ -206,6 +206,10 @@
      replace(DEFAULT_HASH);
      return;
    }
+    if (key === "system" && global.MobilePages && typeof global.MobilePages.renderSystemHome === "function") {
+      global.MobilePages.renderSystemHome();
+      return;
+    }
    const items = visibleHubItems(hub);
    updateHeader({ title: hub.title, back: false });
    const section = key === "system" ? themeToggleSection() : "";
@@ -250,6 +254,7 @@
      '<h2>小白复盘</h2>',
      '<p>登录后进入你的复盘空间</p>',
      "</div>",
+      '<div class="m-auth-accounts" id="m-auth-accounts" hidden></div>',
      '<div class="m-auth-tabs">',
      '<button class="m-auth-tab active" type="button" data-auth-mode="login">登录</button>',
      '<button class="m-auth-tab" type="button" data-auth-mode="register">注册</button>',
@@ -265,6 +270,7 @@
    ].join("");
    authMode = "login";
    bindAuth();
+    loadMobileAccounts();
  }

  function setAuthMode(mode) {
@@ -287,6 +293,34 @@
    document.getElementById("m-auth-form").addEventListener("submit", submitAuth);
  }

+  async function loadMobileAccounts() {
+    const host = document.getElementById("m-auth-accounts");
+    if (!host || !global.MobileSession.listAccounts) return;
+    try {
+      const payload = await global.MobileSession.listAccounts();
+      const accounts = payload.accounts || [];
+      if (!accounts.length) return;
+      host.hidden = false;
+      host.innerHTML = accounts.map(function (account) {
+        return '<button class="m-auth-account" type="button" data-switch-id="' + account.user_id + '">' +
+          '<strong>' + escapeHtml(account.username) + '</strong>' +
+          '<span>直接进入</span></button>';
+      }).join("");
+      host.querySelectorAll("[data-switch-id]").forEach(function (button) {
+        button.addEventListener("click", async function () {
+          try {
+            await global.MobileSession.switchAccount(Number(button.dataset.switchId));
+            replace(DEFAULT_HASH);
+          } catch (error) {
+            showAuthError(document.getElementById("m-auth-error"), error.message || "该账号需重新验证");
+          }
+        });
+      });
+    } catch (_error) {
+      host.hidden = true;
+    }
+  }
+
  function showAuthError(element, message) {
    element.textContent = message;
    element.classList.remove("m-motion-fade-in");
@@ -47,5 +47,30 @@
    return Boolean(state.user && state.user.role === "admin");
  }

-  global.MobileSession = { state: state, me: me, login: login, register: register, logout: logout, isAdmin: isAdmin };
+  async function listAccounts() {
+    return global.MobileAPI.request("/api/auth/accounts");
+  }
+
+  async function switchAccount(userId) {
+    const payload = await global.MobileAPI.request("/api/auth/switch", "POST", {
+      user_id: userId
+    });
+    return applySession(payload);
+  }
+
+  async function forgetAccount(userId) {
+    await global.MobileAPI.request("/api/auth/forget", "POST", { user_id: userId });
+  }
+
+  global.MobileSession = {
+    state: state,
+    me: me,
+    login: login,
+    register: register,
+    logout: logout,
+    listAccounts: listAccounts,
+    switchAccount: switchAccount,
+    forgetAccount: forgetAccount,
+    isAdmin: isAdmin
+  };
 })(window);
@@ -95,7 +95,7 @@
    "/shared/table.js?v=20260803-1",
    "/shared/theme.js?v=20260803-1",
    "/shared/dashboard.js?v=20260820-1",
-    "/shared/session.js?v=20260803-1",
+    "/shared/session.js?v=20260829-hel243",
    "/shared/admin.js?v=20260803-1",
    "/app.js?v=20260803-2",
  ];
@@ -1011,9 +1011,9 @@

  border-radius: 6px;

-  background: var(--r2-ink);
+  background: var(--sentiment-tooltip-bg);

-  color: var(--text-inverse);
+  color: var(--sentiment-tooltip-fg);

  font-size: 11px;

@@ -1021,6 +1021,8 @@
 }

 .sentiment-chart-tooltip b {
+  color: inherit;
+
  font-weight: 700;
 }

@@ -1568,10 +1570,6 @@
  #sentimentCycleView .sentiment-component-item {
    padding: 4px 0px;
  }
-
-  #sentimentCycleView .sentiment-component-item small {
-    display: none;
-  }
 }

@media (min-width: 768px) {
@@ -1764,3 +1762,72 @@
    grid-template-columns: repeat(2, minmax(0, 1fr));
  }
 }
+
+@media (min-width: 1024px) {
+  #sentimentCycleView .redesigned-emotion-grid {
+    align-items: stretch;
+
+    height: var(--sentiment-analysis-height);
+
+    max-height: var(--sentiment-analysis-height);
+
+    overflow: hidden;
+  }
+
+  .redesigned-sentiment-view .sentiment-analysis-main,
+  .redesigned-sentiment-view .sentiment-analysis-rail {
+    align-self: stretch;
+
+    height: 100%;
+
+    min-height: 0px;
+  }
+
+  .redesigned-sentiment-view .sentiment-trend-panel {
+    display: flex;
+
+    flex: 1 1 auto;
+
+    flex-direction: column;
+
+    min-height: 0px;
+  }
+
+  .redesigned-sentiment-view .sentiment-chart-shell {
+    flex: 1 1 auto;
+
+    height: auto;
+
+    min-height: 0px;
+  }
+
+  .redesigned-sentiment-view .sentiment-chart-shell canvas {
+    height: 100%;
+  }
+
+  .redesigned-sentiment-view .sentiment-cycle-summary {
+    flex: 0 0 auto;
+  }
+
+  .redesigned-sentiment-view .sentiment-components-panel {
+    display: flex;
+
+    flex: 1 1 auto;
+
+    flex-direction: column;
+
+    min-height: 0px;
+  }
+
+  .redesigned-sentiment-view .sentiment-component-list {
+    display: flex;
+
+    flex: 1 1 auto;
+
+    flex-direction: column;
+
+    justify-content: space-evenly;
+
+    min-height: 0px;
+  }
+}
@@ -1,10 +1,39 @@
 let sentimentChartAnimationFrame = null;
+let sentimentChartResizeObserver = null;
+let sentimentChartLastSize = "";

 window.XiaobaiPageModules.register("sentiment", ["sentimentCycleView"], {
  bind: bindSentimentEvents,
  enter: ["loadSentiment"],
 });

+function sentimentChartSizeKey(target) {
+  if (!target) return "";
+  const rect = target.getBoundingClientRect();
+  return `${Math.round(rect.width)}x${Math.round(rect.height)}x${window.devicePixelRatio || 1}`;
+}
+
+function observeSentimentTrendChart() {
+  const shell = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
+  if (!shell) return;
+  if (!sentimentChartResizeObserver) {
+    sentimentChartResizeObserver = new ResizeObserver(() => {
+      if (sentimentChartAnimationFrame) return;
+      if (state.activeView !== "sentimentCycleView") return;
+      const rows = state.sentimentHistory?.rows;
+      if (!rows?.length) return;
+      const current = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
+      const nextKey = sentimentChartSizeKey(current);
+      if (!nextKey || nextKey === sentimentChartLastSize) return;
+      drawSentimentTrendChart(rows, 1);
+    });
+  } else {
+    sentimentChartResizeObserver.disconnect();
+  }
+  sentimentChartLastSize = sentimentChartSizeKey(shell);
+  sentimentChartResizeObserver.observe(shell);
+}
+
 async function loadSentimentHistory(force = false) {
  if (!state.dashboard || state.sentimentLoading) return;
  const key = `${elements.tradeDate.value}:${state.sentimentRange}`;
@@ -126,6 +155,7 @@ function animateSentimentTrendChart(rows) {
  if (sentimentChartAnimationFrame) cancelAnimationFrame(sentimentChartAnimationFrame);
  if (!motionEnabled()) {
    drawSentimentTrendChart(rows, 1);
+    observeSentimentTrendChart();
    return;
  }
  const startedAt = performance.now();
@@ -135,7 +165,10 @@ function animateSentimentTrendChart(rows) {
    const progress = 1 - (1 - rawProgress) ** 3;
    drawSentimentTrendChart(rows, progress);
    if (rawProgress < 1) sentimentChartAnimationFrame = requestAnimationFrame(frame);
-    else sentimentChartAnimationFrame = null;
+    else {
+      sentimentChartAnimationFrame = null;
+      observeSentimentTrendChart();
+    }
  };
  sentimentChartAnimationFrame = requestAnimationFrame(frame);
 }
@@ -144,9 +177,9 @@ function drawSentimentTrendChart(rows, progress = 1) {
  const canvas = document.querySelector("#sentimentTrendChart");
  if (!canvas || !rows.length || state.activeView !== "sentimentCycleView") return;
  const rect = canvas.getBoundingClientRect();
-  if (!rect.width) return;
-  const width = Math.max(320, rect.width);
-  const height = Math.max(220, rect.height);
+  if (rect.width < 8 || rect.height < 8) return;
+  const width = rect.width;
+  const height = rect.height;
  const ratio = window.devicePixelRatio || 1;
  canvas.width = Math.round(width * ratio);
  canvas.height = Math.round(height * ratio);
@@ -258,6 +291,7 @@ function drawSentimentTrendChart(rows, progress = 1) {
    const dateText = displayCompactDate(row.trade_date).slice(5);
    context.fillText(dateText, x(index), height - padding.bottom + 10);
  });
+  sentimentChartLastSize = sentimentChartSizeKey(canvas.closest(".sentiment-chart-shell"));
 }

 function bindSentimentChartTooltip(rows) {
@@ -1693,3 +1693,784 @@ button.account-role-badge:focus-visible {
    display: inline-flex;
  }
 }
+
+
+body.login-portal {
+  padding-bottom: 0;
+}
+
+.login-portal {
+  min-height: 100vh;
+
+  display: flex;
+
+  background: var(--canvas);
+
+  color: var(--text-primary);
+}
+
+.login-stage {
+  position: relative;
+
+  flex: 1 1 auto;
+
+  display: grid;
+
+  place-items: center;
+
+  padding: 48px 24px;
+}
+
+.login-theme-toggle {
+  position: absolute;
+
+  z-index: 2;
+
+  top: 16px;
+
+  right: 20px;
+
+  min-height: 32px;
+
+  padding: 0 12px;
+
+  border: 1px solid var(--border-strong);
+
+  border-radius: var(--size-radius-md);
+
+  background: var(--surface);
+
+  color: var(--text-secondary);
+
+  font-size: var(--font-size-label);
+
+  cursor: pointer;
+}
+
+.login-brand {
+  position: relative;
+
+  display: flex;
+
+  flex-direction: column;
+
+  width: var(--login-brand-share);
+
+  min-width: var(--login-brand-min);
+
+  max-width: var(--login-brand-cap);
+
+  flex: 0 0 var(--login-brand-share);
+
+  overflow: hidden;
+
+  padding: var(--login-brand-pad);
+
+  background: var(--login-brand-gradient);
+
+  color: #f4f7ff;
+}
+
+.login-brand-header {
+  display: flex;
+
+  align-items: center;
+
+  gap: 12px;
+}
+
+.login-brand-mark {
+  display: flex;
+
+  flex: 0 0 var(--login-brand-mark-size);
+
+  align-items: center;
+
+  justify-content: center;
+
+  width: var(--login-brand-mark-size);
+
+  height: var(--login-brand-mark-size);
+
+  border-radius: 12px;
+
+  background: rgba(255, 255, 255, 0.12);
+}
+
+.login-brand-glyph {
+  font-size: 20px;
+
+  font-weight: var(--font-weight-semibold);
+}
+
+.login-brand-identity {
+  display: grid;
+
+  gap: 2px;
+}
+
+.login-brand-name {
+  margin: 0;
+
+  font-size: var(--login-brand-name-size);
+
+  font-weight: var(--font-weight-semibold);
+}
+
+.login-brand-subtitle {
+  margin: 0;
+
+  font-size: var(--font-size-caption);
+
+  letter-spacing: 0.02em;
+
+  opacity: 0.72;
+}
+
+.login-brand-copy {
+  display: flex;
+
+  flex: 1 1 auto;
+
+  flex-direction: column;
+
+  justify-content: flex-end;
+
+  padding: 24px 0 20px;
+}
+
+.login-brand-kicker {
+  display: inline-flex;
+
+  align-self: flex-start;
+
+  margin: 0 0 14px;
+
+  padding: 4px 10px;
+
+  border: 1px solid rgba(255, 255, 255, 0.18);
+
+  border-radius: 999px;
+
+  font-size: var(--font-size-caption);
+
+  letter-spacing: 0.08em;
+
+  opacity: 0.86;
+}
+
+.login-brand-title {
+  margin: 0;
+
+  max-width: 12.4em;
+
+  font-size: var(--login-hero-size);
+
+  font-weight: var(--font-weight-semibold);
+
+  line-height: 1.35;
+}
+
+.login-brand-lead {
+  margin: 12px 0 0;
+
+  max-width: 28em;
+
+  font-size: var(--font-size-label);
+
+  line-height: 1.7;
+
+  opacity: 0.78;
+}
+
+.login-brand-market {
+  position: relative;
+
+  min-height: 168px;
+}
+
+.login-brand-chart {
+  display: block;
+
+  width: 100%;
+
+  height: 168px;
+}
+
+.login-chart-area {
+  fill: url(#loginChartFade);
+}
+
+.login-chart-line {
+  fill: none;
+
+  stroke: var(--login-trend-line);
+
+  stroke-width: 2;
+
+  stroke-linecap: round;
+
+  stroke-linejoin: round;
+}
+
+.login-candles line {
+  stroke-width: 1.5;
+}
+
+.login-candles .is-up line,
+.login-candles .is-up rect {
+  fill: var(--login-candle-up);
+
+  stroke: var(--login-candle-up);
+}
+
+.login-candles .is-down line,
+.login-candles .is-down rect {
+  fill: var(--login-candle-down);
+
+  stroke: var(--login-candle-down);
+}
+
+.login-brand-stats {
+  position: absolute;
+
+  right: 0;
+
+  bottom: 18px;
+
+  left: 0;
+
+  display: flex;
+
+  flex-wrap: wrap;
+
+  gap: 8px;
+
+  margin: 0;
+}
+
+.login-stat {
+  display: flex;
+
+  align-items: baseline;
+
+  gap: 6px;
+
+  margin: 0;
+
+  padding: 6px 10px;
+
+  border-radius: 999px;
+
+  background: var(--login-stat-chip-bg);
+}
+
+.login-stat dt {
+  color: rgba(244, 247, 255, 0.64);
+
+  font-size: var(--font-size-caption);
+}
+
+.login-stat dd {
+  margin: 0;
+
+  font-size: var(--font-size-body);
+
+  font-weight: var(--font-weight-semibold);
+}
+
+.login-stat:nth-child(1) dd {
+  color: #f0b45a;
+}
+
+.login-stat:nth-child(2) dd {
+  color: var(--login-candle-up);
+}
+
+.login-stat:nth-child(3) dd {
+  color: var(--login-candle-down);
+}
+
+.login-stat-tag {
+  margin-left: 4px;
+
+  font-size: var(--font-size-caption);
+
+  font-weight: var(--font-weight-regular);
+}
+
+.login-brand-disclaimer {
+  margin: 12px 0 0;
+
+  font-size: var(--font-size-aux);
+
+  letter-spacing: 0.02em;
+
+  opacity: 0.48;
+}
+
+.login-card {
+  width: var(--login-card-width);
+
+  max-width: calc(100vw - 48px);
+
+  padding: var(--login-card-pad);
+
+  border: 1px solid var(--border-strong);
+
+  border-radius: var(--size-radius-dialog);
+
+  background: var(--surface);
+
+  box-shadow: var(--shadow-raised);
+}
+
+.login-card.is-loading .login-form {
+  pointer-events: none;
+
+  opacity: 0.72;
+}
+
+.login-card-title {
+  margin: 0;
+
+  font-size: var(--login-card-title-size);
+
+  font-weight: var(--font-weight-semibold);
+}
+
+.login-card-lead {
+  margin: 8px 0 0;
+
+  color: var(--text-secondary);
+
+  font-size: var(--font-size-label);
+
+  line-height: 1.6;
+}
+
+.login-tabs {
+  display: grid;
+
+  grid-template-columns: 1fr 1fr;
+
+  margin-top: 24px;
+
+  border-bottom: 1px solid var(--line);
+}
+
+.login-tab {
+  min-height: 40px;
+
+  border: 0;
+
+  border-bottom: 2px solid transparent;
+
+  background: transparent;
+
+  color: var(--text-secondary);
+
+  cursor: pointer;
+}
+
+.login-tab.is-active {
+  border-bottom-color: var(--action);
+
+  color: var(--action);
+
+  font-weight: var(--font-weight-medium);
+}
+
+.login-form {
+  display: grid;
+
+  gap: 14px;
+
+  margin-top: 20px;
+}
+
+.login-portal .form-field input.is-invalid {
+  border-color: var(--danger);
+}
+
+.login-submit {
+  width: 100%;
+
+  min-height: var(--login-submit-height);
+}
+
+.login-spinner {
+  width: 14px;
+
+  height: 14px;
+
+  border: 2px solid currentColor;
+
+  border-right-color: transparent;
+
+  border-radius: 50%;
+
+  animation: login-spin 0.7s linear infinite;
+}
+
+@keyframes login-spin {
+  to {
+    transform: rotate(360deg);
+  }
+}
+
+.login-error {
+  margin: 0;
+
+  color: var(--danger);
+
+  font-size: var(--font-size-caption);
+}
+
+.login-error[hidden] {
+  display: none;
+}
+
+.login-hint,
+.login-privacy {
+  margin: 16px 0 0;
+
+  color: var(--text-tertiary);
+
+  font-size: var(--font-size-caption);
+
+  line-height: 1.6;
+}
+
+.login-portal .login-privacy {
+  display: flex;
+
+  align-items: center;
+
+  gap: 6px;
+}
+
+.login-lock {
+  font-size: 12px;
+}
+
+.login-back,
+.login-manage {
+  border: 0;
+
+  background: transparent;
+
+  color: var(--action);
+
+  cursor: pointer;
+}
+
+.login-portal .login-back {
+  margin-bottom: 12px;
+
+  padding: 0;
+
+  font-size: var(--font-size-label);
+}
+
+.login-portal .login-add {
+  display: flex;
+
+  align-items: center;
+
+  justify-content: center;
+
+  width: 100%;
+
+  min-height: 44px;
+
+  margin-top: 12px;
+
+  border: 1px dashed var(--border-strong);
+
+  border-radius: var(--size-radius-md);
+
+  background: transparent;
+
+  color: var(--action);
+
+  cursor: pointer;
+}
+
+.login-portal .login-manage {
+  display: block;
+
+  width: 100%;
+
+  min-height: 36px;
+
+  margin-top: 8px;
+
+  padding: 0;
+
+  text-align: center;
+
+  color: var(--text-secondary);
+}
+
+.login-manage-toolbar {
+  display: flex;
+
+  align-items: center;
+
+  justify-content: space-between;
+
+  gap: 12px;
+
+  margin-top: 16px;
+}
+
+.login-manage-hint {
+  margin: 0;
+
+  color: var(--text-tertiary);
+
+  font-size: var(--font-size-caption);
+}
+
+.login-manage-done {
+  border: 0;
+
+  background: transparent;
+
+  color: var(--action);
+
+  cursor: pointer;
+}
+
+.login-account-list {
+  display: grid;
+
+  gap: 10px;
+
+  margin-top: 20px;
+}
+
+.login-account-row {
+  display: grid;
+
+  grid-template-columns: auto minmax(0, 1fr) auto;
+
+  align-items: center;
+
+  gap: 12px;
+
+  min-height: var(--login-account-row-min);
+
+  padding: 10px 14px;
+
+  border: 1px solid var(--border);
+
+  border-radius: var(--size-radius-md);
+
+  background: var(--surface);
+}
+
+.login-account-row.is-switchable {
+  cursor: pointer;
+}
+
+.login-account-row.is-current {
+  border-color: var(--action);
+}
+
+.login-account-row.is-confirming {
+  display: grid;
+
+  grid-template-columns: minmax(0, 1fr);
+
+  gap: 10px;
+
+  padding: 12px 14px;
+
+  border-color: var(--danger);
+}
+
+.login-avatar {
+  display: grid;
+
+  place-items: center;
+
+  width: var(--login-account-avatar);
+
+  height: var(--login-account-avatar);
+
+  border-radius: 50%;
+
+  color: #fff;
+
+  font-size: var(--font-size-body);
+
+  font-weight: var(--font-weight-semibold);
+}
+
+.login-avatar.tone-0 {
+  background: var(--action);
+}
+
+.login-avatar.tone-1 {
+  background: var(--market-up);
+}
+
+.login-avatar.tone-2 {
+  background: var(--market-down);
+}
+
+.login-avatar.tone-3 {
+  background: var(--warning);
+}
+
+.login-account-meta {
+  display: grid;
+
+  gap: 4px;
+
+  min-width: 0;
+}
+
+.login-account-name {
+  display: flex;
+
+  flex-wrap: wrap;
+
+  align-items: center;
+
+  gap: 6px;
+}
+
+.login-account-meta strong {
+  font-weight: var(--font-weight-medium);
+}
+
+.login-account-used {
+  color: var(--text-tertiary);
+
+  font-size: var(--font-size-caption);
+}
+
+.login-chip {
+  display: inline-flex;
+
+  align-items: center;
+
+  min-height: 18px;
+
+  padding: 0 6px;
+
+  border-radius: 999px;
+
+  background: var(--surface-muted);
+
+  color: var(--text-secondary);
+
+  font-size: var(--font-size-aux);
+}
+
+.login-chip-current {
+  background: var(--action-soft);
+
+  color: var(--action);
+}
+
+.login-chip-member {
+  background: var(--warning-soft);
+
+  color: var(--warning);
+}
+
+.login-account-check {
+  color: var(--action);
+
+  font-size: 16px;
+}
+
+.login-account-action {
+  display: grid;
+
+  justify-items: end;
+
+  gap: 2px;
+
+  color: var(--action);
+
+  font-size: var(--font-size-caption);
+}
+
+.login-account-remove {
+  display: grid;
+
+  place-items: center;
+
+  width: 28px;
+
+  height: 28px;
+
+  border: 0;
+
+  background: transparent;
+
+  color: var(--text-tertiary);
+
+  cursor: pointer;
+}
+
+.login-account-remove:hover {
+  color: var(--danger);
+}
+
+.login-confirm-copy {
+  margin: 0;
+
+  font-size: var(--font-size-label);
+}
+
+.login-confirm-actions {
+  display: flex;
+
+  gap: 8px;
+}
+
+@media (min-width: 1921px) {
+  .login-brand {
+    width: var(--login-brand-wide-share);
+
+    min-width: var(--login-brand-cap);
+
+    max-width: none;
+
+    flex-basis: var(--login-brand-wide-share);
+  }
+}
+
+@media (max-width: 900px) {
+  .login-portal {
+    flex-direction: column;
+  }
+
+  .login-brand {
+    width: 100%;
+
+    min-width: 0;
+
+    max-width: none;
+
+    flex-basis: auto;
+
+    padding: 20px 20px 16px;
+  }
+
+  .login-brand-copy,
+  .login-brand-market,
+  .login-brand-disclaimer {
+    display: none;
+  }
+
+  .login-stage {
+    padding: 28px 16px 40px;
+  }
+}
@@ -53,12 +53,10 @@ async function applyAuthenticatedSession(session) {
 function showAuthGate(message = "") {
  state.user = null;
  state.csrfToken = "";
-  const gate = document.querySelector("#authGate");
-  gate.hidden = false;
-  const errorElement = document.querySelector("#authError");
-  errorElement.textContent = message;
-  errorElement.hidden = !message;
-  document.querySelector("#authUsername").focus();
+  const params = new URLSearchParams();
+  if (message) params.set("notice", message);
+  const query = params.toString();
+  window.location.replace("/login/" + (query ? `?${query}` : ""));
 }

 async function logoutAccount() {
@@ -197,16 +195,14 @@ async function changeAccountPassword(event) {
 }

 async function switchAccount() {
-  const button = document.querySelector("#switchAccountMenuButton");
-  button.disabled = true;
  toggleAccountDropdown(false);
-  try {
-    await apiRequest("/api/auth/logout", "POST", {});
-    window.location.reload();
-  } catch (error) {
-    showToast(error.message || "切换账号失败");
-    button.disabled = false;
+  const params = new URLSearchParams();
+  const next = `${window.location.pathname}${window.location.search}${window.location.hash}`;
+  if (next.startsWith("/") && !next.startsWith("//") && next !== "/login" && !next.startsWith("/login/") && !next.startsWith("/login?")) {
+    params.set("next", next);
  }
+  const query = params.toString();
+  window.location.assign("/login/" + (query ? `?${query}` : ""));
 }


@@ -146,6 +146,25 @@
  --shadow-float: var(--elevation-float);
  --duration-fast: 150ms;
  --duration-normal: 220ms;
+  --login-brand-gradient: linear-gradient(165deg, #0c1e4a, #16307c, #2153cc);
+  --login-brand-share: 34%;
+  --login-brand-min: 420px;
+  --login-brand-cap: 560px;
+  --login-brand-wide-share: 29.2%;
+  --login-brand-pad: 36px 40px 24px;
+  --login-brand-mark-size: 44px;
+  --login-brand-name-size: 16px;
+  --login-hero-size: 28px;
+  --login-card-width: 408px;
+  --login-card-pad: 32px;
+  --login-card-title-size: 22px;
+  --login-account-row-min: 72px;
+  --login-account-avatar: 40px;
+  --login-submit-height: 40px;
+  --login-stat-chip-bg: rgba(8, 12, 24, 0.48);
+  --login-candle-up: #e07078;
+  --login-candle-down: #3db88a;
+  --login-trend-line: rgba(244, 247, 255, 0.88);

  --font-size-aux: 11.5px;
  --font-size-caption: 12.5px;
@@ -210,6 +229,9 @@
  --pool-table-max-height: calc(var(--content-height) - var(--topbar-height) - var(--page-pad-y) - var(--page-pad-y) - var(--card-gap));
  --sentiment-history-max-height: 510px;
  --sentiment-history-min-height: 220px;
+  --sentiment-analysis-height: 600px;
+  --sentiment-tooltip-bg: var(--text-primary);
+  --sentiment-tooltip-fg: var(--text-inverse);
  --primary-share: 1.45fr;
  --secondary-share: .75fr;
  --mobile-nav-height: 64px;
@@ -505,10 +527,17 @@
  --chart-repair: #e2ad58;
  --chart-ma-10: #d39a45;
  --chart-ma-20: #9aa5af;
+  --sentiment-tooltip-bg: #26293e;
+  --sentiment-tooltip-fg: #e8eaed;
  --on-action: #101418;
  --warning-line: #6d5a38;
  --warning-line-strong: #66502d;
  --control-shadow: 0 1px 3px rgba(0, 0, 0, .3);
+  --login-brand-gradient: linear-gradient(165deg, #080c18, #0e1730, #14224a);
+  --login-stat-chip-bg: rgba(6, 8, 16, 0.58);
+  --login-candle-up: #f06d73;
+  --login-candle-down: #43bc8a;
+  --login-trend-line: rgba(232, 236, 244, 0.9);
  --dialog-backdrop: var(--backdrop);
  --ladder-level-1: #2d2426;
  --ladder-level-2: #2b2822;
@@ -47,6 +47,72 @@ function session(role = "admin", subscribed = true) {
  };
 }

+function sentimentHistoryPayload(days = 20) {
+  const phases = ["冰点", "修复", "发酵", "高潮", "分化", "退潮"];
+  const rows = Array.from({ length: days }, (_, index) => {
+    const score = 28 + ((index * 7) % 55);
+    return {
+      trade_date: `2026-08-${String(index + 1).padStart(2, "0")}`,
+      score,
+      label: "情绪观察",
+      phase: phases[index % phases.length],
+      direction: index % 2 ? "升温" : "降温",
+      day_change: index % 2 ? 3.2 : -2.1,
+      seal_rate: 71.5,
+      limit_up_count: 40 + index,
+      first_board_count: 18,
+      second_board_count: 8,
+      three_plus_count: 4,
+      max_height: 5,
+      broken_count: 12,
+      limit_down_count: 3,
+      previous_limit_count: 38,
+      previous_positive_count: 22,
+      previous_positive_rate: 57.9,
+      average_previous_change: 1.2,
+      normalization: "固定锚点",
+      components: {
+        breadth: { label: "市场宽度", score: 55.8, weight: 20, summary: "红盘家数回升" },
+        limit: { label: "涨停连板", score: 79.6, weight: 25, summary: "连板生态改善" },
+        profit: { label: "赚钱效应", score: 67.0, weight: 30, summary: "昨日反馈尚可" },
+        ladder: { label: "涨幅结构", score: 81.5, weight: 15, summary: "高度仍在扩张" },
+        amount: { label: "成交活跃度", score: 46.1, weight: 10, summary: "量能略低于均值" },
+      },
+    };
+  });
+  return { available_days: days, rows };
+}
+
+async function renderSentimentFixture(page, days = 20) {
+  await page.evaluate((payload) => {
+    state.sentimentHistory = payload;
+    renderSentimentHistory();
+  }, sentimentHistoryPayload(days));
+  await page.locator('[data-view="sentimentCycleView"]').first().click();
+  await page.waitForTimeout(900);
+}
+
+function readSentimentLayout() {
+  const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
+  const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
+  const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
+  const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
+  const chart = document.querySelector(".sentiment-chart-shell").getBoundingClientRect();
+  const detail = document.querySelector(".sentiment-detail-toolbar").getBoundingClientRect();
+  const table = document.querySelector(".sentiment-history-frame").getBoundingClientRect();
+  const small = document.querySelector(".sentiment-component-item small");
+  return {
+    topDelta: Math.abs(trend.top - summary.top),
+    bottomDelta: Math.abs(trend.bottom - components.bottom),
+    analysisHeight: analysis.height,
+    chartHeight: chart.height,
+    detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom) - 0.5,
+    tableVisible: table.top < window.innerHeight && table.bottom > detail.bottom,
+    smallVisible: small ? getComputedStyle(small).display !== "none" : false,
+    overflowX: document.documentElement.scrollWidth > document.documentElement.clientWidth + 1,
+  };
+}
+
 function waitForApplicationRuntime(page) {
  return expect(page.locator("body")).toHaveAttribute("data-runtime-ready", "true");
 }
@@ -721,6 +787,7 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  await expect(page.locator(".sentiment-stage-guide, [data-sentiment-stage]")).toHaveCount(0);
  await expect(page.locator("#sentimentPhaseAdvice")).toHaveText("情绪指标继续走弱。");
  const alignment = await page.evaluate(() => {
+    const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
    const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
    const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
    const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
@@ -732,6 +799,8 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    const statusStyle = getComputedStyle(document.querySelector(".sentiment-block .sentiment-text"));
    return {
      columnsAligned: Math.abs(trend.top - summary.top) < 1,
+      bottomsAligned: Math.abs(trend.bottom - components.bottom) < 1,
+      analysisHeight: analysis.height,
      railAligned: Math.abs(summary.x - components.x) < 1 && Math.abs(summary.width - components.width) < 1 && components.top > summary.bottom,
      detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom),
      chartHeight: chart.height,
@@ -743,6 +812,8 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    };
  });
  expect(alignment.columnsAligned).toBe(true);
+  expect(alignment.bottomsAligned).toBe(true);
+  expect(Math.abs(alignment.analysisHeight - 600)).toBeLessThanOrEqual(1);
  expect(alignment.railAligned).toBe(true);
  expect(alignment.detailAfterAnalysis).toBe(true);
  expect(alignment.chartHeight).toBeGreaterThanOrEqual(340);
@@ -780,6 +851,68 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  }
 });

+test("sentiment cycle keeps 600px equal-height layout across zoom viewports", async ({ page }, testInfo) => {
+  const shotDir = testInfo.outputPath("hel-221-shots");
+  await mockApplication(page, session("user", true));
+  const viewports = [
+    { name: "zoom-100", width: 2560, height: 1440 },
+    { name: "zoom-110", width: 2327, height: 1309 },
+    { name: "zoom-125", width: 2048, height: 1152 },
+  ];
+
+  for (const viewport of viewports) {
+    await page.setViewportSize({ width: viewport.width, height: viewport.height });
+    await page.goto("/index.html");
+    await renderSentimentFixture(page, 20);
+    const layout = await page.evaluate(readSentimentLayout);
+    expect(layout.topDelta, viewport.name).toBeLessThanOrEqual(1);
+    expect(layout.bottomDelta, viewport.name).toBeLessThanOrEqual(1);
+    expect(Math.abs(layout.analysisHeight - 600), viewport.name).toBeLessThanOrEqual(1);
+    expect(layout.chartHeight, viewport.name).toBeGreaterThanOrEqual(450);
+    expect(layout.detailAfterAnalysis, viewport.name).toBe(true);
+    expect(layout.tableVisible, viewport.name).toBe(true);
+    expect(layout.smallVisible, viewport.name).toBe(true);
+    expect(layout.overflowX, viewport.name).toBe(false);
+    await page.screenshot({
+      path: `${shotDir}/day-${viewport.name}.png`,
+      fullPage: true,
+    });
+  }
+
+  await page.setViewportSize({ width: 2560, height: 1440 });
+  await page.locator("#themeToggle").click();
+  await expect(page.locator("html")).toHaveAttribute("data-theme", "dark");
+  await page.waitForTimeout(200);
+  const nightLayout = await page.evaluate(readSentimentLayout);
+  expect(nightLayout.topDelta).toBeLessThanOrEqual(1);
+  expect(nightLayout.bottomDelta).toBeLessThanOrEqual(1);
+  expect(Math.abs(nightLayout.analysisHeight - 600)).toBeLessThanOrEqual(1);
+  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
+  const tooltip = page.locator("#sentimentChartTooltip");
+  await expect(tooltip).toBeVisible();
+  await expect(tooltip).toContainText("温度");
+  const tooltipStyle = await tooltip.evaluate((node) => {
+    const style = getComputedStyle(node);
+    const bold = getComputedStyle(node.querySelector("b") || node);
+    return { background: style.backgroundColor, color: style.color, bold: bold.color };
+  });
+  expect(tooltipStyle.background).toBe("rgb(38, 41, 62)");
+  expect(tooltipStyle.color).toBe("rgb(232, 234, 237)");
+  expect(tooltipStyle.bold).toBe("rgb(232, 234, 237)");
+  await page.screenshot({ path: `${shotDir}/night-zoom-100.png`, fullPage: true });
+
+  await page.locator("#themeToggle").click();
+  await expect(page.locator("html")).toHaveAttribute("data-theme", "light");
+  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
+  await expect(tooltip).toBeVisible();
+  const lightTooltip = await tooltip.evaluate((node) => {
+    const style = getComputedStyle(node);
+    return { background: style.backgroundColor, color: style.color };
+  });
+  expect(lightTooltip.background).toBe("rgb(31, 35, 41)");
+  expect(lightTooltip.color).toBe("rgb(255, 255, 255)");
+});
+
 test("limit-up pool separates stock identity and restores the reason column", async ({ page }) => {
  await mockApplication(page, session("user", true));
  await page.goto("/index.html");
@@ -0,0 +1,446 @@
+const { test, expect } = require("@playwright/test");
+const fs = require("fs");
+const path = require("path");
+
+const SHOT_DIR = path.resolve(__dirname, "../../../verify-shots");
+fs.mkdirSync(SHOT_DIR, { recursive: true });
+
+function loginPayload(user) {
+  return {
+    ok: true,
+    authenticated: true,
+    csrf_token: "portal-csrf",
+    user,
+  };
+}
+
+async function mockLoginPortal(page, options = {}) {
+  const accounts = options.accounts || [];
+  let currentUserId = options.currentUserId ?? null;
+  await page.route("**/api/**", async (route) => {
+    const url = new URL(route.request().url());
+    const method = route.request().method();
+    if (url.pathname === "/api/auth/accounts") {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: true, accounts, current_user_id: currentUserId }),
+      });
+      return;
+    }
+    if (url.pathname === "/api/auth/switch" && method === "POST") {
+      const body = route.request().postDataJSON() || {};
+      const account = accounts.find((item) => Number(item.user_id) === Number(body.user_id));
+      if (!account || options.switchFails) {
+        await route.fulfill({
+          status: 401,
+          contentType: "application/json",
+          body: JSON.stringify({ error: "该账号需重新验证" }),
+        });
+        return;
+      }
+      currentUserId = account.user_id;
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(loginPayload(account)),
+      });
+      return;
+    }
+    if (url.pathname === "/api/auth/forget" && method === "POST") {
+      const body = route.request().postDataJSON() || {};
+      const index = accounts.findIndex((item) => Number(item.user_id) === Number(body.user_id));
+      if (index >= 0) accounts.splice(index, 1);
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({ ok: true }),
+      });
+      return;
+    }
+    if ((url.pathname === "/api/auth/login" || url.pathname === "/api/auth/register") && method === "POST") {
+      if (options.loginDelay) await new Promise((resolve) => setTimeout(resolve, options.loginDelay));
+      if (options.loginFails) {
+        await route.fulfill({
+          status: 401,
+          contentType: "application/json",
+          body: JSON.stringify({ error: "账号名或密码不正确，请重新输入。" }),
+        });
+        return;
+      }
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify(loginPayload({
+          id: 9,
+          username: "new_user",
+          role: "user",
+          membership: { active: false, subscribed: false, is_admin: false },
+        })),
+      });
+      return;
+    }
+    if (url.pathname === "/api/auth/me") {
+      const current = accounts.find((item) => Number(item.user_id) === Number(currentUserId)) || null;
+      const authenticated = Boolean(current) && !options.sessionExpired;
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          ok: true,
+          authenticated,
+          csrf_token: "portal-csrf",
+          user: authenticated ? {
+            id: current.user_id,
+            username: current.username,
+            role: current.role,
+            membership: current.membership,
+          } : null,
+        }),
+      });
+      return;
+    }
+    if (url.pathname === "/api/dashboard") {
+      await route.fulfill({
+        status: 200,
+        contentType: "application/json",
+        body: JSON.stringify({
+          ok: true,
+          meta: {
+            trade_date: "2026-07-22",
+            requested_date: "2026-07-22",
+            source: "tushare",
+            realtime: false,
+            cached: true,
+            market_status: "closed",
+            updated_at: "2026-07-22T15:00:00+08:00",
+          },
+          overview: {
+            up_count: 2100,
+            down_count: 2800,
+            limit_up_count: 42,
+            limit_down_count: 8,
+            broken_count: 17,
+            seal_rate: 71.2,
+            amount_billion: 12600,
+            sentiment_score: 48,
+          },
+          limits: [],
+          broken: [],
+          down_limits: [],
+          yesterday_limits: [],
+          limit_performance: [],
+          ladders: [],
+          sectors: [],
+          sector_rotation: [],
+        }),
+      });
+      return;
+    }
+    await route.fulfill({
+      status: 200,
+      contentType: "application/json",
+      body: JSON.stringify({ ok: true }),
+    });
+  });
+}
+
+const SAVED_ACCOUNTS = [
+  {
+    user_id: 1,
+    username: "alpha_user",
+    role: "admin",
+    membership: { active: true, subscribed: true, is_admin: true },
+    last_used_at: "2026-08-29T01:00:00+00:00",
+  },
+  {
+    user_id: 2,
+    username: "beta_user",
+    role: "user",
+    membership: { active: false, subscribed: false, is_admin: false },
+    last_used_at: "2026-08-28T01:00:00+00:00",
+  },
+];
+
+test("first-time login portal asks for a password and hides environment copy", async ({ page }) => {
+  await mockLoginPortal(page, { accounts: [] });
+  await page.goto("/login/");
+  await expect(page.locator(".login-card-title")).toHaveText("欢迎回来");
+  await expect(page.locator("#loginUsername")).toBeVisible();
+  await expect(page.locator(".login-submit")).toHaveText("登录");
+  await expect(page.locator("body")).not.toContainText("内网个人版");
+  await expect(page.locator("body")).not.toContainText("192.168.200.11");
+});
+
+test("saved accounts can switch directly and show a re-auth message on failure", async ({ page }) => {
+  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
+  await page.goto("/login/");
+  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
+  await expect(page.locator(".login-account-row")).toHaveCount(2);
+  const switched = page.waitForRequest((request) => (
+    request.url().includes("/api/auth/switch") && request.method() === "POST"
+  ));
+  await page.locator('[data-switch-id="2"]').click();
+  const request = await switched;
+  expect(JSON.parse(request.postData() || "{}")).toEqual({ user_id: 2 });
+});
+
+test("failed account switch stays on the portal with the original copy", async ({ page }) => {
+  await mockLoginPortal(page, {
+    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
+    switchFails: true,
+  });
+  await page.goto("/login/");
+  await page.locator('[data-switch-id="2"]').click();
+  await expect(page.locator(".login-error")).toHaveText("该账号需重新验证");
+  await expect(page).toHaveURL(/\/login\/?/);
+});
+
+test("managing accounts removes a local record after inline confirmation", async ({ page }) => {
+  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
+  await page.goto("/login/");
+  await page.locator('[data-login-action="manage"]').click();
+  await expect(page.locator(".login-card-title")).toHaveText("管理账号记录");
+  await page.locator('[data-confirm-id="2"]').click();
+  await expect(page.locator(".login-confirm-copy")).toContainText("beta_user");
+  await page.locator('[data-forget-id="2"]').click();
+  await expect(page.locator(".login-account-row")).toHaveCount(1);
+  await expect(page.locator(".login-account-row")).toContainText("alpha_user");
+});
+
+async function assertConfirmedSkeleton(page, { width, height }) {
+  await expect(page.locator(".login-brand-title")).toHaveText("看懂情绪周期，把复盘变成下一次的先手。");
+  await expect(page.locator(".login-brand-header")).toBeVisible();
+  await expect(page.locator(".login-brand-chart")).toBeVisible();
+  await expect(page.locator(".login-brand-stats")).toBeVisible();
+  await expect(page.locator(".login-brand-kicker")).toHaveText("收盘之后 · 复盘开始");
+  const brand = await page.locator(".login-brand").boundingBox();
+  const header = await page.locator(".login-brand-header").boundingBox();
+  const mark = await page.locator(".login-brand-mark").boundingBox();
+  const name = await page.locator(".login-brand-name").boundingBox();
+  const title = await page.locator(".login-brand-title").boundingBox();
+  const stats = await page.locator(".login-brand-stats").boundingBox();
+  const chart = await page.locator(".login-brand-chart").boundingBox();
+  const card = await page.locator(".login-card").boundingBox();
+  expect(brand).toBeTruthy();
+  expect(header.y - brand.y).toBeLessThan(48);
+  expect(Math.abs(mark.y - name.y)).toBeLessThan(16);
+  expect(title.y).toBeGreaterThan(height * 0.28);
+  expect(title.y).toBeLessThan(height * 0.72);
+  expect(stats.y).toBeGreaterThan(height * 0.55);
+  expect(chart.height).toBeGreaterThan(80);
+  expect(card.width).toBeGreaterThan(380);
+  expect(card.width).toBeLessThan(450);
+  if (width === 1440) {
+    expect(brand.width).toBeGreaterThan(470);
+    expect(brand.width).toBeLessThan(520);
+    expect(brand.height).toBe(height);
+  } else if (width === 1920) {
+    expect(brand.width).toBeGreaterThan(540);
+    expect(brand.width).toBeLessThan(580);
+  } else {
+    expect(brand.width).toBeGreaterThan(560);
+  }
+}
+
+async function openPortal(page, { theme, width, height, accounts, currentUserId, loginFails, loginDelay }) {
+  await page.addInitScript((nextTheme) => {
+    localStorage.setItem("xiaobaiTheme", nextTheme);
+  }, theme);
+  await page.setViewportSize({ width, height });
+  await mockLoginPortal(page, { accounts, currentUserId, loginFails, loginDelay });
+  await page.goto("/login/");
+}
+
+for (const theme of ["light", "dark"]) {
+  for (const [width, height] of [[1440, 900], [1920, 1080]]) {
+    test(`confirmed skeleton ${theme} ${width}x${height}`, async ({ page }) => {
+      await openPortal(page, { theme, width, height, accounts: [] });
+      await assertConfirmedSkeleton(page, { width, height });
+      await expect(page.locator("#loginThemeToggle")).toHaveText(theme === "dark" ? "☀ 日间" : "🌙 夜间");
+      await page.screenshot({ path: path.join(SHOT_DIR, `first-${theme}-${width}.png`), fullPage: true });
+    });
+  }
+}
+
+test("ultrawide keeps the left brand from collapsing into a strip", async ({ page }) => {
+  await openPortal(page, { theme: "dark", width: 2560, height: 1080, accounts: [] });
+  await assertConfirmedSkeleton(page, { width: 2560, height: 1080 });
+});
+
+test("picker add remove error and loading share the same desktop skeleton", async ({ page }) => {
+  const accounts = SAVED_ACCOUNTS.map((item) => ({ ...item }));
+  await openPortal(page, {
+    theme: "dark",
+    width: 1440,
+    height: 900,
+    accounts,
+    currentUserId: 1,
+  });
+  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
+  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
+  await expect(page.locator(".login-avatar")).toHaveCount(2);
+  await expect(page.locator(".login-add")).toBeVisible();
+  await page.screenshot({ path: path.join(SHOT_DIR, "picker-dark-1440.png"), fullPage: true });
+
+  await page.locator('[data-login-action="add"]').click();
+  await expect(page.locator(".login-card-title")).toHaveText("添加账号");
+  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
+  await page.screenshot({ path: path.join(SHOT_DIR, "add-dark-1440.png"), fullPage: true });
+
+  await page.locator('[data-login-action="picker"]').click();
+  await page.locator('[data-login-action="manage"]').click();
+  await expect(page.locator(".login-card-title")).toHaveText("管理账号记录");
+  await page.locator('[data-confirm-id="2"]').click();
+  await expect(page.locator(".login-confirm-copy")).toContainText("beta_user");
+  await page.screenshot({ path: path.join(SHOT_DIR, "remove-dark-1440.png"), fullPage: true });
+});
+
+test("login failure and loading keep the confirmed first-login skeleton", async ({ page }) => {
+  await openPortal(page, {
+    theme: "light",
+    width: 1440,
+    height: 900,
+    accounts: [],
+    loginFails: true,
+  });
+  await page.locator("#loginUsername").fill("baiqizhi");
+  await page.locator("#loginPassword").fill("wrong-password");
+  await page.locator(".login-submit").click();
+  await expect(page.locator(".login-error")).toContainText("账号名或密码不正确");
+  await expect(page.locator("#loginPassword")).toHaveClass(/is-invalid/);
+  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
+  await page.screenshot({ path: path.join(SHOT_DIR, "error-light-1440.png"), fullPage: true });
+});
+
+test("loading button appears on the confirmed first-login skeleton", async ({ page }) => {
+  await openPortal(page, {
+    theme: "dark",
+    width: 1440,
+    height: 900,
+    accounts: [],
+    loginDelay: 2500,
+  });
+  await page.evaluate(() => {
+    window.location.replace = () => {};
+  });
+  await page.locator("#loginUsername").fill("baiqizhi");
+  await page.locator("#loginPassword").fill("password12");
+  const submit = page.locator(".login-submit").click();
+  await expect(page.locator(".login-submit")).toContainText("正在登录...");
+  await expect(page.locator(".login-spinner")).toBeVisible();
+  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
+  await page.screenshot({ path: path.join(SHOT_DIR, "loading-dark-1440.png"), fullPage: true });
+  await submit;
+});
+
+async function openPicker(page, options = {}) {
+  const accounts = options.accounts || SAVED_ACCOUNTS.map((item) => ({ ...item }));
+  const currentUserId = options.currentUserId ?? 1;
+  const next = options.next || "/index.html?view=sentimentCycleView";
+  await page.unroute("**/api/**").catch(() => {});
+  await mockLoginPortal(page, {
+    accounts,
+    currentUserId,
+    sessionExpired: options.sessionExpired,
+    switchFails: options.switchFails,
+  });
+  await page.goto(`/login/?next=${encodeURIComponent(next)}`);
+  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
+}
+
+test("clicking the current account from two workspace pages returns without switching", async ({ page }) => {
+  const views = ["sentimentCycleView", "ladderView"];
+  for (const viewId of views) {
+    const next = `/index.html?view=${viewId}`;
+    const switchCalls = [];
+    const onRequest = (request) => {
+      if (request.url().includes("/api/auth/switch") && request.method() === "POST") {
+        switchCalls.push(request);
+      }
+    };
+    page.on("request", onRequest);
+    await openPicker(page, { next });
+    await expect(page.locator('[data-resume-id="1"]')).toContainText("继续使用");
+    await expect(page.locator('[data-resume-id="1"]')).toContainText("当前");
+    await page.locator('[data-resume-id="1"]').click();
+    await expect(page).toHaveURL(new RegExp(`[?&]view=${viewId}\\b`));
+    expect(switchCalls).toEqual([]);
+    page.off("request", onRequest);
+  }
+});
+
+test("a lone current account can return from the picker instead of dead-ending", async ({ page }) => {
+  await openPicker(page, {
+    accounts: [SAVED_ACCOUNTS[0]],
+    currentUserId: 1,
+    next: "/index.html?view=reviewWorkspaceView",
+  });
+  await expect(page.locator(".login-account-row")).toHaveCount(1);
+  await expect(page.locator('[data-switch-id]')).toHaveCount(0);
+  await page.locator('[data-resume-id="1"]').click();
+  await expect(page).toHaveURL(/view=reviewWorkspaceView/);
+});
+
+test("the return control also restores the originating workspace page", async ({ page }) => {
+  await openPicker(page, { next: "/index.html?view=ladderView" });
+  await page.locator('[data-login-action="resume"]').click();
+  await expect(page).toHaveURL(/view=ladderView/);
+});
+
+test("refreshing the picker still returns to the originating page", async ({ page }) => {
+  await openPicker(page, { next: "/index.html?view=sentimentCycleView" });
+  await page.reload();
+  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
+  await page.locator('[data-resume-id="1"]').click();
+  await expect(page).toHaveURL(/view=sentimentCycleView/);
+});
+
+test("an expired current session asks for login instead of pretending to return", async ({ page }) => {
+  await openPicker(page, {
+    next: "/index.html?view=sentimentCycleView",
+    sessionExpired: true,
+  });
+  await page.locator('[data-resume-id="1"]').click();
+  await expect(page.locator(".login-error")).toHaveText("当前会话已失效，请重新登录");
+  await expect(page).toHaveURL(/\/login\/?/);
+});
+
+test("other saved accounts still switch while the current row only resumes", async ({ page }) => {
+  await openPicker(page, { next: "/index.html?view=auctionView" });
+  const switched = page.waitForRequest((request) => (
+    request.url().includes("/api/auth/switch") && request.method() === "POST"
+  ));
+  await page.locator('[data-switch-id="2"]').click();
+  const request = await switched;
+  expect(JSON.parse(request.postData() || "{}")).toEqual({ user_id: 2 });
+});
+
+test("workspace switch-account menu carries the current page back to the picker", async ({ page }) => {
+  await mockLoginPortal(page, {
+    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
+    currentUserId: 1,
+  });
+  await page.goto("/index.html?view=sentimentCycleView");
+  await expect(page.locator("#accountButton")).toBeVisible();
+  await page.locator("#accountButton").click();
+  await page.locator("#switchAccountMenuButton").click();
+  await expect(page).toHaveURL(/\/login\/\?next=/);
+  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
+  await page.locator('[data-resume-id="1"]').click();
+  await expect(page).toHaveURL(/view=sentimentCycleView/);
+});
+
+test("workspace switch-account from a second page also returns to that page", async ({ page }) => {
+  await mockLoginPortal(page, {
+    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
+    currentUserId: 1,
+  });
+  await page.goto("/index.html?view=ladderView");
+  await expect(page.locator("#accountButton")).toBeVisible();
+  await page.locator("#accountButton").click();
+  await page.locator("#switchAccountMenuButton").click();
+  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
+  await page.locator('[data-resume-id="1"]').click();
+  await expect(page).toHaveURL(/view=ladderView/);
+});
@@ -1,7 +1,7 @@
 const { test, expect } = require("@playwright/test");

-// 手机端（/m/）全页面回归：P5 收官打磨。
-// 覆盖：登录、四个入口图标页、行情 12 页、工具 3 页、复盘 5 页、复盘助手，
+// 手机端（/m/）全页面回归：P5 收官打磨 + HEL-233 系统管理恢复。
+// 覆盖：登录、四个入口图标页、行情 12 页、工具 3 页、复盘 5 页、复盘助手、系统管理 5 页，
 // 以及日夜两套渲染、空态、错误态、横屏健壮性、深底深字对比度抽查。

 const EMPTY_DASHBOARD = {
@@ -138,6 +138,36 @@ async function mockMobileApi(page, options = {}) {
      payload = { items: [] };
    } else if (path === "/api/search") {
      payload = { groups: { stocks: [{ id: "002141", code: "002141", name: "贤丰控股", type: "stock", industry: "电子元件" }], sectors: [], themes: [], indices: [] } };
+    } else if (path === "/api/auth/accounts") {
+      payload = {
+        accounts: [{ user_id: auth.user.id, username: auth.user.username, role: auth.user.role, last_used_at: "2026-07-22T09:12:00+08:00" }],
+        current_user_id: auth.user.id,
+      };
+    } else if (path === "/api/account/status") {
+      payload = {
+        birth_profile_configured: true,
+        birth_profile: { birth_datetime: "1990-01-15T08:30", gender: "male" },
+        llm_access: {
+          daily_limit: 50,
+          used_today: 3,
+          remaining_calls: 47,
+          membership: {
+            active: true,
+            subscribed: true,
+            is_admin: auth.user.role === "admin",
+            remaining_days: 20,
+            expires_at: "2026-09-18",
+            plan: "会员",
+          },
+        },
+      };
+    } else if (path === "/api/admin/settings") {
+      payload = {
+        data: { configured: true, snapshot_dates: 12, background_refresh_enabled: true, ifind: { configured: false } },
+        llm: { models: [{ id: "model-1", name: "主模型", base_url: "https://api.openai.com/v1", model: "gpt-4.1", configured: true }], primary_model_id: "model-1", fallback_model_id: "" },
+        membership: { member_daily_limit: 50 },
+        users: [{ id: 2, username: "normal_user", role: "user", membership_subscribed: true, membership_status: "active", membership_expires_at: "2026-09-18", used_today: 3 }],
+      };
    } else if (/^\/api\/stock\/\d+\/preview$/.test(path)) {
      payload = {
        meta: { trade_date: "2026-07-22", intraday_status: "available" },
@@ -230,6 +260,16 @@ const REVIEW_PAGES = [
  ["review/alerts", "提醒中心"],
 ];

+const SYSTEM_PAGES = [
+  ["system/profile", "账号资料"],
+  ["system/password", "修改密码"],
+  ["system/membership", "会员状态"],
+  ["system/admin", "系统设置"],
+  ["system/members", "会员管理"],
+];
+
+const PLACEHOLDER_COPY = "该功能页将在后续批次实现";
+
 test("mobile login renders before authentication", async ({ page }) => {
  await page.setViewportSize({ width: 390, height: 844 });
  await page.route("**/api/**", async (route) => {
@@ -249,12 +289,16 @@ test("mobile login renders before authentication", async ({ page }) => {
 test("four hub pages render their icon grids", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
-  for (const hub of ["market", "tools", "review", "system"]) {
+  for (const hub of ["market", "tools", "review"]) {
    await page.evaluate((h) => { window.MobileRouter.navigate("#/hub/" + h); }, hub);
    await expect(page.locator(".m-hub-grid")).toBeVisible();
    await expect(page.locator(".m-hub-grid .m-grid-item").first()).toBeVisible();
    expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
  }
+  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
+  await expect(page.locator("[data-system-page='home']")).toBeVisible();
+  await expect(page.locator(".m-sys-row").first()).toBeVisible();
+  expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
 });

 for (const theme of ["day", "night"]) {
@@ -296,6 +340,112 @@ test("review five pages render watchlist, trades, daily, notes and alerts", asyn
  }
 });

+test("system management pages render real content instead of placeholders", async ({ page }) => {
+  await mockMobileApi(page);
+  await openMobile(page);
+  for (const [key, label] of SYSTEM_PAGES) {
+    await navigateToFeature(page, key);
+    await expect(page.locator("#m-title")).toHaveText(label);
+    await expect(page.locator(".m-placeholder")).toHaveCount(0);
+    await expect(page.locator("#m-view")).not.toContainText(PLACEHOLDER_COPY);
+    await expect(page.locator("[data-system-page], [data-system-admin-panel]").first()).toBeVisible();
+    expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
+  }
+  await navigateToFeature(page, "system/profile");
+  await expect(page.locator("#m-sys-birth-date")).toBeVisible();
+  await expect(page.locator("[data-system-save-birth]")).toBeVisible();
+  await navigateToFeature(page, "system/password");
+  await expect(page.locator("#m-sys-password-current")).toBeVisible();
+  await navigateToFeature(page, "system/membership");
+  await expect(page.locator(".m-sys-grid")).toBeVisible();
+  await navigateToFeature(page, "system/admin");
+  await expect(page.locator("#m-sys-token")).toBeVisible();
+  await navigateToFeature(page, "system/members");
+  await expect(page.locator("#m-sys-member-limit")).toBeVisible();
+});
+
+test("system home groups entries and keeps admin-only items gated", async ({ page }) => {
+  await mockMobileApi(page);
+  await openMobile(page);
+  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
+  await expect(page.locator("[data-system-page='home']")).toBeVisible();
+  await expect(page.locator("#m-view")).toContainText("账号");
+  await expect(page.locator("#m-view")).toContainText("偏好");
+  await expect(page.locator("#m-view")).toContainText("管理员专区");
+  await expect(page.locator("[data-theme-toggle]")).toBeVisible();
+  await expect(page.locator("[data-system-switch]")).toBeVisible();
+  expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
+});
+
+test("system settings tabs, model editor, delete confirm and theme toggle work", async ({ page }) => {
+  await mockMobileApi(page);
+  await openMobile(page);
+  await navigateToFeature(page, "system/admin");
+  await expect(page.locator("[data-system-admin-panel='market']")).toBeVisible();
+  await page.locator("[data-system-admin-tab='models']").click();
+  await expect(page.locator("[data-system-admin-panel='models']")).toBeVisible();
+  await page.locator("[data-system-edit-model]").first().click();
+  await expect(page.locator(".m-sheet-root.is-open")).toBeVisible();
+  await expect(page.locator(".m-sheet-head h2")).toHaveText("编辑模型");
+  await page.locator("[data-sheet-close]").click();
+  await page.locator("[data-system-admin-tab='market']").click();
+  await expect(page.locator("#m-sys-token")).toBeVisible();
+
+  await navigateToFeature(page, "system/profile");
+  await page.locator("[data-system-delete-birth]").click();
+  await expect(page.locator(".m-dialog")).toBeVisible();
+  await expect(page.locator(".m-dialog")).toContainText("删除命理资料");
+  await page.locator("[data-sheet-close]").click();
+
+  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
+  await expect(page.locator("[data-theme-toggle]")).toBeVisible();
+  const before = await page.locator("#m-app").getAttribute("data-theme");
+  await page.locator("[data-theme-toggle]").click();
+  await expect.poll(async () => page.locator("#m-app").getAttribute("data-theme")).not.toBe(before);
+
+  await navigateToFeature(page, "system/members");
+  await page.locator("[data-system-open-member]").click();
+  await expect(page.locator(".m-sheet-root.is-open")).toBeVisible();
+  await expect(page.locator(".m-sheet-head h2")).toContainText("管理会员");
+});
+
+test("password mismatch shows inline error instead of a silent submit", async ({ page }) => {
+  await mockMobileApi(page);
+  await openMobile(page);
+  await navigateToFeature(page, "system/password");
+  await page.locator("#m-sys-password-current").fill("OldPass12");
+  await page.locator("#m-sys-password-new").fill("NewPass123");
+  await page.locator("#m-sys-password-confirm").fill("OtherPass123");
+  await page.locator("[data-system-save-password]").click();
+  await expect(page.locator("[data-field-error='confirm']")).toBeVisible();
+  await expect(page.locator("[data-field-error='confirm']")).toContainText("两次输入的密码不一致");
+});
+
+test("empty birth profile save shows a validation toast", async ({ page }) => {
+  await mockMobileApi(page);
+  await openMobile(page);
+  await navigateToFeature(page, "system/profile");
+  await expect(page.locator("[data-system-save-birth]")).toBeVisible();
+  await page.locator("#m-sys-birth-date").fill("");
+  await page.locator("#m-sys-birth-time").fill("");
+  await page.locator("[data-system-save-birth]").click();
+  await expect(page.locator("#m-toast.is-visible")).toBeVisible();
+  await expect(page.locator("#m-toast")).toContainText("请填写完整出生日期和时间");
+});
+
+test("non-admin cannot open system admin pages as placeholders", async ({ page }) => {
+  await mockMobileApi(page, { auth: authSession("user", true) });
+  await openMobile(page);
+  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
+  await expect(page.locator("[data-system-page='home']")).toBeVisible();
+  await expect(page.locator('[data-route="#/feature/system/admin"]')).toHaveCount(0);
+  await expect(page.locator('[data-route="#/feature/system/members"]')).toHaveCount(0);
+  await expect(page.locator("[data-system-switch]")).toBeVisible();
+  await navigateToFeature(page, "system/admin");
+  await expect(page.locator("#m-view")).not.toContainText(PLACEHOLDER_COPY);
+  await expect(page.locator("[data-system-page='forbidden']")).toBeVisible();
+});
+
 test("assistant chat renders with presets and input", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
@@ -0,0 +1,132 @@
+from __future__ import annotations
+
+import threading
+import unittest
+from datetime import datetime, timedelta, timezone
+from pathlib import Path
+from tempfile import TemporaryDirectory
+
+from backend.features.accounts.security import SecretVault, token_hash
+from backend.features.accounts.service import AccountService
+from database import ReviewDatabase
+
+
+class AccountSwitchGrantTests(unittest.TestCase):
+    def setUp(self) -> None:
+        self.temp = TemporaryDirectory()
+        self.database = ReviewDatabase(Path(self.temp.name) / "review.db")
+        self.bound_user_id = 0
+        self.service = AccountService(
+            database=self.database,
+            vault=SecretVault(SecretVault.generate_key()),
+            current_user_supplier=lambda: self.bound_user_id,
+            access_supplier=lambda: self.database.user_access(self.bound_user_id) or {},
+            bind_user=self._bind,
+            personal_field_builder=lambda *args, **kwargs: {},
+            auth_lock=threading.Lock(),
+        )
+        self.device_a = token_hash("device-a-token")
+        self.device_b = token_hash("device-b-token")
+
+    def tearDown(self) -> None:
+        self.temp.cleanup()
+
+    def _bind(self, user_id: int) -> None:
+        self.bound_user_id = int(user_id)
+
+    def _register(self, username: str, device_hash: str = "") -> dict:
+        return self.service.register(username, "Password123", device_hash or self.device_a)
+
+    def test_login_records_accounts_for_the_current_device_only(self) -> None:
+        first = self._register("alpha_user")
+        second = self._register("beta_user")
+        self.service.login("alpha_user", "Password123", self.device_b)
+
+        listed = self.service.list_device_accounts(self.device_a)
+        names = [item["username"] for item in listed["accounts"]]
+        self.assertEqual(names, ["beta_user", "alpha_user"])
+        self.assertEqual(
+            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
+            "alpha_user",
+        )
+        self.assertEqual(self.service.list_device_accounts("")["accounts"], [])
+        self.assertEqual(first["user"]["username"], "alpha_user")
+        self.assertEqual(second["user"]["username"], "beta_user")
+
+    def test_switch_uses_device_grant_and_keeps_the_original_authorization(self) -> None:
+        first = self._register("alpha_user")
+        self._register("beta_user")
+        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
+        self.assertEqual(switched["user"]["username"], "alpha_user")
+        remaining = {
+            item["username"]
+            for item in self.service.list_device_accounts(self.device_a)["accounts"]
+        }
+        self.assertEqual(remaining, {"alpha_user", "beta_user"})
+
+    def test_switch_without_a_valid_grant_requires_reauthentication(self) -> None:
+        user = self._register("alpha_user")
+        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
+            self.service.switch_account(self.device_b, int(user["user"]["id"]))
+        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
+            self.service.switch_account("", int(user["user"]["id"]))
+
+    def test_forget_only_removes_the_current_device_grant(self) -> None:
+        user = self._register("alpha_user")
+        self.service.login("alpha_user", "Password123", self.device_b)
+        self.service.forget_account(self.device_a, int(user["user"]["id"]))
+        self.service.forget_account(self.device_a, int(user["user"]["id"]))
+        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
+        self.assertEqual(
+            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
+            "alpha_user",
+        )
+
+    def test_logout_revokes_only_the_current_account_on_this_device(self) -> None:
+        first = self._register("alpha_user")
+        second = self._register("beta_user")
+        self.service.revoke_current_device_grant(self.device_a, int(second["user"]["id"]))
+        names = {
+            item["username"]
+            for item in self.service.list_device_accounts(self.device_a)["accounts"]
+        }
+        self.assertEqual(names, {"alpha_user"})
+        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
+        self.assertEqual(switched["user"]["id"], first["user"]["id"])
+
+    def test_password_change_revokes_grants_on_every_device(self) -> None:
+        user = self._register("alpha_user")
+        self.service.login("alpha_user", "Password123", self.device_b)
+        self._bind(int(user["user"]["id"]))
+        self.service.change_password("Password123", "Password456")
+        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
+        self.assertEqual(self.service.list_device_accounts(self.device_b)["accounts"], [])
+        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
+            self.service.switch_account(self.device_a, int(user["user"]["id"]))
+
+    def test_device_keeps_at_most_five_accounts(self) -> None:
+        usernames = [f"user_{index}" for index in range(6)]
+        ids = [self._register(name)["user"]["id"] for name in usernames]
+        listed = self.service.list_device_accounts(self.device_a)["accounts"]
+        self.assertEqual(len(listed), 5)
+        kept = {item["user_id"] for item in listed}
+        self.assertNotIn(ids[0], kept)
+        self.assertTrue(set(ids[1:]).issubset(kept))
+
+    def test_expired_grants_are_removed_lazily(self) -> None:
+        user = self._register("alpha_user")
+        past = (datetime.now(timezone.utc) - timedelta(days=1)).isoformat(timespec="seconds")
+        self.database.upsert_switch_grant(
+            self.device_a,
+            int(user["user"]["id"]),
+            past,
+            past,
+            past,
+        )
+        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
+        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
+            self.service.switch_account(self.device_a, int(user["user"]["id"]))
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -25,6 +25,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                        ("0002", "create_job_runs"),
                        ("0003", "extend_llm_audit"),
                        ("0004", "add_mentor_note"),
+                        ("0005", "create_account_switch_grants"),
                    ],
                )
                columns = {
@@ -39,7 +40,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 4)
+            self.assertEqual(count, 5)

    def test_database_with_recorded_0004_and_note_column_starts_without_reapply(
        self,
@@ -60,7 +61,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 4)
+            self.assertEqual(count, 5)

    def test_old_database_without_0004_upgrades_and_adds_note_column(self) -> None:
        with tempfile.TemporaryDirectory() as root:
@@ -87,7 +88,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                        "PRAGMA table_info(mentor_preferences)"
                    )
                ]
-            self.assertEqual(versions, {"0001", "0002", "0003", "0004"})
+            self.assertEqual(versions, {"0001", "0002", "0003", "0004", "0005"})
            self.assertIn("note", note_rows)

    def test_database_with_unknown_migration_is_rejected(self) -> None:
@@ -0,0 +1,124 @@
+from __future__ import annotations
+
+import os
+import stat
+import subprocess
+import tempfile
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+CHECK = ROOT / "tools" / "check_deploy_baseline.sh"
+BUILD = ROOT / "tools" / "build_image.sh"
+
+
+def run_check(repo: Path, candidate: str, live: str) -> subprocess.CompletedProcess[str]:
+    env = os.environ.copy()
+    env["GIT_DIR"] = str(repo / ".git")
+    env["GIT_WORK_TREE"] = str(repo)
+    return subprocess.run(
+        ["bash", str(CHECK), candidate, "--live-revision", live],
+        cwd=repo,
+        capture_output=True,
+        text=True,
+        env=env,
+        check=False,
+    )
+
+
+def git(repo: Path, *args: str) -> str:
+    result = subprocess.run(
+        ["git", *args],
+        cwd=repo,
+        capture_output=True,
+        text=True,
+        check=True,
+    )
+    return result.stdout.strip()
+
+
+class DeployBaselineGateTests(unittest.TestCase):
+    @classmethod
+    def setUpClass(cls) -> None:
+        cls.tmpdir = tempfile.TemporaryDirectory()
+        cls.repo = Path(cls.tmpdir.name) / "repo"
+        cls.repo.mkdir()
+        git(cls.repo, "init")
+        git(cls.repo, "config", "user.email", "gate@example.com")
+        git(cls.repo, "config", "user.name", "Gate")
+        (cls.repo / "README").write_text("base\n", encoding="utf-8")
+        git(cls.repo, "add", "README")
+        git(cls.repo, "commit", "-m", "base")
+        cls.base = git(cls.repo, "rev-parse", "HEAD")
+
+        (cls.repo / "online.txt").write_text("live\n", encoding="utf-8")
+        git(cls.repo, "add", "online.txt")
+        git(cls.repo, "commit", "-m", "online")
+        cls.live = git(cls.repo, "rev-parse", "HEAD")
+
+        git(cls.repo, "checkout", "-b", "successor")
+        (cls.repo / "next.txt").write_text("next\n", encoding="utf-8")
+        git(cls.repo, "add", "next.txt")
+        git(cls.repo, "commit", "-m", "successor of live")
+        cls.successor = git(cls.repo, "rev-parse", "HEAD")
+
+        git(cls.repo, "checkout", "-B", "lagging-main", cls.base)
+        (cls.repo / "stale.txt").write_text("stale main\n", encoding="utf-8")
+        git(cls.repo, "add", "stale.txt")
+        git(cls.repo, "commit", "-m", "lagging main")
+        cls.lagging = git(cls.repo, "rev-parse", "HEAD")
+
+        git(cls.repo, "checkout", "-B", "side", cls.base)
+        (cls.repo / "side.txt").write_text("side branch\n", encoding="utf-8")
+        git(cls.repo, "add", "side.txt")
+        git(cls.repo, "commit", "-m", "unrelated side branch")
+        cls.side = git(cls.repo, "rev-parse", "HEAD")
+
+        git(cls.repo, "checkout", "-B", "successor", cls.successor)
+
+    @classmethod
+    def tearDownClass(cls) -> None:
+        cls.tmpdir.cleanup()
+
+    def test_check_script_is_executable(self) -> None:
+        self.assertTrue(CHECK.exists())
+        self.assertTrue(stat.S_IXUSR & CHECK.stat().st_mode)
+
+    def test_successor_of_live_passes(self) -> None:
+        result = run_check(self.repo, self.successor, self.live)
+        self.assertEqual(result.returncode, 0, result.stderr)
+        self.assertIn(self.live, result.stdout)
+        self.assertIn(self.successor, result.stdout)
+        self.assertIn("next.txt", result.stdout)
+        self.assertIn("祖先关系通过", result.stdout)
+
+    def test_lagging_main_is_blocked(self) -> None:
+        result = run_check(self.repo, self.lagging, self.live)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("拒绝", result.stderr)
+
+    def test_side_branch_is_blocked(self) -> None:
+        result = run_check(self.repo, self.side, self.live)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("拒绝", result.stderr)
+
+    def test_unknown_commit_is_blocked(self) -> None:
+        result = run_check(self.repo, "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef", self.live)
+        self.assertNotEqual(result.returncode, 0)
+        self.assertIn("无法解析", result.stderr)
+
+    def test_build_image_calls_the_gate_and_rejects_latest(self) -> None:
+        source = BUILD.read_text(encoding="utf-8")
+        self.assertIn("check_deploy_baseline.sh", source)
+        self.assertIn("禁止构建 latest", source)
+        self.assertIn("org.opencontainers.image.revision", source)
+        gate = CHECK.read_text(encoding="utf-8")
+        self.assertIn("org.opencontainers.image.revision", gate)
+        self.assertIn("merge-base --is-ancestor", gate)
+        self.assertIn("候选将丢失的提交", gate)
+        self.assertIn("禁止人工填写", gate)
+
+
+if __name__ == "__main__":
+    unittest.main()
@@ -344,6 +344,22 @@ class FrontendContractTests(unittest.TestCase):
        self.assertIn("max-height: var(--sentiment-history-max-height);", self.sentiment_styles)
        self.assertIn("overflow: auto;", self.sentiment_styles)

+    def test_sentiment_equal_height_and_tooltip_tokens(self):
+        self.assertIn("--sentiment-analysis-height: 600px;", self.tokens)
+        self.assertIn("--sentiment-tooltip-bg: var(--text-primary);", self.tokens)
+        self.assertIn("--sentiment-tooltip-fg: var(--text-inverse);", self.tokens)
+        self.assertIn("--sentiment-tooltip-bg: #26293e;", self.tokens)
+        self.assertIn("--sentiment-tooltip-fg: #e8eaed;", self.tokens)
+        self.assertIn("height: var(--sentiment-analysis-height);", self.sentiment_styles)
+        self.assertIn("max-height: var(--sentiment-analysis-height);", self.sentiment_styles)
+        self.assertIn("justify-content: space-evenly;", self.sentiment_styles)
+        self.assertIn("background: var(--sentiment-tooltip-bg);", self.sentiment_styles)
+        self.assertIn("color: var(--sentiment-tooltip-fg);", self.sentiment_styles)
+        self.assertIn("new ResizeObserver", self.script)
+        self.assertIn("#sentimentCycleView .redesigned-emotion-grid {", self.sentiment_styles)
+        self.assertNotIn("height: 100vh", self.sentiment_styles)
+        self.assertNotIn("min-height: 100%", self.sentiment_styles)
+
    def test_mentor_final_visual_fix_contract(self):
        shell_styles = (STATIC_DIR / "shared" / "shell.css").read_text(encoding="utf-8")
        mentor_html = (STATIC_DIR / "pages" / "mentor" / "page.html").read_text(encoding="utf-8")
@@ -65,8 +65,11 @@ class GovernanceRegistryTests(unittest.TestCase):
            public,
            {
                ("GET", "/api/health"),
+                ("GET", "/api/auth/accounts"),
                ("POST", "/api/auth/login"),
                ("POST", "/api/auth/register"),
+                ("POST", "/api/auth/switch"),
+                ("POST", "/api/auth/forget"),
            },
        )

@@ -0,0 +1,67 @@
+from __future__ import annotations
+
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+LOGIN = (ROOT / "frontend" / "login" / "index.html").read_text(encoding="utf-8")
+LOGIN_JS = (ROOT / "frontend" / "login" / "page.js").read_text(encoding="utf-8")
+AUTH = (ROOT / "frontend" / "shared" / "auth.css").read_text(encoding="utf-8")
+TOKENS = (ROOT / "frontend" / "shared" / "tokens.css").read_text(encoding="utf-8")
+
+
+class LoginPortalContractTests(unittest.TestCase):
+    def test_confirmed_brand_skeleton_is_in_markup(self) -> None:
+        for needle in (
+            'class="login-brand-header"',
+            'class="login-brand-name"',
+            "A股个人复盘工作台",
+            'class="login-brand-kicker"',
+            "看懂情绪周期，把复盘变成下一次的先手。",
+            'class="login-brand-chart"',
+            'class="login-brand-stats"',
+            "股市有风险，投资需谨慎",
+            'id="loginThemeToggle"',
+            'id="loginCard"',
+        ):
+            self.assertIn(needle, LOGIN)
+
+    def test_login_tokens_own_the_confirmed_layout_metrics(self) -> None:
+        for needle in (
+            "--login-brand-share: 34%;",
+            "--login-brand-cap: 560px;",
+            "--login-brand-wide-share: 29.2%;",
+            "--login-card-width: 408px;",
+            "--login-hero-size: 28px;",
+            "--login-account-row-min: 72px;",
+        ):
+            self.assertIn(needle, TOKENS)
+        self.assertIn("width: var(--login-brand-share);", AUTH)
+        self.assertIn("width: var(--login-card-width);", AUTH)
+        self.assertIn("justify-content: flex-end;", AUTH)
+        self.assertIn("body.login-portal {", AUTH)
+        self.assertIn("padding-bottom: 0;", AUTH)
+        self.assertNotIn("padding: 0 0 var(--statusbar-height);", AUTH)
+
+    def test_portal_keeps_account_switch_and_theme_hooks(self) -> None:
+        self.assertIn("data-switch-id", LOGIN_JS)
+        self.assertIn("data-resume-id", LOGIN_JS)
+        self.assertIn('data-login-action="manage"', LOGIN_JS)
+        self.assertIn('data-login-action="add"', LOGIN_JS)
+        self.assertIn('data-login-action="resume"', LOGIN_JS)
+        self.assertIn("继续使用", LOGIN_JS)
+        self.assertIn("返回复盘", LOGIN_JS)
+        self.assertIn("/api/auth/me", LOGIN_JS)
+        self.assertIn("xiaobaiTheme", LOGIN_JS)
+        self.assertNotIn("内网个人版", LOGIN)
+        self.assertNotIn("192.168.200.11", LOGIN)
+        self.assertNotIn("/api/heaven", LOGIN_JS)
+
+    def test_current_account_row_stays_clickable_without_reswitching(self) -> None:
+        self.assertIn("resumeCurrentAccount", LOGIN_JS)
+        self.assertIn("当前会话已失效，请重新登录", LOGIN_JS)
+        self.assertNotIn("!managing && !current ? \"is-switchable\"", LOGIN_JS)
+        session = (ROOT / "frontend" / "shared" / "session.js").read_text(encoding="utf-8")
+        self.assertIn('params.set("next", next)', session)
+        self.assertIn(".login-account-action", AUTH)
@@ -0,0 +1,86 @@
+from __future__ import annotations
+
+import re
+import unittest
+from pathlib import Path
+
+
+ROOT = Path(__file__).resolve().parents[1]
+NAV = ROOT / "frontend/m/config/nav.config.js"
+PAGES = ROOT / "frontend/m/js/pages.js"
+ROUTER = ROOT / "frontend/m/js/router.js"
+
+
+class MobileSystemPagesRegressionTests(unittest.TestCase):
+    """Prevent mobile system-management entries from falling back to placeholders."""
+
+    def test_nav_system_entries_are_registered_as_real_pages(self) -> None:
+        nav = NAV.read_text(encoding="utf-8")
+        pages = PAGES.read_text(encoding="utf-8")
+        keys = re.findall(r'key:\s*"(system/[^"]+)"', nav)
+        self.assertEqual(
+            keys,
+            [
+                "system/profile",
+                "system/password",
+                "system/membership",
+                "system/admin",
+                "system/members",
+            ],
+        )
+        for key in keys:
+            self.assertIn(f'"{key}": setupSystemPage', pages)
+            self.assertIn(f'"{key}": loadSystem', pages)
+
+    def test_placeholder_copy_is_only_a_router_fallback(self) -> None:
+        router = ROUTER.read_text(encoding="utf-8")
+        pages = PAGES.read_text(encoding="utf-8")
+        self.assertIn("该功能页将在后续批次实现", router)
+        self.assertNotIn("该功能页将在后续批次实现", pages)
+        self.assertIn("function setupSystemPage", pages)
+        self.assertIn("function loadSystem", pages)
+
+    def test_system_pages_render_real_controls_not_stubs(self) -> None:
+        pages = PAGES.read_text(encoding="utf-8")
+        for marker in (
+            'data-system-page="home"',
+            'data-system-page="profile"',
+            'data-system-page="password"',
+            'data-system-page="membership"',
+            'data-system-page="members"',
+            'data-system-page="forbidden"',
+            'data-system-admin-panel="market"',
+            "m-sys-birth-date",
+            "m-sys-password-current",
+            "m-sys-token",
+            "m-sys-member-limit",
+            "data-system-switch",
+            "data-system-edit-model",
+            "data-system-open-member",
+            "管理员专区",
+            "保存密钥",
+            "保存分工",
+            'location.assign("/login/")',
+        ):
+            self.assertIn(marker, pages)
+
+    def test_system_boolean_attrs_do_not_have_stray_quotes(self) -> None:
+        pages = PAGES.read_text(encoding="utf-8")
+        stray = re.findall(r'data-system-[a-z-]*"(?=[>\s])', pages)
+        self.assertEqual(
+            stray,
+            [],
+            "boolean data-system attributes must not have a trailing quote before > or space",
+        )
+        for name in (
+            "data-system-save-birth",
+            "data-system-save-password",
+            "data-system-add-model",
+            "data-system-save-models",
+            "data-system-save-market",
+            "data-system-refresh",
+            "data-system-toggle-refresh",
+            "data-system-save-model",
+        ):
+            self.assertIn(name, pages)
+            self.assertNotIn(name + '">', pages)
@@ -20,6 +20,19 @@ registry, and verification tools.
 - `python tools/backfill_recent_snapshots.py --account <admin> [--lookback 60] [--dry-run]`:
  auditable recent trading-day dashboard snapshot backfill. See
  `docs/maintenance/行情历史补档.md`.
+- `bash tools/build_image.sh <commit> <tag>`: the only sanctioned way to build the
+  production Docker image. Streams `git archive <commit>` to the deploy host over SSH
+  (default `moxiaobai@192.168.200.11`), refuses tags that do not end with the commit
+  short SHA, verifies the revision label after the build, and appends a record to
+  `~/xiaobai-build/BUILD_LOG.tsv` on the host. Building from any server-side working
+  tree is forbidden; see `DOCKER_DEPLOY.md`. Before building, it runs
+  `tools/check_deploy_baseline.sh` so the candidate commit must contain the currently
+  running container's Git revision as an ancestor.
+- `bash tools/check_deploy_baseline.sh <commit> [--live-revision <sha>]`: deployment
+  ancestor gate. Reads the live `org.opencontainers.image.revision` from the running
+  `xiaobai-review` container (or `--live-revision` in tests), prints the live SHA,
+  candidate SHA, file diff, and commits the candidate would drop, then exits if the
+  live revision is not an ancestor of the candidate.

 `verify_baseline.py` does not inspect a parent checkout or skip tests according to files outside
 this application. Historical comparison scripts were retired after final standalone acceptance;
@@ -50,7 +50,13 @@ def _owner(path: str) -> str:


 def _role(method: str, path: str) -> str:
-    if path == "/api/health" or path in {"/api/auth/register", "/api/auth/login"}:
+    if path == "/api/health" or path in {
+        "/api/auth/register",
+        "/api/auth/login",
+        "/api/auth/accounts",
+        "/api/auth/switch",
+        "/api/auth/forget",
+    }:
        return "public"
    from api_access import required_role

@@ -0,0 +1,95 @@
+#!/usr/bin/env bash
+# 小白复盘唯一安全构建入口（HEL-235 固化）
+# 方式：从明确 Git 提交 git archive 流式传输到部署机 docker build，不使用任何服务器工作树。
+# 铁律：禁止在服务器目录（如 /opt/1panel/docker/compose/xiaobaifupan）里 docker build；
+#       禁止构建 latest 等不带提交短号的 tag；严禁向 192.168.200.36 构建或部署。
+set -euo pipefail
+
+HOST_DEFAULT="moxiaobai@192.168.200.11"
+REPO_NAME="xiaobai-review"
+
+usage() {
+  cat <<'EOF'
+用法: tools/build_image.sh <commit> <tag>
+  <commit>  提交号（完整或前缀），必须能被 origin 解析；构建前会自动 fetch
+  <tag>     镜像 tag，必须以 -<提交短号7位> 结尾，锁定镜像来源；禁止 latest、rollback-*
+示例: tools/build_image.sh cefc86917d89 verify-hel235-cefc869
+说明: 仅构建镜像，不启动、不替换任何容器；换版与回滚另行人工执行。
+EOF
+  exit 2
+}
+
+[ $# -eq 2 ] || usage
+COMMIT="$1"
+TAG="$2"
+HOST="${XB_BUILD_HOST:-$HOST_DEFAULT}"
+
+case "$HOST" in
+  *192.168.200.36*)
+    echo "拒绝：192.168.200.36 已永久废弃，严禁在其上构建或部署。" >&2
+    exit 1
+    ;;
+esac
+
+cd "$(git rev-parse --show-toplevel)"
+
+echo "==> 同步远端引用"
+git fetch origin --prune --quiet
+
+FULL_SHA="$(git rev-parse --verify --quiet "${COMMIT}^{commit}" || true)"
+if [ -z "$FULL_SHA" ]; then
+  echo "拒绝：提交 ${COMMIT} 无法解析。构建源必须锁定到已推送 origin 的明确提交。" >&2
+  exit 1
+fi
+SHORT="${FULL_SHA:0:7}"
+SUBJECT="$(git log -1 --format=%s "$FULL_SHA")"
+
+case "$TAG" in
+  latest)
+    echo "拒绝：禁止构建 latest，模糊 tag 无法追溯来源提交。" >&2
+    exit 1
+    ;;
+  rollback-*)
+    echo "拒绝：rollback-* 是部署时对既有镜像的人工 docker tag，不允许用来构建。" >&2
+    exit 1
+    ;;
+esac
+if [[ "$TAG" != *-"$SHORT" ]]; then
+  echo "拒绝：tag「${TAG}」必须以 -${SHORT} 结尾，保证镜像 tag 与来源提交一一对应。" >&2
+  exit 1
+fi
+
+echo "==> 部署基线门禁（线上提交必须是候选祖先）"
+bash "$(git rev-parse --show-toplevel)/tools/check_deploy_baseline.sh" "$FULL_SHA"
+
+echo "==> 构建计划"
+echo "    提交: ${FULL_SHA}  ${SUBJECT}"
+echo "    镜像: ${REPO_NAME}:${TAG}  @ ${HOST}"
+echo "    方式: git archive 流式构建（不读取服务器上任何代码目录）"
+
+echo "==> 流式构建开始"
+git archive --format=tar "$FULL_SHA" \
+  | ssh -o BatchMode=yes "$HOST" docker build --rm \
+      -t "${REPO_NAME}:${TAG}" \
+      --label "org.opencontainers.image.revision=${FULL_SHA}" \
+      --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
+      --label "org.opencontainers.image.source=git-archive-stream" \
+      -
+
+echo "==> 回读校验镜像内记录的提交号"
+GOT="$(ssh -o BatchMode=yes "$HOST" "docker image inspect ${REPO_NAME}:${TAG} --format '{{index .Config.Labels \"org.opencontainers.image.revision\"}}'" 2>/dev/null || true)"
+if [ "$GOT" != "$FULL_SHA" ]; then
+  echo "校验失败：镜像 revision='${GOT:-<空>}'，期望 ${FULL_SHA}。删除不可信镜像，中止。" >&2
+  ssh -o BatchMode=yes "$HOST" docker rmi "${REPO_NAME}:${TAG}" >/dev/null 2>&1 || true
+  exit 1
+fi
+
+IMAGE_ID="$(ssh -o BatchMode=yes "$HOST" "docker image inspect ${REPO_NAME}:${TAG} --format '{{.Id}}'")"
+SHORT_ID="${IMAGE_ID##*:}"
+
+ssh -o BatchMode=yes "$HOST" \
+  "mkdir -p ~/xiaobai-build && printf '%s\t%s\t%s\t%s\tgit-archive-stream\n' \"\$(date '+%F %T')\" ${REPO_NAME}:${TAG} ${FULL_SHA} ${SHORT_ID} >> ~/xiaobai-build/BUILD_LOG.tsv"
+
+echo "==> 完成"
+echo "    ${REPO_NAME}:${TAG}  (${SHORT_ID})"
+echo "    来源提交 ${FULL_SHA} 已写入镜像 label 与 ~/xiaobai-build/BUILD_LOG.tsv"
@@ -0,0 +1,126 @@
+#!/usr/bin/env bash
+# 部署基线门禁（HEL-238）：候选提交必须包含当前线上提交的全部历史。
+# 线上提交号从运行中的容器镜像 label 读取，禁止人工填写“看起来正确”的基线。
+set -euo pipefail
+
+HOST_DEFAULT="moxiaobai@192.168.200.11"
+CONTAINER_DEFAULT="xiaobai-review"
+
+usage() {
+  cat <<'EOF'
+用法: tools/check_deploy_baseline.sh <candidate_commit> [--live-revision <sha>]
+  <candidate_commit>     准备构建/部署的提交（完整或前缀）
+  --live-revision <sha>  仅测试用：直接指定线上提交，跳过 SSH 读取
+环境变量:
+  XB_BUILD_HOST          部署机 SSH（默认 moxiaobai@192.168.200.11）
+  XB_LIVE_CONTAINER      运行中容器名（默认 xiaobai-review）
+  XB_LIVE_REVISION       若已设置则视为线上提交，不再 SSH
+EOF
+  exit 2
+}
+
+[ $# -ge 1 ] || usage
+CANDIDATE="$1"
+shift
+LIVE_OVERRIDE=""
+while [ $# -gt 0 ]; do
+  case "$1" in
+    --live-revision)
+      [ $# -ge 2 ] || usage
+      LIVE_OVERRIDE="$2"
+      shift 2
+      ;;
+    -h|--help)
+      usage
+      ;;
+    *)
+      echo "拒绝：未知参数 $1" >&2
+      usage
+      ;;
+  esac
+done
+
+HOST="${XB_BUILD_HOST:-$HOST_DEFAULT}"
+CONTAINER="${XB_LIVE_CONTAINER:-$CONTAINER_DEFAULT}"
+
+case "$HOST" in
+  *192.168.200.36*)
+    echo "拒绝：192.168.200.36 已永久废弃，严禁在其上构建或部署。" >&2
+    exit 1
+    ;;
+esac
+
+cd "$(git rev-parse --show-toplevel)"
+
+read_live_revision() {
+  if [ -n "${LIVE_OVERRIDE}" ]; then
+    printf '%s\n' "${LIVE_OVERRIDE}"
+    return
+  fi
+  if [ -n "${XB_LIVE_REVISION:-}" ]; then
+    printf '%s\n' "${XB_LIVE_REVISION}"
+    return
+  fi
+  ssh -o BatchMode=yes "$HOST" bash -s -- "$CONTAINER" <<'REMOTE'
+set -euo pipefail
+container="$1"
+revision="$(docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$container" 2>/dev/null || true)"
+if [ -z "$revision" ] || [ "$revision" = "<no value>" ]; then
+  image="$(docker inspect --format '{{.Image}}' "$container" 2>/dev/null || true)"
+  if [ -n "$image" ]; then
+    revision="$(docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$image" 2>/dev/null || true)"
+  fi
+fi
+if [ -z "$revision" ] || [ "$revision" = "<no value>" ]; then
+  echo "拒绝：无法从线上容器 ${container} 读取 org.opencontainers.image.revision。" >&2
+  exit 1
+fi
+printf '%s\n' "$revision"
+REMOTE
+}
+
+LIVE_RAW="$(read_live_revision)"
+LIVE_RAW="$(printf '%s' "$LIVE_RAW" | tr -d '[:space:]')"
+if [ -z "$LIVE_RAW" ]; then
+  echo "拒绝：线上提交号为空，禁止继续构建或部署。" >&2
+  exit 1
+fi
+
+CANDIDATE_SHA="$(git rev-parse --verify --quiet "${CANDIDATE}^{commit}" || true)"
+if [ -z "$CANDIDATE_SHA" ]; then
+  echo "拒绝：候选提交 ${CANDIDATE} 无法解析。" >&2
+  exit 1
+fi
+
+LIVE_SHA="$(git rev-parse --verify --quiet "${LIVE_RAW}^{commit}" || true)"
+if [ -z "$LIVE_SHA" ]; then
+  echo "拒绝：线上提交 ${LIVE_RAW} 在本地仓库无法解析；请先 git fetch，禁止手工填写替代基线。" >&2
+  exit 1
+fi
+
+echo "==> 部署基线对照"
+echo "    线上提交: ${LIVE_SHA}"
+echo "    候选提交: ${CANDIDATE_SHA}"
+
+echo "==> 候选相对线上的文件差异"
+DIFF_FILES="$(git diff --name-only "$LIVE_SHA" "$CANDIDATE_SHA" || true)"
+if [ -z "$DIFF_FILES" ]; then
+  echo "    （无文件差异）"
+else
+  printf '%s\n' "$DIFF_FILES" | sed 's/^/    /'
+fi
+
+echo "==> 候选将丢失的提交（线上有、候选没有）"
+LOST="$(git log --oneline "$CANDIDATE_SHA".."$LIVE_SHA" || true)"
+if [ -z "$LOST" ]; then
+  echo "    （无）"
+else
+  printf '%s\n' "$LOST" | sed 's/^/    /'
+fi
+
+if ! git merge-base --is-ancestor "$LIVE_SHA" "$CANDIDATE_SHA"; then
+  echo "拒绝：候选提交不是当前线上提交的后继，部署会丢失线上已有提交。禁止构建或部署。" >&2
+  exit 1
+fi
+
+echo "==> 祖先关系通过：线上 ${LIVE_SHA:0:7} 是候选 ${CANDIDATE_SHA:0:7} 的祖先"
Author	SHA1	Message	Date
总工 Cursor multica-agent	d2a165ada8	fix(HEL-243): 当前账号可点击返回，避免切换死路当前账号行原先只显示对号、不可点击，单账号时只能关网页。现改为整行继续使用且不重新签发会话，并带回切换前的业务页。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 20:44:18 +08:00
总工	e29d5115fa	部署集成(HEL-241): 合入桌面登录门户返工 aef8a05（含 28px 底部缺口修复）	2026-08-29 20:09:41 +08:00
总工 Cursor multica-agent	aef8a059f2	fix(HEL-240): 去掉登录页底部状态栏缺口登录页覆盖全局 body 底边距，让左栏品牌面板铺满视口高度。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 20:04:22 +08:00
总工 Cursor multica-agent	f905b44675	feat(HEL-240): 按确认样图还原桌面登录页左右骨架把登录门户改回确认稿的品牌行、中下部主标题、底部行情标签和 K 线背景，并让超宽屏按比例展开左栏。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 19:21:13 +08:00
总工 Cursor multica-agent	541fb48c1c	feat(HEL-238): 按确认样图重做手机端系统管理，并加入部署基线门禁 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 17:34:50 +08:00
总工andmultica-agent	2a2d205a38	恢复集成(HEL-237): 并入 HEL-235 安全构建入口工具链（仅构建工具与文档，无运行时影响） Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 16:01:54 +08:00
总工andmultica-agent	34cb32d78f	恢复集成(HEL-237): 以完整基线 `89b8d33` 为底合入登录线 `cefc869` 事故根因：HEL-214/221/226/233 均直接基于 main(`8a5e78f`) 构建部署，绕过了 .11 正式线（HEL-183/188/190/191/192/193/199/207/208 + HEL-164 共 14 个已验收提交），导致问天工具行右对齐、侧栏等高、管理员刷新结果、快照补档、收盘日线修复等整体丢失。本合并以 deploy 前最后完整基线 89b8d33（镜像 official-limit-guard-d9ee725）为底，合入 cefc869（HEL-221 情绪周期等高、HEL-226 登录门户与免密切换、 HEL-233 移动端系统管理五页），三处 CSS 缓存版本统一刷新为 20260829-hel237， architecture-inventory 按合并后源码重新生成。 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 15:51:48 +08:00
总工andmultica-agent	58d2c2fbf6	部署(HEL-235): 修正构建留痕的远端参数传递 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:45:05 +08:00
总工andmultica-agent	585e42dac7	部署(HEL-235): 修复构建后回读校验的远端模板引号 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:44:02 +08:00
总工andmultica-agent	a50d48e5d4	部署(HEL-235): 固化 git 归档流式构建为唯一安全构建入口 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:43:04 +08:00
总工 Cursor multica-agent	cefc86917d	fix(HEL-233): 去掉系统管理按钮属性多余引号，恢复点击五个无值 data-system-* 属性名后多写了引号，选择器匹配失败导致按钮完全无效。 toast 改为在未打开抽屉时也能挂载，并补源码与真实点击回归。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:14:23 +08:00
总工 Cursor multica-agent	13cd9940f7	fix(HEL-233): 恢复移动端系统管理五页，避免再落入占位 nav 里的账号资料/改密/会员/系统设置/会员管理此前从未注册到 pages.js， HEL-227 把用户导向 /m/ 后全部落到占位页。按桌面端已有能力补齐真实页面，并加源码回归防止再次漏注册。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 12:41:38 +08:00
总工	f7cf9a6454	部署集成(HEL-227): 合并登录门户/免密切换(HEL-226)到含 HEL-221 修复的部署线	2026-08-29 11:34:03 +08:00
总工 Cursor multica-agent	f0a1adf52f	施工(HEL-226): 实现登录门户与本机免密切换账号用设备 Cookie 和授权表记住本机已验证账号，登录页按确认样图做成门户，不再把密码写进浏览器。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 11:24:39 +08:00
总工 Cursor multica-agent	213f735f6a	fix(HEL-221): 按确认样图实现情绪周期左右等高与夜间提示桌面分析区固定 600px 并 stretch 对齐，评分构成在剩余高度内分配；夜间 tooltip 使用指定深色对比度，图表按容器尺寸重绘且不随视口拉满整页。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-28 15:01:22 +00:00