fix(HEL-199): 为补档工具补上仓库根 sys.path 引导

使 python3 tools/backfill_recent_snapshots.py --help 在干净环境下可直接运行，并同步文档运行示例为容器内执行。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>
fix(HEL-190): 按真实交易日历补齐最近60日快照，修复断档后只显示当天
2026-08-27 15:12:42 +00:00 · 2026-08-27 14:50:32 +00:00
42 changed files with 1079 additions and 1879 deletions
@@ -18,8 +18,6 @@ TOKEN_PATTERN = re.compile(r"^[A-Za-z0-9_-]{20,128}$")
 USERNAME_PATTERN = re.compile(r"^[A-Za-z0-9_\-\u4e00-\u9fff]{3,30}$")
 SESSION_COOKIE = "xiaobai_session"
 SESSION_MAX_AGE = 30 * 24 * 60 * 60
 DEVICE_COOKIE = "xiaobai_device"
 DEVICE_MAX_AGE = 180 * 24 * 60 * 60
 def load_local_env() -> None:
@@ -2,7 +2,6 @@ from .m0001_adopt_legacy import MIGRATION as M0001_ADOPT_LEGACY
 from .m0002_job_runs import MIGRATION as M0002_JOB_RUNS
 from .m0003_llm_audit import MIGRATION as M0003_LLM_AUDIT
 from .m0004_mentor_notes import MIGRATION as M0004_MENTOR_NOTES
 from .m0005_account_switch_grants import MIGRATION as M0005_ACCOUNT_SWITCH_GRANTS
 from .runner import Migration, MigrationError, MigrationRunner
 MIGRATIONS = (
@@ -10,7 +9,6 @@ MIGRATIONS = (
    M0002_JOB_RUNS,
    M0003_LLM_AUDIT,
    M0004_MENTOR_NOTES,
    M0005_ACCOUNT_SWITCH_GRANTS,
 )
 __all__ = ["MIGRATIONS", "Migration", "MigrationError", "MigrationRunner"]
@@ -1,42 +0,0 @@
 from __future__ import annotations
 import sqlite3
 from backend.database.migrations.runner import Migration
 def create_account_switch_grants(connection: sqlite3.Connection) -> None:
    connection.execute(
        """
        CREATE TABLE IF NOT EXISTS account_switch_grants (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            device_hash TEXT NOT NULL,
            user_id INTEGER NOT NULL,
            granted_at TEXT NOT NULL,
            last_used_at TEXT NOT NULL,
            expires_at TEXT NOT NULL,
            UNIQUE (device_hash, user_id),
            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
        )
        """
    )
    connection.execute(
        """
        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_device
        ON account_switch_grants(device_hash, last_used_at DESC)
        """
    )
    connection.execute(
        """
        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_expiry
        ON account_switch_grants(expires_at)
        """
    )
 MIGRATION = Migration(
    version="0005",
    name="create_account_switch_grants",
    action=create_account_switch_grants,
    signature="account-switch-grants:v1:device,user,granted,used,expires,unique",
 )
@@ -28,11 +28,11 @@ class AccountApplicationMixin:
    def update_membership(self, payload: dict[str, Any]) -> None:
        self.accounts.update_membership(payload)
-    def register_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
+    def register_account(self, username: str, password: str) -> dict[str, Any]:
-        return self.accounts.register(username, password, device_hash)
+        return self.accounts.register(username, password)
-    def login_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
+    def login_account(self, username: str, password: str) -> dict[str, Any]:
-        return self.accounts.login(username, password, device_hash)
+        return self.accounts.login(username, password)
    def change_password(self, current_password: str, new_password: str) -> None:
        self.accounts.change_password(current_password, new_password)
@@ -1,108 +1,49 @@
 from __future__ import annotations
 import json
 import secrets
 from http import HTTPStatus
 from backend.features.accounts.security import token_hash
 class AccountHttpMixin:
    def _device_hash(self) -> str:
        raw = self.device_token()
        return token_hash(raw) if raw else ""
    def _ensure_device_token(self) -> str:
        return self.device_token() or secrets.token_urlsafe(32)
    def _auth_success_headers(self, session_token: str, device_raw: str) -> list[tuple[str, str]]:
        return [
            ("Set-Cookie", self.session_cookie(session_token)),
            ("Set-Cookie", self.device_cookie(device_raw)),
        ]
    def _send_authenticated_session(self, result: dict, status: HTTPStatus, device_raw: str) -> None:
        self.send_json(
            {
                "ok": True,
                "authenticated": True,
                "user": result["user"],
                "csrf_token": result["csrf_token"],
            },
            status,
            self._auth_success_headers(result["session_token"], device_raw),
        )
    def auth_register(self) -> None:
        try:
            body = self.read_json_body()
            device_raw = self._ensure_device_token()
            result = self.application_service.register_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
                token_hash(device_raw),
            )
-            self._send_authenticated_session(result, HTTPStatus.CREATED, device_raw)
+            self.send_json(
                {
                    "ok": True,
                    "authenticated": True,
                    "user": result["user"],
                    "csrf_token": result["csrf_token"],
                },
                HTTPStatus.CREATED,
                {"Set-Cookie": self.session_cookie(result["session_token"])},
            )
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def auth_login(self) -> None:
        try:
            body = self.read_json_body()
            device_raw = self._ensure_device_token()
            result = self.application_service.login_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
                token_hash(device_raw),
            )
-            self._send_authenticated_session(result, HTTPStatus.OK, device_raw)
+            self.send_json(
                {
                    "ok": True,
                    "authenticated": True,
                    "user": result["user"],
                    "csrf_token": result["csrf_token"],
                },
                headers={"Set-Cookie": self.session_cookie(result["session_token"])},
            )
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
    def auth_accounts(self) -> None:
        current_user_id = None
        if self.require_auth(send_error=False):
            current_user_id = int(self.auth_user["id"])
        payload = self.application_service.accounts.list_device_accounts(
            self._device_hash(),
            current_user_id,
        )
        self.send_json({"ok": True, **payload})
    def auth_switch(self) -> None:
        try:
            body = self.read_json_body()
            try:
                user_id = int(body.get("user_id"))
            except (TypeError, ValueError):
                user_id = 0
            device_raw = self.device_token()
            result = self.application_service.accounts.switch_account(
                token_hash(device_raw) if device_raw else "",
                user_id,
            )
            self._send_authenticated_session(
                result,
                HTTPStatus.OK,
                device_raw or self._ensure_device_token(),
            )
        except PermissionError as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def auth_forget(self) -> None:
        try:
            body = self.read_json_body()
            try:
                user_id = int(body.get("user_id"))
            except (TypeError, ValueError):
                user_id = 0
            self.application_service.accounts.forget_account(self._device_hash(), user_id)
        except (ValueError, json.JSONDecodeError):
            pass
        self.send_json({"ok": True})
    def auth_me(self) -> None:
        service = self.application_service
        if not self.require_auth(send_error=False):
@@ -114,15 +55,6 @@ class AccountHttpMixin:
                }
            )
            return
        headers = None
        if not self.device_token():
            device_raw = secrets.token_urlsafe(32)
            service.accounts.remember_account(
                token_hash(device_raw),
                int(self.auth_user["id"]),
                fresh=True,
            )
            headers = [("Set-Cookie", self.device_cookie(device_raw))]
        self.send_json(
            {
                "ok": True,
@@ -134,19 +66,15 @@ class AccountHttpMixin:
                    "membership": service.membership(),
                },
                "csrf_token": str(self.auth_user["csrf_token"]),
-            },
+            }
            headers=headers,
        )
    def auth_logout(self) -> None:
        raw_token = self.session_token()
        user_id = int(getattr(self, "auth_user", {}).get("id") or 0)
        if raw_token:
            from backend.features.accounts.security import token_hash
            self.application_service.database.delete_session(token_hash(raw_token))
        self.application_service.accounts.revoke_current_device_grant(
            self._device_hash(),
            user_id,
        )
        self.send_json(
            {"ok": True},
            headers={"Set-Cookie": self.session_cookie("", clear=True)},
@@ -234,96 +234,3 @@ class AccountRepositoryMixin:
                (user_id,),
            )
            return cursor.rowcount > 0
    def cleanup_expired_switch_grants(self, now: str) -> int:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE expires_at <= ?",
                (now,),
            )
        return int(cursor.rowcount)
    def list_switch_grants(self, device_hash: str, now: str) -> list[dict[str, Any]]:
        with self.connect() as connection:
            rows = connection.execute(
                """
                SELECT u.id, u.username, u.role, u.llm_mode, u.membership_status,
                       u.membership_plan, u.membership_starts_at, u.membership_expires_at,
                       u.created_at, g.last_used_at, g.granted_at, g.expires_at
                FROM account_switch_grants AS g
                JOIN users AS u ON u.id = g.user_id
                WHERE g.device_hash = ? AND g.expires_at > ?
                ORDER BY g.last_used_at DESC, g.id DESC
                """,
                (device_hash, now),
            ).fetchall()
        return [dict(row) for row in rows]
    def get_switch_grant(self, device_hash: str, user_id: int) -> dict[str, Any] | None:
        with self.connect() as connection:
            row = connection.execute(
                """
                SELECT device_hash, user_id, granted_at, last_used_at, expires_at
                FROM account_switch_grants
                WHERE device_hash = ? AND user_id = ?
                """,
                (device_hash, user_id),
            ).fetchone()
        return dict(row) if row else None
    def upsert_switch_grant(
        self,
        device_hash: str,
        user_id: int,
        granted_at: str,
        last_used_at: str,
        expires_at: str,
    ) -> None:
        with self.connect() as connection:
            connection.execute(
                """
                INSERT INTO account_switch_grants
                    (device_hash, user_id, granted_at, last_used_at, expires_at)
                VALUES (?, ?, ?, ?, ?)
                ON CONFLICT(device_hash, user_id) DO UPDATE SET
                    granted_at = excluded.granted_at,
                    last_used_at = excluded.last_used_at,
                    expires_at = excluded.expires_at
                """,
                (device_hash, user_id, granted_at, last_used_at, expires_at),
            )
    def prune_switch_grants(self, device_hash: str, keep: int) -> int:
        with self.connect() as connection:
            rows = connection.execute(
                """
                SELECT id FROM account_switch_grants
                WHERE device_hash = ?
                ORDER BY last_used_at DESC, id DESC
                """,
                (device_hash,),
            ).fetchall()
            extra = [int(row["id"]) for row in rows[keep:]]
            if not extra:
                return 0
            connection.execute(
                f"DELETE FROM account_switch_grants WHERE id IN ({','.join('?' * len(extra))})",
                extra,
            )
        return len(extra)
    def delete_switch_grant(self, device_hash: str, user_id: int) -> bool:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE device_hash = ? AND user_id = ?",
                (device_hash, user_id),
            )
        return cursor.rowcount > 0
    def delete_switch_grants_for_user(self, user_id: int) -> int:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE user_id = ?",
                (user_id,),
            )
        return int(cursor.rowcount)
@@ -6,9 +6,6 @@ class AccountRoutesMixin:
        if parsed.path == "/api/auth/me":
            self.auth_me()
            return True
        if parsed.path == "/api/auth/accounts":
            self.auth_accounts()
            return True
        return False
    def _handle_accounts_get(self, parsed) -> bool:
@@ -77,22 +77,15 @@ class AccountService:
        access = self.access_supplier() or self.database.user_access(self.current_user_id) or {}
        return self.membership_for_access(access)
-    GRANT_SLIDE_DAYS = 30
+    def register(self, username: str, password: str) -> dict[str, Any]:
    GRANT_HARD_DAYS = 180
    MAX_GRANTS_PER_DEVICE = 5
    SWITCH_REAUTH_MESSAGE = "该账号需重新验证"
    def register(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
        username = username.strip()
        self.validate_input(username, password)
        with self.auth_lock:
            salt, password_digest = hash_password(password)
            user = self.database.create_user(username, salt, password_digest)
-        result = self.create_session(user)
+        return self.create_session(user)
        self.remember_account(device_hash, int(user["id"]), fresh=True)
        return result
-    def login(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
+    def login(self, username: str, password: str) -> dict[str, Any]:
        username = username.strip()
        if not username or not password:
            raise ValueError("账号名和密码不能为空。")
@@ -103,9 +96,7 @@ class AccountService:
            str(user.get("password_hash") or ""),
        ):
            raise ValueError("账号名或密码不正确。")
-        result = self.create_session(user)
+        return self.create_session(user)
        self.remember_account(device_hash, int(user["id"]), fresh=True)
        return result
    def change_password(self, current_password: str, new_password: str) -> None:
        current_password = str(current_password or "")
@@ -121,86 +112,6 @@ class AccountService:
        salt, digest = hash_password(new_password)
        if not self.database.update_user_password(self.current_user_id, salt, digest):
            raise ValueError("账号不存在。")
        self.database.delete_switch_grants_for_user(self.current_user_id)
    @staticmethod
    def _utc_now() -> datetime:
        return datetime.now(timezone.utc)
    @classmethod
    def _iso(cls, value: datetime) -> str:
        return value.isoformat(timespec="seconds")
    def remember_account(self, device_hash: str, user_id: int, *, fresh: bool = False) -> None:
        if not device_hash or user_id <= 0:
            return
        now = self._utc_now()
        now_text = self._iso(now)
        self.database.cleanup_expired_switch_grants(now_text)
        existing = None if fresh else self.database.get_switch_grant(device_hash, user_id)
        granted_at = parse_iso_datetime(existing["granted_at"]) if existing else now
        if granted_at is None:
            granted_at = now
        expires = min(
            now + timedelta(days=self.GRANT_SLIDE_DAYS),
            granted_at + timedelta(days=self.GRANT_HARD_DAYS),
        )
        if not existing:
            self.database.prune_switch_grants(device_hash, self.MAX_GRANTS_PER_DEVICE - 1)
        self.database.upsert_switch_grant(
            device_hash,
            user_id,
            self._iso(granted_at),
            now_text,
            self._iso(expires),
        )
    def list_device_accounts(
        self, device_hash: str, current_user_id: int | None = None
    ) -> dict[str, Any]:
        if not device_hash:
            return {"accounts": [], "current_user_id": current_user_id}
        now_text = self._iso(self._utc_now())
        self.database.cleanup_expired_switch_grants(now_text)
        accounts = []
        for row in self.database.list_switch_grants(device_hash, now_text):
            accounts.append(
                {
                    "user_id": int(row["id"]),
                    "username": str(row["username"]),
                    "role": str(row.get("role") or "user"),
                    "membership": self.membership_for_access(row),
                    "last_used_at": str(row.get("last_used_at") or ""),
                }
            )
        return {"accounts": accounts, "current_user_id": current_user_id}
    def switch_account(self, device_hash: str, user_id: int) -> dict[str, Any]:
        if not device_hash or user_id <= 0:
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        now = self._utc_now()
        now_text = self._iso(now)
        self.database.cleanup_expired_switch_grants(now_text)
        grant = self.database.get_switch_grant(device_hash, user_id)
        expires = parse_iso_datetime(grant.get("expires_at")) if grant else None
        if not grant or not expires or expires <= now:
            if grant:
                self.database.delete_switch_grant(device_hash, user_id)
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        user = self.database.user_access(user_id)
        if not user:
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        result = self.create_session(user)
        self.remember_account(device_hash, user_id)
        return result
    def forget_account(self, device_hash: str, user_id: int) -> None:
        if device_hash and user_id > 0:
            self.database.delete_switch_grant(device_hash, user_id)
    def revoke_current_device_grant(self, device_hash: str, user_id: int) -> None:
        if device_hash and user_id > 0:
            self.database.delete_switch_grant(device_hash, user_id)
    def create_session(self, user: dict[str, Any]) -> dict[str, Any]:
        session_token = secrets.token_urlsafe(32)
@@ -0,0 +1,202 @@
 """Auditable recent-trading-day snapshot backfill helpers.
 Planning and backup stay free of provider imports so feature boundary tests remain green.
 The service layer supplies open trading dates from the live calendar and executes sync.
 """
 from __future__ import annotations
 import sqlite3
 from datetime import date, datetime, timedelta
 from pathlib import Path
 from typing import Any, Iterable
 MAX_RANGE_TRADING_DAYS = 15
 MAX_RECENT_TRADING_DAYS = 60
 DEFAULT_RECENT_TRADING_DAYS = 60
 # Tables touched by a successful historical dashboard sync. User / token / model
 # tables must never appear here.
 SNAPSHOT_BACKFILL_WRITE_TABLES = frozenset(
    {
        "dashboard_snapshots",
        "data_snapshots",
        "sync_runs",
    }
 )
 def clamp_recent_lookback(lookback: int) -> int:
    value = int(lookback)
    if value < 1:
        raise ValueError("回补交易日数量至少为 1。")
    if value > MAX_RECENT_TRADING_DAYS:
        raise ValueError(f"单次最多回补最近 {MAX_RECENT_TRADING_DAYS} 个交易日。")
    return value
 def calendar_window_start(end_date: str, lookback: int) -> str:
    """Natural-day lower bound large enough to cover lookback open sessions."""
    end = datetime.strptime(end_date, "%Y%m%d").date()
    span = max(40, int(lookback * 2) + 20)
    return (end - timedelta(days=span)).strftime("%Y%m%d")
 def select_open_trade_dates(
    calendar_rows: Iterable[dict[str, Any]],
    end_date: str,
    lookback: int,
 ) -> list[str]:
    """Pick the last ``lookback`` open SSE sessions on or before ``end_date``."""
    lookback = clamp_recent_lookback(lookback)
    end = normalize_compact_date(end_date)
    open_dates = sorted(
        {
            normalize_compact_date(str(row.get("cal_date") or ""))
            for row in calendar_rows
            if int(row.get("is_open") or 0) == 1 and row.get("cal_date")
        }
    )
    open_dates = [item for item in open_dates if item <= end]
    if not open_dates:
        raise ValueError("交易日历未返回可用交易日，请检查行情 Token。")
    return open_dates[-lookback:]
 def select_open_trade_dates_in_range(
    calendar_rows: Iterable[dict[str, Any]],
    start_date: str,
    end_date: str,
    *,
    maximum: int = MAX_RANGE_TRADING_DAYS,
 ) -> tuple[list[str], list[str]]:
    """Return (open_dates, skipped_non_trading_days) inside an inclusive range."""
    start = normalize_compact_date(start_date)
    end = normalize_compact_date(end_date)
    if start > end:
        raise ValueError("开始日期不能晚于结束日期。")
    open_set = {
        normalize_compact_date(str(row.get("cal_date") or ""))
        for row in calendar_rows
        if int(row.get("is_open") or 0) == 1 and row.get("cal_date")
    }
    open_dates: list[str] = []
    skipped: list[str] = []
    cursor = datetime.strptime(start, "%Y%m%d").date()
    last = datetime.strptime(end, "%Y%m%d").date()
    while cursor <= last:
        compact = cursor.strftime("%Y%m%d")
        if compact in open_set:
            open_dates.append(compact)
        else:
            skipped.append(compact)
        cursor += timedelta(days=1)
    if len(open_dates) > maximum:
        raise ValueError(f"单次最多回补 {maximum} 个交易日。")
    return open_dates, skipped
 def classify_snapshot_coverage(
    trade_dates: list[str],
    existing_dates: Iterable[str],
 ) -> dict[str, Any]:
    present_set = {
        normalize_compact_date(item)
        for item in existing_dates
        if item
    }
    present = [item for item in trade_dates if item in present_set]
    missing = [item for item in trade_dates if item not in present_set]
    return {
        "trade_dates": list(trade_dates),
        "present": present,
        "missing": missing,
        "present_count": len(present),
        "missing_count": len(missing),
    }
 def create_sqlite_backup(
    source_path: Path,
    backup_dir: Path,
    *,
    label: str = "pre-backfill",
    stamped_at: datetime | None = None,
 ) -> Path:
    """Create a timestamped SQLite backup via the native backup API."""
    source = Path(source_path)
    if not source.exists():
        raise FileNotFoundError(f"数据库不存在：{source}")
    stamp = (stamped_at or datetime.now().astimezone()).strftime("%Y%m%d-%H%M%S")
    safe_label = "".join(ch if ch.isalnum() or ch in "-_" else "-" for ch in label).strip("-") or "backup"
    backup_dir = Path(backup_dir)
    backup_dir.mkdir(parents=True, exist_ok=True)
    target = backup_dir / f"review-{safe_label}-{stamp}.db"
    source_conn = sqlite3.connect(f"file:{source}?mode=ro", uri=True)
    try:
        target_conn = sqlite3.connect(target)
        try:
            source_conn.backup(target_conn)
            target_conn.commit()
        finally:
            target_conn.close()
    finally:
        source_conn.close()
    return target
 def display_date(compact: str) -> str:
    value = normalize_compact_date(compact)
    return f"{value[:4]}-{value[4:6]}-{value[6:8]}"
 def normalize_compact_date(value: str) -> str:
    compact = str(value or "").replace("-", "").strip()
    if len(compact) != 8 or not compact.isdigit():
        raise ValueError("日期格式应为 YYYY-MM-DD。")
    datetime.strptime(compact, "%Y%m%d")
    return compact
 def build_backfill_audit(
    *,
    mode: str,
    end_date: str,
    lookback: int | None,
    coverage: dict[str, Any],
    skipped_non_trading_days: list[str] | None = None,
    backup_path: str | None = None,
    dry_run: bool = False,
    results: list[dict[str, Any]] | None = None,
 ) -> dict[str, Any]:
    results = list(results or [])
    succeeded = [row for row in results if row.get("status") == "success"]
    skipped = [row for row in results if row.get("status") == "skipped"]
    failed = [row for row in results if row.get("status") == "failed"]
    return {
        "ok": not failed,
        "mode": mode,
        "dry_run": dry_run,
        "end_date": display_date(end_date),
        "lookback": lookback,
        "backup_path": backup_path,
        "write_tables": sorted(SNAPSHOT_BACKFILL_WRITE_TABLES),
        "trade_dates": [display_date(item) for item in coverage.get("trade_dates") or []],
        "present": [display_date(item) for item in coverage.get("present") or []],
        "missing": [display_date(item) for item in coverage.get("missing") or []],
        "skipped_non_trading_days": [
            display_date(item) for item in (skipped_non_trading_days or [])
        ],
        "present_count": int(coverage.get("present_count") or 0),
        "missing_count": int(coverage.get("missing_count") or 0),
        "results": results,
        "succeeded_count": len(succeeded),
        "skipped_count": len(skipped),
        "failed_count": len(failed),
        "created_dates": [
            str(row.get("trade_date") or "")
            for row in succeeded
            if row.get("action") == "created"
        ],
    }
@@ -227,6 +227,31 @@ class MarketRepositoryMixin:
            result.append(payload)
        return result
    def list_snapshot_trade_dates(
        self,
        start_date: str = "",
        end_date: str = "",
    ) -> list[str]:
        clauses: list[str] = []
        parameters: list[Any] = []
        if start_date:
            clauses.append("trade_date >= ?")
            parameters.append(start_date)
        if end_date:
            clauses.append("trade_date <= ?")
            parameters.append(end_date)
        where = f"WHERE {' AND '.join(clauses)}" if clauses else ""
        with self.connect() as connection:
            rows = connection.execute(
                f"""
                SELECT trade_date FROM dashboard_snapshots
                {where}
                ORDER BY trade_date
                """,
                parameters,
            ).fetchall()
        return [str(row["trade_date"]) for row in rows]
    def start_sync(self, trade_date: str, source: str) -> int:
        started_at = datetime.now().astimezone().isoformat(timespec="seconds")
        with self.connect() as connection:
@@ -3,9 +3,11 @@ from __future__ import annotations
 import copy
 import re
 from datetime import date, datetime, time as dt_time, timedelta
 from pathlib import Path
 from typing import Any
 from backend.bootstrap.config import (
    DATA_DIR,
    normalize_date,
    tushare_code,
    validate_stock_code,
@@ -13,6 +15,17 @@ from backend.bootstrap.config import (
 )
 from backend.data.providers.ifind_client import IfindError
 from backend.data.providers.tushare_client import TushareClient, TushareError
 from backend.features.market.backfill_history import (
    DEFAULT_RECENT_TRADING_DAYS,
    MAX_RANGE_TRADING_DAYS,
    build_backfill_audit,
    calendar_window_start,
    classify_snapshot_coverage,
    create_sqlite_backup,
    display_date,
    select_open_trade_dates,
    select_open_trade_dates_in_range,
 )
 from backend.features.market.charts import ChartDataError
 from backend.features.market.insights import MarketInsightsService
 from backend.features.sentiment.engine import SENTIMENT_ENGINE_VERSION
@@ -890,31 +903,226 @@ class MarketServiceMixin:
            "intraday": intraday_points,
        }
-    def backfill(self, start_date: str, end_date: str) -> list[dict[str, Any]]:
+    def backfill(
-        start = datetime.strptime(normalize_date(start_date), "%Y%m%d").date()
+        self,
-        end = datetime.strptime(normalize_date(end_date), "%Y%m%d").date()
+        start_date: str = "",
-        if start > end:
+        end_date: str = "",
-            raise ValueError("开始日期不能晚于结束日期。")
+        *,
-        weekdays = []
+        lookback: int | None = None,
-        current = start
+        dry_run: bool = False,
-        while current <= end:
+        force: bool = False,
-            if current.weekday() < 5:
+        create_backup: bool = True,
-                weekdays.append(current)
+    ) -> dict[str, Any]:
-            current += timedelta(days=1)
+        """Backfill dashboard snapshots for real trading days only.
-        if len(weekdays) > 15:
+
-            raise ValueError("单次最多回补 15 个工作日。")
+        - Date-range mode keeps the admin UI contract (max 15 open sessions).
-        results = []
+        - Recent mode fills the last N open sessions (default/max 60).
-        for day in weekdays:
+        Weekends and holidays are reported as skipped non-trading days, not errors.
-            dashboard = self.sync_dashboard(day.strftime("%Y%m%d"))
+        """
        if not self.configured:
            raise ValueError("公共行情尚未配置，无法回补历史快照。")
        normalized_end = normalize_date(end_date or date.today().isoformat())
        if lookback is not None or not (start_date and end_date):
            target_lookback = (
                DEFAULT_RECENT_TRADING_DAYS if lookback is None else int(lookback)
            )
            return self.backfill_recent_trading_days(
                end_date=normalized_end,
                lookback=target_lookback,
                dry_run=dry_run,
                force=force,
                create_backup=create_backup,
            )
        return self._backfill_date_range(
            start_date=normalize_date(start_date),
            end_date=normalized_end,
            dry_run=dry_run,
            force=force,
            create_backup=create_backup,
        )
    def backfill_recent_trading_days(
        self,
        end_date: str = "",
        lookback: int = DEFAULT_RECENT_TRADING_DAYS,
        *,
        dry_run: bool = False,
        force: bool = False,
        create_backup: bool = True,
    ) -> dict[str, Any]:
        normalized_end = normalize_date(end_date or date.today().isoformat())
        trade_dates = self._load_recent_open_trade_dates(normalized_end, lookback)
        existing = self.database.list_snapshot_trade_dates(
            trade_dates[0], trade_dates[-1]
        )
        coverage = classify_snapshot_coverage(trade_dates, existing)
        return self._execute_snapshot_backfill(
            mode="recent",
            end_date=normalized_end,
            lookback=lookback,
            coverage=coverage,
            skipped_non_trading_days=[],
            dry_run=dry_run,
            force=force,
            create_backup=create_backup,
        )
    def _backfill_date_range(
        self,
        start_date: str,
        end_date: str,
        *,
        dry_run: bool = False,
        force: bool = False,
        create_backup: bool = True,
    ) -> dict[str, Any]:
        window_start = calendar_window_start(end_date, MAX_RANGE_TRADING_DAYS)
        calendar_rows = self._tushare_client().query(
            "trade_cal",
            {
                "exchange": "SSE",
                "start_date": min(window_start, start_date),
                "end_date": end_date,
            },
            "cal_date,is_open,pretrade_date",
        )
        trade_dates, skipped = select_open_trade_dates_in_range(
            calendar_rows,
            start_date,
            end_date,
            maximum=MAX_RANGE_TRADING_DAYS,
        )
        if not trade_dates:
            raise ValueError("选定区间内没有交易日，周末或节假日无需回补。")
        existing = self.database.list_snapshot_trade_dates(trade_dates[0], trade_dates[-1])
        coverage = classify_snapshot_coverage(trade_dates, existing)
        return self._execute_snapshot_backfill(
            mode="range",
            end_date=end_date,
            lookback=None,
            coverage=coverage,
            skipped_non_trading_days=skipped,
            dry_run=dry_run,
            force=force,
            create_backup=create_backup,
        )
    def _load_recent_open_trade_dates(self, end_date: str, lookback: int) -> list[str]:
        start_date = calendar_window_start(end_date, lookback)
        calendar_rows = self._tushare_client().query(
            "trade_cal",
            {
                "exchange": "SSE",
                "start_date": start_date,
                "end_date": end_date,
            },
            "cal_date,is_open,pretrade_date",
        )
        return select_open_trade_dates(calendar_rows, end_date, lookback)
    def _execute_snapshot_backfill(
        self,
        *,
        mode: str,
        end_date: str,
        lookback: int | None,
        coverage: dict[str, Any],
        skipped_non_trading_days: list[str],
        dry_run: bool,
        force: bool,
        create_backup: bool,
    ) -> dict[str, Any]:
        targets = list(coverage["trade_dates"] if force else coverage["missing"])
        backup_path: str | None = None
        if create_backup and not dry_run and targets:
            backup = create_sqlite_backup(
                Path(self.database.path),
                DATA_DIR / "backups",
                label=f"pre-{mode}-backfill",
            )
            backup_path = str(backup)
        results: list[dict[str, Any]] = []
        if dry_run:
            for trade_date in coverage["trade_dates"]:
                exists = trade_date in coverage["present"]
                if exists and not force:
                    status = "skipped"
                    action = "exists"
                else:
                    status = "planned"
                    action = "refresh" if exists else "create"
                results.append(
                    {
                        "requested_date": display_date(trade_date),
                        "trade_date": display_date(trade_date),
                        "status": status,
                        "action": action,
                    }
                )
            return build_backfill_audit(
                mode=mode,
                end_date=end_date,
                lookback=lookback,
                coverage=coverage,
                skipped_non_trading_days=skipped_non_trading_days,
                backup_path=backup_path,
                dry_run=True,
                results=results,
            )
        present_before = set(coverage["present"])
        for trade_date in targets:
            existed = trade_date in present_before
            try:
                dashboard = self.sync_dashboard(trade_date)
                actual = normalize_date(
                    str(dashboard.get("meta", {}).get("trade_date") or trade_date)
                )
                results.append(
                    {
                        "requested_date": display_date(trade_date),
                        "trade_date": display_date(actual),
                        "status": "success",
                        "action": "refreshed" if existed else "created",
                        "source": dashboard.get("meta", {}).get("source"),
                        "records": self._record_count(dashboard),
                    }
                )
            except Exception as exc:
                results.append(
                    {
                        "requested_date": display_date(trade_date),
                        "trade_date": display_date(trade_date),
                        "status": "failed",
                        "action": "refresh" if existed else "create",
                        "error": str(exc),
                    }
                )
        for trade_date in coverage["present"]:
            if force:
                continue
            results.append(
                {
-                    "requested_date": day.isoformat(),
+                    "requested_date": display_date(trade_date),
-                    "trade_date": dashboard["meta"]["trade_date"],
+                    "trade_date": display_date(trade_date),
-                    "source": dashboard["meta"]["source"],
+                    "status": "skipped",
-                    "records": self._record_count(dashboard),
+                    "action": "exists",
                }
            )
-        return results
+
        results.sort(key=lambda row: str(row.get("requested_date") or ""))
        return build_backfill_audit(
            mode=mode,
            end_date=end_date,
            lookback=lookback,
            coverage=coverage,
            skipped_non_trading_days=skipped_non_trading_days,
            backup_path=backup_path,
            dry_run=False,
            results=results,
        )
    def _stock_identity(self, code: str, trade_date: str) -> tuple[str, str]:
        snapshot = self.database.get_snapshot(trade_date) or {}
@@ -29,11 +29,17 @@ class SystemRoutesMixin:
    def backfill_data(self) -> None:
        try:
            body = self.read_json_body()
-            results = self.application_service.backfill(
+            lookback_raw = body.get("lookback")
            lookback = int(lookback_raw) if lookback_raw not in (None, "") else None
            audit = self.application_service.backfill(
                str(body.get("start_date") or ""),
                str(body.get("end_date") or ""),
                lookback=lookback,
                dry_run=bool(body.get("dry_run")),
                force=bool(body.get("force")),
                create_backup=body.get("create_backup", True) is not False,
            )
-            self.send_json({"ok": True, "results": results})
+            self.send_json({"ok": True, **audit, "results": audit.get("results") or []})
        except ValueError as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
        except Exception as exc:
@@ -7,8 +7,6 @@ from urllib.parse import urlparse
 PUBLIC_POST_HANDLERS = {
    "/api/auth/register": "auth_register",
    "/api/auth/login": "auth_login",
    "/api/auth/switch": "auth_switch",
    "/api/auth/forget": "auth_forget",
 }
 AUTHENTICATED_POST_HANDLERS = {
@@ -9,13 +9,7 @@ from http.cookies import SimpleCookie
 from typing import Any
 from urllib.parse import unquote
-from backend.bootstrap.config import (
+from backend.bootstrap.config import SESSION_COOKIE, SESSION_MAX_AGE, STATIC_DIR
    DEVICE_COOKIE,
    DEVICE_MAX_AGE,
    SESSION_COOKIE,
    SESSION_MAX_AGE,
    STATIC_DIR,
 )
 from backend.features.accounts.security import token_hash
 from backend.http.context import correlation_id
 from backend.http.errors import normalize_error_payload
@@ -27,21 +21,15 @@ class HttpTransportMixin:
    application_service: Any
    route_registry: Any
-    def cookie_value(self, name: str) -> str:
+    def session_token(self) -> str:
        cookie = SimpleCookie()
        try:
            cookie.load(self.headers.get("Cookie", ""))
        except Exception:
            return ""
-        morsel = cookie.get(name)
+        morsel = cookie.get(SESSION_COOKIE)
        return morsel.value if morsel else ""
    def session_token(self) -> str:
        return self.cookie_value(SESSION_COOKIE)
    def device_token(self) -> str:
        return self.cookie_value(DEVICE_COOKIE)
    def require_auth(self, send_error: bool = True) -> bool:
        raw_token = self.session_token()
        service = self.application_service
@@ -91,18 +79,15 @@ class HttpTransportMixin:
            return self.require_member()
        return True
-    def _cookie_header(self, name: str, value: str, max_age: int) -> str:
+    def session_cookie(self, value: str, clear: bool = False) -> str:
-        cookie = f"{name}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
+        max_age = 0 if clear else SESSION_MAX_AGE
        cookie = (
            f"{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
        )
        if self.headers.get("X-Forwarded-Proto", "").lower() == "https":
            cookie += "; Secure"
        return cookie
    def session_cookie(self, value: str, clear: bool = False) -> str:
        return self._cookie_header(SESSION_COOKIE, value, 0 if clear else SESSION_MAX_AGE)
    def device_cookie(self, value: str, clear: bool = False) -> str:
        return self._cookie_header(DEVICE_COOKIE, value, 0 if clear else DEVICE_MAX_AGE)
    def read_json_body(self, allow_empty: bool = False) -> dict[str, Any]:
        length = int(self.headers.get("Content-Length", "0"))
        if length == 0 and allow_empty:
@@ -147,7 +132,7 @@ class HttpTransportMixin:
        self,
        payload: dict[str, Any],
        status: HTTPStatus = HTTPStatus.OK,
-        headers: dict[str, str] | list[tuple[str, str]] | tuple[tuple[str, str], ...] | None = None,
+        headers: dict[str, str] | None = None,
    ) -> None:
        request_id = getattr(self, "_correlation_id", "")
        if not request_id:
@@ -160,8 +145,7 @@ class HttpTransportMixin:
        self.send_header("Content-Length", str(len(content)))
        self.send_header("Cache-Control", "no-store")
        self.send_header("X-Request-ID", request_id)
-        header_items = headers.items() if isinstance(headers, dict) else (headers or ())
+        for name, value in (headers or {}).items():
        for name, value in header_items:
            self.send_header(name, value)
        self.end_headers()
        self.wfile.write(content)
@@ -128,20 +128,6 @@
      "feature": "auction",
      "access": "authenticated"
    },
    {
      "method": "GET",
      "path": "/api/auth/accounts",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/forget",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/login",
@@ -170,13 +156,6 @@
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/switch",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/backfill",
@@ -10,10 +10,10 @@
  },
  "counts": {
    "primary_pages": 16,
-    "api_exact_paths": 56,
+    "api_exact_paths": 53,
    "api_prefixes": 0,
    "api_patterns": 11,
-    "database_tables": 37,
+    "database_tables": 36,
    "frontend_page_fragments": 12
  },
  "pages": [
@@ -96,13 +96,10 @@
      "/api/assistant/chat",
      "/api/assistant/messages",
      "/api/auction",
      "/api/auth/accounts",
      "/api/auth/forget",
      "/api/auth/login",
      "/api/auth/logout",
      "/api/auth/me",
      "/api/auth/register",
      "/api/auth/switch",
      "/api/backfill",
      "/api/chart/intraday",
      "/api/dashboard",
@@ -192,7 +189,6 @@
    "assistant_messages",
    "heaven_readings",
    "job_runs",
    "account_switch_grants",
    "schema_migrations"
  ],
  "background_job_methods": [
@@ -374,10 +370,10 @@
    }
  ],
  "css_layers": [
-    "/shared/tokens.css?v=20260829-1",
+    "/shared/tokens.css?v=20260820-3",
    "/shared/base.css?v=20260806-1",
    "/shared/shell.css?v=20260820-8",
-    "/shared/auth.css?v=20260829-1",
+    "/shared/auth.css?v=20260820-5",
    "/shared/components/controls.css?v=20260820-2",
    "/shared/components/navigation.css?v=20260820-1",
    "/shared/components/cards.css?v=20260820-1",
@@ -465,8 +461,8 @@
    },
    {
      "path": "frontend/index.html",
-      "bytes": 48037,
+      "bytes": 47871,
-      "lines": 663
+      "lines": 661
    },
    {
      "path": "backend/features/screener/catalog.py",
@@ -545,8 +541,8 @@
    },
    {
      "path": "frontend/shared/admin.js",
-      "bytes": 14145,
+      "bytes": 14410,
-      "lines": 261
+      "lines": 268
    },
    {
      "path": "backend/features/heaven/market_context.py",
@@ -555,8 +551,8 @@
    },
    {
      "path": "frontend/shared/session.js",
-      "bytes": 12848,
+      "bytes": 13176,
-      "lines": 283
+      "lines": 293
    },
    {
      "path": "backend/features/market/insights_auction_data.py",
@@ -720,8 +716,8 @@
    },
    {
      "path": "backend/http/dispatch.py",
-      "bytes": 4196,
+      "bytes": 4118,
-      "lines": 117
+      "lines": 115
    },
    {
      "path": "frontend/shared/table.js",
@@ -738,16 +734,16 @@
      "bytes": 3369,
      "lines": 81
    },
    {
      "path": "frontend/app.js",
      "bytes": 3337,
      "lines": 95
    },
    {
      "path": "frontend/pages/themes/page.html",
      "bytes": 3316,
      "lines": 55
    },
    {
      "path": "frontend/app.js",
      "bytes": 3201,
      "lines": 93
    },
    {
      "path": "backend/features/market/insights_context.py",
      "bytes": 3175,
@@ -765,7 +761,7 @@
    },
    {
      "path": "backend/features/accounts/application.py",
-      "bytes": 2514,
+      "bytes": 2442,
      "lines": 63
    },
    {
@@ -803,6 +799,11 @@
      "bytes": 1919,
      "lines": 45
    },
    {
      "path": "backend/features/system/routes.py",
      "bytes": 1791,
      "lines": 46
    },
    {
      "path": "backend/jobs/service.py",
      "bytes": 1746,
@@ -833,11 +834,6 @@
      "bytes": 1455,
      "lines": 48
    },
    {
      "path": "backend/features/system/routes.py",
      "bytes": 1423,
      "lines": 40
    },
    {
      "path": "backend/features/themes/routes.py",
      "bytes": 1337,
@@ -853,11 +849,6 @@
      "bytes": 1143,
      "lines": 19
    },
    {
      "path": "backend/features/accounts/routes.py",
      "bytes": 908,
      "lines": 25
    },
    {
      "path": "backend/features/popularity/routes.py",
      "bytes": 822,
@@ -868,6 +859,11 @@
      "bytes": 817,
      "lines": 23
    },
    {
      "path": "backend/features/accounts/routes.py",
      "bytes": 803,
      "lines": 22
    },
    {
      "path": "backend/features/sentiment/routes.py",
      "bytes": 724,
@@ -0,0 +1,69 @@
 # 行情历史补档（最近 60 个交易日）
 用于修复 `dashboard_snapshots` 断档导致情绪周期 / 主题轮动 / 智能选股只剩当天的问题。
 保留 `latest_contiguous_history` 连续性规则；通过真实交易日历回补缺失交易日快照。
 ## 适用场景
 - 库中已有稀疏历史快照，但最近一个真实交易日缺失，接口 `available_days=1`。
 - 需要可重复执行、可审计、可回退的补档，而不是迁库或放宽算法。
 ## 前置
 1. 使用与线上一致的代码分支。
 2. 管理员账号已配置可用的公共 Tushare Token。
 3. 只操作目标环境自己的 `data/review.db`；禁止 `.36` 与 `.11` 互拷。
 ## 上线步骤（总工执行）
 在目标环境容器内执行（应用根目录；宿主机也可直接跑，脚本已自带仓库根 `sys.path` 引导）：
 ```bash
 # 1) 只读规划：区分已有、真正缺档；不会写入
 docker compose exec xiaobai-review python tools/backfill_recent_snapshots.py --account <管理员账号> --lookback 60 --dry-run --json
 # 2) 正式补档：先走 SQLite backup API 写 data/backups/review-pre-recent-backfill-*.db
 #    再对缺失交易日调用现有 sync_dashboard
 docker compose exec xiaobai-review python tools/backfill_recent_snapshots.py --account <管理员账号> --lookback 60 --json
 # 3) 验证
 #    GET /api/sentiment/history?trade_date=YYYY-MM-DD&limit=60
 #    期望 available_days >= 20，且不再只有 1 天
 ```
 管理端日期区间回补（`/api/backfill`）已改为只处理交易日历中的开市日，周末/节假日会进入
 `skipped_non_trading_days`，不再当成错误；单次仍限制 15 个交易日。最近 60 日请用本工具。
 ## 写入边界
 只会通过现有同步路径写入：
 - `dashboard_snapshots`
 - 同步审计表 `sync_runs`
 - 必要时的 `data_snapshots`（仅当请求日被解析到其他交易日）
 不得改动用户、Token、模型绑定或系统配置表。
 ## 回滚
 1. 优先按审计结果的 `created_dates` 精确删除新增行：
 ```sql
 DELETE FROM dashboard_snapshots WHERE trade_date IN ('YYYYMMDD', ...);
 ```
 2. 若需整库回退，停止写入后用补档前备份覆盖：
 ```bash
 # 示例：把 data/backups/review-pre-recent-backfill-YYYYMMDD-HHMMSS.db
 # 复制回 data/review.db 后重启容器
 ```
 3. 代码回退：对该提交执行 Git revert 后重新部署镜像。
 ## 验收要点
 - dry-run 与正式执行可重复跑；已有交易日默认跳过。
 - 周末、节假日出现在 `skipped_non_trading_days`，不计入失败。
 - 部分交易日同步失败时，其他日期仍会继续，并在审计结果中标 `failed`。
 - 情绪周期、主题轮动 9 列、智能选股置信度随连续交易日恢复。
@@ -25,10 +25,8 @@ async function initialize() {
  try {
    const session = await apiRequest("/api/auth/me");
    if (!session.authenticated) {
-      const params = new URLSearchParams();
+      if (session.registration_required) selectAuthMode("register");
-      if (session.registration_required) params.set("mode", "register");
+      showAuthGate();
      const query = params.toString();
      window.location.replace("/login/" + (query ? `?${query}` : ""));
      return;
    }
    await applyAuthenticatedSession(session);
@@ -24,9 +24,7 @@
    (() => {
      let theme = "light";
      try {
-        const stored = localStorage.getItem("xiaobaiTheme");
+        theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
        if (stored === "dark" || stored === "light") theme = stored;
        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
      } catch (_error) {
        theme = "light";
      }
@@ -34,10 +32,10 @@
      document.documentElement.style.colorScheme = theme;
    })();
  </script>
-  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-1">
+  <link rel="stylesheet" href="/shared/tokens.css?v=20260820-3">
  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
  <link rel="stylesheet" href="/shared/shell.css?v=20260820-8">
-  <link rel="stylesheet" href="/shared/auth.css?v=20260829-1">
+  <link rel="stylesheet" href="/shared/auth.css?v=20260820-5">
  <link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
  <link rel="stylesheet" href="/shared/components/navigation.css?v=20260820-1">
  <link rel="stylesheet" href="/shared/components/cards.css?v=20260820-1">
@@ -59,7 +57,7 @@
  <link rel="stylesheet" href="/pages/review/foundation.css?v=20260820-4">
 </head>
 <body>
-  <section id="authGate" class="auth-gate" aria-label="账号登录" hidden>
+  <section id="authGate" class="auth-gate" aria-label="账号登录">
    <div class="auth-shell">
      <div class="auth-brand">
        <div class="brand-mark" aria-hidden="true"><span class="brand-glyph">复</span></div>
@@ -1,59 +0,0 @@
 <!doctype html>
 <html lang="zh-CN">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="color-scheme" content="light dark">
  <title>登录 · 小白复盘</title>
  <script>
    (() => {
      let theme = "light";
      try {
        const stored = localStorage.getItem("xiaobaiTheme");
        if (stored === "dark" || stored === "light") theme = stored;
        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
      } catch (_error) {
        theme = "light";
      }
      document.documentElement.dataset.theme = theme;
      document.documentElement.style.colorScheme = theme;
    })();
  </script>
  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-1">
  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
  <link rel="stylesheet" href="/shared/auth.css?v=20260829-1">
  <link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
 </head>
 <body class="login-portal">
  <button id="loginThemeToggle" class="login-theme-toggle" type="button">🌙 夜间</button>
  <aside class="login-brand" aria-hidden="true">
    <div class="login-brand-mark"><span class="login-brand-glyph">复</span></div>
    <p class="login-brand-kicker">收盘之后 · 复盘开始</p>
    <h1 class="login-brand-title">小白复盘</h1>
    <p class="login-brand-lead">看懂情绪周期，把复盘变成下一次的先手。</p>
    <dl class="login-brand-stats">
      <div class="login-stat">
        <dt>市场情绪</dt>
        <dd>72 <span class="login-stat-tag">高热</span></dd>
      </div>
      <div class="login-stat">
        <dt>涨停</dt>
        <dd>63</dd>
      </div>
      <div class="login-stat">
        <dt>跌停</dt>
        <dd>4</dd>
      </div>
      <div class="login-stat">
        <dt>两市成交</dt>
        <dd>1.02万亿</dd>
      </div>
    </dl>
  </aside>
  <main class="login-stage">
    <section class="login-card" id="loginCard" aria-live="polite"></section>
  </main>
  <script src="/shared/api.js?v=20260803-2"></script>
  <script src="/login/page.js?v=20260829-1"></script>
 </body>
 </html>
@@ -1,273 +0,0 @@
 (function bootLoginPortal(global) {
  "use strict";
  const THEME_KEY = "xiaobaiTheme";
  const api = global.XiaobaiAPI;
  const card = document.querySelector("#loginCard");
  const themeButton = document.querySelector("#loginThemeToggle");
  const state = {
    view: "first",
    mode: "login",
    accounts: [],
    currentUserId: null,
    loading: false,
    confirmingId: null,
    error: "",
  };
  function escapeHtml(value) {
    return String(value ?? "").replace(/[&<>"']/g, (ch) => (
      { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch]
    ));
  }
  function preferredTheme() {
    try {
      const stored = global.localStorage.getItem(THEME_KEY);
      if (stored === "dark" || stored === "light") return stored;
    } catch (_error) {
      // Fall through to the system preference.
    }
    return global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches
      ? "dark"
      : "light";
  }
  function applyTheme(theme, persist) {
    const normalized = theme === "dark" ? "dark" : "light";
    document.documentElement.dataset.theme = normalized;
    document.documentElement.style.colorScheme = normalized;
    themeButton.textContent = normalized === "dark" ? "☀ 日间" : "🌙 夜间";
    themeButton.setAttribute("aria-label", normalized === "dark" ? "切换到日间模式" : "切换到夜间模式");
    if (persist) {
      try {
        global.localStorage.setItem(THEME_KEY, normalized);
      } catch (_error) {
        // Theme still applies for the current page when storage is unavailable.
      }
    }
  }
  function setError(message) {
    state.error = message || "";
  }
  function membershipLabel(account) {
    if (account.role === "admin") return account.membership?.subscribed ? "管理员 · 会员" : "管理员";
    return account.membership?.subscribed ? "会员" : "普通用户";
  }
  function enterApp() {
    const next = new URLSearchParams(global.location.search).get("next");
    global.location.replace(next && next.startsWith("/") ? next : "/");
  }
  function formMarkup(options) {
    const registering = state.mode === "register";
    const submitLabel = options.submitLabel
      || (state.loading ? "正在登录..." : registering ? "注册并进入" : options.add ? "添加并进入" : "登录");
    return [
      options.back
        ? '<button class="login-back" type="button" data-login-action="picker">返回账号列表</button>'
        : "",
      `<h2 class="login-card-title">${escapeHtml(options.title)}</h2>`,
      `<p class="login-card-lead">${escapeHtml(options.lead)}</p>`,
      '<div class="login-tabs" role="tablist">',
      `<button class="login-tab${state.mode === "login" ? " is-active" : ""}" type="button" data-auth-mode="login">登录</button>`,
      `<button class="login-tab${state.mode === "register" ? " is-active" : ""}" type="button" data-auth-mode="register">注册</button>`,
      "</div>",
      '<form class="login-form" id="loginForm">',
      '<label class="form-field"><span>账号名</span><input id="loginUsername" type="text" minlength="3" maxlength="30" autocomplete="username" required></label>',
      `<label class="form-field"><span>密码</span><input id="loginPassword" type="password" minlength="8" maxlength="128" autocomplete="${registering ? "new-password" : "current-password"}" required></label>`,
      `<label class="form-field" id="loginConfirmField"${registering ? "" : " hidden"}><span>确认密码</span><input id="loginPasswordConfirm" type="password" minlength="8" maxlength="128" autocomplete="new-password"${registering ? " required" : ""}></label>`,
      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : '<p class="login-error" hidden></p>',
      `<button class="button primary login-submit" type="submit"${state.loading ? " disabled" : ""}>`,
      state.loading ? '<span class="login-spinner" aria-hidden="true"></span>' : "",
      `<span>${escapeHtml(submitLabel)}</span></button>`,
      "</form>",
      '<p class="login-hint">密码连续输错 5 次将锁定 10 分钟。还没有账号？切换到「注册」创建。</p>',
    ].join("");
  }
  function accountRow(account) {
    const current = Number(account.user_id) === Number(state.currentUserId);
    const confirming = Number(state.confirmingId) === Number(account.user_id);
    const classes = `login-account-row${current ? " is-current" : ""}${confirming ? " is-confirming" : ""}`;
    if (state.view === "manage" && confirming) {
      return [
        `<div class="${classes}" data-user-id="${account.user_id}">`,
        `<p class="login-confirm-copy">移除「${escapeHtml(account.username)}」的本机记录？</p>`,
        '<div class="login-confirm-actions">',
        `<button class="button danger-button" type="button" data-forget-id="${account.user_id}">移除</button>`,
        '<button class="button" type="button" data-login-action="cancel-forget">取消</button>',
        "</div></div>",
      ].join("");
    }
    const action = state.view === "manage"
      ? `<button class="login-account-remove" type="button" data-confirm-id="${account.user_id}">移除</button>`
      : current
        ? '<span class="login-account-check" aria-hidden="true">✓</span>'
        : `<button class="login-account-enter" type="button" data-switch-id="${account.user_id}">进入</button>`;
    return [
      `<div class="${classes}" data-user-id="${account.user_id}">`,
      '<div class="login-account-meta">',
      `<strong>${escapeHtml(account.username)}</strong>`,
      `<span>${escapeHtml(membershipLabel(account))}${current ? " · 当前" : ""}</span>`,
      "</div>",
      action,
      "</div>",
    ].join("");
  }
  function pickerMarkup() {
    const count = state.accounts.length;
    const managing = state.view === "manage";
    return [
      `<h2 class="login-card-title">${managing ? "管理账号记录" : "选择账号"}</h2>`,
      `<p class="login-card-lead">这台电脑已记录 ${count} 个账号，可直接进入，无需再次输入密码。</p>`,
      managing
        ? '<button class="login-manage" type="button" data-login-action="picker">完成</button>'
        : "",
      `<div class="login-account-list">${state.accounts.map(accountRow).join("")}</div>`,
      managing
        ? ""
        : '<button class="login-add" type="button" data-login-action="add">＋ 添加账号</button>',
      managing
        ? ""
        : '<button class="login-manage" type="button" data-login-action="manage">管理已记录的账号</button>',
      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : "",
      '<p class="login-privacy"><span class="login-lock" aria-hidden="true">🔒</span>账号记录仅保存在这台电脑的浏览器中</p>',
    ].join("");
  }
  function render() {
    card.classList.toggle("is-loading", state.loading);
    if (state.view === "first" || state.view === "add") {
      card.innerHTML = formMarkup({
        title: state.view === "add" ? "添加账号" : "欢迎回来",
        lead: "登录后进入你的复盘空间",
        add: state.view === "add",
        back: state.view === "add",
      });
    } else {
      card.innerHTML = pickerMarkup();
    }
    bindCard();
  }
  function bindCard() {
    card.querySelectorAll("[data-auth-mode]").forEach((button) => {
      button.addEventListener("click", () => {
        state.mode = button.dataset.authMode === "register" ? "register" : "login";
        setError("");
        render();
      });
    });
    card.querySelectorAll("[data-login-action]").forEach((button) => {
      button.addEventListener("click", () => {
        const action = button.dataset.loginAction;
        if (action === "picker") {
          state.view = state.accounts.length ? "picker" : "first";
          state.confirmingId = null;
        } else if (action === "add") {
          state.view = "add";
          state.mode = "login";
        } else if (action === "manage") {
          state.view = "manage";
        } else if (action === "cancel-forget") {
          state.confirmingId = null;
        }
        setError("");
        render();
      });
    });
    card.querySelectorAll("[data-switch-id]").forEach((button) => {
      button.addEventListener("click", () => switchAccount(Number(button.dataset.switchId)));
    });
    card.querySelectorAll("[data-confirm-id]").forEach((button) => {
      button.addEventListener("click", () => {
        state.confirmingId = Number(button.dataset.confirmId);
        render();
      });
    });
    card.querySelectorAll("[data-forget-id]").forEach((button) => {
      button.addEventListener("click", () => forgetAccount(Number(button.dataset.forgetId)));
    });
    const form = card.querySelector("#loginForm");
    if (form) form.addEventListener("submit", submitCredentials);
  }
  async function loadAccounts() {
    const payload = await api.request("/api/auth/accounts");
    state.accounts = payload.accounts || [];
    state.currentUserId = payload.current_user_id ?? null;
    const params = new URLSearchParams(global.location.search);
    if (params.get("mode") === "register") state.mode = "register";
    if (params.get("notice")) setError(params.get("notice"));
    if (state.accounts.length) state.view = "picker";
    else state.view = "first";
  }
  async function submitCredentials(event) {
    event.preventDefault();
    const username = document.querySelector("#loginUsername").value.trim();
    const password = document.querySelector("#loginPassword").value;
    if (state.mode === "register" && password !== document.querySelector("#loginPasswordConfirm").value) {
      setError("两次输入的密码不一致。");
      render();
      return;
    }
    state.loading = true;
    setError("");
    render();
    try {
      await api.request(`/api/auth/${state.mode}`, "POST", { username, password });
      enterApp();
    } catch (error) {
      state.loading = false;
      setError(error.message || "账号操作失败");
      render();
    }
  }
  async function switchAccount(userId) {
    state.loading = true;
    setError("");
    render();
    try {
      await api.request("/api/auth/switch", "POST", { user_id: userId });
      enterApp();
    } catch (error) {
      state.loading = false;
      setError(error.message || "该账号需重新验证");
      render();
    }
  }
  async function forgetAccount(userId) {
    try {
      await api.request("/api/auth/forget", "POST", { user_id: userId });
      state.accounts = state.accounts.filter((item) => Number(item.user_id) !== Number(userId));
      state.confirmingId = null;
      if (!state.accounts.length) state.view = "first";
      setError("");
      render();
    } catch (error) {
      setError(error.message || "移除失败");
      render();
    }
  }
  themeButton.addEventListener("click", () => {
    applyTheme(document.documentElement.dataset.theme === "dark" ? "light" : "dark", true);
  });
  applyTheme(preferredTheme(), false);
  loadAccounts()
    .then(render)
    .catch((error) => {
      setError(error.message || "无法连接本地服务");
      state.view = "first";
      render();
    });
 })(window);
@@ -246,29 +246,6 @@ body {
  padding-top: 8px;
 }
 .m-auth-accounts {
  display: grid;
  gap: 8px;
  margin-bottom: 16px;
 }
 .m-auth-account {
  display: flex;
  align-items: center;
  justify-content: space-between;
  min-height: 48px;
  padding: 0 14px;
  border: 1px solid var(--border);
  border-radius: 10px;
  background: var(--surface);
  color: var(--text-primary);
 }
 .m-auth-account span {
  color: var(--action);
  font-size: var(--font-size-label);
 }
 .m-auth-brand {
  text-align: center;
  margin: 24px 0 20px;
@@ -15,9 +15,7 @@
      (() => {
        let theme = "light";
        try {
-          const stored = localStorage.getItem("xiaobaiTheme");
+          theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
          if (stored === "dark" || stored === "light") theme = stored;
          else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
        } catch (_error) {
          theme = "light";
        }
@@ -5,15 +5,10 @@
  function readTheme() {
    try {
-      const stored = global.localStorage.getItem(THEME_KEY);
+      return global.localStorage.getItem(THEME_KEY) === "dark" ? "dark" : "light";
      if (stored === "dark" || stored === "light") return stored;
    } catch (_error) {
      return "light";
    }
    if (global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches) {
      return "dark";
    }
    return "light";
  }
  function applyTheme(theme) {
@@ -250,7 +250,6 @@
      '<h2>小白复盘</h2>',
      '<p>登录后进入你的复盘空间</p>',
      "</div>",
      '<div class="m-auth-accounts" id="m-auth-accounts" hidden></div>',
      '<div class="m-auth-tabs">',
      '<button class="m-auth-tab active" type="button" data-auth-mode="login">登录</button>',
      '<button class="m-auth-tab" type="button" data-auth-mode="register">注册</button>',
@@ -266,7 +265,6 @@
    ].join("");
    authMode = "login";
    bindAuth();
    loadMobileAccounts();
  }
  function setAuthMode(mode) {
@@ -289,34 +287,6 @@
    document.getElementById("m-auth-form").addEventListener("submit", submitAuth);
  }
  async function loadMobileAccounts() {
    const host = document.getElementById("m-auth-accounts");
    if (!host || !global.MobileSession.listAccounts) return;
    try {
      const payload = await global.MobileSession.listAccounts();
      const accounts = payload.accounts || [];
      if (!accounts.length) return;
      host.hidden = false;
      host.innerHTML = accounts.map(function (account) {
        return '<button class="m-auth-account" type="button" data-switch-id="' + account.user_id + '">' +
          '<strong>' + escapeHtml(account.username) + '</strong>' +
          '<span>直接进入</span></button>';
      }).join("");
      host.querySelectorAll("[data-switch-id]").forEach(function (button) {
        button.addEventListener("click", async function () {
          try {
            await global.MobileSession.switchAccount(Number(button.dataset.switchId));
            replace(DEFAULT_HASH);
          } catch (error) {
            showAuthError(document.getElementById("m-auth-error"), error.message || "该账号需重新验证");
          }
        });
      });
    } catch (_error) {
      host.hidden = true;
    }
  }
  function showAuthError(element, message) {
    element.textContent = message;
    element.classList.remove("m-motion-fade-in");
@@ -47,30 +47,5 @@
    return Boolean(state.user && state.user.role === "admin");
  }
-  async function listAccounts() {
+  global.MobileSession = { state: state, me: me, login: login, register: register, logout: logout, isAdmin: isAdmin };
    return global.MobileAPI.request("/api/auth/accounts");
  }
  async function switchAccount(userId) {
    const payload = await global.MobileAPI.request("/api/auth/switch", "POST", {
      user_id: userId
    });
    return applySession(payload);
  }
  async function forgetAccount(userId) {
    await global.MobileAPI.request("/api/auth/forget", "POST", { user_id: userId });
  }
  global.MobileSession = {
    state: state,
    me: me,
    login: login,
    register: register,
    logout: logout,
    listAccounts: listAccounts,
    switchAccount: switchAccount,
    forgetAccount: forgetAccount,
    isAdmin: isAdmin
  };
 })(window);
@@ -1011,9 +1011,9 @@
  border-radius: 6px;
-  background: var(--sentiment-tooltip-bg);
+  background: var(--r2-ink);
-  color: var(--sentiment-tooltip-fg);
+  color: var(--text-inverse);
  font-size: 11px;
@@ -1021,8 +1021,6 @@
 }
 .sentiment-chart-tooltip b {
  color: inherit;
  font-weight: 700;
 }
@@ -1570,6 +1568,10 @@
  #sentimentCycleView .sentiment-component-item {
    padding: 4px 0px;
  }
  #sentimentCycleView .sentiment-component-item small {
    display: none;
  }
 }
@media (min-width: 768px) {
@@ -1762,72 +1764,3 @@
    grid-template-columns: repeat(2, minmax(0, 1fr));
  }
 }
@media (min-width: 1024px) {
  #sentimentCycleView .redesigned-emotion-grid {
    align-items: stretch;
    height: var(--sentiment-analysis-height);
    max-height: var(--sentiment-analysis-height);
    overflow: hidden;
  }
  .redesigned-sentiment-view .sentiment-analysis-main,
  .redesigned-sentiment-view .sentiment-analysis-rail {
    align-self: stretch;
    height: 100%;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-trend-panel {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-chart-shell {
    flex: 1 1 auto;
    height: auto;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-chart-shell canvas {
    height: 100%;
  }
  .redesigned-sentiment-view .sentiment-cycle-summary {
    flex: 0 0 auto;
  }
  .redesigned-sentiment-view .sentiment-components-panel {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-component-list {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    justify-content: space-evenly;
    min-height: 0px;
  }
 }
@@ -1,39 +1,10 @@
 let sentimentChartAnimationFrame = null;
 let sentimentChartResizeObserver = null;
 let sentimentChartLastSize = "";
 window.XiaobaiPageModules.register("sentiment", ["sentimentCycleView"], {
  bind: bindSentimentEvents,
  enter: ["loadSentiment"],
 });
 function sentimentChartSizeKey(target) {
  if (!target) return "";
  const rect = target.getBoundingClientRect();
  return `${Math.round(rect.width)}x${Math.round(rect.height)}x${window.devicePixelRatio || 1}`;
 }
 function observeSentimentTrendChart() {
  const shell = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
  if (!shell) return;
  if (!sentimentChartResizeObserver) {
    sentimentChartResizeObserver = new ResizeObserver(() => {
      if (sentimentChartAnimationFrame) return;
      if (state.activeView !== "sentimentCycleView") return;
      const rows = state.sentimentHistory?.rows;
      if (!rows?.length) return;
      const current = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
      const nextKey = sentimentChartSizeKey(current);
      if (!nextKey || nextKey === sentimentChartLastSize) return;
      drawSentimentTrendChart(rows, 1);
    });
  } else {
    sentimentChartResizeObserver.disconnect();
  }
  sentimentChartLastSize = sentimentChartSizeKey(shell);
  sentimentChartResizeObserver.observe(shell);
 }
 async function loadSentimentHistory(force = false) {
  if (!state.dashboard || state.sentimentLoading) return;
  const key = `${elements.tradeDate.value}:${state.sentimentRange}`;
@@ -155,7 +126,6 @@ function animateSentimentTrendChart(rows) {
  if (sentimentChartAnimationFrame) cancelAnimationFrame(sentimentChartAnimationFrame);
  if (!motionEnabled()) {
    drawSentimentTrendChart(rows, 1);
    observeSentimentTrendChart();
    return;
  }
  const startedAt = performance.now();
@@ -165,10 +135,7 @@ function animateSentimentTrendChart(rows) {
    const progress = 1 - (1 - rawProgress) ** 3;
    drawSentimentTrendChart(rows, progress);
    if (rawProgress < 1) sentimentChartAnimationFrame = requestAnimationFrame(frame);
-    else {
+    else sentimentChartAnimationFrame = null;
      sentimentChartAnimationFrame = null;
      observeSentimentTrendChart();
    }
  };
  sentimentChartAnimationFrame = requestAnimationFrame(frame);
 }
@@ -177,9 +144,9 @@ function drawSentimentTrendChart(rows, progress = 1) {
  const canvas = document.querySelector("#sentimentTrendChart");
  if (!canvas || !rows.length || state.activeView !== "sentimentCycleView") return;
  const rect = canvas.getBoundingClientRect();
-  if (rect.width < 8 || rect.height < 8) return;
+  if (!rect.width) return;
-  const width = rect.width;
+  const width = Math.max(320, rect.width);
-  const height = rect.height;
+  const height = Math.max(220, rect.height);
  const ratio = window.devicePixelRatio || 1;
  canvas.width = Math.round(width * ratio);
  canvas.height = Math.round(height * ratio);
@@ -291,7 +258,6 @@ function drawSentimentTrendChart(rows, progress = 1) {
    const dateText = displayCompactDate(row.trade_date).slice(5);
    context.fillText(dateText, x(index), height - padding.bottom + 10);
  });
  sentimentChartLastSize = sentimentChartSizeKey(canvas.closest(".sentiment-chart-shell"));
 }
 function bindSentimentChartTooltip(rows) {
@@ -7,7 +7,14 @@ async function backfillData() {
      start_date: document.querySelector("#backfillStart").value,
      end_date: document.querySelector("#backfillEnd").value,
    });
-    showToast(`历史回补完成，共处理 ${payload.results.length} 个工作日`);
+    const failed = (payload.failed_count || 0);
    const skipped = (payload.skipped_non_trading_days || []).length;
    const suffix = failed
      ? `，失败 ${failed} 个`
      : skipped
        ? `，跳过 ${skipped} 个非交易日`
        : "";
    showToast(`历史回补完成，共处理 ${payload.results.length} 个交易日${suffix}`);
    state.sentimentHistory = null;
    state.sentimentHistoryKey = "";
    if (state.activeView === "sentimentCycleView") {
@@ -1667,445 +1667,3 @@ button.account-role-badge:focus-visible {
    display: inline-flex;
  }
 }
 .login-portal {
  min-height: 100vh;
  display: flex;
  background: var(--canvas);
  color: var(--text-primary);
 }
 .login-theme-toggle {
  position: fixed;
  z-index: 2;
  top: 16px;
  right: 20px;
  min-height: 32px;
  padding: 0 12px;
  border: 1px solid var(--border-strong);
  border-radius: var(--size-radius-md);
  background: var(--surface);
  color: var(--text-secondary);
  font-size: var(--font-size-label);
  cursor: pointer;
 }
 .login-brand {
  width: clamp(420px, 34vw, 560px);
  flex: 0 0 auto;
  padding: 44px 48px 36px;
  background: var(--login-brand-gradient);
  color: #f4f7ff;
 }
 .login-brand-mark {
  display: flex;
  align-items: center;
  justify-content: center;
  width: 56px;
  height: 56px;
  border-radius: 16px;
  background: rgba(255, 255, 255, 0.12);
 }
 .login-brand-glyph {
  font-size: 24px;
  font-weight: var(--font-weight-semibold);
 }
 .login-brand-kicker {
  margin: 28px 0 8px;
  font-size: var(--font-size-caption);
  letter-spacing: 0.08em;
  opacity: 0.78;
 }
 .login-brand-title {
  margin: 0;
  font-size: 36px;
  font-weight: var(--font-weight-semibold);
 }
 .login-brand-lead {
  margin: 12px 0 0;
  max-width: 18em;
  font-size: var(--font-size-body);
  line-height: 1.7;
  opacity: 0.86;
 }
 .login-brand-stats {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 16px 20px;
  margin: 40px 0 0;
 }
 .login-stat {
  margin: 0;
 }
 .login-stat dt {
  color: rgba(244, 247, 255, 0.64);
  font-size: var(--font-size-caption);
 }
 .login-stat dd {
  margin: 4px 0 0;
  font-size: 20px;
  font-weight: var(--font-weight-semibold);
 }
 .login-stat-tag {
  margin-left: 6px;
  font-size: var(--font-size-caption);
  font-weight: var(--font-weight-regular);
 }
 .login-stage {
  flex: 1 1 auto;
  display: grid;
  place-items: center;
  padding: 48px 24px;
 }
 .login-card {
  width: 400px;
  max-width: calc(100vw - 48px);
  padding: 32px;
  border: 1px solid var(--border-strong);
  border-radius: var(--size-radius-dialog);
  background: var(--surface);
  box-shadow: var(--shadow-raised);
 }
 .login-card.is-loading .login-form {
  pointer-events: none;
  opacity: 0.72;
 }
 .login-card-title {
  margin: 0;
  font-size: 22px;
  font-weight: var(--font-weight-semibold);
 }
 .login-card-lead {
  margin: 8px 0 0;
  color: var(--text-secondary);
  font-size: var(--font-size-label);
  line-height: 1.6;
 }
 .login-tabs {
  display: grid;
  grid-template-columns: 1fr 1fr;
  margin-top: 24px;
  border-bottom: 1px solid var(--line);
 }
 .login-tab {
  min-height: 40px;
  border: 0;
  border-bottom: 2px solid transparent;
  background: transparent;
  color: var(--text-secondary);
  cursor: pointer;
 }
 .login-tab.is-active {
  border-bottom-color: var(--action);
  color: var(--action);
  font-weight: var(--font-weight-medium);
 }
 .login-form {
  display: grid;
  gap: 14px;
  margin-top: 20px;
 }
 .login-portal .form-field input {
  height: 38px;
 }
 .login-submit {
  width: 100%;
  height: 40px;
  min-height: 40px;
 }
 .login-spinner {
  width: 14px;
  height: 14px;
  border: 2px solid currentColor;
  border-right-color: transparent;
  border-radius: 50%;
  animation: login-spin 0.7s linear infinite;
 }
@keyframes login-spin {
  to {
    transform: rotate(360deg);
  }
 }
 .login-error {
  margin: 0;
  color: var(--danger);
  font-size: var(--font-size-caption);
 }
 .login-error[hidden] {
  display: none;
 }
 .login-hint,
 .login-privacy {
  margin: 16px 0 0;
  color: var(--text-tertiary);
  font-size: var(--font-size-caption);
  line-height: 1.6;
 }
 .login-portal .login-privacy {
  display: flex;
  align-items: center;
  gap: 6px;
 }
 .login-lock {
  font-size: 12px;
 }
 .login-back,
 .login-add,
 .login-manage,
 .login-account-enter,
 .login-account-remove {
  border: 0;
  background: transparent;
  color: var(--action);
  cursor: pointer;
 }
 .login-portal .login-back {
  margin-bottom: 12px;
  padding: 0;
  font-size: var(--font-size-label);
 }
 .login-portal .login-add {
  display: block;
  width: 100%;
  min-height: 40px;
  margin-top: 8px;
  text-align: left;
 }
 .login-portal .login-manage {
  display: block;
  width: 100%;
  min-height: 40px;
  margin-top: 8px;
  text-align: left;
  color: var(--text-secondary);
 }
 .login-account-list {
  display: grid;
  gap: 8px;
  margin-top: 20px;
 }
 .login-account-row {
  display: flex;
  align-items: center;
  justify-content: space-between;
  min-height: 58px;
  padding: 0 14px;
  border: 1px solid var(--border);
  border-radius: var(--size-radius-md);
  background: var(--surface);
 }
 .login-account-row.is-current {
  border-color: var(--action);
 }
 .login-account-row.is-confirming {
  display: grid;
  gap: 10px;
  padding: 12px 14px;
 }
 .login-account-meta {
  display: grid;
  gap: 2px;
 }
 .login-account-meta strong {
  font-weight: var(--font-weight-medium);
 }
 .login-account-meta span {
  color: var(--text-tertiary);
  font-size: var(--font-size-caption);
 }
 .login-account-check {
  color: var(--action);
  font-size: 16px;
 }
 .login-confirm-copy {
  margin: 0;
  font-size: var(--font-size-label);
 }
 .login-confirm-actions {
  display: flex;
  gap: 8px;
 }
@media (max-width: 900px) {
  .login-portal {
    flex-direction: column;
  }
  .login-brand {
    width: 100%;
    padding: 20px 20px 16px;
  }
  .login-brand-lead,
  .login-brand-stats {
    display: none;
  }
  .login-brand-title {
    font-size: 22px;
  }
  .login-brand-kicker {
    margin-top: 12px;
  }
  .login-stage {
    padding: 28px 16px 40px;
  }
 }
@@ -53,10 +53,12 @@ async function applyAuthenticatedSession(session) {
 function showAuthGate(message = "") {
  state.user = null;
  state.csrfToken = "";
-  const params = new URLSearchParams();
+  const gate = document.querySelector("#authGate");
-  if (message) params.set("notice", message);
+  gate.hidden = false;
-  const query = params.toString();
+  const errorElement = document.querySelector("#authError");
-  window.location.replace("/login/" + (query ? `?${query}` : ""));
+  errorElement.textContent = message;
  errorElement.hidden = !message;
  document.querySelector("#authUsername").focus();
 }
 async function logoutAccount() {
@@ -195,8 +197,16 @@ async function changeAccountPassword(event) {
 }
 async function switchAccount() {
  const button = document.querySelector("#switchAccountMenuButton");
  button.disabled = true;
  toggleAccountDropdown(false);
-  window.location.assign("/login/");
+  try {
    await apiRequest("/api/auth/logout", "POST", {});
    window.location.reload();
  } catch (error) {
    showToast(error.message || "切换账号失败");
    button.disabled = false;
  }
 }
@@ -146,7 +146,6 @@
  --shadow-float: var(--elevation-float);
  --duration-fast: 150ms;
  --duration-normal: 220ms;
  --login-brand-gradient: linear-gradient(165deg, #0c1e4a, #16307c, #2153cc);
  --font-size-aux: 11.5px;
  --font-size-caption: 12.5px;
@@ -211,9 +210,6 @@
  --pool-table-max-height: calc(var(--content-height) - var(--topbar-height) - var(--page-pad-y) - var(--page-pad-y) - var(--card-gap));
  --sentiment-history-max-height: 510px;
  --sentiment-history-min-height: 220px;
  --sentiment-analysis-height: 600px;
  --sentiment-tooltip-bg: var(--text-primary);
  --sentiment-tooltip-fg: var(--text-inverse);
  --primary-share: 1.45fr;
  --secondary-share: .75fr;
  --mobile-nav-height: 64px;
@@ -509,13 +505,10 @@
  --chart-repair: #e2ad58;
  --chart-ma-10: #d39a45;
  --chart-ma-20: #9aa5af;
  --sentiment-tooltip-bg: #26293e;
  --sentiment-tooltip-fg: #e8eaed;
  --on-action: #101418;
  --warning-line: #6d5a38;
  --warning-line-strong: #66502d;
  --control-shadow: 0 1px 3px rgba(0, 0, 0, .3);
  --login-brand-gradient: linear-gradient(165deg, #080c18, #0e1730, #14224a);
  --dialog-backdrop: var(--backdrop);
  --ladder-level-1: #2d2426;
  --ladder-level-2: #2b2822;
@@ -47,72 +47,6 @@ function session(role = "admin", subscribed = true) {
  };
 }
 function sentimentHistoryPayload(days = 20) {
  const phases = ["冰点", "修复", "发酵", "高潮", "分化", "退潮"];
  const rows = Array.from({ length: days }, (_, index) => {
    const score = 28 + ((index * 7) % 55);
    return {
      trade_date: `2026-08-${String(index + 1).padStart(2, "0")}`,
      score,
      label: "情绪观察",
      phase: phases[index % phases.length],
      direction: index % 2 ? "升温" : "降温",
      day_change: index % 2 ? 3.2 : -2.1,
      seal_rate: 71.5,
      limit_up_count: 40 + index,
      first_board_count: 18,
      second_board_count: 8,
      three_plus_count: 4,
      max_height: 5,
      broken_count: 12,
      limit_down_count: 3,
      previous_limit_count: 38,
      previous_positive_count: 22,
      previous_positive_rate: 57.9,
      average_previous_change: 1.2,
      normalization: "固定锚点",
      components: {
        breadth: { label: "市场宽度", score: 55.8, weight: 20, summary: "红盘家数回升" },
        limit: { label: "涨停连板", score: 79.6, weight: 25, summary: "连板生态改善" },
        profit: { label: "赚钱效应", score: 67.0, weight: 30, summary: "昨日反馈尚可" },
        ladder: { label: "涨幅结构", score: 81.5, weight: 15, summary: "高度仍在扩张" },
        amount: { label: "成交活跃度", score: 46.1, weight: 10, summary: "量能略低于均值" },
      },
    };
  });
  return { available_days: days, rows };
 }
 async function renderSentimentFixture(page, days = 20) {
  await page.evaluate((payload) => {
    state.sentimentHistory = payload;
    renderSentimentHistory();
  }, sentimentHistoryPayload(days));
  await page.locator('[data-view="sentimentCycleView"]').first().click();
  await page.waitForTimeout(900);
 }
 function readSentimentLayout() {
  const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
  const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
  const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
  const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
  const chart = document.querySelector(".sentiment-chart-shell").getBoundingClientRect();
  const detail = document.querySelector(".sentiment-detail-toolbar").getBoundingClientRect();
  const table = document.querySelector(".sentiment-history-frame").getBoundingClientRect();
  const small = document.querySelector(".sentiment-component-item small");
  return {
    topDelta: Math.abs(trend.top - summary.top),
    bottomDelta: Math.abs(trend.bottom - components.bottom),
    analysisHeight: analysis.height,
    chartHeight: chart.height,
    detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom) - 0.5,
    tableVisible: table.top < window.innerHeight && table.bottom > detail.bottom,
    smallVisible: small ? getComputedStyle(small).display !== "none" : false,
    overflowX: document.documentElement.scrollWidth > document.documentElement.clientWidth + 1,
  };
 }
 function waitForApplicationRuntime(page) {
  return expect(page.locator("body")).toHaveAttribute("data-runtime-ready", "true");
 }
@@ -787,7 +721,6 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  await expect(page.locator(".sentiment-stage-guide, [data-sentiment-stage]")).toHaveCount(0);
  await expect(page.locator("#sentimentPhaseAdvice")).toHaveText("情绪指标继续走弱。");
  const alignment = await page.evaluate(() => {
    const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
    const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
    const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
    const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
@@ -799,8 +732,6 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    const statusStyle = getComputedStyle(document.querySelector(".sentiment-block .sentiment-text"));
    return {
      columnsAligned: Math.abs(trend.top - summary.top) < 1,
      bottomsAligned: Math.abs(trend.bottom - components.bottom) < 1,
      analysisHeight: analysis.height,
      railAligned: Math.abs(summary.x - components.x) < 1 && Math.abs(summary.width - components.width) < 1 && components.top > summary.bottom,
      detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom),
      chartHeight: chart.height,
@@ -812,8 +743,6 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    };
  });
  expect(alignment.columnsAligned).toBe(true);
  expect(alignment.bottomsAligned).toBe(true);
  expect(Math.abs(alignment.analysisHeight - 600)).toBeLessThanOrEqual(1);
  expect(alignment.railAligned).toBe(true);
  expect(alignment.detailAfterAnalysis).toBe(true);
  expect(alignment.chartHeight).toBeGreaterThanOrEqual(340);
@@ -851,68 +780,6 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  }
 });
 test("sentiment cycle keeps 600px equal-height layout across zoom viewports", async ({ page }, testInfo) => {
  const shotDir = testInfo.outputPath("hel-221-shots");
  await mockApplication(page, session("user", true));
  const viewports = [
    { name: "zoom-100", width: 2560, height: 1440 },
    { name: "zoom-110", width: 2327, height: 1309 },
    { name: "zoom-125", width: 2048, height: 1152 },
  ];
  for (const viewport of viewports) {
    await page.setViewportSize({ width: viewport.width, height: viewport.height });
    await page.goto("/index.html");
    await renderSentimentFixture(page, 20);
    const layout = await page.evaluate(readSentimentLayout);
    expect(layout.topDelta, viewport.name).toBeLessThanOrEqual(1);
    expect(layout.bottomDelta, viewport.name).toBeLessThanOrEqual(1);
    expect(Math.abs(layout.analysisHeight - 600), viewport.name).toBeLessThanOrEqual(1);
    expect(layout.chartHeight, viewport.name).toBeGreaterThanOrEqual(450);
    expect(layout.detailAfterAnalysis, viewport.name).toBe(true);
    expect(layout.tableVisible, viewport.name).toBe(true);
    expect(layout.smallVisible, viewport.name).toBe(true);
    expect(layout.overflowX, viewport.name).toBe(false);
    await page.screenshot({
      path: `${shotDir}/day-${viewport.name}.png`,
      fullPage: true,
    });
  }
  await page.setViewportSize({ width: 2560, height: 1440 });
  await page.locator("#themeToggle").click();
  await expect(page.locator("html")).toHaveAttribute("data-theme", "dark");
  await page.waitForTimeout(200);
  const nightLayout = await page.evaluate(readSentimentLayout);
  expect(nightLayout.topDelta).toBeLessThanOrEqual(1);
  expect(nightLayout.bottomDelta).toBeLessThanOrEqual(1);
  expect(Math.abs(nightLayout.analysisHeight - 600)).toBeLessThanOrEqual(1);
  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
  const tooltip = page.locator("#sentimentChartTooltip");
  await expect(tooltip).toBeVisible();
  await expect(tooltip).toContainText("温度");
  const tooltipStyle = await tooltip.evaluate((node) => {
    const style = getComputedStyle(node);
    const bold = getComputedStyle(node.querySelector("b") || node);
    return { background: style.backgroundColor, color: style.color, bold: bold.color };
  });
  expect(tooltipStyle.background).toBe("rgb(38, 41, 62)");
  expect(tooltipStyle.color).toBe("rgb(232, 234, 237)");
  expect(tooltipStyle.bold).toBe("rgb(232, 234, 237)");
  await page.screenshot({ path: `${shotDir}/night-zoom-100.png`, fullPage: true });
  await page.locator("#themeToggle").click();
  await expect(page.locator("html")).toHaveAttribute("data-theme", "light");
  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
  await expect(tooltip).toBeVisible();
  const lightTooltip = await tooltip.evaluate((node) => {
    const style = getComputedStyle(node);
    return { background: style.backgroundColor, color: style.color };
  });
  expect(lightTooltip.background).toBe("rgb(31, 35, 41)");
  expect(lightTooltip.color).toBe("rgb(255, 255, 255)");
 });
 test("limit-up pool separates stock identity and restores the reason column", async ({ page }) => {
  await mockApplication(page, session("user", true));
  await page.goto("/index.html");
@@ -1,151 +0,0 @@
 const { test, expect } = require("@playwright/test");
 function loginPayload(user) {
  return {
    ok: true,
    authenticated: true,
    csrf_token: "portal-csrf",
    user,
  };
 }
 async function mockLoginPortal(page, options = {}) {
  const accounts = options.accounts || [];
  let currentUserId = options.currentUserId ?? null;
  await page.route("**/api/**", async (route) => {
    const url = new URL(route.request().url());
    const method = route.request().method();
    if (url.pathname === "/api/auth/accounts") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({ ok: true, accounts, current_user_id: currentUserId }),
      });
      return;
    }
    if (url.pathname === "/api/auth/switch" && method === "POST") {
      const body = route.request().postDataJSON() || {};
      const account = accounts.find((item) => Number(item.user_id) === Number(body.user_id));
      if (!account || options.switchFails) {
        await route.fulfill({
          status: 401,
          contentType: "application/json",
          body: JSON.stringify({ error: "该账号需重新验证" }),
        });
        return;
      }
      currentUserId = account.user_id;
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify(loginPayload(account)),
      });
      return;
    }
    if (url.pathname === "/api/auth/forget" && method === "POST") {
      const body = route.request().postDataJSON() || {};
      const index = accounts.findIndex((item) => Number(item.user_id) === Number(body.user_id));
      if (index >= 0) accounts.splice(index, 1);
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({ ok: true }),
      });
      return;
    }
    if ((url.pathname === "/api/auth/login" || url.pathname === "/api/auth/register") && method === "POST") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify(loginPayload({
          id: 9,
          username: "new_user",
          role: "user",
          membership: { active: false, subscribed: false, is_admin: false },
        })),
      });
      return;
    }
    if (url.pathname === "/api/auth/me") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({
          ok: true,
          authenticated: Boolean(currentUserId),
          csrf_token: "portal-csrf",
          user: accounts.find((item) => Number(item.user_id) === Number(currentUserId)) || null,
        }),
      });
      return;
    }
    await route.fulfill({
      status: 200,
      contentType: "application/json",
      body: JSON.stringify({ ok: true }),
    });
  });
 }
 const SAVED_ACCOUNTS = [
  {
    user_id: 1,
    username: "alpha_user",
    role: "admin",
    membership: { active: true, subscribed: true, is_admin: true },
    last_used_at: "2026-08-29T01:00:00+00:00",
  },
  {
    user_id: 2,
    username: "beta_user",
    role: "user",
    membership: { active: false, subscribed: false, is_admin: false },
    last_used_at: "2026-08-28T01:00:00+00:00",
  },
 ];
 test("first-time login portal asks for a password and hides environment copy", async ({ page }) => {
  await mockLoginPortal(page, { accounts: [] });
  await page.goto("/login/");
  await expect(page.locator(".login-card-title")).toHaveText("欢迎回来");
  await expect(page.locator("#loginUsername")).toBeVisible();
  await expect(page.locator(".login-submit")).toHaveText("登录");
  await expect(page.locator("body")).not.toContainText("内网个人版");
  await expect(page.locator("body")).not.toContainText("192.168.200.11");
 });
 test("saved accounts can switch directly and show a re-auth message on failure", async ({ page }) => {
  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
  await page.goto("/login/");
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
  await expect(page.locator(".login-account-row")).toHaveCount(2);
  const switched = page.waitForRequest((request) => (
    request.url().includes("/api/auth/switch") && request.method() === "POST"
  ));
  await page.locator('[data-switch-id="2"]').click();
  const request = await switched;
  expect(JSON.parse(request.postData() || "{}")).toEqual({ user_id: 2 });
 });
 test("failed account switch stays on the portal with the original copy", async ({ page }) => {
  await mockLoginPortal(page, {
    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
    switchFails: true,
  });
  await page.goto("/login/");
  await page.locator('[data-switch-id="2"]').click();
  await expect(page.locator(".login-error")).toHaveText("该账号需重新验证");
  await expect(page).toHaveURL(/\/login\/?/);
 });
 test("managing accounts removes a local record after inline confirmation", async ({ page }) => {
  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
  await page.goto("/login/");
  await page.locator('[data-login-action="manage"]').click();
  await expect(page.locator(".login-card-title")).toHaveText("管理账号记录");
  await page.locator('[data-confirm-id="2"]').click();
  await expect(page.locator(".login-confirm-copy")).toContainText("beta_user");
  await page.locator('[data-forget-id="2"]').click();
  await expect(page.locator(".login-account-row")).toHaveCount(1);
  await expect(page.locator(".login-account-row")).toContainText("alpha_user");
 });
@@ -1,132 +0,0 @@
 from __future__ import annotations
 import threading
 import unittest
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from backend.features.accounts.security import SecretVault, token_hash
 from backend.features.accounts.service import AccountService
 from database import ReviewDatabase
 class AccountSwitchGrantTests(unittest.TestCase):
    def setUp(self) -> None:
        self.temp = TemporaryDirectory()
        self.database = ReviewDatabase(Path(self.temp.name) / "review.db")
        self.bound_user_id = 0
        self.service = AccountService(
            database=self.database,
            vault=SecretVault(SecretVault.generate_key()),
            current_user_supplier=lambda: self.bound_user_id,
            access_supplier=lambda: self.database.user_access(self.bound_user_id) or {},
            bind_user=self._bind,
            personal_field_builder=lambda *args, **kwargs: {},
            auth_lock=threading.Lock(),
        )
        self.device_a = token_hash("device-a-token")
        self.device_b = token_hash("device-b-token")
    def tearDown(self) -> None:
        self.temp.cleanup()
    def _bind(self, user_id: int) -> None:
        self.bound_user_id = int(user_id)
    def _register(self, username: str, device_hash: str = "") -> dict:
        return self.service.register(username, "Password123", device_hash or self.device_a)
    def test_login_records_accounts_for_the_current_device_only(self) -> None:
        first = self._register("alpha_user")
        second = self._register("beta_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        listed = self.service.list_device_accounts(self.device_a)
        names = [item["username"] for item in listed["accounts"]]
        self.assertEqual(names, ["beta_user", "alpha_user"])
        self.assertEqual(
            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
            "alpha_user",
        )
        self.assertEqual(self.service.list_device_accounts("")["accounts"], [])
        self.assertEqual(first["user"]["username"], "alpha_user")
        self.assertEqual(second["user"]["username"], "beta_user")
    def test_switch_uses_device_grant_and_keeps_the_original_authorization(self) -> None:
        first = self._register("alpha_user")
        self._register("beta_user")
        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
        self.assertEqual(switched["user"]["username"], "alpha_user")
        remaining = {
            item["username"]
            for item in self.service.list_device_accounts(self.device_a)["accounts"]
        }
        self.assertEqual(remaining, {"alpha_user", "beta_user"})
    def test_switch_without_a_valid_grant_requires_reauthentication(self) -> None:
        user = self._register("alpha_user")
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_b, int(user["user"]["id"]))
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account("", int(user["user"]["id"]))
    def test_forget_only_removes_the_current_device_grant(self) -> None:
        user = self._register("alpha_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        self.service.forget_account(self.device_a, int(user["user"]["id"]))
        self.service.forget_account(self.device_a, int(user["user"]["id"]))
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        self.assertEqual(
            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
            "alpha_user",
        )
    def test_logout_revokes_only_the_current_account_on_this_device(self) -> None:
        first = self._register("alpha_user")
        second = self._register("beta_user")
        self.service.revoke_current_device_grant(self.device_a, int(second["user"]["id"]))
        names = {
            item["username"]
            for item in self.service.list_device_accounts(self.device_a)["accounts"]
        }
        self.assertEqual(names, {"alpha_user"})
        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
        self.assertEqual(switched["user"]["id"], first["user"]["id"])
    def test_password_change_revokes_grants_on_every_device(self) -> None:
        user = self._register("alpha_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        self._bind(int(user["user"]["id"]))
        self.service.change_password("Password123", "Password456")
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        self.assertEqual(self.service.list_device_accounts(self.device_b)["accounts"], [])
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_a, int(user["user"]["id"]))
    def test_device_keeps_at_most_five_accounts(self) -> None:
        usernames = [f"user_{index}" for index in range(6)]
        ids = [self._register(name)["user"]["id"] for name in usernames]
        listed = self.service.list_device_accounts(self.device_a)["accounts"]
        self.assertEqual(len(listed), 5)
        kept = {item["user_id"] for item in listed}
        self.assertNotIn(ids[0], kept)
        self.assertTrue(set(ids[1:]).issubset(kept))
    def test_expired_grants_are_removed_lazily(self) -> None:
        user = self._register("alpha_user")
        past = (datetime.now(timezone.utc) - timedelta(days=1)).isoformat(timespec="seconds")
        self.database.upsert_switch_grant(
            self.device_a,
            int(user["user"]["id"]),
            past,
            past,
            past,
        )
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_a, int(user["user"]["id"]))
 if __name__ == "__main__":
    unittest.main()
@@ -25,7 +25,6 @@ class DatabaseMigrationTests(unittest.TestCase):
                        ("0002", "create_job_runs"),
                        ("0003", "extend_llm_audit"),
                        ("0004", "add_mentor_note"),
                        ("0005", "create_account_switch_grants"),
                    ],
                )
                columns = {
@@ -40,7 +39,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 5)
+            self.assertEqual(count, 4)
    def test_database_with_recorded_0004_and_note_column_starts_without_reapply(
        self,
@@ -61,7 +60,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 5)
+            self.assertEqual(count, 4)
    def test_old_database_without_0004_upgrades_and_adds_note_column(self) -> None:
        with tempfile.TemporaryDirectory() as root:
@@ -88,7 +87,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                        "PRAGMA table_info(mentor_preferences)"
                    )
                ]
-            self.assertEqual(versions, {"0001", "0002", "0003", "0004", "0005"})
+            self.assertEqual(versions, {"0001", "0002", "0003", "0004"})
            self.assertIn("note", note_rows)
    def test_database_with_unknown_migration_is_rejected(self) -> None:
@@ -344,22 +344,6 @@ class FrontendContractTests(unittest.TestCase):
        self.assertIn("max-height: var(--sentiment-history-max-height);", self.sentiment_styles)
        self.assertIn("overflow: auto;", self.sentiment_styles)
    def test_sentiment_equal_height_and_tooltip_tokens(self):
        self.assertIn("--sentiment-analysis-height: 600px;", self.tokens)
        self.assertIn("--sentiment-tooltip-bg: var(--text-primary);", self.tokens)
        self.assertIn("--sentiment-tooltip-fg: var(--text-inverse);", self.tokens)
        self.assertIn("--sentiment-tooltip-bg: #26293e;", self.tokens)
        self.assertIn("--sentiment-tooltip-fg: #e8eaed;", self.tokens)
        self.assertIn("height: var(--sentiment-analysis-height);", self.sentiment_styles)
        self.assertIn("max-height: var(--sentiment-analysis-height);", self.sentiment_styles)
        self.assertIn("justify-content: space-evenly;", self.sentiment_styles)
        self.assertIn("background: var(--sentiment-tooltip-bg);", self.sentiment_styles)
        self.assertIn("color: var(--sentiment-tooltip-fg);", self.sentiment_styles)
        self.assertIn("new ResizeObserver", self.script)
        self.assertIn("#sentimentCycleView .redesigned-emotion-grid {", self.sentiment_styles)
        self.assertNotIn("height: 100vh", self.sentiment_styles)
        self.assertNotIn("min-height: 100%", self.sentiment_styles)
    def test_mentor_final_visual_fix_contract(self):
        shell_styles = (STATIC_DIR / "shared" / "shell.css").read_text(encoding="utf-8")
        mentor_html = (STATIC_DIR / "pages" / "mentor" / "page.html").read_text(encoding="utf-8")
@@ -65,11 +65,8 @@ class GovernanceRegistryTests(unittest.TestCase):
            public,
            {
                ("GET", "/api/health"),
                ("GET", "/api/auth/accounts"),
                ("POST", "/api/auth/login"),
                ("POST", "/api/auth/register"),
                ("POST", "/api/auth/switch"),
                ("POST", "/api/auth/forget"),
            },
        )
@@ -0,0 +1,317 @@
 from __future__ import annotations
 import json
 import tempfile
 import threading
 import unittest
 from datetime import datetime
 from pathlib import Path
 from typing import Any
 from unittest.mock import patch
 from backend.features.market.backfill_history import (
    build_backfill_audit,
    classify_snapshot_coverage,
    create_sqlite_backup,
    select_open_trade_dates,
    select_open_trade_dates_in_range,
 )
 from backend.features.market.service import MarketServiceMixin
 from backend.features.sentiment.engine import (
    build_sentiment_history,
    latest_contiguous_history,
 )
 from backend.features.sentiment.service import SentimentServiceMixin
 from database import ReviewDatabase
 def _snapshot(trade_date: str, previous_trade_date: str) -> dict[str, Any]:
    display = f"{trade_date[:4]}-{trade_date[4:6]}-{trade_date[6:8]}"
    previous_display = (
        f"{previous_trade_date[:4]}-{previous_trade_date[4:6]}-{previous_trade_date[6:8]}"
        if previous_trade_date
        else ""
    )
    return {
        "meta": {
            "trade_date": display,
            "previous_trade_date": previous_display,
            "source": "tushare",
        },
        "overview": {
            "up_count": 2500,
            "down_count": 2000,
            "flat_count": 100,
            "amount_billion": 12000,
            "limit_up_count": 40,
            "limit_down_count": 5,
            "broken_count": 10,
            "seal_rate": 70,
            "max_height": 3,
            "second_board_count": 8,
            "three_plus_count": 4,
            "previous_limit_count": 35,
            "previous_positive_rate": 55,
            "average_previous_change": 1.2,
            "median_previous_change": 0.8,
            "advance_rate": 20,
            "severe_loss_rate": 5,
            "previous_down_count": 3,
            "ladder_completeness": 60,
            "limit_amount_billion": 300,
        },
        "limits": [{"code": "000001"}],
        "broken": [],
        "down_limits": [],
        "yesterday_limits": [],
    }
 class _BackfillHarness(MarketServiceMixin, SentimentServiceMixin):
    def __init__(self, database: ReviewDatabase) -> None:
        self.database = database
        self.sync_lock = threading.Lock()
        self.configured = True
        self.token = "test-token"
        self.current_user_id = 1
        self._calendar_rows: list[dict[str, Any]] = []
        self._fail_dates: set[str] = set()
        self.sync_calls: list[str] = []
    def _tushare_client(self):  # type: ignore[override]
        harness = self
        class _Client:
            def query(self, api_name, params, fields=""):
                assert api_name == "trade_cal"
                start = str(params["start_date"])
                end = str(params["end_date"])
                return [
                    row
                    for row in harness._calendar_rows
                    if start <= str(row["cal_date"]) <= end
                ]
        return _Client()
    def sync_dashboard(self, trade_date: str) -> dict[str, Any]:  # type: ignore[override]
        compact = trade_date.replace("-", "")
        self.sync_calls.append(compact)
        if compact in self._fail_dates:
            raise ValueError(f"simulated failure for {compact}")
        previous = ""
        for row in self._calendar_rows:
            if str(row["cal_date"]) == compact:
                previous = str(row.get("pretrade_date") or "")
                break
        payload = _snapshot(compact, previous)
        self.database.save_snapshot(compact, "tushare", payload)
        return payload
    def _apply_reason_overrides(self, dashboard: dict[str, Any]) -> dict[str, Any]:
        return dashboard
    def _with_storage(self, dashboard: dict[str, Any], cached: bool) -> dict[str, Any]:
        return dashboard
 class BackfillHistoryHelperTests(unittest.TestCase):
    def test_select_open_trade_dates_skips_weekends_and_holidays(self) -> None:
        rows = [
            {"cal_date": "20260821", "is_open": 1, "pretrade_date": "20260820"},
            {"cal_date": "20260822", "is_open": 0, "pretrade_date": "20260821"},  # Sat
            {"cal_date": "20260823", "is_open": 0, "pretrade_date": "20260821"},  # Sun
            {"cal_date": "20260824", "is_open": 1, "pretrade_date": "20260821"},
            {"cal_date": "20260825", "is_open": 1, "pretrade_date": "20260824"},
            {"cal_date": "20260826", "is_open": 1, "pretrade_date": "20260825"},
            {"cal_date": "20260827", "is_open": 1, "pretrade_date": "20260826"},
        ]
        selected = select_open_trade_dates(rows, "20260827", 4)
        self.assertEqual(selected, ["20260824", "20260825", "20260826", "20260827"])
    def test_range_mode_reports_non_trading_days_separately(self) -> None:
        rows = [
            {"cal_date": "20260821", "is_open": 1},
            {"cal_date": "20260824", "is_open": 1},
        ]
        open_dates, skipped = select_open_trade_dates_in_range(
            rows, "20260821", "20260824"
        )
        self.assertEqual(open_dates, ["20260821", "20260824"])
        self.assertEqual(skipped, ["20260822", "20260823"])
    def test_classify_snapshot_coverage_finds_real_gaps(self) -> None:
        coverage = classify_snapshot_coverage(
            ["20260824", "20260825", "20260826", "20260827"],
            ["20260824", "20260827"],
        )
        self.assertEqual(coverage["missing"], ["20260825", "20260826"])
        self.assertEqual(coverage["present"], ["20260824", "20260827"])
 class ContiguousHistoryGapTests(unittest.TestCase):
    def test_missing_previous_trade_day_collapses_to_today(self) -> None:
        payloads = [
            _snapshot("20260824", "20260821"),
            _snapshot("20260827", "20260826"),  # gap: 20260826 missing
        ]
        series = latest_contiguous_history(build_sentiment_history(payloads))
        self.assertEqual([row["trade_date"] for row in series], ["20260827"])
    def test_continuous_history_keeps_full_tail(self) -> None:
        payloads = [
            _snapshot("20260825", "20260824"),
            _snapshot("20260826", "20260825"),
            _snapshot("20260827", "20260826"),
        ]
        series = latest_contiguous_history(build_sentiment_history(payloads))
        self.assertEqual(
            [row["trade_date"] for row in series],
            ["20260825", "20260826", "20260827"],
        )
 class SnapshotBackfillServiceTests(unittest.TestCase):
    def setUp(self) -> None:
        self.temporary = tempfile.TemporaryDirectory()
        self.db_path = Path(self.temporary.name) / "review.db"
        self.database = ReviewDatabase(self.db_path)
        self.service = _BackfillHarness(self.database)
        self.service._calendar_rows = [
            {"cal_date": "20260820", "is_open": 1, "pretrade_date": "20260819"},
            {"cal_date": "20260821", "is_open": 1, "pretrade_date": "20260820"},
            {"cal_date": "20260822", "is_open": 0, "pretrade_date": "20260821"},
            {"cal_date": "20260823", "is_open": 0, "pretrade_date": "20260821"},
            {"cal_date": "20260824", "is_open": 1, "pretrade_date": "20260821"},
            {"cal_date": "20260825", "is_open": 1, "pretrade_date": "20260824"},
            {"cal_date": "20260826", "is_open": 1, "pretrade_date": "20260825"},
            {"cal_date": "20260827", "is_open": 1, "pretrade_date": "20260826"},
        ]
        # Sparse history mimicking .11: keep 0824 and today, miss 0825/0826.
        self.database.save_snapshot("20260824", "tushare", _snapshot("20260824", "20260821"))
        self.database.save_snapshot("20260827", "tushare", _snapshot("20260827", "20260826"))
    def tearDown(self) -> None:
        self.temporary.cleanup()
    def test_recent_backfill_fills_gap_and_restores_history(self) -> None:
        before = self.service.sentiment_history("20260827", 20)
        self.assertEqual(before["available_days"], 1)
        with patch(
            "backend.features.market.service.create_sqlite_backup",
            return_value=Path(self.temporary.name) / "fake-backup.db",
        ) as backup:
            audit = self.service.backfill_recent_trading_days(
                end_date="20260827",
                lookback=4,
                dry_run=False,
                create_backup=True,
            )
        backup.assert_called_once()
        self.assertEqual(sorted(self.service.sync_calls), ["20260825", "20260826"])
        self.assertEqual(audit["missing"], ["2026-08-25", "2026-08-26"])
        self.assertEqual(sorted(audit["created_dates"]), ["2026-08-25", "2026-08-26"])
        after = self.service.sentiment_history("20260827", 20)
        self.assertGreaterEqual(after["available_days"], 4)
        self.assertEqual(
            [row["trade_date"] for row in after["rows"]],
            ["20260824", "20260825", "20260826", "20260827"],
        )
    def test_dry_run_does_not_write_snapshots(self) -> None:
        audit = self.service.backfill_recent_trading_days(
            end_date="20260827",
            lookback=4,
            dry_run=True,
            create_backup=True,
        )
        self.assertTrue(audit["dry_run"])
        self.assertEqual(self.service.sync_calls, [])
        self.assertIsNone(audit["backup_path"])
        self.assertEqual(
            self.database.list_snapshot_trade_dates("20260824", "20260827"),
            ["20260824", "20260827"],
        )
    def test_repeat_execution_skips_existing_days(self) -> None:
        with patch(
            "backend.features.market.service.create_sqlite_backup",
            return_value=Path(self.temporary.name) / "fake-backup.db",
        ):
            first = self.service.backfill_recent_trading_days(
                end_date="20260827", lookback=4
            )
            self.service.sync_calls.clear()
            second = self.service.backfill_recent_trading_days(
                end_date="20260827", lookback=4
            )
        self.assertEqual(first["succeeded_count"], 2)
        self.assertEqual(self.service.sync_calls, [])
        self.assertEqual(second["missing_count"], 0)
        self.assertEqual(second["skipped_count"], 4)
        self.assertIsNone(second["backup_path"])
    def test_partial_failure_continues_remaining_days(self) -> None:
        self.service._fail_dates.add("20260825")
        with patch(
            "backend.features.market.service.create_sqlite_backup",
            return_value=Path(self.temporary.name) / "fake-backup.db",
        ):
            audit = self.service.backfill_recent_trading_days(
                end_date="20260827", lookback=4
            )
        self.assertFalse(audit["ok"])
        self.assertEqual(audit["failed_count"], 1)
        self.assertEqual(audit["succeeded_count"], 1)
        self.assertIn("20260826", self.database.list_snapshot_trade_dates())
        self.assertNotIn("20260825", self.database.list_snapshot_trade_dates())
    def test_range_backfill_skips_weekend_without_treating_as_error(self) -> None:
        with patch(
            "backend.features.market.service.create_sqlite_backup",
            return_value=Path(self.temporary.name) / "fake-backup.db",
        ):
            audit = self.service.backfill(
                start_date="2026-08-21",
                end_date="2026-08-24",
            )
        self.assertEqual(audit["mode"], "range")
        self.assertEqual(audit["skipped_non_trading_days"], ["2026-08-22", "2026-08-23"])
        self.assertEqual(sorted(self.service.sync_calls), ["20260821"])
        self.assertTrue(audit["ok"])
    def test_sqlite_backup_api_creates_restorable_copy(self) -> None:
        backup_dir = Path(self.temporary.name) / "backups"
        backup = create_sqlite_backup(
            self.db_path,
            backup_dir,
            label="pre-recent-backfill",
            stamped_at=datetime(2026, 8, 27, 15, 30, 0),
        )
        self.assertTrue(backup.exists())
        self.assertIn("pre-recent-backfill-20260827-153000", backup.name)
        restored = ReviewDatabase(backup)
        self.assertEqual(
            restored.list_snapshot_trade_dates(),
            ["20260824", "20260827"],
        )
    def test_audit_lists_only_snapshot_related_write_tables(self) -> None:
        audit = build_backfill_audit(
            mode="recent",
            end_date="20260827",
            lookback=60,
            coverage={"trade_dates": [], "present": [], "missing": [], "present_count": 0, "missing_count": 0},
        )
        self.assertEqual(
            audit["write_tables"],
            ["dashboard_snapshots", "data_snapshots", "sync_runs"],
        )
        self.assertNotIn("users", audit["write_tables"])
        self.assertNotIn("system_settings", audit["write_tables"])
 if __name__ == "__main__":
    unittest.main()
@@ -17,6 +17,9 @@ registry, and verification tools.
  `backend/features/*/routes.py` owners.
 - `python tools/build_architecture_inventory.py [--check]`: generate or verify
  `config/architecture-inventory.json` from the current source tree.
 - `python tools/backfill_recent_snapshots.py --account <admin> [--lookback 60] [--dry-run]`:
  auditable recent trading-day dashboard snapshot backfill. See
  `docs/maintenance/行情历史补档.md`.
 `verify_baseline.py` does not inspect a parent checkout or skip tests according to files outside
 this application. Historical comparison scripts were retired after final standalone acceptance;
@@ -0,0 +1,112 @@
 #!/usr/bin/env python3
 """Auditable recent trading-day dashboard snapshot backfill.
 Examples:
  python tools/backfill_recent_snapshots.py --account admin --dry-run
  python tools/backfill_recent_snapshots.py --account admin --lookback 60
  python tools/backfill_recent_snapshots.py --account admin --end-date 2026-08-27 --force
 """
 from __future__ import annotations
 import argparse
 import json
 import sys
 from datetime import date
 from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 if str(ROOT) not in sys.path:
    sys.path.insert(0, str(ROOT))
 from backend.application import SERVICE
 from backend.bootstrap.config import normalize_date
 from backend.features.market.backfill_history import DEFAULT_RECENT_TRADING_DAYS
 def main() -> None:
    parser = argparse.ArgumentParser(
        description="Backfill the latest N real trading-day dashboard snapshots"
    )
    parser.add_argument(
        "--account",
        required=True,
        help="Account that can resolve the shared Tushare token",
    )
    parser.add_argument(
        "--end-date",
        default=date.today().isoformat(),
        help="Inclusive end date YYYY-MM-DD (default: today)",
    )
    parser.add_argument(
        "--lookback",
        type=int,
        default=DEFAULT_RECENT_TRADING_DAYS,
        help=f"Number of open trading days to cover (default {DEFAULT_RECENT_TRADING_DAYS}, max 60)",
    )
    parser.add_argument(
        "--dry-run",
        action="store_true",
        help="Plan only: classify missing gaps without writing",
    )
    parser.add_argument(
        "--force",
        action="store_true",
        help="Re-sync days that already have snapshots",
    )
    parser.add_argument(
        "--no-backup",
        action="store_true",
        help="Skip the SQLite backup API step (not recommended)",
    )
    parser.add_argument(
        "--json",
        action="store_true",
        help="Print the full audit payload as JSON",
    )
    args = parser.parse_args()
    user = SERVICE.database.user_by_username(args.account.strip())
    if not user:
        raise SystemExit("account not found")
    SERVICE.bind_user(int(user["id"]))
    end_date = normalize_date(args.end_date)
    audit = SERVICE.backfill_recent_trading_days(
        end_date=end_date,
        lookback=args.lookback,
        dry_run=args.dry_run,
        force=args.force,
        create_backup=not args.no_backup,
    )
    if args.json:
        print(json.dumps(audit, ensure_ascii=False, indent=2))
        raise SystemExit(0 if audit.get("ok") else 1)
    print(
        f"mode={audit['mode']} end={audit['end_date']} lookback={audit['lookback']} "
        f"dry_run={audit['dry_run']}"
    )
    print(
        f"present={audit['present_count']} missing={audit['missing_count']} "
        f"succeeded={audit['succeeded_count']} skipped={audit['skipped_count']} "
        f"failed={audit['failed_count']}"
    )
    if audit.get("backup_path"):
        print(f"backup={audit['backup_path']}")
    if audit.get("missing"):
        print("missing_dates=" + ",".join(audit["missing"]))
    if audit.get("created_dates"):
        print("created_dates=" + ",".join(audit["created_dates"]))
    failed = [row for row in audit.get("results") or [] if row.get("status") == "failed"]
    for row in failed:
        print(f"failed {row.get('requested_date')}: {row.get('error')}")
    if not audit.get("ok"):
        raise SystemExit(1)
    print("backfill complete")
 if __name__ == "__main__":
    main()
@@ -50,13 +50,7 @@ def _owner(path: str) -> str:
 def _role(method: str, path: str) -> str:
-    if path == "/api/health" or path in {
+    if path == "/api/health" or path in {"/api/auth/register", "/api/auth/login"}:
        "/api/auth/register",
        "/api/auth/login",
        "/api/auth/accounts",
        "/api/auth/switch",
        "/api/auth/forget",
    }:
        return "public"
    from api_access import required_role