docs(HEL-272): 用终版项目介绍更新仓库 README

将总工审核通过的项目介绍写入根目录 README，保留本机启动、Docker 与系统配置等必要说明，技术栈保持公开。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>
修复(HEL-235B): 可靠同步受限权限工作目录
2026-08-30 20:58:16 +08:00 · 2026-08-29 23:29:11 +08:00 · 2026-08-29 23:27:18 +08:00 · 2026-08-29 23:22:59 +08:00 · 2026-08-29 21:59:09 +08:00 · 2026-08-29 21:46:05 +08:00
57 changed files with 6195 additions and 492 deletions
@@ -9,6 +9,7 @@ __pycache__/
 *.log
 runtime/
 data/cache/
 data/backups/
 data/private-mentor-skills/
 data/*.db
 data/*.db-shm
@@ -165,58 +165,58 @@ docker compose restart xiaobai-review
 docker compose down
 ```
-### 使用 Gitea 更新程序（推荐）
+### 服务器本地目录更新与构建（日常推荐）
-代码仓库为：
+生产机 `192.168.200.11` 的 `/opt/1panel/docker/compose/xiaobaifupan` 自 2026-08-29（HEL-235B）
 起已是受 Git 管理的工作目录，只跟踪 Gitea `main`（仓库
 `http://192.168.200.36:3200/leefer/xiaobai-review.git`）。由于目录顶层归 root，
 `.git` 存放在部署账号家目录（外部 Git 目录方案）：
 ```text
-http://192.168.200.36:3200/leefer/xiaobaifupan.git
+~/xiaobai-build/repos/xiaobai-review.git          Git 元数据（分支/历史/索引）
 /opt/1panel/docker/compose/xiaobaifupan           工作目录（程序文件本体）
 ~/xiaobai-build/update-from-main.sh               一键更新+构建入口
 ~/xiaobai-git                                    便捷查看（status/log/diff）
 ```
-首次在服务器部署代码时，可以直接克隆到目标目录：
+日常更新只需要在服务器上执行一条命令：
 ```bash
-sudo mkdir -p /opt/xiaobai-review
+~/xiaobai-build/update-from-main.sh            # 更新到 main 并构建 main-<短号> 镜像
-sudo chown "$USER":"$USER" /opt/xiaobai-review
+~/xiaobai-build/update-from-main.sh verify-tag main-a8732f5   # 部署前复核镜像与 main 一致
 git clone http://192.168.200.36:3200/leefer/xiaobaifupan.git /opt/xiaobai-review
 cd /opt/xiaobai-review
 ```
-私有仓库会提示输入 Gitea 用户名和密码或访问令牌。不要把密码写入仓库 URL、
+脚本在构建前强制完成五道校验，任一不符立即停止、不产出镜像：
 `compose.yaml` 或脚本。然后把原 `.env` 与 `data/` 放回该目录；这两项已被 Git
 忽略，后续拉取代码不会覆盖数据库与密钥。
-如需部署管理员私有问师，通过 NAS 文件管理器将本地
+1. `git fetch` 成功（连不上 Gitea 即停）；
-`data/private-mentor-skills/` 复制到服务器项目的同名 `data` 目录，并保持目录仅由
+2. 必须在 `main` 分支（智能体不得用功能分支直接当正式线）；
-部署账号和容器运行用户读取。该内容不会通过 Gitea 同步。
+3. 工作区无未提交改动、无多余文件；
 4. 只允许快进合并到 `origin/main`（分叉即停）；main 新增/删除顶层文件时会给出
   需管理员执行的精确清单（目录顶层归 root）；
 5. 构建后回读镜像 `org.opencontainers.image.revision`，与 `main` 提交不一致则删除镜像。
-每次更新前先创建 SQLite 一致性备份，再拉取并重建容器：
+镜像 tag 固定为 `main-<提交短号7位>`（不带提交号的模糊 tag 一律禁止）；每次构建在
 `~/xiaobai-build/BUILD_LOG.tsv` 留痕。构建只产出镜像，不启动、不替换容器；换版与
 回滚步骤见 `~/xiaobai-build/README.md`。
-```bash
+`compose.yaml` 的镜像名与 revision 标签同样做了强校验：直接 `docker compose up -d --build`
-cd /opt/xiaobai-review
+会因缺少 `XIAOBAI_GIT_REV` / `XIAOBAI_GIT_SHORT` 变量而拒绝执行，避免再出现构建进
-docker compose exec -T xiaobai-review python -c "import sqlite3; s=sqlite3.connect('/app/data/review.db'); d=sqlite3.connect('/app/data/review-before-update.db'); s.backup(d); d.close(); s.close()"
+`latest` 的模糊版本。需要用 compose 时先 `export` 这两个变量（值以
-git pull --ff-only origin main
+`~/xiaobai-build/xiaobai-git rev-parse HEAD` 为准），或直接用上面的脚本。
 docker compose up -d --build
 docker compose ps
 curl --fail http://127.0.0.1:8765/api/health
 ```
-`docker compose up -d --build` 会原地替换应用容器，不删除宿主机的 `data` 目录。
+### 智能体高级入口：Git 归档流式构建
 数据库迁移会在新容器启动时自动执行。若 `git pull --ff-only` 提示本地代码有修改，
 先用 `git status` 查明原因，不要用强制重置覆盖 `.env` 或 `data`。
-### 不使用 Git 时更新
+有仓库检出、能免密 SSH 到部署机的智能体可以用 `tools/build_image.sh <提交号> <镜像tag>`
 从任意明确提交流式构建（`git archive | ssh docker build`），tag 同样必须以
 `-<提交短号7位>` 结尾，构建后回读 revision 校验并留痕。用于在服务器不便拉取时的
 应急构建；日常正式线仍应走 `main`。
-重新上传代码后执行：
+### 历史方式（已废弃）
-```bash
+早期文档建议在服务器重新 `git clone` 一份或手工上传代码后 `docker compose up --build`。
-docker compose down
+这两条路径已废弃：服务器上**只允许存在一个受管工作目录**（上述
-docker compose build --pull
+`/opt/1panel/docker/compose/xiaobaifupan`），任何脱离 Git 校验的本地构建都会把
-docker compose up -d
+来源提交变成不可追溯状态，禁止使用。
 ```
 `docker compose down` 不会删除宿主机的 `data` 目录。不要使用带有手工删除
 `data` 目录的清理命令。
 ## 7. 备份与恢复
@@ -1,76 +1,360 @@
-# 小白复盘 Web
+# 小白复盘
-一个面向 A 股盘后复盘的本地 Web 工作台。后端使用 Python 访问 Tushare Pro，前端不依赖构建工具。
+> 一个给 A 股股民自己用的**盘后复盘工作台**。
 > 收盘以后打开它，把「今天市场到底发生了什么」按情绪、梯队、轮动、竞价、龙虎榜一条条看明白，再决定明天激进还是保守。
-本目录是经过保真迁移、结构治理和用户人工验收的唯一正式源码，不依赖父目录旧程序或失败版本。
+**一句话定位**：小白复盘是一套可以自己部署、自己掌控数据的 A 股盘后复盘工具。它把散落在各个行情软件里的涨停、炸板、连板梯队、板块轮动、集合竞价、龙虎榜数据，整理成一套**看得懂、能追问、可记录**的复盘界面。
 目录职责见[ARCHITECTURE.md](ARCHITECTURE.md)，产品与维护文档见[docs/README.md](docs/README.md)。
-当前包含集合竞价、涨停池、炸板池、跌停板、昨日涨停、涨停表现、市场天梯、板块轮动、题材库、人气热榜、龙虎榜和个人复盘工作区。交易日快照与同步记录保存在本地 SQLite 数据库 `data/review.db`。
+它**不是**行情交易软件，**不接券商、不代为下单**，也不提供任何形式的个股推荐。
-集合竞价中心采用盘前生命周期：9:15 前显示预告，9:15–9:25 明确等待最终竞价，9:25–9:30 自动读取并重试最终竞价筛选，9:30 后停止更新并冻结为复盘归档。当前 Tushare 只提供 9:25 最终竞价快照，不将其表述为动态虚拟撮合行情。
+---
-第三阶段加入了机构席位、席位别名、个股复权日 K、资金流、自选股、涨停原因修订、个股笔记、每日复盘和历史数据回补。
+## 一、为什么值得试（项目亮点）
-股票代码在桌面端悬停后会显示分时与日 K 快速预览，默认优先展示日 K；移动端点击代码后从底部打开预览面板。股票详情以及板块、题材、指数详情均可在日 K 与最新分时之间切换。日 K 复用个股详情缓存；分时优先使用 iFinD，东方财富仅作隔离的展示兜底，并使用短时内存缓存。图表数据不写入主行情、不参与情绪、选股或问天计算；不可用时明确显示“分时不可用”，不会用日 K 模拟分时走势。
+1. **先看情绪，再看个股**
   用一个 0–100 的「情绪温度」，把当天市场的冷热程度和它处在哪个阶段（冰点 → 修复 → 发酵 → 高潮 → 分化 → 退潮）直接摆在第一屏。先判断环境，再谈个股。
-智能选股包含六阶段盘后候选、29 套精选策略、自定义公式 DSL、自然语言公式编译、候选排名和滚动回测。阶段与精选策略在当日行情更新后由后台确定性计算；自定义选股由用户手动执行，LLM 只负责编译自然语言条件，不参与候选筛选。竞价、估值、财务、资金、人气和席位等字段按已登记的数据可用性进入因子库，缺失时明确显示覆盖问题。
+2. **说的就是短线玩家的话**
   晋级、断板、连板高度、梯队完整度、封单额、炸板……这些词不用解释，界面上原样呈现，不用再自己在行情软件里一层层翻。
-候选只有经用户手动加入后才进入五交易日持续跟踪，展示 T+1 开盘/收盘、T+3、T+5、最大涨幅与最大回撤。提醒中心支持手工日期提醒，并在策略首日反馈和五日跟踪完成时生成账号私有的站内提醒。
+3. **不会写公式，也能按自己的想法筛股票**
   可以直接写一句人话（比如「连续两天放量上涨且不是 ST」），系统会把它编译成受控公式再执行筛选。技术活儿交给程序，判断权始终在你手上。
-问师模块会读取当前复盘、近十日市场情绪、涨跌停、昨日反馈、板块轮动、市场阶段、龙虎榜和指定个股数据，再按选中的游资思维 Skill 进行单师对话。对话记录按账号、老师和交易日期保存在服务端；主模型不可用时自动切换辅助模型。
+4. **有问题可以「问」**
   - **问师**：挑一位游资思维模型，系统自动把当天情绪、梯队、龙虎榜等数据喂给它，单师对话，边看数据边追问。
   - **问天**：一个偏传统文化视角的模块，分「观势 / 观气 / 观心」三部分，看盘之外也给自己留一段安静时间。
-新增公开问师角色时，在 `游资skills` 下增加一个包含 `SKILL.md` 的独立目录，并在 `游资skills/mentor_catalog.json` 中登记素材等级与结构质检。管理员私有角色放在 `data/private-mentor-skills`，该目录不进入 Git 或 Docker 镜像，且只会出现在管理员的问师列表中。系统会从 Skill 的 frontmatter、一级标题、核心模型和引用语中自动生成角色信息，无需修改注册代码。
+5. **复盘能留下来，而不是第二天就忘**
   交易日志可以记录当时的买卖逻辑和情绪标签（平静 / 笃定 / 犹豫 / 焦虑 / 冲动），配合每日复盘三问和提醒中心，帮自己看清是不是在情绪化操作。
-问天模块包含三个相互独立的部分：观势以市场数据生成三才六爻，用于观察“势”，行情缺失或自动取象明显偏差时可显式手动校准六爻，人工结果与自动来源严格区分；观气依据干支、精确节气、五运六气及客主加临关系观察“运”，行业五行仅作传统取象归类；观心先准备1秒，再完成5轮“吸3秒、顿2秒、呼4秒”，随后以六次三枚铜钱起卦、察念和解卦完成一次不输入问题的问心仪式。卦象、干支、节气与气机关系均由本地确定性程序计算，LLM只负责解释，不参与起卦或改动结果。
+6. **数据在自己手里**
   所有数据存在部署机器本地的 SQLite 数据库里，账号密码用 scrypt 哈希保存，行情 Token 和模型密钥加密存放。没有云端账号，不上传个人交易记录。
-问天模块使用项目本地的 `lunar-python` 计算历法，并使用 `data/iching_zh.json` 中的固定六十四卦、卦辞和爻辞。第三方授权见 `THIRD_PARTY_NOTICES.md`。
+7. **一套界面，白天晚上都能看**
   内置日间 / 夜间两套配色，股票代码上悬停就弹出日 K 与分时小图，`Ctrl + K` 可以全局搜索股票、板块和题材。
-“我的复盘”包含结构化手工交易日志，可记录方向、价格、数量、仓位、盈亏、逻辑、执行、情绪和标签，不接券商也不自动下单。顶部“复盘助手”以流式方式读取市场统计、策略跟踪、提醒、个人复盘和交易日志；对话按账号保存，只提供分析和条件化计划。
+---
-## 启动
+## 二、主要功能
-```powershell
+界面左侧一共有 **16 个页面**，另有一个内嵌页面（策略持续跟踪）。下面按分组说明。
-cd app
+
 ### 2.1 市场数据（登录即可用）
 | 页面 | 解决什么问题 | 打开后能看到什么 |
 | --- | --- | --- |
 | **情绪周期** | 收盘后说不清市场整体冷热、处在什么阶段 | 0–100 情绪温度、升温 / 降温方向、六阶段判定、由五个维度（市场宽度 20、涨停生态 25、赚钱效应 30、连板结构 15、成交活跃度 10）加权算出 |
 | **涨停池** | 当天封板的票散在各处，看不出封板结构 | 按首板 / 2 板 / 3 板+ 筛选，含首封时间、开板次数、封单额、涨停原因 |
 | **炸板池** | 触板没封住容易被误当成涨停 | 距涨停还差多少、开了几次板、炸板原因 |
 | **跌停板** | 亏钱效应集中在哪不直观 | 连续跌停天数、风险线索、风险行业聚集提示 |
 | **昨日涨停** | 昨天追板的人今天怎么样 | 晋级 / 炸板 / 跌停 / 断板四类结果，加一条「兑现率」（收红口径）摘要 |
 | **涨停表现** | 梯队到底健不健康 | 按连板高度看晋级率、收红率、平均涨幅，并给出当日结论 |
 | **市场天梯** | 连板梯队靠手翻拼不出来 | 从首板逐层排到当天最高板（至少展示 5 层），配市场高度与梯队完整度指标 |
 | **板块轮动** | 热点是延续还是一日游 | 最近 9 个交易日、Top 12 板块的热力矩阵，点板块可跨日高亮看连续性，并可下钻到申万二级成分股 |
 | **集合竞价** | 9:25 的竞价信息太散 | 四个页签：重点异动 / 我的自选 / 全部候选 / 竞价一字；关注分满分 100，可按「超预期 / 符合预期 / 低于预期」筛选；9:30 后停止更新，冻结归档供复盘 |
 | **题材库** | 题材排行和成分股要开好几个网站 | 左边题材排行、右边成分股，题材上悬停直接出日 K / 分时预览 |
 | **人气热榜** | 各家榜单各看各的 | 同花顺 + 东方财富双榜汇总，可切单榜或看「双榜共识」 |
 | **龙虎榜** | 上榜明细和游资动向查起来费劲 | 每日明细、净买入 / 净卖出筛选、活跃游资，点游资可看当日操作，游资档案带席位归类 |
 ### 2.2 智能功能（会员可用）
 | 页面 | 解决什么问题 | 打开后能看到什么 |
 | --- | --- | --- |
 | **智能选股** | 自己写条件门槛高，盘中手翻太累 | 三种模式：① 六阶段策略，当日行情更新后（15:10 之后）自动计算；② **29 套精选策略库**，每套都标注适用环境、失效风险与准入条件；③ 自定义选股，自然语言写条件 → 编译成受控公式 → 确定性筛选执行 → 滚动回测 |
 | **策略持续跟踪** | 选出来的票加完自选就忘了为什么选 | 只有手动加入的候选才进入跟踪，展示 T+1 开盘 / 收盘、T+3、T+5、最大涨幅与最大回撤，到期自动提醒 |
 | **问师** | 复盘时没人讨论、视角单一 | 选一位游资思维模型单师对话，系统按模型流派自动喂情绪、梯队、龙虎榜等对应数据，回答为流式输出并带动态追问 |
 | **问天** | 想换个视角看市场，也想让自己静下来 | **观势**：用市场数据生成三才六爻，用来观察「势」；**观气**：依干支、精确节气、五运六气观察「运」；**观心**：不看盘、不输问题，先准备 1 秒，接着做 5 轮「吸气 3 秒、停顿 2 秒、呼气 4 秒」，再以六次三枚铜钱起卦完成一次问心仪式 |
 | **我的复盘** | 交易散养、不复盘、情绪化操作 | 结构化交易日志（方向、价格、仓位、盈亏、逻辑、执行、情绪、标签）、每日复盘三问、提醒中心、复盘助手（读取你的日志与市场数据，给出分析和条件化计划） |
 > 说明：卦象、干支、节气与气机关系全部由本地程序确定性计算，大模型只负责文字解释，不参与起卦，也不会改动结果。
 ### 2.3 全局能力
 - 股票 / 板块 / 题材上悬停，弹出日 K 与分时快速预览
 - `Ctrl + K` 全局搜索
 - 日间 / 夜间双主题一键切换
 - 提醒中心集中查看策略跟踪与手工提醒
 - 登录页有一组会动的小 K 线小人（红涨绿跌）
 ---
 ## 三、特色页面展示
 > 下面每个占位都写清了「这张图要展示什么」。补图时，把图片文件放进仓库的 `docs/images/` 目录、按占位里写好的文件名命名，然后将该占位块（引文整段）替换为「补图后替换本块」后面那行图片语法（去掉反引号）即可；图未补上之前，方框内的文字就是给补图人的说明，不影响阅读。
 ### 3.1 情绪周期
 > **【图 1｜情绪周期主界面（截图）】**
 > 展示：日间主题下情绪周期页整屏，需清楚露出 0–100 情绪温度大数字、当前阶段卡（如「发酵」）、以及温度变化曲线。
 > 补图后替换本块：`![情绪周期主界面](docs/images/sentiment-overview.png)`
 > **【图 2｜阶段与五维构成（截图）】**
 > 展示：阶段卡与五个维度的评分构成（市场宽度、涨停生态、赚钱效应、连板结构、成交活跃度），体现「温度不是拍脑袋来的」。
 > 补图后替换本块：`![情绪阶段与五维构成](docs/images/sentiment-dimensions.png)`
 > **【图 3｜日距切换（动图，约 4 秒）】**
 > 展示：在 10 / 20 / 60 日之间切换查看温度走势，动作要慢一点，让人看清曲线在动。
 > 补图后替换本块：`![情绪周期日距切换](docs/images/sentiment-range.gif)`
 ### 3.2 市场天梯
 > **【图 4｜连板梯队全景（截图）】**
 > 展示：从首板一路排到当天最高板的分层结构，右侧「市场高度」与「梯队完整度」两个指标要同时入镜。
 > 补图后替换本块：`![市场天梯](docs/images/ladder-overview.png)`
 > **【图 5｜展开 / 收起交互（动图，约 4 秒）】**
 > 展示：点击展开某高度的成分股再收起，说明每一层都能点开看细节。
 > 补图后替换本块：`![市场天梯展开交互](docs/images/ladder-expand.gif)`
 ### 3.3 涨停相关股池
 > **【图 6｜涨停池与炸板池（截图，两张并排）】**
 > 展示：左为涨停池（含首封时间、开板次数、封单额、涨停原因），右为炸板池（含距涨停、开板次数、炸板原因）。
 > 补图后替换本块：`![涨停池与炸板池](docs/images/pools-limit-broken.png)`
 > **【图 7｜昨日涨停与涨停表现（截图，两张并排）】**
 > 展示：左为昨日涨停的四类结果与兑现率摘要，右为涨停表现按连板高度列出的晋级率、收红率、平均涨幅与当日结论。
 > 补图后替换本块：`![昨日涨停与涨停表现](docs/images/pools-yesterday-performance.png)`
 ### 3.4 板块轮动
 > **【图 8｜9 日热力矩阵（截图）】**
 > 展示：最近 9 个交易日、Top 12 板块的强度色阶矩阵，含强度图例。
 > 补图后替换本块：`![板块轮动热力矩阵](docs/images/rotation-heatmap.png)`
 > **【图 9｜点板块跨日高亮（动图，约 6 秒）】**
 > 展示：点选某个板块后，该板块在 9 天里的位置被高亮，直观看出「延续」还是「一日游」；再点开看下钻的申万二级成分股。
 > 补图后替换本块：`![板块轮动跨日高亮](docs/images/rotation-highlight.gif)`
 ### 3.5 集合竞价
 > **【图 10｜竞价中心与关注分（截图）】**
 > 展示：重点异动页签下的候选列表，关注分列（满分 100）与「超预期 / 符合预期 / 低于预期」筛选条要看得见，右侧的题材承接卡片一并入镜。
 > 补图后替换本块：`![集合竞价中心](docs/images/auction-overview.png)`
 > **【图 11｜竞价生命周期（截图或示意静态图）】**
 > 展示：9:15 前预告 → 9:15–9:25 等待最终竞价 → 9:25–9:30 读取最终竞价 → 9:30 后冻结归档这四个节点。**建议用静态图表达，不做盘中动态录屏，避免被误解为实时撮合行情。**
 > 补图后替换本块：`![竞价生命周期](docs/images/auction-lifecycle.png)`
 ### 3.6 龙虎榜
 > **【图 12｜龙虎榜明细与净买卖（截图）】**
 > 展示：每日上榜明细表，净买入 / 净卖出筛选条，以及活跃游资区域。
 > 补图后替换本块：`![龙虎榜明细](docs/images/dragon-detail.png)`
 > **【图 13｜游资档案（截图）】**
 > 展示：游资档案详情，含席位归类与当日操作列表。
 > 补图后替换本块：`![游资档案](docs/images/dragon-profile.png)`
 > **【图 14｜点游资看当日操作（动图，约 5 秒）】**
 > 展示：在明细里点某个游资，弹出它当天的全部操作，说明「席位 ↔ 个股」是打通的。
 > 补图后替换本块：`![龙虎榜游资点选](docs/images/dragon-click.gif)`
 ### 3.7 智能选股
 > **【图 15｜29 套精选策略库（截图）】**
 > 展示：策略库列表，画面里要能数出策略卡片，并露出其中一张的「适用环境 / 失效风险 / 准入条件」。
 > 补图后替换本块：`![精选策略库](docs/images/screener-library.png)`
 > **【图 16｜自然语言写公式全流程（动图，约 15 秒，可加速）】**
 > 展示：输入一句人话 → 编译成受控公式 → 执行筛选 → 返回候选表 → 加入持续跟踪，完整走一遍。**本图是全篇技术含量最高的一张，务必配「不构成投资建议」角标。**
 > 补图后替换本块：`![自然语言写公式](docs/images/screener-natural-language.gif)`
 > **【图 17｜策略持续跟踪（截图）】**
 > 展示：某个候选的 T+1 开盘 / 收盘、T+3、T+5、最大涨幅与最大回撤。
 > 补图后替换本块：`![策略持续跟踪](docs/images/screener-tracking.png)`
 ### 3.8 问师
 > **【图 18｜问师对话（截图）】**
 > 展示：模型选择区与一段已完成的对话，回答中引用了情绪、梯队、龙虎榜等真实市场数据。
 > 补图后替换本块：`![问师对话](docs/images/mentor-chat.png)`
 ### 3.9 问天
 > **【图 19｜观势（截图）】**
 > 展示：由市场数据生成的三才六爻卦象图，以及六爻与市场数据的对应关系。
 > 补图后替换本块：`![问天观势](docs/images/heaven-shi.png)`
 > **【图 20｜观气（截图）】**
 > 展示：干支、精确节气、五运六气与客主加临关系的呈现。
 > 补图后替换本块：`![问天观气](docs/images/heaven-qi.png)`
 > **【图 21｜观心（截图）】**
 > 展示：观心呼吸引导界面（准备 1 秒 + 「吸 3 秒、顿 2 秒、呼 4 秒」共 5 轮），以及六次三枚铜钱起卦的界面。
 > 补图后替换本块：`![问天观心](docs/images/heaven-xin.png)`
 > **【图 22｜起卦动效（动图，约 10 秒）】**
 > 展示：铜钱起卦与六爻推演的现有效果。**只录现有动画，不做任何页面改动；全片挂「传统文化娱乐化观察，非预测」角标。**
 > 补图后替换本块：`![问天起卦动效](docs/images/heaven-coin.gif)`
 ### 3.10 我的复盘
 > **【图 23｜交易日志与情绪标签（截图）】**
 > 展示：一条交易记录的完整字段，并把情绪五标签（平静 / 笃定 / 犹豫 / 焦虑 / 冲动）放大到看得清。
 > 补图后替换本块：`![交易日志情绪标签](docs/images/review-journal.png)`
 > **【图 24｜复盘助手（动图，约 8 秒）】**
 > 展示：复盘助手读取个人日志与市场数据后，流式输出一段分析与条件化计划。
 > 补图后替换本块：`![复盘助手](docs/images/review-assistant.gif)`
 ### 3.11 全局细节
 > **【图 25｜四个小细节（截图，四宫格拼图）】**
 > 展示：① 代码悬停弹出的日 K / 分时预览；② `Ctrl + K` 全局搜索；③ 日间 / 夜间双主题对比；④ 登录页会动的小 K 线小人。
 > 补图后替换本块：`![全局细节四宫格](docs/images/global-details.png)`
 ---
 ## 四、适合谁用
 - **每天收盘后不知道从哪看起的散户**：先给一个情绪温度和阶段，再往下拆。
 - **做短线、看连板梯队的人**：晋级、断板、高度、完整度都在一个页面里。
 - **想按自己的条件筛股票、但不会写公式的人**：说人话就行。
 - **知道自己「管不住手」的人**：交易日志 + 情绪标签 + 每日复盘三问，把情绪化操作摆到自己面前。
 - **在意数据隐私、想把工具放在自己机器上的人**：私有部署，数据不出本机。
 - **对传统文化视角感兴趣的玩家**：问天的观势 / 观气 / 观心提供了另一种看市场的方式。
 **不太适合**：想要一键自动下单的人（本项目不接券商）；想要「跟着买就能赚」的人（本项目不提供任何形式的投资建议）。
 ---
 ## 五、一天怎么用（典型流程）
 1. **收盘后 10 分钟：定环境**
   打开「情绪周期」，看温度多少、在哪个阶段、是升温还是降温。先定下明天的基调是激进还是保守。
 2. **看结构：谁在涨、涨到几板**
   进「市场天梯」看连板梯队和市场高度，再到「涨停池 / 炸板池 / 跌停板」看当天的封板结构与亏钱效应。
 3. **看延续：热点有没有搬家**
   进「板块轮动」，点几个强势板块，看它们在最近 9 天是连续走强还是只有一天行情。
 4. **看结果：昨天追板的人今天怎么样**
   进「昨日涨停」和「涨停表现」，对照梯队健康度，检验自己的判断。
 5. **查人气与席位**
   「人气热榜」看双榜共识，「龙虎榜」看活跃游资当天做了什么。
 6. **按自己的条件选一批候选**
   进「智能选股」，要么用六阶段策略或 29 套精选策略，要么直接写一句人话让它编译成公式。选出来的候选**手动**加入「策略持续跟踪」，后面 T+1 / T+3 / T+5 会自动提醒你回看。
 7. **有疑问就问**
   「问师」按游资思维模型边看数据边追问；想静一静就去「问天」做一次观心。
 8. **记下来**
   在「我的复盘」里写当天交易日志（含情绪标签）和复盘三问。第二天开盘前，先回看昨天的记录。
 ---
 ## 六、部署与访问
 > 本项目为**私有部署的个人工具**，没有官方在线版，也不提供公共账号。
 - **部署方式**：仓库内提供 `Dockerfile` 与 `compose.yaml`，在已有 Docker 环境的机器上即可启动；也可直接用 Python 运行 `server.py` 在本机启动。
 - **访问方式**：部署完成后通过浏览器访问该机器上的服务端口（默认 8765），**具体地址由部署者自己决定**。出于安全考虑，本文档不写任何内网 IP、账号、密码或密钥。
 - **数据存放**：所有行情快照、复盘记录与账号数据都存在部署机器本地的 SQLite 数据库文件中（`data/review.db`），随 `data/` 目录一起备份即可。
 - **账号**：首次使用先注册，第一个注册的账号自动成为管理员，之后注册的默认为普通用户。
 - **数据来源**：行情数据来自 Tushare Pro 等第三方数据接口（部分分时数据优先使用同花顺 iFinD），**需要部署者自己申请并配置 Token**；部分接口的可用性取决于数据源方的授权与积分权限，个别数据缺失时页面会明确提示，不会用估算值顶替。
 - **大模型功能**：问师、问天解释、复盘助手、自然语言编译公式等需要配置一个 OpenAI 兼容的接口，由部署者自行配置与管理额度；未配置时这些对话与解释功能不可用，市场数据部分不受影响。
 ### 本机启动
 仓库根目录即为运行目录（`server.py`、`requirements.txt` 都在根目录）。
 ```bash
 python -m pip install -r requirements.txt
 python server.py
 ```
-浏览器打开 `http://127.0.0.1:8765`，首次使用先注册账号。首个账号自动成为管理员，后续账号默认为普通用户。主行情不再回退演示数据：盘前、非交易日或临时取数失败时沿用最近真实收盘快照；没有任何真实快照时提示等待管理员完成首次同步。
+默认监听本机回环地址、端口 `8765`（仅本机浏览器可访问）。首次使用先注册账号。主行情不再回退演示数据：盘前、非交易日或临时取数失败时沿用最近真实收盘快照；没有任何真实快照时，页面会提示等待管理员完成首次同步。
-需要后台启动本地验收端口时，使用`tools/start_local.ps1`。该工具把日志、进程号和Python缓存
+Windows 下若需要后台启动，并把日志、进程号和 Python 缓存统一写入 `runtime/`（不在源码根目录产生运行文件），可使用：
 统一写入`runtime/`，不在源码根目录产生运行文件：
 ```powershell
-powershell -ExecutionPolicy Bypass -File tools/start_local.ps1 -Port 8797
+powershell -ExecutionPolicy Bypass -File tools/start_local.ps1
 ```
-局域网 Docker 部署使用 `Dockerfile` 与 `compose.yaml`，完整的迁移、持久化、
+### Docker 部署
 防火墙、备份和恢复步骤见 [DOCKER_DEPLOY.md](DOCKER_DEPLOY.md)。
-账号密码使用 scrypt 哈希；公共 Tushare Token、平台模型密钥以及原始生辰资料均使用 `APP_ENCRYPTION_KEY` 加密后保存在 SQLite。公共数据和平台模型归系统所有，生辰资料仍按账号隔离。普通用户不配置 LLM，只有管理员授权的有效会员可以使用平台模型。请将 `.env` 与数据库一起备份，丢失加密密钥后无法恢复这些资料。
+局域网或服务器部署使用仓库根目录的 `Dockerfile` 与 `compose.yaml`。完整的迁移、持久化、防火墙、备份和恢复步骤见 [DOCKER_DEPLOY.md](DOCKER_DEPLOY.md)。
-## 系统与账号配置
+### 系统与账号配置
-管理员通过页面右上角“系统管理”保存公共 Tushare Token、平台主/辅助模型、会员每日额度和后台刷新开关。所有用户读取同一份 SQLite 行情快照，不再分别配置行情 Token。已有个人凭据中的 Tushare Token 会在升级时迁移到系统配置并从个人凭据移除。
+管理员通过页面右上角「系统管理」保存公共 Tushare Token、平台主/辅助模型、会员每日额度和后台刷新开关。所有用户读取同一份 SQLite 行情快照，不再分别配置行情 Token。
-```text
+`.env` 中的 Tushare 和平台 LLM 配置只用于初始化系统配置，密钥不会返回到浏览器。请将 `.env` 与数据库一起备份，丢失 `APP_ENCRYPTION_KEY` 后无法恢复加密资料。
 TUSHARE_TOKEN=你的Token
 ```
-`.env` 中的 Tushare 和平台 LLM 配置只用于初始化系统配置，密钥不会返回到浏览器。后台刷新只在交易时段更新 SQLite 快照，不会主动刷新或重绘用户页面；用户点击页面“刷新”时读取最新快照。管理员也可点“后台刷新”立即启动一次后台同步，当前页面仍保持不变。
+普通用户在「账号设置」中维护个人资料、查看会员状态和修改密码，不配置个人 LLM。有效会员自动使用平台模型；管理员可在「系统管理」中手动开通、续期、停用会员。平台模型受管理员设置的每日调用次数限制，管理员账号始终可用。
-普通用户在“账号设置”中维护个人资料、查看会员状态和修改密码，不配置个人 LLM。有效会员自动使用平台模型；管理员可在“系统管理”中手动开通、续期、停用会员。平台模型受管理员设置的每日调用次数限制，管理员账号始终可用。
+新增公开问师角色时，在 `游资skills` 下增加一个包含 `SKILL.md` 的独立目录，并在 `游资skills/mentor_catalog.json` 中登记。管理员私有角色放在 `data/private-mentor-skills`，该目录不进入 Git 或 Docker 镜像，且只会出现在管理员的问师列表中。
-Tushare 各接口有独立积分权限。程序优先使用 `limit_list_d` 获取涨跌停明细；该接口不可用时，会尝试通过日线和每日涨跌停价格推算。
+### 相关文档
-## 隔离实时聚合验证
+- [ARCHITECTURE.md](ARCHITECTURE.md) — 模块边界与源码职责
 - [docs/README.md](docs/README.md) — 交接手册入口
 - [DOCKER_DEPLOY.md](DOCKER_DEPLOY.md) — Docker 部署、备份与恢复
 - [THIRD_PARTY_NOTICES.md](THIRD_PARTY_NOTICES.md) — 第三方授权（含问天历法库）
-`backend/data/realtime.py`用于验证东方财富、同花顺和选股宝网页数据源。它不写入 SQLite 主行情快照，也不参与情绪评分或智能选股；当 Tushare 实时指数权限不可用时，观势会使用东方财富三大指数和板块外显，并继续使用 Tushare 的板块成分内核与个股数据。
+**技术组成（简要）**
-登录后可调用：
+| 层面 | 说明 |
 | --- | --- |
 | 后端 | Python 3.12，仅用标准库自带的 HTTP 服务与自研路由，第三方依赖极少 |
 | 数据库 | SQLite（WAL 模式），单文件，易备份 |
 | 前端 | 原生 JavaScript + HTML，无构建工具、无打包步骤，改完刷新即可 |
 | 部署 | Docker / Docker Compose，或本机直接运行 |
 | 安全 | 账号密码 scrypt 哈希存储；行情 Token 与模型密钥使用 `APP_ENCRYPTION_KEY` 加密后存库，密钥与数据库需一起备份 |
-```text
+---
 GET /api/realtime-aggregate/health?sector=元器件
 ```
-返回内容包括东方财富三大指数及板块快照、指数时间差、同花顺和选股宝可用性、每个来源的耗时与错误。盘中指数时间差不超过15秒，收盘后不超过120秒。`ready=true` 仅表示本次验证满足聚合层约束，不代表这些网页内部接口具有长期稳定性或商业使用授权。
+## 七、免责声明
 - 本项目是一个**个人研究与复盘工具**，所提供的全部数据、指标、候选与文字分析，**均不构成投资建议、证券推荐或买卖要约**。
 - 本项目**不接券商、不代为下单**，交易日志只做手工记录与统计，不代表任何实际成交。
 - 情绪温度、阶段判定、连板梯队、策略筛选等均为**基于公开数据的统计与规则计算结果**，不预测未来走势，不保证任何收益。历史统计与回测结果不代表未来表现。
 - 「问天」模块属于**传统文化视角的娱乐化观察**，卦象、干支、节气与气机关系由本地程序确定性生成，用于换个角度看市场和自我觉察，**不具备预测功能，不得作为投资依据**。
 - 行情数据来自第三方接口，可能存在延迟、缺失或口径调整；页面会在数据不可用时明确提示，请以交易所与券商正式披露的数据为准。
 - 股市有风险，入市需谨慎。投资决策及其后果由使用者本人承担。
 ---
 ## 附：精简版项目推荐语
 > 下面三段可以单独整段复制转发，不需要带图也能看懂。
 ### 一句话版（约 60 字，适合评论区、群聊快速安利）
 > 小白复盘：一个自己部署的 A 股盘后复盘工作台——情绪、梯队、轮动、龙虎榜一页页看明白；说人话就能选股，不荐股、不下单，数据只存自己机器。
 ### 短版（约 320 字，适合社交平台、群聊、朋友圈）
 > 发现一个挺特别的 A 股盘后复盘工具，叫「小白复盘」。
 >
 > 它不荐股、也不下单，就专心做一件事：把收盘后散落在各个软件里的信息整理成人看得懂的样子。打开先给你一个 0–100 的情绪温度和「冰点→修复→发酵→高潮→分化→退潮」六个阶段，让你先知道今天是什么环境；然后连板梯队、涨停炸板、板块轮动的 9 天热力图、集合竞价、龙虎榜游资动向，一页一页往下看。
 >
 > 最惊喜的是不会写公式也能选股——直接写一句人话，它帮你编译成条件去筛。还有「问师」可以按游资思维跟你对话，「问天」用卦象换个角度看市场、也让你静一静。
 >
 > 数据存在自己机器上的本地数据库里，私有部署，不上传。
 >
 > 提醒一句：它只是个把信息摆清楚的工具，不荐股也不下单，不构成投资建议。
 ### 稍长版（约 580 字，适合发论坛、公众号、仓库简介）
 > **小白复盘 —— 给 A 股股民自己的盘后复盘工作台**
 >
 > 收盘以后，你是怎么复盘的？在好几个软件之间来回切，还是干脆不复盘？
 >
 > 小白复盘是一套可以自己部署的 A 股盘后复盘工具。它把涨停、炸板、跌停、连板梯队、板块轮动、集合竞价、龙虎榜这些散落各处的数据，整理成 16 个看得懂的页面：
 >
 > - **情绪周期**：0–100 情绪温度 + 六阶段判定，由市场宽度、涨停生态、赚钱效应、连板结构、成交活跃度五个维度加权算出，先看环境再看个股。
 > - **市场天梯**：从首板一路排到当天最高板，配市场高度与梯队完整度。
 > - **板块轮动**：近 9 个交易日 Top 12 板块热力矩阵，点一下就能看出热点是延续还是一日游。
 > - **集合竞价**：关注分满分 100，9:30 后自动冻结归档，专门留给复盘看。
 > - **龙虎榜**：席位明细、活跃游资、游资档案打通，点游资就能看它当天做了什么。
 > - **智能选股**：29 套精选策略（每套都写了适用环境和失效风险），也可以直接写一句人话，让它编译成公式去筛选。
 > - **问师 / 问天 / 我的复盘**：一个陪你按游资思维聊数据，一个用传统卦象换个角度看市场，一个帮你记下每笔交易的逻辑和情绪。
 >
 > 它不接券商、不代为下单，也不给出任何个股推荐——只负责把信息摆清楚，判断始终在你自己手里。所有数据存在你自己机器的本地 SQLite 里，私有部署，不上传。
 >
 > 项目私有部署、无公共在线版；文中所有功能描述均对应现有实现，不构成投资建议，市场有风险。
@@ -18,6 +18,8 @@ TOKEN_PATTERN = re.compile(r"^[A-Za-z0-9_-]{20,128}$")
 USERNAME_PATTERN = re.compile(r"^[A-Za-z0-9_\-\u4e00-\u9fff]{3,30}$")
 SESSION_COOKIE = "xiaobai_session"
 SESSION_MAX_AGE = 30 * 24 * 60 * 60
 DEVICE_COOKIE = "xiaobai_device"
 DEVICE_MAX_AGE = 180 * 24 * 60 * 60
 def load_local_env() -> None:
@@ -26,18 +26,31 @@ class DashboardMixin:
            )
        daily = self._load_daily(trade_date)
        if (
            not daily
            and requested_date == datetime.now().astimezone().strftime("%Y%m%d")
            and trade_date == requested_date
            and datetime.now().astimezone().time().replace(tzinfo=None) >= dt_time(9, 15)
        ):
            return self._realtime_dashboard(
                requested_date,
                trade_date,
                previous_trade_date,
            )
        if not daily:
            # 15:05 后只走日线；日线未就绪时不得回退调用无权限的 rt_k。
            raise TushareError(f"No daily data returned for {trade_date}")
        notices: list[str] = []
        limit_data_source = "official"
        try:
            limit_rows = self._load_limit_lists(trade_date)
            previous_limit_rows = self._load_limit_type(previous_trade_date, "U")
            if not limit_rows:
                limit_data_source = "derived"
                notices.append("涨跌停高级接口当日数据尚未更新，已使用日线数据推算。")
                limit_rows = self._derive_limits(trade_date, daily)
        except TushareError as exc:
            limit_data_source = "derived"
            notices.append(f"涨跌停高级接口不可用，已使用日线数据推算：{exc}")
            limit_rows = self._derive_limits(trade_date, daily)
            previous_daily = self._load_daily(previous_trade_date)
@@ -69,6 +82,7 @@ class DashboardMixin:
                "trade_date": _display_date(trade_date),
                "previous_trade_date": _display_date(previous_trade_date),
                "source": "tushare",
                "limit_data_source": limit_data_source,
                "updated_at": datetime.now().astimezone().isoformat(timespec="seconds"),
                "notice": "；".join(notices),
            },
@@ -86,13 +100,13 @@ class DashboardMixin:
    @staticmethod
    def should_use_realtime(requested_date: str, trade_date: str) -> bool:
-        """Use rt_k only inside the intraday window; 15:05+ must use daily bars."""
+        """Use rt_k for today's open market until end-of-day datasets settle."""
        now = datetime.now().astimezone()
        today = now.strftime("%Y%m%d")
        return (
            requested_date == today
            and trade_date == today
-            and dt_time(9, 15) <= now.time().replace(tzinfo=None) < dt_time(15, 5)
+            and dt_time(9, 15) <= now.time().replace(tzinfo=None) < dt_time(16, 30)
        )
    def _realtime_dashboard(
@@ -2,6 +2,7 @@ from .m0001_adopt_legacy import MIGRATION as M0001_ADOPT_LEGACY
 from .m0002_job_runs import MIGRATION as M0002_JOB_RUNS
 from .m0003_llm_audit import MIGRATION as M0003_LLM_AUDIT
 from .m0004_mentor_notes import MIGRATION as M0004_MENTOR_NOTES
 from .m0005_account_switch_grants import MIGRATION as M0005_ACCOUNT_SWITCH_GRANTS
 from .runner import Migration, MigrationError, MigrationRunner
 MIGRATIONS = (
@@ -9,6 +10,7 @@ MIGRATIONS = (
    M0002_JOB_RUNS,
    M0003_LLM_AUDIT,
    M0004_MENTOR_NOTES,
    M0005_ACCOUNT_SWITCH_GRANTS,
 )
 __all__ = ["MIGRATIONS", "Migration", "MigrationError", "MigrationRunner"]
@@ -0,0 +1,42 @@
 from __future__ import annotations
 import sqlite3
 from backend.database.migrations.runner import Migration
 def create_account_switch_grants(connection: sqlite3.Connection) -> None:
    connection.execute(
        """
        CREATE TABLE IF NOT EXISTS account_switch_grants (
            id INTEGER PRIMARY KEY AUTOINCREMENT,
            device_hash TEXT NOT NULL,
            user_id INTEGER NOT NULL,
            granted_at TEXT NOT NULL,
            last_used_at TEXT NOT NULL,
            expires_at TEXT NOT NULL,
            UNIQUE (device_hash, user_id),
            FOREIGN KEY (user_id) REFERENCES users(id) ON DELETE CASCADE
        )
        """
    )
    connection.execute(
        """
        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_device
        ON account_switch_grants(device_hash, last_used_at DESC)
        """
    )
    connection.execute(
        """
        CREATE INDEX IF NOT EXISTS idx_account_switch_grants_expiry
        ON account_switch_grants(expires_at)
        """
    )
 MIGRATION = Migration(
    version="0005",
    name="create_account_switch_grants",
    action=create_account_switch_grants,
    signature="account-switch-grants:v1:device,user,granted,used,expires,unique",
 )
@@ -28,11 +28,11 @@ class AccountApplicationMixin:
    def update_membership(self, payload: dict[str, Any]) -> None:
        self.accounts.update_membership(payload)
-    def register_account(self, username: str, password: str) -> dict[str, Any]:
+    def register_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
-        return self.accounts.register(username, password)
+        return self.accounts.register(username, password, device_hash)
-    def login_account(self, username: str, password: str) -> dict[str, Any]:
+    def login_account(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
-        return self.accounts.login(username, password)
+        return self.accounts.login(username, password, device_hash)
    def change_password(self, current_password: str, new_password: str) -> None:
        self.accounts.change_password(current_password, new_password)
@@ -1,49 +1,108 @@
 from __future__ import annotations
 import json
 import secrets
 from http import HTTPStatus
 from backend.features.accounts.security import token_hash
 class AccountHttpMixin:
    def _device_hash(self) -> str:
        raw = self.device_token()
        return token_hash(raw) if raw else ""
    def _ensure_device_token(self) -> str:
        return self.device_token() or secrets.token_urlsafe(32)
    def _auth_success_headers(self, session_token: str, device_raw: str) -> list[tuple[str, str]]:
        return [
            ("Set-Cookie", self.session_cookie(session_token)),
            ("Set-Cookie", self.device_cookie(device_raw)),
        ]
    def _send_authenticated_session(self, result: dict, status: HTTPStatus, device_raw: str) -> None:
        self.send_json(
            {
                "ok": True,
                "authenticated": True,
                "user": result["user"],
                "csrf_token": result["csrf_token"],
            },
            status,
            self._auth_success_headers(result["session_token"], device_raw),
        )
    def auth_register(self) -> None:
        try:
            body = self.read_json_body()
            device_raw = self._ensure_device_token()
            result = self.application_service.register_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
                token_hash(device_raw),
            )
-            self.send_json(
+            self._send_authenticated_session(result, HTTPStatus.CREATED, device_raw)
                {
                    "ok": True,
                    "authenticated": True,
                    "user": result["user"],
                    "csrf_token": result["csrf_token"],
                },
                HTTPStatus.CREATED,
                {"Set-Cookie": self.session_cookie(result["session_token"])},
            )
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def auth_login(self) -> None:
        try:
            body = self.read_json_body()
            device_raw = self._ensure_device_token()
            result = self.application_service.login_account(
                str(body.get("username") or ""),
                str(body.get("password") or ""),
                token_hash(device_raw),
            )
-            self.send_json(
+            self._send_authenticated_session(result, HTTPStatus.OK, device_raw)
                {
                    "ok": True,
                    "authenticated": True,
                    "user": result["user"],
                    "csrf_token": result["csrf_token"],
                },
                headers={"Set-Cookie": self.session_cookie(result["session_token"])},
            )
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
    def auth_accounts(self) -> None:
        current_user_id = None
        if self.require_auth(send_error=False):
            current_user_id = int(self.auth_user["id"])
        payload = self.application_service.accounts.list_device_accounts(
            self._device_hash(),
            current_user_id,
        )
        self.send_json({"ok": True, **payload})
    def auth_switch(self) -> None:
        try:
            body = self.read_json_body()
            try:
                user_id = int(body.get("user_id"))
            except (TypeError, ValueError):
                user_id = 0
            device_raw = self.device_token()
            result = self.application_service.accounts.switch_account(
                token_hash(device_raw) if device_raw else "",
                user_id,
            )
            self._send_authenticated_session(
                result,
                HTTPStatus.OK,
                device_raw or self._ensure_device_token(),
            )
        except PermissionError as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.UNAUTHORIZED)
        except (ValueError, json.JSONDecodeError) as exc:
            self.send_json({"error": str(exc)}, HTTPStatus.BAD_REQUEST)
    def auth_forget(self) -> None:
        try:
            body = self.read_json_body()
            try:
                user_id = int(body.get("user_id"))
            except (TypeError, ValueError):
                user_id = 0
            self.application_service.accounts.forget_account(self._device_hash(), user_id)
        except (ValueError, json.JSONDecodeError):
            pass
        self.send_json({"ok": True})
    def auth_me(self) -> None:
        service = self.application_service
        if not self.require_auth(send_error=False):
@@ -55,6 +114,15 @@ class AccountHttpMixin:
                }
            )
            return
        headers = None
        if not self.device_token():
            device_raw = secrets.token_urlsafe(32)
            service.accounts.remember_account(
                token_hash(device_raw),
                int(self.auth_user["id"]),
                fresh=True,
            )
            headers = [("Set-Cookie", self.device_cookie(device_raw))]
        self.send_json(
            {
                "ok": True,
@@ -66,15 +134,19 @@ class AccountHttpMixin:
                    "membership": service.membership(),
                },
                "csrf_token": str(self.auth_user["csrf_token"]),
-            }
+            },
            headers=headers,
        )
    def auth_logout(self) -> None:
        raw_token = self.session_token()
        user_id = int(getattr(self, "auth_user", {}).get("id") or 0)
        if raw_token:
            from backend.features.accounts.security import token_hash
            self.application_service.database.delete_session(token_hash(raw_token))
        self.application_service.accounts.revoke_current_device_grant(
            self._device_hash(),
            user_id,
        )
        self.send_json(
            {"ok": True},
            headers={"Set-Cookie": self.session_cookie("", clear=True)},
@@ -234,3 +234,96 @@ class AccountRepositoryMixin:
                (user_id,),
            )
            return cursor.rowcount > 0
    def cleanup_expired_switch_grants(self, now: str) -> int:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE expires_at <= ?",
                (now,),
            )
        return int(cursor.rowcount)
    def list_switch_grants(self, device_hash: str, now: str) -> list[dict[str, Any]]:
        with self.connect() as connection:
            rows = connection.execute(
                """
                SELECT u.id, u.username, u.role, u.llm_mode, u.membership_status,
                       u.membership_plan, u.membership_starts_at, u.membership_expires_at,
                       u.created_at, g.last_used_at, g.granted_at, g.expires_at
                FROM account_switch_grants AS g
                JOIN users AS u ON u.id = g.user_id
                WHERE g.device_hash = ? AND g.expires_at > ?
                ORDER BY g.last_used_at DESC, g.id DESC
                """,
                (device_hash, now),
            ).fetchall()
        return [dict(row) for row in rows]
    def get_switch_grant(self, device_hash: str, user_id: int) -> dict[str, Any] | None:
        with self.connect() as connection:
            row = connection.execute(
                """
                SELECT device_hash, user_id, granted_at, last_used_at, expires_at
                FROM account_switch_grants
                WHERE device_hash = ? AND user_id = ?
                """,
                (device_hash, user_id),
            ).fetchone()
        return dict(row) if row else None
    def upsert_switch_grant(
        self,
        device_hash: str,
        user_id: int,
        granted_at: str,
        last_used_at: str,
        expires_at: str,
    ) -> None:
        with self.connect() as connection:
            connection.execute(
                """
                INSERT INTO account_switch_grants
                    (device_hash, user_id, granted_at, last_used_at, expires_at)
                VALUES (?, ?, ?, ?, ?)
                ON CONFLICT(device_hash, user_id) DO UPDATE SET
                    granted_at = excluded.granted_at,
                    last_used_at = excluded.last_used_at,
                    expires_at = excluded.expires_at
                """,
                (device_hash, user_id, granted_at, last_used_at, expires_at),
            )
    def prune_switch_grants(self, device_hash: str, keep: int) -> int:
        with self.connect() as connection:
            rows = connection.execute(
                """
                SELECT id FROM account_switch_grants
                WHERE device_hash = ?
                ORDER BY last_used_at DESC, id DESC
                """,
                (device_hash,),
            ).fetchall()
            extra = [int(row["id"]) for row in rows[keep:]]
            if not extra:
                return 0
            connection.execute(
                f"DELETE FROM account_switch_grants WHERE id IN ({','.join('?' * len(extra))})",
                extra,
            )
        return len(extra)
    def delete_switch_grant(self, device_hash: str, user_id: int) -> bool:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE device_hash = ? AND user_id = ?",
                (device_hash, user_id),
            )
        return cursor.rowcount > 0
    def delete_switch_grants_for_user(self, user_id: int) -> int:
        with self.connect() as connection:
            cursor = connection.execute(
                "DELETE FROM account_switch_grants WHERE user_id = ?",
                (user_id,),
            )
        return int(cursor.rowcount)
@@ -6,6 +6,9 @@ class AccountRoutesMixin:
        if parsed.path == "/api/auth/me":
            self.auth_me()
            return True
        if parsed.path == "/api/auth/accounts":
            self.auth_accounts()
            return True
        return False
    def _handle_accounts_get(self, parsed) -> bool:
@@ -77,15 +77,22 @@ class AccountService:
        access = self.access_supplier() or self.database.user_access(self.current_user_id) or {}
        return self.membership_for_access(access)
-    def register(self, username: str, password: str) -> dict[str, Any]:
+    GRANT_SLIDE_DAYS = 30
    GRANT_HARD_DAYS = 180
    MAX_GRANTS_PER_DEVICE = 5
    SWITCH_REAUTH_MESSAGE = "该账号需重新验证"
    def register(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
        username = username.strip()
        self.validate_input(username, password)
        with self.auth_lock:
            salt, password_digest = hash_password(password)
            user = self.database.create_user(username, salt, password_digest)
-        return self.create_session(user)
+        result = self.create_session(user)
        self.remember_account(device_hash, int(user["id"]), fresh=True)
        return result
-    def login(self, username: str, password: str) -> dict[str, Any]:
+    def login(self, username: str, password: str, device_hash: str = "") -> dict[str, Any]:
        username = username.strip()
        if not username or not password:
            raise ValueError("账号名和密码不能为空。")
@@ -96,7 +103,9 @@ class AccountService:
            str(user.get("password_hash") or ""),
        ):
            raise ValueError("账号名或密码不正确。")
-        return self.create_session(user)
+        result = self.create_session(user)
        self.remember_account(device_hash, int(user["id"]), fresh=True)
        return result
    def change_password(self, current_password: str, new_password: str) -> None:
        current_password = str(current_password or "")
@@ -112,6 +121,86 @@ class AccountService:
        salt, digest = hash_password(new_password)
        if not self.database.update_user_password(self.current_user_id, salt, digest):
            raise ValueError("账号不存在。")
        self.database.delete_switch_grants_for_user(self.current_user_id)
    @staticmethod
    def _utc_now() -> datetime:
        return datetime.now(timezone.utc)
    @classmethod
    def _iso(cls, value: datetime) -> str:
        return value.isoformat(timespec="seconds")
    def remember_account(self, device_hash: str, user_id: int, *, fresh: bool = False) -> None:
        if not device_hash or user_id <= 0:
            return
        now = self._utc_now()
        now_text = self._iso(now)
        self.database.cleanup_expired_switch_grants(now_text)
        existing = None if fresh else self.database.get_switch_grant(device_hash, user_id)
        granted_at = parse_iso_datetime(existing["granted_at"]) if existing else now
        if granted_at is None:
            granted_at = now
        expires = min(
            now + timedelta(days=self.GRANT_SLIDE_DAYS),
            granted_at + timedelta(days=self.GRANT_HARD_DAYS),
        )
        if not existing:
            self.database.prune_switch_grants(device_hash, self.MAX_GRANTS_PER_DEVICE - 1)
        self.database.upsert_switch_grant(
            device_hash,
            user_id,
            self._iso(granted_at),
            now_text,
            self._iso(expires),
        )
    def list_device_accounts(
        self, device_hash: str, current_user_id: int | None = None
    ) -> dict[str, Any]:
        if not device_hash:
            return {"accounts": [], "current_user_id": current_user_id}
        now_text = self._iso(self._utc_now())
        self.database.cleanup_expired_switch_grants(now_text)
        accounts = []
        for row in self.database.list_switch_grants(device_hash, now_text):
            accounts.append(
                {
                    "user_id": int(row["id"]),
                    "username": str(row["username"]),
                    "role": str(row.get("role") or "user"),
                    "membership": self.membership_for_access(row),
                    "last_used_at": str(row.get("last_used_at") or ""),
                }
            )
        return {"accounts": accounts, "current_user_id": current_user_id}
    def switch_account(self, device_hash: str, user_id: int) -> dict[str, Any]:
        if not device_hash or user_id <= 0:
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        now = self._utc_now()
        now_text = self._iso(now)
        self.database.cleanup_expired_switch_grants(now_text)
        grant = self.database.get_switch_grant(device_hash, user_id)
        expires = parse_iso_datetime(grant.get("expires_at")) if grant else None
        if not grant or not expires or expires <= now:
            if grant:
                self.database.delete_switch_grant(device_hash, user_id)
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        user = self.database.user_access(user_id)
        if not user:
            raise PermissionError(self.SWITCH_REAUTH_MESSAGE)
        result = self.create_session(user)
        self.remember_account(device_hash, user_id)
        return result
    def forget_account(self, device_hash: str, user_id: int) -> None:
        if device_hash and user_id > 0:
            self.database.delete_switch_grant(device_hash, user_id)
    def revoke_current_device_grant(self, device_hash: str, user_id: int) -> None:
        if device_hash and user_id > 0:
            self.database.delete_switch_grant(device_hash, user_id)
    def create_session(self, user: dict[str, Any]) -> dict[str, Any]:
        session_token = secrets.token_urlsafe(32)
@@ -188,30 +188,6 @@ class MarketServiceMixin:
        age_seconds = (now - updated_at.astimezone(now.tzinfo)).total_seconds()
        return age_seconds >= 8
    def _closing_snapshot_due(
        self,
        normalized_date: str,
        snapshot: dict[str, Any],
    ) -> bool:
        """After 15:05, keep requesting daily bars until today's EOD snapshot exists."""
        if not self.configured or normalized_date != date.today().strftime("%Y%m%d"):
            return False
        now = datetime.now().astimezone()
        if now.weekday() >= 5:
            return False
        local_time = now.time().replace(tzinfo=None)
        if local_time < datetime.strptime("15:05", "%H:%M").time():
            return False
        meta = snapshot.get("meta") or {}
        snapshot_trade_date = str(meta.get("trade_date") or "").replace("-", "")
        if (
            snapshot_trade_date == normalized_date
            and not meta.get("realtime")
            and not meta.get("carried_forward")
        ):
            return False
        return True
    def sync_dashboard(self, trade_date: str) -> dict[str, Any]:
        normalized_date = normalize_date(trade_date)
        source = "tushare"
@@ -222,6 +198,11 @@ class MarketServiceMixin:
                    raise TushareError("公共行情尚未配置")
                dashboard = self._tushare_client().dashboard(normalized_date)
                if (dashboard.get("meta") or {}).get("limit_data_source") == "derived":
                    raise TushareError(
                        str((dashboard.get("meta") or {}).get("notice") or "官方涨跌停数据尚未返回")
                    )
                dashboard["meta"]["source"] = source
                dashboard["meta"]["requested_date"] = self._display_compact_date(normalized_date)
                dashboard = self._enrich_dashboard_sentiment(dashboard, normalized_date)
@@ -256,15 +237,9 @@ class MarketServiceMixin:
                        fallback, normalized_date, f"最新行情暂不可用，沿用最近收盘快照：{exc}"
                    )
                    self.database.finish_sync(
-                        sync_id, "failed", self._record_count(carried), str(exc), "tushare"
+                        sync_id, "fallback", self._record_count(carried), str(exc), "tushare"
                    )
-                    result = self._apply_reason_overrides(
+                    return self._apply_reason_overrides(self._with_storage(carried, cached=True))
                        self._with_storage(carried, cached=True)
                    )
                    # 页面仍可读到沿用快照；后台任务通过顶层 status=failed 记失败。
                    result["status"] = "failed"
                    result["error"] = str(exc)
                    return result
                self.database.finish_sync(sync_id, "failed", message=str(exc))
                raise ValueError("暂无可用的真实行情快照，请等待后台完成首次同步。") from exc
            except Exception as exc:
@@ -1193,4 +1168,3 @@ class MarketServiceMixin:
            len(dashboard.get(key) or [])
            for key in ("limits", "broken", "down_limits", "yesterday_limits")
        )
@@ -26,13 +26,15 @@ class SystemHttpMixin:
    def start_background_refresh(self) -> None:
        try:
            body = self.read_json_body(allow_empty=True)
-            started = self.application_service.request_background_sync(
+            refresh = self.application_service.request_background_sync(
                str(body.get("trade_date") or date.today().isoformat())
            )
            started = bool(refresh.get("started"))
            self.send_json(
                {
                    "ok": True,
                    "started": started,
                    "job_key": str(refresh.get("job_key") or ""),
                    "message": "后台刷新已开始" if started else "已有后台刷新任务正在运行",
                },
                HTTPStatus.ACCEPTED,
@@ -7,6 +7,8 @@ from urllib.parse import urlparse
 PUBLIC_POST_HANDLERS = {
    "/api/auth/register": "auth_register",
    "/api/auth/login": "auth_login",
    "/api/auth/switch": "auth_switch",
    "/api/auth/forget": "auth_forget",
 }
 AUTHENTICATED_POST_HANDLERS = {
@@ -9,7 +9,13 @@ from http.cookies import SimpleCookie
 from typing import Any
 from urllib.parse import unquote
-from backend.bootstrap.config import SESSION_COOKIE, SESSION_MAX_AGE, STATIC_DIR
+from backend.bootstrap.config import (
    DEVICE_COOKIE,
    DEVICE_MAX_AGE,
    SESSION_COOKIE,
    SESSION_MAX_AGE,
    STATIC_DIR,
 )
 from backend.features.accounts.security import token_hash
 from backend.http.context import correlation_id
 from backend.http.errors import normalize_error_payload
@@ -21,15 +27,21 @@ class HttpTransportMixin:
    application_service: Any
    route_registry: Any
-    def session_token(self) -> str:
+    def cookie_value(self, name: str) -> str:
        cookie = SimpleCookie()
        try:
            cookie.load(self.headers.get("Cookie", ""))
        except Exception:
            return ""
-        morsel = cookie.get(SESSION_COOKIE)
+        morsel = cookie.get(name)
        return morsel.value if morsel else ""
    def session_token(self) -> str:
        return self.cookie_value(SESSION_COOKIE)
    def device_token(self) -> str:
        return self.cookie_value(DEVICE_COOKIE)
    def require_auth(self, send_error: bool = True) -> bool:
        raw_token = self.session_token()
        service = self.application_service
@@ -79,15 +91,18 @@ class HttpTransportMixin:
            return self.require_member()
        return True
-    def session_cookie(self, value: str, clear: bool = False) -> str:
+    def _cookie_header(self, name: str, value: str, max_age: int) -> str:
-        max_age = 0 if clear else SESSION_MAX_AGE
+        cookie = f"{name}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
        cookie = (
            f"{SESSION_COOKIE}={value}; Path=/; HttpOnly; SameSite=Lax; Max-Age={max_age}"
        )
        if self.headers.get("X-Forwarded-Proto", "").lower() == "https":
            cookie += "; Secure"
        return cookie
    def session_cookie(self, value: str, clear: bool = False) -> str:
        return self._cookie_header(SESSION_COOKIE, value, 0 if clear else SESSION_MAX_AGE)
    def device_cookie(self, value: str, clear: bool = False) -> str:
        return self._cookie_header(DEVICE_COOKIE, value, 0 if clear else DEVICE_MAX_AGE)
    def read_json_body(self, allow_empty: bool = False) -> dict[str, Any]:
        length = int(self.headers.get("Content-Length", "0"))
        if length == 0 and allow_empty:
@@ -132,7 +147,7 @@ class HttpTransportMixin:
        self,
        payload: dict[str, Any],
        status: HTTPStatus = HTTPStatus.OK,
-        headers: dict[str, str] | None = None,
+        headers: dict[str, str] | list[tuple[str, str]] | tuple[tuple[str, str], ...] | None = None,
    ) -> None:
        request_id = getattr(self, "_correlation_id", "")
        if not request_id:
@@ -145,7 +160,8 @@ class HttpTransportMixin:
        self.send_header("Content-Length", str(len(content)))
        self.send_header("Cache-Control", "no-store")
        self.send_header("X-Request-ID", request_id)
-        for name, value in (headers or {}).items():
+        header_items = headers.items() if isinstance(headers, dict) else (headers or ())
        for name, value in header_items:
            self.send_header(name, value)
        self.end_headers()
        self.wfile.write(content)
@@ -7,6 +7,16 @@ from datetime import date
 from backend.bootstrap.config import normalize_date
 def _verified_dashboard_result(dashboard: dict[str, object]) -> dict[str, object]:
    meta = dashboard.get("meta") or {}
    if isinstance(meta, dict) and meta.get("carried_forward"):
        return {
            "status": "failed",
            "error": str(meta.get("notice") or "未获取到所选日期的最新行情"),
        }
    return dashboard
 class JobServiceMixin:
    def start_background_jobs(self) -> threading.Thread:
        return self.jobs.start_scheduler(
@@ -20,15 +30,16 @@ class JobServiceMixin:
        workers_stopped = self.jobs.wait_for_idle(timeout_seconds)
        return scheduler_stopped and workers_stopped
-    def request_background_sync(self, trade_date: str) -> bool:
+    def request_background_sync(self, trade_date: str) -> dict[str, object]:
        normalized = normalize_date(trade_date)
        key = f"manual:{normalized}:{time.time_ns()}"
-        return self.jobs.submit(
+        started = self.jobs.submit(
            "market.refresh",
            key,
-            lambda: self.sync_dashboard(normalized),
+            lambda: _verified_dashboard_result(self.sync_dashboard(normalized)),
            {"trade_date": normalized, "trigger": "administrator"},
        )
        return {"started": started, "job_key": key if started else ""}
    def _background_refresh_tick(self) -> None:
        if not (
@@ -46,13 +57,4 @@ class JobServiceMixin:
                lambda: self.sync_dashboard(today),
                {"trade_date": today, "trigger": "realtime-poll"},
            )
        elif self._closing_snapshot_due(today, snapshot):
            # 15:05 后改走日线生成当日快照；按分钟去重，避免日线未就绪时刷爆任务。
            bucket = int(time.time() // 60)
            self.jobs.submit(
                "market.refresh",
                f"closing:{today}:{bucket}",
                lambda: self.sync_dashboard(today),
                {"trade_date": today, "trigger": "post-close"},
            )
        self._schedule_automatic_screeners(today, snapshot)
@@ -3,7 +3,9 @@ services:
    build:
      context: .
      dockerfile: Dockerfile
-    image: xiaobai-review:latest
+      labels:
        org.opencontainers.image.revision: "${XIAOBAI_GIT_REV:?必须先设置 XIAOBAI_GIT_REV=当前 main 完整提交号（或改用 tools/update_from_main.sh）}"
    image: xiaobai-review:main-${XIAOBAI_GIT_SHORT:?必须先设置 XIAOBAI_GIT_SHORT=7位提交短号（或改用 tools/update_from_main.sh）}
    container_name: xiaobai-review
    ports:
      - "0.0.0.0:8765:8765/tcp"
@@ -128,6 +128,20 @@
      "feature": "auction",
      "access": "authenticated"
    },
    {
      "method": "GET",
      "path": "/api/auth/accounts",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/forget",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/login",
@@ -156,6 +170,13 @@
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/auth/switch",
      "match": "exact",
      "feature": "auth",
      "access": "public"
    },
    {
      "method": "POST",
      "path": "/api/backfill",
@@ -10,10 +10,10 @@
  },
  "counts": {
    "primary_pages": 16,
-    "api_exact_paths": 53,
+    "api_exact_paths": 56,
    "api_prefixes": 0,
    "api_patterns": 11,
-    "database_tables": 36,
+    "database_tables": 37,
    "frontend_page_fragments": 12
  },
  "pages": [
@@ -96,10 +96,13 @@
      "/api/assistant/chat",
      "/api/assistant/messages",
      "/api/auction",
      "/api/auth/accounts",
      "/api/auth/forget",
      "/api/auth/login",
      "/api/auth/logout",
      "/api/auth/me",
      "/api/auth/register",
      "/api/auth/switch",
      "/api/backfill",
      "/api/chart/intraday",
      "/api/dashboard",
@@ -189,6 +192,7 @@
    "assistant_messages",
    "heaven_readings",
    "job_runs",
    "account_switch_grants",
    "schema_migrations"
  ],
  "background_job_methods": [
@@ -370,11 +374,11 @@
    }
  ],
  "css_layers": [
-    "/shared/tokens.css?v=20260820-3",
+    "/shared/tokens.css?v=20260829-hel240",
    "/shared/base.css?v=20260806-1",
-    "/shared/shell.css?v=20260827-hel183",
+    "/shared/shell.css?v=20260829-hel237",
-    "/shared/auth.css?v=20260820-5",
+    "/shared/auth.css?v=20260829-hel240b",
-    "/shared/components/controls.css?v=20260827-hel183",
+    "/shared/components/controls.css?v=20260829-hel237",
    "/shared/components/navigation.css?v=20260820-1",
    "/shared/components/cards.css?v=20260820-1",
    "/shared/components/tables.css?v=20260820-1",
@@ -461,8 +465,8 @@
    },
    {
      "path": "frontend/index.html",
-      "bytes": 47891,
+      "bytes": 48254,
-      "lines": 661
+      "lines": 664
    },
    {
      "path": "backend/features/screener/catalog.py",
@@ -486,8 +490,8 @@
    },
    {
      "path": "backend/data/providers/tushare_dashboard.py",
-      "bytes": 27730,
+      "bytes": 28234,
-      "lines": 634
+      "lines": 648
    },
    {
      "path": "backend/data/providers/tushare_industries.py",
@@ -551,8 +555,13 @@
    },
    {
      "path": "frontend/shared/session.js",
-      "bytes": 13176,
+      "bytes": 13219,
-      "lines": 293
+      "lines": 289
    },
    {
      "path": "frontend/shared/dashboard.js",
      "bytes": 12894,
      "lines": 274
    },
    {
      "path": "backend/features/market/insights_auction_data.py",
@@ -574,11 +583,6 @@
      "bytes": 10539,
      "lines": 244
    },
    {
      "path": "frontend/shared/dashboard.js",
      "bytes": 9993,
      "lines": 220
    },
    {
      "path": "backend/data/providers/tushare_sectors.py",
      "bytes": 9876,
@@ -669,16 +673,16 @@
      "bytes": 5451,
      "lines": 118
    },
    {
      "path": "frontend/pages.config.js",
      "bytes": 5385,
      "lines": 130
    },
    {
      "path": "frontend/pages/market/search.js",
      "bytes": 5384,
      "lines": 131
    },
    {
      "path": "frontend/pages.config.js",
      "bytes": 5380,
      "lines": 130
    },
    {
      "path": "frontend/pages/auction/page.html",
      "bytes": 5350,
@@ -716,8 +720,8 @@
    },
    {
      "path": "backend/http/dispatch.py",
-      "bytes": 4118,
+      "bytes": 4196,
-      "lines": 115
+      "lines": 117
    },
    {
      "path": "frontend/shared/table.js",
@@ -734,16 +738,16 @@
      "bytes": 3369,
      "lines": 81
    },
    {
      "path": "frontend/app.js",
      "bytes": 3337,
      "lines": 95
    },
    {
      "path": "frontend/pages/themes/page.html",
      "bytes": 3316,
      "lines": 55
    },
    {
      "path": "frontend/app.js",
      "bytes": 3201,
      "lines": 93
    },
    {
      "path": "backend/features/market/insights_context.py",
      "bytes": 3175,
@@ -761,7 +765,7 @@
    },
    {
      "path": "backend/features/accounts/application.py",
-      "bytes": 2442,
+      "bytes": 2514,
      "lines": 63
    },
    {
@@ -769,16 +773,16 @@
      "bytes": 2299,
      "lines": 57
    },
    {
      "path": "backend/jobs/service.py",
      "bytes": 2219,
      "lines": 60
    },
    {
      "path": "backend/features/screener/regime.py",
      "bytes": 2202,
      "lines": 53
    },
    {
      "path": "backend/jobs/service.py",
      "bytes": 2201,
      "lines": 58
    },
    {
      "path": "backend/data/providers/tushare_client.py",
      "bytes": 2166,
@@ -849,6 +853,11 @@
      "bytes": 1143,
      "lines": 19
    },
    {
      "path": "backend/features/accounts/routes.py",
      "bytes": 908,
      "lines": 25
    },
    {
      "path": "backend/features/popularity/routes.py",
      "bytes": 822,
@@ -859,11 +868,6 @@
      "bytes": 817,
      "lines": 23
    },
    {
      "path": "backend/features/accounts/routes.py",
      "bytes": 803,
      "lines": 22
    },
    {
      "path": "backend/features/sentiment/routes.py",
      "bytes": 724,
@@ -25,8 +25,10 @@ async function initialize() {
  try {
    const session = await apiRequest("/api/auth/me");
    if (!session.authenticated) {
-      if (session.registration_required) selectAuthMode("register");
+      const params = new URLSearchParams();
-      showAuthGate();
+      if (session.registration_required) params.set("mode", "register");
      const query = params.toString();
      window.location.replace("/login/" + (query ? `?${query}` : ""));
      return;
    }
    await applyAuthenticatedSession(session);
@@ -24,7 +24,9 @@
    (() => {
      let theme = "light";
      try {
-        theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
+        const stored = localStorage.getItem("xiaobaiTheme");
        if (stored === "dark" || stored === "light") theme = stored;
        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
      } catch (_error) {
        theme = "light";
      }
@@ -32,11 +34,11 @@
      document.documentElement.style.colorScheme = theme;
    })();
  </script>
-  <link rel="stylesheet" href="/shared/tokens.css?v=20260820-3">
+  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-hel240">
  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
-  <link rel="stylesheet" href="/shared/shell.css?v=20260827-hel183">
+  <link rel="stylesheet" href="/shared/shell.css?v=20260829-hel237">
-  <link rel="stylesheet" href="/shared/auth.css?v=20260820-5">
+  <link rel="stylesheet" href="/shared/auth.css?v=20260829-hel240b">
-  <link rel="stylesheet" href="/shared/components/controls.css?v=20260827-hel183">
+  <link rel="stylesheet" href="/shared/components/controls.css?v=20260829-hel237">
  <link rel="stylesheet" href="/shared/components/navigation.css?v=20260820-1">
  <link rel="stylesheet" href="/shared/components/cards.css?v=20260820-1">
  <link rel="stylesheet" href="/shared/components/tables.css?v=20260820-1">
@@ -57,7 +59,7 @@
  <link rel="stylesheet" href="/pages/review/foundation.css?v=20260820-4">
 </head>
 <body>
-  <section id="authGate" class="auth-gate" aria-label="账号登录">
+  <section id="authGate" class="auth-gate" aria-label="账号登录" hidden>
    <div class="auth-shell">
      <div class="auth-brand">
        <div class="brand-mark" aria-hidden="true"><span class="brand-glyph">复</span></div>
@@ -609,6 +611,7 @@
        <label class="form-field"><span>iFinD Refresh Token</span><input id="systemIfindTokenInput" type="password" autocomplete="off" maxlength="2048" placeholder="留空保留现有 Token"></label>
        <label class="switch-control"><input id="systemBackgroundRefresh" type="checkbox"><span>启用交易时段后台刷新</span></label>
        <p class="form-hint">所有用户读取同一份后台快照，页面不会随后台任务自动重绘。</p>
        <div id="adminRefreshStatus" class="admin-refresh-status" data-tone="idle" role="status" aria-live="polite"><i data-lucide="circle-dot"></i><span>尚未手动刷新</span></div>
        <div class="dialog-actions admin-inline-actions"><button id="adminRefreshButton" class="button" type="button"><i data-lucide="refresh-cw"></i>立即后台刷新</button><button class="button primary" type="submit">保存行情配置</button></div>
      </form>
      <section class="settings-section">
@@ -0,0 +1,162 @@
 <!doctype html>
 <html lang="zh-CN">
 <head>
  <meta charset="utf-8">
  <meta name="viewport" content="width=device-width, initial-scale=1">
  <meta name="color-scheme" content="light dark">
  <title>登录 · 小白复盘</title>
  <script>
    (() => {
      let theme = "light";
      try {
        const stored = localStorage.getItem("xiaobaiTheme");
        if (stored === "dark" || stored === "light") theme = stored;
        else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
      } catch (_error) {
        theme = "light";
      }
      document.documentElement.dataset.theme = theme;
      document.documentElement.style.colorScheme = theme;
    })();
  </script>
  <link rel="stylesheet" href="/shared/tokens.css?v=20260829-hel251">
  <link rel="stylesheet" href="/shared/base.css?v=20260806-1">
  <link rel="stylesheet" href="/shared/auth.css?v=20260829-hel251">
  <link rel="stylesheet" href="/shared/components/controls.css?v=20260820-2">
 </head>
 <body class="login-portal">
  <aside class="login-brand" aria-hidden="true">
    <div class="login-brand-header">
      <div class="login-brand-mark"><span class="login-brand-glyph">复</span></div>
      <div class="login-brand-identity">
        <p class="login-brand-name">小白复盘</p>
        <p class="login-brand-subtitle">A股个人复盘工作台</p>
      </div>
    </div>
    <div class="login-mascots" id="loginMascots" aria-hidden="true" data-mood="idle">
      <div class="login-mascots-stage">
        <div class="login-mascot is-red">
          <div class="login-mascot-breathe">
            <div class="login-mascot-lean">
              <svg class="login-mascot-figure" viewBox="0 0 96 210" focusable="false">
                <ellipse class="login-mascot-shadow" cx="48" cy="200" rx="26" ry="5.5"></ellipse>
                <line class="login-mascot-wick" x1="48" y1="10" x2="48" y2="50"></line>
                <rect class="login-mascot-body" x="16" y="50" width="64" height="126" rx="14"></rect>
                <line class="login-mascot-wick" x1="48" y1="176" x2="48" y2="190"></line>
                <g class="login-mascot-face">
                  <circle class="login-mascot-eye" cx="36" cy="94" r="10"></circle>
                  <circle class="login-mascot-eye" cx="60" cy="94" r="10"></circle>
                  <circle class="login-mascot-pupil" cx="36" cy="94" r="4.2"></circle>
                  <circle class="login-mascot-pupil" cx="60" cy="94" r="4.2"></circle>
                  <rect class="login-mascot-lid" x="24" y="82" width="48" height="24" rx="10"></rect>
                  <path class="login-mascot-happy" d="M28 96 Q36 88 44 96"></path>
                  <path class="login-mascot-happy" d="M52 96 Q60 88 68 96"></path>
                  <circle class="login-mascot-sad" cx="36" cy="96" r="2.2"></circle>
                  <circle class="login-mascot-sad" cx="60" cy="96" r="2.2"></circle>
                </g>
                <ellipse class="login-mascot-arm is-left" cx="16" cy="128" rx="8" ry="5.5"></ellipse>
                <ellipse class="login-mascot-arm is-right" cx="80" cy="128" rx="8" ry="5.5"></ellipse>
                <ellipse class="login-mascot-hand is-left" cx="16" cy="128" rx="9" ry="7"></ellipse>
                <ellipse class="login-mascot-hand is-right" cx="80" cy="128" rx="9" ry="7"></ellipse>
              </svg>
            </div>
          </div>
        </div>
        <div class="login-mascot is-green">
          <div class="login-mascot-breathe">
            <div class="login-mascot-lean">
              <div class="login-mascot-figure">
                <svg class="login-mascot-front" viewBox="0 0 84 175" focusable="false">
                  <ellipse class="login-mascot-shadow" cx="42" cy="166" rx="22" ry="4.5"></ellipse>
                  <line class="login-mascot-wick" x1="42" y1="8" x2="42" y2="42"></line>
                  <rect class="login-mascot-body" x="15" y="42" width="54" height="104" rx="12"></rect>
                  <line class="login-mascot-wick" x1="42" y1="146" x2="42" y2="158"></line>
                  <g class="login-mascot-face">
                    <circle class="login-mascot-eye" cx="32" cy="76" r="8.5"></circle>
                    <circle class="login-mascot-eye" cx="52" cy="76" r="8.5"></circle>
                    <circle class="login-mascot-pupil" cx="32" cy="76" r="3.6"></circle>
                    <circle class="login-mascot-pupil" cx="52" cy="76" r="3.6"></circle>
                    <rect class="login-mascot-lid" x="22" y="66" width="40" height="20" rx="8"></rect>
                    <path class="login-mascot-happy" d="M25 78 Q32 71 39 78"></path>
                    <path class="login-mascot-happy" d="M45 78 Q52 71 59 78"></path>
                    <circle class="login-mascot-sad" cx="32" cy="78" r="1.9"></circle>
                    <circle class="login-mascot-sad" cx="52" cy="78" r="1.9"></circle>
                  </g>
                  <ellipse class="login-mascot-arm is-left" cx="15" cy="108" rx="7" ry="4.5"></ellipse>
                  <ellipse class="login-mascot-arm is-right" cx="69" cy="108" rx="7" ry="4.5"></ellipse>
                </svg>
                <svg class="login-mascot-back" viewBox="0 0 84 175" focusable="false">
                  <ellipse class="login-mascot-shadow" cx="42" cy="166" rx="22" ry="4.5"></ellipse>
                  <line class="login-mascot-wick" x1="42" y1="8" x2="42" y2="42"></line>
                  <rect class="login-mascot-body" x="15" y="42" width="54" height="104" rx="12"></rect>
                  <line class="login-mascot-wick" x1="42" y1="146" x2="42" y2="158"></line>
                  <rect class="login-mascot-slit" x="40.5" y="58" width="3" height="72" rx="1.5"></rect>
                  <ellipse class="login-mascot-arm is-left" cx="15" cy="108" rx="7" ry="4.5"></ellipse>
                  <ellipse class="login-mascot-arm is-right" cx="69" cy="108" rx="7" ry="4.5"></ellipse>
                </svg>
              </div>
            </div>
          </div>
        </div>
      </div>
    </div>
    <div class="login-brand-copy">
      <p class="login-brand-kicker">收盘之后 · 复盘开始</p>
      <h1 class="login-brand-title">看懂情绪周期，把复盘变成下一次的先手。</h1>
      <p class="login-brand-lead">情绪周期、涨停梯队、主题轮动、竞价、龙虎榜、人气榜、交易复盘，集中在一个安静的复盘空间。</p>
    </div>
    <div class="login-brand-market">
      <svg class="login-brand-chart" viewBox="0 0 480 168" focusable="false">
        <defs>
          <linearGradient id="loginChartFade" x1="0" x2="0" y1="0" y2="1">
            <stop offset="0%" stop-color="#d7e4ff" stop-opacity="0.18"></stop>
            <stop offset="100%" stop-color="#d7e4ff" stop-opacity="0"></stop>
          </linearGradient>
        </defs>
        <path class="login-chart-area" d="M8 118 C 52 108, 78 96, 112 102 S 168 128, 204 112 S 268 78, 312 86 S 372 118, 428 92 L 472 84 L 472 168 L 8 168 Z"></path>
        <g class="login-candles">
          <g class="is-up" transform="translate(36 0)"><line x1="8" y1="58" x2="8" y2="128"></line><rect x="2" y="72" width="12" height="40"></rect></g>
          <g class="is-down" transform="translate(68 0)"><line x1="8" y1="64" x2="8" y2="132"></line><rect x="2" y="86" width="12" height="28"></rect></g>
          <g class="is-up" transform="translate(100 0)"><line x1="8" y1="48" x2="8" y2="118"></line><rect x="2" y="60" width="12" height="44"></rect></g>
          <g class="is-down" transform="translate(132 0)"><line x1="8" y1="70" x2="8" y2="136"></line><rect x="2" y="92" width="12" height="26"></rect></g>
          <g class="is-up" transform="translate(164 0)"><line x1="8" y1="42" x2="8" y2="110"></line><rect x="2" y="54" width="12" height="38"></rect></g>
          <g class="is-up" transform="translate(196 0)"><line x1="8" y1="36" x2="8" y2="98"></line><rect x="2" y="48" width="12" height="32"></rect></g>
          <g class="is-down" transform="translate(228 0)"><line x1="8" y1="58" x2="8" y2="128"></line><rect x="2" y="78" width="12" height="36"></rect></g>
          <g class="is-up" transform="translate(260 0)"><line x1="8" y1="40" x2="8" y2="104"></line><rect x="2" y="52" width="12" height="36"></rect></g>
          <g class="is-down" transform="translate(292 0)"><line x1="8" y1="66" x2="8" y2="134"></line><rect x="2" y="88" width="12" height="30"></rect></g>
          <g class="is-up" transform="translate(324 0)"><line x1="8" y1="44" x2="8" y2="112"></line><rect x="2" y="58" width="12" height="40"></rect></g>
          <g class="is-down" transform="translate(356 0)"><line x1="8" y1="72" x2="8" y2="138"></line><rect x="2" y="96" width="12" height="24"></rect></g>
          <g class="is-up" transform="translate(388 0)"><line x1="8" y1="38" x2="8" y2="108"></line><rect x="2" y="50" width="12" height="42"></rect></g>
          <g class="is-up" transform="translate(420 0)"><line x1="8" y1="32" x2="8" y2="96"></line><rect x="2" y="44" width="12" height="34"></rect></g>
        </g>
        <path class="login-chart-line" d="M8 118 C 52 108, 78 96, 112 102 S 168 128, 204 112 S 268 78, 312 86 S 372 118, 428 92 L 472 84"></path>
      </svg>
      <dl class="login-brand-stats">
        <div class="login-stat">
          <dt>市场情绪</dt>
          <dd>72 <span class="login-stat-tag">高热</span></dd>
        </div>
        <div class="login-stat">
          <dt>涨停</dt>
          <dd>63</dd>
        </div>
        <div class="login-stat">
          <dt>跌停</dt>
          <dd>4</dd>
        </div>
        <div class="login-stat login-stat-wide">
          <dt>两市成交</dt>
          <dd>1.02万亿</dd>
        </div>
      </dl>
    </div>
    <p class="login-brand-disclaimer">股市有风险，投资需谨慎 · 本工具仅供个人复盘学习使用</p>
  </aside>
  <main class="login-stage">
    <button id="loginThemeToggle" class="login-theme-toggle" type="button">🌙 夜间</button>
    <section class="login-card" id="loginCard" aria-live="polite"></section>
  </main>
  <script src="/shared/api.js?v=20260803-2"></script>
  <script src="/login/page.js?v=20260829-hel251"></script>
 </body>
 </html>
@@ -0,0 +1,610 @@
 (function bootLoginPortal(global) {
  "use strict";
  const THEME_KEY = "xiaobaiTheme";
  const api = global.XiaobaiAPI;
  const card = document.querySelector("#loginCard");
  const themeButton = document.querySelector("#loginThemeToggle");
  const state = {
    view: "first",
    mode: "login",
    accounts: [],
    currentUserId: null,
    loading: false,
    confirmingId: null,
    error: "",
    username: "",
    password: "",
    passwordVisible: false,
  };
  function escapeHtml(value) {
    return String(value ?? "").replace(/[&<>"']/g, (ch) => (
      { "&": "&amp;", "<": "&lt;", ">": "&gt;", '"': "&quot;", "'": "&#39;" }[ch]
    ));
  }
  function preferredTheme() {
    try {
      const stored = global.localStorage.getItem(THEME_KEY);
      if (stored === "dark" || stored === "light") return stored;
    } catch (_error) {
      // Fall through to the system preference.
    }
    return global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches
      ? "dark"
      : "light";
  }
  function applyTheme(theme, persist) {
    const normalized = theme === "dark" ? "dark" : "light";
    document.documentElement.dataset.theme = normalized;
    document.documentElement.style.colorScheme = normalized;
    themeButton.textContent = normalized === "dark" ? "☀ 日间" : "🌙 夜间";
    themeButton.setAttribute("aria-label", normalized === "dark" ? "切换到日间模式" : "切换到夜间模式");
    if (persist) {
      try {
        global.localStorage.setItem(THEME_KEY, normalized);
      } catch (_error) {
        // Theme still applies for the current page when storage is unavailable.
      }
    }
  }
  function setError(message) {
    state.error = message || "";
  }
  function formatLastUsed(value) {
    if (!value) return "";
    const parsed = new Date(value);
    if (Number.isNaN(parsed.getTime())) return "";
    const now = new Date();
    const hh = String(parsed.getHours()).padStart(2, "0");
    const mm = String(parsed.getMinutes()).padStart(2, "0");
    if (parsed.toDateString() === now.toDateString()) return `今天 ${hh}:${mm}`;
    const yesterday = new Date(now);
    yesterday.setDate(now.getDate() - 1);
    if (parsed.toDateString() === yesterday.toDateString()) return `昨天 ${hh}:${mm}`;
    return `${parsed.getMonth() + 1}月${parsed.getDate()}日`;
  }
  function chipsFor(account, current) {
    const chips = [];
    if (current) chips.push('<span class="login-chip login-chip-current">当前</span>');
    if (account.role === "admin") chips.push('<span class="login-chip">管理员</span>');
    if (account.membership?.subscribed) chips.push('<span class="login-chip login-chip-member">会员</span>');
    else if (account.role !== "admin") chips.push('<span class="login-chip">普通用户</span>');
    return chips.join("");
  }
  function returnPath() {
    const raw = new URLSearchParams(global.location.search).get("next") || "";
    if (!raw) return "/";
    try {
      const url = new URL(raw, global.location.origin);
      if (url.origin !== global.location.origin) return "/";
      const path = url.pathname || "/";
      if (path === "/login" || path.startsWith("/login/")) return "/";
      return `${path}${url.search}${url.hash}` || "/";
    } catch (_error) {
      return "/";
    }
  }
  function enterApp() {
    global.location.replace(returnPath());
  }
  function formMarkup(options) {
    const registering = state.mode === "register";
    const submitLabel = options.submitLabel
      || (state.loading ? "正在登录..." : registering ? "注册并进入" : options.add ? "添加并进入" : "登录");
    const lead = options.lead;
    const hint = options.hint;
    const invalid = state.error ? " is-invalid" : "";
    const passwordType = state.passwordVisible ? "text" : "password";
    const passwordToggle = state.passwordVisible ? "隐藏" : "显示";
    return [
      options.back
        ? '<button class="login-back" type="button" data-login-action="picker">返回账号列表</button>'
        : "",
      `<h2 class="login-card-title">${escapeHtml(options.title)}</h2>`,
      `<p class="login-card-lead">${escapeHtml(lead)}</p>`,
      '<div class="login-tabs" role="tablist">',
      `<button class="login-tab${state.mode === "login" ? " is-active" : ""}" type="button" data-auth-mode="login">登录</button>`,
      `<button class="login-tab${state.mode === "register" ? " is-active" : ""}" type="button" data-auth-mode="register">注册</button>`,
      "</div>",
      '<form class="login-form" id="loginForm">',
      `<label class="form-field"><span>账号名</span><input id="loginUsername" type="text" minlength="3" maxlength="30" autocomplete="username" placeholder="请输入账号名" value="${escapeHtml(state.username)}" required></label>`,
      `<label class="form-field"><span>密码</span><span class="login-password-wrap"><input id="loginPassword" class="${invalid.trim()}" type="${passwordType}" minlength="8" maxlength="128" autocomplete="${registering ? "new-password" : "current-password"}" placeholder="请输入密码" value="${escapeHtml(state.password)}" required><button class="login-password-toggle" type="button" data-login-action="toggle-password" aria-pressed="${state.passwordVisible ? "true" : "false"}" aria-label="${state.passwordVisible ? "隐藏密码" : "显示密码"}">${passwordToggle}</button></span></label>`,
      `<label class="form-field" id="loginConfirmField"${registering ? "" : " hidden"}><span>确认密码</span><input id="loginPasswordConfirm" type="password" minlength="8" maxlength="128" autocomplete="new-password"${registering ? " required" : ""}></label>`,
      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : '<p class="login-error" hidden></p>',
      `<button class="button primary login-submit" type="submit"${state.loading ? " disabled" : ""}>`,
      state.loading ? '<span class="login-spinner" aria-hidden="true"></span>' : "",
      `<span>${escapeHtml(submitLabel)}</span></button>`,
      "</form>",
      `<p class="login-hint">${escapeHtml(hint)}</p>`,
    ].join("");
  }
  function accountRow(account) {
    const current = Number(account.user_id) === Number(state.currentUserId);
    const confirming = Number(state.confirmingId) === Number(account.user_id);
    const managing = state.view === "manage";
    const classes = [
      "login-account-row",
      current ? "is-current" : "",
      confirming ? "is-confirming" : "",
      !managing ? "is-switchable" : "",
    ].filter(Boolean).join(" ");
    if (managing && confirming) {
      return [
        `<div class="${classes}" data-user-id="${account.user_id}">`,
        `<p class="login-confirm-copy">移除「${escapeHtml(account.username)}」的本机记录？</p>`,
        '<div class="login-confirm-actions">',
        `<button class="button danger-button" type="button" data-forget-id="${account.user_id}">移除</button>`,
        '<button class="button" type="button" data-login-action="cancel-forget">取消</button>',
        "</div></div>",
      ].join("");
    }
    const glyph = escapeHtml(String(account.username || "账").slice(0, 1));
    const tone = Number(account.user_id || 0) % 4;
    const used = formatLastUsed(account.last_used_at);
    const action = managing
      ? `<button class="login-account-remove" type="button" data-confirm-id="${account.user_id}" aria-label="移除 ${escapeHtml(account.username)}"><svg width="16" height="16" viewBox="0 0 16 16" aria-hidden="true"><path fill="currentColor" d="M6 2h4l.5 1H14v1H2V3h3.5L6 2zm1 4v6H6V6h1zm3 0v6H9V6h1zM3.5 5H13l-.7 8.2A1.5 1.5 0 0 1 10.81 14H5.19a1.5 1.5 0 0 1-1.49-1.8L3.5 5z"></path></svg></button>`
      : current
        ? '<span class="login-account-action"><span class="login-account-check" aria-hidden="true">✓</span>继续使用</span>'
        : "";
    const switchAttr = !managing && !current ? ` data-switch-id="${account.user_id}"` : "";
    const resumeAttr = !managing && current ? ` data-resume-id="${account.user_id}"` : "";
    return [
      `<div class="${classes}" data-user-id="${account.user_id}"${switchAttr}${resumeAttr}>`,
      `<span class="login-avatar tone-${tone}" aria-hidden="true">${glyph}</span>`,
      '<div class="login-account-meta">',
      '<div class="login-account-name">',
      `<strong>${escapeHtml(account.username)}</strong>`,
      chipsFor(account, current),
      "</div>",
      used ? `<span class="login-account-used">上次登录 ${escapeHtml(used)}</span>` : "",
      "</div>",
      action,
      "</div>",
    ].join("");
  }
  function pickerMarkup() {
    const count = state.accounts.length;
    const managing = state.view === "manage";
    return [
      managing
        ? ""
        : '<button class="login-back" type="button" data-login-action="resume">返回复盘</button>',
      `<h2 class="login-card-title">${managing ? "管理账号记录" : "选择账号"}</h2>`,
      `<p class="login-card-lead">${managing
        ? "移除只删除这台电脑上的登录记录，不会注销账号"
        : `这台电脑已记录 ${count} 个账号，点选即可进入，无需再次输入密码。`}</p>`,
      managing
        ? '<div class="login-manage-toolbar"><p class="login-manage-hint">点击右侧图标移除对应记录</p><button class="login-manage-done" type="button" data-login-action="picker">完成</button></div>'
        : "",
      `<div class="login-account-list">${state.accounts.map(accountRow).join("")}</div>`,
      managing
        ? ""
        : '<button class="login-add" type="button" data-login-action="add">＋ 添加账号</button>',
      managing
        ? ""
        : '<button class="login-manage" type="button" data-login-action="manage">管理已记录的账号</button>',
      state.error ? `<p class="login-error">${escapeHtml(state.error)}</p>` : "",
      managing
        ? '<p class="login-privacy"><span class="login-lock" aria-hidden="true">🔒</span>移除后再次登录该账号需重新输入密码</p>'
        : '<p class="login-privacy"><span class="login-lock" aria-hidden="true">🔒</span>账号记录仅保存在这台电脑的浏览器中</p>',
    ].join("");
  }
  function render() {
    card.classList.toggle("is-loading", state.loading);
    if (state.view === "first" || state.view === "add") {
      card.innerHTML = formMarkup({
        title: state.view === "add" ? "添加账号" : "欢迎回来",
        lead: state.view === "add" ? "登录另一个账号，添加后可随时一键切换" : "登录后进入你的复盘空间",
        hint: state.view === "add"
          ? "添加后账号会保存在这台电脑，方便随时切换。"
          : "密码连续输错 5 次将锁定 10 分钟。还没有账号？切换到「注册」创建。",
        add: state.view === "add",
        back: state.view === "add",
      });
    } else {
      card.innerHTML = pickerMarkup();
    }
    bindCard();
    if (mascots) mascots.sync();
  }
  function bindCard() {
    card.querySelectorAll("[data-auth-mode]").forEach((button) => {
      button.addEventListener("click", () => {
        state.mode = button.dataset.authMode === "register" ? "register" : "login";
        setError("");
        render();
      });
    });
    card.querySelectorAll("[data-login-action]").forEach((button) => {
      button.addEventListener("click", () => {
        const action = button.dataset.loginAction;
        if (action === "toggle-password") {
          togglePasswordVisible();
          return;
        }
        if (action === "resume") {
          resumeCurrentAccount();
          return;
        }
        if (action === "picker") {
          state.view = state.accounts.length ? "picker" : "first";
          state.confirmingId = null;
        } else if (action === "add") {
          state.view = "add";
          state.mode = "login";
        } else if (action === "manage") {
          state.view = "manage";
        } else if (action === "cancel-forget") {
          state.confirmingId = null;
        }
        setError("");
        render();
      });
    });
    card.querySelectorAll("[data-switch-id]").forEach((button) => {
      button.addEventListener("click", () => switchAccount(Number(button.dataset.switchId)));
    });
    card.querySelectorAll("[data-resume-id]").forEach((button) => {
      button.addEventListener("click", () => resumeCurrentAccount());
    });
    card.querySelectorAll("[data-confirm-id]").forEach((button) => {
      button.addEventListener("click", (event) => {
        event.stopPropagation();
        state.confirmingId = Number(button.dataset.confirmId);
        render();
      });
    });
    card.querySelectorAll("[data-forget-id]").forEach((button) => {
      button.addEventListener("click", () => forgetAccount(Number(button.dataset.forgetId)));
    });
    const form = card.querySelector("#loginForm");
    if (form) form.addEventListener("submit", submitCredentials);
  }
  async function loadAccounts() {
    const payload = await api.request("/api/auth/accounts");
    state.accounts = payload.accounts || [];
    state.currentUserId = payload.current_user_id ?? null;
    const params = new URLSearchParams(global.location.search);
    if (params.get("mode") === "register") state.mode = "register";
    if (params.get("notice")) setError(params.get("notice"));
    if (state.accounts.length) state.view = "picker";
    else state.view = "first";
  }
  async function submitCredentials(event) {
    event.preventDefault();
    const username = document.querySelector("#loginUsername").value.trim();
    const password = document.querySelector("#loginPassword").value;
    state.username = username;
    state.password = password;
    if (state.mode === "register" && password !== document.querySelector("#loginPasswordConfirm").value) {
      setError("两次输入的密码不一致。");
      render();
      return;
    }
    state.loading = true;
    setError("");
    render();
    try {
      await api.request(`/api/auth/${state.mode}`, "POST", { username, password });
      await celebrateLogin();
      enterApp();
    } catch (error) {
      state.loading = false;
      setError(error.message || "账号操作失败");
      render();
      mascots.fail();
    }
  }
  async function switchAccount(userId) {
    state.loading = true;
    setError("");
    render();
    try {
      await api.request("/api/auth/switch", "POST", { user_id: userId });
      enterApp();
    } catch (error) {
      state.loading = false;
      setError(error.message || "该账号需重新验证");
      render();
    }
  }
  async function resumeCurrentAccount() {
    state.loading = true;
    setError("");
    render();
    try {
      const session = await api.request("/api/auth/me");
      const sessionUserId = session.user?.id;
      const matches = Boolean(session.authenticated) && (
        !state.currentUserId || Number(sessionUserId) === Number(state.currentUserId)
      );
      if (!matches) {
        throw new Error("当前会话已失效，请重新登录");
      }
      enterApp();
    } catch (error) {
      state.loading = false;
      setError(error.message || "当前会话已失效，请重新登录");
      render();
    }
  }
  async function forgetAccount(userId) {
    try {
      await api.request("/api/auth/forget", "POST", { user_id: userId });
      state.accounts = state.accounts.filter((item) => Number(item.user_id) !== Number(userId));
      state.confirmingId = null;
      if (!state.accounts.length) state.view = "first";
      setError("");
      render();
    } catch (error) {
      setError(error.message || "移除失败");
      render();
    }
  }
  function togglePasswordVisible() {
    state.passwordVisible = !state.passwordVisible;
    const input = document.querySelector("#loginPassword");
    const button = document.querySelector(".login-password-toggle");
    if (input) {
      input.type = state.passwordVisible ? "text" : "password";
      input.focus();
    }
    if (button) {
      button.textContent = state.passwordVisible ? "隐藏" : "显示";
      button.setAttribute("aria-pressed", state.passwordVisible ? "true" : "false");
      button.setAttribute("aria-label", state.passwordVisible ? "隐藏密码" : "显示密码");
    }
    mascots.sync();
  }
  function reducedMotion() {
    return Boolean(global.matchMedia && global.matchMedia("(prefers-reduced-motion: reduce)").matches);
  }
  function finePointer() {
    return Boolean(global.matchMedia && global.matchMedia("(pointer: fine)").matches);
  }
  function wait(ms) {
    return new Promise((resolve) => global.setTimeout(resolve, ms));
  }
  async function celebrateLogin() {
    mascots.succeed();
    if (!reducedMotion()) await wait(720);
  }
  const mascots = (() => {
    const root = document.querySelector("#loginMascots");
    const red = root && root.querySelector(".login-mascot.is-red");
    const green = root && root.querySelector(".login-mascot.is-green");
    const motion = {
      pupilX: 0,
      pupilY: 0,
      targetX: 0,
      targetY: 0,
      leanRed: 0,
      leanGreen: 0,
      targetLeanRed: 0,
      targetLeanGreen: 0,
    };
    let mood = "idle";
    let locked = "";
    let blinkTimer = 0;
    let failTimer = 0;
    let raf = 0;
    function setVars() {
      if (!red || !green) return;
      const pupilX = `${motion.pupilX.toFixed(2)}px`;
      const pupilY = `${motion.pupilY.toFixed(2)}px`;
      red.style.setProperty("--pupil-x", pupilX);
      red.style.setProperty("--pupil-y", pupilY);
      green.style.setProperty("--pupil-x", pupilX);
      green.style.setProperty("--pupil-y", pupilY);
      red.style.setProperty("--lean", `${motion.leanRed.toFixed(2)}deg`);
      green.style.setProperty("--lean", `${motion.leanGreen.toFixed(2)}deg`);
    }
    function poseFor(next) {
      if (next === "account" || next === "busy") {
        motion.targetX = 3.2;
        motion.targetY = 0.8;
        motion.targetLeanRed = 7;
        motion.targetLeanGreen = 5.6;
        return;
      }
      if (next === "password") {
        motion.targetX = 0;
        motion.targetY = 0;
        motion.targetLeanRed = 0;
        motion.targetLeanGreen = 0;
        return;
      }
      if (next === "fail") {
        motion.targetX = 0;
        motion.targetY = 2.8;
        motion.targetLeanRed = 8;
        motion.targetLeanGreen = 8;
        return;
      }
      if (next === "success") {
        motion.targetX = 0;
        motion.targetY = 0;
        motion.targetLeanRed = 0;
        motion.targetLeanGreen = 0;
        return;
      }
      if (!finePointer()) {
        motion.targetX = 2.4;
        motion.targetY = 0.4;
        motion.targetLeanRed = 4;
        motion.targetLeanGreen = 3.2;
        return;
      }
      motion.targetLeanRed = 0;
      motion.targetLeanGreen = 0;
    }
    function applyMood(next) {
      if (!root) return;
      const changed = next !== mood;
      if (changed) {
        mood = next;
        root.dataset.mood = next;
        poseFor(next);
      } else if (next !== "idle") {
        poseFor(next);
      }
      if (reducedMotion()) {
        motion.pupilX = motion.targetX;
        motion.pupilY = motion.targetY;
        motion.leanRed = motion.targetLeanRed;
        motion.leanGreen = motion.targetLeanGreen;
        setVars();
      }
    }
    function focusedControl() {
      const active = document.activeElement;
      if (!active || !card.contains(active)) return "";
      if (active.classList.contains("login-password-toggle")) return "loginPassword";
      return active.id || "";
    }
    function desiredMood() {
      if (locked === "success") return "success";
      if (state.loading) return "busy";
      const focused = focusedControl();
      if (focused === "loginPassword" || focused === "loginPasswordConfirm") return "password";
      if (focused === "loginUsername") return "account";
      if (locked === "fail") return "fail";
      return "idle";
    }
    function sync() {
      applyMood(desiredMood());
    }
    function succeed() {
      locked = "success";
      applyMood("success");
    }
    function fail() {
      locked = "fail";
      applyMood("fail");
      global.clearTimeout(failTimer);
      failTimer = global.setTimeout(() => {
        if (locked === "fail") locked = "";
        sync();
      }, 900);
    }
    function blink() {
      if (!root || reducedMotion()) return;
      if (mood !== "idle" && mood !== "account" && mood !== "busy") return;
      root.classList.remove("is-blinking");
      void root.offsetWidth;
      root.classList.add("is-blinking");
      global.setTimeout(() => root.classList.remove("is-blinking"), 160);
    }
    function scheduleBlink() {
      global.clearTimeout(blinkTimer);
      if (reducedMotion()) return;
      const waitMs = 4000 + Math.random() * 2000;
      blinkTimer = global.setTimeout(() => {
        blink();
        scheduleBlink();
      }, waitMs);
    }
    function onMouseMove(event) {
      if (reducedMotion() || !finePointer()) return;
      if (desiredMood() !== "idle") return;
      const rect = root.getBoundingClientRect();
      const cx = rect.left + rect.width * 0.42;
      const cy = rect.top + rect.height * 0.42;
      const dx = event.clientX - cx;
      const dy = event.clientY - cy;
      const dist = Math.hypot(dx, dy) || 1;
      const cap = 3.5;
      motion.targetX = (dx / dist) * Math.min(cap, Math.abs(dx) / 90);
      motion.targetY = (dy / dist) * Math.min(cap, Math.abs(dy) / 90);
      const tilt = Math.max(-5, Math.min(5, (dx / Math.max(global.innerWidth, 1)) * 10));
      motion.targetLeanRed = tilt;
      motion.targetLeanGreen = tilt * 0.8;
    }
    function tick() {
      if (!root) return;
      if (!reducedMotion()) {
        motion.pupilX += (motion.targetX - motion.pupilX) * 0.18;
        motion.pupilY += (motion.targetY - motion.pupilY) * 0.18;
        motion.leanRed += (motion.targetLeanRed - motion.leanRed) * 0.18;
        motion.leanGreen += (motion.targetLeanGreen - motion.leanGreen) * 0.18;
        setVars();
      } else {
        motion.pupilX = motion.targetX;
        motion.pupilY = motion.targetY;
        motion.leanRed = motion.targetLeanRed;
        motion.leanGreen = motion.targetLeanGreen;
        setVars();
      }
      raf = global.requestAnimationFrame(tick);
    }
    function onFocusChange() {
      global.requestAnimationFrame(sync);
    }
    if (root) {
      document.addEventListener("focusin", onFocusChange);
      document.addEventListener("focusout", onFocusChange);
      global.addEventListener("mousemove", onMouseMove, { passive: true });
      if (!reducedMotion()) {
        raf = global.requestAnimationFrame(tick);
        scheduleBlink();
      } else {
        poseFor("idle");
        setVars();
      }
      sync();
    }
    return { sync, succeed, fail };
  })();
  themeButton.addEventListener("click", () => {
    applyTheme(document.documentElement.dataset.theme === "dark" ? "light" : "dark", true);
  });
  applyTheme(preferredTheme(), false);
  loadAccounts()
    .then(render)
    .catch((error) => {
      setError(error.message || "无法连接本地服务");
      state.view = "first";
      render();
    });
 })(window);
@@ -3174,3 +3174,458 @@
  border-top: 1px solid var(--border);
  transform: translateY(calc(-1 * var(--m-keyboard-inset, 0px)));
 }
 .m-sys-lead {
  margin: 8px 0 12px;
  font-size: var(--font-size-label);
  color: var(--text-secondary);
  line-height: 1.5;
 }
 .m-sys-grid {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 8px;
  margin: 0 0 12px;
 }
 .m-sys-grid div {
  padding: 12px;
  border-radius: 8px;
  background: var(--surface-muted);
 }
 .m-sys-grid span {
  display: block;
  font-size: var(--font-size-label);
  color: var(--text-tertiary);
 }
 .m-sys-grid strong {
  display: block;
  margin-top: 4px;
  font-size: var(--font-size-body);
  color: var(--text-primary);
 }
 .m-sys-home {
  padding: 0 0 12px;
  display: flex;
  flex-direction: column;
  gap: 8px;
 }
 .m-sys-body {
  padding: 12px 12px 20px;
  display: flex;
  flex-direction: column;
  gap: 12px;
 }
 .m-sys-home .m-card,
 .m-sys-body .m-card {
  margin-left: 0;
  margin-right: 0;
 }
 .m-sys-profile-card {
  display: flex;
  gap: 12px;
  align-items: flex-start;
  padding: 14px;
 }
 .m-sys-avatar {
  flex: 0 0 auto;
  width: 48px;
  height: 48px;
  border-radius: 50%;
  display: flex;
  align-items: center;
  justify-content: center;
  background: var(--action-soft);
  color: var(--action);
  font-size: var(--font-size-page-title);
  font-weight: 600;
 }
 .m-sys-profile-card strong {
  display: block;
  font-size: var(--font-size-card-title);
  color: var(--text-primary);
 }
 .m-sys-profile-meta {
  margin: 4px 0 8px;
  font-size: var(--font-size-caption);
  color: var(--text-secondary);
 }
 .m-sys-badges {
  display: flex;
  flex-wrap: wrap;
  gap: 6px;
 }
 .m-sys-badge {
  display: inline-flex;
  align-items: center;
  height: 22px;
  padding: 0 8px;
  border-radius: 999px;
  font-size: var(--font-size-aux);
  font-weight: 600;
  background: var(--surface-muted);
  color: var(--text-secondary);
 }
 .m-sys-badge--admin {
  background: var(--action-soft);
  color: var(--action);
 }
 .m-sys-badge--ok {
  background: var(--market-down-soft);
  color: var(--market-down);
 }
 .m-sys-group-title {
  margin: 4px 0 0;
  font-size: var(--font-size-caption);
  font-weight: 600;
  color: var(--text-tertiary);
 }
 .m-sys-list {
  padding: 0;
  overflow: hidden;
 }
 .m-sys-row {
  width: 100%;
  display: flex;
  align-items: center;
  gap: 12px;
  padding: 10px 12px;
  border: 0;
  background: transparent;
  color: inherit;
  text-align: left;
  cursor: pointer;
  -webkit-tap-highlight-color: transparent;
 }
 .m-sys-row + .m-sys-row {
  border-top: 1px solid var(--border);
 }
 .m-sys-row:active {
  background: var(--surface-hover);
 }
 .m-sys-row-icon {
  flex: 0 0 auto;
  width: 36px;
  height: 36px;
  border-radius: 10px;
  display: inline-flex;
  align-items: center;
  justify-content: center;
  background: var(--action-soft);
  color: var(--action);
 }
 .m-sys-row--danger .m-sys-row-icon {
  background: var(--market-up-soft);
  color: var(--market-up);
 }
 .m-sys-row-body {
  flex: 1;
  min-width: 0;
 }
 .m-sys-row-body strong {
  display: block;
  font-size: var(--font-size-body);
  font-weight: 600;
  color: var(--text-primary);
 }
 .m-sys-row-body small {
  display: block;
  margin-top: 2px;
  font-size: var(--font-size-caption);
  color: var(--text-secondary);
 }
 .m-sys-row-chevron {
  flex: 0 0 auto;
  color: var(--text-tertiary);
 }
 .m-sys-foot {
  margin: 8px 0 0;
  text-align: center;
  font-size: var(--font-size-caption);
  color: var(--text-tertiary);
 }
 .m-sys-notice {
  padding: 12px;
  border-radius: 12px;
  background: var(--surface-muted);
 }
 .m-sys-notice p {
  margin: 0;
  font-size: var(--font-size-label);
  color: var(--text-secondary);
  line-height: 1.55;
 }
 .m-sys-notice .m-sys-badges {
  margin-top: 8px;
 }
 .m-sys-section {
  padding: 12px;
 }
 .m-sys-section > strong,
 .m-sys-section-title {
  display: block;
  margin-bottom: 10px;
  font-size: var(--font-size-card-title);
  color: var(--text-primary);
 }
 .m-sys-hint {
  margin: 8px 0 0;
  font-size: var(--font-size-caption);
  color: var(--text-tertiary);
  line-height: 1.45;
 }
 .m-sys-status-list {
  display: grid;
  gap: 8px;
 }
 .m-sys-status-item {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 8px;
  font-size: var(--font-size-body);
  color: var(--text-primary);
 }
 .m-sys-dot {
  width: 8px;
  height: 8px;
  border-radius: 50%;
  background: var(--text-tertiary);
 }
 .m-sys-dot--ok {
  background: var(--market-down);
 }
 .m-sys-switch-row {
  display: flex;
  align-items: center;
  justify-content: space-between;
  gap: 12px;
 }
 .m-sys-switch-row strong {
  display: block;
  font-size: var(--font-size-body);
  margin-bottom: 0;
 }
 .m-btn-outline,
 .m-btn-outline-danger {
  width: 100%;
  height: 44px;
  display: flex;
  align-items: center;
  justify-content: center;
  gap: 8px;
  border-radius: 8px;
  background: var(--surface);
  font-size: var(--font-size-body);
  font-weight: 600;
  cursor: pointer;
  -webkit-tap-highlight-color: transparent;
 }
 .m-btn-outline {
  border: 1px solid var(--action);
  color: var(--action);
 }
 .m-btn-outline:active {
  background: var(--action-soft);
 }
 .m-btn-outline-danger {
  border: 1px solid var(--market-up);
  color: var(--market-up);
 }
 .m-btn-outline-danger:active {
  background: var(--market-up-soft);
 }
 .m-btn-outline:disabled,
 .m-btn-outline-danger:disabled {
  opacity: 0.45;
  cursor: default;
  pointer-events: none;
 }
 .m-sys-model-card .m-sys-badges,
 .m-sys-user-row .m-sys-badges {
  margin-top: 6px;
 }
 .m-sys-model-card {
  display: flex;
  align-items: flex-start;
  justify-content: space-between;
  gap: 8px;
  width: 100%;
  padding: 12px;
  border: 0;
  background: transparent;
  text-align: left;
  cursor: pointer;
 }
 .m-sys-model-card + .m-sys-model-card {
  border-top: 1px solid var(--border);
 }
 .m-sys-model-card:active {
  background: var(--surface-hover);
 }
 .m-sys-user-row {
  display: flex;
  align-items: center;
  gap: 10px;
  padding: 12px;
 }
 .m-sys-user-row + .m-sys-user-row {
  border-top: 1px solid var(--border);
 }
 .m-sys-user-row .m-btn-outline {
  width: auto;
  height: 32px;
  padding: 0 12px;
  flex: 0 0 auto;
 }
 .m-sys-pair {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 8px;
 }
 .m-sheet-root.is-dialog .m-sheet {
  display: none;
 }
 .m-dialog {
  position: absolute;
  left: 50%;
  top: 42%;
  width: calc(100% - 48px);
  max-width: 320px;
  transform: translate(-50%, -46%) scale(0.96);
  border-radius: 12px;
  background: var(--surface);
  box-shadow: var(--elevation-float);
  padding: 18px 16px 14px;
  z-index: 3;
  opacity: 0;
  transition: opacity var(--motion-enter) var(--ease-enter),
              transform var(--motion-enter) var(--ease-enter);
 }
 .m-sheet-root.is-open .m-dialog {
  opacity: 1;
  transform: translate(-50%, -50%) scale(1);
 }
 .m-dialog h2 {
  margin: 0 0 8px;
  font-size: var(--font-size-card-title);
  color: var(--text-primary);
  text-align: center;
 }
 .m-dialog p {
  margin: 0 0 16px;
  font-size: var(--font-size-label);
  color: var(--text-secondary);
  line-height: 1.5;
  text-align: center;
 }
 .m-dialog-actions {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 8px;
 }
 .m-dialog-actions .m-btn-outline,
 .m-dialog-actions .m-btn-outline-danger,
 .m-dialog-actions .m-btn-primary {
  height: 40px;
 }
 .m-sys-sheet-actions {
  display: grid;
  grid-template-columns: 1fr 1fr;
  gap: 8px;
  margin-top: 12px;
 }
 .m-sys-test-row {
  display: flex;
  align-items: center;
  gap: 10px;
  margin: 8px 0 12px;
 }
 .m-sys-test-row .m-btn-outline {
  width: auto;
  flex: 0 0 auto;
  height: 36px;
  padding: 0 12px;
 }
 .m-sys-test-row [data-model-test-status] {
  flex: 1;
  font-size: var(--font-size-caption);
  color: var(--text-secondary);
 }
 .m-sys-hero {
  padding: 14px;
 }
 .m-sys-hero strong {
  display: block;
  font-size: var(--font-size-page-title);
  margin-bottom: 6px;
 }
 .m-page[data-page^="system/"] .m-card {
  margin-bottom: 0;
 }
@@ -246,6 +246,29 @@ body {
  padding-top: 8px;
 }
 .m-auth-accounts {
  display: grid;
  gap: 8px;
  margin-bottom: 16px;
 }
 .m-auth-account {
  display: flex;
  align-items: center;
  justify-content: space-between;
  min-height: 48px;
  padding: 0 14px;
  border: 1px solid var(--border);
  border-radius: 10px;
  background: var(--surface);
  color: var(--text-primary);
 }
 .m-auth-account span {
  color: var(--action);
  font-size: var(--font-size-label);
 }
 .m-auth-brand {
  text-align: center;
  margin: 24px 0 20px;
@@ -313,7 +336,8 @@ body {
  color: var(--text-secondary);
 }
-.m-form-field input {
+.m-form-field input,
 .m-form-field select {
  height: 44px;
  padding: 0 12px;
  border: 1px solid var(--border-strong);
@@ -323,11 +347,20 @@ body {
  font-size: 14px;
 }
-.m-form-field input:focus {
+.m-form-field input:focus,
 .m-form-field select:focus {
  outline: none;
  border-color: var(--action);
 }
 .m-form-field input[type="checkbox"] {
  width: 22px;
  height: 22px;
  padding: 0;
  border: none;
  background: transparent;
 }
 .m-auth-error {
  margin: 0 0 12px;
  padding: 10px 12px;
@@ -15,7 +15,9 @@
      (() => {
        let theme = "light";
        try {
-          theme = localStorage.getItem("xiaobaiTheme") === "dark" ? "dark" : "light";
+          const stored = localStorage.getItem("xiaobaiTheme");
          if (stored === "dark" || stored === "light") theme = stored;
          else if (window.matchMedia && window.matchMedia("(prefers-color-scheme: dark)").matches) theme = "dark";
        } catch (_error) {
          theme = "light";
        }
@@ -5,10 +5,15 @@
  function readTheme() {
    try {
-      return global.localStorage.getItem(THEME_KEY) === "dark" ? "dark" : "light";
+      const stored = global.localStorage.getItem(THEME_KEY);
      if (stored === "dark" || stored === "light") return stored;
    } catch (_error) {
      return "light";
    }
    if (global.matchMedia && global.matchMedia("(prefers-color-scheme: dark)").matches) {
      return "dark";
    }
    return "light";
  }
  function applyTheme(theme) {
@@ -187,9 +187,9 @@
    const dark = document.getElementById("m-app").dataset.theme === "dark";
    const toggle = document.querySelector("[data-theme-toggle]");
    if (toggle) toggle.setAttribute("aria-checked", dark ? "true" : "false");
-    const rowIcon = document.querySelector(".m-theme-row-icon");
+    const rowIcon = document.querySelector(".m-theme-row-icon, [data-theme-row-icon]");
    if (rowIcon) rowIcon.innerHTML = icon(dark ? "moon" : "sun");
-    const rowBodySmall = document.querySelector(".m-theme-row-body small");
+    const rowBodySmall = document.querySelector(".m-theme-row-body small, [data-theme-row-label]");
    if (rowBodySmall) rowBodySmall.textContent = dark ? "当前：夜间模式" : "当前：日间模式";
  }
@@ -206,6 +206,10 @@
      replace(DEFAULT_HASH);
      return;
    }
    if (key === "system" && global.MobilePages && typeof global.MobilePages.renderSystemHome === "function") {
      global.MobilePages.renderSystemHome();
      return;
    }
    const items = visibleHubItems(hub);
    updateHeader({ title: hub.title, back: false });
    const section = key === "system" ? themeToggleSection() : "";
@@ -250,6 +254,7 @@
      '<h2>小白复盘</h2>',
      '<p>登录后进入你的复盘空间</p>',
      "</div>",
      '<div class="m-auth-accounts" id="m-auth-accounts" hidden></div>',
      '<div class="m-auth-tabs">',
      '<button class="m-auth-tab active" type="button" data-auth-mode="login">登录</button>',
      '<button class="m-auth-tab" type="button" data-auth-mode="register">注册</button>',
@@ -265,6 +270,7 @@
    ].join("");
    authMode = "login";
    bindAuth();
    loadMobileAccounts();
  }
  function setAuthMode(mode) {
@@ -287,6 +293,34 @@
    document.getElementById("m-auth-form").addEventListener("submit", submitAuth);
  }
  async function loadMobileAccounts() {
    const host = document.getElementById("m-auth-accounts");
    if (!host || !global.MobileSession.listAccounts) return;
    try {
      const payload = await global.MobileSession.listAccounts();
      const accounts = payload.accounts || [];
      if (!accounts.length) return;
      host.hidden = false;
      host.innerHTML = accounts.map(function (account) {
        return '<button class="m-auth-account" type="button" data-switch-id="' + account.user_id + '">' +
          '<strong>' + escapeHtml(account.username) + '</strong>' +
          '<span>直接进入</span></button>';
      }).join("");
      host.querySelectorAll("[data-switch-id]").forEach(function (button) {
        button.addEventListener("click", async function () {
          try {
            await global.MobileSession.switchAccount(Number(button.dataset.switchId));
            replace(DEFAULT_HASH);
          } catch (error) {
            showAuthError(document.getElementById("m-auth-error"), error.message || "该账号需重新验证");
          }
        });
      });
    } catch (_error) {
      host.hidden = true;
    }
  }
  function showAuthError(element, message) {
    element.textContent = message;
    element.classList.remove("m-motion-fade-in");
@@ -47,5 +47,30 @@
    return Boolean(state.user && state.user.role === "admin");
  }
-  global.MobileSession = { state: state, me: me, login: login, register: register, logout: logout, isAdmin: isAdmin };
+  async function listAccounts() {
    return global.MobileAPI.request("/api/auth/accounts");
  }
  async function switchAccount(userId) {
    const payload = await global.MobileAPI.request("/api/auth/switch", "POST", {
      user_id: userId
    });
    return applySession(payload);
  }
  async function forgetAccount(userId) {
    await global.MobileAPI.request("/api/auth/forget", "POST", { user_id: userId });
  }
  global.MobileSession = {
    state: state,
    me: me,
    login: login,
    register: register,
    logout: logout,
    listAccounts: listAccounts,
    switchAccount: switchAccount,
    forgetAccount: forgetAccount,
    isAdmin: isAdmin
  };
 })(window);
@@ -95,7 +95,7 @@
    "/shared/table.js?v=20260803-1",
    "/shared/theme.js?v=20260803-1",
    "/shared/dashboard.js?v=20260820-1",
-    "/shared/session.js?v=20260803-1",
+    "/shared/session.js?v=20260829-hel243",
    "/shared/admin.js?v=20260803-1",
    "/app.js?v=20260803-2",
  ];
@@ -1011,9 +1011,9 @@
  border-radius: 6px;
-  background: var(--r2-ink);
+  background: var(--sentiment-tooltip-bg);
-  color: var(--text-inverse);
+  color: var(--sentiment-tooltip-fg);
  font-size: 11px;
@@ -1021,6 +1021,8 @@
 }
 .sentiment-chart-tooltip b {
  color: inherit;
  font-weight: 700;
 }
@@ -1568,10 +1570,6 @@
  #sentimentCycleView .sentiment-component-item {
    padding: 4px 0px;
  }
  #sentimentCycleView .sentiment-component-item small {
    display: none;
  }
 }
@media (min-width: 768px) {
@@ -1764,3 +1762,72 @@
    grid-template-columns: repeat(2, minmax(0, 1fr));
  }
 }
@media (min-width: 1024px) {
  #sentimentCycleView .redesigned-emotion-grid {
    align-items: stretch;
    height: var(--sentiment-analysis-height);
    max-height: var(--sentiment-analysis-height);
    overflow: hidden;
  }
  .redesigned-sentiment-view .sentiment-analysis-main,
  .redesigned-sentiment-view .sentiment-analysis-rail {
    align-self: stretch;
    height: 100%;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-trend-panel {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-chart-shell {
    flex: 1 1 auto;
    height: auto;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-chart-shell canvas {
    height: 100%;
  }
  .redesigned-sentiment-view .sentiment-cycle-summary {
    flex: 0 0 auto;
  }
  .redesigned-sentiment-view .sentiment-components-panel {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    min-height: 0px;
  }
  .redesigned-sentiment-view .sentiment-component-list {
    display: flex;
    flex: 1 1 auto;
    flex-direction: column;
    justify-content: space-evenly;
    min-height: 0px;
  }
 }
@@ -1,10 +1,39 @@
 let sentimentChartAnimationFrame = null;
 let sentimentChartResizeObserver = null;
 let sentimentChartLastSize = "";
 window.XiaobaiPageModules.register("sentiment", ["sentimentCycleView"], {
  bind: bindSentimentEvents,
  enter: ["loadSentiment"],
 });
 function sentimentChartSizeKey(target) {
  if (!target) return "";
  const rect = target.getBoundingClientRect();
  return `${Math.round(rect.width)}x${Math.round(rect.height)}x${window.devicePixelRatio || 1}`;
 }
 function observeSentimentTrendChart() {
  const shell = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
  if (!shell) return;
  if (!sentimentChartResizeObserver) {
    sentimentChartResizeObserver = new ResizeObserver(() => {
      if (sentimentChartAnimationFrame) return;
      if (state.activeView !== "sentimentCycleView") return;
      const rows = state.sentimentHistory?.rows;
      if (!rows?.length) return;
      const current = document.querySelector("#sentimentCycleView .sentiment-chart-shell");
      const nextKey = sentimentChartSizeKey(current);
      if (!nextKey || nextKey === sentimentChartLastSize) return;
      drawSentimentTrendChart(rows, 1);
    });
  } else {
    sentimentChartResizeObserver.disconnect();
  }
  sentimentChartLastSize = sentimentChartSizeKey(shell);
  sentimentChartResizeObserver.observe(shell);
 }
 async function loadSentimentHistory(force = false) {
  if (!state.dashboard || state.sentimentLoading) return;
  const key = `${elements.tradeDate.value}:${state.sentimentRange}`;
@@ -126,6 +155,7 @@ function animateSentimentTrendChart(rows) {
  if (sentimentChartAnimationFrame) cancelAnimationFrame(sentimentChartAnimationFrame);
  if (!motionEnabled()) {
    drawSentimentTrendChart(rows, 1);
    observeSentimentTrendChart();
    return;
  }
  const startedAt = performance.now();
@@ -135,7 +165,10 @@ function animateSentimentTrendChart(rows) {
    const progress = 1 - (1 - rawProgress) ** 3;
    drawSentimentTrendChart(rows, progress);
    if (rawProgress < 1) sentimentChartAnimationFrame = requestAnimationFrame(frame);
-    else sentimentChartAnimationFrame = null;
+    else {
      sentimentChartAnimationFrame = null;
      observeSentimentTrendChart();
    }
  };
  sentimentChartAnimationFrame = requestAnimationFrame(frame);
 }
@@ -144,9 +177,9 @@ function drawSentimentTrendChart(rows, progress = 1) {
  const canvas = document.querySelector("#sentimentTrendChart");
  if (!canvas || !rows.length || state.activeView !== "sentimentCycleView") return;
  const rect = canvas.getBoundingClientRect();
-  if (!rect.width) return;
+  if (rect.width < 8 || rect.height < 8) return;
-  const width = Math.max(320, rect.width);
+  const width = rect.width;
-  const height = Math.max(220, rect.height);
+  const height = rect.height;
  const ratio = window.devicePixelRatio || 1;
  canvas.width = Math.round(width * ratio);
  canvas.height = Math.round(height * ratio);
@@ -258,6 +291,7 @@ function drawSentimentTrendChart(rows, progress = 1) {
    const dateText = displayCompactDate(row.trade_date).slice(5);
    context.fillText(dateText, x(index), height - padding.bottom + 10);
  });
  sentimentChartLastSize = sentimentChartSizeKey(canvas.closest(".sentiment-chart-shell"));
 }
 function bindSentimentChartTooltip(rows) {
@@ -40,17 +40,71 @@ async function loadDashboard(force = false, background = false, showOverlay = tr
 async function startAdminRefresh() {
  const buttons = [document.querySelector("#syncButton"), document.querySelector("#adminRefreshButton")].filter(Boolean);
  buttons.forEach((button) => { button.disabled = true; });
  const requestedDate = elements.tradeDate.value;
  setAdminRefreshStatus("running", `正在刷新 ${requestedDate} 的行情，请稍候…`, "loader-circle");
  try {
-    const payload = await apiRequest("/api/admin/refresh", "POST", { trade_date: elements.tradeDate.value });
+    const payload = await apiRequest("/api/admin/refresh", "POST", { trade_date: requestedDate });
-    showToast(payload.message || "后台刷新已提交");
+    if (!payload.started || !payload.job_key) {
-    setStatus("后台刷新运行中，当前页面保持不变");
+      setAdminRefreshStatus("warning", "已有刷新任务正在运行，请稍后再试。", "clock-3");
      showToast(payload.message || "已有后台刷新任务正在运行");
      return;
    }
    setStatus(`正在刷新 ${requestedDate} 的行情`);
    const job = await waitForAdminRefresh(payload.job_key);
    if (job.status === "failed") {
      const reason = job.message || job.error_code || "数据源未返回结果";
      setAdminRefreshStatus("failure", `刷新失败：${reason}`, "circle-x");
      setStatus("后台刷新失败");
      showToast("后台刷新失败");
      return;
    }
    const query = new URLSearchParams({ trade_date: requestedDate });
    const dashboard = await apiRequest(`/api/dashboard?${query}`);
    applyDashboard(dashboard);
    const meta = dashboard.meta || {};
    const actualDate = String(meta.trade_date || "").slice(0, 10);
    const requestedCompact = requestedDate.replaceAll("-", "");
    const actualCompact = actualDate.replaceAll("-", "");
    const updated = formatTimestamp(meta.updated_at);
    if (actualCompact !== requestedCompact || meta.carried_forward) {
      const reason = meta.notice ? `；${meta.notice}` : "";
      setAdminRefreshStatus("warning", `刷新已完成，但没有获取到 ${requestedDate} 的最新行情；当前仍是 ${actualDate || "未知日期"}${reason}`, "triangle-alert");
      showToast("刷新完成，但未获取到所选日期的最新行情");
    } else if (meta.notice) {
      setAdminRefreshStatus("warning", `已刷新到 ${actualDate}（${updated}），但数据源提示：${meta.notice}`, "triangle-alert");
      showToast(`已刷新到 ${actualDate}，请留意数据源提示`);
    } else {
      setAdminRefreshStatus("success", `刷新成功：已获取 ${actualDate} 的最新行情，更新时间 ${updated}`, "circle-check");
      showToast(`刷新成功：已获取 ${actualDate} 的最新行情`);
    }
  } catch (error) {
-    showToast(error.message || "后台刷新启动失败");
+    const message = error.message || "后台刷新失败";
    setAdminRefreshStatus("failure", `刷新失败：${message}`, "circle-x");
    setStatus("后台刷新失败");
    showToast(message);
  } finally {
    buttons.forEach((button) => { button.disabled = false; });
  }
 }
 function setAdminRefreshStatus(tone, message, icon = "circle-dot") {
  const status = document.querySelector("#adminRefreshStatus");
  if (!status) return;
  status.dataset.tone = tone;
  status.innerHTML = `<i data-lucide="${icon}"></i><span>${escapeHtml(message)}</span>`;
  refreshIcons();
 }
 async function waitForAdminRefresh(jobKey) {
  for (let attempt = 0; attempt < 120; attempt += 1) {
    const payload = await apiRequest("/api/admin/settings");
    const job = (payload.data?.jobs || []).find((item) => item.idempotency_key === jobKey);
    if (job && ["success", "failed"].includes(job.status)) return job;
    await new Promise((resolve) => setTimeout(resolve, 1000));
  }
  throw new Error("刷新等待超时，请稍后重试");
 }
 function applyDashboard(payload, background = false) {
  state.dashboard = payload;
  const selectedDate = payload.meta.requested_date || payload.meta.trade_date;
@@ -53,12 +53,10 @@ async function applyAuthenticatedSession(session) {
 function showAuthGate(message = "") {
  state.user = null;
  state.csrfToken = "";
-  const gate = document.querySelector("#authGate");
+  const params = new URLSearchParams();
-  gate.hidden = false;
+  if (message) params.set("notice", message);
-  const errorElement = document.querySelector("#authError");
+  const query = params.toString();
-  errorElement.textContent = message;
+  window.location.replace("/login/" + (query ? `?${query}` : ""));
  errorElement.hidden = !message;
  document.querySelector("#authUsername").focus();
 }
 async function logoutAccount() {
@@ -197,16 +195,14 @@ async function changeAccountPassword(event) {
 }
 async function switchAccount() {
  const button = document.querySelector("#switchAccountMenuButton");
  button.disabled = true;
  toggleAccountDropdown(false);
-  try {
+  const params = new URLSearchParams();
-    await apiRequest("/api/auth/logout", "POST", {});
+  const next = `${window.location.pathname}${window.location.search}${window.location.hash}`;
-    window.location.reload();
+  if (next.startsWith("/") && !next.startsWith("//") && next !== "/login" && !next.startsWith("/login/") && !next.startsWith("/login?")) {
-  } catch (error) {
+    params.set("next", next);
    showToast(error.message || "切换账号失败");
    button.disabled = false;
  }
  const query = params.toString();
  window.location.assign("/login/" + (query ? `?${query}` : ""));
 }
@@ -146,6 +146,32 @@
  --shadow-float: var(--elevation-float);
  --duration-fast: 150ms;
  --duration-normal: 220ms;
  --login-brand-gradient: linear-gradient(165deg, #0c1e4a, #16307c, #2153cc);
  --login-brand-share: 34%;
  --login-brand-min: 420px;
  --login-brand-cap: 560px;
  --login-brand-wide-share: 29.2%;
  --login-brand-pad: 36px 40px 24px;
  --login-brand-mark-size: 44px;
  --login-brand-name-size: 16px;
  --login-hero-size: 28px;
  --login-card-width: 408px;
  --login-card-pad: 32px;
  --login-card-title-size: 22px;
  --login-account-row-min: 72px;
  --login-account-avatar: 40px;
  --login-submit-height: 40px;
  --login-stat-chip-bg: rgba(8, 12, 24, 0.48);
  --login-candle-up: #e07078;
  --login-candle-down: #3db88a;
  --login-trend-line: rgba(244, 247, 255, 0.88);
  --login-mascot-red: #e8605a;
  --login-mascot-red-shade: #c74a45;
  --login-mascot-green: #46be93;
  --login-mascot-green-shade: #37997a;
  --login-mascot-eye: #f7f9fc;
  --login-mascot-pupil: #1a2440;
  --login-mascot-height: clamp(150px, 15vw, 260px);
  --font-size-aux: 11.5px;
  --font-size-caption: 12.5px;
@@ -210,6 +236,9 @@
  --pool-table-max-height: calc(var(--content-height) - var(--topbar-height) - var(--page-pad-y) - var(--page-pad-y) - var(--card-gap));
  --sentiment-history-max-height: 510px;
  --sentiment-history-min-height: 220px;
  --sentiment-analysis-height: 600px;
  --sentiment-tooltip-bg: var(--text-primary);
  --sentiment-tooltip-fg: var(--text-inverse);
  --primary-share: 1.45fr;
  --secondary-share: .75fr;
  --mobile-nav-height: 64px;
@@ -505,10 +534,17 @@
  --chart-repair: #e2ad58;
  --chart-ma-10: #d39a45;
  --chart-ma-20: #9aa5af;
  --sentiment-tooltip-bg: #26293e;
  --sentiment-tooltip-fg: #e8eaed;
  --on-action: #101418;
  --warning-line: #6d5a38;
  --warning-line-strong: #66502d;
  --control-shadow: 0 1px 3px rgba(0, 0, 0, .3);
  --login-brand-gradient: linear-gradient(165deg, #080c18, #0e1730, #14224a);
  --login-stat-chip-bg: rgba(6, 8, 16, 0.58);
  --login-candle-up: #f06d73;
  --login-candle-down: #43bc8a;
  --login-trend-line: rgba(232, 236, 244, 0.9);
  --dialog-backdrop: var(--backdrop);
  --ladder-level-1: #2d2426;
  --ladder-level-2: #2b2822;
@@ -47,6 +47,72 @@ function session(role = "admin", subscribed = true) {
  };
 }
 function sentimentHistoryPayload(days = 20) {
  const phases = ["冰点", "修复", "发酵", "高潮", "分化", "退潮"];
  const rows = Array.from({ length: days }, (_, index) => {
    const score = 28 + ((index * 7) % 55);
    return {
      trade_date: `2026-08-${String(index + 1).padStart(2, "0")}`,
      score,
      label: "情绪观察",
      phase: phases[index % phases.length],
      direction: index % 2 ? "升温" : "降温",
      day_change: index % 2 ? 3.2 : -2.1,
      seal_rate: 71.5,
      limit_up_count: 40 + index,
      first_board_count: 18,
      second_board_count: 8,
      three_plus_count: 4,
      max_height: 5,
      broken_count: 12,
      limit_down_count: 3,
      previous_limit_count: 38,
      previous_positive_count: 22,
      previous_positive_rate: 57.9,
      average_previous_change: 1.2,
      normalization: "固定锚点",
      components: {
        breadth: { label: "市场宽度", score: 55.8, weight: 20, summary: "红盘家数回升" },
        limit: { label: "涨停连板", score: 79.6, weight: 25, summary: "连板生态改善" },
        profit: { label: "赚钱效应", score: 67.0, weight: 30, summary: "昨日反馈尚可" },
        ladder: { label: "涨幅结构", score: 81.5, weight: 15, summary: "高度仍在扩张" },
        amount: { label: "成交活跃度", score: 46.1, weight: 10, summary: "量能略低于均值" },
      },
    };
  });
  return { available_days: days, rows };
 }
 async function renderSentimentFixture(page, days = 20) {
  await page.evaluate((payload) => {
    state.sentimentHistory = payload;
    renderSentimentHistory();
  }, sentimentHistoryPayload(days));
  await page.locator('[data-view="sentimentCycleView"]').first().click();
  await page.waitForTimeout(900);
 }
 function readSentimentLayout() {
  const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
  const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
  const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
  const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
  const chart = document.querySelector(".sentiment-chart-shell").getBoundingClientRect();
  const detail = document.querySelector(".sentiment-detail-toolbar").getBoundingClientRect();
  const table = document.querySelector(".sentiment-history-frame").getBoundingClientRect();
  const small = document.querySelector(".sentiment-component-item small");
  return {
    topDelta: Math.abs(trend.top - summary.top),
    bottomDelta: Math.abs(trend.bottom - components.bottom),
    analysisHeight: analysis.height,
    chartHeight: chart.height,
    detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom) - 0.5,
    tableVisible: table.top < window.innerHeight && table.bottom > detail.bottom,
    smallVisible: small ? getComputedStyle(small).display !== "none" : false,
    overflowX: document.documentElement.scrollWidth > document.documentElement.clientWidth + 1,
  };
 }
 function waitForApplicationRuntime(page) {
  return expect(page.locator("body")).toHaveAttribute("data-runtime-ready", "true");
 }
@@ -721,6 +787,7 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  await expect(page.locator(".sentiment-stage-guide, [data-sentiment-stage]")).toHaveCount(0);
  await expect(page.locator("#sentimentPhaseAdvice")).toHaveText("情绪指标继续走弱。");
  const alignment = await page.evaluate(() => {
    const analysis = document.querySelector(".redesigned-emotion-grid").getBoundingClientRect();
    const components = document.querySelector(".sentiment-components-panel").getBoundingClientRect();
    const trend = document.querySelector(".sentiment-trend-panel").getBoundingClientRect();
    const summary = document.querySelector(".sentiment-cycle-summary").getBoundingClientRect();
@@ -732,6 +799,8 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    const statusStyle = getComputedStyle(document.querySelector(".sentiment-block .sentiment-text"));
    return {
      columnsAligned: Math.abs(trend.top - summary.top) < 1,
      bottomsAligned: Math.abs(trend.bottom - components.bottom) < 1,
      analysisHeight: analysis.height,
      railAligned: Math.abs(summary.x - components.x) < 1 && Math.abs(summary.width - components.width) < 1 && components.top > summary.bottom,
      detailAfterAnalysis: detail.top > Math.max(trend.bottom, components.bottom),
      chartHeight: chart.height,
@@ -743,6 +812,8 @@ test("collapsed overview and sentiment layout keep a single current reading", as
    };
  });
  expect(alignment.columnsAligned).toBe(true);
  expect(alignment.bottomsAligned).toBe(true);
  expect(Math.abs(alignment.analysisHeight - 600)).toBeLessThanOrEqual(1);
  expect(alignment.railAligned).toBe(true);
  expect(alignment.detailAfterAnalysis).toBe(true);
  expect(alignment.chartHeight).toBeGreaterThanOrEqual(340);
@@ -780,6 +851,68 @@ test("collapsed overview and sentiment layout keep a single current reading", as
  }
 });
 test("sentiment cycle keeps 600px equal-height layout across zoom viewports", async ({ page }, testInfo) => {
  const shotDir = testInfo.outputPath("hel-221-shots");
  await mockApplication(page, session("user", true));
  const viewports = [
    { name: "zoom-100", width: 2560, height: 1440 },
    { name: "zoom-110", width: 2327, height: 1309 },
    { name: "zoom-125", width: 2048, height: 1152 },
  ];
  for (const viewport of viewports) {
    await page.setViewportSize({ width: viewport.width, height: viewport.height });
    await page.goto("/index.html");
    await renderSentimentFixture(page, 20);
    const layout = await page.evaluate(readSentimentLayout);
    expect(layout.topDelta, viewport.name).toBeLessThanOrEqual(1);
    expect(layout.bottomDelta, viewport.name).toBeLessThanOrEqual(1);
    expect(Math.abs(layout.analysisHeight - 600), viewport.name).toBeLessThanOrEqual(1);
    expect(layout.chartHeight, viewport.name).toBeGreaterThanOrEqual(450);
    expect(layout.detailAfterAnalysis, viewport.name).toBe(true);
    expect(layout.tableVisible, viewport.name).toBe(true);
    expect(layout.smallVisible, viewport.name).toBe(true);
    expect(layout.overflowX, viewport.name).toBe(false);
    await page.screenshot({
      path: `${shotDir}/day-${viewport.name}.png`,
      fullPage: true,
    });
  }
  await page.setViewportSize({ width: 2560, height: 1440 });
  await page.locator("#themeToggle").click();
  await expect(page.locator("html")).toHaveAttribute("data-theme", "dark");
  await page.waitForTimeout(200);
  const nightLayout = await page.evaluate(readSentimentLayout);
  expect(nightLayout.topDelta).toBeLessThanOrEqual(1);
  expect(nightLayout.bottomDelta).toBeLessThanOrEqual(1);
  expect(Math.abs(nightLayout.analysisHeight - 600)).toBeLessThanOrEqual(1);
  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
  const tooltip = page.locator("#sentimentChartTooltip");
  await expect(tooltip).toBeVisible();
  await expect(tooltip).toContainText("温度");
  const tooltipStyle = await tooltip.evaluate((node) => {
    const style = getComputedStyle(node);
    const bold = getComputedStyle(node.querySelector("b") || node);
    return { background: style.backgroundColor, color: style.color, bold: bold.color };
  });
  expect(tooltipStyle.background).toBe("rgb(38, 41, 62)");
  expect(tooltipStyle.color).toBe("rgb(232, 234, 237)");
  expect(tooltipStyle.bold).toBe("rgb(232, 234, 237)");
  await page.screenshot({ path: `${shotDir}/night-zoom-100.png`, fullPage: true });
  await page.locator("#themeToggle").click();
  await expect(page.locator("html")).toHaveAttribute("data-theme", "light");
  await page.locator("#sentimentTrendChart").hover({ position: { x: 280, y: 120 } });
  await expect(tooltip).toBeVisible();
  const lightTooltip = await tooltip.evaluate((node) => {
    const style = getComputedStyle(node);
    return { background: style.backgroundColor, color: style.color };
  });
  expect(lightTooltip.background).toBe("rgb(31, 35, 41)");
  expect(lightTooltip.color).toBe("rgb(255, 255, 255)");
 });
 test("limit-up pool separates stock identity and restores the reason column", async ({ page }) => {
  await mockApplication(page, session("user", true));
  await page.goto("/index.html");
@@ -0,0 +1,556 @@
 const { test, expect } = require("@playwright/test");
 const fs = require("fs");
 const path = require("path");
 const SHOT_DIR = path.resolve(__dirname, "../../../verify-shots");
 fs.mkdirSync(SHOT_DIR, { recursive: true });
 function loginPayload(user) {
  return {
    ok: true,
    authenticated: true,
    csrf_token: "portal-csrf",
    user,
  };
 }
 async function mockLoginPortal(page, options = {}) {
  const accounts = options.accounts || [];
  let currentUserId = options.currentUserId ?? null;
  await page.route("**/api/**", async (route) => {
    const url = new URL(route.request().url());
    const method = route.request().method();
    if (url.pathname === "/api/auth/accounts") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({ ok: true, accounts, current_user_id: currentUserId }),
      });
      return;
    }
    if (url.pathname === "/api/auth/switch" && method === "POST") {
      const body = route.request().postDataJSON() || {};
      const account = accounts.find((item) => Number(item.user_id) === Number(body.user_id));
      if (!account || options.switchFails) {
        await route.fulfill({
          status: 401,
          contentType: "application/json",
          body: JSON.stringify({ error: "该账号需重新验证" }),
        });
        return;
      }
      currentUserId = account.user_id;
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify(loginPayload(account)),
      });
      return;
    }
    if (url.pathname === "/api/auth/forget" && method === "POST") {
      const body = route.request().postDataJSON() || {};
      const index = accounts.findIndex((item) => Number(item.user_id) === Number(body.user_id));
      if (index >= 0) accounts.splice(index, 1);
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({ ok: true }),
      });
      return;
    }
    if ((url.pathname === "/api/auth/login" || url.pathname === "/api/auth/register") && method === "POST") {
      if (options.loginDelay) await new Promise((resolve) => setTimeout(resolve, options.loginDelay));
      if (options.loginFails) {
        await route.fulfill({
          status: 401,
          contentType: "application/json",
          body: JSON.stringify({ error: "账号名或密码不正确，请重新输入。" }),
        });
        return;
      }
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify(loginPayload({
          id: 9,
          username: "new_user",
          role: "user",
          membership: { active: false, subscribed: false, is_admin: false },
        })),
      });
      return;
    }
    if (url.pathname === "/api/auth/me") {
      const current = accounts.find((item) => Number(item.user_id) === Number(currentUserId)) || null;
      const authenticated = Boolean(current) && !options.sessionExpired;
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({
          ok: true,
          authenticated,
          csrf_token: "portal-csrf",
          user: authenticated ? {
            id: current.user_id,
            username: current.username,
            role: current.role,
            membership: current.membership,
          } : null,
        }),
      });
      return;
    }
    if (url.pathname === "/api/dashboard") {
      await route.fulfill({
        status: 200,
        contentType: "application/json",
        body: JSON.stringify({
          ok: true,
          meta: {
            trade_date: "2026-07-22",
            requested_date: "2026-07-22",
            source: "tushare",
            realtime: false,
            cached: true,
            market_status: "closed",
            updated_at: "2026-07-22T15:00:00+08:00",
          },
          overview: {
            up_count: 2100,
            down_count: 2800,
            limit_up_count: 42,
            limit_down_count: 8,
            broken_count: 17,
            seal_rate: 71.2,
            amount_billion: 12600,
            sentiment_score: 48,
          },
          limits: [],
          broken: [],
          down_limits: [],
          yesterday_limits: [],
          limit_performance: [],
          ladders: [],
          sectors: [],
          sector_rotation: [],
        }),
      });
      return;
    }
    await route.fulfill({
      status: 200,
      contentType: "application/json",
      body: JSON.stringify({ ok: true }),
    });
  });
 }
 const SAVED_ACCOUNTS = [
  {
    user_id: 1,
    username: "alpha_user",
    role: "admin",
    membership: { active: true, subscribed: true, is_admin: true },
    last_used_at: "2026-08-29T01:00:00+00:00",
  },
  {
    user_id: 2,
    username: "beta_user",
    role: "user",
    membership: { active: false, subscribed: false, is_admin: false },
    last_used_at: "2026-08-28T01:00:00+00:00",
  },
 ];
 test("first-time login portal asks for a password and hides environment copy", async ({ page }) => {
  await mockLoginPortal(page, { accounts: [] });
  await page.goto("/login/");
  await expect(page.locator(".login-card-title")).toHaveText("欢迎回来");
  await expect(page.locator("#loginUsername")).toBeVisible();
  await expect(page.locator(".login-submit")).toHaveText("登录");
  await expect(page.locator("body")).not.toContainText("内网个人版");
  await expect(page.locator("body")).not.toContainText("192.168.200.11");
 });
 test("saved accounts can switch directly and show a re-auth message on failure", async ({ page }) => {
  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
  await page.goto("/login/");
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
  await expect(page.locator(".login-account-row")).toHaveCount(2);
  const switched = page.waitForRequest((request) => (
    request.url().includes("/api/auth/switch") && request.method() === "POST"
  ));
  await page.locator('[data-switch-id="2"]').click();
  const request = await switched;
  expect(JSON.parse(request.postData() || "{}")).toEqual({ user_id: 2 });
 });
 test("failed account switch stays on the portal with the original copy", async ({ page }) => {
  await mockLoginPortal(page, {
    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
    switchFails: true,
  });
  await page.goto("/login/");
  await page.locator('[data-switch-id="2"]').click();
  await expect(page.locator(".login-error")).toHaveText("该账号需重新验证");
  await expect(page).toHaveURL(/\/login\/?/);
 });
 test("managing accounts removes a local record after inline confirmation", async ({ page }) => {
  await mockLoginPortal(page, { accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })) });
  await page.goto("/login/");
  await page.locator('[data-login-action="manage"]').click();
  await expect(page.locator(".login-card-title")).toHaveText("管理账号记录");
  await page.locator('[data-confirm-id="2"]').click();
  await expect(page.locator(".login-confirm-copy")).toContainText("beta_user");
  await page.locator('[data-forget-id="2"]').click();
  await expect(page.locator(".login-account-row")).toHaveCount(1);
  await expect(page.locator(".login-account-row")).toContainText("alpha_user");
 });
 async function assertConfirmedSkeleton(page, { width, height }) {
  await expect(page.locator(".login-brand-title")).toHaveText("看懂情绪周期，把复盘变成下一次的先手。");
  await expect(page.locator(".login-brand-header")).toBeVisible();
  await expect(page.locator(".login-brand-chart")).toBeVisible();
  await expect(page.locator(".login-brand-stats")).toBeVisible();
  await expect(page.locator(".login-brand-kicker")).toHaveText("收盘之后 · 复盘开始");
  const brand = await page.locator(".login-brand").boundingBox();
  const header = await page.locator(".login-brand-header").boundingBox();
  const mark = await page.locator(".login-brand-mark").boundingBox();
  const name = await page.locator(".login-brand-name").boundingBox();
  const title = await page.locator(".login-brand-title").boundingBox();
  const stats = await page.locator(".login-brand-stats").boundingBox();
  const chart = await page.locator(".login-brand-chart").boundingBox();
  const card = await page.locator(".login-card").boundingBox();
  expect(brand).toBeTruthy();
  expect(header.y - brand.y).toBeLessThan(48);
  expect(Math.abs(mark.y - name.y)).toBeLessThan(16);
  expect(title.y).toBeGreaterThan(height * 0.28);
  expect(title.y).toBeLessThan(height * 0.72);
  expect(stats.y).toBeGreaterThan(height * 0.55);
  expect(chart.height).toBeGreaterThan(80);
  await expect(page.locator("#loginMascots")).toBeVisible();
  expect(card.width).toBeGreaterThan(380);
  expect(card.width).toBeLessThan(450);
  if (width === 1440) {
    expect(brand.width).toBeGreaterThan(470);
    expect(brand.width).toBeLessThan(520);
    expect(brand.height).toBe(height);
    const mascots = await page.locator("#loginMascots").boundingBox();
    const kicker = await page.locator(".login-brand-kicker").boundingBox();
    expect(mascots).toBeTruthy();
    expect(kicker).toBeTruthy();
    expect(mascots.y).toBeGreaterThan(header.y + header.height - 4);
    expect(mascots.y + mascots.height).toBeLessThan(kicker.y + 8);
    const gapTop = header.y + header.height;
    const gapBottom = kicker.y;
    const mid = (gapTop + gapBottom) / 2;
    const mascotMid = mascots.y + mascots.height / 2;
    expect(Math.abs(mascotMid - mid)).toBeLessThan(48);
    expect(title.y).toBeGreaterThan(470);
    expect(title.y).toBeLessThan(580);
  } else if (width === 1920) {
    expect(brand.width).toBeGreaterThan(540);
    expect(brand.width).toBeLessThan(580);
  } else {
    expect(brand.width).toBeGreaterThan(560);
  }
 }
 async function openPortal(page, { theme, width, height, accounts, currentUserId, loginFails, loginDelay }) {
  await page.addInitScript((nextTheme) => {
    localStorage.setItem("xiaobaiTheme", nextTheme);
  }, theme);
  await page.setViewportSize({ width, height });
  await mockLoginPortal(page, { accounts, currentUserId, loginFails, loginDelay });
  await page.goto("/login/");
 }
 for (const theme of ["light", "dark"]) {
  for (const [width, height] of [[1440, 900], [1920, 1080]]) {
    test(`confirmed skeleton ${theme} ${width}x${height}`, async ({ page }) => {
      await openPortal(page, { theme, width, height, accounts: [] });
      await assertConfirmedSkeleton(page, { width, height });
      await expect(page.locator("#loginThemeToggle")).toHaveText(theme === "dark" ? "☀ 日间" : "🌙 夜间");
      await page.screenshot({ path: path.join(SHOT_DIR, `first-${theme}-${width}.png`), fullPage: true });
    });
  }
 }
 test("ultrawide keeps the left brand from collapsing into a strip", async ({ page }) => {
  await openPortal(page, { theme: "dark", width: 2560, height: 1080, accounts: [] });
  await assertConfirmedSkeleton(page, { width: 2560, height: 1080 });
 });
 test("picker add remove error and loading share the same desktop skeleton", async ({ page }) => {
  const accounts = SAVED_ACCOUNTS.map((item) => ({ ...item }));
  await openPortal(page, {
    theme: "dark",
    width: 1440,
    height: 900,
    accounts,
    currentUserId: 1,
  });
  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
  await expect(page.locator(".login-avatar")).toHaveCount(2);
  await expect(page.locator(".login-add")).toBeVisible();
  await page.screenshot({ path: path.join(SHOT_DIR, "picker-dark-1440.png"), fullPage: true });
  await page.locator('[data-login-action="add"]').click();
  await expect(page.locator(".login-card-title")).toHaveText("添加账号");
  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
  await page.screenshot({ path: path.join(SHOT_DIR, "add-dark-1440.png"), fullPage: true });
  await page.locator('[data-login-action="picker"]').click();
  await page.locator('[data-login-action="manage"]').click();
  await expect(page.locator(".login-card-title")).toHaveText("管理账号记录");
  await page.locator('[data-confirm-id="2"]').click();
  await expect(page.locator(".login-confirm-copy")).toContainText("beta_user");
  await page.screenshot({ path: path.join(SHOT_DIR, "remove-dark-1440.png"), fullPage: true });
 });
 test("login failure and loading keep the confirmed first-login skeleton", async ({ page }) => {
  await openPortal(page, {
    theme: "light",
    width: 1440,
    height: 900,
    accounts: [],
    loginFails: true,
  });
  await page.locator("#loginUsername").fill("baiqizhi");
  await page.locator("#loginPassword").fill("wrong-password");
  await page.locator(".login-submit").click();
  await expect(page.locator(".login-error")).toContainText("账号名或密码不正确");
  await expect(page.locator("#loginPassword")).toHaveClass(/is-invalid/);
  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
  await page.screenshot({ path: path.join(SHOT_DIR, "error-light-1440.png"), fullPage: true });
 });
 test("loading button appears on the confirmed first-login skeleton", async ({ page }) => {
  await openPortal(page, {
    theme: "dark",
    width: 1440,
    height: 900,
    accounts: [],
    loginDelay: 2500,
  });
  await page.evaluate(() => {
    window.location.replace = () => {};
  });
  await page.locator("#loginUsername").fill("baiqizhi");
  await page.locator("#loginPassword").fill("password12");
  const submit = page.locator(".login-submit").click();
  await expect(page.locator(".login-submit")).toContainText("正在登录...");
  await expect(page.locator(".login-spinner")).toBeVisible();
  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
  await page.screenshot({ path: path.join(SHOT_DIR, "loading-dark-1440.png"), fullPage: true });
  await submit;
 });
 async function openPicker(page, options = {}) {
  const accounts = options.accounts || SAVED_ACCOUNTS.map((item) => ({ ...item }));
  const currentUserId = options.currentUserId ?? 1;
  const next = options.next || "/index.html?view=sentimentCycleView";
  await page.unroute("**/api/**").catch(() => {});
  await mockLoginPortal(page, {
    accounts,
    currentUserId,
    sessionExpired: options.sessionExpired,
    switchFails: options.switchFails,
  });
  await page.goto(`/login/?next=${encodeURIComponent(next)}`);
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
 }
 test("clicking the current account from two workspace pages returns without switching", async ({ page }) => {
  const views = ["sentimentCycleView", "ladderView"];
  for (const viewId of views) {
    const next = `/index.html?view=${viewId}`;
    const switchCalls = [];
    const onRequest = (request) => {
      if (request.url().includes("/api/auth/switch") && request.method() === "POST") {
        switchCalls.push(request);
      }
    };
    page.on("request", onRequest);
    await openPicker(page, { next });
    await expect(page.locator('[data-resume-id="1"]')).toContainText("继续使用");
    await expect(page.locator('[data-resume-id="1"]')).toContainText("当前");
    await page.locator('[data-resume-id="1"]').click();
    await expect(page).toHaveURL(new RegExp(`[?&]view=${viewId}\\b`));
    expect(switchCalls).toEqual([]);
    page.off("request", onRequest);
  }
 });
 test("a lone current account can return from the picker instead of dead-ending", async ({ page }) => {
  await openPicker(page, {
    accounts: [SAVED_ACCOUNTS[0]],
    currentUserId: 1,
    next: "/index.html?view=reviewWorkspaceView",
  });
  await expect(page.locator(".login-account-row")).toHaveCount(1);
  await expect(page.locator('[data-switch-id]')).toHaveCount(0);
  await page.locator('[data-resume-id="1"]').click();
  await expect(page).toHaveURL(/view=reviewWorkspaceView/);
 });
 test("the return control also restores the originating workspace page", async ({ page }) => {
  await openPicker(page, { next: "/index.html?view=ladderView" });
  await page.locator('[data-login-action="resume"]').click();
  await expect(page).toHaveURL(/view=ladderView/);
 });
 test("refreshing the picker still returns to the originating page", async ({ page }) => {
  await openPicker(page, { next: "/index.html?view=sentimentCycleView" });
  await page.reload();
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
  await page.locator('[data-resume-id="1"]').click();
  await expect(page).toHaveURL(/view=sentimentCycleView/);
 });
 test("an expired current session asks for login instead of pretending to return", async ({ page }) => {
  await openPicker(page, {
    next: "/index.html?view=sentimentCycleView",
    sessionExpired: true,
  });
  await page.locator('[data-resume-id="1"]').click();
  await expect(page.locator(".login-error")).toHaveText("当前会话已失效，请重新登录");
  await expect(page).toHaveURL(/\/login\/?/);
 });
 test("other saved accounts still switch while the current row only resumes", async ({ page }) => {
  await openPicker(page, { next: "/index.html?view=auctionView" });
  const switched = page.waitForRequest((request) => (
    request.url().includes("/api/auth/switch") && request.method() === "POST"
  ));
  await page.locator('[data-switch-id="2"]').click();
  const request = await switched;
  expect(JSON.parse(request.postData() || "{}")).toEqual({ user_id: 2 });
 });
 test("workspace switch-account menu carries the current page back to the picker", async ({ page }) => {
  await mockLoginPortal(page, {
    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
    currentUserId: 1,
  });
  await page.goto("/index.html?view=sentimentCycleView");
  await expect(page.locator("#accountButton")).toBeVisible();
  await page.locator("#accountButton").click();
  await page.locator("#switchAccountMenuButton").click();
  await expect(page).toHaveURL(/\/login\/\?next=/);
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
  await page.locator('[data-resume-id="1"]').click();
  await expect(page).toHaveURL(/view=sentimentCycleView/);
 });
 test("workspace switch-account from a second page also returns to that page", async ({ page }) => {
  await mockLoginPortal(page, {
    accounts: SAVED_ACCOUNTS.map((item) => ({ ...item })),
    currentUserId: 1,
  });
  await page.goto("/index.html?view=ladderView");
  await expect(page.locator("#accountButton")).toBeVisible();
  await page.locator("#accountButton").click();
  await page.locator("#switchAccountMenuButton").click();
  await expect(page.locator(".login-card-title")).toHaveText("选择账号");
  await page.locator('[data-resume-id="1"]').click();
  await expect(page).toHaveURL(/view=ladderView/);
 });
 test("desktop mascots react to account focus, password, toggle, loading, success and failure", async ({ page }) => {
  await openPortal(page, { theme: "light", width: 1440, height: 900, accounts: [] });
  const mascots = page.locator("#loginMascots");
  await expect(mascots).toHaveAttribute("data-mood", "idle");
  await page.locator("#loginUsername").focus();
  await expect(mascots).toHaveAttribute("data-mood", "account");
  await page.locator("#loginPassword").focus();
  await expect(mascots).toHaveAttribute("data-mood", "password");
  await expect.poll(async () => (
    page.locator(".login-mascot.is-red .login-mascot-hand.is-left").evaluate((node) => getComputedStyle(node).opacity)
  )).toBe("1");
  await page.locator(".login-password-toggle").click();
  await expect(page.locator("#loginPassword")).toHaveAttribute("type", "text");
  await expect(mascots).toHaveAttribute("data-mood", "password");
  await page.locator(".login-password-toggle").click();
  await expect(page.locator("#loginPassword")).toHaveAttribute("type", "password");
  await expect(mascots).toHaveAttribute("data-mood", "password");
  await page.screenshot({ path: path.join(SHOT_DIR, "mascots-password-light-1440.png"), fullPage: true });
 });
 test("login loading and failure drive short mascot feedback", async ({ page }) => {
  await openPortal(page, {
    theme: "dark",
    width: 1440,
    height: 900,
    accounts: [],
    loginFails: true,
    loginDelay: 800,
  });
  await page.locator("#loginUsername").fill("baiqizhi");
  await page.locator("#loginPassword").fill("wrong-password");
  const submit = page.locator(".login-submit").click();
  await expect(page.locator("#loginMascots")).toHaveAttribute("data-mood", "busy");
  await expect(page.locator(".login-error")).toContainText("账号名或密码不正确");
  await expect(page.locator("#loginMascots")).toHaveAttribute("data-mood", "fail");
  await page.screenshot({ path: path.join(SHOT_DIR, "mascots-fail-dark-1440.png"), fullPage: true });
  await submit;
 });
 test("login success plays a hop before leaving the portal", async ({ page }) => {
  await openPortal(page, { theme: "light", width: 1440, height: 900, accounts: [] });
  await page.evaluate(() => {
    window.location.replace = () => {};
  });
  await page.locator("#loginUsername").fill("baiqizhi");
  await page.locator("#loginPassword").fill("password12");
  const submit = page.locator(".login-submit").click();
  await expect(page.locator("#loginMascots")).toHaveAttribute("data-mood", /busy|success/);
  await expect(page.locator("#loginMascots")).toHaveAttribute("data-mood", "success", { timeout: 4000 });
  await page.screenshot({ path: path.join(SHOT_DIR, "mascots-success-light-1440.png"), fullPage: true });
  await submit;
 });
 test("reduced motion keeps static mascots without mouse tracking", async ({ page }) => {
  await page.emulateMedia({ reducedMotion: "reduce" });
  await openPortal(page, { theme: "dark", width: 1440, height: 900, accounts: [] });
  const mascots = page.locator("#loginMascots");
  await expect(mascots).toBeVisible();
  await expect(mascots).toHaveAttribute("data-mood", "idle");
  const before = await mascots.evaluate((node) => getComputedStyle(node.querySelector(".login-mascot.is-red")).getPropertyValue("--pupil-x"));
  await page.mouse.move(1200, 120);
  await page.waitForTimeout(120);
  const after = await mascots.evaluate((node) => getComputedStyle(node.querySelector(".login-mascot.is-red")).getPropertyValue("--pupil-x"));
  expect(after).toBe(before);
  await page.locator("#loginPassword").focus();
  await expect(mascots).toHaveAttribute("data-mood", "password");
  await page.screenshot({ path: path.join(SHOT_DIR, "mascots-reduced-dark-1440.png"), fullPage: true });
 });
 test("mouse follow updates mascot pupils on a fine pointer", async ({ page }) => {
  await openPortal(page, { theme: "light", width: 1440, height: 900, accounts: [] });
  const mascots = page.locator("#loginMascots");
  await page.mouse.move(80, 160);
  await page.waitForTimeout(180);
  const left = await mascots.evaluate((node) => getComputedStyle(node.querySelector(".login-mascot.is-red")).getPropertyValue("--pupil-x"));
  await page.mouse.move(1280, 200);
  await page.waitForTimeout(180);
  const right = await mascots.evaluate((node) => getComputedStyle(node.querySelector(".login-mascot.is-red")).getPropertyValue("--pupil-x"));
  expect(Number.parseFloat(right)).toBeGreaterThan(Number.parseFloat(left));
 });
 test("narrow screens hide mascots without moving the login card", async ({ page }) => {
  await openPortal(page, { theme: "light", width: 800, height: 900, accounts: [] });
  await expect(page.locator("#loginMascots")).toBeHidden();
  await expect(page.locator(".login-card-title")).toHaveText("欢迎回来");
  await expect(page.locator(".login-brand-title")).toBeHidden();
 });
 test("theme toggle keeps mascots in the brand gap", async ({ page }) => {
  await openPortal(page, { theme: "light", width: 1440, height: 900, accounts: [] });
  await page.locator("#loginThemeToggle").click();
  await expect(page.locator("html")).toHaveAttribute("data-theme", "dark");
  await assertConfirmedSkeleton(page, { width: 1440, height: 900 });
  await page.screenshot({ path: path.join(SHOT_DIR, "mascots-idle-dark-1440.png"), fullPage: true });
 });
@@ -1,7 +1,7 @@
 const { test, expect } = require("@playwright/test");
-// 手机端（/m/）全页面回归：P5 收官打磨。
+// 手机端（/m/）全页面回归：P5 收官打磨 + HEL-233 系统管理恢复。
-// 覆盖：登录、四个入口图标页、行情 12 页、工具 3 页、复盘 5 页、复盘助手，
+// 覆盖：登录、四个入口图标页、行情 12 页、工具 3 页、复盘 5 页、复盘助手、系统管理 5 页，
 // 以及日夜两套渲染、空态、错误态、横屏健壮性、深底深字对比度抽查。
 const EMPTY_DASHBOARD = {
@@ -138,6 +138,36 @@ async function mockMobileApi(page, options = {}) {
      payload = { items: [] };
    } else if (path === "/api/search") {
      payload = { groups: { stocks: [{ id: "002141", code: "002141", name: "贤丰控股", type: "stock", industry: "电子元件" }], sectors: [], themes: [], indices: [] } };
    } else if (path === "/api/auth/accounts") {
      payload = {
        accounts: [{ user_id: auth.user.id, username: auth.user.username, role: auth.user.role, last_used_at: "2026-07-22T09:12:00+08:00" }],
        current_user_id: auth.user.id,
      };
    } else if (path === "/api/account/status") {
      payload = {
        birth_profile_configured: true,
        birth_profile: { birth_datetime: "1990-01-15T08:30", gender: "male" },
        llm_access: {
          daily_limit: 50,
          used_today: 3,
          remaining_calls: 47,
          membership: {
            active: true,
            subscribed: true,
            is_admin: auth.user.role === "admin",
            remaining_days: 20,
            expires_at: "2026-09-18",
            plan: "会员",
          },
        },
      };
    } else if (path === "/api/admin/settings") {
      payload = {
        data: { configured: true, snapshot_dates: 12, background_refresh_enabled: true, ifind: { configured: false } },
        llm: { models: [{ id: "model-1", name: "主模型", base_url: "https://api.openai.com/v1", model: "gpt-4.1", configured: true }], primary_model_id: "model-1", fallback_model_id: "" },
        membership: { member_daily_limit: 50 },
        users: [{ id: 2, username: "normal_user", role: "user", membership_subscribed: true, membership_status: "active", membership_expires_at: "2026-09-18", used_today: 3 }],
      };
    } else if (/^\/api\/stock\/\d+\/preview$/.test(path)) {
      payload = {
        meta: { trade_date: "2026-07-22", intraday_status: "available" },
@@ -230,6 +260,16 @@ const REVIEW_PAGES = [
  ["review/alerts", "提醒中心"],
 ];
 const SYSTEM_PAGES = [
  ["system/profile", "账号资料"],
  ["system/password", "修改密码"],
  ["system/membership", "会员状态"],
  ["system/admin", "系统设置"],
  ["system/members", "会员管理"],
 ];
 const PLACEHOLDER_COPY = "该功能页将在后续批次实现";
 test("mobile login renders before authentication", async ({ page }) => {
  await page.setViewportSize({ width: 390, height: 844 });
  await page.route("**/api/**", async (route) => {
@@ -249,12 +289,16 @@ test("mobile login renders before authentication", async ({ page }) => {
 test("four hub pages render their icon grids", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
-  for (const hub of ["market", "tools", "review", "system"]) {
+  for (const hub of ["market", "tools", "review"]) {
    await page.evaluate((h) => { window.MobileRouter.navigate("#/hub/" + h); }, hub);
    await expect(page.locator(".m-hub-grid")).toBeVisible();
    await expect(page.locator(".m-hub-grid .m-grid-item").first()).toBeVisible();
    expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
  }
  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
  await expect(page.locator("[data-system-page='home']")).toBeVisible();
  await expect(page.locator(".m-sys-row").first()).toBeVisible();
  expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
 });
 for (const theme of ["day", "night"]) {
@@ -296,6 +340,112 @@ test("review five pages render watchlist, trades, daily, notes and alerts", asyn
  }
 });
 test("system management pages render real content instead of placeholders", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
  for (const [key, label] of SYSTEM_PAGES) {
    await navigateToFeature(page, key);
    await expect(page.locator("#m-title")).toHaveText(label);
    await expect(page.locator(".m-placeholder")).toHaveCount(0);
    await expect(page.locator("#m-view")).not.toContainText(PLACEHOLDER_COPY);
    await expect(page.locator("[data-system-page], [data-system-admin-panel]").first()).toBeVisible();
    expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
  }
  await navigateToFeature(page, "system/profile");
  await expect(page.locator("#m-sys-birth-date")).toBeVisible();
  await expect(page.locator("[data-system-save-birth]")).toBeVisible();
  await navigateToFeature(page, "system/password");
  await expect(page.locator("#m-sys-password-current")).toBeVisible();
  await navigateToFeature(page, "system/membership");
  await expect(page.locator(".m-sys-grid")).toBeVisible();
  await navigateToFeature(page, "system/admin");
  await expect(page.locator("#m-sys-token")).toBeVisible();
  await navigateToFeature(page, "system/members");
  await expect(page.locator("#m-sys-member-limit")).toBeVisible();
 });
 test("system home groups entries and keeps admin-only items gated", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
  await expect(page.locator("[data-system-page='home']")).toBeVisible();
  await expect(page.locator("#m-view")).toContainText("账号");
  await expect(page.locator("#m-view")).toContainText("偏好");
  await expect(page.locator("#m-view")).toContainText("管理员专区");
  await expect(page.locator("[data-theme-toggle]")).toBeVisible();
  await expect(page.locator("[data-system-switch]")).toBeVisible();
  expect(await measureOverflow(page)).toBeLessThanOrEqual(1);
 });
 test("system settings tabs, model editor, delete confirm and theme toggle work", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
  await navigateToFeature(page, "system/admin");
  await expect(page.locator("[data-system-admin-panel='market']")).toBeVisible();
  await page.locator("[data-system-admin-tab='models']").click();
  await expect(page.locator("[data-system-admin-panel='models']")).toBeVisible();
  await page.locator("[data-system-edit-model]").first().click();
  await expect(page.locator(".m-sheet-root.is-open")).toBeVisible();
  await expect(page.locator(".m-sheet-head h2")).toHaveText("编辑模型");
  await page.locator("[data-sheet-close]").click();
  await page.locator("[data-system-admin-tab='market']").click();
  await expect(page.locator("#m-sys-token")).toBeVisible();
  await navigateToFeature(page, "system/profile");
  await page.locator("[data-system-delete-birth]").click();
  await expect(page.locator(".m-dialog")).toBeVisible();
  await expect(page.locator(".m-dialog")).toContainText("删除命理资料");
  await page.locator("[data-sheet-close]").click();
  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
  await expect(page.locator("[data-theme-toggle]")).toBeVisible();
  const before = await page.locator("#m-app").getAttribute("data-theme");
  await page.locator("[data-theme-toggle]").click();
  await expect.poll(async () => page.locator("#m-app").getAttribute("data-theme")).not.toBe(before);
  await navigateToFeature(page, "system/members");
  await page.locator("[data-system-open-member]").click();
  await expect(page.locator(".m-sheet-root.is-open")).toBeVisible();
  await expect(page.locator(".m-sheet-head h2")).toContainText("管理会员");
 });
 test("password mismatch shows inline error instead of a silent submit", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
  await navigateToFeature(page, "system/password");
  await page.locator("#m-sys-password-current").fill("OldPass12");
  await page.locator("#m-sys-password-new").fill("NewPass123");
  await page.locator("#m-sys-password-confirm").fill("OtherPass123");
  await page.locator("[data-system-save-password]").click();
  await expect(page.locator("[data-field-error='confirm']")).toBeVisible();
  await expect(page.locator("[data-field-error='confirm']")).toContainText("两次输入的密码不一致");
 });
 test("empty birth profile save shows a validation toast", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
  await navigateToFeature(page, "system/profile");
  await expect(page.locator("[data-system-save-birth]")).toBeVisible();
  await page.locator("#m-sys-birth-date").fill("");
  await page.locator("#m-sys-birth-time").fill("");
  await page.locator("[data-system-save-birth]").click();
  await expect(page.locator("#m-toast.is-visible")).toBeVisible();
  await expect(page.locator("#m-toast")).toContainText("请填写完整出生日期和时间");
 });
 test("non-admin cannot open system admin pages as placeholders", async ({ page }) => {
  await mockMobileApi(page, { auth: authSession("user", true) });
  await openMobile(page);
  await page.evaluate(() => { window.MobileRouter.navigate("#/hub/system"); });
  await expect(page.locator("[data-system-page='home']")).toBeVisible();
  await expect(page.locator('[data-route="#/feature/system/admin"]')).toHaveCount(0);
  await expect(page.locator('[data-route="#/feature/system/members"]')).toHaveCount(0);
  await expect(page.locator("[data-system-switch]")).toBeVisible();
  await navigateToFeature(page, "system/admin");
  await expect(page.locator("#m-view")).not.toContainText(PLACEHOLDER_COPY);
  await expect(page.locator("[data-system-page='forbidden']")).toBeVisible();
 });
 test("assistant chat renders with presets and input", async ({ page }) => {
  await mockMobileApi(page);
  await openMobile(page);
@@ -0,0 +1,132 @@
 from __future__ import annotations
 import threading
 import unittest
 from datetime import datetime, timedelta, timezone
 from pathlib import Path
 from tempfile import TemporaryDirectory
 from backend.features.accounts.security import SecretVault, token_hash
 from backend.features.accounts.service import AccountService
 from database import ReviewDatabase
 class AccountSwitchGrantTests(unittest.TestCase):
    def setUp(self) -> None:
        self.temp = TemporaryDirectory()
        self.database = ReviewDatabase(Path(self.temp.name) / "review.db")
        self.bound_user_id = 0
        self.service = AccountService(
            database=self.database,
            vault=SecretVault(SecretVault.generate_key()),
            current_user_supplier=lambda: self.bound_user_id,
            access_supplier=lambda: self.database.user_access(self.bound_user_id) or {},
            bind_user=self._bind,
            personal_field_builder=lambda *args, **kwargs: {},
            auth_lock=threading.Lock(),
        )
        self.device_a = token_hash("device-a-token")
        self.device_b = token_hash("device-b-token")
    def tearDown(self) -> None:
        self.temp.cleanup()
    def _bind(self, user_id: int) -> None:
        self.bound_user_id = int(user_id)
    def _register(self, username: str, device_hash: str = "") -> dict:
        return self.service.register(username, "Password123", device_hash or self.device_a)
    def test_login_records_accounts_for_the_current_device_only(self) -> None:
        first = self._register("alpha_user")
        second = self._register("beta_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        listed = self.service.list_device_accounts(self.device_a)
        names = [item["username"] for item in listed["accounts"]]
        self.assertEqual(names, ["beta_user", "alpha_user"])
        self.assertEqual(
            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
            "alpha_user",
        )
        self.assertEqual(self.service.list_device_accounts("")["accounts"], [])
        self.assertEqual(first["user"]["username"], "alpha_user")
        self.assertEqual(second["user"]["username"], "beta_user")
    def test_switch_uses_device_grant_and_keeps_the_original_authorization(self) -> None:
        first = self._register("alpha_user")
        self._register("beta_user")
        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
        self.assertEqual(switched["user"]["username"], "alpha_user")
        remaining = {
            item["username"]
            for item in self.service.list_device_accounts(self.device_a)["accounts"]
        }
        self.assertEqual(remaining, {"alpha_user", "beta_user"})
    def test_switch_without_a_valid_grant_requires_reauthentication(self) -> None:
        user = self._register("alpha_user")
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_b, int(user["user"]["id"]))
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account("", int(user["user"]["id"]))
    def test_forget_only_removes_the_current_device_grant(self) -> None:
        user = self._register("alpha_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        self.service.forget_account(self.device_a, int(user["user"]["id"]))
        self.service.forget_account(self.device_a, int(user["user"]["id"]))
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        self.assertEqual(
            self.service.list_device_accounts(self.device_b)["accounts"][0]["username"],
            "alpha_user",
        )
    def test_logout_revokes_only_the_current_account_on_this_device(self) -> None:
        first = self._register("alpha_user")
        second = self._register("beta_user")
        self.service.revoke_current_device_grant(self.device_a, int(second["user"]["id"]))
        names = {
            item["username"]
            for item in self.service.list_device_accounts(self.device_a)["accounts"]
        }
        self.assertEqual(names, {"alpha_user"})
        switched = self.service.switch_account(self.device_a, int(first["user"]["id"]))
        self.assertEqual(switched["user"]["id"], first["user"]["id"])
    def test_password_change_revokes_grants_on_every_device(self) -> None:
        user = self._register("alpha_user")
        self.service.login("alpha_user", "Password123", self.device_b)
        self._bind(int(user["user"]["id"]))
        self.service.change_password("Password123", "Password456")
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        self.assertEqual(self.service.list_device_accounts(self.device_b)["accounts"], [])
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_a, int(user["user"]["id"]))
    def test_device_keeps_at_most_five_accounts(self) -> None:
        usernames = [f"user_{index}" for index in range(6)]
        ids = [self._register(name)["user"]["id"] for name in usernames]
        listed = self.service.list_device_accounts(self.device_a)["accounts"]
        self.assertEqual(len(listed), 5)
        kept = {item["user_id"] for item in listed}
        self.assertNotIn(ids[0], kept)
        self.assertTrue(set(ids[1:]).issubset(kept))
    def test_expired_grants_are_removed_lazily(self) -> None:
        user = self._register("alpha_user")
        past = (datetime.now(timezone.utc) - timedelta(days=1)).isoformat(timespec="seconds")
        self.database.upsert_switch_grant(
            self.device_a,
            int(user["user"]["id"]),
            past,
            past,
            past,
        )
        self.assertEqual(self.service.list_device_accounts(self.device_a)["accounts"], [])
        with self.assertRaisesRegex(PermissionError, "该账号需重新验证"):
            self.service.switch_account(self.device_a, int(user["user"]["id"]))
 if __name__ == "__main__":
    unittest.main()
@@ -0,0 +1,24 @@
 from __future__ import annotations
 import unittest
 from backend.jobs.service import _verified_dashboard_result
 class AdminRefreshStatusTests(unittest.TestCase):
    def test_carried_snapshot_is_reported_as_failed_job(self):
        result = _verified_dashboard_result(
            {"meta": {"carried_forward": True, "notice": "官方涨跌停数据尚未返回"}}
        )
        self.assertEqual(result["status"], "failed")
        self.assertEqual(result["error"], "官方涨跌停数据尚未返回")
    def test_current_snapshot_is_reported_as_successful_job(self):
        dashboard = {"meta": {"trade_date": "2026-08-28", "carried_forward": False}}
        self.assertIs(_verified_dashboard_result(dashboard), dashboard)
 if __name__ == "__main__":
    unittest.main()
@@ -1,226 +0,0 @@
 from __future__ import annotations
 import threading
 import unittest
 from datetime import datetime
 from unittest.mock import patch
 from backend.data.providers.tushare_client import TushareClient
 from backend.data.providers.tushare_transport import TushareError
 from server import DashboardService
 class FixedDatetime(datetime):
    fixed_now = datetime(2026, 8, 28, 15, 4).astimezone()
    @classmethod
    def now(cls, tz=None):
        return cls.fixed_now
 class WindowClient(TushareClient):
    def __init__(self, token: str = "test-token"):
        super().__init__(token)
        self.calls: list[str] = []
        self.daily_rows: list[dict] = []
        self.rt_k_error: Exception | None = None
    def query(self, api_name, params=None, fields=""):
        self.calls.append(api_name)
        params = params or {}
        if api_name == "trade_cal":
            return [
                {
                    "cal_date": "20260828",
                    "is_open": 1,
                    "pretrade_date": "20260827",
                }
            ]
        if api_name == "daily":
            return list(self.daily_rows)
        if api_name == "rt_k":
            if self.rt_k_error is not None:
                raise self.rt_k_error
            raise AssertionError("rt_k should not be called in this scenario")
        if api_name in {"limit_list_d", "stock_basic", "stk_limit", "daily_basic"}:
            return []
        raise AssertionError(f"Unexpected API call: {api_name} {params}")
    def resolve_trade_context(self, requested_date: str):
        return requested_date, "20260827"
 class SyncDatabaseStub:
    def __init__(self, latest=None):
        self.latest = latest
        self.snapshots: dict[str, dict] = {}
        self.sync_runs: list[dict] = []
        self._sync_id = 0
    def start_sync(self, trade_date: str, source: str) -> int:
        self._sync_id += 1
        self.sync_runs.append(
            {
                "id": self._sync_id,
                "trade_date": trade_date,
                "source": source,
                "status": "running",
            }
        )
        return self._sync_id
    def finish_sync(
        self,
        sync_id: int,
        status: str,
        record_count: int = 0,
        message: str = "",
        source: str | None = None,
    ) -> None:
        for row in self.sync_runs:
            if row["id"] == sync_id:
                row.update(
                    {
                        "status": status,
                        "record_count": record_count,
                        "message": message,
                        "source": source or row["source"],
                    }
                )
                return
        raise AssertionError(f"unknown sync_id {sync_id}")
    def save_snapshot(self, trade_date: str, source: str, payload: dict) -> None:
        self.snapshots[trade_date] = {"source": source, "payload": payload}
    def save_data_snapshot(self, kind: str, cache_key: str, source: str, payload: dict) -> None:
        return None
    def get_latest_real_snapshot(self, _trade_date: str, strictly_before: bool = False):
        return self.latest
    def reason_overrides(self, _trade_date: str):
        return {}
 class DashboardRefreshWindowTests(unittest.TestCase):
    def setUp(self) -> None:
        TushareClient._realtime_reference_cache.clear()
        TushareClient._capital_cache.clear()
        TushareClient._latest_realtime_market.clear()
        TushareClient._stock_activity_cache.clear()
    def _service(self, client: WindowClient, latest=None) -> DashboardService:
        service = object.__new__(DashboardService)
        service._system_credentials = {"tushare_token": "test-token"}
        service.sync_lock = threading.Lock()
        service.database = SyncDatabaseStub(latest=latest)
        service.data_gateway = None
        service._tushare_client = lambda: client
        service._enrich_dashboard_sentiment = lambda dashboard, _date: dashboard
        service._apply_reason_overrides = lambda dashboard: dashboard
        return service
    def test_should_use_realtime_at_1504(self) -> None:
        FixedDatetime.fixed_now = datetime(2026, 8, 28, 15, 4).astimezone()
        with patch("backend.data.providers.tushare_dashboard.datetime", FixedDatetime):
            self.assertTrue(TushareClient.should_use_realtime("20260828", "20260828"))
    def test_should_use_daily_at_1505(self) -> None:
        FixedDatetime.fixed_now = datetime(2026, 8, 28, 15, 5).astimezone()
        with patch("backend.data.providers.tushare_dashboard.datetime", FixedDatetime):
            self.assertFalse(TushareClient.should_use_realtime("20260828", "20260828"))
    def test_after_close_empty_daily_does_not_call_rt_k(self) -> None:
        FixedDatetime.fixed_now = datetime(2026, 8, 28, 15, 49).astimezone()
        client = WindowClient()
        client.daily_rows = []
        with patch("backend.data.providers.tushare_dashboard.datetime", FixedDatetime):
            with self.assertRaises(TushareError):
                client.dashboard("20260828")
        self.assertIn("daily", client.calls)
        self.assertNotIn("rt_k", client.calls)
    def test_after_close_uses_daily_when_ready(self) -> None:
        FixedDatetime.fixed_now = datetime(2026, 8, 28, 15, 49).astimezone()
        client = WindowClient()
        client.daily_rows = [
            {
                "ts_code": "000001.SZ",
                "trade_date": "20260828",
                "open": 10,
                "high": 11,
                "low": 9.5,
                "close": 10.5,
                "pre_close": 10,
                "pct_chg": 5,
                "vol": 1000,
                "amount": 1_000_000,
            }
        ]
        def load_limit_lists(_trade_date):
            return []
        def load_limit_type(_trade_date, _limit_type):
            return []
        client._load_limit_lists = load_limit_lists  # type: ignore[method-assign]
        client._load_limit_type = load_limit_type  # type: ignore[method-assign]
        client._derive_limits = lambda *args, **kwargs: []  # type: ignore[method-assign]
        with patch("backend.data.providers.tushare_dashboard.datetime", FixedDatetime):
            dashboard = client.dashboard("20260828")
        self.assertIn("daily", client.calls)
        self.assertNotIn("rt_k", client.calls)
        self.assertFalse(dashboard["meta"].get("realtime"))
        self.assertEqual(dashboard["meta"]["trade_date"], "2026-08-28")
    def test_fallback_old_snapshot_marks_sync_and_job_status_failed(self) -> None:
        FixedDatetime.fixed_now = datetime(2026, 8, 28, 15, 49).astimezone()
        client = WindowClient()
        client.daily_rows = []
        latest = {
            "meta": {"source": "tushare", "trade_date": "2026-08-27"},
            "overview": {},
            "limits": [],
            "broken": [],
            "down_limits": [],
            "yesterday_limits": [],
        }
        service = self._service(client, latest=latest)
        with patch("backend.data.providers.tushare_dashboard.datetime", FixedDatetime):
            result = service.sync_dashboard("20260828")
        self.assertEqual(result["status"], "failed")
        self.assertTrue(result["meta"]["carried_forward"])
        self.assertEqual(result["meta"]["trade_date"], "2026-08-27")
        self.assertEqual(service.database.sync_runs[-1]["status"], "failed")
        self.assertNotIn("rt_k", client.calls)
    def test_closing_snapshot_due_after_1505_when_today_missing(self) -> None:
        FixedDatetime.fixed_now = datetime(2026, 8, 28, 15, 49).astimezone()
        service = object.__new__(DashboardService)
        service._system_credentials = {"tushare_token": "test-token"}
        with patch("backend.features.market.service.datetime", FixedDatetime), patch(
            "backend.features.market.service.date"
        ) as fake_date:
            fake_date.today.return_value = FixedDatetime.fixed_now.date()
            self.assertTrue(service._closing_snapshot_due("20260828", {}))
            self.assertFalse(
                service._closing_snapshot_due(
                    "20260828",
                    {
                        "meta": {
                            "trade_date": "2026-08-28",
                            "realtime": False,
                        }
                    },
                )
            )
 if __name__ == "__main__":
    unittest.main()
@@ -25,6 +25,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                        ("0002", "create_job_runs"),
                        ("0003", "extend_llm_audit"),
                        ("0004", "add_mentor_note"),
                        ("0005", "create_account_switch_grants"),
                    ],
                )
                columns = {
@@ -39,7 +40,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 4)
+            self.assertEqual(count, 5)
    def test_database_with_recorded_0004_and_note_column_starts_without_reapply(
        self,
@@ -60,7 +61,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                count = connection.execute(
                    "SELECT COUNT(*) AS count FROM schema_migrations"
                ).fetchone()["count"]
-            self.assertEqual(count, 4)
+            self.assertEqual(count, 5)
    def test_old_database_without_0004_upgrades_and_adds_note_column(self) -> None:
        with tempfile.TemporaryDirectory() as root:
@@ -87,7 +88,7 @@ class DatabaseMigrationTests(unittest.TestCase):
                        "PRAGMA table_info(mentor_preferences)"
                    )
                ]
-            self.assertEqual(versions, {"0001", "0002", "0003", "0004"})
+            self.assertEqual(versions, {"0001", "0002", "0003", "0004", "0005"})
            self.assertIn("note", note_rows)
    def test_database_with_unknown_migration_is_rejected(self) -> None:
@@ -0,0 +1,124 @@
 from __future__ import annotations
 import os
 import stat
 import subprocess
 import tempfile
 import unittest
 from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 CHECK = ROOT / "tools" / "check_deploy_baseline.sh"
 BUILD = ROOT / "tools" / "build_image.sh"
 def run_check(repo: Path, candidate: str, live: str) -> subprocess.CompletedProcess[str]:
    env = os.environ.copy()
    env["GIT_DIR"] = str(repo / ".git")
    env["GIT_WORK_TREE"] = str(repo)
    return subprocess.run(
        ["bash", str(CHECK), candidate, "--live-revision", live],
        cwd=repo,
        capture_output=True,
        text=True,
        env=env,
        check=False,
    )
 def git(repo: Path, *args: str) -> str:
    result = subprocess.run(
        ["git", *args],
        cwd=repo,
        capture_output=True,
        text=True,
        check=True,
    )
    return result.stdout.strip()
 class DeployBaselineGateTests(unittest.TestCase):
    @classmethod
    def setUpClass(cls) -> None:
        cls.tmpdir = tempfile.TemporaryDirectory()
        cls.repo = Path(cls.tmpdir.name) / "repo"
        cls.repo.mkdir()
        git(cls.repo, "init")
        git(cls.repo, "config", "user.email", "gate@example.com")
        git(cls.repo, "config", "user.name", "Gate")
        (cls.repo / "README").write_text("base\n", encoding="utf-8")
        git(cls.repo, "add", "README")
        git(cls.repo, "commit", "-m", "base")
        cls.base = git(cls.repo, "rev-parse", "HEAD")
        (cls.repo / "online.txt").write_text("live\n", encoding="utf-8")
        git(cls.repo, "add", "online.txt")
        git(cls.repo, "commit", "-m", "online")
        cls.live = git(cls.repo, "rev-parse", "HEAD")
        git(cls.repo, "checkout", "-b", "successor")
        (cls.repo / "next.txt").write_text("next\n", encoding="utf-8")
        git(cls.repo, "add", "next.txt")
        git(cls.repo, "commit", "-m", "successor of live")
        cls.successor = git(cls.repo, "rev-parse", "HEAD")
        git(cls.repo, "checkout", "-B", "lagging-main", cls.base)
        (cls.repo / "stale.txt").write_text("stale main\n", encoding="utf-8")
        git(cls.repo, "add", "stale.txt")
        git(cls.repo, "commit", "-m", "lagging main")
        cls.lagging = git(cls.repo, "rev-parse", "HEAD")
        git(cls.repo, "checkout", "-B", "side", cls.base)
        (cls.repo / "side.txt").write_text("side branch\n", encoding="utf-8")
        git(cls.repo, "add", "side.txt")
        git(cls.repo, "commit", "-m", "unrelated side branch")
        cls.side = git(cls.repo, "rev-parse", "HEAD")
        git(cls.repo, "checkout", "-B", "successor", cls.successor)
    @classmethod
    def tearDownClass(cls) -> None:
        cls.tmpdir.cleanup()
    def test_check_script_is_executable(self) -> None:
        self.assertTrue(CHECK.exists())
        self.assertTrue(stat.S_IXUSR & CHECK.stat().st_mode)
    def test_successor_of_live_passes(self) -> None:
        result = run_check(self.repo, self.successor, self.live)
        self.assertEqual(result.returncode, 0, result.stderr)
        self.assertIn(self.live, result.stdout)
        self.assertIn(self.successor, result.stdout)
        self.assertIn("next.txt", result.stdout)
        self.assertIn("祖先关系通过", result.stdout)
    def test_lagging_main_is_blocked(self) -> None:
        result = run_check(self.repo, self.lagging, self.live)
        self.assertNotEqual(result.returncode, 0)
        self.assertIn("拒绝", result.stderr)
    def test_side_branch_is_blocked(self) -> None:
        result = run_check(self.repo, self.side, self.live)
        self.assertNotEqual(result.returncode, 0)
        self.assertIn("拒绝", result.stderr)
    def test_unknown_commit_is_blocked(self) -> None:
        result = run_check(self.repo, "deadbeefdeadbeefdeadbeefdeadbeefdeadbeef", self.live)
        self.assertNotEqual(result.returncode, 0)
        self.assertIn("无法解析", result.stderr)
    def test_build_image_calls_the_gate_and_rejects_latest(self) -> None:
        source = BUILD.read_text(encoding="utf-8")
        self.assertIn("check_deploy_baseline.sh", source)
        self.assertIn("禁止构建 latest", source)
        self.assertIn("org.opencontainers.image.revision", source)
        gate = CHECK.read_text(encoding="utf-8")
        self.assertIn("org.opencontainers.image.revision", gate)
        self.assertIn("merge-base --is-ancestor", gate)
        self.assertIn("候选将丢失的提交", gate)
        self.assertIn("禁止人工填写", gate)
 if __name__ == "__main__":
    unittest.main()
@@ -344,6 +344,22 @@ class FrontendContractTests(unittest.TestCase):
        self.assertIn("max-height: var(--sentiment-history-max-height);", self.sentiment_styles)
        self.assertIn("overflow: auto;", self.sentiment_styles)
    def test_sentiment_equal_height_and_tooltip_tokens(self):
        self.assertIn("--sentiment-analysis-height: 600px;", self.tokens)
        self.assertIn("--sentiment-tooltip-bg: var(--text-primary);", self.tokens)
        self.assertIn("--sentiment-tooltip-fg: var(--text-inverse);", self.tokens)
        self.assertIn("--sentiment-tooltip-bg: #26293e;", self.tokens)
        self.assertIn("--sentiment-tooltip-fg: #e8eaed;", self.tokens)
        self.assertIn("height: var(--sentiment-analysis-height);", self.sentiment_styles)
        self.assertIn("max-height: var(--sentiment-analysis-height);", self.sentiment_styles)
        self.assertIn("justify-content: space-evenly;", self.sentiment_styles)
        self.assertIn("background: var(--sentiment-tooltip-bg);", self.sentiment_styles)
        self.assertIn("color: var(--sentiment-tooltip-fg);", self.sentiment_styles)
        self.assertIn("new ResizeObserver", self.script)
        self.assertIn("#sentimentCycleView .redesigned-emotion-grid {", self.sentiment_styles)
        self.assertNotIn("height: 100vh", self.sentiment_styles)
        self.assertNotIn("min-height: 100%", self.sentiment_styles)
    def test_mentor_final_visual_fix_contract(self):
        shell_styles = (STATIC_DIR / "shared" / "shell.css").read_text(encoding="utf-8")
        mentor_html = (STATIC_DIR / "pages" / "mentor" / "page.html").read_text(encoding="utf-8")
@@ -65,8 +65,11 @@ class GovernanceRegistryTests(unittest.TestCase):
            public,
            {
                ("GET", "/api/health"),
                ("GET", "/api/auth/accounts"),
                ("POST", "/api/auth/login"),
                ("POST", "/api/auth/register"),
                ("POST", "/api/auth/switch"),
                ("POST", "/api/auth/forget"),
            },
        )
@@ -0,0 +1,90 @@
 from __future__ import annotations
 import unittest
 from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 LOGIN = (ROOT / "frontend" / "login" / "index.html").read_text(encoding="utf-8")
 LOGIN_JS = (ROOT / "frontend" / "login" / "page.js").read_text(encoding="utf-8")
 AUTH = (ROOT / "frontend" / "shared" / "auth.css").read_text(encoding="utf-8")
 TOKENS = (ROOT / "frontend" / "shared" / "tokens.css").read_text(encoding="utf-8")
 class LoginPortalContractTests(unittest.TestCase):
    def test_confirmed_brand_skeleton_is_in_markup(self) -> None:
        for needle in (
            'class="login-brand-header"',
            'class="login-brand-name"',
            "A股个人复盘工作台",
            'class="login-brand-kicker"',
            "看懂情绪周期，把复盘变成下一次的先手。",
            'class="login-brand-chart"',
            'class="login-brand-stats"',
            "股市有风险，投资需谨慎",
            'id="loginThemeToggle"',
            'id="loginCard"',
        ):
            self.assertIn(needle, LOGIN)
    def test_login_tokens_own_the_confirmed_layout_metrics(self) -> None:
        for needle in (
            "--login-brand-share: 34%;",
            "--login-brand-cap: 560px;",
            "--login-brand-wide-share: 29.2%;",
            "--login-card-width: 408px;",
            "--login-hero-size: 28px;",
            "--login-account-row-min: 72px;",
        ):
            self.assertIn(needle, TOKENS)
        self.assertIn("width: var(--login-brand-share);", AUTH)
        self.assertIn("width: var(--login-card-width);", AUTH)
        self.assertIn("justify-content: flex-end;", AUTH)
        self.assertIn("body.login-portal {", AUTH)
        self.assertIn("padding-bottom: 0;", AUTH)
        self.assertNotIn("padding: 0 0 var(--statusbar-height);", AUTH)
    def test_confirmed_mascots_fill_the_brand_gap(self) -> None:
        for needle in (
            'id="loginMascots"',
            'aria-hidden="true"',
            'class="login-mascot is-red"',
            'class="login-mascot is-green"',
            'class="login-mascot-back"',
            'class="login-mascot-slit"',
        ):
            self.assertIn(needle, LOGIN)
        for needle in (
            "--login-mascot-red: #e8605a;",
            "--login-mascot-green: #46be93;",
            "--login-mascot-height: clamp(150px, 15vw, 260px);",
        ):
            self.assertIn(needle, TOKENS)
        self.assertIn("flex: 1 1 auto;", AUTH)
        self.assertIn(".login-mascots {", AUTH)
        self.assertIn("prefers-reduced-motion: reduce", AUTH)
        self.assertIn('next === "password"', LOGIN_JS)
        self.assertIn("toggle-password", LOGIN_JS)
        self.assertIn("celebrateLogin", LOGIN_JS)
    def test_portal_keeps_account_switch_and_theme_hooks(self) -> None:
        self.assertIn("data-switch-id", LOGIN_JS)
        self.assertIn("data-resume-id", LOGIN_JS)
        self.assertIn('data-login-action="manage"', LOGIN_JS)
        self.assertIn('data-login-action="add"', LOGIN_JS)
        self.assertIn('data-login-action="resume"', LOGIN_JS)
        self.assertIn("继续使用", LOGIN_JS)
        self.assertIn("返回复盘", LOGIN_JS)
        self.assertIn("/api/auth/me", LOGIN_JS)
        self.assertIn("xiaobaiTheme", LOGIN_JS)
        self.assertNotIn("内网个人版", LOGIN)
        self.assertNotIn("192.168.200.11", LOGIN)
        self.assertNotIn("/api/heaven", LOGIN_JS)
    def test_current_account_row_stays_clickable_without_reswitching(self) -> None:
        self.assertIn("resumeCurrentAccount", LOGIN_JS)
        self.assertIn("当前会话已失效，请重新登录", LOGIN_JS)
        self.assertNotIn("!managing && !current ? \"is-switchable\"", LOGIN_JS)
        session = (ROOT / "frontend" / "shared" / "session.js").read_text(encoding="utf-8")
        self.assertIn('params.set("next", next)', session)
        self.assertIn(".login-account-action", AUTH)
@@ -0,0 +1,86 @@
 from __future__ import annotations
 import re
 import unittest
 from pathlib import Path
 ROOT = Path(__file__).resolve().parents[1]
 NAV = ROOT / "frontend/m/config/nav.config.js"
 PAGES = ROOT / "frontend/m/js/pages.js"
 ROUTER = ROOT / "frontend/m/js/router.js"
 class MobileSystemPagesRegressionTests(unittest.TestCase):
    """Prevent mobile system-management entries from falling back to placeholders."""
    def test_nav_system_entries_are_registered_as_real_pages(self) -> None:
        nav = NAV.read_text(encoding="utf-8")
        pages = PAGES.read_text(encoding="utf-8")
        keys = re.findall(r'key:\s*"(system/[^"]+)"', nav)
        self.assertEqual(
            keys,
            [
                "system/profile",
                "system/password",
                "system/membership",
                "system/admin",
                "system/members",
            ],
        )
        for key in keys:
            self.assertIn(f'"{key}": setupSystemPage', pages)
            self.assertIn(f'"{key}": loadSystem', pages)
    def test_placeholder_copy_is_only_a_router_fallback(self) -> None:
        router = ROUTER.read_text(encoding="utf-8")
        pages = PAGES.read_text(encoding="utf-8")
        self.assertIn("该功能页将在后续批次实现", router)
        self.assertNotIn("该功能页将在后续批次实现", pages)
        self.assertIn("function setupSystemPage", pages)
        self.assertIn("function loadSystem", pages)
    def test_system_pages_render_real_controls_not_stubs(self) -> None:
        pages = PAGES.read_text(encoding="utf-8")
        for marker in (
            'data-system-page="home"',
            'data-system-page="profile"',
            'data-system-page="password"',
            'data-system-page="membership"',
            'data-system-page="members"',
            'data-system-page="forbidden"',
            'data-system-admin-panel="market"',
            "m-sys-birth-date",
            "m-sys-password-current",
            "m-sys-token",
            "m-sys-member-limit",
            "data-system-switch",
            "data-system-edit-model",
            "data-system-open-member",
            "管理员专区",
            "保存密钥",
            "保存分工",
            'location.assign("/login/")',
        ):
            self.assertIn(marker, pages)
    def test_system_boolean_attrs_do_not_have_stray_quotes(self) -> None:
        pages = PAGES.read_text(encoding="utf-8")
        stray = re.findall(r'data-system-[a-z-]*"(?=[>\s])', pages)
        self.assertEqual(
            stray,
            [],
            "boolean data-system attributes must not have a trailing quote before > or space",
        )
        for name in (
            "data-system-save-birth",
            "data-system-save-password",
            "data-system-add-model",
            "data-system-save-models",
            "data-system-save-market",
            "data-system-refresh",
            "data-system-toggle-refresh",
            "data-system-save-model",
        ):
            self.assertIn(name, pages)
            self.assertNotIn(name + '">', pages)
@@ -111,6 +111,25 @@ class RealtimeDashboardTests(unittest.TestCase):
        self.assertEqual(quote["amount_billion"], 3.0)
        self.assertAlmostEqual(quote["turnover_rate"], 0.01)
    def test_close_dashboard_marks_official_limit_data(self):
        dashboard = self.client.dashboard("20260720")
        self.assertEqual(dashboard["meta"]["limit_data_source"], "official")
    def test_close_dashboard_marks_derived_limit_data_as_incomplete(self):
        original_query = self.client.query
        def query(api_name, params=None, fields=""):
            if api_name == "limit_list_d":
                return []
            return original_query(api_name, params, fields)
        self.client.query = query
        dashboard = self.client.dashboard("20260720")
        self.assertEqual(dashboard["meta"]["limit_data_source"], "derived")
        self.assertIn("日线数据推算", dashboard["meta"]["notice"])
 if __name__ == "__main__":
    unittest.main()
@@ -20,6 +20,25 @@ registry, and verification tools.
 - `python tools/backfill_recent_snapshots.py --account <admin> [--lookback 60] [--dry-run]`:
  auditable recent trading-day dashboard snapshot backfill. See
  `docs/maintenance/行情历史补档.md`.
 - `tools/update_from_main.sh` (deployed to the server as
  `~/xiaobai-build/update-from-main.sh`): the server-side update-and-build entry for
  the managed local worktree at `/opt/1panel/docker/compose/xiaobaifupan`. Fetches
  Gitea `main`, enforces branch/clean/fast-forward checks, builds a
  `main-<shortsha>` tagged image with the revision label, and verifies the label
  after the build. `tools/xiaobai-git` is the matching git wrapper for that
  worktree (`status`/`log`/`diff`).
 - `bash tools/build_image.sh <commit> <tag>`: agent-grade entry that streams
  `git archive <commit>` to the deploy host over SSH (default
  `moxiaobai@192.168.200.11`), refuses tags that do not end with the commit
  short SHA, verifies the revision label after the build, and appends a record to
  `~/xiaobai-build/BUILD_LOG.tsv` on the host. Before building, it runs
  `tools/check_deploy_baseline.sh` so the candidate commit must contain the currently
  running container's Git revision as an ancestor.
 - `bash tools/check_deploy_baseline.sh <commit> [--live-revision <sha>]`: deployment
  ancestor gate. Reads the live `org.opencontainers.image.revision` from the running
  `xiaobai-review` container (or `--live-revision` in tests), prints the live SHA,
  candidate SHA, file diff, and commits the candidate would drop, then exits if the
  live revision is not an ancestor of the candidate.
 `verify_baseline.py` does not inspect a parent checkout or skip tests according to files outside
 this application. Historical comparison scripts were retired after final standalone acceptance;
@@ -50,7 +50,13 @@ def _owner(path: str) -> str:
 def _role(method: str, path: str) -> str:
-    if path == "/api/health" or path in {"/api/auth/register", "/api/auth/login"}:
+    if path == "/api/health" or path in {
        "/api/auth/register",
        "/api/auth/login",
        "/api/auth/accounts",
        "/api/auth/switch",
        "/api/auth/forget",
    }:
        return "public"
    from api_access import required_role
@@ -0,0 +1,95 @@
 #!/usr/bin/env bash
 # 小白复盘唯一安全构建入口（HEL-235 固化）
 # 方式：从明确 Git 提交 git archive 流式传输到部署机 docker build，不使用任何服务器工作树。
 # 铁律：禁止在服务器目录（如 /opt/1panel/docker/compose/xiaobaifupan）里 docker build；
 #       禁止构建 latest 等不带提交短号的 tag；严禁向 192.168.200.36 构建或部署。
 set -euo pipefail
 HOST_DEFAULT="moxiaobai@192.168.200.11"
 REPO_NAME="xiaobai-review"
 usage() {
  cat <<'EOF'
 用法: tools/build_image.sh <commit> <tag>
  <commit>  提交号（完整或前缀），必须能被 origin 解析；构建前会自动 fetch
  <tag>     镜像 tag，必须以 -<提交短号7位> 结尾，锁定镜像来源；禁止 latest、rollback-*
 示例: tools/build_image.sh cefc86917d89 verify-hel235-cefc869
 说明: 仅构建镜像，不启动、不替换任何容器；换版与回滚另行人工执行。
 EOF
  exit 2
 }
 [ $# -eq 2 ] || usage
 COMMIT="$1"
 TAG="$2"
 HOST="${XB_BUILD_HOST:-$HOST_DEFAULT}"
 case "$HOST" in
  *192.168.200.36*)
    echo "拒绝：192.168.200.36 已永久废弃，严禁在其上构建或部署。" >&2
    exit 1
    ;;
 esac
 cd "$(git rev-parse --show-toplevel)"
 echo "==> 同步远端引用"
 git fetch origin --prune --quiet
 FULL_SHA="$(git rev-parse --verify --quiet "${COMMIT}^{commit}" || true)"
 if [ -z "$FULL_SHA" ]; then
  echo "拒绝：提交 ${COMMIT} 无法解析。构建源必须锁定到已推送 origin 的明确提交。" >&2
  exit 1
 fi
 SHORT="${FULL_SHA:0:7}"
 SUBJECT="$(git log -1 --format=%s "$FULL_SHA")"
 case "$TAG" in
  latest)
    echo "拒绝：禁止构建 latest，模糊 tag 无法追溯来源提交。" >&2
    exit 1
    ;;
  rollback-*)
    echo "拒绝：rollback-* 是部署时对既有镜像的人工 docker tag，不允许用来构建。" >&2
    exit 1
    ;;
 esac
 if [[ "$TAG" != *-"$SHORT" ]]; then
  echo "拒绝：tag「${TAG}」必须以 -${SHORT} 结尾，保证镜像 tag 与来源提交一一对应。" >&2
  exit 1
 fi
 echo "==> 部署基线门禁（线上提交必须是候选祖先）"
 bash "$(git rev-parse --show-toplevel)/tools/check_deploy_baseline.sh" "$FULL_SHA"
 echo "==> 构建计划"
 echo "    提交: ${FULL_SHA}  ${SUBJECT}"
 echo "    镜像: ${REPO_NAME}:${TAG}  @ ${HOST}"
 echo "    方式: git archive 流式构建（不读取服务器上任何代码目录）"
 echo "==> 流式构建开始"
 git archive --format=tar "$FULL_SHA" \
  | ssh -o BatchMode=yes "$HOST" docker build --rm \
      -t "${REPO_NAME}:${TAG}" \
      --label "org.opencontainers.image.revision=${FULL_SHA}" \
      --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
      --label "org.opencontainers.image.source=git-archive-stream" \
      -
 echo "==> 回读校验镜像内记录的提交号"
 GOT="$(ssh -o BatchMode=yes "$HOST" "docker image inspect ${REPO_NAME}:${TAG} --format '{{index .Config.Labels \"org.opencontainers.image.revision\"}}'" 2>/dev/null || true)"
 if [ "$GOT" != "$FULL_SHA" ]; then
  echo "校验失败：镜像 revision='${GOT:-<空>}'，期望 ${FULL_SHA}。删除不可信镜像，中止。" >&2
  ssh -o BatchMode=yes "$HOST" docker rmi "${REPO_NAME}:${TAG}" >/dev/null 2>&1 || true
  exit 1
 fi
 IMAGE_ID="$(ssh -o BatchMode=yes "$HOST" "docker image inspect ${REPO_NAME}:${TAG} --format '{{.Id}}'")"
 SHORT_ID="${IMAGE_ID##*:}"
 ssh -o BatchMode=yes "$HOST" \
  "mkdir -p ~/xiaobai-build && printf '%s\t%s\t%s\t%s\tgit-archive-stream\n' \"\$(date '+%F %T')\" ${REPO_NAME}:${TAG} ${FULL_SHA} ${SHORT_ID} >> ~/xiaobai-build/BUILD_LOG.tsv"
 echo "==> 完成"
 echo "    ${REPO_NAME}:${TAG}  (${SHORT_ID})"
 echo "    来源提交 ${FULL_SHA} 已写入镜像 label 与 ~/xiaobai-build/BUILD_LOG.tsv"
@@ -0,0 +1,126 @@
 #!/usr/bin/env bash
 # 部署基线门禁（HEL-238）：候选提交必须包含当前线上提交的全部历史。
 # 线上提交号从运行中的容器镜像 label 读取，禁止人工填写“看起来正确”的基线。
 set -euo pipefail
 HOST_DEFAULT="moxiaobai@192.168.200.11"
 CONTAINER_DEFAULT="xiaobai-review"
 usage() {
  cat <<'EOF'
 用法: tools/check_deploy_baseline.sh <candidate_commit> [--live-revision <sha>]
  <candidate_commit>     准备构建/部署的提交（完整或前缀）
  --live-revision <sha>  仅测试用：直接指定线上提交，跳过 SSH 读取
 环境变量:
  XB_BUILD_HOST          部署机 SSH（默认 moxiaobai@192.168.200.11）
  XB_LIVE_CONTAINER      运行中容器名（默认 xiaobai-review）
  XB_LIVE_REVISION       若已设置则视为线上提交，不再 SSH
 EOF
  exit 2
 }
 [ $# -ge 1 ] || usage
 CANDIDATE="$1"
 shift
 LIVE_OVERRIDE=""
 while [ $# -gt 0 ]; do
  case "$1" in
    --live-revision)
      [ $# -ge 2 ] || usage
      LIVE_OVERRIDE="$2"
      shift 2
      ;;
    -h|--help)
      usage
      ;;
    *)
      echo "拒绝：未知参数 $1" >&2
      usage
      ;;
  esac
 done
 HOST="${XB_BUILD_HOST:-$HOST_DEFAULT}"
 CONTAINER="${XB_LIVE_CONTAINER:-$CONTAINER_DEFAULT}"
 case "$HOST" in
  *192.168.200.36*)
    echo "拒绝：192.168.200.36 已永久废弃，严禁在其上构建或部署。" >&2
    exit 1
    ;;
 esac
 cd "$(git rev-parse --show-toplevel)"
 read_live_revision() {
  if [ -n "${LIVE_OVERRIDE}" ]; then
    printf '%s\n' "${LIVE_OVERRIDE}"
    return
  fi
  if [ -n "${XB_LIVE_REVISION:-}" ]; then
    printf '%s\n' "${XB_LIVE_REVISION}"
    return
  fi
  ssh -o BatchMode=yes "$HOST" bash -s -- "$CONTAINER" <<'REMOTE'
 set -euo pipefail
 container="$1"
 revision="$(docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$container" 2>/dev/null || true)"
 if [ -z "$revision" ] || [ "$revision" = "<no value>" ]; then
  image="$(docker inspect --format '{{.Image}}' "$container" 2>/dev/null || true)"
  if [ -n "$image" ]; then
    revision="$(docker inspect --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' "$image" 2>/dev/null || true)"
  fi
 fi
 if [ -z "$revision" ] || [ "$revision" = "<no value>" ]; then
  echo "拒绝：无法从线上容器 ${container} 读取 org.opencontainers.image.revision。" >&2
  exit 1
 fi
 printf '%s\n' "$revision"
 REMOTE
 }
 LIVE_RAW="$(read_live_revision)"
 LIVE_RAW="$(printf '%s' "$LIVE_RAW" | tr -d '[:space:]')"
 if [ -z "$LIVE_RAW" ]; then
  echo "拒绝：线上提交号为空，禁止继续构建或部署。" >&2
  exit 1
 fi
 CANDIDATE_SHA="$(git rev-parse --verify --quiet "${CANDIDATE}^{commit}" || true)"
 if [ -z "$CANDIDATE_SHA" ]; then
  echo "拒绝：候选提交 ${CANDIDATE} 无法解析。" >&2
  exit 1
 fi
 LIVE_SHA="$(git rev-parse --verify --quiet "${LIVE_RAW}^{commit}" || true)"
 if [ -z "$LIVE_SHA" ]; then
  echo "拒绝：线上提交 ${LIVE_RAW} 在本地仓库无法解析；请先 git fetch，禁止手工填写替代基线。" >&2
  exit 1
 fi
 echo "==> 部署基线对照"
 echo "    线上提交: ${LIVE_SHA}"
 echo "    候选提交: ${CANDIDATE_SHA}"
 echo "==> 候选相对线上的文件差异"
 DIFF_FILES="$(git diff --name-only "$LIVE_SHA" "$CANDIDATE_SHA" || true)"
 if [ -z "$DIFF_FILES" ]; then
  echo "    （无文件差异）"
 else
  printf '%s\n' "$DIFF_FILES" | sed 's/^/    /'
 fi
 echo "==> 候选将丢失的提交（线上有、候选没有）"
 LOST="$(git log --oneline "$CANDIDATE_SHA".."$LIVE_SHA" || true)"
 if [ -z "$LOST" ]; then
  echo "    （无）"
 else
  printf '%s\n' "$LOST" | sed 's/^/    /'
 fi
 if ! git merge-base --is-ancestor "$LIVE_SHA" "$CANDIDATE_SHA"; then
  echo "拒绝：候选提交不是当前线上提交的后继，部署会丢失线上已有提交。禁止构建或部署。" >&2
  exit 1
 fi
 echo "==> 祖先关系通过：线上 ${LIVE_SHA:0:7} 是候选 ${CANDIDATE_SHA:0:7} 的祖先"
@@ -0,0 +1,110 @@
 #!/usr/bin/env bash
 # 小白复盘服务器本地目录安全更新/构建入口（HEL-235B 固化）
 # 作用：把 /opt/1panel/docker/compose/xiaobaifupan 的 Git 工作目录安全快进到 Gitea main，
 #       校验“本地 HEAD = origin/main = 镜像 revision”后，从本地目录构建带提交号的镜像。
 # 禁止：不从 main 构建；不使用不带提交短号的 tag；本地有改动/落后/分叉时一律停止。
 # 说明：目录顶层归 root，本脚本用“截断写入”绕开 git 对顶层文件 unlink+重建的权限要求；
 #       但 main 新增/删除顶层文件时无法自动处理，会列出需管理员执行的精确清单。
 set -euo pipefail
 GIT_DIR_PATH="$HOME/xiaobai-build/repos/xiaobai-review.git"
 WORK_TREE="/opt/1panel/docker/compose/xiaobaifupan"
 IMAGE_REPO="xiaobai-review"
 LOG_FILE="$HOME/xiaobai-build/BUILD_LOG.tsv"
 MODE="${1:-build}"
 g() { git --git-dir="$GIT_DIR_PATH" --work-tree="$WORK_TREE" "$@"; }
 refuse() { printf '拒绝：%s\n' "$*" >&2; exit 1; }
 [ "$MODE" = "build" ] || [ "$MODE" = "verify-tag" ] || refuse "未知子命令「${MODE}」（可用：build / verify-tag <tag>）"
 [ -d "$GIT_DIR_PATH" ] || refuse "Git 目录不存在：$GIT_DIR_PATH"
 echo "==> 拉取 Gitea origin/main"
 g fetch --quiet origin main || refuse "无法连接 Gitea 拉取 origin/main"
 echo "==> 检查分支与工作区"
 BRANCH="$(g symbolic-ref --short HEAD 2>/dev/null || true)"
 [ "$BRANCH" = "main" ] || refuse "当前不在 main 分支（${BRANCH:-detached}），停止"
 DIRTY="$(g status --porcelain)"
 [ -z "$DIRTY" ] || refuse "本地目录有未提交改动或多余文件，先处理再构建：
 $DIRTY"
 LOCAL_HEAD="$(g rev-parse HEAD)"
 REMOTE_HEAD="$(g rev-parse origin/main)"
 if [ "$LOCAL_HEAD" != "$REMOTE_HEAD" ]; then
  g merge-base --is-ancestor "$LOCAL_HEAD" "$REMOTE_HEAD" \
    || refuse "本地 main 与 origin/main 历史分叉，停止（未改写工作目录）"
  CHANGES="$(g diff --no-renames --name-status HEAD origin/main)"
  TOP_AD="$(printf '%s\n' "$CHANGES" | grep -E "^[AD][[:space:]]+[^/]+$" || true)"
  [ -z "$TOP_AD" ] || refuse "main 相比本地新增/删除了顶层文件，目录顶层归 root，需管理员执行：
 $TOP_AD"
  echo "==> 同步 origin/main 文件（顶层文件保留原 inode，避免目录权限限制）"
  while IFS=$'\t' read -r status path; do
    [ -n "$path" ] || continue
    case "$status" in
      D)
        case "$path" in
          */*) rm -f -- "$WORK_TREE/$path" ;;
          *) refuse "main 删除了顶层文件 $path，需管理员处理" ;;
        esac
        ;;
      A|M)
        MODE_BITS="$(g ls-tree origin/main -- "$path" | awk '{print $1}')"
        case "$MODE_BITS" in
          100644|100755) ;;
          *) refuse "文件 ${path} 的 Git 类型 ${MODE_BITS} 不支持自动同步，需管理员处理" ;;
        esac
        mkdir -p -- "$(dirname "$WORK_TREE/$path")"
        g show "origin/main:$path" > "$WORK_TREE/$path"
        [ "$MODE_BITS" = "100755" ] && chmod 755 "$WORK_TREE/$path" || chmod 644 "$WORK_TREE/$path"
        ;;
      *) refuse "遇到未支持的 Git 变更类型 ${status}：${path}" ;;
    esac
  done <<< "$CHANGES"
  g read-tree origin/main
  g update-ref refs/heads/main "$REMOTE_HEAD" "$LOCAL_HEAD"
  DIRTY="$(g status --porcelain)"
  [ -z "$DIRTY" ] || refuse "快进后工作区仍不一致，停止：
 $DIRTY"
  LOCAL_HEAD="$(g rev-parse HEAD)"
 fi
 [ "$LOCAL_HEAD" = "$REMOTE_HEAD" ] || refuse "本地 HEAD 与 origin/main 不一致，停止"
 SHORT="${LOCAL_HEAD:0:7}"
 echo "==> 校验通过：本地 HEAD = origin/main = ${LOCAL_HEAD}（${SHORT}）"
 if [ "$MODE" = "verify-tag" ]; then
  TAG="${2:?用法: update-from-main.sh verify-tag <tag>}"
  [ "$TAG" = "main-${SHORT}" ] \
    || refuse "镜像标签必须是当前 main 对应的 main-${SHORT}，收到：${TAG}"
  LABEL="$(docker image inspect "${IMAGE_REPO}:${TAG}" \
    --format '{{index .Config.Labels "org.opencontainers.image.revision"}}' 2>/dev/null)" \
    || refuse "镜像 ${IMAGE_REPO}:${TAG} 不存在"
  [ "$LABEL" = "$LOCAL_HEAD" ] || refuse "镜像 revision（${LABEL}）与当前 main（${LOCAL_HEAD}）不一致，禁止部署"
  echo "==> 通过：${IMAGE_REPO}:${TAG} 的 revision 与 main 一致，可以部署"
  exit 0
 fi
 TAG="main-${SHORT}"
 echo "==> 从本地目录构建 ${IMAGE_REPO}:${TAG}"
 docker build --rm -t "${IMAGE_REPO}:${TAG}" \
  --label "org.opencontainers.image.revision=${LOCAL_HEAD}" \
  --label "org.opencontainers.image.created=$(date -u +%Y-%m-%dT%H:%M:%SZ)" \
  "$WORK_TREE" 2>&1 | tail -5
 echo "==> 回读校验镜像 revision"
 GOT="$(docker image inspect "${IMAGE_REPO}:${TAG}" \
  --format '{{index .Config.Labels "org.opencontainers.image.revision"}}')"
 if [ "$GOT" != "$LOCAL_HEAD" ]; then
  docker rmi "${IMAGE_REPO}:${TAG}" >/dev/null 2>&1 || true
  refuse "镜像 revision（${GOT}）与 main（${LOCAL_HEAD}）不一致，已删除镜像"
 fi
 IMAGE_ID="$(docker image inspect "${IMAGE_REPO}:${TAG}" --format '{{.Id}}' | cut -c8-19)"
 mkdir -p "$(dirname "$LOG_FILE")"
 printf '%s\t%s\t%s\t%s\tlocal-worktree\n' \
  "$(date '+%F %T')" "${IMAGE_REPO}:${TAG}" "${LOCAL_HEAD}" "${IMAGE_ID}" >> "$LOG_FILE"
 cat <<EOF
 ==> 完成：${IMAGE_REPO}:${TAG}（revision=${LOCAL_HEAD}）
    部署需人工确认，参考 ~/xiaobai-build/README.md 的换版与回滚步骤。
 EOF
@@ -0,0 +1,6 @@
 #!/usr/bin/env bash
 # 查看服务器本地目录 Git 状态的便捷入口：xiaobai-git status / log / diff 等
 exec git \
  --git-dir="$HOME/xiaobai-build/repos/xiaobai-review.git" \
  --work-tree="/opt/1panel/docker/compose/xiaobaifupan" \
  "$@"
Author	SHA1	Message	Date
总工 Cursor multica-agent	cda13a787f	docs(HEL-272): 用终版项目介绍更新仓库 README 将总工审核通过的项目介绍写入根目录 README，保留本机启动、Docker 与系统配置等必要说明，技术栈保持公开。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-30 20:58:16 +08:00
总管andmultica-agent	6b688fd473	修复(HEL-235B): 可靠同步受限权限工作目录 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 23:29:11 +08:00
总管andmultica-agent	1e8da5fee2	部署(HEL-235B): 补严分叉与镜像标签校验 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 23:27:18 +08:00
总工andmultica-agent	51f410d942	部署(HEL-235B): 服务器本地目录纳入 Git 管理，固化 main 校验构建流程 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 23:22:59 +08:00
总工	a8732f51be	部署集成(HEL-252): 合入登录页动态小人 `4a63ccd`	2026-08-29 21:59:09 +08:00
总工 Cursor multica-agent	4a63ccd10f	feat(HEL-251): 按确认稿实现登录页动态小K线人物在桌面登录门户品牌空白带加入红绿小K线角色，支持焦点、密码遮挡、登录反馈和减少动态效果，且不移动原有文案与行情图。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 21:46:05 +08:00
总工	865d8b0516	部署集成(HEL-244): 合入切换账号返回修复 `d2a165a`	2026-08-29 21:01:12 +08:00
总工 Cursor multica-agent	d2a165ada8	fix(HEL-243): 当前账号可点击返回，避免切换死路当前账号行原先只显示对号、不可点击，单账号时只能关网页。现改为整行继续使用且不重新签发会话，并带回切换前的业务页。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 20:44:18 +08:00
总工	e29d5115fa	部署集成(HEL-241): 合入桌面登录门户返工 aef8a05（含 28px 底部缺口修复）	2026-08-29 20:09:41 +08:00
总工 Cursor multica-agent	aef8a059f2	fix(HEL-240): 去掉登录页底部状态栏缺口登录页覆盖全局 body 底边距，让左栏品牌面板铺满视口高度。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 20:04:22 +08:00
总工 Cursor multica-agent	f905b44675	feat(HEL-240): 按确认样图还原桌面登录页左右骨架把登录门户改回确认稿的品牌行、中下部主标题、底部行情标签和 K 线背景，并让超宽屏按比例展开左栏。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 19:21:13 +08:00
总工 Cursor multica-agent	541fb48c1c	feat(HEL-238): 按确认样图重做手机端系统管理，并加入部署基线门禁 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 17:34:50 +08:00
总工andmultica-agent	2a2d205a38	恢复集成(HEL-237): 并入 HEL-235 安全构建入口工具链（仅构建工具与文档，无运行时影响） Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 16:01:54 +08:00
总工andmultica-agent	34cb32d78f	恢复集成(HEL-237): 以完整基线 `89b8d33` 为底合入登录线 `cefc869` 事故根因：HEL-214/221/226/233 均直接基于 main(`8a5e78f`) 构建部署，绕过了 .11 正式线（HEL-183/188/190/191/192/193/199/207/208 + HEL-164 共 14 个已验收提交），导致问天工具行右对齐、侧栏等高、管理员刷新结果、快照补档、收盘日线修复等整体丢失。本合并以 deploy 前最后完整基线 89b8d33（镜像 official-limit-guard-d9ee725）为底，合入 cefc869（HEL-221 情绪周期等高、HEL-226 登录门户与免密切换、 HEL-233 移动端系统管理五页），三处 CSS 缓存版本统一刷新为 20260829-hel237， architecture-inventory 按合并后源码重新生成。 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 15:51:48 +08:00
总工andmultica-agent	58d2c2fbf6	部署(HEL-235): 修正构建留痕的远端参数传递 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:45:05 +08:00
总工andmultica-agent	585e42dac7	部署(HEL-235): 修复构建后回读校验的远端模板引号 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:44:02 +08:00
总工andmultica-agent	a50d48e5d4	部署(HEL-235): 固化 git 归档流式构建为唯一安全构建入口 Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:43:04 +08:00
总工 Cursor multica-agent	cefc86917d	fix(HEL-233): 去掉系统管理按钮属性多余引号，恢复点击五个无值 data-system-* 属性名后多写了引号，选择器匹配失败导致按钮完全无效。 toast 改为在未打开抽屉时也能挂载，并补源码与真实点击回归。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 13:14:23 +08:00
总工 Cursor multica-agent	13cd9940f7	fix(HEL-233): 恢复移动端系统管理五页，避免再落入占位 nav 里的账号资料/改密/会员/系统设置/会员管理此前从未注册到 pages.js， HEL-227 把用户导向 /m/ 后全部落到占位页。按桌面端已有能力补齐真实页面，并加源码回归防止再次漏注册。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 12:41:38 +08:00
总工	f7cf9a6454	部署集成(HEL-227): 合并登录门户/免密切换(HEL-226)到含 HEL-221 修复的部署线	2026-08-29 11:34:03 +08:00
总工 Cursor multica-agent	f0a1adf52f	施工(HEL-226): 实现登录门户与本机免密切换账号用设备 Cookie 和授权表记住本机已验证账号，登录页按确认样图做成门户，不再把密码写进浏览器。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-29 11:24:39 +08:00
总工 Cursor multica-agent	213f735f6a	fix(HEL-221): 按确认样图实现情绪周期左右等高与夜间提示桌面分析区固定 600px 并 stretch 对齐，评分构成在剩余高度内分配；夜间 tooltip 使用指定深色对比度，图表按容器尺寸重绘且不随视口拉满整页。 Co-authored-by: Cursor <cursoragent@cursor.com> Co-authored-by: multica-agent <github@multica.ai>	2026-08-28 15:01:22 +00:00
总管andmultica-agent	89b8d33de7	fix(HEL-164): 排除构建中的数据库备份 Co-authored-by: multica-agent <github@multica.ai>	2026-08-28 11:32:21 +00:00
总管andmultica-agent	d9ee725744	fix(HEL-164): 拒绝缓存不完整涨停快照 Co-authored-by: multica-agent <github@multica.ai>	2026-08-28 09:44:51 +00:00
总管andmultica-agent	1cb2745867	feat(HEL-164): 显示管理员刷新实际结果 Co-authored-by: multica-agent <github@multica.ai>	2026-08-28 09:29:06 +00:00
总管andmultica-agent	f27471238a	fix(HEL-164): 撤回盘后刷新改动并恢复原逻辑 Co-authored-by: multica-agent <github@multica.ai>	2026-08-28 09:05:42 +00:00