feat(auth): M2 POST /wechat/conflict/rebind(换绑=注销X重建Y,单事务)

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

.env.example

@@ -29,7 +29,7 @@ JG_REQUEST_TIMEOUT_SEC=15
 
 # ===== 无障碍保护存活监控(pull 后置检测;本期不接推送)=====
 HEARTBEAT_MONITOR_ENABLED=true
-HEARTBEAT_TIMEOUT_MINUTES=10
+HEARTBEAT_TIMEOUT_MINUTES=60
 HEARTBEAT_SCAN_INTERVAL_SEC=60
 
 # ===== 短信 (mock 模式) =====

.gitignore

@@ -48,3 +48,12 @@ secrets/*
 # 运行日志(run.sh 输出, 不入库)
 *.log
 logs/
+
+# Claude Code 自动持久化的权限 allowlist / 个人本地设置(会话专属,不入库)。
+# 需要团队共享的 Claude 配置(commands/ 等)可单独 git add -f,不受此忽略影响。
+.claude/settings.json
+.claude/settings.local.json
+tests/meituan_coupon_bj.tsv
+tests/meituan_coupon_data.tsv
+tests/meituan_coupon_fz.tsv
+tests/meituan_coupon_xm.tsv

alembic/versions/11c44afbea58_analytics_selfstat_tables.py

@@ -0,0 +1,72 @@
+"""analytics_selfstat tables
+
+Revision ID: 11c44afbea58
+Revises: admin_user_plain_password
+Create Date: 2026-07-08 16:32:49.351817
+
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+
+# revision identifiers, used by Alembic.
+revision: str = '11c44afbea58'
+down_revision: str | Sequence[str] | None = 'admin_user_plain_password'
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'analytics_selfstat',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('device_id', sa.String(length=64), nullable=False),
+        sa.Column('epoch_id', sa.String(length=64), nullable=False),
+        sa.Column('app_ver', sa.String(length=32), nullable=True),
+        sa.Column('oem', sa.String(length=32), nullable=True),
+        sa.Column('os', sa.String(length=32), nullable=True),
+        sa.Column('batches_attempted', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.Column('batches_ok', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.Column('batches_fail', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.Column('retries', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.Column('queue_depth', sa.Integer(), nullable=False, server_default='0'),
+        sa.Column('sent_at', sa.BigInteger(), nullable=True),
+        sa.Column('created_at', sa.DateTime(timezone=True),
+                  server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    with op.batch_alter_table('analytics_selfstat', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_analytics_selfstat_created_at'), ['created_at'], unique=False)
+        batch_op.create_index(batch_op.f('ix_analytics_selfstat_device_id'), ['device_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_analytics_selfstat_epoch_id'), ['epoch_id'], unique=False)
+
+    op.create_table(
+        'analytics_selfstat_event',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('snapshot_id', sa.Integer(), nullable=False),
+        sa.Column('event', sa.String(length=64), nullable=False),
+        sa.Column('attempted', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.Column('drop_capture', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.Column('delivered', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.Column('drop_undelivered', sa.BigInteger(), nullable=False, server_default='0'),
+        sa.ForeignKeyConstraint(['snapshot_id'], ['analytics_selfstat.id'], ),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    with op.batch_alter_table('analytics_selfstat_event', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_analytics_selfstat_event_event'), ['event'], unique=False)
+        batch_op.create_index(batch_op.f('ix_analytics_selfstat_event_snapshot_id'), ['snapshot_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('analytics_selfstat_event', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_analytics_selfstat_event_snapshot_id'))
+        batch_op.drop_index(batch_op.f('ix_analytics_selfstat_event_event'))
+    op.drop_table('analytics_selfstat_event')
+    with op.batch_alter_table('analytics_selfstat', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_analytics_selfstat_epoch_id'))
+        batch_op.drop_index(batch_op.f('ix_analytics_selfstat_device_id'))
+        batch_op.drop_index(batch_op.f('ix_analytics_selfstat_created_at'))
+    op.drop_table('analytics_selfstat')

alembic/versions/761ef181ce7c_merge_jd_cps_order_fields_and_coupon_.py

@@ -0,0 +1,26 @@
+"""merge jd_cps_order_fields and coupon_session_origin_package heads
+
+Revision ID: 761ef181ce7c
+Revises: coupon_session_origin_package, jd_cps_order_fields
+Create Date: 2026-07-01 13:52:16.068808
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '761ef181ce7c'
+down_revision: Union[str, Sequence[str], None] = ('coupon_session_origin_package', 'jd_cps_order_fields')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/ad_ecpm_trace_id.py

@@ -0,0 +1,44 @@
+"""ad_ecpm_record.trace_id(展示收益归属到比价/领券 trace)
+
+信息流(Draw)展示 eCPM 上报时带上本场比价/领券 trace_id,落此列;领券数据 / 比价记录看板
+按 trace_id 聚合"本次广告收益"。激励视频/福利/旧客户端为 NULL。
+
+本迁移原以 (11c44afbea58, merge_pages_override_coupon_slot) 为双亲、顺带收敛双 head,
+但与它并行落 main 的 merge_selfstat_coupon_slot 已用同一对双亲做了纯收敛 → 同一对
+父节点出现两个收敛点、main 上又成双 head。故重挂到该 merge 之后成单链(仅改链接、
+schema 改动不变;两文件都保留,已 stamp 在 merge 上的库可直接线性升级)。
+
+Revision ID: ad_ecpm_trace_id
+Revises: merge_selfstat_coupon_slot
+Create Date: 2026-07-10
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "ad_ecpm_trace_id"
+down_revision: Union[str, Sequence[str], None] = "merge_selfstat_coupon_slot"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # SQLite 下 ADD COLUMN(可空)与 CREATE INDEX 均原生支持,无需 batch_alter_table
+    # (同 ad_feed_reward_trace_id 迁移)。
+    op.add_column(
+        "ad_ecpm_record",
+        sa.Column("trace_id", sa.String(length=64), nullable=True),
+    )
+    op.create_index(
+        op.f("ix_ad_ecpm_record_trace_id"),
+        "ad_ecpm_record",
+        ["trace_id"],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_ad_ecpm_record_trace_id"), table_name="ad_ecpm_record")
+    op.drop_column("ad_ecpm_record", "trace_id")

alembic/versions/admin_role_table.py

@@ -0,0 +1,69 @@
+"""admin_role 表(RBAC 角色 → 可见页面)+ 种子内建角色
+
+新增后台 RBAC:角色持有一组页面 key,登录后左侧只展示这些页。super_admin 内建全权(pages 存空、
+effective_pages 特判为全部)、不可编辑删除;operator/finance 播默认页集,可由 super_admin 增删改。
+admin_user.role 弱引用本表 name。全新环境顺序应用即得三条内建角色。
+
+Revision ID: admin_role_table
+Revises: comparison_product_names
+Create Date: 2026-07-04 00:00:00.000000
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+revision: str = "admin_role_table"
+down_revision: str | Sequence[str] | None = "comparison_product_names"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+_JSON = sa.JSON().with_variant(postgresql.JSONB(), "postgresql")
+
+# 与 app/admin/permissions.py 的 BUILTIN_ROLES 同口径(迁移内联一份,不耦合 app 常量)。
+# 页集对齐 Prototypes/dashboard/permissions.md 的 ROLES。key 承重(require_role),label 为展示名。
+_BUILTIN = [
+    {"name": "super_admin", "label": "管理员", "pages": [], "is_builtin": True},
+    {"name": "operator", "label": "运营", "pages": [
+        "dashboard", "coupon-data", "ad-revenue-report", "comparison-records",
+        "cps", "device-liveness", "price-reports", "feedbacks",
+    ], "is_builtin": False},
+    {"name": "finance", "label": "财务", "pages": [
+        "dashboard", "ad-revenue-report", "cps", "withdraws",
+    ], "is_builtin": False},
+    {"name": "tech", "label": "技术", "pages": [
+        "dashboard", "device-liveness", "config", "ad-revenue", "event-logs", "audit-logs",
+    ], "is_builtin": False},
+]
+
+
+def upgrade() -> None:
+    op.create_table(
+        "admin_role",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("name", sa.String(length=32), nullable=False),
+        sa.Column("label", sa.String(length=32), nullable=False, server_default=""),
+        sa.Column("pages", _JSON, nullable=False),
+        sa.Column("is_builtin", sa.Boolean(), nullable=False, server_default=sa.false()),
+        sa.Column(
+            "created_at", sa.DateTime(timezone=True),
+            server_default=sa.func.now(), nullable=False,
+        ),
+    )
+    op.create_index("ix_admin_role_name", "admin_role", ["name"], unique=True)
+
+    tbl = sa.table(
+        "admin_role",
+        sa.column("name", sa.String),
+        sa.column("label", sa.String),
+        sa.column("pages", _JSON),
+        sa.column("is_builtin", sa.Boolean),
+    )
+    op.bulk_insert(tbl, _BUILTIN)
+
+
+def downgrade() -> None:
+    op.drop_index("ix_admin_role_name", table_name="admin_role")
+    op.drop_table("admin_role")

alembic/versions/admin_user_pages_override.py

@@ -0,0 +1,35 @@
+"""admin_user 加 pages_override 列(「自定义」权限:按人存专属可见页 key 列表)
+
+权限管理页新增「自定义」角色:选它时该成员的可见页不跟随任何共享角色,而由逐页勾选决定,
+存这个人专属的一份页 key 列表。仅 role == "custom" 时有效;普通角色为 None(可见页跟随角色)。
+PG 用 JSONB,SQLite 退化为通用 JSON(同 admin_audit_log.detail / comparison_record.raw_payload)。
+
+Revision ID: admin_user_pages_override
+Revises: admin_user_plain_password
+Create Date: 2026-07-08 00:00:00.000000
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects.postgresql import JSONB
+
+from alembic import op
+
+revision: str = "admin_user_pages_override"
+down_revision: str | Sequence[str] | None = "admin_user_plain_password"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+# 与 app/models/admin.py 的 _JSON 一致:PG JSONB / 其它 JSON
+_JSON = sa.JSON().with_variant(JSONB(), "postgresql")
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("admin_user", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("pages_override", _JSON, nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("admin_user", schema=None) as batch_op:
+        batch_op.drop_column("pages_override")

alembic/versions/admin_user_plain_password.py

@@ -0,0 +1,29 @@
+"""admin_user 加 plain_password 列(明文登录密码,仅后台 UI 建/重置的账号留存)
+
+权限管理页需能复看某成员已确定的登录密码转交本人。系统只存哈希无法反推,故对「后台 UI 创建/重置」
+的管理员额外留存一份明文;脚本/起后台建的超管为 None(前端不显示密码)。旧账号无此列值 → 同样不显示。
+
+Revision ID: admin_user_plain_password
+Revises: admin_role_table
+Create Date: 2026-07-04 00:00:00.000000
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "admin_user_plain_password"
+down_revision: str | Sequence[str] | None = "admin_role_table"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("admin_user", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("plain_password", sa.String(length=128), nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("admin_user", schema=None) as batch_op:
+        batch_op.drop_column("plain_password")

alembic/versions/comparison_llm_cost.py

@@ -0,0 +1,33 @@
+"""comparison_record: llm_cost_yuan + llm_price_snapshot(比价 LLM 调用成本 + 当时单价快照)
+
+回填 llm_calls 时按「当时的价」逐模型算出本次比价 LLM 总成本(元),连同所用单价快照一起冻结到
+记录上;admin 比价记录详情展示实际成本(旧记录 NULL → 前端回退估算)。见 services/llm_cost.py。
+
+Revision ID: comparison_llm_cost
+Revises: ad_ecpm_trace_id
+Create Date: 2026-07-13
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+revision: str = "comparison_llm_cost"
+down_revision: str | Sequence[str] | None = "ad_ecpm_trace_id"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+_JSONB = sa.JSON().with_variant(postgresql.JSONB(), "postgresql")
+
+
+def upgrade() -> None:
+    # 均可空、无索引;SQLite 原生支持 ADD COLUMN,无需 batch_alter_table(同 comparison_debug_fields)。
+    op.add_column("comparison_record", sa.Column("llm_cost_yuan", sa.Float(), nullable=True))
+    op.add_column("comparison_record", sa.Column("llm_price_snapshot", _JSONB, nullable=True))
+
+
+def downgrade() -> None:
+    op.drop_column("comparison_record", "llm_price_snapshot")
+    op.drop_column("comparison_record", "llm_cost_yuan")

alembic/versions/comparison_product_names.py

@@ -0,0 +1,70 @@
+"""comparison_record 加 product_names 列(下单商品名派生串)+ 回填历史行
+
+admin 比价记录页要把原「店/商品」一列拆成「店」+「商品」两列、并支持按商品名搜索。
+items 是 JSON(SQLite 下 json.dumps ensure_ascii 会把中文转义存成 \\uXXXX,无法直接 CAST+LIKE
+命中中文),故把商品名派生成普通文本列,跨库 LIKE 一致、可索引。
+
+写路径(upsert_record / harvest_done)已同步派生;本迁移建列并从已存 items 回填历史行。
+全新环境顺序应用即得空列 + 回填(表本为空,回填 no-op)。
+
+Revision ID: comparison_product_names
+Revises: comparison_record_trace_unique
+Create Date: 2026-07-04 00:00:00.000000
+"""
+
+import json
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "comparison_product_names"
+down_revision: str | Sequence[str] | None = "comparison_record_trace_unique"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def _product_names(items) -> str | None:
+    """items([{name,...}]) → 顿号分隔的商品名串(去重保序)。与 repositories.comparison
+    ._product_names_from_items 同口径,迁移内联一份避免耦合 app 代码。"""
+    if isinstance(items, str):  # SQLite: items 以 JSON 文本存,取回是 str
+        try:
+            items = json.loads(items)
+        except (ValueError, TypeError):
+            return None
+    if not isinstance(items, list) or not items:
+        return None
+    names: list[str] = []
+    for it in items:
+        name = it.get("name") if isinstance(it, dict) else None
+        if not name:
+            continue
+        s = str(name).strip()
+        if s and s not in names:
+            names.append(s)
+    joined = "、".join(names)
+    return joined[:500] or None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("comparison_record", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("product_names", sa.String(length=512), nullable=True))
+
+    # 回填:从已存 items 派生商品名。items 小(菜名列表),一次取回即可;只更新有商品名的行。
+    bind = op.get_bind()
+    rows = bind.execute(
+        sa.text("SELECT id, items FROM comparison_record")
+    ).fetchall()
+    for rid, items in rows:
+        pn = _product_names(items)
+        if pn:
+            bind.execute(
+                sa.text("UPDATE comparison_record SET product_names = :pn WHERE id = :id"),
+                {"pn": pn, "id": rid},
+            )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("comparison_record", schema=None) as batch_op:
+        batch_op.drop_column("product_names")

alembic/versions/comparison_record_trace_unique.py

@@ -0,0 +1,49 @@
+"""comparison_record: 唯一键 (user_id,trace_id) → trace_id 单列 + user_id 可空
+
+Revision ID: comparison_record_trace_unique
+Revises: feedback_type_reply
+Create Date: 2026-07-03 12:00:00.000000
+
+比价记录改「后端 harvest」：app-server 在帧0(pricebot 出 trace_id)即建行，随 done/finalize
+逐步补全，客户端不再 POST 记录。故本表要两处调整：
+  1. user_id 改**可空**——harvest 建行那刻(软鉴权 / 老客户端匿名)可能还没有 user_id。
+  2. 唯一键 (user_id, trace_id) → **trace_id 单列**——trace_id 由 app-server 签发、全局唯一，
+     一次比价一行；harvest 建行时 user_id 还没有，不能再用复合键去重。
+
+⚠️ 上线前(QA)务必确认 comparison_record 无重复 trace_id：旧复合唯一键**允许**同 trace_id
+   跨不同 user_id（实际上客户端 UUID 从不重复，但约束没拦），若真有重复,建 trace 单列唯一会失败。
+   查:  SELECT trace_id, COUNT(*) c FROM comparison_record GROUP BY trace_id HAVING c > 1;
+
+SQLite 不支持直接 drop/alter 约束/列，用 batch_alter_table（建临时表+拷数据+换名），
+与 coupon_engage_per_package / store_mapping_* 同款；Postgres 直接执行原生 ALTER。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'comparison_record_trace_unique'
+down_revision: Union[str, Sequence[str], None] = 'feedback_type_reply'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        # harvest 帧0 建行时 user_id 可能暂缺 → 放开非空。
+        batch_op.alter_column('user_id', existing_type=sa.Integer(), nullable=True)
+        # 复合唯一 → trace_id 单列唯一。
+        batch_op.drop_constraint('uq_comparison_user_trace', type_='unique')
+        batch_op.create_unique_constraint('uq_comparison_trace', ['trace_id'])
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        batch_op.drop_constraint('uq_comparison_trace', type_='unique')
+        batch_op.create_unique_constraint(
+            'uq_comparison_user_trace', ['user_id', 'trace_id']
+        )
+        # 回退非空前提是当时无 null user_id 行(harvest 期可能有孤儿行,回滚需先清理)。
+        batch_op.alter_column('user_id', existing_type=sa.Integer(), nullable=False)

alembic/versions/coupon_claim_app_env.py

@@ -0,0 +1,32 @@
+"""coupon_claim_record 加 app_env 列(领券所属 session 环境;每券成功率表按它过滤 prod/dev)
+
+Revision ID: coupon_claim_app_env
+Revises: coupon_session_platform_success
+Create Date: 2026-07-08 00:00:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+revision: str = "coupon_claim_app_env"
+down_revision: str | Sequence[str] | None = "coupon_session_platform_success"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("coupon_claim_record", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("app_env", sa.String(length=16), nullable=True))
+        batch_op.create_index(
+            "ix_coupon_claim_record_app_env", ["app_env"], unique=False
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("coupon_claim_record", schema=None) as batch_op:
+        batch_op.drop_index("ix_coupon_claim_record_app_env")
+        batch_op.drop_column("app_env")

alembic/versions/coupon_session_platform_success.py

@@ -0,0 +1,37 @@
+"""coupon_session 加 platform_success 列(本次至少领到一张的平台 id 列表)
+
+供 admin「领券数据」算 ②整单成功率 / ③点位成功率(平台粒度)。数据落点:服务端 /step 逐帧
+按 trace_id 并集写入(见 app/repositories/coupon_state.merge_session_platform_success)。旧行 NULL
+视作空集,已建表环境靠它补列、全新环境顺序应用不重复加列。设计:docs/guides/领券成功率指标-设计与埋点.md。
+
+Revision ID: coupon_session_platform_success
+Revises: admin_user_plain_password
+Create Date: 2026-07-07 00:00:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "coupon_session_platform_success"
+down_revision: str | Sequence[str] | None = "admin_user_plain_password"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+# PG 用 JSONB,SQLite(本地/测试)退化为通用 JSON(同 model 的 _JSON variant / 建表迁移)。
+_JSON = sa.JSON().with_variant(postgresql.JSONB(), "postgresql")
+
+
+def upgrade() -> None:
+    with op.batch_alter_table("coupon_session", schema=None) as batch_op:
+        batch_op.add_column(sa.Column("platform_success", _JSON, nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("coupon_session", schema=None) as batch_op:
+        batch_op.drop_column("platform_success")

alembic/versions/feedback_type_reply.py

@@ -0,0 +1,48 @@
+"""feedback 加反馈来源/场景/运营回复(source / scene / admin_reply)
+
+admin「用户反馈」页要展示并筛选「反馈类型」(比价反馈 / 普通反馈),并支持审核时给用户留言:
+  - source: 反馈来源入口(profile=「我的」页 / comparison=比价结果页)。NOT NULL,
+    旧数据 + 普通反馈默认 profile(server_default)。加索引供 admin 按类型筛选。
+  - scene: 比价反馈的问题场景(找错商品/优惠不对…),普通反馈为 NULL。
+  - admin_reply: 运营给用户的回复留言(用户端可见),随「我的反馈」历史下发。
+
+均为新增列(SQLite 原生支持 add_column);downgrade 的 drop_column 在 SQLite 走 batch 兜底。
+
+Revision ID: feedback_type_reply
+Revises: 761ef181ce7c
+Create Date: 2026-07-02 00:00:00.000000
+"""
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "feedback_type_reply"
+down_revision: str | Sequence[str] | None = "761ef181ce7c"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "feedback",
+        sa.Column(
+            "source",
+            sa.String(length=16),
+            nullable=False,
+            server_default="profile",
+        ),
+    )
+    op.add_column("feedback", sa.Column("scene", sa.String(length=32), nullable=True))
+    op.add_column("feedback", sa.Column("admin_reply", sa.String(length=256), nullable=True))
+    op.create_index("ix_feedback_source", "feedback", ["source"])
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("feedback") as batch_op:
+        batch_op.drop_index("ix_feedback_source")
+        batch_op.drop_column("admin_reply")
+        batch_op.drop_column("scene")
+        batch_op.drop_column("source")

alembic/versions/merge_pages_override_coupon_slot.py

@@ -0,0 +1,28 @@
+"""合并两个 alembic head:admin_user_pages_override(#126 权限)+ coupon_claim_app_env(领券成功率)。
+
+两条迁移都从 admin_user_plain_password 分叉——#126 经 pull main 进入本分支,领券成功率为本分支新增——
+于是出现两个 head。本迁移仅把二者收敛成单 head,让 `alembic upgrade head`(单数,部署/run.sh 用)
+恢复正常;**不含任何表结构 / 数据改动**(纯 merge)。
+
+Revision ID: merge_pages_override_coupon_slot
+Revises: admin_user_pages_override, coupon_claim_app_env
+Create Date: 2026-07-09 00:00:00.000000
+"""
+
+from collections.abc import Sequence
+
+revision: str = "merge_pages_override_coupon_slot"
+down_revision: str | Sequence[str] | None = (
+    "admin_user_pages_override",
+    "coupon_claim_app_env",
+)
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """纯合并 head,无 schema 改动。"""
+
+
+def downgrade() -> None:
+    """拆回两个 head,无 schema 改动。"""

alembic/versions/merge_selfstat_coupon_slot.py

@@ -0,0 +1,29 @@
+"""合并两个 alembic head:11c44afbea58(#127 埋点健康度 selfstat)+ merge_pages_override_coupon_slot(#130 自带的合并迁移)。
+
+三条分支都从 admin_user_plain_password 分叉(#126 权限 / #127 selfstat / #130 领券成功率)。
+#130 自带的 merge 创建时本地 main 尚无 #127 的 11c44afbea58,只收敛了 #126 + 自身两条,
+#130 合入后 main 上仍留两个 head → `alembic upgrade head`(单数,部署/run.sh 用)直接报错、服务起不来。
+本迁移仅把二者收敛成单 head;**不含任何表结构 / 数据改动**(纯 merge)。
+
+Revision ID: merge_selfstat_coupon_slot
+Revises: 11c44afbea58, merge_pages_override_coupon_slot
+Create Date: 2026-07-10 00:00:00.000000
+"""
+
+from collections.abc import Sequence
+
+revision: str = "merge_selfstat_coupon_slot"
+down_revision: str | Sequence[str] | None = (
+    "11c44afbea58",
+    "merge_pages_override_coupon_slot",
+)
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    """纯合并 head,无 schema 改动。"""
+
+
+def downgrade() -> None:
+    """拆回两个 head,无 schema 改动。"""

alembic/versions/phone_rebind_log.py

@@ -0,0 +1,32 @@
+"""phone_rebind_log 表(M2 换绑 30 天限制台账)
+
+Revision ID: phone_rebind_log
+Revises: comparison_llm_cost
+"""
+from alembic import op
+import sqlalchemy as sa
+
+revision = "phone_rebind_log"
+down_revision = "comparison_llm_cost"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "phone_rebind_log",
+        sa.Column("id", sa.Integer(), primary_key=True, autoincrement=True),
+        sa.Column("phone", sa.String(length=20), nullable=False),
+        sa.Column("old_user_id", sa.Integer(), nullable=True),
+        sa.Column("new_user_id", sa.Integer(), nullable=False),
+        sa.Column("source", sa.String(length=32), nullable=False, server_default="wechat_conflict"),
+        sa.Column("rebound_at", sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+    )
+    op.create_index("ix_phone_rebind_log_phone", "phone_rebind_log", ["phone"])
+    op.create_index("ix_phone_rebind_log_rebound_at", "phone_rebind_log", ["rebound_at"])
+
+
+def downgrade() -> None:
+    op.drop_index("ix_phone_rebind_log_rebound_at", table_name="phone_rebind_log")
+    op.drop_index("ix_phone_rebind_log_phone", table_name="phone_rebind_log")
+    op.drop_table("phone_rebind_log")

app/admin/main.py

@@ -26,12 +26,14 @@ from app.admin.routers.cps import router as cps_router
 from app.admin.routers.dashboard import router as dashboard_router
 from app.admin.routers.device_liveness import router as device_liveness_router
 from app.admin.routers.ops_stat_config import router as ops_stat_config_router
+from app.admin.routers.analytics_health import router as analytics_health_router
 from app.admin.routers.event_logs import router as event_logs_router
 from app.admin.routers.feedback import router as feedback_router
 from app.admin.routers.feedback_qr import router as feedback_qr_router
 from app.admin.routers.onboarding import router as onboarding_router
 from app.admin.routers.ops_marquee_seed import router as ops_marquee_seed_router
 from app.admin.routers.price_report import router as price_report_router
+from app.admin.routers.roles import router as roles_router
 from app.admin.routers.users import router as users_router
 from app.admin.routers.wallet import router as wallet_router
 from app.admin.routers.withdraw import router as withdraw_router
@@ -96,8 +98,10 @@ admin_app.include_router(withdraw_router)
 admin_app.include_router(price_report_router)
 admin_app.include_router(feedback_router)
 admin_app.include_router(event_logs_router)
+admin_app.include_router(analytics_health_router)
 admin_app.include_router(feedback_qr_router)
 admin_app.include_router(admins_router)
+admin_app.include_router(roles_router)
 admin_app.include_router(audit_router)
 admin_app.include_router(config_router)
 admin_app.include_router(comparison_router)

app/admin/permissions.py

@@ -0,0 +1,83 @@
+"""admin 后台「页面权限目录」—— RBAC 的权限侧单一真源。
+
+一个权限 = 一个页面(= 左侧导航项)。角色持有一组 page key,登录后左侧只展示这些页(见前端
+layout.tsx 按 pages 过滤导航)。key 必须与前端路由一级对齐(/dashboard → "dashboard")。
+
+super_admin 为内建全权角色,恒可见全部页(effective_pages 特判)。新增页面 = 这里加一条 +
+前端导航加对应项(key 一致即可被各角色勾选可见)。
+"""
+from __future__ import annotations
+
+SUPER_ADMIN_ROLE = "super_admin"
+# 「自定义」哨兵角色:不是 admin_role 表里的行,而是标记「这个人的可见页由 pages_override 决定」。
+# admin_user.role == CUSTOM_ROLE 时,有效可见页取 admin_user.pages_override(见 auth._admin_out_with_pages)。
+CUSTOM_ROLE = "custom"
+
+# 分组镜像前端导航(app/(main)/layout.tsx 的 NAV_GROUPS);key = 路由一级
+PERMISSION_CATALOG: list[dict] = [
+    {"group": "看板", "pages": [
+        {"key": "dashboard", "label": "数据大盘"},
+        {"key": "coupon-data", "label": "领券数据"},
+        {"key": "ad-revenue-report", "label": "广告收益"},
+        {"key": "comparison-records", "label": "比价记录"},
+        {"key": "cps", "label": "CPS收益"},
+        {"key": "device-liveness", "label": "设备存活"},
+    ]},
+    {"group": "奖励审核", "pages": [
+        {"key": "withdraws", "label": "提现审核"},
+        {"key": "price-reports", "label": "低价审核"},
+        {"key": "feedbacks", "label": "用户反馈"},
+    ]},
+    {"group": "数据配置", "pages": [
+        {"key": "config", "label": "系统配置"},
+        {"key": "ad-revenue", "label": "广告配置"},
+        {"key": "users", "label": "用户管理"},
+    ]},
+    {"group": "其他", "pages": [
+        {"key": "admins", "label": "权限管理"},
+        {"key": "event-logs", "label": "埋点日志"},
+        {"key": "audit-logs", "label": "审计日志"},
+    ]},
+]
+
+# 全部页面 key(super_admin 有效可见 = 此全集;也用于校验角色 pages 合法性)
+ALL_PAGE_KEYS: list[str] = [p["key"] for g in PERMISSION_CATALOG for p in g["pages"]]
+_ALL_SET = set(ALL_PAGE_KEYS)
+
+# 内建角色定义(种子 / ensure 兜底的单一真源):(key, 中文展示名, 默认可见页)。
+# 页集对齐 Prototypes/dashboard/permissions.md 的 ROLES;super_admin 恒全权(pages 空、bypass)。
+# key 承重(require_role / admin_user.role),勿改;label 为 UI 展示名。
+BUILTIN_ROLES: list[dict] = [
+    {"name": SUPER_ADMIN_ROLE, "label": "管理员", "pages": []},
+    {"name": "operator", "label": "运营", "pages": [
+        "dashboard", "coupon-data", "ad-revenue-report", "comparison-records",
+        "cps", "device-liveness", "price-reports", "feedbacks",
+    ]},
+    {"name": "finance", "label": "财务", "pages": [
+        "dashboard", "ad-revenue-report", "cps", "withdraws",
+    ]},
+    {"name": "tech", "label": "技术", "pages": [
+        "dashboard", "device-liveness", "config", "ad-revenue", "event-logs", "audit-logs",
+    ]},
+]
+
+# 内建 key → 中文展示名(展示 / 自愈用)
+BUILTIN_LABELS: dict[str, str] = {r["name"]: r["label"] for r in BUILTIN_ROLES}
+
+
+def sanitize_pages(pages: list[str] | None) -> list[str]:
+    """过滤掉不在目录里的 key(去重、保序),防脏数据/目录收缩后的悬空 key。"""
+    seen: set[str] = set()
+    out: list[str] = []
+    for k in pages or []:
+        if k in _ALL_SET and k not in seen:
+            seen.add(k)
+            out.append(k)
+    return out
+
+
+def effective_pages(role_name: str, role_pages: list[str] | None) -> list[str]:
+    """某角色的有效可见页:super_admin → 全部;其余 → 其 pages 与目录取交(自愈悬空 key)。"""
+    if role_name == SUPER_ADMIN_ROLE:
+        return list(ALL_PAGE_KEYS)
+    return sanitize_pages(role_pages)

app/admin/repositories/ad_audit.py

@@ -136,12 +136,16 @@ def _feed_scene_matches(rec: AdFeedRewardRecord, scene: str | None) -> bool:
     """该信息流记录是否落入请求的展示筛选 scene。
     - scene=="feed":ad_type in ("feed", NULL)(旧数据 NULL 视为 feed,向后兼容)
     - scene=="draw":ad_type=="draw"
+    - scene=="feed_all":所有信息流(feed/draw/NULL 都要)——业务已全切 Draw 信息流,收益报表把「Draw 信息流」
+      当作整个信息流口径(含历史误标 feed/NULL),用它避免筛选漏历史。
     - scene 为 None:不筛(两类都要)。
     """
     if scene == "feed":
         return rec.ad_type in (None, "feed")
     if scene == "draw":
         return rec.ad_type == "draw"
+    if scene == "feed_all":
+        return True
     return True
 
 
@@ -184,6 +188,7 @@ def _feed_rows(
                 "record_id": rec.id,
                 "user_id": rec.user_id,
                 "ad_session_id": rec.ad_session_id,
+                "trace_id": rec.trace_id,
                 "app_env": rec.app_env,
                 "our_code_id": rec.our_code_id,
                 "created_at": rec.created_at,
@@ -209,6 +214,7 @@ def _feed_rows(
                 "record_id": rec.id,
                 "user_id": rec.user_id,
                 "ad_session_id": rec.ad_session_id,
+                "trace_id": rec.trace_id,
                 "app_env": rec.app_env,
                 "our_code_id": rec.our_code_id,
                 "created_at": rec.created_at,
@@ -241,7 +247,7 @@ def audit_rows(
     rows: list[dict] = []
     if scene in (None, "reward_video"):
         rows.extend(_reward_video_rows(db, date=date, user_id=user_id))
-    if scene in (None, "feed", "draw"):
+    if scene in (None, "feed", "draw", "feed_all"):
         rows.extend(_feed_rows(db, date=date, user_id=user_id, scene=scene))
     return rows
 

app/admin/repositories/ad_revenue.py

@@ -3,9 +3,11 @@
 只读。每行 = 一次广告事件(不再按用户聚合):
 - **激励视频**:一次观看 = 1 条展示(ad_ecpm)+ 1 条发奖(ad_reward),按 ad_session_id 合并成一行,
   直接给出 eCPM / 收益 + 状态 / 应发 / 实发 / 一致;点开看该条金币复算因子。
-- **信息流**:轮播每条展示各一行(impressionId 各自独立);整场发奖(ad_feed_reward,client_event_id)
-  与逐条展示无法对应,单独成「纯发奖」行。
-- 兜底:有展示无发奖(中途关 / 未达发奖)、有发奖无展示(未上报 eCPM)都各自成行。
+- **信息流(比价/领券)**:一次比价 / 一次领券 = 一条整场发奖(ad_feed_reward)一行,给出 eCPM /
+  发奖金币 + 应发 / 实发 / 一致;点开看金币复算因子。⚠️ draw 的逐条展示(ad_ecpm,impressionId 各自
+  独立、与整场发奖无公共键、无法归到「哪一次」)**不再单独占行**(2026-07 按「一次比价/领券放一块」调整)——
+  其展示数 / eCPM / 预估收益仍进全量统计(合计 / 趋势 / 分类大盘 / 穿山甲对照),只是主表不逐条铺开。
+- 兜底:激励视频有展示无发奖(中途关 / 未达发奖)、有发奖无展示(未上报 eCPM)仍各自成行。
 
 展示与收益来自 ad_ecpm_record(收益 = eCPM元 ÷ 1000);应发 / 实发金币复用金币审计逐条复算
 (ad_audit.audit_rows,与正式发奖同一公式口径,不另写公式)。合计与对账在全量上统计,
@@ -58,14 +60,6 @@ def _date_range(date_from: str, date_to: str) -> list[str]:
 _AUDIT_SCENES = {"reward_video", "feed", "draw"}
 
 
-def _event_ad_type(row: dict) -> str:
-    """纯发奖事件行的 ad_type:信息流行用 audit 带回的真实 ad_type(feed/draw),回退 feed;
-    激励视频行恒 reward_video。不再用 scene 硬映射,避免把 draw 丢成 feed。"""
-    if row["scene"] == "reward_video":
-        return "reward_video"
-    return row.get("ad_type") or "feed"
-
-
 # 发奖复算明细字段(展开下钻看「金币怎么算出来的」)——从 audit 行原样取这些 key。
 _REWARD_DETAIL_KEYS = (
     "record_id", "created_at", "status", "ecpm", "ecpm_factor", "units",
@@ -108,9 +102,14 @@ def ad_revenue_report(
     #    同时保留全量列表,未被展示合并的成「纯发奖」事件。
     reward_by_session: dict[tuple[int, str], list[dict]] = {}
     all_reward_rows: list[dict] = []
-    # 报表 ad_type 直接当 audit scene 用(取值一致);未知/无效 ad_type 不取发奖行。draw 在此被
-    # 正确传成 scene="draw",audit 会按 ad_type 筛出 Draw 发奖,不再丢成 feed。
-    audit_scene = ad_type if ad_type in _AUDIT_SCENES else None
+    # 报表 ad_type → audit scene:reward_video/feed 直传;**draw(前端「Draw 信息流」)映射成 feed_all**
+    # ——业务已全切 Draw,把「Draw 信息流」当作整个信息流口径(含历史误标 feed/NULL),否则筛选会漏历史。
+    if ad_type == "draw":
+        audit_scene = "feed_all"
+    elif ad_type in _AUDIT_SCENES:
+        audit_scene = ad_type
+    else:
+        audit_scene = None
     if ad_type is None or audit_scene is not None:
         for d in _date_range(date_from, date_to):
             for row in ad_audit.audit_rows(db, date=d, user_id=user_id, scene=audit_scene):
@@ -140,7 +139,10 @@ def ad_revenue_report(
     )
     if user_id is not None:
         stmt = stmt.where(AdEcpmRecord.user_id == user_id)
-    if ad_type is not None:
+    if ad_type == "draw":
+        # draw = 所有信息流展示(业务已全 Draw,含历史误标 feed);展示行只进统计,不占主表行
+        stmt = stmt.where(AdEcpmRecord.ad_type.in_(["draw", "feed"]))
+    elif ad_type is not None:
         stmt = stmt.where(AdEcpmRecord.ad_type == ad_type)
     for rec in db.execute(stmt).scalars():
         rwd = _pop_reward(rec.user_id, rec.ad_session_id)
@@ -165,6 +167,8 @@ def ad_revenue_report(
             ),
             "adn": rec.adn,
             "slot_id": rec.slot_id,
+            "sub_rewards": [],
+            "sub_count": 1,
         }
         if rwd is not None:
             ev.update({
@@ -184,33 +188,88 @@ def ad_revenue_report(
             })
         events.append(ev)
 
-    # 3) 未被展示合并的发奖行 → 「纯发奖」事件(信息流整场发奖 / 有发奖无展示)。
-    #    收益恒 0(收益只算展示侧,避免与展示行重复计)。
+    # 3) 未被展示合并的发奖行 → 事件:
+    #    - 激励视频(reward_video):逐条成「纯发奖」事件(每次一个 ad_session_id;有发奖无展示等)。
+    #    - 信息流(feed/draw):同一次比价/领券的多条广告共享**整场 ad_session_id**(客户端整场复用),
+    #      按 (user_id, ad_session_id) 聚成**一次比价 / 一次领券**父事件;sub_rewards 为组内逐条明细,
+    #      应发/实发取组内合计;业务已全 Draw → 类型统一 "draw"。session 缺失(极少旧数据)各自单独成组。
+    feed_groups: dict[tuple[int, str], list[dict]] = {}
     for row in all_reward_rows:
         if row["record_id"] in used_reward_ids:
             continue
+        if row["scene"] == "reward_video":
+            events.append({
+                "event_key": f"rwd-{row['record_id']}",
+                "report_date": row["_report_date"],
+                "user_id": row["user_id"],
+                "ad_type": "reward_video",
+                "feed_scene": row.get("feed_scene"),
+                "app_env": row.get("app_env"),
+                "our_code_id": row.get("our_code_id"),
+                "created_at": row["created_at"],
+                "hour": _cn_hour(row["created_at"]) if by_hour else None,
+                "has_impression": False,
+                "impressions": 0,
+                "ecpm": row["ecpm"],
+                "revenue_yuan": 0.0,
+                "adn": None,
+                "slot_id": None,
+                "has_reward": True,
+                "status": row["status"],
+                "expected_coin": int(row["expected_coin"]),
+                "actual_coin": int(row["actual_coin"]),
+                "matched": bool(row["matched"]),
+                "reward_detail": _reward_detail(row),
+                "sub_rewards": [],
+                "sub_count": 1,
+            })
+        else:
+            # 聚合单位 = 一次完整比价/领券流程:优先用 trace_id(比价带 comparisonTraceId、领券带 sessionTraceId,
+            # 整个流程不变;即使中途点广告致浮层关闭重弹、ad_session_id 变了,trace_id 仍不变 → 全流程聚成一行)。
+            # 无 trace_id(历史领券未上报 / 旧数据)回退整场 ad_session_id;再无则 record_id 各自成组、不误并。
+            grp_key = row.get("trace_id") or row.get("ad_session_id") or f"_rid-{row['record_id']}"
+            feed_groups.setdefault((row["user_id"], grp_key), []).append(row)
+
+    # 信息流分组 → 「一次比价 / 一次领券」父事件(收益恒 0:收益只算展示侧,避免与展示行重复计)。
+    for (uid, grp_key), group in feed_groups.items():
+        group.sort(key=lambda r: (r["created_at"], r["record_id"]))
+        rep = group[-1]  # 代表条(最新一条):时间/场景/应用/代码位取它
+        expected_sum = sum(int(g["expected_coin"]) for g in group)
+        actual_sum = sum(int(g["actual_coin"]) for g in group)
+        # 父行 eCPM:组内各条 eCPM(分)均值(展示用,各条不同);无有效值则取代表条
+        ecpm_fens = [rewards.parse_ecpm_fen(g["ecpm"]) for g in group if g.get("ecpm")]
+        avg_ecpm = str(round(sum(ecpm_fens) / len(ecpm_fens))) if ecpm_fens else rep.get("ecpm")
+        # 主表逐行显示用:这次发奖广告的预估收益之和(发奖侧 eCPM 折算,钳顶同展示侧)。只放进
+        # row_revenue_yuan 给主表逐行展示,不进 revenue_yuan/合计/趋势——避免与展示侧 total 重复计。
+        row_revenue = round(sum(
+            min(rewards.parse_ecpm_yuan(g["ecpm"]), rewards.AD_ECPM_MAX_FEN / 100.0) / 1000.0
+            for g in group if g.get("ecpm")
+        ), 6)
         events.append({
-            "event_key": f"rwd-{row['record_id']}",
-            "report_date": row["_report_date"],
-            "user_id": row["user_id"],
-            "ad_type": _event_ad_type(row),
-            "feed_scene": row.get("feed_scene"),
-            "app_env": row.get("app_env"),
-            "our_code_id": row.get("our_code_id"),
-            "created_at": row["created_at"],
-            "hour": _cn_hour(row["created_at"]) if by_hour else None,
+            "event_key": f"feedgrp-{uid}-{grp_key}",
+            "report_date": rep["_report_date"],
+            "user_id": uid,
+            "ad_type": "draw",  # 业务已全切 Draw 信息流,聚合行统一 draw
+            "feed_scene": rep.get("feed_scene"),
+            "app_env": rep.get("app_env"),
+            "our_code_id": rep.get("our_code_id"),
+            "created_at": rep["created_at"],
+            "hour": _cn_hour(rep["created_at"]) if by_hour else None,
             "has_impression": False,
             "impressions": 0,
-            "ecpm": row["ecpm"],
+            "ecpm": avg_ecpm,
             "revenue_yuan": 0.0,
+            "row_revenue_yuan": row_revenue,
             "adn": None,
             "slot_id": None,
             "has_reward": True,
-            "status": row["status"],
-            "expected_coin": int(row["expected_coin"]),
-            "actual_coin": int(row["actual_coin"]),
-            "matched": bool(row["matched"]),
-            "reward_detail": _reward_detail(row),
+            "status": rep["status"],  # 代表状态(逐条见展开)
+            "expected_coin": expected_sum,
+            "actual_coin": actual_sum,
+            "matched": all(bool(g["matched"]) for g in group),
+            "reward_detail": None,
+            "sub_rewards": [_reward_detail(g) for g in group],
+            "sub_count": len(group),
         })
 
     # 「场景」作为全局筛选(与 user_id/ad_type 一致):同时作用于明细、合计与 daily/hourly 趋势。
@@ -326,14 +385,48 @@ def ad_revenue_report(
         for k, v in type_map.items()
     }
 
-    # DAU:复用大盘「今日活跃」口径(stats.today_dau,last_login_at)。该口径只能算今日,
-    # 故仅当查询=今日单天时给值;历史 / 多天区间返回 None,前端显示「-」。
-    is_today = date_from == date_to == rewards.cn_today().isoformat()
-    dau = admin_stats.today_dau(db) if is_today else None
+    # 分场景小计(按 feed_scene:展示条数 + 预估收益),同 type_stats 基于全量 events——
+    # 供数据大盘「领券广告 / 比价广告」卡用。此前大盘是在分页 items 里按 feed_scene 现算,
+    # 2026-07-02 起信息流逐条展示行(唯一带收益 + 场景的行)不再进主表 items,现算恒为 0;
+    # 改为服务端在全量上聚合下发(也顺带不受 limit 分页截断影响)。feed_scene 为空(激励视频 /
+    # 旧数据)不计入任何场景桶。
+    scene_map: dict[str, dict] = {}
+    for e in events:
+        sc = e.get("feed_scene")
+        if not sc:
+            continue
+        s = scene_map.get(sc)
+        if s is None:
+            s = {"impressions": 0, "revenue_yuan": 0.0}
+            scene_map[sc] = s
+        s["impressions"] += e["impressions"]
+        s["revenue_yuan"] += e["revenue_yuan"]
+    scene_stats = {
+        k: {"impressions": v["impressions"], "revenue_yuan": round(v["revenue_yuan"], 6)}
+        for k, v in scene_map.items()
+    }
+
+    # DAU:复用数据大盘活跃用户口径(登录 + 开始比价 + 开始领券,按用户去重),按所选日期区间
+    # 统计(含今日),历史 / 多天区间同样有值。ARPU = 区间预估收益 ÷ 区间活跃用户。全局口径,
+    # 不随 user / ad_type / feed_scene / app_env 筛选变化(活跃用户口径无这些维度)。
+    dau = admin_stats.period_active_dau(
+        db, _date.fromisoformat(date_from), _date.fromisoformat(date_to)
+    )
+
+    # 主表「逐行」= 单次广告行为(2026-07 按「一次比价/领券放一块」聚合):激励视频 = 一次观看一行(展示+发奖
+    # 按 ad_session_id 合并);一次比价 / 一次领券 = 该次整场多条广告按 ad_session_id 聚成一行(展开看逐条)。
+    # 信息流(draw/feed)的逐条展示(ad_ecpm,impressionId 各自独立、与整场发奖无公共键)不再单独占行
+    # ——其展示数 / eCPM / 预估收益已计入上面的全量统计(total_*、daily / hourly、type_stats、穿山甲对照),
+    # 只是主表不逐条铺开;逐条明细在父行展开里看(sub_rewards)。合计 / 趋势 / 分类大盘均基于全量 events,
+    # 不受此过滤影响;total / 分页只作用于主表行。
+    main_rows = [
+        e for e in events
+        if not (e["ad_type"] in ("draw", "feed") and e["has_impression"] and not e["has_reward"])
+    ]
 
     return {
-        "total": len(events),
-        "truncated": len(events) > offset + limit,
+        "total": len(main_rows),
+        "truncated": len(main_rows) > offset + limit,
         "total_impressions": total_impressions,
         "total_revenue_yuan": total_revenue_yuan,
         # 穿山甲后台收益合计(元):预估 revenue + 收益Api;非全量视图(带 user/类型/场景过滤)或无数据为 None。
@@ -346,6 +439,7 @@ def ad_revenue_report(
         "daily": daily,
         "hourly": hourly,
         "type_stats": type_stats,
+        "scene_stats": scene_stats,
         "dau": dau,
-        "items": events[offset:offset + limit],
+        "items": main_rows[offset:offset + limit],
     }

app/admin/repositories/admin_role.py

@@ -0,0 +1,81 @@
+"""admin_role 表 CRUD + 「角色 → 有效可见页」解析。"""
+from __future__ import annotations
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.admin.permissions import (
+    ALL_PAGE_KEYS,
+    BUILTIN_ROLES,
+    SUPER_ADMIN_ROLE,
+    sanitize_pages,
+)
+from app.models.admin_role import AdminRole
+
+
+def ensure_builtin_roles(db: Session) -> None:
+    """空表时播种内建角色(管理员/运营/财务/技术)。幂等:表非空即 no-op。
+    给 create_all 环境(测试 / 未跑迁移的全新库)兜底,迁移已播种则不重复。
+    仅 super_admin 为 is_builtin(锁定不可改删);运营/财务/技术可编辑页/删除。"""
+    if db.execute(select(AdminRole.id).limit(1)).first() is not None:
+        return
+    db.add_all([
+        AdminRole(
+            name=r["name"], label=r["label"], pages=list(r["pages"]),
+            is_builtin=(r["name"] == SUPER_ADMIN_ROLE),
+        )
+        for r in BUILTIN_ROLES
+    ])
+    db.commit()
+
+
+def list_roles(db: Session) -> list[AdminRole]:
+    ensure_builtin_roles(db)
+    # super_admin(内建)恒排最前,其余按创建序
+    return list(
+        db.execute(
+            select(AdminRole).order_by(AdminRole.is_builtin.desc(), AdminRole.id)
+        ).scalars().all()
+    )
+
+
+def get_role(db: Session, name: str) -> AdminRole | None:
+    return db.execute(
+        select(AdminRole).where(AdminRole.name == name)
+    ).scalar_one_or_none()
+
+
+def create_role(db: Session, *, name: str, label: str, pages: list[str]) -> AdminRole:
+    # 自定义角色:name(key)= label = 用户输入的名称
+    role = AdminRole(name=name, label=label, pages=sanitize_pages(pages), is_builtin=False)
+    db.add(role)
+    db.commit()
+    db.refresh(role)
+    return role
+
+
+def update_role(
+    db: Session, role: AdminRole, *, label: str | None = None, pages: list[str] | None = None
+) -> AdminRole:
+    # 只改展示名 label + 可见页;name(key)不可变(admin_user.role / require_role 承重)
+    if label is not None:
+        role.label = label
+    if pages is not None:
+        role.pages = sanitize_pages(pages)
+    db.commit()
+    db.refresh(role)
+    return role
+
+
+def delete_role(db: Session, role: AdminRole) -> None:
+    db.delete(role)
+    db.commit()
+
+
+def effective_pages_of(db: Session, role_name: str) -> list[str]:
+    """某角色名的有效可见页:super_admin → 全部;其余 → 查表 pages 与目录取交。"""
+    if role_name == SUPER_ADMIN_ROLE:
+        return list(ALL_PAGE_KEYS)
+    ensure_builtin_roles(db)
+    role = get_role(db, role_name)
+    return sanitize_pages(role.pages if role else None)

app/admin/repositories/admin_user.py

@@ -20,12 +20,23 @@ def get_by_username(db: Session, username: str) -> AdminUser | None:
 
 
 def create_admin(
-    db: Session, *, username: str, password: str, role: str = "operator"
+    db: Session,
+    *,
+    username: str,
+    password: str,
+    role: str = "operator",
+    plain_password: str | None = None,
+    pages_override: list[str] | None = None,
 ) -> AdminUser:
+    """建管理员。plain_password 非空则额外留存明文(后台 UI 建的账号传,供权限管理页复看);
+    脚本/起后台建账号不传(留 None → 前端不显示密码)。
+    pages_override:role=="custom" 时传专属可见页 key 列表;普通角色为 None。"""
     admin = AdminUser(
         username=username,
         password_hash=hash_password(password),
         role=role,
+        plain_password=plain_password,
+        pages_override=pages_override,
     )
     db.add(admin)
     db.commit()

app/admin/repositories/analytics_health.py

@@ -0,0 +1,146 @@
+"""埋点健康度聚合(埋点成功率 / 上报成功率)。
+
+只存原始累计快照,查询时在 Python 侧差分聚合(admin 低频、量级小,跨 PG/SQLite 无方言坑;
+与 cps.py / coupon_data.py 同款约定)。差分按 (device_id, epoch_id, event) 分区、created_at
+升序,相邻做差、负值夹 0;每增量按其快照 created_at 归入北京天桶。
+"""
+from __future__ import annotations
+
+from collections import defaultdict
+from datetime import UTC, datetime
+
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.core import rewards
+from app.models.analytics_selfstat import AnalyticsSelfStat as H
+from app.models.analytics_selfstat import AnalyticsSelfStatEvent as E
+
+_COUNTS = ("attempted", "drop_capture", "delivered", "drop_undelivered")
+
+
+def diff_snapshots(rows: list[dict]) -> list[dict]:
+    """累计快照行 → 每快照增量行(纯逻辑)。
+
+    rows 每行含 device_id/epoch_id/event/created_at/app_ver/oem/os + 四个累计计数。
+    返回每行含 dims + created_at + 四个增量 d_*(分区首行增量=累计值;负值夹 0)。
+    """
+    parts: dict[tuple, list[dict]] = defaultdict(list)
+    for r in rows:
+        parts[(r["device_id"], r["epoch_id"], r["event"])].append(r)
+
+    out: list[dict] = []
+    for group in parts.values():
+        group.sort(key=lambda r: (r["created_at"], r.get("id", 0)))
+        prev = {k: 0 for k in _COUNTS}
+        for r in group:
+            deltas = {f"d_{k}": max(0, int(r[k]) - prev[k]) for k in _COUNTS}
+            out.append({
+                "device_id": r["device_id"], "epoch_id": r["epoch_id"], "event": r["event"],
+                "created_at": r["created_at"], "app_ver": r["app_ver"],
+                "oem": r["oem"], "os": r["os"], **deltas,
+            })
+            prev = {k: int(r[k]) for k in _COUNTS}
+    return out
+
+
+def _cn_day(dt: datetime) -> str:
+    """created_at(UTC 口径)→ 北京日期字符串 YYYY-MM-DD。naive 当 UTC,tz-aware 直接换算。"""
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=UTC)
+    return dt.astimezone(rewards.CN_TZ).date().isoformat()
+
+
+def _rates(sums: dict) -> dict:
+    """由四个增量和派生两段率(分母 0 → None)。"""
+    persisted_denom = sums["attempted"]
+    report_denom = sums["delivered"] + sums["drop_undelivered"]
+    return {
+        **sums,
+        "track_success_rate": (
+            (sums["attempted"] - sums["drop_capture"]) / persisted_denom
+            if persisted_denom else None
+        ),
+        "report_success_rate": (
+            sums["delivered"] / report_denom if report_denom else None
+        ),
+    }
+
+
+def _sum_deltas(deltas: list[dict]) -> dict:
+    return {k: sum(d[f"d_{k}"] for d in deltas) for k in _COUNTS}
+
+
+def _fetch_rows(db: Session, date_from: datetime, date_to: datetime) -> list[dict]:
+    """取 [from, to) 区间行 + 每分区在 from 左侧的最后一条基线行(供第一条区间增量做差)。"""
+    cols = (
+        H.id, H.device_id, H.epoch_id, E.event, H.created_at,
+        H.app_ver, H.oem, H.os,
+        E.attempted, E.drop_capture, E.delivered, E.drop_undelivered,
+    )
+    in_range = db.execute(
+        select(*cols).join(E, E.snapshot_id == H.id)
+        .where(H.created_at >= date_from, H.created_at < date_to)
+    ).mappings().all()
+
+    # 注:基线子查询无下界扫 from 左侧全量(spec §7 已接受的取舍;量级变大再上物化 rollup)。
+    # 用 max(id) 而非 max(created_at) 选"最新一条":id 严格单调,避免 SQLite 秒级时间戳撞车时选歧义。
+    sub = (
+        select(H.device_id, H.epoch_id, E.event, func.max(H.id).label("max_id"))
+        .join(E, E.snapshot_id == H.id)
+        .where(H.created_at < date_from)
+        .group_by(H.device_id, H.epoch_id, E.event)
+        .subquery()
+    )
+    baseline = db.execute(
+        select(*cols).join(E, E.snapshot_id == H.id).join(
+            sub, sub.c.max_id == H.id
+        )
+    ).mappings().all()
+
+    return [dict(r) for r in list(baseline) + list(in_range)]
+
+
+def _in_range_deltas(db: Session, date_from: datetime, date_to: datetime) -> list[dict]:
+    """差分后只保留 created_at ∈ [from, to) 的增量(基线行被差分用后丢弃)。
+
+    Python 侧过滤需对齐 tz 口径:SQLite 返回 naive UTC,PG 返回 aware UTC。
+    统一转成 naive UTC 再比较,兼容两种后端。
+    """
+    def _to_naive_utc(dt: datetime) -> datetime:
+        if dt.tzinfo is not None:
+            return dt.astimezone(UTC).replace(tzinfo=None)
+        return dt
+
+    from_naive = _to_naive_utc(date_from)
+    to_naive = _to_naive_utc(date_to)
+    deltas = diff_snapshots(_fetch_rows(db, date_from, date_to))
+    return [d for d in deltas if from_naive <= _to_naive_utc(d["created_at"]) < to_naive]
+
+
+def overview(db: Session, date_from: datetime, date_to: datetime) -> dict:
+    deltas = _in_range_deltas(db, date_from, date_to)
+    return _rates(_sum_deltas(deltas))
+
+
+def trend(db: Session, date_from: datetime, date_to: datetime) -> list[dict]:
+    deltas = _in_range_deltas(db, date_from, date_to)
+    by_day: dict[str, list[dict]] = defaultdict(list)
+    for d in deltas:
+        by_day[_cn_day(d["created_at"])].append(d)
+    return [
+        {"day": day, **_rates(_sum_deltas(items))}
+        for day, items in sorted(by_day.items())
+    ]
+
+
+def breakdown(db: Session, date_from: datetime, date_to: datetime, dim: str) -> list[dict]:
+    if dim not in ("event", "app_ver", "oem"):
+        raise ValueError(f"invalid dim: {dim!r}")
+    deltas = _in_range_deltas(db, date_from, date_to)
+    by_key: dict[str, list[dict]] = defaultdict(list)
+    for d in deltas:
+        by_key[d.get(dim) or "(unknown)"].append(d)
+    rows = [{"key": key, **_rates(_sum_deltas(items))} for key, items in by_key.items()]
+    rows.sort(key=lambda r: (r["report_success_rate"] is None, r["report_success_rate"] or 0.0))
+    return rows

app/admin/repositories/coupon_data.py

@@ -5,17 +5,21 @@
 - 发起数 = 区间内全部 session(含 started/completed/failed/abandoned),= 流失统计的基数。
 - 完成数 / 耗时均值 / 分位 = 仅 status==completed 子集(成功跑完才有可比的"领券耗时")。
 - summary/daily/hourly/total 在全量上算,不受分页;items 为排序后当前页。
+- 另含 coupon_slot_report(数据源 coupon_claim_record):按 coupon_id「按券成功率」表,见设计 §13。
 """
 from __future__ import annotations
 
-from datetime import UTC, date as _date, datetime
+from datetime import UTC, datetime
+from datetime import date as _date
 
-from sqlalchemy import func, or_, select
+from sqlalchemy import case, func, or_, select
 from sqlalchemy.orm import Session
 
 from app.core import rewards
-from app.models.coupon_state import CouponSession
+from app.models.coupon_state import CouponClaimRecord, CouponSession
 from app.models.user import User
+from app.repositories import ad_ecpm as crud_ecpm
+from app.repositories.coupon_state import DEFAULT_PLATFORMS, coupon_id_to_platform
 
 
 def _cn_hour(dt: datetime) -> int:
@@ -42,7 +46,47 @@ def _avg(vals: list[int]) -> int | None:
     return round(sum(vals) / len(vals)) if vals else None
 
 
-def _session_to_row(r, phone: str | None = None, nickname: str | None = None) -> dict:
+def _success_rates(rows: list) -> dict:
+    """平台粒度成功率(见 docs/guides/领券成功率指标-设计与埋点.md §3/§12):
+
+    - sel(s) = 勾选平台(`platforms` 空 → 全领三档 DEFAULT_PLATFORMS);
+    - succ(s) = `platform_success` ∩ sel(至少领到一张的平台);
+    - ② 整单成功率 = #{sel⊆succ 且 sel≠∅} / 发起数;
+    - ③ 点位成功率 = Σ|succ| / Σ|sel|;per_platform[p] = 勾了 p 且成功 / 勾了 p。
+    基数含全部 session(started/completed/failed/abandoned),与「发起数」同基数。
+    """
+    started = len(rows)
+    full_success = 0
+    point_success = 0
+    point_total = 0
+    per_succ = {p: 0 for p in DEFAULT_PLATFORMS}
+    per_total = {p: 0 for p in DEFAULT_PLATFORMS}
+    for r in rows:
+        sel = set(r.platforms) if r.platforms else set(DEFAULT_PLATFORMS)
+        succ = set(r.platform_success or []) & sel
+        point_success += len(succ)
+        point_total += len(sel)
+        if sel and succ == sel:
+            full_success += 1
+        for p in sel:
+            if p in per_total:  # 只统计三档已知平台;未知/非法平台 id 不进 per_platform
+                per_total[p] += 1
+                if p in succ:
+                    per_succ[p] += 1
+    return {
+        "full_success_count": full_success,
+        "full_success_rate": round(full_success / started, 4) if started else None,
+        "point_success_count": point_success,
+        "point_total_count": point_total,
+        "point_success_rate": round(point_success / point_total, 4) if point_total else None,
+        "per_platform": {
+            p: (round(per_succ[p] / per_total[p], 4) if per_total[p] else None)
+            for p in DEFAULT_PLATFORMS
+        },
+    }
+
+
+def _session_to_row(r, phone: str | None = None, nickname: str | None = None, ad_revenue_yuan: float = 0.0) -> dict:
     """CouponSession ORM → 明细行 dict(主表「领券数据」与「用户全部领券」抽屉共用)。"""
     return {
         "id": r.id,
@@ -61,6 +105,7 @@ def _session_to_row(r, phone: str | None = None, nickname: str | None = None) ->
         "started_at": r.started_at,
         "claimed_count": r.claimed_count,
         "trace_url": r.trace_url,
+        "ad_revenue_yuan": ad_revenue_yuan,
     }
 
 
@@ -84,6 +129,7 @@ def coupon_data_report(
     date_to: str,
     user: str | None = None,
     app_env: str | None = None,
+    statuses: list[str] | None = None,
     granularity: str = "day",
     limit: int = 500,
     offset: int = 0,
@@ -93,6 +139,8 @@ def coupon_data_report(
 
     - user:手机号/昵称模糊搜(匹配不到任何用户 → 空结果)。
     - app_env:prod/dev 精确;None=全部。
+    - statuses:领券状态多选(started/completed/failed/abandoned);None/空=全部。整个视图
+      (汇总/成功率/趋势/明细)按选中状态算,与 app_env 同级过滤(方案 A)。
     - sort:time=发起时刻倒序(默认) / elapsed=全程耗时倒序(None 末尾)。
     """
     by_hour = granularity == "hour"
@@ -115,6 +163,8 @@ def coupon_data_report(
     )
     if app_env is not None:
         stmt = stmt.where(CouponSession.app_env == app_env)
+    if statuses:
+        stmt = stmt.where(CouponSession.status.in_(statuses))
     if user_ids is not None:
         stmt = stmt.where(CouponSession.user_id.in_(user_ids))
     rows = list(db.execute(stmt).scalars())
@@ -131,6 +181,7 @@ def coupon_data_report(
         "p50_ms": _percentile(completed_elapsed, 50),
         "p95_ms": _percentile(completed_elapsed, 95),
         "p99_ms": _percentile(completed_elapsed, 99),
+        **_success_rates(rows),
     }
 
     # ── 按天趋势(柱=发起/完成数,线=平均耗时)──
@@ -197,10 +248,11 @@ def coupon_data_report(
                 select(User.id, User.phone, User.nickname).where(User.id.in_(uids))
             ).all()
         }
+    rev_map = crud_ecpm.revenue_yuan_by_trace(db, [r.trace_id for r in page])
     items = []
     for r in page:
         phone, nickname = user_map.get(r.user_id, (None, None)) if r.user_id is not None else (None, None)
-        items.append(_session_to_row(r, phone, nickname))
+        items.append(_session_to_row(r, phone, nickname, ad_revenue_yuan=rev_map.get(r.trace_id, 0.0)))
 
     return {
         "summary": summary,
@@ -222,4 +274,57 @@ def coupon_user_records(db: Session, *, user_id: int, limit: int = 100) -> dict:
     total = db.execute(
         select(func.count()).select_from(CouponSession).where(CouponSession.user_id == user_id)
     ).scalar_one()
-    return {"items": [_session_to_row(r) for r in rows], "total": int(total)}
+    rev_map = crud_ecpm.revenue_yuan_by_trace(db, [r.trace_id for r in rows])
+    return {
+        "items": [_session_to_row(r, ad_revenue_yuan=rev_map.get(r.trace_id, 0.0)) for r in rows],
+        "total": int(total),
+    }
+
+
+_SLOT_OK = ("success", "already_claimed")
+_SLOT_TRIED = ("success", "already_claimed", "failed")
+
+
+def coupon_slot_report(
+    db: Session, *, date_from: str, date_to: str, app_env: str | None = None
+) -> dict:
+    """按 coupon_id(具体券)聚合成功率(见 docs/guides/领券成功率指标-设计与埋点.md §13)。
+
+    数据源 coupon_claim_record(粒度=设备-天,唯一键 device+coupon+day)。
+    - 尝试 = status ∈ {success, already_claimed, failed}(skipped 排除);
+    - 成功 = status ∈ {success, already_claimed};成功率 = 成功/尝试;
+    - claim_date 区间 + app_env(None=全部)过滤;按 tried 倒序返回。
+    """
+    d_from = _date.fromisoformat(date_from)
+    d_to = _date.fromisoformat(date_to)
+    ok = case((CouponClaimRecord.status.in_(_SLOT_OK), 1), else_=0)
+    stmt = (
+        select(
+            CouponClaimRecord.coupon_id,
+            func.max(CouponClaimRecord.coupon_name).label("coupon_name"),
+            func.count().label("tried"),
+            func.sum(ok).label("succeeded"),
+        )
+        .where(
+            CouponClaimRecord.claim_date >= d_from,
+            CouponClaimRecord.claim_date <= d_to,
+            CouponClaimRecord.status.in_(_SLOT_TRIED),
+        )
+        .group_by(CouponClaimRecord.coupon_id)
+    )
+    if app_env is not None:
+        stmt = stmt.where(CouponClaimRecord.app_env == app_env)
+    items = []
+    for coupon_id, coupon_name, tried, succeeded in db.execute(stmt).all():
+        tried = int(tried or 0)
+        succeeded = int(succeeded or 0)
+        items.append({
+            "coupon_id": coupon_id,
+            "coupon_name": coupon_name,
+            "platform": coupon_id_to_platform(coupon_id),
+            "tried": tried,
+            "succeeded": succeeded,
+            "success_rate": round(succeeded / tried, 4) if tried else None,
+        })
+    items.sort(key=lambda x: (-x["tried"], x["coupon_id"]))
+    return {"items": items}

app/admin/repositories/cps.py

@@ -51,7 +51,27 @@ def _yuan_to_cents(v: object) -> int | None:
 
 def _ts_to_dt(ts: object) -> datetime | None:
     """秒级时间戳 → tz-aware UTC datetime(绝对时刻,前端按北京展示)。"""
-    if not ts:
+    if ts is None:
+        return None
+    if isinstance(ts, datetime):
+        return ts if ts.tzinfo else ts.replace(tzinfo=_BJ_TZ).astimezone(timezone.utc)
+    s = str(ts).strip()
+    if not s or s.lower() == "null":
+        return None
+    try:
+        seconds = float(Decimal(s))
+    except (InvalidOperation, ValueError):
+        return None
+    if seconds == 0:
+        return None
+    # 美团文档是秒级时间戳，这里顺手兼容毫秒/微秒，避免上游格式变化导致时间再次落空。
+    if abs(seconds) > 10_000_000_000_000:
+        seconds /= 1_000_000
+    elif abs(seconds) > 10_000_000_000:
+        seconds /= 1_000
+    try:
+        return datetime.fromtimestamp(seconds, tz=timezone.utc)
+    except (OverflowError, OSError, ValueError):
         return None
 
 
@@ -83,10 +103,6 @@ def _pick(row: dict[str, Any], *keys: str) -> Any:
         if key in row and row[key] is not None:
             return row[key]
     return None
-    try:
-        return datetime.fromtimestamp(int(ts), tz=timezone.utc)
-    except (ValueError, OSError, TypeError):
-        return None
 
 
 # ───────────── 群 ─────────────

app/admin/repositories/mutations.py

@@ -65,16 +65,19 @@ def review_feedback(
     reward_coins: int | None = None,
     reject_reason: str | None = None,
     review_note: str | None = None,
+    admin_reply: str | None = None,
     commit: bool = True,
 ) -> Feedback:
-    """审核反馈:置 adopted/rejected + 记录奖励/原因/审核人/审核时间。
+    """审核反馈:置 adopted/rejected + 记录奖励/原因/回复留言/审核人/审核时间。
 
     发金币(wallet.grant_coins)由 router 在同一事务里调,确保状态、金币流水、审计一起提交。
+    admin_reply=给用户的回复留言(用户端可见),与 review_note(内部备注)区分。
     """
     feedback.status = status
     feedback.reward_coins = reward_coins
     feedback.reject_reason = reject_reason
     feedback.review_note = review_note
+    feedback.admin_reply = admin_reply
     feedback.reviewed_by_admin_id = reviewed_by_admin_id
     feedback.reviewed_at = datetime.now(CN_TZ).replace(tzinfo=None)
     if commit:

app/admin/repositories/queries.py

@@ -11,6 +11,7 @@ from zoneinfo import ZoneInfo
 from sqlalchemy import Select, asc, case, desc, func, or_, select
 from sqlalchemy.orm import Session
 
+from app.admin.repositories.stats import COMPARE_START_EVENT, COUPON_START_EVENT
 from app.core import rewards
 from app.core.config import settings
 from app.models.ad_feed_reward import AdFeedRewardRecord
@@ -18,12 +19,23 @@ from app.models.ad_reward import AdRewardRecord
 from app.models.admin import AdminAuditLog
 from app.models.analytics_event import AnalyticsEvent
 from app.models.comparison import ComparisonRecord
+from app.models.coupon_state import CouponPromptEngagement
 from app.models.device import DeviceLiveness
 from app.models.feedback import Feedback
 from app.models.onboarding import OnboardingCompletion
 from app.models.price_report import PriceReport
 from app.models.user import User
-from app.models.wallet import CashTransaction, CoinAccount, CoinTransaction, WithdrawOrder
+from app.models.wallet import (
+    CashTransaction,
+    CoinAccount,
+    CoinTransaction,
+    InviteCashTransaction,
+    WithdrawOrder,
+)
+from app.repositories import ad_ecpm
+
+# 「最近活跃」计入的行为事件(与大盘 DAU/留存活跃口径一致:开始比价 + 开始领券)
+_ACTIVE_EVENTS = (COMPARE_START_EVENT, COUPON_START_EVENT)
 
 # 折算成可提现现金时,非广告金币来源的排除集(广告单独统计、人工调整不算"赚取")
 _NON_TASK_BIZ_TYPES = ("reward_video", "feed_ad_reward", "admin_grant", "admin_deduct")
@@ -76,6 +88,86 @@ def offset_paginate(
     return items, next_cursor, total
 
 
+def _last_active_parts():
+    """「最近活跃」的两个按 user_id 预聚合派生表(最近开始比价/领券事件、最近领券发起)。
+
+    活跃口径与大盘 DAU/留存一致(2026-07-05 产品定:进入 App≈登录 last_login_at +
+    发起比价 real_compare_start + 发起领券 real_coupon_start/claim_started)。
+    用 LEFT JOIN 预聚合而非相关标量子查询:后者在 PG 上对 users 每行各跑一个 SubPlan
+    (排序键、range 筛选、offset_paginate 的 count 三处叠加),埋点表大了会拖垮列表接口;
+    预聚合借 analytics_event.event 索引只扫两类 start 事件,每次查询聚合一次。
+    """
+    ev_agg = (
+        select(
+            AnalyticsEvent.user_id.label("user_id"),
+            func.max(AnalyticsEvent.created_at).label("last_at"),
+        )
+        .where(
+            AnalyticsEvent.user_id.is_not(None),
+            AnalyticsEvent.event.in_(_ACTIVE_EVENTS),
+        )
+        .group_by(AnalyticsEvent.user_id)
+        .subquery()
+    )
+    eng_agg = (
+        select(
+            CouponPromptEngagement.user_id.label("user_id"),
+            func.max(CouponPromptEngagement.created_at).label("last_at"),
+        )
+        .where(
+            CouponPromptEngagement.user_id.is_not(None),
+            CouponPromptEngagement.engage_type == "claim_started",
+        )
+        .group_by(CouponPromptEngagement.user_id)
+        .subquery()
+    )
+    return ev_agg, eng_agg
+
+
+def _norm_utc(dt: datetime | None) -> datetime | None:
+    """naive 视为 UTC 补 tzinfo(SQLite 读回 naive、PG 读回 aware,混着 max() 会 TypeError)。"""
+    if dt is None:
+        return None
+    return dt if dt.tzinfo is not None else dt.replace(tzinfo=timezone.utc)
+
+
+def _attach_last_active(db: Session, users: list[User]) -> None:
+    """给本页用户瞬态挂 last_active_at(非 DB 列,供 AdminUserListItem from_attributes 读)。
+
+    口径同 [_last_active_expr];按本页 user_id 批量两次 GROUP BY,防 N+1。
+    """
+    uids = [u.id for u in users]
+    if not uids:
+        return
+    ev_map = dict(
+        db.execute(
+            select(AnalyticsEvent.user_id, func.max(AnalyticsEvent.created_at))
+            .where(
+                AnalyticsEvent.user_id.in_(uids),
+                AnalyticsEvent.event.in_(_ACTIVE_EVENTS),
+            )
+            .group_by(AnalyticsEvent.user_id)
+        ).all()
+    )
+    eng_map = dict(
+        db.execute(
+            select(CouponPromptEngagement.user_id, func.max(CouponPromptEngagement.created_at))
+            .where(
+                CouponPromptEngagement.user_id.in_(uids),
+                CouponPromptEngagement.engage_type == "claim_started",
+            )
+            .group_by(CouponPromptEngagement.user_id)
+        ).all()
+    )
+    for u in users:
+        candidates = [
+            _norm_utc(u.last_login_at),
+            _norm_utc(ev_map.get(u.id)),
+            _norm_utc(eng_map.get(u.id)),
+        ]
+        u.last_active_at = max((c for c in candidates if c is not None), default=None)
+
+
 def list_users(
     db: Session,
     *,
@@ -87,16 +179,34 @@ def list_users(
     created_to: datetime | None = None,
     last_login_from: datetime | None = None,
     last_login_to: datetime | None = None,
+    last_active_from: datetime | None = None,
+    last_active_to: datetime | None = None,
     sort_by: str = "id",
     sort_order: str = "desc",
     limit: int = 20,
     cursor: int | None = None,
 ) -> tuple[list[User], int | None, int]:
-    """用户列表(admin 全量)。支持手机号前缀 / 渠道 / 状态 / 昵称模糊 / 注册·最近登录时间范围筛选,
-    按 id·注册时间·最近登录排序。**offset 分页**(cursor=offset):任意列排序下游标语义统一,
+    """用户列表(admin 全量)。支持手机号前缀 / 渠道 / 状态 / 昵称模糊 / 注册·最近登录·最近活跃
+    时间范围筛选,按 id·注册时间·最近登录·最近活跃排序;每页附带计算列 last_active_at
+    (口径见 [_last_active_expr])。**offset 分页**(cursor=offset):任意列排序下游标语义统一,
     代价是翻页期间数据变动可能错位一条——admin 低频场景可接受(同 [list_all_withdraw_orders])。
     日期入参统一转 tz-aware UTC 比较(列为 timestamptz,见 _as_utc)。"""
-    stmt = select(User)
+    # 最近活跃 = max(最近登录, 最近行为事件, 最近领券发起)。PG 用 GREATEST;SQLite 标量 max()
+    # 任一参数 NULL 即返回 NULL,故 LEFT JOIN 未命中侧 coalesce 到 last_login_at 兜底
+    # (注册即登录,该列恒非空)。派生表 1:1(按 user_id 聚合),outerjoin 不会放大行数,
+    # offset_paginate 的 count 不受影响。
+    ev_agg, eng_agg = _last_active_parts()
+    greatest = func.greatest if db.get_bind().dialect.name == "postgresql" else func.max
+    last_active = greatest(
+        User.last_login_at,
+        func.coalesce(ev_agg.c.last_at, User.last_login_at),
+        func.coalesce(eng_agg.c.last_at, User.last_login_at),
+    )
+    stmt = (
+        select(User)
+        .outerjoin(ev_agg, ev_agg.c.user_id == User.id)
+        .outerjoin(eng_agg, eng_agg.c.user_id == User.id)
+    )
     if phone:
         stmt = stmt.where(User.phone.like(f"{phone}%"))  # 前缀匹配
     if register_channel:
@@ -113,16 +223,25 @@ def list_users(
         stmt = stmt.where(User.last_login_at >= _as_utc(last_login_from))
     if last_login_to is not None:
         stmt = stmt.where(User.last_login_at <= _as_utc(last_login_to))
+    if last_active_from is not None:
+        stmt = stmt.where(last_active >= _as_utc(last_active_from))
+    if last_active_to is not None:
+        stmt = stmt.where(last_active <= _as_utc(last_active_to))
 
     sort_cols = {
         "id": User.id,
         "created_at": User.created_at,
         "last_login_at": User.last_login_at,
+        "last_active_at": last_active,
     }
     sort_col = sort_cols.get(sort_by, User.id)
     order_fn = asc if sort_order == "asc" else desc
     id_order = asc(User.id) if sort_order == "asc" else desc(User.id)
-    return offset_paginate(db, stmt, (order_fn(sort_col), id_order), limit=limit, cursor=cursor)
+    items, next_cursor, total = offset_paginate(
+        db, stmt, (order_fn(sort_col), id_order), limit=limit, cursor=cursor
+    )
+    _attach_last_active(db, items)
+    return items, next_cursor, total
 
 
 def _attach_user_info(db: Session, records: list[ComparisonRecord | Feedback | PriceReport]) -> None:
@@ -148,11 +267,14 @@ def list_comparison_records(
     phone: str | None = None,
     status: str | None = None,
     business_type: str | None = None,
+    store: str | None = None,
+    product: str | None = None,
     limit: int = 20,
     cursor: int | None = None,
 ) -> tuple[list[ComparisonRecord], int | None, int]:
     """admin 比价记录列表(debug)。按 user_id 精确 或 phone 前缀定位用户 + status/业务类型筛,
-    offset 分页(创建时间倒序、id 兜底)。join User 取 phone/nickname 瞬态挂记录上。"""
+    store(店名)/product(商品名)子串模糊匹配,offset 分页(创建时间倒序、id 兜底)。
+    join User 取 phone/nickname 瞬态挂记录上。"""
     stmt = select(ComparisonRecord)
     if user_id is not None:
         stmt = stmt.where(ComparisonRecord.user_id == user_id)
@@ -166,12 +288,22 @@ def list_comparison_records(
         stmt = stmt.where(ComparisonRecord.status == status)
     if business_type:
         stmt = stmt.where(ComparisonRecord.business_type == business_type)
+    if store:
+        stmt = stmt.where(ComparisonRecord.store_name.like(f"%{store}%"))
+    if product:
+        # 商品名搜 product_names 派生文本列(非 items JSON:SQLite 下 JSON 中文被转义无法直接 LIKE)。
+        stmt = stmt.where(ComparisonRecord.product_names.like(f"%{product}%"))
     items, next_cursor, total = offset_paginate(
         db, stmt,
         (desc(ComparisonRecord.created_at), desc(ComparisonRecord.id)),
         limit=limit, cursor=cursor,
     )
     _attach_user_info(db, items)
+    # 「本次比价看广告的预估收益」:按本页 trace_id 一次性聚合(同 _attach_user_info 逐页范式)。
+    # ad_revenue_yuan 非 ORM 列,仅瞬态挂实例上供 AdminComparisonListItem(from_attributes)读出。
+    rev = ad_ecpm.revenue_yuan_by_trace(db, [it.trace_id for it in items])
+    for it in items:
+        it.ad_revenue_yuan = rev.get(it.trace_id, 0.0)
     return items, next_cursor, total
 
 
@@ -390,6 +522,7 @@ def list_all_withdraw_orders(
     *,
     user_id: int | None = None,
     status: str | None = None,
+    source: str | None = None,
     keyword: str | None = None,
     date_from: datetime | None = None,
     date_to: datetime | None = None,
@@ -409,6 +542,9 @@ def list_all_withdraw_orders(
         stmt = stmt.where(WithdrawOrder.user_id == user_id)
     if status:
         stmt = stmt.where(WithdrawOrder.status == status)
+    # 提现类型:coin_cash(福利页提现)/ invite_cash(邀请提现);None=全部
+    if source:
+        stmt = stmt.where(WithdrawOrder.source == source)
 
     kw = (keyword or "").strip()
     if kw:
@@ -534,6 +670,7 @@ def list_feedbacks(
     db: Session,
     *,
     status: str | None = None,
+    source: str | None = None,
     user_id: int | None = None,
     content: str | None = None,
     created_from: datetime | None = None,
@@ -543,13 +680,15 @@ def list_feedbacks(
     limit: int = 20,
     cursor: int | None = None,
 ) -> tuple[list[Feedback], int | None, int]:
-    """反馈工单列表。支持 状态 / 用户ID / 内容模糊 / 提交时间范围 筛选,按 id·提交时间排序。
-    **offset 分页**(cursor=offset):任意列排序下游标语义统一(同 [list_users]),代价是翻页期间
-    数据变动可能错位一条——admin 低频场景可接受。返回 (items, next_cursor, total),total 供页码分页。
-    created_at 为 timestamptz,日期入参统一转 tz-aware UTC 比较。"""
+    """反馈工单列表。支持 状态 / 反馈类型(source) / 用户ID / 内容模糊 / 提交时间范围 筛选,
+    按 id·提交时间排序。**offset 分页**(cursor=offset):任意列排序下游标语义统一(同 [list_users]),
+    代价是翻页期间数据变动可能错位一条——admin 低频场景可接受。返回 (items, next_cursor, total),
+    total 供页码分页。created_at 为 timestamptz,日期入参统一转 tz-aware UTC 比较。"""
     stmt = select(Feedback)
     if status:
         stmt = stmt.where(Feedback.status == status)
+    if source:
+        stmt = stmt.where(Feedback.source == source)
     if user_id is not None:
         stmt = stmt.where(Feedback.user_id == user_id)
     if content and content.strip():
@@ -719,26 +858,19 @@ def withdraw_risk_flags(
     return flags, score
 
 
-def withdraw_ledger_check(db: Session) -> dict:
-    cash_balance_total = int(
-        db.execute(select(func.coalesce(func.sum(CoinAccount.cash_balance_cents), 0))).scalar_one()
-    )
-    cash_txn_total = int(
-        db.execute(select(func.coalesce(func.sum(CashTransaction.amount_cents), 0))).scalar_one()
-    )
+def _check_withdraw_ledger_side(
+    orders: list[WithdrawOrder], txns: list, *, withdraw_biz: str, refund_biz: str
+) -> dict:
+    """对某一本账(普通现金 / 邀请奖励金)做提现单 ↔ 流水的交叉校验。
 
-    orders = list(db.execute(select(WithdrawOrder)).scalars().all())
-    cash_txns = list(
-        db.execute(
-            select(CashTransaction).where(
-                CashTransaction.biz_type.in_(("withdraw", "withdraw_refund"))
-            )
-        ).scalars().all()
-    )
-    withdraw_refs = {txn.ref_id for txn in cash_txns if txn.biz_type == "withdraw"}
+    orders 已按 source 过滤到本账;txns 是本账流水表里 withdraw_biz/refund_biz 两类流水。
+    规则:每单发起应有一条扣款流水(ref_id=out_bill_no);失败/拒绝单应有且仅一条退款流水;
+    非退款终态不应出现退款流水。四个计数全为 0 即本账自洽。
+    """
+    withdraw_refs = {txn.ref_id for txn in txns if txn.biz_type == withdraw_biz}
     refund_counts: dict[str, int] = {}
-    for txn in cash_txns:
-        if txn.biz_type == "withdraw_refund" and txn.ref_id:
+    for txn in txns:
+        if txn.biz_type == refund_biz and txn.ref_id:
             refund_counts[txn.ref_id] = refund_counts.get(txn.ref_id, 0) + 1
 
     missing_withdraw = 0
@@ -753,24 +885,95 @@ def withdraw_ledger_check(db: Session) -> dict:
         if has_refund and order.status not in {"failed", "rejected"}:
             refund_on_non_terminal += 1
 
-    duplicate_refund = sum(1 for count in refund_counts.values() if count > 1)
-    diff = cash_balance_total - cash_txn_total
+    return {
+        "missing_withdraw": missing_withdraw,
+        "missing_refund": missing_refund,
+        "duplicate_refund": sum(1 for count in refund_counts.values() if count > 1),
+        "refund_on_non_terminal": refund_on_non_terminal,
+    }
+
+
+def withdraw_ledger_check(db: Session) -> dict:
+    """现金账本校验:两本物理隔离的账各自对账(产品红线:coin_cash / invite_cash 不串)。
+
+    普通现金:CoinAccount.cash_balance_cents ↔ cash_transaction(withdraw/withdraw_refund);
+    邀请奖励金:CoinAccount.invite_cash_balance_cents ↔ invite_cash_transaction
+              (invite_withdraw/invite_withdraw_refund)。
+    提现单按 source 分流到对应账核对——邀请提现的流水写在 invite_cash_transaction 表,
+    绝不能拿去和普通现金流水比(否则每笔邀请提现单都会被误报「缺扣款/缺退款流水」)。
+    分流口径与 create_withdraw 一致:仅 source==invite_cash 走邀请账,其余(含历史空值)归普通现金。
+    """
+    orders = list(db.execute(select(WithdrawOrder)).scalars().all())
+    coin_orders = [o for o in orders if o.source != "invite_cash"]
+    invite_orders = [o for o in orders if o.source == "invite_cash"]
+
+    # —— 普通现金账(coin_cash) ——
+    cash_balance_total = int(
+        db.execute(select(func.coalesce(func.sum(CoinAccount.cash_balance_cents), 0))).scalar_one()
+    )
+    cash_txn_total = int(
+        db.execute(select(func.coalesce(func.sum(CashTransaction.amount_cents), 0))).scalar_one()
+    )
+    cash_txns = list(
+        db.execute(
+            select(CashTransaction).where(
+                CashTransaction.biz_type.in_(("withdraw", "withdraw_refund"))
+            )
+        ).scalars().all()
+    )
+    coin = _check_withdraw_ledger_side(
+        coin_orders, cash_txns, withdraw_biz="withdraw", refund_biz="withdraw_refund"
+    )
+    cash_diff = cash_balance_total - cash_txn_total
+
+    # —— 邀请奖励金账(invite_cash,独立账户 + 独立流水表) ——
+    invite_balance_total = int(
+        db.execute(
+            select(func.coalesce(func.sum(CoinAccount.invite_cash_balance_cents), 0))
+        ).scalar_one()
+    )
+    invite_txn_total = int(
+        db.execute(
+            select(func.coalesce(func.sum(InviteCashTransaction.amount_cents), 0))
+        ).scalar_one()
+    )
+    invite_txns = list(
+        db.execute(
+            select(InviteCashTransaction).where(
+                InviteCashTransaction.biz_type.in_(("invite_withdraw", "invite_withdraw_refund"))
+            )
+        ).scalars().all()
+    )
+    invite = _check_withdraw_ledger_side(
+        invite_orders, invite_txns,
+        withdraw_biz="invite_withdraw", refund_biz="invite_withdraw_refund",
+    )
+    invite_diff = invite_balance_total - invite_txn_total
+
     ok = (
-        diff == 0
-        and missing_withdraw == 0
-        and missing_refund == 0
-        and duplicate_refund == 0
-        and refund_on_non_terminal == 0
+        cash_diff == 0
+        and invite_diff == 0
+        and all(v == 0 for v in coin.values())
+        and all(v == 0 for v in invite.values())
     )
     return {
         "ok": ok,
+        # 普通现金账(coin_cash:金币兑换的现金)
         "cash_balance_total_cents": cash_balance_total,
         "cash_transaction_total_cents": cash_txn_total,
-        "balance_diff_cents": diff,
-        "missing_withdraw_txn_count": missing_withdraw,
-        "missing_refund_txn_count": missing_refund,
-        "duplicate_refund_txn_count": duplicate_refund,
-        "refund_txn_on_non_terminal_count": refund_on_non_terminal,
+        "balance_diff_cents": cash_diff,
+        "missing_withdraw_txn_count": coin["missing_withdraw"],
+        "missing_refund_txn_count": coin["missing_refund"],
+        "duplicate_refund_txn_count": coin["duplicate_refund"],
+        "refund_txn_on_non_terminal_count": coin["refund_on_non_terminal"],
+        # 邀请奖励金账(invite_cash:与普通现金物理隔离,各自对账)
+        "invite_cash_balance_total_cents": invite_balance_total,
+        "invite_cash_transaction_total_cents": invite_txn_total,
+        "invite_balance_diff_cents": invite_diff,
+        "invite_missing_withdraw_txn_count": invite["missing_withdraw"],
+        "invite_missing_refund_txn_count": invite["missing_refund"],
+        "invite_duplicate_refund_txn_count": invite["duplicate_refund"],
+        "invite_refund_txn_on_non_terminal_count": invite["refund_on_non_terminal"],
     }
 
 
@@ -806,6 +1009,12 @@ def get_user_overview(db: Session, user_id: int) -> dict | None:
     }
 
 
+def _as_utc_naive(value: datetime) -> datetime:
+    """窗口入参 → UTC naive(= _as_utc 去时区),与库里按 naive UTC 存取的 created_at 同口径比较。
+    历史遗留:_window_conds 一直引用本函数却未定义(自定义区间会 NameError),此处补上。"""
+    return _as_utc(value).replace(tzinfo=None)
+
+
 def _window_conds(col, date_from: datetime | None, date_to: datetime | None) -> list:
     """把 [date_from, date_to] 转成对 col(created_at)的过滤条件;都为 None = 全量(注册至今)。"""
     conds = []
@@ -895,6 +1104,13 @@ def user_reward_stats(
     }
 
 
+def _cn_wall_to_utc(dt: datetime) -> datetime:
+    """coin_transaction 存的是北京 wall-clock(naive,见 wallet.grant_coins「存北京 wall-clock」),转成 UTC naive,
+    与广告表(func.now() UTC)统一 —— 让本函数按同一绝对时刻排序、且前端 apiTime(把无时区时间当 UTC 再 +8 展示)
+    口径一致;否则签到会比实际多显示 8 小时(北京时间又被 +8)。"""
+    return dt.replace(tzinfo=rewards.CN_TZ).astimezone(timezone.utc).replace(tzinfo=None)
+
+
 def user_coin_records(
     db: Session,
     user_id: int,
@@ -915,6 +1131,9 @@ def user_coin_records(
     offset = max(cursor or 0, 0)
     fetch = offset + limit + 1
     rows: list[dict] = []
+    # coin_transaction 存北京 wall-clock(其余表存 UTC);签到窗口边界 +8h 对齐北京,过滤/计数才不偏移 8 小时
+    signin_from = date_from + timedelta(hours=8) if date_from is not None else None
+    signin_to = date_to + timedelta(hours=8) if date_to is not None else None
 
     for rec in db.execute(
         select(AdRewardRecord)
@@ -958,7 +1177,7 @@ def user_coin_records(
         .where(
             CoinTransaction.user_id == user_id,
             CoinTransaction.biz_type == "signin",
-            *_window_conds(CoinTransaction.created_at, date_from, date_to),
+            *_window_conds(CoinTransaction.created_at, signin_from, signin_to),
         )
         .order_by(CoinTransaction.created_at.desc())
         .limit(fetch)
@@ -966,7 +1185,8 @@ def user_coin_records(
         rows.append({
             "source": "signin",
             "source_label": "签到",
-            "created_at": rec.created_at,
+            # 北京 wall-clock → UTC,与广告记录统一(前端 apiTime 会 +8 回北京展示,不然签到会多 8 小时)
+            "created_at": _cn_wall_to_utc(rec.created_at),
             "ecpm": None,
             "coin": rec.amount,
         })
@@ -992,7 +1212,7 @@ def user_coin_records(
         + _count(
             CoinTransaction, CoinTransaction.user_id == user_id,
             CoinTransaction.biz_type == "signin",
-            *_window_conds(CoinTransaction.created_at, date_from, date_to),
+            *_window_conds(CoinTransaction.created_at, signin_from, signin_to),
         )
     )
     return rows[offset:offset + limit], (offset + limit if has_more else None), total

app/admin/repositories/stats.py

@@ -5,17 +5,23 @@ user.last_login_at / comparison_record.status / withdraw_order.status)要加索
 """
 from __future__ import annotations
 
+from collections import Counter
 from datetime import date, datetime, time, timedelta, timezone
 from decimal import Decimal, InvalidOperation
 
-from sqlalchemy import func, select
+from sqlalchemy import case, func, select
 from sqlalchemy.orm import Session
 
+from app.admin.repositories.coupon_data import _percentile
 from app.models.ad_feed_reward import AdFeedRewardRecord
 from app.models.ad_reward import AdRewardRecord
 from app.models.analytics_event import AnalyticsEvent
 from app.models.comparison import ComparisonRecord
-from app.models.coupon_state import CouponPromptEngagement
+from app.models.coupon_state import (
+    CouponClaimRecord,
+    CouponPromptEngagement,
+    CouponSession,
+)
 from app.models.cps_order import CpsOrder
 from app.models.feedback import Feedback
 from app.models.savings import SavingsRecord
@@ -24,11 +30,17 @@ from app.models.user import User
 from app.models.wallet import CoinTransaction, WithdrawOrder
 
 _BEIJING = timezone(timedelta(hours=8))
-COUPON_REWARD_BIZ_TYPES = ("reward_video", "ad_reward", "coupon", "coupon_reward")
+REWARD_VIDEO_BIZ_TYPES = ("reward_video", "ad_reward")
+# 领券/比价奖励金币的真实来源是信息流广告发奖(ad_feed_reward_record,按 feed_scene 分场景);
+# coin_transaction 里只有扁平的 feed_ad_reward、biz_type 不分 coupon/comparison,故这俩桶历史从未
+# 被写入,仅留作未来兜底,实际金额在下方按 feed_scene 汇总 ad_feed_reward_record 得出。reward_video/
+# ad_reward 是激励视频,单独成桶、不再混进领券奖励(历史误并会把激励视频金币双计进领券)。
+COUPON_REWARD_BIZ_TYPES = ("coupon", "coupon_reward")
 COMPARISON_REWARD_BIZ_TYPES = ("comparison", "compare_reward", "comparison_reward")
 EXCLUDED_REWARD_BIZ_TYPES = ("invite_inviter", "invite_invitee", "admin_grant")
 UNCLASSIFIED_FEED_BIZ_TYPES = ("feed_ad_reward",)
 REGULAR_TASK_EXCLUDED_BIZ_TYPES = (
+    *REWARD_VIDEO_BIZ_TYPES,
     *COUPON_REWARD_BIZ_TYPES,
     *COMPARISON_REWARD_BIZ_TYPES,
     *EXCLUDED_REWARD_BIZ_TYPES,
@@ -55,29 +67,10 @@ def _beijing_today_start_utc() -> datetime:
 def today_dau(db: Session) -> int:
     """今日活跃用户数(DAU):登录 + 开始比价 + 开始领券,按用户去重。
 
-    广告收益报表复用这个函数;历史窗口 DAU 由 dashboard_overview 的 period 口径另算。
+    = period_active_dau(今天, 今天);历史 / 多天窗口用 period_active_dau 传区间(广告收益报表复用)。
     """
     today_bj = datetime.now(_BEIJING).date()
-    today_start = _beijing_today_start_utc()
-    tomorrow_start = today_start + timedelta(days=1)
-    login_user_ids = _id_set(
-        db,
-        select(User.id).where(User.last_login_at >= today_start, User.last_login_at < tomorrow_start),
-    )
-    compare_start_user_ids = _event_user_ids(
-        db, (COMPARE_START_EVENT,), today_start, tomorrow_start
-    )
-    coupon_event_user_ids = _event_user_ids(
-        db, (COUPON_START_EVENT,), today_start, tomorrow_start
-    )
-    coupon_claim_user_ids = _id_set(
-        db,
-        select(CouponPromptEngagement.user_id).where(
-            CouponPromptEngagement.engage_date == today_bj,
-            CouponPromptEngagement.engage_type == "claim_started",
-        ),
-    )
-    return len(login_user_ids | compare_start_user_ids | coupon_event_user_ids | coupon_claim_user_ids)
+    return period_active_dau(db, today_bj, today_bj)
 
 
 def _default_period_end() -> date:
@@ -134,6 +127,56 @@ def _event_user_ids(
     )
 
 
+def _period_active_user_ids(
+    db: Session,
+    *,
+    start_utc: datetime,
+    end_utc: datetime,
+    period_from: date,
+    period_to: date,
+) -> set[int]:
+    """区间去重活跃用户 id 集合:登录(last_login_at)+ 开始比价(real_compare_start)+
+    开始领券(real_coupon_start / claim_started)。
+
+    user / analytics_event 用 UTC aware 边界 [start_utc, end_utc);coupon_prompt_engagement
+    的 engage_date 是北京自然日 date 列,用 [period_from, period_to] 闭区间。今日 / 历史 / 多天通用。
+    """
+    login_user_ids = _id_set(
+        db,
+        select(User.id).where(User.last_login_at >= start_utc, User.last_login_at < end_utc),
+    )
+    compare_start_user_ids = _event_user_ids(db, (COMPARE_START_EVENT,), start_utc, end_utc)
+    coupon_event_user_ids = _event_user_ids(db, (COUPON_START_EVENT,), start_utc, end_utc)
+    coupon_claim_user_ids = _id_set(
+        db,
+        select(CouponPromptEngagement.user_id).where(
+            CouponPromptEngagement.engage_date >= period_from,
+            CouponPromptEngagement.engage_date <= period_to,
+            CouponPromptEngagement.engage_type == "claim_started",
+        ),
+    )
+    return login_user_ids | compare_start_user_ids | coupon_event_user_ids | coupon_claim_user_ids
+
+
+def period_active_dau(db: Session, date_from: date, date_to: date) -> int:
+    """任意北京自然日区间 [date_from, date_to] 的去重活跃用户数。
+
+    与数据大盘 period.users.active 同口径(登录 + 开始比价 + 开始领券);广告收益报表按所选
+    日期区间(含今日)复用,ARPU = 区间预估收益 ÷ 本数。全局口径,不随用户 / 类型 / 场景筛选变化。
+    """
+    period_from, period_to = _normalize_period(date_from, date_to)
+    start_utc, end_utc, _start_local, _end_local = _period_bounds(period_from, period_to)
+    return len(
+        _period_active_user_ids(
+            db,
+            start_utc=start_utc,
+            end_utc=end_utc,
+            period_from=period_from,
+            period_to=period_to,
+        )
+    )
+
+
 def _commission_rate_percent(raw: str | None) -> Decimal | None:
     """美团 commissionRate 原值: "300"=3%, "10"=0.1%;也兼容 "3%"。"""
     if raw is None:
@@ -261,31 +304,19 @@ def dashboard_overview(
     period_new_user_ids = _user_id_set(
         select(User.id).where(User.created_at >= start_utc, User.created_at < end_utc)
     )
-    login_user_ids = _user_id_set(
-        select(User.id).where(User.last_login_at >= start_utc, User.last_login_at < end_utc)
-    )
-    compare_start_user_ids = _event_user_ids(
-        db, (COMPARE_START_EVENT,), start_utc, end_utc
-    )
-    coupon_event_user_ids = _event_user_ids(
-        db, (COUPON_START_EVENT,), start_utc, end_utc
-    )
-    coupon_claim_user_ids = _user_id_set(
-        select(CouponPromptEngagement.user_id).where(
-            CouponPromptEngagement.engage_date >= period_from,
-            CouponPromptEngagement.engage_date <= period_to,
-            CouponPromptEngagement.engage_type == "claim_started",
-        )
-    )
-    period_active_user_ids = (
-        login_user_ids | compare_start_user_ids | coupon_event_user_ids | coupon_claim_user_ids
-    )
-    period_retained_new_user_ids = period_new_user_ids & period_active_user_ids
-    period_retention_rate = (
-        round(len(period_retained_new_user_ids) / len(period_new_user_ids), 4)
-        if period_new_user_ids
-        else None
+    period_active_user_ids = _period_active_user_ids(
+        db,
+        start_utc=start_utc,
+        end_utc=end_utc,
+        period_from=period_from,
+        period_to=period_to,
     )
+    # 留存口径(2026-07-05 产品改):次日留存——窗口内每天 D,取 **D-1 日(前日)新增**用户,
+    # 统计其 D 日活跃(登录/开始比价/开始领券)比例,逐日累加。默认窗口=昨日单天,即
+    # 「前日新增用户的昨日留存」。原口径(窗口内新增∩窗口内活跃)在单日窗口下≈100% 无意义
+    # (注册即登录,当天新增必然当天活跃)。逐日 cohort 在下方 trend 循环内顺带累计。
+    retention_cohort_total = 0
+    retention_retained_total = 0
     trend_points: list[dict] = []
     for cur_date in _date_range(period_from, period_to):
         day_start_utc, day_end_utc, day_start_local, day_end_local = _period_bounds(
@@ -295,33 +326,26 @@ def dashboard_overview(
             ComparisonRecord.created_at >= day_start_local,
             ComparisonRecord.created_at < day_end_local,
         )
-        daily_login_user_ids = _user_id_set(
+        daily_active_user_ids = _period_active_user_ids(
+            db,
+            start_utc=day_start_utc,
+            end_utc=day_end_utc,
+            period_from=cur_date,
+            period_to=cur_date,
+        )
+        # 次日留存:cohort = 前一日(D-1)新增用户,留存 = 其中当日(D)活跃者(口径见上)。
+        cohort_ids = _user_id_set(
             select(User.id).where(
-                User.last_login_at >= day_start_utc,
-                User.last_login_at < day_end_utc,
-            )
-        )
-        daily_compare_start_user_ids = _event_user_ids(
-            db, (COMPARE_START_EVENT,), day_start_utc, day_end_utc
-        )
-        daily_coupon_event_user_ids = _event_user_ids(
-            db, (COUPON_START_EVENT,), day_start_utc, day_end_utc
-        )
-        daily_coupon_claim_user_ids = _user_id_set(
-            select(CouponPromptEngagement.user_id).where(
-                CouponPromptEngagement.engage_date == cur_date,
-                CouponPromptEngagement.engage_type == "claim_started",
+                User.created_at >= day_start_utc - timedelta(days=1),
+                User.created_at < day_end_utc - timedelta(days=1),
             )
         )
+        retention_cohort_total += len(cohort_ids)
+        retention_retained_total += len(cohort_ids & daily_active_user_ids)
         trend_points.append(
             {
                 "date": cur_date,
-                "active_users": len(
-                    daily_login_user_ids
-                    | daily_compare_start_user_ids
-                    | daily_coupon_event_user_ids
-                    | daily_coupon_claim_user_ids
-                ),
+                "active_users": len(daily_active_user_ids),
                 "new_users": _count(
                     User,
                     User.created_at >= day_start_utc,
@@ -330,6 +354,11 @@ def dashboard_overview(
                 "comparisons": _count(ComparisonRecord, *daily_comparison_conds),
             }
         )
+    period_retention_rate = (
+        round(retention_retained_total / retention_cohort_total, 4)
+        if retention_cohort_total
+        else None
+    )
 
     period_coin_conds = (
         CoinTransaction.created_at >= start_local,
@@ -339,7 +368,7 @@ def dashboard_overview(
     period_reward_video_coin_total = _sum(
         CoinTransaction.amount,
         *period_coin_conds,
-        CoinTransaction.biz_type.in_(("reward_video", "ad_reward")),
+        CoinTransaction.biz_type.in_(REWARD_VIDEO_BIZ_TYPES),
     )
     period_feed_ad_coin_total = _sum(
         CoinTransaction.amount,
@@ -361,15 +390,29 @@ def dashboard_overview(
         *period_coin_conds,
         CoinTransaction.biz_type.like("task_%"),
     )
+    # 领券/比价奖励金币 = biz_type 桶(历史空,兜底)+ 该场景信息流广告实发金币
+    # (ad_feed_reward_record.feed_scene,granted;reward_date 是北京日期串,与 period 同自然日窗口)。
     period_coupon_reward_coin_total = _sum(
         CoinTransaction.amount,
         *period_coin_conds,
         CoinTransaction.biz_type.in_(COUPON_REWARD_BIZ_TYPES),
+    ) + _sum(
+        AdFeedRewardRecord.coin,
+        AdFeedRewardRecord.status == "granted",
+        AdFeedRewardRecord.feed_scene == "coupon",
+        AdFeedRewardRecord.reward_date >= period_from.isoformat(),
+        AdFeedRewardRecord.reward_date <= period_to.isoformat(),
     )
     period_comparison_reward_coin_total = _sum(
         CoinTransaction.amount,
         *period_coin_conds,
         CoinTransaction.biz_type.in_(COMPARISON_REWARD_BIZ_TYPES),
+    ) + _sum(
+        AdFeedRewardRecord.coin,
+        AdFeedRewardRecord.status == "granted",
+        AdFeedRewardRecord.feed_scene == "comparison",
+        AdFeedRewardRecord.reward_date >= period_from.isoformat(),
+        AdFeedRewardRecord.reward_date <= period_to.isoformat(),
     )
     period_regular_task_coin_total = _sum(
         CoinTransaction.amount,
@@ -413,6 +456,98 @@ def dashboard_overview(
         else None
     )
 
+    # ===== 领券核心数据(2026-07-05 产品新增)=====
+    # 数据源:coupon_session(一次领券一行,started_date 北京自然日)+ coupon_claim_record
+    # (一券/点位一天一条终态,claim_date 北京自然日)。点位与 session 不按 trace_id 关联——
+    # record_claims 更新路径不覆盖 trace_id(同设备同券同日重跑归第一次的 trace),按
+    # (device_id, 自然日) 桶关联才可靠;同桶多次发起共享同一份点位终态。
+    period_coupon_sessions = db.execute(
+        select(
+            CouponSession.device_id,
+            CouponSession.started_date,
+            CouponSession.status,
+            CouponSession.elapsed_ms,
+        ).where(
+            CouponSession.started_date >= period_from,
+            CouponSession.started_date <= period_to,
+            # 只统计正式环境,同「领券数据」页默认口径(防 debug 包调试数据串台;
+            # 命中 ix_coupon_session_date_env)。点位表无 app_env 列,但点位指标只经
+            # 下方 prod session 触达的 (device, 日) 桶进入统计,随之收敛到 prod。
+            CouponSession.app_env == "prod",
+        )
+    ).all()
+    coupon_started = len(period_coupon_sessions)
+    coupon_completed_elapsed = sorted(
+        s.elapsed_ms
+        for s in period_coupon_sessions
+        if s.status == "completed" and s.elapsed_ms is not None
+    )
+    # 点位桶:(device, 日) → (点位总数, 成功点位数)。成功口径与「我的」页累计领券一致
+    # (sum_claimed_count,2026-06-15 产品定):success + already_claimed(已领过=持有券)都算成功。
+    point_buckets: dict[tuple[str, date], tuple[int, int]] = {
+        (dev, d): (int(total), int(succ or 0))
+        for dev, d, total, succ in db.execute(
+            select(
+                CouponClaimRecord.device_id,
+                CouponClaimRecord.claim_date,
+                func.count(),
+                func.sum(
+                    case(
+                        (CouponClaimRecord.status.in_(("success", "already_claimed")), 1),
+                        else_=0,
+                    )
+                ),
+            )
+            .where(
+                CouponClaimRecord.claim_date >= period_from,
+                # 上界放宽一天:跨零点场次(23:5x 发起)的点位 claim_date 落在发起日+1,
+                # 桶只经下方 session 触达的键参与计数,放宽不会引入无关数据。
+                CouponClaimRecord.claim_date <= period_to + timedelta(days=1),
+            )
+            .group_by(CouponClaimRecord.device_id, CouponClaimRecord.claim_date)
+        ).all()
+    }
+    # 全部领成功的次数:completed 且其 (device, 日) 桶内点位全部成功(桶为空不算)。
+    coupon_all_success = 0
+    completed_bucket_totals: list[int] = []
+    session_bucket_keys: set[tuple[str, date]] = set()
+    for s in period_coupon_sessions:
+        key = (s.device_id, s.started_date)
+        if key not in point_buckets:
+            # 跨零点回退:发起日桶不存在(点位终态全部落在次日)时取 (device, 发起日+1)。
+            # 仅在发起日桶完全缺失时回退,避免抢占该设备次日 session 自己的桶。
+            next_key = (s.device_id, s.started_date + timedelta(days=1))
+            if next_key in point_buckets:
+                key = next_key
+        bucket = point_buckets.get(key)
+        if bucket is not None:
+            session_bucket_keys.add(key)
+        if s.status != "completed" or bucket is None:
+            continue
+        total, succ = bucket
+        completed_bucket_totals.append(total)
+        if total > 0 and succ == total:
+            coupon_all_success += 1
+    # 每次发起的应领点位数:取「完成过的领券」实际点位数的众数(done 帧会给所有点位终态,
+    # 完成场的点位数=当前配置的全量点位数;数据自校准,配置改点位数无需改代码)。本期无完成场
+    # 时给不出,点位成功率置空。
+    coupon_points_per_session = (
+        Counter(completed_bucket_totals).most_common(1)[0][0]
+        if completed_bucket_totals
+        else None
+    )
+    # 成功点位数:本期 session 触达过的 (device, 日) 桶内成功点位之和(桶级去重,同桶重试不重复计)。
+    coupon_point_success = sum(point_buckets[k][1] for k in session_bucket_keys)
+    # 点位成功率 = 成功点位数 / (发起数 × 应领点位数):中途退出未跑到的点位不产生记录,
+    # 但发起数×点位数把它们计入分母 → 视为失败,符合产品口径;重试会拉低该率(分母按次数计)。
+    coupon_point_success_rate = (
+        round(
+            min(1.0, coupon_point_success / (coupon_started * coupon_points_per_session)), 4
+        )
+        if coupon_started and coupon_points_per_session
+        else None
+    )
+
     return {
         "users": {
             "total": _count(User),
@@ -428,7 +563,7 @@ def dashboard_overview(
             "reward_video_coin_total": _sum(
                 CoinTransaction.amount,
                 CoinTransaction.amount > 0,
-                CoinTransaction.biz_type.in_(("reward_video", "ad_reward")),
+                CoinTransaction.biz_type.in_(REWARD_VIDEO_BIZ_TYPES),
             ),
             "reward_video_watch_count": _count(
                 AdRewardRecord,
@@ -476,11 +611,13 @@ def dashboard_overview(
             "users": {
                 "new": len(period_new_user_ids),
                 "active": len(period_active_user_ids),
-                "retained_new_users": len(period_retained_new_user_ids),
+                "retained_new_users": retention_retained_total,
+                "retention_cohort": retention_cohort_total,
                 "retention_rate": period_retention_rate,
                 "retention_note": (
-                    "口径:登录(last_login_at)+开始比价(real_compare_start)+"
-                    "开始领券(real_coupon_start/claim_started),按用户去重"
+                    "次日留存:窗口内每天取前一日新增用户,统计其当日活跃"
+                    "(登录/开始比价/开始领券,按用户去重)比例,逐日累加;"
+                    "默认窗口=昨日,即前日新增用户的昨日留存"
                 ),
             },
             "comparison": {
@@ -491,6 +628,17 @@ def dashboard_overview(
                 "average_duration_ms": period_avg_duration_ms,
                 "average_saved_cents": period_avg_saved_cents,
             },
+            "coupon": {
+                "started": coupon_started,
+                "all_success": coupon_all_success,
+                "success_rate": (
+                    round(coupon_all_success / coupon_started, 4) if coupon_started else None
+                ),
+                "point_success": coupon_point_success,
+                "points_per_session": coupon_points_per_session,
+                "point_success_rate": coupon_point_success_rate,
+                "median_elapsed_ms": _percentile(coupon_completed_elapsed, 50),
+            },
             "coins": {
                 "granted_total": _sum(CoinTransaction.amount, *period_coin_conds),
                 "reward_video_coin_total": period_reward_video_coin_total,

app/admin/routers/ad_revenue.py

@@ -91,6 +91,7 @@ def get_ad_revenue_report(
         daily=[AdRevenueDaily(**d) for d in result["daily"]],
         hourly=[AdRevenueHourly(**h) for h in result["hourly"]],
         type_stats={k: AdRevenueTypeStat(**v) for k, v in result["type_stats"].items()},
+        scene_stats={k: AdRevenueTypeStat(**v) for k, v in result["scene_stats"].items()},
         dau=result["dau"],
         total=result["total"],
         truncated=result["truncated"],

app/admin/routers/admins.py

@@ -5,6 +5,8 @@ from fastapi import APIRouter, Depends, HTTPException, Request
 
 from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, CurrentAdmin, get_client_ip, require_role
+from app.admin.permissions import CUSTOM_ROLE, SUPER_ADMIN_ROLE, sanitize_pages
+from app.admin.repositories import admin_role as role_repo
 from app.admin.repositories import admin_user as admin_repo
 from app.admin.schemas.admin import AdminCreateRequest, AdminUpdateRequest
 from app.admin.schemas.auth import AdminOut
@@ -23,9 +25,31 @@ def _active_super_count(db: AdminDb) -> int:
     )
 
 
-@router.get("", response_model=list[AdminOut], summary="管理员列表")
+def _validate_role(db: AdminDb, role: str) -> None:
+    """角色必须是 super_admin / custom(自定义) / admin_role 表里已存在的角色,否则 400。"""
+    if role in (SUPER_ADMIN_ROLE, CUSTOM_ROLE):
+        return
+    role_repo.ensure_builtin_roles(db)  # 空表(测试/全新库)兜底播种,再校验
+    if role_repo.get_role(db, role) is None:
+        raise HTTPException(status_code=400, detail=f"角色不存在: {role}")
+
+
+def _clean_override(role: str, pages_override: list[str] | None) -> list[str] | None:
+    """按最终角色算出该存的 pages_override:custom → 勾选集(过滤非法 key,可空列表);
+    非 custom → None(切回普通角色即清空自定义页)。"""
+    if role == CUSTOM_ROLE:
+        return sanitize_pages(pages_override)
+    return None
+
+
+@router.get("", response_model=list[AdminOut], summary="管理员列表(含明文密码,super_admin 专属)")
 def list_admins(db: AdminDb) -> list[AdminOut]:
-    return [AdminOut.model_validate(a) for a in admin_repo.list_admins(db)]
+    out: list[AdminOut] = []
+    for a in admin_repo.list_admins(db):
+        item = AdminOut.model_validate(a)
+        item.password = a.plain_password  # 明文:仅本 super_admin 专属路由下发,供权限管理页复看
+        out.append(item)
+    return out
 
 
 @router.post("", response_model=AdminOut, summary="创建管理员")
@@ -34,12 +58,17 @@ def create_admin(
 ) -> AdminOut:
     if admin_repo.get_by_username(db, body.username) is not None:
         raise HTTPException(status_code=409, detail="用户名已存在")
+    _validate_role(db, body.role)
+    override = _clean_override(body.role, body.pages_override)
     new = admin_repo.create_admin(
-        db, username=body.username, password=body.password, role=body.role
+        db, username=body.username, password=body.password, role=body.role,
+        plain_password=body.password,  # UI 建的账号留存明文,供权限管理页复看
+        pages_override=override,
     )
     write_audit(
         db, admin, action="admin.create", target_type="admin", target_id=new.id,
-        detail={"username": new.username, "role": new.role}, ip=get_client_ip(request), commit=True,
+        detail={"username": new.username, "role": new.role, "pages_override": override},
+        ip=get_client_ip(request), commit=True,
     )
     return AdminOut.model_validate(new)
 
@@ -67,8 +96,12 @@ def update_admin(
     if demotes_super and _active_super_count(db) <= 1:
         raise HTTPException(status_code=400, detail="不能降级/禁用最后一个超级管理员")
 
+    if body.role is not None:
+        _validate_role(db, body.role)
+
     changes: dict = {}
-    if body.role is not None and body.role != target.role:
+    role_changed = body.role is not None and body.role != target.role
+    if role_changed:
         changes["role"] = {"before": target.role, "after": body.role}
         target.role = body.role
     if body.status is not None and body.status != target.status:
@@ -77,6 +110,18 @@ def update_admin(
     if body.password is not None:
         changes["password"] = "reset"
         target.password_hash = hash_password(body.password)
+        target.plain_password = body.password  # 同步留存明文,权限管理页复看保持一致
+
+    # 自定义可见页:按「最终角色」(target.role,已应用完角色变更)决定该存什么。
+    # - 切到/维持 custom 且传了 pages_override → 用勾选集;切到 custom 没传 → 清成空列表。
+    # - 切回普通角色 → 清空 override(_clean_override 返回 None)。
+    # - 角色没变、只传 pages_override(编辑现有 custom 用户的勾选)→ 也更新。
+    if role_changed or body.pages_override is not None:
+        new_override = _clean_override(target.role, body.pages_override)
+        if new_override != target.pages_override:
+            changes["pages_override"] = {"before": target.pages_override, "after": new_override}
+            target.pages_override = new_override
+
     if not changes:
         raise HTTPException(status_code=400, detail="无任何变更字段")
     db.commit()
@@ -86,3 +131,27 @@ def update_admin(
         detail=changes, ip=get_client_ip(request), commit=True,
     )
     return AdminOut.model_validate(target)
+
+
+@router.delete("/{admin_id}", summary="删除管理员(带审计)")
+def delete_admin(admin_id: int, request: Request, admin: CurrentAdmin, db: AdminDb) -> dict:
+    target = admin_repo.get_by_id(db, admin_id)
+    if target is None:
+        raise HTTPException(status_code=404, detail="管理员不存在")
+    if admin_id == admin.id:
+        raise HTTPException(status_code=400, detail="不能删除自己")
+    # 防自锁:删掉某个 active super_admin 前,确认后仍至少剩 1 个,否则进「零可用超管」死局。
+    if (
+        target.role == "super_admin"
+        and target.status == "active"
+        and _active_super_count(db) <= 1
+    ):
+        raise HTTPException(status_code=400, detail="不能删除最后一个超级管理员")
+    username = target.username
+    db.delete(target)
+    db.commit()
+    write_audit(
+        db, admin, action="admin.delete", target_type="admin", target_id=admin_id,
+        detail={"username": username, "role": target.role}, ip=get_client_ip(request), commit=True,
+    )
+    return {"deleted": True}

app/admin/routers/analytics_health.py

@@ -0,0 +1,49 @@
+"""admin 埋点健康度:埋点成功率 / 上报成功率 总览 + 趋势 + 下钻(只读)。"""
+from __future__ import annotations
+
+from datetime import datetime
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from app.admin.deps import AdminDb, get_current_admin
+from app.admin.repositories import analytics_health as repo
+from app.admin.schemas.analytics_health import (
+    HealthBreakdownRow,
+    HealthMetrics,
+    HealthTrendPoint,
+)
+
+router = APIRouter(
+    prefix="/admin/api/analytics-health",
+    tags=["admin-analytics-health"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("/overview", response_model=HealthMetrics, summary="两段成功率总览")
+def overview(
+    db: AdminDb,
+    date_from: Annotated[datetime, Query()],
+    date_to: Annotated[datetime, Query()],
+) -> HealthMetrics:
+    return HealthMetrics(**repo.overview(db, date_from, date_to))
+
+
+@router.get("/trend", response_model=list[HealthTrendPoint], summary="按北京天趋势")
+def trend(
+    db: AdminDb,
+    date_from: Annotated[datetime, Query()],
+    date_to: Annotated[datetime, Query()],
+) -> list[HealthTrendPoint]:
+    return [HealthTrendPoint(**p) for p in repo.trend(db, date_from, date_to)]
+
+
+@router.get("/breakdown", response_model=list[HealthBreakdownRow], summary="按维度下钻")
+def breakdown(
+    db: AdminDb,
+    date_from: Annotated[datetime, Query()],
+    date_to: Annotated[datetime, Query()],
+    dim: Annotated[str, Query(pattern="^(event|app_ver|oem)$")] = "event",
+) -> list[HealthBreakdownRow]:
+    return [HealthBreakdownRow(**r) for r in repo.breakdown(db, date_from, date_to, dim)]

app/admin/routers/auth.py

@@ -6,6 +6,8 @@ import logging
 from fastapi import APIRouter, Depends, HTTPException
 
 from app.admin.deps import AdminDb, CurrentAdmin
+from app.admin.permissions import CUSTOM_ROLE, sanitize_pages
+from app.admin.repositories import admin_role as role_repo
 from app.admin.repositories import admin_user as admin_repo
 from app.admin.schemas.auth import AdminLoginRequest, AdminLoginResponse, AdminOut
 from app.admin.security import create_admin_token
@@ -17,6 +19,17 @@ logger = logging.getLogger("shagua.admin.auth")
 router = APIRouter(prefix="/admin/api/auth", tags=["admin-auth"])
 
 
+def _admin_out_with_pages(admin, db: AdminDb) -> AdminOut:  # noqa: ANN001
+    """AdminOut + 有效可见页(前端左侧导航按此过滤)。
+    role=="custom" → 用这个人的 pages_override(按人自定义,过滤悬空 key);其余走角色解析。"""
+    out = AdminOut.model_validate(admin)
+    if admin.role == CUSTOM_ROLE:
+        out.pages = sanitize_pages(admin.pages_override)
+    else:
+        out.pages = role_repo.effective_pages_of(db, admin.role)
+    return out
+
+
 @router.post(
     "/login",
     response_model=AdminLoginResponse,
@@ -39,10 +52,10 @@ def login(req: AdminLoginRequest, db: AdminDb) -> AdminLoginResponse:
     return AdminLoginResponse(
         access_token=token,
         expires_in=expires_in,
-        admin=AdminOut.model_validate(admin),
+        admin=_admin_out_with_pages(admin, db),
     )
 
 
-@router.get("/me", response_model=AdminOut, summary="当前管理员")
-def me(admin: CurrentAdmin) -> AdminOut:
-    return AdminOut.model_validate(admin)
+@router.get("/me", response_model=AdminOut, summary="当前管理员(含有效可见页)")
+def me(admin: CurrentAdmin, db: AdminDb) -> AdminOut:
+    return _admin_out_with_pages(admin, db)

app/admin/routers/comparison.py

@@ -32,12 +32,15 @@ def list_comparison_records(
     phone: Annotated[str | None, Query(description="手机号前缀")] = None,
     status: Annotated[str | None, Query(pattern="^(success|failed|cancelled)$")] = None,
     business_type: Annotated[str | None, Query()] = None,
+    store: Annotated[str | None, Query(description="店名子串模糊匹配")] = None,
+    product: Annotated[str | None, Query(description="商品名子串模糊匹配")] = None,
     limit: Annotated[int, Query(ge=1, le=100)] = 20,
     cursor: Annotated[int | None, Query()] = None,
 ) -> CursorPage[AdminComparisonListItem]:
     items, next_cursor, total = queries.list_comparison_records(
         db, user_id=user_id, phone=phone, status=status,
-        business_type=business_type, limit=limit, cursor=cursor,
+        business_type=business_type, store=store, product=product,
+        limit=limit, cursor=cursor,
     )
     return CursorPage(
         items=[AdminComparisonListItem.model_validate(r) for r in items],

app/admin/routers/config.py

@@ -55,9 +55,14 @@ def _item(db, key: str) -> ConfigItemOut:
     raise HTTPException(status_code=404, detail="未知配置项")
 
 
-@router.get("", response_model=list[ConfigItemOut], summary="所有可配项 + 当前值")
+@router.get("", response_model=list[ConfigItemOut], summary="所有可配项 + 当前值(不含 hidden)")
 def list_config(db: AdminDb) -> list[ConfigItemOut]:
-    return [ConfigItemOut(**item) for item in app_config.list_all(db)]
+    # hidden 项(已下线/由专用页管理,如福利页任务·里程碑·看广告调参、首页轮播数据源)不在本页渲染。
+    return [
+        ConfigItemOut(**item)
+        for item in app_config.list_all(db)
+        if not CONFIG_DEFS[item["key"]].get("hidden")
+    ]
 
 
 @router.patch("/{key}", response_model=ConfigItemOut, summary="改某项配置(带审计)")

app/admin/routers/coupon_data.py

@@ -18,6 +18,8 @@ from app.admin.schemas.coupon_data import (
     CouponDataOut,
     CouponDataRow,
     CouponDataSummary,
+    CouponSlotRow,
+    CouponSlotsOut,
     CouponUserRecordsOut,
 )
 from app.core.rewards import cn_today
@@ -52,6 +54,10 @@ def get_coupon_data(
     date_to: Annotated[str | None, Query(description="结束日 北京 YYYY-MM-DD,闭区间,默认=date_from")] = None,
     user: Annotated[str | None, Query(description="用户手机号/昵称模糊搜;不传=全部")] = None,
     app_env: Annotated[str, Query(description="prod(默认) / dev / all(全部环境)")] = "prod",
+    status: Annotated[
+        list[str] | None,
+        Query(description="领券状态多选 started/completed/failed/abandoned;不传=全部"),
+    ] = None,
     granularity: Annotated[
         str, Query(description="day=按天 / hour=按小时(北京);区间>1 天建议 day")
     ] = "day",
@@ -73,7 +79,7 @@ def get_coupon_data(
     env = None if app_env == "all" else app_env
     result = coupon_data.coupon_data_report(
         db, date_from=d_from.isoformat(), date_to=d_to.isoformat(),
-        user=user, app_env=env, granularity=granularity,
+        user=user, app_env=env, statuses=status, granularity=granularity,
         limit=limit, offset=offset, sort=sort,
     )
     return CouponDataOut(
@@ -87,6 +93,35 @@ def get_coupon_data(
     )
 
 
+@router.get(
+    "/coupons",
+    response_model=CouponSlotsOut,
+    summary="按券成功率(coupon_id 粒度;成功/(成功+失败),skipped 排除,设备-天口径)",
+)
+def get_coupon_slots(
+    db: AdminDb,
+    date_from: Annotated[str | None, Query(description="起始日 北京 YYYY-MM-DD,默认今天")] = None,
+    date_to: Annotated[str | None, Query(description="结束日 北京 YYYY-MM-DD,闭区间,默认=date_from")] = None,
+    app_env: Annotated[str, Query(description="prod(默认) / dev / all(全部环境)")] = "prod",
+) -> CouponSlotsOut:
+    today = cn_today()
+    d_from = _parse_day(date_from, field="date_from", default=today)
+    d_to = _parse_day(date_to, field="date_to", default=d_from)
+    if d_to < d_from:
+        raise HTTPException(status_code=422, detail="date_to 不能早于 date_from")
+    if (d_to - d_from).days + 1 > _MAX_RANGE_DAYS:
+        raise HTTPException(status_code=422, detail=f"区间最长 {_MAX_RANGE_DAYS} 天")
+    env = None if app_env == "all" else app_env
+    result = coupon_data.coupon_slot_report(
+        db, date_from=d_from.isoformat(), date_to=d_to.isoformat(), app_env=env
+    )
+    return CouponSlotsOut(
+        date_from=d_from.isoformat(),
+        date_to=d_to.isoformat(),
+        items=[CouponSlotRow(**r) for r in result["items"]],
+    )
+
+
 @router.get(
     "/user-records",
     response_model=CouponUserRecordsOut,

app/admin/routers/feedback.py

@@ -36,6 +36,8 @@ def _ensure_pending(fb: Feedback) -> None:
 def list_feedbacks(
     db: AdminDb,
     status: Annotated[str | None, Query()] = None,
+    # 反馈类型筛选:profile(普通反馈)/ comparison(比价反馈);None=全部
+    source: Annotated[str | None, Query(pattern="^(profile|comparison)$")] = None,
     user_id: Annotated[int | None, Query()] = None,
     content: Annotated[str | None, Query(max_length=100)] = None,
     created_from: Annotated[datetime | None, Query()] = None,
@@ -48,6 +50,7 @@ def list_feedbacks(
     items, next_cursor, total = queries.list_feedbacks(
         db,
         status=status,
+        source=source,
         user_id=user_id,
         content=content,
         created_from=created_from,
@@ -101,6 +104,7 @@ def approve_feedback(
         status="adopted",
         reward_coins=payload.reward_coins,
         review_note=payload.note,
+        admin_reply=payload.reply,
         reviewed_by_admin_id=admin.id,
         commit=False,
     )
@@ -123,6 +127,7 @@ def approve_feedback(
             "after": "adopted",
             "reward_coins": payload.reward_coins,
             "note": payload.note,
+            "reply": payload.reply,
         },
         ip=get_client_ip(request),
         commit=False,
@@ -152,6 +157,7 @@ def reject_feedback(
         status="rejected",
         reject_reason=payload.reason,
         review_note=payload.note,
+        admin_reply=payload.reply,
         reviewed_by_admin_id=admin.id,
         commit=False,
     )
@@ -166,6 +172,7 @@ def reject_feedback(
             "after": "rejected",
             "reason": payload.reason,
             "note": payload.note,
+            "reply": payload.reply,
         },
         ip=get_client_ip(request),
         commit=False,

app/admin/routers/ops_marquee_seed.py

@@ -8,6 +8,7 @@ from __future__ import annotations
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
+from pydantic import BaseModel
 
 from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
@@ -18,11 +19,17 @@ from app.admin.schemas.ops_marquee_seed import (
     OpsMarqueeSeedCreate,
     OpsMarqueeSeedOut,
     OpsMarqueeSeedUpdate,
+    OpsRealRecordItem,
+    OpsRealRecordsOut,
     OpsSavingsFeedPreviewOut,
 )
 from app.models.admin import AdminUser
 from app.models.ops_marquee_seed import OpsMarqueeSeed
-from app.repositories import ops_marquee
+from app.repositories import app_config, ops_marquee
+
+
+class MarqueeModeUpdate(BaseModel):
+    mode: str  # mixed / real / seed
 
 router = APIRouter(
     prefix="/admin/api/marquee-seeds",
@@ -52,9 +59,58 @@ def list_seeds(db: AdminDb) -> list[OpsMarqueeSeedOut]:
 def preview_feed(
     db: AdminDb,
     limit: Annotated[int, Query(ge=1, le=30)] = 8,
+    mode: Annotated[str | None, Query(description="mixed/real/seed;不传=当前持久化模式")] = None,
 ) -> OpsSavingsFeedPreviewOut:
-    """返回客户端实际会看到的 feed(真实记录会插队、种子随机抽取/金额随机/名字合成),供运营对效果。"""
-    return OpsSavingsFeedPreviewOut(items=ops_marquee.get_feed(db, limit=limit))
+    """返回客户端实际会看到的 feed(真实记录会插队、种子随机抽取/金额随机/名字合成),供运营对效果。
+
+    mode 显式指定则预览该模式(**不改持久化配置**,供前端切换开关时实时预览);不传则用当前持久化模式。
+    """
+    if mode is not None and mode not in ops_marquee.FEED_MODES:
+        raise HTTPException(status_code=400, detail="mode 需为 mixed / real / seed")
+    return OpsSavingsFeedPreviewOut(items=ops_marquee.get_feed(db, limit=limit, mode=mode))
+
+
+@router.get("/real-records", response_model=OpsRealRecordsOut, summary="分页浏览当前模式下可展示的记录(审核用)")
+def list_real_records(
+    db: AdminDb,
+    mode: Annotated[str | None, Query(description="mixed/real/seed;不传=当前持久化模式")] = None,
+    offset: Annotated[int, Query(ge=0)] = 0,
+    limit: Annotated[int, Query(ge=1, le=50)] = 8,
+) -> OpsRealRecordsOut:
+    """分页列出**当前模式**下可在 app 轮播展示的全部记录(**不去重**):只真实=真实记录;只种子=各启用
+    种子按生成逻辑各出一行;混播=真实+种子。与 app 同口径洗牌+去连簇,固定种子→翻页稳定、能翻遍全部。
+    item.user_id=0 表示种子行。"""
+    if mode is not None and mode not in ops_marquee.FEED_MODES:
+        raise HTTPException(status_code=400, detail="mode 需为 mixed / real / seed")
+    items, total = ops_marquee.list_real_records(db, mode=mode, offset=offset, limit=limit)
+    return OpsRealRecordsOut(items=[OpsRealRecordItem(**it) for it in items], total=total)
+
+
+# 注:/mode 两个端点须在 /{seed_id} 之前注册,否则 PATCH /mode 会被 /{seed_id} 抢先按 id 解析。
+@router.get("/mode", summary="首页轮播数据源模式(mixed/real/seed)")
+def get_feed_mode(db: AdminDb) -> dict:
+    """当前轮播取数模式:mixed=真实优先+种子补位(默认)/ real=只真实 / seed=只种子·合成。"""
+    return {"mode": ops_marquee.get_feed_mode(db)}
+
+
+@router.patch("/mode", summary="改首页轮播数据源模式(带审计)")
+def set_feed_mode(
+    body: MarqueeModeUpdate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> dict:
+    if body.mode not in ops_marquee.FEED_MODES:
+        raise HTTPException(status_code=400, detail="mode 需为 mixed / real / seed")
+    before = ops_marquee.get_feed_mode(db)
+    app_config.set_value(db, "marquee_feed_mode", body.mode, admin_id=admin.id, commit=False)
+    write_audit(
+        db, admin, action="ops_marquee_seed.set_mode", target_type="config",
+        target_id="marquee_feed_mode", detail={"before": before, "after": body.mode},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return {"mode": body.mode}
 
 
 @router.post("", response_model=OpsMarqueeSeedOut, summary="新增轮播种子(带审计)")

app/admin/routers/roles.py

@@ -0,0 +1,129 @@
+"""admin RBAC 角色管理(仅 super_admin):列角色 / 权限目录 / 增删改角色。均写审计。
+
+角色 = 一组「可见页面」(见 app/admin/permissions.py)。角色登录后台后左侧只展示其 pages 对应导航项。
+只有 super_admin(内建全权角色)能进本组端点(dependencies=require_role() 无参 = 仅 super_admin)。
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+from sqlalchemy import func, select
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, CurrentAdmin, get_client_ip, require_role
+from app.admin.permissions import (
+    PERMISSION_CATALOG,
+    SUPER_ADMIN_ROLE,
+    effective_pages,
+    sanitize_pages,
+)
+from app.admin.repositories import admin_role as role_repo
+from app.admin.schemas.role import (
+    PermissionGroup,
+    RoleCreateRequest,
+    RoleOut,
+    RoleUpdateRequest,
+)
+from app.models.admin import AdminUser
+from app.models.admin_role import AdminRole
+
+router = APIRouter(
+    prefix="/admin/api/roles",
+    tags=["admin-roles"],
+    dependencies=[Depends(require_role())],  # 无参 = 仅 super_admin
+)
+
+
+def _usage_counts(db: AdminDb) -> dict[str, int]:
+    rows = db.execute(
+        select(AdminUser.role, func.count(AdminUser.id)).group_by(AdminUser.role)
+    ).all()
+    return {r: c for r, c in rows}
+
+
+def _to_out(role: AdminRole, usage: dict[str, int]) -> RoleOut:
+    return RoleOut(
+        id=role.id,
+        name=role.name,
+        label=role.label or role.name,
+        pages=effective_pages(role.name, role.pages),
+        is_builtin=role.is_builtin,
+        in_use=usage.get(role.name, 0),
+    )
+
+
+@router.get("", response_model=list[RoleOut], summary="角色列表(含可见页 + 使用数)")
+def list_roles(db: AdminDb) -> list[RoleOut]:
+    usage = _usage_counts(db)
+    return [_to_out(r, usage) for r in role_repo.list_roles(db)]
+
+
+@router.get("/catalog", response_model=list[PermissionGroup], summary="页面权限目录(分组)")
+def get_catalog() -> list[PermissionGroup]:
+    return [PermissionGroup(**g) for g in PERMISSION_CATALOG]
+
+
+@router.post("", response_model=RoleOut, summary="新增角色(带审计)")
+def create_role(
+    body: RoleCreateRequest, request: Request, admin: CurrentAdmin, db: AdminDb
+) -> RoleOut:
+    name = body.name.strip()
+    if not name:
+        raise HTTPException(status_code=400, detail="角色名称不能为空")
+    if name == SUPER_ADMIN_ROLE:
+        raise HTTPException(status_code=400, detail="super_admin 为内建角色,不能新建")
+    if role_repo.get_role(db, name) is not None:
+        raise HTTPException(status_code=409, detail="角色名称已存在")
+    # 自定义角色:name(key)= label = 输入名称
+    role = role_repo.create_role(db, name=name, label=name, pages=body.pages)
+    write_audit(
+        db, admin, action="role.create", target_type="role", target_id=str(role.id),
+        detail={"name": name, "pages": role.pages}, ip=get_client_ip(request), commit=True,
+    )
+    return _to_out(role, _usage_counts(db))
+
+
+@router.patch("/{role_id}", response_model=RoleOut, summary="改角色(展示名/可见页,带审计)")
+def update_role(
+    role_id: int, body: RoleUpdateRequest, request: Request, admin: CurrentAdmin, db: AdminDb
+) -> RoleOut:
+    role = db.get(AdminRole, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="角色不存在")
+    if role.is_builtin:
+        raise HTTPException(status_code=400, detail="内建角色「管理员」不可编辑")
+
+    new_label = body.label.strip() if body.label is not None else None
+    changes: dict = {}
+    if new_label and new_label != role.label:
+        changes["label"] = {"before": role.label, "after": new_label}
+    if body.pages is not None:
+        changes["pages"] = {"before": role.pages, "after": sanitize_pages(body.pages)}
+    if not changes:
+        raise HTTPException(status_code=400, detail="无任何变更字段")
+
+    # 只改展示名 + 可见页;key(name)不可变,故无需级联 admin_user.role
+    role_repo.update_role(db, role, label=new_label, pages=body.pages)
+    write_audit(
+        db, admin, action="role.update", target_type="role", target_id=str(role_id),
+        detail=changes, ip=get_client_ip(request), commit=True,
+    )
+    return _to_out(role, _usage_counts(db))
+
+
+@router.delete("/{role_id}", summary="删角色(带审计;内建/在用不可删)")
+def delete_role(role_id: int, request: Request, admin: CurrentAdmin, db: AdminDb) -> dict:
+    role = db.get(AdminRole, role_id)
+    if role is None:
+        raise HTTPException(status_code=404, detail="角色不存在")
+    if role.is_builtin:
+        raise HTTPException(status_code=400, detail="内建角色不可删除")
+    used = _usage_counts(db).get(role.name, 0)
+    if used > 0:
+        raise HTTPException(status_code=400, detail=f"该角色仍有 {used} 名管理员在用,请先改派再删")
+    name = role.name
+    role_repo.delete_role(db, role)
+    write_audit(
+        db, admin, action="role.delete", target_type="role", target_id=str(role_id),
+        detail={"name": name}, ip=get_client_ip(request), commit=True,
+    )
+    return {"deleted": True}

app/admin/routers/users.py

@@ -42,7 +42,12 @@ def list_users(
     created_to: Annotated[datetime | None, Query()] = None,
     last_login_from: Annotated[datetime | None, Query()] = None,
     last_login_to: Annotated[datetime | None, Query()] = None,
-    sort_by: Annotated[str, Query(pattern="^(id|created_at|last_login_at)$")] = "id",
+    # 最近活跃(登录/发起比价/发起领券取最大,见 queries._last_active_expr)筛选与排序
+    last_active_from: Annotated[datetime | None, Query()] = None,
+    last_active_to: Annotated[datetime | None, Query()] = None,
+    sort_by: Annotated[
+        str, Query(pattern="^(id|created_at|last_login_at|last_active_at)$")
+    ] = "id",
     sort_order: Annotated[str, Query(pattern="^(asc|desc)$")] = "desc",
     limit: Annotated[int, Query(ge=1, le=100)] = 20,
     cursor: Annotated[int | None, Query()] = None,
@@ -51,6 +56,7 @@ def list_users(
         db, phone=phone, register_channel=register_channel, status=status,
         nickname=nickname, created_from=created_from, created_to=created_to,
         last_login_from=last_login_from, last_login_to=last_login_to,
+        last_active_from=last_active_from, last_active_to=last_active_to,
         sort_by=sort_by, sort_order=sort_order, limit=limit, cursor=cursor,
     )
     return CursorPage(

app/admin/routers/withdraw.py

@@ -50,6 +50,8 @@ def list_withdraws(
     db: AdminDb,
     user_id: Annotated[int | None, Query()] = None,
     status: Annotated[str | None, Query()] = None,
+    # 提现类型筛选:coin_cash(福利页提现)/ invite_cash(邀请提现);None=全部
+    source: Annotated[str | None, Query(pattern="^(coin_cash|invite_cash)$")] = None,
     keyword: Annotated[str | None, Query(max_length=100)] = None,
     date_from: Annotated[datetime | None, Query()] = None,
     date_to: Annotated[datetime | None, Query()] = None,
@@ -69,6 +71,7 @@ def list_withdraws(
         db,
         user_id=user_id,
         status=status,
+        source=source,
         keyword=keyword,
         date_from=date_from,
         date_to=date_to,

app/admin/schemas/ad_revenue.py

@@ -94,6 +94,11 @@ class AdRevenueRow(BaseModel):
     impressions: int = Field(..., description="本行展示条数:有展示=1 / 纯发奖=0(供日汇总、趋势图复用)")
     ecpm: str | None = Field(None, description="eCPM 原始值(分/千次);展示行取展示值,纯发奖行取发奖采用值")
     revenue_yuan: float = Field(..., description="本次展示预估收益(元)= eCPM元 ÷ 1000;纯发奖行=0")
+    row_revenue_yuan: float | None = Field(
+        None,
+        description="主表逐行展示用的预估收益(元):一次比价/领券聚合行=该次发奖广告 eCPM 折算之和;"
+        "其它行为空(前端回退取 revenue_yuan)。不进合计/趋势,避免与展示侧重复计",
+    )
     adn: str | None = Field(None, description="实际填充 ADN 子渠道(pangle/gdt…);纯发奖行为空")
     slot_id: str | None = Field(None, description="底层 mediation rit(非我们配置的广告位 ID);纯发奖行为空")
     # ── 发奖侧 ──
@@ -106,6 +111,15 @@ class AdRevenueRow(BaseModel):
         None,
         description="发奖复算明细(eCPM/因子1/份数/LT/因子2/应发/实发/一致);点行展开下钻用,纯展示为空",
     )
+    sub_rewards: list[AdRevenueRecord] = Field(
+        default_factory=list,
+        description="一次比价/领券聚合行的组内逐条发奖明细(同一整场 ad_session_id 的多条广告);"
+        "点行展开渲染多行。激励视频/纯展示行为空(单条看 reward_detail)",
+    )
+    sub_count: int = Field(
+        1,
+        description="本行聚合的发奖条数:一次比价/领券=该次广告条数(≥1);激励视频/纯展示=1",
+    )
 
 
 class AdRevenueReportOut(BaseModel):
@@ -122,9 +136,16 @@ class AdRevenueReportOut(BaseModel):
         default_factory=dict,
         description="按广告类型(ad_type)小计 {ad_type: {impressions, revenue_yuan}};前端取 draw / reward_video 做分类大盘",
     )
+    scene_stats: dict[str, AdRevenueTypeStat] = Field(
+        default_factory=dict,
+        description="按信息流场景(feed_scene)小计 {comparison/coupon/welfare: {impressions, revenue_yuan}};"
+        "全量统计(不受分页截断),供数据大盘「领券广告 / 比价广告」卡;feed_scene 为空的事件不计入",
+    )
     dau: int | None = Field(
         None,
-        description="今日活跃用户数(复用大盘口径,last_login_at);**仅查询=今日单天时有值**,历史/多天为 null",
+        description="所选日期区间的去重活跃用户数(口径同数据大盘 period.users.active:登录 + 开始比价 + "
+        "开始领券)。按 date_from~date_to 区间统计,含今日、近 7 天、近 30 天等任意区间;全局口径,"
+        "不随 user_id / ad_type / feed_scene / app_env 筛选变化",
     )
     total: int = Field(..., description="广告事件总数(全量,不受分页影响;= 当前筛选下的分页总条数)")
     truncated: bool = Field(..., description="当前页之后是否还有更多事件(len(events) > offset + limit)")

app/admin/schemas/admin.py

@@ -6,21 +6,25 @@ from typing import Literal
 
 from pydantic import BaseModel, ConfigDict, Field
 
-_Role = Literal["super_admin", "finance", "operator"]
+# 角色不再硬编码枚举:改为任意角色名(自定义角色由 admin_role 表管理),存在性在路由层校验。
 
 
 class AdminCreateRequest(BaseModel):
     username: str = Field(..., min_length=3, max_length=64)
     password: str = Field(..., min_length=8, max_length=72)  # bcrypt ≤72 字节
-    role: _Role = "operator"
+    role: str = Field("operator", min_length=1, max_length=32)
+    # 仅当 role == "custom":这个人专属可见页 key 列表(逐页勾选结果)。其余角色不传/忽略。
+    pages_override: list[str] | None = None
 
 
 class AdminUpdateRequest(BaseModel):
-    """改角色 / 启用禁用 / 重置密码,字段都可选(只改传了的)。"""
+    """改角色 / 启用禁用 / 重置密码 / 自定义可见页,字段都可选(只改传了的)。"""
 
-    role: _Role | None = None
+    role: str | None = Field(None, min_length=1, max_length=32)
     status: Literal["active", "disabled"] | None = None
     password: str | None = Field(None, min_length=8, max_length=72)
+    # 改成/更新「自定义」可见页;role 切回普通角色时后端会清空 override(见路由)。
+    pages_override: list[str] | None = None
 
 
 class AdminAuditLogOut(BaseModel):

app/admin/schemas/analytics_health.py

@@ -0,0 +1,21 @@
+"""埋点健康度 admin 响应 schema。"""
+from __future__ import annotations
+
+from pydantic import BaseModel
+
+
+class HealthMetrics(BaseModel):
+    attempted: int
+    drop_capture: int
+    delivered: int
+    drop_undelivered: int
+    track_success_rate: float | None
+    report_success_rate: float | None
+
+
+class HealthTrendPoint(HealthMetrics):
+    day: str
+
+
+class HealthBreakdownRow(HealthMetrics):
+    key: str

app/admin/schemas/auth.py

@@ -20,6 +20,15 @@ class AdminOut(BaseModel):
     status: str
     created_at: datetime
     last_login_at: datetime | None = None
+    # 该管理员当前角色的有效可见页(= 左侧导航项 key);仅登录 / /me 填充,列表接口默认空。
+    # 前端据此过滤左侧导航(super_admin = 全部页;role=="custom" = pages_override)。见 permissions.py。
+    pages: list[str] = []
+    # 「自定义」可见页原始勾选集(role=="custom" 时非空);列表接口下发,供权限管理页编辑回填勾选。
+    # 普通角色为 None。from_attributes 自动从 ORM 列取。
+    pages_override: list[str] | None = None
+    # 明文登录密码:仅「管理员账号列表」(super_admin 专属路由)填充,供权限管理页编辑时复看;
+    # 无留存(脚本建的超管 / 旧账号)为 None → 前端不显示。登录 / /me 不下发(保持 None)。
+    password: str | None = None
 
 
 class AdminLoginResponse(BaseModel):

app/admin/schemas/comparison.py

@@ -23,6 +23,7 @@ class AdminComparisonListItem(BaseModel):
     status: str
     information: str | None = None
     store_name: str | None = None
+    product_names: str | None = None   # 下单商品名派生串(顿号分隔;「商品」列展示 + 商品搜索)
     source_platform_name: str | None = None
     best_platform_name: str | None = None
     source_price_cents: int | None = None
@@ -35,11 +36,14 @@ class AdminComparisonListItem(BaseModel):
     retry_count: int | None = None
     input_tokens: int | None = None      # Σ usage.prompt_tokens(server 派生)
     output_tokens: int | None = None     # Σ usage.completion_tokens(server 派生)
+    # 本次比价 LLM 总成本(元,按当时价冻结);旧记录/未回填为 None → 前端「成本」列回退估算。见 services/llm_cost.py。
+    llm_cost_yuan: float | None = None
     device_model: str | None = None
     rom_vendor: str | None = None
     rom_name: str | None = None
     android_version: str | None = None
     app_version: str | None = None
+    ad_revenue_yuan: float = 0.0   # 本次比价看的信息流广告预估收益(元),queries 瞬态挂 ORM 实例上
     created_at: datetime
 
 
@@ -70,3 +74,5 @@ class AdminComparisonDetail(AdminComparisonListItem):
     # 原始上报全量;「卡在哪一步」从 raw_payload.platform_results[*].status 读
     # (store_not_found/items_not_found/below_minimum/unsupported = 卡在 找店/加菜/起送/读价)。
     raw_payload: dict | None = None
+    # 算成本所用单价快照 {mode, prices:{model:{...}}}(llm_cost_yuan 继承自列表项)。见 services/llm_cost.py。
+    llm_price_snapshot: dict | None = None

app/admin/schemas/coupon_data.py

@@ -19,6 +19,16 @@ class CouponDataSummary(BaseModel):
     p50_ms: int | None = Field(None, description="耗时 50 分位(ms,中位数)")
     p95_ms: int | None = Field(None, description="耗时 95 分位(ms)")
     p99_ms: int | None = Field(None, description="耗时 99 分位(ms)")
+    # 平台粒度成功率(见 docs/guides/领券成功率指标-设计与埋点.md):基数含全部 session。
+    full_success_count: int = Field(0, description="整单成功数(勾选平台全部领到的 session 数)")
+    full_success_rate: float | None = Field(None, description="整单成功率②=整单成功数/发起数;无数据为空")
+    point_success_count: int = Field(0, description="成功平台点位数(Σ 每次成功的平台数)")
+    point_total_count: int = Field(0, description="总平台点位数(Σ 每次勾选平台数;空勾选=全领三档)")
+    point_success_rate: float | None = Field(None, description="点位成功率③=成功点位/总点位;无数据为空")
+    per_platform: dict[str, float | None] = Field(
+        default_factory=dict,
+        description="分平台点位成功率 {平台id: rate|None};恒含美团/淘宝/京东三档,区间内无人勾选的平台为 None",
+    )
 
 
 class CouponDataDaily(BaseModel):
@@ -60,6 +70,9 @@ class CouponDataRow(BaseModel):
     started_at: datetime = Field(..., description="发起时刻(明细「时间」列)")
     claimed_count: int | None = None
     trace_url: str | None = Field(None, description="pricebot 公网 trace 链接(仅 completed 有);admin 渲染可点链接,无则显示可复制 trace_id")
+    ad_revenue_yuan: float = Field(
+        0.0, description="本次领券看的信息流广告预估收益(元);按 trace_id 聚合 ad_ecpm_record"
+    )
 
 
 class CouponDataOut(BaseModel):
@@ -81,3 +94,22 @@ class CouponUserRecordsOut(BaseModel):
 
     items: list[CouponDataRow]
     total: int
+
+
+class CouponSlotRow(BaseModel):
+    """按券成功率一行(§13):粒度=设备-天;成功率=成功/(成功+失败),skipped 排除。"""
+
+    coupon_id: str
+    coupon_name: str | None = None
+    platform: str | None = Field(None, description="美团/淘宝/京东 平台 id;无法识别为空")
+    tried: int = Field(..., description="尝试数(success+already_claimed+failed 的设备-天数)")
+    succeeded: int = Field(..., description="成功数(success+already_claimed)")
+    success_rate: float | None = Field(None, description="成功率=成功/尝试")
+
+
+class CouponSlotsOut(BaseModel):
+    """按券成功率表响应(§13)。"""
+
+    date_from: str
+    date_to: str
+    items: list[CouponSlotRow]

app/admin/schemas/dashboard.py

@@ -43,7 +43,10 @@ class DashboardComparison(BaseModel):
 class DashboardPeriodUsers(BaseModel):
     new: int
     active: int
+    # 次日留存(2026-07-05 起):retained_new_users = 窗口内逐日「前一日新增且当日活跃」用户数之和,
+    # retention_cohort = 对应的前一日新增基数之和,retention_rate = 两者之比。
     retained_new_users: int
+    retention_cohort: int = 0
     retention_rate: float | None = None
     retention_note: str
 
@@ -57,6 +60,24 @@ class DashboardPeriodComparison(BaseModel):
     average_saved_cents: int | None = None
 
 
+class DashboardPeriodCoupon(BaseModel):
+    """领券核心数据(2026-07-05 产品新增)。点位=一张券(coupon_claim_record 一天一条终态);
+    成功口径 success+already_claimed(与「我的」页累计领券一致)。"""
+
+    started: int = 0
+    # 全部领成功的次数:completed 且当日该设备全部点位成功
+    all_success: int = 0
+    success_rate: float | None = None
+    # 本期 session 触达的点位中成功的条数(同设备同日去重)
+    point_success: int = 0
+    # 每次发起的应领点位数(本期完成场实际点位数的众数;无完成场为空)
+    points_per_session: int | None = None
+    # 点位成功率 = point_success / (started × points_per_session);未跑到的点位计入分母视为失败
+    point_success_rate: float | None = None
+    # 耗时中位数(仅 completed 的 elapsed_ms,同「领券数据」页口径)
+    median_elapsed_ms: int | None = None
+
+
 class DashboardPeriodCoins(BaseModel):
     granted_total: int
     reward_video_coin_total: int = 0
@@ -85,6 +106,7 @@ class DashboardPeriod(BaseModel):
     date_to: date
     users: DashboardPeriodUsers
     comparison: DashboardPeriodComparison
+    coupon: DashboardPeriodCoupon = DashboardPeriodCoupon()
     coins: DashboardPeriodCoins
     cash: DashboardPeriodCash
     trend: list[DashboardTrendPoint] = []

app/admin/schemas/feedback.py

@@ -15,11 +15,17 @@ class FeedbackOut(BaseModel):
     user_id: int
     content: str
     contact: str
+    # 反馈来源入口:profile(「我的」页)/ comparison(比价结果页)——admin 展示/筛选「反馈类型」
+    source: str = "profile"
+    # 比价反馈的问题场景(找错商品/优惠不对…);普通反馈为 None
+    scene: str | None = None
     images: list[str] | None = None
     status: str
     reject_reason: str | None = None
     reward_coins: int | None = None
     review_note: str | None = None
+    # 运营给用户的回复留言(用户端可见,采纳/未采纳都可填)
+    admin_reply: str | None = None
     reviewed_by_admin_id: int | None = None
     reviewed_at: datetime | None = None
     created_at: datetime
@@ -39,12 +45,14 @@ class FeedbackApproveRequest(BaseModel):
         le=FEEDBACK_REWARD_MAX_COINS,
         description="采纳后发放金币数",
     )
-    note: str | None = Field(default=None, max_length=256, description="采纳要点/审核备注")
+    note: str | None = Field(default=None, max_length=256, description="采纳要点/审核备注(内部)")
+    reply: str | None = Field(default=None, max_length=256, description="给用户的回复留言,用户端可见")
 
 
 class FeedbackRejectRequest(BaseModel):
     reason: str = Field(min_length=1, max_length=256, description="未采纳原因,用户端可见")
     note: str | None = Field(default=None, max_length=256, description="运营内部审核备注")
+    reply: str | None = Field(default=None, max_length=256, description="给用户的回复留言,用户端可见")
 
 
 class FeedbackSummary(BaseModel):

app/admin/schemas/ops_marquee_seed.py

@@ -62,3 +62,16 @@ class OpsSavingsFeedPreviewItem(BaseModel):
 class OpsSavingsFeedPreviewOut(BaseModel):
     """运营预览:实际混播出来的 feed(真实记录会插队,与客户端一致)。"""
     items: list[OpsSavingsFeedPreviewItem]
+
+
+class OpsRealRecordItem(BaseModel):
+    masked_user: str          # 脱敏后展示名(与 app 一致)
+    saved_amount_cents: int   # 节省金额(分)
+    created_at: str           # 比价记录时间(YYYY-MM-DD HH:MM)
+    user_id: int              # 真实 user_id(供运营核对,不下发客户端)
+
+
+class OpsRealRecordsOut(BaseModel):
+    """分页浏览「全部可展示的真实记录」(success+省>0,不去重、稳定顺序)。"""
+    items: list[OpsRealRecordItem]
+    total: int                # 满足条件的真实记录总数(算页数用)

app/admin/schemas/role.py

@@ -0,0 +1,35 @@
+"""admin RBAC 角色 + 权限目录 schemas。"""
+from __future__ import annotations
+
+from pydantic import BaseModel, Field
+
+
+class PermissionPage(BaseModel):
+    key: str
+    label: str
+
+
+class PermissionGroup(BaseModel):
+    group: str
+    pages: list[PermissionPage]
+
+
+class RoleOut(BaseModel):
+    id: int
+    name: str             # 角色 key(承重,不可变)
+    label: str            # 展示名(UI 显示)
+    pages: list[str]      # 有效可见页 key(super_admin = 全部页)
+    is_builtin: bool      # 内建角色(super_admin):不可编辑/删除
+    in_use: int           # 使用该角色的管理员数(删除前端提示 / 拦截用)
+
+
+class RoleCreateRequest(BaseModel):
+    # 新增自定义角色:name 即用户输入的名称(同时作 key 与展示名)
+    name: str = Field(..., min_length=1, max_length=32)
+    pages: list[str] = Field(default_factory=list)
+
+
+class RoleUpdateRequest(BaseModel):
+    # 只改展示名 + 可见页;key 不可变
+    label: str | None = Field(None, min_length=1, max_length=32)
+    pages: list[str] | None = None

app/admin/schemas/user.py

@@ -17,8 +17,12 @@ class AdminUserListItem(BaseModel):
     status: str
     debug_trace_enabled: bool = False
     wechat_openid: str | None = None
+    wechat_nickname: str | None = None
     created_at: datetime
     last_login_at: datetime
+    # 最近活跃 = max(最近登录, 最近发起比价, 最近发起领券);列表页由 queries._attach_last_active
+    # 瞬态挂上。其他复用本 schema 的入口(用户 360 等)没挂该属性 → None(前端显示 '-')。
+    last_active_at: datetime | None = None
 
 
 class AdminUserOverview(BaseModel):

app/admin/schemas/wallet.py

@@ -41,6 +41,8 @@ class WithdrawOrderOut(BaseModel):
     user_id: int
     out_bill_no: str
     amount_cents: int
+    # 提现类型:coin_cash(福利页提现,金币兑换的现金)/ invite_cash(邀请提现,邀请奖励金)
+    source: str = "coin_cash"
     user_name: str | None = None  # 提现实名(审核核对 + 打款用)
     status: str
     wechat_state: str | None = None
@@ -128,6 +130,7 @@ class WithdrawBulkResult(BaseModel):
 
 class WithdrawLedgerCheckOut(BaseModel):
     ok: bool
+    # 普通现金账(coin_cash:金币兑换的现金)
     cash_balance_total_cents: int
     cash_transaction_total_cents: int
     balance_diff_cents: int
@@ -135,6 +138,14 @@ class WithdrawLedgerCheckOut(BaseModel):
     missing_refund_txn_count: int
     duplicate_refund_txn_count: int
     refund_txn_on_non_terminal_count: int
+    # 邀请奖励金账(invite_cash:与普通现金物理隔离,各自对账)。默认 0 向后兼容。
+    invite_cash_balance_total_cents: int = 0
+    invite_cash_transaction_total_cents: int = 0
+    invite_balance_diff_cents: int = 0
+    invite_missing_withdraw_txn_count: int = 0
+    invite_missing_refund_txn_count: int = 0
+    invite_duplicate_refund_txn_count: int = 0
+    invite_refund_txn_on_non_terminal_count: int = 0
 
 
 class WxpayHealthCheckOut(BaseModel):

app/api/deps.py

@@ -54,5 +54,29 @@ def get_current_user(
     return user
 
 
+def get_current_user_optional(
+    credentials: Annotated[HTTPAuthorizationCredentials | None, Depends(_bearer)],
+    db: Annotated[Session, Depends(get_db)],
+) -> User | None:
+    """软鉴权:有合法 Bearer 就返回 user,否则(无 header / 无效 token / 用户禁用)一律返回
+    None,**不 raise**。
+
+    比价 step / finalize 灰度期用:新客户端带 JWT → 拿到 user_id 绑定 harvest 行;
+    老客户端(不带 JWT)→ None,harvest 行 user_id 暂空,由其后续 /compare/record 上报补齐。
+    等新版覆盖率够高,再把这几条端点从软鉴权收紧成硬 get_current_user。
+    """
+    if credentials is None or credentials.scheme.lower() != "bearer":
+        return None
+    try:
+        payload = decode_token(credentials.credentials, expected_type="access")
+        user = db.get(User, int(payload["sub"]))
+    except (TokenError, KeyError, ValueError, TypeError):
+        return None
+    if user is None or user.status != "active":
+        return None
+    return user
+
+
 CurrentUser = Annotated[User, Depends(get_current_user)]
+OptionalUser = Annotated[User | None, Depends(get_current_user_optional)]
 DbSession = Annotated[Session, Depends(get_db)]

app/api/v1/ad.py

@@ -286,6 +286,7 @@ def ecpm_report(payload: EcpmReportIn, user: CurrentUser, db: DbSession) -> Ecpm
         ad_session_id=payload.ad_session_id,
         adn=payload.adn, slot_id=payload.slot_id,
         feed_scene=payload.feed_scene,
+        trace_id=payload.trace_id,
         app_env=payload.app_env, our_code_id=payload.our_code_id,
     )
     logger.info(

app/api/v1/analytics.py

@@ -6,13 +6,18 @@ POST /api/v1/analytics/events — 批量接收新手引导(及后续)埋点,appe
 """
 from __future__ import annotations
 
-from fastapi import APIRouter, Request
+import logging
+
+from fastapi import APIRouter, HTTPException, Request
 
 from app.api.deps import DbSession
 from app.repositories import analytics as analytics_repo
+from app.repositories import analytics_selfstat as selfstat_repo
 from app.schemas.analytics import AnalyticsBatchIn, AnalyticsIngestOut
+from app.schemas.analytics_selfstat import SelfStatBatchIn, SelfStatIngestOut
 
 router = APIRouter(prefix="/api/v1/analytics", tags=["analytics"])
+logger = logging.getLogger("shagua.analytics")
 
 
 def _client_ip(request: Request) -> str:
@@ -29,3 +34,13 @@ def ingest_events(
 ) -> AnalyticsIngestOut:
     n = analytics_repo.record_batch(db, batch, client_ip=_client_ip(request))
     return AnalyticsIngestOut(received=n)
+
+
+@router.post("/selfstat", response_model=SelfStatIngestOut, summary="上报自报计数快照")
+def ingest_selfstat(batch: SelfStatBatchIn, db: DbSession) -> SelfStatIngestOut:
+    try:
+        snap_id = selfstat_repo.record_selfstat(db, batch)
+    except Exception:  # noqa: BLE001 — 计数链路要稳,落库失败不裸奔 500,记日志回明确错误
+        logger.exception("selfstat ingest failed device=%s epoch=%s", batch.device_id, batch.epoch_id)
+        raise HTTPException(status_code=503, detail="selfstat ingest failed") from None
+    return SelfStatIngestOut(snapshot_id=snap_id)

app/api/v1/auth.py

@@ -12,19 +12,31 @@ from __future__ import annotations
 
 import logging
 
-from fastapi import APIRouter, Depends, HTTPException, Request, status
+from fastapi import APIRouter, HTTPException, Request, status
+from sqlalchemy.exc import IntegrityError
 
 from app.api.deps import CurrentUser, DbSession
 from app.core import test_account
-from app.core.ratelimit import enforce_rate_limit, rate_limit
-from app.core.security import TokenError, decode_token, issue_token_pair
+from app.core.ratelimit import enforce_rate_limit
+from app.core.security import (
+    TokenError,
+    create_bind_ticket,
+    create_conflict_ticket,
+    decode_bind_ticket,
+    decode_conflict_ticket,
+    decode_token,
+    issue_token_pair,
+)
+from app.integrations import wxpay
 from app.integrations.jiguang import JiguangError, mask_phone, verify_and_get_phone
 from app.integrations.sms import SmsError, send_code, verify_code
 from app.repositories import onboarding as onboarding_repo
+from app.repositories import phone_rebind as rebind_repo
 from app.repositories import user as user_repo
 from app.schemas.auth import (
     JverifyLoginRequest,
     LogoutResponse,
+    OccupiedAccountInfo,
     RefreshRequest,
     SmsLoginRequest,
     SmsSendRequest,
@@ -32,6 +44,13 @@ from app.schemas.auth import (
     TokenPair,
     TokenWithUser,
     UserOut,
+    WechatBindPhoneJverifyRequest,
+    WechatBindPhoneSmsRequest,
+    WechatBindResultResponse,
+    WechatConflictContinueRequest,
+    WechatConflictRebindRequest,
+    WechatLoginRequest,
+    WechatLoginResponse,
 )
 
 logger = logging.getLogger("shagua.auth")
@@ -41,7 +60,7 @@ router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
 # 手机号登录防刷:同一设备(device_id) + 同一 IP 每小时最多的登录尝试次数(成功/失败都计)。
 SMS_LOGIN_MAX_PER_HOUR = 5
 # 发码防刷:同一设备(device_id) + 同一 IP 每小时最多的发码次数。
-# 堵「换手机号绕开单号 60s 冷却 / 单号每日上限」的洞 —— 那两道是单号维度,一机换号能绕开。
+# 堵「换手机号绕开单号 60s 冷却」的洞 —— 冷却是单号维度,一机换号能绕开。
 SMS_SEND_MAX_PER_HOUR_PER_DEVICE = 5
 
 
@@ -100,8 +119,8 @@ def sms_send(req: SmsSendRequest, request: Request) -> SmsSendResponse:
         return SmsSendResponse(sent=True, mock=True, cooldown_sec=0)
 
     # 防刷:同一设备(device_id) + 同一 IP 每小时最多 SMS_SEND_MAX_PER_HOUR_PER_DEVICE 次发码。
-    # 补「换手机号绕开单号 60s 冷却 / 单号每日上限」的洞(那两道是单号维度,一机换号能绕);设备维度按机器封顶,
-    # 挡短信轰炸/烧钱。放在真发(send_code)之前 → 超限直接拦下、不真发短信。与路由上 IP 维度(10次/分钟)互补。
+    # 补「换手机号绕开单号 60s 冷却」的洞(冷却是单号维度,一机换号能绕);设备维度按机器封顶,
+    # 挡短信轰炸/烧钱。放在真发(send_code)之前 → 超限直接拦下、不真发短信。
     enforce_rate_limit(
         request,
         scope="sms-send-device",
@@ -125,7 +144,6 @@ def sms_send(req: SmsSendRequest, request: Request) -> SmsSendResponse:
     "/sms/login",
     response_model=TokenWithUser,
     summary="手机号+验证码登录",
-    dependencies=[Depends(rate_limit(20, 60, "sms-login"))],  # 防撞库爆破(另有单码失败次数上限)
 )
 def sms_login(req: SmsLoginRequest, request: Request, db: DbSession) -> TokenWithUser:
     # 测试账号:免验证码登录 + 每日上限 + 每次都走新手引导(详见 app/core/test_account.py)。
@@ -143,7 +161,7 @@ def sms_login(req: SmsLoginRequest, request: Request, db: DbSession) -> TokenWit
         return _login_response(user, onboarding_completed=False, force_onboarding=True)
 
     # 防刷:同一设备(device_id) + 同一 IP 每小时最多 SMS_LOGIN_MAX_PER_HOUR 次登录尝试。放在验证码校验
-    # **之前** → 输错验证码的失败尝试也计数,才挡得住撞库/爆破。与路由上 IP 维度的 sms-login 限流(同 IP)互补。
+    # **之前** → 输错验证码的失败尝试也计数,才挡得住撞库/爆破(另有单码失败 SMS_MAX_VERIFY_ATTEMPTS 次即作废兜底)。
     # ⚠️ 按设备而非手机号 → 一台机器换不同手机号刷登录也受限(防一机狂登多号);device_id 空(老客户端)时
     #    退化为该 IP 下所有空设备聚一桶,仍受限。
     enforce_rate_limit(
@@ -167,6 +185,261 @@ def sms_login(req: SmsLoginRequest, request: Request, db: DbSession) -> TokenWit
     return _login_response(user, onboarding_completed=completed)
 
 
+# ===================== 微信登录 =====================
+
+@router.post(
+    "/wechat-login",
+    response_model=WechatLoginResponse,
+    summary="微信登录(openid 命中即登入,否则发绑号令牌)",
+)
+def wechat_login(req: WechatLoginRequest, db: DbSession) -> WechatLoginResponse:
+    from app.core.config import settings  # 局部 import,避免循环
+
+    # 微信登录只需 code→openid(sns/oauth2),不需要商户转账证书;故只校验 APP_ID/SECRET。
+    if not (settings.WECHAT_APP_ID and settings.WECHAT_APP_SECRET):
+        raise HTTPException(status_code=503, detail="wechat login not configured")
+
+    try:
+        info = wxpay.code_to_userinfo(req.code)  # {openid, nickname, avatar_url, raw};失败抛 ValueError
+    except ValueError as e:
+        raise HTTPException(status_code=400, detail=str(e)) from e
+
+    openid = info["openid"]
+    user = user_repo.get_user_by_wechat_openid(db, openid)
+    if user is not None:
+        # openid 命中 → 直接登入(绝不套用提现 bind-wechat 的"撞号即 409"逻辑)
+        if user.status != "active":
+            raise HTTPException(status_code=403, detail="account disabled")
+        user_repo.touch_last_login(db, user)
+        completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=req.device_id)
+        logger.info("wechat_login hit user_id=%d openid=%s*** onboarded=%s", user.id, openid[:6], completed)
+        return WechatLoginResponse(
+            status="logged_in",
+            token=_login_response(user, onboarding_completed=completed),
+        )
+
+    # 未命中 → 签发短时 bind_ticket,进手机号绑定流程(账号此刻还不建)
+    ticket = create_bind_ticket(
+        openid=openid,
+        wechat_nickname=info["nickname"],
+        wechat_avatar_url=info["avatar_url"],
+    )
+    logger.info("wechat_login new openid=%s*** issue bind_ticket", openid[:6])
+    return WechatLoginResponse(
+        status="need_bind_phone",
+        bind_ticket=ticket,
+        wechat_nickname=info["nickname"],
+        wechat_avatar_url=info["avatar_url"],
+    )
+
+
+def _finish_wechat_bind(
+    db,
+    *,
+    openid: str,
+    wechat_nickname: str | None,
+    wechat_avatar_url: str | None,
+    phone: str,
+    device_id: str,
+) -> WechatBindResultResponse:
+    """绑手机建号的公共尾段:手机号被占用 → 返回 phone_occupied(M2 处理 3 选 1);
+    未占用 → 新建微信账号(channel=wechat,昵称头像取微信)→ 签 token 登入。"""
+    existing = user_repo.get_user_by_phone(db, phone)
+    if existing is not None:
+        from app.core.config import settings  # 局部 import,避免循环
+
+        ticket = create_conflict_ticket(
+            openid=openid,
+            wechat_nickname=wechat_nickname,
+            wechat_avatar_url=wechat_avatar_url,
+            phone=phone,
+        )
+        blocked = rebind_repo.rebound_within_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS)
+        logger.info(
+            "wechat bind phone occupied phone=%s by user_id=%d has_wechat=%s",
+            mask_phone(phone), existing.id, bool(existing.wechat_openid),
+        )
+        return WechatBindResultResponse(
+            status="phone_occupied",
+            occupied_account=OccupiedAccountInfo(
+                nickname=existing.nickname,
+                avatar_url=existing.avatar_url,
+                created_at=existing.created_at,
+                has_wechat=bool(existing.wechat_openid),
+            ),
+            conflict_ticket=ticket,
+            rebind_available=not blocked,
+            rebind_blocked_days=(
+                rebind_repo.remaining_block_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS)
+                if blocked else 0
+            ),
+        )
+    user = user_repo.create_wechat_user(
+        db,
+        phone=phone,
+        openid=openid,
+        wechat_nickname=wechat_nickname,
+        wechat_avatar_url=wechat_avatar_url,
+    )
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=device_id)
+    logger.info("wechat bind ok user_id=%d phone=%s openid=%s*** onboarded=%s",
+                user.id, mask_phone(phone), openid[:6], completed)
+    return WechatBindResultResponse(
+        status="logged_in",
+        token=_login_response(user, onboarding_completed=completed),
+    )
+
+
+@router.post(
+    "/wechat/bind-phone/sms",
+    response_model=WechatBindResultResponse,
+    summary="微信登录·其他手机号(短信)绑定",
+)
+def wechat_bind_phone_sms(
+    req: WechatBindPhoneSmsRequest, request: Request, db: DbSession
+) -> WechatBindResultResponse:
+    try:
+        claims = decode_bind_ticket(req.bind_ticket)
+    except TokenError as e:
+        raise HTTPException(status_code=401, detail="授权已过期,请重新用微信登录") from e
+
+    # 防刷:同 sms/login,按 设备+IP 每小时限流(放在验证码校验之前,失败也计数)
+    enforce_rate_limit(
+        request,
+        scope="wechat-bind-sms-device",
+        subject=req.device_id,
+        limit=SMS_LOGIN_MAX_PER_HOUR,
+        window_sec=3600,
+        detail="登录尝试过于频繁,请稍后再试",
+    )
+
+    if not verify_code(req.phone, req.code):
+        raise HTTPException(status_code=400, detail="invalid sms code")
+
+    return _finish_wechat_bind(
+        db,
+        openid=claims["openid"],
+        wechat_nickname=claims["wnk"],
+        wechat_avatar_url=claims["wav"],
+        phone=req.phone,
+        device_id=req.device_id,
+    )
+
+
+@router.post(
+    "/wechat/bind-phone/jverify",
+    response_model=WechatBindResultResponse,
+    summary="微信登录·本机号(极光)绑定",
+)
+def wechat_bind_phone_jverify(
+    req: WechatBindPhoneJverifyRequest, db: DbSession
+) -> WechatBindResultResponse:
+    try:
+        claims = decode_bind_ticket(req.bind_ticket)
+    except TokenError as e:
+        raise HTTPException(status_code=401, detail="授权已过期,请重新用微信登录") from e
+
+    try:
+        phone = verify_and_get_phone(req.login_token)
+    except JiguangError as e:
+        logger.error("[JG] verify+decrypt failed: %s", e, exc_info=True)
+        raise HTTPException(status_code=502, detail=f"jiguang verify failed: {e}") from e
+
+    return _finish_wechat_bind(
+        db,
+        openid=claims["openid"],
+        wechat_nickname=claims["wnk"],
+        wechat_avatar_url=claims["wav"],
+        phone=phone,
+        device_id=req.device_id,
+    )
+
+
+# ===================== 微信占用冲突(M2) =====================
+
+@router.post(
+    "/wechat/conflict/continue",
+    response_model=WechatBindResultResponse,
+    summary="微信占用冲突·继续绑定(登录老账号,能绑就绑)",
+)
+def wechat_conflict_continue(
+    req: WechatConflictContinueRequest, request: Request, db: DbSession
+) -> WechatBindResultResponse:
+    try:
+        claims = decode_conflict_ticket(req.conflict_ticket)
+    except TokenError as e:
+        raise HTTPException(status_code=401, detail="操作超时,请重新用微信登录") from e
+
+    enforce_rate_limit(
+        request, scope="wechat-conflict-device", subject=req.device_id,
+        limit=SMS_LOGIN_MAX_PER_HOUR, window_sec=3600, detail="操作过于频繁,请稍后再试",
+    )
+
+    user = user_repo.get_user_by_phone(db, claims["phone"])
+    if user is None:
+        # P 期间被腾空(老账号改号/注销)→ 前提已变,让前端重走
+        raise HTTPException(status_code=409, detail="账号状态已变化,请重新登录")
+    if user.status != "active":
+        raise HTTPException(status_code=403, detail="account disabled")
+
+    if user.wechat_openid is None:
+        try:
+            user_repo.attach_wechat_to_user(
+                db, user, openid=claims["openid"],
+                wechat_nickname=claims["wnk"], wechat_avatar_url=claims["wav"],
+            )
+        except IntegrityError:
+            db.rollback()  # openid 被别处绑走 → 只登入不绑
+            user_repo.touch_last_login(db, user)
+    else:
+        user_repo.touch_last_login(db, user)  # X 已绑别的微信 → 只登入,丢弃本次 openid
+
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=req.device_id)
+    logger.info("wechat conflict continue user_id=%d openid=%s***", user.id, claims["openid"][:6])
+    return WechatBindResultResponse(
+        status="logged_in",
+        token=_login_response(user, onboarding_completed=completed),
+    )
+
+
+@router.post(
+    "/wechat/conflict/rebind",
+    response_model=WechatBindResultResponse,
+    summary="微信占用冲突·换绑(注销老账号+用该号重建全新账号)",
+)
+def wechat_conflict_rebind(
+    req: WechatConflictRebindRequest, request: Request, db: DbSession
+) -> WechatBindResultResponse:
+    from app.core.config import settings  # 局部 import,避免循环
+
+    try:
+        claims = decode_conflict_ticket(req.conflict_ticket)
+    except TokenError as e:
+        raise HTTPException(status_code=401, detail="操作超时,请重新用微信登录") from e
+
+    enforce_rate_limit(
+        request, scope="wechat-conflict-device", subject=req.device_id,
+        limit=SMS_LOGIN_MAX_PER_HOUR, window_sec=3600, detail="操作过于频繁,请稍后再试",
+    )
+
+    phone = claims["phone"]
+    if rebind_repo.rebound_within_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS):
+        days = rebind_repo.remaining_block_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS)
+        raise HTTPException(status_code=409, detail=f"该手机号 {days} 天内已换绑过,暂不能再次换绑")
+
+    user = user_repo.rebind_account(
+        db, phone=phone, openid=claims["openid"],
+        wechat_nickname=claims["wnk"], wechat_avatar_url=claims["wav"],
+    )
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=req.device_id)
+    logger.info("wechat conflict rebind new_user_id=%d phone=%s openid=%s***",
+                user.id, mask_phone(phone), claims["openid"][:6])
+    return WechatBindResultResponse(
+        status="logged_in",
+        token=_login_response(user, onboarding_completed=completed),
+    )
+
+
 # ===================== Refresh =====================
 
 @router.post("/refresh", response_model=TokenPair, summary="用 refresh_token 换新 token 对")

app/api/v1/compare.py

@@ -1,49 +1,114 @@
-"""外卖比价业务透传端点。
+"""外卖比价业务透传端点 + 后端 harvest 落库。
 
-把客户端的 POST /api/v1/intent/recognize 和 /api/v1/price/step 请求原样转发给
-pricebot-backend 的 /api/intent/recognize 和 /api/price/step。MVP 阶段**不鉴权**
-(同 coupon/step,见 docs/待办与技术债.md P1:device_id 透传区分设备,待补 JWT +
-device_id↔user_id 绑定后才能做用户级画像)。
+把客户端 POST /api/v1/intent/* 和 /api/v1/price/step 转发给 pricebot,同时**由 app-server
+在透传里直接落库比价记录**(不再靠客户端 POST /compare/record):
+  - 帧0(客户端首帧不带 trace_id)→ app-server 用 uuid 签发 trace_id、注入转发 body、回给
+    客户端;并按 trace_id 建 running 行(harvest_running)。
+  - 最终 done 帧 → 更新成 success/failed + 结果(harvest_done)。发奖不在这里:#113 已把
+    邀请奖口径从「比价」移到「实际下单」(order.py)。
+  - /trace/finalize(用户终止/Phase1 未识别,无 done)→ 更新成 cancelled/failed
+    (harvest_abort,**不降级 success**)。
+trace_url 从 pricebot 响应**顶层 trace_url** 取(pricebot 每帧都带,见其 goal_engine.process_step)。
 
-- Phase 1 /intent/recognize:从源平台(淘宝闪购/美团/京东外卖)购物车页识别店名+菜品+
-  价格,一次性。
-- Phase 2 /price/step:多轮循环,在目标平台复现订单读到手价,直到 done。
+鉴权:软鉴权(OptionalUser)——新客户端带 JWT → 绑 user_id;老客户端不带 → user_id 暂空,
+由其后续 /compare/record 上报补(灰度期两条写路径按 trace_id reconcile,success 不被降级)。
 
-真正的目标驱动比价逻辑在 pricebot-backend(GoalEngine,另一个 repo),本接口只是透传壳。
-电商(ecom)那两个端点 food MVP 暂不需要,以后放开 scene 时再加 /ecom/intent/recognize
-和 /ecom/step 两行即可。
-
-pricebot 协议文档:
-  pricebot-backend/docs/main/02_api_protocol.md
+真正的目标驱动比价逻辑在 pricebot-backend(GoalEngine,另一个 repo),本接口是透传壳 + 落库。
+pricebot 协议文档: pricebot-backend/docs/main/02_api_protocol.md
 """
 from __future__ import annotations
 
 import json
 import logging
+import time
+import uuid
 from typing import Any
 
 import httpx
 from fastapi import APIRouter, HTTPException, Request, status
+from fastapi.concurrency import run_in_threadpool
 
+from app.api.deps import OptionalUser
 from app.core.config import settings
+from app.core.logging import trace_id_ctx
 from app.core.pricebot_client import get_pricebot_client
 from app.core.pricebot_router import pick_pricebot
+from app.db.session import SessionLocal
+from app.repositories import comparison as crud_compare
 
 logger = logging.getLogger("shagua.compare")
 
 router = APIRouter(prefix="/api/v1", tags=["compare"])
 
 
-async def _passthrough(request: Request, upstream_path: str) -> dict[str, Any]:
-    """把请求体原样转发给 pricebot-backend 的 {upstream_path}。
+# ============================================================
+# harvest 落库(阻塞 SQLAlchemy → run_in_threadpool,独立 SessionLocal,不阻塞事件循环;
+# 任何写库异常都吞掉、绝不连累比价透传返回 —— 同 coupon.py 现有 best-effort 写法)。
+# ============================================================
 
-    跟 coupon_step 同款透传壳:不鉴权、不做 schema 校验,仅读 device_id/trace_id/step
-    打日志。比价单帧是大上下文 / 逐帧 LLM,超时用 PRICEBOT_COMPARE_TIMEOUT_SEC(60s,
-    比领券的 30s 长)。
+
+def _harvest_running_blocking(
+    trace_id: str, user_id: int | None, business_type: str,
+    device_id: str | None, device_info: dict | None, trace_url: str | None,
+) -> None:
+    with SessionLocal() as db:
+        crud_compare.harvest_running(
+            db, trace_id=trace_id, user_id=user_id, business_type=business_type,
+            device_id=device_id, device_info=device_info, trace_url=trace_url,
+        )
+    logger.info(
+        "harvest running row (user=%s)", user_id,
+        extra={"phase": "harvest_running", "status": "running", "user_id": user_id},
+    )
+
+
+def _harvest_done_blocking(
+    trace_id: str, user_id: int | None, done_params: dict, business_type: str,
+    device_id: str | None, device_info: dict | None, trace_url: str | None,
+) -> None:
+    with SessionLocal() as db:
+        rec, newly_success = crud_compare.harvest_done(
+            db, trace_id=trace_id, user_id=user_id, done_params=done_params,
+            business_type=business_type, device_id=device_id,
+            device_info=device_info, trace_url=trace_url,
+        )
+        logger.info(
+            "harvest done → %s saved=%s newly=%s", rec.status,
+            rec.saved_amount_cents, newly_success,
+            extra={"phase": "harvest_done", "status": rec.status,
+                   "saved_cents": rec.saved_amount_cents,
+                   "best_platform": rec.best_platform_id, "newly_success": newly_success,
+                   "user_id": user_id},
+        )
+        # 不在此处发邀请奖:#113 已把发奖口径从「比价」移到「实际下单」(order.py),harvest
+        # 只记录比价、不发奖。否则比价先于下单 + try_reward 幂等闸会让奖落在「比价」这步,
+        # 架空 #113 的「下单才发奖」防刷意图(newly_success 仅留作日志观测)。
+
+
+def _harvest_abort_blocking(
+    trace_id: str, status_hint: str, reason: str | None, trace_url: str | None,
+) -> None:
+    with SessionLocal() as db:
+        rec = crud_compare.harvest_abort(
+            db, trace_id=trace_id, status=status_hint, reason=reason, trace_url=trace_url,
+        )
+    logger.info(
+        "harvest abort → %s", (rec.status if rec else "no-row"),
+        extra={"phase": "harvest_abort",
+               "status": (rec.status if rec else None), "reason": reason},
+    )
+
+
+async def _forward(
+    request: Request, upstream_path: str, user, *, harvest_first_frame: bool = True,
+) -> tuple[dict[str, Any], str, dict[str, Any]]:
+    """透传给 pricebot 的 {upstream_path},并 mint trace_id + 首帧建 running 行。
+    返回 (resp_json, trace_id, meta)。
+
+    - 客户端首帧不带 trace_id → app-server 用 uuid 签发、写进转发 body、回填进响应顶层
+      `trace_id`(客户端据此拿到后续帧都带上)。带了(老客户端 / 后续帧)→ 原样用、走原始 bytes 快路。
+    - 仅**本次 mint(=首帧)**建 running 行(idempotent);后续帧不再写库。
     """
-    # 读原始字节,避免"反序列化→再序列化"的双重 JSON(省 ~一半透传 CPU,让 app-server
-    # 单 worker 也扛得住高并发)。只 json.loads 一次拿 trace_id 做亲和 + 打日志,转发时
-    # 直接发原始 bytes(content=raw),不重新 dumps。
     raw = await request.body()
     try:
         meta = json.loads(raw)
@@ -52,26 +117,41 @@ async def _passthrough(request: Request, upstream_path: str) -> dict[str, Any]:
     if not isinstance(meta, dict):
         meta = {}
 
-    # 按 trace_id 一致性 hash 选 pricebot 实例(同一比价的所有帧落同一进程,内存维护 state)
-    base = pick_pricebot(meta.get("trace_id"))
+    trace_id = meta.get("trace_id")
+    minted = False
+    if not trace_id:
+        trace_id = str(uuid.uuid4())
+        meta["trace_id"] = trace_id
+        raw = json.dumps(meta).encode()  # 仅首帧重新序列化(注入 trace_id);后续帧走原始 bytes
+        minted = True
+
+    # 请求级 trace_id 贯穿:此后本请求(含 run_in_threadpool 里的 harvest)每行日志自动带 trace_id
+    trace_id_ctx.set(trace_id)
+
+    base = pick_pricebot(trace_id)
     url = f"{base.rstrip('/')}{upstream_path}"
     timeout = settings.PRICEBOT_COMPARE_TIMEOUT_SEC
+    step = meta.get("step")
 
     logger.info(
-        "compare %s device_id=%s trace_id=%s step=%s",
-        upstream_path,
-        meta.get("device_id"),
-        meta.get("trace_id"),
-        meta.get("step"),
+        "→ pricebot %s step=%s%s", upstream_path, step, " [mint]" if minted else "",
+        extra={"phase": "forward", "endpoint": upstream_path, "step": step,
+               "device_id": meta.get("device_id"), "minted": minted,
+               "query": meta.get("query"), "user_id": (user.id if user else None)},
     )
 
+    t0 = time.monotonic()
     try:
         client = get_pricebot_client()
         resp = await client.post(
             url, content=raw, headers={"Content-Type": "application/json"}, timeout=timeout
         )
     except httpx.RequestError as e:
-        logger.error("[pricebot] request failed: %s", e)
+        logger.error(
+            "← pricebot %s 不可达: %s", upstream_path, e,
+            extra={"phase": "resp", "endpoint": upstream_path, "step": step,
+                   "error": "upstream_unreachable"},
+        )
         raise HTTPException(
             status_code=status.HTTP_502_BAD_GATEWAY,
             detail=f"pricebot upstream unreachable: {e}",
@@ -79,49 +159,112 @@ async def _passthrough(request: Request, upstream_path: str) -> dict[str, Any]:
 
     if resp.status_code >= 500:
         logger.error(
-            "[pricebot] 5xx status=%d body=%s",
-            resp.status_code,
-            resp.text[:500],
+            "← pricebot %s 5xx=%d", upstream_path, resp.status_code,
+            extra={"phase": "resp", "endpoint": upstream_path, "step": step,
+                   "http_status": resp.status_code, "error": "upstream_5xx"},
         )
         raise HTTPException(
             status_code=status.HTTP_502_BAD_GATEWAY,
             detail=f"pricebot upstream returned {resp.status_code}",
         )
 
-    return resp.json()
+    resp_json = resp.json()
+    cost_ms = int((time.monotonic() - t0) * 1000)
+    if not isinstance(resp_json, dict):
+        return {}, trace_id, meta
+    # 回传 app-server 签发的 trace_id(新客户端首帧据此拿到,后续帧都带上它)
+    resp_json.setdefault("trace_id", trace_id)
+    _action = resp_json.get("action") or {}
+    logger.info(
+        "← pricebot %s cmd=%s cont=%s %dms", upstream_path,
+        _action.get("command"), resp_json.get("continue"), cost_ms,
+        extra={"phase": "resp", "endpoint": upstream_path, "step": step,
+               "command": _action.get("command"), "continue": resp_json.get("continue"),
+               "cost_ms": cost_ms},
+    )
+
+    # 首帧建 running 行(仅本次 mint;老客户端自带 trace_id → 不 mint → 由 done / 其 POST 建行)
+    if minted and harvest_first_frame:
+        try:
+            await run_in_threadpool(
+                _harvest_running_blocking, trace_id,
+                (user.id if user else None), "food",
+                meta.get("device_id"), meta.get("device_info"),
+                resp_json.get("trace_url"),
+            )
+        except Exception as e:  # noqa: BLE001
+            logger.warning("harvest_running failed trace=%s: %s", trace_id, e)
+
+    return resp_json, trace_id, meta
 
 
-@router.post("/intent/recognize", summary="外卖比价 Phase 1 意图识别 (透传到 pricebot)")
-async def intent_recognize(request: Request) -> dict[str, Any]:
-    return await _passthrough(request, "/api/intent/recognize")
+@router.post("/intent/recognize", summary="外卖比价 Phase 1 意图识别 (透传 + 建 running 行)")
+async def intent_recognize(request: Request, user: OptionalUser) -> dict[str, Any]:
+    resp, _, _ = await _forward(request, "/api/intent/recognize", user)
+    return resp
 
 
-@router.post("/intent/step", summary="外卖比价 Phase 1 多帧意图识别 (透传到 pricebot, 仅淘宝源)")
-async def intent_step(request: Request) -> dict[str, Any]:
-    # 多帧版意图识别(展开+滚动采集→提取): 循环调用直到 done(done 帧顶层带
-    # result+calibration)。目前仅淘宝源走这条, 其它源走上面单次 /intent/recognize。
-    return await _passthrough(request, "/api/intent/step")
+@router.post("/intent/step", summary="外卖比价 Phase 1 多帧意图识别 (透传, 仅淘宝源)")
+async def intent_step(request: Request, user: OptionalUser) -> dict[str, Any]:
+    resp, _, _ = await _forward(request, "/api/intent/step", user)
+    return resp
 
 
-@router.post(
-    "/intent/precoupon/step",
-    summary="外卖比价 Phase 0 意图识别前先用券 (透传到 pricebot, 仅美团源)",
-)
-async def intent_precoupon_step(request: Request) -> dict[str, Any]:
-    # 美团源平台『意图识别前先用券』多帧循环: 客户端在调 /intent/recognize 之前先循环
-    # 调本端点到 done(continue=false)。订单页底部有『点击使用X红包』就自动选最大免费券
-    # 用上, 已用券/无券则首帧秒过。与 /intent/step 同属 intent 域, 复用同一透传壳。
-    return await _passthrough(request, "/api/intent/precoupon/step")
+@router.post("/intent/precoupon/step", summary="外卖比价 Phase 0 识别前先用券 (透传, 仅美团源)")
+async def intent_precoupon_step(request: Request, user: OptionalUser) -> dict[str, Any]:
+    resp, _, _ = await _forward(request, "/api/intent/precoupon/step", user)
+    return resp
 
 
-@router.post("/price/step", summary="外卖比价 Phase 2 步进 (透传到 pricebot)")
-async def price_step(request: Request) -> dict[str, Any]:
-    return await _passthrough(request, "/api/price/step")
+@router.post("/price/step", summary="外卖比价 Phase 2 步进 (透传 + done 落库)")
+async def price_step(request: Request, user: OptionalUser) -> dict[str, Any]:
+    resp, trace_id, meta = await _forward(request, "/api/price/step", user)
+    # 最终 done 帧(command=done 且 continue=false)→ harvest 更新成终态。
+    # (单平台中途 done 被 pricebot 改写成 wait+continue=true,不会命中这里,同 coupon 语义。)
+    action = resp.get("action") or {}
+    if action.get("command") == "done" and not resp.get("continue", True):
+        done_params = action.get("params") or {}
+        try:
+            await run_in_threadpool(
+                _harvest_done_blocking, trace_id, (user.id if user else None),
+                done_params, "food",
+                meta.get("device_id"), meta.get("device_info"),
+                resp.get("trace_url") or done_params.get("trace_url"),
+            )
+        except Exception as e:  # noqa: BLE001
+            logger.warning("harvest_done failed trace=%s: %s", trace_id, e)
+    return resp
 
 
-@router.post("/trace/finalize", summary="比价 trace 收尾上云 (透传到 pricebot, 终止/未识别拿 trace_url)")
-async def trace_finalize(request: Request) -> dict[str, Any]:
-    # 用户终止 / Phase1 未识别没走到 done 帧, pricebot 没上云也没回传 trace_url。客户端收尾时
-    # 打这个, _passthrough 按 trace_id 一致性 hash 落到处理这条 trace 的同一 pricebot 进程
-    # (dir_cache 在那, 才能算对 trace 目录), 由后者打包上云返回 {trace_url}。
-    return await _passthrough(request, "/api/trace/finalize")
+@router.post("/trace/epilogue", summary="比价结果页尾声帧 (透传到 pricebot, 用户视角截图入 trace)")
+async def trace_epilogue(request: Request, user: OptionalUser) -> dict[str, Any]:
+    # App 收到 done、渲染完结果页后,把自己页面的截图(base64)传给 pricebot 存进 trace
+    # 目录并触发重传 —— trace 里补上"用户实际看到的汇总页"(步骤帧只有目标 App 画面)。
+    # body ~几百 KB(截图 base64), 纯透传壳(harvest_first_frame=False:不建行/不落库,
+    # 该 trace 的记录已由 done/finalize 落终态)。#112 原走 _passthrough,合并到 harvest
+    # 分支后统一走 _forward(_passthrough 已并入它)。
+    resp, _, _ = await _forward(
+        request, "/api/trace/epilogue", user, harvest_first_frame=False,
+    )
+    return resp
+
+
+@router.post("/trace/finalize", summary="比价 trace 收尾上云 (透传 + 夭折落库)")
+async def trace_finalize(request: Request, user: OptionalUser) -> dict[str, Any]:
+    # 用户终止 / Phase1 未识别没到 done 帧: pricebot 打包半截上云返回 {trace_url};
+    # app-server 顺手把该 trace 的 running 行更新成夭折终态(**不降级 success**)。
+    # 客户端 finalize body 带 status(cancelled/failed)+ reason;老客户端只带 trace_id →
+    # 默认 cancelled,其后续 /compare/record 上报再补精确态。
+    resp, trace_id, meta = await _forward(
+        request, "/api/trace/finalize", user, harvest_first_frame=False,
+    )
+    try:
+        await run_in_threadpool(
+            _harvest_abort_blocking, trace_id,
+            (meta.get("status") or "cancelled"),
+            (meta.get("reason") or meta.get("information")),
+            (resp.get("trace_url") if isinstance(resp, dict) else None),
+        )
+    except Exception as e:  # noqa: BLE001
+        logger.warning("harvest_abort failed trace=%s: %s", trace_id, e)
+    return resp

app/api/v1/compare_record.py

@@ -1,15 +1,13 @@
-"""比价记录 endpoint(「我的比价记录」数据源)。
+"""比价记录 endpoint(「我的比价记录」+ admin 数据源)。
 
 路由前缀 `/api/v1/compare`:
-  POST /record         上报一次比价结果(幂等:同 user+trace_id 覆盖)
+  POST /record         (灰度期兼容)老客户端上报,按 **trace_id** 幂等 + 不降级 success
   GET  /records        比价记录列表(游标分页)
   GET  /records/{id}   单条详情(含 raw_payload 全量)
 
-**均需鉴权**(CurrentUser)——与同文件无关的不鉴权透传 `compare.py` 分开:那个是
-转发壳(MVP 不鉴权),这里是按用户维度落库的业务接口,必须有 user_id。
-
-注:本轮只做 server 端,客户端(android 仓)在 done 帧后调 POST /record 上报的改动
-另起一轮(见 app-server docs/待办与技术债.md P1)。
+**均需鉴权**(CurrentUser)。⚠️ 写路径现以 `compare.py` 透传壳的**后端 harvest** 为主
+(帧0 建 running 行 → done/finalize 落终态,新客户端不再 POST);本 POST /record 仅灰度期
+给老客户端用,与 harvest 按 trace_id reconcile。新版覆盖够高后可下线本 POST(阶段3)。
 """
 from __future__ import annotations
 
@@ -21,16 +19,16 @@ from app.api.deps import CurrentUser, DbSession
 from app.db.session import SessionLocal
 from app.models.comparison import ComparisonRecord
 from app.repositories import comparison as crud_compare
-from app.repositories import invite as crud_invite
-from app.services.pricebot_llm_calls import fetch_llm_calls
 from app.schemas.compare_record import (
     CompareStatsOut,
     ComparisonRecordCreatedOut,
     ComparisonRecordDetailOut,
     ComparisonRecordIn,
-    ComparisonRecordPage,
     ComparisonRecordOut,
+    ComparisonRecordPage,
 )
+from app.services.llm_cost import compute_llm_cost, get_llm_prices
+from app.services.pricebot_llm_calls import fetch_llm_calls
 
 logger = logging.getLogger("shagua.compare_record")
 
@@ -53,18 +51,8 @@ def report_record(
     # 任务做,不阻塞上报响应(顺带给 pricebot 落盘留足余量)。upsert 已 commit,后台用
     # 独立 session 按 record id 回填 llm_calls + 派生 llm_call_count/retry_count。
     background_tasks.add_task(_backfill_llm_calls, rec.id, rec.trace_id)
-    # 邀请 v2 发奖:被邀请人完成一次【成功】比价 → 给邀请人发邀请奖励金(幂等,只发一次)。
-    # best-effort:发奖异常不影响比价上报本身(rec 已 commit),只 log;邀请人补偿靠后续对账。
-    if rec.status == "success":
-        try:
-            reward = crud_invite.try_reward_on_compare(db, user.id)
-            if reward.status == "granted":
-                logger.info(
-                    "invite compare reward granted inviter=%s invitee=%s cents=%s",
-                    reward.inviter_user_id, user.id, reward.reward_cents,
-                )
-        except Exception as e:  # noqa: BLE001 best-effort,发奖失败不阻塞上报
-            logger.warning("invite compare reward failed invitee=%s: %s", user.id, e)
+    # 注:邀请发奖已从"比价成功"挪到"实际下单"(见 api/v1/order.py report_order)——
+    # 冰拍板:被邀请人完成比价并实际下单才算邀请成功,仅完成比价不再发奖。
     logger.info(
         "compare record user=%s trace=%s biz=%s status=%s saved=%s (llm_calls backfill queued)",
         user.id,
@@ -94,6 +82,8 @@ def _backfill_llm_calls(record_id: int, trace_id: str) -> None:
         # error 的调用 usage 可能为 None,or {} 兜底)
         rec.input_tokens = sum((c.get("usage") or {}).get("prompt_tokens") or 0 for c in calls)
         rec.output_tokens = sum((c.get("usage") or {}).get("completion_tokens") or 0 for c in calls)
+        # 本次比价 LLM 成本(元)+ 当时单价快照:按 app_config 现价逐模型算好冻结(services/llm_cost.py)。
+        rec.llm_cost_yuan, rec.llm_price_snapshot = compute_llm_cost(calls, get_llm_prices(db))
         db.commit()
         logger.info(
             "backfill llm_calls trace=%s n=%d in_tok=%d out_tok=%d",

app/api/v1/coupon.py

@@ -81,7 +81,16 @@ def _record_claims_blocking(
     device_id: str, user_id: int | None, trace_id: str | None, results: list[dict]
 ) -> None:
     with SessionLocal() as db:
-        coupon_repo.record_claims(db, device_id, user_id, trace_id, results)
+        # 取本次 session 环境,给 coupon_claim_record 打 app_env 标(每券成功率表按它过滤;设计 §13)。
+        app_env = coupon_repo.session_app_env(db, trace_id)
+        coupon_repo.record_claims(db, device_id, user_id, trace_id, results, app_env=app_env)
+        # 顺带把本帧「成功平台」并入 coupon_session.platform_success(admin 领券数据 ②整单/③点位成功率;
+        # 设计 route B,见 docs/guides/领券成功率指标-设计与埋点.md)。复用同一 SessionLocal、紧接 record_claims,
+        # 不新增连接;并集幂等(无新平台不写),trace_id 缺失或 session 行未落库则跳过。
+        if trace_id:
+            coupon_repo.merge_session_platform_success(
+                db, trace_id, coupon_repo.succeeded_platforms(results)
+            )
 
 
 def _mark_completed_blocking(

app/api/v1/feedback.py

@@ -31,7 +31,18 @@ router = APIRouter(prefix="/api/v1/feedback", tags=["feedback"])
 _MAX_IMAGES = 6
 _CONTENT_MAX = 200
 _CONTACT_MAX = 128
+_SCENE_MAX = 32
 _VALID_RECORD_STATUS = {"pending", "adopted", "rejected"}
+_VALID_SOURCES = {"profile", "comparison"}
+
+
+def _resolve_source(source: str, scene: str) -> str:
+    """反馈来源:客户端显式传的 source 优先(profile / comparison);未传或非法时,
+    按 scene 有无派生——比价结果页反馈才带 scene,故 scene 非空即视作 comparison。"""
+    src = source.strip().lower()
+    if src in _VALID_SOURCES:
+        return src
+    return "comparison" if scene.strip() else "profile"
 
 
 def _app_status(db_status: str) -> str:
@@ -46,10 +57,12 @@ def _record_out(fb) -> FeedbackRecordOut:
     return FeedbackRecordOut(
         id=fb.id,
         content=fb.content,
+        scene=getattr(fb, "scene", None),
         images=fb.images or [],
         status=_app_status(fb.status),
         reject_reason=getattr(fb, "reject_reason", None),
         reward_coins=getattr(fb, "reward_coins", None),
+        admin_reply=getattr(fb, "admin_reply", None),
         created_at=fb.created_at,
     )
 
@@ -61,6 +74,11 @@ async def submit_feedback(
     content: str = Form(...),
     # 原型改版后客户端不再采集联系方式;保留字段以兼容旧端 + 后续可能复用,默认空串。
     contact: str = Form(default=""),
+    # 反馈来源入口:profile(「我的」页)/ comparison(比价结果页)。新端显式传;旧端不带 →
+    # 空串 → 按 scene 有无派生。admin 据此展示/筛选「反馈类型」。
+    source: str = Form(default=""),
+    # 比价结果页反馈的「问题场景」(找错商品/优惠不对…);普通反馈不带 → 空串 → 存 NULL。
+    scene: str = Form(default=""),
     # 提交端环境快照(admin 反馈页展示「提交版本号」「机型OS版本」);旧端不带 → 空串 → 存 NULL。
     app_version: str = Form(default=""),
     device_model: str = Form(default=""),
@@ -76,6 +94,8 @@ async def submit_feedback(
         raise HTTPException(status_code=400, detail="反馈内容过长")
     if len(contact) > _CONTACT_MAX:
         raise HTTPException(status_code=400, detail="联系方式过长")
+    scene = scene.strip()[:_SCENE_MAX]
+    resolved_source = _resolve_source(source, scene)
 
     files = [f for f in (images or []) if f is not None and f.filename]
     if len(files) > _MAX_IMAGES:
@@ -91,10 +111,13 @@ async def submit_feedback(
 
     fb = feedback_repo.create_feedback(
         db, user_id=user.id, content=content, contact=contact, images=urls,
+        source=resolved_source, scene=scene or None,
         app_version=app_version.strip(), device_model=device_model.strip(),
         rom_name=rom_name.strip(), android_version=android_version.strip(),
     )
-    logger.info("feedback id=%d user_id=%d images=%d", fb.id, user.id, len(urls))
+    logger.info(
+        "feedback id=%d user_id=%d source=%s images=%d", fb.id, user.id, resolved_source, len(urls)
+    )
     return FeedbackOut.model_validate(fb)
 
 

app/api/v1/meituan.py

@@ -25,9 +25,19 @@ from app.schemas.meituan import (
     ReferralLinkResponse,
     TopSalesRequest,
 )
+from app.utils.meituan_city import get_meituan_city
 
 logger = logging.getLogger("shagua.meituan")
 
+
+def _resolve_city_id(latitude: float, longitude: float) -> str:
+    """经纬度 → 美团城市 ID;解析失败返 ""（调用方应降级返空）。"""
+    try:
+        return get_meituan_city(latitude, longitude).get("city_id", "")
+    except Exception:
+        logger.exception("get_meituan_city 失败")
+        return ""
+
 router = APIRouter(prefix="/api/v1/meituan", tags=["meituan-cps"])
 
 
@@ -175,13 +185,19 @@ def feed(req: FeedRequest, db: Session = Depends(get_db)) -> FeedResponse:
         status = "degraded" if (not cards and wm_fail and dd_fail) else ("ok" if cards else "empty")
         return FeedResponse(items=cards, has_next=wm_hn or dd_hn, page=req.page, status=status)
 
-    # 智能推荐(rec):走【离线库】筛佣金率 ≥ 3%,分页返回(SQL 侧去重+排序+分页,秒级、不打美团)。
+    # 智能推荐(rec):走【离线库】筛佣金率 ≥ 3%,按城市过滤,分页返回(SQL 侧去重+排序+分页,秒级、不打美团)。
     # 实测库里佣金≥3% 去重后仅 ~578 条(几乎全是外卖;到店团购佣金普遍 <3%):实时按"同城热销榜单"
     # 拉既撞限流、又填不满(该榜单中位佣金 ~0.8%,筛完每页剩 0-1 条),故从库出。佣金阈值逻辑不变。
     if tab == "rec":
+        city_id = _resolve_city_id(lat, lon)
+        if not city_id:
+            return FeedResponse(items=[], has_next=False, page=req.page, status="degraded")
         PAGE = 20
         try:
-            base = select(MeituanCoupon).where(MeituanCoupon.commission_percent >= 3.0)
+            base = select(MeituanCoupon).where(
+                MeituanCoupon.commission_percent >= 3.0,
+                MeituanCoupon.city_id == city_id,
+            )
             deduped = base.distinct(MeituanCoupon.dedup_key).order_by(
                 MeituanCoupon.dedup_key,
                 MeituanCoupon.commission_percent.desc(),
@@ -211,6 +227,9 @@ def feed(req: FeedRequest, db: Session = Depends(get_db)) -> FeedResponse:
                 card.distance_text = None
                 card.distance_meters = None
                 cards.append(card)
+        if not cards and req.page == 1:
+            # 命中城市却 0 券:该城确无 ≥3% 券,或 ETL 灌的 city_id 与 city_dict 口径不一致。
+            logger.info("[feed] rec city_id=%s 命中 0 券(该城确无券?或 ETL/city_dict 的 city_id 口径不一致)", city_id)
         return FeedResponse(items=cards, has_next=has_next, page=req.page,
                             status="ok" if cards else "empty")
 
@@ -254,14 +273,24 @@ def referral_link(req: ReferralLinkRequest) -> ReferralLinkResponse:
 
 
 @router.post("/top-sales", response_model=CouponListResponse,
-             summary="销量最高(从离线库 meituan_coupon 按销量降序 + 跨源去重,不实时打美团)")
+             summary="销量最高(从离线库 meituan_coupon 按销量降序 + 跨源去重,按城市过滤,不实时打美团)")
 def top_sales(req: TopSalesRequest, db: Session = Depends(get_db)) -> CouponListResponse:
+    # 按设备经纬度定位城市,只查同城券;老客户端不带坐标 → 降级返空(不 422、不误返全城)。
+    if req.latitude is None or req.longitude is None:
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
+    city_id = _resolve_city_id(req.latitude, req.longitude)
+    if not city_id:
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
+
     # 去重 + 排序 + 分页全在 SQL 做,每页只取并解析当前页 ~20 条。
     # (之前实现每翻一页都全表拉取 + 全量 from_raw 解析,翻页慢 → 客户端滑动卡顿/翻不动。)
     # 库为空(prod 刚部署 / ETL 未跑完)时返空 + status=empty,不崩;库查询异常降级 degraded。
     try:
         # 1) DISTINCT ON (dedup_key):每个去重键(品牌|名|价)只留销量最高那条(同销量再按佣金)
-        base = select(MeituanCoupon).where(MeituanCoupon.sale_volume_num.isnot(None))
+        base = select(MeituanCoupon).where(
+            MeituanCoupon.sale_volume_num.isnot(None),
+            MeituanCoupon.city_id == city_id,
+        )
         if req.platform is not None:
             base = base.where(MeituanCoupon.platform == req.platform)
         deduped = base.distinct(MeituanCoupon.dedup_key).order_by(
@@ -292,6 +321,14 @@ def top_sales(req: TopSalesRequest, db: Session = Depends(get_db)) -> CouponList
         except Exception:  # noqa: BLE001
             continue
         if card.product_view_sign:
+            # 不显示距离:库里的距离是相对城市默认点的(对用户无意义、且误导)。
+            # 置空后前端"距离 店名"那行只剩店名、自动顶到最左(店名移到原距离的位置)。
+            # 逻辑与推荐流保持一致
+            card.distance_text = None
+            card.distance_meters = None
             cards.append(card)
+    if not cards and req.page == 1:
+        # 命中城市却 0 券:可能该城确无券,也可能 ETL 灌的 city_id 与 city_dict 口径不一致(静默降级的隐患)。
+        logger.info("[top-sales] city_id=%s 命中 0 券(该城确无券?或 ETL/city_dict 的 city_id 口径不一致)", city_id)
     return CouponListResponse(items=cards, has_next=has_next, search_id=None,
                               status="ok" if cards else "empty")

app/api/v1/order.py

@@ -1,9 +1,14 @@
+import logging
+
 from fastapi import APIRouter
 
 from app.api.deps import CurrentUser, DbSession
+from app.repositories import invite as crud_invite
 from app.repositories import savings as crud_savings
 from app.schemas.order import OrderReportOut, OrderReportRequest
 
+logger = logging.getLogger("shagua.order")
+
 router = APIRouter(prefix="/api/v1/order", tags=["order"])
 
 
@@ -15,6 +20,20 @@ router = APIRouter(prefix="/api/v1/order", tags=["order"])
 def report_order(req: OrderReportRequest, user: CurrentUser, db: DbSession) -> OrderReportOut:
     # 记账唯一真相表是 savings_record(source='compare')。
     rec, duplicated = crud_savings.create_from_report(db, user.id, req)
+    # 邀请 v2 发奖:被邀请人【实际下单】(而非仅完成比价)才给邀请人发邀请奖励金(幂等,只发一次)。
+    # 触发点从"比价成功上报"挪到这里(冰:完成比价并实际下单才算成功)。仅首次真实上报触发,
+    # 重复上报(duplicated)跳过。best-effort:发奖异常不影响订单上报本身(rec 已 commit),只 log;
+    # try_reward_on_compare 自带 compare_reward_granted 幂等闸,漏发靠后续对账补。
+    if not duplicated:
+        try:
+            reward = crud_invite.try_reward_on_compare(db, user.id)
+            if reward.status == "granted":
+                logger.info(
+                    "invite order reward granted inviter=%s invitee=%s cents=%s",
+                    reward.inviter_user_id, user.id, reward.reward_cents,
+                )
+        except Exception as e:  # noqa: BLE001 best-effort,发奖失败不阻塞订单上报
+            logger.warning("invite order reward failed invitee=%s: %s", user.id, e)
     return OrderReportOut(
         id=rec.id,
         platform=rec.platform or req.platform,

app/api/v1/user.py

@@ -69,6 +69,18 @@ def complete_onboarding(
     return OkResponse()
 
 
+@router.post("/onboarding/reset", response_model=OkResponse, summary="重置新手引导(删该 设备+账号 完成标记,下次登录重走)")
+def reset_onboarding(
+    req: OnboardingCompleteRequest, user: CurrentUser, db: DbSession
+) -> OkResponse:
+    """删该 (当前账号, device_id) 的引导完成标记 → 下次登录 onboarding_completed=false,客户端重走。
+    与 /onboarding/complete 互逆。device_id 取客户端硬件级 ANDROID_ID(与登录/complete 一致)。
+    幂等:无记录也返回 ok。仅删自己(当前 JWT 用户)这台设备的记录,不影响别的账号/设备。"""
+    deleted = onboarding_repo.delete_completion(db, user_id=user.id, device_id=req.device_id)
+    logger.info("onboarding reset user_id=%d device_len=%d deleted=%d", user.id, len(req.device_id), deleted)
+    return OkResponse()
+
+
 @router.get(
     "/onboarding/status",
     response_model=OnboardingStatusResponse,

app/api/v1/wallet.py

@@ -43,6 +43,7 @@ from app.schemas.welfare import (
     WithdrawRequest,
     WithdrawResultOut,
     WithdrawStatusOut,
+    WithdrawTierOut,
 )
 
 logger = logging.getLogger("shagua.wallet")
@@ -173,8 +174,15 @@ def unbind_wechat(
     return UnbindWechatResultOut(bound=False)
 
 
-@router.get("/withdraw-info", response_model=WithdrawInfoOut, summary="提现额度/绑定状态/免确认开关")
-def withdraw_info(user: CurrentUser, db: DbSession) -> WithdrawInfoOut:
+@router.get("/withdraw-info", response_model=WithdrawInfoOut, summary="提现额度/绑定状态/免确认开关/档位")
+def withdraw_info(
+    user: CurrentUser,
+    db: DbSession,
+    source: str = Query(
+        "coin_cash",
+        description="提现账户:coin_cash(福利页,下发 tiers 档位) / invite_cash(邀请页,tiers 为空走旧逻辑)",
+    ),
+) -> WithdrawInfoOut:
     u = db.get(User, user.id)
     # 顺带同步免确认授权状态(捕获首单确认后已生效的授权 pending→active),让开关展示实时
     auth = crud_wallet.sync_transfer_auth(db, user.id)
@@ -185,6 +193,7 @@ def withdraw_info(user: CurrentUser, db: DbSession) -> WithdrawInfoOut:
         wechat_nickname=u.wechat_nickname if u else None,
         wechat_avatar_url=u.wechat_avatar_url if u else None,
         transfer_auth_enabled=bool(auth and auth.state == "active"),
+        tiers=[WithdrawTierOut(**t) for t in crud_wallet.withdraw_tier_states(db, user.id, source)],
     )
 
 
@@ -218,6 +227,9 @@ def withdraw(req: WithdrawRequest, user: CurrentUser, db: DbSession) -> Withdraw
             status_code=status.HTTP_409_CONFLICT,
             detail="已有提现申请正在审核或打款中,请处理完成后再申请",
         ) from e
+    except crud_wallet.WithdrawTierUnavailableError as e:
+        # 福利页档位闸(7-9):次数满/已选其他额度。正常客户端已按 tiers 预拦,此处兜底防绕过。
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="今日额度已达上限") from e
     except crud_wallet.InsufficientCashError as e:
         raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="现金余额不足") from e
 

app/core/config.py

@@ -44,6 +44,11 @@ class Settings(BaseSettings):
     JWT_ALGORITHM: str = "HS256"
     JWT_ACCESS_TOKEN_EXPIRE_MINUTES: int = 120
     JWT_REFRESH_TOKEN_EXPIRE_DAYS: int = 30
+    # 微信登录未命中 openid 时签发的"待绑手机"令牌有效期(JWT_SECRET_KEY 签名,typ=wechat_bind;
+    # 见 security.create_bind_ticket)。需覆盖"授权→输手机号→收短信→输验证码"整个绑定流程。
+    WECHAT_BIND_TICKET_EXPIRE_MINUTES: int = 10
+    # 一个手机号 30 天内最多换绑一次(微信占用冲突页的"换绑"动作)。见 phone_rebind_log。
+    PHONE_REBIND_LIMIT_DAYS: int = 30
 
     # ===== Admin 后台 =====
     # admin 用独立 JWT secret(≠ JWT_SECRET_KEY),App 用户 token 无法越权访问后台。
@@ -68,7 +73,7 @@ class Settings(BaseSettings):
 
     # 无障碍保护存活监控后台任务(pull 后置检测;本期不接推送)
     HEARTBEAT_MONITOR_ENABLED: bool = True       # 总开关
-    HEARTBEAT_TIMEOUT_MINUTES: int = 10          # 多久没心跳算掉线(≈3 个客户端心跳周期)
+    HEARTBEAT_TIMEOUT_MINUTES: int = 60          # 多久没心跳算掉线(1 小时,避免短暂离线误判被杀)
     HEARTBEAT_SCAN_INTERVAL_SEC: int = 60        # 扫描周期
 
     # ===== 短信 =====
@@ -107,6 +112,9 @@ class Settings(BaseSettings):
     # 美团调用走的代理。本机开发直连美团会 SSL EOF,需填 http://127.0.0.1:7897;
     # 线上国内服务器留空(=直连)。见 .env.example 与 integrations/meituan.py。
     MT_CPS_PROXY: str = ""
+    # 本地开发:开启后 /feed 接口直接返回 mock 数据,不调美团 API、不查离线库,
+    # 方便前端联调 feed 卡片样式、分页、距离排序等 UI。生产必须 false。
+    MT_CPS_MOCK_FEED: bool = True
 
     @property
     def mt_cps_configured(self) -> bool:

app/core/config_schema.py

@@ -11,7 +11,10 @@ from typing import Any
 
 from app.core import rewards as r
 
-# type 约定(给前端渲染编辑控件用):int / int_list / dict_str_int / bool
+# type 约定(给前端渲染编辑控件用):int / int_list / dict_str_int / bool / enum
+# hidden=True:仍是合法可配项(业务照常 get_value / admin 可经专用端点读写),但**不在通用
+#   「系统配置」页渲染**(admin/routers/config.py:list_config 按此过滤)。用于把已下线/已改由
+#   专用页管理的项从福利页 Tab 收起,同时保留后端默认值与写入能力。
 CONFIG_DEFS: dict[str, dict[str, Any]] = {
     "signin_rewards": {
         "default": list(r.SIGNIN_REWARDS), "label": "签到 7 天金币档位",
@@ -30,18 +33,21 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
         "default": r.WITHDRAW_MAX_CENTS, "label": "提现最高额(分)",
         "group": "钱包", "type": "int",
     },
+    # 从福利页 Tab 收起(hidden)的项:任务 / 里程碑 整组 + 看广告组里的「单次金币(遗留展示值)/
+    # 每轮次数 / 比价领券信息流广告开关 comparing_ad_enabled」。key 与默认值保留、后端业务照常读取,
+    # 仅不在配置页渲染。看广告组保留可见的:每日上限 / 单次金币上限 / 关闭后冷却。
     "task_rewards": {
         "default": dict(r.TASK_REWARDS), "label": "一次性任务奖励",
-        "group": "任务", "type": "dict_str_int", "help": "task_key → 金币。",
+        "group": "任务", "type": "dict_str_int", "help": "task_key → 金币。", "hidden": True,
     },
     "record_milestones": {
         "default": list(r.RECORD_MILESTONES), "label": "比价里程碑金币档位",
-        "group": "里程碑", "type": "int_list",
+        "group": "里程碑", "type": "int_list", "hidden": True,
         "help": "累计成功比价第 1~N 档解锁发的金币。",
     },
     "ad_reward_coin": {
         "default": r.AD_REWARD_COIN, "label": "看广告单次金币",
-        "group": "看广告", "type": "int",
+        "group": "看广告", "type": "int", "hidden": True,
         "help": "历史兼容/测试展示值;正式发放按 eCPM 公式计算。",
     },
     "ad_daily_limit": {
@@ -54,7 +60,7 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
     },
     "ad_round_count": {
         "default": r.VIDEO_ROUND_REQUIRED_COUNT, "label": "每轮看广告次数",
-        "group": "看广告", "type": "int", "help": "当前为 1,表示每次广告关闭后触发短冷却。",
+        "group": "看广告", "type": "int", "hidden": True, "help": "当前为 1,表示每次广告关闭后触发短冷却。",
     },
     "ad_cooldown_sec": {
         "default": r.VIDEO_ROUND_COOLDOWN_SECONDS, "label": "广告关闭后冷却(秒)",
@@ -67,7 +73,7 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
     },
     "comparing_ad_enabled": {
         "default": True, "label": "比价/领券期信息流广告",
-        "group": "看广告", "type": "bool",
+        "group": "看广告", "type": "bool", "hidden": True,
         "help": (
             "开启后,比价进行中 + 领券等候期会在悬浮窗展示穿山甲信息流广告(变现行为);"
             "关闭则全程不出广告。客户端按 app 启动 / 每场比价开始时拉取并缓存,故为「最终一致」的"
@@ -84,4 +90,25 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
             "提现页「批量对账」手动按钮不受影响。"
         ),
     },
+    # 首页轮播数据源(hidden:不进通用配置 Tab,由「首页轮播种子」页的专用端点 /marquee-seeds/mode 读写)。
+    "marquee_feed_mode": {
+        "default": "mixed", "label": "首页轮播数据源",
+        "group": "首页轮播", "type": "enum", "hidden": True,
+        "help": "mixed=真实优先+种子补位(默认);real=只用真实比价记录;seed=只用种子/合成(演示)。",
+    },
+    # 比价 LLM 调用成本计价。值是嵌套 JSON(非 str→int),借 dict_str_int 类型在配置页走原始 JSON
+    # 编辑框;set_value 不校验类型,嵌套 JSON 照存。
+    "llm_token_price": {
+        "default": {
+            "per_model": {"qwen3.5-flash": {"input_per_1m": 0.8, "output_per_1m": 2.0}},
+            "default": {"input_per_1m": 3.0, "output_per_1m": 15.0},
+            "currency": "CNY", "unit": "per_1m_tokens",
+        },
+        "label": "LLM 模型单价(元/百万 token)",
+        "group": "LLM 成本", "type": "dict_str_int",
+        "help": (
+            "比价 LLM 调用成本计价。JSON:per_model 按模型配 input/output 单价(元/1M token),"
+            "default 兜底未登记的模型。改价只影响之后回填的新记录,历史记录用当时价格快照。"
+        ),
+    },
 }

app/core/logging.py

@@ -2,9 +2,15 @@
 
 业务代码用 `logger = logging.getLogger("shagua.xxx")` 即可, 本模块在 main.py 启动时调一次。
 
-- 控制台(stdout): 人类可读文本, 给 systemd / 本地看。
-- 文件 `logs/app-server.log`: 单行 JSON, 供阿里云 SLS/Logtail 采集(JSON 模式零正则);
-  异常栈作为字段内嵌不换行 → 每条日志一行。
+- 控制台(stdout): 人类可读文本, 给 systemd / 本地看; 有 trace 时行尾附 `trace=xxx`。
+- 文件 `logs/app-server.log`: 单行 JSON, 供**阿里云 SLS / Logtail** 采集(JSON 模式零正则);
+  异常栈内嵌为字段不换行 → 每条日志一行。
+- **结构化字段(SLS 可直接查/聚合)**:
+  - `trace_id`: 请求级贯穿——在入口 `trace_id_ctx.set(...)` 后, 本请求内**每一行日志**(含
+    run_in_threadpool 里的 harvest, contextvars 自动拷进线程)都自动带上, 无需手写。
+    SLS 里 `trace_id: "xxx"` 一查即得整条比价链路, 按 time 升序即请求顺序。
+  - 任意 `logger.info(msg, extra={"phase": ..., "step": ..., "command": ...})` 的 extra
+    键都会平铺进 JSON 顶层 → SLS 可按 phase/step/command/cost_ms 等过滤聚合。
 - 环境变量:
   - LOG_JSON_CONSOLE=1   控制台也输出 JSON
   - LOG_DIR / LOG_FILE   改落盘路径(默认 logs/app-server.log)
@@ -17,13 +23,36 @@ import json
 import logging
 import os
 import sys
+from contextvars import ContextVar
 from datetime import datetime
 from logging.handlers import RotatingFileHandler
 from pathlib import Path
 
 
+# 请求级 trace_id:入口(如 compare.py 透传壳)set 之后, 本请求上下文(含 run_in_threadpool
+# 拷贝出去的线程)内所有日志自动带上。默认空串 = 非请求上下文(启动/后台 worker)。
+trace_id_ctx: ContextVar[str] = ContextVar("trace_id", default="")
+
+
+# 标准 LogRecord 属性 + 格式化期附加项:凡不在此集合的 record 属性都视为业务 extra, 平铺进 JSON。
+_RESERVED = set(
+    logging.LogRecord("", 0, "", 0, "", (), None).__dict__
+) | {"message", "asctime", "trace_id", "taskName"}
+
+
+class _ContextFilter(logging.Filter):
+    """把 trace_id_ctx 注入每条 record(供两个 formatter 取用)。挂在 handler 上,
+    命中每条(含 propagate 上来的)记录, 在 format 之前置好 record.trace_id。"""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        if not hasattr(record, "trace_id"):
+            record.trace_id = trace_id_ctx.get()
+        return True
+
+
 class JsonFormatter(logging.Formatter):
-    """把 LogRecord 序列化成单行 JSON(SLS/Logtail 友好)。异常栈内嵌为字段, 整条仍是一行。"""
+    """LogRecord → 单行 JSON(SLS/Logtail 友好)。trace_id 提到顶层、extra 键平铺, 异常栈内嵌。"""
+
     def __init__(self, service: str = "app-server"):
         super().__init__()
         self.service = service
@@ -35,10 +64,17 @@ class JsonFormatter(logging.Formatter):
             "level": record.levelname,
             "service": self.service,
             "logger": record.name,
-            "func": record.funcName,
-            "line": record.lineno,
-            "message": record.getMessage(),
         }
+        tid = getattr(record, "trace_id", "") or trace_id_ctx.get()
+        if tid:
+            data["trace_id"] = tid
+        # 业务 extra 字段(phase / step / endpoint / command / cost_ms / status ...)平铺进顶层
+        for k, v in record.__dict__.items():
+            if k not in _RESERVED and not k.startswith("_"):
+                data[k] = v
+        data["func"] = record.funcName
+        data["line"] = record.lineno
+        data["message"] = record.getMessage()
         if record.exc_info:
             data["exception"] = self.formatException(record.exc_info)
         if record.stack_info:
@@ -46,6 +82,15 @@ class JsonFormatter(logging.Formatter):
         return json.dumps(data, ensure_ascii=False, default=str)
 
 
+class TextFormatter(logging.Formatter):
+    """控制台文本:标准行 + 有 trace_id 时行尾附 `trace=xxx`(无 trace 的启动/后台日志不加噪)。"""
+
+    def format(self, record: logging.LogRecord) -> str:
+        base = super().format(record)
+        tid = getattr(record, "trace_id", "") or trace_id_ctx.get()
+        return f"{base} trace={tid}" if tid else base
+
+
 _CONFIGURED = False
 
 
@@ -63,14 +108,17 @@ def setup_logging(debug: bool = False) -> None:
     for h in list(root.handlers):
         root.removeHandler(h)
 
+    ctx_filter = _ContextFilter()
+
     # 控制台: 默认文本(systemd/本地看); LOG_JSON_CONSOLE=1 时输出 JSON
     console = logging.StreamHandler(sys.stdout)
     if os.getenv("LOG_JSON_CONSOLE") == "1":
         console.setFormatter(JsonFormatter(service))
     else:
         console.setFormatter(
-            logging.Formatter("%(asctime)s %(levelname)s %(name)s: %(message)s")
+            TextFormatter("%(asctime)s %(levelname)s %(name)s: %(message)s")
         )
+    console.addFilter(ctx_filter)
     root.addHandler(console)
 
     # 文件: 单行 JSON, 供 Logtail 采集(自动轮转, 单文件 10MB, 保留 5 个)
@@ -82,6 +130,7 @@ def setup_logging(debug: bool = False) -> None:
         log_file, maxBytes=10 * 1024 * 1024, backupCount=5, encoding="utf-8",
     )
     file_handler.setFormatter(JsonFormatter(service))
+    file_handler.addFilter(ctx_filter)
     root.addHandler(file_handler)
 
     # 第三方库降噪

app/core/rewards.py

@@ -6,6 +6,7 @@
 from __future__ import annotations
 
 from datetime import date, datetime, timedelta, timezone
+from typing import NamedTuple
 
 # 业务时区:签到的"今天"按北京时间算,不能用 UTC。
 # 否则 UTC+8 的凌晨 0~8 点会被算成 UTC 的前一天,导致签到日期错位。
@@ -52,6 +53,30 @@ WITHDRAW_MIN_CENTS: int = 10
 WITHDRAW_MAX_CENTS: int = 5_000_000  # 5 万元
 
 
+# ===== 提现档位(福利页 coin_cash;7-9 对齐原型 withdrawal.html)=====
+# 后端是档位唯一真相源:withdraw-info 按此下发,create_withdraw 按此校验(防绕过客户端刷)。
+# 规则(2026-07-09 拍板):
+#   - 新人档(is_newbie):账号历史一次性,"发起就算用过"(任意状态含被拒),用过即不再下发;
+#     0.1 与 0.3 各自独立同天可各提一次,且不参与常规档"每日选一个额度"互斥。
+#   - 常规档:按北京日计次(0.5×3 / 10×1 / 20×1),三档每天只能选一个。
+# invite_cash(邀请页)本轮无档位概念,不在此表。改档位=改这里发版。
+class WithdrawTier(NamedTuple):
+    amount_cents: int
+    label: str          # 客户端档位方块展示文案
+    badge: str | None   # 角标文案;None=无角标
+    daily_limit: int    # 每日次数上限(新人档的"历史一次性"另由 is_newbie 判定)
+    is_newbie: bool
+
+
+WITHDRAW_TIERS_COIN_CASH: tuple[WithdrawTier, ...] = (
+    WithdrawTier(10, "0.1", "新人福利", 1, True),
+    WithdrawTier(30, "0.3", "新人福利", 1, True),
+    WithdrawTier(50, "0.5", None, 3, False),
+    WithdrawTier(1000, "10", None, 1, False),
+    WithdrawTier(2000, "20", None, 1, False),
+)
+
+
 # ===== 一次性任务(领一次,user_task 去重)=====
 TASK_ENABLE_NOTIFICATION = "enable_notification"
 

app/core/security.py

@@ -87,6 +87,91 @@ def issue_token_pair(user_id: int) -> dict[str, Any]:
     }
 
 
+def create_bind_ticket(
+    *, openid: str, wechat_nickname: str | None, wechat_avatar_url: str | None
+) -> str:
+    """微信登录未命中 openid 时,签发短时"待绑手机"令牌,承载 openid + 微信昵称头像。
+
+    typ='wechat_bind'、sub=openid;有效期 settings.WECHAT_BIND_TICKET_EXPIRE_MINUTES 分钟。
+    与 access/refresh 用同一 JWT_SECRET_KEY 签名,靠 typ 区分,decode_bind_ticket 校验 typ。
+    """
+    now = _now()
+    expire = now + timedelta(minutes=settings.WECHAT_BIND_TICKET_EXPIRE_MINUTES)
+    payload: dict[str, Any] = {
+        "sub": openid,
+        "typ": "wechat_bind",
+        "wnk": wechat_nickname,
+        "wav": wechat_avatar_url,
+        "iat": int(now.timestamp()),
+        "exp": int(expire.timestamp()),
+    }
+    return jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm=settings.JWT_ALGORITHM)
+
+
+def decode_bind_ticket(token: str) -> dict[str, Any]:
+    """解析"待绑手机"令牌,校验签名/过期/类型。失败抛 TokenError。
+
+    返回 {'openid': str, 'wnk': str|None, 'wav': str|None}。
+    """
+    try:
+        payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=[settings.JWT_ALGORITHM])
+    except jwt.ExpiredSignatureError as e:
+        raise TokenError("bind ticket expired") from e
+    except jwt.InvalidTokenError as e:
+        raise TokenError(f"invalid bind ticket: {e}") from e
+    if payload.get("typ") != "wechat_bind":
+        raise TokenError(f"wrong token type: want=wechat_bind got={payload.get('typ')}")
+    if "sub" not in payload:
+        raise TokenError("bind ticket missing sub")
+    return {"openid": payload["sub"], "wnk": payload.get("wnk"), "wav": payload.get("wav")}
+
+
+def create_conflict_ticket(
+    *, openid: str, wechat_nickname: str | None, wechat_avatar_url: str | None, phone: str
+) -> str:
+    """手机号占用时签发的短时"冲突处理"令牌。
+
+    比 bind_ticket 多编码 **已验证的手机号 phone** —— 换绑/继续绑定只认它,证明"这对
+    openid/手机号刚在绑号时验证通过",免用户重输验证码,又堵住"拿自己 openid + 任意手机号
+    去夺号"的接管漏洞。typ='wechat_conflict';有效期复用 WECHAT_BIND_TICKET_EXPIRE_MINUTES。
+    """
+    now = _now()
+    expire = now + timedelta(minutes=settings.WECHAT_BIND_TICKET_EXPIRE_MINUTES)
+    payload: dict[str, Any] = {
+        "sub": openid,
+        "typ": "wechat_conflict",
+        "wnk": wechat_nickname,
+        "wav": wechat_avatar_url,
+        "phn": phone,
+        "iat": int(now.timestamp()),
+        "exp": int(expire.timestamp()),
+    }
+    return jwt.encode(payload, settings.JWT_SECRET_KEY, algorithm=settings.JWT_ALGORITHM)
+
+
+def decode_conflict_ticket(token: str) -> dict[str, Any]:
+    """解析"冲突处理"令牌,校验签名/过期/类型。失败抛 TokenError。
+
+    返回 {'openid': str, 'wnk': str|None, 'wav': str|None, 'phone': str}。
+    """
+    try:
+        payload = jwt.decode(token, settings.JWT_SECRET_KEY, algorithms=[settings.JWT_ALGORITHM])
+    except jwt.ExpiredSignatureError as e:
+        raise TokenError("conflict ticket expired") from e
+    except jwt.InvalidTokenError as e:
+        raise TokenError(f"invalid conflict ticket: {e}") from e
+    if payload.get("typ") != "wechat_conflict":
+        raise TokenError(f"wrong token type: want=wechat_conflict got={payload.get('typ')}")
+    if "sub" not in payload or "phn" not in payload:
+        raise TokenError("conflict ticket missing sub/phn")
+    return {
+        "openid": payload["sub"],
+        "wnk": payload.get("wnk"),
+        "wav": payload.get("wav"),
+        "phone": payload["phn"],
+    }
+
+
 # ===================== 密码 hash(admin 后台账号用)=====================
 # 用户侧是手机号+验证码登录,不存密码;仅 admin 账号用 username+password 登录。
 

app/integrations/sms.py

@@ -8,15 +8,16 @@
     校验)→ 鉴权复用极光一键登录的 `JG_APP_KEY`/`JG_MASTER_SECRET`(同一极光应用)。
 
 验证码存储:**进程内存**(单 worker uvicorn 够用)。重启丢失(用户重发即可)。多
-worker / 多机时内存不共享 → 冷却、每日上限、校验都会失效,届时迁移到 DB/Redis。
+worker / 多机时内存不共享 → 冷却、校验都会失效,届时迁移到 DB/Redis。
 见 docs/待办与技术债.md。
 
-防刷三层(短信花钱 + `/sms/send` 在登录前无法 JWT 鉴权):
+防刷两层(短信花钱 + `/sms/send` 在登录前无法 JWT 鉴权):
   1. 单号 `SMS_SEND_INTERVAL_SEC` 冷却(本文件)
-  2. 单号每日 `SMS_DAILY_LIMIT_PER_PHONE` 条上限(本文件)
-  3. 单设备(device_id)每小时频控(api 层 auth.sms_send 内 enforce_rate_limit)+ 极光控制台 IP 白名单/防轰炸(运维侧)。
+  2. 单设备(device_id)每小时频控(api 层 auth.sms_send 内 enforce_rate_limit)+ 极光控制台 IP 白名单/防轰炸(运维侧)。
      ⚠️ 原「单 IP 频控(rate_limit 依赖)」2026-06-26 按产品要求删除、改设备维度;但 device_id 客户端可伪造/轮换,
         脚本轮换 id 能绕过本层 → 挡脚本狂发主要靠极光控制台侧(+ 可选 nginx 限流)。
+     ⚠️ 原「单号每日上限」2026-07-03 按精简要求删除(mentor 定:登录风控只留单号冷却 + 单设备频控);
+        单号维度现仅剩 60s 冷却,「换号轰炸」由单设备频控封顶。
 另:单码校验失败 `SMS_MAX_VERIFY_ATTEMPTS` 次即作废(防爆破),验过即作废(一次性)。
 """
 from __future__ import annotations
@@ -26,7 +27,6 @@ import logging
 import secrets
 import time
 from dataclasses import dataclass
-from datetime import datetime
 from threading import Lock
 
 import httpx
@@ -56,22 +56,17 @@ class _CodeRecord:
 # 进程内存(单 worker 有效;多 worker 不共享,见模块 docstring)
 _codes: dict[str, _CodeRecord] = {}            # phone -> 当前有效验证码
 _last_sent: dict[str, float] = {}              # phone -> 上次发送 epoch(冷却)
-_daily_count: dict[str, tuple[str, int]] = {}  # phone -> (date_str, 当日发送数)
 _lock = Lock()
 _GC_THRESHOLD = 10000  # 任一内存 dict 超此阈值,send 时顺手清过期项(防无限增长,仿 ratelimit)
 
 
-def _today() -> str:
-    return datetime.now().strftime("%Y-%m-%d")
-
-
 def _gen_code() -> str:
     """生成 N 位数字验证码(用 secrets 而非 random;允许前导 0)。"""
     return "".join(secrets.choice("0123456789") for _ in range(settings.SMS_CODE_LENGTH))
 
 
 def _gc(now: float) -> None:
-    """顺手清理过期内存项,防三个 dict 无限增长。仅在持锁时调用,且某 dict 超
+    """顺手清理过期内存项,防两个 dict 无限增长。仅在持锁时调用,且某 dict 超
     _GC_THRESHOLD 才扫它(低频,开销可忽略)。"""
     if len(_codes) > _GC_THRESHOLD:
         for p in [p for p, r in _codes.items() if now > r.expires_at]:
@@ -80,10 +75,6 @@ def _gc(now: float) -> None:
         cutoff = now - settings.SMS_SEND_INTERVAL_SEC
         for p in [p for p, ts in _last_sent.items() if ts < cutoff]:
             _last_sent.pop(p, None)
-    if len(_daily_count) > _GC_THRESHOLD:
-        today = _today()
-        for p in [p for p, (d, _c) in _daily_count.items() if d != today]:
-            _daily_count.pop(p, None)
 
 
 def send_code(phone: str) -> int:
@@ -102,17 +93,9 @@ def send_code(phone: str) -> int:
             remain = int(settings.SMS_SEND_INTERVAL_SEC - elapsed)
             raise SmsError(f"发送过于频繁,请 {remain}s 后再试")
 
-        today = _today()
-        day, cnt = _daily_count.get(phone, ("", 0))
-        if day != today:
-            cnt = 0
-        if cnt >= settings.SMS_DAILY_LIMIT_PER_PHONE:
-            raise SmsError("今日验证码发送次数已达上限,请明天再试")
-
         code = _gen_code()
-        # 预占:先记冷却/计数/存码,释放锁后再发网络(发失败保留冷却+计数,见下)
+        # 预占:先记冷却/存码,释放锁后再发网络(发失败保留冷却,见下)
         _last_sent[phone] = now
-        _daily_count[phone] = (today, cnt + 1)
         _codes[phone] = _CodeRecord(code=code, expires_at=now + settings.SMS_CODE_TTL_SEC)
 
     # --- lock 外:真正发送(网络 IO 不持锁)---
@@ -123,7 +106,7 @@ def send_code(phone: str) -> int:
             _send_via_jiguang(phone, code)
             logger.info("[SMS] sent to %s****", phone[:3])
     except Exception as e:
-        # 发送失败:**保留冷却 + 每日计数**(失败也限速,挡住余额不足/签名失效时
+        # 发送失败:**保留冷却**(失败也限速,挡住余额不足/签名失效时
         # 前端重试狂打极光),只清掉没发出去的码(用户收不到,留着无意义且占内存)。
         with _lock:
             _codes.pop(phone, None)

app/main.py

@@ -71,6 +71,12 @@ async def lifespan(_: FastAPI) -> AsyncIterator[None]:
         settings.DATABASE_URL.split("://", 1)[0],
     )
     get_pricebot_client()  # 预热透传 client:把建 SSL 上下文的一次性成本付在启动,首个领券请求即热
+    try:
+        # 预热离线地理库:首次加载 ~2.5M 行 CSV + 建 KDTree,摊到启动、不砸首个按城市过滤的请求
+        from app.utils import geo
+        geo.ensure_loaded()
+    except Exception:  # noqa: BLE001
+        logger.exception("reverse_geocoder 预热失败(城市反查将在首个请求时懒加载)")
     reconcile_task = start_withdraw_reconcile_worker()
     heartbeat_task = start_heartbeat_monitor()
     daily_exchange_task = start_daily_exchange_worker()

app/models/__init__.py

@@ -5,7 +5,12 @@ from app.models.ad_pangle_revenue import AdPangleDailyRevenue  # noqa: F401
 from app.models.ad_reward import AdRewardRecord  # noqa: F401
 from app.models.ad_watch_log import AdWatchLog  # noqa: F401
 from app.models.admin import AdminAuditLog, AdminUser  # noqa: F401
+from app.models.admin_role import AdminRole  # noqa: F401
 from app.models.analytics_event import AnalyticsEvent  # noqa: F401
+from app.models.analytics_selfstat import (  # noqa: F401
+    AnalyticsSelfStat,
+    AnalyticsSelfStatEvent,
+)
 from app.models.app_config import AppConfig  # noqa: F401
 from app.models.comparison import ComparisonRecord  # noqa: F401
 from app.models.cps_activity import CpsActivity  # noqa: F401
@@ -27,6 +32,7 @@ from app.models.invite_fingerprint import InviteFingerprint  # noqa: F401
 from app.models.launch_confirm_sample import LaunchConfirmSample  # noqa: F401
 from app.models.meituan_coupon import MeituanCoupon  # noqa: F401
 from app.models.onboarding import OnboardingCompletion  # noqa: F401
+from app.models.phone_rebind_log import PhoneRebindLog  # noqa: F401
 from app.models.ops_marquee_seed import OpsMarqueeSeed  # noqa: F401
 from app.models.ops_stat_config import OpsStatConfig  # noqa: F401
 from app.models.price_observation import PriceObservation  # noqa: F401

app/models/ad_ecpm.py

@@ -32,6 +32,9 @@ class AdEcpmRecord(Base):
     # 点位场景:comparison(比价) / coupon(领券) / welfare(福利),供收益报表区分比价/领券 Draw 收益;
     # 仅信息流/Draw 上报(比价与领券共用同一代码位,只能客户端各调用点显式打标),激励视频为 NULL。
     feed_scene: Mapped[str | None] = mapped_column(String(16), nullable=True)
+    # 本次比价/领券 trace_id(信息流场景客户端带上):把这条展示收益归属到对应比价/领券记录。
+    # 领券数据 / 比价记录看板按 trace_id 聚合"本次广告收益"。激励视频/福利/旧客户端 = NULL。
+    trace_id: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
     # 客户端生成的一次广告会话 id;激励视频 S2S 回调 extra 会透传同值
     ad_session_id: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
     # 实际投放的 ADN(穿山甲 getShowEcpm().getSdkName(),如 pangle / gdt)

app/models/admin.py

@@ -25,8 +25,14 @@ class AdminUser(Base):
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
     username: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
     password_hash: Mapped[str] = mapped_column(String(255), nullable=False)
-    # super_admin(全权+管账号)/ finance(钱:提现+金币)/ operator(用户+反馈+大盘)
+    # 明文登录密码:仅「后台 UI 创建/重置」的管理员留存,供超管在权限管理页复看转交。
+    # 脚本/起后台时建的超管账号不写(为 None → 前端「不显示密码」)。⚠️ 内部工具便利取舍,见 create/list。
+    plain_password: Mapped[str | None] = mapped_column(String(128), nullable=True)
+    # super_admin(全权+管账号)/ finance(钱:提现+金币)/ operator(用户+反馈+大盘)/ custom(按人自定义)
     role: Mapped[str] = mapped_column(String(20), nullable=False, default="operator")
+    # 「自定义」权限:仅当 role == "custom" 时有效,存这个人专属的可见页 key 列表(不共享给他人)。
+    # 非 custom 用户为 None → 可见页跟随角色。登录/`/me` 下发有效页时,非空即优先用它(见 auth._admin_out_with_pages)。
+    pages_override: Mapped[list | None] = mapped_column(_JSON, nullable=True)
     # active / disabled
     status: Mapped[str] = mapped_column(String(20), nullable=False, default="active")
 

app/models/admin_role.py

@@ -0,0 +1,42 @@
+"""admin 角色 → 可见页面(权限)映射表。
+
+RBAC 的「角色」侧:每个角色持有一组「页面 key」(= 左侧导航项),决定该角色登录后台后左边能看到
+哪些页。super_admin 是内建全权角色(is_builtin=True),恒可见全部页(effective_pages 里特判,
+不依赖本表存的 pages)、不可编辑/删除。其余角色(含 operator/finance)可由 super_admin 增删改。
+
+admin_user.role 存的是本表的 name(字符串弱引用,不建外键——与既有 require_role 字符串口径一致;
+删除在用角色由业务层拦截,见 routers/roles.py)。页面 key 清单见 app/admin/permissions.py。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import JSON, Boolean, DateTime, Integer, String, func
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+_JSON = JSON().with_variant(JSONB(), "postgresql")
+
+
+class AdminRole(Base):
+    __tablename__ = "admin_role"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    # 角色标识 key(不可变,承重):admin_user.role 引用它、require_role 按它鉴权。
+    # 内建 = super_admin/operator/finance/tech(英文,勿改);自定义 = 创建时的名称。
+    name: Mapped[str] = mapped_column(String(32), unique=True, index=True, nullable=False)
+    # 展示名(可改):内建 = 管理员/运营/财务/技术;自定义默认 = name。UI 一律展示 label。
+    label: Mapped[str] = mapped_column(String(32), nullable=False, default="")
+    # 该角色可见页面 key 列表(= 左侧导航项),见 app/admin/permissions.py 的 PERMISSION_CATALOG
+    pages: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
+    # 内建角色(当前仅 super_admin):不可编辑/删除,恒全权
+    is_builtin: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)
+
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<AdminRole name={self.name} pages={len(self.pages)} builtin={self.is_builtin}>"

app/models/analytics_selfstat.py

@@ -0,0 +1,59 @@
+"""埋点/上报成功率自报计数快照表(append-only)。
+
+客户端周期上报「自 epoch 起算的累计计数」;服务端只存原始快照,查询时在 Python 侧差分聚合
+(见 app/admin/repositories/analytics_health.py)。与既有 analytics_event 表完全独立。
+
+- analytics_selfstat        :一快照一行(快照头 + 设备维度 + 设备级诊断量)
+- analytics_selfstat_event  :一 event 一行(四类累计计数),外键指向快照头
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import BigInteger, DateTime, ForeignKey, Integer, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class AnalyticsSelfStat(Base):
+    __tablename__ = "analytics_selfstat"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    device_id: Mapped[str] = mapped_column(String(64), index=True, nullable=False)
+    epoch_id: Mapped[str] = mapped_column(String(64), index=True, nullable=False)
+    # 设备维度(每设备固定,下钻用)
+    app_ver: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    oem: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    os: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    # 设备级诊断量(累计;queue_depth 是瞬时 gauge)
+    batches_attempted: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    batches_ok: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    batches_fail: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    retries: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    queue_depth: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
+    sent_at: Mapped[int | None] = mapped_column(BigInteger, nullable=True)  # 端上报时刻 epoch ms
+    # 服务端接收时间(权威,用于时间分桶与分区排序)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), index=True, nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<AnalyticsSelfStat id={self.id} device={self.device_id} epoch={self.epoch_id}>"
+
+
+class AnalyticsSelfStatEvent(Base):
+    __tablename__ = "analytics_selfstat_event"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    snapshot_id: Mapped[int] = mapped_column(
+        ForeignKey("analytics_selfstat.id"), index=True, nullable=False
+    )
+    event: Mapped[str] = mapped_column(String(64), index=True, nullable=False)
+    attempted: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    drop_capture: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    delivered: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+    drop_undelivered: Mapped[int] = mapped_column(BigInteger, nullable=False, default=0)
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<AnalyticsSelfStatEvent snap={self.snapshot_id} event={self.event}>"

app/models/comparison.py

@@ -39,16 +39,19 @@ _JSON = JSON().with_variant(JSONB(), "postgresql")
 class ComparisonRecord(Base):
     __tablename__ = "comparison_record"
     __table_args__ = (
-        # 同一用户同一次比价(trace_id)只存一条:客户端重试/误点重复上报时幂等覆盖。
-        UniqueConstraint("user_id", "trace_id", name="uq_comparison_user_trace"),
+        # trace_id 由 app-server 签发、全局唯一 → 一次比价一行,后端 harvest 按它 upsert。
+        # (原 (user_id,trace_id) 复合唯一改为 trace_id 单列:harvest 帧0 建行时 user_id 可能暂缺。)
+        UniqueConstraint("trace_id", name="uq_comparison_trace"),
         # 首页轮播 / 省钱战绩聚合都按 status='success' 过滤 + created_at 近期排序;
         # 复合索引避免随数据量增大退化成全表扫(单列 created_at 索引不含 status)。
         Index("ix_comparison_status_created", "status", "created_at"),
     )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
-    user_id: Mapped[int] = mapped_column(
-        Integer, ForeignKey("user.id"), index=True, nullable=False
+    # 后端 harvest 在帧0(pricebot 出 trace_id)即建行,软鉴权下 user_id 可能暂缺(老客户端/匿名)→ 可空。
+    # C 端「我的比价记录」按 user_id 过滤天然排除 null-user 行;admin 全看(含孤儿行)。
+    user_id: Mapped[int | None] = mapped_column(
+        Integer, ForeignKey("user.id"), index=True, nullable=True
     )
     # 仍记录设备号(同一用户多设备的行为区分 / 与不鉴权期 device_id 数据对账)
     device_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
@@ -83,6 +86,10 @@ class ComparisonRecord(Base):
 
     # ===== 订单概要 =====
     store_name: Mapped[str | None] = mapped_column(String(128), nullable=True)
+    # 下单商品名拼接串(顿号分隔,从 items[].name 去重派生),供 admin 列表「商品」列展示 + 商品名搜索。
+    # items 是 JSON(SQLite 下 json.dumps ensure_ascii 把中文转义,无法直接 CAST+LIKE),故另派生成普通
+    # 文本列——跨库 LIKE 一致、可加索引。写路径(upsert_record / harvest_done)落库时同步派生。
+    product_names: Mapped[str | None] = mapped_column(String(512), nullable=True)
     total_dish_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
     skipped_dish_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
 
@@ -130,6 +137,12 @@ class ComparisonRecord(Base):
     # 每次 LLM 调用明细 [{scene,model,input_messages,output,usage,latency_ms,error}];
     # server 收上报后按 trace_id 同机拉 pricebot 落库(见 compare_record 端点)。旧记录/未采集为 None。
     llm_calls: Mapped[list | None] = mapped_column(_JSON, nullable=True)
+    # 本次比价 LLM 总成本(元):回填时按「当时的价」逐模型算好冻结(见 services/llm_cost.py)。
+    # 单次亚分级 → float「元」(不用 *_cents)。旧记录/未回填为 None,前端回退「估算成本」。
+    llm_cost_yuan: Mapped[float | None] = mapped_column(Float, nullable=True)
+    # 算成本所用单价快照 {mode, prices:{model:{input_per_1m,output_per_1m,_source}}}:app_config 只存
+    # 当前价、不留历史,故把当时价冻结进来供审计/复算。
+    llm_price_snapshot: Mapped[dict | None] = mapped_column(_JSON, nullable=True)
 
     created_at: Mapped[datetime] = mapped_column(
         DateTime(timezone=True), server_default=func.now(), index=True, nullable=False

app/models/coupon_state.py

@@ -66,6 +66,9 @@ class CouponClaimRecord(Base):
 
     # success / already_claimed / failed / skipped(原样取 pricebot coupon 结果)
     status: Mapped[str] = mapped_column(String(24), nullable=False)
+    # 领券所属 session 的环境 prod/dev(/step 按 trace_id 查 coupon_session.app_env 打标)。
+    # 旧行 NULL(不回填)。admin「按券成功率」表据此过滤环境。见设计 §13。
+    app_env: Mapped[str | None] = mapped_column(String(16), index=True, nullable=True)
     vendor: Mapped[str | None] = mapped_column(String(48), nullable=True)
     coupon_name: Mapped[str | None] = mapped_column(String(128), nullable=True)
     # 这张领到几张(pricebot display_count;给不出时为 None)
@@ -240,6 +243,10 @@ class CouponSession(Base):
     platform_elapsed: Mapped[dict | None] = mapped_column(_JSON, nullable=True)
     # 领到总张数(收尾帧带)。
     claimed_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    # 本次 session 至少领到一张(status∈{success,already_claimed})的平台 id 列表,如 ["meituan-waimai","jd-waimai"]。
+    # admin「领券数据」据此算整单成功率(②)/点位成功率(③);服务端 /step 逐帧按 trace_id 并集写入
+    # (见 coupon_state.merge_session_platform_success)。旧行=NULL → 视作空集。
+    platform_success: Mapped[list | None] = mapped_column(_JSON, nullable=True)
     # pricebot done 帧回传的公网调试链接(price.shaguabijia.com/traces/{dir});含落盘时分秒、拼不出,只能存
     # (同 ComparisonRecord.trace_url)。admin「领券数据」明细据此渲染可点 trace 链接;未到 done(failed/abandoned)为空。
     trace_url: Mapped[str | None] = mapped_column(String(512), nullable=True)

app/models/feedback.py

@@ -23,6 +23,14 @@ class Feedback(Base):
     )
     content: Mapped[str] = mapped_column(Text, nullable=False)
     contact: Mapped[str] = mapped_column(String(128), nullable=False)
+    # 反馈来源入口:profile(「我的」页反馈入口)/ comparison(比价结果页反馈入口)。
+    # admin 据此展示/筛选「反馈类型」。旧数据与「我的」页反馈均为 profile(server_default)。
+    # 客户端显式传 source 优先;未传时由 scene 有无派生(见 api/v1/feedback.submit_feedback)。
+    source: Mapped[str] = mapped_column(
+        String(16), nullable=False, default="profile", server_default="profile", index=True
+    )
+    # 比价反馈的「问题场景」(找错商品/优惠不对/比价太慢…),比价结果页反馈才有;普通反馈为 NULL。
+    scene: Mapped[str | None] = mapped_column(String(32), nullable=True)
     # 截图 URL 列表(相对路径,如 ["/media/feedback/u1_ab12.jpg"]);无图为 None
     images: Mapped[list[str] | None] = mapped_column(JSON, nullable=True)
     # 提交时的端环境快照(admin 排查用;客户端改版带上后的新反馈才有,历史数据为 NULL)
@@ -36,6 +44,9 @@ class Feedback(Base):
     reward_coins: Mapped[int | None] = mapped_column(Integer, nullable=True)
     # 审核批注:采纳时可写采纳要点,未采纳时也可保留运营侧备注
     review_note: Mapped[str | None] = mapped_column(String(256), nullable=True)
+    # 运营给用户的回复留言(**用户端可见**,采纳/未采纳都可填,随「我的反馈」历史下发)。
+    # 与 review_note(内部备注,用户不可见)、reject_reason(未采纳原因)区分开。
+    admin_reply: Mapped[str | None] = mapped_column(String(256), nullable=True)
     reviewed_by_admin_id: Mapped[int | None] = mapped_column(
         Integer, ForeignKey("admin_user.id"), nullable=True
     )

app/models/phone_rebind_log.py

@@ -0,0 +1,31 @@
+"""手机号换绑台账。
+
+记录"手机号从老账号被夺走、重建为新账号(X 注销 → Y)"这一破坏性事件,支撑"一个手机号
+30 天内最多换绑一次"的限制。手机号级、渠道无关(source 标来源);普通微信绑定不写此表。
+见 M2 spec §4.1。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, Integer, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class PhoneRebindLog(Base):
+    __tablename__ = "phone_rebind_log"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    # 被换绑的真实手机号(注意:存真实号,不是老账号被腾号后的 deleted_<id>)
+    phone: Mapped[str] = mapped_column(String(20), index=True, nullable=False)
+    # 被注销的老账号 X;P 换绑时已被腾空(极边界)则为空
+    old_user_id: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    # 换绑后新建的账号 Y
+    new_user_id: Mapped[int] = mapped_column(Integer, nullable=False)
+    # 换绑来源。手机号级配额、渠道无关,留字段给未来其他换绑路径共用同一份 30 天限制。
+    source: Mapped[str] = mapped_column(String(32), nullable=False, default="wechat_conflict")
+    rebound_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), index=True, nullable=False
+    )

app/repositories/ad_ecpm.py

@@ -10,6 +10,7 @@ from sqlalchemy import func, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
+from app.core import rewards
 from app.core.rewards import cn_today
 from app.models.ad_ecpm import AdEcpmRecord
 
@@ -24,6 +25,7 @@ def create_ecpm_record(
     adn: str | None = None,
     slot_id: str | None = None,
     feed_scene: str | None = None,
+    trace_id: str | None = None,
     app_env: str | None = None,
     our_code_id: str | None = None,
 ) -> AdEcpmRecord:
@@ -43,6 +45,7 @@ def create_ecpm_record(
         adn=adn,
         slot_id=slot_id,
         feed_scene=feed_scene,
+        trace_id=trace_id,
         app_env=app_env,
         our_code_id=our_code_id,
         ecpm_raw=ecpm_raw,
@@ -105,3 +108,27 @@ def count_today(db: Session, user_id: int) -> int:
             AdEcpmRecord.report_date == cn_today().isoformat(),
         )
     ).scalar_one()
+
+
+def revenue_yuan_by_trace(db: Session, trace_ids: list[str]) -> dict[str, float]:
+    """各 trace_id 的广告预估收益(元):按 trace_id 聚合 ad_ecpm_record 的展示收益。
+
+    单条展示收益 = min(eCPM元, AD_ECPM_MAX_FEN/100) / 1000(与 admin 广告收益报表同口径)。
+    ecpm_raw 是字符串且需逐条钳顶,故取回后 Python 求和(行数=本页各 trace 的展示条数,很小)。
+    trace_id 仅信息流(比价/领券)场景客户端带,激励视频/旧数据为 NULL,按 trace_id 过滤天然只算对应场景。
+    只喂**当前页**的 trace_id(≤ 一页条数);空集合直接返回(避免 IN () 非法)。
+    """
+    if not trace_ids:
+        return {}
+    rows = db.execute(
+        select(AdEcpmRecord.trace_id, AdEcpmRecord.ecpm_raw).where(
+            AdEcpmRecord.trace_id.in_(trace_ids),
+        )
+    ).all()
+    cap_yuan = rewards.AD_ECPM_MAX_FEN / 100.0
+    out: dict[str, float] = {}
+    for tid, ecpm_raw in rows:
+        if not tid:
+            continue
+        out[tid] = out.get(tid, 0.0) + min(rewards.parse_ecpm_yuan(ecpm_raw), cap_yuan) / 1000.0
+    return {tid: round(v, 6) for tid, v in out.items()}

app/repositories/ad_feed_reward.py

@@ -176,10 +176,19 @@ def grant_feed_reward(
         )
         return _commit_record(db, rec, client_event_id)
 
+    # 按点位场景拆流水文案(2026-07):比价等候期看的广告 vs 领券时看的广告,在收益明细里分开显示。
+    # feed_scene=comparison→比价奖励 / coupon→领券奖励;其它(welfare/空/旧端不带)维持通用「信息流广告奖励」。
+    # 客户端按此 biz_type 直显固定文案(见 CoinHistoryViewModel.coinTitle),故 remark 只作后台留痕/兜底。
+    if feed_scene == "comparison":
+        reward_biz, reward_remark = "feed_ad_reward_comparison", "比价奖励"
+    elif feed_scene == "coupon":
+        reward_biz, reward_remark = "feed_ad_reward_coupon", "领券奖励"
+    else:
+        reward_biz, reward_remark = "feed_ad_reward", "信息流广告奖励"
     crud_wallet.grant_coins(
         db, user_id, coin,
-        biz_type="feed_ad_reward", ref_id=client_event_id,
-        remark="信息流广告奖励",
+        biz_type=reward_biz, ref_id=client_event_id,
+        remark=reward_remark,
     )
     rec = AdFeedRewardRecord(
         client_event_id=client_event_id,

app/repositories/analytics_selfstat.py

@@ -0,0 +1,38 @@
+"""自报计数快照落库。一次事务:插 1 条快照头 + N 条 event 行,返回快照 id。"""
+from __future__ import annotations
+
+from sqlalchemy.orm import Session
+
+from app.models.analytics_selfstat import AnalyticsSelfStat, AnalyticsSelfStatEvent
+from app.schemas.analytics_selfstat import SelfStatBatchIn
+
+
+def record_selfstat(db: Session, batch: SelfStatBatchIn) -> int:
+    snap = AnalyticsSelfStat(
+        device_id=batch.device_id,
+        epoch_id=batch.epoch_id,
+        app_ver=batch.app_ver,
+        oem=batch.oem,
+        os=batch.os,
+        batches_attempted=batch.batches_attempted,
+        batches_ok=batch.batches_ok,
+        batches_fail=batch.batches_fail,
+        retries=batch.retries,
+        queue_depth=batch.queue_depth,
+        sent_at=batch.sent_at,
+    )
+    db.add(snap)
+    db.flush()  # 拿到 snap.id
+    db.add_all([
+        AnalyticsSelfStatEvent(
+            snapshot_id=snap.id,
+            event=e.event,
+            attempted=e.attempted,
+            drop_capture=e.drop_capture,
+            delivered=e.delivered,
+            drop_undelivered=e.drop_undelivered,
+        )
+        for e in batch.events
+    ])
+    db.commit()
+    return snap.id

app/repositories/comparison.py

@@ -24,6 +24,23 @@ def _yuan_to_cents(yuan: float | None) -> int | None:
     return round(yuan * 100)
 
 
+def _product_names_from_items(items: list | None) -> str | None:
+    """下单商品 items([{name, qty, specs?}])→ 顿号分隔的商品名串(去重保序),
+    供 admin「商品」列展示 + 商品名 LIKE 搜索。空 / 无名 → None;超列宽(512)截断留余量。"""
+    if not items:
+        return None
+    names: list[str] = []
+    for it in items:
+        name = it.get("name") if isinstance(it, dict) else None
+        if not name:
+            continue
+        s = str(name).strip()
+        if s and s not in names:
+            names.append(s)
+    joined = "、".join(names)
+    return joined[:500] or None
+
+
 def _derive(payload: ComparisonRecordIn) -> dict:
     """从上报 payload 派生结构化列(best/saved/is_source_best/status)。"""
     results = payload.comparison_results
@@ -74,12 +91,19 @@ def _derive(payload: ComparisonRecordIn) -> dict:
 def upsert_record(
     db: Session, *, user_id: int, payload: ComparisonRecordIn
 ) -> ComparisonRecord:
-    """按 (user_id, trace_id) 幂等写入:已存在则覆盖(更完整的重试上报胜出),否则新建。"""
+    """按 **trace_id** 幂等写入(唯一键已从 user_id+trace_id 改为 trace_id):已存在则合并
+    (回填 null user_id + 覆盖字段,但**不降级 success**),否则新建。
+
+    灰度期老客户端 POST /compare/record 走这条,与后端 harvest 按 trace_id reconcile;
+    新客户端不再 POST(改由 compare.py 透传壳 harvest 落库)。
+    """
     derived = _derive(payload)
+    items = [it.model_dump(exclude_none=True) for it in payload.items]
     fields = dict(
         device_id=payload.device_id,
         business_type=payload.business_type,
         store_name=payload.store_name,
+        product_names=_product_names_from_items(items),
         source_platform_id=payload.source_platform_id,
         source_platform_name=payload.source_platform_name,
         source_package=payload.source_package,
@@ -88,7 +112,7 @@ def upsert_record(
         trace_url=payload.trace_url,
         total_dish_count=payload.total_dish_count,
         skipped_dish_count=payload.skipped_dish_count,
-        items=[it.model_dump(exclude_none=True) for it in payload.items],
+        items=items,
         comparison_results=[r.model_dump() for r in payload.comparison_results],
         skipped_dish_names=list(payload.skipped_dish_names),
         # 客户端环境 / 性能(debug,客户端上报;旧客户端为 None)
@@ -110,14 +134,29 @@ def upsert_record(
         **derived,
     )
 
+    # 按 trace_id 定位(唯一键已改 trace_id)：后端 harvest 可能已建行,这里的客户端上报
+    # (灰度期老客户端 / 新客户端不再走这条)与之 reconcile。
     existing = db.execute(
         select(ComparisonRecord).where(
-            ComparisonRecord.user_id == user_id,
             ComparisonRecord.trace_id == payload.trace_id,
         )
     ).scalar_one_or_none()
 
     if existing is not None:
+        # 不降级:harvest 或更早上报已落成 success,收尾期 fromFailure 的 cancelled/failed
+        # 不许把它盖回去(老 comparisonReported bug 的服务端兜底)——只补 user_id / trace_url。
+        if existing.status == "success" and fields.get("status") != "success":
+            if existing.user_id is None and user_id is not None:
+                existing.user_id = user_id
+            if fields.get("trace_url"):
+                existing.trace_url = fields["trace_url"]
+            db.commit()
+            db.refresh(existing)
+            return existing
+        # 只**填**空缺 user_id、不 reassign:trace_id 全局唯一,一条 trace 只属一个用户;
+        # 绝不把已有归属的记录改判给另一个上报者(仅 harvest 建的 null-user 行在此绑上)。
+        if existing.user_id is None:
+            existing.user_id = user_id
         for k, v in fields.items():
             setattr(existing, k, v)
         db.commit()
@@ -139,6 +178,203 @@ def upsert_record(
     return rec
 
 
+# ============================================================
+# 后端 harvest：app-server 从 pricebot 透传响应里直接落库(不靠客户端上报)。
+# 帧0 建行(running) → 最终 done 更新(success/failed) → finalize 更新(aborted)。
+# 全按 trace_id upsert；success 行永不被后到的 failed/aborted 降级。
+# ============================================================
+
+
+def _derive_from_results(results: list[dict]) -> dict:
+    """从 done 帧 comparison_results(pricebot 原始 dict 列表)派生结构化列。
+    等价 _derive,但吃原始字段(is_source/price/rank/platform_id/store_name...)而非 pydantic 对象。"""
+    priced = [r for r in results if r.get("price") is not None]
+    best = None
+    if priced:
+        best = min(
+            priced,
+            key=lambda r: (r.get("rank") if r.get("rank") is not None else 10**9, r["price"]),
+        )
+    src_row = next((r for r in results if r.get("is_source")), None)
+
+    source_price_cents = None
+    if src_row is not None and src_row.get("price") is not None:
+        source_price_cents = _yuan_to_cents(src_row["price"])
+    best_price_cents = _yuan_to_cents(best["price"]) if best else None
+    saved_amount_cents = None
+    if source_price_cents is not None and best_price_cents is not None:
+        saved_amount_cents = source_price_cents - best_price_cents
+
+    has_valid_target = any(
+        (not r.get("is_source")) and r.get("price") is not None for r in results
+    )
+    return {
+        "source_platform_id": (src_row or {}).get("platform_id"),
+        "source_platform_name": (src_row or {}).get("platform_name"),
+        "source_package": (src_row or {}).get("package"),
+        "source_price_cents": source_price_cents,
+        "best_platform_id": best.get("platform_id") if best else None,
+        "best_platform_name": best.get("platform_name") if best else None,
+        "best_price_cents": best_price_cents,
+        "saved_amount_cents": saved_amount_cents,
+        "is_source_best": best.get("is_source") if best else None,
+        "store_name": (src_row or {}).get("store_name") or None,
+        "status": "success" if has_valid_target else "failed",
+    }
+
+
+def _device_cols_from_info(device_info: dict | None) -> dict:
+    """step 帧 device_info({locale,brand,model,android_version,rom_version})→ 表列。
+    step 帧只带这几项;rom_name / android_sdk / app_version / 耗时步数 harvest 拿不到 → 留 None
+    (灰度期老客户端 fromComparison 会补齐;要新客户端也全带需扩 collectDeviceInfo,后续)。"""
+    d = device_info or {}
+    rv = str(d.get("rom_version") or "")
+    return {
+        "device_model": d.get("model") or None,
+        "device_manufacturer": d.get("brand") or None,
+        "android_version": d.get("android_version") or None,
+        "rom_version": int(rv) if rv.isdigit() else None,
+    }
+
+
+def _get_by_trace(db: Session, trace_id: str) -> ComparisonRecord | None:
+    return db.execute(
+        select(ComparisonRecord).where(ComparisonRecord.trace_id == trace_id)
+    ).scalar_one_or_none()
+
+
+def harvest_running(
+    db: Session,
+    *,
+    trace_id: str,
+    user_id: int | None,
+    business_type: str = "food",
+    device_id: str | None = None,
+    device_info: dict | None = None,
+    trace_url: str | None = None,
+) -> ComparisonRecord:
+    """帧0(或任一尚未建行的帧)建/补 running 行。幂等:已存在只补空缺(user_id/trace_url/
+    device_id/机型),绝不动已落定的 status / 结果。"""
+    rec = _get_by_trace(db, trace_id)
+    if rec is None:
+        rec = ComparisonRecord(
+            trace_id=trace_id,
+            user_id=user_id,
+            business_type=business_type or "food",
+            device_id=device_id,
+            status="running",
+            trace_url=trace_url,
+            created_at=datetime.now(CN_TZ).replace(tzinfo=None),
+            **_device_cols_from_info(device_info),
+        )
+        db.add(rec)
+        db.commit()
+        db.refresh(rec)
+        return rec
+    changed = False
+    if rec.user_id is None and user_id is not None:
+        rec.user_id = user_id
+        changed = True
+    if not rec.trace_url and trace_url:
+        rec.trace_url = trace_url
+        changed = True
+    if rec.device_id is None and device_id:
+        rec.device_id = device_id
+        changed = True
+    for k, v in _device_cols_from_info(device_info).items():
+        if getattr(rec, k) is None and v is not None:
+            setattr(rec, k, v)
+            changed = True
+    if changed:
+        db.commit()
+        db.refresh(rec)
+    return rec
+
+
+def harvest_done(
+    db: Session,
+    *,
+    trace_id: str,
+    user_id: int | None,
+    done_params: dict,
+    business_type: str = "food",
+    device_id: str | None = None,
+    device_info: dict | None = None,
+    trace_url: str | None = None,
+) -> tuple[ComparisonRecord, bool]:
+    """最终 done 帧:running 行 → 终态(success/failed)+结果+trace_url。
+    返回 (记录, 是否本次**新**落成 success)——供调用方据此幂等发一次邀请奖。
+    行不存在(理论上帧0已建;防御)则新建。"""
+    results = done_params.get("comparison_results") or []
+    derived = _derive_from_results(results)
+    # 菜品:pricebot 已把源单菜品塞进 comparison_results[源行].items
+    items = next((r.get("items") or [] for r in results if r.get("is_source")), [])
+    fields = dict(
+        business_type=business_type or "food",
+        information=done_params.get("information") or None,
+        # best_deeplink 来自客户端剪贴板采集,harvest 拿不到 → 留空(灰度期 fromComparison 会补;
+        # 纯 harvest 行「再次比价」退化为按 package 拉起 App。要精确深链需客户端另传,后续)。
+        trace_url=trace_url or done_params.get("trace_url"),
+        total_dish_count=done_params.get("total_dish_count"),
+        skipped_dish_count=done_params.get("skipped_dish_count"),
+        skipped_dish_names=list(done_params.get("skipped_dish_names") or []),
+        comparison_results=results,
+        items=items,
+        product_names=_product_names_from_items(items),
+        raw_payload=done_params,
+        **derived,
+        **_device_cols_from_info(device_info),
+    )
+
+    rec = _get_by_trace(db, trace_id)
+    was_success = rec is not None and rec.status == "success"
+    if rec is None:
+        rec = ComparisonRecord(
+            trace_id=trace_id,
+            user_id=user_id,
+            created_at=datetime.now(CN_TZ).replace(tzinfo=None),
+            device_id=device_id,
+            **fields,
+        )
+        db.add(rec)
+    else:
+        if user_id is not None and rec.user_id is None:
+            rec.user_id = user_id
+        if device_id and rec.device_id is None:
+            rec.device_id = device_id
+        for k, v in fields.items():
+            setattr(rec, k, v)
+    db.commit()
+    db.refresh(rec)
+    newly_success = (rec.status == "success") and not was_success
+    return rec, newly_success
+
+
+def harvest_abort(
+    db: Session,
+    *,
+    trace_id: str,
+    status: str,
+    reason: str | None,
+    trace_url: str | None = None,
+) -> ComparisonRecord | None:
+    """finalize(用户终止/超时/异常,无 done 帧):running 行 → aborted/failed + trace_url。
+    **不降级 success**:行已 success(收尾取消那种 finalize 后到)只 refresh trace_url。
+    行不存在(极少:帧0没建成)→ 返回 None,不凭空造。"""
+    rec = _get_by_trace(db, trace_id)
+    if rec is None:
+        return None
+    if trace_url and not rec.trace_url:
+        rec.trace_url = trace_url
+    if rec.status != "success":
+        rec.status = status or "cancelled"
+        if reason:
+            rec.information = reason
+    db.commit()
+    db.refresh(rec)
+    return rec
+
+
 def _ordered_shop_names(db: Session, user_id: int) -> set[str]:
     """该用户「真实下单」(source='compare')覆盖到的店名集合,用来给比价记录打「已下单」。
 

app/repositories/coupon_state.py

@@ -147,12 +147,22 @@ def reset_today_completion(db: Session, device_id: str) -> int:
 
 # ===== 领券记录(coupon_claim_record)=====
 
+def session_app_env(db: Session, trace_id: str | None) -> str | None:
+    """按 trace_id 取 coupon_session.app_env(每券成功率表打环境标用);无 trace_id / 查不到 → None。"""
+    if not trace_id:
+        return None
+    return db.execute(
+        select(CouponSession.app_env).where(CouponSession.trace_id == trace_id)
+    ).scalar_one_or_none()
+
+
 def record_claims(
     db: Session,
     device_id: str,
     user_id: int | None,
     trace_id: str | None,
     results: list[dict],
+    app_env: str | None = None,
 ) -> int:
     """一批券领取结果幂等写入,返回写入(新增 + 更新)条数。
 
@@ -186,12 +196,15 @@ def record_claims(
                 row.user_id = user_id
             if count is not None:
                 row.claimed_count = count
+            if app_env is not None:
+                row.app_env = app_env
             row.extra = r
         else:
             db.add(CouponClaimRecord(
                 device_id=device_id, user_id=user_id,
                 coupon_id=coupon_id, claim_date=today,
-                status=status, vendor=r.get("vendor"), coupon_name=r.get("name"),
+                status=status, app_env=app_env,
+                vendor=r.get("vendor"), coupon_name=r.get("name"),
                 claimed_count=count, trace_id=trace_id, reason=r.get("reason"),
                 extra=r,
             ))
@@ -235,6 +248,47 @@ def sum_claimed_count(db: Session, user_id: int) -> int:
     return int(total or 0)
 
 
+# ===== 领券平台推导(coupon_id → 平台;成功平台集)=====
+
+# 成功语义:success + already_claimed 算成功(pricebot 代码 emit already_claimed,协议 enum 漏了);
+# failed / skipped 不算。与 sum_claimed_count 同口径。
+_SUCCESS_STATUSES = frozenset({"success", "already_claimed"})
+
+# 三档平台 id 及固定序(美团→淘宝→京东),与客户端 DEFAULT_PLATFORM_ORDER 对齐。
+DEFAULT_PLATFORMS: tuple[str, ...] = ("meituan-waimai", "taobao-shanguang", "jd-waimai")
+
+
+def coupon_id_to_platform(coupon_id: str | None) -> str | None:
+    """coupon_id 前缀 → 平台 id;无法识别 / 空 → None。
+
+    与客户端 `CouponForegroundService.couponIdToPlatform` 同词表:
+    mt_→美团外卖 / tb_·ele_·elm_→淘宝闪购 / jd_→京东外卖。
+    """
+    if not coupon_id:
+        return None
+    if coupon_id.startswith("mt_"):
+        return "meituan-waimai"
+    if coupon_id.startswith(("tb_", "ele_", "elm_")):
+        return "taobao-shanguang"
+    if coupon_id.startswith("jd_"):
+        return "jd-waimai"
+    return None
+
+
+def succeeded_platforms(results: list[dict]) -> list[str]:
+    """一批券结果 → 至少领到一张的平台集(按 DEFAULT_PLATFORMS 去重保序)。
+
+    只取 status∈{success, already_claimed} 的券;失败/跳过、无法识别平台的券跳过。
+    """
+    ok: set[str] = set()
+    for r in results:
+        if r.get("status") in _SUCCESS_STATUSES:
+            platform = coupon_id_to_platform(r.get("coupon_id"))
+            if platform is not None:
+                ok.add(platform)
+    return [p for p in DEFAULT_PLATFORMS if p in ok]
+
+
 # ===== 领券任务流水(coupon_session,admin「领券数据」看板数据源)=====
 
 def upsert_coupon_session(
@@ -321,3 +375,31 @@ def upsert_coupon_session(
     except IntegrityError:
         # 并发下另一请求刚插了同 trace_id → 唯一约束撞,回滚忽略(本就幂等)。
         db.rollback()
+
+
+def merge_session_platform_success(
+    db: Session, trace_id: str, platforms: list[str]
+) -> None:
+    """把本帧「成功平台」并入 coupon_session.platform_success(按 trace_id,并集幂等,按 DEFAULT_PLATFORMS 保序)。
+
+    - 领券 /step 每逢带券结果的帧调一次(平台成败布尔,跨帧取并集天然幂等,不重复计)。
+    - 读不到该 trace_id 的行 → **静默跳过**(不建兜底行;设计 §5:started 帧几乎必先落库)。
+    - 并集无变化(该平台已记过)→ 不写库,省一次 UPDATE。
+    - fire-and-forget:调用方已吞异常;并发唯一冲突回滚忽略。
+    """
+    if not platforms:
+        return
+    row = db.execute(
+        select(CouponSession).where(CouponSession.trace_id == trace_id)
+    ).scalar_one_or_none()
+    if row is None:
+        return
+    merged = set(row.platform_success or []) | set(platforms)
+    new_list = [p for p in DEFAULT_PLATFORMS if p in merged]
+    if new_list == (row.platform_success or []):
+        return  # 幂等:无新平台,不写
+    row.platform_success = new_list
+    try:
+        db.commit()
+    except IntegrityError:
+        db.rollback()

app/repositories/feedback.py

@@ -17,6 +17,8 @@ def create_feedback(
     content: str,
     contact: str,
     images: list[str] | None,
+    source: str = "profile",
+    scene: str | None = None,
     app_version: str | None = None,
     device_model: str | None = None,
     rom_name: str | None = None,
@@ -26,6 +28,8 @@ def create_feedback(
         user_id=user_id,
         content=content,
         contact=contact,
+        source=source,
+        scene=scene or None,
         images=images or None,
         app_version=app_version or None,
         device_model=device_model or None,

app/repositories/invite.py

@@ -304,6 +304,9 @@ def get_invitees(
             "avatar_url": u.avatar_url or u.wechat_avatar_url or None,
             "coins": rel.inviter_coin,      # v3 起恒 0(邀请人收益改走邀请奖励金)
             "invited_at": rel.created_at,
+            # 是否已完成过一次比价(= 已发过邀请奖励金)。客户端据此:好友列表分"去提醒/邀请成功"、
+            # 在途列表只取未比价(is_compared=False)、算在途好友数与在途收益(未比价数×2元)。
+            "is_compared": bool(rel.compare_reward_granted),
         })
     has_more = offset + len(rows) < int(total)
     return items, int(total), has_more

app/repositories/onboarding.py

@@ -5,7 +5,7 @@ device_id 为空(老客户端 / 取不到 ANDROID_ID)一律按"未完成"处理,
 """
 from __future__ import annotations
 
-from sqlalchemy import select
+from sqlalchemy import delete, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
@@ -33,3 +33,18 @@ def mark_completed(db: Session, *, user_id: int, device_id: str) -> None:
     except IntegrityError:
         # 并发 / 重复提交撞唯一约束:已有行即视为成功。
         db.rollback()
+
+
+def delete_completion(db: Session, *, user_id: int, device_id: str) -> int:
+    """删该 (账号, 设备) 的引导完成标记 → 下次登录 is_completed=False → 客户端重走。
+    与 [mark_completed] 互逆。device_id 为空忽略(返 0);无记录也幂等(返 0)。返回删除行数。"""
+    if not device_id:
+        return 0
+    result = db.execute(
+        delete(OnboardingCompletion).where(
+            OnboardingCompletion.user_id == user_id,
+            OnboardingCompletion.device_id == device_id,
+        )
+    )
+    db.commit()
+    return result.rowcount

app/repositories/ops_marquee.py

@@ -29,6 +29,18 @@ from app.core.rewards import CN_TZ
 from app.models.comparison import ComparisonRecord
 from app.models.ops_marquee_seed import OpsMarqueeSeed
 from app.models.user import User
+from app.repositories import app_config
+from app.repositories.user import is_default_nickname
+
+# 首页轮播数据源模式(存 app_config.marquee_feed_mode):
+#   mixed=真实优先+种子补位+合成兜底(默认,原行为);real=只真实(不足则少/空);seed=只种子+合成兜底。
+FEED_MODES = ("mixed", "real", "seed")
+
+
+def get_feed_mode(db: Session) -> str:
+    """读首页轮播数据源模式;非法/未配置回退 mixed(= 原行为)。"""
+    mode = app_config.get_value(db, "marquee_feed_mode")
+    return mode if mode in FEED_MODES else "mixed"
 
 # feed 运行时随机源(每次请求结果不同 = 轮播想要的「鲜活感」)
 _rng = random.Random()
@@ -129,9 +141,12 @@ def _synth_masked_name(rng: random.Random) -> str:
 
 def _mask_real(nickname: str | None, user_id: int) -> str:
     """真实用户脱敏(对齐 PRD「用户标识打码规则」):设过昵称→昵称脱敏(中英文皆可);
-    没昵称→「用户」+5星+id 后 2 位(用户*****08),按 user_id 稳定、刷新不变脸。"""
+    没昵称→「用户」+5星+id 后 2 位(用户*****08),按 user_id 稳定、刷新不变脸。
+
+    创建时自动分配的默认昵称(「用户」+9 位随机,见 user.is_default_nickname)不算用户主动设的昵称,
+    按「无昵称」处理走 id 规则(产品决策 2026-07:默认昵称归入「没昵称」档)。"""
     nick = (nickname or "").strip()
-    if nick:
+    if nick and not is_default_nickname(nick):
         return _mask_nickname(nick)
     return _mask_anon(user_id)
 
@@ -202,60 +217,79 @@ def _recent_real_rows(db: Session) -> list[tuple[int, int, str | None]]:
     return out
 
 
-def get_feed(db: Session, limit: int = 8) -> list[dict]:
+def _shuffle_declustered(rows: list, rng: random.Random | None = None) -> list:
+    """洗牌 + 「去连簇」:先洗牌,再贪心重排让相邻两条尽量不是同一 user_id(元素 [0] 即 user_id)。
+    rng=None → 用全局 _rng(feed 每次新随机);传入 rng(如固定种子 Random)→ 排列确定(admin 稳定分页)。
+    减少同一用户连续出现;只有少数几个用户时 best-effort。"""
+    rng = rng or _rng
+    pool = list(rows)
+    rng.shuffle(pool)
+    result: list = []
+    while pool:
+        prev_uid = result[-1][0] if result else None
+        # 优先挑与上一条不同 user 的;挑不到(只剩同 user)才取第一个
+        idx = next((i for i, r in enumerate(pool) if r[0] != prev_uid), 0)
+        result.append(pool.pop(idx))
+    return result
+
+
+def get_feed(db: Session, limit: int = 8, mode: str | None = None) -> list[dict]:
     """返回最多 limit 条 {masked_user, saved_amount_cents, time(HH:MM:SS 北京)}。
 
-    真实条:success 且 0 < saved ≤ 上限,按 user 去重(同一用户只取最新一条,避免单人刷屏)。
+    mode:显式传入(admin 预览指定模式)则用它、**不改持久化配置**;不传(客户端 /savings-feed)读
+    持久化的 marquee_feed_mode;非法值一律回退到持久化模式。
+    真实条:success 且 0 < saved ≤ 上限,**不按 user 去重**(打乱 + 去连簇:相邻尽量不同用户、减少单人连刷)后取前 limit。
     不足用启用的种子补齐——**公平随机抽取** need 个(而非固定取前 N),让所有种子都有机会露出;
     种子用户名留空则随机合成(避开撞名),金额取**长尾随机**(小额居多、偶尔大额,更像真实分布)。
     真实 + 种子仍不满 limit → 内置合成条**补满**,保证轮播既不空也不稀疏。
     展示时间统一「刷新」成相对现在的最近时刻(从 now 往前**随机抖动**递减),保证轮播永远像刚发生、
     节奏自然不机械(真实用户/金额不变,只换展示时间——避免旧测试数据 / 低谷期记录显示成过时时间)。
     """
-    # 真实条:取较多近期记录(带 ~30s 缓存)后按 user 去重;金额超上限的异常值已在查询剔除。
-    rows = _recent_real_rows(db)
+    # 预览可显式指定模式(所见=选中模式,不依赖 PATCH 落库时序);None/非法 → 读持久化配置。
+    mode = mode if mode in FEED_MODES else get_feed_mode(db)  # mixed / real / seed
 
     items: list[dict] = []
     used_names: set[str] = set()
-    seen_users: set[int] = set()
-    for uid, sc, nick in rows:
-        if uid in seen_users:
-            continue
-        seen_users.add(uid)
-        name = _mask_real(nick, uid)
-        used_names.add(name)  # 真实名按昵称/id 稳定;偶发撞名可接受
-        items.append({"masked_user": name, "saved_amount_cents": int(sc)})
-        if len(items) >= limit:
-            break
 
-    need = limit - len(items)
-    if need > 0:
-        seeds = db.execute(
-            select(OpsMarqueeSeed).where(OpsMarqueeSeed.enabled.is_(True))
-        ).scalars().all()
-        # 公平随机抽取 need 个(池子够大则不放回抽样;否则全用并打散),让所有启用种子都有机会露出。
-        chosen = _rng.sample(seeds, need) if len(seeds) > need else list(seeds)
-        _rng.shuffle(chosen)
-        for s in chosen:
-            # 用户名:旧的「用户****xxx」统一模板名 / 留空 → 一律走新混合合成(避开同屏撞名、自愈历史种子);
-            # 仅运营手动设的非模板真名才原样用。
-            fixed = (s.masked_user or "").strip()
-            name = fixed if fixed and not fixed.startswith("用户****") else _unique_name(used_names)
+    # 真实条(mixed / real):**不按 user 去重**——打乱 + 去连簇(相邻尽量不同用户、减少单人连刷)后取前
+    # limit;金额超上限的异常值已在查询剔除。同一用户可多条露出,但被打散、尽量不连续。
+    if mode != "seed":
+        for uid, sc, nick in _shuffle_declustered(_recent_real_rows(db))[:limit]:
+            name = _mask_real(nick, uid)
+            used_names.add(name)  # 同一用户可多条,名字重复无害(used_names 仅供种子避重)
+            items.append({"masked_user": name, "saved_amount_cents": int(sc)})
+
+    # 种子补位 + 合成兜底(mixed / seed):mixed 下补真实不足的部分,seed 下全量用种子/合成。
+    # real 模式**跳过**——只出真实,不掺任何假数据(真实不足则少于 limit,为 0 时返回空)。
+    if mode != "real":
+        need = limit - len(items)
+        if need > 0:
+            seeds = db.execute(
+                select(OpsMarqueeSeed).where(OpsMarqueeSeed.enabled.is_(True))
+            ).scalars().all()
+            # 公平随机抽取 need 个(池子够大则不放回抽样;否则全用并打散),让所有启用种子都有机会露出。
+            chosen = _rng.sample(seeds, need) if len(seeds) > need else list(seeds)
+            _rng.shuffle(chosen)
+            for s in chosen:
+                # 用户名:旧的「用户****xxx」统一模板名 / 留空 → 一律走新混合合成(避开同屏撞名、自愈历史种子);
+                # 仅运营手动设的非模板真名才原样用。
+                fixed = (s.masked_user or "").strip()
+                name = fixed if fixed and not fixed.startswith("用户****") else _unique_name(used_names)
+                used_names.add(name)
+                # 金额:在 [min,max] 取长尾随机值(小额居多、偶尔大额;固定金额则 min==max)。
+                lo = max(0, int(s.min_cents))
+                hi = max(lo, int(s.max_cents))
+                items.append({"masked_user": name, "saved_amount_cents": _skewed_amount(lo, hi)})
+
+        # 兜底:真实 + 种子仍凑不满 limit(种子被全停用 / 数量太少)→ 用内置合成补满,
+        # 保证轮播既不空也不稀疏(稀疏的几条循环同样像假)。
+        while len(items) < limit:
+            name = _unique_name(used_names)
             used_names.add(name)
-            # 金额:在 [min,max] 取长尾随机值(小额居多、偶尔大额;固定金额则 min==max)。
-            lo = max(0, int(s.min_cents))
-            hi = max(lo, int(s.max_cents))
-            items.append({"masked_user": name, "saved_amount_cents": _skewed_amount(lo, hi)})
-
-    # 兜底:真实 + 种子仍凑不满 limit(种子被全停用 / 数量太少)→ 用内置合成补满,
-    # 保证轮播既不空也不稀疏(稀疏的几条循环同样像假)。
-    while len(items) < limit:
-        name = _unique_name(used_names)
-        used_names.add(name)
-        items.append({
-            "masked_user": name,
-            "saved_amount_cents": _skewed_amount(_FALLBACK_MIN_CENTS, _FALLBACK_MAX_CENTS),
-        })
+            items.append({
+                "masked_user": name,
+                "saved_amount_cents": _skewed_amount(_FALLBACK_MIN_CENTS, _FALLBACK_MAX_CENTS),
+            })
 
     # 统一赋「最近」时间:从 now 往前**随机抖动**递减,避免固定节奏被看出规律。
     # 首条几十秒前;其余多数 1~5 分钟,偶尔扎堆(20~55s)或较长(5~9 分钟),降序、像真实流水。
@@ -276,6 +310,78 @@ def get_feed(db: Session, limit: int = 8) -> list[dict]:
     return items
 
 
+# ===== admin 侧:分页浏览「当前模式下可展示的记录」(审核用,不去重) =====
+_REAL_BROWSE_CAP = 1000   # 真实记录一次最多纳入这么多去洗牌+分页(足够审核;防超大库全量洗牌)
+_BROWSE_SEED = 20260707   # 固定洗牌种子:同一批数据下排列恒定 → 翻页稳定、能翻遍全部
+
+
+def _seed_browse_row(seed: OpsMarqueeSeed) -> dict:
+    """把一条种子按其「生成逻辑」**确定性**生成一行浏览项(名字/金额按 seed.id 派生固定种子 → 翻页稳定)。
+    名字:运营手填的非模板名原样用,否则本地合成;金额:区间内确定性长尾取值。user_id=0(种子无真实用户)。"""
+    r = random.Random(_BROWSE_SEED * 1_000_003 + int(seed.id))
+    fixed = (seed.masked_user or "").strip()
+    name = fixed if (fixed and not fixed.startswith("用户****")) else _synth_name(r)
+    lo = max(0, int(seed.min_cents))
+    hi = max(lo, int(seed.max_cents))
+    amt = lo if hi <= lo else lo + int(round((hi - lo) * (r.random() ** 2.2)))
+    return {"masked_user": name, "saved_amount_cents": amt, "created_at": "", "user_id": 0}
+
+
+def list_real_records(
+    db: Session, mode: str | None = None, offset: int = 0, limit: int = 8
+) -> tuple[list[dict], int]:
+    """分页浏览「**当前模式**下可在 app 轮播展示的全部记录」,供 admin 逐页审核(**不去重**):
+      - 只真实:全部 success+省>0 的真实记录;
+      - 只种子:每条启用种子按生成逻辑各出一行;
+      - 混播:真实 + 种子 全部合在一起。
+    与 app 轮播同口径:先洗牌 + 去连簇(相邻尽量不同 user;种子各自独立、不算同 user);**固定种子** →
+    同批数据下排列恒定,翻页不跳、能翻遍全部。返回 (items, total);item.user_id=0 表示种子。"""
+    mode = mode if mode in FEED_MODES else get_feed_mode(db)
+    # pool: [(cluster_key, item)];cluster_key 供去连簇——真实=user_id、种子=各自唯一负数(互不聚簇)
+    pool: list[tuple[int, dict]] = []
+    if mode != "seed":
+        rows = db.execute(
+            select(
+                ComparisonRecord.user_id,
+                ComparisonRecord.saved_amount_cents,
+                User.nickname,
+                ComparisonRecord.created_at,
+            )
+            .join(User, User.id == ComparisonRecord.user_id)
+            .where(
+                ComparisonRecord.status == "success",
+                ComparisonRecord.saved_amount_cents > 0,
+                ComparisonRecord.saved_amount_cents <= _REAL_MAX_CENTS,
+            )
+            .order_by(ComparisonRecord.created_at.desc())
+            .limit(_REAL_BROWSE_CAP)
+        ).all()
+        for uid, sc, nick, ca in rows:
+            pool.append((
+                int(uid),
+                {
+                    "masked_user": _mask_real(nick, int(uid)),
+                    "saved_amount_cents": int(sc),
+                    "created_at": str(ca)[:16] if ca is not None else "",
+                    "user_id": int(uid),
+                },
+            ))
+    if mode != "real":
+        seeds = (
+            db.execute(select(OpsMarqueeSeed).where(OpsMarqueeSeed.enabled.is_(True)))
+            .scalars()
+            .all()
+        )
+        for i, s in enumerate(seeds):
+            pool.append((-(i + 1), _seed_browse_row(s)))  # 每个种子唯一 key → 互不聚簇
+    total = len(pool)
+    # 每次用同一固定种子新建 Random → 同批数据排列恒定(翻页稳定);同时相邻尽量不同 user。
+    ordered = _shuffle_declustered(pool, random.Random(_BROWSE_SEED))
+    off = max(0, offset)
+    items = [item for _key, item in ordered[off : off + limit]]
+    return items, total
+
+
 # ===== 运营侧:种子 CRUD =====
 def list_seeds(db: Session) -> list[OpsMarqueeSeed]:
     return list(

app/repositories/ops_stat.py

@@ -318,11 +318,14 @@ def update_config(
         row.random_current = _monotonic(row, random_initial)
         row.random_last_tick_at = now
     elif apply_now:
-        # 立即更新:不等钟点,马上刷新一次
+        # 立即更新:不等钟点,马上刷新一次。
+        # random:走一档增长;real/manual:直接落到「配置目标值」(manual_value / max(真实,保底)),
+        # **显式保存即所见即所得,绕过「只增不减」护栏**——运营手动改值就是要按配置显示(含调小)。
+        # (护栏仍作用于自动 tick 的 _refresh:防门面在两次保存之间被真实刷新/自增长悄悄缩水。)
         if row.mode == "random" and row.random_current is not None:
             row.random_current = _grow(row, row.random_current, 1)
         else:
-            row.random_current = _monotonic(row, _current_target(db, row))
+            row.random_current = _current_target(db, row)
         row.random_last_tick_at = now
     elif row.random_current is None:
         # 首次无值:按当前模式播种,使配置后立即有合理展示值

app/repositories/phone_rebind.py

@@ -0,0 +1,39 @@
+"""手机号换绑台账(phone_rebind_log)的查询与写入。见 M2 spec §4.1。"""
+from __future__ import annotations
+
+import math
+from datetime import datetime, timedelta, timezone
+
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.models.phone_rebind_log import PhoneRebindLog
+
+
+def rebound_within_days(db: Session, phone: str, days: int) -> bool:
+    """该手机号在最近 days 天内是否换绑过(命中 → 禁止再次换绑)。"""
+    since = datetime.now(timezone.utc) - timedelta(days=days)
+    stmt = (
+        select(PhoneRebindLog.id)
+        .where(PhoneRebindLog.phone == phone, PhoneRebindLog.rebound_at >= since)
+        .limit(1)
+    )
+    return db.execute(stmt).first() is not None
+
+
+def remaining_block_days(db: Session, phone: str, days: int) -> int:
+    """距离该手机号可再次换绑还剩几天(向上取整;无记录返回 0)。"""
+    last = db.execute(
+        select(func.max(PhoneRebindLog.rebound_at)).where(PhoneRebindLog.phone == phone)
+    ).scalar_one_or_none()
+    if last is None:
+        return 0
+    if last.tzinfo is None:  # SQLite 取回 naive datetime,按 UTC 归一
+        last = last.replace(tzinfo=timezone.utc)
+    remaining = (last + timedelta(days=days) - datetime.now(timezone.utc)).total_seconds()
+    return max(0, math.ceil(remaining / 86400))
+
+
+def add_rebind_log(db: Session, *, phone: str, old_user_id: int | None, new_user_id: int, source: str) -> None:
+    """写一条换绑台账(**不 commit**,交给调用方 rebind_account 的单事务)。"""
+    db.add(PhoneRebindLog(phone=phone, old_user_id=old_user_id, new_user_id=new_user_id, source=source))

app/repositories/user.py

@@ -12,6 +12,7 @@ from sqlalchemy import select
 from sqlalchemy.orm import Session
 
 from app.models.user import User
+from app.repositories import phone_rebind
 
 
 # ===== 创建时分配的标识:用户名(对外展示账号 ID)+ 默认昵称 =====
@@ -42,6 +43,22 @@ def _gen_nickname() -> str:
     )
 
 
+def is_default_nickname(nickname: str | None) -> bool:
+    """是否为创建时自动分配的默认昵称(= "用户" + 9 位字母数字,见 [_gen_nickname])。
+
+    这类不是用户主动设置的昵称,展示脱敏时按「无昵称」处理(走 id 规则,见 ops_marquee._mask_real)。
+    精确匹配生成格式(前缀 + 定长字母数字集),不误伤真人以「用户」开头的昵称(如「用户体验师」含汉字、
+    长度也不符)。用户改过昵称即不再匹配。"""
+    if not nickname:
+        return False
+    s = nickname.strip()
+    return (
+        len(s) == len(_NICKNAME_PREFIX) + _NICKNAME_LEN
+        and s.startswith(_NICKNAME_PREFIX)
+        and all(c in _NICKNAME_ALPHABET for c in s[len(_NICKNAME_PREFIX):])
+    )
+
+
 def get_user_by_username(db: Session, username: str) -> User | None:
     return db.execute(
         select(User).where(User.username == username)
@@ -70,6 +87,83 @@ def get_user_by_phone(db: Session, phone: str) -> User | None:
     return db.execute(stmt).scalar_one_or_none()
 
 
+def get_user_by_wechat_openid(db: Session, openid: str) -> User | None:
+    stmt = select(User).where(User.wechat_openid == openid)
+    return db.execute(stmt).scalar_one_or_none()
+
+
+def touch_last_login(db: Session, user: User) -> User:
+    """openid 命中登录时更新 last_login_at(手机号登录在 upsert_user_for_login 里已更新)。"""
+    user.last_login_at = datetime.now(timezone.utc)
+    db.commit()
+    db.refresh(user)
+    return user
+
+
+def attach_wechat_to_user(
+    db: Session, user: User, *, openid: str, wechat_nickname: str | None, wechat_avatar_url: str | None
+) -> User:
+    """继续绑定:把微信 openid + 微信源字段并入已存在账号(调用方保证 user.wechat_openid 为空)。
+
+    **只写 wechat_openid / wechat_nickname / wechat_avatar_url,不动展示 nickname/avatar_url**
+    (完整 §10"默认则用微信、改过则保留"规则留 M3)。撞 openid 唯一约束(O 期间被别处绑走,
+    极罕见)时由调用方捕获 IntegrityError 兜底降级为"只登入不绑"。
+    """
+    user.wechat_openid = openid
+    user.wechat_nickname = wechat_nickname
+    user.wechat_avatar_url = wechat_avatar_url
+    user.last_login_at = datetime.now(timezone.utc)
+    db.commit()
+    db.refresh(user)
+    return user
+
+
+def _build_wechat_user(
+    db: Session,
+    *,
+    phone: str,
+    openid: str,
+    wechat_nickname: str | None,
+    wechat_avatar_url: str | None,
+) -> User:
+    """构造并 db.add 一个微信账号行(register_channel='wechat',展示昵称头像取微信,缺则默认),
+    **不 commit**。create_wechat_user 与 rebind_account 共用,保证建号逻辑单一来源。"""
+    user = User(
+        phone=phone,
+        username=_gen_unique_username(db),
+        nickname=wechat_nickname or _gen_nickname(),
+        avatar_url=wechat_avatar_url,
+        register_channel="wechat",
+        wechat_openid=openid,
+        wechat_nickname=wechat_nickname,
+        wechat_avatar_url=wechat_avatar_url,
+        last_login_at=datetime.now(timezone.utc),
+    )
+    db.add(user)
+    return user
+
+
+def create_wechat_user(
+    db: Session,
+    *,
+    phone: str,
+    openid: str,
+    wechat_nickname: str | None,
+    wechat_avatar_url: str | None,
+) -> User:
+    """微信登录新建账号(未占用分支)。见 _build_wechat_user。
+
+    openid 唯一约束是并发/重复绑定的最终防线(极罕见,openid 在 wechat-login 刚查过为空)。
+    """
+    user = _build_wechat_user(
+        db, phone=phone, openid=openid,
+        wechat_nickname=wechat_nickname, wechat_avatar_url=wechat_avatar_url,
+    )
+    db.commit()
+    db.refresh(user)
+    return user
+
+
 def upsert_user_for_login(
     db: Session,
     *,
@@ -138,3 +232,44 @@ def soft_delete_account(db: Session, user: User) -> None:
     # 释放邀请码唯一槽
     user.invite_code = None
     db.commit()
+
+
+def rebind_account(
+    db: Session,
+    *,
+    phone: str,
+    openid: str,
+    wechat_nickname: str | None,
+    wechat_avatar_url: str | None,
+    source: str = "wechat_conflict",
+) -> User:
+    """换绑:**单事务内**注销老账号 X(腾出手机号)+ 用该号建全新微信账号 Y + 写换绑台账。
+
+    - 老账号可能已不存在(P 被腾空)→ old_user_id=None,直接建 Y(幂等更稳)。
+    - 手机号唯一约束靠时序:先把 X.phone 改名并 flush 腾号,再插 Y。
+    - 全程不中途 commit,任一步失败整体回滚,绝不出现"X 删了 Y 没建"。
+    X 的字段变更等价 soft_delete_account(软删 + 匿名化 + 释放 openid/邀请码唯一槽),但不在此 commit。
+    """
+    old = get_user_by_phone(db, phone)
+    old_id = old.id if old is not None else None
+    if old is not None:
+        old.status = "deleted"
+        old.phone = f"deleted_{old.id}"
+        old.nickname = None
+        old.avatar_url = None
+        old.wechat_openid = None
+        old.wechat_nickname = None
+        old.wechat_avatar_url = None
+        old.invite_code = None
+        db.flush()  # 先落 phone 改名,腾出手机号唯一约束,才能给 Y 用
+    new_user = _build_wechat_user(
+        db, phone=phone, openid=openid,
+        wechat_nickname=wechat_nickname, wechat_avatar_url=wechat_avatar_url,
+    )
+    db.flush()  # 拿 new_user.id
+    phone_rebind.add_rebind_log(
+        db, phone=phone, old_user_id=old_id, new_user_id=new_user.id, source=source
+    )
+    db.commit()
+    db.refresh(new_user)
+    return new_user

app/repositories/wallet.py

@@ -11,7 +11,7 @@ import unicodedata
 import uuid
 from datetime import datetime, timedelta, timezone
 
-from sqlalchemy import select, update
+from sqlalchemy import func, select, update
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
@@ -67,6 +67,10 @@ class WithdrawTooFrequentError(Exception):
     """提现申请过于频繁,或已有未完成提现单。"""
 
 
+class WithdrawTierUnavailableError(Exception):
+    """该档位今日不可提:次数已满,或今天已选了其他额度(7-9 福利页档位规则)。"""
+
+
 class WithdrawTransferError(Exception):
     """调用微信转账失败(已退回余额)。"""
 
@@ -296,6 +300,9 @@ def daily_auto_exchange(db: Session) -> dict:
     - **逐用户独立事务**:单个用户异常 rollback 不影响其他人;exchange_coins_to_cash 内部按用户 commit。
     返回统计 dict(scanned/converted/skipped_done/skipped_dust/failed/total_cents)。
     """
+    # ⚠️「今天」写死北京时(rewards.cn_today() = datetime.now(CN_TZ).date(), CN_TZ=+8),与服务器/用户
+    #   时区无关(用户 2026-07-01 硬约束:兑换一律北京 0 点日切)。**禁止**改成 date.today() / 裸
+    #   datetime.now().date()——那会跟随进程本地时区,服务器非 CST 时会在错误的"天"兑/重复兑。
     today = rewards.cn_today()
     stats = {
         "scanned": 0, "converted": 0, "skipped_done": 0,
@@ -602,6 +609,89 @@ def _settle_after_ambiguous(db: Session, order: WithdrawOrder, reason: str) -> N
         db.commit()
 
 
+def _beijing_today_start_utc() -> datetime:
+    """北京时今日 0 点(转 UTC)。WithdrawOrder.created_at 是 func.now()(UTC)存储,
+    比较时统一转 UTC,与 admin 看板 today_start 同口径(admin/repositories/queries.py)。"""
+    return (
+        datetime.now(rewards.CN_TZ)
+        .replace(hour=0, minute=0, second=0, microsecond=0)
+        .astimezone(timezone.utc)
+    )
+
+
+def withdraw_tier_states(db: Session, user_id: int, source: str = "coin_cash") -> list[dict]:
+    """福利页(coin_cash)提现档位的可提现状态。withdraw-info 下发与 create_withdraw 校验共用此口径。
+
+    规则(2026-07-09 拍板,7-9提现ui对齐):
+      - 新人档(0.1/0.3):账号历史一次性——只要发起过(**任意状态**,含被拒/失败,"发起就算")
+        即视为已用,直接**从返回列表消失**;两档各自独立互不影响,不参与"每日选一个额度"互斥。
+      - 常规档(0.5×3 / 10×1 / 20×1):按北京日计次,"发起就算占用"(当天创建的单不论最终状态
+        都计入,被拒/失败不退当天名额);三档每天只能选一个,选定后其余两档当天 other_tier_selected。
+      - invite_cash 本轮无档位概念 → 返回空列表(邀请页客户端仍用本地写死档位,行为不变)。
+    余额是否足够由客户端本地判断(余额随兑换实时变化,不在此快照)。
+    """
+    if source != "coin_cash":
+        return []
+    tiers = rewards.WITHDRAW_TIERS_COIN_CASH
+    amounts = [t.amount_cents for t in tiers]
+    newbie_amounts = [t.amount_cents for t in tiers if t.is_newbie]
+    # 新人档历史是否用过:任意时间、任意状态("发起就算")
+    used_newbie: set[int] = set(
+        db.execute(
+            select(WithdrawOrder.amount_cents)
+            .distinct()
+            .where(
+                WithdrawOrder.user_id == user_id,
+                WithdrawOrder.source == "coin_cash",
+                WithdrawOrder.amount_cents.in_(newbie_amounts),
+            )
+        ).scalars()
+    ) if newbie_amounts else set()
+    # 今日(北京日)每档已发起次数(任意状态)
+    today_counts: dict[int, int] = {
+        int(amount): int(cnt)
+        for amount, cnt in db.execute(
+            select(WithdrawOrder.amount_cents, func.count(WithdrawOrder.id))
+            .where(
+                WithdrawOrder.user_id == user_id,
+                WithdrawOrder.source == "coin_cash",
+                WithdrawOrder.amount_cents.in_(amounts),
+                WithdrawOrder.created_at >= _beijing_today_start_utc(),
+            )
+            .group_by(WithdrawOrder.amount_cents)
+        )
+    }
+    # "每日选一个额度":今天发起过的常规档(新人档不算)
+    selected_regular = next(
+        (t.amount_cents for t in tiers if not t.is_newbie and today_counts.get(t.amount_cents, 0) > 0),
+        None,
+    )
+    out: list[dict] = []
+    for t in tiers:
+        if t.is_newbie:
+            if t.amount_cents in used_newbie:
+                continue  # 用过即消失,不再下发
+            out.append({
+                "amount_cents": t.amount_cents, "label": t.label, "badge": t.badge,
+                "is_newbie": True, "available": True, "disabled_reason": None,
+                "remaining_today": 1,
+            })
+            continue
+        used = today_counts.get(t.amount_cents, 0)
+        if selected_regular is not None and selected_regular != t.amount_cents:
+            available, reason, remaining = False, "other_tier_selected", 0
+        elif used >= t.daily_limit:
+            available, reason, remaining = False, "quota_exhausted", 0
+        else:
+            available, reason, remaining = True, None, t.daily_limit - used
+        out.append({
+            "amount_cents": t.amount_cents, "label": t.label, "badge": t.badge,
+            "is_newbie": False, "available": available, "disabled_reason": reason,
+            "remaining_today": remaining,
+        })
+    return out
+
+
 def create_withdraw(
     db: Session,
     user_id: int,
@@ -657,6 +747,19 @@ def create_withdraw(
     if active_order_id is not None:
         raise WithdrawTooFrequentError
 
+    # 福利页档位闸(7-9):coin_cash 只能提预设档位,且该档今日可提(服务端权威口径,防绕过
+    # 客户端刷)。放在幂等返回/在途互斥之后:同号重试仍原样返回旧单,不被档位闸误杀。
+    # allow_sub_min(0.01 调试直发)保持原样放行,不受档位约束;invite_cash 本轮无档位概念不校验。
+    if source == "coin_cash" and not allow_sub_min:
+        tier_state = next(
+            (t for t in withdraw_tier_states(db, user_id, source) if t["amount_cents"] == amount_cents),
+            None,
+        )
+        if tier_state is None:  # 非预设档位金额,或新人档已用过(已从列表消失)
+            raise InvalidWithdrawAmountError
+        if not tier_state["available"]:
+            raise WithdrawTierUnavailableError
+
     # 账户须存在(原子扣款的 UPDATE 不会建账户)
     get_or_create_account(db, user_id, commit=True)
 

app/schemas/ad.py

@@ -63,6 +63,12 @@ class EcpmReportIn(BaseModel):
         description="点位场景:comparison(比价等待) / coupon(领券) / welfare(福利页);"
         "比价与领券共用同一 Draw 代码位,需客户端在各调用点显式标注,供收益报表区分比价/领券;激励视频为空",
     )
+    trace_id: str | None = Field(
+        None,
+        max_length=64,
+        description="本次比价/领券 trace_id(信息流场景带上):把这条展示收益归属到对应比价/领券,"
+        "供领券数据/比价记录看板聚合本场广告收益;激励视频/福利为空",
+    )
     app_env: str | None = Field(
         None, max_length=16, description="我们的穿山甲应用环境:prod(傻瓜比价正式) / test(测试应用)"
     )

app/schemas/analytics_selfstat.py

@@ -0,0 +1,34 @@
+"""自报计数上报 schema。字段名对齐客户端 payload(snake_case),累计值语义。"""
+from __future__ import annotations
+
+from pydantic import BaseModel, Field
+
+
+class SelfStatEventIn(BaseModel):
+    event: str = Field(max_length=64)
+    attempted: int = 0
+    drop_capture: int = 0
+    delivered: int = 0
+    drop_undelivered: int = 0
+
+
+class SelfStatBatchIn(BaseModel):
+    device_id: str = Field(max_length=64)
+    epoch_id: str = Field(max_length=64)
+    sent_at: int | None = None
+    app_ver: str | None = Field(default=None, max_length=32)
+    oem: str | None = Field(default=None, max_length=32)
+    os: str | None = Field(default=None, max_length=32)
+    batches_attempted: int = 0
+    batches_ok: int = 0
+    batches_fail: int = 0
+    retries: int = 0
+    queue_depth: int = 0
+    # 允许空列表:某次快照只上报设备级计数(batches_*/retries/queue_depth)、无 event 细分时也合法
+    # (与 AnalyticsBatchIn 的 min_length=1 有意不同——那是行为事件、必须至少一条)。
+    events: list[SelfStatEventIn] = Field(default_factory=list, max_length=200)
+
+
+class SelfStatIngestOut(BaseModel):
+    ok: bool = True
+    snapshot_id: int

app/schemas/auth.py

@@ -102,3 +102,64 @@ class RefreshRequest(BaseModel):
 
 class LogoutResponse(BaseModel):
     ok: bool = True
+
+
+# ===== 微信登录 =====
+
+class WechatLoginRequest(BaseModel):
+    code: str = Field(..., min_length=1, description="微信 App 授权拿到的 code(单次有效)")
+    device_id: str = Field(
+        "", max_length=64,
+        description="硬件级设备标识(Android ANDROID_ID),用于新手引导按 设备+账号 去重;空=按未完成处理",
+    )
+
+
+class WechatLoginResponse(BaseModel):
+    # status="logged_in" → openid 命中,token 有值;"need_bind_phone" → 未命中,bind_ticket 有值
+    status: str
+    token: TokenWithUser | None = None
+    bind_ticket: str | None = None
+    wechat_nickname: str | None = None
+    wechat_avatar_url: str | None = None
+
+
+class OccupiedAccountInfo(BaseModel):
+    """手机号被占用时返回的原账号脱敏展示信息(供冲突页)。"""
+    nickname: str | None = None
+    avatar_url: str | None = None
+    created_at: datetime
+    has_wechat: bool = False
+
+
+class WechatBindResultResponse(BaseModel):
+    # status="logged_in" → 未占用,已建号登入,token 有值;
+    # "phone_occupied" → 手机号被占用,occupied_account + conflict_ticket 有值,token 为 None
+    status: str
+    token: TokenWithUser | None = None
+    occupied_account: OccupiedAccountInfo | None = None
+    conflict_ticket: str | None = None            # 占用时签发,换绑/继续绑定只认它
+    rebind_available: bool | None = None          # 该手机号 30 天内是否还能换绑(给换绑按钮预置禁用态)
+    rebind_blocked_days: int | None = None        # 被限时剩余天数(rebind_available=False 时>0)
+
+
+class WechatBindPhoneSmsRequest(BaseModel):
+    bind_ticket: str = Field(..., min_length=1)
+    phone: str = Field(..., min_length=11, max_length=11, pattern=r"^1\d{10}$")
+    code: str = Field(..., min_length=4, max_length=8)
+    device_id: str = Field("", max_length=64)
+
+
+class WechatBindPhoneJverifyRequest(BaseModel):
+    bind_ticket: str = Field(..., min_length=1)
+    login_token: str = Field(..., min_length=1, description="客户端 loginAuth 拿到的 loginToken")
+    device_id: str = Field("", max_length=64)
+
+
+class WechatConflictContinueRequest(BaseModel):
+    conflict_ticket: str = Field(..., min_length=1)
+    device_id: str = Field("", max_length=64)
+
+
+class WechatConflictRebindRequest(BaseModel):
+    conflict_ticket: str = Field(..., min_length=1)
+    device_id: str = Field("", max_length=64)

app/schemas/feedback.py

@@ -30,10 +30,14 @@ class FeedbackQrConfigOut(BaseModel):
 class FeedbackRecordOut(BaseModel):
     id: int
     content: str
+    # 比价反馈的问题场景(找错商品/优惠不对…);普通反馈为 None
+    scene: str | None = None
     images: list[str] = Field(default_factory=list)
     status: str
     reject_reason: str | None = None
     reward_coins: int | None = None
+    # 运营给用户的回复留言(用户端可见,采纳/未采纳都可能有)
+    admin_reply: str | None = None
     created_at: datetime
 
 

app/schemas/invite.py

@@ -69,6 +69,7 @@ class InviteeItem(BaseModel):
     avatar_url: str | None = None   # 头像 URL;null = 前端画默认色块
     coins: int                      # 这次邀请给我(邀请人)发的金币
     invited_at: datetime            # 邀请绑定时间(前端转"今天/3天前")
+    is_compared: bool = False       # 该好友是否已完成过一次比价(好友列表分"去提醒/邀请成功";在途列表只取 False)
 
 
 class InviteeListOut(BaseModel):

app/schemas/meituan.py

@@ -174,9 +174,13 @@ class FeedResponse(BaseModel):
 
 class TopSalesRequest(BaseModel):
     """销量最高 tab:从离线库 meituan_coupon 按销量降序取(不实时打美团)。"""
+    # 可选:老客户端(本次改动前发版)不带经纬度。缺省时后端降级返空(status=degraded),
+    # 不做 422 硬拒,也不误返"全城"结果。新客户端会传坐标 → 按城市过滤。
+    longitude: float | None = Field(None, description="经度(用于定位城市;缺省=老客户端,降级返空)")
+    latitude: float | None = Field(None, description="纬度(用于定位城市;缺省=老客户端,降级返空)")
     page: int = Field(1, ge=1)
     page_size: int = Field(20, ge=1, le=50)
-    platform: int | None = Field(None, description="可选: 1只外卖 / 2只到店; 不填=全部(全城销量)")
+    platform: int | None = Field(None, description="可选: 1只外卖 / 2只到店; 不填=全部(同城销量)")
 
 
 # ───────────────── 换链 请求 / 响应 ─────────────────