功能：统一限制策略与白名单管理

新增统一限制规则、临时不限和风控免告警白名单，接入比价、短信登录、广告、引导视频与账号冷却等业务链路。补充设备选择、权限、审计、迁移及回归测试。

.env.example

@@ -33,12 +33,38 @@ HEARTBEAT_TIMEOUT_MINUTES=60
 HEARTBEAT_SCAN_INTERVAL_SEC=60
 
 # ===== 短信 (mock 模式) =====
-# mock = true 时,任意 6 位数字均通过,且 /sms/send 不真发短信(只 log)。
-# 后续接阿里云/腾讯云短信时,改成 false 并填供应商相关 key。
+# mock = true 时,任意 6 位数字均通过,且 /sms/send 不真发短信(只 log)。生产改 false。
 SMS_MOCK=true
 SMS_CODE_TTL_SEC=300
 SMS_SEND_INTERVAL_SEC=60
 
+# ===== 短信提供商(可切换:jiguang 默认 / aliyun 阿里云号码认证 / chuanglan 创蓝云智)=====
+# jiguang  :本服务生成验证码,极光 REST 只负责下发,本地内存校验(复用上面极光 JG_* 凭证)。
+# aliyun   :阿里云 dypns 号码认证,阿里云生成+下发+校验(Mode A,核验免费);缺凭证时 /sms/* 返 503。
+#            需在阿里云号码认证控制台开通「融合认证」,并使用系统赠送签名 + 赠送模板。
+# chuanglan:创蓝云智(253)模板短信,本服务生成码、创蓝只下发、本地校验(Mode B,与极光同);缺凭证 503。
+#            用 YZM 前缀验证码账号;服务器出网 IP 需在创蓝控制台加白名单(否则 117)。见 docs/integrations/chuanglan/tpl-send.md。
+SMS_PROVIDER=jiguang
+ALIYUN_SMS_ACCESS_KEY_ID=
+ALIYUN_SMS_ACCESS_KEY_SECRET=
+ALIYUN_SMS_SIGN_NAME=
+ALIYUN_SMS_TEMPLATE_CODE=
+# 方案名:留空=默认方案;若填,发码与校验须一致(本服务已共用同一配置项,不会不匹配)。
+ALIYUN_SMS_SCHEME_NAME=
+ALIYUN_SMS_ENDPOINT=dypnsapi.aliyuncs.com
+ALIYUN_SMS_CODE_LENGTH=6
+ALIYUN_SMS_VALID_TIME_SEC=300
+ALIYUN_SMS_INTERVAL_SEC=60
+ALIYUN_SMS_TIMEOUT_SEC=15
+# --- 创蓝云智(253)---
+CHUANGLAN_SMS_ACCOUNT=
+CHUANGLAN_SMS_PASSWORD=
+CHUANGLAN_SMS_TEMPLATE_ID=1022457679
+# 短信签名文案【品牌】;模板已关联签名则留空。
+CHUANGLAN_SMS_SIGNATURE=
+CHUANGLAN_SMS_ENDPOINT=https://smssh.253.com/msg/sms/v2/tpl/send
+CHUANGLAN_SMS_TIMEOUT_SEC=10
+
 # ===== 测试账号(release 包全流程联调用)=====
 # 配一个固定测试手机号,专供无 SIM 卡 / 不走一键登录时打通全流程:该号登录【免短信验证码】
 # (real 模式下也跳过校验)、每次登录【都重走新手引导】,并有【每日登录上限】防被人猜到号后脚本刷。

.gitignore

@@ -49,6 +49,9 @@ secrets/*
 *.log
 logs/
 
+# 本地 admin server(端口 8771)Windows 启动脚本,个人调试用,不入库
+/run8771.bat
+
 # Claude Code 自动持久化的权限 allowlist / 个人本地设置(会话专属,不入库)。
 # 需要团队共享的 Claude 配置(commands/ 等)可单独 git add -f,不受此忽略影响。
 .claude/settings.json

alembic/versions/6d2309208549_merge_comparison_platforms_fail_reason_.py

@@ -0,0 +1,26 @@
+"""merge comparison platforms + fail_reason heads
+
+Revision ID: 6d2309208549
+Revises: comparison_platforms_col, comparison_record_fail_reason
+Create Date: 2026-07-29 01:48:41.868083
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '6d2309208549'
+down_revision: Union[str, Sequence[str], None] = ('comparison_platforms_col', 'comparison_record_fail_reason')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/comparison_platforms_col.py

@@ -0,0 +1,47 @@
+"""add platforms unified array column to comparison_record
+
+展示模型统一数组(pricebot done.params.platforms 原样存): 每平台一行、自带
+status/is_best/display, 记录页据此直接渲染, 不再靠 comparison_results + 客户端合并 + 前端派生。
+纯新增列, 老记录为空 → 前端回退老 comparison_results。
+
+Revision ID: comparison_platforms_col
+Revises: user_manual_risk_fields
+"""
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+revision: str = "comparison_platforms_col"
+down_revision: str | None = "user_manual_risk_fields"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+_JSON = sa.JSON().with_variant(postgresql.JSONB(), "postgresql")
+
+
+def upgrade() -> None:
+    # 幂等: 线上为了提前给历史数据补 platforms(2026-07-29), 已手动
+    # `ALTER TABLE comparison_record ADD COLUMN IF NOT EXISTS platforms jsonb
+    #  NOT NULL DEFAULT '[]'::jsonb`(与本 migration 定义一致)。列已存在时跳过,
+    # 否则上线 alembic upgrade head 会撞 DuplicateColumn 直接部署失败。
+    bind = op.get_bind()
+    cols = {c["name"] for c in sa.inspect(bind).get_columns("comparison_record")}
+    if "platforms" in cols:
+        return
+    with op.batch_alter_table("comparison_record") as batch_op:
+        batch_op.add_column(
+            sa.Column(
+                "platforms", _JSON, nullable=False,
+                server_default=sa.text("'[]'"),
+            )
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("comparison_record") as batch_op:
+        batch_op.drop_column("platforms")

alembic/versions/comparison_record_fail_reason.py

@@ -0,0 +1,49 @@
+"""comparison_record.fail_reason (失败卡展示原因)
+
+Revision ID: comparison_record_fail_reason
+Revises: user_manual_risk_fields
+Create Date: 2026-07-28 12:00:00.000000
+
+失败记录的展示原因:information 具体则=它;笼统则由写路径从 platform_results 捞出的
+业务原因;纯系统失败为 None(端侧品牌兜底)。见 repositories.comparison._derive_fail_display。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'comparison_record_fail_reason'
+down_revision: Union[str, Sequence[str], None] = 'user_manual_risk_fields'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('fail_reason', sa.String(length=256), nullable=True))
+    # 回填老失败记录:information 具体的直接搬过来(笼统/系统失败留 None → 端侧品牌兜底)。
+    # 新记录由写路径 _derive_fail_display 落库(含 platform_results 救援/补判),不走这条。
+    # platform_results 只在 raw_payload 里,SQL 里不易解析,故老记录不做救援/补判(可接受:
+    # 老 mixed/打烊记录回退品牌兜底);具体 information 的老记录本次即可显示真实原因。
+    op.execute(
+        """
+        UPDATE comparison_record
+        SET fail_reason = information
+        WHERE status = 'failed'
+          AND information IS NOT NULL
+          AND information <> ''
+          AND information NOT IN (
+              '比价过程出错，请稍后重试',
+              '比价出错',
+              '比价未完成',
+              'done 参数缺少可验证的目标平台结果'
+          )
+        """
+    )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('comparison_record', schema=None) as batch_op:
+        batch_op.drop_column('fail_reason')

alembic/versions/guide_video_scene_unique.py

@@ -0,0 +1,31 @@
+"""guide video play count is independent for coupon and comparison
+
+Revision ID: guide_video_scene_unique
+Revises: 6d2309208549
+"""
+from alembic import op
+
+revision = "guide_video_scene_unique"
+down_revision = "6d2309208549"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.drop_index("uq_guide_video_play_user_seq", table_name="guide_video_play")
+    op.create_index(
+        "uq_guide_video_play_user_scene_seq",
+        "guide_video_play",
+        ["user_id", "scene", "seq"],
+        unique=True,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("uq_guide_video_play_user_scene_seq", table_name="guide_video_play")
+    op.create_index(
+        "uq_guide_video_play_user_seq",
+        "guide_video_play",
+        ["user_id", "seq"],
+        unique=True,
+    )

alembic/versions/limit_policy_whitelist.py

@@ -0,0 +1,128 @@
+"""add per-subject limit policy whitelist
+
+Revision ID: limit_policy_whitelist
+Revises: guide_video_scene_unique
+"""
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+from alembic import op
+
+revision: str = "limit_policy_whitelist"
+down_revision: str | Sequence[str] | None = "guide_video_scene_unique"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+_JSON = sa.JSON().with_variant(postgresql.JSONB(), "postgresql")
+_PAGE = "limit-whitelist"
+_DEFAULT_ROLES = ("operator", "tech")
+
+
+def _role_table() -> sa.TableClause:
+    return sa.table(
+        "admin_role",
+        sa.column("name", sa.String),
+        sa.column("pages", _JSON),
+    )
+
+
+def _add_default_role_permissions() -> None:
+    """Grant the page without replacing existing role customisations."""
+    role = _role_table()
+    conn = op.get_bind()
+    rows = conn.execute(
+        sa.select(role.c.name, role.c.pages).where(
+            role.c.name.in_(_DEFAULT_ROLES)
+        )
+    ).all()
+    for name, pages in rows:
+        current_pages = list(pages or [])
+        if _PAGE not in current_pages:
+            conn.execute(
+                role.update()
+                .where(role.c.name == name)
+                .values(pages=[*current_pages, _PAGE])
+            )
+
+
+def _remove_default_role_permissions() -> None:
+    role = _role_table()
+    conn = op.get_bind()
+    rows = conn.execute(
+        sa.select(role.c.name, role.c.pages).where(
+            role.c.name.in_(_DEFAULT_ROLES)
+        )
+    ).all()
+    for name, pages in rows:
+        current_pages = list(pages or [])
+        if _PAGE in current_pages:
+            conn.execute(
+                role.update()
+                .where(role.c.name == name)
+                .values(
+                    pages=[page for page in current_pages if page != _PAGE]
+                )
+            )
+
+
+def upgrade() -> None:
+    op.create_table(
+        "limit_policy_override",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("subject_type", sa.String(length=16), nullable=False),
+        sa.Column("subject_value", sa.String(length=128), nullable=False),
+        sa.Column("rule_code", sa.String(length=64), nullable=False),
+        sa.Column("mode", sa.String(length=24), nullable=False),
+        sa.Column("limit_value", sa.Integer(), nullable=True),
+        sa.Column(
+            "enabled", sa.Boolean(), server_default=sa.true(), nullable=False
+        ),
+        sa.Column("starts_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("expires_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("reset_at", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("reason", sa.String(length=256), nullable=True),
+        sa.Column("created_by_admin_id", sa.Integer(), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.func.now(),
+            nullable=False,
+        ),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint(
+            "subject_type",
+            "subject_value",
+            "rule_code",
+            name="uq_limit_policy_subject_rule",
+        ),
+    )
+    op.create_index(
+        "ix_limit_policy_lookup",
+        "limit_policy_override",
+        ["subject_type", "subject_value", "rule_code", "enabled"],
+        unique=False,
+    )
+    op.create_index(
+        "ix_limit_policy_expires",
+        "limit_policy_override",
+        ["expires_at"],
+        unique=False,
+    )
+    _add_default_role_permissions()
+
+
+def downgrade() -> None:
+    _remove_default_role_permissions()
+    op.drop_index("ix_limit_policy_expires", table_name="limit_policy_override")
+    op.drop_index("ix_limit_policy_lookup", table_name="limit_policy_override")
+    op.drop_table("limit_policy_override")

app/admin/main.py

@@ -31,6 +31,7 @@ from app.admin.routers.feedback import router as feedback_router
 from app.admin.routers.feedback_qr import router as feedback_qr_router
 from app.admin.routers.guide_video import router as guide_video_router
 from app.admin.routers.huawei_review import router as huawei_review_router
+from app.admin.routers.limit_whitelist import router as limit_whitelist_router
 from app.admin.routers.onboarding import router as onboarding_router
 from app.admin.routers.ops_marquee_seed import router as ops_marquee_seed_router
 from app.admin.routers.ops_stat_config import router as ops_stat_config_router
@@ -103,6 +104,7 @@ admin_app.include_router(wallet_router)
 admin_app.include_router(withdraw_router)
 admin_app.include_router(price_report_router)
 admin_app.include_router(risk_monitor_router)
+admin_app.include_router(limit_whitelist_router)
 admin_app.include_router(feedback_router)
 admin_app.include_router(event_logs_router)
 admin_app.include_router(analytics_health_router)

app/admin/permissions.py

@@ -40,6 +40,7 @@ PERMISSION_CATALOG: list[dict] = [
         {"key": "analytics-health", "label": "埋点成功率"},
         {"key": "event-logs", "label": "埋点日志"},
         {"key": "audit-logs", "label": "审计日志"},
+        {"key": "limit-whitelist", "label": "白名单"},
     ]},
     {"group": "其他", "pages": [
         {"key": "admins", "label": "权限管理"},
@@ -58,13 +59,14 @@ BUILTIN_ROLES: list[dict] = [
     {"name": "operator", "label": "运营", "pages": [
         "dashboard", "coupon-data", "ad-revenue-report", "comparison-records",
         "cps", "risk-monitor", "device-liveness", "price-reports", "feedbacks", "huawei-review",
+        "limit-whitelist",
     ]},
     {"name": "finance", "label": "财务", "pages": [
         "dashboard", "ad-revenue-report", "cps", "invite-withdraws", "withdraws",
     ]},
     {"name": "tech", "label": "技术", "pages": [
         "dashboard", "risk-monitor", "device-liveness", "analytics-health", "config", "ad-revenue", "huawei-review",
-        "event-logs", "audit-logs",
+        "event-logs", "audit-logs", "limit-whitelist",
     ]},
 ]
 

app/admin/repositories/ad_revenue.py

@@ -43,7 +43,7 @@ _KNOWN_PROD_BUSINESS_CODE_IDS = frozenset({"104098712", "104099389"})
 _TEST_BUSINESS_CODE_IDS = frozenset({"104127529", "104127626", "104137445"})
 
 
-def _business_code_ids(db: Session, app_env: str | None) -> set[str]:
+def business_code_ids(db: Session, app_env: str | None) -> set[str]:
     """返回指定应用环境下可用于业务收益对账的 GroMore 聚合代码位。"""
     prod_config = app_config.get_ad_config(db)
     prod_ids = set(_KNOWN_PROD_BUSINESS_CODE_IDS) | {
@@ -320,10 +320,10 @@ def ad_revenue_report(
 
     # 业务口径仅保留正式配置/测试业务链路实际使用的代码位。穿山甲“全量”还包含广告测试
     # demo、插屏等没有客户端收益上报的曝光，两边直接比较会天然产生假差额。
-    business_code_ids: set[str] | None = None
+    business_ids: set[str] | None = None
     if revenue_scope == "business":
-        business_code_ids = _business_code_ids(db, app_env)
-        events = [e for e in events if e.get("our_code_id") in business_code_ids]
+        business_ids = business_code_ids(db, app_env)
+        events = [e for e in events if e.get("our_code_id") in business_ids]
 
     # 排序:time=按时间倒序(新→旧);ecpm=按 eCPM 数值倒序(eCPM 原值是字符串「分」,转数值排;
     # 纯发奖行用其发奖采用的 eCPM,缺失/非法计 0 排末尾)。
@@ -381,7 +381,7 @@ def ad_revenue_report(
             date_from=date_from,
             date_to=date_to,
             app_env=app_env,
-            our_code_ids=business_code_ids,
+            our_code_ids=business_ids,
         )
         if pangle_aggs:
             by_date = {a["date"]: a for a in pangle_aggs}

app/admin/repositories/limit_whitelist.py

@@ -0,0 +1,455 @@
+"""CRUD and presentation helpers for limit policy overrides."""
+from __future__ import annotations
+
+from datetime import UTC, datetime
+
+from sqlalchemy import String, cast, func, or_, select
+from sqlalchemy.exc import IntegrityError
+from sqlalchemy.orm import Session
+
+from app.core import limit_policy
+from app.models.app_config import AppConfig
+from app.models.comparison import ComparisonRecord
+from app.models.limit_policy import LimitPolicyOverride
+from app.models.risk import BehaviorEvent
+from app.models.user import User
+from app.repositories import app_config
+from app.repositories import risk as risk_repo
+
+
+class DuplicateOverrideError(Exception):
+    pass
+
+
+_EVENT_SOURCE_LABELS = {
+    risk_repo.EVENT_SMS_SEND: "短信验证码",
+    risk_repo.EVENT_SMS_LOGIN: "短信登录",
+    risk_repo.EVENT_ONECLICK_LOGIN: "一键登录",
+}
+
+
+def _matching_users(keyword: str):
+    pattern = f"%{keyword}%"
+    return select(User.id).where(
+        or_(
+            cast(User.id, String).ilike(pattern),
+            User.username.ilike(pattern),
+            User.phone.ilike(pattern),
+            User.nickname.ilike(pattern),
+        )
+    )
+
+
+def _user_maps(
+    db: Session, *, user_ids: set[int], phones: set[str]
+) -> tuple[dict[int, User], dict[str, User]]:
+    conditions = []
+    if user_ids:
+        conditions.append(User.id.in_(user_ids))
+    if phones:
+        conditions.append(User.phone.in_(phones))
+    if not conditions:
+        return {}, {}
+    users = list(db.scalars(select(User).where(or_(*conditions))).all())
+    return {user.id: user for user in users}, {user.phone: user for user in users}
+
+
+def _behavior_device_candidates(
+    db: Session, *, keyword: str | None, limit: int
+) -> list[dict]:
+    conditions = [
+        BehaviorEvent.subject_type == limit_policy.SUBJECT_DEVICE,
+        BehaviorEvent.subject_id != "",
+        BehaviorEvent.subject_id.not_like(
+            f"{limit_policy.LEGACY_IP_DEVICE_PREFIX}%"
+        ),
+    ]
+    if keyword:
+        value = keyword.strip()
+        pattern = f"%{value}%"
+        matched_users = _matching_users(value)
+        conditions.append(
+            or_(
+                BehaviorEvent.subject_id.ilike(pattern),
+                BehaviorEvent.device_id.ilike(pattern),
+                BehaviorEvent.device_model.ilike(pattern),
+                BehaviorEvent.phone.ilike(pattern),
+                cast(BehaviorEvent.user_id, String).ilike(pattern),
+                BehaviorEvent.user_id.in_(matched_users),
+                BehaviorEvent.phone.in_(
+                    select(User.phone).where(User.id.in_(_matching_users(value)))
+                ),
+            )
+        )
+
+    ranked = (
+        select(
+            BehaviorEvent.subject_id.label("device_id"),
+            BehaviorEvent.event_type,
+            BehaviorEvent.user_id,
+            BehaviorEvent.phone,
+            BehaviorEvent.device_model,
+            BehaviorEvent.occurred_at.label("last_active_at"),
+            func.row_number()
+            .over(
+                partition_by=BehaviorEvent.subject_id,
+                order_by=(
+                    BehaviorEvent.occurred_at.desc(),
+                    BehaviorEvent.id.desc(),
+                ),
+            )
+            .label("rank"),
+        )
+        .where(*conditions)
+        .subquery()
+    )
+    rows = db.execute(
+        select(ranked)
+        .where(ranked.c.rank == 1)
+        .order_by(ranked.c.last_active_at.desc(), ranked.c.device_id.asc())
+        .limit(limit)
+    ).all()
+    by_id, by_phone = _user_maps(
+        db,
+        user_ids={row.user_id for row in rows if row.user_id is not None},
+        phones={row.phone for row in rows if row.phone},
+    )
+    result = []
+    for row in rows:
+        user = by_id.get(row.user_id) if row.user_id is not None else None
+        user = user or (by_phone.get(row.phone) if row.phone else None)
+        result.append(
+            {
+                "device_id": row.device_id,
+                "source": row.event_type,
+                "source_label": _EVENT_SOURCE_LABELS.get(
+                    row.event_type, "登录/鉴权流水"
+                ),
+                "user_id": user.id if user else row.user_id,
+                "username": user.username if user else None,
+                "phone": user.phone if user else row.phone,
+                "nickname": user.nickname if user else None,
+                "device_model": row.device_model,
+                "last_active_at": row.last_active_at,
+            }
+        )
+    return result
+
+
+def _comparison_device_candidates(
+    db: Session, *, keyword: str | None, limit: int
+) -> list[dict]:
+    conditions = [
+        ComparisonRecord.device_id.is_not(None),
+        ComparisonRecord.device_id != "",
+    ]
+    if keyword:
+        value = keyword.strip()
+        pattern = f"%{value}%"
+        conditions.append(
+            or_(
+                ComparisonRecord.device_id.ilike(pattern),
+                ComparisonRecord.device_model.ilike(pattern),
+                cast(ComparisonRecord.user_id, String).ilike(pattern),
+                ComparisonRecord.user_id.in_(_matching_users(value)),
+            )
+        )
+    ranked = (
+        select(
+            ComparisonRecord.device_id,
+            ComparisonRecord.user_id,
+            ComparisonRecord.device_model,
+            ComparisonRecord.created_at.label("last_active_at"),
+            func.row_number()
+            .over(
+                partition_by=ComparisonRecord.device_id,
+                order_by=(
+                    ComparisonRecord.created_at.desc(),
+                    ComparisonRecord.id.desc(),
+                ),
+            )
+            .label("rank"),
+        )
+        .where(*conditions)
+        .subquery()
+    )
+    rows = db.execute(
+        select(ranked)
+        .where(ranked.c.rank == 1)
+        .order_by(ranked.c.last_active_at.desc(), ranked.c.device_id.asc())
+        .limit(limit)
+    ).all()
+    by_id, _ = _user_maps(
+        db,
+        user_ids={row.user_id for row in rows if row.user_id is not None},
+        phones=set(),
+    )
+    return [
+        {
+            "device_id": row.device_id,
+            "source": "comparison_record",
+            "source_label": "比价记录",
+            "user_id": user.id if user else row.user_id,
+            "username": user.username if user else None,
+            "phone": user.phone if user else None,
+            "nickname": user.nickname if user else None,
+            "device_model": row.device_model,
+            "last_active_at": row.last_active_at,
+        }
+        for row in rows
+        for user in [by_id.get(row.user_id) if row.user_id is not None else None]
+    ]
+
+
+def list_device_candidates(
+    db: Session,
+    *,
+    rule_code: str,
+    keyword: str | None = None,
+    limit: int = 30,
+) -> list[dict]:
+    rule = limit_policy.get_rule(rule_code)
+    if limit_policy.SUBJECT_DEVICE not in rule.subject_types:
+        raise ValueError("当前限制项不支持设备白名单")
+    if limit_policy.device_source_scope(rule_code) == "comparison":
+        return _comparison_device_candidates(db, keyword=keyword, limit=limit)
+    return _behavior_device_candidates(db, keyword=keyword, limit=limit)
+
+
+def _aware(value: datetime | None) -> datetime | None:
+    if value is None:
+        return None
+    return value.replace(tzinfo=UTC) if value.tzinfo is None else value
+
+
+def status_of(row: LimitPolicyOverride, *, now: datetime | None = None) -> str:
+    now = _aware(now) or datetime.now(UTC)
+    if not row.enabled:
+        return "disabled"
+    if _aware(row.starts_at) and _aware(row.starts_at) > now:
+        return "scheduled"
+    if _aware(row.expires_at) and _aware(row.expires_at) <= now:
+        return "expired"
+    return "active"
+
+
+def to_dict(db: Session, row: LimitPolicyOverride) -> dict:
+    rule = limit_policy.get_rule(row.rule_code)
+    effective = limit_policy.resolve(
+        db,
+        row.rule_code,
+        phone=row.subject_value if row.subject_type == "phone" else None,
+        device=row.subject_value if row.subject_type == "device" else None,
+    )
+    return {
+        "id": row.id,
+        "subject_type": row.subject_type,
+        "subject_value": row.subject_value,
+        "rule_code": row.rule_code,
+        "rule_label": rule.label,
+        "rule_group": rule.group,
+        "mode": row.mode,
+        "limit_value": row.limit_value,
+        "global_limit": effective.global_limit,
+        "effective_limit": effective.limit,
+        "enabled": row.enabled,
+        "starts_at": row.starts_at,
+        "expires_at": row.expires_at,
+        "reset_at": row.reset_at,
+        "reason": row.reason,
+        "status": status_of(row),
+        "created_by_admin_id": row.created_by_admin_id,
+        "created_at": row.created_at,
+        "updated_at": row.updated_at,
+    }
+
+
+def list_rows(
+    db: Session,
+    *,
+    subject_type: str | None = None,
+    keyword: str | None = None,
+    rule_code: str | None = None,
+    offset: int = 0,
+    limit: int = 100,
+) -> tuple[list[LimitPolicyOverride], int]:
+    stmt = select(LimitPolicyOverride)
+    count_stmt = select(func.count(LimitPolicyOverride.id))
+    conditions = []
+    if subject_type:
+        conditions.append(LimitPolicyOverride.subject_type == subject_type)
+    if keyword:
+        conditions.append(
+            LimitPolicyOverride.subject_value.ilike(f"%{keyword.strip()}%")
+        )
+    if rule_code:
+        conditions.append(LimitPolicyOverride.rule_code == rule_code)
+    if conditions:
+        stmt = stmt.where(*conditions)
+        count_stmt = count_stmt.where(*conditions)
+    total = int(db.scalar(count_stmt) or 0)
+    rows = list(
+        db.execute(
+            stmt.order_by(
+                LimitPolicyOverride.created_at.desc(),
+                LimitPolicyOverride.id.desc(),
+            )
+            .offset(offset)
+            .limit(limit)
+        ).scalars()
+    )
+    return rows, total
+
+
+def create(
+    db: Session,
+    *,
+    subject_type: str,
+    subject_value: str,
+    rule_code: str,
+    mode: str,
+    limit_value: int | None,
+    enabled: bool,
+    starts_at: datetime | None,
+    expires_at: datetime | None,
+    reason: str,
+    admin_id: int,
+    reactivate_inactive: bool = False,
+) -> LimitPolicyOverride:
+    rule = limit_policy.get_rule(rule_code)
+    subject_value = limit_policy.validate_whitelist_subject(
+        subject_type, subject_value
+    )
+    limit_policy.validate_override(
+        rule,
+        subject_type=subject_type,
+        mode=mode,
+        limit_value=limit_value,
+        starts_at=starts_at,
+        expires_at=expires_at,
+    )
+    existing = db.execute(
+        select(LimitPolicyOverride).where(
+            LimitPolicyOverride.subject_type == subject_type,
+            LimitPolicyOverride.subject_value == subject_value,
+            LimitPolicyOverride.rule_code == rule_code,
+        )
+    ).scalar_one_or_none()
+    if existing is not None:
+        if (
+            not reactivate_inactive
+            or status_of(existing) not in {"disabled", "expired"}
+        ):
+            raise DuplicateOverrideError
+        # “恢复全局”与自然过期都会保留原行供审计。再次加入白名单时
+        # 复用该行，避免唯一键让批量新增永久失败；完整变更仍写 admin 审计日志。
+        existing.mode = mode
+        existing.limit_value = (
+            limit_value if mode == limit_policy.MODE_OVERRIDE else None
+        )
+        existing.enabled = enabled
+        existing.starts_at = starts_at
+        existing.expires_at = expires_at
+        existing.reset_at = None
+        existing.reason = reason.strip() or None
+        db.flush()
+        return existing
+
+    row = LimitPolicyOverride(
+        subject_type=subject_type,
+        subject_value=subject_value,
+        rule_code=rule_code,
+        mode=mode,
+        limit_value=limit_value if mode == limit_policy.MODE_OVERRIDE else None,
+        enabled=enabled,
+        starts_at=starts_at,
+        expires_at=expires_at,
+        reason=reason.strip() or None,
+        created_by_admin_id=admin_id,
+    )
+    db.add(row)
+    try:
+        db.flush()
+    except IntegrityError as exc:
+        db.rollback()
+        raise DuplicateOverrideError from exc
+    return row
+
+
+def update(
+    db: Session,
+    row: LimitPolicyOverride,
+    *,
+    enabled: bool | None,
+    starts_at: datetime | None,
+    expires_at: datetime | None,
+    reason: str | None,
+    fields_set: set[str],
+) -> LimitPolicyOverride:
+    new_starts = starts_at if "starts_at" in fields_set else row.starts_at
+    new_expires = expires_at if "expires_at" in fields_set else row.expires_at
+    new_enabled = enabled if "enabled" in fields_set and enabled is not None else row.enabled
+    rule = limit_policy.get_rule(row.rule_code)
+    if row.mode == limit_policy.MODE_OVERRIDE and new_enabled:
+        raise ValueError("历史覆盖配置只能停用、恢复全局或删除")
+    if new_enabled:
+        limit_policy.validate_override(
+            rule,
+            subject_type=row.subject_type,
+            mode=row.mode,
+            limit_value=None,
+            starts_at=new_starts,
+            expires_at=new_expires,
+        )
+    if "enabled" in fields_set and enabled is not None:
+        row.enabled = enabled
+    if "starts_at" in fields_set:
+        row.starts_at = starts_at
+    if "expires_at" in fields_set:
+        row.expires_at = expires_at
+    if "reason" in fields_set:
+        row.reason = reason.strip() if reason else None
+    db.flush()
+    return row
+
+
+def update_global_limit(
+    db: Session, rule_code: str, value: int, *, admin_id: int
+) -> tuple[int, int]:
+    rule = limit_policy.get_rule(rule_code)
+    if not rule.min_value <= value <= rule.max_value:
+        raise ValueError(
+            f"限制值必须在 {rule.min_value} 到 {rule.max_value} 之间"
+        )
+    before = limit_policy.resolve(db, rule_code).global_limit
+    app_config.set_value(db, rule.config_key, value, admin_id=admin_id, commit=False)
+    # 引导视频仍有一个旧的专用配置页。同步其结构化配置，保证两个入口读取
+    # 同一数值；业务判定仍统一走 limit_policy。
+    if rule.legacy_config_key and rule.legacy_json_field:
+        legacy = db.get(AppConfig, rule.legacy_config_key)
+        legacy_value = (
+            dict(legacy.value)
+            if legacy is not None and isinstance(legacy.value, dict)
+            else {}
+        )
+        legacy_value[rule.legacy_json_field] = value
+        if legacy is None:
+            legacy = AppConfig(
+                key=rule.legacy_config_key,
+                value=legacy_value,
+                updated_by_admin_id=admin_id,
+            )
+            db.add(legacy)
+        else:
+            legacy.value = legacy_value
+            legacy.updated_by_admin_id = admin_id
+        db.flush()
+    return before, value
+
+
+def restore_global(row: LimitPolicyOverride) -> LimitPolicyOverride:
+    """Stop applying the exception while retaining its history for audit."""
+
+    row.enabled = False
+    row.reset_at = None
+    return row

app/admin/repositories/queries.py

@@ -14,6 +14,7 @@ from sqlalchemy.orm import Session
 
 from app.core import rewards
 from app.core.config import settings
+from app.models.ad_ecpm import AdEcpmRecord
 from app.models.ad_feed_reward import AdFeedRewardRecord
 from app.models.ad_reward import AdRewardRecord
 from app.models.admin import AdminAuditLog
@@ -1257,11 +1258,15 @@ def user_reward_stats(
     date_from: datetime | None = None,
     date_to: datetime | None = None,
     withdraw_source: str | None = None,
+    app_env: str | None = None,
+    revenue_scope: str = "all",
+    feed_scene: str | None = None,
 ) -> dict:
     """提现详情「用户统计区」10 项。窗口作用于除「现金余额」外的所有项(余额是当前快照)。
 
-    口径:激励视频/信息流只统计 granted;数量——视频按条数、信息流按份数(unit_count 累加);
-    平均 eCPM 用原始分值(分/千次)按记录取算术平均;各「提现」= 该来源累计金币折现。
+    口径:激励视频/信息流奖励数量只统计 granted;数量——视频按条数、信息流按份数(unit_count 累加)。
+    平均 Draw eCPM 与广告收益报表一致:基于 ad_ecpm_record 的全部 draw/feed 展示记录计算，
+    不以是否发奖为筛选条件。各「提现」= 该来源累计金币折现。
     传统任务 = 窗口内正向金币中,排除广告(reward_video/feed_ad_reward)与人工调整后的折现。
     """
     withdraw_source_conds = (
@@ -1296,30 +1301,68 @@ def user_reward_stats(
 
     # 只投影本统计实际使用的列。避免滚动发布或旧本地库尚未补齐无关新列时，
     # SQLAlchemy 因 select(ORM) 自动展开整表字段而让提现详情整体 500。
+    business_ids: set[str] | None = None
+    if revenue_scope == "business":
+        # 与广告收益报表共用正式/测试业务代码位集合，避免两个页面随配置切换后再次漂移。
+        from app.admin.repositories.ad_revenue import business_code_ids
+
+        business_ids = business_code_ids(db, app_env)
+
+    rv_conds = [
+        AdRewardRecord.user_id == user_id,
+        AdRewardRecord.reward_scene == "reward_video",
+        AdRewardRecord.status == "granted",
+        *_window_conds(AdRewardRecord.created_at, date_from, date_to),
+    ]
+    if app_env is not None:
+        rv_conds.append(AdRewardRecord.app_env == app_env)
+    if business_ids is not None:
+        rv_conds.append(AdRewardRecord.our_code_id.in_(business_ids))
     rv = db.execute(
         select(AdRewardRecord.ecpm_raw, AdRewardRecord.coin).where(
-            AdRewardRecord.user_id == user_id,
-            AdRewardRecord.reward_scene == "reward_video",
-            AdRewardRecord.status == "granted",
-            *_window_conds(AdRewardRecord.created_at, date_from, date_to),
+            *rv_conds,
         )
     ).all()
     rv_ecpms = [rewards.parse_ecpm_fen(r.ecpm_raw) for r in rv if r.ecpm_raw]
     rv_coins = sum(r.coin for r in rv)
 
-    feed = db.execute(
+    feed_reward_conds = [
+        AdFeedRewardRecord.user_id == user_id,
+        AdFeedRewardRecord.status == "granted",
+        *_window_conds(AdFeedRewardRecord.created_at, date_from, date_to),
+    ]
+    if app_env is not None:
+        feed_reward_conds.append(AdFeedRewardRecord.app_env == app_env)
+    if feed_scene is not None:
+        feed_reward_conds.append(AdFeedRewardRecord.feed_scene == feed_scene)
+    if business_ids is not None:
+        feed_reward_conds.append(AdFeedRewardRecord.our_code_id.in_(business_ids))
+    feed_rewards = db.execute(
         select(
             AdFeedRewardRecord.unit_count,
-            AdFeedRewardRecord.ecpm_raw,
             AdFeedRewardRecord.coin,
         ).where(
-            AdFeedRewardRecord.user_id == user_id,
-            AdFeedRewardRecord.status == "granted",
-            *_window_conds(AdFeedRewardRecord.created_at, date_from, date_to),
+            *feed_reward_conds,
         )
     ).all()
-    feed_ecpms = [rewards.parse_ecpm_fen(f.ecpm_raw) for f in feed if f.ecpm_raw]
-    feed_coins = sum(f.coin for f in feed)
+    feed_coins = sum(f.coin for f in feed_rewards)
+
+    feed_impression_conds = [
+        AdEcpmRecord.user_id == user_id,
+        AdEcpmRecord.ad_type.in_(("draw", "feed")),
+        *_window_conds(AdEcpmRecord.created_at, date_from, date_to),
+    ]
+    if app_env is not None:
+        feed_impression_conds.append(AdEcpmRecord.app_env == app_env)
+    if feed_scene is not None:
+        feed_impression_conds.append(AdEcpmRecord.feed_scene == feed_scene)
+    if business_ids is not None:
+        feed_impression_conds.append(AdEcpmRecord.our_code_id.in_(business_ids))
+    feed_impressions = db.execute(
+        select(AdEcpmRecord.ecpm_raw).where(*feed_impression_conds)
+    ).all()
+    # 与 ad_revenue.category_stats 相同:每次展示权重相同，非法原值按 parse_ecpm_fen 记 0。
+    feed_ecpms = [rewards.parse_ecpm_fen(row.ecpm_raw) for row in feed_impressions]
 
     trad_coins = db.execute(
         select(func.coalesce(func.sum(CoinTransaction.amount), 0)).where(
@@ -1338,7 +1381,7 @@ def user_reward_stats(
         "reward_video_count": len(rv),
         "reward_video_avg_ecpm": round(sum(rv_ecpms) / len(rv_ecpms), 2) if rv_ecpms else 0.0,
         "reward_video_cash_cents": _coins_to_cents(rv_coins),
-        "feed_count": int(sum(f.unit_count for f in feed)),
+        "feed_count": int(sum(f.unit_count for f in feed_rewards)),
         "feed_avg_ecpm": round(sum(feed_ecpms) / len(feed_ecpms), 2) if feed_ecpms else 0.0,
         "feed_cash_cents": _coins_to_cents(feed_coins),
     }

app/admin/routers/config.py

@@ -12,7 +12,11 @@ from fastapi import APIRouter, Depends, HTTPException, Request
 from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
 from app.admin.schemas.config import ConfigItemOut, ConfigUpdateRequest
-from app.core.config_schema import CONFIG_DEFS
+from app.core.config_schema import (
+    AD_FEED_DAILY_LIMIT_KEY,
+    AD_REWARD_VIDEO_DAILY_LIMIT_KEY,
+    CONFIG_DEFS,
+)
 from app.core.rewards import SIGNIN_CYCLE_LEN
 from app.models.admin import AdminUser
 from app.repositories import app_config
@@ -88,6 +92,23 @@ def update_config(
 
     before = app_config.get_value(db, key)
     app_config.set_value(db, key, body.value, admin_id=admin.id, commit=False)
+    if key == "ad_daily_limit":
+        # 旧系统配置接口过去只有一个广告日上限。仍有人直接调用时，同时同步
+        # 新的激励视频/Draw 两项，避免旧入口写入后业务实际值不变。
+        app_config.set_value(
+            db,
+            AD_REWARD_VIDEO_DAILY_LIMIT_KEY,
+            body.value,
+            admin_id=admin.id,
+            commit=False,
+        )
+        app_config.set_value(
+            db,
+            AD_FEED_DAILY_LIMIT_KEY,
+            body.value,
+            admin_id=admin.id,
+            commit=False,
+        )
     write_audit(
         db, admin, action="config.set", target_type="config", target_id=key,
         detail={"before": before, "after": body.value}, ip=get_client_ip(request), commit=False,

app/admin/routers/guide_video.py

@@ -9,7 +9,7 @@ client_max_body_size,见 shaguabijia-admin-web/deploy/nginx/admin.shaguabijia.co
 """
 from __future__ import annotations
 
-from typing import Annotated
+from typing import Annotated, Literal
 
 from fastapi import APIRouter, Depends, File, HTTPException, Request, UploadFile
 
@@ -26,15 +26,21 @@ router = APIRouter(
     dependencies=[Depends(get_current_admin)],
 )
 
+GuideScene = Literal["coupon", "comparison"]
 
-def _out(db: AdminDb) -> GuideVideoConfigOut:
+
+def _out(db: AdminDb, scene: GuideScene) -> GuideVideoConfigOut:
     """配置 + 播放统计合成响应(四个写接口都以最新状态返回,前端一次同步到位)。"""
-    return GuideVideoConfigOut(**guide_video.get_config(db), **guide_video.play_stats(db))
+    return GuideVideoConfigOut(
+        scene=scene,
+        **guide_video.get_config(db, scene),
+        **guide_video.play_stats(db, scene),
+    )
 
 
 @router.get("", response_model=GuideVideoConfigOut, summary="新手引导视频配置(领券浮层)")
-def get_config(db: AdminDb) -> GuideVideoConfigOut:
-    return _out(db)
+def get_config(db: AdminDb, scene: GuideScene = "coupon") -> GuideVideoConfigOut:
+    return _out(db, scene)
 
 
 @router.patch("", response_model=GuideVideoConfigOut, summary="改开关/次数/金币(带审计)")
@@ -43,21 +49,24 @@ def update_config(
     request: Request,
     admin: Annotated[AdminUser, Depends(require_role("operator"))],
     db: AdminDb,
+    scene: GuideScene = "coupon",
 ) -> GuideVideoConfigOut:
     before, after = guide_video.update_config(
         db,
         enabled=body.enabled,
         max_plays=body.max_plays,
         reward_coin=body.reward_coin,
+        scene=scene,
         admin_id=admin.id,
         commit=False,
     )
     write_audit(
         db, admin, action="guide_video.update", target_type="guide_video", target_id=None,
-        detail={"before": before, "after": after}, ip=get_client_ip(request), commit=False,
+        detail={"scene": scene, "before": before, "after": after},
+        ip=get_client_ip(request), commit=False,
     )
     db.commit()
-    return _out(db)
+    return _out(db, scene)
 
 
 @router.post("/video", response_model=GuideVideoConfigOut, summary="上传新手引导视频(MP4,带审计)")
@@ -65,23 +74,31 @@ async def upload_video(
     request: Request,
     admin: Annotated[AdminUser, Depends(require_role("operator"))],
     db: AdminDb,
-    file: UploadFile = File(...),
+    file: Annotated[UploadFile, File()],
+    scene: GuideScene = "coupon",
 ) -> GuideVideoConfigOut:
     data = await file.read()
     try:
         url = media.save_guide_video(data)
     except media.MediaError as e:
         raise HTTPException(status_code=400, detail=str(e)) from e
-    before, after = guide_video.set_video(db, url, admin_id=admin.id, commit=False)
+    before, after = guide_video.set_video(
+        db, url, scene=scene, admin_id=admin.id, commit=False
+    )
     write_audit(
         db, admin, action="guide_video.set_video", target_type="guide_video", target_id=None,
-        detail={"before": before.get("video_url"), "after": url, "bytes": len(data)},
+        detail={
+            "scene": scene,
+            "before": before.get("video_url"),
+            "after": url,
+            "bytes": len(data),
+        },
         ip=get_client_ip(request), commit=False,
     )
     db.commit()
     # 提交成功后再删旧片,避免新片没落库就把旧片丢了
     media.delete_guide_video(before.get("video_url"))
-    return _out(db)
+    return _out(db, scene)
 
 
 @router.delete("/video", response_model=GuideVideoConfigOut, summary="移除新手引导视频(带审计)")
@@ -89,13 +106,17 @@ def delete_video(
     request: Request,
     admin: Annotated[AdminUser, Depends(require_role("operator"))],
     db: AdminDb,
+    scene: GuideScene = "coupon",
 ) -> GuideVideoConfigOut:
     """移除后 /guide-video/start 一律返回 should_play=false,领券浮层回到「只放广告」。"""
-    before, after = guide_video.set_video(db, None, admin_id=admin.id, commit=False)
+    before, after = guide_video.set_video(
+        db, None, scene=scene, admin_id=admin.id, commit=False
+    )
     write_audit(
         db, admin, action="guide_video.delete_video", target_type="guide_video", target_id=None,
-        detail={"before": before.get("video_url")}, ip=get_client_ip(request), commit=False,
+        detail={"scene": scene, "before": before.get("video_url")},
+        ip=get_client_ip(request), commit=False,
     )
     db.commit()
     media.delete_guide_video(before.get("video_url"))
-    return _out(db)
+    return _out(db, scene)

app/admin/routers/limit_whitelist.py

@@ -0,0 +1,361 @@
+"""Unified limit rules and per-phone/device whitelist overrides."""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request, status
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, CurrentAdmin, get_client_ip, require_page
+from app.admin.repositories import limit_whitelist as repo
+from app.admin.schemas.limit_whitelist import (
+    DeviceCandidateOut,
+    GlobalLimitUpdate,
+    LimitOverrideBulkWrite,
+    LimitOverrideList,
+    LimitOverrideOut,
+    LimitOverridePatch,
+    LimitOverrideWrite,
+    LimitRuleOut,
+)
+from app.core import limit_policy
+from app.models.limit_policy import LimitPolicyOverride
+from app.repositories import risk as risk_repo
+
+router = APIRouter(
+    prefix="/admin/api/limit-whitelist",
+    tags=["admin-limit-whitelist"],
+    dependencies=[Depends(require_page("limit-whitelist"))],
+)
+
+def _reconcile_risk_rule(db, rule_code: str) -> None:
+    now = risk_repo.utcnow()
+    if rule_code == "risk.sms.hourly":
+        risk_repo.reconcile_behavior_rule(
+            db,
+            rule_code=risk_repo.RULE_SMS_HOURLY,
+            at=now,
+            commit=False,
+        )
+    elif rule_code == "risk.oneclick.daily":
+        risk_repo.reconcile_behavior_rule(
+            db,
+            rule_code=risk_repo.RULE_ONECLICK_DAILY,
+            at=now,
+            commit=False,
+        )
+    elif rule_code == "risk.compare.daily":
+        risk_repo.reconcile_compare_rule(db, at=now, commit=False)
+
+
+def _row_or_404(db, override_id: int) -> LimitPolicyOverride:
+    row = db.get(LimitPolicyOverride, override_id)
+    if row is None:
+        raise HTTPException(status_code=404, detail="白名单配置不存在")
+    return row
+
+
+def _out(db, row: LimitPolicyOverride) -> LimitOverrideOut:
+    return LimitOverrideOut(**repo.to_dict(db, row))
+
+
+def _audit_payload(value: LimitOverrideOut) -> dict:
+    return value.model_dump(mode="json")
+
+
+@router.get("/rules", response_model=list[LimitRuleOut], summary="读取所有限制规则")
+def list_rules(db: AdminDb) -> list[LimitRuleOut]:
+    return [LimitRuleOut(**item) for item in limit_policy.rule_catalog(db)]
+
+
+@router.patch(
+    "/rules/{rule_code}",
+    response_model=LimitRuleOut,
+    summary="修改规则的全局限制值",
+)
+def update_rule(
+    rule_code: str,
+    body: GlobalLimitUpdate,
+    request: Request,
+    admin: CurrentAdmin,
+    db: AdminDb,
+) -> LimitRuleOut:
+    try:
+        before, after = repo.update_global_limit(
+            db, rule_code, body.value, admin_id=admin.id
+        )
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail="未知限制规则") from exc
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    _reconcile_risk_rule(db, rule_code)
+    write_audit(
+        db,
+        admin,
+        action="limit.rule.update",
+        target_type="limit_rule",
+        target_id=rule_code,
+        detail={"before": before, "after": after},
+        ip=get_client_ip(request),
+        commit=False,
+    )
+    db.commit()
+    item = next(
+        item for item in limit_policy.rule_catalog(db) if item["code"] == rule_code
+    )
+    return LimitRuleOut(**item)
+
+
+@router.get(
+    "/device-candidates",
+    response_model=list[DeviceCandidateOut],
+    summary="按限制项搜索可加入白名单的设备",
+)
+def list_device_candidates(
+    db: AdminDb,
+    rule_code: str = Query(..., min_length=1, max_length=64),
+    keyword: str | None = Query(None, max_length=128),
+    limit: int = Query(30, ge=1, le=50),
+) -> list[DeviceCandidateOut]:
+    try:
+        rows = repo.list_device_candidates(
+            db,
+            rule_code=rule_code,
+            keyword=keyword,
+            limit=limit,
+        )
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail="未知限制规则") from exc
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    return [DeviceCandidateOut(**row) for row in rows]
+
+
+@router.get("", response_model=LimitOverrideList, summary="读取白名单配置")
+def list_overrides(
+    db: AdminDb,
+    subject_type: str | None = Query(None, pattern="^(phone|device)$"),
+    keyword: str | None = Query(None, max_length=128),
+    rule_code: str | None = Query(None, max_length=64),
+    offset: int = Query(0, ge=0),
+    limit: int = Query(100, ge=1, le=500),
+) -> LimitOverrideList:
+    rows, total = repo.list_rows(
+        db,
+        subject_type=subject_type,
+        keyword=keyword,
+        rule_code=rule_code,
+        offset=offset,
+        limit=limit,
+    )
+    return LimitOverrideList(items=[_out(db, row) for row in rows], total=total)
+
+
+@router.post(
+    "",
+    response_model=LimitOverrideOut,
+    status_code=status.HTTP_201_CREATED,
+    summary="新增白名单配置",
+)
+def create_override(
+    body: LimitOverrideWrite,
+    request: Request,
+    admin: CurrentAdmin,
+    db: AdminDb,
+) -> LimitOverrideOut:
+    try:
+        row = repo.create(
+            db,
+            **body.model_dump(),
+            limit_value=None,
+            admin_id=admin.id,
+        )
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail="未知限制规则") from exc
+    except repo.DuplicateOverrideError as exc:
+        raise HTTPException(
+            status_code=409,
+            detail="该手机号或设备已配置此规则，请编辑现有配置",
+        ) from exc
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    _reconcile_risk_rule(db, row.rule_code)
+    result = _out(db, row)
+    write_audit(
+        db,
+        admin,
+        action="limit.override.create",
+        target_type="limit_override",
+        target_id=str(row.id),
+        detail={"after": _audit_payload(result)},
+        ip=get_client_ip(request),
+        commit=False,
+    )
+    db.commit()
+    return _out(db, row)
+
+
+@router.post(
+    "/bulk",
+    response_model=list[LimitOverrideOut],
+    status_code=status.HTTP_201_CREATED,
+    summary="批量新增临时不限或免告警白名单",
+)
+def create_overrides_bulk(
+    body: LimitOverrideBulkWrite,
+    request: Request,
+    admin: CurrentAdmin,
+    db: AdminDb,
+) -> list[LimitOverrideOut]:
+    rows: list[LimitPolicyOverride] = []
+    current_rule_code = ""
+    try:
+        if body.subject_type == limit_policy.SUBJECT_DEVICE:
+            limit_policy.validate_device_rule_scope(body.rule_codes)
+        for current_rule_code in body.rule_codes:
+            rule = limit_policy.get_rule(current_rule_code)
+            mode = (
+                limit_policy.MODE_SUPPRESS_ALERT
+                if rule.alert_only
+                else limit_policy.MODE_UNLIMITED
+            )
+            rows.append(
+                repo.create(
+                    db,
+                    subject_type=body.subject_type,
+                    subject_value=body.subject_value,
+                    rule_code=current_rule_code,
+                    mode=mode,
+                    limit_value=None,
+                    enabled=body.enabled,
+                    starts_at=body.starts_at,
+                    expires_at=body.expires_at,
+                    reason=body.reason,
+                    admin_id=admin.id,
+                    reactivate_inactive=True,
+                )
+            )
+    except KeyError as exc:
+        raise HTTPException(status_code=404, detail="未知限制规则") from exc
+    except repo.DuplicateOverrideError as exc:
+        rule = limit_policy.get_rule(current_rule_code)
+        raise HTTPException(
+            status_code=409,
+            detail=f"“{rule.label}”已有白名单配置，请编辑或重置现有配置",
+        ) from exc
+    except ValueError as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+
+    for row in rows:
+        _reconcile_risk_rule(db, row.rule_code)
+    results = [_out(db, row) for row in rows]
+    write_audit(
+        db,
+        admin,
+        action="limit.override.bulk_create",
+        target_type="limit_override",
+        target_id=",".join(str(row.id) for row in rows),
+        detail={"after": [_audit_payload(item) for item in results]},
+        ip=get_client_ip(request),
+        commit=False,
+    )
+    db.commit()
+    return [_out(db, row) for row in rows]
+
+
+@router.patch(
+    "/{override_id}",
+    response_model=LimitOverrideOut,
+    summary="编辑白名单配置",
+)
+def update_override(
+    override_id: int,
+    body: LimitOverridePatch,
+    request: Request,
+    admin: CurrentAdmin,
+    db: AdminDb,
+) -> LimitOverrideOut:
+    row = _row_or_404(db, override_id)
+    before = _audit_payload(_out(db, row))
+    try:
+        repo.update(
+            db,
+            row,
+            **body.model_dump(),
+            fields_set=set(body.model_fields_set),
+        )
+    except (KeyError, ValueError) as exc:
+        raise HTTPException(status_code=400, detail=str(exc)) from exc
+    _reconcile_risk_rule(db, row.rule_code)
+    after = _out(db, row)
+    write_audit(
+        db,
+        admin,
+        action="limit.override.update",
+        target_type="limit_override",
+        target_id=str(row.id),
+        detail={"before": before, "after": _audit_payload(after)},
+        ip=get_client_ip(request),
+        commit=False,
+    )
+    db.commit()
+    return _out(db, row)
+
+
+@router.post(
+    "/{override_id}/reset",
+    response_model=LimitOverrideOut,
+    summary="停用例外配置并恢复全局策略",
+)
+def restore_global_policy(
+    override_id: int,
+    request: Request,
+    admin: CurrentAdmin,
+    db: AdminDb,
+) -> LimitOverrideOut:
+    row = _row_or_404(db, override_id)
+    before = _audit_payload(_out(db, row))
+    repo.restore_global(row)
+    _reconcile_risk_rule(db, row.rule_code)
+    after = _out(db, row)
+    write_audit(
+        db,
+        admin,
+        action="limit.override.restore_global",
+        target_type="limit_override",
+        target_id=str(row.id),
+        detail={"before": before, "after": _audit_payload(after)},
+        ip=get_client_ip(request),
+        commit=False,
+    )
+    db.commit()
+    return _out(db, row)
+
+
+@router.delete(
+    "/{override_id}",
+    status_code=status.HTTP_204_NO_CONTENT,
+    summary="删除白名单配置",
+)
+def delete_override(
+    override_id: int,
+    request: Request,
+    admin: CurrentAdmin,
+    db: AdminDb,
+) -> None:
+    row = _row_or_404(db, override_id)
+    before = _audit_payload(_out(db, row))
+    target_id = str(row.id)
+    rule_code = row.rule_code
+    db.delete(row)
+    db.flush()
+    _reconcile_risk_rule(db, rule_code)
+    write_audit(
+        db,
+        admin,
+        action="limit.override.delete",
+        target_type="limit_override",
+        target_id=target_id,
+        detail={"before": before},
+        ip=get_client_ip(request),
+        commit=False,
+    )
+    db.commit()

app/admin/routers/users.py

@@ -88,6 +88,11 @@ def get_user_reward_stats(
     withdraw_source: Annotated[
         str | None, Query(pattern="^(coin_cash|invite_cash)$")
     ] = None,
+    app_env: Annotated[str | None, Query(pattern="^(prod|test)$")] = None,
+    revenue_scope: Annotated[str, Query(pattern="^(business|all)$")] = "all",
+    feed_scene: Annotated[
+        str | None, Query(pattern="^(comparison|coupon|welfare)$")
+    ] = None,
 ) -> UserRewardStats:
     """提现详情抽屉「用户统计区」。date_from/date_to 都不传 = 注册至今(全量)。"""
     if not user_repo.user_exists(db, user_id):
@@ -99,6 +104,9 @@ def get_user_reward_stats(
             date_from=date_from,
             date_to=date_to,
             withdraw_source=withdraw_source,
+            app_env=app_env,
+            revenue_scope=revenue_scope,
+            feed_scene=feed_scene,
         )
     )
 

app/admin/schemas/guide_video.py

@@ -7,6 +7,7 @@ from app.repositories.guide_video import MAX_PLAYS_LIMIT, REWARD_COIN_LIMIT
 
 
 class GuideVideoConfigOut(BaseModel):
+    scene: str
     enabled: bool
     video_url: str | None = None   # 相对地址 /media/guide_video/xxx.mp4;未配片 = None
     max_plays: int

app/admin/schemas/limit_whitelist.py

@@ -0,0 +1,127 @@
+"""Admin contracts for global limit rules and per-subject overrides."""
+from __future__ import annotations
+
+from datetime import UTC, datetime
+from typing import Literal
+
+from pydantic import BaseModel, ConfigDict, Field, model_validator
+
+SubjectType = Literal["phone", "device"]
+PolicyMode = Literal["unlimited", "suppress_alert"]
+
+
+class LimitRuleOut(BaseModel):
+    code: str
+    label: str
+    group: str
+    global_limit: int
+    default_limit: int
+    window_label: str
+    subject_types: list[str]
+    allowed_modes: list[str]
+    min_value: int
+    max_value: int
+    supports_reset: bool
+    alert_only: bool
+
+
+class GlobalLimitUpdate(BaseModel):
+    value: int = Field(ge=0, le=1_000_000)
+
+
+class DeviceCandidateOut(BaseModel):
+    device_id: str
+    source: str
+    source_label: str
+    user_id: int | None = None
+    username: str | None = None
+    phone: str | None = None
+    nickname: str | None = None
+    device_model: str | None = None
+    last_active_at: datetime
+
+
+class LimitOverrideWrite(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    subject_type: SubjectType
+    subject_value: str = Field(min_length=1, max_length=128)
+    rule_code: str = Field(min_length=1, max_length=64)
+    mode: PolicyMode
+    enabled: bool = True
+    starts_at: datetime | None = None
+    expires_at: datetime | None = None
+    reason: str = Field("", max_length=256)
+
+    @model_validator(mode="after")
+    def validate_time_range(self):
+        if self.starts_at and self.expires_at and self.expires_at <= self.starts_at:
+            raise ValueError("失效时间必须晚于生效时间")
+        return self
+
+
+class LimitOverrideBulkWrite(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    subject_type: SubjectType
+    subject_value: str = Field(min_length=1, max_length=128)
+    rule_codes: list[str] = Field(min_length=1, max_length=32)
+    enabled: bool = True
+    starts_at: datetime | None = None
+    expires_at: datetime
+    reason: str = Field("", max_length=256)
+
+    @model_validator(mode="after")
+    def validate_bulk_request(self):
+        self.rule_codes = list(dict.fromkeys(self.rule_codes))
+        starts_at = (
+            self.starts_at.replace(tzinfo=UTC)
+            if self.starts_at and self.starts_at.tzinfo is None
+            else self.starts_at
+        )
+        expires_at = (
+            self.expires_at.replace(tzinfo=UTC)
+            if self.expires_at.tzinfo is None
+            else self.expires_at
+        )
+        if starts_at and expires_at <= starts_at:
+            raise ValueError("失效时间必须晚于生效时间")
+        if expires_at <= datetime.now(UTC):
+            raise ValueError("失效时间必须晚于当前时间")
+        return self
+
+
+class LimitOverridePatch(BaseModel):
+    model_config = ConfigDict(extra="forbid")
+
+    enabled: bool | None = None
+    starts_at: datetime | None = None
+    expires_at: datetime | None = None
+    reason: str | None = Field(None, max_length=256)
+
+
+class LimitOverrideOut(BaseModel):
+    id: int
+    subject_type: str
+    subject_value: str
+    rule_code: str
+    rule_label: str
+    rule_group: str
+    mode: str
+    limit_value: int | None
+    global_limit: int
+    effective_limit: int | None
+    enabled: bool
+    starts_at: datetime | None
+    expires_at: datetime | None
+    reset_at: datetime | None
+    reason: str | None
+    status: str
+    created_by_admin_id: int | None
+    created_at: datetime
+    updated_at: datetime
+
+
+class LimitOverrideList(BaseModel):
+    items: list[LimitOverrideOut]
+    total: int

app/admin/schemas/risk_monitor.py

@@ -21,9 +21,9 @@ class RiskMonitorSummary(BaseModel):
 
 
 class RiskRuleConfig(BaseModel):
-    sms_hourly_threshold: int = Field(ge=1, le=5)
+    sms_hourly_threshold: int = Field(ge=1, le=100_000)
     oneclick_daily_threshold: int = Field(ge=1, le=100_000)
-    compare_daily_threshold: int = Field(ge=1, le=100)
+    compare_daily_threshold: int = Field(ge=1, le=100_000)
 
 
 class RiskIncidentItem(BaseModel):

app/admin/schemas/user.py

@@ -60,7 +60,7 @@ class UserRewardStats(BaseModel):
     reward_video_avg_ecpm: float  # 平均激励视频 eCPM(分/千次)
     reward_video_cash_cents: int  # 激励视频提现(金币折现)
     feed_count: int  # 累计信息流广告数(granted 份数,unit_count 累加)
-    feed_avg_ecpm: float  # 平均信息流广告 eCPM(分/千次)
+    feed_avg_ecpm: float  # 全部 Draw/feed 实际展示的平均 eCPM(分/千次,含未发奖展示)
     feed_cash_cents: int  # 信息流广告提现(金币折现)
 
 

app/api/v1/ad.py

@@ -18,7 +18,7 @@ import uuid
 from fastapi import APIRouter, Depends, HTTPException, Path, Request, status
 
 from app.api.deps import CurrentUser, DbSession
-from app.core import rewards
+from app.core import limit_policy, rewards
 from app.core.config import settings
 from app.core.ratelimit import rate_limit
 from app.integrations import pangle
@@ -413,12 +413,23 @@ def feed_reward(payload: FeedRewardIn, user: CurrentUser, db: DbSession) -> Feed
         "feed ad reward user_id=%d event=%s status=%s units=%d coin=%d",
         user.id, rec.client_event_id, rec.status, rec.unit_count, rec.coin,
     )
+    feed_policy = limit_policy.resolve_for_user(db, "ad.feed.daily", user.id)
+    feed_limit = (
+        rewards.get_ad_daily_limit(db)
+        if feed_policy.override_id is None
+        and feed_policy.bucket_version == "default"
+        else feed_policy.limit
+    )
     return FeedRewardOut(
         granted=(rec.status == "granted"),
         status=rec.status,
         coin=rec.coin,
         unit_count=rec.unit_count,
-        daily_limit=rewards.get_ad_daily_limit(db),
+        daily_limit=(
+            feed_limit
+            if feed_limit is not None
+            else limit_policy.get_rule("ad.feed.daily").max_value
+        ),
     )
 
 

app/api/v1/auth.py

@@ -16,7 +16,7 @@ from fastapi import APIRouter, HTTPException, Request
 from sqlalchemy.exc import IntegrityError
 
 from app.api.deps import CurrentUser, DbSession
-from app.core import test_account
+from app.core import limit_policy, test_account
 from app.core.ratelimit import (
     RateLimitRule,
     check_rate_limits,
@@ -69,6 +69,7 @@ SMS_LOGIN_MAX_PER_HOUR = 5
 # 堵「换手机号绕开单号 60s 冷却」的洞 —— 冷却是单号维度,一机换号能绕开。
 SMS_SEND_MAX_PER_HOUR_PER_DEVICE = 5     # 每小时上限
 SMS_SEND_MAX_PER_DAY_PER_DEVICE = 20     # 每天上限(再叠一层日封顶,挡低频长时间轰炸)
+UNLIMITED_VERIFY_ATTEMPTS = 2_147_483_647
 
 
 def _client_ip(request: Request) -> str:
@@ -198,16 +199,53 @@ def sms_send(req: SmsSendRequest, request: Request, db: DbSession) -> SmsSendRes
     # 补「换手机号绕开单号 60s 冷却」的洞(冷却是单号维度,一机换号能绕);设备维度按机器封顶,挡短信轰炸/烧钱。
     # 关键:被单号 60s 冷却挡下的重发是「没真发、没烧钱」→ 不该占额度。故 check(先判)放在真发之前
     # (超限直接 429、不真发),record(计数)只在 send_code 成功后调 —— 冷却/供应商失败抛 429 时直接返回、不计数。
+    hourly_policy = limit_policy.resolve(
+        db,
+        "sms.send.hourly",
+        phone=req.phone,
+        device=subject_id,
+    )
+    daily_policy = limit_policy.resolve(
+        db,
+        "sms.send.daily",
+        phone=req.phone,
+        device=subject_id,
+    )
+    cooldown_policy = limit_policy.resolve(
+        db,
+        "sms.phone.cooldown",
+        phone=req.phone,
+    )
+    hourly_limit = (
+        SMS_SEND_MAX_PER_HOUR_PER_DEVICE
+        if hourly_policy.override_id is None
+        and hourly_policy.bucket_version == "default"
+        else hourly_policy.limit
+    )
+    daily_limit = (
+        SMS_SEND_MAX_PER_DAY_PER_DEVICE
+        if daily_policy.override_id is None
+        and daily_policy.bucket_version == "default"
+        else daily_policy.limit
+    )
     send_rules = [
-        RateLimitRule("sms-send-device", SMS_SEND_MAX_PER_HOUR_PER_DEVICE, 3600,
-                      "操作过于频繁,请稍后再试"),
-        RateLimitRule("sms-send-device-daily", SMS_SEND_MAX_PER_DAY_PER_DEVICE, 86400,
-                      "今日验证码发送次数过多,请明天再试"),
+        RateLimitRule("sms-send-device", hourly_limit, 3600,
+                      "操作过于频繁,请稍后再试", hourly_policy.bucket_version),
+        RateLimitRule("sms-send-device-daily", daily_limit, 86400,
+                      "今日验证码发送次数过多,请明天再试", daily_policy.bucket_version),
     ]
-    check_rate_limits(request, subject=req.device_id, rules=send_rules)
+    check_rate_limits(request, subject=subject_id, rules=send_rules)
 
     try:
-        cooldown = send_code(req.phone)
+        cooldown = send_code(
+            req.phone,
+            cooldown_sec=(
+                None
+                if cooldown_policy.override_id is None
+                and cooldown_policy.bucket_version == "default"
+                else (0 if cooldown_policy.limit is None else cooldown_policy.limit)
+            ),
+        )
     except SmsError as e:
         risk_repo.record_behavior_event(
             db,
@@ -224,7 +262,7 @@ def sms_send(req: SmsSendRequest, request: Request, db: DbSession) -> SmsSendRes
         raise HTTPException(status_code=e.status_code, detail=str(e)) from e
 
     # 发码成功 → 两道闸各 +1(被单号冷却挡下的重发走不到这里,故不占额度)
-    record_rate_limits(request, subject=req.device_id, rules=send_rules)
+    record_rate_limits(request, subject=subject_id, rules=send_rules)
 
     from app.core.config import settings  # 局部 import 避免循环
 
@@ -283,16 +321,52 @@ def sms_login(req: SmsLoginRequest, request: Request, db: DbSession) -> TokenWit
     # **之前** → 输错验证码的失败尝试也计数,才挡得住撞库/爆破(另有单码失败 SMS_MAX_VERIFY_ATTEMPTS 次即作废兜底)。
     # ⚠️ 按设备而非手机号 → 一台机器换不同手机号刷登录也受限(防一机狂登多号);device_id 空(老客户端)时
     #    退化为该 IP 下所有空设备聚一桶,仍受限。
+    login_policy = limit_policy.resolve(
+        db,
+        "sms.login.hourly",
+        phone=req.phone,
+        device=subject_id,
+    )
+    verify_policy = limit_policy.resolve(
+        db,
+        "sms.code.failed_attempts",
+        phone=req.phone,
+    )
+    login_limit = (
+        SMS_LOGIN_MAX_PER_HOUR
+        if login_policy.override_id is None
+        and login_policy.bucket_version == "default"
+        else login_policy.limit
+    )
     enforce_rate_limit(
         request,
         scope="sms-login-device",
-        subject=req.device_id,
-        limit=SMS_LOGIN_MAX_PER_HOUR,
+        subject=subject_id,
+        limit=login_limit,
         window_sec=3600,
         detail="登录尝试过于频繁,请稍后再试",
+        bucket_suffix=login_policy.bucket_version,
     )
 
-    if not verify_code(req.phone, req.code):
+    try:
+        ok = verify_code(
+            req.phone,
+            req.code,
+            max_failed_attempts=(
+                None
+                if verify_policy.override_id is None
+                and verify_policy.bucket_version == "default"
+                else (
+                    UNLIMITED_VERIFY_ATTEMPTS
+                    if verify_policy.limit is None
+                    else verify_policy.limit
+                )
+            ),
+        )
+    except SmsError as e:  # provider 校验降级(如阿里云接口异常)→ 原样透出其状态码(503),别误报「验证码错误」
+        raise HTTPException(status_code=e.status_code, detail=str(e)) from e
+    if not ok:
+        # 校验码错误才记风控失败事件(provider 降级 503 已在上面提前 raise,不算「验证失败」)
         risk_repo.record_behavior_event(
             db,
             event_type=risk_repo.EVENT_SMS_LOGIN,
@@ -389,15 +463,25 @@ def _finish_wechat_bind(
     未占用 → 新建微信账号(channel=wechat,昵称头像取微信)→ 签 token 登入。"""
     existing = user_repo.get_user_by_phone(db, phone)
     if existing is not None:
-        from app.core.config import settings  # 局部 import,避免循环
-
         ticket = create_conflict_ticket(
             openid=openid,
             wechat_nickname=wechat_nickname,
             wechat_avatar_url=wechat_avatar_url,
             phone=phone,
         )
-        blocked = rebind_repo.rebound_within_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS)
+        rebind_policy = limit_policy.resolve(
+            db,
+            "phone.rebind.days",
+            phone=phone,
+            device=device_id,
+        )
+        rebind_days = rebind_policy.limit or 0
+        blocked = rebind_repo.rebound_within_days(
+            db,
+            phone,
+            rebind_days,
+            reset_at=rebind_policy.reset_at,
+        )
         logger.info(
             "wechat bind phone occupied phone=%s by user_id=%d has_wechat=%s",
             mask_phone(phone), existing.id, bool(existing.wechat_openid),
@@ -413,7 +497,12 @@ def _finish_wechat_bind(
             conflict_ticket=ticket,
             rebind_available=not blocked,
             rebind_blocked_days=(
-                rebind_repo.remaining_block_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS)
+                rebind_repo.remaining_block_days(
+                    db,
+                    phone,
+                    rebind_days,
+                    reset_at=rebind_policy.reset_at,
+                )
                 if blocked else 0
             ),
         )
@@ -446,17 +535,53 @@ def wechat_bind_phone_sms(
     except TokenError as e:
         raise HTTPException(status_code=401, detail="授权已过期,请重新用微信登录") from e
 
+    subject_id = _device_subject(req.device_id, request)
     # 防刷:同 sms/login,按 设备+IP 每小时限流(放在验证码校验之前,失败也计数)
+    bind_policy = limit_policy.resolve(
+        db,
+        "wechat.bind.hourly",
+        phone=req.phone,
+        device=subject_id,
+    )
+    verify_policy = limit_policy.resolve(
+        db,
+        "sms.code.failed_attempts",
+        phone=req.phone,
+    )
+    bind_limit = (
+        SMS_LOGIN_MAX_PER_HOUR
+        if bind_policy.override_id is None
+        and bind_policy.bucket_version == "default"
+        else bind_policy.limit
+    )
     enforce_rate_limit(
         request,
         scope="wechat-bind-sms-device",
-        subject=req.device_id,
-        limit=SMS_LOGIN_MAX_PER_HOUR,
+        subject=subject_id,
+        limit=bind_limit,
         window_sec=3600,
         detail="登录尝试过于频繁,请稍后再试",
+        bucket_suffix=bind_policy.bucket_version,
     )
 
-    if not verify_code(req.phone, req.code):
+    try:
+        ok = verify_code(
+            req.phone,
+            req.code,
+            max_failed_attempts=(
+                None
+                if verify_policy.override_id is None
+                and verify_policy.bucket_version == "default"
+                else (
+                    UNLIMITED_VERIFY_ATTEMPTS
+                    if verify_policy.limit is None
+                    else verify_policy.limit
+                )
+            ),
+        )
+    except SmsError as e:  # provider 校验降级(如阿里云接口异常)→ 原样透出其状态码(503),别误报「验证码错误」
+        raise HTTPException(status_code=e.status_code, detail=str(e)) from e
+    if not ok:
         raise HTTPException(status_code=400, detail="invalid sms code")
 
     return _finish_wechat_bind(
@@ -513,9 +638,23 @@ def wechat_conflict_continue(
     except TokenError as e:
         raise HTTPException(status_code=401, detail="操作超时,请重新用微信登录") from e
 
+    subject_id = _device_subject(req.device_id, request)
+    conflict_policy = limit_policy.resolve(
+        db,
+        "wechat.conflict.hourly",
+        phone=claims["phone"],
+        device=subject_id,
+    )
+    conflict_limit = (
+        SMS_LOGIN_MAX_PER_HOUR
+        if conflict_policy.override_id is None
+        and conflict_policy.bucket_version == "default"
+        else conflict_policy.limit
+    )
     enforce_rate_limit(
-        request, scope="wechat-conflict-device", subject=req.device_id,
-        limit=SMS_LOGIN_MAX_PER_HOUR, window_sec=3600, detail="操作过于频繁,请稍后再试",
+        request, scope="wechat-conflict-device", subject=subject_id,
+        limit=conflict_limit, window_sec=3600, detail="操作过于频繁,请稍后再试",
+        bucket_suffix=conflict_policy.bucket_version,
     )
 
     user = user_repo.get_user_by_phone(db, claims["phone"])
@@ -553,21 +692,50 @@ def wechat_conflict_continue(
 def wechat_conflict_rebind(
     req: WechatConflictRebindRequest, request: Request, db: DbSession
 ) -> WechatBindResultResponse:
-    from app.core.config import settings  # 局部 import,避免循环
-
     try:
         claims = decode_conflict_ticket(req.conflict_ticket)
     except TokenError as e:
         raise HTTPException(status_code=401, detail="操作超时,请重新用微信登录") from e
 
+    subject_id = _device_subject(req.device_id, request)
+    conflict_policy = limit_policy.resolve(
+        db,
+        "wechat.conflict.hourly",
+        phone=claims["phone"],
+        device=subject_id,
+    )
+    conflict_limit = (
+        SMS_LOGIN_MAX_PER_HOUR
+        if conflict_policy.override_id is None
+        and conflict_policy.bucket_version == "default"
+        else conflict_policy.limit
+    )
     enforce_rate_limit(
-        request, scope="wechat-conflict-device", subject=req.device_id,
-        limit=SMS_LOGIN_MAX_PER_HOUR, window_sec=3600, detail="操作过于频繁,请稍后再试",
+        request, scope="wechat-conflict-device", subject=subject_id,
+        limit=conflict_limit, window_sec=3600, detail="操作过于频繁,请稍后再试",
+        bucket_suffix=conflict_policy.bucket_version,
     )
 
     phone = claims["phone"]
-    if rebind_repo.rebound_within_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS):
-        days = rebind_repo.remaining_block_days(db, phone, settings.PHONE_REBIND_LIMIT_DAYS)
+    rebind_policy = limit_policy.resolve(
+        db,
+        "phone.rebind.days",
+        phone=phone,
+        device=req.device_id,
+    )
+    rebind_days = rebind_policy.limit or 0
+    if rebind_repo.rebound_within_days(
+        db,
+        phone,
+        rebind_days,
+        reset_at=rebind_policy.reset_at,
+    ):
+        days = rebind_repo.remaining_block_days(
+            db,
+            phone,
+            rebind_days,
+            reset_at=rebind_policy.reset_at,
+        )
         raise HTTPException(status_code=409, detail=f"该手机号 {days} 天内已换绑过,暂不能再次换绑")
 
     user = user_repo.rebind_account(

app/api/v1/compare.py

@@ -108,7 +108,7 @@ def _harvest_done_blocking(
 
 def _harvest_abort_blocking(
     trace_id: str, status_hint: str, reason: str | None, trace_url: str | None,
-) -> None:
+) -> int | None:
     with SessionLocal() as db:
         rec = crud_compare.harvest_abort(
             db, trace_id=trace_id, status=status_hint, reason=reason, trace_url=trace_url,
@@ -118,6 +118,7 @@ def _harvest_abort_blocking(
         extra={"phase": "harvest_abort",
                "status": (rec.status if rec else None), "reason": reason},
     )
+    return rec.id if rec is not None else None
 
 
 async def _forward(
@@ -291,7 +292,10 @@ async def trace_epilogue(
 
 @router.post("/trace/finalize", summary="比价 trace 收尾上云 (透传 + 夭折落库)")
 async def trace_finalize(
-    request: Request, user: OptionalUser, db: DbSession
+    request: Request,
+    background_tasks: BackgroundTasks,
+    user: OptionalUser,
+    db: DbSession,
 ) -> dict[str, Any]:
     _ensure_compare_allowed(user, db)
     # 用户终止 / Phase1 未识别没到 done 帧: pricebot 打包半截上云返回 {trace_url};
@@ -302,12 +306,16 @@ async def trace_finalize(
         request, "/api/trace/finalize", user, harvest_first_frame=False,
     )
     try:
-        await run_in_threadpool(
+        record_id = await run_in_threadpool(
             _harvest_abort_blocking, trace_id,
             (meta.get("status") or "cancelled"),
             (meta.get("reason") or meta.get("information")),
             (resp.get("trace_url") if isinstance(resp, dict) else None),
         )
+        if record_id is not None:
+            background_tasks.add_task(
+                backfill_comparison_llm_cost, record_id, trace_id
+            )
     except Exception as e:  # noqa: BLE001
         logger.warning("harvest_abort failed trace=%s: %s", trace_id, e)
     return resp

app/api/v1/compare_record.py

@@ -16,6 +16,7 @@ import logging
 from fastapi import APIRouter, BackgroundTasks, HTTPException, Query, status
 
 from app.api.deps import CurrentUser, DbSession
+from app.core import limit_policy
 from app.repositories import comparison as crud_compare
 from app.repositories import risk as risk_repo
 from app.schemas.compare_record import (
@@ -53,17 +54,29 @@ def reserve_compare_start(
     ):
         raise HTTPException(status_code=403, detail="账号存在异常，该功能暂不可用")
     try:
+        policy = limit_policy.resolve(
+            db,
+            "compare.start.daily",
+            phone=user.phone,
+            device=payload.device_id,
+        )
         rec, used = crud_compare.reserve_daily_start(
             db,
             user_id=user.id,
             trace_id=payload.trace_id,
             business_type=payload.business_type,
             device_id=payload.device_id,
+            limit=policy.limit,
+            reset_at=policy.reset_at,
         )
     except crud_compare.DailyCompareStartLimitExceeded:
         raise HTTPException(
             status_code=status.HTTP_429_TOO_MANY_REQUESTS,
-            detail="今日已比价超过100次，请明天再试",
+            detail=(
+                f"今日已比价超过{policy.limit}次，请明天再试"
+                if policy.limit is not None
+                else "今日比价次数已达上限，请明天再试"
+            ),
         ) from None
     except crud_compare.ComparisonTraceOwnershipError:
         raise HTTPException(
@@ -71,11 +84,16 @@ def reserve_compare_start(
             detail="比价任务标识冲突，请重新发起",
         ) from None
     # 风控阈值由后台动态配置，不能再只在固定的 100 次业务上限处同步。
-    risk_repo.sync_compare_incident(db, user_id=user.id, at=rec.created_at)
+    risk_repo.sync_compare_incident(
+        db,
+        user_id=user.id,
+        at=rec.created_at,
+        device_id=payload.device_id,
+    )
     return CompareStartReserveOut(
-        limit=crud_compare.DAILY_COMPARE_START_LIMIT,
+        limit=policy.limit,
         used=used,
-        remaining=max(crud_compare.DAILY_COMPARE_START_LIMIT - used, 0),
+        remaining=max(policy.limit - used, 0) if policy.limit is not None else None,
     )
 
 

app/core/config.py

@@ -141,6 +141,49 @@ class Settings(BaseSettings):
     SMS_DAILY_LIMIT_PER_PHONE: int = 10   # 单手机号每日发送上限(防刷 + 控费)
     SMS_MAX_VERIFY_ATTEMPTS: int = 5      # 单个验证码最多校验失败次数,超过即作废(防爆破)
 
+    # ===== 短信提供商(可切换:极光 / 阿里云号码认证 / 创蓝云智)=====
+    # jiguang(默认):本服务生成验证码,极光只负责下发,本地内存校验(自管码,现状不变)。
+    # aliyun:阿里云 dypns 号码认证,阿里云生成+下发+校验(Mode A);缺凭证时 /sms/* 返 503(优雅降级)。
+    # chuanglan:创蓝云智(253)模板短信,本服务生成码、创蓝只下发、本地校验(Mode B,与极光同);缺凭证 503。
+    SMS_PROVIDER: Literal["jiguang", "aliyun", "chuanglan"] = "jiguang"
+    ALIYUN_SMS_ACCESS_KEY_ID: str = ""
+    ALIYUN_SMS_ACCESS_KEY_SECRET: str = ""
+    ALIYUN_SMS_SIGN_NAME: str = ""            # 系统赠送签名(自定义签名下发易失败)
+    ALIYUN_SMS_TEMPLATE_CODE: str = ""        # 赠送模板 CODE(须与赠送签名搭配)
+    ALIYUN_SMS_SCHEME_NAME: str = ""          # 方案名(可空=默认方案);send/check 共用避免不匹配
+    ALIYUN_SMS_ENDPOINT: str = "dypnsapi.aliyuncs.com"
+    ALIYUN_SMS_CODE_LENGTH: int = 6           # 验证码位数(CodeLength 4~8)
+    ALIYUN_SMS_VALID_TIME_SEC: int = 300      # 验证码有效期秒(ValidTime);短信内 min 文案 = //60
+    ALIYUN_SMS_INTERVAL_SEC: int = 60         # 单号发送频控秒(Interval);核验免费
+    ALIYUN_SMS_TIMEOUT_SEC: int = 15          # 阿里云 API 读/连超时秒
+
+    # --- 创蓝云智(253)模板短信,Mode B 自管码,httpx 直连 + HMAC 签名(见 docs/integrations/chuanglan/tpl-send.md)---
+    CHUANGLAN_SMS_ACCOUNT: str = ""       # YZM 前缀验证码账号
+    CHUANGLAN_SMS_PASSWORD: str = ""      # API 密码(仅用于本地算 HMAC 签名,不随请求上行)
+    CHUANGLAN_SMS_TEMPLATE_ID: str = ""   # 模板 ID(控制台创建)
+    CHUANGLAN_SMS_SIGNATURE: str = ""     # 短信签名文案【品牌】;模板已关联签名则留空
+    CHUANGLAN_SMS_ENDPOINT: str = "https://smssh.253.com/msg/sms/v2/tpl/send"
+    CHUANGLAN_SMS_TIMEOUT_SEC: int = 10   # httpx 读/连超时秒
+
+    @property
+    def aliyun_sms_configured(self) -> bool:
+        """阿里云短信凭证齐全(缺则 SMS_PROVIDER=aliyun 时 /sms/* 返 503,而非启动崩)。"""
+        return bool(
+            self.ALIYUN_SMS_ACCESS_KEY_ID
+            and self.ALIYUN_SMS_ACCESS_KEY_SECRET
+            and self.ALIYUN_SMS_SIGN_NAME
+            and self.ALIYUN_SMS_TEMPLATE_CODE
+        )
+
+    @property
+    def chuanglan_sms_configured(self) -> bool:
+        """创蓝短信凭证齐全(缺则 SMS_PROVIDER=chuanglan 时 /sms/send 返 503,而非启动崩)。"""
+        return bool(
+            self.CHUANGLAN_SMS_ACCOUNT
+            and self.CHUANGLAN_SMS_PASSWORD
+            and self.CHUANGLAN_SMS_TEMPLATE_ID
+        )
+
     # ===== 测试账号(release 包全流程联调用)=====
     # 配一个固定测试手机号,专供无 SIM 卡 / 不走一键登录时打通全流程:该号登录【免短信验证码】
     # (real 模式下也跳过校验)、每次登录【强制重走新手引导】,并设【每日使用次数上限】防被人

app/core/config_schema.py

@@ -14,12 +14,137 @@ from app.core import rewards as r
 RISK_SMS_HOURLY_THRESHOLD_KEY = "risk_sms_hourly_threshold"
 RISK_ONECLICK_DAILY_THRESHOLD_KEY = "risk_oneclick_daily_threshold"
 RISK_COMPARE_DAILY_THRESHOLD_KEY = "risk_compare_daily_threshold"
+COMPARE_DAILY_LIMIT_KEY = "compare_daily_limit"
+SMS_SEND_HOURLY_LIMIT_KEY = "sms_send_hourly_limit"
+SMS_SEND_DAILY_LIMIT_KEY = "sms_send_daily_limit"
+SMS_LOGIN_HOURLY_LIMIT_KEY = "sms_login_hourly_limit"
+WECHAT_BIND_SMS_HOURLY_LIMIT_KEY = "wechat_bind_sms_hourly_limit"
+WECHAT_CONFLICT_HOURLY_LIMIT_KEY = "wechat_conflict_hourly_limit"
+SMS_PHONE_COOLDOWN_SECONDS_KEY = "sms_phone_cooldown_seconds"
+SMS_CODE_MAX_FAILED_ATTEMPTS_KEY = "sms_code_max_failed_attempts"
+AD_REWARD_VIDEO_DAILY_LIMIT_KEY = "ad_reward_video_daily_limit"
+AD_FEED_DAILY_LIMIT_KEY = "ad_feed_daily_limit"
+PHONE_REBIND_DAYS_KEY = "phone_rebind_days"
+GUIDE_VIDEO_MAX_PLAYS_KEY = "guide_video_max_plays"
 
 # type 约定(给前端渲染编辑控件用):int / int_list / dict_str_int / bool / enum
 # hidden=True:仍是合法可配项(业务照常 get_value / admin 可经专用端点读写),但**不在通用
 #   「系统配置」页渲染**(admin/routers/config.py:list_config 按此过滤)。用于把已下线/已改由
 #   专用页管理的项从福利页 Tab 收起,同时保留后端默认值与写入能力。
 CONFIG_DEFS: dict[str, dict[str, Any]] = {
+    COMPARE_DAILY_LIMIT_KEY: {
+        "default": 100,
+        "label": "账号每日比价次数上限",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 100_000,
+        "hidden": True,
+        "help": "北京时间自然日内每个账号可发起的比价次数。",
+    },
+    SMS_SEND_HOURLY_LIMIT_KEY: {
+        "default": 5,
+        "label": "短信每小时发送上限",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 10_000,
+        "hidden": True,
+        "help": "同一设备和 IP 在固定 1 小时窗口内成功发送短信的次数。",
+    },
+    SMS_SEND_DAILY_LIMIT_KEY: {
+        "default": 20,
+        "label": "短信 24 小时发送上限",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 100_000,
+        "hidden": True,
+        "help": "同一设备和 IP 在固定 24 小时窗口内成功发送短信的次数。",
+    },
+    SMS_LOGIN_HOURLY_LIMIT_KEY: {
+        "default": 5,
+        "label": "短信登录每小时尝试上限",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 10_000,
+        "hidden": True,
+        "help": "成功与失败均计入。",
+    },
+    WECHAT_BIND_SMS_HOURLY_LIMIT_KEY: {
+        "default": 5,
+        "label": "微信短信绑定每小时尝试上限",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 10_000,
+        "hidden": True,
+    },
+    WECHAT_CONFLICT_HOURLY_LIMIT_KEY: {
+        "default": 5,
+        "label": "微信冲突处理每小时尝试上限",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 10_000,
+        "hidden": True,
+        "help": "继续登录与重新绑定共享此额度。",
+    },
+    SMS_PHONE_COOLDOWN_SECONDS_KEY: {
+        "default": 60,
+        "label": "同手机号短信发送冷却秒数",
+        "group": "限制策略",
+        "type": "int",
+        "min": 0,
+        "max": 86_400,
+        "hidden": True,
+    },
+    SMS_CODE_MAX_FAILED_ATTEMPTS_KEY: {
+        "default": 5,
+        "label": "单验证码最大失败次数",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 100,
+        "hidden": True,
+    },
+    AD_REWARD_VIDEO_DAILY_LIMIT_KEY: {
+        "default": r.DAILY_AD_REWARD_LIMIT,
+        "label": "激励视频每日发奖次数",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 100_000,
+        "hidden": True,
+    },
+    AD_FEED_DAILY_LIMIT_KEY: {
+        "default": r.DAILY_AD_REWARD_LIMIT,
+        "label": "Draw 信息流每日发奖次数",
+        "group": "限制策略",
+        "type": "int",
+        "min": 1,
+        "max": 100_000,
+        "hidden": True,
+    },
+    PHONE_REBIND_DAYS_KEY: {
+        "default": 30,
+        "label": "手机/微信换绑冷却天数",
+        "group": "限制策略",
+        "type": "int",
+        "min": 0,
+        "max": 3650,
+        "hidden": True,
+    },
+    GUIDE_VIDEO_MAX_PLAYS_KEY: {
+        "default": 3,
+        "label": "领券引导视频最大播放次数",
+        "group": "限制策略",
+        "type": "int",
+        "min": 0,
+        "max": 50,
+        "hidden": True,
+    },
     "signin_rewards": {
         "default": list(r.SIGNIN_REWARDS), "label": "签到 7 天金币档位",
         "group": "签到", "type": "int_list",
@@ -56,7 +181,8 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
     },
     "ad_daily_limit": {
         "default": r.DAILY_AD_REWARD_LIMIT, "label": "看广告每日上限(次)",
-        "group": "看广告", "type": "int", "help": "福利页激励视频每日可发奖次数上限,默认 500。",
+        "group": "看广告", "type": "int", "hidden": True,
+        "help": "历史共享上限；新配置由白名单页分别管理激励视频与 Draw 信息流。",
     },
     "ad_max_coin": {
         "default": r.MAX_AD_REWARD_COIN, "label": "看广告单次金币上限",
@@ -118,9 +244,9 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
         "group": "风控",
         "type": "int",
         "min": 1,
-        "max": 5,
+        "max": 100_000,
         "hidden": True,
-        "help": "同一设备在北京时间同一自然小时内成功下发短信达到该次数时告警；不得高于现有每小时 5 次的发送上限。",
+        "help": "同一设备在北京时间同一自然小时内成功下发短信达到该次数时告警。",
     },
     RISK_ONECLICK_DAILY_THRESHOLD_KEY: {
         "default": 20,
@@ -138,7 +264,7 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
         "group": "风控",
         "type": "int",
         "min": 1,
-        "max": 100,
+        "max": 100_000,
         "hidden": True,
         "help": "同一账户在北京时间同一自然日内发起比价达到该次数时告警。",
     },

app/core/limit_policy.py

@@ -0,0 +1,525 @@
+"""Unified global limits and per-phone/device policy overrides.
+
+The registry is the single source of truth for the whitelist page.  Existing
+constants remain as backwards-compatible defaults, while business call sites
+resolve an effective value here.
+"""
+from __future__ import annotations
+
+from collections.abc import Iterable
+from dataclasses import dataclass
+from datetime import UTC, datetime
+
+from sqlalchemy import or_, select
+from sqlalchemy.orm import Session
+
+from app.core.config_schema import (
+    AD_FEED_DAILY_LIMIT_KEY,
+    AD_REWARD_VIDEO_DAILY_LIMIT_KEY,
+    COMPARE_DAILY_LIMIT_KEY,
+    GUIDE_VIDEO_MAX_PLAYS_KEY,
+    PHONE_REBIND_DAYS_KEY,
+    RISK_COMPARE_DAILY_THRESHOLD_KEY,
+    RISK_ONECLICK_DAILY_THRESHOLD_KEY,
+    RISK_SMS_HOURLY_THRESHOLD_KEY,
+    SMS_CODE_MAX_FAILED_ATTEMPTS_KEY,
+    SMS_LOGIN_HOURLY_LIMIT_KEY,
+    SMS_PHONE_COOLDOWN_SECONDS_KEY,
+    SMS_SEND_DAILY_LIMIT_KEY,
+    SMS_SEND_HOURLY_LIMIT_KEY,
+    WECHAT_BIND_SMS_HOURLY_LIMIT_KEY,
+    WECHAT_CONFLICT_HOURLY_LIMIT_KEY,
+)
+from app.models.app_config import AppConfig
+from app.models.limit_policy import LimitPolicyOverride
+from app.models.user import User
+from app.repositories import app_config
+
+MODE_INHERIT = "inherit"
+MODE_OVERRIDE = "override"
+MODE_UNLIMITED = "unlimited"
+MODE_SUPPRESS_ALERT = "suppress_alert"
+
+SUBJECT_PHONE = "phone"
+SUBJECT_DEVICE = "device"
+SUBJECT_TYPES = (SUBJECT_PHONE, SUBJECT_DEVICE)
+SUBJECT_PRECEDENCE = {SUBJECT_DEVICE: 0, SUBJECT_PHONE: 1}
+LEGACY_IP_DEVICE_PREFIX = "legacy-ip:"
+
+
+@dataclass(frozen=True)
+class RuleDefinition:
+    code: str
+    label: str
+    group: str
+    config_key: str
+    default_limit: int
+    window_label: str
+    subject_types: tuple[str, ...]
+    min_value: int = 1
+    max_value: int = 100_000
+    allow_unlimited: bool = True
+    supports_reset: bool = True
+    alert_only: bool = False
+    legacy_config_key: str | None = None
+    legacy_json_field: str | None = None
+
+    @property
+    def allowed_modes(self) -> tuple[str, ...]:
+        if self.alert_only:
+            return (MODE_SUPPRESS_ALERT,)
+        return (MODE_UNLIMITED,) if self.allow_unlimited else ()
+
+
+RULES: tuple[RuleDefinition, ...] = (
+    RuleDefinition(
+        "compare.start.daily",
+        "每日发起比价次数",
+        "比价",
+        COMPARE_DAILY_LIMIT_KEY,
+        100,
+        "北京时间自然日",
+        SUBJECT_TYPES,
+    ),
+    RuleDefinition(
+        "sms.send.hourly",
+        "短信每小时成功发送次数",
+        "短信与登录",
+        SMS_SEND_HOURLY_LIMIT_KEY,
+        5,
+        "固定 1 小时窗口",
+        SUBJECT_TYPES,
+        max_value=10_000,
+    ),
+    RuleDefinition(
+        "sms.send.daily",
+        "短信 24 小时成功发送次数",
+        "短信与登录",
+        SMS_SEND_DAILY_LIMIT_KEY,
+        20,
+        "固定 24 小时窗口",
+        SUBJECT_TYPES,
+    ),
+    RuleDefinition(
+        "sms.phone.cooldown",
+        "同手机号短信发送冷却",
+        "短信与登录",
+        SMS_PHONE_COOLDOWN_SECONDS_KEY,
+        60,
+        "秒",
+        (SUBJECT_PHONE,),
+        min_value=0,
+        max_value=86_400,
+    ),
+    RuleDefinition(
+        "sms.code.failed_attempts",
+        "单验证码最大失败次数",
+        "短信与登录",
+        SMS_CODE_MAX_FAILED_ATTEMPTS_KEY,
+        5,
+        "单个验证码",
+        (SUBJECT_PHONE,),
+        max_value=100,
+    ),
+    RuleDefinition(
+        "sms.login.hourly",
+        "短信登录每小时尝试次数",
+        "短信与登录",
+        SMS_LOGIN_HOURLY_LIMIT_KEY,
+        5,
+        "固定 1 小时窗口",
+        SUBJECT_TYPES,
+        max_value=10_000,
+    ),
+    RuleDefinition(
+        "wechat.bind.hourly",
+        "微信短信绑定每小时尝试次数",
+        "短信与登录",
+        WECHAT_BIND_SMS_HOURLY_LIMIT_KEY,
+        5,
+        "固定 1 小时窗口",
+        SUBJECT_TYPES,
+        max_value=10_000,
+    ),
+    RuleDefinition(
+        "wechat.conflict.hourly",
+        "微信冲突处理每小时尝试次数",
+        "短信与登录",
+        WECHAT_CONFLICT_HOURLY_LIMIT_KEY,
+        5,
+        "固定 1 小时窗口",
+        SUBJECT_TYPES,
+        max_value=10_000,
+    ),
+    RuleDefinition(
+        "ad.reward_video.daily",
+        "激励视频每日发奖次数",
+        "广告",
+        AD_REWARD_VIDEO_DAILY_LIMIT_KEY,
+        500,
+        "北京时间自然日",
+        (SUBJECT_PHONE,),
+        legacy_config_key="ad_daily_limit",
+    ),
+    RuleDefinition(
+        "ad.feed.daily",
+        "Draw 信息流每日发奖次数",
+        "广告",
+        AD_FEED_DAILY_LIMIT_KEY,
+        500,
+        "北京时间自然日",
+        (SUBJECT_PHONE,),
+        legacy_config_key="ad_daily_limit",
+    ),
+    RuleDefinition(
+        "ad.reward_video.cooldown",
+        "激励视频发奖后冷却秒数",
+        "广告",
+        "ad_cooldown_sec",
+        3,
+        "秒",
+        (SUBJECT_PHONE,),
+        min_value=0,
+        max_value=86_400,
+    ),
+    RuleDefinition(
+        "guide.video.lifetime",
+        "领券引导视频最大播放次数",
+        "引导与账号",
+        GUIDE_VIDEO_MAX_PLAYS_KEY,
+        3,
+        "账号生命周期",
+        (SUBJECT_PHONE,),
+        min_value=0,
+        max_value=50,
+        legacy_config_key="coupon_guide_video",
+        legacy_json_field="max_plays",
+    ),
+    RuleDefinition(
+        "phone.rebind.days",
+        "手机/微信换绑冷却天数",
+        "引导与账号",
+        PHONE_REBIND_DAYS_KEY,
+        30,
+        "自然日",
+        (SUBJECT_PHONE,),
+        min_value=0,
+        max_value=3650,
+    ),
+    RuleDefinition(
+        "risk.sms.hourly",
+        "短信设备每小时告警",
+        "风控免告警",
+        RISK_SMS_HOURLY_THRESHOLD_KEY,
+        5,
+        "北京时间自然小时",
+        (SUBJECT_DEVICE,),
+        max_value=100_000,
+        allow_unlimited=False,
+        alert_only=True,
+    ),
+    RuleDefinition(
+        "risk.oneclick.daily",
+        "一键登录设备每日告警",
+        "风控免告警",
+        RISK_ONECLICK_DAILY_THRESHOLD_KEY,
+        20,
+        "北京时间自然日",
+        (SUBJECT_DEVICE,),
+        max_value=100_000,
+        allow_unlimited=False,
+        alert_only=True,
+    ),
+    RuleDefinition(
+        "risk.compare.daily",
+        "比价账号每日告警",
+        "风控免告警",
+        RISK_COMPARE_DAILY_THRESHOLD_KEY,
+        100,
+        "北京时间自然日",
+        (SUBJECT_PHONE,),
+        max_value=100_000,
+        allow_unlimited=False,
+        alert_only=True,
+    ),
+)
+RULE_MAP = {rule.code: rule for rule in RULES}
+
+
+@dataclass(frozen=True)
+class EffectiveLimit:
+    rule_code: str
+    global_limit: int
+    limit: int | None
+    mode: str
+    suppressed: bool
+    override_id: int | None
+    matched_subject_type: str | None
+    matched_subject_value: str | None
+    reset_at: datetime | None
+    bucket_version: str
+
+    @property
+    def unlimited(self) -> bool:
+        return self.limit is None
+
+
+def normalize_subject(subject_type: str, value: str) -> str:
+    value = (value or "").strip()
+    if subject_type == SUBJECT_PHONE:
+        value = "".join(ch for ch in value if ch.isdigit())
+    if subject_type not in SUBJECT_TYPES:
+        raise ValueError(f"unsupported subject type: {subject_type}")
+    if not value:
+        raise ValueError("subject value is empty")
+    return value[:128]
+
+
+def validate_whitelist_subject(subject_type: str, value: str) -> str:
+    """Normalize a whitelist subject and reject unsafe pseudo-devices.
+
+    Old clients without a device ID are grouped by public IP for rate limiting.
+    That fallback remains valid at runtime, but it is not a stable, unique
+    device identity and must never be persisted as a device whitelist target.
+    """
+
+    normalized = normalize_subject(subject_type, value)
+    if (
+        subject_type == SUBJECT_DEVICE
+        and normalized.startswith(LEGACY_IP_DEVICE_PREFIX)
+    ):
+        raise ValueError(
+            "旧客户端未上报真实设备 ID，不能加入设备白名单，请升级客户端后重试"
+        )
+    return normalized
+
+
+def get_rule(rule_code: str) -> RuleDefinition:
+    try:
+        return RULE_MAP[rule_code]
+    except KeyError as exc:
+        raise ValueError(f"unknown rule: {rule_code}") from exc
+
+
+def device_source_scope(rule_code: str) -> str:
+    """返回设备候选数据所属命名空间，防止一个设备 ID 跨来源误套规则。"""
+    rule = get_rule(rule_code)
+    if SUBJECT_DEVICE not in rule.subject_types:
+        raise ValueError("当前限制项不支持设备白名单")
+    return "comparison" if rule_code == "compare.start.daily" else "auth"
+
+
+def validate_device_rule_scope(rule_codes: Iterable[str]) -> None:
+    scopes = {device_source_scope(rule_code) for rule_code in rule_codes}
+    if len(scopes) > 1:
+        raise ValueError("比价设备限制与短信/登录设备限制不能在同一白名单中混选")
+
+
+def _global_limit(db: Session, rule: RuleDefinition) -> tuple[int, str]:
+    row = db.get(AppConfig, rule.config_key)
+    if row is not None:
+        return int(row.value), "configured"
+
+    if rule.legacy_config_key:
+        legacy = db.get(AppConfig, rule.legacy_config_key)
+        if legacy is not None:
+            value = legacy.value
+            if rule.legacy_json_field:
+                value = value.get(rule.legacy_json_field) if isinstance(value, dict) else None
+            if value is not None:
+                return int(value), "legacy"
+
+    try:
+        return int(app_config.get_value(db, rule.config_key)), "default"
+    except KeyError:
+        return rule.default_limit, "default"
+
+
+def _aware(value: datetime | None) -> datetime | None:
+    if value is None:
+        return None
+    return value.replace(tzinfo=UTC) if value.tzinfo is None else value
+
+
+def _matching_overrides(
+    db: Session,
+    rule: RuleDefinition,
+    subjects: dict[str, str | None],
+    now: datetime,
+) -> list[LimitPolicyOverride]:
+    pairs: list[tuple[str, str]] = []
+    for subject_type in rule.subject_types:
+        raw = subjects.get(subject_type)
+        if raw:
+            pairs.append((subject_type, normalize_subject(subject_type, raw)))
+    if not pairs:
+        return []
+    clauses = [
+        (
+            (LimitPolicyOverride.subject_type == subject_type)
+            & (LimitPolicyOverride.subject_value == subject_value)
+        )
+        for subject_type, subject_value in pairs
+    ]
+    rows = list(
+        db.execute(
+            select(LimitPolicyOverride).where(
+                LimitPolicyOverride.rule_code == rule.code,
+                LimitPolicyOverride.enabled.is_(True),
+                or_(*clauses),
+            )
+        ).scalars()
+    )
+    active = [
+        row
+        for row in rows
+        if (_aware(row.starts_at) is None or _aware(row.starts_at) <= now)
+        and (_aware(row.expires_at) is None or _aware(row.expires_at) > now)
+    ]
+    return sorted(active, key=lambda row: SUBJECT_PRECEDENCE[row.subject_type])
+
+
+def resolve(
+    db: Session,
+    rule_code: str,
+    *,
+    phone: str | None = None,
+    device: str | None = None,
+    now: datetime | None = None,
+) -> EffectiveLimit:
+    """Resolve global config plus the most specific active override.
+
+    Device overrides win over phone overrides when both match.
+    """
+
+    rule = get_rule(rule_code)
+    now = _aware(now) or datetime.now(UTC)
+    global_limit, global_version = _global_limit(db, rule)
+    matches = _matching_overrides(
+        db, rule, {SUBJECT_PHONE: phone, SUBJECT_DEVICE: device}, now
+    )
+    row = matches[0] if matches else None
+    if row is None:
+        return EffectiveLimit(
+            rule.code,
+            global_limit,
+            global_limit,
+            MODE_INHERIT,
+            False,
+            None,
+            None,
+            None,
+            None,
+            global_version,
+        )
+
+    limit: int | None = global_limit
+    suppressed = False
+    if row.mode == MODE_OVERRIDE:
+        limit = int(row.limit_value) if row.limit_value is not None else global_limit
+    elif row.mode == MODE_UNLIMITED:
+        limit = None
+    elif row.mode == MODE_SUPPRESS_ALERT:
+        suppressed = True
+    # 编辑限制值/备注不应隐式清空计数；只有显式“重置状态”才切换桶。
+    reset_version = _aware(row.reset_at)
+    version = (
+        f"{global_version}:o:{row.id}:"
+        f"{reset_version.isoformat() if reset_version else '0'}"
+    )
+    return EffectiveLimit(
+        rule.code,
+        global_limit,
+        limit,
+        row.mode,
+        suppressed,
+        row.id,
+        row.subject_type,
+        row.subject_value,
+        _aware(row.reset_at),
+        version,
+    )
+
+
+def resolve_for_user(
+    db: Session,
+    rule_code: str,
+    user_id: int,
+    *,
+    device: str | None = None,
+) -> EffectiveLimit:
+    user = db.get(User, user_id)
+    return resolve(
+        db,
+        rule_code,
+        phone=user.phone if user is not None else None,
+        device=device,
+    )
+
+
+def rule_catalog(db: Session) -> list[dict]:
+    out: list[dict] = []
+    for rule in RULES:
+        value, _ = _global_limit(db, rule)
+        out.append(
+            {
+                "code": rule.code,
+                "label": rule.label,
+                "group": rule.group,
+                "global_limit": value,
+                "default_limit": rule.default_limit,
+                "window_label": rule.window_label,
+                "subject_types": list(rule.subject_types),
+                "allowed_modes": list(rule.allowed_modes),
+                "min_value": rule.min_value,
+                "max_value": rule.max_value,
+                "supports_reset": rule.supports_reset,
+                "alert_only": rule.alert_only,
+            }
+        )
+    return out
+
+
+def validate_override(
+    rule: RuleDefinition,
+    *,
+    subject_type: str,
+    mode: str,
+    limit_value: int | None,
+    starts_at: datetime | None,
+    expires_at: datetime | None,
+) -> None:
+    if subject_type not in rule.subject_types:
+        raise ValueError("该规则不支持此主体类型")
+    if mode not in rule.allowed_modes:
+        raise ValueError("该规则不支持此策略模式")
+    if limit_value is not None:
+        raise ValueError("白名单不支持覆盖指定值")
+    if mode in {MODE_UNLIMITED, MODE_SUPPRESS_ALERT} and expires_at is None:
+        raise ValueError("临时白名单必须设置失效时间")
+    if starts_at and expires_at and _aware(expires_at) <= _aware(starts_at):
+        raise ValueError("失效时间必须晚于生效时间")
+    if (
+        mode in {MODE_UNLIMITED, MODE_SUPPRESS_ALERT}
+        and expires_at is not None
+        and _aware(expires_at) <= datetime.now(UTC)
+    ):
+        raise ValueError("临时白名单的失效时间必须晚于当前时间")
+    if mode == MODE_SUPPRESS_ALERT and not rule.alert_only:
+        raise ValueError("免告警只支持风控监控的三项规则")
+
+
+def active_overrides(
+    db: Session,
+    *,
+    subject_type: str | None = None,
+    keyword: str | None = None,
+) -> Iterable[LimitPolicyOverride]:
+    stmt = select(LimitPolicyOverride)
+    if subject_type:
+        stmt = stmt.where(LimitPolicyOverride.subject_type == subject_type)
+    if keyword:
+        stmt = stmt.where(LimitPolicyOverride.subject_value.ilike(f"%{keyword.strip()}%"))
+    return db.execute(
+        stmt.order_by(LimitPolicyOverride.updated_at.desc(), LimitPolicyOverride.id.desc())
+    ).scalars()

app/core/ratelimit.py

@@ -75,10 +75,11 @@ def enforce_rate_limit(
     request: Request,
     scope: str,
     subject: str,
-    limit: int,
+    limit: int | None,
     window_sec: float,
     *,
     detail: str = "操作过于频繁,请稍后再试",
+    bucket_suffix: str = "",
 ) -> None:
     """在路由内部手动限流,按 (subject, 客户端 IP) 计数。
 
@@ -87,9 +88,9 @@ def enforce_rate_limit(
     key = `scope:subject:client_ip`;同一 (subject, IP) 在 window_sec 内超过 limit 次 → 抛 429。
     受 [settings.RATE_LIMIT_ENABLED] 总开关控制(与 [rate_limit] 一致)。
     """
-    if not settings.RATE_LIMIT_ENABLED:
+    if not settings.RATE_LIMIT_ENABLED or limit is None:
         return
-    key = f"{scope}:{subject}:{_client_ip(request)}"
+    key = f"{scope}:{subject}:{_client_ip(request)}:{bucket_suffix}"
     if not _hit(key, limit, window_sec):
         raise HTTPException(
             status_code=status.HTTP_429_TOO_MANY_REQUESTS,
@@ -112,9 +113,10 @@ class RateLimitRule(NamedTuple):
     """
 
     scope: str
-    limit: int
+    limit: int | None
     window_sec: float
     detail: str = "操作过于频繁,请稍后再试"
+    bucket_suffix: str = ""
 
 
 def _peek(key: str, limit: int, window_sec: float) -> bool:
@@ -150,7 +152,13 @@ def check_rate_limits(request: Request, subject: str, rules: list[RateLimitRule]
         return
     ip = _client_ip(request)
     for rule in rules:
-        if not _peek(f"{rule.scope}:{subject}:{ip}", rule.limit, rule.window_sec):
+        if rule.limit is None:
+            continue
+        if not _peek(
+            f"{rule.scope}:{subject}:{ip}:{rule.bucket_suffix}",
+            rule.limit,
+            rule.window_sec,
+        ):
             raise HTTPException(
                 status_code=status.HTTP_429_TOO_MANY_REQUESTS,
                 detail=rule.detail,
@@ -167,4 +175,9 @@ def record_rate_limits(request: Request, subject: str, rules: list[RateLimitRule
         return
     ip = _client_ip(request)
     for rule in rules:
-        _commit(f"{rule.scope}:{subject}:{ip}", rule.window_sec)
+        if rule.limit is None:
+            continue
+        _commit(
+            f"{rule.scope}:{subject}:{ip}:{rule.bucket_suffix}",
+            rule.window_sec,
+        )

app/integrations/sms/__init__.py

@@ -0,0 +1,48 @@
+"""短信验证码服务 —— provider 分派入口。
+
+对外只暴露 `send_code` / `verify_code` / `SmsError`,api 层无需关心用哪个 provider。
+provider 由 `settings.SMS_PROVIDER` 选择(**每次调用读取**,支持运行时切换 + 灰度回退):
+  - `jiguang`(默认):自管码(本服务生成、内存存/校验,极光只发)。见 [jiguang.py](jiguang.py)。
+  - `aliyun`:阿里云号码认证(阿里云生成+下发+校验,Mode A)。见 [aliyun.py](aliyun.py)。
+  - `chuanglan`:创蓝云智(253)模板短信,自管码 Mode B(本服务生成、内存存/校验,创蓝只发)。见 [chuanglan.py](chuanglan.py)。
+
+mock(`SMS_MOCK=true`)与各 provider 的行为差异都封在 provider 内部;本层只做路由。
+拆包前本模块是单文件 `sms.py`;拆包后极光逻辑迁入 `jiguang` 子模块,行为零改动。
+"""
+from __future__ import annotations
+
+from app.core.config import settings
+
+from . import aliyun, chuanglan, jiguang
+from .base import SmsError
+
+__all__ = ["SmsError", "send_code", "verify_code"]
+
+# provider 名 -> 模块;未知/缺省值回退 jiguang(默认兜底,防误配把登录打挂)。
+_PROVIDERS = {"aliyun": aliyun, "chuanglan": chuanglan}
+
+
+def _provider():
+    """按配置选 provider 模块(每次调用读 settings,支持运行时切换 / 测试注入)。"""
+    return _PROVIDERS.get(settings.SMS_PROVIDER, jiguang)
+
+
+def send_code(phone: str, *, cooldown_sec: int | None = None) -> int:
+    """发送验证码,返回距下次可发的冷却秒数;失败抛 SmsError。委托给当前 provider。"""
+    provider = _provider()
+    if cooldown_sec is None:
+        return provider.send_code(phone)
+    return provider.send_code(phone, cooldown_sec=cooldown_sec)
+
+
+def verify_code(
+    phone: str,
+    code: str,
+    *,
+    max_failed_attempts: int | None = None,
+) -> bool:
+    """校验验证码,返回是否通过;provider 异常降级抛 SmsError。委托给当前 provider。"""
+    provider = _provider()
+    if max_failed_attempts is None:
+        return provider.verify_code(phone, code)
+    return provider.verify_code(phone, code, max_failed_attempts=max_failed_attempts)

app/integrations/sms/aliyun.py

@@ -0,0 +1,214 @@
+"""阿里云号码认证(dypns)短信 provider —— Mode A(阿里云托管验证码)。
+
+与极光(自管码)最大不同:**本服务不生成/不存储验证码**,验证码由阿里云生成+存储+下发+校验。
+  - 发码:调 SendSmsVerifyCode,TemplateParam 用 `{"code":"##code##","min":...}` 占位,阿里云生成。
+  - 校验:调 CheckSmsVerifyCode,阿里云返回 PASS / UNKNOWN。核验免费。
+→ 天然消除极光路径「内存存码、多 worker 不共享」的技术债(发码/校验可落不同 worker,阿里云统一裁决)。
+
+**唯一本地态**:per-phone 连续失败计数(`_verify_attempts`),用于复刻极光「单码失败
+`SMS_MAX_VERIFY_ATTEMPTS` 次即作废」的防爆破语义 —— 刻意与极光一致,避免两 provider 行为不同
+导致排查困惑。其多 worker 降级特性与极光现状同级;另有 API 层登录频控(设备+IP)做硬兜底。
+
+单号发送频控(冷却)交给阿里云 `Interval` 参数(命中→FREQUENCY_FAIL→429),本地不再维护冷却。
+
+SDK 交互隔离在 `_call_send` / `_call_check` 两个薄封装(惰性 import + 惰性建 client,仿 wxpay
+惰性加载),单测 monkeypatch 这两个即可,不触真 SDK / 网络。
+"""
+from __future__ import annotations
+
+import json
+import logging
+import time
+from threading import Lock
+
+from app.core.config import settings
+
+from .base import SmsError, mock_verify
+
+logger = logging.getLogger("shagua.sms.aliyun")
+
+# 阿里云路径唯一本地态:per-phone 连续失败次数(与极光同语义,防爆破)。
+_verify_attempts: dict[str, int] = {}   # phone -> 连续失败次数
+_verify_seen: dict[str, float] = {}     # phone -> 最近触碰 epoch(仅供 GC 老化)
+_lock = Lock()
+_GC_THRESHOLD = 10000                    # 超此阈值,send 时顺手清老于验证码有效期的计数(仿极光 _gc)
+
+# 发码错误码 → (HTTP 码, 用户提示)。未列出的一律 503(供应商不可用)。
+_SEND_ERRORS: dict[str, tuple[int, str]] = {
+    "MOBILE_NUMBER_ILLEGAL": (400, "手机号无效"),
+    "BUSINESS_LIMIT_CONTROL": (429, "今日发送次数过多,请明天再试"),
+    "FREQUENCY_FAIL": (429, "发送过于频繁,请稍后再试"),
+}
+# 需运维介入的配置/开通类错误:打 critical 日志(融合认证未开通 / 参数非法)。
+_SEND_CRITICAL_CODES = frozenset({"FUNCTION_NOT_OPENED", "INVALID_PARAMETERS"})
+
+_client = None  # 惰性构建的 SDK client(模块级缓存)
+
+
+# ============================ 对外:发码 / 校验 ============================
+
+def send_code(phone: str, *, cooldown_sec: int | None = None) -> int:
+    """发送验证码(阿里云生成+下发)。
+
+    Returns: 距下次可发的秒数(= ALIYUN_SMS_INTERVAL_SEC,冷却由阿里云 Interval 侧执行)。
+    Raises: SmsError(手机号无效 400 / 过频·天级流控 429 / 未配置·未开通·其他 503)。
+    """
+    effective_cooldown = (
+        settings.ALIYUN_SMS_INTERVAL_SEC if cooldown_sec is None else cooldown_sec
+    )
+    if settings.SMS_MOCK:
+        logger.info("[SMS-aliyun-MOCK] to %s**** (不真发)", phone[:3])
+        return effective_cooldown
+    if not settings.aliyun_sms_configured:
+        raise SmsError("短信服务未配置(缺阿里云凭证)", status_code=503)
+
+    result = (
+        _call_send(phone)
+        if cooldown_sec is None
+        else _call_send(phone, cooldown_sec=effective_cooldown)
+    )
+
+    if result["success"] and result["code"] == "OK":
+        now = time.time()
+        with _lock:
+            _gc(now)                          # 顺手清老计数(超阈值才扫)
+            _verify_attempts.pop(phone, None)  # 新码 = 新失败预算
+            _verify_seen.pop(phone, None)
+        logger.info("[SMS-aliyun] sent to %s****", phone[:3])
+        return effective_cooldown
+
+    code = result["code"]
+    logger.error("[SMS-aliyun] send failed code=%s msg=%s", code, result["message"])
+    if code in _SEND_CRITICAL_CODES:
+        logger.critical("[SMS-aliyun] %s —— 需运维处理(融合认证未开通 / 参数非法)", code)
+    status, msg = _SEND_ERRORS.get(code, (503, "短信服务暂不可用,请稍后重试"))
+    raise SmsError(msg, status_code=status)
+
+
+def verify_code(
+    phone: str,
+    code: str,
+    *,
+    max_failed_attempts: int | None = None,
+) -> bool:
+    """校验验证码(阿里云裁决)。
+
+    - **mock**:放行任意 N 位数字(provider 无关,同极光)。
+    - **real**:先查本地失败计数(达上限即本地作废,不调阿里云,与极光一致)→ 调 CheckSmsVerifyCode:
+      PASS 清计数返 True(一次性);UNKNOWN 计数 +1 返 False;接口异常抛 SmsError(503)。
+    """
+    if settings.SMS_MOCK:
+        ok = mock_verify(code)
+        logger.info("[SMS-aliyun-MOCK] verify %s for %s****", "ok" if ok else "fail", phone[:3])
+        return ok
+
+    # 失败计数是 best-effort:网络调用不持锁(不能锁跨 IO),故并发下同号可能多放行个位数次。
+    # 无碍——API 层登录频控(设备+IP 5/时)是硬上限,阿里云码有效期 + DuplicatePolicy 亦兜底。
+    effective_max_attempts = (
+        settings.SMS_MAX_VERIFY_ATTEMPTS
+        if max_failed_attempts is None
+        else max_failed_attempts
+    )
+    with _lock:
+        if _verify_attempts.get(phone, 0) >= effective_max_attempts:
+            return False  # 已作废:保持计数(直到 send_code 重置),与极光「达上限即作废」一致
+
+    result = _call_check(phone, code)  # 传输/SDK 异常在内部抛 SmsError(503)
+
+    if not (result["success"] and result["code"] == "OK"):
+        # 接口层失败(非码错):降级 503,别误报「验证码错误」(400),便于区分排查。
+        logger.error("[SMS-aliyun] check failed code=%s msg=%s", result["code"], result["message"])
+        raise SmsError("短信服务暂不可用,请稍后重试", status_code=503)
+
+    if result["verify_result"] == "PASS":
+        with _lock:
+            _verify_attempts.pop(phone, None)  # 验过即清(一次性)
+            _verify_seen.pop(phone, None)
+        return True
+
+    # UNKNOWN:码错 / 过期 → 失败计数 +1(累计到上限即作废)
+    with _lock:
+        _verify_attempts[phone] = _verify_attempts.get(phone, 0) + 1
+        _verify_seen[phone] = time.time()
+    return False
+
+
+def _gc(now: float) -> None:
+    """超阈值时清理老于验证码有效期的失败计数(码早已在阿里云侧失效,计数无意义)。仅持锁调用。"""
+    if len(_verify_attempts) <= _GC_THRESHOLD:
+        return
+    cutoff = now - settings.ALIYUN_SMS_VALID_TIME_SEC
+    for p in [p for p, ts in _verify_seen.items() if ts < cutoff]:
+        _verify_attempts.pop(p, None)
+        _verify_seen.pop(p, None)
+
+
+# ============================ SDK 接缝(单测 monkeypatch 这两个)============================
+
+def _get_client():
+    """惰性构建 dypns SDK client(仿 wxpay 惰性加载:jiguang-only 部署不加载 alibabacloud)。"""
+    global _client
+    if _client is None:
+        from alibabacloud_dypnsapi20170525.client import Client
+        from alibabacloud_tea_openapi import models as open_api_models
+
+        cfg = open_api_models.Config(
+            access_key_id=settings.ALIYUN_SMS_ACCESS_KEY_ID,
+            access_key_secret=settings.ALIYUN_SMS_ACCESS_KEY_SECRET,
+            read_timeout=settings.ALIYUN_SMS_TIMEOUT_SEC * 1000,     # SDK 单位 ms
+            connect_timeout=settings.ALIYUN_SMS_TIMEOUT_SEC * 1000,
+        )
+        cfg.endpoint = settings.ALIYUN_SMS_ENDPOINT
+        _client = Client(cfg)
+    return _client
+
+
+def _call_send(phone: str, *, cooldown_sec: int | None = None) -> dict:
+    """调 SendSmsVerifyCode。返回归一化 {success, code, message};import/建 client/调用 任一失败抛 SmsError(503)。"""
+    valid_min = max(1, settings.ALIYUN_SMS_VALID_TIME_SEC // 60)
+    template_param = json.dumps({"code": "##code##", "min": str(valid_min)}, ensure_ascii=False)
+    try:
+        # import + 建 req + 调用 全在 try 内:任一 provider 侧失败都归一成 503(保「provider 出问题→503」不变式)
+        from alibabacloud_dypnsapi20170525 import models as dypns_models
+        req = dypns_models.SendSmsVerifyCodeRequest(
+            phone_number=phone,
+            sign_name=settings.ALIYUN_SMS_SIGN_NAME,
+            template_code=settings.ALIYUN_SMS_TEMPLATE_CODE,
+            template_param=template_param,
+            code_length=settings.ALIYUN_SMS_CODE_LENGTH,
+            valid_time=settings.ALIYUN_SMS_VALID_TIME_SEC,
+            interval=(
+                settings.ALIYUN_SMS_INTERVAL_SEC
+                if cooldown_sec is None
+                else cooldown_sec
+            ),
+            scheme_name=settings.ALIYUN_SMS_SCHEME_NAME or None,
+        )
+        body = _get_client().send_sms_verify_code(req).body
+    except Exception as e:
+        logger.exception("[SMS-aliyun] send_sms_verify_code 调用异常 phone=%s****", phone[:3])
+        raise SmsError("短信服务暂不可用,请稍后重试", status_code=503) from e
+    return {"success": bool(body.success), "code": body.code, "message": body.message}
+
+
+def _call_check(phone: str, code: str) -> dict:
+    """调 CheckSmsVerifyCode。返回归一化 {success, code, message, verify_result};import/建 client/调用 任一失败抛 SmsError(503)。"""
+    try:
+        # import + 建 req + 调用 全在 try 内:任一 provider 侧失败都归一成 503(保「provider 出问题→503」不变式)
+        from alibabacloud_dypnsapi20170525 import models as dypns_models
+        req = dypns_models.CheckSmsVerifyCodeRequest(
+            phone_number=phone,
+            verify_code=code,
+            scheme_name=settings.ALIYUN_SMS_SCHEME_NAME or None,
+        )
+        body = _get_client().check_sms_verify_code(req).body
+    except Exception as e:
+        logger.exception("[SMS-aliyun] check_sms_verify_code 调用异常 phone=%s****", phone[:3])
+        raise SmsError("短信服务暂不可用,请稍后重试", status_code=503) from e
+    verify_result = getattr(body.model, "verify_result", None) if body.model else None
+    return {
+        "success": bool(body.success),
+        "code": body.code,
+        "message": body.message,
+        "verify_result": verify_result,
+    }

app/integrations/sms/base.py

@@ -0,0 +1,23 @@
+"""短信 provider 共享基座:业务异常 + provider 无关的 mock 校验。
+
+各 provider(jiguang / aliyun)都 `from .base import SmsError`,api 层也从包入口拿到同一个
+`SmsError` —— 保证无论用哪个 provider,异常类型与 HTTP 码映射语义一致。
+"""
+from __future__ import annotations
+
+from app.core.config import settings
+
+
+class SmsError(Exception):
+    """业务异常。`status_code` 决定 api 层翻成哪个 HTTP 码:
+    过频/每日超限 = 429(客户端等会再来),供应商不可用 = 503,手机号无效 = 400。
+    """
+
+    def __init__(self, message: str, status_code: int = 429) -> None:
+        super().__init__(message)
+        self.status_code = status_code
+
+
+def mock_verify(code: str) -> bool:
+    """mock 模式校验:放行任意 SMS_CODE_LENGTH 位数字(provider 无关,测试/开发便利,不真校验)。"""
+    return len(code) == settings.SMS_CODE_LENGTH and code.isdigit()

app/integrations/sms/chuanglan.py

@@ -0,0 +1,237 @@
+"""创蓝云智(253)短信 provider(自管码 Mode B)。
+
+创蓝 `tpl/send` v2 是**纯发送网关**(本服务生成码 → 放入 templateParamJson → 创蓝只下发,
+无校验接口),故与极光同为 **Mode B**:本服务生成/存储/校验验证码,创蓝只负责发。
+
+**本模块的存码/冷却/一次性/防爆破/GC 机器与 [jiguang.py](jiguang.py) 是刻意的隔离复制**
+(设计见 docs/superpowers/specs/2026-07-26-chuanglan-sms-verify-design.md):极光文件一行不动、
+零回归风险于登录关键路径的默认 provider;代价是两处 Mode B 并发逻辑重复,改动需同步。唯一新逻辑
+是 `_send_via_chuanglan`(HMAC-SHA256 签名 + httpx POST + 错误码映射)。
+
+两种运行模式由 `SMS_MOCK` 切换:
+  - **mock**(开发/测试,默认):不真发,验证码打日志;校验放行任意 N 位数字。
+  - **real**(`SMS_MOCK=false` 且 `SMS_PROVIDER=chuanglan`):`secrets` 生成码 → 调创蓝 `tpl/send`
+    下发(HMAC 签名,password 仅本地算签不上行)→ 校验比对本地存码(一次性 / 过期 / 防爆破)。
+
+验证码存储:**进程内存**(单 worker 够用,多 worker 不共享,与极光同级技术债)。防刷同极光:
+单号 `SMS_SEND_INTERVAL_SEC` 冷却(本文件)+ 单设备/IP 频控(api 层)+ 单码失败 `SMS_MAX_VERIFY_ATTEMPTS`
+次即作废。运维侧另需在创蓝控制台配 **IP 白名单**(否则 117)。接口调研见 docs/integrations/chuanglan/tpl-send.md。
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import logging
+import secrets
+import time
+from dataclasses import dataclass
+from threading import Lock
+
+import httpx
+
+from app.core.config import settings
+
+from .base import SmsError, mock_verify
+
+logger = logging.getLogger("shagua.sms.chuanglan")
+
+
+@dataclass
+class _CodeRecord:
+    code: str
+    expires_at: float
+    attempts: int = 0
+
+
+# 进程内存(单 worker 有效;多 worker 不共享,见模块 docstring)。与极光同结构。
+_codes: dict[str, _CodeRecord] = {}            # phone -> 当前有效验证码
+_last_sent: dict[str, float] = {}              # phone -> 上次发送 epoch(冷却)
+_lock = Lock()
+_GC_THRESHOLD = 10000  # 任一内存 dict 超此阈值,send 时顺手清过期项(防无限增长)
+
+# 发码错误码(创蓝 `code`)→ (HTTP 码, 用户提示)。未列出的一律 503(供应商不可用)。
+_SEND_ERRORS: dict[str, tuple[int, str]] = {
+    "103": (429, "发送过于频繁，请稍后再试"),   # 提交速度过快
+    "107": (400, "手机号无效"),                 # 手机号码错误
+}
+# 需运维介入的配置/开通/余额类错误:打 critical 日志(仍归 503)。
+_SEND_CRITICAL_CODES = frozenset({
+    "109",  # 无发送量/余额不足
+    "117",  # IP 未加白名单
+    "102",  # 密码错误
+    "116",  # 签名不合法
+    "124",  # 模板内容不匹配
+    "152",  # 模板不存在
+    "101",  # 账号不存在
+    "118",  # 无发送权限
+})
+
+
+def _gen_code() -> str:
+    """生成 N 位数字验证码(用 secrets 而非 random;允许前导 0)。"""
+    return "".join(secrets.choice("0123456789") for _ in range(settings.SMS_CODE_LENGTH))
+
+
+def _gc(now: float) -> None:
+    """顺手清理过期内存项,防两个 dict 无限增长。仅在持锁时调用,且某 dict 超阈值才扫它。"""
+    if len(_codes) > _GC_THRESHOLD:
+        for p in [p for p, r in _codes.items() if now > r.expires_at]:
+            _codes.pop(p, None)
+    if len(_last_sent) > _GC_THRESHOLD:
+        cutoff = now - settings.SMS_SEND_INTERVAL_SEC
+        for p in [p for p, ts in _last_sent.items() if ts < cutoff]:
+            _last_sent.pop(p, None)
+
+
+def send_code(phone: str, *, cooldown_sec: int | None = None) -> int:
+    """发送验证码。
+
+    Returns: 距下次可发的秒数(= SMS_SEND_INTERVAL_SEC)
+    Raises: SmsError(过频 429 / 手机号无效 400 / 供应商失败 503)
+    """
+    now = time.time()
+    effective_cooldown = (
+        settings.SMS_SEND_INTERVAL_SEC if cooldown_sec is None else cooldown_sec
+    )
+
+    # --- lock 内:防刷检查 + 预占(防并发重复发烧钱)---
+    with _lock:
+        _gc(now)  # 顺手清过期内存(超阈值才扫)
+        elapsed = now - _last_sent.get(phone, 0.0)
+        if elapsed < effective_cooldown:
+            remain = int(effective_cooldown - elapsed)
+            raise SmsError(f"发送过于频繁,请 {remain}s 后再试")
+
+        code = _gen_code()
+        # 预占:先记冷却/存码,释放锁后再发网络(发失败保留冷却,见下)
+        _last_sent[phone] = now
+        _codes[phone] = _CodeRecord(code=code, expires_at=now + settings.SMS_CODE_TTL_SEC)
+
+    # --- lock 外:真正发送(网络 IO 不持锁)---
+    try:
+        if settings.SMS_MOCK:
+            logger.info("[SMS-chuanglan-MOCK] to %s**** code=%s (不真发)", phone[:3], code)
+        else:
+            _send_via_chuanglan(phone, code)
+            logger.info("[SMS-chuanglan] sent to %s****", phone[:3])
+    except Exception as e:
+        # 发送失败:**保留冷却**(失败也限速,挡住余额不足/签名失效时前端重试狂打),
+        # 只清掉没发出去的码(用户收不到,留着无意义且占内存)。
+        with _lock:
+            _codes.pop(phone, None)
+        if isinstance(e, SmsError):
+            raise
+        logger.exception("[SMS-chuanglan] send failed phone=%s****", phone[:3])
+        raise SmsError("验证码发送失败,请稍后重试", status_code=503) from e
+
+    return effective_cooldown
+
+
+def verify_code(
+    phone: str,
+    code: str,
+    *,
+    max_failed_attempts: int | None = None,
+) -> bool:
+    """校验验证码。
+
+    - **mock 模式**:放行任意 N 位数字(测试/开发便利,不真校验)。
+    - **real 模式**:比对本服务存的码,匹配即作废(一次性);失败累计到上限也作废(防爆破)。
+    """
+    if settings.SMS_MOCK:
+        ok = mock_verify(code)
+        logger.info("[SMS-chuanglan-MOCK] verify %s for %s****", "ok" if ok else "fail", phone[:3])
+        return ok
+
+    effective_max_attempts = (
+        settings.SMS_MAX_VERIFY_ATTEMPTS
+        if max_failed_attempts is None
+        else max_failed_attempts
+    )
+    with _lock:
+        rec = _codes.get(phone)
+        if rec is None:
+            return False
+        if time.time() > rec.expires_at:
+            _codes.pop(phone, None)
+            return False
+        if rec.attempts >= effective_max_attempts:
+            _codes.pop(phone, None)  # 试错过多,作废
+            return False
+        if secrets.compare_digest(code.encode("utf-8"), rec.code.encode("utf-8")):
+            _codes.pop(phone, None)  # 验过即作废
+            return True
+        rec.attempts += 1
+        return False
+
+
+# ============================ 发送接缝(单测 monkeypatch 这两个 / httpx.post)============================
+
+def _sign(password: str, timestamp: str, nonce: str) -> str:
+    """创蓝 HMAC-SHA256 签名:key=md5(password),msg=sorted([md5pwd,ts,nonce]) 拼接去空白,输出小写 hex。"""
+    md5pwd = hashlib.md5(password.encode()).hexdigest()          # 32 位小写 hex
+    raw = "".join(sorted([md5pwd, timestamp, nonce]))            # 字典序升序,无分隔符拼接
+    raw = "".join(raw.split())                                  # 去所有空白(faithful;三段本无空白)
+    return hmac.new(md5pwd.encode(), raw.encode(), hashlib.sha256).hexdigest()
+
+
+def _call_chuanglan(phone: str, code: str) -> dict:
+    """组装 + 签名 + POST 创蓝 tpl/send,返回解析后的响应 dict。
+
+    传输错误 / HTTP≠200 / 响应非 JSON 一律抛 SmsError(503)(保「provider 出问题→503」不变式);
+    业务码(含 000000)由调用方 `_send_via_chuanglan` 判读。password 只用于算签,不入 body。
+    """
+    timestamp = str(int(time.time()))
+    nonce = secrets.token_hex(16)  # 32 位 hex
+    body = {
+        "account": settings.CHUANGLAN_SMS_ACCOUNT,
+        "timestamp": timestamp,
+        "nonce": nonce,
+        "phoneNumbers": phone,
+        "templateId": settings.CHUANGLAN_SMS_TEMPLATE_ID,
+        "templateParamJson": json.dumps([{"param1": code}]),
+    }
+    if settings.CHUANGLAN_SMS_SIGNATURE:
+        body["signature"] = settings.CHUANGLAN_SMS_SIGNATURE
+    headers = {
+        "Content-Type": "application/json",
+        "X-QA-Hmac-Signature": _sign(settings.CHUANGLAN_SMS_PASSWORD, timestamp, nonce),
+    }
+    try:
+        resp = httpx.post(
+            settings.CHUANGLAN_SMS_ENDPOINT,
+            json=body,
+            headers=headers,
+            timeout=settings.CHUANGLAN_SMS_TIMEOUT_SEC,
+        )
+    except httpx.HTTPError as e:
+        logger.exception("[SMS-chuanglan] 网络错误 phone=%s****", phone[:3])
+        raise SmsError("短信服务暂不可用,请稍后重试", status_code=503) from e
+
+    if resp.status_code != 200:
+        logger.error("[SMS-chuanglan] http=%s body=%s", resp.status_code, resp.text[:200])
+        raise SmsError("短信服务暂不可用,请稍后重试", status_code=503)
+    try:
+        return resp.json()
+    except Exception as e:
+        logger.error("[SMS-chuanglan] 响应非 JSON: %s", resp.text[:200])
+        raise SmsError("短信服务暂不可用,请稍后重试", status_code=503) from e
+
+
+def _send_via_chuanglan(phone: str, code: str) -> None:
+    """调创蓝 tpl/send 发送。成功静默返回;失败按错误码映射抛 SmsError。"""
+    if not settings.chuanglan_sms_configured:
+        raise SmsError("短信服务未配置(缺创蓝 account/password/templateId)", status_code=503)
+
+    result = _call_chuanglan(phone, code)  # 传输/非200/解析异常在内部抛 SmsError(503)
+    rcode = str(result.get("code"))
+    if rcode == "000000":
+        return
+
+    emsg = result.get("errorMsg") or ""
+    logger.error("[SMS-chuanglan] send failed code=%s msg=%s", rcode, emsg)
+    if rcode in _SEND_CRITICAL_CODES:
+        logger.critical("[SMS-chuanglan] %s —— 需运维处理(余额/IP白名单/密码/签名/模板/账号)", rcode)
+    status, msg = _SEND_ERRORS.get(rcode, (503, "短信服务暂不可用,请稍后重试"))
+    raise SmsError(msg, status_code=status)

app/integrations/sms/jiguang.py

@@ -1,15 +1,15 @@
-"""短信验证码服务。
+"""极光短信 provider(自管码 Mode B)。
 
 两种运行模式由 `SMS_MOCK` 切换:
   - **mock**(开发/测试,默认):不真发短信,验证码打到日志;校验**放行任意 N 位数字**
     (测试/开发便利)。真实校验逻辑(比对存码 / 一次性 / 防爆破)由 real 分支 + 单测覆盖。
-  - **real**(生产 `SMS_MOCK=false`):本服务生成 N 位验证码 → 调极光短信 REST
-    `/v1/messages` 发送(自定义验证码模式,极光只负责发,code 由本服务生成/保管/
+  - **real**(生产 `SMS_MOCK=false` 且 `SMS_PROVIDER=jiguang`):本服务生成 N 位验证码 → 调极光
+    短信 REST `/v1/messages` 发送(自定义验证码模式,极光只负责发,code 由本服务生成/保管/
     校验)→ 鉴权复用极光一键登录的 `JG_APP_KEY`/`JG_MASTER_SECRET`(同一极光应用)。
 
 验证码存储:**进程内存**(单 worker uvicorn 够用)。重启丢失(用户重发即可)。多
-worker / 多机时内存不共享 → 冷却、校验都会失效,届时迁移到 DB/Redis。
-见 docs/待办与技术债.md。
+worker / 多机时内存不共享 → 冷却、校验都会失效,届时迁移到 DB/Redis(或改用 aliyun provider,
+其验证码由阿里云托管、无本地存码)。见 docs/待办与技术债.md。
 
 防刷两层(短信花钱 + `/sms/send` 在登录前无法 JWT 鉴权):
   1. 单号 `SMS_SEND_INTERVAL_SEC` 冷却(本文件)
@@ -34,17 +34,9 @@ import httpx
 
 from app.core.config import settings
 
-logger = logging.getLogger("shagua.sms")
+from .base import SmsError, mock_verify
 
-
-class SmsError(Exception):
-    """业务异常。`status_code` 决定 api 层翻成哪个 HTTP 码:
-    过频/每日超限 = 429(客户端等会再来),供应商不可用 = 503,手机号无效 = 400。
-    """
-
-    def __init__(self, message: str, status_code: int = 429) -> None:
-        super().__init__(message)
-        self.status_code = status_code
+logger = logging.getLogger("shagua.sms.jiguang")
 
 
 @dataclass
@@ -78,20 +70,23 @@ def _gc(now: float) -> None:
             _last_sent.pop(p, None)
 
 
-def send_code(phone: str) -> int:
+def send_code(phone: str, *, cooldown_sec: int | None = None) -> int:
     """发送验证码。
 
     Returns: 距下次可发的秒数(= SMS_SEND_INTERVAL_SEC)
     Raises: SmsError(过频 429 / 当日超限 429 / 供应商失败 503 / 手机号无效 400)
     """
     now = time.time()
+    effective_cooldown = (
+        settings.SMS_SEND_INTERVAL_SEC if cooldown_sec is None else cooldown_sec
+    )
 
     # --- lock 内:防刷检查 + 预占(防并发重复发烧钱)---
     with _lock:
         _gc(now)  # 顺手清过期内存(超阈值才扫)
         elapsed = now - _last_sent.get(phone, 0.0)
-        if elapsed < settings.SMS_SEND_INTERVAL_SEC:
-            remain = int(settings.SMS_SEND_INTERVAL_SEC - elapsed)
+        if elapsed < effective_cooldown:
+            remain = int(effective_cooldown - elapsed)
             raise SmsError(f"发送过于频繁,请 {remain}s 后再试")
 
         code = _gen_code()
@@ -116,20 +111,30 @@ def send_code(phone: str) -> int:
         logger.exception("[SMS] send failed phone=%s****", phone[:3])
         raise SmsError("验证码发送失败,请稍后重试", status_code=503) from e
 
-    return settings.SMS_SEND_INTERVAL_SEC
+    return effective_cooldown
 
 
-def verify_code(phone: str, code: str) -> bool:
+def verify_code(
+    phone: str,
+    code: str,
+    *,
+    max_failed_attempts: int | None = None,
+) -> bool:
     """校验验证码。
 
     - **mock 模式**:放行任意 N 位数字(测试/开发便利,不真校验)。
     - **real 模式**:比对本服务存的码,匹配即作废(一次性);失败累计到上限也作废(防爆破)。
     """
     if settings.SMS_MOCK:
-        ok = len(code) == settings.SMS_CODE_LENGTH and code.isdigit()
+        ok = mock_verify(code)
         logger.info("[SMS-MOCK] verify %s for %s****", "ok" if ok else "fail", phone[:3])
         return ok
 
+    effective_max_attempts = (
+        settings.SMS_MAX_VERIFY_ATTEMPTS
+        if max_failed_attempts is None
+        else max_failed_attempts
+    )
     with _lock:
         rec = _codes.get(phone)
         if rec is None:
@@ -137,7 +142,7 @@ def verify_code(phone: str, code: str) -> bool:
         if time.time() > rec.expires_at:
             _codes.pop(phone, None)
             return False
-        if rec.attempts >= settings.SMS_MAX_VERIFY_ATTEMPTS:
+        if rec.attempts >= effective_max_attempts:
             _codes.pop(phone, None)  # 试错过多,作废
             return False
         if secrets.compare_digest(code.encode("utf-8"), rec.code.encode("utf-8")):

app/models/__init__.py

@@ -36,6 +36,7 @@ from app.models.inactivity import (  # noqa: F401
 from app.models.invite import InviteRelation  # noqa: F401
 from app.models.invite_fingerprint import InviteFingerprint  # noqa: F401
 from app.models.launch_confirm_sample import LaunchConfirmSample  # noqa: F401
+from app.models.limit_policy import LimitPolicyOverride  # noqa: F401
 from app.models.meituan_coupon import MeituanCoupon  # noqa: F401
 from app.models.notification import Notification  # noqa: F401
 from app.models.onboarding import OnboardingCompletion  # noqa: F401

app/models/comparison.py

@@ -102,12 +102,21 @@ class ComparisonRecord(Base):
     # done 帧 information 文案。成功:"在美团找到同店,到手价 ¥X…";
     # 失败:具体原因(如"美团、京东外卖均未找到该商品")。前端在比价失败时当原因展示。
     information: Mapped[str | None] = mapped_column(String(256), nullable=True)
+    # 失败卡「原因」行的展示文案(仅 status=failed 时非空):information 具体则=它;笼统则从
+    # platform_results 捞出的业务原因(打烊/未起送/找不到店或菜/单点不配送);纯系统失败为 None
+    # → 端侧显示品牌兜底「网络开小差…」。写路径(harvest_done / upsert_record)落库时派生。
+    # 见 repositories.comparison._derive_fail_display。
+    fail_reason: Mapped[str | None] = mapped_column(String(256), nullable=True)
 
     # ===== 明细(JSON,越详细越好)=====
     # 下单菜品 [{name, qty, specs?}]
     items: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
     # 逐平台对比 [{platform_id, platform_name, package, price, is_source, rank, coupon_saved, coupon_name, applied_coupons}](price/coupon_saved 单位:元,原样存;coupon_name=优惠来源名;applied_coupons=[{name,amount}] 多券明细)
     comparison_results: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
+    # 展示模型统一数组(pricebot done.params.platforms 原样存): 每平台一行、自带
+    # status/is_best/display/display_order, 记录页据此直接渲染, 不再靠 comparison_results
+    # + 客户端合并 + 前端派生。老记录/旧客户端为空 → 前端回退老 comparison_results 渲染。
+    platforms: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
     # 目标平台未找到、跳过的菜名
     skipped_dish_names: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
     # 客户端上报的原始 payload(calibration + done.params 全量),未来取数兜底

app/models/guide_video.py

@@ -1,7 +1,7 @@
 """新手引导视频播放记录(领券浮层前 N 次用它替代广告)。
 
 产品规则(2026-07 拍板):新用户点「一键自动领取」后的等候浮层,**前 3 次**不放广告,
-改放运营后台上传的引导视频;每次固定 120 金币,中途关闭也算看完照发。
+改放运营后台上传的引导视频;默认每次固定 100 金币,中途关闭也算看完照发。
 
 口径:
 - **计次按账号**(user_id),与设备无关 —— 换设备不重新送 3 次。
@@ -38,7 +38,13 @@ class GuideVideoPlay(Base):
         # start_play 捕获 IntegrityError 降级成"这次不放视频"。
         # 用 unique Index 而非 UniqueConstraint:与迁移里的 create_index 对齐(SQLite 加约束
         # 要整表重建),autogenerate 才不会每次报一条假 diff。
-        Index("uq_guide_video_play_user_seq", "user_id", "seq", unique=True),
+        Index(
+            "uq_guide_video_play_user_scene_seq",
+            "user_id",
+            "scene",
+            "seq",
+            unique=True,
+        ),
     )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)

app/models/limit_policy.py

@@ -0,0 +1,77 @@
+"""Per-subject limit policy overrides used by the admin whitelist page."""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import (
+    Boolean,
+    DateTime,
+    Index,
+    Integer,
+    String,
+    UniqueConstraint,
+    func,
+    true,
+)
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class LimitPolicyOverride(Base):
+    """One rule override for one phone or device.
+
+    ``reset_at`` is a non-destructive usage baseline.  Business records and
+    security events remain intact; quota readers only count rows at or after
+    this timestamp.
+    """
+
+    __tablename__ = "limit_policy_override"
+    __table_args__ = (
+        UniqueConstraint(
+            "subject_type",
+            "subject_value",
+            "rule_code",
+            name="uq_limit_policy_subject_rule",
+        ),
+        Index(
+            "ix_limit_policy_lookup",
+            "subject_type",
+            "subject_value",
+            "rule_code",
+            "enabled",
+        ),
+        Index("ix_limit_policy_expires", "expires_at"),
+    )
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    subject_type: Mapped[str] = mapped_column(String(16), nullable=False)
+    subject_value: Mapped[str] = mapped_column(String(128), nullable=False)
+    rule_code: Mapped[str] = mapped_column(String(64), nullable=False)
+    # 产品只保留“临时不限/免告警”。即使有内部脚本绕过 API 直接建 ORM
+    # 对象，也不能再悄悄落成已经下线的 override 模式。
+    mode: Mapped[str] = mapped_column(String(24), nullable=False, default="unlimited")
+    limit_value: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    enabled: Mapped[bool] = mapped_column(
+        Boolean, nullable=False, default=True, server_default=true()
+    )
+    starts_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    expires_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    reset_at: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), nullable=True
+    )
+    reason: Mapped[str | None] = mapped_column(String(256), nullable=True)
+    created_by_admin_id: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True),
+        server_default=func.now(),
+        onupdate=func.now(),
+        nullable=False,
+    )

app/repositories/ad_feed_reward.py

@@ -5,11 +5,13 @@
 """
 from __future__ import annotations
 
+from datetime import datetime
+
 from sqlalchemy import func, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
-from app.core import rewards
+from app.core import limit_policy, rewards
 from app.core.rewards import cn_today
 from app.models.ad_feed_reward import AdFeedRewardRecord
 from app.repositories import wallet as crud_wallet
@@ -29,8 +31,14 @@ def _find_by_event(db: Session, client_event_id: str) -> AdFeedRewardRecord | No
     ).scalar_one_or_none()
 
 
-def _granted_today(db: Session, user_id: int, reward_date: str) -> int:
-    return db.execute(
+def _granted_today(
+    db: Session,
+    user_id: int,
+    reward_date: str,
+    *,
+    reset_at: datetime | None = None,
+) -> int:
+    stmt = (
         select(func.count())
         .select_from(AdFeedRewardRecord)
         .where(
@@ -38,7 +46,10 @@ def _granted_today(db: Session, user_id: int, reward_date: str) -> int:
             AdFeedRewardRecord.reward_date == reward_date,
             AdFeedRewardRecord.status == "granted",
         )
-    ).scalar_one()
+    )
+    if reset_at is not None:
+        stmt = stmt.where(AdFeedRewardRecord.created_at >= reset_at)
+    return db.execute(stmt).scalar_one()
 
 
 def granted_unit_total(db: Session, user_id: int) -> int:
@@ -121,7 +132,27 @@ def grant_feed_reward(
         )
         return _commit_record(db, rec, client_event_id)
 
-    if _granted_today(db, user_id, today) >= rewards.get_ad_daily_limit(db):
+    daily_policy = limit_policy.resolve_for_user(
+        db,
+        "ad.feed.daily",
+        user_id,
+    )
+    daily_limit = (
+        rewards.get_ad_daily_limit(db)
+        if daily_policy.override_id is None
+        and daily_policy.bucket_version == "default"
+        else daily_policy.limit
+    )
+    if (
+        daily_limit is not None
+        and _granted_today(
+            db,
+            user_id,
+            today,
+            reset_at=daily_policy.reset_at,
+        )
+        >= daily_limit
+    ):
         rec = AdFeedRewardRecord(
             client_event_id=client_event_id,
             user_id=user_id,

app/repositories/ad_reward.py

@@ -10,13 +10,13 @@
 """
 from __future__ import annotations
 
-from datetime import datetime, timezone
+from datetime import UTC, datetime
 
 from sqlalchemy import func, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
-from app.core import rewards
+from app.core import limit_policy, rewards
 from app.core.ad_cooldown import compute_cooldown
 from app.core.rewards import DAILY_AD_WATCH_SECONDS_LIMIT, cn_today
 from app.models.ad_reward import AdRewardRecord
@@ -96,8 +96,14 @@ def round_coin_total(db: Session, user_id: int, boost_round_id: str) -> int:
     )
 
 
-def _granted_today(db: Session, user_id: int, reward_date: str) -> int:
-    return db.execute(
+def _granted_today(
+    db: Session,
+    user_id: int,
+    reward_date: str,
+    *,
+    reset_at: datetime | None = None,
+) -> int:
+    stmt = (
         select(func.count())
         .select_from(AdRewardRecord)
         .where(
@@ -106,7 +112,10 @@ def _granted_today(db: Session, user_id: int, reward_date: str) -> int:
             AdRewardRecord.status == "granted",
             AdRewardRecord.reward_scene == "reward_video",
         )
-    ).scalar_one()
+    )
+    if reset_at is not None:
+        stmt = stmt.where(AdRewardRecord.created_at >= reset_at)
+    return db.execute(stmt).scalar_one()
 
 
 def _granted_cumulative(db: Session, user_id: int) -> int:
@@ -165,7 +174,27 @@ def grant_ad_reward(
         DAILY_AD_WATCH_SECONDS_LIMIT > 0
         and watched_seconds_today(db, user_id, today=today) >= DAILY_AD_WATCH_SECONDS_LIMIT
     )
-    over_count = _granted_today(db, user_id, today) >= rewards.get_ad_daily_limit(db)
+    daily_policy = limit_policy.resolve_for_user(
+        db,
+        "ad.reward_video.daily",
+        user_id,
+    )
+    daily_limit = (
+        rewards.get_ad_daily_limit(db)
+        if daily_policy.override_id is None
+        and daily_policy.bucket_version == "default"
+        else daily_policy.limit
+    )
+    over_count = (
+        daily_limit is not None
+        and _granted_today(
+            db,
+            user_id,
+            today,
+            reset_at=daily_policy.reset_at,
+        )
+        >= daily_limit
+    )
     if over_time or over_count:
         rec = AdRewardRecord(
             trans_id=trans_id, user_id=user_id, coin=0, status="capped",
@@ -321,19 +350,24 @@ def _commit_record(db: Session, rec: AdRewardRecord, trans_id: str) -> AdRewardR
     return rec
 
 
-def _granted_times_today_desc(db: Session, user_id: int, reward_date: str) -> list[datetime]:
+def _granted_times_today_desc(
+    db: Session,
+    user_id: int,
+    reward_date: str,
+    *,
+    reset_at: datetime | None = None,
+) -> list[datetime]:
     """当日 status=granted 记录的 created_at,按时间倒序(最新在前)——冷却策略的输入数据。"""
-    return list(
-        db.execute(
-            select(AdRewardRecord.created_at)
-            .where(
+    stmt = select(AdRewardRecord.created_at).where(
                 AdRewardRecord.user_id == user_id,
                 AdRewardRecord.reward_date == reward_date,
                 AdRewardRecord.status == "granted",
                 AdRewardRecord.reward_scene == "reward_video",
             )
-            .order_by(AdRewardRecord.created_at.desc())
-        ).scalars()
+    if reset_at is not None:
+        stmt = stmt.where(AdRewardRecord.created_at >= reset_at)
+    return list(
+        db.execute(stmt.order_by(AdRewardRecord.created_at.desc())).scalars()
     )
 
 
@@ -349,16 +383,47 @@ def today_status(
     旧客户端兼容,当前 DAILY_AD_WATCH_SECONDS_LIMIT=0 表示不启用时长闸。
     """
     today = cn_today().isoformat()
-    granted_desc = _granted_times_today_desc(db, user_id, today)
+    daily_policy = limit_policy.resolve_for_user(
+        db,
+        "ad.reward_video.daily",
+        user_id,
+    )
+    cooldown_policy = limit_policy.resolve_for_user(
+        db,
+        "ad.reward_video.cooldown",
+        user_id,
+    )
+    daily_limit = (
+        rewards.get_ad_daily_limit(db)
+        if daily_policy.override_id is None
+        and daily_policy.bucket_version == "default"
+        else daily_policy.limit
+    )
+    cooldown_seconds = (
+        rewards.get_ad_cooldown_sec(db)
+        if cooldown_policy.override_id is None
+        and cooldown_policy.bucket_version == "default"
+        else (cooldown_policy.limit or 0)
+    )
+    granted_desc = _granted_times_today_desc(
+        db,
+        user_id,
+        today,
+        reset_at=daily_policy.reset_at,
+    )
     state = compute_cooldown(
         granted_desc,
-        datetime.now(timezone.utc),
+        datetime.now(UTC),
         round_size=rewards.get_ad_round_count(db),
-        cooldown_seconds=rewards.get_ad_cooldown_sec(db),
+        cooldown_seconds=cooldown_seconds,
     )
     return (
         len(granted_desc),
-        rewards.get_ad_daily_limit(db),
+        (
+            daily_limit
+            if daily_limit is not None
+            else limit_policy.get_rule("ad.reward_video.daily").max_value
+        ),
         0,
         state.round_count,
         state.cooldown_until,

app/repositories/comparison.py

@@ -52,6 +52,81 @@ def _product_names_from_items(items: list | None) -> str | None:
     return joined[:500] or None
 
 
+# ---- 失败记录的展示文案(记录页失败卡「原因」行)------------------------------
+# information 具体就直出;笼统(_GENERIC_INFO)则从 platform_results 捞一条用户可读的业务
+# 原因;捞不到 → None(端侧显示品牌兜底「网络开小差…」)。pricebot 把 store_closed /
+# no_delivery 漏成了 status=failed,这里按 reason 关键字补判;打烊类 reason 常带一坨脏店名
+# (店名+月售+起送+配送…),统一成简短模板。自动化黑话(搜索失败/读价失败/购物车残留/裸
+# FAILED…)不给用户看 → 归入品牌兜底。
+
+# pricebot 组不出具体原因时的笼统 information(线上统计的大头),一律走品牌兜底。
+_GENERIC_INFO = {
+    "比价过程出错，请稍后重试",
+    "比价出错",
+    "比价未完成",
+    "done 参数缺少可验证的目标平台结果",
+}
+# 干净业务结局 status(直接可信),按展示优先级(越靠前越先选)。
+_BIZ_STATUS_PRIORITY = (
+    "below_minimum",
+    "no_delivery",
+    "store_closed",
+    "items_not_found",
+    "store_not_found",
+)
+
+
+def _store_closed_text(reason: str | None) -> str:
+    """打烊/暂停营业/休息类 reason 常带脏店名元数据 → 只留结论,套简短模板。"""
+    r = reason or ""
+    if "暂停营业" in r:
+        state = "暂停营业"
+    elif "休息" in r:
+        state = "休息中"
+    else:
+        state = "已打烊"
+    return f"门店{state}，无法比价"
+
+
+def _target_display_reason(platform_results: dict | None) -> str | None:
+    """从逐平台结果里挑一条"可展示给用户"的失败原因;挑不到返回 None。
+    ① status 命中干净业务结局集 → 直接采信(打烊套模板,其余用 reason);
+    ② 补判 pricebot 漏成 status=failed 的两类:打烊(套模板)、单点不配送(reason 本身干净);
+    自动化黑话(搜索失败/读价失败/购物车残留/裸 FAILED…)一律不展示 → None。"""
+    pr = platform_results or {}
+    targets = [
+        v for v in pr.values() if isinstance(v, dict) and not v.get("is_source")
+    ]
+    for want in _BIZ_STATUS_PRIORITY:  # ① 干净 status 优先
+        for v in targets:
+            if v.get("status") == want:
+                if want == "store_closed":
+                    return _store_closed_text(v.get("reason"))
+                if v.get("reason"):
+                    return v["reason"]
+    for v in targets:  # ② 漏成 failed 的业务结局补判
+        if v.get("status") != "failed":
+            continue
+        reason = (v.get("reason") or "").strip()
+        if any(k in reason for k in ("打烊", "暂停营业", "休息")):
+            return _store_closed_text(reason)
+        if "单点不配送" in reason:
+            return reason
+    return None
+
+
+def _derive_fail_display(
+    information: str | None, platform_results: dict | None
+) -> str | None:
+    """失败记录展示文案:information 具体则直出;笼统则从 platform_results 捞/补判;
+    都拿不到 → None(端侧品牌兜底)。仅在 status=failed 时调用。"""
+    info = (information or "").strip()
+    text = info if (info and info not in _GENERIC_INFO) else _target_display_reason(
+        platform_results
+    )
+    return text[:256] if text else None
+
+
 def _derive(payload: ComparisonRecordIn) -> dict:
     """从上报 payload 派生结构化列(best/saved/is_source_best/status)。"""
     results = payload.comparison_results
@@ -89,8 +164,9 @@ def _derive(payload: ComparisonRecordIn) -> dict:
 
     is_source_best = best.is_source if best is not None else None
 
-    # status:客户端显式给了就用;否则有"非源且有价"的结果=success,否则 failed
-    status = payload.status
+    # status:优先 pricebot record_status(区分 below_minimum/store_closed) → 客户端显式 status
+    # → 兜底"非源且有价"=success/否则 failed。record_status 让"未满起送"不再塌缩成 failed。
+    status = payload.record_status or payload.status
     if status is None:
         has_valid_target = any(
             (not r.is_source) and r.price is not None for r in results
@@ -105,6 +181,11 @@ def _derive(payload: ComparisonRecordIn) -> dict:
         "saved_amount_cents": saved_amount_cents,
         "is_source_best": is_source_best,
         "status": status,
+        "fail_reason": (
+            _derive_fail_display(payload.information, _pr)
+            if status == "failed"
+            else None
+        ),
     }
 
 
@@ -117,16 +198,35 @@ def upsert_record(
     灰度期老客户端 POST /compare/record 走这条,与后端 harvest 按 trace_id reconcile;
     新客户端不再 POST(改由 compare.py 透传壳 harvest 落库)。
     """
-    derived = _derive(payload)
+    # 单源派生: 与 harvest_done 一致, payload 带 platforms 时从它派生(唯一真相源
+    # _derive_from_platforms), 老客户端不带 platforms 时回退 _derive(从 comparison_results)。
+    if payload.platforms:
+        derived = _derive_from_platforms(payload.platforms, payload.record_status)
+        # 对齐 _derive 返回键(#189 fail_reason): 两路径 fields 键集一致, 覆盖已有行时不残留旧值
+        derived["fail_reason"] = (
+            _derive_fail_display(payload.information, payload.platform_results or {})
+            if derived["status"] == "failed"
+            else None
+        )
+        # 单源派生取自 platforms 源行(常无源平台元数据/店名)→ 空则用 payload 兜底不丢字段。
+        # 下面 fields 不再显式写这四个键, 统一由 derived 提供(否则 dict(store_name=..., **derived)
+        # 与 _derive_from_platforms 同名键撞键 TypeError)。
+        for _k in ("store_name", "source_platform_id", "source_platform_name", "source_package"):
+            if not derived.get(_k):
+                derived[_k] = getattr(payload, _k)
+    else:
+        derived = _derive(payload)
+        # _derive 只从 comparison_results 派生, 不含源平台四件套 / store_name → 从 payload 补,
+        # 与上面 platforms 分支键集对齐(fields 统一靠 **derived 提供这些列)。
+        for _k in ("store_name", "source_platform_id", "source_platform_name", "source_package"):
+            derived[_k] = getattr(payload, _k)
     items = [it.model_dump(exclude_none=True) for it in payload.items]
     fields = dict(
         device_id=payload.device_id,
         business_type=payload.business_type,
-        store_name=payload.store_name,
         product_names=_product_names_from_items(items),
-        source_platform_id=payload.source_platform_id,
-        source_platform_name=payload.source_platform_name,
-        source_package=payload.source_package,
+        # store_name / source_platform_id / source_platform_name / source_package 统一由
+        # derived 提供(见上方两分支补齐), 不在此显式写 —— 否则与 _derive_from_platforms 撞键。
         information=payload.information,
         best_deeplink=payload.best_deeplink,
         trace_url=payload.trace_url,
@@ -134,6 +234,7 @@ def upsert_record(
         skipped_dish_count=payload.skipped_dish_count,
         items=items,
         comparison_results=[r.model_dump() for r in payload.comparison_results],
+        platforms=list(payload.platforms or []),
         skipped_dish_names=list(payload.skipped_dish_names),
         # 客户端环境 / 性能(debug,客户端上报;旧客户端为 None)
         device_model=payload.device_model,
@@ -206,7 +307,8 @@ def upsert_record(
 
 
 def _derive_from_results(
-    results: list[dict], platform_results: dict | None = None
+    results: list[dict], platform_results: dict | None = None,
+    record_status: str | None = None,
 ) -> dict:
     """从 done 帧 comparison_results(pricebot 原始 dict 列表)派生结构化列。
     等价 _derive,但吃原始字段(is_source/price/rank/platform_id/store_name...)而非 pydantic 对象。
@@ -254,7 +356,53 @@ def _derive_from_results(
         "saved_amount_cents": saved_amount_cents,
         "is_source_best": best.get("is_source") if best else None,
         "store_name": (src_row or {}).get("store_name") or None,
-        "status": "success" if has_valid_target else "failed",
+        # 记录级结局: 优先用 pricebot 下发的 record_status(区分 below_minimum/store_closed,
+        # 不再把"未满起送"塌缩成 failed → 记录页不再误报"网络开小差"); 旧 pricebot 未下发时
+        # 回退老的 success/failed 二态派生, 向后兼容。
+        "status": record_status or ("success" if has_valid_target else "failed"),
+    }
+
+
+def _derive_from_platforms(
+    platforms: list, record_status: str | None = None,
+) -> dict:
+    """从 done 帧 platforms(每平台一行、渲染就绪)派生结构化列——**单一真相源**。
+
+    best_* 直接取 platforms 里 is_best 的那一行、source_* 取 role=source 行,与前端读的
+    platforms 天然一致(不再像 _derive_from_results 那样从 comparison_results 二次评最优,
+    消除"标量列 vs platforms"双源不一致)。platforms 非空时优先走这里;老 pricebot 无
+    platforms 时调用方回退 _derive_from_results(向后兼容)。"""
+    rows = [p for p in (platforms or []) if isinstance(p, dict)]
+    src = next((p for p in rows if p.get("role") == "source"), None)
+    best = next((p for p in rows if p.get("is_best")), None)
+    source_price_cents = _yuan_to_cents(src.get("price")) if src else None
+    best_price_cents = _yuan_to_cents(best.get("price")) if best else None
+    saved_amount_cents = None
+    if source_price_cents is not None and best_price_cents is not None:
+        saved_amount_cents = source_price_cents - best_price_cents
+    has_valid_target = any(
+        p.get("role") != "source" and p.get("price") is not None for p in rows
+    )
+    # store_name: 优先源行; recompare 场景源平台自己当目标、源行被目标覆盖(pricebot
+    # _build_platform_rows 有意去重, platforms 无 role=source 行)→ 回退 best 行 → 首个有店名
+    # 的行(显示现场实际比到的店), 免得记录页店名空掉兜底显示成"比价"。正常比价有源行不走回退。
+    store_name = (
+        (src or {}).get("store_name")
+        or (best or {}).get("store_name")
+        or next((p.get("store_name") for p in rows if p.get("store_name")), None)
+    )
+    return {
+        "source_platform_id": (src or {}).get("platform_id"),
+        "source_platform_name": (src or {}).get("platform_name"),
+        "source_package": (src or {}).get("package"),
+        "source_price_cents": source_price_cents,
+        "best_platform_id": (best or {}).get("platform_id"),
+        "best_platform_name": (best or {}).get("platform_name"),
+        "best_price_cents": best_price_cents,
+        "saved_amount_cents": saved_amount_cents,
+        "is_source_best": (best.get("role") == "source") if best else None,
+        "store_name": store_name or None,
+        "status": record_status or ("success" if has_valid_target else "failed"),
     }
 
 
@@ -286,6 +434,8 @@ def reserve_daily_start(
     business_type: str = "food",
     device_id: str | None = None,
     now: datetime | None = None,
+    limit: int | None = DAILY_COMPARE_START_LIMIT,
+    reset_at: datetime | None = None,
 ) -> tuple[ComparisonRecord, int]:
     """Atomically reserve one of a user's 100 Beijing-day comparison starts.
 
@@ -311,6 +461,11 @@ def reserve_daily_start(
         if existing_at.tzinfo is not None:
             existing_at = existing_at.astimezone(CN_TZ).replace(tzinfo=None)
         day_start = existing_at.replace(hour=0, minute=0, second=0, microsecond=0)
+        if reset_at is not None:
+            reset_start = reset_at
+            if reset_start.tzinfo is not None:
+                reset_start = reset_start.astimezone(CN_TZ).replace(tzinfo=None)
+            day_start = max(day_start, reset_start)
         day_end = day_start + timedelta(days=1)
         used = db.scalar(
             select(func.count(ComparisonRecord.id)).where(
@@ -325,6 +480,11 @@ def reserve_daily_start(
     if current.tzinfo is not None:
         current = current.astimezone(CN_TZ).replace(tzinfo=None)
     day_start = current.replace(hour=0, minute=0, second=0, microsecond=0)
+    if reset_at is not None:
+        reset_start = reset_at
+        if reset_start.tzinfo is not None:
+            reset_start = reset_start.astimezone(CN_TZ).replace(tzinfo=None)
+        day_start = max(day_start, reset_start)
     day_end = day_start + timedelta(days=1)
     used = db.scalar(
         select(func.count(ComparisonRecord.id)).where(
@@ -333,7 +493,7 @@ def reserve_daily_start(
             ComparisonRecord.created_at < day_end,
         )
     ) or 0
-    if used >= DAILY_COMPARE_START_LIMIT:
+    if limit is not None and used >= limit:
         raise DailyCompareStartLimitExceeded
 
     rec = ComparisonRecord(
@@ -413,12 +573,40 @@ def harvest_done(
     返回 (记录, 是否本次**新**落成 success)——供调用方据此幂等发一次邀请奖。
     行不存在(理论上帧0已建;防御)则新建。"""
     results = done_params.get("comparison_results") or []
-    derived = _derive_from_results(results, done_params.get("platform_results"))
-    # 菜品:pricebot 已把源单菜品塞进 comparison_results[源行].items
-    items = next((r.get("items") or [] for r in results if r.get("is_source")), [])
+    # 展示模型统一数组(pricebot 新增, 每平台一行自带 status/is_best): 原样存, 记录页据此直渲染。
+    # record_status: 记录级结局(success/below_minimum/store_closed/failed), 覆盖老二态派生。
+    platforms = done_params.get("platforms") or []
+    record_status = done_params.get("record_status")
+    # 单源派生: platforms(含 pricebot 权威 is_best)是唯一真相源, best_*/source_*/saved/status
+    # 全从它取 → 与前端读的 platforms 天然一致; 菜品也取 platforms 源行。老 pricebot 无
+    # platforms 时回退从 comparison_results 派生(向后兼容)。
+    if platforms:
+        derived = _derive_from_platforms(platforms, record_status)
+        # 菜品优先源行; recompare 无源行 → 回退 best 行 → 首个有菜品的行(同 store_name 回退)
+        _item_row = (
+            next((p for p in platforms if isinstance(p, dict) and p.get("role") == "source"), None)
+            or next((p for p in platforms if isinstance(p, dict) and p.get("is_best")), None)
+            or next((p for p in platforms if isinstance(p, dict) and p.get("items")), None)
+        )
+        items = (_item_row or {}).get("items") or []
+    else:
+        derived = _derive_from_results(
+            results, done_params.get("platform_results"), record_status
+        )
+        # pricebot 已把源单菜品塞进 comparison_results[源行].items
+        items = next((r.get("items") or [] for r in results if r.get("is_source")), [])
+    # 失败展示原因(#189): platforms / results 两个派生分支的 status 都可能 failed, 统一在此算
+    fail_reason = (
+        _derive_fail_display(
+            done_params.get("information"), done_params.get("platform_results")
+        )
+        if derived["status"] == "failed"
+        else None
+    )
     fields = dict(
         business_type=business_type or "food",
         information=done_params.get("information") or None,
+        fail_reason=fail_reason,
         # best_deeplink 来自客户端剪贴板采集,harvest 拿不到 → 留空(灰度期 fromComparison 会补;
         # 纯 harvest 行「再次比价」退化为按 package 拉起 App。要精确深链需客户端另传,后续)。
         trace_url=trace_url or done_params.get("trace_url"),
@@ -426,6 +614,7 @@ def harvest_done(
         skipped_dish_count=done_params.get("skipped_dish_count"),
         skipped_dish_names=list(done_params.get("skipped_dish_names") or []),
         comparison_results=results,
+        platforms=platforms,
         items=items,
         product_names=_product_names_from_items(items),
         raw_payload=done_params,

app/repositories/guide_video.py

@@ -1,8 +1,8 @@
 """新手引导视频:运营配置读写 + 播放计次 + 发币。
 
-**配置**(开关 / 视频地址 / 前几次 / 每次金币)整体作为一个 JSON 存进通用 app_config 表
-(key=coupon_guide_video),写法完全对齐 feedback_qr —— 不进 CONFIG_DEFS,所以不会污染
-系统配置页的通用列表,由本模块独占维护。
+**配置**(开关 / 视频地址 / 前几次 / 每次金币)按场景分别作为一个 JSON 存进通用
+app_config 表。领券使用 coupon_guide_video，比价使用 comparison_guide_video；
+写法完全对齐 feedback_qr，不进入系统配置页的通用列表。
 
 **计次**按账号(user_id)、**开播即计数**:客户端每次要展示领券等候浮层时调
 `/api/v1/guide-video/start`,命中则当场写一行 guide_video_play(status='playing')。
@@ -25,12 +25,16 @@ from sqlalchemy import func, select, update
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
-from app.core import rewards
+from app.core import limit_policy, rewards
 from app.models.app_config import AppConfig
 from app.models.guide_video import GuideVideoPlay
 from app.repositories import wallet as crud_wallet
 
-_KEY = "coupon_guide_video"
+SCENES = ("coupon", "comparison")
+_KEY_BY_SCENE = {
+    "coupon": "coupon_guide_video",
+    "comparison": "comparison_guide_video",
+}
 
 #: 金币流水 biz_type。客户端收益明细按它显示「新手引导视频奖励」。
 BIZ_TYPE = "guide_video"
@@ -41,7 +45,7 @@ _DEFAULTS: dict[str, Any] = {
     "enabled": True,
     "video_url": None,   # None/空 = 未配片 → 不下发,浮层照旧放广告
     "max_plays": 3,      # 每个账号前 N 次浮层放引导视频
-    "reward_coin": 120,  # 每次固定金币
+    "reward_coin": 100,  # 每次固定金币
 }
 
 _FIELDS = tuple(_DEFAULTS.keys())
@@ -65,19 +69,38 @@ def _merge(raw: Any) -> dict[str, Any]:
     return out
 
 
-def get_config(db: Session) -> dict[str, Any]:
+def _config_key(scene: str) -> str:
+    if scene not in _KEY_BY_SCENE:
+        raise ValueError(f"unsupported guide video scene: {scene}")
+    return _KEY_BY_SCENE[scene]
+
+
+def get_config(db: Session, scene: str = "coupon") -> dict[str, Any]:
     """完整配置 + updated_at(admin 读 / 业务读共用)。"""
-    row = db.get(AppConfig, _KEY)
+    row = db.get(AppConfig, _config_key(scene))
     cfg = _merge(row.value if row is not None else None)
+    if scene == "coupon":
+        # 白名单里的引导视频规则只对应领券场景；比价仍使用自己的独立配置。
+        cfg["max_plays"] = limit_policy.resolve(
+            db, "guide.video.lifetime"
+        ).global_limit
     cfg["updated_at"] = row.updated_at.isoformat() if row is not None and row.updated_at else None
     return cfg
 
 
-def _write(db: Session, value: dict[str, Any], *, admin_id: int, commit: bool) -> dict[str, Any]:
+def _write(
+    db: Session,
+    value: dict[str, Any],
+    *,
+    scene: str,
+    admin_id: int,
+    commit: bool,
+) -> dict[str, Any]:
     """整体覆写该行(value 须为完整字段 dict),返回合并后的完整配置(含 updated_at)。"""
-    row = db.get(AppConfig, _KEY)
+    key = _config_key(scene)
+    row = db.get(AppConfig, key)
     if row is None:
-        row = AppConfig(key=_KEY, value=value, updated_by_admin_id=admin_id)
+        row = AppConfig(key=key, value=value, updated_by_admin_id=admin_id)
         db.add(row)
     else:
         row.value = value  # 整体重新赋值,SQLAlchemy 才侦测得到变更
@@ -98,11 +121,12 @@ def update_config(
     enabled: bool | None = None,
     max_plays: int | None = None,
     reward_coin: int | None = None,
+    scene: str = "coupon",
     admin_id: int,
     commit: bool = True,
 ) -> tuple[dict[str, Any], dict[str, Any]]:
     """改开关 / 次数 / 金币(只改传了的字段;视频走 set_video)。返回 (before, after) 供审计。"""
-    row = db.get(AppConfig, _KEY)
+    row = db.get(AppConfig, _config_key(scene))
     before = _merge(row.value if row is not None else None)
     new_value = {k: before[k] for k in _FIELDS}
     if enabled is not None:
@@ -111,45 +135,91 @@ def update_config(
         new_value["max_plays"] = max(0, min(int(max_plays), MAX_PLAYS_LIMIT))
     if reward_coin is not None:
         new_value["reward_coin"] = max(0, min(int(reward_coin), REWARD_COIN_LIMIT))
-    after = _write(db, new_value, admin_id=admin_id, commit=commit)
+    after = _write(
+        db,
+        new_value,
+        scene=scene,
+        admin_id=admin_id,
+        commit=False,
+    )
+    if scene == "coupon" and max_plays is not None:
+        # 兼容仍调用旧专用接口的客户端/脚本，并把统一策略全局值一并更新。
+        from app.core.config_schema import GUIDE_VIDEO_MAX_PLAYS_KEY
+        from app.repositories import app_config
+
+        app_config.set_value(
+            db,
+            GUIDE_VIDEO_MAX_PLAYS_KEY,
+            new_value["max_plays"],
+            admin_id=admin_id,
+            commit=False,
+        )
+    if commit:
+        db.commit()
+        after = get_config(db, scene)
     return before, after
 
 
 def set_video(
-    db: Session, video_url: str | None, *, admin_id: int, commit: bool = True
+    db: Session,
+    video_url: str | None,
+    *,
+    scene: str = "coupon",
+    admin_id: int,
+    commit: bool = True,
 ) -> tuple[dict[str, Any], dict[str, Any]]:
     """设置/清空引导视频地址。返回 (before, after);before['video_url'] 供调用方删旧文件。"""
-    row = db.get(AppConfig, _KEY)
+    row = db.get(AppConfig, _config_key(scene))
     before = _merge(row.value if row is not None else None)
     new_value = {k: before[k] for k in _FIELDS}
     new_value["video_url"] = video_url
-    after = _write(db, new_value, admin_id=admin_id, commit=commit)
+    after = _write(
+        db,
+        new_value,
+        scene=scene,
+        admin_id=admin_id,
+        commit=commit,
+    )
     return before, after
 
 
 # ===== 播放计次 =====
 
 
-def used_plays(db: Session, user_id: int) -> int:
+def used_plays(
+    db: Session,
+    user_id: int,
+    *,
+    scene: str = "coupon",
+    reset_at: datetime | None = None,
+) -> int:
     """该账号已用掉的引导视频次数(开播即算,含未发币的)。"""
-    return int(
-        db.execute(
-            select(func.count()).select_from(GuideVideoPlay).where(
-                GuideVideoPlay.user_id == user_id
-            )
-        ).scalar_one()
+    stmt = select(func.count()).select_from(GuideVideoPlay).where(
+        GuideVideoPlay.user_id == user_id,
+        GuideVideoPlay.scene == scene,
     )
+    if reset_at is not None:
+        # 该表的既有写入口使用北京时间 naive 墙钟，重置基线必须转换成
+        # 同一存储口径再比较；单独改成 UTC 会让存量/增量记录偏移 8 小时。
+        reset_value = reset_at.astimezone(rewards.CN_TZ).replace(tzinfo=None)
+        stmt = stmt.where(GuideVideoPlay.started_at >= reset_value)
+    return int(db.execute(stmt).scalar_one())
 
 
-def play_stats(db: Session) -> dict[str, int]:
+def play_stats(db: Session, scene: str = "coupon") -> dict[str, int]:
     """全站播放统计(admin 页展示):总播放次数 / 其中已发币次数。"""
     total = int(
-        db.execute(select(func.count()).select_from(GuideVideoPlay)).scalar_one()
+        db.execute(
+            select(func.count()).select_from(GuideVideoPlay).where(
+                GuideVideoPlay.scene == scene
+            )
+        ).scalar_one()
     )
     granted = int(
         db.execute(
             select(func.count()).select_from(GuideVideoPlay).where(
-                GuideVideoPlay.status == "granted"
+                GuideVideoPlay.status == "granted",
+                GuideVideoPlay.scene == scene,
             )
         ).scalar_one()
     )
@@ -168,11 +238,22 @@ def start_play(
       reward_coin  播完/中途关闭都发的固定金币
       seq / remaining  第几次 / 发完这次还剩几次(仅展示与排查用)
     """
-    cfg = get_config(db)
+    _config_key(scene)
+    cfg = get_config(db, scene)
     video_url = (cfg.get("video_url") or "").strip()
-    max_plays = int(cfg.get("max_plays") or 0)
+    policy = (
+        limit_policy.resolve_for_user(db, "guide.video.lifetime", user_id)
+        if scene == "coupon"
+        else None
+    )
+    max_plays = policy.limit if policy is not None else int(cfg.get("max_plays") or 0)
+    exposed_max_plays = max_plays if max_plays is not None else 1_000_000
     reward_coin = int(cfg.get("reward_coin") or 0)
-    used = used_plays(db, user_id)
+    used = (
+        used_plays(db, user_id, scene=scene, reset_at=policy.reset_at)
+        if policy is not None and policy.reset_at is not None
+        else used_plays(db, user_id, scene=scene)
+    )
 
     def _miss(used_now: int) -> dict[str, Any]:
         return {
@@ -181,20 +262,29 @@ def start_play(
             "play_token": "",
             "reward_coin": reward_coin,
             "seq": used_now,
-            "remaining": max(0, max_plays - used_now),
+            "remaining": max(0, exposed_max_plays - used_now),
         }
 
-    if not cfg.get("enabled") or not video_url or max_plays <= 0 or used >= max_plays:
+    if (
+        not cfg.get("enabled")
+        or not video_url
+        or (max_plays is not None and (max_plays <= 0 or used >= max_plays))
+    ):
         return _miss(used)
 
-    seq = used + 1
+    # ``seq`` remains scene 内 lifetime-monotonic because
+    # (user_id, scene, seq) is unique.
+    # A whitelist reset only changes the quota baseline; reusing seq=1 would
+    # collide with historical rows and make every post-reset start fail.
+    seq = used_plays(db, user_id, scene=scene) + 1
     play = GuideVideoPlay(
         user_id=user_id,
         play_token=uuid.uuid4().hex,
         scene=scene,
         seq=seq,
         video_url=video_url,
-        coin=0,
+        # 固化本次承诺发放的金币，避免运营改价后已开播记录按新价结算。
+        coin=reward_coin,
         status="playing",
         completed=0,
         started_at=datetime.now(rewards.CN_TZ).replace(tzinfo=None),
@@ -210,14 +300,19 @@ def start_play(
             db.flush()
     except IntegrityError:
         db.rollback()
-        return _miss(used_plays(db, user_id))
+        used_now = (
+            used_plays(db, user_id, scene=scene, reset_at=policy.reset_at)
+            if policy is not None and policy.reset_at is not None
+            else used_plays(db, user_id, scene=scene)
+        )
+        return _miss(used_now)
     return {
         "should_play": True,
         "video_url": video_url,
         "play_token": play.play_token,
         "reward_coin": reward_coin,
         "seq": seq,
-        "remaining": max(0, max_plays - seq),
+        "remaining": max(0, exposed_max_plays - (used + 1)),
     }
 
 
@@ -240,8 +335,9 @@ def grant_play(
     重复上报返回 granted=False + 已发金币(客户端据此不重复累加 toast 金额)。
     """
     token = (play_token or "").strip()
-    # 金币额度以**服务端配置**为准,不信客户端(客户端只上报"播完/关闭")。
-    coin = int(get_config(db).get("reward_coin") or 0)
+    # 金币额度取开播时由服务端固化的值，不信客户端，也不受后续配置变更影响。
+    play = _find_play(db, user_id, token)
+    coin = int(play.coin if play is not None else 0)
 
     # 幂等核心:把 status 放进 WHERE 做条件更新(compare-and-set),而不是"先读再判再写"。
     # 「播完」与「✕ 关闭」抢跑、或客户端超时重试时,两个请求会都读到 status='playing',

app/repositories/phone_rebind.py

@@ -2,7 +2,7 @@
 from __future__ import annotations
 
 import math
-from datetime import datetime, timedelta, timezone
+from datetime import UTC, datetime, timedelta
 
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
@@ -10,9 +10,22 @@ from sqlalchemy.orm import Session
 from app.models.phone_rebind_log import PhoneRebindLog
 
 
-def rebound_within_days(db: Session, phone: str, days: int) -> bool:
+def rebound_within_days(
+    db: Session,
+    phone: str,
+    days: int,
+    *,
+    reset_at: datetime | None = None,
+) -> bool:
     """该手机号在最近 days 天内是否换绑过(命中 → 禁止再次换绑)。"""
-    since = datetime.now(timezone.utc) - timedelta(days=days)
+    since = datetime.now(UTC) - timedelta(days=days)
+    if reset_at is not None:
+        reset_value = (
+            reset_at.replace(tzinfo=UTC)
+            if reset_at.tzinfo is None
+            else reset_at.astimezone(UTC)
+        )
+        since = max(since, reset_value)
     stmt = (
         select(PhoneRebindLog.id)
         .where(PhoneRebindLog.phone == phone, PhoneRebindLog.rebound_at >= since)
@@ -21,16 +34,25 @@ def rebound_within_days(db: Session, phone: str, days: int) -> bool:
     return db.execute(stmt).first() is not None
 
 
-def remaining_block_days(db: Session, phone: str, days: int) -> int:
+def remaining_block_days(
+    db: Session,
+    phone: str,
+    days: int,
+    *,
+    reset_at: datetime | None = None,
+) -> int:
     """距离该手机号可再次换绑还剩几天(向上取整;无记录返回 0)。"""
+    conditions = [PhoneRebindLog.phone == phone]
+    if reset_at is not None:
+        conditions.append(PhoneRebindLog.rebound_at >= reset_at)
     last = db.execute(
-        select(func.max(PhoneRebindLog.rebound_at)).where(PhoneRebindLog.phone == phone)
+        select(func.max(PhoneRebindLog.rebound_at)).where(*conditions)
     ).scalar_one_or_none()
     if last is None:
         return 0
     if last.tzinfo is None:  # SQLite 取回 naive datetime,按 UTC 归一
-        last = last.replace(tzinfo=timezone.utc)
-    remaining = (last + timedelta(days=days) - datetime.now(timezone.utc)).total_seconds()
+        last = last.replace(tzinfo=UTC)
+    remaining = (last + timedelta(days=days) - datetime.now(UTC)).total_seconds()
     return max(0, math.ceil(remaining / 86400))
 
 

app/repositories/risk.py

@@ -9,6 +9,7 @@ from sqlalchemy import func, select
 from sqlalchemy.exc import IntegrityError
 from sqlalchemy.orm import Session
 
+from app.core import limit_policy
 from app.core.config_schema import (
     RISK_COMPARE_DAILY_THRESHOLD_KEY,
     RISK_ONECLICK_DAILY_THRESHOLD_KEY,
@@ -257,22 +258,34 @@ def _upsert_incident(
 
 
 def evaluate_behavior_rule(
-    db: Session, *, rule_code: str, subject_id: str, at: datetime
+    db: Session,
+    *,
+    rule_code: str,
+    subject_id: str,
+    at: datetime,
+    threshold: int | None = None,
+    subject_reset_at: datetime | None = None,
 ) -> RiskIncident | None:
     spec = RULES[rule_code]
-    threshold = get_rule_threshold(db, rule_code)
+    effective_threshold = threshold or get_rule_threshold(db, rule_code)
     window_key, window_start, end = _window_bounds(at, spec.window)
     reset_at = get_rule_reset_at(db, rule_code)
-    start = max(window_start, reset_at) if reset_at else window_start
+    baselines = [value for value in (reset_at, subject_reset_at) if value is not None]
+    start = max(window_start, *baselines) if baselines else window_start
     count, first_at, last_at, triggered_at = _event_stats(
         db,
         spec,
         subject_id=subject_id,
         start=start,
         end=end,
-        threshold=threshold,
+        threshold=effective_threshold,
     )
-    if count < threshold or first_at is None or last_at is None or triggered_at is None:
+    if (
+        count < effective_threshold
+        or first_at is None
+        or last_at is None
+        or triggered_at is None
+    ):
         return None
     return _upsert_incident(
         db,
@@ -300,7 +313,6 @@ def reconcile_behavior_rule(
     """按当前阈值重算短信/一键登录当前窗口，并收起已不再命中的待处理告警。"""
     spec = RULES[rule_code]
     current = at or utcnow()
-    threshold = get_rule_threshold(db, rule_code)
     window_key, window_start, end = _window_bounds(current, spec.window)
     reset_at = get_rule_reset_at(db, rule_code)
     start = max(window_start, reset_at) if reset_at else window_start
@@ -311,23 +323,39 @@ def reconcile_behavior_rule(
         BehaviorEvent.occurred_at >= start,
         BehaviorEvent.occurred_at < end,
     )
-    qualifying_rows = db.execute(
+    subject_rows = db.execute(
         select(
             BehaviorEvent.subject_id,
             func.max(BehaviorEvent.occurred_at),
+            func.max(BehaviorEvent.phone),
         )
         .where(*filters)
         .group_by(BehaviorEvent.subject_id)
-        .having(func.count(BehaviorEvent.id) >= threshold)
     ).all()
-    qualifying = {str(subject_id) for subject_id, _ in qualifying_rows}
-    for subject_id, last_at in qualifying_rows:
-        evaluate_behavior_rule(
+    qualifying: set[str] = set()
+    policy_code = {
+        RULE_SMS_HOURLY: "risk.sms.hourly",
+        RULE_ONECLICK_DAILY: "risk.oneclick.daily",
+    }[rule_code]
+    for subject_id, last_at, phone in subject_rows:
+        policy = limit_policy.resolve(
+            db,
+            policy_code,
+            phone=phone,
+            device=str(subject_id),
+        )
+        if policy.suppressed or policy.limit is None:
+            continue
+        incident = evaluate_behavior_rule(
             db,
             rule_code=rule_code,
             subject_id=str(subject_id),
             at=last_at or current,
+            threshold=policy.limit,
+            subject_reset_at=policy.reset_at,
         )
+        if incident is not None:
+            qualifying.add(str(subject_id))
 
     open_incidents = db.scalars(
         select(RiskIncident).where(
@@ -383,7 +411,29 @@ def record_behavior_event(
     db.add(event)
     db.flush()
     if evaluate_rule:
-        evaluate_behavior_rule(db, rule_code=evaluate_rule, subject_id=subject_id, at=at)
+        policy_code = {
+            RULE_SMS_HOURLY: "risk.sms.hourly",
+            RULE_ONECLICK_DAILY: "risk.oneclick.daily",
+        }.get(evaluate_rule)
+        policy = (
+            limit_policy.resolve(
+                db,
+                policy_code,
+                phone=phone,
+                device=device_id or subject_id,
+            )
+            if policy_code
+            else None
+        )
+        if policy is None or not policy.suppressed:
+            evaluate_behavior_rule(
+                db,
+                rule_code=evaluate_rule,
+                subject_id=subject_id,
+                at=at,
+                threshold=policy.limit if policy else None,
+                subject_reset_at=policy.reset_at if policy else None,
+            )
     if commit:
         db.commit()
         db.refresh(event)
@@ -396,20 +446,33 @@ def sync_compare_incident(
     user_id: int,
     at: datetime,
     threshold: int | None = None,
+    device_id: str | None = None,
     commit: bool = True,
 ) -> RiskIncident | None:
-    effective_threshold = threshold or get_rule_threshold(db, RULE_COMPARE_DAILY)
+    policy = limit_policy.resolve_for_user(
+        db,
+        "risk.compare.daily",
+        user_id,
+        device=device_id,
+    )
+    if policy.suppressed:
+        return None
+    effective_threshold = threshold or policy.limit or get_rule_threshold(
+        db, RULE_COMPARE_DAILY
+    )
     # comparison_record 的既有写入口统一落“北京时间 naive”时间；这里必须沿用同一
     # 口径，否则 SQLite/PG session timezone 不同时会把凌晨记录算到前一天。
     local = at.astimezone(CN_TZ).replace(tzinfo=None) if at.tzinfo else at
     window_start = local.replace(hour=0, minute=0, second=0, microsecond=0)
     end = window_start + timedelta(days=1)
     window_key = window_start.strftime("%Y-%m-%d")
-    reset_at = get_rule_reset_at(db, RULE_COMPARE_DAILY)
-    reset_local = (
-        reset_at.astimezone(CN_TZ).replace(tzinfo=None) if reset_at else None
-    )
-    start = max(window_start, reset_local) if reset_local else window_start
+    global_reset_at = get_rule_reset_at(db, RULE_COMPARE_DAILY)
+    baselines = [
+        value.astimezone(CN_TZ).replace(tzinfo=None)
+        for value in (global_reset_at, policy.reset_at)
+        if value is not None
+    ]
+    start = max(window_start, *baselines) if baselines else window_start
     filters = (
         ComparisonRecord.user_id == user_id,
         ComparisonRecord.created_at >= start,
@@ -464,7 +527,6 @@ def reconcile_compare_rule(
         reset_at.astimezone(CN_TZ).replace(tzinfo=None) if reset_at else None
     )
     start = max(window_start, reset_local) if reset_local else window_start
-    threshold = get_rule_threshold(db, RULE_COMPARE_DAILY)
     rows = db.execute(
         select(
             ComparisonRecord.user_id,
@@ -476,17 +538,17 @@ def reconcile_compare_rule(
             ComparisonRecord.created_at < end,
         )
         .group_by(ComparisonRecord.user_id)
-        .having(func.count(ComparisonRecord.id) >= threshold)
     ).all()
-    qualifying = {str(user_id) for user_id, _ in rows}
+    qualifying: set[str] = set()
     for user_id, last_at in rows:
-        sync_compare_incident(
+        incident = sync_compare_incident(
             db,
             user_id=int(user_id),
             at=last_at or current,
-            threshold=threshold,
             commit=False,
         )
+        if incident is not None:
+            qualifying.add(str(user_id))
 
     open_incidents = db.scalars(
         select(RiskIncident).where(

app/schemas/compare_record.py

@@ -107,6 +107,13 @@ class ComparisonRecordIn(BaseModel):
     # 明细
     items: list[ComparisonItemIn] = Field(default_factory=list)
     comparison_results: list[ComparisonResultIn] = Field(default_factory=list)
+    # 展示模型统一数组(pricebot done.params.platforms 原样透传): 每平台一行、自带
+    # status/is_best/display/display_order,记录页据此直渲染。宽松 list[dict] 存(结构由
+    # pricebot 定,server 只原样落库),前端读它、老记录空时回退 comparison_results。
+    platforms: list[dict] = Field(default_factory=list)
+    # 记录级结局(pricebot 下发): success/below_minimum/store_closed/failed。让"未满起送"不再
+    # 被塌缩成 failed。_derive 优先用它、其次客户端 status、再兜底二态派生。
+    record_status: str | None = None
     # 逐平台结局摘要(含失败平台的细分原因 status: store_not_found/items_not_found/below_minimum/
     # unsupported/...)。来自 done.params.platform_results,客户端透传;落 raw_payload(不单列),
     # admin「卡在哪一步」从这里读。dict{platform_id: {...}} 宽松存(结构由 pricebot 定——是
@@ -173,8 +180,13 @@ class ComparisonRecordOut(BaseModel):
     skipped_dish_count: int | None = None
     status: str
     information: str | None = None
+    # 失败卡「原因」文案:具体失败给具体原因,纯系统失败为 None(端侧品牌兜底)。见模型 fail_reason。
+    fail_reason: str | None = None
     items: list = []
     comparison_results: list = []
+    # 展示模型统一数组(每平台一行、自带 status/is_best/display/display_order): 记录页据此
+    # 直渲染, 不再靠 comparison_results + 前端派生。老记录为空 → 前端回退 comparison_results。
+    platforms: list = []
     skipped_dish_names: list = []
     total_ms: int | None = None
     # 「已下单」(店级):该店名在该用户真实下单(source='compare')里出现过即 True。
@@ -210,9 +222,9 @@ class CompareStartReserveIn(BaseModel):
 
 
 class CompareStartReserveOut(BaseModel):
-    limit: int
+    limit: int | None
     used: int
-    remaining: int
+    remaining: int | None
 
 
 class CompareStatsOut(BaseModel):

app/schemas/guide_video.py

@@ -1,13 +1,15 @@
 """新手引导视频(领券等候浮层前 N 次替代广告)的客户端请求/响应契约。"""
 from __future__ import annotations
 
+from typing import Literal
+
 from pydantic import BaseModel, Field
 
 
 class GuideVideoStartIn(BaseModel):
-    """开播询问。scene 目前只有 coupon(领券浮层);预留给日后比价等场景。"""
+    """开播询问。领券与比价分别使用独立配置和独立次数。"""
 
-    scene: str = Field(default="coupon", max_length=16)
+    scene: Literal["coupon", "comparison"] = "coupon"
 
 
 class GuideVideoStartOut(BaseModel):

app/services/comparison_llm_backfill.py

@@ -135,7 +135,7 @@ def repair_missing_comparison_llm_costs(
                 select(ComparisonRecord.id, ComparisonRecord.trace_id)
                 .where(
                     *date_conditions,
-                    ComparisonRecord.status.in_(("success", "failed")),
+                    ComparisonRecord.status.in_(("success", "failed", "cancelled")),
                     ComparisonRecord.llm_cost_yuan.is_(None),
                 )
                 .order_by(ComparisonRecord.created_at.desc(), ComparisonRecord.id.desc())

docs/integrations/aliyun/CheckSmsVerifyCode.md

@@ -0,0 +1,224 @@
+CheckSmsVerifyCode - 核验验证码
+更新时间：2026年3月19日 20:02:53
+核验短信验证码并返回核验是否成功的结果。
+
+调试
+您可以在OpenAPI Explorer中直接运行该接口，免去您计算签名的困扰。运行成功后，OpenAPI Explorer可以自动生成SDK代码示例。
+
+ 调试 
+授权信息
+下表是API对应的授权信息，可以在RAM权限策略语句的Action元素中使用，用来给RAM用户或RAM角色授予调用此API的权限。具体说明如下：
+
+操作：是指具体的权限点。
+
+访问级别：是指每个操作的访问级别，取值为写入（Write）、读取（Read）或列出（List）。
+
+资源类型：是指操作中支持授权的资源类型。具体说明如下：
+
+对于必选的资源类型，用前面加 * 表示。
+
+对于不支持资源级授权的操作，用全部资源表示。
+
+条件关键字：是指云产品自身定义的条件关键字。
+
+关联操作：是指成功执行操作所需要的其他权限。操作者必须同时具备关联操作的权限，操作才能成功。
+
+放大查看
+操作
+
+访问级别
+
+资源类型
+
+条件关键字
+
+关联操作
+
+dypns:CheckSmsVerifyCode
+
+none
+
+*全部资源
+
+*
+
+无	无
+请求参数
+放大查看
+名称
+
+类型
+
+必填
+
+描述
+
+示例值
+
+SchemeName	
+string
+
+否
+
+方案名称，如果不填则为“默认方案”。最多不超过 20 个字符。
+
+重要 如果发送接口的方案名称不为空，请确保该参数不为空且与发送接口的方案名称参数一致
+测试方案
+
+CountryCode	
+string
+
+否
+
+号码国家编码，默认为 86。
+
+86
+
+PhoneNumber	
+string
+
+是
+
+手机号。
+
+186****0000
+
+OutId	
+string
+
+否
+
+外部流水号。
+
+12123231
+
+VerifyCode	
+string
+
+是
+
+验证码。
+
+说明
+SendSmsVerifyCode 接口的字段 TemplateParam，配置方式有 2 种：
+
+{"code":"##code##","min":"5"}
+
+{"code":"123456","min":"5"}
+
+{"code":"##code##","min":"5"}验证码是 api 动态生成的，阿里云接口可以完成校验。
+
+{"code":"123456","min":"5"}验证码是用户配置的不是 api 动态生成，阿里云接口无法校验。
+
+请您按照实际情况传入对应的验证码。
+
+1231
+
+CaseAuthPolicy	
+integer
+
+否
+
+验证码大小写字母核验策略。取值：
+
+1：不区分大小写。
+
+2：区分大小写。
+
+1
+
+返回参数
+放大查看
+名称
+
+类型
+
+描述
+
+示例值
+
+object
+
+AccessDeniedDetail	
+string
+
+访问被拒绝详细信息。
+
+无
+
+Message	
+string
+
+状态码的描述。
+
+成功
+
+Model	
+object
+
+请求结果数据。
+
+OutId	
+string
+
+外部流水号。
+
+1212312
+
+VerifyResult	
+string
+
+短信验证码核验结果。取值：
+
+PASS：短信验证码核验成功。
+
+UNKNOWN：短信验证码核验失败。
+
+PASS
+
+Code	
+string
+
+接口请求状态码。
+
+返回 OK 代表请求成功。
+
+其他错误码，请参见返回码。
+
+重要 接口请求成功不代表短信验证码核验成功，短信验证码核验结果仅以Model.VerifyResult参数返回值为准。
+OK
+
+Success	
+boolean
+
+接口调用是否成功。取值：
+
+true：接口调用成功。
+
+false：接口调用失败。
+
+重要 接口调用成功不代表短信验证码核验成功，短信验证码核验结果仅以Model.VerifyResult参数返回值为准。
+true
+
+RequestId	
+string
+
+CF8854E5-DB21-3E5D-A9B1-DDC752FD7384
+
+示例
+正常返回示例
+
+JSON格式
+
+放大查看复制代码
+{
+  "AccessDeniedDetail": "无",
+  "Message": "成功",
+  "Model": {
+    "OutId": "1212312",
+    "VerifyResult": "PASS"
+  },
+  "Code": "OK",
+  "Success": true,
+  "RequestId": "CF8854E5-DB21-3E5D-A9B1-DDC752FD7384"
+}

docs/integrations/aliyun/SendSmsVerifyCode.md

@@ -0,0 +1,396 @@
+SendSmsVerifyCode - 发送短信验证码
+更新时间：2026年7月3日 09:54:53
+发送短信验证码。
+
+接口说明
+由于运营商近期加强对短信签名的管控。您自定义的签名面临下发失败问题，推荐您使用号码认证控制台赠送的短信签名和模板进行短信认证。系统赠送签名必须搭配系统赠送模板使用。
+
+请确保在使用该接口前，已充分了解号码认证服务产品的收费方式和价格，短信认证服务仅收取短信发送费用（按运营商回执状态计费，短信提交成功但运营商回执失败时不计费），核验服务免费。
+
+调试
+您可以在OpenAPI Explorer中直接运行该接口，免去您计算签名的困扰。运行成功后，OpenAPI Explorer可以自动生成SDK代码示例。
+
+ 调试 
+授权信息
+下表是API对应的授权信息，可以在RAM权限策略语句的Action元素中使用，用来给RAM用户或RAM角色授予调用此API的权限。具体说明如下：
+
+操作：是指具体的权限点。
+
+访问级别：是指每个操作的访问级别，取值为写入（Write）、读取（Read）或列出（List）。
+
+资源类型：是指操作中支持授权的资源类型。具体说明如下：
+
+对于必选的资源类型，用前面加 * 表示。
+
+对于不支持资源级授权的操作，用全部资源表示。
+
+条件关键字：是指云产品自身定义的条件关键字。
+
+关联操作：是指成功执行操作所需要的其他权限。操作者必须同时具备关联操作的权限，操作才能成功。
+
+放大查看
+操作
+
+访问级别
+
+资源类型
+
+条件关键字
+
+关联操作
+
+dypns:SendSmsVerifyCode
+
+create
+
+*全部资源
+
+*
+
+无	无
+请求参数
+放大查看
+名称
+
+类型
+
+必填
+
+描述
+
+示例值
+
+SchemeName	
+string
+
+否
+
+方案名称，如果不填则为“默认方案”。最多不超过 20 个字符。
+
+测试方案
+
+CountryCode	
+string
+
+否
+
+号码国家编码。默认为 86，目前也仅支持国内号码发送。
+
+86
+
+PhoneNumber	
+string
+
+是
+
+短信接收方手机号。
+
+130****0000
+
+SignName	
+string
+
+是
+
+签名名称。暂不支持使用自定义签名，请使用系统赠送的签名，您可在赠送签名配置页面选择需要下发的签名。
+
+恒创联众
+
+TemplateCode	
+string
+
+是
+
+短信模板 CODE。参数SignName选择赠送签名时，必须搭配赠送模板下发短信。您可在赠送模板配置页面选择适用您业务场景的模板。
+
+100001
+
+TemplateParam	
+string
+
+是
+
+短信模板参数。验证码位置有两种传值方式：
+
+可使用"##code##"替代，由参数 CodeType 指定验证码生成规则；
+
+也可直接传入具体的验证码值，直接下发至接收方。
+
+示例：如模板内容为：“您的验证码是${code}，有效期${min}分钟，请勿告诉他人。”。
+
+重要 上文中的 code 请替换成您实际申请的验证码模板中的参数名称
+该字段可传入{"code":"##code##","min":"5"}由系统根据规则生成验证码；
+
+或直接传入指定的验证码值{"code":"123456","min":"5"}。
+
+说明
+{"code":"##code##","min":"5"}验证码是 api 动态生成的，阿里云接口可以完成校验。
+
+{"code":"123456","min":"5"}验证码是用户配置的不是 api 动态生成，阿里云接口无法校验。
+
+说明
+如果 JSON 中需要带换行符，请参照标准的 JSON 协议处理。
+
+模板变量规范，请参见短信模板规范。
+
+{"code":"##code##","min":"5"}
+
+SmsUpExtendCode	
+string
+
+否
+
+上行短信扩展码。上行短信指发送给通信服务提供商的短信，用于定制某种服务、完成查询，或是办理某种业务等，需要收费，按运营商普通短信资费进行扣费。
+
+说明
+扩展码是生成签名时系统自动默认生成的，不支持自行传入。无特殊需要此字段的用户请忽略此字段。如需使用，请联系您的商务经理。
+
+1213123
+
+OutId	
+string
+
+否
+
+外部流水号。
+
+外部流水号（透传）
+
+CodeLength	
+integer
+
+否
+
+验证码长度支持 4～8 位长度，默认是 4 位。
+
+4
+
+ValidTime	
+integer
+
+否
+
+验证码有效时长，单位秒，默认为 300 秒。
+
+300
+
+DuplicatePolicy	
+integer
+
+否
+
+核验规则，当有效时间内对同场景内的同号码重复发送验证码时，旧验证码如何处理。
+
+1：覆盖处理（默认），即旧验证码会失效掉。
+
+2：保留，即多个验证码都是在有效期内都可以校验通过。
+
+枚举值：
+
+1 :
+覆盖
+
+2 :
+保留
+
+1
+
+Interval	
+integer
+
+否
+
+时间间隔，单位：秒。即多久间隔可以发送一次验证码，用于频控，默认 60 秒。
+
+60
+
+CodeType	
+integer
+
+否
+
+生成的验证码类型。当参数 TemplateParam 传入占位符时，此参数必填，将由系统根据指定的规则生成验证码。取值：
+
+1：纯数字（默认）。
+
+2：纯大写字母。
+
+3：纯小写字母。
+
+4：大小字母混合。
+
+5：数字+大写字母混合。
+
+6：数字+小写字母混合。
+
+7：数字+大小写字母混合。
+
+枚举值：
+
+1 :
+纯数字
+
+2 :
+纯大写字母
+
+3 :
+纯小写字母
+
+4 :
+大小字母混合
+
+5 :
+数字+大写字母混合
+
+6 :
+数字+小写字母混合
+
+7 :
+数字+大小写字母混合
+
+1
+
+ReturnVerifyCode	
+boolean
+
+否
+
+是否返回验证码。取值：
+
+true：返回。
+
+false：不返回。
+
+true
+
+AutoRetry	
+integer
+
+否
+
+是否自动替换签名重试（默认开启），可取值：
+
+1 开启自动重试功能，开启后，在验证码有效期内，当运营商返回明确的失败状态时，允许阿里云尽可能的尝试使用其他方式发送验证码，以提升发送成功率。其他方式包括且不限于：通过其他运营商重试、更换签名重试等
+
+0 不开启自动重试
+
+是否自动重试
+
+返回参数
+放大查看
+名称
+
+类型
+
+描述
+
+示例值
+
+object
+
+AccessDeniedDetail	
+string
+
+访问被拒绝详细信息。
+
+无
+
+Message	
+string
+
+状态码的描述。
+
+成功
+
+RequestId	
+string
+
+请求 ID。
+
+CC3BB6D2-2FDF-4321-9DCE-B38165CE4C47
+
+Model	
+object
+
+请求结果数据。
+
+VerifyCode	
+string
+
+验证码。
+
+4232
+
+RequestId	
+string
+
+请求 ID。
+
+a3671ccf-0102-4c8e-8797-a3678e091d09
+
+OutId	
+string
+
+外部流水号。
+
+1231231313
+
+BizId	
+string
+
+业务 ID。
+
+112231421412414124123^4
+
+Code	
+string
+
+请求状态码。返回 OK 代表请求成功。其他错误码，请参见返回码列表。
+
+OK
+
+Success	
+boolean
+
+请求是否成功。
+
+true：请求成功。
+
+false：请求失败。
+
+true
+
+示例
+正常返回示例
+
+JSON格式
+
+放大查看复制代码
+{
+  "AccessDeniedDetail": "无",
+  "Message": "成功 ",
+  "RequestId": "CC3BB6D2-2FDF-4321-9DCE-B38165CE4C47",
+  "Model": {
+    "VerifyCode": "4232",
+    "RequestId": "a3671ccf-0102-4c8e-8797-a3678e091d09",
+    "OutId": "1231231313",
+    "BizId": "112231421412414124123^4"
+  },
+  "Code": "OK",
+  "Success": true
+}
+错误码
+放大查看
+HTTP status code
+
+错误码
+
+错误信息
+
+描述
+
+400	MOBILE_NUMBER_ILLEGAL	The mobile number is illegal.	手机号码格式错误
+400	BUSINESS_LIMIT_CONTROL	The number has exceeded the limit for the day.	触发号码天级流控
+400	FREQUENCY_FAIL	Check frequency fail.	频控校验未通过
+400	INVALID_PARAMETERS	parameter is not valid.	非法参数
+400	FUNCTION_NOT_OPENED	You have not opened this function.	没有开通融合认证功能

docs/integrations/chuanglan/tpl-send.md

@@ -0,0 +1,117 @@
+# 创蓝云智（253/蓝创云智）模板短信 v2 发送接口
+
+> 官方文档：<https://doc.chuanglan.com/document/HAQYSZKH9HT5Z50L>
+> 用途：手机号 + 验证码登录的**验证码短信下发**（本服务生成码 → 创蓝只负责发送，属自管码 Mode B，与极光同模式）。
+> 本文件为**接口调研摘要**，供 `app/integrations/sms/chuanglan.py` 实现对照。以线上文档为准。
+
+## 接口概览
+
+| 项 | 值 |
+|---|---|
+| 请求地址 | `POST https://smssh.253.com/msg/sms/v2/tpl/send` |
+| Content-Type | `application/json`（UTF-8） |
+| 协议 | HTTPS |
+| 鉴权 | HMAC-SHA256 签名头 `X-QA-Hmac-Signature`（推荐）**或** body 明文 `password`（二选一） |
+
+## 鉴权：两种方式（二选一，不可并用）
+
+1. **HMAC 签名头（推荐，密码不上行）**：请求头带 `X-QA-Hmac-Signature`，body **不放** `password`。
+2. **明文密码**：body 放 `password`，不带签名头。
+
+### HMAC-SHA256 签名算法
+
+1. `md5Password = MD5(password)` —— 32 位**小写十六进制**。
+2. 取三个值 `[md5Password, timestamp, nonce]`，**按字典序升序排序**，**无分隔符拼接**，再 `replaceAll("\\s+", "")` 去除所有空白。
+3. `signature = HmacSHA256(key = md5Password, message = 上一步拼接串)` —— 输出**小写十六进制**。
+4. 放入请求头：`X-QA-Hmac-Signature: <signature>`。
+
+> 注意 `key` 就是 `md5Password` 本身（32 位 hex 字符串），不是原始 password。`timestamp` / `nonce` 同时也是 body 字段，必须与签名里用的一致。
+
+## 请求参数（body，JSON）
+
+| 参数 | 类型 | 必填 | 说明 |
+|---|---|---|---|
+| `account` | String | 是 | API 账号；验证码短信用 **`YZM` 前缀**账号（如 `YZM0000001`） |
+| `timestamp` | String | 是 | Unix 秒级时间戳；**60 秒**内有效，过期报 139 |
+| `nonce` | String | 是 | 32 位随机串（防重放） |
+| `phoneNumbers` | String | 是 | 手机号，逗号分隔最多 1000 个；**YZM 验证码账号不支持批量，只能单号** |
+| `templateId` | String | 是 | 模板 ID（控制台创建 / 模板接口查询） |
+| `templateParamJson` | String | 条件 | 模板变量，JSON 字符串；模板有 `{s}` 占位符时必填（见下） |
+| `password` | String | 条件 | 仅在**不使用**签名头时放 body |
+| `signature` | String | 条件 | **短信签名文案**（如 `【创蓝云智】`）；模板未关联签名时必填。**注意与鉴权头 `X-QA-Hmac-Signature` 是两回事** |
+| `report` | String | 否 | `"true"` 时接收状态回执 |
+| `callbackUrl` | String | 否 | 回执回调完整 URL |
+| `uid` | String | 否 | 自定义标识（≤256 字符），回执原样返回 |
+| `extend` | String | 否 | 数字扩展码（≤5 位），用于上行匹配 |
+
+### `templateParamJson` 格式与 `{s}` 占位
+
+- 模板内容用 `{s}` 作占位符，例：`您正在申请手机注册，验证码为：{s}，5分钟内有效！`
+- `templateParamJson` 是 **JSON 数组，元素为对象**，键按 `param1`、`param2`…递增；第 1 个 `{s}` ← `param1`，第 2 个 ← `param2`。
+- 单条验证码（一个 `{s}` = 验证码）示例：`"[{\"param1\":\"123456\"}]"`
+
+## 响应格式
+
+```json
+{
+  "code": "000000",
+  "msgId": "25071018345400902898000000000001",
+  "time": "20250710183454",
+  "successNum": "1",
+  "failNum": "0",
+  "errorMsg": ""
+}
+```
+
+| 字段 | 说明 |
+|---|---|
+| `code` | 状态码，`"000000"` = 成功 |
+| `msgId` | 消息 ID（32 位） |
+| `time` | 响应时间戳 |
+| `successNum` / `failNum` | 提交成功 / 失败条数 |
+| `errorMsg` | 错误描述（成功为空） |
+
+## 响应 / 错误码（节选）
+
+| code | 含义 | 归属 |
+|---|---|---|
+| `000000` | 成功 | — |
+| `101` | 账号不存在 | 客服 |
+| `102` | 密码错误 | 客服 |
+| `103` | 提交速度过快（超频） | 客服 |
+| `107` | 手机号码错误 | 客服 |
+| `109` | 无发送量（余额/套餐不足） | 销售 |
+| `110` | 不在发送时段 | 销售 |
+| `116` | 签名不合法 / 未带签名 | 服务 |
+| `117` | IP 未加白名单 | 服务 |
+| `118` | 账号无发送权限 | 服务 |
+| `124` | 模板内容不匹配 | 服务 |
+| `129` | JSON 格式错误 | 客服 |
+| `135` | 相同手机号内容重复 | 客服 |
+| `139` | 时间戳过期 | 客服 |
+| `152` | 模板不存在 | 服务 |
+| `158` | 退订文案不合规 | 客服 |
+
+## 完整请求示例（单条验证码，明文密码方式省略 password 用签名头）
+
+```json
+{
+  "account": "YZM0000001",
+  "timestamp": "1752143733",
+  "nonce": "x4zfk0y5foqwx6cbnw3bfmimy98abqs1",
+  "phoneNumbers": "17601337176",
+  "templateId": "1021143438",
+  "templateParamJson": "[{\"param1\":\"123456\"}]",
+  "report": "true"
+}
+```
+
+（HMAC 方式：另加请求头 `X-QA-Hmac-Signature: <算法输出>`，body 不含 `password`。）
+
+## 接入要点
+
+- **IP 白名单**：服务器出网 IP 必须在控制台加白，否则 117。
+- **验证码账号（YZM）**：无发送时段限制；单号发送、不支持批量。
+- **时间戳 60s**：`timestamp` 与本地时钟偏差过大会 139，注意服务器时间同步。
+- **退订文案**：仅支持 `拒收请回复R`，且必须在短信末尾（验证码短信一般无需）。
+- **签名 vs 鉴权头**：`signature`（body）= 短信开头的 `【品牌】` 文案；`X-QA-Hmac-Signature`（header）= 请求鉴权。二者含义完全不同，勿混。

docs/integrations/sms.md

@@ -1,9 +1,26 @@
 # 短信验证码（sms）
 
-> 文件:`app/integrations/sms.py` | 关联接口:[auth-sms-send](../api/auth-sms-send.md) · [auth-sms-login](../api/auth-sms-login.md) | [← 集成索引](./README.md)
+> 文件:`app/integrations/sms/`(分派器 `__init__` + `jiguang` / `aliyun` provider + `base`) | 关联接口:[auth-sms-send](../api/auth-sms-send.md) · [auth-sms-login](../api/auth-sms-login.md) | [← 集成索引](./README.md)
 
 ## 作用
-手机号 + 验证码登录的验证码发送 / 校验。**已接极光短信 REST**,由 `SMS_MOCK` 切 mock / real。
+手机号 + 验证码登录的验证码发送 / 校验。支持**可切换 provider**(`SMS_PROVIDER`):`jiguang`(默认,极光自管码)/ `aliyun`(阿里云号码认证托管码)/ `chuanglan`(创蓝云智模板短信,自管码)。`SMS_MOCK` 另切 mock / real。
+
+## 短信提供商(`SMS_PROVIDER`,可切换 + 灰度回退)
+| | `jiguang`(默认) | `aliyun` | `chuanglan` |
+|---|---|---|---|
+| 验证码模式 | 自管码 Mode B | 托管码 Mode A | 自管码 Mode B(与极光同) |
+| 验证码 | **本服务生成**、极光只下发、**本地内存校验** | **阿里云生成 + 下发 + 校验**(dypns 号码认证,核验免费) | **本服务生成**、创蓝只下发、**本地内存校验** |
+| 发码 | 极光 `/v1/messages` | `SendSmsVerifyCode`(`##code##` 占位) | 创蓝 `tpl/send` v2(HMAC 签名头,password 不上行) |
+| 校验 | 比对本地存码 | `CheckSmsVerifyCode` → `PASS` / `UNKNOWN` | 比对本地存码 |
+| 多 worker | ⚠️ 内存存码不共享(见已知局限) | ✅ 阿里云托管,天然共享 | ⚠️ 内存存码不共享(与极光同级债) |
+| 防爆破 | 单码失败 `SMS_MAX_VERIFY_ATTEMPTS` 次即作废 | **同语义**(本地 per-phone 失败计数) | **同语义**(复制自极光) |
+| 单号冷却 | 本地 `SMS_SEND_INTERVAL_SEC` | 交给阿里云 `Interval` | 本地 `SMS_SEND_INTERVAL_SEC` |
+| 依赖 | `httpx`(复用) | SDK `alibabacloud_dypnsapi20170525` | `httpx` + 标准库 `hashlib`/`hmac`(**无新依赖**) |
+
+- `aliyun` 需在**号码认证控制台开通「融合认证」**,用系统赠送签名 + 赠送模板;配置见 `.env.example` 的 `ALIYUN_SMS_*`,SDK 为 `alibabacloud_dypnsapi20170525`。
+- `chuanglan` 用 **YZM 前缀验证码账号**,服务器出网 IP 须在创蓝控制台**加白名单**(否则 117);Mode B 存码/冷却/校验逻辑是**从极光隔离复制**(极光文件不动),仅发送走 HMAC 签名。配置见 `.env.example` 的 `CHUANGLAN_SMS_*`,接口调研见 [chuanglan/tpl-send.md](chuanglan/tpl-send.md),设计见 [spec](../superpowers/specs/2026-07-26-chuanglan-sms-verify-design.md)。
+
+**以下章节描述 `jiguang` provider(自管码)细节**(`chuanglan` 的存码/冷却/校验语义与之相同)。
 
 | | mock(`SMS_MOCK=true`,默认 / 开发测试) | real(`SMS_MOCK=false`,生产) |
 |---|---|---|

docs/superpowers/specs/2026-07-25-aliyun-sms-verify-design.md

@@ -0,0 +1,182 @@
+# 阿里云短信验证服务 — 设计方案
+
+- 日期：2026-07-25
+- 状态：已定稿，待实现
+- 范围：新增阿里云 dypns（号码认证服务）短信验证码 provider，与现有极光短信可切换
+
+## 1. 背景与目标
+
+现有短信验证码服务 `app/integrations/sms.py`：本服务**本地生成**验证码、存**进程内存**、极光 REST 仅负责下发；`verify_code()` 比对本地内存（一次性 + 单码失败 `SMS_MAX_VERIFY_ATTEMPTS` 次即作废）。docstring 已标注"内存存码、多 worker 不共享"为技术债。
+
+阿里云文档（`docs/integrations/aliyun/`）为 **号码认证服务 dypns** 的 `SendSmsVerifyCode` + `CheckSmsVerifyCode`：该产品由**阿里云生成并校验**验证码（`{"code":"##code##"}` 模式），核验免费。
+
+目标：接入阿里云该套接口作为一个新的短信 provider，可与极光切换。
+
+## 2. 关键决策（已确认）
+
+1. **验证码模式 = Mode A（阿里云托管码）**：发码用 `SendSmsVerifyCode` + `##code##` 占位符，阿里云生成/存储/下发；校验用 `CheckSmsVerifyCode`，阿里云返回 `PASS/UNKNOWN`。本服务不再本地生成/存储验证码。
+2. **可切换 Provider**：新增 `SMS_PROVIDER=jiguang|aliyun` 开关，`send_code/verify_code` 按 provider 分派；保留极光作回退（短信=花钱+登录关键路径，灰度上线/融合认证未开通时可秒切回极光）。
+3. **官方 SDK**：调阿里云 dypns 用 `alibabacloud_dypnsapi20170525`，签名/加签由 SDK 处理。
+4. **防爆破与极光一致**（排查一致性）：阿里云路径**保留**与极光相同的"单码失败 N 次即作废"本地计数，而非改用 API 层频控，避免两 provider 行为不一致导致排查困惑。
+
+## 3. 模块结构（`sms.py` 单文件升级为 provider 包）
+
+```
+app/integrations/sms/
+  __init__.py     # 公开 API + 分派器:send_code / verify_code / SmsError
+                  #   - SMS_MOCK=true 短路(不碰任何 provider)
+                  #   - 按 settings.SMS_PROVIDER 选 jiguang / aliyun
+  base.py         # SmsError(沿用现定义)+ Provider 协议(send_code/verify_code 签名约定)
+  jiguang.py      # 现有自管码逻辑原样迁入(内存存码/冷却/一次性/防爆破 全保留,行为零改动)
+  aliyun.py       # 新增:SendSmsVerifyCode 发码 + CheckSmsVerifyCode 校验 + 本地失败计数
+```
+
+- `__init__.py` 继续 re-export `SmsError / send_code / verify_code`，故 `app/api/v1/auth.py:37` 的
+  `from app.integrations.sms import SmsError, send_code, verify_code` **导入不变**。
+- 纯增量重构：极光逻辑整体迁入 `jiguang.py`，对外行为零变化。
+
+## 4. 数据流 — 阿里云 provider（Mode A）
+
+### 4.1 发码 `aliyun.send_code(phone) -> int`
+1. 校验 `settings.aliyun_sms_configured`（缺 AK/SignName/TemplateCode → `SmsError(503)`）。
+2. 调 `SendSmsVerifyCode`：
+   - `PhoneNumber=phone`
+   - `SignName=ALIYUN_SMS_SIGN_NAME`、`TemplateCode=ALIYUN_SMS_TEMPLATE_CODE`
+   - `TemplateParam = json({"code":"##code##","min": str(ALIYUN_SMS_VALID_TIME_SEC//60)})`
+   - `CodeLength=ALIYUN_SMS_CODE_LENGTH`、`ValidTime=ALIYUN_SMS_VALID_TIME_SEC`、`Interval=ALIYUN_SMS_INTERVAL_SEC`
+   - `SchemeName=ALIYUN_SMS_SCHEME_NAME`(可空)
+3. 成功（`body.Success and body.Code=="OK"`）→ **清本地失败计数**（新码=新预算）→ 返回 `ALIYUN_SMS_INTERVAL_SEC` 作客户端冷却秒数。
+4. 失败 → 按 §6 错误码映射抛 `SmsError`。
+
+### 4.2 校验 `aliyun.verify_code(phone, code) -> bool`
+1. **本地失败计数**：`attempts >= SMS_MAX_VERIFY_ATTEMPTS` → 直接 `False`（码已作废，不调阿里云）。
+2. 调 `CheckSmsVerifyCode(PhoneNumber, VerifyCode=code, SchemeName)`。
+3. `body.Model.VerifyResult`：
+   - `"PASS"` → 清计数，返回 `True`（一次性）。
+   - `"UNKNOWN"` → `attempts += 1`，返回 `False`（码错/过期）。
+4. 网络错误 / 接口非 `OK` → 抛 `SmsError(503)`（**不静默返回 False**，区分"阿里云挂了"与"码错了"；网络错误不计入 attempts）。
+
+本服务**不存验证码**，仅存一个 per-phone 失败计数（见 §7）。
+
+## 5. 分派器 & mock（`__init__.py`）
+
+```
+send_code(phone):
+    if settings.SMS_MOCK:          # 短路:不碰 provider(测试/开发)
+        log placeholder code; return cooldown
+    return _provider().send_code(phone)
+
+verify_code(phone, code):
+    if settings.SMS_MOCK:          # 放行任意 N 位数字(沿用现 mock 语义)
+        return len(code)==SMS_CODE_LENGTH and code.isdigit()
+    return _provider().verify_code(phone, code)
+
+_provider():  jiguang if settings.SMS_PROVIDER=="jiguang" else aliyun
+```
+
+- mock 语义提到分派层、provider 无关 → 现有 28 个测试文件（conftest 设 `SMS_MOCK=true`）全部零改动通过。
+
+## 6. 错误映射
+
+### 发码（阿里云错误码 → SmsError.status_code）
+| 阿里云码 | HTTP | 说明 |
+|---|---|---|
+| `MOBILE_NUMBER_ILLEGAL` | 400 | 手机号格式错误 |
+| `BUSINESS_LIMIT_CONTROL` | 429 | 号码天级流控 |
+| `FREQUENCY_FAIL` | 429 | 频控（`Interval` 命中） |
+| `FUNCTION_NOT_OPENED` | 503 | 融合认证未开通（**critical 日志**，需运维开通） |
+| `INVALID_PARAMETERS` | 503 | 参数错误（配置/模板问题，**critical 日志**） |
+| 其他非 OK / `Success=false` / 网络错误 | 503 | 供应商不可用 |
+
+### 校验
+- `PASS` → True；`UNKNOWN` → False；接口异常/网络错误 → `SmsError(503)`。
+
+## 7. 防爆破 / 频控分工
+
+| 机制 | 极光（Mode B） | 阿里云（Mode A） |
+|---|---|---|
+| 验证码存储 | 本地内存 | **阿里云托管**（消除多 worker 存码债） |
+| 单号发送冷却 | 本地 `_last_sent` 60s | **交给阿里云 `Interval`**（无本地状态），命中→429 |
+| 单设备+IP 频控 | API 层 5/时、20/天 | 同左，**不变** |
+| **防爆破（单码失败 N 次即作废）** | 本地 `_CodeRecord.attempts` | **本地 per-phone 计数**，与极光同语义（§4.2） |
+
+- 阿里云路径的**唯一本地状态** = per-phone 失败计数 `dict[phone,int]` + `Lock` + GC（仿极光 `_gc`）。
+- 多 worker 降级：失败计数按 worker 各计，effective 上限 = N×workers；与极光现状**同级**（属刻意保留的一致性），且 API 层登录频控（`sms-login-device` 设备+IP 5/时）提供硬兜底。
+- 计数复位：`send_code` 成功清计数、`verify` PASS 清计数（新码/验过即新预算）。
+- API 层设备频控与测试账号短路（`app/core/test_account.py`）**完全不动**。
+
+## 8. 配置项（`app/core/config.py` 新增）
+
+```python
+SMS_PROVIDER: str = "jiguang"          # jiguang | aliyun;默认极光(保持现状,上线后切 aliyun)
+# --- 阿里云 dypns 号码认证 ---
+ALIYUN_SMS_ACCESS_KEY_ID: str = ""
+ALIYUN_SMS_ACCESS_KEY_SECRET: str = ""
+ALIYUN_SMS_SIGN_NAME: str = ""         # 系统赠送签名(自定义签名下发易失败)
+ALIYUN_SMS_TEMPLATE_CODE: str = ""     # 赠送模板 CODE(须与赠送签名搭配)
+ALIYUN_SMS_SCHEME_NAME: str = ""       # 方案名(可空=默认方案);send/check 必须一致 → 单一来源
+ALIYUN_SMS_ENDPOINT: str = "dypnsapi.aliyuncs.com"
+ALIYUN_SMS_CODE_LENGTH: int = 6        # CodeLength 4~8
+ALIYUN_SMS_VALID_TIME_SEC: int = 300   # ValidTime;短信内 min 文案 = //60
+ALIYUN_SMS_INTERVAL_SEC: int = 60      # Interval 单号发送频控
+```
+
+- 新增属性 `aliyun_sms_configured`（仿 `mt_cps_configured`）：AK_ID/AK_SECRET/SignName/TemplateCode 齐全才为真；`SMS_PROVIDER=aliyun` 但未配 → `send_code` 抛 `SmsError(503)`。
+- 复用现有 `SMS_MOCK`、`SMS_CODE_LENGTH`（mock 校验位数）、`SMS_MAX_VERIFY_ATTEMPTS`（防爆破上限，两 provider 共用）。
+
+### 配置敏感点
+- `TemplateParam` 变量名（`code`/`min`）须与控制台所选**赠送模板**一致。融合认证验证码模板通常即 `code`+`min`，按此硬编码并加注释；若模板变量名不同，改 `aliyun.py` 该处即可。
+- `SchemeName` 在 send 与 check 必须一致，故用**单一** `ALIYUN_SMS_SCHEME_NAME` 供两处，避免不匹配（CheckSmsVerifyCode 文档明确警告）。
+
+## 9. auth.py 改动（最小）
+
+`verify_code` 现在可能抛 `SmsError`（阿里云降级 503）。两处调用点各包一层 `try/except SmsError → HTTPException(e.status_code)`，与 `send_code` 现有写法一致：
+- `app/api/v1/auth.py` `sms_login`（约 L185）
+- `app/api/v1/auth.py` `wechat_bind_phone_sms`（约 L325）
+
+`send_code` 调用点已 try/except `SmsError`，无需改。
+
+## 10. 依赖 & SDK
+
+- `pyproject.toml` 增 `alibabacloud_dypnsapi20170525`（连带 `alibabacloud-tea-openapi` 等）。
+- SDK 同步阻塞调用 → 与现有 sync 端点 + sync httpx 风格一致（FastAPI 跑 threadpool，无碍）。
+- `aliyun.py` 内**惰性 import SDK + 惰性建 client**（仿 `wxpay` 惰性加载证书）：`SMS_PROVIDER=jiguang` 时不加载 alibabacloud，启动保持精简。
+- SDK 调用形态（实现时按实际包名/字段核对）：
+  ```python
+  from alibabacloud_dypnsapi20170525.client import Client
+  from alibabacloud_dypnsapi20170525 import models as dypns_models
+  from alibabacloud_tea_openapi import models as open_api_models
+  cfg = open_api_models.Config(access_key_id=..., access_key_secret=...)
+  cfg.endpoint = settings.ALIYUN_SMS_ENDPOINT
+  client = Client(cfg)
+  resp = client.send_sms_verify_code(dypns_models.SendSmsVerifyCodeRequest(...))
+  # resp.body.code / resp.body.success / resp.body.model.verify_code
+  resp = client.check_sms_verify_code(dypns_models.CheckSmsVerifyCodeRequest(...))
+  # resp.body.model.verify_result == "PASS"
+  ```
+
+## 11. 测试
+
+- 现有测试：`SMS_MOCK=true` → 分派器短路，全绿不变。
+- 新增 `tests/test_sms_aliyun.py`（monkeypatch SDK client，不发真网络）：
+  1. 发码成功 → 返回 cooldown、清计数。
+  2. 各错误码 → 对应 `SmsError.status_code`（400/429/503）。
+  3. 校验 `PASS`→True（清计数）/ `UNKNOWN`→False（计数 +1）/ 接口异常→`SmsError(503)`。
+  4. 失败计数达 `SMS_MAX_VERIFY_ATTEMPTS` → 直接 False，不再调阿里云。
+  5. `send_code` 成功复位计数。
+- 新增分派测试：`SMS_PROVIDER` 切换选中正确 provider；`SMS_MOCK` 优先于 provider。
+
+## 12. YAGNI（明确不做）
+
+- ❌ 不做 Redis/DB 存码（Mode A 无需；极光路径内存债维持现状，非本次范围）。
+- ❌ 不改极光任何行为、不动 API 层频控/测试账号逻辑。
+- ❌ 不做多签名/多模板轮换（单签名单模板足够）。
+- ❌ 不把失败计数持久化/跨进程（刻意保留与极光同级的本地态）。
+
+## 13. 验收标准
+
+- `SMS_PROVIDER=aliyun` 且配置齐全时：`/sms/send` 走 `SendSmsVerifyCode`、`/sms/login` 走 `CheckSmsVerifyCode`，真机可收码并登录。
+- `SMS_PROVIDER=jiguang`（默认）：行为与当前完全一致。
+- `SMS_MOCK=true`：任意 N 位数字通过，不发真短信。
+- 阿里云接口异常时：`/sms/login` 返回 503（非 400），日志可区分。
+- `ruff check .` 通过；新增/现有 `pytest` 全绿。

docs/superpowers/specs/2026-07-26-chuanglan-sms-verify-design.md

@@ -0,0 +1,143 @@
+# 创蓝云智(253)短信验证服务 — 设计方案
+
+- 日期：2026-07-26
+- 状态：已定稿，待实现
+- 范围：新增创蓝云智（253/蓝创云智）模板短信 provider，与现有极光 / 阿里云可切换
+
+## 1. 背景与目标
+
+短信验证码服务已是**可切换 provider** 架构（`app/integrations/sms/`：`__init__` 分派 + `jiguang` / `aliyun` + `base`）。本次接入第三家 **创蓝云智** 作为新 provider。
+
+创蓝 `tpl/send` v2 接口（调研见 `docs/integrations/chuanglan/tpl-send.md`）是**纯发送网关**：本服务生成验证码、放入 `templateParamJson`，创蓝只负责下发，**无校验接口**。故属 **Mode B（自管码）**，与极光同模式（本地生成/存储/校验），仅"发送调用"不同。
+
+目标：接入创蓝作为可切换 provider；默认仍极光，opt-in 切换，灰度可秒回退。
+
+## 2. 关键决策（已确认）
+
+1. **Mode B 自管码**：本服务 `secrets` 生成 N 位码 → 存进程内存 → 创蓝 REST 只下发；`verify_code` 比对本地存码（一次性 + 失败 `SMS_MAX_VERIFY_ATTEMPTS` 次即作废）。与极光同语义。
+2. **代码组织 = 隔离复制（不重构极光）**：`chuanglan.py` **自带一份**存码/冷却/校验机器（从 `jiguang.py` 复制适配），**极光文件一行不动**。契合阿里云先例的 provider 隔离哲学，零回归风险于登录关键路径的默认 provider。代价：Mode B 并发逻辑在 jiguang / chuanglan 两处重复，日后改动需同步（YAGNI 权衡，已接受）。
+3. **鉴权 = HMAC 签名头**（`X-QA-Hmac-Signature`）：password 仅用于本地算签、**不上行**。不做明文密码 body 模式。
+4. **无新依赖**：创蓝是普通 HTTPS POST，复用现有 `httpx` + 标准库 `hashlib`/`hmac`（对比阿里云需 SDK）。
+5. **可切换 + 回退**：`SMS_PROVIDER` 增 `chuanglan`；默认仍 `jiguang`；误配/未知值一律回退 `jiguang`（保持 `test_unknown_provider_falls_back_to_jiguang` 语义）。
+
+## 3. 模块结构
+
+```
+app/integrations/sms/
+  __init__.py    # 分派器: {"aliyun":aliyun,"chuanglan":chuanglan}.get(SMS_PROVIDER, jiguang)
+  base.py        # 不动(SmsError / mock_verify 复用)
+  jiguang.py     # 不动
+  aliyun.py      # 不动
+  chuanglan.py   # 新增(本设计)
+```
+
+- `__init__.py` 继续 re-export `SmsError / send_code / verify_code`，`app/api/v1/auth.py` 导入不变。
+- 纯增量：只新增 `chuanglan.py` + 扩分派 dict + 加配置；不改极光/阿里云行为。
+
+## 4. 数据流 — chuanglan provider（Mode B，复制自 jiguang）
+
+### 4.1 发码 `chuanglan.send_code(phone) -> int`
+结构与 `jiguang.send_code` 一致：
+1. `_lock` 内：`_gc` → 单号冷却检查（`_last_sent`，`SMS_SEND_INTERVAL_SEC`，命中→`SmsError(429)`）→ `_gen_code()` 生成 N 位 → **预占**（写 `_last_sent` + `_codes[phone]=_CodeRecord(code, expires_at=now+SMS_CODE_TTL_SEC)`）。
+2. `_lock` 外：`SMS_MOCK` → 打日志不真发；否则 `_send_via_chuanglan(phone, code)`。
+3. 失败：**保留冷却**（失败也限速）、`_codes.pop(phone)`（没发出去的码删掉）；`SmsError` 原样抛，其他异常 → `SmsError(503)`。
+4. 返回 `SMS_SEND_INTERVAL_SEC` 作客户端冷却秒数。
+
+### 4.2 校验 `chuanglan.verify_code(phone, code) -> bool`
+与 `jiguang.verify_code` 一致：
+- `SMS_MOCK` → `mock_verify`（放行任意 N 位数字）。
+- real：`_lock` 内查 `_codes[phone]`；不存在/过期→False（并清）；`attempts >= SMS_MAX_VERIFY_ATTEMPTS`→清+False（防爆破）；`secrets.compare_digest` 匹配→清+True（一次性）；否则 `attempts += 1` 返 False。
+
+### 4.3 发送 `_send_via_chuanglan(phone, code)`（唯一新逻辑）
+1. 配置校验 `settings.chuanglan_sms_configured`（缺 account/password/templateId → `SmsError(503)`）。
+2. 组装：
+   - `timestamp = str(int(time.time()))`、`nonce = secrets.token_hex(16)`（32 hex）
+   - `body = {account, timestamp, nonce, phoneNumbers=phone, templateId, templateParamJson=json.dumps([{"param1": code}])}`；`CHUANGLAN_SMS_SIGNATURE` 非空则加 `signature` 字段。**HMAC 方式 body 不含 password。**
+3. 签名 `_sign(password, timestamp, nonce)`：
+   ```
+   md5pwd = md5(password).hexdigest()                       # 32 位小写 hex
+   s = "".join(sorted([md5pwd, timestamp, nonce]))          # 字典序升序拼接
+   s = "".join(s.split())                                   # 去空白(faithful，本例无空白)
+   sig = hmac_sha256(key=md5pwd.encode(), msg=s.encode()).hexdigest()   # 小写 hex
+   ```
+   置请求头 `X-QA-Hmac-Signature: sig`、`Content-Type: application/json`。
+4. `httpx.post(CHUANGLAN_SMS_ENDPOINT, json=body, headers=..., timeout=CHUANGLAN_SMS_TIMEOUT_SEC)`；网络异常 → `SmsError(503)`。
+5. 解析 `resp.json()`：`code == "000000"` → 成功返回；否则按 §5 映射抛 `SmsError`。HTTP≠200 或 JSON 解析失败 → `SmsError(503)`。
+
+## 5. 错误码映射（创蓝 `code` → SmsError.status_code）
+
+| 创蓝 code | HTTP | 处理 |
+|---|---|---|
+| `000000` | — | 成功 return |
+| `103` | 429 | 超频，"发送过于频繁，请稍后再试" |
+| `107` | 400 | 手机号错误，"手机号无效" |
+| `109` | 503 | 无发送量/余额 → **critical 日志**（需充值） |
+| `117` | 503 | IP 未白名单 → **critical 日志**（需运维加白） |
+| `102` / `116` / `124` / `152` / `101` / `118` | 503 | 密码/签名/模板/账号/权限配置错 → **critical 日志** |
+| 其他 / `Success` 非 000000 / HTTP≠200 / 网络错 | 503 | "短信服务暂不可用，请稍后重试" |
+
+- 映射用 `_SEND_ERRORS: dict[str,(int,str)]` + `_SEND_CRITICAL_CODES: frozenset`（仿 aliyun 写法）。
+
+## 6. 防爆破 / 频控分工（与极光同级）
+
+| 机制 | 实现 |
+|---|---|
+| 验证码存储 | 本地进程内存 `_codes`（与极光同，多 worker 不共享的技术债同级） |
+| 单号发送冷却 | 本地 `_last_sent`，`SMS_SEND_INTERVAL_SEC` |
+| 单设备+IP 频控 | API 层（`app/api/v1/auth.py`），**不变** |
+| 防爆破（单码失败 N 次作废）| 本地 `_CodeRecord.attempts`，`SMS_MAX_VERIFY_ATTEMPTS` |
+
+- 创蓝控制台侧另建议叠加：**IP 白名单**（否则 117）+ 发送频控。
+
+## 7. 配置项（`app/core/config.py` 新增）
+
+```python
+SMS_PROVIDER: Literal["jiguang", "aliyun", "chuanglan"] = "jiguang"
+# --- 创蓝云智(253)模板短信,Mode B 自管码,httpx 直连 + HMAC 签名 ---
+CHUANGLAN_SMS_ACCOUNT: str = ""       # YZM 前缀验证码账号
+CHUANGLAN_SMS_PASSWORD: str = ""      # API 密码(仅本地算签,不上行)
+CHUANGLAN_SMS_TEMPLATE_ID: str = ""   # 模板 ID
+CHUANGLAN_SMS_SIGNATURE: str = ""     # 短信签名文案【品牌】;模板已带签名则留空
+CHUANGLAN_SMS_ENDPOINT: str = "https://smssh.253.com/msg/sms/v2/tpl/send"
+CHUANGLAN_SMS_TIMEOUT_SEC: int = 10   # httpx 读/连超时
+```
+
+- 新增属性 `chuanglan_sms_configured`（仿 `aliyun_sms_configured`）：account/password/templateId 齐全才为真。
+- 复用 `SMS_MOCK` / `SMS_CODE_LENGTH` / `SMS_CODE_TTL_SEC` / `SMS_SEND_INTERVAL_SEC` / `SMS_MAX_VERIFY_ATTEMPTS`（provider 无关的 Mode B 旋钮）。
+- `.env.example` 增 `CHUANGLAN_SMS_*` 块 + 注释。
+
+### 模板变量敏感点
+- 默认按**单占位** `templateParamJson=[{"param1": code}]`（模板形如「您的验证码 {s}，5分钟内有效」）。
+- 若控制台模板把「有效分钟」也做成第二个 `{s}`，实现时在此加 `param2`（改 `chuanglan.py` 一处）。
+
+## 8. auth.py 改动
+
+无。`send_code` / `verify_code` 签名与返回不变，分派层内部路由；两调用点现有 `try/except SmsError` 已覆盖 chuanglan 的 429/400/503。
+
+## 9. 测试
+
+- 现有测试：`SMS_MOCK=true` → 分派器短路，全绿不变。
+- 新增 `tests/test_sms_chuanglan.py`（monkeypatch `_send_via_chuanglan` 内 httpx 接缝，不发真网络）：
+  1. 发码成功（`code=000000`）→ 返回 cooldown、码入内存。
+  2. 各错误码 → 对应 `SmsError.status_code`（103→429 / 107→400 / 109/117/其他→503）。
+  3. HTTP≠200 / 网络异常 → `SmsError(503)`。
+  4. 校验：匹配→True 且作废（一次性）；过期→False；失败累计达上限→作废 False；不匹配→attempts+1 False。
+  5. 冷却：`SMS_SEND_INTERVAL_SEC` 内二次发 → `SmsError(429)`。
+  6. `_sign` 签名算法：对固定 (password, ts, nonce) 断言 HMAC 输出（独立复算比对）。
+- 扩 `tests/test_sms_dispatch.py`：`SMS_PROVIDER=chuanglan` 路由命中 chuanglan；未知值回退 jiguang。
+
+## 10. YAGNI（明确不做）
+
+- ❌ 不重构极光 / 不动阿里云。
+- ❌ 不做明文密码 body 模式（只 HMAC）。
+- ❌ 不做状态回执 `report` / `callbackUrl`。
+- ❌ 不做批量发送（验证码单号）。
+- ❌ 不做 DB/Redis 存码（与极光同级内存态，多 worker 债维持现状）。
+
+## 11. 验收标准
+
+- `SMS_PROVIDER=chuanglan` 且配置齐全时：`/sms/send` 走创蓝 `tpl/send`、`/sms/login` 本地校验，真机可收码并登录。
+- `SMS_PROVIDER=jiguang`（默认）/ `aliyun`：行为与当前完全一致。
+- `SMS_MOCK=true`：任意 N 位数字通过，不真发。
+- 创蓝接口异常时：`/sms/send` 返回对应码（429/400/503），日志可区分（余额/白名单打 critical）。
+- `ruff check .` 通过；新增/现有 `pytest` 全绿。

pyproject.toml

@@ -29,6 +29,9 @@ dependencies = [
     # HTTP 客户端 (调极光 REST)
     "httpx>=0.27.0",
 
+    # 阿里云号码认证(dypns)短信验证码 provider(SMS_PROVIDER=aliyun 时用;签名由 SDK 处理)
+    "alibabacloud_dypnsapi20170525>=2.0.0",
+
     # multipart form (FastAPI 表单上传依赖)
     "python-multipart>=0.0.9",
 

tests/test_admin_config.py

@@ -68,12 +68,12 @@ def test_list_config(admin_client: TestClient, token: str) -> None:
     r = admin_client.get("/admin/api/config", headers=_auth(token))
     assert r.status_code == 200, r.text
     items = {i["key"]: i for i in r.json()}
-    # 非 hidden 项照常返回;看广告组保留可见的:每日上限 / 单次金币上限 / 关闭后冷却。
-    assert "signin_rewards" in items and "ad_daily_limit" in items and "ad_cooldown_sec" in items
-    # hidden 项(任务/里程碑、首页轮播数据源、看广告组的单次金币/每轮次数/信息流广告开关)不在配置页返回。
+    # 非 hidden 项照常返回；广告次数上限迁到「白名单」统一配置。
+    assert "signin_rewards" in items and "ad_cooldown_sec" in items
+    # hidden 项(任务/里程碑、首页轮播数据源、广告次数/单次金币/每轮次数/信息流广告开关)不在配置页返回。
     for hidden_key in (
         "task_rewards", "record_milestones", "marquee_feed_mode",
-        "ad_reward_coin", "ad_round_count", "comparing_ad_enabled",
+        "ad_daily_limit", "ad_reward_coin", "ad_round_count", "comparing_ad_enabled",
     ):
         assert hidden_key not in items, f"{hidden_key} 应被 hidden 过滤"
     assert items["signin_rewards"]["value"] == [

tests/test_admin_read.py

@@ -219,6 +219,115 @@ def test_user_reward_stats_can_scope_withdrawals_by_account(
     assert invite.json()["cash_balance_cents"] == 456
 
 
+def test_user_reward_stats_draw_ecpm_uses_all_filtered_impressions(
+    admin_client: TestClient, admin_token: str
+) -> None:
+    """Draw 平均 eCPM 应与收益报表一致，不能只平均成功发奖记录。"""
+    from app.models.ad_ecpm import AdEcpmRecord
+    from app.models.ad_feed_reward import AdFeedRewardRecord
+
+    uid = _seed_user_with_data("13800000024")
+    created_at = datetime(2038, 1, 15, 4, tzinfo=UTC)
+    db = SessionLocal()
+    try:
+        db.add_all(
+            [
+                AdFeedRewardRecord(
+                    client_event_id="reward-stats-granted-high",
+                    ad_session_id="reward-stats-granted-high",
+                    user_id=uid,
+                    reward_date="2038-01-15",
+                    duration_seconds=10,
+                    unit_count=1,
+                    ecpm_raw="9000",
+                    ad_type="draw",
+                    feed_scene="coupon",
+                    app_env="prod",
+                    our_code_id="104098712",
+                    coin=9,
+                    status="granted",
+                    created_at=created_at,
+                ),
+                AdEcpmRecord(
+                    user_id=uid,
+                    ad_type="draw",
+                    feed_scene="coupon",
+                    ad_session_id="reward-stats-impression-low",
+                    app_env="prod",
+                    our_code_id="104098712",
+                    ecpm_raw="1000",
+                    report_date="2038-01-15",
+                    created_at=created_at,
+                ),
+                AdEcpmRecord(
+                    user_id=uid,
+                    ad_type="feed",
+                    feed_scene="coupon",
+                    ad_session_id="reward-stats-impression-mid",
+                    app_env="prod",
+                    our_code_id="104098712",
+                    ecpm_raw="3000",
+                    report_date="2038-01-15",
+                    created_at=created_at,
+                ),
+                # 同用户但不同场景/环境/非业务代码位，均不应进入本次详情筛选。
+                AdEcpmRecord(
+                    user_id=uid,
+                    ad_type="draw",
+                    feed_scene="comparison",
+                    ad_session_id="reward-stats-other-scene",
+                    app_env="prod",
+                    our_code_id="104098712",
+                    ecpm_raw="7000",
+                    report_date="2038-01-15",
+                    created_at=created_at,
+                ),
+                AdEcpmRecord(
+                    user_id=uid,
+                    ad_type="draw",
+                    feed_scene="coupon",
+                    ad_session_id="reward-stats-test-env",
+                    app_env="test",
+                    our_code_id="104127529",
+                    ecpm_raw="8000",
+                    report_date="2038-01-15",
+                    created_at=created_at,
+                ),
+                AdEcpmRecord(
+                    user_id=uid,
+                    ad_type="draw",
+                    feed_scene="coupon",
+                    ad_session_id="reward-stats-non-business",
+                    app_env="prod",
+                    our_code_id="demo-slot",
+                    ecpm_raw="9000",
+                    report_date="2038-01-15",
+                    created_at=created_at,
+                ),
+            ]
+        )
+        db.commit()
+    finally:
+        db.close()
+
+    response = admin_client.get(
+        f"/admin/api/users/{uid}/reward-stats",
+        params={
+            "date_from": "2038-01-15T00:00:00Z",
+            "date_to": "2038-01-15T23:59:59Z",
+            "app_env": "prod",
+            "revenue_scope": "business",
+            "feed_scene": "coupon",
+        },
+        headers=_auth(admin_token),
+    )
+    assert response.status_code == 200, response.text
+    data = response.json()
+    assert data["feed_count"] == 1
+    # 全部真实展示 (1000 + 3000) / 2；不能返回成功发奖记录的 9000。
+    assert data["feed_avg_ecpm"] == 2000.0
+
+
 def test_user_coin_record_sort_accepts_mixed_timezone_datetimes() -> None:
     """线上 PostgreSQL 返回 aware，SQLite/历史转换可能返回 naive，二者必须可混排。"""
     naive = datetime(2038, 1, 1, 8, 0)

tests/test_admin_roles.py

@@ -73,6 +73,7 @@ def test_monitoring_audit_catalog_and_api_permissions(
         "analytics-health",
         "event-logs",
         "audit-logs",
+        "limit-whitelist",
     ]
 
     # 运营默认可查风控和设备存活，不能绕过导航直调技术/审计接口。
@@ -82,6 +83,9 @@ def test_monitoring_audit_catalog_and_api_permissions(
     assert admin_client.get(
         "/admin/api/device-liveness/stats", headers=_auth(operator_token)
     ).status_code == 200
+    assert admin_client.get(
+        "/admin/api/limit-whitelist/rules", headers=_auth(operator_token)
+    ).status_code == 200
     for path in (
         "/admin/api/analytics-health/overview?date_from=2026-07-01T00:00:00Z&date_to=2026-07-02T00:00:00Z",
         "/admin/api/event-logs",
@@ -89,13 +93,14 @@ def test_monitoring_audit_catalog_and_api_permissions(
     ):
         assert admin_client.get(path, headers=_auth(operator_token)).status_code == 403
 
-    # 技术角色默认拥有监控审计组全部五项权限。
+    # 技术角色默认拥有监控审计组全部六项权限。
     for path in (
         "/admin/api/risk-monitor/summary",
         "/admin/api/device-liveness/stats",
         "/admin/api/analytics-health/overview?date_from=2026-07-01T00:00:00Z&date_to=2026-07-02T00:00:00Z",
         "/admin/api/event-logs",
         "/admin/api/audit-logs",
+        "/admin/api/limit-whitelist/rules",
     ):
         assert admin_client.get(path, headers=_auth(tech_token)).status_code == 200
 
@@ -199,7 +204,7 @@ def test_builtin_roles_labels_and_pages(admin_client, super_token) -> None:
     }
     assert set(roles["tech"]["pages"]) == {
         "dashboard", "risk-monitor", "device-liveness", "analytics-health", "config",
-        "ad-revenue", "huawei-review", "event-logs", "audit-logs",
+        "ad-revenue", "huawei-review", "event-logs", "audit-logs", "limit-whitelist",
     }
 
 

tests/test_auth.py

@@ -11,12 +11,13 @@ import time
 import pytest
 
 from app.integrations import sms
+from app.integrations.sms import jiguang
 
 
 def _reset(phone: str) -> None:
     """清该号的进程内存状态,隔离 real 模式用例。"""
-    sms._codes.pop(phone, None)
-    sms._last_sent.pop(phone, None)
+    jiguang._codes.pop(phone, None)
+    jiguang._last_sent.pop(phone, None)
 
 
 class _OkResp:
@@ -227,16 +228,16 @@ def test_sms_real_send_calls_jiguang(monkeypatch) -> None:
         captured.update(url=url, body=json, auth=headers.get("Authorization", ""))
         return _OkResp()
 
-    monkeypatch.setattr(sms.settings, "SMS_MOCK", False)
-    monkeypatch.setattr(sms.httpx, "post", _fake_post)
+    monkeypatch.setattr(jiguang.settings, "SMS_MOCK", False)
+    monkeypatch.setattr(jiguang.httpx, "post", _fake_post)
 
-    sms.send_code(phone)
+    jiguang.send_code(phone)
 
-    assert captured["url"] == sms.settings.SMS_SEND_ENDPOINT
+    assert captured["url"] == jiguang.settings.SMS_SEND_ENDPOINT
     assert captured["body"]["mobile"] == phone
-    assert captured["body"]["sign_id"] == sms.settings.SMS_SIGN_ID
-    assert captured["body"]["temp_id"] == sms.settings.SMS_TEMPLATE_ID
-    assert captured["body"]["temp_para"]["code"] == sms._codes[phone].code
+    assert captured["body"]["sign_id"] == jiguang.settings.SMS_SIGN_ID
+    assert captured["body"]["temp_id"] == jiguang.settings.SMS_TEMPLATE_ID
+    assert captured["body"]["temp_para"]["code"] == jiguang._codes[phone].code
     assert captured["auth"].startswith("Basic ")
 
 
@@ -244,33 +245,33 @@ def test_sms_real_verify_one_time_and_wrong(monkeypatch) -> None:
     """real 校验:错误码拒(不消费)→ 正确码成功 → 验过即作废。"""
     phone = "13455134000"
     _reset(phone)
-    monkeypatch.setattr(sms.settings, "SMS_MOCK", False)
-    monkeypatch.setattr(sms.httpx, "post", lambda *a, **k: _OkResp())
+    monkeypatch.setattr(jiguang.settings, "SMS_MOCK", False)
+    monkeypatch.setattr(jiguang.httpx, "post", lambda *a, **k: _OkResp())
 
-    sms.send_code(phone)
-    code = sms._codes[phone].code
+    jiguang.send_code(phone)
+    code = jiguang._codes[phone].code
     wrong = "000000" if code != "000000" else "111111"
 
-    assert sms.verify_code(phone, wrong) is False
-    assert sms.verify_code(phone, code) is True
-    assert sms.verify_code(phone, code) is False  # 已作废
+    assert jiguang.verify_code(phone, wrong) is False
+    assert jiguang.verify_code(phone, code) is True
+    assert jiguang.verify_code(phone, code) is False  # 已作废
 
 
 def test_sms_real_verify_attempts_exhausted(monkeypatch) -> None:
     """real 校验:错误次数到上限即作废,正确码也不再通过(防爆破)。"""
     phone = "13466134000"
     _reset(phone)
-    monkeypatch.setattr(sms.settings, "SMS_MOCK", False)
-    monkeypatch.setattr(sms.settings, "SMS_MAX_VERIFY_ATTEMPTS", 3)
-    monkeypatch.setattr(sms.httpx, "post", lambda *a, **k: _OkResp())
+    monkeypatch.setattr(jiguang.settings, "SMS_MOCK", False)
+    monkeypatch.setattr(jiguang.settings, "SMS_MAX_VERIFY_ATTEMPTS", 3)
+    monkeypatch.setattr(jiguang.httpx, "post", lambda *a, **k: _OkResp())
 
-    sms.send_code(phone)
-    code = sms._codes[phone].code
+    jiguang.send_code(phone)
+    code = jiguang._codes[phone].code
     wrong = "000000" if code != "000000" else "111111"
 
     for _ in range(3):
-        assert sms.verify_code(phone, wrong) is False
-    assert sms.verify_code(phone, code) is False  # 超限作废
+        assert jiguang.verify_code(phone, wrong) is False
+    assert jiguang.verify_code(phone, code) is False  # 超限作废
 
 
 def test_sms_real_balance_error_keeps_cooldown(monkeypatch) -> None:
@@ -284,36 +285,36 @@ def test_sms_real_balance_error_keeps_cooldown(monkeypatch) -> None:
         def json(self):
             return {"error": {"code": 50014, "message": "no money"}}
 
-    monkeypatch.setattr(sms.settings, "SMS_MOCK", False)
-    monkeypatch.setattr(sms.httpx, "post", lambda *a, **k: _ErrResp())
+    monkeypatch.setattr(jiguang.settings, "SMS_MOCK", False)
+    monkeypatch.setattr(jiguang.httpx, "post", lambda *a, **k: _ErrResp())
 
     with pytest.raises(sms.SmsError) as ei:
-        sms.send_code(phone)
+        jiguang.send_code(phone)
     assert ei.value.status_code == 503
-    assert phone not in sms._codes      # 没发出去的码已清
-    assert phone in sms._last_sent      # 冷却保留:失败也限速
+    assert phone not in jiguang._codes      # 没发出去的码已清
+    assert phone in jiguang._last_sent      # 冷却保留:失败也限速
 
     # 立即重试 → 被冷却挡下(429),不会再打极光
     with pytest.raises(sms.SmsError) as ei2:
-        sms.send_code(phone)
+        jiguang.send_code(phone)
     assert ei2.value.status_code == 429
 
 
 def test_sms_gc_purges_stale_only(monkeypatch) -> None:
     """GC 清过期码 / 旧冷却,但不动今天有效的(阈值设 0 强制每次扫)。"""
-    monkeypatch.setattr(sms, "_GC_THRESHOLD", 0)
-    sms._codes.clear()
-    sms._last_sent.clear()
+    monkeypatch.setattr(jiguang, "_GC_THRESHOLD", 0)
+    jiguang._codes.clear()
+    jiguang._last_sent.clear()
     now = time.time()
-    sms._codes["stale"] = sms._CodeRecord(code="111111", expires_at=now - 1)
-    sms._codes["fresh"] = sms._CodeRecord(code="222222", expires_at=now + 999)
-    sms._last_sent["old"] = now - 99999
-    sms._last_sent["recent"] = now
+    jiguang._codes["stale"] = jiguang._CodeRecord(code="111111", expires_at=now - 1)
+    jiguang._codes["fresh"] = jiguang._CodeRecord(code="222222", expires_at=now + 999)
+    jiguang._last_sent["old"] = now - 99999
+    jiguang._last_sent["recent"] = now
 
-    sms._gc(now)
+    jiguang._gc(now)
 
-    assert "stale" not in sms._codes and "fresh" in sms._codes
-    assert "old" not in sms._last_sent and "recent" in sms._last_sent
+    assert "stale" not in jiguang._codes and "fresh" in jiguang._codes
+    assert "old" not in jiguang._last_sent and "recent" in jiguang._last_sent
 
 
 # ============================ 用户名 / 默认昵称 ============================

tests/test_compare_harvest.py

@@ -102,6 +102,7 @@ def test_harvest_done_derives_and_newly_success_once(client) -> None:
         assert rec.is_source_best is False
         assert rec.store_name == "测试店"
         assert rec.information == "美团更便宜"
+        assert rec.fail_reason is None               # 成功记录不派生失败原因
         assert rec.items == [{"name": "肥牛饭", "qty": 1}]
         assert rec.trace_url.endswith("/done/")
         # 再来一次(重试 done)→ 已 success,newly_success=False(发奖不重复触发)
@@ -110,6 +111,35 @@ def test_harvest_done_derives_and_newly_success_once(client) -> None:
         assert newly2 is False
 
 
+def test_harvest_done_failed_derives_fail_reason(client) -> None:
+    """failed 记录:记录级 information 笼统,但 fail_reason 从 platform_results 救出具体原因
+    (id 3030 型:美团系统失败 + 京东 items_not_found → 展示京东那条)。"""
+    tid = _tid()
+    done_failed = {
+        "comparison_results": [
+            {"platform_id": "taobao_flash", "platform_name": "淘宝闪购",
+             "package": "com.taobao.taobao", "price": 23.04, "is_source": True, "rank": 1,
+             "items": [{"name": "肥牛饭", "qty": 1}]},
+        ],
+        "platform_results": {
+            "taobao_flash": {"is_source": True, "status": "source", "price": 23.04},
+            "meituan_waimai": {"is_source": False, "status": "failed",
+                               "reason": "搜索店铺失败, 无法跳转到搜索页"},
+            "jd_waimai_standalone": {"is_source": False, "status": "items_not_found",
+                                     "reason": "京东外卖此店内未找到这些菜品"},
+        },
+        "information": "比价过程出错，请稍后重试",
+    }
+    with SessionLocal() as db:
+        crud.harvest_running(db, trace_id=tid, user_id=None)
+        rec, newly = crud.harvest_done(db, trace_id=tid, user_id=None,
+                                       done_params=done_failed)
+        assert newly is False                        # 没落成 success
+        assert rec.status == "failed"
+        assert rec.fail_reason == "京东外卖此店内未找到这些菜品"
+        assert rec.information == "比价过程出错，请稍后重试"  # 原文案仍留存
+
+
 def test_harvest_abort_cancels_running(client) -> None:
     tid = _tid()
     with SessionLocal() as db:
@@ -233,7 +263,9 @@ def test_trace_finalize_harvests_abort(client) -> None:
     with SessionLocal() as db:                        # 先有 running 行(帧0建的)
         crud.harvest_running(db, trace_id=tid, user_id=None)
     p, _cap = _mock_pricebot({"trace_url": "https://price.shaguabijia.com/traces/fin/"})
-    with p:
+    with p, patch(
+        "app.api.v1.compare.backfill_comparison_llm_cost"
+    ) as backfill:
         r = client.post("/api/v1/trace/finalize",
                         json={"trace_id": tid, "status": "cancelled", "reason": "用户终止"})
     assert r.status_code == 200
@@ -241,6 +273,7 @@ def test_trace_finalize_harvests_abort(client) -> None:
         rec = _get(db, tid)
         assert rec is not None and rec.status == "cancelled"
         assert rec.trace_url.endswith("/fin/")
+        backfill.assert_called_once_with(rec.id, tid)
 
 
 def test_price_step_binds_user_when_authed(client) -> None:

tests/test_comparison_llm_backfill.py

@@ -72,6 +72,7 @@ def test_backfill_retries_then_persists_cost(monkeypatch):
 
 def test_repair_batch_only_targets_terminal_missing_rows(monkeypatch):
     missing_id = _record("llm-repair-missing")
+    cancelled_id = _record("llm-repair-cancelled", status="cancelled")
     running_id = _record("llm-repair-running", status="running")
     calls = [
         {
@@ -96,12 +97,15 @@ def test_repair_batch_only_targets_terminal_missing_rows(monkeypatch):
         )
         assert result["repaired"] >= 1
         assert "llm-repair-missing" in seen
+        assert "llm-repair-cancelled" in seen
         assert "llm-repair-running" not in seen
         with SessionLocal() as db:
             assert db.get(ComparisonRecord, missing_id).llm_cost_yuan is not None
+            assert db.get(ComparisonRecord, cancelled_id).llm_cost_yuan is not None
             assert db.get(ComparisonRecord, running_id).llm_cost_yuan is None
     finally:
         _delete(missing_id)
+        _delete(cancelled_id)
         _delete(running_id)
 
 

tests/test_fail_reason.py

@@ -0,0 +1,122 @@
+"""失败卡展示原因派生(repositories.comparison._derive_fail_display)单元测试。
+
+用例取自线上真实 failed 记录(platform_results 形态),覆盖:
+  - information 具体 → 直出
+  - information 笼统 + platform_results 有干净业务结局 → 救援出该原因(id 3030/2964 型)
+  - information 笼统 + 仅系统失败(搜索失败等黑话)→ None(端侧品牌兜底,id 3027 型)
+  - store_closed / no_delivery 被 pricebot 漏成 status=failed → 按 reason 关键字补判
+  - 打烊类脏店名 blob → 统一简短模板
+  - platform_results 为空 / 非对象 → None
+"""
+from __future__ import annotations
+
+from app.repositories import comparison as crud
+
+
+def test_specific_information_passthrough() -> None:
+    # information 本身具体(未达起送/找不到菜等)→ 直出,不看 platform_results
+    assert (
+        crud._derive_fail_display("淘宝闪购未达起送门槛，可加菜凑单后下单", {})
+        == "淘宝闪购未达起送门槛，可加菜凑单后下单"
+    )
+    assert crud._derive_fail_display("未识别到商品", {}) == "未识别到商品"
+
+
+def test_generic_info_rescued_from_items_not_found() -> None:
+    # id 3030 型:美团系统失败 + 京东 items_not_found,记录级 information 笼统 → 救出京东那条
+    pr = {
+        "eleme": {"is_source": True, "status": "source", "price": 23.04},
+        "meituan_waimai": {
+            "is_source": False, "status": "failed",
+            "reason": "搜索店铺失败, 无法跳转到搜索页",
+        },
+        "jd_waimai_standalone": {
+            "is_source": False, "status": "items_not_found",
+            "reason": "京东外卖此店内未找到这些菜品",
+        },
+    }
+    assert (
+        crud._derive_fail_display("比价过程出错，请稍后重试", pr)
+        == "京东外卖此店内未找到这些菜品"
+    )
+
+
+def test_generic_info_rescued_from_store_not_found() -> None:
+    # id 2964 型:美团系统失败 + 京东 store_not_found → 救出京东相似店铺文案
+    pr = {
+        "taobao_flash": {"is_source": True, "status": "source", "price": 127.98},
+        "meituan": {
+            "is_source": False, "status": "failed",
+            "reason": "比价过程出错，请稍后重试",
+        },
+        "jd_waimai": {
+            "is_source": False, "status": "store_not_found",
+            "reason": "未在京东找到「黔珍味·贵州牛肉蘸水健康菜 (望京店)」相似店铺",
+        },
+    }
+    assert (
+        crud._derive_fail_display("比价过程出错，请稍后重试", pr)
+        == "未在京东找到「黔珍味·贵州牛肉蘸水健康菜 (望京店)」相似店铺"
+    )
+
+
+def test_generic_info_pure_system_failure_returns_none() -> None:
+    # id 3027 型:唯一目标平台是自动化黑话失败 → 不给用户看 → None(端侧品牌兜底)
+    pr = {
+        "eleme": {"is_source": True, "status": "source", "price": 18.83},
+        "meituan_waimai": {
+            "is_source": False, "status": "failed",
+            "reason": "搜索店铺失败, 无法跳转到搜索页",
+        },
+    }
+    assert crud._derive_fail_display("比价过程出错，请稍后重试", pr) is None
+
+
+def test_store_closed_leaked_to_failed_is_rescued_and_cleaned() -> None:
+    # 打烊被漏成 status=failed;reason 常带脏店名 blob → 统一简短模板
+    pr = {
+        "jd_waimai": {"is_source": True, "status": "source", "price": 25},
+        "taobao_flash": {
+            "is_source": False, "status": "failed",
+            "reason": "淘宝闪购「沙胆彪炭炉牛杂煲(...)，蜂鸟准时达，月售300+，起送¥20」本店已休息,无法比价",
+        },
+    }
+    assert crud._derive_fail_display("比价过程出错，请稍后重试", pr) == "门店休息中，无法比价"
+
+    pr2 = {
+        "taobao_flash": {"is_source": True, "status": "source", "price": 31.83},
+        "meituan": {
+            "is_source": False, "status": "failed",
+            "reason": "美团「奈雪的茶（北京王府井奥莱·香江」门店已打烊,无法比价",
+        },
+    }
+    assert crud._derive_fail_display("比价出错", pr2) == "门店已打烊，无法比价"
+
+
+def test_no_delivery_leaked_to_failed_is_rescued() -> None:
+    # 单点不配送被漏成 status=failed;reason 本身干净 → 直接用
+    reason = "京东外卖该商家所选商品单点不配送，无法进入结算比价"
+    pr = {
+        "taobao_flash": {"is_source": True, "status": "source", "price": 20.1},
+        "jd_waimai_standalone": {
+            "is_source": False, "status": "failed", "reason": reason,
+        },
+    }
+    assert crud._derive_fail_display("比价过程出错，请稍后重试", pr) == reason
+
+
+def test_empty_or_missing_platform_results_returns_none() -> None:
+    # 「比价出错」+ 空 {} / None / 非对象:引擎早夭,无可展示原因 → None
+    assert crud._derive_fail_display("比价出错", {}) is None
+    assert crud._derive_fail_display("比价过程出错，请稍后重试", None) is None
+    assert crud._derive_fail_display("比价出错", []) is None  # 老 array 形态,防御
+
+
+def test_clean_status_wins_over_priority_order() -> None:
+    # 多个业务结局同现时按 _BIZ_STATUS_PRIORITY 选(below_minimum 优先于 store_not_found)
+    pr = {
+        "src": {"is_source": True, "status": "source", "price": 30},
+        "a": {"is_source": False, "status": "store_not_found", "reason": "未找到店铺A"},
+        "b": {"is_source": False, "status": "below_minimum", "reason": "B未达起送门槛"},
+    }
+    assert crud._derive_fail_display("比价过程出错，请稍后重试", pr) == "B未达起送门槛"

tests/test_guide_video.py

@@ -75,7 +75,7 @@ def _assert_ledger_balanced(user_id: int) -> None:
 
 @pytest.fixture()
 def guide_configured():
-    """给全局配置塞一支片子(默认 max_plays=3 / reward_coin=120),用完还原成未配片。"""
+    """给全局配置塞一支片子(默认 max_plays=3 / reward_coin=100),用完还原成未配片。"""
     with SessionLocal() as db:
         crud_guide.set_video(db, VIDEO_URL, admin_id=1)
         cfg = crud_guide.get_config(db)
@@ -201,7 +201,11 @@ def test_start_loses_seq_race_degrades_to_ad(client, guide_configured, monkeypat
     assert first["should_play"] is True and first["seq"] == 1
 
     # 本次请求读到的是过期计数 → 仍会算出 seq=1
-    monkeypatch.setattr(crud_guide, "used_plays", lambda db, user_id: 0)
+    monkeypatch.setattr(
+        crud_guide,
+        "used_plays",
+        lambda db, user_id, *, scene="coupon", reset_at=None: 0,
+    )
     with SessionLocal() as db:
         result = crud_guide.start_play(db, uid)
 
@@ -261,3 +265,99 @@ def test_reward_loses_race_does_not_double_mint(client, guide_configured) -> Non
     assert _coin_balance(uid) == coin, "一次播放只能发一次币"
     assert len(_guide_txns(uid)) == 1, "一个 play_token 只能有一条金币流水"
     _assert_ledger_balanced(uid)
+
+
+def test_coupon_and_comparison_configs_and_counts_are_independent(client) -> None:
+    phone = "13920000008"
+    token = _login(client, phone)
+    uid = _user_id(phone)
+    comparison_url = "/media/guide_video/pytest_comparison.mp4"
+
+    with SessionLocal() as db:
+        coupon_before = crud_guide.get_config(db, "coupon")
+        comparison_before = crud_guide.get_config(db, "comparison")
+        crud_guide.set_video(db, VIDEO_URL, scene="coupon", admin_id=1)
+        crud_guide.update_config(
+            db,
+            scene="comparison",
+            enabled=True,
+            max_plays=1,
+            reward_coin=321,
+            admin_id=1,
+        )
+        crud_guide.set_video(
+            db,
+            comparison_url,
+            scene="comparison",
+            admin_id=1,
+        )
+
+    try:
+        coupon = client.post(
+            "/api/v1/guide-video/start",
+            json={"scene": "coupon"},
+            headers=_auth(token),
+        ).json()
+        comparison = client.post(
+            "/api/v1/guide-video/start",
+            json={"scene": "comparison"},
+            headers=_auth(token),
+        ).json()
+        comparison_blocked = client.post(
+            "/api/v1/guide-video/start",
+            json={"scene": "comparison"},
+            headers=_auth(token),
+        ).json()
+
+        assert coupon["should_play"] is True
+        assert coupon["video_url"] == VIDEO_URL
+        assert coupon["seq"] == 1
+        assert comparison["should_play"] is True
+        assert comparison["video_url"] == comparison_url
+        assert comparison["reward_coin"] == 321
+        assert comparison["seq"] == 1
+        assert comparison_blocked["should_play"] is False
+
+        with SessionLocal() as db:
+            assert crud_guide.play_stats(db, "coupon")["total_plays"] >= 1
+            assert crud_guide.play_stats(db, "comparison")["total_plays"] == 1
+            rows = list(
+                db.scalars(
+                    select(GuideVideoPlay)
+                    .where(GuideVideoPlay.user_id == uid)
+                    .order_by(GuideVideoPlay.scene)
+                )
+            )
+            assert [(row.scene, row.seq) for row in rows] == [
+                ("comparison", 1),
+                ("coupon", 1),
+            ]
+    finally:
+        with SessionLocal() as db:
+            crud_guide.update_config(
+                db,
+                scene="coupon",
+                enabled=coupon_before["enabled"],
+                reward_coin=coupon_before["reward_coin"],
+                admin_id=1,
+            )
+            crud_guide.set_video(
+                db,
+                coupon_before["video_url"],
+                scene="coupon",
+                admin_id=1,
+            )
+            crud_guide.update_config(
+                db,
+                scene="comparison",
+                enabled=comparison_before["enabled"],
+                max_plays=comparison_before["max_plays"],
+                reward_coin=comparison_before["reward_coin"],
+                admin_id=1,
+            )
+            crud_guide.set_video(
+                db,
+                comparison_before["video_url"],
+                scene="comparison",
+                admin_id=1,
+            )

tests/test_limit_whitelist.py

@@ -0,0 +1,943 @@
+from __future__ import annotations
+
+from copy import deepcopy
+from datetime import UTC, datetime, timedelta
+from uuid import uuid4
+
+import pytest
+from fastapi.testclient import TestClient
+
+from app.admin.main import admin_app
+from app.admin.repositories import admin_user as admin_repo
+from app.admin.security import create_admin_token
+from app.api.v1 import auth as auth_api
+from app.core import limit_policy
+from app.core.config_schema import (
+    AD_FEED_DAILY_LIMIT_KEY,
+    AD_REWARD_VIDEO_DAILY_LIMIT_KEY,
+    GUIDE_VIDEO_MAX_PLAYS_KEY,
+    PHONE_REBIND_DAYS_KEY,
+    SMS_PHONE_COOLDOWN_SECONDS_KEY,
+)
+from app.core.security import create_token
+from app.db.session import SessionLocal
+from app.main import app
+from app.models.app_config import AppConfig
+from app.models.comparison import ComparisonRecord
+from app.models.limit_policy import LimitPolicyOverride
+from app.models.risk import RiskIncident
+from app.repositories import risk as risk_repo
+from app.repositories import user as user_repo
+
+
+def _snapshot_configs(keys: list[str]) -> dict[str, tuple[bool, object, int | None]]:
+    with SessionLocal() as db:
+        snapshot = {}
+        for key in keys:
+            row = db.get(AppConfig, key)
+            snapshot[key] = (
+                row is not None,
+                deepcopy(row.value) if row is not None else None,
+                row.updated_by_admin_id if row is not None else None,
+            )
+        return snapshot
+
+
+def _restore_configs(snapshot: dict[str, tuple[bool, object, int | None]]) -> None:
+    with SessionLocal() as db:
+        for key, (existed, value, admin_id) in snapshot.items():
+            row = db.get(AppConfig, key)
+            if not existed:
+                if row is not None:
+                    db.delete(row)
+                continue
+            if row is None:
+                db.add(
+                    AppConfig(
+                        key=key,
+                        value=deepcopy(value),
+                        updated_by_admin_id=admin_id,
+                    )
+                )
+            else:
+                row.value = deepcopy(value)
+                row.updated_by_admin_id = admin_id
+        db.commit()
+
+
+@pytest.fixture()
+def admin_headers() -> dict[str, str]:
+    username = f"limit_admin_{uuid4().hex[:8]}"
+    with SessionLocal() as db:
+        admin = admin_repo.create_admin(
+            db,
+            username=username,
+            password="limit-admin-pass",
+            role="super_admin",
+        )
+        admin_id = admin.id
+    token, _ = create_admin_token(admin_id=admin_id, role="super_admin")
+    return {"Authorization": f"Bearer {token}"}
+
+
+@pytest.fixture()
+def custom_admin_headers() -> dict[str, str]:
+    username = f"limit_custom_{uuid4().hex[:8]}"
+    with SessionLocal() as db:
+        admin = admin_repo.create_admin(
+            db,
+            username=username,
+            password="limit-admin-pass",
+            role="custom",
+            pages_override=["limit-whitelist"],
+        )
+        admin_id = admin.id
+    token, _ = create_admin_token(admin_id=admin_id, role="custom")
+    return {"Authorization": f"Bearer {token}"}
+
+
+def test_custom_admin_with_page_permission_can_manage_whitelist(
+    custom_admin_headers,
+) -> None:
+    phone = f"139{int(uuid4().hex[:8], 16) % 100000000:08d}"
+    expires_at = (datetime.now(UTC) + timedelta(hours=2)).isoformat()
+
+    with TestClient(admin_app) as client:
+        created = client.post(
+            "/admin/api/limit-whitelist/bulk",
+            headers=custom_admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_codes": ["compare.start.daily"],
+                "expires_at": expires_at,
+                "reason": "custom role page permission",
+            },
+        )
+        assert created.status_code == 201, created.text
+        override_id = created.json()[0]["id"]
+        deleted = client.delete(
+            f"/admin/api/limit-whitelist/{override_id}",
+            headers=custom_admin_headers,
+        )
+        assert deleted.status_code == 204, deleted.text
+
+
+def test_bulk_create_reactivates_existing_rows(admin_headers) -> None:
+    phone = f"139{int(uuid4().hex[:8], 16) % 100000000:08d}"
+    first_expiry = (datetime.now(UTC) + timedelta(hours=1)).isoformat()
+    second_expiry = (datetime.now(UTC) + timedelta(hours=3)).isoformat()
+
+    with TestClient(admin_app) as client:
+        first = client.post(
+            "/admin/api/limit-whitelist/bulk",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_codes": ["compare.start.daily"],
+                "expires_at": first_expiry,
+                "reason": "first period",
+            },
+        )
+        assert first.status_code == 201, first.text
+        first_id = first.json()[0]["id"]
+        reset = client.post(
+            f"/admin/api/limit-whitelist/{first_id}/reset",
+            headers=admin_headers,
+        )
+        assert reset.status_code == 200, reset.text
+
+        recreated = client.post(
+            "/admin/api/limit-whitelist/bulk",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_codes": [
+                    "compare.start.daily",
+                    "sms.phone.cooldown",
+                ],
+                "expires_at": second_expiry,
+                "reason": "renewed period",
+            },
+        )
+        assert recreated.status_code == 201, recreated.text
+        rows = {item["rule_code"]: item for item in recreated.json()}
+        assert rows["compare.start.daily"]["id"] == first_id
+        assert rows["compare.start.daily"]["enabled"] is True
+        assert rows["compare.start.daily"]["status"] == "active"
+        assert rows["compare.start.daily"]["reason"] == "renewed period"
+        assert rows["sms.phone.cooldown"]["enabled"] is True
+
+
+def test_admin_whitelist_crud_and_policy_precedence(admin_headers) -> None:
+    suffix = uuid4().hex[:10]
+    phone = f"139{int(suffix[:8], 16) % 100000000:08d}"
+    device = f"limit-device-{suffix}"
+    expires_at = (datetime.now(UTC) + timedelta(hours=2)).isoformat()
+
+    with TestClient(admin_app) as client:
+        rules = client.get(
+            "/admin/api/limit-whitelist/rules",
+            headers=admin_headers,
+        )
+        assert rules.status_code == 200, rules.text
+        assert {item["code"] for item in rules.json()} >= {
+            "compare.start.daily",
+            "sms.send.hourly",
+            "ad.reward_video.daily",
+            "risk.compare.daily",
+        }
+        rules_by_code = {item["code"]: item for item in rules.json()}
+        assert all(
+            "inherit" not in item["allowed_modes"] for item in rules.json()
+        )
+        assert all(
+            "override" not in item["allowed_modes"] for item in rules.json()
+        )
+        assert "unlimited" in rules_by_code["sms.phone.cooldown"]["allowed_modes"]
+        assert "unlimited" in rules_by_code["sms.code.failed_attempts"]["allowed_modes"]
+        assert "suppress_alert" in rules_by_code["risk.compare.daily"]["allowed_modes"]
+
+        removed_inherit = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_code": "compare.start.daily",
+                "mode": "inherit",
+                "enabled": True,
+            },
+        )
+        assert removed_inherit.status_code == 422
+
+        invalid_alert = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_code": "compare.start.daily",
+                "mode": "suppress_alert",
+                "enabled": True,
+                "reason": "invalid",
+            },
+        )
+        assert invalid_alert.status_code == 400
+
+        missing_expiry = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_code": "compare.start.daily",
+                "mode": "unlimited",
+                "enabled": True,
+                "reason": "temporary QA",
+            },
+        )
+        assert missing_expiry.status_code == 400
+
+        expired_unlimited = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_code": "compare.start.daily",
+                "mode": "unlimited",
+                "enabled": True,
+                "expires_at": "2020-01-01T00:00:00Z",
+                "reason": "expired temporary policy",
+            },
+        )
+        assert expired_unlimited.status_code == 400
+        assert "晚于当前时间" in expired_unlimited.json()["detail"]
+
+        removed_override = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_code": "compare.start.daily",
+                "mode": "override",
+                "limit_value": 2,
+                "enabled": True,
+                "expires_at": expires_at,
+            },
+        )
+        assert removed_override.status_code == 422
+
+        phone_created = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_code": "compare.start.daily",
+                "mode": "unlimited",
+                "enabled": True,
+                "expires_at": expires_at,
+                "reason": "temporary QA",
+            },
+        )
+        assert phone_created.status_code == 201, phone_created.text
+        phone_id = phone_created.json()["id"]
+        assert phone_created.json()["effective_limit"] is None
+
+        phone_updated = client.patch(
+            f"/admin/api/limit-whitelist/{phone_id}",
+            headers=admin_headers,
+            json={
+                "enabled": True,
+                "reason": "updated from admin",
+            },
+        )
+        assert phone_updated.status_code == 200, phone_updated.text
+        assert phone_updated.json()["effective_limit"] is None
+        assert phone_updated.json()["reason"] == "updated from admin"
+        with SessionLocal() as db:
+            persisted = db.get(LimitPolicyOverride, phone_id)
+            assert persisted is not None
+            assert persisted.mode == "unlimited"
+            assert persisted.limit_value is None
+            assert persisted.reason == "updated from admin"
+
+        removed_patch_fields = client.patch(
+            f"/admin/api/limit-whitelist/{phone_id}",
+            headers=admin_headers,
+            json={"mode": "override", "limit_value": 4},
+        )
+        assert removed_patch_fields.status_code == 422
+
+        inverted_time = client.patch(
+            f"/admin/api/limit-whitelist/{phone_id}",
+            headers=admin_headers,
+            json={
+                "starts_at": "2030-01-02T00:00:00Z",
+                "expires_at": "2030-01-01T00:00:00Z",
+            },
+        )
+        assert inverted_time.status_code == 400
+        assert "晚于生效时间" in inverted_time.json()["detail"]
+
+        duplicate = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_code": "compare.start.daily",
+                "mode": "unlimited",
+                "enabled": True,
+                "expires_at": expires_at,
+            },
+        )
+        assert duplicate.status_code == 409
+
+        device_created = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "device",
+                "subject_value": device,
+                "rule_code": "compare.start.daily",
+                "mode": "unlimited",
+                "enabled": True,
+                "expires_at": expires_at,
+                "reason": "device QA",
+            },
+        )
+        assert device_created.status_code == 201, device_created.text
+        device_id = device_created.json()["id"]
+        assert device_created.json()["effective_limit"] is None
+
+        with SessionLocal() as db:
+            effective = limit_policy.resolve(
+                db,
+                "compare.start.daily",
+                phone=phone,
+                device=device,
+            )
+            assert effective.unlimited is True
+            assert effective.matched_subject_type == "device"
+
+        restored = client.post(
+            f"/admin/api/limit-whitelist/{phone_id}/reset",
+            headers=admin_headers,
+        )
+        assert restored.status_code == 200, restored.text
+        assert restored.json()["enabled"] is False
+        assert restored.json()["status"] == "disabled"
+        assert restored.json()["effective_limit"] == restored.json()["global_limit"]
+        assert restored.json()["reset_at"] is None
+        with SessionLocal() as db:
+            effective = limit_policy.resolve(
+                db,
+                "compare.start.daily",
+                phone=phone,
+                device=None,
+            )
+            assert effective.override_id is None
+            assert effective.limit == effective.global_limit
+
+        ordered = client.get(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            params={"rule_code": "compare.start.daily", "limit": 500},
+        )
+        assert ordered.status_code == 200, ordered.text
+        ordered_ids = [item["id"] for item in ordered.json()["items"]]
+        assert ordered_ids.index(device_id) < ordered_ids.index(phone_id)
+
+        listed = client.get(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            params={"keyword": suffix[:5]},
+        )
+        assert listed.status_code == 200
+        assert listed.json()["total"] >= 1
+
+        deleted = client.delete(
+            f"/admin/api/limit-whitelist/{device_id}",
+            headers=admin_headers,
+        )
+        assert deleted.status_code == 204
+        client.delete(
+            f"/admin/api/limit-whitelist/{phone_id}",
+            headers=admin_headers,
+        )
+
+
+def test_device_candidates_are_rule_aware_and_searchable(admin_headers) -> None:
+    suffix = uuid4().hex[:8]
+    phone = f"135{int(suffix, 16) % 100000000:08d}"
+    auth_device = f"android-id-{suffix}"
+    compare_device = f"device-PJZ110-{suffix}"
+    now = datetime.now(UTC).replace(microsecond=0)
+    with SessionLocal() as db:
+        user = user_repo.upsert_user_for_login(
+            db,
+            phone=phone,
+            register_channel="sms",
+        )
+        user.nickname = f"候选设备用户{suffix}"
+        risk_repo.record_behavior_event(
+            db,
+            event_type=risk_repo.EVENT_ONECLICK_LOGIN,
+            subject_type="device",
+            subject_id=auth_device,
+            user_id=user.id,
+            device_id=auth_device,
+            device_model="OPPO Find X8",
+            phone=phone,
+            outcome="success",
+            occurred_at=now,
+        )
+        db.add(
+            ComparisonRecord(
+                user_id=user.id,
+                device_id=compare_device,
+                trace_id=f"device-candidate-{suffix}",
+                device_model="PJZ110",
+                status="success",
+                items=[],
+                comparison_results=[],
+                skipped_dish_names=[],
+                created_at=now.replace(tzinfo=None),
+            )
+        )
+        db.commit()
+        user_id = user.id
+        username = user.username
+
+    with TestClient(admin_app) as client:
+        for keyword in (phone, str(user_id), username, "Find X8"):
+            response = client.get(
+                "/admin/api/limit-whitelist/device-candidates",
+                headers=admin_headers,
+                params={
+                    "rule_code": "risk.oneclick.daily",
+                    "keyword": keyword,
+                },
+            )
+            assert response.status_code == 200, response.text
+            item = next(
+                row for row in response.json() if row["device_id"] == auth_device
+            )
+            assert item["source_label"] == "一键登录"
+            assert item["user_id"] == user_id
+            assert item["phone"] == phone
+            assert item["device_model"] == "OPPO Find X8"
+
+        comparison = client.get(
+            "/admin/api/limit-whitelist/device-candidates",
+            headers=admin_headers,
+            params={
+                "rule_code": "compare.start.daily",
+                "keyword": "PJZ110",
+            },
+        )
+        assert comparison.status_code == 200, comparison.text
+        assert len(comparison.json()) == 1
+        comparison_item = comparison.json()[0]
+        assert comparison_item["device_id"] == compare_device
+        assert comparison_item["source"] == "comparison_record"
+        assert comparison_item["source_label"] == "比价记录"
+        assert comparison_item["user_id"] == user_id
+        assert comparison_item["username"] == username
+        assert comparison_item["phone"] == phone
+        assert comparison_item["nickname"] == f"候选设备用户{suffix}"
+        assert comparison_item["device_model"] == "PJZ110"
+        assert comparison_item["last_active_at"].startswith(
+            now.replace(tzinfo=None).isoformat()
+        )
+
+        phone_only = client.get(
+            "/admin/api/limit-whitelist/device-candidates",
+            headers=admin_headers,
+            params={"rule_code": "risk.compare.daily"},
+        )
+        assert phone_only.status_code == 400
+        assert "不支持设备白名单" in phone_only.json()["detail"]
+
+
+def test_legacy_ip_is_not_a_device_candidate_or_valid_whitelist_subject(
+    admin_headers,
+) -> None:
+    suffix = uuid4().hex[:8]
+    legacy_device = f"legacy-ip:203.0.113.{int(suffix[:2], 16) % 200 + 1}"
+    expires_at = (datetime.now(UTC) + timedelta(hours=2)).isoformat()
+    with SessionLocal() as db:
+        risk_repo.record_behavior_event(
+            db,
+            event_type=risk_repo.EVENT_SMS_SEND,
+            subject_type="device",
+            subject_id=legacy_device,
+            device_id=None,
+            phone=f"136{int(suffix, 16) % 100000000:08d}",
+            outcome="success",
+        )
+
+    with TestClient(admin_app) as client:
+        candidates = client.get(
+            "/admin/api/limit-whitelist/device-candidates",
+            headers=admin_headers,
+            params={
+                "rule_code": "sms.send.hourly",
+                "keyword": legacy_device,
+            },
+        )
+        assert candidates.status_code == 200, candidates.text
+        assert all(
+            row["device_id"] != legacy_device for row in candidates.json()
+        )
+
+        single = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "device",
+                "subject_value": legacy_device,
+                "rule_code": "sms.send.hourly",
+                "mode": "unlimited",
+                "enabled": True,
+                "expires_at": expires_at,
+            },
+        )
+        assert single.status_code == 400, single.text
+        assert "未上报真实设备 ID" in single.json()["detail"]
+
+        bulk = client.post(
+            "/admin/api/limit-whitelist/bulk",
+            headers=admin_headers,
+            json={
+                "subject_type": "device",
+                "subject_value": legacy_device,
+                "rule_codes": ["sms.send.hourly", "sms.send.daily"],
+                "enabled": True,
+                "expires_at": expires_at,
+            },
+        )
+        assert bulk.status_code == 400, bulk.text
+        assert "未上报真实设备 ID" in bulk.json()["detail"]
+
+
+def test_bulk_create_automatically_selects_unlimited_and_suppress_modes(
+    admin_headers,
+) -> None:
+    suffix = uuid4().hex[:8]
+    phone = f"137{int(suffix, 16) % 100000000:08d}"
+    expires_at = (datetime.now(UTC) + timedelta(hours=2)).isoformat()
+
+    with TestClient(admin_app) as client:
+        created = client.post(
+            "/admin/api/limit-whitelist/bulk",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_codes": [
+                    "compare.start.daily",
+                    "risk.compare.daily",
+                ],
+                "expires_at": expires_at,
+                "reason": "批量白名单测试",
+            },
+        )
+        assert created.status_code == 201, created.text
+        rows = {item["rule_code"]: item for item in created.json()}
+        assert rows["compare.start.daily"]["mode"] == "unlimited"
+        assert rows["compare.start.daily"]["effective_limit"] is None
+        assert rows["risk.compare.daily"]["mode"] == "suppress_alert"
+        assert rows["risk.compare.daily"]["effective_limit"] == rows[
+            "risk.compare.daily"
+        ]["global_limit"]
+
+        duplicate_batch = client.post(
+            "/admin/api/limit-whitelist/bulk",
+            headers=admin_headers,
+            json={
+                "subject_type": "phone",
+                "subject_value": phone,
+                "rule_codes": [
+                    "compare.start.daily",
+                    "sms.send.daily",
+                ],
+                "expires_at": expires_at,
+            },
+        )
+        assert duplicate_batch.status_code == 409
+        with SessionLocal() as db:
+            rolled_back = (
+                db.query(LimitPolicyOverride)
+                .filter(
+                    LimitPolicyOverride.subject_type == "phone",
+                    LimitPolicyOverride.subject_value == phone,
+                    LimitPolicyOverride.rule_code == "sms.send.daily",
+                )
+                .one_or_none()
+            )
+            assert rolled_back is None
+
+        for item in created.json():
+            deleted = client.delete(
+                f"/admin/api/limit-whitelist/{item['id']}",
+                headers=admin_headers,
+            )
+            assert deleted.status_code == 204
+
+
+def test_device_bulk_rejects_mixed_candidate_namespaces(admin_headers) -> None:
+    expires_at = (datetime.now(UTC) + timedelta(hours=2)).isoformat()
+    with TestClient(admin_app) as client:
+        response = client.post(
+            "/admin/api/limit-whitelist/bulk",
+            headers=admin_headers,
+            json={
+                "subject_type": "device",
+                "subject_value": f"mixed-device-{uuid4().hex[:8]}",
+                "rule_codes": [
+                    "compare.start.daily",
+                    "sms.send.hourly",
+                ],
+                "expires_at": expires_at,
+            },
+        )
+    assert response.status_code == 400
+    assert "不能在同一白名单中混选" in response.json()["detail"]
+
+
+def test_legacy_ip_device_whitelist_matches_sms_policy(monkeypatch) -> None:
+    suffix = uuid4().hex[:8]
+    client_ip = f"203.0.113.{int(suffix[:2], 16) % 200 + 1}"
+    legacy_device = f"legacy-ip:{client_ip}"
+    phone = f"134{int(suffix, 16) % 100000000:08d}"
+    expires_at = datetime.now(UTC) + timedelta(hours=2)
+    with SessionLocal() as db:
+        row = LimitPolicyOverride(
+            subject_type="device",
+            subject_value=legacy_device,
+            rule_code="sms.send.hourly",
+            mode="unlimited",
+            enabled=True,
+            expires_at=expires_at,
+        )
+        db.add(row)
+        db.commit()
+        override_id = row.id
+
+    original_resolve = auth_api.limit_policy.resolve
+    matched_override_ids: list[int | None] = []
+
+    def spy_resolve(db, rule_code, **subjects):
+        result = original_resolve(db, rule_code, **subjects)
+        if rule_code == "sms.send.hourly":
+            matched_override_ids.append(result.override_id)
+        return result
+
+    monkeypatch.setattr(auth_api.limit_policy, "resolve", spy_resolve)
+    try:
+        with TestClient(app) as client:
+            response = client.post(
+                "/api/v1/auth/sms/send",
+                headers={"x-forwarded-for": client_ip},
+                json={"phone": phone},
+            )
+        assert response.status_code == 200, response.text
+        assert matched_override_ids == [override_id]
+    finally:
+        with SessionLocal() as db:
+            row = db.get(LimitPolicyOverride, override_id)
+            if row is not None:
+                db.delete(row)
+                db.commit()
+
+
+def test_global_guide_limit_stays_in_sync_with_legacy_config(admin_headers) -> None:
+    snapshot = _snapshot_configs(
+        [
+            GUIDE_VIDEO_MAX_PLAYS_KEY,
+            "coupon_guide_video",
+            "comparison_guide_video",
+        ]
+    )
+    try:
+        with TestClient(admin_app) as client:
+            changed = client.patch(
+                "/admin/api/limit-whitelist/rules/guide.video.lifetime",
+                headers=admin_headers,
+                json={"value": 7},
+            )
+            assert changed.status_code == 200, changed.text
+            assert changed.json()["global_limit"] == 7
+
+            legacy_page = client.get(
+                "/admin/api/guide-video",
+                headers=admin_headers,
+            )
+            assert legacy_page.status_code == 200, legacy_page.text
+            assert legacy_page.json()["max_plays"] == 7
+            assert legacy_page.json()["scene"] == "coupon"
+
+            comparison_changed = client.patch(
+                "/admin/api/guide-video",
+                headers=admin_headers,
+                params={"scene": "comparison"},
+                json={"max_plays": 9},
+            )
+            assert comparison_changed.status_code == 200, comparison_changed.text
+            assert comparison_changed.json()["scene"] == "comparison"
+            assert comparison_changed.json()["max_plays"] == 9
+
+            coupon_again = client.get(
+                "/admin/api/guide-video",
+                headers=admin_headers,
+                params={"scene": "coupon"},
+            )
+            assert coupon_again.status_code == 200, coupon_again.text
+            assert coupon_again.json()["max_plays"] == 7
+    finally:
+        _restore_configs(snapshot)
+
+
+def test_legacy_ad_limit_update_syncs_split_global_rules(admin_headers) -> None:
+    snapshot = _snapshot_configs(
+        ["ad_daily_limit", AD_REWARD_VIDEO_DAILY_LIMIT_KEY, AD_FEED_DAILY_LIMIT_KEY]
+    )
+    try:
+        with TestClient(admin_app) as client:
+            changed = client.patch(
+                "/admin/api/config/ad_daily_limit",
+                headers=admin_headers,
+                json={"value": 321},
+            )
+            assert changed.status_code == 200, changed.text
+
+            rules = client.get(
+                "/admin/api/limit-whitelist/rules",
+                headers=admin_headers,
+            )
+            by_code = {item["code"]: item for item in rules.json()}
+            assert by_code["ad.reward_video.daily"]["global_limit"] == 321
+            assert by_code["ad.feed.daily"]["global_limit"] == 321
+    finally:
+        _restore_configs(snapshot)
+
+
+def test_zero_disables_cooldown_style_global_rules(admin_headers) -> None:
+    snapshot = _snapshot_configs(
+        [SMS_PHONE_COOLDOWN_SECONDS_KEY, PHONE_REBIND_DAYS_KEY]
+    )
+    try:
+        with TestClient(admin_app) as client:
+            for rule_code in ("sms.phone.cooldown", "phone.rebind.days"):
+                changed = client.patch(
+                    f"/admin/api/limit-whitelist/rules/{rule_code}",
+                    headers=admin_headers,
+                    json={"value": 0},
+                )
+                assert changed.status_code == 200, changed.text
+                assert changed.json()["global_limit"] == 0
+    finally:
+        _restore_configs(snapshot)
+
+
+def test_compare_start_uses_phone_override_and_reset_baseline() -> None:
+    suffix = uuid4().hex[:8]
+    phone = f"136{int(suffix, 16) % 100000000:08d}"
+    device = f"compare-policy-{suffix}"
+    with SessionLocal() as db:
+        user = user_repo.upsert_user_for_login(
+            db,
+            phone=phone,
+            register_channel="sms",
+        )
+        db.add(
+            LimitPolicyOverride(
+                subject_type="phone",
+                subject_value=phone,
+                rule_code="compare.start.daily",
+                mode="override",
+                limit_value=1,
+                enabled=True,
+            )
+        )
+        db.commit()
+        user_id = user.id
+
+    token, _ = create_token(user_id=user_id, token_type="access")
+    headers = {"Authorization": f"Bearer {token}"}
+    with TestClient(app) as client:
+        first = client.post(
+            "/api/v1/compare/start",
+            headers=headers,
+            json={
+                "trace_id": f"limit-policy-first-{suffix}",
+                "business_type": "food",
+                "device_id": device,
+            },
+        )
+        assert first.status_code == 200, first.text
+        assert first.json() == {"limit": 1, "used": 1, "remaining": 0}
+
+        blocked = client.post(
+            "/api/v1/compare/start",
+            headers=headers,
+            json={
+                "trace_id": f"limit-policy-blocked-{suffix}",
+                "business_type": "food",
+                "device_id": device,
+            },
+        )
+        assert blocked.status_code == 429
+
+        with SessionLocal() as db:
+            override = db.query(LimitPolicyOverride).filter(
+                LimitPolicyOverride.subject_type == "phone",
+                LimitPolicyOverride.subject_value == phone,
+                LimitPolicyOverride.rule_code == "compare.start.daily",
+            ).one()
+            override.reset_at = datetime.now(UTC)
+            db.commit()
+
+        after_reset = client.post(
+            "/api/v1/compare/start",
+            headers=headers,
+            json={
+                "trace_id": f"limit-policy-reset-{suffix}",
+                "business_type": "food",
+                "device_id": device,
+            },
+        )
+        assert after_reset.status_code == 200, after_reset.text
+        assert after_reset.json() == {"limit": 1, "used": 1, "remaining": 0}
+
+
+def test_suppress_alert_keeps_events_but_creates_no_incident() -> None:
+    suffix = uuid4().hex[:10]
+    device = f"suppress-device-{suffix}"
+    phone = f"138{int(suffix[:8], 16) % 100000000:08d}"
+    now = risk_repo.utcnow().replace(microsecond=0)
+    with SessionLocal() as db:
+        db.add(
+            LimitPolicyOverride(
+                subject_type="device",
+                subject_value=device,
+                rule_code="risk.sms.hourly",
+                mode="suppress_alert",
+                enabled=True,
+            )
+        )
+        db.commit()
+        for index in range(10):
+            risk_repo.record_behavior_event(
+                db,
+                event_type=risk_repo.EVENT_SMS_SEND,
+                subject_type="device",
+                subject_id=device,
+                device_id=device,
+                phone=phone,
+                outcome="success",
+                occurred_at=now + timedelta(seconds=index),
+                evaluate_rule=risk_repo.RULE_SMS_HOURLY,
+            )
+
+    with SessionLocal() as db:
+        incident = db.query(RiskIncident).filter(
+            RiskIncident.rule_code == risk_repo.RULE_SMS_HOURLY,
+            RiskIncident.subject_id == device,
+        ).one_or_none()
+        assert incident is None
+
+
+def test_adding_suppress_alert_resolves_existing_incident(admin_headers) -> None:
+    suffix = uuid4().hex[:10]
+    device = f"suppress-existing-{suffix}"
+    now = risk_repo.utcnow().replace(microsecond=0)
+    with SessionLocal() as db:
+        for index in range(5):
+            risk_repo.record_behavior_event(
+                db,
+                event_type=risk_repo.EVENT_SMS_SEND,
+                subject_type="device",
+                subject_id=device,
+                device_id=device,
+                phone=f"13700001{index:03d}",
+                outcome="success",
+                occurred_at=now + timedelta(seconds=index),
+                evaluate_rule=risk_repo.RULE_SMS_HOURLY,
+            )
+        incident = db.query(RiskIncident).filter(
+            RiskIncident.rule_code == risk_repo.RULE_SMS_HOURLY,
+            RiskIncident.subject_id == device,
+        ).one()
+        assert incident.status == "open"
+
+    with TestClient(admin_app) as client:
+        created = client.post(
+            "/admin/api/limit-whitelist",
+            headers=admin_headers,
+            json={
+                "subject_type": "device",
+                "subject_value": device,
+                "rule_code": "risk.sms.hourly",
+                "mode": "suppress_alert",
+                "enabled": True,
+                "expires_at": (datetime.now(UTC) + timedelta(hours=2)).isoformat(),
+                "reason": "QA device",
+            },
+        )
+        assert created.status_code == 201, created.text
+
+    with SessionLocal() as db:
+        incident = db.query(RiskIncident).filter(
+            RiskIncident.rule_code == risk_repo.RULE_SMS_HOURLY,
+            RiskIncident.subject_id == device,
+        ).one()
+        assert incident.status == "resolved"
+        assert incident.action_reason == risk_repo.AUTO_RESOLVED_REASON

tests/test_risk_monitor.py

@@ -533,7 +533,7 @@ def test_admin_can_edit_rules_and_current_window_is_reconciled() -> None:
             "/admin/api/risk-monitor/rules",
             headers=headers,
             json={
-                "sms_hourly_threshold": 21,
+                "sms_hourly_threshold": 100_001,
                 "oneclick_daily_threshold": 20,
                 "compare_daily_threshold": 100,
             },

tests/test_sms_aliyun.py

@@ -0,0 +1,185 @@
+"""阿里云短信 provider(Mode A)单元测试。
+
+SDK 交互隔离在 aliyun._call_send / aliyun._call_check 两个薄封装,本文件全程 monkeypatch
+它们(返回归一化结果 dict 或抛 SmsError)→ 不触真 SDK、不发网络。测的是 provider 的可映射逻辑:
+错误码→HTTP 码、PASS/UNKNOWN 解释、本地失败计数(与极光同语义)、mock 短路。
+"""
+from __future__ import annotations
+
+import pytest
+
+from app.core.config import settings
+from app.integrations.sms import aliyun
+from app.integrations.sms.base import SmsError
+
+PHONE = "13800138000"
+
+
+def _configure(monkeypatch, *, mock: bool = False) -> None:
+    """配齐阿里云凭证 + 设 SMS_MOCK;清本地失败计数隔离用例。"""
+    monkeypatch.setattr(settings, "SMS_MOCK", mock)
+    monkeypatch.setattr(settings, "ALIYUN_SMS_ACCESS_KEY_ID", "ak")
+    monkeypatch.setattr(settings, "ALIYUN_SMS_ACCESS_KEY_SECRET", "sk")
+    monkeypatch.setattr(settings, "ALIYUN_SMS_SIGN_NAME", "恒创联众")
+    monkeypatch.setattr(settings, "ALIYUN_SMS_TEMPLATE_CODE", "SMS_100001")
+    aliyun._verify_attempts.clear()
+
+
+def _send_ok(phone):
+    return {"success": True, "code": "OK", "message": "成功", "verify_code": "1234"}
+
+
+def _check(result):
+    def _f(phone, code):
+        return {"success": True, "code": "OK", "message": "成功", "verify_result": result}
+    return _f
+
+
+# ============================ 发码 ============================
+
+def test_send_success_returns_interval_and_resets_attempts(monkeypatch) -> None:
+    _configure(monkeypatch)
+    aliyun._verify_attempts[PHONE] = 3  # 旧失败计数
+    monkeypatch.setattr(aliyun, "_call_send", _send_ok)
+
+    assert aliyun.send_code(PHONE) == settings.ALIYUN_SMS_INTERVAL_SEC
+    assert PHONE not in aliyun._verify_attempts  # 新码 = 新预算
+
+
+@pytest.mark.parametrize(
+    "code,expected",
+    [
+        ("MOBILE_NUMBER_ILLEGAL", 400),
+        ("BUSINESS_LIMIT_CONTROL", 429),
+        ("FREQUENCY_FAIL", 429),
+        ("FUNCTION_NOT_OPENED", 503),
+        ("INVALID_PARAMETERS", 503),
+        ("SOME_UNEXPECTED_CODE", 503),
+    ],
+)
+def test_send_maps_error_codes(monkeypatch, code, expected) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(
+        aliyun, "_call_send",
+        lambda phone: {"success": False, "code": code, "message": code, "verify_code": None},
+    )
+    with pytest.raises(SmsError) as ei:
+        aliyun.send_code(PHONE)
+    assert ei.value.status_code == expected
+
+
+def test_send_not_configured_raises_503_without_calling_aliyun(monkeypatch) -> None:
+    monkeypatch.setattr(settings, "SMS_MOCK", False)
+    monkeypatch.setattr(settings, "ALIYUN_SMS_ACCESS_KEY_ID", "")  # 凭证缺
+
+    def _boom(phone):
+        raise AssertionError("未配置时不应调用阿里云")
+
+    monkeypatch.setattr(aliyun, "_call_send", _boom)
+    with pytest.raises(SmsError) as ei:
+        aliyun.send_code(PHONE)
+    assert ei.value.status_code == 503
+
+
+def test_send_transport_error_propagates_503(monkeypatch) -> None:
+    _configure(monkeypatch)
+
+    def _boom(phone):
+        raise SmsError("network down", status_code=503)
+
+    monkeypatch.setattr(aliyun, "_call_send", _boom)
+    with pytest.raises(SmsError) as ei:
+        aliyun.send_code(PHONE)
+    assert ei.value.status_code == 503
+
+
+def test_send_mock_returns_interval_no_network(monkeypatch) -> None:
+    _configure(monkeypatch, mock=True)
+
+    def _boom(phone):
+        raise AssertionError("mock 不应调用阿里云")
+
+    monkeypatch.setattr(aliyun, "_call_send", _boom)
+    assert aliyun.send_code(PHONE) == settings.ALIYUN_SMS_INTERVAL_SEC
+
+
+# ============================ 校验 ============================
+
+def test_verify_pass_true_and_clears_attempts(monkeypatch) -> None:
+    _configure(monkeypatch)
+    aliyun._verify_attempts[PHONE] = 2
+    monkeypatch.setattr(aliyun, "_call_check", _check("PASS"))
+
+    assert aliyun.verify_code(PHONE, "1234") is True
+    assert PHONE not in aliyun._verify_attempts  # 验过即清
+
+
+def test_verify_unknown_false_and_increments(monkeypatch) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(aliyun, "_call_check", _check("UNKNOWN"))
+
+    assert aliyun.verify_code(PHONE, "0000") is False
+    assert aliyun._verify_attempts[PHONE] == 1
+    assert aliyun.verify_code(PHONE, "0000") is False
+    assert aliyun._verify_attempts[PHONE] == 2
+
+
+def test_verify_attempts_cap_short_circuits(monkeypatch) -> None:
+    _configure(monkeypatch)
+    aliyun._verify_attempts[PHONE] = settings.SMS_MAX_VERIFY_ATTEMPTS
+
+    def _boom(phone, code):
+        raise AssertionError("达失败上限后不应再调阿里云")
+
+    monkeypatch.setattr(aliyun, "_call_check", _boom)
+    assert aliyun.verify_code(PHONE, "1234") is False  # 本地作废
+
+
+def test_verify_api_error_raises_503(monkeypatch) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(
+        aliyun, "_call_check",
+        lambda phone, code: {"success": False, "code": "SYSTEM_ERROR",
+                             "message": "err", "verify_result": None},
+    )
+    with pytest.raises(SmsError) as ei:
+        aliyun.verify_code(PHONE, "1234")
+    assert ei.value.status_code == 503
+
+
+def test_verify_transport_error_raises_503(monkeypatch) -> None:
+    _configure(monkeypatch)
+
+    def _boom(phone, code):
+        raise SmsError("network down", status_code=503)
+
+    monkeypatch.setattr(aliyun, "_call_check", _boom)
+    with pytest.raises(SmsError) as ei:
+        aliyun.verify_code(PHONE, "1234")
+    assert ei.value.status_code == 503
+
+
+def test_verify_mock_passes_any_ndigit(monkeypatch) -> None:
+    _configure(monkeypatch, mock=True)
+
+    def _boom(phone, code):
+        raise AssertionError("mock 不应调用阿里云")
+
+    monkeypatch.setattr(aliyun, "_call_check", _boom)
+    assert aliyun.verify_code(PHONE, "123456") is True   # 6 位数字放行
+    assert aliyun.verify_code(PHONE, "12345") is False   # 位数不对
+
+
+# ============================ 端点:阿里云降级 → 503(auth.py 包 try/except)============================
+
+def test_sms_login_aliyun_outage_returns_503(client, monkeypatch) -> None:
+    """SMS_PROVIDER=aliyun 且校验时阿里云异常 → /sms/login 返 503(而非 400/500),便于区分排查。"""
+    _configure(monkeypatch)  # 配齐凭证 + SMS_MOCK=False + 清计数
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "aliyun")
+
+    def _boom(phone, code):
+        raise SmsError("aliyun down", status_code=503)
+
+    monkeypatch.setattr(aliyun, "_call_check", _boom)
+    r = client.post("/api/v1/auth/sms/login", json={"phone": "13812345678", "code": "1234"})
+    assert r.status_code == 503, r.text

tests/test_sms_chuanglan.py

@@ -0,0 +1,286 @@
+"""创蓝云智(253)短信 provider(Mode B 自管码)单元测试。
+
+HTTP 交互隔离在 chuanglan._call_chuanglan(薄封装:签名 + httpx POST + 解析),映射逻辑在
+chuanglan._send_via_chuanglan。本文件 monkeypatch 这两个接缝(或更底层 httpx.post)→ 不发真网络。
+测的是:HMAC 签名算法、请求体不上行 password、错误码→HTTP 码、自管码存/校验(与极光同语义)、mock 短路。
+"""
+from __future__ import annotations
+
+import hashlib
+import hmac
+import json
+import time
+
+import httpx
+import pytest
+
+from app.core.config import settings
+from app.integrations.sms import chuanglan
+from app.integrations.sms.base import SmsError
+
+PHONE = "13800138000"
+
+
+class _FakeResp:
+    """极简 httpx.Response 替身:只暴露 status_code / json() / text。"""
+
+    def __init__(self, status_code: int = 200, payload: dict | None = None, text: str = "") -> None:
+        self.status_code = status_code
+        self._payload = payload if payload is not None else {}
+        self.text = text or json.dumps(self._payload)
+
+    def json(self) -> dict:
+        return self._payload
+
+
+def _configure(monkeypatch, *, mock: bool = False) -> None:
+    """配齐创蓝凭证 + 设 SMS_MOCK;清本地存码/冷却隔离用例。"""
+    monkeypatch.setattr(settings, "SMS_MOCK", mock)
+    monkeypatch.setattr(settings, "CHUANGLAN_SMS_ACCOUNT", "YZM0000001")
+    monkeypatch.setattr(settings, "CHUANGLAN_SMS_PASSWORD", "secret")
+    monkeypatch.setattr(settings, "CHUANGLAN_SMS_TEMPLATE_ID", "1021143438")
+    monkeypatch.setattr(settings, "CHUANGLAN_SMS_SIGNATURE", "【创蓝云智】")
+    chuanglan._codes.clear()
+    chuanglan._last_sent.clear()
+
+
+def _ok_payload(**over) -> dict:
+    p = {
+        "code": "000000",
+        "msgId": "25071018345400902898000000000001",
+        "time": "20250710183454",
+        "successNum": "1",
+        "failNum": "0",
+        "errorMsg": "",
+    }
+    p.update(over)
+    return p
+
+
+# ============================ 签名算法 ============================
+
+def test_sign_implements_documented_hmac() -> None:
+    """_sign = HmacSHA256(key=md5(password), msg=sorted([md5pwd,ts,nonce]) 拼接),小写 hex。"""
+    password, ts, nonce = "secret", "1752143733", "0123456789abcdef0123456789abcdef"
+    md5pwd = hashlib.md5(password.encode()).hexdigest()
+    expected = hmac.new(
+        md5pwd.encode(),
+        "".join(sorted([md5pwd, ts, nonce])).encode(),
+        hashlib.sha256,
+    ).hexdigest()
+
+    sig = chuanglan._sign(password, ts, nonce)
+    assert sig == expected
+    assert len(sig) == 64 and sig == sig.lower()
+
+
+def test_sign_changes_with_nonce() -> None:
+    assert chuanglan._sign("p", "1", "nonceA") != chuanglan._sign("p", "1", "nonceB")
+
+
+# ============================ _call_chuanglan(HTTP 接缝)============================
+
+def test_call_chuanglan_builds_signed_request_without_password(monkeypatch) -> None:
+    _configure(monkeypatch)
+    captured: dict = {}
+
+    def fake_post(url, **kw):
+        captured.update(url=url, body=kw.get("json"), headers=kw.get("headers"), timeout=kw.get("timeout"))
+        return _FakeResp(200, _ok_payload())
+
+    monkeypatch.setattr(httpx, "post", fake_post)
+
+    result = chuanglan._call_chuanglan(PHONE, "123456")
+
+    assert result["code"] == "000000"
+    assert captured["url"] == settings.CHUANGLAN_SMS_ENDPOINT
+    body = captured["body"]
+    assert body["account"] == "YZM0000001"
+    assert body["phoneNumbers"] == PHONE
+    assert body["templateId"] == "1021143438"
+    assert body["templateParamJson"] == json.dumps([{"param1": "123456"}])
+    assert body["signature"] == "【创蓝云智】"
+    assert "password" not in body            # HMAC 方式:密码只用于算签,不上行
+    assert len(body["nonce"]) == 32
+    assert captured["headers"]["X-QA-Hmac-Signature"] == chuanglan._sign(
+        "secret", body["timestamp"], body["nonce"]
+    )
+    assert captured["timeout"] == settings.CHUANGLAN_SMS_TIMEOUT_SEC
+
+
+def test_call_chuanglan_omits_signature_when_blank(monkeypatch) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(settings, "CHUANGLAN_SMS_SIGNATURE", "")
+    captured: dict = {}
+    monkeypatch.setattr(httpx, "post", lambda url, **kw: captured.update(body=kw.get("json")) or _FakeResp(200, _ok_payload()))
+
+    chuanglan._call_chuanglan(PHONE, "123456")
+    assert "signature" not in captured["body"]   # 模板自带签名时不传
+
+
+def test_call_chuanglan_http_non_200_raises_503(monkeypatch) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(httpx, "post", lambda url, **kw: _FakeResp(500, {}, "oops"))
+    with pytest.raises(SmsError) as ei:
+        chuanglan._call_chuanglan(PHONE, "123456")
+    assert ei.value.status_code == 503
+
+
+def test_call_chuanglan_network_error_raises_503(monkeypatch) -> None:
+    _configure(monkeypatch)
+
+    def boom(url, **kw):
+        raise httpx.ConnectError("down")
+
+    monkeypatch.setattr(httpx, "post", boom)
+    with pytest.raises(SmsError) as ei:
+        chuanglan._call_chuanglan(PHONE, "123456")
+    assert ei.value.status_code == 503
+
+
+# ============================ _send_via_chuanglan(错误码映射)============================
+
+@pytest.mark.parametrize(
+    "code,expected",
+    [
+        ("000000", None),   # 成功不抛
+        ("103", 429),       # 超频
+        ("107", 400),       # 手机号错误
+        ("109", 503),       # 无发送量/余额
+        ("117", 503),       # IP 未白名单
+        ("102", 503),       # 密码错误
+        ("116", 503),       # 签名不合法
+        ("124", 503),       # 模板内容不匹配
+        ("152", 503),       # 模板不存在
+        ("999999", 503),    # 未知码兜底
+    ],
+)
+def test_send_via_chuanglan_maps_codes(monkeypatch, code, expected) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(chuanglan, "_call_chuanglan", lambda phone, c: _ok_payload(code=code, errorMsg=code))
+    if expected is None:
+        assert chuanglan._send_via_chuanglan(PHONE, "123456") is None
+    else:
+        with pytest.raises(SmsError) as ei:
+            chuanglan._send_via_chuanglan(PHONE, "123456")
+        assert ei.value.status_code == expected
+
+
+def test_send_via_chuanglan_not_configured_raises_503_without_calling(monkeypatch) -> None:
+    monkeypatch.setattr(settings, "SMS_MOCK", False)
+    monkeypatch.setattr(settings, "CHUANGLAN_SMS_ACCOUNT", "")   # 凭证缺
+
+    def _boom(phone, c):
+        raise AssertionError("未配置时不应发起请求")
+
+    monkeypatch.setattr(chuanglan, "_call_chuanglan", _boom)
+    with pytest.raises(SmsError) as ei:
+        chuanglan._send_via_chuanglan(PHONE, "123456")
+    assert ei.value.status_code == 503
+
+
+# ============================ send_code(自管码,复制自极光)============================
+
+def test_send_code_success_stores_and_returns_cooldown(monkeypatch) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(chuanglan, "_send_via_chuanglan", lambda p, c: None)
+
+    assert chuanglan.send_code(PHONE) == settings.SMS_SEND_INTERVAL_SEC
+    assert PHONE in chuanglan._codes
+    assert len(chuanglan._codes[PHONE].code) == settings.SMS_CODE_LENGTH
+
+
+def test_send_code_cooldown_raises_429(monkeypatch) -> None:
+    _configure(monkeypatch)
+    monkeypatch.setattr(chuanglan, "_send_via_chuanglan", lambda p, c: None)
+    chuanglan.send_code(PHONE)
+    with pytest.raises(SmsError) as ei:
+        chuanglan.send_code(PHONE)
+    assert ei.value.status_code == 429
+
+
+def test_send_code_failure_keeps_cooldown_drops_code(monkeypatch) -> None:
+    _configure(monkeypatch)
+
+    def boom(p, c):
+        raise SmsError("no balance", status_code=503)
+
+    monkeypatch.setattr(chuanglan, "_send_via_chuanglan", boom)
+    with pytest.raises(SmsError) as ei:
+        chuanglan.send_code(PHONE)
+    assert ei.value.status_code == 503
+    assert PHONE not in chuanglan._codes      # 没发出去的码删掉
+    assert PHONE in chuanglan._last_sent       # 冷却保留:失败也限速
+
+
+def test_send_code_unexpected_error_wrapped_503(monkeypatch) -> None:
+    _configure(monkeypatch)
+
+    def boom(p, c):
+        raise RuntimeError("boom")
+
+    monkeypatch.setattr(chuanglan, "_send_via_chuanglan", boom)
+    with pytest.raises(SmsError) as ei:
+        chuanglan.send_code(PHONE)
+    assert ei.value.status_code == 503
+
+
+def test_send_code_mock_short_circuits_no_network(monkeypatch) -> None:
+    _configure(monkeypatch, mock=True)
+
+    def boom(p, c):
+        raise AssertionError("mock 不应发网络")
+
+    monkeypatch.setattr(chuanglan, "_send_via_chuanglan", boom)
+    assert chuanglan.send_code(PHONE) == settings.SMS_SEND_INTERVAL_SEC
+
+
+# ============================ verify_code(自管码,复制自极光)============================
+
+def test_verify_code_success_is_one_time(monkeypatch) -> None:
+    _configure(monkeypatch)
+    chuanglan._codes[PHONE] = chuanglan._CodeRecord(code="123456", expires_at=time.time() + 300)
+    assert chuanglan.verify_code(PHONE, "123456") is True
+    assert chuanglan.verify_code(PHONE, "123456") is False   # 验过即作废
+
+
+def test_verify_code_wrong_caps_then_invalidates(monkeypatch) -> None:
+    _configure(monkeypatch)
+    chuanglan._codes[PHONE] = chuanglan._CodeRecord(code="123456", expires_at=time.time() + 300)
+    for _ in range(settings.SMS_MAX_VERIFY_ATTEMPTS):
+        assert chuanglan.verify_code(PHONE, "000000") is False
+    # 达失败上限即作废:即便随后给对的码也 False
+    assert chuanglan.verify_code(PHONE, "123456") is False
+
+
+def test_verify_code_expired_false_and_cleared(monkeypatch) -> None:
+    _configure(monkeypatch)
+    chuanglan._codes[PHONE] = chuanglan._CodeRecord(code="123456", expires_at=time.time() - 1)
+    assert chuanglan.verify_code(PHONE, "123456") is False
+    assert PHONE not in chuanglan._codes
+
+
+def test_verify_code_no_record_false(monkeypatch) -> None:
+    _configure(monkeypatch)
+    assert chuanglan.verify_code(PHONE, "123456") is False
+
+
+def test_verify_code_mock_passes_any_ndigit(monkeypatch) -> None:
+    _configure(monkeypatch, mock=True)
+    assert chuanglan.verify_code(PHONE, "123456") is True    # 6 位数字放行
+    assert chuanglan.verify_code(PHONE, "12345") is False    # 位数不对
+
+
+# ============================ 端点:SMS_PROVIDER=chuanglan 端到端路由 ============================
+
+def test_sms_send_chuanglan_outage_returns_503(client, monkeypatch) -> None:
+    """SMS_PROVIDER=chuanglan 且发送时创蓝异常 → /sms/send 返 503(auth.py 现有 try/except 覆盖)。"""
+    _configure(monkeypatch)
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "chuanglan")
+
+    def boom(p, c):
+        raise SmsError("chuanglan down", status_code=503)
+
+    monkeypatch.setattr(chuanglan, "_send_via_chuanglan", boom)
+    r = client.post("/api/v1/auth/sms/send", json={"phone": "13812345678"})
+    assert r.status_code == 503, r.text

tests/test_sms_dispatch.py

@@ -0,0 +1,53 @@
+"""SMS 分派器:按 settings.SMS_PROVIDER 路由到正确 provider。
+
+契约:send_code / verify_code **每次调用**读 settings.SMS_PROVIDER 选 provider(支持运行时切换 /
+灰度回退);默认 jiguang。此处 monkeypatch 两 provider 的实现为标记函数,断言路由命中 + 可秒切。
+"""
+from __future__ import annotations
+
+from app.core.config import settings
+from app.integrations import sms
+from app.integrations.sms import aliyun, chuanglan, jiguang
+
+
+def test_send_code_routes_by_provider_and_switches_per_call(monkeypatch) -> None:
+    calls: list[str] = []
+    monkeypatch.setattr(jiguang, "send_code", lambda phone: (calls.append("jiguang"), 60)[1])
+    monkeypatch.setattr(aliyun, "send_code", lambda phone: (calls.append("aliyun"), 60)[1])
+    monkeypatch.setattr(chuanglan, "send_code", lambda phone: (calls.append("chuanglan"), 60)[1])
+
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "jiguang")
+    assert sms.send_code("13800138000") == 60
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "aliyun")
+    assert sms.send_code("13800138000") == 60
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "chuanglan")
+    assert sms.send_code("13800138000") == 60
+
+    assert calls == ["jiguang", "aliyun", "chuanglan"]  # 每次按当前 provider 路由,运行时可切
+
+
+def test_verify_code_routes_by_provider(monkeypatch) -> None:
+    calls: list[str] = []
+    monkeypatch.setattr(jiguang, "verify_code", lambda phone, code: (calls.append("jiguang"), True)[1])
+    monkeypatch.setattr(aliyun, "verify_code", lambda phone, code: (calls.append("aliyun"), True)[1])
+    monkeypatch.setattr(chuanglan, "verify_code", lambda phone, code: (calls.append("chuanglan"), True)[1])
+
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "jiguang")
+    assert sms.verify_code("13800138000", "123456") is True
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "aliyun")
+    assert sms.verify_code("13800138000", "123456") is True
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "chuanglan")
+    assert sms.verify_code("13800138000", "123456") is True
+
+    assert calls == ["jiguang", "aliyun", "chuanglan"]
+
+
+def test_unknown_provider_falls_back_to_jiguang(monkeypatch) -> None:
+    """SMS_PROVIDER 非 aliyun 一律走 jiguang(默认兜底,防误配把登录打挂)。"""
+    calls: list[str] = []
+    monkeypatch.setattr(jiguang, "send_code", lambda phone: (calls.append("jiguang"), 60)[1])
+    monkeypatch.setattr(aliyun, "send_code", lambda phone: (calls.append("aliyun"), 60)[1])
+    monkeypatch.setattr(settings, "SMS_PROVIDER", "jiguang")
+
+    sms.send_code("13800138000")
+    assert calls == ["jiguang"]