feat(admin/ad): 提现自动对账后台开关 + 客户端广告 flags 端点 + 穿山甲多 m-key 验签 (#59)

- 自动对账接入 app_config 运行时配置(新增 bool 配置类型):env 部署总闸 + DB 运营日常开关
  双层;worker 每轮读 DB 即时生效,健康检查改报「env AND DB」实际生效态
- 新增 GET /api/v1/platform/flags(不鉴权)下发 comparing_ad_enabled 远程 kill-switch,
  客户端拉取后缓存;空库回退默认 True
- 穿山甲发奖回调支持多激励位 m-key(三命名项 PANGLE_REWARD_SECRET_TEST/_DEDICATED/_PROD
  + 旧逗号分隔合并去重),verify_callback_sign_any 逐个验签任一通过即受理;向后兼容旧单 key
- 补 test_platform / bool config 用例;app_config 文档同步

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: OuYingJun1024 <1034284404@qq.com>
Reviewed-on: #59
Co-authored-by: ouzhou <ouzhou@wonderable.ai>
Co-committed-by: ouzhou <ouzhou@wonderable.ai>

.env.example

@@ -79,12 +79,26 @@ WXPAY_MCH_PRIVATE_KEY_PATH=./secrets/apiclient_key.pem
 WXPAY_PUBLIC_KEY_ID=PUB_KEY_ID_xxxxxxxx
 WXPAY_PUBLIC_KEY_PATH=./secrets/pub_key.pem
 WXPAY_TRANSFER_SCENE_ID=1000
+WXPAY_AUTH_NOTIFY_URL=
+WITHDRAW_AUTO_RECONCILE_ENABLED=false
+WITHDRAW_AUTO_RECONCILE_INTERVAL_SEC=300
+WITHDRAW_AUTO_RECONCILE_OLDER_THAN_MINUTES=15
+# 0 点自动兑金币开关(deploy/daily-exchange.timer 触发的脚本读它;false=脚本 no-op)。默认 true。
+AUTO_EXCHANGE_ENABLED=true
 
 # ===== 穿山甲激励视频(服务端发奖回调)=====
 # 看完激励视频后穿山甲服务器 S2S 回调本服务发金币(客户端不参与发奖)。
-# PANGLE_REWARD_SECRET 是穿山甲后台配置的"奖励校验密钥",用于验签,从后台取到后填这里;
-# 配齐并把 ENABLED=true 后,/api/v1/ad/pangle-callback 才受理回调(否则 503)。
+# 穿山甲"奖励校验密钥"(m-key),验签用,从 GroMore 后台各广告位取到后填这里。
+# 配齐(任一非空)并把 ENABLED=true 后,/api/v1/ad/pangle-callback 才受理回调(否则 503)。
+# 每个激励位 m-key 不同但共用同一回调 URL → 各位分开一行配(留空的忽略);验签逐个试、任一通过即接受。
 PANGLE_CALLBACK_ENABLED=false
+# 测试应用 激励位 104099649
+PANGLE_REWARD_SECRET_TEST=
+# 测试应用 专属激励位 104127529
+PANGLE_REWARD_SECRET_TEST_DEDICATED=
+# 正式应用 激励位 104099389
+PANGLE_REWARD_SECRET_PROD=
+# (旧用法,仍兼容:单个或逗号分隔的多个 m-key,会与上面三个合并去重)
 PANGLE_REWARD_SECRET=
 # ⚠️ 仅本地联调:true 时开放 POST /api/v1/ad/test-grant,让 debug 客户端看完广告直接发奖,
 # 验证"看广告→金币到账"全链路(未部署公网、穿山甲 S2S 打不到本地时用)。生产必须 false(绕过反作弊)。

.gitignore

@@ -43,3 +43,4 @@ secrets/*
 
 # 运行日志(run.sh 输出, 不入库)
 *.log
+logs/

alembic/versions/45047b5a884c_merge_store_mapping_jd_dl_invalid_and_.py

@@ -0,0 +1,26 @@
+"""merge store_mapping_jd_dl_invalid and ad_revenue heads (0.1.2)
+
+Revision ID: 45047b5a884c
+Revises: d4e68464761d, store_mapping_jd_dl_invalid
+Create Date: 2026-06-16 01:38:26.273226
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '45047b5a884c'
+down_revision: Union[str, Sequence[str], None] = ('d4e68464761d', 'store_mapping_jd_dl_invalid')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/9b894f5fff05_merge_user_force_onboarding_and_.py

@@ -0,0 +1,26 @@
+"""merge user_force_onboarding and comparison_idx_coupon_daily heads
+
+Revision ID: 9b894f5fff05
+Revises: d4b87c5847de, user_force_onboarding
+Create Date: 2026-06-10 22:49:02.248506
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '9b894f5fff05'
+down_revision: Union[str, Sequence[str], None] = ('d4b87c5847de', 'user_force_onboarding')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/a8c47fc4dc39_merge_invite_fingerprint_and_ad_reward_.py

@@ -0,0 +1,26 @@
+"""merge invite_fingerprint and ad_reward heads
+
+Revision ID: a8c47fc4dc39
+Revises: invite_fingerprint_table, 044dce6e9b1f
+Create Date: 2026-06-10 01:03:03.699443
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'a8c47fc4dc39'
+down_revision: Union[str, Sequence[str], None] = ('invite_fingerprint_table', '044dce6e9b1f')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/ad_feed_reward_session_id.py

@@ -0,0 +1,38 @@
+"""add ad_session_id to ad feed reward record
+
+Revision ID: ad_feed_reward_session
+Revises: coin_reward_phase2
+Create Date: 2026-06-09
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "ad_feed_reward_session"
+down_revision = "coin_reward_phase2"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "ad_feed_reward_record",
+        sa.Column("ad_session_id", sa.String(length=64), nullable=True),
+    )
+    op.create_index(
+        op.f("ix_ad_feed_reward_record_ad_session_id"),
+        "ad_feed_reward_record",
+        ["ad_session_id"],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(
+        op.f("ix_ad_feed_reward_record_ad_session_id"),
+        table_name="ad_feed_reward_record",
+    )
+    op.drop_column("ad_feed_reward_record", "ad_session_id")

alembic/versions/ad_revenue_report_cols.py

@@ -0,0 +1,39 @@
+"""ad revenue report columns: app_env + our_code_id
+
+给 ad_ecpm_record / ad_reward_record / ad_feed_reward_record 各加两列:
+- app_env:我们的穿山甲应用环境(prod=傻瓜比价正式 / test=测试应用)
+- our_code_id:我们在穿山甲后台配置的代码位 ID(104xxx,非底层 mediation rit)
+
+供「广告收益报表」按 用户/日期/广告类型/应用/代码位 聚合 展示条数/收益/金币。
+旧数据这两列为 NULL(报表里来源列留空),新数据由客户端上报/发奖时回填。
+
+Revision ID: ad_revenue_report_cols
+Revises: coupon_engage_per_package
+Create Date: 2026-06-15
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "ad_revenue_report_cols"
+down_revision = "coupon_engage_per_package"
+branch_labels = None
+depends_on = None
+
+
+_TABLES = ("ad_ecpm_record", "ad_reward_record", "ad_feed_reward_record")
+
+
+def upgrade() -> None:
+    for table in _TABLES:
+        op.add_column(table, sa.Column("app_env", sa.String(length=16), nullable=True))
+        op.add_column(table, sa.Column("our_code_id", sa.String(length=64), nullable=True))
+
+
+def downgrade() -> None:
+    for table in _TABLES:
+        op.drop_column(table, "our_code_id")
+        op.drop_column(table, "app_env")

alembic/versions/b3f1a2c4d5e6_user_username_and_default_nickname.py

@@ -0,0 +1,79 @@
+"""user.username(对外展示账号 ID)+ 默认昵称,并回填存量用户
+
+Revision ID: b3f1a2c4d5e6
+Revises: 45047b5a884c
+Create Date: 2026-06-16 12:00:00.000000
+
+加 user.username(11 位纯数字、首位非 1 与手机号天然区分、全局唯一)。存量用户:
+生成唯一 username,昵称为空的补 9 位字母数字随机昵称。
+迁移自包含(不 import app 业务代码,逻辑冻结为当时快照)。
+"""
+import secrets
+import string
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'b3f1a2c4d5e6'
+down_revision: Union[str, Sequence[str], None] = '45047b5a884c'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+_USERNAME_FIRST = "23456789"      # 首位避前导 0、避 1(手机号都以 1 开头)
+_USERNAME_DIGITS = "0123456789"
+_NICKNAME_ALPHABET = string.ascii_letters + string.digits
+
+
+def _gen_username() -> str:
+    return secrets.choice(_USERNAME_FIRST) + "".join(
+        secrets.choice(_USERNAME_DIGITS) for _ in range(10)
+    )
+
+
+def _gen_nickname() -> str:
+    return "".join(secrets.choice(_NICKNAME_ALPHABET) for _ in range(9))
+
+
+def upgrade() -> None:
+    # 1. 先加可空列(存量行此刻还没值)
+    with op.batch_alter_table('user', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('username', sa.String(length=11), nullable=True))
+
+    # 2. 回填存量:每人一个唯一 username;昵称为空的补随机昵称。
+    #    表里 username 原本全空,本批用 used 防互撞即可(无既有非空值需规避)。
+    #    "user" 是 PostgreSQL 保留字,必须加双引号(SQLite 也接受双引号标识符)。
+    bind = op.get_bind()
+    rows = bind.execute(sa.text('SELECT id, nickname FROM "user"')).fetchall()
+    used = set()
+    for row in rows:
+        uid, nick = row[0], row[1]
+        while True:
+            uname = _gen_username()
+            if uname not in used:
+                used.add(uname)
+                break
+        if nick is None or not str(nick).strip():
+            bind.execute(
+                sa.text('UPDATE "user" SET username = :u, nickname = :n WHERE id = :i'),
+                {"u": uname, "n": _gen_nickname(), "i": uid},
+            )
+        else:
+            bind.execute(
+                sa.text('UPDATE "user" SET username = :u WHERE id = :i'),
+                {"u": uname, "i": uid},
+            )
+
+    # 3. 收紧:NOT NULL + 唯一索引(对齐模型 unique=True, index=True)
+    with op.batch_alter_table('user', schema=None) as batch_op:
+        batch_op.alter_column('username', existing_type=sa.String(length=11), nullable=False)
+        batch_op.create_index('ix_user_username', ['username'], unique=True)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('user', schema=None) as batch_op:
+        batch_op.drop_index('ix_user_username')
+        batch_op.drop_column('username')

alembic/versions/coin_reward_points_phase2.py

@@ -0,0 +1,71 @@
+"""coin reward points phase2
+
+Revision ID: coin_reward_phase2
+Revises: 0cf18d590b1d
+Create Date: 2026-06-08
+"""
+
+from __future__ import annotations
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision = "coin_reward_phase2"
+down_revision = "0cf18d590b1d"
+branch_labels = None
+depends_on = None
+
+
+def upgrade() -> None:
+    op.add_column(
+        "ad_ecpm_record",
+        sa.Column("ad_session_id", sa.String(length=64), nullable=True),
+    )
+    op.create_index(
+        op.f("ix_ad_ecpm_record_ad_session_id"),
+        "ad_ecpm_record",
+        ["ad_session_id"],
+        unique=False,
+    )
+    op.create_index(
+        "uq_ad_ecpm_record_session",
+        "ad_ecpm_record",
+        ["ad_session_id"],
+        unique=True,
+    )
+
+    op.add_column(
+        "ad_reward_record",
+        sa.Column(
+            "reward_scene",
+            sa.String(length=32),
+            nullable=False,
+            server_default="reward_video",
+        ),
+    )
+    op.add_column(
+        "ad_reward_record",
+        sa.Column("ad_session_id", sa.String(length=64), nullable=True),
+    )
+    op.add_column(
+        "ad_reward_record",
+        sa.Column("ecpm_raw", sa.String(length=32), nullable=True),
+    )
+    op.create_index(
+        op.f("ix_ad_reward_record_ad_session_id"),
+        "ad_reward_record",
+        ["ad_session_id"],
+        unique=False,
+    )
+
+
+def downgrade() -> None:
+    op.drop_index(op.f("ix_ad_reward_record_ad_session_id"), table_name="ad_reward_record")
+    op.drop_column("ad_reward_record", "ecpm_raw")
+    op.drop_column("ad_reward_record", "ad_session_id")
+    op.drop_column("ad_reward_record", "reward_scene")
+
+    op.drop_index("uq_ad_ecpm_record_session", table_name="ad_ecpm_record")
+    op.drop_index(op.f("ix_ad_ecpm_record_ad_session_id"), table_name="ad_ecpm_record")
+    op.drop_column("ad_ecpm_record", "ad_session_id")

alembic/versions/coin_transaction_task_ref_unique.py

@@ -0,0 +1,40 @@
+"""add coin_transaction task ref unique index
+
+可重复任务(task_enable_notification「打开消息提醒」逐次减半领取)的发放路径是无锁的
+读-算-写:并发/连点的两个 claim 会都读到同一已领次数、算出同一 ref_id(task_key:N)、
+各发一笔,导致双倍发钱。给 coin_transaction 加 (user_id, biz_type, ref_id) 部分唯一索引
+(仅 biz_type LIKE 'task%' 且 ref_id 非空),第二笔撞唯一约束 → IntegrityError,被
+task.claim_task 兜底成 AlreadyClaimedError(409)。与 cash_transaction 提现退款、
+withdraw_order 在途单的「唯一约束 + IntegrityError 兜底」同模式。
+
+Revision ID: coin_txn_task_ref_uq
+Revises: drop_force_onboarding
+Create Date: 2026-06-12 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "coin_txn_task_ref_uq"
+down_revision: Union[str, Sequence[str], None] = "drop_force_onboarding"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_index(
+        "ux_coin_transaction_task_ref",
+        "coin_transaction",
+        ["user_id", "biz_type", "ref_id"],
+        unique=True,
+        sqlite_where=sa.text("biz_type LIKE 'task%' AND ref_id IS NOT NULL"),
+        postgresql_where=sa.text("biz_type LIKE 'task%' AND ref_id IS NOT NULL"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ux_coin_transaction_task_ref", table_name="coin_transaction")

alembic/versions/comparison_status_created_idx.py

@@ -0,0 +1,48 @@
+"""add composite index (status, created_at) on comparison_record
+
+首页轮播 feed(按 status='success' 过滤 + created_at 近期排序)与省钱战绩聚合
+都吃这个过滤+排序;复合索引避免随数据量增大退化成全表扫。
+
+Revision ID: comparison_status_created_idx
+Revises: a8c47fc4dc39
+Create Date: 2026-06-10
+"""
+
+from __future__ import annotations
+
+from alembic import op
+
+revision = "comparison_status_created_idx"
+down_revision = "a8c47fc4dc39"
+branch_labels = None
+depends_on = None
+
+INDEX_NAME = "ix_comparison_status_created"
+
+
+def upgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        # PG 上 comparison_record 已有数据量, 普通 CREATE INDEX 持表写锁会阻塞线上写入;
+        # 用 CONCURRENTLY 不锁表(须脱离事务, autocommit_block 切到自动提交)。
+        with op.get_context().autocommit_block():
+            op.create_index(
+                INDEX_NAME, "comparison_record", ["status", "created_at"],
+                unique=False, postgresql_concurrently=True,
+            )
+    else:
+        op.create_index(
+            INDEX_NAME, "comparison_record", ["status", "created_at"], unique=False
+        )
+
+
+def downgrade() -> None:
+    bind = op.get_bind()
+    if bind.dialect.name == "postgresql":
+        with op.get_context().autocommit_block():
+            op.drop_index(
+                INDEX_NAME, table_name="comparison_record",
+                postgresql_concurrently=True,
+            )
+    else:
+        op.drop_index(INDEX_NAME, table_name="comparison_record")

alembic/versions/coupon_daily_completion_table.py

@@ -0,0 +1,58 @@
+"""coupon daily completion table(今日跑完整轮领券 → 首页置灰源)
+
+Revision ID: coupon_daily_completion
+Revises: f8d3b1e60a27
+Create Date: 2026-06-10 00:00:00.000000
+
+"""
+
+from collections.abc import Sequence
+
+import sqlalchemy as sa
+
+from alembic import op
+
+# revision identifiers, used by Alembic.
+revision: str = "coupon_daily_completion"
+down_revision: str | Sequence[str] | None = "f8d3b1e60a27"
+branch_labels: str | Sequence[str] | None = None
+depends_on: str | Sequence[str] | None = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        "coupon_daily_completion",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("device_id", sa.String(length=64), nullable=False),
+        sa.Column("user_id", sa.Integer(), nullable=True),
+        sa.Column("complete_date", sa.Date(), nullable=False),
+        sa.Column("trace_id", sa.String(length=64), nullable=True),
+        sa.Column(
+            "created_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("(CURRENT_TIMESTAMP)"),
+            nullable=False,
+        ),
+        sa.Column(
+            "updated_at",
+            sa.DateTime(timezone=True),
+            server_default=sa.text("(CURRENT_TIMESTAMP)"),
+            nullable=False,
+        ),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("device_id", "complete_date", name="uq_coupon_completion_device_date"),
+    )
+    with op.batch_alter_table("coupon_daily_completion", schema=None) as batch_op:
+        batch_op.create_index(
+            batch_op.f("ix_coupon_daily_completion_user_id"), ["user_id"], unique=False
+        )
+        batch_op.create_index(
+            batch_op.f("ix_coupon_daily_completion_trace_id"), ["trace_id"], unique=False
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table("coupon_daily_completion", schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f("ix_coupon_daily_completion_trace_id"))
+        batch_op.drop_index(batch_op.f("ix_coupon_daily_completion_user_id"))
+    op.drop_table("coupon_daily_completion")

alembic/versions/coupon_engage_per_package.py

@@ -0,0 +1,53 @@
+"""coupon_prompt_engagement 频控加 package 维度(美团/淘宝/京东各自独立弹)
+
+Revision ID: coupon_engage_per_package
+Revises: store_mapping_jd_cols
+Create Date: 2026-06-14 11:00:00.000000
+
+需求:领券引导窗按 (device, App, 自然日) 频控——在美团弹过/领过,不影响淘宝、京东今天
+仍各弹一次。原表唯一键是 (device_id, engage_date),缺 package → 任一 App 弹过就把整台
+设备当天标记 engage,其余 App 被压住不弹(bug)。
+
+本迁移:
+  1. 加 package 列(NOT NULL,旧行用 server_default "" 填占位,不影响新逻辑判断)。
+  2. 旧唯一约束 (device_id, engage_date) → 新 (device_id, package, engage_date)。
+
+SQLite 不支持直接 drop/add 约束,用 batch_alter_table(建临时表 + 拷数据 + 换名,
+与 store_mapping_* 同款)。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'coupon_engage_per_package'
+down_revision: Union[str, Sequence[str], None] = 'store_mapping_jd_cols'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('coupon_prompt_engagement', schema=None) as batch_op:
+        # 加 package 列。旧行(改造前的全局记录)填 "" 占位:它们对应的是"老的全局态",
+        # 新逻辑按 (device, package, 日) 判,占位 "" 不会与真实包名(com.xxx)碰撞。
+        batch_op.add_column(
+            sa.Column('package', sa.String(length=64), nullable=False, server_default='')
+        )
+        # 旧唯一约束 (device_id, engage_date) → 新三元组 (device_id, package, engage_date)。
+        batch_op.drop_constraint('uq_coupon_engage_device_date', type_='unique')
+        batch_op.create_unique_constraint(
+            'uq_coupon_engage_device_pkg_date',
+            ['device_id', 'package', 'engage_date'],
+        )
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('coupon_prompt_engagement', schema=None) as batch_op:
+        batch_op.drop_constraint('uq_coupon_engage_device_pkg_date', type_='unique')
+        batch_op.create_unique_constraint(
+            'uq_coupon_engage_device_date',
+            ['device_id', 'engage_date'],
+        )
+        batch_op.drop_column('package')

alembic/versions/cps_link_tables.py

@@ -0,0 +1,61 @@
+"""cps_link / cps_click tables (群发短链 + 点击统计)
+
+Revision ID: cps_link_tables
+Revises: cps_tables
+Create Date: 2026-06-16 13:20:00.000000
+
+群发券链接套一层 /c/{code} 做点击统计:cps_link(短码→美团目标) + cps_click(点击事件)。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+revision: str = "cps_link_tables"
+down_revision: Union[str, Sequence[str], None] = "cps_tables"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+_NOW = sa.text("CURRENT_TIMESTAMP")
+
+
+def upgrade() -> None:
+    op.create_table(
+        "cps_link",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("code", sa.String(length=16), nullable=False),
+        sa.Column("group_id", sa.Integer(), nullable=False),
+        sa.Column("activity_id", sa.Integer(), nullable=False),
+        sa.Column("sid", sa.String(length=64), nullable=False),
+        sa.Column("platform", sa.String(length=20), nullable=False, server_default="meituan"),
+        sa.Column("target_url", sa.String(length=1024), nullable=False),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=_NOW, nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("code", name="uq_cps_link_code"),
+    )
+    op.create_index("ix_cps_link_code", "cps_link", ["code"])
+    op.create_index("ix_cps_link_group_id", "cps_link", ["group_id"])
+    op.create_index("ix_cps_link_activity_id", "cps_link", ["activity_id"])
+    op.create_index("ix_cps_link_sid", "cps_link", ["sid"])
+
+    op.create_table(
+        "cps_click",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("link_id", sa.Integer(), nullable=False),
+        sa.Column("group_id", sa.Integer(), nullable=False),
+        sa.Column("sid", sa.String(length=64), nullable=False),
+        sa.Column("ip", sa.String(length=64), nullable=True),
+        sa.Column("ua", sa.String(length=512), nullable=True),
+        sa.Column("clicked_at", sa.DateTime(timezone=True), server_default=_NOW, nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+    op.create_index("ix_cps_click_link_id", "cps_click", ["link_id"])
+    op.create_index("ix_cps_click_group_id", "cps_click", ["group_id"])
+    op.create_index("ix_cps_click_sid", "cps_click", ["sid"])
+    op.create_index("ix_cps_click_clicked_at", "cps_click", ["clicked_at"])
+
+
+def downgrade() -> None:
+    op.drop_table("cps_click")
+    op.drop_table("cps_link")

alembic/versions/cps_tables.py

@@ -0,0 +1,92 @@
+"""cps_group / cps_activity / cps_order tables (CPS 分发与对账)
+
+Revision ID: cps_tables
+Revises: b3f1a2c4d5e6
+Create Date: 2026-06-16 12:40:00.000000
+
+群发 CPS 优惠券的分发与对账:cps_group(群=sid) + cps_activity(可推广活动池) +
+cps_order(美团 query_order 按 sid 拉回的订单明细)。金额统一存「分」。
+order_id 全局唯一(reconcile 按它 upsert,订单状态会变则更新)。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+from sqlalchemy.dialects import postgresql
+
+
+revision: str = "cps_tables"
+down_revision: Union[str, Sequence[str], None] = "b3f1a2c4d5e6"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+_NOW = sa.text("CURRENT_TIMESTAMP")
+
+
+def upgrade() -> None:
+    op.create_table(
+        "cps_group",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("sid", sa.String(length=64), nullable=False),
+        sa.Column("name", sa.String(length=128), nullable=False),
+        sa.Column("member_count", sa.Integer(), nullable=True),
+        sa.Column("status", sa.String(length=20), nullable=False, server_default="active"),
+        sa.Column("remark", sa.String(length=256), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=_NOW, nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("sid", name="uq_cps_group_sid"),
+    )
+    op.create_index("ix_cps_group_sid", "cps_group", ["sid"])
+
+    op.create_table(
+        "cps_activity",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("platform", sa.String(length=20), nullable=False, server_default="meituan"),
+        sa.Column("name", sa.String(length=128), nullable=False),
+        sa.Column("act_id", sa.String(length=64), nullable=True),
+        sa.Column("product_view_sign", sa.String(length=128), nullable=True),
+        sa.Column("status", sa.String(length=20), nullable=False, server_default="active"),
+        sa.Column("remark", sa.String(length=256), nullable=True),
+        sa.Column("created_at", sa.DateTime(timezone=True), server_default=_NOW, nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+    )
+
+    op.create_table(
+        "cps_order",
+        sa.Column("id", sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column("order_id", sa.String(length=64), nullable=False),
+        sa.Column("sid", sa.String(length=64), nullable=True),
+        sa.Column("act_id", sa.String(length=64), nullable=True),
+        sa.Column("biz_line", sa.Integer(), nullable=True),
+        sa.Column("trade_type", sa.Integer(), nullable=True),
+        sa.Column("pay_price_cents", sa.Integer(), nullable=True),
+        sa.Column("commission_cents", sa.Integer(), nullable=True),
+        sa.Column("commission_rate", sa.String(length=16), nullable=True),
+        sa.Column("refund_price_cents", sa.Integer(), nullable=True),
+        sa.Column("refund_profit_cents", sa.Integer(), nullable=True),
+        sa.Column("mt_status", sa.String(length=8), nullable=True),
+        sa.Column("invalid_reason", sa.String(length=128), nullable=True),
+        sa.Column("product_name", sa.String(length=512), nullable=True),
+        sa.Column("pay_time", sa.DateTime(timezone=True), nullable=True),
+        sa.Column("mt_update_time", sa.DateTime(timezone=True), nullable=True),
+        sa.Column(
+            "raw",
+            sa.JSON().with_variant(postgresql.JSONB(), "postgresql"),
+            nullable=False,
+        ),
+        sa.Column("first_seen", sa.DateTime(timezone=True), server_default=_NOW, nullable=False),
+        sa.Column("updated_at", sa.DateTime(timezone=True), server_default=_NOW, nullable=False),
+        sa.PrimaryKeyConstraint("id"),
+        sa.UniqueConstraint("order_id", name="uq_cps_order_order_id"),
+    )
+    op.create_index("ix_cps_order_order_id", "cps_order", ["order_id"])
+    op.create_index("ix_cps_order_sid", "cps_order", ["sid"])
+    op.create_index("ix_cps_order_act_id", "cps_order", ["act_id"])
+    op.create_index("ix_cps_order_mt_status", "cps_order", ["mt_status"])
+    op.create_index("ix_cps_order_pay_time", "cps_order", ["pay_time"])
+
+
+def downgrade() -> None:
+    op.drop_table("cps_order")
+    op.drop_table("cps_activity")
+    op.drop_table("cps_group")

alembic/versions/d4b87c5847de_merge_comparison_idx_and_coupon_daily_.py

@@ -0,0 +1,26 @@
+"""merge comparison idx and coupon daily completion heads
+
+Revision ID: d4b87c5847de
+Revises: comparison_status_created_idx, onboarding_completion
+Create Date: 2026-06-10 16:45:50.285917
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'd4b87c5847de'
+down_revision: Union[str, Sequence[str], None] = ('comparison_status_created_idx', 'onboarding_completion')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/d4e68464761d_merge_ad_revenue_report_cols_and_store_.py

@@ -0,0 +1,26 @@
+"""merge ad_revenue_report_cols and store_mapping_tb_dl_invalid heads
+
+Revision ID: d4e68464761d
+Revises: ad_revenue_report_cols, store_mapping_tb_dl_invalid
+Create Date: 2026-06-15 21:55:58.115692
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'd4e68464761d'
+down_revision: Union[str, Sequence[str], None] = ('ad_revenue_report_cols', 'store_mapping_tb_dl_invalid')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/drop_user_force_onboarding.py

@@ -0,0 +1,40 @@
+"""drop user.force_onboarding column
+
+force_onboarding(运营「按用户」强制新手引导)机制废弃:客户端实际按 onboarding_completion
+(设备+账号 维度)判断是否走引导,该 force_onboarding 列从未被客户端正确响应(被
+onboarding_completed 压过)。改用 admin「设备维度」重置(删 onboarding_completion 记录)替代,
+见 app/admin/routers/onboarding.py。本迁移删列。
+
+Revision ID: drop_force_onboarding
+Revises: 9b894f5fff05
+Create Date: 2026-06-12 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "drop_force_onboarding"
+down_revision: Union[str, Sequence[str], None] = "9b894f5fff05"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.drop_column("user", "force_onboarding")
+
+
+def downgrade() -> None:
+    # 回滚:重建列(同 user_force_onboarding 迁移的 upgrade)。sa.false() 两端兼容。
+    op.add_column(
+        "user",
+        sa.Column(
+            "force_onboarding",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )

alembic/versions/f8d3b1e60a27_add_debug_trace_and_merge_heads.py

@@ -0,0 +1,49 @@
+"""add user.debug_trace_enabled + comparison_record.trace_url
+
+调试链接权限功能：
+  - user.debug_trace_enabled：运营后台给指定用户开「复制调试链接」权限
+  - comparison_record.trace_url：比价记录页「复制调试链接」的数据（pricebot done 帧给，
+    dir 名含落盘时分秒、前端/server 拼不出，必须落库）
+
+注：本迁移最初基于旧 main（#31，双 head）写、down_revision 曾指向那对父；但 #33 已用
+a8c47fc4dc39 合并了那对双 head，故改为线性接在 a8c47fc4dc39 之后、只负责加两列
+（避免与 a8c47fc4dc39 平行再造一个双 head）。
+
+Revision ID: f8d3b1e60a27
+Revises: a8c47fc4dc39
+Create Date: 2026-06-10 02:40:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "f8d3b1e60a27"
+down_revision: Union[str, Sequence[str], None] = "a8c47fc4dc39"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # sa.false() 渲染成 PG 的 false / SQLite 的 0，两端兼容（避免字符串 "false" 在 SQLite 上存歪）
+    op.add_column(
+        "user",
+        sa.Column(
+            "debug_trace_enabled",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )
+    op.add_column(
+        "comparison_record",
+        sa.Column("trace_url", sa.String(length=512), nullable=True),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("comparison_record", "trace_url")
+    op.drop_column("user", "debug_trace_enabled")

alembic/versions/invite_fingerprint_table.py

@@ -0,0 +1,50 @@
+"""invite_fingerprint table (任务 3 指纹归因兜底)
+
+Revision ID: invite_fingerprint_table
+Revises: 0cf18d590b1d
+Create Date: 2026-06-08 14:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'invite_fingerprint_table'
+down_revision: Union[str, Sequence[str], None] = '0cf18d590b1d'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # 邀请指纹归因表:落地页访问时记一行,登录后剪贴板没拿到邀请码时反查
+    op.create_table(
+        'invite_fingerprint',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('inviter_user_id', sa.Integer(), nullable=False),
+        sa.Column('ip', sa.String(length=64), nullable=False),
+        sa.Column('device_model', sa.String(length=64), nullable=False, server_default=''),
+        sa.Column('screen', sa.String(length=32), nullable=False, server_default=''),
+        sa.Column('user_agent', sa.Text(), nullable=False, server_default=''),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.func.now(), nullable=False),
+        sa.ForeignKeyConstraint(['inviter_user_id'], ['user.id']),
+        sa.PrimaryKeyConstraint('id'),
+    )
+    # 反查主索引:(ip, screen, device_model, created_at)
+    # /bind 兜底分支 WHERE ip=? AND screen=? AND device_model=? AND created_at > now - 7d
+    # ORDER BY created_at DESC LIMIT 1 — SQLite/PG 优化器都能反向扫该索引
+    op.create_index(
+        'ix_invite_fp_match',
+        'invite_fingerprint',
+        ['ip', 'screen', 'device_model', 'created_at'],
+    )
+    # 兜底/统计索引:按 inviter 看"这个邀请人的落地页被谁访问过"
+    op.create_index('ix_invite_fp_inviter', 'invite_fingerprint', ['inviter_user_id'])
+
+
+def downgrade() -> None:
+    op.drop_index('ix_invite_fp_inviter', table_name='invite_fingerprint')
+    op.drop_index('ix_invite_fp_match', table_name='invite_fingerprint')
+    op.drop_table('invite_fingerprint')

alembic/versions/merge_ad_feed_reward_session_and_withdraw_safety_heads.py

@@ -0,0 +1,26 @@
+"""merge ad feed reward session and withdraw safety heads
+
+Revision ID: 044dce6e9b1f
+Revises: ad_feed_reward_session, withdraw_safety_indexes
+Create Date: 2026-06-09 09:52:08.276767
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = '044dce6e9b1f'
+down_revision: Union[str, Sequence[str], None] = ('ad_feed_reward_session', 'withdraw_safety_indexes')
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    pass
+
+
+def downgrade() -> None:
+    pass

alembic/versions/onboarding_completion_table.py

@@ -0,0 +1,39 @@
+"""onboarding_completion table (新手引导完成标记,按 user+device 去重)
+
+Revision ID: onboarding_completion
+Revises: coupon_daily_completion
+Create Date: 2026-06-10 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'onboarding_completion'
+down_revision: Union[str, Sequence[str], None] = 'coupon_daily_completion'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # (账号, 设备) 一条完成标记;device_id = 客户端硬件级 ANDROID_ID(跨卸载重装稳定)。
+    op.create_table(
+        'onboarding_completion',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        sa.Column('user_id', sa.Integer(), nullable=False),
+        sa.Column('device_id', sa.String(length=64), nullable=False),
+        sa.Column('completed_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        sa.UniqueConstraint('user_id', 'device_id', name='uq_onboarding_user_device'),
+    )
+    with op.batch_alter_table('onboarding_completion', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_onboarding_completion_user_id'), ['user_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('onboarding_completion', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_onboarding_completion_user_id'))
+    op.drop_table('onboarding_completion')

alembic/versions/store_mapping_jd_cols.py

@@ -0,0 +1,40 @@
+"""store_mapping 加京东原料列(jd_vender_id + 分享链/反查 URL/deeplink)
+
+Revision ID: store_mapping_jd_cols
+Revises: store_mapping_meituan_cols
+Create Date: 2026-06-13 00:00:00.000000
+
+京东秒送接入店内搜索 deeplink 链路: 3.cn 短链 → 跟随重定向反查 venderId+storeId →
+openapp.jdmobile:// deeplink。京东店铺身份是**两个**稳定数字 id: storeId 进 id_jd(稳定
+店主键, 同 taobao 的 shopId→id_taobao), venderId 进单列 jd_vender_id(deeplink 还需它)。
+其余三列与 taobao_*/meituan_* 原料列平行。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_jd_cols'
+down_revision: Union[str, Sequence[str], None] = 'store_mapping_meituan_cols'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('jd_vender_id', sa.String(length=64), nullable=True))
+        batch_op.add_column(sa.Column('jd_share_url', sa.String(length=256), nullable=True))
+        batch_op.add_column(sa.Column('jd_resolved_url', sa.Text(), nullable=True))
+        batch_op.add_column(sa.Column('jd_deeplink', sa.Text(), nullable=True))
+        batch_op.create_index(batch_op.f('ix_store_mapping_jd_vender_id'), ['jd_vender_id'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_store_mapping_jd_vender_id'))
+        batch_op.drop_column('jd_deeplink')
+        batch_op.drop_column('jd_resolved_url')
+        batch_op.drop_column('jd_share_url')
+        batch_op.drop_column('jd_vender_id')

alembic/versions/store_mapping_jd_dl_invalid.py

@@ -0,0 +1,32 @@
+"""store_mapping 加京东 deeplink 失效标记列 jd_deeplink_invalid_at
+
+Revision ID: store_mapping_jd_dl_invalid
+Revises: store_mapping_tb_dl_invalid
+Create Date: 2026-06-15 00:00:00.000000
+
+京东同淘宝: 缓存的店内搜索 deeplink 会失效(打开是"当前门店超出配送范围"页)。pricebot 比价撞到
+失效页时回退正常搜店, 并 server→server 通知把该 storeId 的 deeplink 标记失效。本列记失效时刻
+(NULL=有效); lookup 反查时过滤掉已失效的京东候选, 不再返回坏 deeplink。
+与淘宝 taobao_deeplink_invalid_at 对称; 用时间戳而非布尔: 留痕可审计、可统计失效率, 不销毁原 deeplink。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_jd_dl_invalid'
+down_revision: Union[str, Sequence[str], None] = 'store_mapping_tb_dl_invalid'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('jd_deeplink_invalid_at', sa.DateTime(timezone=True), nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_column('jd_deeplink_invalid_at')

alembic/versions/store_mapping_meituan_cols.py

@@ -0,0 +1,39 @@
+"""store_mapping 加美团原料列(poi_id_str + 分享链/反查 URL/deeplink)
+
+Revision ID: store_mapping_meituan_cols
+Revises: store_mapping_table
+Create Date: 2026-06-13 00:00:00.000000
+
+美团接入店内搜索 deeplink 链路: dpurl.cn 短链 → 302 反查 poi_id_str → imeituan:// deeplink。
+poi_id_str 每次分享重新加密、非稳定主键, 单列 meituan_poi_id_str 存(不占 id_meituan,
+后者留给将来 CPS API 的稳定数字 poi_id)。其余三列与 taobao_* 原料列平行。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_meituan_cols'
+down_revision: Union[str, Sequence[str], None] = 'store_mapping_table'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('meituan_poi_id_str', sa.String(length=64), nullable=True))
+        batch_op.add_column(sa.Column('meituan_share_url', sa.String(length=256), nullable=True))
+        batch_op.add_column(sa.Column('meituan_resolved_url', sa.Text(), nullable=True))
+        batch_op.add_column(sa.Column('meituan_deeplink', sa.Text(), nullable=True))
+        batch_op.create_index(batch_op.f('ix_store_mapping_meituan_poi_id_str'), ['meituan_poi_id_str'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_store_mapping_meituan_poi_id_str'))
+        batch_op.drop_column('meituan_deeplink')
+        batch_op.drop_column('meituan_resolved_url')
+        batch_op.drop_column('meituan_share_url')
+        batch_op.drop_column('meituan_poi_id_str')

alembic/versions/store_mapping_table.py

@@ -0,0 +1,77 @@
+"""store_mapping table (平台店铺表:跨平台同店 id/名 映射,server 侧无条件落库)
+
+Revision ID: store_mapping_table
+Revises: coin_txn_task_ref_uq
+Create Date: 2026-06-13 00:00:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_table'
+down_revision: Union[str, Sequence[str], None] = 'coin_txn_task_ref_uq'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_table(
+        'store_mapping',
+        sa.Column('id', sa.Integer(), autoincrement=True, nullable=False),
+        # 跨平台身份
+        sa.Column('id_taobao', sa.String(length=64), nullable=True),
+        sa.Column('name_taobao', sa.String(length=128), nullable=True),
+        sa.Column('id_meituan', sa.String(length=64), nullable=True),
+        sa.Column('name_meituan', sa.String(length=128), nullable=True),
+        sa.Column('id_jd', sa.String(length=64), nullable=True),
+        sa.Column('name_jd', sa.String(length=128), nullable=True),
+        # 地理
+        sa.Column('city', sa.String(length=64), nullable=True),
+        sa.Column('geohash', sa.String(length=16), nullable=True),
+        sa.Column('lng', sa.Float(), nullable=True),
+        sa.Column('lat', sa.Float(), nullable=True),
+        sa.Column('taobao_address', sa.String(length=256), nullable=True),
+        # 溯源
+        sa.Column('source_platform', sa.String(length=32), nullable=True),
+        sa.Column('business_type', sa.String(length=16), nullable=False),
+        sa.Column('trace_id', sa.String(length=64), nullable=False),
+        sa.Column('source_device_id', sa.String(length=64), nullable=True),
+        sa.Column('source_user_id', sa.Integer(), nullable=True),
+        # 淘宝原料(URL 可能很长 → Text)
+        sa.Column('taobao_share_url', sa.String(length=256), nullable=True),
+        sa.Column('taobao_resolved_url', sa.Text(), nullable=True),
+        sa.Column('taobao_deeplink', sa.Text(), nullable=True),
+        # PG 上为 JSONB,其它(SQLite)为 JSON——与模型层 with_variant 对齐
+        sa.Column('attrs', sa.JSON().with_variant(sa.dialects.postgresql.JSONB(), 'postgresql'), nullable=True),
+        sa.Column('created_at', sa.DateTime(timezone=True), server_default=sa.text('(CURRENT_TIMESTAMP)'), nullable=False),
+        sa.PrimaryKeyConstraint('id'),
+        # 一次比价一行,trace_id 幂等去重(防 pricebot 重试 / replay 重复写)
+        sa.UniqueConstraint('trace_id', name='uq_store_mapping_trace'),
+    )
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.create_index(batch_op.f('ix_store_mapping_id_taobao'), ['id_taobao'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_id_meituan'), ['id_meituan'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_id_jd'), ['id_jd'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_geohash'), ['geohash'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_source_platform'), ['source_platform'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_source_device_id'), ['source_device_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_source_user_id'), ['source_user_id'], unique=False)
+        batch_op.create_index(batch_op.f('ix_store_mapping_created_at'), ['created_at'], unique=False)
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_index(batch_op.f('ix_store_mapping_created_at'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_source_user_id'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_source_device_id'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_source_platform'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_geohash'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_id_jd'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_id_meituan'))
+        batch_op.drop_index(batch_op.f('ix_store_mapping_id_taobao'))
+
+    op.drop_table('store_mapping')

alembic/versions/store_mapping_tb_dl_invalid.py

@@ -0,0 +1,33 @@
+"""store_mapping 加淘宝 deeplink 失效标记列 taobao_deeplink_invalid_at
+
+Revision ID: store_mapping_tb_dl_invalid
+Revises: coupon_engage_per_package
+Create Date: 2026-06-15 00:00:00.000000
+
+缓存的淘宝店内搜索 deeplink 会失效(打开是"页面出错了"降级页)。pricebot 比价撞到错误页时
+回退正常搜店, 并 server→server 通知把该 shopId 的 deeplink 标记失效。本列记失效时刻
+(NULL=有效); lookup 反查时过滤掉已失效的淘宝候选, 不再返回坏 deeplink。
+只加淘宝一列(当前只接淘宝); 用时间戳而非布尔: 留痕可审计、可统计失效率, 且不销毁原 deeplink。
+无需索引: 过滤总叠在 name_taobao== 之后, 候选集已小。
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = 'store_mapping_tb_dl_invalid'
+down_revision: Union[str, Sequence[str], None] = 'coupon_engage_per_package'
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.add_column(sa.Column('taobao_deeplink_invalid_at', sa.DateTime(timezone=True), nullable=True))
+
+
+def downgrade() -> None:
+    with op.batch_alter_table('store_mapping', schema=None) as batch_op:
+        batch_op.drop_column('taobao_deeplink_invalid_at')

alembic/versions/user_force_onboarding.py

@@ -0,0 +1,39 @@
+"""add user.force_onboarding
+
+运营后台「一键开启新手引导」:置 true → 用户下次启动 App 被强制重走引导教程(即便本地已完成),
+走完引导(/api/v1/user/onboarding/complete)后端自动清回 false,不无限循环。
+见 app/models/user.py force_onboarding 列、admin POST /admin/api/users/{id}/force-onboarding。
+
+Revision ID: user_force_onboarding
+Revises: onboarding_completion
+Create Date: 2026-06-10 21:30:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "user_force_onboarding"
+down_revision: Union[str, Sequence[str], None] = "onboarding_completion"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    # sa.false() 渲染成 PG 的 false / SQLite 的 0,两端兼容(同 debug_trace_enabled)。
+    op.add_column(
+        "user",
+        sa.Column(
+            "force_onboarding",
+            sa.Boolean(),
+            nullable=False,
+            server_default=sa.false(),
+        ),
+    )
+
+
+def downgrade() -> None:
+    op.drop_column("user", "force_onboarding")

alembic/versions/withdraw_safety_indexes.py

@@ -0,0 +1,42 @@
+"""add withdraw concurrency safety indexes
+
+Revision ID: withdraw_safety_indexes
+Revises: 0cf18d590b1d
+Create Date: 2026-06-08 16:20:00.000000
+
+"""
+from typing import Sequence, Union
+
+from alembic import op
+import sqlalchemy as sa
+
+
+# revision identifiers, used by Alembic.
+revision: str = "withdraw_safety_indexes"
+down_revision: Union[str, Sequence[str], None] = "0cf18d590b1d"
+branch_labels: Union[str, Sequence[str], None] = None
+depends_on: Union[str, Sequence[str], None] = None
+
+
+def upgrade() -> None:
+    op.create_index(
+        "ux_withdraw_order_user_active",
+        "withdraw_order",
+        ["user_id"],
+        unique=True,
+        sqlite_where=sa.text("status IN ('reviewing', 'pending')"),
+        postgresql_where=sa.text("status IN ('reviewing', 'pending')"),
+    )
+    op.create_index(
+        "ux_cash_transaction_withdraw_refund_ref",
+        "cash_transaction",
+        ["ref_id"],
+        unique=True,
+        sqlite_where=sa.text("biz_type = 'withdraw_refund' AND ref_id IS NOT NULL"),
+        postgresql_where=sa.text("biz_type = 'withdraw_refund' AND ref_id IS NOT NULL"),
+    )
+
+
+def downgrade() -> None:
+    op.drop_index("ux_cash_transaction_withdraw_refund_ref", table_name="cash_transaction")
+    op.drop_index("ux_withdraw_order_user_active", table_name="withdraw_order")

app/admin/main.py

@@ -13,14 +13,19 @@ from contextlib import asynccontextmanager
 from fastapi import FastAPI
 from fastapi.middleware.cors import CORSMiddleware
 
+from app.admin.routers.ad_audit import router as ad_audit_router
+from app.admin.routers.ad_revenue import router as ad_revenue_router
 from app.admin.routers.admins import router as admins_router
 from app.admin.routers.audit import router as audit_router
 from app.admin.routers.auth import router as auth_router
 from app.admin.routers.config import router as config_router
+from app.admin.routers.cps import router as cps_router
 from app.admin.routers.dashboard import router as dashboard_router
 from app.admin.routers.ops_stat_config import router as ops_stat_config_router
 from app.admin.routers.feedback import router as feedback_router
+from app.admin.routers.onboarding import router as onboarding_router
 from app.admin.routers.ops_marquee_seed import router as ops_marquee_seed_router
+from app.admin.routers.price_report import router as price_report_router
 from app.admin.routers.users import router as users_router
 from app.admin.routers.wallet import router as wallet_router
 from app.admin.routers.withdraw import router as withdraw_router
@@ -78,9 +83,14 @@ admin_app.include_router(dashboard_router)
 admin_app.include_router(ops_stat_config_router)
 admin_app.include_router(ops_marquee_seed_router)
 admin_app.include_router(users_router)
+admin_app.include_router(onboarding_router)
 admin_app.include_router(wallet_router)
 admin_app.include_router(withdraw_router)
+admin_app.include_router(price_report_router)
 admin_app.include_router(feedback_router)
 admin_app.include_router(admins_router)
 admin_app.include_router(audit_router)
 admin_app.include_router(config_router)
+admin_app.include_router(cps_router)
+admin_app.include_router(ad_audit_router)
+admin_app.include_router(ad_revenue_router)

app/admin/repositories/ad_audit.py

@@ -0,0 +1,248 @@
+"""看广告金币审计:复算 expected_coin 并与实发对比。
+
+只读。复用 [app.core.rewards] 的公式函数(不另写公式,避免与正式发奖口径漂移):
+- 看视频:每条 granted = 1 份,第 N 份 = 该用户 granted 的 reward_video **账号累计**顺序号
+  (与 ad_reward.grant_ad_reward 里 `_granted_cumulative + 1` 一致;LT 因子不按天重置,
+  故复算时要把当日序号叠加上该用户在本日**之前**的累计已发份数)。
+- 信息流:每条按 unit_count 份逐份累加,LT 序号 = 该用户 granted 份数**账号累计**
+  (与 ad_feed_reward._unit_reward_total 的 existing_units 一致;同样不按天重置,
+  复算需叠加本日之前的累计份数)。
+
+非 granted(capped/ecpm_missing)不占用份序号、应发恒 0,据此校验闸口是否确实没发。
+"""
+from __future__ import annotations
+
+from sqlalchemy import func, select
+from sqlalchemy.orm import Session
+
+from app.core import rewards
+from app.models.ad_feed_reward import AdFeedRewardRecord
+from app.models.ad_reward import AdRewardRecord
+from app.repositories.ad_feed_reward import FEED_REWARD_UNIT_SECONDS
+
+
+def _prior_granted_counts(
+    db: Session, *, date: str, user_id: int | None
+) -> dict[int, int]:
+    """各用户在 date **之前**已发奖的 reward_video 累计份数,作为当日复算的 LT 序号起点。
+    LT 因子改账号累计后,当日第 1 份并非全局第 1 份,需叠加历史累计。"""
+    stmt = (
+        select(AdRewardRecord.user_id, func.count())
+        .where(
+            AdRewardRecord.reward_date < date,
+            AdRewardRecord.reward_scene == "reward_video",
+            AdRewardRecord.status == "granted",
+        )
+        .group_by(AdRewardRecord.user_id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdRewardRecord.user_id == user_id)
+    return {uid: n for uid, n in db.execute(stmt).all()}
+
+
+def _reward_video_rows(
+    db: Session, *, date: str, user_id: int | None
+) -> list[dict]:
+    """看视频记录复算。按 (user_id, created_at) 升序还原账号累计第 N 份(含本日之前的累计)。"""
+    stmt = (
+        select(AdRewardRecord)
+        .where(
+            AdRewardRecord.reward_date == date,
+            AdRewardRecord.reward_scene == "reward_video",
+        )
+        .order_by(AdRewardRecord.user_id, AdRewardRecord.created_at, AdRewardRecord.id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdRewardRecord.user_id == user_id)
+
+    # 用本日之前的累计份数做起点,当日 granted 在其上继续递增 → 与 _granted_cumulative+1 对齐
+    granted_n: dict[int, int] = _prior_granted_counts(db, date=date, user_id=user_id)
+    rows: list[dict] = []
+    for rec in db.execute(stmt).scalars():
+        if rec.status == "granted":
+            nth = granted_n.get(rec.user_id, 0) + 1
+            granted_n[rec.user_id] = nth
+            expected = rewards.calculate_ad_reward_coin(rec.ecpm_raw, nth)
+            rows.append({
+                "scene": "reward_video",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "app_env": rec.app_env,
+                "our_code_id": rec.our_code_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": rewards.ad_ecpm_factor(rewards.parse_ecpm_yuan(rec.ecpm_raw)),
+                "units": 1,
+                "lt_index_start": nth,
+                "lt_index_end": nth,
+                "lt_factor_start": rewards.ad_lt_factor(nth),
+                "lt_factor_end": rewards.ad_lt_factor(nth),
+                "expected_coin": expected,
+                "actual_coin": rec.coin,
+                "matched": expected == rec.coin,
+            })
+        else:
+            # capped / ecpm_missing:不发金币,校验实发确为 0
+            rows.append({
+                "scene": "reward_video",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "app_env": rec.app_env,
+                "our_code_id": rec.our_code_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": None,
+                "units": 1,
+                "lt_index_start": None,
+                "lt_index_end": None,
+                "lt_factor_start": None,
+                "lt_factor_end": None,
+                "expected_coin": 0,
+                "actual_coin": rec.coin,
+                "matched": rec.coin == 0,
+            })
+    return rows
+
+
+def _feed_prior_granted_units(
+    db: Session, *, date: str, user_id: int | None
+) -> dict[int, int]:
+    """各用户在 date **之前** granted 的信息流份数累计,作为当日复算的 LT 序号起点。"""
+    stmt = (
+        select(
+            AdFeedRewardRecord.user_id,
+            func.coalesce(func.sum(AdFeedRewardRecord.unit_count), 0),
+        )
+        .where(
+            AdFeedRewardRecord.reward_date < date,
+            AdFeedRewardRecord.status == "granted",
+        )
+        .group_by(AdFeedRewardRecord.user_id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdFeedRewardRecord.user_id == user_id)
+    return {uid: int(n) for uid, n in db.execute(stmt).all()}
+
+
+def _feed_rows(db: Session, *, date: str, user_id: int | None) -> list[dict]:
+    """信息流记录复算。granted 记录逐份累加,LT 序号沿用账号累计份数(含本日之前)。"""
+    stmt = (
+        select(AdFeedRewardRecord)
+        .where(AdFeedRewardRecord.reward_date == date)
+        .order_by(AdFeedRewardRecord.user_id, AdFeedRewardRecord.created_at, AdFeedRewardRecord.id)
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdFeedRewardRecord.user_id == user_id)
+
+    # 本日之前的累计份数做起点,与 _unit_reward_total 的 existing_units(累计)对齐
+    granted_units: dict[int, int] = _feed_prior_granted_units(db, date=date, user_id=user_id)
+    rows: list[dict] = []
+    for rec in db.execute(stmt).scalars():
+        if rec.status == "granted":
+            existing = granted_units.get(rec.user_id, 0)
+            units = rec.unit_count
+            expected = sum(
+                rewards.calculate_ad_reward_coin(rec.ecpm_raw, existing + offset)
+                for offset in range(1, units + 1)
+            )
+            granted_units[rec.user_id] = existing + units
+            start = existing + 1 if units > 0 else None
+            end = existing + units if units > 0 else None
+            rows.append({
+                "scene": "feed",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "app_env": rec.app_env,
+                "our_code_id": rec.our_code_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": rewards.ad_ecpm_factor(rewards.parse_ecpm_yuan(rec.ecpm_raw)),
+                "units": units,
+                "lt_index_start": start,
+                "lt_index_end": end,
+                "lt_factor_start": rewards.ad_lt_factor(start) if start else None,
+                "lt_factor_end": rewards.ad_lt_factor(end) if end else None,
+                "expected_coin": expected,
+                "actual_coin": rec.coin,
+                "matched": expected == rec.coin,
+            })
+        else:
+            rows.append({
+                "scene": "feed",
+                "record_id": rec.id,
+                "user_id": rec.user_id,
+                "app_env": rec.app_env,
+                "our_code_id": rec.our_code_id,
+                "created_at": rec.created_at,
+                "status": rec.status,
+                "ecpm": rec.ecpm_raw,
+                "ecpm_factor": None,
+                "units": rec.unit_count,
+                "lt_index_start": None,
+                "lt_index_end": None,
+                "lt_factor_start": None,
+                "lt_factor_end": None,
+                "expected_coin": 0,
+                "actual_coin": rec.coin,
+                "matched": rec.coin == 0,
+            })
+    return rows
+
+
+def audit_rows(
+    db: Session, *, date: str, user_id: int | None, scene: str | None = None
+) -> list[dict]:
+    """当日逐条发奖复算行(未排序)。scene: None=两类 / "reward_video" / "feed"。
+
+    每行含 `app_env`/`our_code_id`/`expected_coin`/`actual_coin` 等,供金币审计逐条对账,
+    也供广告收益报表把「应发/实发」按 用户×类型×应用×代码位 聚合(见 ad_revenue,复用同一复算口径)。
+    """
+    rows: list[dict] = []
+    if scene in (None, "reward_video"):
+        rows.extend(_reward_video_rows(db, date=date, user_id=user_id))
+    if scene in (None, "feed"):
+        rows.extend(_feed_rows(db, date=date, user_id=user_id))
+    return rows
+
+
+def ad_coin_audit(
+    db: Session,
+    *,
+    date: str,
+    user_id: int | None,
+    scene: str | None,
+    limit: int,
+    only_mismatch: bool = False,
+) -> dict:
+    """当日发奖复算。返回 {total, mismatch_count, truncated, items}。
+
+    scene: None=两类都要 / "reward_video" / "feed";only_mismatch=True 只展示不一致(✗)行。
+    关键:`total` 与 `mismatch_count` 在**全量**(截断前)上统计,故对账数字始终可信,不受 limit
+    影响;`items` 才是展示集(only_mismatch 时只取 ✗ 行)按 created_at 倒序截断到 limit。
+    份序号在全天数据上已算好,limit 只影响展示条数、不影响 expected 复算正确性。
+    """
+    rows = audit_rows(db, date=date, user_id=user_id, scene=scene)
+    rows.sort(key=lambda r: (r["created_at"], r["record_id"]), reverse=True)
+
+    total = len(rows)
+    mismatch_count = sum(1 for r in rows if not r["matched"])
+    display = [r for r in rows if not r["matched"]] if only_mismatch else rows
+    return {
+        "total": total,
+        "mismatch_count": mismatch_count,
+        "truncated": len(display) > limit,
+        "items": display[:limit],
+    }
+
+
+def formula_snapshot() -> dict:
+    """当前公式参数快照(给前端展示规则参照)。直接读 rewards 常量,与发奖同源。"""
+    return {
+        "coin_per_yuan": rewards.COIN_PER_YUAN,
+        "feed_unit_seconds": FEED_REWARD_UNIT_SECONDS,
+        "ecpm_factor_tiers": [list(t) for t in rewards.AD_ECPM_FACTOR_TABLE],
+        "lt_factor_tiers": [list(t) for t in rewards.AD_LT_FACTOR_TABLE],
+    }

app/admin/repositories/ad_revenue.py

@@ -0,0 +1,239 @@
+"""admin 广告收益报表:按 用户 / 日期 / 广告类型 / 应用 / 代码位 聚合(单表含发奖对账)。
+
+只读。聚合键 = user_id × ad_type × app_env × our_code_id;每组一行同时给出:
+- 展示条数 + 收益:`ad_ecpm_record`(每行 = 客户端一次广告展示;收益 = Σ eCPM元 ÷ 1000)。
+  激励视频每次展示上报一行;信息流轮播每条展示各上报一行(每条独立 id,不复用会话)。
+- 应发金币 / 实发金币:复用金币审计的**逐条复算**(`ad_audit.audit_rows`,与正式发奖同一公式口径,
+  不另写公式),把每条发奖记录的 expected/actual 按同维度求和;`matched` = 组内**逐条**全部一致
+  (任一条不符该组即不符,不用「应发和==实发和」以免互相抵消掩盖错误)。**不改发奖逻辑**,只读复算。
+
+展示与发奖来自不同表,做并集:有展示无发奖(用户中途关 / 未达发奖)、有发奖无展示
+(未上报 eCPM)都各自成行。app_env/our_code_id 旧数据为 NULL → 归到「来源未知」组。
+
+⚠️ 局限:① 历史 Draw 发奖混在 ad_feed_reward_record 无类型标记,金币侧统一记 `feed`(迁移后 Draw
+不再产生新数据)。② 聚合级只能看出「某组应发≠实发」,定位到具体哪条仍需逐条审计接口(ad-coin-audit)。
+"""
+from __future__ import annotations
+
+from datetime import date as _date, datetime, timedelta, timezone
+
+from sqlalchemy import select
+from sqlalchemy.orm import Session
+
+from app.admin.repositories import ad_audit
+from app.core import rewards
+from app.models.ad_ecpm import AdEcpmRecord
+
+
+def _cn_hour(dt: datetime) -> int:
+    """created_at(UTC 口径)→ 北京时间小时(0–23)。naive 当 UTC 处理(sqlite),tz-aware 直接换算(pg)。"""
+    if dt.tzinfo is None:
+        dt = dt.replace(tzinfo=timezone.utc)
+    return dt.astimezone(rewards.CN_TZ).hour
+
+
+def _key(
+    report_date: str,
+    user_id: int,
+    ad_type: str,
+    app_env: str | None,
+    our_code_id: str | None,
+    hour: int | None,
+) -> tuple:
+    return (report_date, user_id, ad_type, app_env or None, our_code_id or None, hour)
+
+
+def _date_range(date_from: str, date_to: str) -> list[str]:
+    """闭区间内逐日 'YYYY-MM-DD' 串(含首尾)。date_from > date_to 时返回空。"""
+    d0 = _date.fromisoformat(date_from)
+    d1 = _date.fromisoformat(date_to)
+    out: list[str] = []
+    d = d0
+    while d <= d1:
+        out.append(d.isoformat())
+        d += timedelta(days=1)
+    return out
+
+
+# 审计行的 scene 与报表 ad_type 一一对应
+_SCENE_TO_AD_TYPE = {"reward_video": "reward_video", "feed": "feed"}
+
+
+def ad_revenue_report(
+    db: Session,
+    *,
+    date_from: str,
+    date_to: str,
+    user_id: int | None = None,
+    ad_type: str | None = None,
+    granularity: str = "day",
+    limit: int = 500,
+) -> dict:
+    """日期区间(北京时间,闭区间)广告收益聚合 + 发奖对账。单日时 date_from==date_to。
+
+    聚合键含**日期**:report_date × user × ad_type × app_env × our_code_id(× 北京小时,granularity=hour)。
+    ad_type: None=全部 / reward_video / feed / draw。
+    granularity: "day"=按天 / "hour"=按小时(聚合键再加北京小时 0–23,每组一行)。
+    limit 只截断展示明细,total 与 total_* / daily 在全量上统计(不受 limit 影响),数字始终可信。
+
+    返回额外含 `daily`(按日期汇总的展示/收益/应发/实发,供前端按天趋势图;不受 limit 影响)。
+
+    注:按小时下,展示按 ecpm 记录的小时、金币按发奖记录的小时各自归桶——S2S 回调可能比展示晚
+    一会儿,故同一次广告的展示与金币偶尔落相邻小时(按天则一致)。
+    """
+    by_hour = granularity == "hour"
+    groups: dict[tuple, dict] = {}
+
+    def _grp(key: tuple) -> dict:
+        g = groups.get(key)
+        if g is None:
+            rdate, uid, atype, app_env, code_id, hour = key
+            g = {
+                "report_date": rdate,
+                "user_id": uid,
+                "ad_type": atype,
+                "app_env": app_env,
+                "our_code_id": code_id,
+                "hour": hour,
+                "impressions": 0,
+                "revenue_yuan": 0.0,
+                "expected_coin": 0,
+                "actual_coin": 0,
+                "adns": set(),
+                "impression_records": [],  # 该组逐条展示明细(展开下钻用)
+                "records": [],  # 该组逐条发奖复算明细(展开下钻用)
+            }
+            groups[key] = g
+        return g
+
+    # 1) 展示条数 + 收益 ← ad_ecpm_record(report_date 闭区间;字符串 YYYY-MM-DD 字典序即日期序)
+    stmt = select(AdEcpmRecord).where(
+        AdEcpmRecord.report_date >= date_from,
+        AdEcpmRecord.report_date <= date_to,
+    )
+    if user_id is not None:
+        stmt = stmt.where(AdEcpmRecord.user_id == user_id)
+    if ad_type is not None:
+        stmt = stmt.where(AdEcpmRecord.ad_type == ad_type)
+    for rec in db.execute(stmt).scalars():
+        hour = _cn_hour(rec.created_at) if by_hour else None
+        g = _grp(_key(rec.report_date, rec.user_id, rec.ad_type, rec.app_env, rec.our_code_id, hour))
+        g["impressions"] += 1
+        # 单次展示收益(元) = eCPM元 ÷ 1000(每千次→单次);用与发奖同源的解析,口径一致。
+        rev = rewards.parse_ecpm_yuan(rec.ecpm_raw) / 1000.0
+        g["revenue_yuan"] += rev
+        if rec.adn:
+            g["adns"].add(rec.adn)
+        g["impression_records"].append({
+            "id": rec.id,
+            "created_at": rec.created_at,
+            "ecpm": rec.ecpm_raw,
+            "revenue_yuan": round(rev, 6),
+            "adn": rec.adn,
+            "slot_id": rec.slot_id,
+        })
+
+    # 2) 应发 / 实发金币 ← 复用金币审计逐条复算(同一公式口径),按同维度求和。
+    #    audit_rows 是单日的,区间逐日调用,每天的行归到当天 report_date(语义与单日报表完全一致)。
+    #    ad_type=draw 时审计无对应记录(scene 只有 reward_video/feed),金币侧自然为空。
+    audit_scene = _SCENE_TO_AD_TYPE.get(ad_type) if ad_type is not None else None
+    if ad_type is None or audit_scene is not None:
+        for d in _date_range(date_from, date_to):
+            for row in ad_audit.audit_rows(db, date=d, user_id=user_id, scene=audit_scene):
+                atype = _SCENE_TO_AD_TYPE.get(row["scene"], row["scene"])
+                hour = _cn_hour(row["created_at"]) if by_hour else None
+                g = _grp(_key(d, row["user_id"], atype, row.get("app_env"), row.get("our_code_id"), hour))
+                g["expected_coin"] += int(row["expected_coin"])
+                g["actual_coin"] += int(row["actual_coin"])
+                # 逐条明细(eCPM/因子1/份数/LT/因子2/应发/实发/一致)——前端展开该组时下钻展示。
+                g["records"].append({
+                    "record_id": row["record_id"],
+                    "created_at": row["created_at"],
+                    "status": row["status"],
+                    "ecpm": row["ecpm"],
+                    "ecpm_factor": row["ecpm_factor"],
+                    "units": row["units"],
+                    "lt_index_start": row["lt_index_start"],
+                    "lt_index_end": row["lt_index_end"],
+                    "lt_factor_start": row["lt_factor_start"],
+                    "lt_factor_end": row["lt_factor_end"],
+                    "expected_coin": row["expected_coin"],
+                    "actual_coin": row["actual_coin"],
+                    "matched": row["matched"],
+                })
+
+    rows = list(groups.values())
+    rows.sort(
+        key=lambda r: (
+            r["report_date"],
+            r["user_id"],
+            r["hour"] if r["hour"] is not None else -1,
+            r["ad_type"] or "",
+            r["our_code_id"] or "",
+        )
+    )
+
+    total_impressions = sum(r["impressions"] for r in rows)
+    total_expected_coin = sum(r["expected_coin"] for r in rows)
+    total_actual_coin = sum(r["actual_coin"] for r in rows)
+    total_revenue_yuan = round(sum(r["revenue_yuan"] for r in rows), 6)
+
+    # 按日期汇总(全量,不受 limit):供前端按天趋势图。
+    daily_map: dict[str, dict] = {}
+    for r in rows:
+        d = daily_map.get(r["report_date"])
+        if d is None:
+            d = {
+                "date": r["report_date"],
+                "impressions": 0,
+                "revenue_yuan": 0.0,
+                "expected_coin": 0,
+                "actual_coin": 0,
+            }
+            daily_map[r["report_date"]] = d
+        d["impressions"] += r["impressions"]
+        d["revenue_yuan"] += r["revenue_yuan"]
+        d["expected_coin"] += r["expected_coin"]
+        d["actual_coin"] += r["actual_coin"]
+    daily = [
+        {**d, "revenue_yuan": round(d["revenue_yuan"], 6)}
+        for d in sorted(daily_map.values(), key=lambda x: x["date"])
+    ]
+
+    items = [
+        {
+            "report_date": r["report_date"],
+            "user_id": r["user_id"],
+            "ad_type": r["ad_type"],
+            "app_env": r["app_env"],
+            "our_code_id": r["our_code_id"],
+            "hour": r["hour"],
+            "impressions": r["impressions"],
+            "revenue_yuan": round(r["revenue_yuan"], 6),
+            "expected_coin": r["expected_coin"],
+            "actual_coin": r["actual_coin"],
+            # 组内**逐条**全部一致才记一致——不能用「应发和==实发和」,否则一条多发+一条少发会互相
+            # 抵消、求和相等被误判为 ✓,掩盖真实发奖错误。纯展示无发奖记录的组 all([]) → True。
+            "matched": all(rec["matched"] for rec in r["records"]),
+            "adns": sorted(r["adns"]),
+            "impression_records": sorted(
+                r["impression_records"], key=lambda x: (x["created_at"], x["id"])
+            ),
+            "records": sorted(r["records"], key=lambda x: (x["created_at"], x["record_id"])),
+        }
+        for r in rows[:limit]
+    ]
+
+    return {
+        "total": len(rows),
+        "truncated": len(rows) > limit,
+        "total_impressions": total_impressions,
+        "total_revenue_yuan": total_revenue_yuan,
+        "total_expected_coin": total_expected_coin,
+        "total_actual_coin": total_actual_coin,
+        "mismatch_count": sum(
+            1 for r in rows if not all(rec["matched"] for rec in r["records"])
+        ),
+        "daily": daily,
+        "items": items,
+    }

app/admin/repositories/audit_log.py

@@ -4,7 +4,7 @@
 """
 from __future__ import annotations
 
-from sqlalchemy import select
+from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
 from app.models.admin import AdminAuditLog
@@ -49,8 +49,9 @@ def list_audit_logs(
     admin_id: int | None = None,
     limit: int = 50,
     cursor: int | None = None,
-) -> tuple[list[AdminAuditLog], int | None]:
-    """游标分页(id 倒序),与现有 list_* 约定一致。返回 (rows, next_cursor)。"""
+) -> tuple[list[AdminAuditLog], int | None, int]:
+    """offset 分页(id 倒序)+ total。cursor 即 offset((page-1)*pageSize),支持页码跳页。
+    返回 (rows, next_cursor, total)。"""
     stmt = select(AdminAuditLog)
     if action:
         stmt = stmt.where(AdminAuditLog.action == action)
@@ -58,13 +59,15 @@ def list_audit_logs(
         stmt = stmt.where(AdminAuditLog.target_type == target_type)
     if admin_id is not None:
         stmt = stmt.where(AdminAuditLog.admin_id == admin_id)
-    if cursor is not None:
-        stmt = stmt.where(AdminAuditLog.id < cursor)
-    stmt = stmt.order_by(AdminAuditLog.id.desc())
-    rows = list(db.execute(stmt.limit(limit + 1)).scalars().all())
+
+    total = int(db.execute(select(func.count()).select_from(stmt.subquery())).scalar_one())
+    offset = max(cursor or 0, 0)
+    rows = list(
+        db.execute(
+            stmt.order_by(AdminAuditLog.id.desc()).offset(offset).limit(limit + 1)
+        ).scalars().all()
+    )
     has_more = len(rows) > limit
     items = rows[:limit]
-    # next_cursor 必须是"本页返回的最后一条"的 id(下一页查 id < 它),不能用 rows[limit]——
-    # rows[limit] 是探测下一页用的第 limit+1 条,它既不在本页也不在下页 → 每页边界丢一条。
-    next_cursor = items[-1].id if has_more else None
-    return items, next_cursor
+    next_cursor = offset + limit if has_more else None
+    return items, next_cursor, total

app/admin/repositories/cps.py

@@ -0,0 +1,287 @@
+"""admin CPS 数据访问:群/活动 CRUD + 美团订单拉单入库(对账) + 按群统计聚合。
+
+美团 query_order 返回的金额是「元」字符串、时间是秒级时间戳,这里统一转「分」+ tz-aware。
+统计在 Python 侧聚合(订单量级小、admin 低频),逻辑清晰、跨 PG/SQLite 无 SQL 方言坑。
+"""
+from __future__ import annotations
+
+from datetime import datetime, timezone
+from decimal import Decimal, InvalidOperation
+from uuid import uuid4
+
+from sqlalchemy import desc, select
+from sqlalchemy.orm import Session
+
+from app.admin.repositories.queries import _as_utc, offset_paginate
+from app.integrations import meituan
+from app.repositories import cps_link as cps_link_repo
+from app.models.cps_activity import CpsActivity
+from app.models.cps_group import CpsGroup
+from app.models.cps_order import CpsOrder
+
+# 美团订单状态:取消(4)/风控(5)不计佣金;结算(6)为佣金真正到账
+_INVALID_STATUS = {"4", "5"}
+_SETTLED_STATUS = "6"
+
+
+# ───────────── 单位换算 ─────────────
+def _yuan_to_cents(v: object) -> int | None:
+    """「元」字符串/数 → 分。None / 空 / 字面 "null" → None。"""
+    if v is None:
+        return None
+    s = str(v).strip()
+    if not s or s.lower() == "null":
+        return None
+    try:
+        return int((Decimal(s) * 100).to_integral_value())
+    except (InvalidOperation, ValueError):
+        return None
+
+
+def _ts_to_dt(ts: object) -> datetime | None:
+    """秒级时间戳 → tz-aware UTC datetime(绝对时刻,前端按北京展示)。"""
+    if not ts:
+        return None
+    try:
+        return datetime.fromtimestamp(int(ts), tz=timezone.utc)
+    except (ValueError, OSError, TypeError):
+        return None
+
+
+# ───────────── 群 ─────────────
+def get_group(db: Session, group_id: int) -> CpsGroup | None:
+    return db.get(CpsGroup, group_id)
+
+
+def get_group_by_sid(db: Session, sid: str) -> CpsGroup | None:
+    return db.execute(select(CpsGroup).where(CpsGroup.sid == sid)).scalar_one_or_none()
+
+
+def list_groups(
+    db: Session, *, keyword: str | None = None, status: str | None = None,
+    limit: int = 20, cursor: int | None = None,
+) -> tuple[list[CpsGroup], int | None, int]:
+    stmt = select(CpsGroup)
+    if keyword and keyword.strip():
+        kw = f"%{keyword.strip()}%"
+        stmt = stmt.where(CpsGroup.name.ilike(kw) | CpsGroup.sid.ilike(kw))
+    if status:
+        stmt = stmt.where(CpsGroup.status == status)
+    return offset_paginate(db, stmt, (desc(CpsGroup.id),), limit=limit, cursor=cursor)
+
+
+def create_group(
+    db: Session, *, name: str, sid: str | None = None,
+    member_count: int | None = None, remark: str | None = None, commit: bool = True,
+) -> CpsGroup:
+    """建群。sid 留空 → 自动 g<id>(先 flush 拿 id 再回填)。"""
+    group = CpsGroup(
+        name=name,
+        sid=sid or f"tmp{uuid4().hex[:20]}",  # 临时唯一占位,留空时下面回填 g<id>
+        member_count=member_count,
+        remark=remark,
+    )
+    db.add(group)
+    db.flush()
+    if not sid:
+        group.sid = f"g{group.id}"
+        db.flush()
+    if commit:
+        db.commit()
+        db.refresh(group)
+    return group
+
+
+def update_group(
+    db: Session, group: CpsGroup, *, name: str | None = None,
+    member_count: int | None = None, status: str | None = None,
+    remark: str | None = None, commit: bool = True,
+) -> CpsGroup:
+    if name is not None:
+        group.name = name
+    if member_count is not None:
+        group.member_count = member_count
+    if status is not None:
+        group.status = status
+    if remark is not None:
+        group.remark = remark
+    if commit:
+        db.commit()
+        db.refresh(group)
+    else:
+        db.flush()
+    return group
+
+
+# ───────────── 活动 ─────────────
+def get_activity(db: Session, activity_id: int) -> CpsActivity | None:
+    return db.get(CpsActivity, activity_id)
+
+
+def list_activities(
+    db: Session, *, platform: str | None = None, status: str | None = None,
+    limit: int = 20, cursor: int | None = None,
+) -> tuple[list[CpsActivity], int | None, int]:
+    stmt = select(CpsActivity)
+    if platform:
+        stmt = stmt.where(CpsActivity.platform == platform)
+    if status:
+        stmt = stmt.where(CpsActivity.status == status)
+    return offset_paginate(db, stmt, (desc(CpsActivity.id),), limit=limit, cursor=cursor)
+
+
+def create_activity(
+    db: Session, *, name: str, platform: str = "meituan", act_id: str | None = None,
+    product_view_sign: str | None = None, remark: str | None = None, commit: bool = True,
+) -> CpsActivity:
+    activity = CpsActivity(
+        name=name, platform=platform, act_id=act_id,
+        product_view_sign=product_view_sign, remark=remark,
+    )
+    db.add(activity)
+    if commit:
+        db.commit()
+        db.refresh(activity)
+    else:
+        db.flush()
+    return activity
+
+
+# ───────────── 订单(对账) ─────────────
+def _map_order_fields(r: dict) -> dict:
+    """美团 query_order 单条 dataList → CpsOrder 字段(金额转分、时间转 datetime)。"""
+    pn = r.get("productName")
+    if pn and len(pn) > 500:
+        pn = pn[:500]
+    return {
+        "sid": (r.get("sid") or None),
+        "act_id": str(r["actId"]) if r.get("actId") is not None else None,
+        "biz_line": r.get("businessLine"),
+        "trade_type": r.get("tradeType"),
+        "pay_price_cents": _yuan_to_cents(r.get("payPrice")),
+        "commission_cents": _yuan_to_cents(r.get("profit")),
+        "commission_rate": str(r["commissionRate"]) if r.get("commissionRate") is not None else None,
+        "refund_price_cents": _yuan_to_cents(r.get("refundPrice")),
+        "refund_profit_cents": _yuan_to_cents(r.get("refundProfit")),
+        "mt_status": str(r["status"]) if r.get("status") is not None else None,
+        "invalid_reason": (r.get("invalidReason") or None),
+        "product_name": pn or None,
+        "pay_time": _ts_to_dt(r.get("payTime")),
+        "mt_update_time": _ts_to_dt(r.get("updateTime")),
+        "raw": r,
+    }
+
+
+def reconcile_orders(
+    db: Session, *, start_time: int, end_time: int,
+    query_time_type: int = 1, sid: str | None = None, max_pages: int = 200,
+) -> dict:
+    """调美团 query_order 分页拉单 → 按 order_id upsert。返回 {fetched, inserted, updated, pages}。
+
+    订单状态会随时间变(付款→完成→结算/退款),重复拉同一单则更新。max_pages 防异常死循环。
+    """
+    fetched = inserted = updated = pages = 0
+    page = 1
+    while page <= max_pages:
+        resp = meituan.query_order(
+            sid=sid, start_time=start_time, end_time=end_time,
+            query_time_type=query_time_type, page=page, limit=100,
+        )
+        rows = ((resp.get("data") or {}).get("dataList")) or []
+        if not rows:
+            break
+        pages += 1
+        for r in rows:
+            order_id = str(r.get("orderId") or "").strip()
+            if not order_id:
+                continue
+            fetched += 1
+            fields = _map_order_fields(r)
+            existing = db.execute(
+                select(CpsOrder).where(CpsOrder.order_id == order_id)
+            ).scalar_one_or_none()
+            if existing is None:
+                db.add(CpsOrder(order_id=order_id, **fields))
+                inserted += 1
+            else:
+                for k, v in fields.items():
+                    setattr(existing, k, v)
+                updated += 1
+        if len(rows) < 100:
+            break
+        page += 1
+    db.commit()
+    return {"fetched": fetched, "inserted": inserted, "updated": updated, "pages": pages}
+
+
+def list_orders(
+    db: Session, *, sid: str | None = None, mt_status: str | None = None,
+    limit: int = 20, cursor: int | None = None,
+) -> tuple[list[CpsOrder], int | None, int]:
+    stmt = select(CpsOrder)
+    if sid:
+        stmt = stmt.where(CpsOrder.sid == sid)
+    if mt_status:
+        stmt = stmt.where(CpsOrder.mt_status == mt_status)
+    return offset_paginate(db, stmt, (desc(CpsOrder.id),), limit=limit, cursor=cursor)
+
+
+# ───────────── 统计(按群聚合) ─────────────
+def group_stats(
+    db: Session, *, date_from: datetime | None = None, date_to: datetime | None = None,
+) -> list[dict]:
+    """按 sid 聚合订单 + join 群信息。已建但本期无单的活跃群也列出(全 0)。
+    未归群的 sid(历史/其它来源)单独成行 group_id=None。按预估佣金降序。
+    """
+    stmt = select(CpsOrder)
+    if date_from is not None:
+        stmt = stmt.where(CpsOrder.pay_time >= _as_utc(date_from))
+    if date_to is not None:
+        stmt = stmt.where(CpsOrder.pay_time <= _as_utc(date_to))
+    orders = list(db.execute(stmt).scalars().all())
+
+    groups = {g.sid: g for g in db.execute(select(CpsGroup)).scalars().all()}
+
+    buckets: dict[str | None, list[CpsOrder]] = {}
+    for o in orders:
+        buckets.setdefault(o.sid, []).append(o)
+
+    rows: list[dict] = []
+    for sid, items in buckets.items():
+        g = groups.get(sid) if sid else None
+        valid = [o for o in items if o.mt_status not in _INVALID_STATUS]
+        settled = [o for o in items if o.mt_status == _SETTLED_STATUS]
+        canceled = [o for o in items if o.mt_status in _INVALID_STATUS]
+        rows.append({
+            "group_id": g.id if g else None,
+            "sid": sid,
+            "name": g.name if g else (sid or "（无 sid 归属）"),
+            "member_count": g.member_count if g else None,
+            "order_count": len(valid),
+            "settled_count": len(settled),
+            "canceled_count": len(canceled),
+            "gmv_cents": sum(o.pay_price_cents or 0 for o in valid),
+            "est_commission_cents": sum(o.commission_cents or 0 for o in valid),
+            "settled_commission_cents": sum(o.commission_cents or 0 for o in settled),
+        })
+
+    # 已建的活跃群但本期无单 → 补 0 行,让运营看到全部群
+    seen = set(buckets.keys())
+    for sid, g in groups.items():
+        if sid not in seen and g.status == "active":
+            rows.append({
+                "group_id": g.id, "sid": sid, "name": g.name,
+                "member_count": g.member_count, "order_count": 0,
+                "settled_count": 0, "canceled_count": 0, "gmv_cents": 0,
+                "est_commission_cents": 0, "settled_commission_cents": 0,
+            })
+
+    # 合并点击数据(按 group_id):点击只对生成过我们短链的群有,未归群行(group_id=None)恒 0
+    clicks = cps_link_repo.click_stats_by_group(db, date_from=date_from, date_to=date_to)
+    for r in rows:
+        c = clicks.get(r["group_id"]) if r["group_id"] is not None else None
+        r["click_pv"] = c["pv"] if c else 0
+        r["click_uv"] = c["uv"] if c else 0
+
+    rows.sort(key=lambda x: x["est_commission_cents"], reverse=True)
+    return rows

app/admin/repositories/mutations.py

@@ -8,9 +8,15 @@ set_user_status / update_feedback_status 支持 commit=False,让 router 把"业
 """
 from __future__ import annotations
 
+from datetime import datetime
+
+from sqlalchemy import delete
 from sqlalchemy.orm import Session
 
+from app.core.rewards import CN_TZ
 from app.models.feedback import Feedback
+from app.models.onboarding import OnboardingCompletion
+from app.models.price_report import PriceReport
 from app.models.user import User
 
 
@@ -24,6 +30,20 @@ def set_user_status(db: Session, user: User, *, status: str, commit: bool = True
     return user
 
 
+def set_user_debug_trace(
+    db: Session, user: User, *, enabled: bool, commit: bool = True
+) -> User:
+    """开关用户「复制调试链接」权限。同 set_user_status：支持 commit=False 让 router 把
+    业务写 + 审计写放进同一事务。"""
+    user.debug_trace_enabled = enabled
+    if commit:
+        db.commit()
+        db.refresh(user)
+    else:
+        db.flush()
+    return user
+
+
 def update_feedback_status(
     db: Session, feedback: Feedback, *, status: str, commit: bool = True
 ) -> Feedback:
@@ -34,3 +54,54 @@ def update_feedback_status(
     else:
         db.flush()
     return feedback
+
+
+def review_price_report(
+    db: Session,
+    report: PriceReport,
+    *,
+    status: str,
+    reward_coins: int | None = None,
+    reject_reason: str | None = None,
+    commit: bool = True,
+) -> PriceReport:
+    """审核上报:置 approved/rejected + 记审核时间;通过填 reward_coins、拒绝填 reject_reason。
+
+    发金币(wallet.grant_coins)不在这里——由 router 在同一事务里调,涉钱逻辑不重写(见模块头注释)。
+    """
+    report.status = status
+    if reward_coins is not None:
+        report.reward_coins = reward_coins
+    if reject_reason is not None:
+        report.reject_reason = reject_reason
+    report.reviewed_at = datetime.now(CN_TZ).replace(tzinfo=None)  # 北京 wall-clock,同 created_at
+    if commit:
+        db.commit()
+        db.refresh(report)
+    else:
+        db.flush()
+    return report
+
+
+def delete_device_onboarding(db: Session, device_id: str, *, commit: bool = True) -> int:
+    """删某设备(device_id)的全部 onboarding 完成记录 → 该设备上所有账号下次登录重走引导。
+    返回删除行数。支持 commit=False 让 router 把业务写 + 审计写放进同一事务。"""
+    n = db.execute(
+        delete(OnboardingCompletion).where(OnboardingCompletion.device_id == device_id)
+    ).rowcount
+    if commit:
+        db.commit()
+    else:
+        db.flush()
+    return n
+
+
+def delete_all_onboarding(db: Session, *, commit: bool = True) -> int:
+    """清空 onboarding_completion 表 → 所有用户在所有设备下次登录都重走引导。返回删除行数。
+    支持 commit=False(同 delete_device_onboarding)。"""
+    n = db.execute(delete(OnboardingCompletion)).rowcount
+    if commit:
+        db.commit()
+    else:
+        db.flush()
+    return n

app/admin/repositories/queries.py

@@ -5,11 +5,17 @@
 """
 from __future__ import annotations
 
-from sqlalchemy import Select, func, select
+from datetime import datetime, timedelta, timezone
+from zoneinfo import ZoneInfo
+
+from sqlalchemy import Select, asc, desc, func, or_, select
 from sqlalchemy.orm import Session
 
+from app.models.admin import AdminAuditLog
 from app.models.comparison import ComparisonRecord
 from app.models.feedback import Feedback
+from app.models.onboarding import OnboardingCompletion
+from app.models.price_report import PriceReport
 from app.models.user import User
 from app.models.wallet import CashTransaction, CoinAccount, CoinTransaction, WithdrawOrder
 
@@ -32,15 +38,48 @@ def cursor_paginate(
     return items, next_cursor
 
 
+def offset_paginate(
+    db: Session, stmt: Select, sort_clause: tuple, *, limit: int, cursor: int | None
+) -> tuple[list, int | None, int]:
+    """offset 分页 + 总数。stmt 只含 where/join,不要预先带 order_by/offset/limit。
+
+    cursor 即 offset(页码分页:offset=(page-1)*pageSize)。返回 (items, next_cursor, total):
+    - total:符合筛选条件的总条数(供 antd pagination 渲染页码/共 N 条),count 在 P0 量级开销可忽略;
+    - next_cursor:下一页 offset(兼容「加载更多」),末页为 None。
+    多取 1 条探测下一页。sort_clause 为 order_by 表达式元组(末位应含 id 保证稳定排序)。"""
+    total = int(
+        db.execute(select(func.count()).select_from(stmt.subquery())).scalar_one()
+    )
+    offset = max(cursor or 0, 0)
+    rows = list(
+        db.execute(stmt.order_by(*sort_clause).offset(offset).limit(limit + 1)).scalars().all()
+    )
+    has_more = len(rows) > limit
+    items = rows[:limit]
+    next_cursor = offset + limit if has_more else None
+    return items, next_cursor, total
+
+
 def list_users(
     db: Session,
     *,
     phone: str | None = None,
     register_channel: str | None = None,
     status: str | None = None,
+    nickname: str | None = None,
+    created_from: datetime | None = None,
+    created_to: datetime | None = None,
+    last_login_from: datetime | None = None,
+    last_login_to: datetime | None = None,
+    sort_by: str = "id",
+    sort_order: str = "desc",
     limit: int = 20,
     cursor: int | None = None,
-) -> tuple[list[User], int | None]:
+) -> tuple[list[User], int | None, int]:
+    """用户列表(admin 全量)。支持手机号前缀 / 渠道 / 状态 / 昵称模糊 / 注册·最近登录时间范围筛选,
+    按 id·注册时间·最近登录排序。**offset 分页**(cursor=offset):任意列排序下游标语义统一,
+    代价是翻页期间数据变动可能错位一条——admin 低频场景可接受(同 [list_all_withdraw_orders])。
+    日期入参统一转 tz-aware UTC 比较(列为 timestamptz,见 _as_utc)。"""
     stmt = select(User)
     if phone:
         stmt = stmt.where(User.phone.like(f"{phone}%"))  # 前缀匹配
@@ -48,7 +87,46 @@ def list_users(
         stmt = stmt.where(User.register_channel == register_channel)
     if status:
         stmt = stmt.where(User.status == status)
-    return cursor_paginate(db, stmt, User.id, limit=limit, cursor=cursor)
+    if nickname and nickname.strip():
+        stmt = stmt.where(User.nickname.ilike(f"%{nickname.strip()}%"))
+    if created_from is not None:
+        stmt = stmt.where(User.created_at >= _as_utc(created_from))
+    if created_to is not None:
+        stmt = stmt.where(User.created_at <= _as_utc(created_to))
+    if last_login_from is not None:
+        stmt = stmt.where(User.last_login_at >= _as_utc(last_login_from))
+    if last_login_to is not None:
+        stmt = stmt.where(User.last_login_at <= _as_utc(last_login_to))
+
+    sort_cols = {
+        "id": User.id,
+        "created_at": User.created_at,
+        "last_login_at": User.last_login_at,
+    }
+    sort_col = sort_cols.get(sort_by, User.id)
+    order_fn = asc if sort_order == "asc" else desc
+    id_order = asc(User.id) if sort_order == "asc" else desc(User.id)
+    return offset_paginate(db, stmt, (order_fn(sort_col), id_order), limit=limit, cursor=cursor)
+
+
+def list_onboarding_devices(db: Session, *, limit: int = 500) -> list[dict]:
+    """按设备(device_id, ANDROID_ID)聚合 onboarding_completion:每台设备走过引导的账号数 +
+    最近完成时间,按最近完成倒序。设备维度新手引导管理用。没走过引导的设备不在表里(本就会
+    引导、无需管理)。当前全量返回(上限 limit;调试期设备少,量大再加分页/搜索)。"""
+    rows = db.execute(
+        select(
+            OnboardingCompletion.device_id,
+            func.count(OnboardingCompletion.id),
+            func.max(OnboardingCompletion.completed_at),
+        )
+        .group_by(OnboardingCompletion.device_id)
+        .order_by(func.max(OnboardingCompletion.completed_at).desc())
+        .limit(limit)
+    ).all()
+    return [
+        {"device_id": did, "account_count": int(cnt), "last_completed_at": last}
+        for did, cnt, last in rows
+    ]
 
 
 def list_all_coin_transactions(
@@ -88,15 +166,112 @@ def list_all_withdraw_orders(
     *,
     user_id: int | None = None,
     status: str | None = None,
+    keyword: str | None = None,
+    date_from: datetime | None = None,
+    date_to: datetime | None = None,
+    date_field: str = "created_at",
+    sort_by: str = "created_at",
+    sort_order: str = "desc",
+    quick_filter: str | None = None,
     limit: int = 20,
     cursor: int | None = None,
-) -> tuple[list[WithdrawOrder], int | None]:
+) -> tuple[list[WithdrawOrder], int | None, int]:
     stmt = select(WithdrawOrder)
+    needs_user_join = bool(keyword and keyword.strip()) or quick_filter == "high_risk"
+    if needs_user_join:
+        stmt = stmt.outerjoin(User, User.id == WithdrawOrder.user_id)
+
     if user_id is not None:
         stmt = stmt.where(WithdrawOrder.user_id == user_id)
     if status:
         stmt = stmt.where(WithdrawOrder.status == status)
-    return cursor_paginate(db, stmt, WithdrawOrder.id, limit=limit, cursor=cursor)
+
+    kw = (keyword or "").strip()
+    if kw:
+        pattern = f"%{kw}%"
+        conditions = [
+            WithdrawOrder.out_bill_no.ilike(pattern),
+            WithdrawOrder.transfer_bill_no.ilike(pattern),
+            WithdrawOrder.user_name.ilike(pattern),
+            WithdrawOrder.wechat_state.ilike(pattern),
+            WithdrawOrder.fail_reason.ilike(pattern),
+            User.phone.ilike(pattern),
+            User.nickname.ilike(pattern),
+            User.wechat_nickname.ilike(pattern),
+        ]
+        if kw.isdigit():
+            conditions.append(WithdrawOrder.user_id == int(kw))
+        stmt = stmt.where(or_(*conditions))
+
+    date_col = WithdrawOrder.updated_at if date_field == "updated_at" else WithdrawOrder.created_at
+    if date_from is not None:
+        stmt = stmt.where(date_col >= _as_utc(date_from))
+    if date_to is not None:
+        stmt = stmt.where(date_col <= _as_utc(date_to))
+
+    # tz-aware:列为 timestamptz,比较绝对时刻、与 DB 会话时区无关(同 _as_utc / stats.py)
+    now = datetime.now(timezone.utc)
+    today_start = (
+        datetime.now(ZoneInfo("Asia/Shanghai"))
+        .replace(hour=0, minute=0, second=0, microsecond=0)
+        .astimezone(timezone.utc)
+    )
+    if quick_filter == "abnormal":
+        stmt = stmt.where(
+            or_(
+                WithdrawOrder.status.in_(("failed", "rejected")),
+                WithdrawOrder.fail_reason.is_not(None),
+                WithdrawOrder.wechat_state.in_(("FAIL", "CANCELLED", "CLOSED")),
+            )
+        )
+    elif quick_filter == "failed":
+        stmt = stmt.where(WithdrawOrder.status == "failed")
+    elif quick_filter == "overdue_reviewing":
+        stmt = stmt.where(
+            WithdrawOrder.status == "reviewing",
+            WithdrawOrder.created_at <= now - timedelta(minutes=30),
+        )
+    elif quick_filter == "pending_overdue":
+        stmt = stmt.where(
+            WithdrawOrder.status == "pending",
+            WithdrawOrder.updated_at <= now - timedelta(minutes=15),
+        )
+    elif quick_filter == "today":
+        stmt = stmt.where(WithdrawOrder.created_at >= today_start)
+    elif quick_filter == "high_risk":
+        stmt = stmt.where(
+            or_(
+                WithdrawOrder.user_name.is_(None),
+                WithdrawOrder.user_name == "",
+                User.status != "active",
+                User.created_at >= now - timedelta(hours=24),
+                WithdrawOrder.status.in_(("failed", "rejected")),
+                WithdrawOrder.fail_reason.is_not(None),
+            )
+        )
+
+    sort_cols = {
+        "id": WithdrawOrder.id,
+        "created_at": WithdrawOrder.created_at,
+        "updated_at": WithdrawOrder.updated_at,
+        "amount_cents": WithdrawOrder.amount_cents,
+    }
+    sort_col = sort_cols.get(sort_by, WithdrawOrder.created_at)
+    order_fn = asc if sort_order == "asc" else desc
+    id_order = asc(WithdrawOrder.id) if sort_order == "asc" else desc(WithdrawOrder.id)
+    return offset_paginate(db, stmt, (order_fn(sort_col), id_order), limit=limit, cursor=cursor)
+
+
+def _as_utc(value: datetime) -> datetime:
+    """前端传 ISO 时间 → 统一成 tz-aware UTC 再比较。
+
+    所有时间列均为 `DateTime(timezone=True)`(Postgres timestamptz);用 tz-aware 绑定参数
+    比较的是绝对时刻,与 DB 会话时区无关、恒正确。曾用 naive UTC,正确性依赖会话 TimeZone=UTC,
+    生产会话非 UTC 时筛选边界会整体偏移——故统一 tz-aware(与 stats.py / withdraw_summary 一致)。
+    无时区入参按 UTC 解释。"""
+    if value.tzinfo is None:
+        return value.replace(tzinfo=timezone.utc)
+    return value.astimezone(timezone.utc)
 
 
 def list_feedbacks(
@@ -104,15 +279,35 @@ def list_feedbacks(
     *,
     status: str | None = None,
     user_id: int | None = None,
+    content: str | None = None,
+    created_from: datetime | None = None,
+    created_to: datetime | None = None,
+    sort_by: str = "id",
+    sort_order: str = "desc",
     limit: int = 20,
     cursor: int | None = None,
-) -> tuple[list[Feedback], int | None]:
+) -> tuple[list[Feedback], int | None, int]:
+    """反馈工单列表。支持 状态 / 用户ID / 内容模糊 / 提交时间范围 筛选,按 id·提交时间排序。
+    **offset 分页**(cursor=offset):任意列排序下游标语义统一(同 [list_users]),代价是翻页期间
+    数据变动可能错位一条——admin 低频场景可接受。返回 (items, next_cursor, total),total 供页码分页。
+    created_at 为 timestamptz,日期入参统一转 tz-aware UTC 比较。"""
     stmt = select(Feedback)
     if status:
         stmt = stmt.where(Feedback.status == status)
     if user_id is not None:
         stmt = stmt.where(Feedback.user_id == user_id)
-    return cursor_paginate(db, stmt, Feedback.id, limit=limit, cursor=cursor)
+    if content and content.strip():
+        stmt = stmt.where(Feedback.content.ilike(f"%{content.strip()}%"))
+    if created_from is not None:
+        stmt = stmt.where(Feedback.created_at >= _as_utc(created_from))
+    if created_to is not None:
+        stmt = stmt.where(Feedback.created_at <= _as_utc(created_to))
+
+    sort_cols = {"id": Feedback.id, "created_at": Feedback.created_at}
+    sort_col = sort_cols.get(sort_by, Feedback.id)
+    order_fn = asc if sort_order == "asc" else desc
+    id_order = asc(Feedback.id) if sort_order == "asc" else desc(Feedback.id)
+    return offset_paginate(db, stmt, (order_fn(sort_col), id_order), limit=limit, cursor=cursor)
 
 
 def get_withdraw_by_out_bill_no(db: Session, out_bill_no: str) -> WithdrawOrder | None:
@@ -122,6 +317,147 @@ def get_withdraw_by_out_bill_no(db: Session, out_bill_no: str) -> WithdrawOrder
     ).scalar_one_or_none()
 
 
+def withdraw_summary(db: Session) -> dict:
+    """提现审核台顶部统计。金额单位:分。"""
+    rows = db.execute(
+        select(
+            WithdrawOrder.status,
+            func.count(WithdrawOrder.id),
+            func.coalesce(func.sum(WithdrawOrder.amount_cents), 0),
+        ).group_by(WithdrawOrder.status)
+    ).all()
+    by_status = {
+        status: {"count": int(count), "amount_cents": int(amount_cents)}
+        for status, count, amount_cents in rows
+    }
+
+    today_start = (
+        datetime.now(ZoneInfo("Asia/Shanghai"))
+        .replace(hour=0, minute=0, second=0, microsecond=0)
+        .astimezone(timezone.utc)
+    )
+
+    def _today_count(status: str) -> int:
+        return db.execute(
+            select(func.count(WithdrawOrder.id)).where(
+                WithdrawOrder.status == status,
+                WithdrawOrder.updated_at >= today_start,
+            )
+        ).scalar_one()
+
+    today_success_amount = db.execute(
+        select(func.coalesce(func.sum(WithdrawOrder.amount_cents), 0)).where(
+            WithdrawOrder.status == "success",
+            WithdrawOrder.updated_at >= today_start,
+        )
+    ).scalar_one()
+
+    return {
+        "reviewing_count": by_status.get("reviewing", {}).get("count", 0),
+        "reviewing_amount_cents": by_status.get("reviewing", {}).get("amount_cents", 0),
+        "pending_count": by_status.get("pending", {}).get("count", 0),
+        "failed_count": by_status.get("failed", {}).get("count", 0),
+        "today_success_count": _today_count("success"),
+        "today_success_amount_cents": int(today_success_amount),
+        "today_rejected_count": _today_count("rejected"),
+    }
+
+
+def list_withdraw_audit_logs(
+    db: Session, out_bill_no: str, *, limit: int = 20
+) -> list[AdminAuditLog]:
+    return list(
+        db.execute(
+            select(AdminAuditLog)
+            .where(AdminAuditLog.target_type == "withdraw", AdminAuditLog.target_id == out_bill_no)
+            .order_by(AdminAuditLog.id.desc())
+            .limit(limit)
+        ).scalars().all()
+    )
+
+
+def withdraw_risk_flags(
+    order: WithdrawOrder,
+    user: User | None,
+    recent_withdraws: list[WithdrawOrder],
+    cash_balance_cents: int,
+) -> tuple[list[str], int]:
+    flags: list[str] = []
+    if not order.user_name:
+        flags.append("缺少提现实名")
+    if user and user.status != "active":
+        flags.append(f"账号状态:{user.status}")
+    if user and user.created_at:
+        created_at = user.created_at.replace(tzinfo=timezone.utc) if user.created_at.tzinfo is None else user.created_at
+        if datetime.now(timezone.utc) - created_at < timedelta(hours=24):
+            flags.append("新注册用户")
+    failed_or_rejected = sum(1 for item in recent_withdraws if item.status in {"failed", "rejected"})
+    if failed_or_rejected:
+        flags.append(f"历史异常提现{failed_or_rejected}笔")
+    recent_reviewing = sum(1 for item in recent_withdraws if item.status == "reviewing")
+    if recent_reviewing >= 3:
+        flags.append(f"待审核提现偏多:{recent_reviewing}笔")
+    if cash_balance_cents < 0:
+        flags.append("现金余额为负")
+    score = min(100, len(flags) * 20 + failed_or_rejected * 10)
+    return flags, score
+
+
+def withdraw_ledger_check(db: Session) -> dict:
+    cash_balance_total = int(
+        db.execute(select(func.coalesce(func.sum(CoinAccount.cash_balance_cents), 0))).scalar_one()
+    )
+    cash_txn_total = int(
+        db.execute(select(func.coalesce(func.sum(CashTransaction.amount_cents), 0))).scalar_one()
+    )
+
+    orders = list(db.execute(select(WithdrawOrder)).scalars().all())
+    cash_txns = list(
+        db.execute(
+            select(CashTransaction).where(
+                CashTransaction.biz_type.in_(("withdraw", "withdraw_refund"))
+            )
+        ).scalars().all()
+    )
+    withdraw_refs = {txn.ref_id for txn in cash_txns if txn.biz_type == "withdraw"}
+    refund_counts: dict[str, int] = {}
+    for txn in cash_txns:
+        if txn.biz_type == "withdraw_refund" and txn.ref_id:
+            refund_counts[txn.ref_id] = refund_counts.get(txn.ref_id, 0) + 1
+
+    missing_withdraw = 0
+    missing_refund = 0
+    refund_on_non_terminal = 0
+    for order in orders:
+        if order.out_bill_no not in withdraw_refs:
+            missing_withdraw += 1
+        has_refund = refund_counts.get(order.out_bill_no, 0) > 0
+        if order.status in {"failed", "rejected"} and not has_refund:
+            missing_refund += 1
+        if has_refund and order.status not in {"failed", "rejected"}:
+            refund_on_non_terminal += 1
+
+    duplicate_refund = sum(1 for count in refund_counts.values() if count > 1)
+    diff = cash_balance_total - cash_txn_total
+    ok = (
+        diff == 0
+        and missing_withdraw == 0
+        and missing_refund == 0
+        and duplicate_refund == 0
+        and refund_on_non_terminal == 0
+    )
+    return {
+        "ok": ok,
+        "cash_balance_total_cents": cash_balance_total,
+        "cash_transaction_total_cents": cash_txn_total,
+        "balance_diff_cents": diff,
+        "missing_withdraw_txn_count": missing_withdraw,
+        "missing_refund_txn_count": missing_refund,
+        "duplicate_refund_txn_count": duplicate_refund,
+        "refund_txn_on_non_terminal_count": refund_on_non_terminal,
+    }
+
+
 def get_user_overview(db: Session, user_id: int) -> dict | None:
     """用户 360 概览:基础资料 + 钱包余额 + 各项 count。历史明细走各自分页接口(带 user_id 过滤)。"""
     user = db.get(User, user_id)
@@ -151,3 +487,34 @@ def get_user_overview(db: Session, user_id: int) -> dict | None:
         ).scalar_one(),
         "feedback_total": _count(Feedback, Feedback.user_id == user_id),
     }
+
+
+def list_price_reports(
+    db: Session,
+    *,
+    status: str | None = None,
+    user_id: int | None = None,
+    limit: int = 20,
+    cursor: int | None = None,
+) -> tuple[list[PriceReport], int | None, int]:
+    """上报更低价列表(admin 全量,可按状态/用户筛)。offset 分页 + total,id 倒序。"""
+    stmt = select(PriceReport)
+    if status:
+        stmt = stmt.where(PriceReport.status == status)
+    if user_id is not None:
+        stmt = stmt.where(PriceReport.user_id == user_id)
+    return offset_paginate(db, stmt, (PriceReport.id.desc(),), limit=limit, cursor=cursor)
+
+
+def price_report_summary(db: Session) -> dict:
+    """上报审核台各状态计数(待审核/已通过/已拒绝/合计)。"""
+    rows = db.execute(
+        select(PriceReport.status, func.count(PriceReport.id)).group_by(PriceReport.status)
+    ).all()
+    by_status = {status: int(count) for status, count in rows}
+    return {
+        "pending": by_status.get("pending", 0),
+        "approved": by_status.get("approved", 0),
+        "rejected": by_status.get("rejected", 0),
+        "total": sum(by_status.values()),
+    }

app/admin/repositories/stats.py

@@ -10,8 +10,11 @@ from datetime import datetime, timedelta, timezone
 from sqlalchemy import func, select
 from sqlalchemy.orm import Session
 
+from app.models.ad_feed_reward import AdFeedRewardRecord
+from app.models.ad_reward import AdRewardRecord
 from app.models.comparison import ComparisonRecord
 from app.models.feedback import Feedback
+from app.models.signin import SigninBoostRecord, SigninRecord
 from app.models.user import User
 from app.models.wallet import CoinTransaction, WithdrawOrder
 
@@ -71,6 +74,37 @@ def dashboard_overview(db: Session) -> dict:
         "coins": {
             # 累计发放金币(coin_transaction 里所有 amount>0 之和;负数是兑换/扣减不计)
             "granted_total": _sum(CoinTransaction.amount, CoinTransaction.amount > 0),
+            "reward_video_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type.in_(("reward_video", "ad_reward")),
+            ),
+            "reward_video_watch_count": _count(
+                AdRewardRecord,
+                AdRewardRecord.reward_scene == "reward_video",
+                AdRewardRecord.status == "granted",
+            ),
+            "feed_ad_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type == "feed_ad_reward",
+            ),
+            "feed_ad_watch_count": _count(
+                AdFeedRewardRecord,
+                AdFeedRewardRecord.status == "granted",
+            ),
+            "signin_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type == "signin",
+            ),
+            "signin_count": _count(SigninRecord),
+            "signin_boost_coin_total": _sum(
+                CoinTransaction.amount,
+                CoinTransaction.amount > 0,
+                CoinTransaction.biz_type == "signin_boost",
+            ),
+            "signin_boost_watch_count": _count(SigninBoostRecord),
         },
         "cash": {
             "withdraw_success_cents": _sum(

app/admin/routers/ad_audit.py

@@ -0,0 +1,48 @@
+"""admin 看广告金币审计:只读对账,核对发奖金币是否按公式计算。
+
+任意已登录 admin 可看(只读,不涉及资金操作)。复算逻辑在 app/admin/repositories/ad_audit.py。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, Query
+
+from app.admin.deps import AdminDb, get_current_admin
+from app.admin.repositories import ad_audit
+from app.admin.schemas.ad_audit import AdCoinAuditOut, AdCoinAuditRow, AdCoinFormulaOut
+from app.core.rewards import cn_today
+
+router = APIRouter(
+    prefix="/admin/api/ad-coin-audit",
+    tags=["admin-ad-coin-audit"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=AdCoinAuditOut, summary="看广告金币公式审计(复算对比)")
+def get_ad_coin_audit(
+    db: AdminDb,
+    date: Annotated[str | None, Query(description="北京时间 YYYY-MM-DD,默认今天")] = None,
+    user_id: Annotated[int | None, Query(description="只看某用户;不传=全部用户")] = None,
+    scene: Annotated[
+        str | None, Query(description="reward_video / feed;不传=两类都要")
+    ] = None,
+    limit: Annotated[int, Query(ge=1, le=500)] = 100,
+    only_mismatch: Annotated[
+        bool, Query(description="只看不一致(✗)行;统计数仍按全量,不受影响")
+    ] = False,
+) -> AdCoinAuditOut:
+    audit_date = date or cn_today().isoformat()
+    result = ad_audit.ad_coin_audit(
+        db, date=audit_date, user_id=user_id, scene=scene, limit=limit,
+        only_mismatch=only_mismatch,
+    )
+    return AdCoinAuditOut(
+        date=audit_date,
+        formula=AdCoinFormulaOut(**ad_audit.formula_snapshot()),
+        total=result["total"],
+        mismatch_count=result["mismatch_count"],
+        truncated=result["truncated"],
+        items=[AdCoinAuditRow(**r) for r in result["items"]],
+    )

app/admin/routers/ad_revenue.py

@@ -0,0 +1,75 @@
+"""admin 广告收益报表:按 用户/日期/广告类型/应用/代码位 聚合 展示条数 / 收益 / 金币。
+
+任意已登录 admin 可看(只读,不涉及资金操作)。聚合逻辑在 app/admin/repositories/ad_revenue.py。
+"""
+from __future__ import annotations
+
+from datetime import date as _date
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query
+
+from app.admin.deps import AdminDb, get_current_admin
+from app.admin.repositories import ad_revenue
+from app.admin.schemas.ad_revenue import AdRevenueDaily, AdRevenueReportOut, AdRevenueRow
+from app.core.rewards import cn_today
+
+router = APIRouter(
+    prefix="/admin/api/ad-revenue-report",
+    tags=["admin-ad-revenue-report"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+# 区间最大跨度(天);超出拒绝,避免审计页一次拉过多天(逐日审计 + 大查询)拖垮接口。
+_MAX_RANGE_DAYS = 92
+
+
+def _parse_day(value: str | None, *, field: str, default: _date) -> _date:
+    if value is None:
+        return default
+    try:
+        return _date.fromisoformat(value)
+    except ValueError as e:
+        raise HTTPException(status_code=422, detail=f"{field} 需为 YYYY-MM-DD") from e
+
+
+@router.get("", response_model=AdRevenueReportOut, summary="广告收益报表(按 日期区间/用户/类型/应用/代码位 聚合)")
+def get_ad_revenue_report(
+    db: AdminDb,
+    date_from: Annotated[str | None, Query(description="起始日 北京时间 YYYY-MM-DD,默认今天")] = None,
+    date_to: Annotated[str | None, Query(description="结束日 北京时间 YYYY-MM-DD,闭区间,默认=date_from")] = None,
+    user_id: Annotated[int | None, Query(description="只看某用户;不传=全部用户")] = None,
+    ad_type: Annotated[
+        str | None,
+        Query(description="reward_video / feed / draw;不传=全部类型"),
+    ] = None,
+    granularity: Annotated[
+        str, Query(description="day=按天 / hour=按小时(北京时间);区间>1 天建议用 day")
+    ] = "day",
+    limit: Annotated[int, Query(ge=1, le=1000)] = 500,
+) -> AdRevenueReportOut:
+    today = cn_today()
+    d_from = _parse_day(date_from, field="date_from", default=today)
+    d_to = _parse_day(date_to, field="date_to", default=d_from)
+    if d_to < d_from:
+        raise HTTPException(status_code=422, detail="date_to 不能早于 date_from")
+    if (d_to - d_from).days + 1 > _MAX_RANGE_DAYS:
+        raise HTTPException(status_code=422, detail=f"区间最长 {_MAX_RANGE_DAYS} 天")
+
+    result = ad_revenue.ad_revenue_report(
+        db, date_from=d_from.isoformat(), date_to=d_to.isoformat(),
+        user_id=user_id, ad_type=ad_type, granularity=granularity, limit=limit,
+    )
+    return AdRevenueReportOut(
+        date_from=d_from.isoformat(),
+        date_to=d_to.isoformat(),
+        daily=[AdRevenueDaily(**d) for d in result["daily"]],
+        total=result["total"],
+        truncated=result["truncated"],
+        total_impressions=result["total_impressions"],
+        total_revenue_yuan=result["total_revenue_yuan"],
+        total_expected_coin=result["total_expected_coin"],
+        total_actual_coin=result["total_actual_coin"],
+        mismatch_count=result["mismatch_count"],
+        items=[AdRevenueRow(**r) for r in result["items"]],
+    )

app/admin/routers/admins.py

@@ -17,6 +17,12 @@ router = APIRouter(
 )
 
 
+def _active_super_count(db: AdminDb) -> int:
+    return sum(
+        1 for a in admin_repo.list_admins(db) if a.role == "super_admin" and a.status == "active"
+    )
+
+
 @router.get("", response_model=list[AdminOut], summary="管理员列表")
 def list_admins(db: AdminDb) -> list[AdminOut]:
     return [AdminOut.model_validate(a) for a in admin_repo.list_admins(db)]
@@ -48,16 +54,29 @@ def update_admin(
     if admin_id == admin.id and body.status == "disabled":
         raise HTTPException(status_code=400, detail="不能禁用自己")
 
+    # 防自锁:降级 / 禁用某个 super_admin 前,确认操作后仍至少剩 1 个 active super_admin,
+    # 否则会进入「零可用超管」死局——本路由仅 super 可进,只能改库恢复。
+    demotes_super = (
+        target.role == "super_admin"
+        and target.status == "active"
+        and (
+            (body.role is not None and body.role != "super_admin")
+            or body.status == "disabled"
+        )
+    )
+    if demotes_super and _active_super_count(db) <= 1:
+        raise HTTPException(status_code=400, detail="不能降级/禁用最后一个超级管理员")
+
     changes: dict = {}
-    if body.role is not None:
+    if body.role is not None and body.role != target.role:
+        changes["role"] = {"before": target.role, "after": body.role}
         target.role = body.role
-        changes["role"] = body.role
-    if body.status is not None:
+    if body.status is not None and body.status != target.status:
+        changes["status"] = {"before": target.status, "after": body.status}
         target.status = body.status
-        changes["status"] = body.status
     if body.password is not None:
-        target.password_hash = hash_password(body.password)
         changes["password"] = "reset"
+        target.password_hash = hash_password(body.password)
     if not changes:
         raise HTTPException(status_code=400, detail="无任何变更字段")
     db.commit()

app/admin/routers/audit.py

@@ -26,9 +26,11 @@ def list_audit_logs(
     limit: Annotated[int, Query(ge=1, le=100)] = 50,
     cursor: Annotated[int | None, Query()] = None,
 ) -> CursorPage[AdminAuditLogOut]:
-    items, next_cursor = audit_repo.list_audit_logs(
+    items, next_cursor, total = audit_repo.list_audit_logs(
         db, action=action, target_type=target_type, admin_id=admin_id, limit=limit, cursor=cursor,
     )
     return CursorPage(
-        items=[AdminAuditLogOut.model_validate(x) for x in items], next_cursor=next_cursor,
+        items=[AdminAuditLogOut.model_validate(x) for x in items],
+        next_cursor=next_cursor,
+        total=total,
     )

app/admin/routers/config.py

@@ -13,6 +13,7 @@ from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
 from app.admin.schemas.config import ConfigItemOut, ConfigUpdateRequest
 from app.core.config_schema import CONFIG_DEFS
+from app.core.rewards import SIGNIN_CYCLE_LEN
 from app.models.admin import AdminUser
 from app.repositories import app_config
 
@@ -34,14 +35,17 @@ def _validate(key: str, value: Any) -> None:
             raise ValueError("需为非空整数列表")
         if not all(isinstance(x, int) and not isinstance(x, bool) and x >= 0 for x in value):
             raise ValueError("列表元素需为非负整数")
-        if key == "signin_rewards" and len(value) != 14:
-            raise ValueError("签到档位必须正好 14 个(对应 14 天循环)")
+        if key == "signin_rewards" and len(value) != SIGNIN_CYCLE_LEN:
+            raise ValueError(f"签到档位必须正好 {SIGNIN_CYCLE_LEN} 个(对应 {SIGNIN_CYCLE_LEN} 天循环)")
     elif t == "dict_str_int":
         if not isinstance(value, dict) or not all(
             isinstance(k, str) and isinstance(v, int) and not isinstance(v, bool)
             for k, v in value.items()
         ):
             raise ValueError("需为 {字符串: 整数} 映射")
+    elif t == "bool":
+        if not isinstance(value, bool):
+            raise ValueError("需为布尔值")
 
 
 def _item(db, key: str) -> ConfigItemOut:

app/admin/routers/cps.py

@@ -0,0 +1,268 @@
+"""admin CPS 分发与对账:群(sid)管理 + 活动池 + 生成带 sid 券链接 + 美团订单对账 + 统计。
+
+当前仅接美团(get_referral_link / query_order)。淘宝/京东待各自联盟凭证。
+群/活动管理 = operator;订单对账(涉佣金) = finance;只读列表/统计 = 登录即可。
+"""
+from __future__ import annotations
+
+import time
+from datetime import datetime, timedelta, timezone
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import cps as cps_repo
+from app.admin.schemas.common import CursorPage
+from app.core.config import settings
+from app.repositories import cps_link as cps_link_repo
+from app.admin.schemas.cps import (
+    CpsActivityCreate,
+    CpsActivityOut,
+    CpsGroupCreate,
+    CpsGroupOut,
+    CpsGroupStat,
+    CpsGroupUpdate,
+    CpsOrderOut,
+    CpsReconcileResult,
+    CpsReferralLinkOut,
+    CpsReferralLinkRequest,
+    CpsStatsOut,
+)
+from app.integrations import meituan
+from app.integrations.meituan import MeituanCpsError
+from app.models.admin import AdminUser
+
+router = APIRouter(
+    prefix="/admin/api/cps",
+    tags=["admin-cps"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+# ───────────── 群(sid) ─────────────
+@router.get("/groups", response_model=CursorPage[CpsGroupOut], summary="群(sid)列表")
+def list_groups(
+    db: AdminDb,
+    keyword: Annotated[str | None, Query(max_length=100)] = None,
+    status: Annotated[str | None, Query(pattern="^(active|archived)$")] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[CpsGroupOut]:
+    items, next_cursor, total = cps_repo.list_groups(
+        db, keyword=keyword, status=status, limit=limit, cursor=cursor
+    )
+    return CursorPage(
+        items=[CpsGroupOut.model_validate(g) for g in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+@router.post("/groups", response_model=CpsGroupOut, summary="新建群(分配 sid)")
+def create_group(
+    body: CpsGroupCreate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> CpsGroupOut:
+    if body.sid and cps_repo.get_group_by_sid(db, body.sid) is not None:
+        raise HTTPException(status_code=409, detail="sid 已存在")
+    group = cps_repo.create_group(
+        db, name=body.name, sid=body.sid, member_count=body.member_count,
+        remark=body.remark, commit=False,
+    )
+    write_audit(
+        db, admin, action="cps.group.create", target_type="cps_group", target_id=group.id,
+        detail={"sid": group.sid, "name": group.name}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    db.refresh(group)
+    return CpsGroupOut.model_validate(group)
+
+
+@router.patch("/groups/{group_id}", response_model=CpsGroupOut, summary="编辑群")
+def update_group(
+    group_id: int,
+    body: CpsGroupUpdate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> CpsGroupOut:
+    group = cps_repo.get_group(db, group_id)
+    if group is None:
+        raise HTTPException(status_code=404, detail="群不存在")
+    cps_repo.update_group(
+        db, group, name=body.name, member_count=body.member_count,
+        status=body.status, remark=body.remark, commit=False,
+    )
+    write_audit(
+        db, admin, action="cps.group.update", target_type="cps_group", target_id=group_id,
+        detail=body.model_dump(exclude_none=True), ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    db.refresh(group)
+    return CpsGroupOut.model_validate(group)
+
+
+# ───────────── 活动 ─────────────
+@router.get("/activities", response_model=CursorPage[CpsActivityOut], summary="活动列表")
+def list_activities(
+    db: AdminDb,
+    platform: Annotated[str | None, Query(max_length=20)] = None,
+    status: Annotated[str | None, Query(pattern="^(active|archived)$")] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[CpsActivityOut]:
+    items, next_cursor, total = cps_repo.list_activities(
+        db, platform=platform, status=status, limit=limit, cursor=cursor
+    )
+    return CursorPage(
+        items=[CpsActivityOut.model_validate(a) for a in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+@router.post("/activities", response_model=CpsActivityOut, summary="新建活动")
+def create_activity(
+    body: CpsActivityCreate,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> CpsActivityOut:
+    if not body.act_id and not body.product_view_sign:
+        raise HTTPException(status_code=400, detail="act_id 或 product_view_sign 必填其一")
+    activity = cps_repo.create_activity(
+        db, name=body.name, platform=body.platform, act_id=body.act_id,
+        product_view_sign=body.product_view_sign, remark=body.remark, commit=False,
+    )
+    write_audit(
+        db, admin, action="cps.activity.create", target_type="cps_activity", target_id=activity.id,
+        detail={"name": activity.name, "act_id": activity.act_id, "platform": activity.platform},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    db.refresh(activity)
+    return CpsActivityOut.model_validate(activity)
+
+
+# ───────────── 转链 ─────────────
+@router.post("/referral-link", response_model=CpsReferralLinkOut, summary="生成群发短链(带 sid + 点击统计)")
+def generate_referral_link(
+    body: CpsReferralLinkRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> CpsReferralLinkOut:
+    group = cps_repo.get_group(db, body.group_id)
+    if group is None:
+        raise HTTPException(status_code=404, detail="群不存在")
+    activity = cps_repo.get_activity(db, body.activity_id)
+    if activity is None:
+        raise HTTPException(status_code=404, detail="活动不存在")
+    if activity.platform != "meituan":
+        raise HTTPException(status_code=400, detail=f"当前仅支持美团转链(活动平台={activity.platform})")
+    try:
+        # 全要:短链作跳转目标(微信可打开),长链/deeplink 作参考/备用
+        resp = meituan.get_referral_link(
+            act_id=activity.act_id,
+            product_view_sign=activity.product_view_sign,
+            sid=group.sid,
+            link_type_list=[1, 2, 3],
+        )
+    except MeituanCpsError as e:
+        raise HTTPException(status_code=502, detail=f"美团转链失败: {e}") from e
+
+    link_map = {str(k): v for k, v in (resp.get("referralLinkMap") or {}).items()}
+    if not link_map and resp.get("data"):
+        link_map = {"1": resp["data"]}
+    # 跳转目标优先短链(2,微信可打开)→ 长链(1)→ deeplink(3)
+    target_url = link_map.get("2") or link_map.get("1") or link_map.get("3")
+    if not target_url:
+        raise HTTPException(status_code=502, detail="美团未返回有效链接(检查 actId 是否在推广有效期)")
+
+    # 存我们的短链:发群用 /c/{code},用户点 → 我们记点击 → 302 跳 target_url
+    link = cps_link_repo.create_link(
+        db, group_id=group.id, activity_id=activity.id, sid=group.sid,
+        target_url=target_url, platform=activity.platform, commit=False,
+    )
+    write_audit(
+        db, admin, action="cps.referral_link.generate", target_type="cps_link", target_id=link.id,
+        detail={"sid": group.sid, "activity_id": activity.id, "code": link.code},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    db.refresh(link)
+
+    base = settings.CPS_REDIRECT_BASE.rstrip("/")
+    redirect_url = f"{base}/c/{link.code}" if base else f"/c/{link.code}"
+    return CpsReferralLinkOut(
+        redirect_url=redirect_url,
+        code=link.code,
+        sid=group.sid,
+        group_name=group.name,
+        activity_name=activity.name,
+        target_url=target_url,
+        link_map=link_map,
+    )
+
+
+# ───────────── 订单对账 ─────────────
+@router.post("/orders/reconcile", response_model=CpsReconcileResult, summary="拉取美团订单对账")
+def reconcile_orders(
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+    days: Annotated[int, Query(ge=1, le=90)] = 7,
+    sid: Annotated[str | None, Query(max_length=64)] = None,
+) -> CpsReconcileResult:
+    now = int(time.time())
+    try:
+        result = cps_repo.reconcile_orders(
+            db, start_time=now - days * 86400, end_time=now, sid=sid,
+        )
+    except MeituanCpsError as e:
+        raise HTTPException(status_code=502, detail=f"美团拉单失败: {e}") from e
+    write_audit(
+        db, admin, action="cps.order.reconcile", target_type="cps_order", target_id=None,
+        detail={"days": days, "sid": sid, **result}, ip=get_client_ip(request), commit=True,
+    )
+    return CpsReconcileResult(**result)
+
+
+@router.get("/orders", response_model=CursorPage[CpsOrderOut], summary="订单明细")
+def list_orders(
+    db: AdminDb,
+    sid: Annotated[str | None, Query(max_length=64)] = None,
+    mt_status: Annotated[str | None, Query(max_length=8)] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[CpsOrderOut]:
+    items, next_cursor, total = cps_repo.list_orders(
+        db, sid=sid, mt_status=mt_status, limit=limit, cursor=cursor
+    )
+    return CursorPage(
+        items=[CpsOrderOut.model_validate(o) for o in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+# ───────────── 统计 ─────────────
+@router.get("/stats", response_model=CpsStatsOut, summary="按群对账统计")
+def get_stats(
+    db: AdminDb,
+    days: Annotated[int, Query(ge=1, le=90)] = 30,
+) -> CpsStatsOut:
+    date_to = datetime.now(timezone.utc)
+    date_from = date_to - timedelta(days=days)
+    rows = cps_repo.group_stats(db, date_from=date_from, date_to=date_to)
+    stats = [CpsGroupStat(**r) for r in rows]
+    return CpsStatsOut(
+        groups=stats,
+        total_order_count=sum(s.order_count for s in stats),
+        total_est_commission_cents=sum(s.est_commission_cents for s in stats),
+        total_settled_commission_cents=sum(s.settled_commission_cents for s in stats),
+    )

app/admin/routers/feedback.py

@@ -1,6 +1,7 @@
-"""admin 反馈工单:列表(读)+ 标记已处理(写,带审计)。"""
+"""admin 反馈工单:列表(读,支持 状态/用户ID/内容/时间 筛选 + 排序)+ 标记已处理(写,带审计)。"""
 from __future__ import annotations
 
+from datetime import datetime
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
@@ -25,14 +26,30 @@ def list_feedbacks(
     db: AdminDb,
     status: Annotated[str | None, Query()] = None,
     user_id: Annotated[int | None, Query()] = None,
+    content: Annotated[str | None, Query(max_length=100)] = None,
+    created_from: Annotated[datetime | None, Query()] = None,
+    created_to: Annotated[datetime | None, Query()] = None,
+    sort_by: Annotated[str, Query(pattern="^(id|created_at)$")] = "id",
+    sort_order: Annotated[str, Query(pattern="^(asc|desc)$")] = "desc",
     limit: Annotated[int, Query(ge=1, le=100)] = 20,
     cursor: Annotated[int | None, Query()] = None,
 ) -> CursorPage[FeedbackOut]:
-    items, next_cursor = queries.list_feedbacks(
-        db, status=status, user_id=user_id, limit=limit, cursor=cursor,
+    items, next_cursor, total = queries.list_feedbacks(
+        db,
+        status=status,
+        user_id=user_id,
+        content=content,
+        created_from=created_from,
+        created_to=created_to,
+        sort_by=sort_by,
+        sort_order=sort_order,
+        limit=limit,
+        cursor=cursor,
     )
     return CursorPage(
-        items=[FeedbackOut.model_validate(f) for f in items], next_cursor=next_cursor,
+        items=[FeedbackOut.model_validate(f) for f in items],
+        next_cursor=next_cursor,
+        total=total,
     )
 
 

app/admin/routers/onboarding.py

@@ -0,0 +1,86 @@
+"""admin 设备维度新手引导管理:列设备 / 重置单设备 / 全部重置。
+
+背景:原 force_onboarding(运营「按用户」强制引导)客户端不认(被 onboarding_completed 压过),
+已废弃。改为直接操作 onboarding_completion(设备+账号 维度):删记录 → 该(设备,账号)的
+onboarding_completed 变 false → 客户端任何版本下次登录都重走引导。可靠、不依赖客户端实现。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import mutations, queries
+from app.admin.schemas.common import CursorPage, OkResponse
+from app.admin.schemas.onboarding import DeviceOnboardingItem, ResetAllRequest
+from app.models.admin import AdminUser
+
+router = APIRouter(
+    prefix="/admin/api/onboarding",
+    tags=["admin-onboarding"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get(
+    "/devices",
+    response_model=CursorPage[DeviceOnboardingItem],
+    summary="设备列表(按设备聚合走过引导的账号)",
+)
+def list_devices(db: AdminDb) -> CursorPage[DeviceOnboardingItem]:
+    """列出走过新手引导的设备(ANDROID_ID),按最近完成时间倒序。没走过引导的设备不在表里、
+    本就会引导,无需管理,故不列。当前全量返回(上限 500;设备量大再加分页/搜索),
+    next_cursor 恒 None。"""
+    rows = queries.list_onboarding_devices(db)
+    return CursorPage(
+        items=[DeviceOnboardingItem(**r) for r in rows],
+        next_cursor=None,
+    )
+
+
+@router.post(
+    "/devices/{device_id}/reset",
+    response_model=OkResponse,
+    summary="重置单个设备(该设备所有账号下次重走引导)",
+)
+def reset_device(
+    device_id: str,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    """删该设备的全部 onboarding 完成记录 → 该设备上所有账号下次登录重走引导。"""
+    # 业务写 + 审计写同一事务(commit=False),最后一起 commit(同 users 各写接口)
+    deleted = mutations.delete_device_onboarding(db, device_id, commit=False)
+    write_audit(
+        db, admin, action="device_onboarding.reset", target_type="device", target_id=device_id,
+        detail={"deleted_rows": deleted}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post(
+    "/reset-all",
+    response_model=OkResponse,
+    summary="全部重设(清空所有设备引导记录)",
+)
+def reset_all(
+    body: ResetAllRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    """清空 onboarding_completion 表 → 所有用户在所有设备下次登录都重走引导。
+    需 confirm=true 防误触(前端另有二次确认弹窗)。"""
+    if not body.confirm:
+        raise HTTPException(status_code=400, detail="需 confirm=true 确认")
+    deleted = mutations.delete_all_onboarding(db, commit=False)
+    write_audit(
+        db, admin, action="device_onboarding.reset_all", target_type="onboarding", target_id=None,
+        detail={"deleted_rows": deleted}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()

app/admin/routers/ops_marquee_seed.py

@@ -12,6 +12,8 @@ from fastapi import APIRouter, Depends, HTTPException, Query, Request
 from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
 from app.admin.schemas.ops_marquee_seed import (
+    OpsMarqueeSeedBatchDelete,
+    OpsMarqueeSeedBatchEnable,
     OpsMarqueeSeedBulkCreate,
     OpsMarqueeSeedCreate,
     OpsMarqueeSeedOut,
@@ -111,6 +113,40 @@ def bulk_generate(
     return [_out(s) for s in seeds]
 
 
+@router.post("/batch-delete", summary="批量删除种子(带审计)")
+def batch_delete_seeds(
+    body: OpsMarqueeSeedBatchDelete,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> dict:
+    n = ops_marquee.batch_delete(db, body.ids, commit=False)
+    write_audit(
+        db, admin, action="ops_marquee_seed.batch_delete", target_type="ops_marquee_seed",
+        target_id=None, detail={"ids": body.ids, "deleted": n},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return {"deleted": n}
+
+
+@router.post("/batch-enable", summary="批量启用 / 停用种子(带审计)")
+def batch_enable_seeds(
+    body: OpsMarqueeSeedBatchEnable,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> dict:
+    n = ops_marquee.batch_set_enabled(db, body.ids, body.enabled, commit=False)
+    write_audit(
+        db, admin, action="ops_marquee_seed.batch_enable", target_type="ops_marquee_seed",
+        target_id=None, detail={"ids": body.ids, "enabled": body.enabled, "updated": n},
+        ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return {"updated": n}
+
+
 @router.patch("/{seed_id}", response_model=OpsMarqueeSeedOut, summary="改轮播种子(带审计)")
 def update_seed(
     seed_id: int,

app/admin/routers/price_report.py

@@ -0,0 +1,107 @@
+"""admin 上报更低价审核:列表 + 统计(读)+ 通过(发金币)/拒绝(写,带审计)。
+
+数据由客户端 POST /api/v1/report 写入 price_report 表(提交即 pending);本路由是运营后台
+对它的人工审核窗口。**通过** → 给上报用户钱包发固定金币(PRICE_REPORT_REWARD_COINS):
+改状态 + 发金币(wallet.grant_coins)+ 审计同一事务一起 commit(原子,仿 users.grant_user_coins),
+绝不只改状态不发钱或反之。客户端轮询 GET /api/v1/report/records 自动看到结果(无需推送)。
+"""
+from __future__ import annotations
+
+from typing import Annotated
+
+from fastapi import APIRouter, Depends, HTTPException, Query, Request
+
+from app.admin.audit import write_audit
+from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
+from app.admin.repositories import mutations, queries
+from app.admin.schemas.common import CursorPage, OkResponse
+from app.admin.schemas.price_report import (
+    PriceReportOut,
+    PriceReportRejectRequest,
+    PriceReportSummary,
+)
+from app.core.rewards import PRICE_REPORT_REWARD_COINS
+from app.models.admin import AdminUser
+from app.models.price_report import PriceReport
+from app.repositories import wallet as wallet_repo
+
+router = APIRouter(
+    prefix="/admin/api/price-reports",
+    tags=["admin-price-report"],
+    dependencies=[Depends(get_current_admin)],
+)
+
+
+@router.get("", response_model=CursorPage[PriceReportOut], summary="上报更低价列表(筛选+分页)")
+def list_price_reports(
+    db: AdminDb,
+    status: Annotated[str | None, Query()] = None,
+    user_id: Annotated[int | None, Query()] = None,
+    limit: Annotated[int, Query(ge=1, le=100)] = 20,
+    cursor: Annotated[int | None, Query()] = None,
+) -> CursorPage[PriceReportOut]:
+    items, next_cursor, total = queries.list_price_reports(
+        db, status=status, user_id=user_id, limit=limit, cursor=cursor,
+    )
+    return CursorPage(
+        items=[PriceReportOut.model_validate(r) for r in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+@router.get("/summary", response_model=PriceReportSummary, summary="上报审核统计(各状态计数)")
+def price_report_summary(db: AdminDb) -> PriceReportSummary:
+    return PriceReportSummary.model_validate(queries.price_report_summary(db))
+
+
+@router.post("/{report_id}/approve", response_model=OkResponse, summary="通过上报(发固定金币)")
+def approve_price_report(
+    report_id: int,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    # 行锁(SELECT FOR UPDATE):并发/连点双请求会都读到 pending → 各发一次金币双倍发奖,
+    # 锁住该行串行化,第二个请求拿锁后看到 approved → 走 400。SQLite 下 FOR UPDATE 为 no-op。
+    rep = db.get(PriceReport, report_id, with_for_update=True)
+    if rep is None:
+        raise HTTPException(status_code=404, detail="上报记录不存在")
+    if rep.status != "pending":
+        raise HTTPException(status_code=400, detail=f"该上报已审核过(当前 {rep.status}),不可重复操作")
+    coins = PRICE_REPORT_REWARD_COINS
+    # 改状态 + 发金币 + 审计同一事务(commit=False),最后一起 commit:改了就有痕、发了就留账
+    mutations.review_price_report(db, rep, status="approved", reward_coins=coins, commit=False)
+    wallet_repo.grant_coins(
+        db, rep.user_id, coins,
+        biz_type="price_report_reward", ref_id=str(rep.id), remark="上报更低价审核通过",
+    )
+    write_audit(
+        db, admin, action="price_report.approve", target_type="price_report", target_id=report_id,
+        detail={"reward_coins": coins, "user_id": rep.user_id}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post("/{report_id}/reject", response_model=OkResponse, summary="拒绝上报")
+def reject_price_report(
+    report_id: int,
+    body: PriceReportRejectRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    rep = db.get(PriceReport, report_id, with_for_update=True)  # 行锁,同 approve(防并发重复审核)
+    if rep is None:
+        raise HTTPException(status_code=404, detail="上报记录不存在")
+    if rep.status != "pending":
+        raise HTTPException(status_code=400, detail=f"该上报已审核过(当前 {rep.status}),不可重复操作")
+    reason = body.reason.strip()
+    mutations.review_price_report(db, rep, status="rejected", reject_reason=reason, commit=False)
+    write_audit(
+        db, admin, action="price_report.reject", target_type="price_report", target_id=report_id,
+        detail={"reason": reason, "user_id": rep.user_id}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()

app/admin/routers/users.py

@@ -1,6 +1,7 @@
 """admin 用户管理:列表 + 360 详情(读)+ 封禁/解封 + 手动调金币(写,带审计)。"""
 from __future__ import annotations
 
+from datetime import datetime
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
@@ -12,7 +13,9 @@ from app.admin.schemas.common import CursorPage, OkResponse
 from app.admin.schemas.user import (
     AdminUserListItem,
     AdminUserOverview,
+    GrantCashRequest,
     GrantCoinsRequest,
+    SetDebugTraceRequest,
     SetUserStatusRequest,
 )
 from app.models.admin import AdminUser
@@ -26,22 +29,32 @@ router = APIRouter(
 )
 
 
-@router.get("", response_model=CursorPage[AdminUserListItem], summary="用户列表(筛选+分页)")
+@router.get("", response_model=CursorPage[AdminUserListItem], summary="用户列表(筛选+排序+分页)")
 def list_users(
     db: AdminDb,
     phone: Annotated[str | None, Query()] = None,
     register_channel: Annotated[str | None, Query()] = None,
     status: Annotated[str | None, Query()] = None,
+    nickname: Annotated[str | None, Query(max_length=100)] = None,
+    created_from: Annotated[datetime | None, Query()] = None,
+    created_to: Annotated[datetime | None, Query()] = None,
+    last_login_from: Annotated[datetime | None, Query()] = None,
+    last_login_to: Annotated[datetime | None, Query()] = None,
+    sort_by: Annotated[str, Query(pattern="^(id|created_at|last_login_at)$")] = "id",
+    sort_order: Annotated[str, Query(pattern="^(asc|desc)$")] = "desc",
     limit: Annotated[int, Query(ge=1, le=100)] = 20,
     cursor: Annotated[int | None, Query()] = None,
 ) -> CursorPage[AdminUserListItem]:
-    items, next_cursor = queries.list_users(
+    items, next_cursor, total = queries.list_users(
         db, phone=phone, register_channel=register_channel, status=status,
-        limit=limit, cursor=cursor,
+        nickname=nickname, created_from=created_from, created_to=created_to,
+        last_login_from=last_login_from, last_login_to=last_login_to,
+        sort_by=sort_by, sort_order=sort_order, limit=limit, cursor=cursor,
     )
     return CursorPage(
         items=[AdminUserListItem.model_validate(u) for u in items],
         next_cursor=next_cursor,
+        total=total,
     )
 
 
@@ -77,7 +90,29 @@ def set_user_status(
     return OkResponse()
 
 
-@router.post("/{user_id}/coins", response_model=OkResponse, summary="手动增减金币(带审计)")
+@router.post("/{user_id}/debug-trace", response_model=OkResponse, summary="开关调试链接权限")
+def set_user_debug_trace(
+    user_id: int,
+    body: SetDebugTraceRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("operator"))],
+    db: AdminDb,
+) -> OkResponse:
+    user = user_repo.get_user_by_id(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    before = user.debug_trace_enabled
+    # 业务写 + 审计写同一事务(commit=False),最后一起 commit(同 set_user_status)
+    mutations.set_user_debug_trace(db, user, enabled=body.enabled, commit=False)
+    write_audit(
+        db, admin, action="user.debug_trace.set", target_type="user", target_id=user_id,
+        detail={"before": before, "after": body.enabled}, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post("/{user_id}/coins", response_model=OkResponse, summary="手动增减/设值金币(带审计)")
 def grant_user_coins(
     user_id: int,
     body: GrantCoinsRequest,
@@ -85,27 +120,97 @@ def grant_user_coins(
     admin: Annotated[AdminUser, Depends(require_role("finance"))],
     db: AdminDb,
 ) -> OkResponse:
-    if body.amount == 0:
-        raise HTTPException(status_code=400, detail="amount 不能为 0")
     user = user_repo.get_user_by_id(db, user_id)
     if user is None:
         raise HTTPException(status_code=404, detail="用户不存在")
-    # 负数扣减时不允许扣成负余额(运营误操作保护)
-    if body.amount < 0:
-        acc_now = wallet_repo.get_or_create_account(db, user_id, commit=False)
-        if acc_now.coin_balance + body.amount < 0:
-            raise HTTPException(
-                status_code=400, detail=f"扣减后金币为负(当前余额 {acc_now.coin_balance})"
-            )
-    biz_type = "admin_grant" if body.amount > 0 else "admin_deduct"
+    # set=设为目标值:读当前余额算出要写的差值,仍复用 grant_coins 写一笔流水(沿用原子/审计/扣负保护)
+    if body.mode == "set":
+        if body.amount < 0:
+            raise HTTPException(status_code=400, detail="目标金币值不能为负")
+        # lock=True:锁账户行,防连点/并发各读同一 before 算同一 delta 双写,余额错位
+        before = wallet_repo.get_or_create_account(db, user_id, commit=False, lock=True).coin_balance
+        delta = body.amount - before
+        if delta == 0:
+            raise HTTPException(status_code=400, detail=f"当前金币已为 {body.amount},无需调整")
+    else:
+        if body.amount == 0:
+            raise HTTPException(status_code=400, detail="amount 不能为 0")
+        delta = body.amount
+        # 负数扣减时不允许扣成负余额(运营误操作保护);lock=True 防并发扣穿
+        if delta < 0:
+            acc_now = wallet_repo.get_or_create_account(db, user_id, commit=False, lock=True)
+            if acc_now.coin_balance + delta < 0:
+                raise HTTPException(
+                    status_code=400, detail=f"扣减后金币为负(当前余额 {acc_now.coin_balance})"
+                )
+    biz_type = "admin_grant" if delta > 0 else "admin_deduct"
     # grant_coins 只 flush 不 commit;审计同 commit=False;最后一起 commit → 原子(改钱+留痕)
     acc, _ = wallet_repo.grant_coins(
-        db, user_id, body.amount, biz_type=biz_type, remark=f"admin:{body.reason}"[:128],
+        db, user_id, delta, biz_type=biz_type, remark=f"admin:{body.reason}"[:128],
     )
+    detail = {"amount": delta, "balance_after": acc.coin_balance, "reason": body.reason}
+    if body.mode == "set":
+        detail.update({"mode": "set", "target": body.amount, "before": before})
     write_audit(
         db, admin, action="user.coins.grant", target_type="user", target_id=user_id,
-        detail={"amount": body.amount, "balance_after": acc.coin_balance, "reason": body.reason},
-        ip=get_client_ip(request), commit=False,
+        detail=detail, ip=get_client_ip(request), commit=False,
+    )
+    db.commit()
+    return OkResponse()
+
+
+@router.post("/{user_id}/cash", response_model=OkResponse, summary="手动增减/设值现金(带审计)")
+def grant_user_cash(
+    user_id: int,
+    body: GrantCashRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> OkResponse:
+    """给指定用户增/减或设值现金(分)。delta:正=发放、负=扣减;set:直接设为目标值。
+    主要用于让无现金用户直接测试提现。"""
+    user = user_repo.get_user_by_id(db, user_id)
+    if user is None:
+        raise HTTPException(status_code=404, detail="用户不存在")
+    # set=设为目标值:读当前余额算差值,仍复用 grant_cash 写一笔流水(沿用原子/审计/扣负保护)
+    if body.mode == "set":
+        if body.amount_cents < 0:
+            raise HTTPException(status_code=400, detail="目标现金值不能为负")
+        # lock=True:锁账户行,防连点/并发各读同一 before 算同一 delta 双写,余额错位
+        before = wallet_repo.get_or_create_account(
+            db, user_id, commit=False, lock=True
+        ).cash_balance_cents
+        delta = body.amount_cents - before
+        if delta == 0:
+            raise HTTPException(
+                status_code=400, detail=f"当前现金已为 {body.amount_cents} 分,无需调整"
+            )
+    else:
+        if body.amount_cents == 0:
+            raise HTTPException(status_code=400, detail="amount_cents 不能为 0")
+        delta = body.amount_cents
+        # 负数扣减时不允许扣成负余额(运营误操作保护);lock=True 防并发扣穿
+        if delta < 0:
+            acc_now = wallet_repo.get_or_create_account(db, user_id, commit=False, lock=True)
+            if acc_now.cash_balance_cents + delta < 0:
+                raise HTTPException(
+                    status_code=400, detail=f"扣减后现金为负(当前余额 {acc_now.cash_balance_cents} 分)"
+                )
+    biz_type = "admin_grant" if delta > 0 else "admin_deduct"
+    # grant_cash 只 flush 不 commit;审计同 commit=False;最后一起 commit → 原子(改钱+留痕)
+    acc, _ = wallet_repo.grant_cash(
+        db, user_id, delta, biz_type=biz_type, remark=f"admin:{body.reason}"[:128],
+    )
+    detail = {
+        "amount_cents": delta,
+        "balance_after_cents": acc.cash_balance_cents,
+        "reason": body.reason,
+    }
+    if body.mode == "set":
+        detail.update({"mode": "set", "target_cents": body.amount_cents, "before_cents": before})
+    write_audit(
+        db, admin, action="user.cash.grant", target_type="user", target_id=user_id,
+        detail=detail, ip=get_client_ip(request), commit=False,
     )
     db.commit()
     return OkResponse()

app/admin/routers/withdraw.py

@@ -6,6 +6,7 @@
 """
 from __future__ import annotations
 
+from datetime import datetime
 from typing import Annotated
 
 from fastapi import APIRouter, Depends, HTTPException, Query, Request
@@ -14,9 +15,26 @@ from app.admin.audit import write_audit
 from app.admin.deps import AdminDb, get_client_ip, get_current_admin, require_role
 from app.admin.repositories import queries
 from app.admin.schemas.common import CursorPage
-from app.admin.schemas.wallet import ReconcileResult, WithdrawOrderOut, WithdrawRejectRequest
+from app.admin.schemas.admin import AdminAuditLogOut
+from app.admin.schemas.wallet import (
+    CashTxnOut,
+    ReconcileResult,
+    WithdrawBulkRejectRequest,
+    WithdrawBulkRequest,
+    WithdrawBulkResult,
+    WithdrawBulkItemResult,
+    WithdrawDetailOut,
+    WithdrawLedgerCheckOut,
+    WithdrawOrderOut,
+    WithdrawRejectRequest,
+    WithdrawSummaryOut,
+    WithdrawUserSnapshot,
+    WxpayHealthCheckOut,
+)
+from app.core.config import settings
 from app.integrations import wxpay
 from app.models.admin import AdminUser
+from app.repositories import app_config
 from app.repositories import wallet as wallet_repo
 
 router = APIRouter(
@@ -31,14 +49,154 @@ def list_withdraws(
     db: AdminDb,
     user_id: Annotated[int | None, Query()] = None,
     status: Annotated[str | None, Query()] = None,
+    keyword: Annotated[str | None, Query(max_length=100)] = None,
+    date_from: Annotated[datetime | None, Query()] = None,
+    date_to: Annotated[datetime | None, Query()] = None,
+    date_field: Annotated[str, Query(pattern="^(created_at|updated_at)$")] = "created_at",
+    sort_by: Annotated[
+        str, Query(pattern="^(id|created_at|updated_at|amount_cents)$")
+    ] = "created_at",
+    sort_order: Annotated[str, Query(pattern="^(asc|desc)$")] = "desc",
+    quick_filter: Annotated[
+        str | None,
+        Query(pattern="^(abnormal|failed|overdue_reviewing|pending_overdue|today|high_risk)$"),
+    ] = None,
     limit: Annotated[int, Query(ge=1, le=100)] = 20,
     cursor: Annotated[int | None, Query()] = None,
 ) -> CursorPage[WithdrawOrderOut]:
-    items, next_cursor = queries.list_all_withdraw_orders(
-        db, user_id=user_id, status=status, limit=limit, cursor=cursor,
+    items, next_cursor, total = queries.list_all_withdraw_orders(
+        db,
+        user_id=user_id,
+        status=status,
+        keyword=keyword,
+        date_from=date_from,
+        date_to=date_to,
+        date_field=date_field,
+        sort_by=sort_by,
+        sort_order=sort_order,
+        quick_filter=quick_filter,
+        limit=limit,
+        cursor=cursor,
     )
     return CursorPage(
-        items=[WithdrawOrderOut.model_validate(o) for o in items], next_cursor=next_cursor,
+        items=[WithdrawOrderOut.model_validate(o) for o in items],
+        next_cursor=next_cursor,
+        total=total,
+    )
+
+
+@router.get("/summary", response_model=WithdrawSummaryOut, summary="提现审核台统计")
+def withdraws_summary(db: AdminDb) -> WithdrawSummaryOut:
+    return WithdrawSummaryOut(**queries.withdraw_summary(db))
+
+
+@router.get(
+    "/health-check",
+    response_model=WxpayHealthCheckOut,
+    summary="提现配置健康检查",
+    dependencies=[Depends(require_role("finance"))],  # 暴露密钥路径/配置,限财务+super
+)
+def withdraw_health_check(db: AdminDb) -> WxpayHealthCheckOut:
+    private_path = wxpay._resolve_config_path(settings.WXPAY_MCH_PRIVATE_KEY_PATH)  # noqa: SLF001
+    public_path = wxpay._resolve_config_path(settings.WXPAY_PUBLIC_KEY_PATH)  # noqa: SLF001
+    issues: list[str] = []
+
+    private_loadable = False
+    public_loadable = False
+    try:
+        wxpay._load_private_key()  # noqa: SLF001
+        private_loadable = True
+    except Exception as e:  # noqa: BLE001
+        issues.append(f"商户私钥不可用:{e}")
+    try:
+        wxpay._load_public_key()  # noqa: SLF001
+        public_loadable = True
+    except Exception as e:  # noqa: BLE001
+        issues.append(f"微信支付平台公钥不可用:{e}")
+
+    if not settings.wxpay_configured:
+        issues.append("微信支付基础配置不完整")
+    if not settings.WXPAY_AUTH_NOTIFY_URL:
+        issues.append("免确认授权回调地址未配置")
+
+    # 实际是否自动对账 = env 部署总闸(worker 起没起)AND 运营后台 DB 开关(本轮跑不跑)。
+    worker_running = settings.WITHDRAW_AUTO_RECONCILE_ENABLED
+    daily_on = bool(app_config.get_value(db, "withdraw_auto_reconcile_enabled"))
+    auto_reconcile_enabled = worker_running and daily_on
+    if not worker_running:
+        issues.append("自动对账 worker 未启动(部署侧 env WITHDRAW_AUTO_RECONCILE_ENABLED=false)")
+    elif not daily_on:
+        issues.append("自动对账运营开关已关闭(系统配置页可开)")
+
+    return WxpayHealthCheckOut(
+        ok=not issues,
+        wxpay_configured=settings.wxpay_configured,
+        wxpay_auth_configured=settings.wxpay_auth_configured,
+        private_key_path=str(private_path),
+        private_key_exists=private_path.exists(),
+        private_key_loadable=private_loadable,
+        public_key_path=str(public_path),
+        public_key_exists=public_path.exists(),
+        public_key_loadable=public_loadable,
+        auth_notify_url_configured=bool(settings.WXPAY_AUTH_NOTIFY_URL),
+        auto_reconcile_enabled=auto_reconcile_enabled,
+        auto_reconcile_interval_sec=settings.WITHDRAW_AUTO_RECONCILE_INTERVAL_SEC,
+        auto_reconcile_older_than_minutes=settings.WITHDRAW_AUTO_RECONCILE_OLDER_THAN_MINUTES,
+        issues=issues,
+    )
+
+
+@router.get("/ledger-check", response_model=WithdrawLedgerCheckOut, summary="提现资金账本校验")
+def withdraw_ledger_check(db: AdminDb) -> WithdrawLedgerCheckOut:
+    return WithdrawLedgerCheckOut(**queries.withdraw_ledger_check(db))
+
+
+@router.get("/{out_bill_no}", response_model=WithdrawDetailOut, summary="提现单详情")
+def withdraw_detail(out_bill_no: str, db: AdminDb) -> WithdrawDetailOut:
+    order = queries.get_withdraw_by_out_bill_no(db, out_bill_no)
+    if order is None:
+        raise HTTPException(status_code=404, detail="提现单不存在")
+
+    overview = queries.get_user_overview(db, order.user_id)
+    user_snapshot = None
+    if overview is not None:
+        user = overview["user"]
+        user_snapshot = WithdrawUserSnapshot(
+            id=user.id,
+            phone=user.phone,
+            nickname=user.nickname,
+            status=user.status,
+            wechat_nickname=user.wechat_nickname,
+            wechat_avatar_url=user.wechat_avatar_url,
+            created_at=user.created_at,
+            last_login_at=user.last_login_at,
+            cash_balance_cents=overview["cash_balance_cents"],
+            withdraw_total=overview["withdraw_total"],
+            withdraw_success_cents=overview["withdraw_success_cents"],
+        )
+
+    recent_withdraws, _, _ = queries.list_all_withdraw_orders(
+        db, user_id=order.user_id, limit=5, cursor=None,
+    )
+    recent_cash_transactions, _ = queries.list_all_cash_transactions(
+        db, user_id=order.user_id, limit=8, cursor=None,
+    )
+    audit_logs = queries.list_withdraw_audit_logs(db, out_bill_no, limit=10)
+    risk_flags, risk_score = queries.withdraw_risk_flags(
+        order,
+        overview["user"] if overview else None,
+        recent_withdraws,
+        overview["cash_balance_cents"] if overview else 0,
+    )
+
+    return WithdrawDetailOut(
+        order=WithdrawOrderOut.model_validate(order),
+        user=user_snapshot,
+        risk_flags=risk_flags,
+        risk_score=risk_score,
+        recent_withdraws=[WithdrawOrderOut.model_validate(o) for o in recent_withdraws],
+        recent_cash_transactions=[CashTxnOut.model_validate(t) for t in recent_cash_transactions],
+        audit_logs=[AdminAuditLogOut.model_validate(log) for log in audit_logs],
     )
 
 
@@ -61,6 +219,159 @@ def reconcile(
     return ReconcileResult(**result)
 
 
+def _bulk_result(items: list[WithdrawBulkItemResult]) -> WithdrawBulkResult:
+    success = sum(1 for item in items if item.ok)
+    return WithdrawBulkResult(
+        total=len(items),
+        success=success,
+        failed=len(items) - success,
+        items=items,
+    )
+
+
+@router.post("/bulk/refresh", response_model=WithdrawBulkResult, summary="批量刷新查单")
+def bulk_refresh_withdraws(
+    body: WithdrawBulkRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawBulkResult:
+    results: list[WithdrawBulkItemResult] = []
+    ip = get_client_ip(request)
+    for out_bill_no in body.out_bill_nos:
+        try:
+            order = queries.get_withdraw_by_out_bill_no(db, out_bill_no)
+            if order is None:
+                raise wallet_repo.WithdrawOrderNotFound
+            refreshed = wallet_repo.refresh_withdraw_status(
+                db, order.user_id, out_bill_no, cancel_if_unconfirmed=True,
+            )
+            write_audit(
+                db, admin, action="withdraw.refresh", target_type="withdraw",
+                target_id=out_bill_no,
+                detail={
+                    "status": refreshed.status,
+                    "wechat_state": refreshed.wechat_state,
+                    "fail_reason": refreshed.fail_reason,
+                    "bulk": True,
+                },
+                ip=ip, commit=True,
+            )
+            results.append(
+                WithdrawBulkItemResult(
+                    out_bill_no=out_bill_no, ok=True, status=refreshed.status
+                )
+            )
+        except wallet_repo.WithdrawOrderNotFound:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="提现单不存在")
+            )
+        except wxpay.WxPayNotConfiguredError:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="微信支付未配置")
+            )
+        except Exception as e:  # noqa: BLE001 - 批量操作单笔失败不打断整批
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=f"系统异常: {e}")
+            )
+    return _bulk_result(results)
+
+
+@router.post("/bulk/approve", response_model=WithdrawBulkResult, summary="批量审核通过并打款")
+def bulk_approve_withdraws(
+    body: WithdrawBulkRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawBulkResult:
+    results: list[WithdrawBulkItemResult] = []
+    ip = get_client_ip(request)
+    for out_bill_no in body.out_bill_nos:
+        try:
+            order = wallet_repo.approve_withdraw(db, out_bill_no)
+            write_audit(
+                db, admin, action="withdraw.approve", target_type="withdraw",
+                target_id=out_bill_no,
+                detail={
+                    "status": order.status,
+                    "wechat_state": order.wechat_state,
+                    "amount_cents": order.amount_cents,
+                    "bulk": True,
+                },
+                ip=ip, commit=True,
+            )
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=True, status=order.status)
+            )
+        except wallet_repo.WithdrawOrderNotFound:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="提现单不存在")
+            )
+        except wallet_repo.WithdrawNotReviewable as e:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=str(e))
+            )
+        except wxpay.WxPayNotConfiguredError:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="微信支付未配置")
+            )
+        except Exception as e:  # noqa: BLE001 - 批量操作单笔失败不打断整批
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=f"系统异常: {e}")
+            )
+    return _bulk_result(results)
+
+
+@router.post("/bulk/reject", response_model=WithdrawBulkResult, summary="批量审核拒绝并退款")
+def bulk_reject_withdraws(
+    body: WithdrawBulkRejectRequest,
+    request: Request,
+    admin: Annotated[AdminUser, Depends(require_role("finance"))],
+    db: AdminDb,
+) -> WithdrawBulkResult:
+    results: list[WithdrawBulkItemResult] = []
+    ip = get_client_ip(request)
+    for out_bill_no in body.out_bill_nos:
+        try:
+            order = wallet_repo.reject_withdraw(db, out_bill_no, body.reason)
+            write_audit(
+                db, admin, action="withdraw.reject", target_type="withdraw",
+                target_id=out_bill_no,
+                detail={
+                    "reason": body.reason,
+                    "amount_cents": order.amount_cents,
+                    "bulk": True,
+                },
+                ip=ip, commit=True,
+            )
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=True, status=order.status)
+            )
+        except wallet_repo.WithdrawOrderNotFound:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error="提现单不存在")
+            )
+        except wallet_repo.WithdrawNotReviewable as e:
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=str(e))
+            )
+        except Exception as e:  # noqa: BLE001 - 批量操作单笔失败不打断整批
+            db.rollback()
+            results.append(
+                WithdrawBulkItemResult(out_bill_no=out_bill_no, ok=False, error=f"系统异常: {e}")
+            )
+    return _bulk_result(results)
+
+
 @router.post("/{out_bill_no}/refresh", response_model=WithdrawOrderOut, summary="单笔重试查单")
 def refresh_withdraw(
     out_bill_no: str,
@@ -79,7 +390,11 @@ def refresh_withdraw(
         raise HTTPException(status_code=503, detail="微信支付未配置") from e
     write_audit(
         db, admin, action="withdraw.refresh", target_type="withdraw", target_id=out_bill_no,
-        detail={"status": refreshed.status, "wechat_state": refreshed.wechat_state},
+        detail={
+            "status": refreshed.status,
+            "wechat_state": refreshed.wechat_state,
+            "fail_reason": refreshed.fail_reason,
+        },
         ip=get_client_ip(request), commit=True,
     )
     return WithdrawOrderOut.model_validate(refreshed)

app/admin/schemas/ad_audit.py

@@ -0,0 +1,62 @@
+"""看广告金币审计 schemas。
+
+只读对账视图:把"看视频"(ad_reward_record)和"信息流"(ad_feed_reward_record)两类发奖记录,
+用与正式发奖相同的公式 [app.core.rewards.calculate_ad_reward_coin] 复算一遍 expected_coin,
+和实际入账的 actual_coin 对比,核对金币公式是否生效。字段 snake_case、金额按金币整数。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class AdCoinAuditRow(BaseModel):
+    """单条发奖记录的复算明细。"""
+
+    scene: str = Field(..., description="reward_video(看视频) / feed(信息流)")
+    record_id: int = Field(..., description="对应记录表主键")
+    user_id: int
+    created_at: datetime
+    status: str = Field(..., description="granted / capped / ecpm_missing")
+    ecpm: str | None = Field(None, description="本次采用的 eCPM 原始值(分/千次展示,SDK getEcpm 原值)")
+    ecpm_factor: float | None = Field(None, description="因子1(eCPM 档)")
+    units: int = Field(..., description="折算份数:看视频恒为 1;信息流 = 满 10 秒的份数")
+    lt_index_start: int | None = Field(None, description="本条占用的当日第几份(起)")
+    lt_index_end: int | None = Field(None, description="本条占用的当日第几份(止);看视频 = 起")
+    lt_factor_start: float | None = Field(None, description="因子2(LT)起值")
+    lt_factor_end: float | None = Field(None, description="因子2(LT)止值;看视频 = 起值")
+    expected_coin: int = Field(..., description="按公式复算应发金币")
+    actual_coin: int = Field(..., description="实际入账金币")
+    matched: bool = Field(..., description="复算与实发是否一致(capped/ecpm_missing 校验是否确为 0)")
+
+
+class AdCoinFormulaOut(BaseModel):
+    """当前金币公式参数(给前端展示规则参照)。"""
+
+    description: str = Field(
+        "eCPM元 = getEcpm分 ÷ 100;单份金币 = round(eCPM元 ÷ 1000 × 因子1 × 因子2 × coin_per_yuan);"
+        "因子1 按 eCPM元 判档(阈值 100/200/400 元)",
+        description="公式说明",
+    )
+    coin_per_yuan: int = Field(..., description="金币:元 汇率")
+    ecpm_unit: str = Field("分/千次展示(SDK getEcpm 原值)", description="eCPM 口径")
+    feed_unit_seconds: int = Field(..., description="信息流每多少秒折 1 份")
+    # [(因子值, 区间下限, 区间上限或 null)]
+    ecpm_factor_tiers: list[tuple[float, int, int | None]] = Field(..., description="因子1 档位表")
+    lt_factor_tiers: list[tuple[float, int, int | None]] = Field(..., description="因子2 LT 档位表")
+
+
+class AdCoinAuditOut(BaseModel):
+    """审计响应:公式参照 + 全量统计 + 明细。"""
+
+    date: str = Field(..., description="审计日期(北京时间 YYYY-MM-DD)")
+    formula: AdCoinFormulaOut
+    total: int = Field(..., description="该筛选下复算总条数(全量,不受 limit/only_mismatch 影响)")
+    mismatch_count: int = Field(
+        ..., description="全量不一致条数(=0 说明公式全部生效;在截断前统计,可信)"
+    )
+    truncated: bool = Field(
+        ..., description="展示集是否被 limit 截断(true=还有未返回的明细,请缩小范围或调大 limit)"
+    )
+    items: list[AdCoinAuditRow] = Field(..., description="展示明细;only_mismatch=true 时只含 ✗ 行")

app/admin/schemas/ad_revenue.py

@@ -0,0 +1,90 @@
+"""广告收益报表 schemas。
+
+按 用户 / 日期 / 广告类型 / 应用 / 代码位 聚合的只读报表:展示条数、收益(元)、金币、来源。
+字段 snake_case;收益按元(float),金币按整数。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class AdRevenueImpression(BaseModel):
+    """聚合行下钻的单条**展示**明细(每次广告展示一条,展开该组时展示)。"""
+
+    id: int = Field(..., description="ad_ecpm_record 主键")
+    created_at: datetime
+    ecpm: str = Field(..., description="本次展示 eCPM 原始值(分/千次展示)")
+    revenue_yuan: float = Field(..., description="本次展示预估收益(元)= eCPM元 ÷ 1000")
+    adn: str | None = Field(None, description="实际填充 ADN 子渠道(pangle/gdt…)")
+    slot_id: str | None = Field(None, description="底层 mediation rit(非我们配置的广告位 ID)")
+
+
+class AdRevenueRecord(BaseModel):
+    """聚合行下钻的单条发奖复算明细(与金币审计同源,展开该组时展示)。"""
+
+    record_id: int
+    created_at: datetime
+    status: str = Field(..., description="granted / capped / ecpm_missing")
+    ecpm: str | None = Field(None, description="本次采用的 eCPM 原始值(分/千次展示)")
+    ecpm_factor: float | None = Field(None, description="因子1(eCPM 档);非 granted 为空")
+    units: int = Field(..., description="折算份数:激励视频恒 1;信息流 = 满 10 秒份数")
+    lt_index_start: int | None = Field(None, description="本条占用「账号累计第几份」的起")
+    lt_index_end: int | None = Field(None, description="本条占用「账号累计第几份」的止;激励视频 = 起")
+    lt_factor_start: float | None = Field(None, description="因子2(LT)起值")
+    lt_factor_end: float | None = Field(None, description="因子2(LT)止值;激励视频 = 起")
+    expected_coin: int = Field(..., description="按公式复算应发金币")
+    actual_coin: int = Field(..., description="实际入账金币")
+    matched: bool = Field(..., description="复算与实发是否一致")
+
+
+class AdRevenueDaily(BaseModel):
+    """按日期汇总的一天(供前端按天趋势图;全量,不受 limit 影响)。"""
+
+    date: str = Field(..., description="北京时间 YYYY-MM-DD")
+    impressions: int = Field(..., description="当天展示条数合计")
+    revenue_yuan: float = Field(..., description="当天预估收益合计(元)")
+    expected_coin: int = Field(..., description="当天应发金币合计")
+    actual_coin: int = Field(..., description="当天实发金币合计")
+
+
+class AdRevenueRow(BaseModel):
+    """一个聚合组(report_date × user × ad_type × app_env × our_code_id)的汇总。"""
+
+    report_date: str = Field(..., description="该组所属日期(北京时间 YYYY-MM-DD)")
+    user_id: int
+    ad_type: str = Field(..., description="reward_video(激励视频) / feed(信息流) / draw(历史 Draw 信息流)")
+    app_env: str | None = Field(None, description="我们的应用:prod(傻瓜比价正式) / test(测试应用);旧数据为空")
+    our_code_id: str | None = Field(None, description="我们后台配置的代码位 ID(104xxx);旧数据为空")
+    hour: int | None = Field(None, description="北京时间小时 0–23(granularity=hour 时有值;按天为 null)")
+    impressions: int = Field(..., description="展示条数(每条广告展示一条;轮播每条各计一次)")
+    revenue_yuan: float = Field(..., description="收益(元)= Σ(eCPM元 ÷ 1000);测试应用多为 0")
+    expected_coin: int = Field(..., description="应发金币(按公式复算,与金币审计同源)")
+    actual_coin: int = Field(..., description="实发金币(实际入账,按现发奖算法)")
+    matched: bool = Field(..., description="该组应发==实发(组内任一条不符则 false)")
+    adns: list[str] = Field(default_factory=list, description="实际填充的底层 ADN 子渠道集合(如 pangle/gdt)")
+    impression_records: list[AdRevenueImpression] = Field(
+        default_factory=list,
+        description="该组逐条展示明细(时间/eCPM/收益/adn);展开下钻用,无发奖也有(只要有展示)",
+    )
+    records: list[AdRevenueRecord] = Field(
+        default_factory=list,
+        description="该组逐条发奖复算明细(eCPM/因子1/份数/LT/因子2/应发/实发/一致);展开下钻用,纯展示无发奖记录的组为空",
+    )
+
+
+class AdRevenueReportOut(BaseModel):
+    """报表响应:全量统计 + 按天趋势 + 聚合明细。"""
+
+    date_from: str = Field(..., description="报表起始日期(北京时间 YYYY-MM-DD)")
+    date_to: str = Field(..., description="报表结束日期(北京时间 YYYY-MM-DD,闭区间;单日时与 date_from 相同)")
+    daily: list[AdRevenueDaily] = Field(..., description="按日期汇总序列(全量,供按天趋势图)")
+    total: int = Field(..., description="聚合组总数(全量,不受 limit 影响)")
+    truncated: bool = Field(..., description="明细是否被 limit 截断")
+    total_impressions: int = Field(..., description="全量展示条数合计")
+    total_revenue_yuan: float = Field(..., description="全量收益合计(元)")
+    total_expected_coin: int = Field(..., description="全量应发金币合计")
+    total_actual_coin: int = Field(..., description="全量实发金币合计")
+    mismatch_count: int = Field(..., description="应发≠实发的组数(=0 说明全部按公式发放)")
+    items: list[AdRevenueRow] = Field(..., description="聚合明细(按 用户→类型→代码位 排序)")

app/admin/schemas/common.py

@@ -9,10 +9,15 @@ T = TypeVar("T")
 
 
 class CursorPage(BaseModel, Generic[T]):
-    """游标分页响应:items + 下一页游标(next_cursor=None 表示末页)。"""
+    """分页响应:items + 下一页游标(next_cursor=None 表示末页)+ 可选 total。
+
+    next_cursor:offset 分页时即下一页 offset,「加载更多」用;末页为 None。
+    total:符合筛选条件的总条数,页码分页(antd pagination)用;不需要总数的接口可不传(None)。
+    """
 
     items: list[T]
     next_cursor: int | None = None
+    total: int | None = None
 
 
 class OkResponse(BaseModel):

app/admin/schemas/config.py

@@ -10,7 +10,7 @@ class ConfigItemOut(BaseModel):
     key: str
     label: str
     group: str
-    type: str  # int / int_list / dict_str_int
+    type: str  # int / int_list / dict_str_int / bool
     help: str | None = None
     default: Any
     value: Any

app/admin/schemas/cps.py

@@ -0,0 +1,122 @@
+"""admin CPS 分发与对账 schemas。金额统一「分」(cents),前端 yuan() 展示。"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field
+
+
+# ───────────── 群(sid) ─────────────
+class CpsGroupOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    sid: str
+    name: str
+    member_count: int | None = None
+    status: str
+    remark: str | None = None
+    created_at: datetime
+
+
+class CpsGroupCreate(BaseModel):
+    name: str = Field(min_length=1, max_length=128)
+    # 留空 → 后端自动生成 g<id>;填写则必须字母+数字(美团 sid 限制)。
+    sid: str | None = Field(default=None, max_length=64, pattern=r"^[A-Za-z0-9]+$")
+    member_count: int | None = Field(default=None, ge=0)
+    remark: str | None = Field(default=None, max_length=256)
+
+
+class CpsGroupUpdate(BaseModel):
+    name: str | None = Field(default=None, min_length=1, max_length=128)
+    member_count: int | None = Field(default=None, ge=0)
+    status: str | None = Field(default=None, pattern=r"^(active|archived)$")
+    remark: str | None = Field(default=None, max_length=256)
+
+
+# ───────────── 活动(actId) ─────────────
+class CpsActivityOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    platform: str
+    name: str
+    act_id: str | None = None
+    product_view_sign: str | None = None
+    status: str
+    remark: str | None = None
+    created_at: datetime
+
+
+class CpsActivityCreate(BaseModel):
+    name: str = Field(min_length=1, max_length=128)
+    platform: str = Field(default="meituan", pattern=r"^(meituan|taobao|jd)$")
+    act_id: str | None = Field(default=None, max_length=64)
+    product_view_sign: str | None = Field(default=None, max_length=128)
+    remark: str | None = Field(default=None, max_length=256)
+
+
+# ───────────── 转链 ─────────────
+class CpsReferralLinkRequest(BaseModel):
+    group_id: int
+    activity_id: int
+    # 链接类型:1长链 2短链 3deeplink。默认短链(微信可打开)+deeplink。
+    link_types: list[int] = Field(default_factory=lambda: [2, 3])
+
+
+class CpsReferralLinkOut(BaseModel):
+    redirect_url: str  # ★ 我们的群发短链(/c/{code}),发群就用这个,点击经我们统计
+    code: str
+    sid: str
+    group_name: str
+    activity_name: str
+    target_url: str  # 实际 302 跳转的美团短链
+    link_map: dict[str, str]  # 美团原始 1长链/2短链/3deeplink(参考/备用)
+
+
+# ───────────── 对账拉单 ─────────────
+class CpsReconcileResult(BaseModel):
+    fetched: int      # 本次美团返回的订单条数
+    inserted: int     # 新入库
+    updated: int      # 已存在→更新状态/佣金
+    pages: int        # 翻了几页
+
+
+# ───────────── 订单明细 ─────────────
+class CpsOrderOut(BaseModel):
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    order_id: str
+    sid: str | None = None
+    act_id: str | None = None
+    pay_price_cents: int | None = None
+    commission_cents: int | None = None
+    commission_rate: str | None = None
+    mt_status: str | None = None
+    invalid_reason: str | None = None
+    product_name: str | None = None
+    pay_time: datetime | None = None
+
+
+# ───────────── 统计 ─────────────
+class CpsGroupStat(BaseModel):
+    group_id: int | None = None   # None = 未归群的 sid(历史/其它来源)
+    sid: str | None = None
+    name: str
+    member_count: int | None = None
+    click_pv: int = 0             # 点击总次数
+    click_uv: int = 0             # 独立点击(按 ip+ua 近似去重)
+    order_count: int              # 有效订单数(不含取消/风控)
+    settled_count: int            # 已结算单数
+    canceled_count: int           # 取消+风控单数
+    gmv_cents: int                # 成交额(有效单 payPrice 合计)
+    est_commission_cents: int     # 预估佣金(有效单 profit 合计)
+    settled_commission_cents: int  # 已结算佣金
+
+
+class CpsStatsOut(BaseModel):
+    groups: list[CpsGroupStat]
+    total_order_count: int
+    total_est_commission_cents: int
+    total_settled_commission_cents: int

app/admin/schemas/dashboard.py

@@ -14,6 +14,14 @@ class DashboardUsers(BaseModel):
 
 
 class DashboardCoins(BaseModel):
+    reward_video_coin_total: int = 0
+    reward_video_watch_count: int = 0
+    feed_ad_coin_total: int = 0
+    feed_ad_watch_count: int = 0
+    signin_coin_total: int = 0
+    signin_count: int = 0
+    signin_boost_coin_total: int = 0
+    signin_boost_watch_count: int = 0
     granted_total: int
 
 

app/admin/schemas/onboarding.py

@@ -0,0 +1,24 @@
+"""admin 设备维度新手引导管理 schemas。
+
+force_onboarding(按用户)废弃后改用「按设备」:直接操作 onboarding_completion(设备+账号 维度),
+客户端任何版本都按它判断是否走引导,故可靠。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, Field
+
+
+class DeviceOnboardingItem(BaseModel):
+    """一台设备(ANDROID_ID)的引导聚合:在该设备走过引导的账号数 + 最近完成时间。"""
+
+    device_id: str
+    account_count: int
+    last_completed_at: datetime
+
+
+class ResetAllRequest(BaseModel):
+    confirm: bool = Field(
+        False, description="必须 true 才清空全部设备的引导记录(防误调接口;前端另有二次确认弹窗)"
+    )

app/admin/schemas/ops_marquee_seed.py

@@ -4,7 +4,7 @@
 """
 from __future__ import annotations
 
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 
 
 class OpsMarqueeSeedOut(BaseModel):
@@ -42,6 +42,17 @@ class OpsMarqueeSeedBulkCreate(BaseModel):
     enabled: bool = True
 
 
+class OpsMarqueeSeedBatchDelete(BaseModel):
+    """批量删除选中的种子。"""
+    ids: list[int] = Field(..., max_length=500)  # 上限防超大列表(审计行/IN 子句过大)
+
+
+class OpsMarqueeSeedBatchEnable(BaseModel):
+    """批量启用 / 停用选中的种子。"""
+    ids: list[int] = Field(..., max_length=500)
+    enabled: bool
+
+
 class OpsSavingsFeedPreviewItem(BaseModel):
     masked_user: str
     saved_amount_cents: int

app/admin/schemas/ops_stat_config.py

@@ -20,7 +20,7 @@ class OpsStatItemOut(BaseModel):
     random_kind: str  # mult(×倍率) / add(+绝对增量)
     random_step_min: int  # 绝对增量区间(基础单位;total_saved 为分)
     random_step_max: int
-    real_offset: int  # 真实值模式基数偏移(基础单位)
+    real_offset: int  # 真实值模式保底值(基础单位):展示=max(真实,保底)。列名沿用 real_offset
     allow_decrease: bool  # 是否允许展示值下降(默认 false = 只增不减)
     random_current: int | None = None
     random_last_tick_at: str | None = None

app/admin/schemas/price_report.py

@@ -0,0 +1,54 @@
+"""admin 上报更低价审核 schemas。"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from pydantic import BaseModel, ConfigDict, Field, field_validator
+
+
+class PriceReportOut(BaseModel):
+    """admin 列表项:price_report 全字段(审核要看的快照 + 截图 + 状态 + 奖励)。"""
+
+    model_config = ConfigDict(from_attributes=True)
+
+    id: int
+    user_id: int
+    comparison_record_id: int | None = None
+    # 选中比价记录的快照
+    store_name: str | None = None
+    dish_summary: str | None = None
+    original_platform_id: str | None = None
+    original_platform_name: str | None = None
+    original_price_cents: int | None = None
+    # 用户上报的更低价
+    reported_platform_id: str
+    reported_platform_name: str
+    reported_price_cents: int
+    images: list[str] = []
+    # 审核
+    status: str
+    reject_reason: str | None = None
+    reward_coins: int | None = None
+    reviewed_at: datetime | None = None
+    created_at: datetime
+
+
+class PriceReportRejectRequest(BaseModel):
+    reason: str = Field(min_length=1, max_length=256, description="拒绝理由,用户端记录页会看到")
+
+    @field_validator("reason")
+    @classmethod
+    def _reason_not_blank(cls, v: str) -> str:
+        # min_length=1 放过纯空白(" "),trim 后再校验非空,避免审计/用户端记录到空理由
+        if not v.strip():
+            raise ValueError("拒绝理由不能为空")
+        return v.strip()
+
+
+class PriceReportSummary(BaseModel):
+    """审核台顶部各状态计数。"""
+
+    pending: int
+    approved: int
+    rejected: int
+    total: int

app/admin/schemas/user.py

@@ -4,7 +4,7 @@ from __future__ import annotations
 from datetime import datetime
 from typing import Literal
 
-from pydantic import BaseModel, ConfigDict, Field
+from pydantic import BaseModel, ConfigDict, Field, field_validator
 
 
 class AdminUserListItem(BaseModel):
@@ -15,6 +15,7 @@ class AdminUserListItem(BaseModel):
     nickname: str | None = None
     register_channel: str
     status: str
+    debug_trace_enabled: bool = False
     wechat_openid: str | None = None
     created_at: datetime
     last_login_at: datetime
@@ -36,12 +37,44 @@ class AdminUserOverview(BaseModel):
     feedback_total: int
 
 
+def _strip_reason(v: str) -> str:
+    # min_length=1 放过纯空白(" "),trim 后再校验非空,避免审计记到空原因
+    if not v.strip():
+        raise ValueError("操作原因不能为空")
+    return v.strip()
+
+
 class GrantCoinsRequest(BaseModel):
-    amount: int = Field(..., description="金币变动:正=增加,负=扣减(不可为 0)")
+    mode: Literal["delta", "set"] = Field(
+        "delta", description="delta=增减(amount 为变动量) / set=设为(amount 为目标值,须≥0)"
+    )
+    amount: int = Field(
+        ...,
+        description="delta 模式:金币变动(正=增加,负=扣减,不可为 0);set 模式:目标金币值(须≥0)",
+    )
     reason: str = Field(..., min_length=1, max_length=128, description="操作原因(必填,入审计)")
 
+    _v_reason = field_validator("reason")(_strip_reason)
+
+
+class GrantCashRequest(BaseModel):
+    mode: Literal["delta", "set"] = Field(
+        "delta", description="delta=增减(amount_cents 为变动量) / set=设为(amount_cents 为目标值,须≥0)"
+    )
+    amount_cents: int = Field(
+        ...,
+        description="delta 模式:现金变动(分,正=增加,负=扣减,不可为 0);set 模式:目标现金值(分,须≥0)",
+    )
+    reason: str = Field(..., min_length=1, max_length=128, description="操作原因(必填,入审计)")
+
+    _v_reason = field_validator("reason")(_strip_reason)
+
 
 class SetUserStatusRequest(BaseModel):
     status: Literal["active", "disabled"] = Field(
         ..., description="active=解封 / disabled=封禁(注销 deleted 不走此接口)"
     )
+
+
+class SetDebugTraceRequest(BaseModel):
+    enabled: bool = Field(..., description="是否给该用户开「复制调试链接」权限")

app/admin/schemas/wallet.py

@@ -5,6 +5,8 @@ from datetime import datetime
 
 from pydantic import BaseModel, ConfigDict, Field
 
+from app.admin.schemas.admin import AdminAuditLogOut
+
 
 class CoinTxnOut(BaseModel):
     model_config = ConfigDict(from_attributes=True)
@@ -48,11 +50,99 @@ class WithdrawOrderOut(BaseModel):
     updated_at: datetime
 
 
+class WithdrawSummaryOut(BaseModel):
+    reviewing_count: int
+    reviewing_amount_cents: int
+    pending_count: int
+    failed_count: int
+    today_success_count: int
+    today_success_amount_cents: int
+    today_rejected_count: int
+
+
+class WithdrawUserSnapshot(BaseModel):
+    id: int
+    phone: str
+    nickname: str | None = None
+    status: str
+    wechat_nickname: str | None = None
+    wechat_avatar_url: str | None = None
+    created_at: datetime
+    last_login_at: datetime
+    cash_balance_cents: int
+    withdraw_total: int
+    withdraw_success_cents: int
+
+
+class WithdrawDetailOut(BaseModel):
+    order: WithdrawOrderOut
+    user: WithdrawUserSnapshot | None = None
+    risk_flags: list[str]
+    risk_score: int
+    recent_withdraws: list[WithdrawOrderOut]
+    recent_cash_transactions: list[CashTxnOut]
+    audit_logs: list[AdminAuditLogOut]
+
+
 class ReconcileResult(BaseModel):
     checked: int
     resolved: int
 
 
+class WithdrawBulkRequest(BaseModel):
+    out_bill_nos: list[str] = Field(
+        ..., min_length=1, max_length=50, description="提现商户单号列表"
+    )
+
+
+class WithdrawBulkRejectRequest(WithdrawBulkRequest):
+    reason: str = Field(
+        ..., min_length=1, max_length=200, description="批量拒绝理由(用户可见)"
+    )
+
+
+class WithdrawBulkItemResult(BaseModel):
+    out_bill_no: str
+    ok: bool
+    status: str | None = None
+    error: str | None = None
+
+
+class WithdrawBulkResult(BaseModel):
+    total: int
+    success: int
+    failed: int
+    items: list[WithdrawBulkItemResult]
+
+
+class WithdrawLedgerCheckOut(BaseModel):
+    ok: bool
+    cash_balance_total_cents: int
+    cash_transaction_total_cents: int
+    balance_diff_cents: int
+    missing_withdraw_txn_count: int
+    missing_refund_txn_count: int
+    duplicate_refund_txn_count: int
+    refund_txn_on_non_terminal_count: int
+
+
+class WxpayHealthCheckOut(BaseModel):
+    ok: bool
+    wxpay_configured: bool
+    wxpay_auth_configured: bool
+    private_key_path: str
+    private_key_exists: bool
+    private_key_loadable: bool
+    public_key_path: str
+    public_key_exists: bool
+    public_key_loadable: bool
+    auth_notify_url_configured: bool
+    auto_reconcile_enabled: bool
+    auto_reconcile_interval_sec: int
+    auto_reconcile_older_than_minutes: int
+    issues: list[str]
+
+
 class WithdrawRejectRequest(BaseModel):
     reason: str = Field(
         ..., min_length=1, max_length=200, description="拒绝理由(写入 fail_reason,用户可见)"

app/api/internal/store.py

@@ -0,0 +1,110 @@
+"""平台店铺映射内部上报端点(pricebot → app-server)。
+
+pricebot 在淘宝比价拿到 shopId 后,把这一行跨平台店铺映射 POST 到这里落库。
+**不是给客户端的接口**:不走用户 JWT,靠 server 间共享密钥头 `X-Internal-Secret` 校验
+(复用 price.py 的 _check_secret,与 price-observation 同一密钥)。
+
+与 price.py 的 /internal/price-observation 平行:那个落价格事实,这个落店铺身份映射。
+"""
+from __future__ import annotations
+
+import logging
+
+from typing import Annotated
+
+from fastapi import APIRouter, Header
+
+from app.api.deps import DbSession
+from app.api.internal.price import _check_secret
+from app.repositories import store_mapping as repo
+from app.schemas.store_mapping import (
+    StoreMappingIn,
+    StoreMappingInvalidateIn,
+    StoreMappingInvalidateOut,
+    StoreMappingOut,
+)
+
+logger = logging.getLogger("shagua.internal.store")
+
+router = APIRouter(prefix="/internal", tags=["internal"])
+
+
+@router.get(
+    "/store-mapping/lookup",
+    summary="比价前按源平台店名反查各目标平台已沉淀的店铺 id(命中→pricebot 直接 deeplink)",
+)
+def lookup_store_mapping(
+    source_platform: str,
+    name: str,
+    db: DbSession,
+    lat: float | None = None,
+    lng: float | None = None,
+    x_internal_secret: Annotated[str | None, Header()] = None,
+) -> dict:
+    _check_secret(x_internal_secret)
+    result = repo.lookup_nearest(db, source_platform, name, lat, lng)
+    if result:
+        hits = ", ".join(
+            f"{t}:row{v['row_id']}"
+            f"{'(' + str(v['dist_km']) + 'km)' if 'dist_km' in v else ''}"
+            f"→{v.get('deeplink') or '(无deeplink)'}"
+            for t, v in result.items()
+        )
+        logger.info(
+            "store_mapping lookup source=%s name=%r geo=(%s,%s) → 命中 %s",
+            source_platform, name, lat, lng, hits,
+        )
+    else:
+        logger.info(
+            "store_mapping lookup source=%s name=%r geo=(%s,%s) → MISS",
+            source_platform, name, lat, lng,
+        )
+    return result
+
+
+@router.post(
+    "/store-mapping",
+    response_model=StoreMappingOut,
+    summary="平台店铺映射内部上报(pricebot→app-server,落 store_mapping)",
+)
+def report_store_mapping(
+    payload: StoreMappingIn,
+    db: DbSession,
+    x_internal_secret: Annotated[str | None, Header()] = None,
+) -> StoreMappingOut:
+    _check_secret(x_internal_secret)
+    created, row_id = repo.upsert(db, payload)
+    logger.info(
+        "store_mapping trace=%s %s row_id=%s source=%s "
+        "taobao=(%s,%s) jd=(%s,%s) device=%s user=%s",
+        payload.trace_id, "新建" if created else "合并", row_id, payload.source_platform,
+        payload.id_taobao, payload.name_taobao, payload.id_jd, payload.name_jd,
+        payload.source_device_id, payload.source_user_id,
+    )
+    return StoreMappingOut(inserted=created, row_id=row_id)
+
+
+@router.post(
+    "/store-mapping/invalidate",
+    response_model=StoreMappingInvalidateOut,
+    summary="标记某平台 shopId 的缓存 deeplink 失效(pricebot 撞错误页回退时上报,lookup 不再返回)",
+)
+def invalidate_store_mapping(
+    payload: StoreMappingInvalidateIn,
+    db: DbSession,
+    x_internal_secret: Annotated[str | None, Header()] = None,
+) -> StoreMappingInvalidateOut:
+    _check_secret(x_internal_secret)
+    if payload.platform == "taobao":
+        affected = repo.mark_taobao_deeplink_invalid(db, payload.shop_id)
+    elif payload.platform == "jd":
+        affected = repo.mark_jd_deeplink_invalid(db, payload.shop_id)
+    else:
+        # 当前只接淘宝/京东; 其它平台先 no-op(affected=0), 不报错 — 向后兼容 pricebot 将来扩展。
+        logger.info("store_mapping invalidate 跳过: platform=%s 暂不支持", payload.platform)
+        return StoreMappingInvalidateOut(ok=True, affected=0)
+    logger.info(
+        "store_mapping invalidate platform=%s shop_id=%s → 标记失效 %d 行",
+        payload.platform, payload.shop_id, affected,
+    )
+    return StoreMappingInvalidateOut(ok=True, affected=affected)

app/api/v1/ad.py

@@ -10,6 +10,7 @@
 from __future__ import annotations
 
 import logging
+import json
 import uuid
 
 from fastapi import APIRouter, Depends, HTTPException, Request, status
@@ -23,6 +24,7 @@ from app.repositories import ad_ecpm as crud_ecpm
 from app.repositories import ad_feed_reward as crud_feed
 from app.repositories import ad_reward as crud_ad
 from app.repositories import ad_watch as crud_watch
+from app.repositories import signin as crud_signin
 from app.schemas.ad import (
     AdRewardStatusOut,
     EcpmReportIn,
@@ -30,6 +32,9 @@ from app.schemas.ad import (
     FeedRewardIn,
     FeedRewardOut,
     PangleCallbackOut,
+    RewardNoShowIn,
+    RewardNoShowOut,
+    TestGrantIn,
     TestGrantOut,
     WatchReportIn,
     WatchReportOut,
@@ -44,6 +49,23 @@ REASON_OK = 0
 REASON_BAD_PARAMS = 1  # 验签过但缺 trans_id / user_id 非数字
 REASON_UNKNOWN_USER = 2  # user_id 不存在(可能伪造)
 
+REWARD_SCENE_REWARD_VIDEO = "reward_video"
+REWARD_SCENE_SIGNIN_BOOST = "signin_boost"
+SUPPORTED_REWARD_SCENES = {REWARD_SCENE_REWARD_VIDEO, REWARD_SCENE_SIGNIN_BOOST}
+
+
+def _parse_extra(raw_extra: str | None) -> dict[str, str]:
+    """解析客户端 setMediaExtra 透传的 JSON;旧格式/异常返回空 dict。"""
+    if not raw_extra:
+        return {}
+    try:
+        data = json.loads(raw_extra)
+    except (TypeError, ValueError):
+        return {}
+    if not isinstance(data, dict):
+        return {}
+    return {str(k): str(v) for k, v in data.items() if v is not None}
+
 
 @router.get(
     "/pangle-callback",
@@ -52,9 +74,9 @@ REASON_UNKNOWN_USER = 2  # user_id 不存在(可能伪造)
     dependencies=[Depends(rate_limit(300, 60, "pangle-callback"))],
 )
 def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
-    """穿山甲 GroMore 在激励视频播完后回调,带 user_id / trans_id / reward_amount / sign 等 query 参数。
+    """穿山甲 GroMore 在激励视频播完后回调,带 user_id / trans_id / ecpm / sign 等 query 参数。
 
-    流程:开关/密钥就绪 → 验签(SHA256(m-key:trans_id)) → 解析 user_id/reward_amount → 幂等发金币。
+    流程:开关/密钥就绪 → 验签(SHA256(m-key:trans_id)) → 解析 user_id/场景/eCPM → 幂等发金币。
     验签失败 403(留给真请求重试);参数缺/坏或 user 不存在 → is_verify=false + reason(不发,不重试)。
     granted / capped → is_verify=true + reason=0。
     """
@@ -65,7 +87,7 @@ def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
 
     params = dict(request.query_params)
 
-    if not pangle.verify_callback_sign(params, settings.PANGLE_REWARD_SECRET):
+    if not pangle.verify_callback_sign_any(params, settings.pangle_reward_secrets):
         logger.warning("pangle callback bad sign trans_id=%s", params.get("trans_id"))
         raise HTTPException(status_code=status.HTTP_403_FORBIDDEN, detail="bad sign")
 
@@ -77,19 +99,86 @@ def pangle_callback(request: Request, db: DbSession) -> PangleCallbackOut:
         return PangleCallbackOut(is_verify=False, reason=REASON_BAD_PARAMS)
 
     user_id = int(raw_user_id)
-    coin = rewards.resolve_ad_reward_coin(db, params.get("reward_amount"))
     raw = "&".join(f"{k}={v}" for k, v in sorted(params.items()) if k != "sign")
-    try:
-        rec = crud_ad.grant_ad_reward(
-            db, user_id, trans_id, coin=coin,
-            reward_name=params.get("reward_name"), raw=raw[:1024],
+    extra = {}
+    for extra_key in ("extra", "gromoreExtra", "gromore_extra"):
+        extra.update(_parse_extra(params.get(extra_key)))
+    reward_scene = extra.get("reward_scene") or REWARD_SCENE_REWARD_VIDEO
+    ad_session_id = extra.get("ad_session_id")
+    ecpm = params.get("ecpm")
+
+    existing = crud_ad.find_by_trans(db, trans_id)
+    if existing is not None:
+        logger.info(
+            "pangle callback idempotent user_id=%d trans_id=%s status=%s scene=%s",
+            user_id, trans_id, existing.status, existing.reward_scene,
         )
+        return PangleCallbackOut(is_verify=True, reason=REASON_OK)
+
+    try:
+        if reward_scene not in SUPPORTED_REWARD_SCENES:
+            rec = crud_ad.record_external_reward(
+                db, user_id, trans_id, coin=0, reward_scene=reward_scene[:32],
+                ad_session_id=ad_session_id, ecpm=ecpm,
+                reward_name=params.get("reward_name"), raw=raw[:1024],
+                status="unknown_scene",
+            )
+            logger.warning(
+                "pangle callback unknown scene user_id=%d trans_id=%s scene=%s",
+                user_id, trans_id, reward_scene,
+            )
+            return PangleCallbackOut(is_verify=False, reason=REASON_BAD_PARAMS)
+        if reward_scene == REWARD_SCENE_SIGNIN_BOOST:
+            try:
+                boost, _balance = crud_signin.boost_today_signin(
+                    db, user_id, ad_ref_id=trans_id, commit=False
+                )
+            except crud_signin.NotSignedTodayError:
+                db.rollback()
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=0, reward_scene=reward_scene,
+                    ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    status="not_signed",
+                )
+            except crud_signin.AlreadyBoostedError:
+                db.rollback()
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=0, reward_scene=reward_scene,
+                    ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    status="already_boosted",
+                )
+            except crud_signin.LastCycleDayBoostBlockedError:
+                db.rollback()
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=0, reward_scene=reward_scene,
+                    ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    status="last_day",
+                )
+            else:
+                rec = crud_ad.record_external_reward(
+                    db, user_id, trans_id, coin=boost.coin_awarded,
+                    reward_scene=reward_scene, ad_session_id=ad_session_id, ecpm=ecpm,
+                    reward_name=params.get("reward_name"), raw=raw[:1024],
+                    commit=False,
+                )
+                db.commit()
+                db.refresh(rec)
+        else:
+            rec = crud_ad.grant_ad_reward(
+                db, user_id, trans_id, ecpm=ecpm, ad_session_id=ad_session_id,
+                reward_scene=REWARD_SCENE_REWARD_VIDEO,
+                reward_name=params.get("reward_name"), raw=raw[:1024],
+            )
     except crud_ad.UnknownUserError:
         logger.warning("pangle callback unknown user_id=%d trans_id=%s", user_id, trans_id)
         return PangleCallbackOut(is_verify=False, reason=REASON_UNKNOWN_USER)
 
     logger.info(
-        "ad reward user_id=%d trans_id=%s status=%s coin=%d", user_id, trans_id, rec.status, rec.coin
+        "ad reward user_id=%d trans_id=%s scene=%s status=%s coin=%d",
+        user_id, trans_id, rec.reward_scene, rec.status, rec.coin,
     )
     # granted / capped 均算"已处理":is_verify=true 不让穿山甲重试(capped 只是没加币)
     return PangleCallbackOut(is_verify=True, reason=REASON_OK)
@@ -153,11 +242,14 @@ def ecpm_report(payload: EcpmReportIn, user: CurrentUser, db: DbSession) -> Ecpm
     crud_ecpm.create_ecpm_record(
         db, user.id,
         ad_type=payload.ad_type, ecpm_raw=payload.ecpm,
+        ad_session_id=payload.ad_session_id,
         adn=payload.adn, slot_id=payload.slot_id,
+        app_env=payload.app_env, our_code_id=payload.our_code_id,
     )
     logger.info(
-        "ad ecpm report user_id=%d type=%s ecpm=%s adn=%s slot=%s",
-        user.id, payload.ad_type, payload.ecpm, payload.adn, payload.slot_id,
+        "ad ecpm report user_id=%d type=%s session=%s ecpm=%s adn=%s slot=%s app=%s code=%s",
+        user.id, payload.ad_type, payload.ad_session_id, payload.ecpm, payload.adn, payload.slot_id,
+        payload.app_env, payload.our_code_id,
     )
     return EcpmReportOut(ok=True)
 
@@ -168,7 +260,7 @@ def ecpm_report(payload: EcpmReportIn, user: CurrentUser, db: DbSession) -> Ecpm
     summary="[仅本地联调]模拟穿山甲回调发奖",
     dependencies=[Depends(rate_limit(60, 60, "ad-test-grant"))],
 )
-def test_grant(user: CurrentUser, db: DbSession) -> TestGrantOut:
+def test_grant(user: CurrentUser, db: DbSession, payload: TestGrantIn | None = None) -> TestGrantOut:
     """⚠️ 仅本地联调用:没部署公网、穿山甲 S2S 回调打不到本地时,客户端(debug 包)看完广告后
     调这个接口,直接走与回调相同的发奖逻辑(幂等 + 每日上限),验证"看广告→金币到账"全链路。
 
@@ -178,18 +270,66 @@ def test_grant(user: CurrentUser, db: DbSession) -> TestGrantOut:
     if not settings.AD_REWARD_TEST_GRANT_ENABLED:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="not found")
 
-    # 每次新 trans_id,模拟一次独立的穿山甲发奖回调(幂等键各不相同 → 每次都发,直到当日上限)
+    reward_scene = (payload.reward_scene if payload is not None else REWARD_SCENE_REWARD_VIDEO)
+    if reward_scene not in SUPPORTED_REWARD_SCENES:
+        raise HTTPException(status_code=status.HTTP_422_UNPROCESSABLE_ENTITY, detail="bad reward_scene")
+
+    # 每次新 trans_id,模拟一次独立的穿山甲发奖回调(幂等键各不相同 → 每次都发,直到当日上限/今日膨胀一次)
     trans_id = f"test-{user.id}-{uuid.uuid4().hex}"
-    try:
-        rec = crud_ad.grant_ad_reward(
-            db, user.id, trans_id, reward_name="测试发奖", raw="client debug test-grant"
-        )
-    except crud_ad.UnknownUserError as e:
-        raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="user not found") from e
+    if reward_scene == REWARD_SCENE_SIGNIN_BOOST:
+        try:
+            boost, _balance = crud_signin.boost_today_signin(
+                db, user.id, ad_ref_id=trans_id, commit=False
+            )
+        except crud_signin.NotSignedTodayError:
+            db.rollback()
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=0, reward_scene=reward_scene,
+                raw="client debug test-grant signin_boost", status="not_signed",
+            )
+        except crud_signin.AlreadyBoostedError:
+            db.rollback()
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=0, reward_scene=reward_scene,
+                raw="client debug test-grant signin_boost", status="already_boosted",
+            )
+        except crud_signin.LastCycleDayBoostBlockedError:
+            db.rollback()
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=0, reward_scene=reward_scene,
+                raw="client debug test-grant signin_boost", status="last_day",
+            )
+        else:
+            rec = crud_ad.record_external_reward(
+                db, user.id, trans_id, coin=boost.coin_awarded,
+                reward_scene=reward_scene, reward_name="测试签到膨胀",
+                raw="client debug test-grant signin_boost", commit=False,
+            )
+            db.commit()
+            db.refresh(rec)
+    else:
+        # 优先用客户端按 ad_session_id 上报的真实 eCPM(走与正式发奖相同的公式);
+        # 取不到或 eCPM≤0(测试应用常返 0/假值)时兜底 200,保证本地联调仍能验出非零金币。
+        ad_session_id = payload.ad_session_id if payload is not None else None
+        ecpm_val = "200"
+        if ad_session_id:
+            ecpm_rec = crud_ecpm.find_by_session(db, user_id=user.id, ad_session_id=ad_session_id)
+            if ecpm_rec is not None and rewards.parse_ecpm_fen(ecpm_rec.ecpm_raw) > 0:
+                ecpm_val = ecpm_rec.ecpm_raw
+        try:
+            rec = crud_ad.grant_ad_reward(
+                db, user.id, trans_id, ecpm=ecpm_val, ad_session_id=ad_session_id,
+                reward_name="测试发奖", raw=f"client debug test-grant ecpm={ecpm_val}",
+            )
+        except crud_ad.UnknownUserError as e:
+            raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="user not found") from e
 
     (used, limit, coin_per, round_count, cooldown_until,
      _watched, _watch_limit) = crud_ad.today_status(db, user.id)
-    logger.info("ad TEST grant user_id=%d status=%s coin=%d", user.id, rec.status, rec.coin)
+    logger.info(
+        "ad TEST grant user_id=%d scene=%s status=%s coin=%d",
+        user.id, reward_scene, rec.status, rec.coin,
+    )
     return TestGrantOut(
         granted=(rec.status == "granted"),
         status=rec.status,
@@ -220,8 +360,12 @@ def feed_reward(payload: FeedRewardIn, user: CurrentUser, db: DbSession) -> Feed
         client_event_id=payload.client_event_id,
         ecpm=payload.ecpm,
         duration_seconds=payload.duration_seconds,
+        ad_session_id=payload.ad_session_id,
         adn=payload.adn,
         slot_id=payload.slot_id,
+        app_env=payload.app_env,
+        our_code_id=payload.our_code_id,
+        aborted=payload.aborted,
     )
     logger.info(
         "feed ad reward user_id=%d event=%s status=%s units=%d coin=%d",
@@ -234,3 +378,30 @@ def feed_reward(payload: FeedRewardIn, user: CurrentUser, db: DbSession) -> Feed
         unit_count=rec.unit_count,
         daily_limit=rewards.get_ad_daily_limit(db),
     )
+
+
+@router.post(
+    "/reward-noshow",
+    response_model=RewardNoShowOut,
+    summary="激励视频提前关闭/未发奖留痕",
+    dependencies=[Depends(rate_limit(120, 60, "ad-reward-noshow"))],
+)
+def reward_noshow(payload: RewardNoShowIn, user: CurrentUser, db: DbSession) -> RewardNoShowOut:
+    """激励视频展示了但用户提前关/跳过、未触发 S2S 发奖时,客户端 best-effort 上报一条留痕,
+    让广告收益报表能呈现「有展示、没发金币」的原因。不发金币;同一 session 已发奖则跳过。
+    """
+    rec = crud_ad.record_reward_noshow(
+        db,
+        user.id,
+        ad_session_id=payload.ad_session_id,
+        ecpm=payload.ecpm,
+        adn=payload.adn,
+        slot_id=payload.slot_id,
+        app_env=payload.app_env,
+        our_code_id=payload.our_code_id,
+    )
+    logger.info(
+        "ad reward noshow user_id=%d session=%s watched=%ds -> status=%s",
+        user.id, payload.ad_session_id, payload.watched_seconds, rec.status,
+    )
+    return RewardNoShowOut(ok=True, status=rec.status)

app/api/v1/auth.py

@@ -19,6 +19,7 @@ from app.core.ratelimit import rate_limit
 from app.core.security import TokenError, decode_token, issue_token_pair
 from app.integrations.jiguang import JiguangError, mask_phone, verify_and_get_phone
 from app.integrations.sms import SmsError, send_code, verify_code
+from app.repositories import onboarding as onboarding_repo
 from app.repositories import user as user_repo
 from app.schemas.auth import (
     JverifyLoginRequest,
@@ -37,12 +38,13 @@ logger = logging.getLogger("shagua.auth")
 router = APIRouter(prefix="/api/v1/auth", tags=["auth"])
 
 
-def _login_response(db, user) -> TokenWithUser:
-    """登录类接口共用的响应组装。"""
+def _login_response(user, *, onboarding_completed: bool) -> TokenWithUser:
+    """登录类接口共用的响应组装。onboarding_completed 据登录请求的 device_id 算好后传入。"""
     tokens = issue_token_pair(user.id)
     return TokenWithUser(
         **tokens,
         user=UserOut.model_validate(user),
+        onboarding_completed=onboarding_completed,
     )
 
 
@@ -66,8 +68,9 @@ def jverify_login(req: JverifyLoginRequest, db: DbSession) -> TokenWithUser:
     if user.status != "active":
         raise HTTPException(status_code=403, detail="account disabled")
 
-    logger.info("jverify_login ok user_id=%d phone=%s", user.id, mask_phone(phone))
-    return _login_response(db, user)
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=req.device_id)
+    logger.info("jverify_login ok user_id=%d phone=%s onboarded=%s", user.id, mask_phone(phone), completed)
+    return _login_response(user, onboarding_completed=completed)
 
 
 # ===================== 短信登录 =====================
@@ -103,8 +106,9 @@ def sms_login(req: SmsLoginRequest, db: DbSession) -> TokenWithUser:
     if user.status != "active":
         raise HTTPException(status_code=403, detail="account disabled")
 
-    logger.info("sms_login ok user_id=%d phone=%s", user.id, mask_phone(req.phone))
-    return _login_response(db, user)
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=req.device_id)
+    logger.info("sms_login ok user_id=%d phone=%s onboarded=%s", user.id, mask_phone(req.phone), completed)
+    return _login_response(user, onboarding_completed=completed)
 
 
 # ===================== Refresh =====================

app/api/v1/compare.py

@@ -102,6 +102,17 @@ async def intent_step(request: Request) -> dict[str, Any]:
     return await _passthrough(request, "/api/intent/step")
 
 
+@router.post(
+    "/intent/precoupon/step",
+    summary="外卖比价 Phase 0 意图识别前先用券 (透传到 pricebot, 仅美团源)",
+)
+async def intent_precoupon_step(request: Request) -> dict[str, Any]:
+    # 美团源平台『意图识别前先用券』多帧循环: 客户端在调 /intent/recognize 之前先循环
+    # 调本端点到 done(continue=false)。订单页底部有『点击使用X红包』就自动选最大免费券
+    # 用上, 已用券/无券则首帧秒过。与 /intent/step 同属 intent 域, 复用同一透传壳。
+    return await _passthrough(request, "/api/intent/precoupon/step")
+
+
 @router.post("/price/step", summary="外卖比价 Phase 2 步进 (透传到 pricebot)")
 async def price_step(request: Request) -> dict[str, Any]:
     return await _passthrough(request, "/api/price/step")

app/api/v1/compare_record.py

@@ -77,10 +77,12 @@ def list_records(
     items, next_cursor = crud_compare.list_records(
         db, user.id, limit=limit, cursor=cursor
     )
-    return ComparisonRecordPage(
-        items=[ComparisonRecordOut.model_validate(it) for it in items],
-        next_cursor=next_cursor,
-    )
+    outs = [ComparisonRecordOut.model_validate(it) for it in items]
+    # 权限闸:未开 debug_trace_enabled 的用户不下发 trace_url(列表页「复制调试链接」靠它)
+    if not user.debug_trace_enabled:
+        for o in outs:
+            o.trace_url = None
+    return ComparisonRecordPage(items=outs, next_cursor=next_cursor)
 
 
 @router.get(
@@ -94,4 +96,12 @@ def get_record(
     rec = crud_compare.get_record(db, user.id, record_id)
     if rec is None:
         raise HTTPException(status_code=status.HTTP_404_NOT_FOUND, detail="record not found")
-    return ComparisonRecordDetailOut.model_validate(rec)
+    out = ComparisonRecordDetailOut.model_validate(rec)
+    # 权限闸:未开 debug_trace_enabled 的用户不下发 trace_url。
+    # ⚠️ raw_payload 是上报体全量(model_dump),里面也藏着一份 trace_url,必须一并抹掉——
+    # 否则无权限用户从详情接口的 raw_payload 绕过权限闸拿到 trace_url。
+    if not user.debug_trace_enabled:
+        out.trace_url = None
+        if isinstance(out.raw_payload, dict):
+            out.raw_payload.pop("trace_url", None)
+    return out

app/api/v1/coupon.py

@@ -18,12 +18,18 @@ import httpx
 from fastapi import APIRouter, HTTPException, Request, status
 from fastapi.concurrency import run_in_threadpool
 
-from app.api.deps import DbSession
+from app.api.deps import CurrentUser, DbSession
 from app.core.config import settings
 from app.core.pricebot_router import pick_pricebot
 from app.db.session import SessionLocal
 from app.repositories import coupon_state as coupon_repo
-from app.schemas.coupon_state import CouponPromptDismissIn, CouponPromptShouldShowOut
+from app.schemas.coupon_state import (
+    CouponCompletedTodayOut,
+    CouponPromptDismissIn,
+    CouponPromptShouldShowOut,
+    CouponPromptShownIn,
+    CouponStatsOut,
+)
 
 logger = logging.getLogger("shagua.coupon")
 
@@ -62,11 +68,11 @@ def _extract_coupon_results(resp_json: dict) -> list[dict]:
 
 
 def _mark_engagement_blocking(
-    device_id: str, user_id: int | None, engage_type: str
+    device_id: str, package: str, user_id: int | None, engage_type: str
 ) -> None:
     """独立 session 写 engagement(async 端点经 run_in_threadpool 调,不阻塞事件循环)。"""
     with SessionLocal() as db:
-        coupon_repo.mark_engagement(db, device_id, user_id, engage_type)
+        coupon_repo.mark_engagement(db, device_id, package, user_id, engage_type)
 
 
 def _record_claims_blocking(
@@ -76,6 +82,14 @@ def _record_claims_blocking(
         coupon_repo.record_claims(db, device_id, user_id, trace_id, results)
 
 
+def _mark_completed_blocking(
+    device_id: str, user_id: int | None, trace_id: str | None
+) -> None:
+    """独立 session 写"今日已跑完整轮"(到 done 帧那刻调,best-effort 不阻塞领券)。"""
+    with SessionLocal() as db:
+        coupon_repo.mark_completed_today(db, device_id, user_id, trace_id)
+
+
 @router.post("/step", summary="领券任务步进 (透传到 pricebot)")
 async def coupon_step(
     request: Request,
@@ -99,14 +113,17 @@ async def coupon_step(
     device_id = meta.get("device_id")
     user_id = _to_int(meta.get("user_id"))  # 登录态才带;判断不靠它,资产留痕用
     trace_id = meta.get("trace_id")
+    # 发起领券时前台 App 包名(step body 带 "package")。频控按 App,这条 engagement 要记到
+    # 对应 App 上。App 内「去领取」发起时 package 可能缺/为空 → 退化为 "" 占位(全局态)。
+    pkg = meta.get("package") or ""
 
     # 领券任务首帧(step=0)= 用户已发起领券 → 记一条今日 engagement(claim_started),
-    # 今天这台设备不再弹引导窗(对齐前台"点一键领取即 markEngaged")。写库失败绝不能
+    # 今天**这个 App** 不再弹引导窗(对齐前台"点一键领取即 markEngaged")。写库失败绝不能
     # 连累领券主流程,整段吞掉。
     if device_id and meta.get("step") == 0:
         try:
             await run_in_threadpool(
-                _mark_engagement_blocking, device_id, user_id, "claim_started"
+                _mark_engagement_blocking, device_id, pkg, user_id, "claim_started"
             )
         except Exception as e:  # noqa: BLE001
             logger.warning("coupon engagement write failed: %s", e)
@@ -160,17 +177,45 @@ async def coupon_step(
             except Exception as e:  # noqa: BLE001
                 logger.warning("coupon claim write failed: %s", e)
 
+    # 整轮跑完(done 帧)→ 记一条"今日已完成",首页「去领取」卡据此置灰。
+    # pricebot 把中途单券 done 改写成 wait+continue=true,只有整套全跑完那帧才保留
+    # command=="done"(见 pricebot main.py),故 done 已等价"整轮完成"(用户决策 A 方案:
+    # 到 done 即算,不管单券成败),无需再判 continue。写库失败绝不连累领券返回。
+    action = resp_json.get("action") or {}
+    if device_id and action.get("command") == "done":
+        try:
+            await run_in_threadpool(
+                _mark_completed_blocking, device_id, user_id, trace_id
+            )
+        except Exception as e:  # noqa: BLE001
+            logger.warning("coupon completion write failed: %s", e)
+
     return resp_json
 
 
+@router.post("/prompt/shown", summary="领券引导窗弹出即上报(按 App 记 shown)")
+def coupon_prompt_shown(payload: CouponPromptShownIn, db: DbSession) -> dict[str, bool]:
+    """客户端弹出引导窗那刻调 → 记一条今日 engagement(shown),今天**这个 App** 不再自动弹。
+
+    频控主判据(管跨重装):弹出即占用今天这个 App 的"一次"。用户领/拒/无视都算用掉。
+    后续点领取/拒绝再由 step/dismiss 把 type 升级。按 (device, package, 日) 记。
+    """
+    coupon_repo.mark_engagement(
+        db, payload.device_id, payload.package, payload.user_id, "shown"
+    )
+    return {"ok": True}
+
+
 @router.post("/prompt/dismiss", summary="用户拒绝/关闭领券引导窗(记今日已 engage)")
 def coupon_prompt_dismiss(payload: CouponPromptDismissIn, db: DbSession) -> dict[str, bool]:
-    """客户端点关闭引导窗时调用 → 记一条今日 engagement(dismissed),今天不再弹。
+    """客户端点关闭引导窗时调用 → 记一条今日 engagement(dismissed),今天**这个 App** 不再弹。
 
     server 在透传链路里看不到"用户拒绝"(拒绝不发起领券),故必须客户端通知。
-    MVP 不鉴权,按 device_id 记。
+    频控按 (device, package, 日),各 App 独立。MVP 不鉴权,按 device_id 记。
     """
-    coupon_repo.mark_engagement(db, payload.device_id, payload.user_id, "dismissed")
+    coupon_repo.mark_engagement(
+        db, payload.device_id, payload.package, payload.user_id, "dismissed"
+    )
     return {"ok": True}
 
 
@@ -180,10 +225,59 @@ def coupon_prompt_dismiss(payload: CouponPromptDismissIn, db: DbSession) -> dict
     summary="切到外卖 App 时是否还应弹领券引导窗",
 )
 def coupon_prompt_should_show(
-    device_id: str, db: DbSession
+    device_id: str, db: DbSession, package: str = ""
 ) -> CouponPromptShouldShowOut:
-    """今天这台设备已 engage(领或拒)过 → should_show=false。客户端据此决定弹不弹
-    (前台 SP 缓存做快速路径,这里是权威)。"""
+    """今天这台设备**这个 App** 已 engage(弹/领/拒)过 → should_show=false。各 App 独立:
+    美团弹过不压淘宝/京东。客户端切到目标 App 时带 package 查(老客户端不带 → "" 全局态)。"""
     return CouponPromptShouldShowOut(
-        should_show=not coupon_repo.has_engaged_today(db, device_id)
+        should_show=not coupon_repo.has_engaged_today(db, device_id, package)
     )
+
+
+@router.post("/prompt/reset", summary="重置今日领券引导窗 engagement(开发测频控用)")
+def coupon_prompt_reset(payload: CouponPromptDismissIn, db: DbSession) -> dict[str, bool]:
+    """删这台设备今天的 engagement → has_engaged_today 变 false,今天又能弹。
+    开发设置「重置今日领券弹窗状态」按钮调。MVP 不鉴权,按 device_id。"""
+    coupon_repo.reset_today_engagement(db, payload.device_id)
+    return {"ok": True}
+
+
+@router.get(
+    "/completed-today",
+    response_model=CouponCompletedTodayOut,
+    summary="这台设备今天是否已跑完整轮领券(到 done 帧)",
+)
+def coupon_completed_today(
+    device_id: str, db: DbSession
+) -> CouponCompletedTodayOut:
+    """今天这台设备已跑完整轮(到 done)→ completed=true。客户端据此把首页「去领取」
+    卡置灰、不可点(用户决策 A 方案:到 done 即算,不管单券成败)。判断维度 device_id
+    必须与领券循环上报的一致(客户端两端都用 ANDROID_ID)。"""
+    return CouponCompletedTodayOut(
+        completed=coupon_repo.has_completed_today(db, device_id)
+    )
+
+
+@router.post(
+    "/completed-today/reset",
+    summary="重置今日已完成(开发设置全重置用,恢复首页「去领取」卡可点)",
+)
+def coupon_completed_today_reset(
+    payload: CouponPromptDismissIn, db: DbSession
+) -> dict[str, bool]:
+    """删这台设备今天的 completion → has_completed_today 变 false,首页「去领取」卡恢复可点。
+    与 /prompt/reset 配套:开发设置「重置今日领券弹窗状态」一键把今日状态全清。MVP 不鉴权。"""
+    coupon_repo.reset_today_completion(db, payload.device_id)
+    return {"ok": True}
+
+
+@router.get(
+    "/stats",
+    response_model=CouponStatsOut,
+    summary="累计领券数(「我的」页战绩卡「领取优惠券 X 张」)",
+)
+def coupon_stats(user: CurrentUser, db: DbSession) -> CouponStatsOut:
+    """该登录用户累计领到的券数(SUM(claimed_count),口径见 coupon_repo.sum_claimed_count)。
+    **鉴权(CurrentUser)**——区别于同文件不鉴权的 /step 透传与 /prompt 频控(那些按 device_id):
+    个人战绩按 user_id 聚合,必须有登录态。"""
+    return CouponStatsOut(coupon_count=coupon_repo.sum_claimed_count(db, user.id))

app/api/v1/cps_redirect.py

@@ -0,0 +1,39 @@
+"""CPS 群发短链跳转:用户点 /c/{code} → 记一条点击 → 302 跳美团。
+
+公网、无鉴权(群里任何人点都要能跳)。记点击失败绝不影响跳转(用户体验优先)。
+"""
+from __future__ import annotations
+
+from fastapi import APIRouter, Depends, Request
+from fastapi.responses import RedirectResponse
+from sqlalchemy.orm import Session
+
+from app.db.session import get_db
+from app.repositories import cps_link as cps_link_repo
+
+router = APIRouter(tags=["cps-redirect"])
+
+# code 不存在/失效时的兜底落地(避免用户看到报错)
+_FALLBACK_URL = "https://www.meituan.com/"
+
+
+def _client_ip(request: Request) -> str | None:
+    xff = request.headers.get("x-forwarded-for")
+    if xff:
+        return xff.split(",")[0].strip()
+    return request.client.host if request.client else None
+
+
+@router.get("/c/{code}", summary="群发短链跳转(记点击 + 302)")
+def cps_redirect(code: str, request: Request, db: Session = Depends(get_db)):
+    link = cps_link_repo.get_by_code(db, code)
+    if link is None:
+        return RedirectResponse(_FALLBACK_URL, status_code=302)
+    try:
+        cps_link_repo.record_click(
+            db, link=link, ip=_client_ip(request),
+            ua=request.headers.get("user-agent"),
+        )
+    except Exception:
+        pass  # 记点击失败不阻断跳转
+    return RedirectResponse(link.target_url, status_code=302)

app/api/v1/feedback.py

@@ -1,7 +1,7 @@
 """帮助与反馈 endpoint。
 
 路由前缀 `/api/v1/feedback`,需 Bearer 鉴权(反馈绑到登录用户,便于回访)。
-  POST /  提交反馈(multipart:content / contact 必填,images 可选 ≤4 张)
+  POST /  提交反馈(multipart:content 必填;contact 可选(原型改版后客户端已不再采集);images 可选 ≤6 张)
 
 截图复用 [app.core.media] 落盘到 /media/feedback/。
 """
@@ -20,8 +20,8 @@ logger = logging.getLogger("shagua.feedback")
 
 router = APIRouter(prefix="/api/v1/feedback", tags=["feedback"])
 
-_MAX_IMAGES = 4
-_CONTENT_MAX = 2000
+_MAX_IMAGES = 6
+_CONTENT_MAX = 200
 _CONTACT_MAX = 128
 
 
@@ -30,7 +30,8 @@ async def submit_feedback(
     user: CurrentUser,
     db: DbSession,
     content: str = Form(...),
-    contact: str = Form(...),
+    # 原型改版后客户端不再采集联系方式;保留字段以兼容旧端 + 后续可能复用,默认空串。
+    contact: str = Form(default=""),
     images: list[UploadFile] = File(default=[]),
 ) -> FeedbackOut:
     content = content.strip()
@@ -39,8 +40,6 @@ async def submit_feedback(
         raise HTTPException(status_code=400, detail="反馈内容不能为空")
     if len(content) > _CONTENT_MAX:
         raise HTTPException(status_code=400, detail="反馈内容过长")
-    if not contact:
-        raise HTTPException(status_code=400, detail="联系方式不能为空")
     if len(contact) > _CONTACT_MAX:
         raise HTTPException(status_code=400, detail="联系方式过长")
 

app/api/v1/invite.py

@@ -1,25 +1,37 @@
 """好友邀请 endpoint。
 
-路由前缀 /api/v1/invite,需 Bearer 鉴权(用户级数据):
-  GET  /me     我的邀请码 + 分享链接 + 已邀人数/已得金币(邀请页展示)
-  POST /bind   把当前登录用户(被邀请人)绑定到某邀请码,注册即生效,双方各发金币
+路由前缀 /api/v1/invite,需 Bearer 鉴权(用户级数据);唯一例外是 /landing-track
+(落地页 dl.html 浏览器访问、无 token,详见任务 3 [[invite-three-tasks]]):
+  GET  /me                我的邀请码 + 分享链接 + 已邀人数/已得金币(邀请页展示)
+  POST /bind              把当前登录用户(被邀请人)绑定到某邀请码;支持三种归因:
+                          ① clipboard:首启读剪贴板拿邀请码 → 上报码
+                          ② manual:用户在邀请页输入邀请码 → 上报码
+                          ③ fingerprint:剪贴板没拿到时上报指纹,后端反查
+  POST /landing-track     落地页 dl.html 访问时上报指纹(剪贴板兜底的服务端一端,无需鉴权)
 
-客户端两种调用 /bind:
-  - 自动:首启读剪贴板拿到邀请码 → 登录后调本接口(channel=clipboard)
-  - 手动:用户在邀请页输入好友邀请码(channel=manual)
-
-绑定的真正逻辑(邀请码生成/反查、幂等、自邀屏蔽、发金币)在 repositories/invite.py。
+绑定的真正逻辑(邀请码生成/反查、幂等、自邀屏蔽、发金币、指纹反查)在
+repositories/invite.py。
 """
 from __future__ import annotations
 
 import logging
+import re
 
-from fastapi import APIRouter
+from fastapi import APIRouter, Request
 
 from app.api.deps import CurrentUser, DbSession
+from app.core import rewards
 from app.core.config import settings
 from app.repositories import invite as invite_repo
-from app.schemas.invite import BindInviteIn, BindInviteOut, InviteInfoOut
+from app.schemas.invite import (
+    BindInviteIn,
+    BindInviteOut,
+    InviteeItem,
+    InviteeListOut,
+    InviteInfoOut,
+    LandingTrackIn,
+    LandingTrackOut,
+)
 
 logger = logging.getLogger("shagua.invite")
 
@@ -31,9 +43,43 @@ _BIND_MESSAGES = {
     "invalid_code": "邀请码无效",
     "self_invite": "不能填写自己的邀请码",
     "not_eligible": "邀请仅对新注册用户生效",
+    "fp_not_found": "未匹配到邀请关系",
 }
 
 
+def _client_ip(request: Request) -> str:
+    """从 HTTP 头拿真实 IP。nginx 反代时走 X-Forwarded-For;裸跑 uvicorn 走 request.client。"""
+    xff = request.headers.get("x-forwarded-for", "")
+    if xff:
+        # X-Forwarded-For 可能是 "client, proxy1, proxy2" 链;取第一个 = 真实客户端
+        return xff.split(",")[0].strip()
+    return request.client.host if request.client else ""
+
+
+# Android UA 形如 '... ; <Model> Build/<id>) AppleWebKit/...';抓 ';' 后到 ' Build/' 前
+# 的 token = Build.MODEL(跨端跟客户端 android.os.Build.MODEL 对齐)。user-agents 库
+# 把 Android 设备归为 'Smartphone' 通用名,抓不到真实型号,只能正则。
+_ANDROID_BUILD_MODEL_RE = re.compile(r";\s*([^;]+?)\s+Build/", re.IGNORECASE)
+
+
+def _parse_device_model(ua: str) -> str:
+    """解析浏览器 UA 拿手机型号(如 '24115RA8EC'、'PJF110')。
+
+    Android:正则抓 UA 里 ';...Build/' 前的 token(== Build.MODEL),跨端可严格匹配。
+    iOS / 解析不到:退到 user-agents 库的通用解析,失败/UA 空 → 返空字符串。
+    """
+    if not ua:
+        return ""
+    m = _ANDROID_BUILD_MODEL_RE.search(ua)
+    if m:
+        return m.group(1).strip()
+    try:
+        from user_agents import parse
+        return (parse(ua).device.model or "").strip()
+    except Exception:  # noqa: BLE001
+        return ""
+
+
 @router.get("/me", response_model=InviteInfoOut, summary="我的邀请码 + 分享链接 + 战绩")
 def my_invite(user: CurrentUser, db: DbSession) -> InviteInfoOut:
     code = invite_repo.ensure_code(db, user)
@@ -48,17 +94,124 @@ def my_invite(user: CurrentUser, db: DbSession) -> InviteInfoOut:
     )
 
 
-@router.post("/bind", response_model=BindInviteOut, summary="绑定邀请人(注册即生效,双方发金币)")
-def bind_invite(req: BindInviteIn, user: CurrentUser, db: DbSession) -> BindInviteOut:
-    result = invite_repo.bind(
-        db, invitee=user, invite_code=req.invite_code, channel=req.channel,
+@router.get("/invitees", response_model=InviteeListOut, summary="我邀请的人列表(分页)")
+def my_invitees(
+    user: CurrentUser, db: DbSession, limit: int = 20, offset: int = 0
+) -> InviteeListOut:
+    """邀请页小窗(取前几条) + 完整列表页(分页加载)共用。
+
+    名字/头像的降级兜底在 repositories/invite.get_invitees 算好,这里只组装响应。
+    limit 夹到 [1,50] 防滥用;offset 不小于 0。
+    """
+    limit = max(1, min(limit, 50))
+    offset = max(0, offset)
+    items, total, has_more = invite_repo.get_invitees(
+        db, user.id, limit=limit, offset=offset,
+    )
+    return InviteeListOut(
+        items=[InviteeItem(**it) for it in items],
+        total=total,
+        has_more=has_more,
+    )
+
+
+@router.post(
+    "/landing-track",
+    response_model=LandingTrackOut,
+    summary="落地页指纹采集(无需鉴权)",
+)
+def landing_track(
+    req: LandingTrackIn, request: Request, db: DbSession
+) -> LandingTrackOut:
+    """B 浏览器打开 dl.html?ref=xxx 时上报指纹。
+
+    服务端从 HTTP 头拿 IP/UA、解析 UA 拿 device_model,跟 req.screen 一起入库。
+    无需鉴权(浏览器没 token)。invalid_code / no_ip 走 silent 返回(不抛 5xx 影响下载流程)。
+    """
+    inviter = invite_repo.resolve_inviter(db, req.ref)
+    if inviter is None or inviter.status != "active":
+        return LandingTrackOut(status="invalid_code")
+
+    ip = _client_ip(request)
+    if not ip:
+        return LandingTrackOut(status="no_ip")
+
+    ua_str = request.headers.get("user-agent", "")
+    device_model = _parse_device_model(ua_str)
+
+    invite_repo.record_fingerprint(
+        db,
+        inviter_user_id=inviter.id,
+        ip=ip,
+        screen=req.screen,
+        device_model=device_model,
+        user_agent=ua_str,
     )
     logger.info(
-        "invite bind invitee=%d code=%s channel=%s -> %s",
-        user.id, req.invite_code, req.channel, result.status,
+        "invite landing-track inviter=%d ip=%s screen=%s model=%s",
+        inviter.id, ip, req.screen, device_model,
     )
+    return LandingTrackOut(status="ok")
+
+
+@router.post("/bind", response_model=BindInviteOut, summary="绑定邀请人(注册即生效,双方发金币)")
+def bind_invite(
+    req: BindInviteIn, user: CurrentUser, db: DbSession, request: Request
+) -> BindInviteOut:
+    code = (req.invite_code or "").strip()
+
+    # 路径 1:有邀请码 → 走原路径(clipboard / manual)
+    if code:
+        result = invite_repo.bind(
+            db, invitee=user, invite_code=code, channel=req.channel,
+        )
+        logger.info(
+            "invite bind invitee=%d code=%s channel=%s -> %s",
+            user.id, code, req.channel, result.status,
+        )
+        return BindInviteOut(
+            status=result.status,
+            coins_awarded=result.invitee_coin,
+            message=_BIND_MESSAGES.get(result.status, result.status),
+        )
+
+    # 路径 2:无邀请码 + 有指纹 → 指纹兜底反查
+    if req.fingerprint is not None:
+        ip = _client_ip(request)
+        inviter = invite_repo.resolve_inviter_by_fingerprint(
+            db,
+            ip=ip,
+            screen=req.fingerprint.screen,
+            device_model=req.fingerprint.device_model,
+            window_days=rewards.INVITE_FP_WINDOW_DAYS,
+        )
+        if inviter is None:
+            logger.info(
+                "invite bind invitee=%d fingerprint not_found ip=%s screen=%s model=%s",
+                user.id, ip, req.fingerprint.screen, req.fingerprint.device_model,
+            )
+            return BindInviteOut(
+                status="fp_not_found",
+                coins_awarded=0,
+                message=_BIND_MESSAGES["fp_not_found"],
+            )
+        # 用反查到的 inviter.invite_code 走原 bind 流程(走原幂等/自邀/新人闸/发币逻辑)
+        result = invite_repo.bind(
+            db, invitee=user, invite_code=inviter.invite_code, channel="fingerprint",
+        )
+        logger.info(
+            "invite bind invitee=%d fingerprint -> inviter=%d code=%s -> %s",
+            user.id, inviter.id, inviter.invite_code, result.status,
+        )
+        return BindInviteOut(
+            status=result.status,
+            coins_awarded=result.invitee_coin,
+            message=_BIND_MESSAGES.get(result.status, result.status),
+        )
+
+    # 路径 3:啥都没传 → 无效请求
     return BindInviteOut(
-        status=result.status,
-        coins_awarded=result.invitee_coin,
-        message=_BIND_MESSAGES.get(result.status, result.status),
+        status="invalid_code",
+        coins_awarded=0,
+        message=_BIND_MESSAGES["invalid_code"],
     )

app/api/v1/meituan.py

@@ -8,12 +8,12 @@ import logging
 from concurrent.futures import ThreadPoolExecutor, as_completed
 
 from fastapi import APIRouter, Depends, HTTPException
-from sqlalchemy import select
-from sqlalchemy.orm import Session
+from sqlalchemy import nullslast, select
+from sqlalchemy.orm import Session, aliased
 
 from app.core.config import settings
 from app.db.session import get_db
-from app.integrations.meituan import MeituanCpsError, get_referral_link, query_coupon
+from app.integrations.meituan import MeituanCpsError, _call, get_referral_link, query_coupon
 from app.models.meituan_coupon import MeituanCoupon
 from app.schemas.meituan import (
     CouponCard,
@@ -34,7 +34,7 @@ router = APIRouter(prefix="/api/v1/meituan", tags=["meituan-cps"])
 @router.post("/coupons", response_model=CouponListResponse, summary="券列表(为您推荐)")
 def list_coupons(req: CouponListRequest) -> CouponListResponse:
     if not settings.mt_cps_configured:
-        return CouponListResponse(items=[], has_next=False, search_id=None)
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
     logger.info("[coupons] lon=%.6f lat=%.6f topic=%s", req.longitude, req.latitude, req.list_topic_id)
     try:
         raw = query_coupon(
@@ -50,14 +50,21 @@ def list_coupons(req: CouponListRequest) -> CouponListResponse:
             page_size=req.page_size,
         )
     except MeituanCpsError as e:
-        logger.error("query_coupon failed: %s", e)
-        raise HTTPException(status_code=502, detail=f"meituan: {e}") from e
+        # 软降级:不再抛 502(避免前端弹报错 toast),返空 + degraded,前端显示「服务繁忙」。
+        logger.warning("[coupons] query_coupon 失败,降级返空: %s", e)
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
 
-    items = [CouponCard.from_raw(it) for it in (raw.get("data") or [])]
+    items: list[CouponCard] = []
+    for it in (raw.get("data") or []):
+        try:
+            items.append(CouponCard.from_raw(it))
+        except Exception:  # noqa: BLE001
+            continue
     return CouponListResponse(
         items=items,
         has_next=raw.get("hasNext", False),
         search_id=raw.get("searchId"),
+        status="ok" if items else "empty",
     )
 
 
@@ -93,59 +100,136 @@ def _commission_pct(card: CouponCard) -> float:
 
 
 @router.post("/feed", response_model=FeedResponse, summary="混合feed(外卖+到店交叉);tab=rec智能推荐/distance距离最近")
-def feed(req: FeedRequest) -> FeedResponse:
-    if not settings.mt_cps_configured:
-        return FeedResponse(items=[], has_next=False, page=req.page)
+def feed(req: FeedRequest, db: Session = Depends(get_db)) -> FeedResponse:
     lon, lat = req.longitude, req.latitude
     tab = (req.tab or "").strip()
     logger.info("[feed] tab=%s page=%s lon=%.6f lat=%.6f", tab or "(default)", req.page, lon, lat)
 
-    def _fetch_topic(platform: int, biz_line: int | None, topic: int) -> list[dict]:
+    # rec 是纯离线库查询,不依赖 MT 凭证、不实时打美团;其余 tab(distance / 默认)要实时打美团,
+    # 未配凭证直接降级返空(degraded),让前端区分「服务暂不可用」而非「暂无」。
+    if tab != "rec" and not settings.mt_cps_configured:
+        return FeedResponse(items=[], has_next=False, page=req.page, status="degraded")
+
+    def _fetch_topic(platform: int, biz_line: int | None, topic: int) -> tuple[list[dict], bool]:
+        """返回(items, 是否调用失败)。失败标志用于把默认 feed 整页标 degraded。"""
         try:
-            return (query_coupon(
+            data = (query_coupon(
                 longitude=lon, latitude=lat,
                 platform=platform, biz_line=biz_line,
                 list_topic_id=topic, page_size=20,
             ).get("data") or [])
+            return data, False
         except MeituanCpsError:
-            return []
+            return [], True
 
-    # 距离最近:拉齐全部榜单轮次,合并去重,后端在【完整池子】上全局按距离由近及远排,一次性返回。
-    # (距离排序必须在完整池上做、不能逐页排——这正是之前放前端不合理的根因。)
+    # 距离最近:搜索召回(外卖搜"外卖" + 到店搜"美食",都 sortField=6 离我最近)一页页拉。
+    # 搜索翻页必须用 searchId(pageNo 翻不动),所以每个 feed 页顺序翻到第 N 页;两路并行、page 1 最快。
+    # 无状态、不改 APP(传页码即可);按你位置实时算距离(库里没存 POI 经纬度,只能实时)。
     if tab == "distance":
-        with ThreadPoolExecutor(max_workers=len(_TOPIC_ROUNDS) * 2) as pool:
-            futs = []
-            for wm_topic, dd_topic in _TOPIC_ROUNDS:
-                futs.append(pool.submit(_fetch_topic, 1, None, wm_topic))
-                futs.append(pool.submit(_fetch_topic, 2, 1, dd_topic))
-            raws = [f.result() for f in futs]
+        lon_i, lat_i = int(lon * 1_000_000), int(lat * 1_000_000)
+
+        def _search_page_n(platform: int, biz_line: int | None, keyword: str, n: int) -> tuple[list[dict], bool, bool]:
+            """顺序翻到第 n 页(搜索须 searchId 续页),返回(第 n 页 items, 是否还有下一页, 是否调用失败)。"""
+            sid: str | None = None
+            data: list[dict] = []
+            has_next = False
+            for pg in range(1, n + 1):
+                body: dict = {
+                    "platform": platform, "searchText": keyword, "sortField": 6,
+                    "longitude": lon_i, "latitude": lat_i, "pageSize": 20,
+                }
+                if biz_line is not None:
+                    body["bizLine"] = biz_line
+                if sid:
+                    body["searchId"] = sid
+                else:
+                    body["pageNo"] = 1
+                try:
+                    r = _call("/cps_open/common/api/v1/query_coupon", body)
+                except MeituanCpsError:
+                    return [], False, True   # 调用失败(用于标 degraded)
+                data = r.get("data") or []
+                sid = r.get("searchId")
+                has_next = bool(r.get("hasNext")) and bool(data)
+                if not data or (not has_next and pg < n):
+                    return [], False, False   # 没那么多页了(非错误)
+            return data, has_next, False
+
+        with ThreadPoolExecutor(max_workers=2) as pool:
+            f_wm = pool.submit(_search_page_n, 1, None, "外卖", req.page)
+            f_dd = pool.submit(_search_page_n, 2, 1, "美食", req.page)
+            (wm_data, wm_hn, wm_fail), (dd_data, dd_hn, dd_fail) = f_wm.result(), f_dd.result()
+
         seen: set[str] = set()
         cards: list[CouponCard] = []
-        for raw_list in raws:
-            for it in raw_list:
+        for it in wm_data + dd_data:
+            try:
                 card = CouponCard.from_raw(it)
-                if card.product_view_sign and card.product_view_sign not in seen:
-                    seen.add(card.product_view_sign)
-                    cards.append(card)
+            except Exception:  # noqa: BLE001
+                continue
+            if card.product_view_sign and card.product_view_sign not in seen:
+                seen.add(card.product_view_sign)
+                cards.append(card)
         cards.sort(key=lambda c: c.distance_meters if c.distance_meters is not None else float("inf"))
-        return FeedResponse(items=cards, has_next=False, page=1)
+        # 两路都失败且无数据 → degraded;否则有数据 ok / 无数据 empty
+        status = "degraded" if (not cards and wm_fail and dd_fail) else ("ok" if cards else "empty")
+        return FeedResponse(items=cards, has_next=wm_hn or dd_hn, page=req.page, status=status)
 
-    # 智能推荐(rec,默认):沿用逐轮分页的混合 feed,后端过滤掉佣金率 < 3%。
+    # 智能推荐(rec):走【离线库】筛佣金率 ≥ 3%,分页返回(SQL 侧去重+排序+分页,秒级、不打美团)。
+    # 实测库里佣金≥3% 去重后仅 ~578 条(几乎全是外卖;到店团购佣金普遍 <3%):实时按"同城热销榜单"
+    # 拉既撞限流、又填不满(该榜单中位佣金 ~0.8%,筛完每页剩 0-1 条),故从库出。佣金阈值逻辑不变。
+    if tab == "rec":
+        PAGE = 20
+        try:
+            base = select(MeituanCoupon).where(MeituanCoupon.commission_percent >= 3.0)
+            deduped = base.distinct(MeituanCoupon.dedup_key).order_by(
+                MeituanCoupon.dedup_key,
+                MeituanCoupon.commission_percent.desc(),
+            ).subquery()
+            m = aliased(MeituanCoupon, deduped)
+            start = (req.page - 1) * PAGE
+            rows = db.execute(
+                select(m)
+                # 销量高的优先(无销量档排后),同档佣金高优先,id 兜底稳定分页
+                .order_by(nullslast(m.sale_volume_num.desc()), m.commission_percent.desc(), m.id)
+                .offset(start)
+                .limit(PAGE + 1)
+            ).scalars().all()
+        except Exception:  # noqa: BLE001
+            logger.exception("[feed] rec 库查询失败,降级返空")
+            return FeedResponse(items=[], has_next=False, page=req.page, status="degraded")
+        has_next = len(rows) > PAGE
+        cards: list[CouponCard] = []
+        for row in rows[:PAGE]:
+            try:
+                card = CouponCard.from_raw(row.raw or {})
+            except Exception:  # noqa: BLE001
+                continue
+            if card.product_view_sign:
+                # 智能推荐不显示距离:库里的距离是相对城市默认点的(对用户无意义、且误导)。
+                # 置空后前端"距离 店名"那行只剩店名、自动顶到最左(店名移到原距离的位置)。
+                card.distance_text = None
+                card.distance_meters = None
+                cards.append(card)
+        return FeedResponse(items=cards, has_next=has_next, page=req.page,
+                            status="ok" if cards else "empty")
+
+    # 默认(老客户端不传 tab):沿用逐轮分页的混合 feed,不筛。
     page_idx = req.page - 1
     if page_idx >= len(_TOPIC_ROUNDS):
-        return FeedResponse(items=[], has_next=False, page=req.page)
+        return FeedResponse(items=[], has_next=False, page=req.page, status="empty")
 
     wm_topic, dd_topic = _TOPIC_ROUNDS[page_idx]
     with ThreadPoolExecutor(max_workers=2) as pool:
         f_wm = pool.submit(_fetch_topic, 1, None, wm_topic)
         f_dd = pool.submit(_fetch_topic, 2, 1, dd_topic)
-        waimai, daodian = f_wm.result(), f_dd.result()
+        (waimai, wm_fail), (daodian, dd_fail) = f_wm.result(), f_dd.result()
 
     items = _interleave(waimai, daodian)
-    if tab == "rec":
-        items = [c for c in items if _commission_pct(c) >= 3.0]
     has_next = page_idx + 1 < len(_TOPIC_ROUNDS)
-    return FeedResponse(items=items, has_next=has_next, page=req.page)
+    # 两路都失败且无数据 → degraded;否则有数据 ok / 无数据 empty
+    status = "degraded" if (not items and wm_fail and dd_fail) else ("ok" if items else "empty")
+    return FeedResponse(items=items, has_next=has_next, page=req.page, status=status)
 
 
 @router.post("/referral-link", response_model=ReferralLinkResponse, summary="换取推广链接(点抢时调)")
@@ -172,32 +256,42 @@ def referral_link(req: ReferralLinkRequest) -> ReferralLinkResponse:
 @router.post("/top-sales", response_model=CouponListResponse,
              summary="销量最高(从离线库 meituan_coupon 按销量降序 + 跨源去重,不实时打美团)")
 def top_sales(req: TopSalesRequest, db: Session = Depends(get_db)) -> CouponListResponse:
-    # 只取有销量档的(美团很多券没销量,排不了);按销量降序、同销量再按佣金降序
-    stmt = select(MeituanCoupon).where(MeituanCoupon.sale_volume_num.isnot(None))
-    if req.platform is not None:
-        stmt = stmt.where(MeituanCoupon.platform == req.platform)
-    stmt = stmt.order_by(
-        MeituanCoupon.sale_volume_num.desc(),
-        MeituanCoupon.commission_percent.desc(),
-    )
-    rows = db.execute(stmt).scalars().all()
+    # 去重 + 排序 + 分页全在 SQL 做,每页只取并解析当前页 ~20 条。
+    # (之前实现每翻一页都全表拉取 + 全量 from_raw 解析,翻页慢 → 客户端滑动卡顿/翻不动。)
+    # 库为空(prod 刚部署 / ETL 未跑完)时返空 + status=empty,不崩;库查询异常降级 degraded。
+    try:
+        # 1) DISTINCT ON (dedup_key):每个去重键(品牌|名|价)只留销量最高那条(同销量再按佣金)
+        base = select(MeituanCoupon).where(MeituanCoupon.sale_volume_num.isnot(None))
+        if req.platform is not None:
+            base = base.where(MeituanCoupon.platform == req.platform)
+        deduped = base.distinct(MeituanCoupon.dedup_key).order_by(
+            MeituanCoupon.dedup_key,
+            MeituanCoupon.sale_volume_num.desc(),
+            MeituanCoupon.commission_percent.desc(),
+        ).subquery()
 
-    # 跨源去重(dedup_key = 品牌|名|价):按销量降序遍历,每个 dedup_key 只留第一条(=销量最高那条)。
-    # 用 raw(整条原始返回)重建 CouponCard,字段与实时接口完全一致,前端无需改渲染。
-    seen: set[str] = set()
+        # 2) 对去重结果按销量降序分页;多取 1 条判断 has_next,只对本页做 from_raw
+        m = aliased(MeituanCoupon, deduped)
+        start = (req.page - 1) * req.page_size
+        rows = db.execute(
+            select(m)
+            # 加 id 作稳定 tiebreaker:同销量同佣金的并列项排序确定,避免跨页重复/漏项
+            .order_by(m.sale_volume_num.desc(), m.commission_percent.desc(), m.id)
+            .offset(start)
+            .limit(req.page_size + 1)
+        ).scalars().all()
+    except Exception:  # noqa: BLE001
+        logger.exception("[top-sales] 库查询失败,降级返空")
+        return CouponListResponse(items=[], has_next=False, search_id=None, status="degraded")
+
+    has_next = len(rows) > req.page_size
     cards: list[CouponCard] = []
-    for row in rows:
-        if row.dedup_key in seen:
-            continue
-        seen.add(row.dedup_key)
+    for row in rows[:req.page_size]:
         try:
             card = CouponCard.from_raw(row.raw or {})
         except Exception:  # noqa: BLE001
             continue
         if card.product_view_sign:
             cards.append(card)
-
-    start = (req.page - 1) * req.page_size
-    page_items = cards[start:start + req.page_size]
-    has_next = start + req.page_size < len(cards)
-    return CouponListResponse(items=page_items, has_next=has_next, search_id=None)
+    return CouponListResponse(items=cards, has_next=has_next, search_id=None,
+                              status="ok" if cards else "empty")

app/api/v1/platform.py

@@ -2,6 +2,7 @@
 
 路由前缀 `/api/v1/platform`:
   GET /stats   首页三统计(帮助用户 / 完成比价 / 累计节省),按运营后台配的模式算。
+  GET /flags   客户端运营 feature flag(比价/领券期广告开关等),客户端拉取后缓存。
 
 展示模式(real/manual/random,每指标独立)与计算逻辑见 app/repositories/ops_stat.py。
 """
@@ -12,9 +13,15 @@ import logging
 from fastapi import APIRouter, Query
 
 from app.api.deps import DbSession
+from app.repositories import app_config
 from app.repositories import ops_marquee as marquee_crud
 from app.repositories import ops_stat as crud
-from app.schemas.platform import PlatformStatsOut, SavingsFeedItem, SavingsFeedOut
+from app.schemas.platform import (
+    AppFlagsOut,
+    PlatformStatsOut,
+    SavingsFeedItem,
+    SavingsFeedOut,
+)
 
 logger = logging.getLogger("shagua.platform")
 
@@ -35,3 +42,12 @@ def stats(db: DbSession) -> PlatformStatsOut:
 def savings_feed(db: DbSession, limit: int = Query(8, ge=1, le=30)) -> SavingsFeedOut:
     items = marquee_crud.get_feed(db, limit=limit)
     return SavingsFeedOut(items=[SavingsFeedItem(**it) for it in items])
+
+
+@router.get("/flags", response_model=AppFlagsOut, summary="客户端运营 feature flag(不鉴权)")
+def flags(db: DbSession) -> AppFlagsOut:
+    """客户端拉取运营开关并缓存(app 启动 / 每场比价开始时刷新)。不鉴权:开关非敏感,
+    且比价无障碍服务取值时未必有登录态。值来自 app_config(admin 可改),空库回退默认。"""
+    return AppFlagsOut(
+        comparing_ad_enabled=bool(app_config.get_value(db, "comparing_ad_enabled")),
+    )

app/api/v1/signin.py

@@ -12,7 +12,9 @@ import logging
 from fastapi import APIRouter, HTTPException, status
 
 from app.api.deps import CurrentUser, DbSession
+from app.repositories import ad_reward as crud_ad
 from app.repositories import signin as crud_signin
+from app.repositories import wallet as crud_wallet
 from app.schemas.welfare import (
     SigninBoostRequest,
     SigninBoostResultOut,
@@ -54,14 +56,21 @@ def do_signin(user: CurrentUser, db: DbSession) -> SigninResultOut:
 def boost_signin(
     payload: SigninBoostRequest, user: CurrentUser, db: DbSession
 ) -> SigninBoostResultOut:
-    try:
-        record, balance = crud_signin.boost_today_signin(
-            db, user.id, ad_ref_id=payload.ad_ref_id
-        )
-    except crud_signin.NotSignedTodayError as e:
-        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="not signed today") from e
-    except crud_signin.AlreadyBoostedError as e:
-        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="already boosted today") from e
+    if not payload.ad_ref_id:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="ad reward required")
+    ad_rec = crud_ad.find_by_trans(db, payload.ad_ref_id)
+    if (
+        ad_rec is None
+        or ad_rec.user_id != user.id
+        or ad_rec.reward_scene != "signin_boost"
+        or ad_rec.status != "granted"
+    ):
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="ad reward not verified")
+    record = crud_signin.boost_by_ad_ref(db, user.id, payload.ad_ref_id)
+    if record is None:
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="signin boost not granted")
+    acc = crud_wallet.get_or_create_account(db, user.id)
+    balance = acc.coin_balance
 
     logger.info(
         "signin boost ok user_id=%d date=%s coin=%d",

app/api/v1/user.py

@@ -12,13 +12,19 @@ from __future__ import annotations
 
 import logging
 
-from fastapi import APIRouter, File, HTTPException, UploadFile
+from fastapi import APIRouter, File, HTTPException, Query, UploadFile
 
 from app.api.deps import CurrentUser, DbSession
 from app.core import media
+from app.repositories import onboarding as onboarding_repo
 from app.repositories import user as user_repo
 from app.schemas.auth import UserOut
-from app.schemas.user import OkResponse, ProfileUpdateRequest
+from app.schemas.user import (
+    OkResponse,
+    OnboardingCompleteRequest,
+    OnboardingStatusResponse,
+    ProfileUpdateRequest,
+)
 
 logger = logging.getLogger("shagua.user")
 
@@ -51,6 +57,34 @@ async def upload_avatar(
     return UserOut.model_validate(updated)
 
 
+@router.post("/onboarding/complete", response_model=OkResponse, summary="标记新手引导完成(按 设备+账号)")
+def complete_onboarding(
+    req: OnboardingCompleteRequest, user: CurrentUser, db: DbSession
+) -> OkResponse:
+    """走完新手引导时调一次。按 (当前账号, device_id) 落一条完成标记,跨卸载重装持久。
+    幂等:重复调用不报错。device_id 取客户端硬件级 ANDROID_ID,与登录请求一致。"""
+    onboarding_repo.mark_completed(db, user_id=user.id, device_id=req.device_id)
+    logger.info("onboarding complete user_id=%d device_len=%d", user.id, len(req.device_id))
+    return OkResponse()
+
+
+@router.get(
+    "/onboarding/status",
+    response_model=OnboardingStatusResponse,
+    summary="查新手引导是否已完成(按 设备+账号)",
+)
+def onboarding_status(
+    user: CurrentUser,
+    db: DbSession,
+    device_id: str = Query("", max_length=64, description="硬件级 ANDROID_ID;空=按未完成处理"),
+) -> OnboardingStatusResponse:
+    """已登录用户启动时查:该 (账号, 设备) 走过引导没。false → 客户端重走(运营在 admin 删了该设备
+    记录即触发)。替代原 force_onboarding(按用户)——改设备维度后这是"运营触发重走"的查询入口。
+    device_id 为空一律按未完成(同登录:不误跳过)。"""
+    completed = onboarding_repo.is_completed(db, user_id=user.id, device_id=device_id)
+    return OnboardingStatusResponse(completed=completed)
+
+
 @router.delete("", response_model=OkResponse, summary="注销账号(软删除)")
 def delete_account(user: CurrentUser, db: DbSession) -> OkResponse:
     media.delete_avatar(user.avatar_url)

app/api/v1/wallet.py

@@ -35,6 +35,7 @@ from app.schemas.welfare import (
     ExchangeResultOut,
     TransferAuthResultOut,
     TransferAuthStatusOut,
+    UnbindWechatRequest,
     UnbindWechatResultOut,
     WithdrawInfoOut,
     WithdrawOrderOut,
@@ -151,9 +152,24 @@ def bind_wechat(req: BindWechatRequest, user: CurrentUser, db: DbSession) -> Bin
 
 
 @router.post("/unbind-wechat", response_model=UnbindWechatResultOut, summary="解绑微信(清空 openid)")
-def unbind_wechat(user: CurrentUser, db: DbSession) -> UnbindWechatResultOut:
+def unbind_wechat(
+    user: CurrentUser, db: DbSession, req: UnbindWechatRequest | None = None
+) -> UnbindWechatResultOut:
+    # 有「待审核(reviewing)」提现单时,首次解绑拦下要求确认:这类单还没打款,确认解绑(force)
+    # 时会被立即退回现金余额(refund_reviewing_withdraws_on_unbind),后台不再挂单,用户需先知情。
+    # (pending 单转账已在途、解绑影响不到,不拦;见 has_reviewing_withdraw。)
+    force = req.force if req is not None else False
+    if not force and crud_wallet.has_reviewing_withdraw(db, user.id):
+        logger.info("unbind wechat needs_confirm(有待审核提现) user_id=%d", user.id)
+        return UnbindWechatResultOut(
+            bound=bool(user.wechat_openid),
+            needs_confirm=True,
+            message="你有提现正在审核中,解绑微信后这笔会自动退回到现金余额。确定解绑吗?",
+        )
+    # 先把待审核提现立即退回现金(无则 no-op),再清 openid —— 让"解绑即退"名副其实
+    refunded = crud_wallet.refund_reviewing_withdraws_on_unbind(db, user.id)
     crud_wallet.unbind_wechat_openid(db, user.id)
-    logger.info("unbind wechat ok user_id=%d", user.id)
+    logger.info("unbind wechat ok user_id=%d force=%s refunded_withdraws=%d", user.id, force, refunded)
     return UnbindWechatResultOut(bound=False)
 
 
@@ -176,7 +192,7 @@ def withdraw_info(user: CurrentUser, db: DbSession) -> WithdrawInfoOut:
     "/withdraw",
     response_model=WithdrawResultOut,
     summary="发起提现(扣款建单,待人工审核;审核通过后才打款)",
-    dependencies=[Depends(rate_limit(20, 60, "withdraw"))],  # #6 同 IP 每分钟≤20 次
+    dependencies=[Depends(rate_limit(5, 60, "withdraw"))],  # IP 级粗限流;用户级未完成单限制在仓库层
 )
 def withdraw(req: WithdrawRequest, user: CurrentUser, db: DbSession) -> WithdrawResultOut:
     # 提现发起本身不调微信(打款在审核通过后),但仍要求微信支付已配置——否则审核通过也打不了款,提前拦
@@ -189,12 +205,17 @@ def withdraw(req: WithdrawRequest, user: CurrentUser, db: DbSession) -> Withdraw
     except crud_wallet.InvalidWithdrawAmountError as e:
         raise HTTPException(
             status_code=status.HTTP_400_BAD_REQUEST,
-            detail=f"amount_cents must be within [{WITHDRAW_MIN_CENTS}, {WITHDRAW_MAX_CENTS}]",
+            detail="提现金额不符合要求",
         ) from e
     except crud_wallet.WechatNotBoundError as e:
-        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="wechat not bound") from e
+        raise HTTPException(status_code=status.HTTP_400_BAD_REQUEST, detail="请先绑定微信") from e
+    except crud_wallet.WithdrawTooFrequentError as e:
+        raise HTTPException(
+            status_code=status.HTTP_409_CONFLICT,
+            detail="已有提现申请正在审核或打款中,请处理完成后再申请",
+        ) from e
     except crud_wallet.InsufficientCashError as e:
-        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="insufficient cash balance") from e
+        raise HTTPException(status_code=status.HTTP_409_CONFLICT, detail="现金余额不足") from e
 
     # 调试直发(非生产):skip_review=true 时跳过人工审核,立即发起微信转账(等价 admin approve)。
     # 双闸保护——客户端仅 debug 包下发此 flag,服务端仅非 prod 才认;任一道闸拦住即恢复正常审核,

app/core/config.py

@@ -9,11 +9,16 @@ from functools import lru_cache
 from pathlib import Path
 from typing import Literal
 
-from pydantic import Field
+from pydantic import Field, model_validator
 from pydantic_settings import BaseSettings, SettingsConfigDict
 
 _PROJECT_ROOT = Path(__file__).resolve().parent.parent.parent
 
+# 生产环境 JWT secret 的最小可接受长度(字节)。HS256 推荐高熵随机串;<16 视为弱密钥。
+_MIN_PROD_SECRET_LEN = 16
+# 已知的占位默认值(代码里写死的 default),prod 下绝不能沿用。
+_INSECURE_SECRET_DEFAULTS = frozenset({"change-me", "change-me-admin", ""})
+
 
 class Settings(BaseSettings):
     model_config = SettingsConfigDict(
@@ -102,6 +107,13 @@ class Settings(BaseSettings):
     WXPAY_PUBLIC_KEY_PATH: str = "./secrets/pub_key.pem"             # 微信支付平台公钥
     WXPAY_TRANSFER_SCENE_ID: str = "1000"  # 转账场景 ID(1000=现金营销)
     WXPAY_REQUEST_TIMEOUT_SEC: int = 10
+    WITHDRAW_AUTO_RECONCILE_ENABLED: bool = False
+    WITHDRAW_AUTO_RECONCILE_INTERVAL_SEC: int = 300
+    WITHDRAW_AUTO_RECONCILE_OLDER_THAN_MINUTES: int = 15
+    # 0 点自动兑金币(由 deploy/daily-exchange.timer 触发 scripts.daily_auto_exchange)。
+    # 客户端已删手动兑入口、改为「0 点自动兑现金」,故默认开;运营要临时停可在 .env 置 false,
+    # 无需动 systemd timer——脚本读此开关,false 时直接 no-op 退出。
+    AUTO_EXCHANGE_ENABLED: bool = True
     # 免确认收款授权(用户授权免确认模式)的授权结果回调地址,必须公网可访问 HTTPS、不带参数。
     # 发起授权 / 首单顺带授权时作为 authorization_notify_url 传给微信。一期不处理回调内容
     # (授权状态靠 query 查询兜底),但微信要求该字段非空,故启用免确认前必须配置;留空时免确认相关接口返回未配置。
@@ -124,8 +136,15 @@ class Settings(BaseSettings):
 
     # ===== 穿山甲激励视频(服务端发奖回调)=====
     # 看完激励视频后穿山甲服务器回调本服务发金币(S2S,客户端被破解也刷不到)。
-    # PANGLE_REWARD_SECRET 是穿山甲后台配置的"奖励校验密钥",验签用,从后台取到后填 .env。
+    # 穿山甲后台配置的"奖励校验密钥"(m-key),验签用。每个 GroMore 广告位 m-key 不同(后台各自
+    # 生成),但共用同一回调 URL → 多个位的 m-key 都要配上。验签时所有非空 m-key 逐个试、任一通过
+    # 即接受(见 pangle.verify_callback_sign_any / 下面的 pangle_reward_secrets)。
     PANGLE_CALLBACK_ENABLED: bool = False
+    # 推荐:每个激励位的 m-key 分开一行配,清晰不混淆(留空的忽略)。
+    PANGLE_REWARD_SECRET_TEST: str = ""            # 测试应用 激励位 104099649
+    PANGLE_REWARD_SECRET_TEST_DEDICATED: str = ""  # 测试应用 专属激励位 104127529
+    PANGLE_REWARD_SECRET_PROD: str = ""            # 正式应用 激励位 104099389
+    # 旧用法:单个或逗号分隔的多个 m-key,仍兼容(会与上面三个命名项合并去重)。
     PANGLE_REWARD_SECRET: str = ""
 
     # ⚠️ 仅本地联调:打开后开放 POST /api/v1/ad/test-grant,让(已登录的)客户端在没部署公网、
@@ -133,10 +152,23 @@ class Settings(BaseSettings):
     # 它让客户端能自助发奖 = 绕过反作弊,**生产必须保持 False**(默认 False;只在本地 .env 设 true)。
     AD_REWARD_TEST_GRANT_ENABLED: bool = False
 
+    @property
+    def pangle_reward_secrets(self) -> list[str]:
+        """汇总所有 m-key 成列表(去空白、去空项、去重保序)。验签时逐个试、任一通过即接受
+        (见 pangle.verify_callback_sign_any)。来源可混用:三个命名项 + 旧的逗号分隔 PANGLE_REWARD_SECRET。"""
+        raw = [
+            *self.PANGLE_REWARD_SECRET.split(","),
+            self.PANGLE_REWARD_SECRET_TEST,
+            self.PANGLE_REWARD_SECRET_TEST_DEDICATED,
+            self.PANGLE_REWARD_SECRET_PROD,
+        ]
+        cleaned = [s.strip() for s in raw if s and s.strip()]
+        return list(dict.fromkeys(cleaned))  # 去重保序
+
     @property
     def pangle_callback_configured(self) -> bool:
-        """回调开关打开且验签密钥已配,才接受发奖回调。"""
-        return bool(self.PANGLE_CALLBACK_ENABLED and self.PANGLE_REWARD_SECRET)
+        """回调开关打开且至少配了一个验签密钥,才接受发奖回调。"""
+        return bool(self.PANGLE_CALLBACK_ENABLED and self.pangle_reward_secrets)
 
     # ===== Pricebot 上游 (领券/比价业务透传目标) =====
     # pricebot-backend 默认跑在 8000。/api/v1/coupon/step 会透传到这里的 /api/coupon/step
@@ -178,6 +210,13 @@ class Settings(BaseSettings):
     # MVP 落地页就放 app-server 的 /media 静态目录下(dl.html)。
     INVITE_LANDING_URL: str = "https://app-api.shaguabijia.com/media/dl.html"
 
+    # ===== CPS 群发短链跳转 =====
+    # 群发券链接套一层我们的短链 /c/{code} 做点击统计后 302 跳美团。这里是写进 admin
+    # 生成链接里的对外跳转域名前缀。本地填 http://localhost:8770;生产**强烈建议用独立
+    # 域名**(大量群发会被微信封,别用主 API 域名连累整个 App)。留空 → 跳转端点用请求
+    # 的 Host 兜底拼绝对地址。
+    CPS_REDIRECT_BASE: str = ""
+
     # ===== CORS =====
     CORS_ALLOW_ORIGINS: str = ""
 
@@ -191,6 +230,29 @@ class Settings(BaseSettings):
     def is_prod(self) -> bool:
         return self.APP_ENV == "prod"
 
+    @model_validator(mode="after")
+    def _enforce_prod_secrets(self) -> "Settings":
+        """prod 下强校验 JWT secret,弱/默认/空即启动报错(fail-fast,挡住 token 被伪造)。
+
+        只校验两个签发凭证:App 用户的 JWT_SECRET_KEY、后台的 ADMIN_JWT_SECRET——它们沿用默认值
+        时任何人都能伪造 access/admin token → 账号与后台失陷。INTERNAL_API_SECRET 默认空 = 内部端点
+        关闭(返 503),是安全的默认态,故不在此强制。dev 不触发,便于本地直接起。
+        """
+        if not self.is_prod:
+            return self
+        weak: list[str] = []
+        for name in ("JWT_SECRET_KEY", "ADMIN_JWT_SECRET"):
+            value = getattr(self, name)
+            if value in _INSECURE_SECRET_DEFAULTS or len(value) < _MIN_PROD_SECRET_LEN:
+                weak.append(name)
+        if weak:
+            raise ValueError(
+                f"APP_ENV=prod 但检测到弱/默认密钥: {', '.join(weak)} —— 必须改成 "
+                f"≥{_MIN_PROD_SECRET_LEN} 位高熵随机串(否则 JWT 可被伪造 → 用户/后台账号失陷)。"
+                f"生成示例: python -c \"import secrets; print(secrets.token_urlsafe(48))\""
+            )
+        return self
+
 
 @lru_cache(maxsize=1)
 def get_settings() -> Settings:

app/core/config_schema.py

@@ -11,12 +11,12 @@ from typing import Any
 
 from app.core import rewards as r
 
-# type 约定(给前端渲染编辑控件用):int / int_list / dict_str_int
+# type 约定(给前端渲染编辑控件用):int / int_list / dict_str_int / bool
 CONFIG_DEFS: dict[str, dict[str, Any]] = {
     "signin_rewards": {
-        "default": list(r.SIGNIN_REWARDS), "label": "签到 14 天金币档位",
+        "default": list(r.SIGNIN_REWARDS), "label": "签到 7 天金币档位",
         "group": "签到", "type": "int_list",
-        "help": "第 1~14 天每天签到发的金币;断签重置回第 1 天。长度需为 14。",
+        "help": "第 1~7 天每天签到发的金币;断签重置回第 1 天。长度需为 7。",
     },
     "min_exchange_coin": {
         "default": r.MIN_EXCHANGE_COIN, "label": "最低兑换金币",
@@ -42,7 +42,7 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
     "ad_reward_coin": {
         "default": r.AD_REWARD_COIN, "label": "看广告单次金币",
         "group": "看广告", "type": "int",
-        "help": "看完一个激励视频发的金币;须与穿山甲后台代码位'奖励数量'保持一致。",
+        "help": "历史兼容/测试展示值;正式发放按 eCPM 公式计算。",
     },
     "ad_daily_limit": {
         "default": r.DAILY_AD_REWARD_LIMIT, "label": "看广告每日上限(次)",
@@ -50,7 +50,7 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
     },
     "ad_max_coin": {
         "default": r.MAX_AD_REWARD_COIN, "label": "看广告单次金币上限",
-        "group": "看广告", "type": "int", "help": "夹紧穿山甲回调里异常的 reward_amount,防刷爆。",
+        "group": "看广告", "type": "int", "help": "历史 reward_amount 口径保留项;正式发放按 eCPM 公式计算。",
     },
     "ad_round_count": {
         "default": r.VIDEO_ROUND_REQUIRED_COUNT, "label": "每轮看广告次数",
@@ -60,4 +60,28 @@ CONFIG_DEFS: dict[str, dict[str, Any]] = {
         "default": r.VIDEO_ROUND_COOLDOWN_SECONDS, "label": "广告关闭后冷却(秒)",
         "group": "看广告", "type": "int", "help": "点击退出广告后,下次点击观看前的冷却时间,默认 3 秒。",
     },
+    "signin_boost_coin": {
+        "default": r.SIGNIN_BOOST_COIN, "label": "签到膨胀固定金币",
+        "group": "签到", "type": "int",
+        "help": "Day1-Day6 签到后看完激励视频额外发放的固定金币;Day7 不展示也不允许膨胀。",
+    },
+    "comparing_ad_enabled": {
+        "default": True, "label": "比价/领券期信息流广告",
+        "group": "看广告", "type": "bool",
+        "help": (
+            "开启后,比价进行中 + 领券等候期会在悬浮窗展示穿山甲信息流广告(变现行为);"
+            "关闭则全程不出广告。客户端按 app 启动 / 每场比价开始时拉取并缓存,故为「最终一致」的"
+            "远程开关(下一场比价生效),用于出问题时无需发版即可快速止血。debug 包可用本地开关覆盖。"
+        ),
+    },
+    "withdraw_auto_reconcile_enabled": {
+        "default": True, "label": "提现自动对账",
+        "group": "钱包", "type": "bool",
+        "help": (
+            "开启后后台 worker 每隔一段时间自动扫描超时仍「打款中」的提现单并归一化"
+            "(查微信/退款/撤单)。需部署侧 env WITHDRAW_AUTO_RECONCILE_ENABLED=true 启动 worker "
+            "进程后此开关才起效;扫描间隔/超时阈值仍由 env 控制。关掉只停自动扫描,"
+            "提现页「批量对账」手动按钮不受影响。"
+        ),
+    },
 }

app/core/rewards.py

@@ -17,11 +17,10 @@ def cn_today() -> date:
     return datetime.now(CN_TZ).date()
 
 
-# ===== 签到:14 天循环,断签重置回第 1 天 =====
-# 第 1→14 天的金币奖励,签到逻辑用 cycle_day(1..14)索引。
+# ===== 签到:7 天循环,断签重置回第 1 天(原型 2026-06 由 14 天改 7 天一轮)=====
+# 第 1→7 天的金币奖励,签到逻辑用 cycle_day(1..7)索引;一轮 7 天累计 2500 金币(对原型 banner)。
 SIGNIN_REWARDS: tuple[int, ...] = (
-    200, 120, 150, 180, 200, 250, 500,
-    200, 250, 300, 350, 400, 500, 3000,
+    200, 200, 300, 200, 400, 400, 800,
 )
 SIGNIN_CYCLE_LEN: int = len(SIGNIN_REWARDS)
 
@@ -57,13 +56,40 @@ WITHDRAW_MAX_CENTS: int = 5_000_000  # 5 万元
 TASK_ENABLE_NOTIFICATION = "enable_notification"
 
 # task_key -> 奖励金币
-# 打开消息提醒: 1000 金币(=¥0.1, 客户端原型展示口径; 量级与签到/里程碑相称)。
+# 打开消息提醒: 750 金币(客户端原型展示口径 2026-06 调 1000→750; 量级与签到/里程碑相称)。
 # 注意: 不再 = 兑换下限(下限已降到 MIN_EXCHANGE_COIN=COIN_PER_CENT=100), test_exchange_flow 改走 grant_coins 直接供款。
+# ⚠️打开消息提醒是「可重复领取」任务(2026-06):每次开启通知发一次,金额逐次减半(见 notification_reward),
+# 这里的 750 是首次(基数)。客户端只在「通知权限关闭」时展示该任务,开着就隐藏。
 TASK_REWARDS: dict[str, int] = {
-    TASK_ENABLE_NOTIFICATION: 1000,
+    TASK_ENABLE_NOTIFICATION: 750,
 }
 
 
+def notification_reward(base: int, times_claimed: int) -> int:
+    """打开消息提醒第 (times_claimed+1) 次领取的金币。
+
+    基数 base(=750)起,每次减半、四舍五入到整数、最低 1:
+      750 → 375 → 188 → 94 → 47 → 24 → 12 → 6 → 3 → 2 → 1 → 1 …
+    (四舍五入用 (x+1)//2,匹配产品给的 750/375/188/94 序列。)
+    """
+    r = max(1, base)
+    for _ in range(max(0, times_claimed)):
+        r = max(1, (r + 1) // 2)
+    return r
+
+
+def notification_max_claims(base: int) -> int:
+    """打开消息提醒最多可领取的次数:减半到最低 1 那次为止(含),之后不再可领。
+
+    防止「通知一直关着」时无限刷最低档 1 金币(发放上限闸,服务端硬限,不依赖客户端只在
+    通知关闭时才展示的约定)。base=750 时序列 750→…→1 在第 11 次落到 1,故上限 11 次。
+    """
+    n = 0
+    while notification_reward(base, n) > 1:
+        n += 1
+    return n + 1  # 含第一次减半到 1 的那一次
+
+
 # ===== 比价战绩里程碑(累计成功比价 N 次,逐档解锁领金币)=====
 # 第 1→6 次的金币奖励(1-based:第 N 次比价解锁第 N 档)。值沿用客户端原型档位。
 # 数据源是 comparison_record 里 status='success' 的条数;每档领一次,
@@ -77,6 +103,12 @@ def record_milestone_reward(milestone: int) -> int:
     return RECORD_MILESTONES[milestone - 1]
 
 
+# ===== 上报更低价(人工审核通过发固定金币)=====
+# 用户上报"某平台比我们算的最低价更便宜"+ 截图,经运营后台人工审核通过后发放的固定金币奖励。
+# 与广告/任务同量级;固定值(产品 2026-06 定),要调直接改这里;客户端记录页按 reward_coins 显示。
+PRICE_REPORT_REWARD_COINS: int = 1000
+
+
 # ===== 邀请好友(注册即生效,邀请人 + 被邀请人各发金币)=====
 # 10000 金币 = 1 元,双方各得 1 元。MVP 先用固定常量(不走 app_config)。
 INVITE_INVITER_COINS: int = 10000
@@ -85,9 +117,18 @@ INVITE_INVITEE_COINS: int = 10000
 # 自动绑(剪贴板)在首次注册登录后几秒内发生;留 72h 给手动填码兜底。
 INVITE_NEW_USER_WINDOW_HOURS: int = 72
 
+# 指纹归因兜底(剪贴板被覆盖时):落地页 POST /landing-track 存的指纹记录,在此窗口内可被
+# /bind 反查撞库。窗口取舍:太短(24h)覆盖不到"晚上看链接、第二天装"的常见场景;太宽
+# (30d)IP/设备会漂、匹配错率上升。7 天兼顾"看广告→使用"周期与匹配精度。
+INVITE_FP_WINDOW_DAYS: int = 7
+
 
 # ===== 看激励视频 / 信息流广告发金币 =====
-# 金币数值体系约定:eCPM 单位按"元/千次展示"处理,单次收入 = eCPM / 1000 元。
+# eCPM 取自穿山甲 SDK getShowEcpm().getEcpm(),官方口径单位是【分/千次展示】(不是元!
+# csjplatform 文档原文"通过 getEcpm 获取的单位是分")。计算时先 ÷100 转成元;
+# 因子1 档位阈值按【元/千次】定(100/200/400 元 = ¥100/¥200/¥400 CPM,产品口径 2026-06-09)。
+# 注:真实 eCPM 一般 <¥100 CPM,故多落最低档 0.1,高档基本不触发——这是产品有意的取舍。
+# 单次展示收益(元) = eCPM元 ÷ 1000(每千次→单次)。
 AD_ECPM_FACTOR_TABLE: tuple[tuple[float, int, int | None], ...] = (
     (0.1, 0, 100),
     (0.3, 101, 200),
@@ -102,9 +143,16 @@ AD_LT_FACTOR_TABLE: tuple[tuple[float, int, int | None], ...] = (
     (1.0, 11, None),
 )
 
+# 客户端可影响的 eCPM 可信上限(分/千次展示):信息流广告一期由客户端上报 eCPM,伪造天价 eCPM
+# 可铸出天量金币(见 calculate_ad_reward_coin)。真实 eCPM 一般 <¥100 CPM(=10000 分),档位表顶档
+# 为 >¥400(=40000 分);取 ¥500 CPM=50000 分,留足真实头部余量又封死伪造值。钳在唯一计算口
+# calculate_ad_reward_coin,故 feed 与 reward_video(回退客户端上报 eCPM 时)一并护住;阈值设在所有
+# 真实值之上,不会少发正规奖励。
+AD_ECPM_MAX_FEN: int = 50_000
 
-def parse_ecpm_yuan(ecpm: str | int | float | None) -> float:
-    """解析 eCPM 原始值。当前产品口径:SDK 返回值按"元/千次展示"处理。"""
+
+def parse_ecpm_fen(ecpm: str | int | float | None) -> float:
+    """解析 eCPM 原始值(穿山甲 getEcpm 原值,单位=分/千次展示)。非法/缺失→0。"""
     if ecpm is None:
         return 0.0
     try:
@@ -114,8 +162,14 @@ def parse_ecpm_yuan(ecpm: str | int | float | None) -> float:
     return max(0.0, value)
 
 
+def parse_ecpm_yuan(ecpm: str | int | float | None) -> float:
+    """eCPM 转成元(getEcpm 原值是分,÷100)。因子档位判定与收益换算都用元。"""
+    return parse_ecpm_fen(ecpm) / 100.0
+
+
 def ad_ecpm_factor(ecpm_yuan: float) -> float:
-    """eCPM 档位因子:0-100=0.1,101-200=0.3,201-400=0.4,>400=0.6。"""
+    """eCPM 档位因子(阈值单位=元/千次):≤100=0.1,101-200=0.3,201-400=0.4,>400=0.6。
+    产品口径(2026-06-09):阈值按元判档;真实 eCPM(<¥100 CPM)多落最低档 0.1。"""
     if ecpm_yuan > 400:
         return 0.6
     if ecpm_yuan > 200:
@@ -125,33 +179,40 @@ def ad_ecpm_factor(ecpm_yuan: float) -> float:
     return 0.1
 
 
-def ad_lt_factor(today_count_after_this: int) -> float:
-    """LT 因子。today_count_after_this 是当天累计第 N 条/份广告奖励。"""
-    count = max(1, today_count_after_this)
+def ad_lt_factor(count_after_this: int) -> float:
+    """LT 因子。count_after_this 是该账号累计第 N 条/份看视频奖励(不按天重置)。"""
+    count = max(1, count_after_this)
     for factor, lo, hi in AD_LT_FACTOR_TABLE:
         if count >= lo and (hi is None or count <= hi):
             return factor
     return 1.0
 
 
-def calculate_ad_reward_coin(ecpm: str | int | float | None, today_count_after_this: int) -> int:
+def calculate_ad_reward_coin(ecpm: str | int | float | None, count_after_this: int) -> int:
     """按金币数值体系计算单份广告奖励金币。
 
-    单次奖励(元)=eCPM/1000 × 因子1(eCPM 档) × 因子2(LT);再按 1 元=10000 金币取整。
+    eCPM 是穿山甲 getEcpm 原值,单位【分/千次展示】;先 ÷100 转成元(因子判档 + 收益换算都用元)。
+    单次收益(元)= eCPM元 ÷ 1000(每千次→单次) × 因子1(eCPM 元档) × 因子2(LT);
+    再按 1 元=10000 金币取整。count_after_this 为账号累计第 N 次看视频(LT 因子用,不按天重置)。
+
+    eCPM 在此先钳到 AD_ECPM_MAX_FEN(¥500 CPM):信息流广告一期 eCPM 由客户端上报,伪造天价值
+    会铸天量金币;钳在这唯一入口,feed 与 reward_video 回退客户端 eCPM 的路径都护住,且阈值高于
+    所有真实值,不影响正规发奖。
     """
-    ecpm_yuan = parse_ecpm_yuan(ecpm)
-    yuan = (ecpm_yuan / 1000.0) * ad_ecpm_factor(ecpm_yuan) * ad_lt_factor(today_count_after_this)
+    ecpm_yuan = min(parse_ecpm_yuan(ecpm), AD_ECPM_MAX_FEN / 100.0)
+    yuan = (ecpm_yuan / 1000.0) * ad_ecpm_factor(ecpm_yuan) * ad_lt_factor(count_after_this)
     return max(0, round(yuan * COIN_PER_YUAN))
 
 
+# 签到看广告膨胀:S2S 固定补发(原型 2026-06 由 2000 提到 3000,对应 CTA「看广告最高膨胀至3000金币」)。
+SIGNIN_BOOST_COIN: int = 3000
+
+
 # ===== 看激励视频发金币(穿山甲 S2S 服务端回调发奖)=====
-# 看完一个激励视频发的金币(666 金币 ≈¥0.0666,汇率 10000 金币=1 元)。
-# 作用:① 回调缺/坏 reward_amount 时的回退值;② 客户端进度接口展示的"单次预告金币";
-#       ③ test-grant 本地联调的发奖额。
-# 真实发放以穿山甲回调带回的 reward_amount 为准(见 resolve_ad_reward_coin),后台应把
-# 代码位"奖励数量"配成与本值一致(=666),保证"广告内展示 / 进度预告 / 实际到账"三者一致。
+# 历史固定金币口径保留项。正式激励视频实发按 calculate_ad_reward_coin(eCPM, 当日第 N 次)
+# 计算;该值只用于旧接口兼容、配置页展示和本地联调兜底。
 AD_REWARD_COIN: int = 666
-# 单次发奖金币上限:夹紧穿山甲回调里异常的 reward_amount(如后台多打一个 0),防刷爆余额。
+# 历史 reward_amount 口径保留项。正式激励视频实发按 eCPM 公式计算。
 MAX_AD_REWARD_COIN: int = 1000
 # 每用户每日发奖次数上限。产品口径:一天最多看 500 次广告。
 DAILY_AD_REWARD_LIMIT: int = 500
@@ -169,7 +230,7 @@ VIDEO_ROUND_COOLDOWN_SECONDS: int = 3
 
 
 def resolve_ad_reward_coin(db, reward_amount: str | int | None) -> int:  # noqa: ANN001
-    """把穿山甲回调的 reward_amount(后台代码位配的"奖励数量")解析成本次发放金币。
+    """历史 reward_amount 口径解析函数,保留给旧脚本/旧配置兼容。
 
     缺失 / 非数字 / ≤0 → 回退配置单次金币;超过配置单次上限 → 夹紧(均从 app_config 读)。
     注:reward_amount 不参与穿山甲 sign(只签 trans_id),但伪造回调需先伪造合法 sign
@@ -236,3 +297,7 @@ def get_ad_round_count(db) -> int:  # noqa: ANN001
 
 def get_ad_cooldown_sec(db) -> int:  # noqa: ANN001
     return int(_cfg(db, "ad_cooldown_sec"))
+
+
+def get_signin_boost_coin(db) -> int:  # noqa: ANN001
+    return int(_cfg(db, "signin_boost_coin"))

app/core/withdraw_reconcile_worker.py

@@ -0,0 +1,131 @@
+"""提现 pending 单自动对账后台任务。"""
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import logging
+import os
+import time
+from collections.abc import Iterator
+from pathlib import Path
+
+from sqlalchemy.exc import SQLAlchemyError
+
+from app.core.config import settings
+from app.db.session import SessionLocal
+from app.integrations.wxpay import WxPayNotConfiguredError
+from app.repositories import app_config
+from app.repositories import wallet as wallet_repo
+
+_AUTO_RECONCILE_KEY = "withdraw_auto_reconcile_enabled"
+
+logger = logging.getLogger("shagua.withdraw_reconcile")
+_LOCK_PATH = Path(__file__).resolve().parents[2] / "data" / "withdraw_reconcile.lock"
+
+
+def _touch_lock() -> None:
+    with contextlib.suppress(FileNotFoundError):
+        os.utime(_LOCK_PATH, None)
+
+
+@contextlib.contextmanager
+def _single_instance_lock(stale_after_sec: int) -> Iterator[bool]:
+    """同机多进程保护:同一时间只允许一个自动查单 worker 运行。"""
+    _LOCK_PATH.parent.mkdir(parents=True, exist_ok=True)
+    fd: int | None = None
+    try:
+        try:
+            fd = os.open(str(_LOCK_PATH), os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+        except FileExistsError:
+            try:
+                age = time.time() - _LOCK_PATH.stat().st_mtime
+            except FileNotFoundError:
+                age = stale_after_sec + 1
+            if age > stale_after_sec:
+                with contextlib.suppress(FileNotFoundError):
+                    _LOCK_PATH.unlink()
+                try:
+                    fd = os.open(str(_LOCK_PATH), os.O_CREAT | os.O_EXCL | os.O_WRONLY)
+                except FileExistsError:
+                    fd = None
+
+        if fd is None:
+            yield False
+            return
+
+        os.write(fd, f"pid={os.getpid()} started_at={int(time.time())}\n".encode("ascii"))
+        yield True
+    finally:
+        if fd is not None:
+            os.close(fd)
+            with contextlib.suppress(FileNotFoundError):
+                _LOCK_PATH.unlink()
+
+
+def _reconcile_once(older_than_minutes: int) -> dict | None:
+    """读运营开关(app_config):关着返回 None(本轮跳过),开着才真扫单。
+
+    env WITHDRAW_AUTO_RECONCILE_ENABLED 是部署级总闸(决定 worker 起不起);
+    这里的 DB 开关是运营级日常开关,后台一改下一轮即生效、跨进程一致、无需重启。
+    """
+    with SessionLocal() as db:
+        if not app_config.get_value(db, _AUTO_RECONCILE_KEY):
+            return None
+        return wallet_repo.reconcile_pending_withdraws(db, older_than_minutes=older_than_minutes)
+
+
+async def _run_loop() -> None:
+    interval = max(30, int(settings.WITHDRAW_AUTO_RECONCILE_INTERVAL_SEC))
+    older_than = max(1, int(settings.WITHDRAW_AUTO_RECONCILE_OLDER_THAN_MINUTES))
+    lock_stale_after = max(interval * 3, 600)
+    with _single_instance_lock(lock_stale_after) as lock_acquired:
+        if not lock_acquired:
+            logger.warning("withdraw auto reconcile skipped: another worker owns lock")
+            return
+
+        await _run_locked_loop(interval, older_than)
+
+
+async def _run_locked_loop(interval: int, older_than: int) -> None:
+    logger.info(
+        "withdraw auto reconcile worker started interval=%ss older_than=%sm "
+        "(runtime on/off via app_config '%s')",
+        interval,
+        older_than,
+        _AUTO_RECONCILE_KEY,
+    )
+    try:
+        while True:
+            try:
+                _touch_lock()
+                result = await asyncio.to_thread(_reconcile_once, older_than)
+                if result is not None and (result["checked"] or result["resolved"]):
+                    logger.info("withdraw auto reconcile result=%s", result)
+            except WxPayNotConfiguredError:
+                logger.warning("withdraw auto reconcile skipped: wxpay not configured")
+            except SQLAlchemyError:
+                logger.exception("withdraw auto reconcile db error")
+            except Exception:  # noqa: BLE001 - 后台任务不能因单次异常退出
+                logger.exception("withdraw auto reconcile unexpected error")
+            await asyncio.sleep(interval)
+    except asyncio.CancelledError:
+        logger.info("withdraw auto reconcile stopped")
+        raise
+
+
+def start_withdraw_reconcile_worker() -> asyncio.Task | None:
+    if not settings.WITHDRAW_AUTO_RECONCILE_ENABLED:
+        # 部署级总闸关:worker 进程不启动(运营后台开关此时无效,需先在 env 打开)。
+        logger.info("withdraw auto reconcile worker not started (env master switch off)")
+        return None
+    if not settings.wxpay_configured:
+        logger.warning("withdraw auto reconcile enabled but wxpay not configured")
+    return asyncio.create_task(_run_loop(), name="withdraw-auto-reconcile")
+
+
+async def stop_withdraw_reconcile_worker(task: asyncio.Task | None) -> None:
+    if task is None:
+        return
+    task.cancel()
+    with contextlib.suppress(asyncio.CancelledError):
+        await task

app/integrations/cities.py

@@ -0,0 +1,34 @@
+# -*- coding: utf-8 -*-
+"""美团城市字典(地级市)读取。
+
+数据源:app/integrations/data/meituan_cities.json,由 tools/gen_meituan_cities.py 从
+美团官方「城市字典」Excel 生成(359 个地级市:city_id / 城市名 / 省份)。
+实测一个地级市 cityId 已覆盖其下辖县级市供给(徐州 → 邳州 / 新沂 / 睢宁 …),故无区县层级。
+
+- ETL(scripts/pull_meituan_coupons.py)遍历 all_cities() 全量抓取入库。
+- 读取侧将来「按城市过滤」时,也从这里取 city_id ↔ 城市名映射。
+"""
+from __future__ import annotations
+
+import functools
+import json
+from pathlib import Path
+
+_JSON = Path(__file__).resolve().parent / "data" / "meituan_cities.json"
+
+
+@functools.lru_cache(maxsize=1)
+def all_cities() -> list[dict]:
+    """全部城市 [{city_id, name, province}, ...](359 个地级市)。"""
+    return json.loads(_JSON.read_text(encoding="utf-8"))
+
+
+@functools.lru_cache(maxsize=1)
+def _by_id() -> dict[str, dict]:
+    return {c["city_id"]: c for c in all_cities()}
+
+
+def city_name(city_id: str) -> str | None:
+    """city_id → 城市名(查不到返回 None)。"""
+    c = _by_id().get(city_id)
+    return c["name"] if c else None

app/integrations/meituan.py

@@ -126,13 +126,23 @@ def query_coupon(
 
 def get_referral_link(
     *,
-    product_view_sign: str,
+    product_view_sign: str | None = None,
+    act_id: str | None = None,
     platform: int = 1,
     biz_line: int | None = None,
     sid: str | None = None,
     link_type_list: list[int] | None = None,
 ) -> dict[str, Any]:
-    body: dict[str, Any] = {"productViewSign": product_view_sign}
+    """换推广链接。actId(活动物料)与 productViewSign(商品券)二选一。
+    用 actId 入参时,出参 data 为 null,链接全在 referralLinkMap(实测)。
+    """
+    if not act_id and not product_view_sign:
+        raise MeituanCpsError("act_id 或 product_view_sign 必填其一")
+    body: dict[str, Any] = {}
+    if act_id:
+        body["actId"] = act_id
+    else:
+        body["productViewSign"] = product_view_sign
     if platform == 2:
         body["platform"] = 2
         if biz_line is not None:
@@ -142,3 +152,30 @@ def get_referral_link(
     body["linkTypeList"] = link_type_list or [1, 3]
 
     return _call("/cps_open/common/api/v1/get_referral_link", body)
+
+
+def query_order(
+    *,
+    sid: str | None = None,
+    start_time: int,
+    end_time: int,
+    query_time_type: int = 1,
+    page: int = 1,
+    limit: int = 100,
+) -> dict[str, Any]:
+    """按时间窗(+可选 sid)拉 CPS 订单做对账。实测要点:
+    - 分页是 page / limit(不是 pageNo/pageSize);startTime/endTime 是 10 位秒级时间戳
+    - query_time_type: 1 按支付时间 2 按更新时间
+    - 响应 data.dataList[],每条含 orderId / sid / payPrice(元) / profit(元) /
+      commissionRate / status(2付款 3完成 4取消 5风控 6结算) / payTime(秒) / actId 等
+    """
+    body: dict[str, Any] = {
+        "queryTimeType": query_time_type,
+        "startTime": start_time,
+        "endTime": end_time,
+        "page": page,
+        "limit": limit,
+    }
+    if sid:
+        body["sid"] = sid
+    return _call("/cps_open/common/api/v1/query_order", body)

app/integrations/pangle.py

@@ -8,9 +8,9 @@
 我们客户端是 useMediation(true) 融合,回调走 GroMore 广告位层级,**不是**联盟代码位层级):
 **sign = SHA256("{m-key}:{trans_id}")** 的十六进制串。注意:
 - 是**普通 SHA256**,不是 HMAC,也不是 RSA;
-- **只对 `m-key:trans_id` 这一个字符串**签名,user_id / reward_amount 等其余参数**不参与**签名
+- **只对 `m-key:trans_id` 这一个字符串**签名,user_id / ecpm / extra 等其余参数**不参与**签名
   (它们的可信度由"能算出正确 sign = 知道 m-key"间接保证——伪造者没有 m-key 就连合法 sign
-  都造不出,自然也无法注入假 user_id/reward_amount)。
+  都造不出,自然也无法注入假 user_id/ecpm/extra)。
 m-key(安全密钥)在穿山甲后台「GroMore 聚合管理 → 搜广告位ID → 编辑」处获取,配到
 `settings.PANGLE_REWARD_SECRET`。(联盟代码位层级用的是另一套 Security Key + isValid 响应,我们不走那条。)
 """
@@ -42,3 +42,13 @@ def verify_callback_sign(params: dict[str, str], secret: str) -> bool:
     got = params.get("sign") or ""
     expect = build_sign(trans_id, secret)
     return hmac.compare_digest(got, expect)
+
+
+def verify_callback_sign_any(params: dict[str, str], secrets: list[str]) -> bool:
+    """对**多个** m-key 逐个验签,任一通过即接受。
+
+    多广告位场景:每个 GroMore 广告位的 m-key 由后台各自生成、互不相同,但本服务用
+    同一个回调 URL 接所有位的回调。配置里放多个密钥(逗号分隔),回调到达时挨个试。
+    仍然安全:伪造者必须知道其中某个 m-key 才能算出合法 sign;空列表 → 一律失败。
+    """
+    return any(verify_callback_sign(params, s) for s in secrets if s)

app/integrations/wxpay.py

@@ -14,7 +14,9 @@ import base64
 import json
 import time
 import uuid
+from pathlib import Path
 
+import certifi
 import httpx
 from cryptography.hazmat.primitives import hashes, serialization
 from cryptography.hazmat.primitives.asymmetric import padding
@@ -23,6 +25,7 @@ from cryptography.hazmat.primitives.asymmetric.rsa import RSAPrivateKey, RSAPubl
 from app.core.config import settings
 
 _API_HOST = "https://api.mch.weixin.qq.com"
+_PROJECT_ROOT = Path(__file__).resolve().parents[2]
 _TRANSFER_PATH = "/v3/fund-app/mch-transfer/transfer-bills"
 # 免确认收款授权(用户授权免确认模式)
 _AUTH_PATH = "/v3/fund-app/mch-transfer/user-confirm-authorization"
@@ -38,15 +41,30 @@ class WxPayNotConfiguredError(Exception):
     """微信支付凭证 / 证书缺失,无法调用。"""
 
 
+def _http_client() -> httpx.Client:
+    """微信相关 HTTP 客户端。
+
+    显式使用当前 Python 环境的 certifi 证书,避免被外部 SSL_CERT_FILE 指到不存在文件。
+    代理仍允许从环境变量读取,方便本地开发。
+    """
+    return httpx.Client(verify=certifi.where())
+
+
+def _resolve_config_path(value: str) -> Path:
+    path = Path(value)
+    return path if path.is_absolute() else _PROJECT_ROOT / path
+
+
 def _load_private_key() -> RSAPrivateKey:
     global _private_key
     if _private_key is None:
+        key_path = _resolve_config_path(settings.WXPAY_MCH_PRIVATE_KEY_PATH)
         try:
-            with open(settings.WXPAY_MCH_PRIVATE_KEY_PATH, "rb") as f:
+            with key_path.open("rb") as f:
                 _private_key = serialization.load_pem_private_key(f.read(), password=None)
         except FileNotFoundError as e:
             raise WxPayNotConfiguredError(
-                f"商户私钥不存在: {settings.WXPAY_MCH_PRIVATE_KEY_PATH}"
+                f"商户私钥不存在: {key_path}"
             ) from e
     return _private_key
 
@@ -54,12 +72,13 @@ def _load_private_key() -> RSAPrivateKey:
 def _load_public_key() -> RSAPublicKey:
     global _public_key
     if _public_key is None:
+        key_path = _resolve_config_path(settings.WXPAY_PUBLIC_KEY_PATH)
         try:
-            with open(settings.WXPAY_PUBLIC_KEY_PATH, "rb") as f:
+            with key_path.open("rb") as f:
                 _public_key = serialization.load_pem_public_key(f.read())
         except FileNotFoundError as e:
             raise WxPayNotConfiguredError(
-                f"微信支付平台公钥不存在: {settings.WXPAY_PUBLIC_KEY_PATH}"
+                f"微信支付平台公钥不存在: {key_path}"
             ) from e
     return _public_key
 
@@ -126,7 +145,7 @@ def create_transfer(
         "Content-Type": "application/json",
         "Wechatpay-Serial": settings.WXPAY_PUBLIC_KEY_ID,
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_TRANSFER_PATH}",
             content=body_str,
@@ -143,7 +162,7 @@ def query_transfer(out_bill_no: str) -> dict:
         "Authorization": _build_authorization("GET", path, ""),
         "Accept": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.get(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -159,7 +178,7 @@ def cancel_transfer(out_bill_no: str) -> dict:
         "Accept": "application/json",
         "Content-Type": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -171,16 +190,17 @@ def code_to_userinfo(code: str) -> dict:
     返回 {openid, nickname, avatar_url, raw}。失败抛 ValueError。
     注意:微信隐私新政下,部分 app 的 sns/userinfo 可能返回脱敏值(昵称"微信用户"/灰头像);
     nickname/avatar_url 可能为空,调用方需兜底。"""
-    r1 = httpx.get(
-        "https://api.weixin.qq.com/sns/oauth2/access_token",
-        params={
-            "appid": settings.WECHAT_APP_ID,
-            "secret": settings.WECHAT_APP_SECRET,
-            "code": code,
-            "grant_type": "authorization_code",
-        },
-        timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
-    )
+    with _http_client() as client:
+        r1 = client.get(
+            "https://api.weixin.qq.com/sns/oauth2/access_token",
+            params={
+                "appid": settings.WECHAT_APP_ID,
+                "secret": settings.WECHAT_APP_SECRET,
+                "code": code,
+                "grant_type": "authorization_code",
+            },
+            timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
+        )
     d1 = r1.json()
     if "openid" not in d1 or "access_token" not in d1:
         raise ValueError(f"微信授权失败: {d1.get('errmsg', d1)}")
@@ -191,11 +211,12 @@ def code_to_userinfo(code: str) -> dict:
     raw: dict = {}
     # userinfo 拉取失败不应让绑定失败(openid 已拿到),吞掉异常只是没昵称头像
     try:
-        r2 = httpx.get(
-            "https://api.weixin.qq.com/sns/userinfo",
-            params={"access_token": d1["access_token"], "openid": openid, "lang": "zh_CN"},
-            timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
-        )
+        with _http_client() as client:
+            r2 = client.get(
+                "https://api.weixin.qq.com/sns/userinfo",
+                params={"access_token": d1["access_token"], "openid": openid, "lang": "zh_CN"},
+                timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC,
+            )
         raw = r2.json()
         nickname = raw.get("nickname") or None
         avatar_url = raw.get("headimgurl") or None
@@ -244,7 +265,7 @@ def apply_transfer_authorization(
         "Accept": "application/json",
         "Content-Type": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_AUTH_PATH}",
             content=body_str,
@@ -262,7 +283,7 @@ def query_transfer_authorization(out_authorization_no: str) -> dict:
         "Authorization": _build_authorization("GET", path, ""),
         "Accept": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.get(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -277,7 +298,7 @@ def close_transfer_authorization(out_authorization_no: str) -> dict:
         "Accept": "application/json",
         "Content-Type": "application/json",
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{path}", headers=headers, timeout=settings.WXPAY_REQUEST_TIMEOUT_SEC
         )
@@ -319,7 +340,7 @@ def pre_transfer_with_authorization(
         "Content-Type": "application/json",
         "Wechatpay-Serial": settings.WXPAY_PUBLIC_KEY_ID,
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_PRE_TRANSFER_AUTH_PATH}",
             content=body_str,
@@ -356,7 +377,7 @@ def transfer_with_authorization(
         "Content-Type": "application/json",
         "Wechatpay-Serial": settings.WXPAY_PUBLIC_KEY_ID,
     }
-    with httpx.Client() as client:
+    with _http_client() as client:
         resp = client.post(
             f"{_API_HOST}{_TRANSFER_WITH_AUTH_PATH}",
             content=body_str,

app/main.py

@@ -20,7 +20,9 @@ from app.api.v1.compare import router as compare_router
 from app.api.v1.compare_milestone import router as compare_milestone_router
 from app.api.v1.compare_record import router as compare_record_router
 from app.api.v1.coupon import router as coupon_router
+from app.api.v1.cps_redirect import router as cps_redirect_router
 from app.api.internal.price import router as internal_price_router
+from app.api.internal.store import router as internal_store_router
 from app.api.v1.feedback import router as feedback_router
 from app.api.v1.invite import router as invite_router
 from app.api.v1.meituan import router as meituan_router
@@ -35,6 +37,10 @@ from app.api.v1.wallet import router as wallet_router
 from app.api.v1.wxpay import router as wxpay_router
 from app.core.config import settings
 from app.core.logging import setup_logging
+from app.core.withdraw_reconcile_worker import (
+    start_withdraw_reconcile_worker,
+    stop_withdraw_reconcile_worker,
+)
 
 setup_logging(debug=settings.APP_DEBUG)
 logger = logging.getLogger("shagua.main")
@@ -50,8 +56,12 @@ async def lifespan(_: FastAPI) -> AsyncIterator[None]:
         settings.APP_DEBUG,
         settings.DATABASE_URL.split("://", 1)[0],
     )
-    yield
-    logger.info("shutting down")
+    reconcile_task = start_withdraw_reconcile_worker()
+    try:
+        yield
+    finally:
+        await stop_withdraw_reconcile_worker(reconcile_task)
+        logger.info("shutting down")
 
 
 app = FastAPI(
@@ -94,9 +104,12 @@ app.include_router(savings_router)
 app.include_router(ad_router)
 app.include_router(order_router)
 app.include_router(report_router)
-# 内部(server→server)端点:pricebot 上报价格观测,靠共享密钥头校验,不对客户端开放。
+# 内部(server→server)端点:pricebot 上报价格观测 / 店铺映射,靠共享密钥头校验,不对客户端开放。
 app.include_router(internal_price_router)
+app.include_router(internal_store_router)
 app.include_router(platform_router)
+# CPS 群发短链跳转 /c/{code}(公网无鉴权:记点击 → 302 跳美团)
+app.include_router(cps_redirect_router)
 
 # 用户上传文件(头像)静态服务。生产可改由 nginx 直接 serve MEDIA_ROOT。
 _media_root = Path(settings.MEDIA_ROOT)

app/models/__init__.py

@@ -6,20 +6,28 @@ from app.models.ad_watch_log import AdWatchLog  # noqa: F401
 from app.models.admin import AdminAuditLog, AdminUser  # noqa: F401
 from app.models.app_config import AppConfig  # noqa: F401
 from app.models.comparison import ComparisonRecord  # noqa: F401
+from app.models.cps_activity import CpsActivity  # noqa: F401
+from app.models.cps_group import CpsGroup  # noqa: F401
+from app.models.cps_link import CpsClick, CpsLink  # noqa: F401
+from app.models.cps_order import CpsOrder  # noqa: F401
 from app.models.comparison_milestone import ComparisonMilestoneClaim  # noqa: F401
 from app.models.coupon_state import (  # noqa: F401
     CouponClaimRecord,
+    CouponDailyCompletion,
     CouponPromptEngagement,
 )
 from app.models.feedback import Feedback  # noqa: F401
 from app.models.invite import InviteRelation  # noqa: F401
+from app.models.invite_fingerprint import InviteFingerprint  # noqa: F401
 from app.models.meituan_coupon import MeituanCoupon  # noqa: F401
+from app.models.onboarding import OnboardingCompletion  # noqa: F401
 from app.models.ops_marquee_seed import OpsMarqueeSeed  # noqa: F401
 from app.models.ops_stat_config import OpsStatConfig  # noqa: F401
 from app.models.price_observation import PriceObservation  # noqa: F401
 from app.models.price_report import PriceReport  # noqa: F401
 from app.models.savings import SavingsRecord  # noqa: F401
 from app.models.signin import SigninBoostRecord, SigninRecord  # noqa: F401
+from app.models.store_mapping import StoreMapping  # noqa: F401
 from app.models.task import UserTask  # noqa: F401
 from app.models.user import User  # noqa: F401
 from app.models.wallet import (  # noqa: F401

app/models/ad_ecpm.py

@@ -1,11 +1,8 @@
 """广告展示 eCPM 上报记录(内部收益统计/对账)。
 
-每条 = 客户端一次广告展示(`onAdShow`)后读到的 eCPM 信息。和发奖记录
-[ad_reward.AdRewardRecord] 是**两条独立的数据流**:
-- 发奖走穿山甲 S2S 回调(后端 → 有 trans_id、无 ecpm);
-- eCPM 走客户端上报(客户端 → 有 ecpm、无 trans_id)。
-两者没有公共键,无法逐条一一对应,所以本表用于**按用户/按天聚合收益**口径的对账,
-不做"这条发奖 = 这条 ecpm"的精确关联。穿山甲后台报表才是结算权威,本表是细粒度补充。
+每条 = 客户端一次广告展示(`onAdShow`)后读到的 eCPM 信息。`ad_session_id`
+由客户端生成,并通过激励视频 extra 透传给 S2S 回调,用于把"展示 eCPM"与
+"奖励完成"绑定。没有 session id 的旧上报仍可作为按天对账补充。
 
 ⚠️ `ecpm_raw` 原样存客户端上报的字符串——eCPM 单位(分 / 元)截至 2026-05-31 尚未最终确认,
 确认后再加一列解析好的数值;在此之前对账按"待定单位"处理。
@@ -14,7 +11,7 @@ from __future__ import annotations
 
 from datetime import datetime
 
-from sqlalchemy import DateTime, ForeignKey, Integer, String, func
+from sqlalchemy import DateTime, ForeignKey, Integer, String, UniqueConstraint, func
 from sqlalchemy.orm import Mapped, mapped_column
 
 from app.db.base import Base
@@ -22,6 +19,9 @@ from app.db.base import Base
 
 class AdEcpmRecord(Base):
     __tablename__ = "ad_ecpm_record"
+    __table_args__ = (
+        UniqueConstraint("ad_session_id", name="uq_ad_ecpm_record_session"),
+    )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
     user_id: Mapped[int] = mapped_column(
@@ -29,11 +29,18 @@ class AdEcpmRecord(Base):
     )
     # 广告类型:reward_video(激励视频) / draw(Draw 信息流) 等;不强行统一代码位,各类型各自上报
     ad_type: Mapped[str] = mapped_column(String(32), nullable=False)
+    # 客户端生成的一次广告会话 id;激励视频 S2S 回调 extra 会透传同值
+    ad_session_id: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
     # 实际投放的 ADN(穿山甲 getShowEcpm().getSdkName(),如 pangle / gdt)
     adn: Mapped[str | None] = mapped_column(String(32), nullable=True)
     # 实际展示用的代码位(底层 mediation rit,非客户端配置位)
     slot_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
-    # 客户端上报的 eCPM 原始字符串(单位待确认,原样存)
+    # 我们的穿山甲应用环境:prod(傻瓜比价正式应用) / test(测试应用)。客户端按 AdConfig.useProductionApp 上报。
+    # 与底层 adn 不同:这是「我们用的是哪个 App」,adn 是「聚合后实际填充的子渠道」。旧数据为 NULL。
+    app_env: Mapped[str | None] = mapped_column(String(16), nullable=True)
+    # 我们在穿山甲后台配置的代码位 ID(AdConfig.feedCodeId/rewardCodeId 返回的 104xxx,**非** slot_id 的底层 rit)。旧数据为 NULL。
+    our_code_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    # 客户端上报的 eCPM 原始字符串(单位:分/千次展示,SDK getEcpm 原值,原样存)
     ecpm_raw: Mapped[str] = mapped_column(String(32), nullable=False)
     # 北京时间日期串 'YYYY-MM-DD',按它等值做"按天聚合"(不在 SQL 里做跨时区 date 比较)
     report_date: Mapped[str] = mapped_column(String(10), index=True, nullable=False)

app/models/ad_feed_reward.py

@@ -20,6 +20,7 @@ class AdFeedRewardRecord(Base):
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
     client_event_id: Mapped[str] = mapped_column(String(64), nullable=False)
+    ad_session_id: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
     user_id: Mapped[int] = mapped_column(
         Integer, ForeignKey("user.id"), index=True, nullable=False
     )
@@ -29,6 +30,9 @@ class AdFeedRewardRecord(Base):
     ecpm_raw: Mapped[str] = mapped_column(String(32), nullable=False)
     adn: Mapped[str | None] = mapped_column(String(32), nullable=True)
     slot_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    # 来源(广告收益报表用):我们的应用环境 prod/test + 我们配置的代码位 104xxx,由客户端 feed-reward 上报带上。旧数据为 NULL。
+    app_env: Mapped[str | None] = mapped_column(String(16), nullable=True)
+    our_code_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
     coin: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
     status: Mapped[str] = mapped_column(String(16), nullable=False, default="granted")
 

app/models/ad_reward.py

@@ -1,8 +1,8 @@
 """看激励视频发奖记录(穿山甲 S2S 回调)。
 
-每条 = 穿山甲一次发奖回调。`trans_id`(穿山甲交易号)唯一,做幂等键:穿山甲会重试回调,
-同号只发一次金币。`reward_date`(北京时间日期串)给"每日上限"计数用——按日期串等值查,
-不在 SQL 里做跨时区 date 比较(SQLite 上不可靠)。审计 / 对账时整张表可逐笔回溯。
+每条 = 穿山甲/GroMore 一次服务端激励回调。`trans_id`(交易号)唯一,做幂等键:
+穿山甲会重试回调,同号只处理一次。`reward_scene` 区分福利页激励视频、签到膨胀等
+不同奖励场景,避免统计和每日上限互相污染。
 """
 from __future__ import annotations
 
@@ -25,8 +25,18 @@ class AdRewardRecord(Base):
     )
     # 实发金币(capped 时为 0)
     coin: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-    # granted(已发) / capped(当日超限未发)
+    # granted(已发) / capped(当日超限未发) / ecpm_missing(缺 eCPM 未发)
     status: Mapped[str] = mapped_column(String(16), nullable=False, default="granted")
+    # reward_video(福利页看视频) / signin_boost(签到膨胀)
+    reward_scene: Mapped[str] = mapped_column(String(32), nullable=False, default="reward_video")
+    # 客户端生成并通过 extra 透传的广告会话 id
+    ad_session_id: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
+    # 本次发奖采用的 eCPM 原始值(回调自带或按 ad_session_id 匹配的客户端上报)
+    ecpm_raw: Mapped[str | None] = mapped_column(String(32), nullable=True)
+    # 来源(广告收益报表用):我们的应用环境 prod/test + 我们配置的代码位 104xxx。
+    # S2S 回调本身不带这俩,发奖时按 ad_session_id 匹配 ad_ecpm_record 回填(查不到为 NULL)。
+    app_env: Mapped[str | None] = mapped_column(String(16), nullable=True)
+    our_code_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
     # 北京时间日期串 'YYYY-MM-DD',按它等值统计当日发奖次数
     reward_date: Mapped[str] = mapped_column(String(10), index=True, nullable=False)
     # 穿山甲上报的奖励名(参考,不作发奖依据)
@@ -39,4 +49,7 @@ class AdRewardRecord(Base):
     )
 
     def __repr__(self) -> str:  # pragma: no cover
-        return f"<AdRewardRecord trans_id={self.trans_id} user_id={self.user_id} {self.status} coin={self.coin}>"
+        return (
+            f"<AdRewardRecord trans_id={self.trans_id} user_id={self.user_id} "
+            f"scene={self.reward_scene} {self.status} coin={self.coin}>"
+        )

app/models/comparison.py

@@ -19,6 +19,7 @@ from sqlalchemy import (
     Boolean,
     DateTime,
     ForeignKey,
+    Index,
     Integer,
     String,
     UniqueConstraint,
@@ -39,6 +40,9 @@ class ComparisonRecord(Base):
     __table_args__ = (
         # 同一用户同一次比价(trace_id)只存一条:客户端重试/误点重复上报时幂等覆盖。
         UniqueConstraint("user_id", "trace_id", name="uq_comparison_user_trace"),
+        # 首页轮播 / 省钱战绩聚合都按 status='success' 过滤 + created_at 近期排序;
+        # 复合索引避免随数据量增大退化成全表扫(单列 created_at 索引不含 status)。
+        Index("ix_comparison_status_created", "status", "created_at"),
     )
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
@@ -53,6 +57,10 @@ class ComparisonRecord(Base):
     )
     # pricebot 侧 trace_id:关联调试落盘 + 幂等去重键
     trace_id: Mapped[str] = mapped_column(String(64), nullable=False)
+    # 本次比价的公网调试链接(price.shaguabijia.com/traces/{dir}/)。pricebot done 帧给、
+    # 客户端上报带上——dir 名含 pricebot 落盘的时分秒,前端/server 都拼不出,必须存。
+    # 查看接口按 user.debug_trace_enabled 决定返不返回。旧记录 / 未开上云为 None。
+    trace_url: Mapped[str | None] = mapped_column(String(512), nullable=True)
 
     # ===== 源平台(发起比价的那家)=====
     source_platform_id: Mapped[str | None] = mapped_column(String(32), nullable=True)
@@ -86,7 +94,7 @@ class ComparisonRecord(Base):
     # ===== 明细(JSON,越详细越好)=====
     # 下单菜品 [{name, qty, specs?}]
     items: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
-    # 逐平台对比 [{platform_id, platform_name, package, price, is_source, rank, coupon_saved, coupon_name}](price/coupon_saved 单位:元,原样存;coupon_name=优惠来源名)
+    # 逐平台对比 [{platform_id, platform_name, package, price, is_source, rank, coupon_saved, coupon_name, applied_coupons}](price/coupon_saved 单位:元,原样存;coupon_name=优惠来源名;applied_coupons=[{name,amount}] 多券明细)
     comparison_results: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)
     # 目标平台未找到、跳过的菜名
     skipped_dish_names: Mapped[list] = mapped_column(_JSON, nullable=False, default=list)

app/models/coupon_state.py

@@ -93,15 +93,22 @@ class CouponClaimRecord(Base):
         )
 
 
-class CouponPromptEngagement(Base):
-    """按 (device, 自然日) 记"今天是否对领券引导窗表达过意向"——弹窗频控源。"""
+class CouponDailyCompletion(Base):
+    """按 (device, 自然日) 记"今天是否已跑完整轮领券(到 done 帧)"——首页置灰源。
 
-    __tablename__ = "coupon_prompt_engagement"
+    与 engagement 区别:engagement = 用户表达过意向(点了一键领取/拒绝即记,不管跑没跑完);
+    completion = 这一轮真跑到了 done(整套流程走完)。首页「去领取」卡据此置灰:跑完了
+    今天就不能再领。判断口径(用户决策 2026-06-10 A 方案):**到 done 即算**,不管单券
+    成败(失败/跳过常是无障碍/环境问题,重复点也补不回来)。判断维度 device_id,与
+    engagement/claim 一致。
+    """
+
+    __tablename__ = "coupon_daily_completion"
     __table_args__ = (
-        # 一台设备一天一条:今天 engage 过(领或拒)就不再弹。
+        # 一台设备一天一条:今天跑完过就置灰。
         UniqueConstraint(
-            "device_id", "engage_date",
-            name="uq_coupon_engage_device_date",
+            "device_id", "complete_date",
+            name="uq_coupon_completion_device_date",
         ),
     )
 
@@ -110,9 +117,55 @@ class CouponPromptEngagement(Base):
     device_id: Mapped[str] = mapped_column(String(64), nullable=False)
     user_id: Mapped[int | None] = mapped_column(Integer, index=True, nullable=True)
     # Asia/Shanghai 自然日。
+    complete_date: Mapped[date] = mapped_column(Date, nullable=False)
+    # 哪次任务跑到 done,回指 pricebot work_logs / 排查。
+    trace_id: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
+
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(),
+        nullable=False,
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return (
+            f"<CouponDailyCompletion device={self.device_id} "
+            f"date={self.complete_date}>"
+        )
+
+
+class CouponPromptEngagement(Base):
+    """按 (device, **App**, 自然日) 记"今天这个 App 是否对领券引导窗表达过意向"——弹窗频控源。
+
+    2026-06-14:频控维度从 (device, 日) 改为 (device, package, 日)。需求是美团/淘宝/京东
+    各自独立——在美团弹过/领过,不影响淘宝、京东今天仍各弹一次。原来缺 package → 任一 App
+    弹过就把整台设备当天标记 engage,其余 App 被压住不弹(bug)。
+    """
+
+    __tablename__ = "coupon_prompt_engagement"
+    __table_args__ = (
+        # 一台设备、一个 App、一天一条:今天**这个 App** engage 过(领或拒)才不再弹该 App。
+        UniqueConstraint(
+            "device_id", "package", "engage_date",
+            name="uq_coupon_engage_device_pkg_date",
+        ),
+    )
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+
+    device_id: Mapped[str] = mapped_column(String(64), nullable=False)
+    # 触发弹窗的目标 App 包名(com.sankuai.meituan / com.taobao.taobao / com.jingdong.app.mall)。
+    # 频控维度,各 App 独立。旧行(改造前)无此值 → 迁移用占位 "" 填,不影响新逻辑判断。
+    package: Mapped[str] = mapped_column(
+        String(64), nullable=False, server_default=""
+    )
+    user_id: Mapped[int | None] = mapped_column(Integer, index=True, nullable=True)
+    # Asia/Shanghai 自然日。
     engage_date: Mapped[date] = mapped_column(Date, nullable=False)
-    # claim_started(点了一键领取)/ dismissed(点了拒绝/关闭)。仅记录区分,
-    # 判断只看"今天有没有这条",type 不影响弹不弹。
+    # claim_started(点了一键领取)/ dismissed(点了拒绝/关闭)/ shown(自动弹出即记)。
+    # 仅记录区分,判断只看"今天这个 App 有没有这条",type 不影响弹不弹。
     engage_type: Mapped[str] = mapped_column(String(16), nullable=False)
 
     created_at: Mapped[datetime] = mapped_column(

app/models/cps_activity.py

@@ -0,0 +1,34 @@
+"""CPS 可推广活动池(cps_activity)。
+
+运营预存常推的活动(券),生成链接时选它,省得每次记 actId。当前只接美团:
+`act_id` = 美团联盟「我要推广-活动推广」第一列的物料 ID。`platform` 预留,接
+淘宝/京东时复用本表(各自的活动标识)。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, Integer, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class CpsActivity(Base):
+    __tablename__ = "cps_activity"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    platform: Mapped[str] = mapped_column(String(20), nullable=False, default="meituan")  # meituan|taobao|jd
+    name: Mapped[str] = mapped_column(String(128), nullable=False)
+    # 美团活动物料 ID(actId);淘宝/京东接入后存各自活动标识。
+    act_id: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    # 美团商品券 productViewSign(与 act_id 二选一转链;多数活动用 act_id)。
+    product_view_sign: Mapped[str | None] = mapped_column(String(128), nullable=True)
+    status: Mapped[str] = mapped_column(String(20), nullable=False, default="active")  # active | archived
+    remark: Mapped[str | None] = mapped_column(String(256), nullable=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<CpsActivity id={self.id} platform={self.platform} name={self.name!r}>"

app/models/cps_group.py

@@ -0,0 +1,32 @@
+"""CPS 推广群(cps_group)。
+
+每个微信群一条记录,`sid` 是美团联盟二级渠道追踪位(get_referral_link / query_order
+共用):发券时塞进推广链接,订单回来按 sid 归群对账。美团限制 sid 仅字母+数字 ≤64。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, Integer, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class CpsGroup(Base):
+    __tablename__ = "cps_group"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    # 每群唯一的渠道标识,建群时分配(留空则自动生成 g<id>)。字母+数字,≤64。
+    sid: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
+    name: Mapped[str] = mapped_column(String(128), nullable=False)
+    # 群人数,运营填,作转化率分母(可空)。
+    member_count: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    status: Mapped[str] = mapped_column(String(20), nullable=False, default="active")  # active | archived
+    remark: Mapped[str | None] = mapped_column(String(256), nullable=True)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<CpsGroup id={self.id} sid={self.sid!r} name={self.name!r}>"

app/models/cps_link.py

@@ -0,0 +1,52 @@
+"""CPS 群发短链(cps_link)+ 点击事件(cps_click)。
+
+群发券链接套一层我们自己的短链 `/c/{code}`:用户点 → 记一条 cps_click → 302 跳
+target_url(美团短链,微信可打开)。据此统计点击 PV/UV(按群/活动/时段),配合 cps_order
+的下单/佣金做"点击→下单→佣金"漏斗。group_id/sid 在 cps_click 里冗余一份,统计直接按
+群聚合点击、不必 join cps_link。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, Integer, String, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class CpsLink(Base):
+    __tablename__ = "cps_link"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    # 短码:发群链接 /c/{code} 的 code,全局唯一。
+    code: Mapped[str] = mapped_column(String(16), unique=True, index=True, nullable=False)
+    group_id: Mapped[int] = mapped_column(Integer, index=True, nullable=False)
+    activity_id: Mapped[int] = mapped_column(Integer, index=True, nullable=False)
+    sid: Mapped[str] = mapped_column(String(64), index=True, nullable=False)
+    platform: Mapped[str] = mapped_column(String(20), nullable=False, default="meituan")
+    # 302 跳转目标(美团短链,微信内可打开并唤起 App)。
+    target_url: Mapped[str] = mapped_column(String(1024), nullable=False)
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<CpsLink id={self.id} code={self.code!r} sid={self.sid!r}>"
+
+
+class CpsClick(Base):
+    __tablename__ = "cps_click"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    link_id: Mapped[int] = mapped_column(Integer, index=True, nullable=False)
+    group_id: Mapped[int] = mapped_column(Integer, index=True, nullable=False)  # 冗余,按群聚合快
+    sid: Mapped[str] = mapped_column(String(64), index=True, nullable=False)    # 冗余
+    ip: Mapped[str | None] = mapped_column(String(64), nullable=True)
+    ua: Mapped[str | None] = mapped_column(String(512), nullable=True)
+    clicked_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), index=True, nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<CpsClick id={self.id} link_id={self.link_id} group_id={self.group_id}>"

app/models/cps_order.py

@@ -0,0 +1,63 @@
+"""CPS 对账订单(cps_order)。
+
+从美团联盟 query_order 按时间窗拉回、按 sid 归群的订单明细。字段对齐 query_order
+实测返回:
+  - payPrice / profit 是「元」字符串 → 入库统一转「分」(与全站口径一致)
+  - payTime / updateTime 是秒级时间戳 → 入库转 tz-aware datetime
+  - status: 2付款 3完成 4取消 5风控 6结算(取消/风控不计佣金)
+order_id 全局唯一,reconcile 按它 upsert(订单状态会变,重复拉则更新)。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import JSON, DateTime, Integer, String, func
+from sqlalchemy.dialects.postgresql import JSONB
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class CpsOrder(Base):
+    __tablename__ = "cps_order"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    # 美团订单号(加密串),全局唯一,upsert 幂等键。
+    order_id: Mapped[str] = mapped_column(String(64), unique=True, index=True, nullable=False)
+    # 渠道追踪位 = 群 sid(历史无 sid 订单为空)。按它归群聚合。
+    sid: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
+    act_id: Mapped[str | None] = mapped_column(String(64), index=True, nullable=True)
+    biz_line: Mapped[int | None] = mapped_column(Integer, nullable=True)  # 1=外卖
+    trade_type: Mapped[int | None] = mapped_column(Integer, nullable=True)  # 1=cps 2=cpa
+
+    pay_price_cents: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    commission_cents: Mapped[int | None] = mapped_column(Integer, nullable=True)  # 预估佣金(profit)
+    commission_rate: Mapped[str | None] = mapped_column(String(16), nullable=True)  # "300"=3% "10"=0.1%
+    refund_price_cents: Mapped[int | None] = mapped_column(Integer, nullable=True)
+    refund_profit_cents: Mapped[int | None] = mapped_column(Integer, nullable=True)
+
+    # 美团订单状态: 2付款 3完成 4取消 5风控 6结算
+    mt_status: Mapped[str | None] = mapped_column(String(8), index=True, nullable=True)
+    invalid_reason: Mapped[str | None] = mapped_column(String(128), nullable=True)
+    product_name: Mapped[str | None] = mapped_column(String(512), nullable=True)
+
+    pay_time: Mapped[datetime | None] = mapped_column(
+        DateTime(timezone=True), index=True, nullable=True
+    )
+    mt_update_time: Mapped[datetime | None] = mapped_column(DateTime(timezone=True), nullable=True)
+
+    raw: Mapped[dict] = mapped_column(
+        JSON().with_variant(JSONB(), "postgresql"), nullable=False, default=dict
+    )
+    first_seen: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+    updated_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), onupdate=func.now(), nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return (
+            f"<CpsOrder id={self.id} order_id={self.order_id!r} "
+            f"sid={self.sid!r} status={self.mt_status} profit_cents={self.commission_cents}>"
+        )

app/models/feedback.py

@@ -1,7 +1,8 @@
 """用户反馈表(帮助与反馈)。
 
-每条 = 用户一次提交。content 必填,contact 必填(微信/QQ/手机,便于回访),images 为可选的
-截图 URL 列表(/media/feedback/...,JSON 存)。status: new(待处理)/ handled(已处理)。
+每条 = 用户一次提交。content 必填;contact 原为必填(微信/QQ/手机),原型改版后客户端不再采集,
+新数据存空串(列保持 NOT NULL,免迁移;历史数据仍有值);images 为可选的截图 URL 列表
+(/media/feedback/...,JSON 存)。status: new(待处理)/ handled(已处理)。
 """
 from __future__ import annotations
 

app/models/invite_fingerprint.py

@@ -0,0 +1,46 @@
+"""邀请指纹归因表(剪贴板归因兜底)。
+
+数据流(对应 [[invite-three-tasks]] 任务 3):
+  1. B 浏览器打开落地页 dl.html?ref=邀请码 → JS POST /api/v1/invite/landing-track
+  2. 后端从 HTTP 头拿 IP/UA,解析 UA 得 device_model,跟 JS 上报的 screen 一起入库
+  3. B 装包首启 → 登录后,若剪贴板没拿到邀请码(被覆盖),客户端再算一次 screen+Build.MODEL
+     上报 → 后端用 (ip, screen, device_model) 反查本表 7 天内最近匹配 → 拿出 inviter_user_id
+     → 走原 bind 路径(channel=fingerprint)
+
+不要索引(IP, created_at) 单独,组合索引 (ip, screen, device_model, created_at desc) 反查更省。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, ForeignKey, Integer, String, Text, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class InviteFingerprint(Base):
+    __tablename__ = "invite_fingerprint"
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    inviter_user_id: Mapped[int] = mapped_column(
+        Integer, ForeignKey("user.id"), index=True, nullable=False
+    )
+    # 落地页访问者 IP(服务端从 HTTP 头拿,X-Forwarded-For 由部署侧 nginx 透传)
+    ip: Mapped[str] = mapped_column(String(64), nullable=False)
+    # 客户端 Build.MODEL / 浏览器 UA 解析出来的型号(如 "PJF110"、"23046PNC9C")
+    device_model: Mapped[str] = mapped_column(String(64), nullable=False, default="")
+    # 屏幕分辨率 "1080x2400"(浏览器 screen.width × height,客户端 DisplayMetrics)
+    screen: Mapped[str] = mapped_column(String(32), nullable=False, default="")
+    # 完整 UA 字符串(留 debug / 排查"匹配不上"用,不直接参与匹配)
+    user_agent: Mapped[str] = mapped_column(Text, nullable=False, default="")
+
+    created_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), index=True, nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return (
+            f"<InviteFingerprint inviter={self.inviter_user_id} "
+            f"ip={self.ip} model={self.device_model} screen={self.screen}>"
+        )

app/models/onboarding.py

@@ -0,0 +1,40 @@
+"""新手引导完成标记(按 设备 + 账号 去重)。
+
+产品规则:同一台设备 + 同一个账号,新手引导只跑一次;卸载重装(同设备同账号)
+不再触发。本地标记(SharedPreferences)卸载即丢,所以"完成"必须落后端,按
+(user_id, device_id) 唯一一条。
+
+⚠️ device_id 这里用客户端的**硬件级稳定标识**(Android `Settings.Secure.ANDROID_ID`),
+同签名 app 卸载重装不变、仅恢复出厂才重置——区别于领券/比价用的 per-install device_id
+(见 coupon_state,存 SP、重装会变)。换新设备 → 无此行 → 重新走引导。
+"""
+from __future__ import annotations
+
+from datetime import datetime
+
+from sqlalchemy import DateTime, Integer, String, UniqueConstraint, func
+from sqlalchemy.orm import Mapped, mapped_column
+
+from app.db.base import Base
+
+
+class OnboardingCompletion(Base):
+    """一台设备 + 一个账号 一条:走完新手引导即写入,登录时据此跳过引导。"""
+
+    __tablename__ = "onboarding_completion"
+    __table_args__ = (
+        # 同账号、同设备只一条:重复 mark / 并发提交靠它幂等。
+        UniqueConstraint("user_id", "device_id", name="uq_onboarding_user_device"),
+    )
+
+    id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
+    # 登录态用户。引导是登录后才走的,故必填(非空)、进唯一键。
+    user_id: Mapped[int] = mapped_column(Integer, index=True, nullable=False)
+    # 硬件级稳定设备标识(ANDROID_ID),卸载重装不变。
+    device_id: Mapped[str] = mapped_column(String(64), nullable=False)
+    completed_at: Mapped[datetime] = mapped_column(
+        DateTime(timezone=True), server_default=func.now(), nullable=False
+    )
+
+    def __repr__(self) -> str:  # pragma: no cover
+        return f"<OnboardingCompletion user={self.user_id} device={self.device_id}>"

app/models/ops_marquee_seed.py

@@ -25,7 +25,8 @@ class OpsMarqueeSeed(Base):
     __tablename__ = "ops_marquee_seed"
 
     id: Mapped[int] = mapped_column(Integer, primary_key=True, autoincrement=True)
-    # 脱敏用户名,如「用户********a52」;留空(NULL)→ feed 展示时按脱敏格式随机合成(避开撞名)
+    # 脱敏用户名(手机尾号 / 中文昵称风格,如「138****5678」「省钱**」);留空(NULL)或旧「用户****xxx」
+    # 模板名 → feed 展示时随机合成混合风格名(避开撞名、自愈历史种子)
     masked_user: Mapped[str | None] = mapped_column(String(64), nullable=True)
     # 节省金额区间(分);feed 每次在 [min,max] 随机取一个值。固定金额则 min==max。客户端 ÷100 显示「x.xx 元」
     min_cents: Mapped[int] = mapped_column(Integer, nullable=False)

app/models/ops_stat_config.py

@@ -53,7 +53,8 @@ class OpsStatConfig(Base):
     random_kind: Mapped[str] = mapped_column(String(8), nullable=False, default="mult")
     random_step_min: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
     random_step_max: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
-    # real 模式基数偏移(基础单位;total_saved 为分):展示值 = 真实值 + 偏移(冷启动期既真实又体面)
+    # real 模式保底值(基础单位;total_saved 为分):展示值 = max(真实值, 保底值)。冷启动显示保底撑
+    # 场面,真实值涨过保底后显示纯真实、零差距。列名沿用 real_offset(语义已从"偏移"改为"保底")
     real_offset: Mapped[int] = mapped_column(Integer, nullable=False, default=0)
     # 门面数字默认「只增不减」;运营明确要下调时才开此开关(real/manual 刷新都受护栏约束)
     allow_decrease: Mapped[bool] = mapped_column(Boolean, nullable=False, default=False)