agentworkshop 0.7.8 → 0.7.11

package/server/data/line-runs.json

@@ -7,7 +7,7 @@
     "productId": "pd-6348a595",
     "productName": "0.8mm 光学膜",
     "startedAt": "2026-09-03T11:18:01.213Z",
-    "taggedSamples": 40180
+    "taggedSamples": 49286
   },
   {
     "lineId": "ln-9a60a0cd",
@@ -57,7 +57,7 @@
     "productId": "pd-db432902",
     "productName": "探针产品",
     "startedAt": "2026-09-04T05:08:10.103Z",
-    "taggedSamples": 11354
+    "taggedSamples": 17196
   },
   {
     "lineId": "ln-6a34fbc7",
@@ -67,7 +67,7 @@
     "productId": "pd-10cfc2b3",
     "productName": "全协议产品-mtnynfph",
     "startedAt": "2026-09-05T05:47:26.453Z",
-    "taggedSamples": 25175
+    "taggedSamples": 48679
   },
   {
     "lineId": "ln-419463e0",
@@ -77,7 +77,7 @@
     "productId": "pd-b9b15b64",
     "productName": "全协议产品-mtnzg090",
     "startedAt": "2026-09-05T06:09:36.931Z",
-    "taggedSamples": 25155
+    "taggedSamples": 48652
   },
   {
     "lineId": "ln-3548f325",
@@ -87,7 +87,7 @@
     "productId": "pd-fd822802",
     "productName": "runp3-prod",
     "startedAt": "2026-09-05T07:23:51.972Z",
-    "taggedSamples": 1994
+    "taggedSamples": 3925
   },
   {
     "lineId": "ln-c3a7ba01",
@@ -107,6 +107,26 @@
     "productId": "pd-d547a376",
     "productName": "pp-prod",
     "startedAt": "2026-09-05T09:47:55.526Z",
-    "taggedSamples": 393
+    "taggedSamples": 6231
+  },
+  {
+    "lineId": "ln-1acc1a0c",
+    "runId": "rr-d3ac8878",
+    "recipeId": "rc-2a7b0def",
+    "recipeName": "lx8-recipe",
+    "productId": "pd-3adf854f",
+    "productName": "lx8-prod",
+    "startedAt": "2026-09-06T02:22:23.209+08:00",
+    "taggedSamples": 4136
+  },
+  {
+    "lineId": "ln-917490c1",
+    "runId": "rr-04594711",
+    "recipeId": "rc-4c9d5135",
+    "recipeName": "lx8-recipe",
+    "productId": "pd-75752beb",
+    "productName": "lx8-prod",
+    "startedAt": "2026-09-06T02:24:50.582+08:00",
+    "taggedSamples": 3995
   }
 ]

package/server/plugins/backup.ts

@@ -1,116 +1,119 @@
-/**
- * 备份定时插件(S6,production-readiness-plan)。
- *
- * 对 data/ 下三库(workshop/users/daq-timeseries)每日 serialize 镜像快照到
- * data/backups/,按 BACKUP_KEEP(默认 7)轮转;调度模式复用 ws.ts 保留期清理的
- * setInterval + globalThis key 防 HMR 重复 + unref()。dev 与生产均生效
- * (备份无副作用,始终开启;BACKUP_DISABLED=1 可关)。
- */
-import { copyFileSync, existsSync, mkdirSync, readdirSync, renameSync, rmSync } from 'node:fs'
-import { resolve } from 'node:path'
-import { ensureDataDir } from '@/shared/config/home.mjs'
-import { backupSettings } from '../services/workshop/settings'
-import { backupRegistry } from '../services/workshop/db/backup-registry'
-
-const g = globalThis as typeof globalThis & { __awBackupTimer?: NodeJS.Timeout, __awBackupLastAt?: string }
-
-const DB_FILES = ['workshop.sqlite', 'users.sqlite', 'daq-timeseries.sqlite'] as const
-
-/**
- * 单库在线快照(hardening ST-2 终版:零侵入文件拷贝)。
- *
- * 真实事故两连(Windows + node:sqlite):
- *  1) 对活库开第二连接 serialize/close → 主连接 prepared statements 全部失效;
- *  2) 对主连接 serialize() → 该连接上全部语句被 finalize(20 分钟后 Mailbox 一用即炸)。
- * 结论:node:sqlite 上 serialize 路线对常驻服务不可行。终版:PASSIVE checkpoint
- * (尽力把 WAL 并回主文件,失败不影响服务)→ 拷贝主文件。得到的是「最后一次
- * checkpoint 时刻」的有效 SQLite 镜像;备份语义为日级韧性的兜底,允许略旧。
- */
-async function backupOne(src: string, target: string): Promise<void> {
-  const db = backupRegistry.get(src)
-  if (db) {
-    try {
-      db.exec('PRAGMA wal_checkpoint(PASSIVE)')
-    }
-    catch { /* 忙时跳过 checkpoint,拷出的镜像退回上次 checkpoint 点,仍有效 */ }
-  }
-  // 原子落盘:快照写一半被杀会留下截断 .bak(轮转后还被当作有效备份)
-  const tmp = `${target}.tmp`
-  copyFileSync(src, tmp)
-  try {
-    renameSync(tmp, target)
-  }
-  catch {
-    // rename 失败(目标被占用等):退回直写,可用性优先
-    copyFileSync(src, target)
-    try {
-      rmSync(tmp)
-    }
-    catch { /* ignore */ }
-  }
-}
-
-async function backupOnce(dataDir: string): Promise<void> {
-  const backupDir = resolve(dataDir, 'backups')
-  mkdirSync(backupDir, { recursive: true })
-  const stamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)
-  for (const file of DB_FILES) {
-    const src = resolve(dataDir, file)
-    if (!existsSync(src) || !backupRegistry.has(src)) continue
-    const target = resolve(backupDir, `${file}.${stamp}.bak`)
-    try {
-      await backupOne(src, target)
-      console.log('[backup]', file, '快照完成(serialize)')
-    }
-    catch (err) {
-      console.error(`[backup] ${file} 快照失败:`, err instanceof Error ? err.message : err)
-    }
-  }
-  // 轮转:每库仅保留最近 backup.keep 份(按文件名内时间戳倒序;env BACKUP_KEEP 兼容)
-  const keep = Math.max(1, backupSettings().keep)
-  for (const file of DB_FILES) {
-    const own = readdirSync(backupDir)
-      .filter(f => f.startsWith(`${file}.`) && f.endsWith('.bak'))
-      .sort()
-      .reverse()
-    for (const stale of own.slice(keep)) {
-      try {
-        rmSync(resolve(backupDir, stale))
-      }
-      catch { /* 轮转失败不致命 */ }
-    }
-  }
-  console.log('[backup] 快照完成 →', backupDir)
-  // R4:记录最近一次成功备份时间,供 /api/metrics 观测
-  g.__awBackupLastAt = new Date().toISOString()
-}
-
-export default function backupPlugin() {
-  const backupCfg = backupSettings()
-  if (backupCfg.disabled) return
-  if (g.__awBackupTimer) return
-  const dataDir = ensureDataDir()
-
-  // 启动 30s 后首备(避开启动风暴),此后每 backup.interval_hours(默认 24h)
-  const first = setTimeout(() => {
-    try {
-      // backupOnce 是 async:同步 try/catch 接不住内部 rejection(会变成 unhandled
-      // rejection 触发 dev-stability-guard 退进程),必须显式 .catch
-      backupOnce(dataDir).catch((err: unknown) => {
-        console.error('[backup] 首备失败:', err instanceof Error ? err.message : err)
-      })
-    }
-    catch (err) {
-      console.error('[backup] 首备失败:', err instanceof Error ? err.message : err)
-    }
-  }, 30_000)
-  first.unref?.()
-  const hours = Math.max(1, backupCfg.interval_hours)
-  const timer = setInterval(() => {
-    backupOnce(dataDir).catch((err: unknown) => {
-      console.error('[backup] 定时备份失败:', err instanceof Error ? err.message : err)
-    })
-  }, hours * 3_600_000)
-  timer.unref?.()
-  g.__awBackupTimer = timer
-}
+/**
+ * 备份定时插件(S6,production-readiness-plan)。
+ *
+ * 对 data/ 下三库(workshop/users/daq-timeseries)每日 serialize 镜像快照到
+ * data/backups/,按 BACKUP_KEEP(默认 7)轮转;调度模式复用 ws.ts 保留期清理的
+ * setInterval + globalThis key 防 HMR 重复 + unref()。dev 与生产均生效
+ * (备份无副作用,始终开启;BACKUP_DISABLED=1 可关)。
+ */
+import { existsSync, mkdirSync, readdirSync, renameSync, rmSync } from 'node:fs'
+import { copyFile as copyFileAsync } from 'node:fs/promises'
+import { resolve } from 'node:path'
+import { ensureDataDir } from '@/shared/config/home.mjs'
+import { backupSettings } from '../services/workshop/settings'
+import { backupRegistry } from '../services/workshop/db/backup-registry'
+
+const g = globalThis as typeof globalThis & { __awBackupTimer?: NodeJS.Timeout, __awBackupLastAt?: string }
+
+const DB_FILES = ['workshop.sqlite', 'users.sqlite', 'daq-timeseries.sqlite'] as const
+
+/**
+ * 单库在线快照(hardening ST-2 终版:零侵入文件拷贝)。
+ *
+ * 真实事故两连(Windows + node:sqlite):
+ *  1) 对活库开第二连接 serialize/close → 主连接 prepared statements 全部失效;
+ *  2) 对主连接 serialize() → 该连接上全部语句被 finalize(20 分钟后 Mailbox 一用即炸)。
+ * 结论:node:sqlite 上 serialize 路线对常驻服务不可行。终版:PASSIVE checkpoint
+ * (尽力把 WAL 并回主文件,失败不影响服务)→ 拷贝主文件。得到的是「最后一次
+ * checkpoint 时刻」的有效 SQLite 镜像;备份语义为日级韧性的兜底,允许略旧。
+ */
+async function backupOne(src: string, target: string): Promise<void> {
+  const db = backupRegistry.get(src)
+  if (db) {
+    try {
+      db.exec('PRAGMA wal_checkpoint(PASSIVE)')
+    }
+    catch { /* 忙时跳过 checkpoint,拷出的镜像退回上次 checkpoint 点,仍有效 */ }
+  }
+  // 原子落盘:快照写一半被杀会留下截断 .bak(轮转后还被当作有效备份)
+  // 异步拷贝:daq-timeseries 可达数百 MB,copyFileSync 会同步冻结事件循环数秒
+  // (期间 WS 扇出/采样 sweep/API 全部停摆)
+  const tmp = `${target}.tmp`
+  await copyFileAsync(src, tmp)
+  try {
+    renameSync(tmp, target)
+  }
+  catch {
+    // rename 失败(目标被占用等):退回直写,可用性优先
+    await copyFileAsync(src, target)
+    try {
+      rmSync(tmp)
+    }
+    catch { /* ignore */ }
+  }
+}
+
+async function backupOnce(dataDir: string): Promise<void> {
+  const backupDir = resolve(dataDir, 'backups')
+  mkdirSync(backupDir, { recursive: true })
+  const stamp = new Date().toISOString().replace(/[:.]/g, '-').slice(0, 19)
+  for (const file of DB_FILES) {
+    const src = resolve(dataDir, file)
+    if (!existsSync(src) || !backupRegistry.has(src)) continue
+    const target = resolve(backupDir, `${file}.${stamp}.bak`)
+    try {
+      await backupOne(src, target)
+      console.log('[backup]', file, '快照完成(serialize)')
+    }
+    catch (err) {
+      console.error(`[backup] ${file} 快照失败:`, err instanceof Error ? err.message : err)
+    }
+  }
+  // 轮转:每库仅保留最近 backup.keep 份(按文件名内时间戳倒序;env BACKUP_KEEP 兼容)
+  const keep = Math.max(1, backupSettings().keep)
+  for (const file of DB_FILES) {
+    const own = readdirSync(backupDir)
+      .filter(f => f.startsWith(`${file}.`) && f.endsWith('.bak'))
+      .sort()
+      .reverse()
+    for (const stale of own.slice(keep)) {
+      try {
+        rmSync(resolve(backupDir, stale))
+      }
+      catch { /* 轮转失败不致命 */ }
+    }
+  }
+  console.log('[backup] 快照完成 →', backupDir)
+  // R4:记录最近一次成功备份时间,供 /api/metrics 观测
+  g.__awBackupLastAt = new Date().toISOString()
+}
+
+export default function backupPlugin() {
+  const backupCfg = backupSettings()
+  if (backupCfg.disabled) return
+  if (g.__awBackupTimer) return
+  const dataDir = ensureDataDir()
+
+  // 启动 30s 后首备(避开启动风暴),此后每 backup.interval_hours(默认 24h)
+  const first = setTimeout(() => {
+    try {
+      // backupOnce 是 async:同步 try/catch 接不住内部 rejection(会变成 unhandled
+      // rejection 触发 dev-stability-guard 退进程),必须显式 .catch
+      backupOnce(dataDir).catch((err: unknown) => {
+        console.error('[backup] 首备失败:', err instanceof Error ? err.message : err)
+      })
+    }
+    catch (err) {
+      console.error('[backup] 首备失败:', err instanceof Error ? err.message : err)
+    }
+  }, 30_000)
+  first.unref?.()
+  const hours = Math.max(1, backupCfg.interval_hours)
+  const timer = setInterval(() => {
+    backupOnce(dataDir).catch((err: unknown) => {
+      console.error('[backup] 定时备份失败:', err instanceof Error ? err.message : err)
+    })
+  }, hours * 3_600_000)
+  timer.unref?.()
+  g.__awBackupTimer = timer
+}

package/server/repositories/user.repository.ts

@@ -40,6 +40,14 @@ CREATE TABLE IF NOT EXISTS user_tokens (
   last_used_at TEXT
 );
 CREATE INDEX IF NOT EXISTS idx_user_tokens_user ON user_tokens(user_id);
+CREATE TABLE IF NOT EXISTS user_line_grants (
+  user_id     TEXT NOT NULL REFERENCES users(id) ON DELETE CASCADE,
+  line_id     TEXT NOT NULL,
+  mode        TEXT NOT NULL,
+  granted_by  TEXT,
+  granted_at  TEXT NOT NULL,
+  PRIMARY KEY (user_id, line_id)
+);
 `
 
 let db: DatabaseSync | null = null
@@ -50,6 +58,9 @@ function getDb(): DatabaseSync {
     db = new DatabaseSync(DB_PATH)
     // 主连接登记(备份 serialize 用;见 backup-registry 说明)
     backupRegistry.register(DB_PATH, db)
+    // WAL:认证读路径不再与写互斥(rollback 模式每请求写锁+fsync 串行化全部 API)
+    db.exec('PRAGMA journal_mode = WAL')
+    db.exec('PRAGMA synchronous = NORMAL')
     db.exec('PRAGMA busy_timeout = 5000')
     db.exec(SCHEMA_SQL)
     migrateSchema(db)
@@ -69,6 +80,8 @@ function migrateSchema(d: DatabaseSync): void {
   if (!cols.some(c => c.name === 'expires_at')) {
     d.exec('ALTER TABLE user_tokens ADD COLUMN expires_at TEXT')
   }
+  // 安全迁移:清空存量明文 token——库中只保留哈希,备份/文件拷贝不再等于凭据泄漏
+  d.exec('UPDATE user_tokens SET token_plain = NULL WHERE token_plain IS NOT NULL')
   // 存量 token 宽限 30 天(从部署时刻起算,避免升级即全员掉线)
   d.prepare('UPDATE user_tokens SET expires_at = ? WHERE expires_at IS NULL').run(isoInDays(TOKEN_TTL_DAYS))
 }
@@ -168,7 +181,7 @@ function hashToken(token: string): string {
   return createHash('sha256').update(token).digest('hex')
 }
 
-/** 签发新 token：明文返回一次并存档（token_plain，支持随时查看），库中另存哈希用于认证比对 */
+/** 签发新 token：明文仅此一次返回,库中只存 SHA-256 哈希(0.7.10 起不再存档明文) */
 function issueToken(userId: string, label: string): { raw: string, row: UserToken } {
   const raw = `ut-${randomUUID().replace(/-/g, '')}`
   const hash = hashToken(raw)
@@ -179,14 +192,18 @@ function issueToken(userId: string, label: string): { raw: string, row: UserToke
     createdAt: now(),
     lastUsedAt: null,
     preview: maskPreview(raw),
-    hasPlain: true,
+    hasPlain: false,
   }
   const d = getDb()
-  d.prepare('INSERT INTO user_tokens (id, user_id, label, token_hash, token_plain, created_at, expires_at) VALUES (?, ?, ?, ?, ?, ?, ?)')
-    .run(row.id, userId, label, hash, raw, row.createdAt, isoInDays(TOKEN_TTL_DAYS))
+  d.prepare('INSERT INTO user_tokens (id, user_id, label, token_hash, token_plain, created_at, expires_at) VALUES (?, ?, ?, ?, NULL, ?, ?)')
+    .run(row.id, userId, label, hash, row.createdAt, isoInDays(TOKEN_TTL_DAYS))
   return { raw, row }
 }
 
+/** last_used_at 写节流:每 tokenId 60s 最多落库一次(高频认证路径不再逐请求写锁) */
+const lastUsedSeen = new Map<string, number>()
+const LAST_USED_THROTTLE_MS = 60_000
+
 /** 按 token 明文查用户（命中且未过期则刷新 last_used_at）；无效/已过期返回 null。tokenId 供前端识别当前会话 token。 */
 export function findByToken(token: string): (User & { tokenId: string }) | null {
   const d = getDb()
@@ -201,7 +218,11 @@ WHERE t.token_hash = ?`,
   if (row.expiresAt && Date.parse(row.expiresAt) < Date.now()) return null
   // 禁用账号即时失效(此前存量 token 在禁用后最长 30 天仍可用)
   if (row.status && row.status !== 'active') return null
-  d.prepare('UPDATE user_tokens SET last_used_at = ? WHERE token_hash = ?').run(now(), hash)
+  const seenAt = lastUsedSeen.get(row.tokenId) ?? 0
+  if (Date.now() - seenAt >= LAST_USED_THROTTLE_MS) {
+    lastUsedSeen.set(row.tokenId, Date.now())
+    d.prepare('UPDATE user_tokens SET last_used_at = ? WHERE token_hash = ?').run(now(), hash)
+  }
   return row
 }
 
@@ -233,6 +254,19 @@ export const userRepository = {
     return { items: rows.map(toUser), total, page, pageSize }
   },
 
+  /** 全量用户(不分页;管理面授权矩阵用,避免分页截断) */
+  listAll(): User[] {
+    const d = getDb()
+    const rows = d.prepare('SELECT id, name, email, role, status, created_at AS createdAt FROM users ORDER BY created_at DESC').all() as Array<Record<string, unknown>>
+    return rows.map(toUser)
+  },
+
+  /** 全部产线授权(单查询;管理面按 userId 分组,替代逐用户 N+1) */
+  allGrants(): Array<{ userId: string, lineId: string, mode: string, grantedBy: string | null, grantedAt: string }> {
+    const d = getDb()
+    return d.prepare('SELECT user_id AS userId, line_id AS lineId, mode, granted_by AS grantedBy, granted_at AS grantedAt FROM user_line_grants').all() as Array<{ userId: string, lineId: string, mode: string, grantedBy: string | null, grantedAt: string }>
+  },
+
   findById(id: string): User | undefined {
     const d = getDb()
     const row = d.prepare('SELECT id, name, email, role, status, created_at AS createdAt FROM users WHERE id = ?').get(id) as Record<string, unknown> | undefined
@@ -254,10 +288,37 @@ export const userRepository = {
   /** 是否存在活跃管理员(初始化判定:false → 系统处于首启注册模式,首个注册账号将成为管理员) */
   hasActiveAdmin(): boolean {
     const d = getDb()
-    const { n } = d.prepare("SELECT COUNT(*) AS n FROM users WHERE role = 'admin' AND status = 'active'").get() as { n: number }
+    const { n } = d.prepare('SELECT COUNT(*) AS n FROM users WHERE role = \'admin\' AND status = \'active\'').get() as { n: number }
     return n > 0
   },
 
+  // ===== 产线授权(user_line_grants;admin/editor 不查此表,全量全权)=====
+
+  /** 某用户全部产线授权 */
+  listGrants(userId: string): Array<{ lineId: string, mode: string, grantedBy: string | null, grantedAt: string }> {
+    const d = getDb()
+    return d.prepare('SELECT line_id AS lineId, mode, granted_by AS grantedBy, granted_at AS grantedAt FROM user_line_grants WHERE user_id = ?').all(userId) as Array<{ lineId: string, mode: string, grantedBy: string | null, grantedAt: string }>
+  },
+
+  /** 单条授权(mode 非 readonly/operate → 撤销);返回是否发生变化 */
+  setGrant(userId: string, lineId: string, mode: string | null, grantedBy: string | null): boolean {
+    const d = getDb()
+    if (mode !== 'readonly' && mode !== 'operate') {
+      return d.prepare('DELETE FROM user_line_grants WHERE user_id = ? AND line_id = ?').run(userId, lineId).changes > 0
+    }
+    d.prepare(`INSERT INTO user_line_grants (user_id, line_id, mode, granted_by, granted_at) VALUES (?, ?, ?, ?, ?)
+      ON CONFLICT(user_id, line_id) DO UPDATE SET mode = excluded.mode, granted_by = excluded.granted_by, granted_at = excluded.granted_at`)
+      .run(userId, lineId, mode, grantedBy, now())
+    return true
+  },
+
+  /** 用户 → 产线访问映射(lineId → 'readonly'|'operate');无记录 = 无权 */
+  lineAccessMap(userId: string): Map<string, string> {
+    const d = getDb()
+    const rows = d.prepare('SELECT line_id AS lineId, mode FROM user_line_grants WHERE user_id = ?').all(userId) as Array<{ lineId: string, mode: string }>
+    return new Map(rows.map(r => [r.lineId, r.mode]))
+  },
+
   /** 内部：取密码哈希（仅认证路径使用，不参与领域对象外泄） */
   getPasswordHash(email: string): { id: string, hash: string } | null {
     const d = getDb()
@@ -280,6 +341,25 @@ export const userRepository = {
     return user
   },
 
+  /** 原子注册(IMMEDIATE 事务内判定管理员空缺):并发注册不会产生第二个 bootstrap admin */
+  createWithRoleBootstrap(input: UserCreate & { password: string }): { user: User, bootstrap: boolean } {
+    const d = getDb()
+    d.exec('BEGIN IMMEDIATE')
+    try {
+      const bootstrap = !this.hasActiveAdmin()
+      const user = this.create({ ...input, role: bootstrap ? 'admin' : input.role })
+      d.exec('COMMIT')
+      return { user, bootstrap }
+    }
+    catch (err) {
+      try {
+        d.exec('ROLLBACK')
+      }
+      catch { /* 事务已自滚 */ }
+      throw err
+    }
+  },
+
   update(id: string, input: UserUpdate): User | undefined {
     const d = getDb()
     const current = this.findById(id)

package/server/services/system-config.ts

@@ -97,6 +97,11 @@ export class SystemConfigService {
   private disposed = false
   private applyWarned = false
 
+  /** 是否已完成 init()(descriptors 装载完毕;settings.ts 据此决定消费内存权威还是文件链) */
+  get ready(): boolean {
+    return this.descriptors.length > 0
+  }
+
   constructor(readonly root: string) {
     this.configPath = join(root, 'config.yml')
     // 设置文件必须与 CLI(aw config set)/start/dev-guard 同源(resolveRunMode 单一入口):

package/server/services/user.service.ts

@@ -84,7 +84,8 @@ export const userService = {
   // ===== 认证（公开端点）=====
 
   /** 注册：创建账号 + 签发首个 token（邮箱/用户名占用 → 409）。
-   * 首启初始化:系统尚无活跃管理员时,首个注册账号授予 admin(空库自注册建站) */
+   * 首启初始化:原子事务内判定「尚无活跃管理员」→ 首个注册账号授予 admin
+   * (并发注册不会产生第二个 bootstrap admin) */
   register(input: UserRegister): AuthResult {
     if (userRepository.findByEmail(input.email)) {
       throw new AppError(409, ErrorCodes.CONFLICT, '邮箱已被注册')
@@ -92,11 +93,12 @@ export const userService = {
     if (userRepository.findByName(input.name)) {
       throw new AppError(409, 'USER_EXISTS', `用户名已存在: ${input.name}`)
     }
-    const needsBootstrap = !userRepository.hasActiveAdmin()
+    const { user, bootstrap: needsBootstrap } = userRepository.createWithRoleBootstrap({
+      ...input, role: 'user', status: 'active',
+    })
     if (needsBootstrap) {
       console.log(`[users] 初始化:尚无管理员账号,首个注册账号授予管理员角色(${input.email})`)
     }
-    const user = userRepository.create({ ...input, role: needsBootstrap ? 'admin' : 'user', status: 'active' })
     const { raw } = userRepository.createToken(user.id, needsBootstrap ? 'bootstrap-admin' : 'default')
     return { user: this.publicProfile(user), token: raw }
   },

package/server/services/workshop/daq/bus/index.ts

@@ -2,13 +2,13 @@
  * DaqQueuePort 工厂 —— 配置驱动(DAQ_MQTT_URL 由 infra 提供),缺省进程内 mock 队列。
  * 单例 globalThis;rebuildDaqQueue() 支持重连时切回真实 MQTT。
  */
-import { createLogger } from '../../logger'
+import { createLogger } from '../../logger'
 import { InProcQueueAdapter } from './inproc.adapter'
 import { MqttQueueAdapter } from './mqtt.adapter'
 import type { DaqQueuePort } from './queue-port'
 
-const log = createLogger('daq.queue')
-
+const log = createLogger('daq.queue')
+
 const g = globalThis as typeof globalThis & { __daqQueue?: DaqQueuePort }
 
 export async function getDaqQueue(): Promise<DaqQueuePort> {
@@ -22,6 +22,8 @@ export async function getDaqQueue(): Promise<DaqQueuePort> {
 
 /** 重连/初始装配:按 infra 判定结果(重新)构建 MQTT 或进程内队列 */
 export async function rebuildDaqQueue(online: boolean, url?: string | null): Promise<DaqQueuePort> {
+  // 换装前释放旧 adapter(mqtt 连接 / inproc 泵),防重建泄漏
+  await g.__daqQueue?.close?.()
   if (!online || !url) {
     if (g.__daqQueue?.backend !== 'inproc') {
       g.__daqQueue = new InProcQueueAdapter()

package/server/services/workshop/daq/bus/inproc.adapter.ts

@@ -3,11 +3,11 @@
  * 与 MQTT 版同契约:生产端 publish 即刻入队不阻塞采集;消费泵按序拉取,
  * 拥塞时丢最旧并计数(暴露给 meta,诚实可见)。
  */
-import { createLogger } from '../../logger'
+import { createLogger } from '../../logger'
 import type { DaqConsumer, DaqQueuePort, DaqSampleEnvelope } from './queue-port'
 
-const log = createLogger('daq.queue')
-
+const log = createLogger('daq.queue')
+
 const QUEUE_CAP = 10_000
 /** 消费泵节拍(ms):攒批交给下游(TSDB 批量写) */
 const PUMP_INTERVAL = 250
@@ -45,6 +45,15 @@ export class InProcQueueAdapter implements DaqQueuePort {
     }
   }
 
+  /** 释放消费泵(rebuild 换装前调用,防定时器泄漏) */
+  close(): void {
+    if (this.pump) {
+      clearInterval(this.pump)
+      this.pump = null
+    }
+    this.consumers.clear()
+  }
+
   private drain(): void {
     if (this.queue.length === 0 || this.consumers.size === 0) return
     const batch = this.queue.splice(0, this.queue.length)

package/server/services/workshop/daq/bus/mqtt.adapter.ts

@@ -107,5 +107,18 @@ export class MqttQueueAdapter implements DaqQueuePort {
     return () => {
       this.consumers.delete(fn)
     }
+  }
+
+  /** 断开 MQTT 连接并清理订阅(rebuild 换装前调用,防 socket/keepalive 泄漏) */
+  async close(): Promise<void> {
+    this.consumers.clear()
+    const c = this.client
+    this.client = null
+    if (c) {
+      try {
+        await new Promise<void>(r => c.end(false, () => r()))
+      }
+      catch { /* 已断连等场景:尽力而为 */ }
+    }
   }
 }

package/server/services/workshop/daq/bus/queue-port.ts

@@ -51,4 +51,6 @@ export interface DaqQueuePort {
   publish(env: DaqSampleEnvelope): void
   /** 消费者:注册处理函数;返回退订 */
   consume(fn: DaqConsumer): () => void
+  /** 释放底层资源(mqtt 连接 / inproc 泵);rebuild 换装前必须调用,防 socket/定时器泄漏 */
+  close?(): Promise<void> | void
 }

package/server/services/workshop/daq/daq-controller.ts

@@ -289,6 +289,7 @@ class DaqController {
         value: node.value ?? env.value,
         state: node.state,
         at: env.at,
+        lineId: node.lineId ?? null,
       } satisfies AepDaqReading
       this.broadcast?.('daq.reading', reading)
       // 插件钩子:下发级采样观察(与 WS daq.reading 同点同节拍;宿主未装载时零开销 no-op)
@@ -373,6 +374,7 @@ class DaqController {
       templateRef: node.templateRef,
       kind: f.kind,
       at: env.at,
+      lineId: node.lineId ?? null,
       preview: f.kind === 'vector' ? DaqController.previewOf(f.points ?? [], FRAME_PREVIEW_POINTS) : undefined,
       metrics,
       thumbUrl: f.kind === 'image' && f.objectKey
@@ -619,6 +621,9 @@ class DaqController {
     }
     finally {
       this.tsdbWriting = false
+      // 尾批自愈:flush 期间新样本/帧到达时 schedule 被跳过(tsdbWriting 守卫),
+      // 若此处不留 timer,停线后的残余批次将无定时器可触发,驻留内存直至进程重启
+      if (this.tsdbBuffer.length > 0 || this.frameBuffer.length > 0) this.scheduleTsdbFlush()
     }
   }
 
@@ -626,13 +631,25 @@ class DaqController {
    *  状态随行:节点 alarm 派生自用户设置的量程/预警带(数据驱动),透传给孪生而非让孪生按硬编码阈值猜 */
   private pendingBackfill = new Map<string, Record<string, number | string | boolean>>()
 
+  /** 同绑定 siblings 缓存(1s TTL):回写热路径不再逐样本全量 scan,O(N²)→O(N)/周期 */
+  private siblingsCache = new Map<string, { at: number, list: DaqNode[] }>()
+
+  private siblingsOf(bindingId: string): DaqNode[] {
+    const hit = this.siblingsCache.get(bindingId)
+    if (hit && Date.now() - hit.at < 1000) return hit.list
+    const list = this.repo.all().filter(n => n.deviceBindingId === bindingId)
+    if (this.siblingsCache.size > 500) this.siblingsCache.clear()
+    this.siblingsCache.set(bindingId, { at: Date.now(), list })
+    return list
+  }
+
   private writeBackTelemetry(node: DaqNode): void {
     if (!node.deviceBindingId || node.value == null) return
     const host = getDaqHostPorts()
     if (!host) return // 端口未装配(边缘独立/装配前):不攒积压,直接跳过回写
     const key = findDaqTemplate(node.templateKey)?.telemetryKey ?? node.templateKey
     // 同设备多节点绑定:取最严重节点态(alarm > warn > ok/offline),避免"最近写者定态"抖动
-    const siblings = this.repo.all().filter(n => n.deviceBindingId === node.deviceBindingId)
+    const siblings = this.siblingsOf(node.deviceBindingId)
     const worst = siblings.some(n => n.state === 'alarm')
       ? 'alarm'
       : siblings.some(n => n.state === 'warn') ? 'warn' : 'ok'