merge: 合入本地 Ops 扩展与 origin/main（ECR-009–016）

保留远程用户侧 ECR-009–016 与本地 Ops 目录/RBAC/CMS/危机等能力；文档标注分叉期间 ECR 编号冲突。 Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-13 01:45:53 +08:00
parent 89756f65b4 1026cd0596
commit 4889ff5916
593 changed files with 21918 additions and 328 deletions
@@ -0,0 +1,107 @@
+# Backend Design: ECR-012 星座对齐收口
+
+> Architect 产出；Engineer 只消费本文件。  
+> 实现纪律：`$ESS_ROOT/technology-governance/BACKEND_STANDARD.md`  
+> 项目分层权威：`.ai/architecture.md`
+
+| Field | Value |
+|-------|-------|
+| ID | BD-2026-012 |
+| ECR | ECR-012 |
+| Change Level | L2 |
+| Status | Approved |
+| Approved | 2026-08-07（Human） |
+| Author | Architect |
+| Date | 2026-08-07 |
+| Risk | Low |
+
+---
+
+## Context
+
+- 问题 / 目标：星座/合盘主路径已落地，需 Spec 对齐、H5/报告页一致、测试加厚；默认 **不改表结构**。  
+- 非目标：真支付、新模块、换星历、Ops。  
+- 相关 Spec：`star-profile.md`；前序 ECR-003（fortune→outlook）。
+
+## Architecture Change
+
+- 是否改变分层边界：**No**  
+- 受影响层：Application（`internal/star` 仅按需）· API 文档 · UI（user-h5）
+
+## Module Changes
+
+| Module | Layer | Change | Must NOT |
+|--------|-------|--------|----------|
+| `internal/star` / `outlook` / `synastry` | Domain/App | 仅修偏离 Spec 的 summary/detail 键或文案 | 新表；换 ephemeris |
+| `handler` reports/synastry | API | 契约不变则不动；OpenAPI 描述可补 | Handler SQL |
+| `user-h5` star/synastry/report | UI | 对齐面板、卫生、分享、测试 | 直连 DB；真支付 |
+| packages/types · sdk | Shared | 仅当 OpenAPI/DTO 需同步 | 发明新领域同义词 |
+
+## Data Flow
+
+```text
+Profile(birth*)
+  → POST /reports/star | /reports/synastry
+  → star engine / synastry.BuildReport
+  → GrowthReport summary(outlook, charts, …) + gated detail
+  → H5 StarProfilePage | Synastry* | ReportPage
+  →（可选）pay-mock deep_access → detail 可见
+```
+
+## API Changes
+
+- 契约：`proto/openapi.yaml`  
+- 变更：**默认 None**（路径与语义保持）；允许描述/`$ref` 补强  
+- 兼容：禁止重新引入 summary.`fortune`
+
+## Database Changes
+
+- 表 / 字段：**无**  
+- Migration Required：**NO**
+
+## Migration Plan
+
+- Required：NO  
+- 回滚：代码回滚即可  
+
+## Failure Handling
+
+- 无档案 / 缺生日：Empty 表单（现有）  
+- detail 无权益：服务端剥离（现有，须保持测试）  
+- 旧报告缺 outlook：H5 空态，不伪造 fortune  
+
+## Test Plan
+
+- Unit：outlook bundle keys；H5 fortuneBundleFrom  
+- Integration：`TestFlowStarDeepAccess` · synastry charts keys · 禁用词  
+- E2E：p2 star 路径 mock 含 outlook  
+
+## Rollback Plan
+
+- git revert 本 ECR；无数据迁移  
+
+---
+
+## Backend Change Boundary
+
+```text
+Change Level: L2
+Change: star/synastry Spec alignment (mostly H5 + tests; optional star package hygiene)
+
+Affected:
+  Domain: StarProfile / Synastry (existing)
+  Application: internal/star* (optional)
+  Infrastructure: none (no migration)
+  API: OpenAPI docs only (default)
+  Migration: Not required
+  Tests: integration + H5 + e2e
+  Risk: Low
+```
+
+## Architecture Regression Check
+
+- [ ] 无 Handler 直连 DB  
+- [ ] 不改鉴权面  
+- [ ] 未引入非默认中间件 / 新星历依赖  
+- [ ] 未简化分层  
+- [ ] 无 summary.`fortune` 回归  
@@ -0,0 +1,98 @@
+# Backend Design: ECR-013A Admin RBAC
+
+> Architect 产出；**Contract Definition** — Status Draft；Approve 前禁止实现。  
+> Parent: WAVE0-FROZEN
+
+| Field | Value |
+|-------|-------|
+| ID | BD-2026-013A |
+| ECR | ECR-013A |
+| Change Level | L2 |
+| Status | Approved |
+| Approved | 2026-08-07（Human） · Coding authorized |
+| Author | Architect |
+| Date | 2026-08-07 |
+| Risk | Medium |
+
+---
+
+## Context
+
+- 目标：管理员角色/权限点 + API 强制鉴权 + 审计  
+- 非目标：UserStatus(013B)；真支付；UGC  
+- Spec：`ops-rbac.md` · boundary-rules `Admin_RBAC`
+
+## Architecture Change
+
+- 分层边界：**No**  
+- 受影响层：API · Application(`service/admin`) · Infrastructure(repo+migration) · UI(admin-h5 最小)
+
+## Module Changes
+
+| Module | Layer | Change | Must NOT |
+|--------|-------|--------|----------|
+| admin repo/service | App/Infra | roles · permissions · account.role_id | 改 users.status |
+| middleware | API | RequirePermission | DeviceAuth 混用 |
+| admin handlers | API | /roles* · /me 扩展 | Handler SQL |
+| admin-h5 | UI | 读 permissions | 直连 DB |
+
+## Data Flow
+
+```text
+Admin login → AdminSession
+  → load AdminAccount + Role + Permissions
+  → request + RequirePermission(code)
+       → allow → service → audit
+       → deny  → 403 + audit
+```
+
+## API Changes
+
+- 契约意图见 Spec；实现轮写 `proto/openapi.yaml`  
+- 兼容：additive；旧 admin 账号迁移到 `super_admin`
+
+## Database Changes
+
+- Migration **Required: YES**（实现轮）  
+- 表：`admin_roles` · `admin_role_permissions`（或等价）· `admin_accounts.role_id`  
+- Wave 0 / Contract 轮：**不写 migration 文件**
+
+## Failure Handling
+
+- 无权限：403  
+- 无会话：401  
+- 删 super_admin：4xx  
+
+## Test Plan
+
+- Integration：AC-F/S/O；AC-P-01 本机抽样  
+- 禁止跳过 Security AC  
+
+## Rollback Plan
+
+- down migration；middleware 开关（实现轮详写）
+
+---
+
+## Backend Change Boundary
+
+```text
+Change Level: L2
+Change: Admin RBAC roles + permission gates
+
+Affected:
+  Domain: AdminRole, AdminPermission
+  Application: service/admin
+  Infrastructure: admin_repo + migration (implement phase)
+  API: /admin/roles* , /admin/me
+  Migration: Required at implement — NOT in contract phase
+  Tests: integration admin RBAC
+  Risk: Medium
+```
+
+## Architecture Regression Check
+
+- [ ] 无 Handler 直连 DB  
+- [ ] Admin / Device 鉴权隔离  
+- [ ] 不拥有 UserStatus / Membership 写  
+- [ ] 符合 Admin_RBAC boundary-rules  
@@ -0,0 +1,107 @@
+# Backend Design: ECR-013B AccountLifecycle
+
+> Architect 产出；**Approved** + Coding Start Authorization 2026-08-07。  
+> Parent: WAVE0-FROZEN · Predecessor: ECR-013A Closed
+
+| Field | Value |
+|-------|-------|
+| ID | BD-2026-013B |
+| ECR | ECR-013B |
+| Change Level | L2 |
+| Status | Approved |
+| Approved | 2026-08-07（Human） · Coding authorized |
+| Author | Architect |
+| Date | 2026-08-07 |
+| Risk | Medium |
+
+---
+
+## Context
+
+- 目标：UserStatus 状态机 + 运营迁移 + C 端拒绝非 active  
+- 非目标：soft-delete；UGC；真支付；AdminAccount 启停深化  
+- Spec：`ops-account-lifecycle.md` · boundary-rules `Identity_Profile`
+
+## Architecture Change
+
+- 分层边界：**No**  
+- 受影响层：API(admin) · Application(account/lifecycle 或 admin 协作服务) · Middleware(DeviceAuth) · Infrastructure(repo+migration) · UI(admin-h5 最小)
+
+## Module Changes
+
+| Module | Layer | Change | Must NOT |
+|--------|-------|--------|----------|
+| account / user status service | App | 迁移 + 边校验 + 事务 | soft-delete |
+| DeviceAuth / session | API | 拒绝非 active | 改 Visitor 创建语义 |
+| admin handlers | API | POST status · GET transitions | Handler SQL |
+| admin_rbac seed | Infra | additive permission | 重做 RBAC |
+| admin-h5 | UI | 用户详情 CTA | 直连 DB |
+
+## Data Flow
+
+```text
+Admin POST /users/:id/status
+  → RequirePermission(admin.users.status.write)
+  → validate edge
+  → tx: UPDATE users.status + INSERT transition + AuditLog
+  → 200
+
+C-end request
+  → DeviceAuth / Bearer resolve user
+  → if status != active → 401/403
+```
+
+## API Changes
+
+- 契约意图见 Spec；实现轮写 `proto/openapi.yaml`  
+- 兼容：additive；既有 status 字段语义收紧（非 active 开始拒绝）
+
+## Database Changes
+
+- Migration **Required: YES**（实现轮）  
+- 表：`account_state_transitions`  
+- Permission 种子：`admin.users.status.write`  
+- Wave 0 / Contract 轮：**不写 migration 文件**
+
+## Failure Handling
+
+- 非法边 / 同状态：400  
+- 无权限：403  
+- 无会话：401  
+- 用户不存在：404  
+
+## Test Plan
+
+- Integration：AC-F/S/O；AC-P-01 本机抽样  
+- 禁止跳过 Security AC（含 C 端拒绝）  
+
+## Rollback Plan
+
+- down migration；DeviceAuth 去掉 status 检查；permission 行可留（无害）
+
+---
+
+## Backend Change Boundary
+
+```text
+Change Level: L2
+Change: UserStatus transitions + C-end reject non-active
+
+Affected:
+  Domain: UserStatus, AccountStateTransition
+  Application: account lifecycle service
+  Infrastructure: migration + repo
+  API: /admin/users/:id/status*
+  Middleware: DeviceAuth / session gate
+  Migration: Required at implement — NOT in contract phase
+  Tests: integration admin status + device reject
+  Risk: Medium
+```
+
+## Architecture Regression Check
+
+- [ ] 无 Handler 直连 DB  
+- [ ] Admin / Device 鉴权隔离  
+- [ ] UserStatus 归属 Identity_Profile  
+- [ ] 不拥有 Payment / UGC  
+- [ ] 符合 boundary-rules  
@@ -0,0 +1,23 @@
+# Backend Design: ECR-014 MembershipPlan
+
+| ID | BD-2026-014 |
+| ECR | ECR-014 |
+| Status | Approved |
+| Coding | Authorized（Loop） |
+| Change Level | L2 |
+| Risk | Low |
+
+## Change Boundary
+
+```text
+Domain: MembershipPlan
+App: admin + membership CreateOrder amount/days
+Infra: migration + repo
+API: /admin/membership-plans*
+Migration: YES
+Tests: integration
+```
+
+## Rollback
+
+down migration；回退硬编码 planDays/amount
@@ -0,0 +1,17 @@
+# Backend Design: ECR-015 RedemptionCode
+
+| ID | BD-2026-015 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+
+## Boundary
+
+```text
+Domain: RedemptionBatch, RedemptionCode
+App: admin + membership.Redeem
+API: /admin/redemption-* , POST /membership/redeem
+Migration: YES 000018
+```
+
+Rollback: down migration
@@ -0,0 +1,24 @@
+# Backend Design: ECR-016 UserIntelligence
+
+| ID | BD-2026-016 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | NO |
+
+## Backend Change Boundary
+
+```text
+Domain: UserInsight read model (BehaviorSnapshot · PsychologicalTagSet derived)
+App: AdminHandler → admin.Service → AdminRepo aggregates
+API: GET /api/v1/admin/users/{id}/insight
+Permission: admin.users.read
+Migration: NO
+UI: admin-h5 UserDetail「洞察」Tab
+```
+
+## Out of boundary
+
+Write tags · new tables · Ask body edit · UGC · true payment
+
+Rollback: remove route + UI tab（无 schema）
@@ -0,0 +1,24 @@
+# Backend Design: ECR-017 AskOperations
+
+| ID | BD-2026-017 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000019（权限 only） |
+
+## Backend Change Boundary
+
+```text
+Domain: AskSessionView (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /api/v1/admin/ask/threads[+/:id]
+Permission: admin.ask.read
+Migration: 000019 grant to super_admin
+UI: admin-h5 /ask
+```
+
+## Out of boundary
+
+Message write/delete · SystemPrompt · Knowledge* · QualityFeedback write · UGC · Payment
+
+Rollback: down migration revoke permission + remove routes/UI
@@ -0,0 +1,24 @@
+# Backend Design: ECR-018 Entitlement
+
+| ID | BD-2026-018 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | NO |
+
+## Backend Change Boundary
+
+```text
+Domain: Entitlement read model (Membership ∪ DeepAccess ∪ ask quotas)
+App: AdminHandler → admin.Service → AdminRepo + ReportRepo.GetMembership
+API: GET /api/v1/admin/users/{id}/entitlements
+Permission: admin.users.read
+Migration: NO
+UI: admin-h5 UserDetail「权益」Tab
+```
+
+## Out of boundary
+
+Payment gateway · new entitlement matrix table · order mutation · UGC
+
+Rollback: remove route + UI tab（无 schema）
@@ -0,0 +1,25 @@
+# Backend Design: ECR-019 ContentSafety
+
+| ID | BD-2026-019 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000020 |
+
+## Backend Change Boundary
+
+```text
+Domain: FilterRule (read) + evaluate (no ModerationCase write)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/content-safety/filter-rules[+/:id]
+     POST /admin/content-safety/evaluate
+Permission: admin.content_safety.read
+Migration: 000020 table + seed + perm
+UI: admin-h5 /safety
+```
+
+## Out of boundary
+
+ModerationCase · CrisisPolicy write · UGC · Payment · external moderation vendor
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,26 @@
+# Backend Design: ECR-020 QualityFeedback
+
+| ID | BD-2026-020 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000021 |
+
+## Backend Change Boundary
+
+```text
+Domain: QualityFeedback
+App: AdminHandler + AskHandler → services → repos
+API: GET /admin/ask/feedback
+     POST /admin/ask/threads/{id}/feedback
+     POST /ask/threads/{id}/feedback
+Permission: admin.ask.read · admin.ask.feedback.write
+Migration: 000021
+UI: admin-h5 /ask feedback panel
+```
+
+## Out of boundary
+
+Message mutation · SystemPrompt · UGC plaza · Payment
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,24 @@
+# Backend Design: ECR-021 AICoreConfig
+
+| ID | BD-2026-021 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000022 |
+
+## Backend Change Boundary
+
+```text
+Domain: SystemPrompt (read catalog)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/system-prompts[+/:id]
+Permission: admin.ai_config.read
+Migration: 000022 table + seed ask_default + perm
+UI: admin-h5 /ai
+```
+
+## Out of boundary
+
+Prompt write/publish · Knowledge* · ToolDefinition · runtime engine swap · UGC · Payment
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,25 @@
+# Backend Design: ECR-022 CrisisCare
+
+| ID | BD-2026-022 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000023 |
+
+## Backend Change Boundary
+
+```text
+Domain: CrisisPolicy (read) + evaluate (no CrisisEvent write)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/crisis/policies[+/:id]
+     POST /admin/crisis/evaluate
+Permission: admin.crisis.read
+Migration: 000023
+UI: admin-h5 /crisis
+```
+
+## Out of boundary
+
+CrisisEvent write · InterventionOutcome · policy publish · medical diagnosis · UGC · Payment
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,24 @@
+# Backend Design: ECR-023 KnowledgeSource
+
+| ID | BD-2026-023 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000024 |
+
+## Backend Change Boundary
+
+```text
+Domain: KnowledgeSource (read catalog only)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/knowledge-sources[+/:id]
+Permission: admin.ai_config.read (reuse; no new perm)
+Migration: 000024 knowledge_sources + seed ask_grounding
+UI: admin-h5 /ai KnowledgeSource panel
+```
+
+## Out of boundary
+
+KnowledgeChunk · Embedding · upload/publish · ToolDefinition · UGC · Payment · runtime RAG wiring
+
+Rollback: down migration + remove routes/UI panel
@@ -0,0 +1,23 @@
+# Backend Design: ECR-024 Banner
+
+| ID | BD-2026-024 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000025 |
+
+## Backend Change Boundary
+
+```text
+Domain: Banner (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/cms/banners; GET /admin/cms/banners/{id}
+Permission: admin.cms.read
+Migration: 000025
+```
+
+## Out of boundary
+
+Banner 写发布 · FeedSlot · ScheduledPublication · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-025 FeedSlot
+
+| ID | BD-2026-025 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000026 |
+
+## Backend Change Boundary
+
+```text
+Domain: FeedSlot (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/cms/feed-slots; GET /admin/cms/feed-slots/{id}
+Permission: admin.cms.read
+Migration: 000026
+```
+
+## Out of boundary
+
+FeedSlot 写发布 · ScheduledPublication · UGC · 真支付 · Banner 写
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-026 ScheduledPublication
+
+| ID | BD-2026-026 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000027 |
+
+## Backend Change Boundary
+
+```text
+Domain: ScheduledPublication (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/cms/publications; GET /admin/cms/publications/{id}
+Permission: admin.cms.read
+Migration: 000027
+```
+
+## Out of boundary
+
+定时发布写操作 · UGC · 真支付 · Banner/FeedSlot 写
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-027 KnowledgeChunk
+
+| ID | BD-2026-027 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000028 |
+
+## Backend Change Boundary
+
+```text
+Domain: KnowledgeChunk (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/knowledge-chunks; GET /admin/ai/knowledge-chunks/{id}
+Permission: admin.ai_config.read
+Migration: 000028
+```
+
+## Out of boundary
+
+Embedding · 上传切块 · 运行时 RAG 接线 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-028 ToolDefinition
+
+| ID | BD-2026-028 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000029 |
+
+## Backend Change Boundary
+
+```text
+Domain: ToolDefinition (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ai/tools; GET /admin/ai/tools/{id}
+Permission: admin.ai_config.read
+Migration: 000029
+```
+
+## Out of boundary
+
+工具在线编辑 · 运行时绑定 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-029 BlockPolicy
+
+| ID | BD-2026-029 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000030 |
+
+## Backend Change Boundary
+
+```text
+Domain: BlockPolicy (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/content-safety/block-policies; GET /admin/content-safety/block-policies/{id}
+Permission: admin.content_safety.read
+Migration: 000030
+```
+
+## Out of boundary
+
+策略写发布 · 用户侧硬拦截上线 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-030 ModerationCase
+
+| ID | BD-2026-030 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000031 |
+
+## Backend Change Boundary
+
+```text
+Domain: ModerationCase (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/content-safety/cases; GET /admin/content-safety/cases/{id}
+Permission: admin.content_safety.read
+Migration: 000031
+```
+
+## Out of boundary
+
+审核写回 · 真 NLP 厂商 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-031 CrisisEvent
+
+| ID | BD-2026-031 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000032 |
+
+## Backend Change Boundary
+
+```text
+Domain: CrisisEvent (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/crisis/events; GET /admin/crisis/events/{id}
+Permission: admin.crisis.read
+Migration: 000032
+```
+
+## Out of boundary
+
+事件写入工单流 · 医疗诊断 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-032 InterventionOutcome
+
+| ID | BD-2026-032 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000033 |
+
+## Backend Change Boundary
+
+```text
+Domain: InterventionOutcome (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/crisis/interventions; GET /admin/crisis/interventions/{id}
+Permission: admin.crisis.read
+Migration: 000033
+```
+
+## Out of boundary
+
+干预写回 · 医疗诊断 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-033 HandoffCase
+
+| ID | BD-2026-033 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000034 |
+
+## Backend Change Boundary
+
+```text
+Domain: HandoffCase (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/ask/handoffs; GET /admin/ask/handoffs/{id}
+Permission: admin.ask.read
+Migration: 000034
+```
+
+## Out of boundary
+
+转人工写流 · 顾问执业 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-034 PrivacyRequest
+
+| ID | BD-2026-034 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000035 |
+
+## Backend Change Boundary
+
+```text
+Domain: PrivacyRequest (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/privacy/requests; GET /admin/privacy/requests/{id}
+Permission: admin.privacy.read
+Migration: 000035
+```
+
+## Out of boundary
+
+隐私请求履约写 · soft-delete · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-035 StarConfig
+
+| ID | BD-2026-035 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000036 |
+
+## Backend Change Boundary
+
+```text
+Domain: StarConfig (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/explore/star-configs; GET /admin/explore/star-configs/{id}
+Permission: admin.explore.read
+Migration: 000036
+```
+
+## Out of boundary
+
+配置写发布 · 引擎改分层 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-036 RhythmConfig
+
+| ID | BD-2026-036 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000037 |
+
+## Backend Change Boundary
+
+```text
+Domain: RhythmConfig (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/explore/rhythm-configs; GET /admin/explore/rhythm-configs/{id}
+Permission: admin.explore.read
+Migration: 000037
+```
+
+## Out of boundary
+
+配置写发布 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-037 ImageCardDeck
+
+| ID | BD-2026-037 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000038 |
+
+## Backend Change Boundary
+
+```text
+Domain: ImageCardDeck (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/explore/image-card-decks; GET /admin/explore/image-card-decks/{id}
+Permission: admin.explore.read
+Migration: 000038
+```
+
+## Out of boundary
+
+牌组写发布 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-038 ReportTemplate
+
+| ID | BD-2026-038 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000039 |
+
+## Backend Change Boundary
+
+```text
+Domain: ReportTemplate (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/growth/report-templates; GET /admin/growth/report-templates/{id}
+Permission: admin.growth.read
+Migration: 000039
+```
+
+## Out of boundary
+
+模板写发布 · 广告投放 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-039 FunnelDefinition
+
+| ID | BD-2026-039 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | YES 000040 |
+
+## Backend Change Boundary
+
+```text
+Domain: FunnelDefinition (read)
+App: AdminHandler → admin.Service → AdminRepo
+API: GET /admin/analytics/funnel-definitions; GET /admin/analytics/funnel-definitions/{id}
+Permission: admin.analytics.read
+Migration: 000040
+```
+
+## Out of boundary
+
+漏斗写配置 · UGC · 真支付
+
+Rollback: down migration + remove routes/UI
@@ -0,0 +1,23 @@
+# Backend Design: ECR-040 ScaleDefinition
+
+| ID | BD-2026-040 |
+| Status | Approved |
+| Coding | Loop authorized |
+| Level | L2 |
+| Migration | NO |
+
+## Backend Change Boundary
+
+```text
+Domain: ScaleDefinition (read projection of scales)
+App: AdminHandler → admin.Service → ScaleRepo
+API: GET /admin/explore/scales[+/:id]
+Permission: admin.explore.read
+UI: admin-h5 /catalogs
+```
+
+## Out of boundary
+
+PATCH status · 题干编辑 · UGC · Payment
+
+Rollback: remove routes/UI