补充前端状态和安全边界注释

resources/js/chat-room/baccarat-loss-cover-admin.js

@@ -182,6 +182,7 @@ export async function submitBaccaratLossCoverEvent(event) {
         return;
     }
 
+    // 前端只收集表单字段；权限、时间范围和字段合法性仍以后端校验为准。
     const payload = {
         title: document.getElementById("blc-admin-title")?.value || "",
         description: document.getElementById("blc-admin-description")?.value || "",

resources/js/chat-room/bank-modal.js

@@ -211,6 +211,7 @@ export function bankShowMsg(message, success) {
     element.style.border = success ? "1px solid #bbf7d0" : "1px solid #fecaca";
     element.style.color = success ? "#16a34a" : "#ef4444";
     element.style.display = "block";
+    // 连续存取款时清理上一次隐藏任务，避免旧 timer 把新提示提前隐藏。
     clearTimeout(element._t);
     element._t = setTimeout(() => {
         element.style.display = "none";

resources/js/chat-room/friend-panel.js

@@ -254,6 +254,7 @@ async function friendAction(action, username, button) {
     setNotice("");
 
     try {
+        // 用户名进入 URL path 前必须编码，避免特殊字符破坏路径或请求目标。
         const response = await fetch(`/friend/${encodeURIComponent(username)}/${action}`, {
             method: action === "remove" ? "DELETE" : "POST",
             headers: {
@@ -311,6 +312,7 @@ export async function friendSearch() {
     setNotice("正在添加…");
 
     try {
+        // 搜索输入的用户名同样先做 path 编码，再交由后端做存在性与权限校验。
         const response = await fetch(`/friend/${encodeURIComponent(username)}/add`, {
             method: "POST",
             headers: {

resources/js/chat-room/mobile-drawer.js

@@ -4,6 +4,7 @@ import { escapeHtml } from "./html.js";
 import { renderRoomsOnlineStatusToContainer } from "./rooms.js";
 
 let mobileDrawerEventsBound = false;
+// 模块级状态用于维持抽屉互斥、搜索 RAF 节流和房间列表短缓存。
 let mobileDrawerOpen = null;
 let mobileUserListRenderTimer = null;
 let mobileRoomsOnlineStatusCache = null;
@@ -226,6 +227,7 @@ export async function loadMobileRoomList() {
     }
 
     if (mobileRoomsOnlineStatusCache && Date.now() - mobileRoomsOnlineStatusCacheAt < MOBILE_ROOMS_ONLINE_STATUS_CACHE_TTL) {
+        // 切换手机房间 tab 可能高频触发，10 秒短缓存用来减少接口压力，允许轻微延迟。
         renderMobileRoomList(mobileRoomsOnlineStatusCache, container);
         return;
     }

resources/js/chat-room/preferences-status.js

@@ -84,6 +84,7 @@ export function normalizeDailyStatus(raw, nowTimestamp = Date.now()) {
  */
 export function loadBlockedSystemSenders(blockableSystemSenders = BLOCKABLE_SYSTEM_SENDERS) {
     try {
+        // 旧 localStorage 可能损坏或被手动篡改，读取后只保留当前允许屏蔽的发送者。
         const saved = JSON.parse(localStorage.getItem(BLOCKED_SYSTEM_SENDERS_STORAGE_KEY) || "[]");
 
         if (!Array.isArray(saved)) {