针对日志并发问题，在自动存点中增加Redis分布式冷却锁，杜绝进程重复触发导致经验暴涨，完善单元测试

修复 AutoSaveExp 自动存点指令中，有职务用户的等级处理逻辑：
- 职务等级改为最低要求（不足时补级），不再强制锁定
- 允许职务成员通过经验值超越职务等级
- 与 ChatController::calculateNewLevel 保持一致

之前 AutoSaveExp 每5分钟把蔚蓝的心情（LV.91/金牌聊务员）
强制降到90级，心跳60秒后又升回91并触发升级广播，
导致用户反复看到"升级到91级"的提示。

.agents/plugins/marketplace.json

@@ -0,0 +1,20 @@
+{
+  "name": "chatroom-local-marketplace",
+  "interface": {
+    "displayName": "Chatroom Local Plugins"
+  },
+  "plugins": [
+    {
+      "name": "chatroom-ride-development",
+      "source": {
+        "source": "local",
+        "path": "./plugins/chatroom-ride-development"
+      },
+      "policy": {
+        "installation": "AVAILABLE",
+        "authentication": "ON_INSTALL"
+      },
+      "category": "Productivity"
+    }
+  ]
+}

.agents/rules/chat.md

@@ -1,150 +0,0 @@
----
-trigger: always_on
----
-
-> **技术栈**：Laravel 12 · PHP 8.4 · Laravel Reverb (WebSocket) · Redis · MySQL 8.0 · Laravel Horizon
-> **原项目**：`/Users/pllx/Web/chat/hp0709`（VBScript ASP + MS Access 聊天室）
-> **目标域名**：`http://chatroom.test`（Herd 自动配置）
-
----
-
-## 一、环境版本要求
-
-| 组件                  | 版本                       |
-| --------------------- | -------------------------- |
-| **PHP**               | 8.4.5+                     |
-| **Laravel Framework** | v12.x                      |
-| **Laravel Reverb**    | latest（WebSocket 服务器） |
-| **Laravel Horizon**   | v5（Redis 队列可视化管理） |
-| **PHPUnit**           | v11（测试框架）            |
-| **Node.js**           | 20.x LTS                   |
-| **MySQL**             | 8.0+                       |
-| **Redis**             | 7.x                        |
-
----
-
-## 二、代码规范（强制执行）
-
-### 2.1 Laravel Pint 格式化
-
-```bash
-# 提交代码前必须运行，修复格式问题
-vendor/bin/pint --dirty
-
-# 检查格式问题（不修复）
-vendor/bin/pint --test
-
-# 格式化整个项目
-vendor/bin/pint
-```
-
-### 2.2 PHP 8.4 类型系统（必须遵守）
-
-```php
-// ✅ 正确：构造函数属性提升 (Constructor Property Promotion)
-class ChatController extends Controller
-{
-    public function __construct(
-        private readonly ChatStateService    $chatState,
-        private readonly MessageFilterService $filter,
-    ) {}
-}
-
-// ❌ 错误：不允许无参空构造函数
-class SomeClass
-{
-    public function __construct() {} // 禁止！
-}
-
-// ✅ 正确：显式返回类型 + 参数类型提示
-public function send(SendMessageRequest $request): JsonResponse
-{
-    // ...
-}
-
-// ✅ 正确：使用 PHP 8.4 新特性
-// 联合类型
-public function findUser(int|string $id): User|null {}
-
-// readonly 属性
-class MessageDto
-{
-    public function __construct(
-        public readonly string $content,
-        public readonly string $fromUser,
-        public readonly int    $roomId,
-    ) {}
-}
-```
-
-### 2.3 Laravel 12 中间件配置（重要）
-
-> [!IMPORTANT]
-> Laravel 12 已废弃 `Kernel.php`，中间件在 `bootstrap/app.php` 中配置。
-
-```php
-// bootstrap/app.php
-return Application::configure(basePath: dirname(__DIR__))
-    ->withRouting(
-        web: __DIR__.'/../routes/web.php',
-        api: __DIR__.'/../routes/api.php',          // API 路由
-        channels: __DIR__.'/../routes/channels.php', // WebSocket 频道
-        commands: __DIR__.'/../routes/console.php',
-        health: '/up',
-    )
-    ->withMiddleware(function (Middleware $middleware): void {
-        // 注册聊天室登录验证中间件
-        $middleware->alias([
-            'chat.auth'    => \App\Http\Middleware\ChatAuthenticate::class,
-            'chat.level'   => \App\Http\Middleware\LevelRequired::class,
-        ]);
-
-        // Session 中间件（Web 路由自动携带）
-        $middleware->web(append: [
-            \App\Http\Middleware\HandleInertiaRequests::class,
-        ]);
-    })
-    ->withExceptions(function (Exceptions $exceptions): void {
-        //
-    })->create();
-```
-
-### 2.4 中文注释规范（每个文件必须）
-
-```php
-<?php
-
-/**
- * 文件功能：[本文件的业务职责描述]
- *
- * 对应原 ASP 文件：[原文件名.asp]
- *
- * @package  App\[命名空间]
- * @author   ChatRoom Laravel
- * @version  1.0.0
- */
-
-namespace App\Services;
-
-class ChatStateService
-{
-    /**
-     * 用户进入聊天房间，将其信息写入 Redis。
-     *
-     * 替代原 ASP 的 Application("_user_list") 字符串拼接操作。
-     *
-     * @param  int    $roomId    房间 ID
-     * @param  string $username  用户名
-     * @param  array  $userInfo  用户信息（等级、头像、性别等）
-     */
-    public function userJoin(int $roomId, string $username, array $userInfo): void
-    {
-        // 将用户信息序列化后存入 Redis Hash，Key 为 "room:{房间ID}:users"
-        $this->redis->hset("room:{$roomId}:users", $username, json_encode($userInfo));
-    }
-}
-```
-
-### 2.5 迁移文件注意事项
-
-同时新建多个迁移文件时，要注意 是否有关联主键问题，主键所在表要先创建，所以迁移文件名称 要比被调用表文件名的靠前，否则执行迁移时会报错；

.agents/skills/tailwindcss-development/SKILL.md

@@ -1,129 +0,0 @@
----
-name: tailwindcss-development
-description: "Styles applications using Tailwind CSS v4 utilities. Activates when adding styles, restyling components, working with gradients, spacing, layout, flex, grid, responsive design, dark mode, colors, typography, or borders; or when the user mentions CSS, styling, classes, Tailwind, restyle, hero section, cards, buttons, or any visual/UI changes."
-license: MIT
-metadata:
-  author: laravel
----
-
-# Tailwind CSS Development
-
-## When to Apply
-
-Activate this skill when:
-
-- Adding styles to components or pages
-- Working with responsive design
-- Implementing dark mode
-- Extracting repeated patterns into components
-- Debugging spacing or layout issues
-
-## Documentation
-
-Use `search-docs` for detailed Tailwind CSS v4 patterns and documentation.
-
-## Basic Usage
-
-- Use Tailwind CSS classes to style HTML. Check and follow existing Tailwind conventions in the project before introducing new patterns.
-- Offer to extract repeated patterns into components that match the project's conventions (e.g., Blade, JSX, Vue).
-- Consider class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child elements carefully to reduce repetition, and group elements logically.
-
-## Tailwind CSS v4 Specifics
-
-- Always use Tailwind CSS v4 and avoid deprecated utilities.
-- `corePlugins` is not supported in Tailwind v4.
-
-### CSS-First Configuration
-
-In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed:
-
-<!-- CSS-First Config -->
-```css
-@theme {
-  --color-brand: oklch(0.72 0.11 178);
-}
-```
-
-### Import Syntax
-
-In Tailwind v4, import Tailwind with a regular CSS `@import` statement instead of the `@tailwind` directives used in v3:
-
-<!-- v4 Import Syntax -->
-```diff
-- @tailwind base;
-- @tailwind components;
-- @tailwind utilities;
-+ @import "tailwindcss";
-```
-
-### Replaced Utilities
-
-Tailwind v4 removed deprecated utilities. Use the replacements shown below. Opacity values remain numeric.
-
-| Deprecated | Replacement |
-|------------|-------------|
-| bg-opacity-* | bg-black/* |
-| text-opacity-* | text-black/* |
-| border-opacity-* | border-black/* |
-| divide-opacity-* | divide-black/* |
-| ring-opacity-* | ring-black/* |
-| placeholder-opacity-* | placeholder-black/* |
-| flex-shrink-* | shrink-* |
-| flex-grow-* | grow-* |
-| overflow-ellipsis | text-ellipsis |
-| decoration-slice | box-decoration-slice |
-| decoration-clone | box-decoration-clone |
-
-## Spacing
-
-Use `gap` utilities instead of margins for spacing between siblings:
-
-<!-- Gap Utilities -->
-```html
-<div class="flex gap-8">
-    <div>Item 1</div>
-    <div>Item 2</div>
-</div>
-```
-
-## Dark Mode
-
-If existing pages and components support dark mode, new pages and components must support it the same way, typically using the `dark:` variant:
-
-<!-- Dark Mode -->
-```html
-<div class="bg-white dark:bg-gray-900 text-gray-900 dark:text-white">
-    Content adapts to color scheme
-</div>
-```
-
-## Common Patterns
-
-### Flexbox Layout
-
-<!-- Flexbox Layout -->
-```html
-<div class="flex items-center justify-between gap-4">
-    <div>Left content</div>
-    <div>Right content</div>
-</div>
-```
-
-### Grid Layout
-
-<!-- Grid Layout -->
-```html
-<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
-    <div>Card 1</div>
-    <div>Card 2</div>
-    <div>Card 3</div>
-</div>
-```
-
-## Common Pitfalls
-
-- Using deprecated v3 utilities (bg-opacity-*, flex-shrink-*, etc.)
-- Using `@tailwind` directives instead of `@import "tailwindcss"`
-- Trying to use `tailwind.config.js` instead of CSS `@theme` directive
-- Using margins for spacing between siblings instead of gap utilities
-- Forgetting to add dark mode variants when the project uses dark mode

.codex/environments/environment-2.toml

@@ -1,12 +0,0 @@
-# THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY
-version = 1
-name = "chatroom"
-
-[setup]
-script = ""
-
-[cleanup]
-script = '''
-php artisan reverb:start
-php artisan horizon
-'''

.codex/environments/environment.toml

@@ -1,14 +0,0 @@
-# THIS IS AUTOGENERATED. DO NOT EDIT MANUALLY
-version = 1
-name = "chatroom"
-
-[setup]
-script = ""
-
-[[actions]]
-name = "启动ws"
-icon = "tool"
-command = '''
-php artisan reverb:start
-php artisan horizon
-'''

.gemini/settings.json

@@ -1,20 +0,0 @@
-{
-    "mcpServers": {
-        "laravel-boost": {
-            "command": "php",
-            "args": [
-                "artisan",
-                "boost:mcp"
-            ]
-        },
-        "herd": {
-            "command": "php",
-            "args": [
-                "/Applications/Herd.app/Contents/Resources/herd-mcp.phar"
-            ],
-            "env": {
-                "SITE_PATH": "/Users/pllx/Web/Herd/chatroom"
-            }
-        }
-    }
-}

.github/skills/tailwindcss-development/SKILL.md

@@ -1,129 +0,0 @@
----
-name: tailwindcss-development
-description: "Styles applications using Tailwind CSS v4 utilities. Activates when adding styles, restyling components, working with gradients, spacing, layout, flex, grid, responsive design, dark mode, colors, typography, or borders; or when the user mentions CSS, styling, classes, Tailwind, restyle, hero section, cards, buttons, or any visual/UI changes."
-license: MIT
-metadata:
-  author: laravel
----
-
-# Tailwind CSS Development
-
-## When to Apply
-
-Activate this skill when:
-
-- Adding styles to components or pages
-- Working with responsive design
-- Implementing dark mode
-- Extracting repeated patterns into components
-- Debugging spacing or layout issues
-
-## Documentation
-
-Use `search-docs` for detailed Tailwind CSS v4 patterns and documentation.
-
-## Basic Usage
-
-- Use Tailwind CSS classes to style HTML. Check and follow existing Tailwind conventions in the project before introducing new patterns.
-- Offer to extract repeated patterns into components that match the project's conventions (e.g., Blade, JSX, Vue).
-- Consider class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child elements carefully to reduce repetition, and group elements logically.
-
-## Tailwind CSS v4 Specifics
-
-- Always use Tailwind CSS v4 and avoid deprecated utilities.
-- `corePlugins` is not supported in Tailwind v4.
-
-### CSS-First Configuration
-
-In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed:
-
-<!-- CSS-First Config -->
-```css
-@theme {
-  --color-brand: oklch(0.72 0.11 178);
-}
-```
-
-### Import Syntax
-
-In Tailwind v4, import Tailwind with a regular CSS `@import` statement instead of the `@tailwind` directives used in v3:
-
-<!-- v4 Import Syntax -->
-```diff
-- @tailwind base;
-- @tailwind components;
-- @tailwind utilities;
-+ @import "tailwindcss";
-```
-
-### Replaced Utilities
-
-Tailwind v4 removed deprecated utilities. Use the replacements shown below. Opacity values remain numeric.
-
-| Deprecated | Replacement |
-|------------|-------------|
-| bg-opacity-* | bg-black/* |
-| text-opacity-* | text-black/* |
-| border-opacity-* | border-black/* |
-| divide-opacity-* | divide-black/* |
-| ring-opacity-* | ring-black/* |
-| placeholder-opacity-* | placeholder-black/* |
-| flex-shrink-* | shrink-* |
-| flex-grow-* | grow-* |
-| overflow-ellipsis | text-ellipsis |
-| decoration-slice | box-decoration-slice |
-| decoration-clone | box-decoration-clone |
-
-## Spacing
-
-Use `gap` utilities instead of margins for spacing between siblings:
-
-<!-- Gap Utilities -->
-```html
-<div class="flex gap-8">
-    <div>Item 1</div>
-    <div>Item 2</div>
-</div>
-```
-
-## Dark Mode
-
-If existing pages and components support dark mode, new pages and components must support it the same way, typically using the `dark:` variant:
-
-<!-- Dark Mode -->
-```html
-<div class="bg-white dark:bg-gray-900 text-gray-900 dark:text-white">
-    Content adapts to color scheme
-</div>
-```
-
-## Common Patterns
-
-### Flexbox Layout
-
-<!-- Flexbox Layout -->
-```html
-<div class="flex items-center justify-between gap-4">
-    <div>Left content</div>
-    <div>Right content</div>
-</div>
-```
-
-### Grid Layout
-
-<!-- Grid Layout -->
-```html
-<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
-    <div>Card 1</div>
-    <div>Card 2</div>
-    <div>Card 3</div>
-</div>
-```
-
-## Common Pitfalls
-
-- Using deprecated v3 utilities (bg-opacity-*, flex-shrink-*, etc.)
-- Using `@tailwind` directives instead of `@import "tailwindcss"`
-- Trying to use `tailwind.config.js` instead of CSS `@theme` directive
-- Using margins for spacing between siblings instead of gap utilities
-- Forgetting to add dark mode variants when the project uses dark mode

.gitignore

@@ -15,6 +15,10 @@
 /.github
 /.gemini
 /.agents
+/.codex
+/.hermes
+/.reasonix
+/.understand-anything
 /auth.json
 /node_modules
 /public/build
@@ -30,3 +34,9 @@ vendor.zip
 test-captcha.php
 public/.user.ini
 dump.rdb
+
+# AI 生成文件
+AGENTS.md
+GEMINI.md
+rr
+.rr.yaml

.junie/guidelines.md

@@ -1,256 +0,0 @@
-<laravel-boost-guidelines>
-=== foundation rules ===
-
-# Laravel Boost Guidelines
-
-The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
-
-## Foundational Context
-
-This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
-
-- php - 8.4.5
-- laravel/framework (LARAVEL) - v12
-- laravel/horizon (HORIZON) - v5
-- laravel/prompts (PROMPTS) - v0
-- laravel/reverb (REVERB) - v1
-- laravel/boost (BOOST) - v2
-- laravel/mcp (MCP) - v0
-- laravel/pail (PAIL) - v1
-- laravel/pint (PINT) - v1
-- laravel/sail (SAIL) - v1
-- phpunit/phpunit (PHPUNIT) - v11
-- laravel-echo (ECHO) - v2
-- tailwindcss (TAILWINDCSS) - v4
-
-## Skills Activation
-
-This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
-
-- `tailwindcss-development` — Styles applications using Tailwind CSS v4 utilities. Activates when adding styles, restyling components, working with gradients, spacing, layout, flex, grid, responsive design, dark mode, colors, typography, or borders; or when the user mentions CSS, styling, classes, Tailwind, restyle, hero section, cards, buttons, or any visual/UI changes.
-
-## Conventions
-
-- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
-- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
-- Check for existing components to reuse before writing a new one.
-
-## Verification Scripts
-
-- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
-
-## Application Structure & Architecture
-
-- Stick to existing directory structure; don't create new base folders without approval.
-- Do not change the application's dependencies without approval.
-
-## Frontend Bundling
-
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
-
-## Documentation Files
-
-- You must only create documentation files if explicitly requested by the user.
-
-## Replies
-
-- Be concise in your explanations - focus on what's important rather than explaining obvious details.
-
-=== boost rules ===
-
-# Laravel Boost
-
-- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
-
-## Artisan
-
-- Use the `list-artisan-commands` tool when you need to call an Artisan command to double-check the available parameters.
-
-## URLs
-
-- Whenever you share a project URL with the user, you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain/IP, and port.
-
-## Tinker / Debugging
-
-- You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
-- Use the `database-query` tool when you only need to read from the database.
-- Use the `database-schema` tool to inspect table structure before writing migrations or models.
-
-## Reading Browser Logs With the `browser-logs` Tool
-
-- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
-- Only recent browser logs will be useful - ignore old logs.
-
-## Searching Documentation (Critically Important)
-
-- Boost comes with a powerful `search-docs` tool you should use before trying other approaches when working with Laravel or Laravel ecosystem packages. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
-- Search the documentation before making code changes to ensure we are taking the correct approach.
-- Use multiple, broad, simple, topic-based queries at once. For example: `['rate limiting', 'routing rate limiting', 'routing']`. The most relevant results will be returned first.
-- Do not add package names to queries; package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
-
-### Available Search Syntax
-
-1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'.
-2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit".
-3. Quoted Phrases (Exact Position) - query="infinite scroll" - words must be adjacent and in that order.
-4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit".
-5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms.
-
-=== php rules ===
-
-# PHP
-
-- Always use curly braces for control structures, even for single-line bodies.
-
-## Constructors
-
-- Use PHP 8 constructor property promotion in `__construct()`.
-    - `public function __construct(public GitHub $github) { }`
-- Do not allow empty `__construct()` methods with zero parameters unless the constructor is private.
-
-## Type Declarations
-
-- Always use explicit return type declarations for methods and functions.
-- Use appropriate PHP type hints for method parameters.
-
-<!-- Explicit Return Types and Method Params -->
-```php
-protected function isAccessible(User $user, ?string $path = null): bool
-{
-    ...
-}
-```
-
-## Enums
-
-- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
-
-## Comments
-
-- Prefer PHPDoc blocks over inline comments. Never use comments within the code itself unless the logic is exceptionally complex.
-
-## PHPDoc Blocks
-
-- Add useful array shape type definitions when appropriate.
-
-=== herd rules ===
-
-# Laravel Herd
-
-- The application is served by Laravel Herd and will be available at: `https?://[kebab-case-project-dir].test`. Use the `get-absolute-url` tool to generate valid URLs for the user.
-- You must not run any commands to make the site available via HTTP(S). It is always available through Laravel Herd.
-
-=== laravel/core rules ===
-
-# Do Things the Laravel Way
-
-- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using the `list-artisan-commands` tool.
-- If you're creating a generic PHP class, use `php artisan make:class`.
-- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
-
-## Database
-
-- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
-- Use Eloquent models and relationships before suggesting raw database queries.
-- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
-- Generate code that prevents N+1 query problems by using eager loading.
-- Use Laravel's query builder for very complex database operations.
-
-### Model Creation
-
-- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `list-artisan-commands` to check the available options to `php artisan make:model`.
-
-### APIs & Eloquent Resources
-
-- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
-
-## Controllers & Validation
-
-- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
-- Check sibling Form Requests to see if the application uses array or string based validation rules.
-
-## Authentication & Authorization
-
-- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
-
-## URL Generation
-
-- When generating links to other pages, prefer named routes and the `route()` function.
-
-## Queues
-
-- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
-
-## Configuration
-
-- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
-
-## Testing
-
-- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
-- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
-- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
-
-## Vite Error
-
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
-
-=== laravel/v12 rules ===
-
-# Laravel 12
-
-- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
-- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.
-
-## Laravel 12 Structure
-
-- In Laravel 12, middleware are no longer registered in `app/Http/Kernel.php`.
-- Middleware are configured declaratively in `bootstrap/app.php` using `Application::configure()->withMiddleware()`.
-- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
-- `bootstrap/providers.php` contains application specific service providers.
-- The `app\Console\Kernel.php` file no longer exists; use `bootstrap/app.php` or `routes/console.php` for console configuration.
-- Console commands in `app/Console/Commands/` are automatically available and do not require manual registration.
-
-## Database
-
-- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
-- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
-
-### Models
-
-- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
-
-=== pint/core rules ===
-
-# Laravel Pint Code Formatter
-
-- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
-- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
-
-=== phpunit/core rules ===
-
-# PHPUnit
-
-- This application uses PHPUnit for testing. All tests must be written as PHPUnit classes. Use `php artisan make:test --phpunit {name}` to create a new test.
-- If you see a test using "Pest", convert it to PHPUnit.
-- Every time a test has been updated, run that singular test.
-- When the tests relating to your feature are passing, ask the user if they would like to also run the entire test suite to make sure everything is still passing.
-- Tests should cover all happy paths, failure paths, and edge cases.
-- You must not remove any tests or test files from the tests directory without approval. These are not temporary or helper files; these are core to the application.
-
-## Running Tests
-
-- Run the minimal number of tests, using an appropriate filter, before finalizing.
-- To run all tests: `php artisan test --compact`.
-- To run all tests in a file: `php artisan test --compact tests/Feature/ExampleTest.php`.
-- To filter on a particular test name: `php artisan test --compact --filter=testName` (recommended after making a change to a related file).
-
-=== tailwindcss/core rules ===
-
-# Tailwind CSS
-
-- Always use existing Tailwind conventions; check project patterns before adding new ones.
-- IMPORTANT: Always use `search-docs` tool for version-specific Tailwind CSS documentation and updated code examples. Never rely on training data.
-- IMPORTANT: Activate `tailwindcss-development` every time you're working with a Tailwind CSS or styling-related task.
-
-</laravel-boost-guidelines>

.junie/mcp/mcp.json

@@ -1,20 +0,0 @@
-{
-    "mcpServers": {
-        "laravel-boost": {
-            "command": "/opt/homebrew/Cellar/php/8.4.5_1/bin/php",
-            "args": [
-                "/Users/pllx/Web/Herd/chatroom/artisan",
-                "boost:mcp"
-            ]
-        },
-        "herd": {
-            "command": "/opt/homebrew/Cellar/php/8.4.5_1/bin/php",
-            "args": [
-                "/Applications/Herd.app/Contents/Resources/herd-mcp.phar"
-            ],
-            "env": {
-                "SITE_PATH": "/Users/pllx/Web/Herd/chatroom"
-            }
-        }
-    }
-}

.junie/skills/tailwindcss-development/SKILL.md

@@ -1,129 +0,0 @@
----
-name: tailwindcss-development
-description: "Styles applications using Tailwind CSS v4 utilities. Activates when adding styles, restyling components, working with gradients, spacing, layout, flex, grid, responsive design, dark mode, colors, typography, or borders; or when the user mentions CSS, styling, classes, Tailwind, restyle, hero section, cards, buttons, or any visual/UI changes."
-license: MIT
-metadata:
-  author: laravel
----
-
-# Tailwind CSS Development
-
-## When to Apply
-
-Activate this skill when:
-
-- Adding styles to components or pages
-- Working with responsive design
-- Implementing dark mode
-- Extracting repeated patterns into components
-- Debugging spacing or layout issues
-
-## Documentation
-
-Use `search-docs` for detailed Tailwind CSS v4 patterns and documentation.
-
-## Basic Usage
-
-- Use Tailwind CSS classes to style HTML. Check and follow existing Tailwind conventions in the project before introducing new patterns.
-- Offer to extract repeated patterns into components that match the project's conventions (e.g., Blade, JSX, Vue).
-- Consider class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child elements carefully to reduce repetition, and group elements logically.
-
-## Tailwind CSS v4 Specifics
-
-- Always use Tailwind CSS v4 and avoid deprecated utilities.
-- `corePlugins` is not supported in Tailwind v4.
-
-### CSS-First Configuration
-
-In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed:
-
-<!-- CSS-First Config -->
-```css
-@theme {
-  --color-brand: oklch(0.72 0.11 178);
-}
-```
-
-### Import Syntax
-
-In Tailwind v4, import Tailwind with a regular CSS `@import` statement instead of the `@tailwind` directives used in v3:
-
-<!-- v4 Import Syntax -->
-```diff
-- @tailwind base;
-- @tailwind components;
-- @tailwind utilities;
-+ @import "tailwindcss";
-```
-
-### Replaced Utilities
-
-Tailwind v4 removed deprecated utilities. Use the replacements shown below. Opacity values remain numeric.
-
-| Deprecated | Replacement |
-|------------|-------------|
-| bg-opacity-* | bg-black/* |
-| text-opacity-* | text-black/* |
-| border-opacity-* | border-black/* |
-| divide-opacity-* | divide-black/* |
-| ring-opacity-* | ring-black/* |
-| placeholder-opacity-* | placeholder-black/* |
-| flex-shrink-* | shrink-* |
-| flex-grow-* | grow-* |
-| overflow-ellipsis | text-ellipsis |
-| decoration-slice | box-decoration-slice |
-| decoration-clone | box-decoration-clone |
-
-## Spacing
-
-Use `gap` utilities instead of margins for spacing between siblings:
-
-<!-- Gap Utilities -->
-```html
-<div class="flex gap-8">
-    <div>Item 1</div>
-    <div>Item 2</div>
-</div>
-```
-
-## Dark Mode
-
-If existing pages and components support dark mode, new pages and components must support it the same way, typically using the `dark:` variant:
-
-<!-- Dark Mode -->
-```html
-<div class="bg-white dark:bg-gray-900 text-gray-900 dark:text-white">
-    Content adapts to color scheme
-</div>
-```
-
-## Common Patterns
-
-### Flexbox Layout
-
-<!-- Flexbox Layout -->
-```html
-<div class="flex items-center justify-between gap-4">
-    <div>Left content</div>
-    <div>Right content</div>
-</div>
-```
-
-### Grid Layout
-
-<!-- Grid Layout -->
-```html
-<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
-    <div>Card 1</div>
-    <div>Card 2</div>
-    <div>Card 3</div>
-</div>
-```
-
-## Common Pitfalls
-
-- Using deprecated v3 utilities (bg-opacity-*, flex-shrink-*, etc.)
-- Using `@tailwind` directives instead of `@import "tailwindcss"`
-- Trying to use `tailwind.config.js` instead of CSS `@theme` directive
-- Using margins for spacing between siblings instead of gap utilities
-- Forgetting to add dark mode variants when the project uses dark mode

AGENTS.md

@@ -1,256 +0,0 @@
-<laravel-boost-guidelines>
-=== foundation rules ===
-
-# Laravel Boost Guidelines
-
-The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
-
-## Foundational Context
-
-This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
-
-- php - 8.4.5
-- laravel/framework (LARAVEL) - v12
-- laravel/horizon (HORIZON) - v5
-- laravel/prompts (PROMPTS) - v0
-- laravel/reverb (REVERB) - v1
-- laravel/boost (BOOST) - v2
-- laravel/mcp (MCP) - v0
-- laravel/pail (PAIL) - v1
-- laravel/pint (PINT) - v1
-- laravel/sail (SAIL) - v1
-- phpunit/phpunit (PHPUNIT) - v11
-- laravel-echo (ECHO) - v2
-- tailwindcss (TAILWINDCSS) - v4
-
-## Skills Activation
-
-This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
-
-- `tailwindcss-development` — Styles applications using Tailwind CSS v4 utilities. Activates when adding styles, restyling components, working with gradients, spacing, layout, flex, grid, responsive design, dark mode, colors, typography, or borders; or when the user mentions CSS, styling, classes, Tailwind, restyle, hero section, cards, buttons, or any visual/UI changes.
-
-## Conventions
-
-- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
-- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
-- Check for existing components to reuse before writing a new one.
-
-## Verification Scripts
-
-- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
-
-## Application Structure & Architecture
-
-- Stick to existing directory structure; don't create new base folders without approval.
-- Do not change the application's dependencies without approval.
-
-## Frontend Bundling
-
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
-
-## Documentation Files
-
-- You must only create documentation files if explicitly requested by the user.
-
-## Replies
-
-- Be concise in your explanations - focus on what's important rather than explaining obvious details.
-
-=== boost rules ===
-
-# Laravel Boost
-
-- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
-
-## Artisan
-
-- Use the `list-artisan-commands` tool when you need to call an Artisan command to double-check the available parameters.
-
-## URLs
-
-- Whenever you share a project URL with the user, you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain/IP, and port.
-
-## Tinker / Debugging
-
-- You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
-- Use the `database-query` tool when you only need to read from the database.
-- Use the `database-schema` tool to inspect table structure before writing migrations or models.
-
-## Reading Browser Logs With the `browser-logs` Tool
-
-- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
-- Only recent browser logs will be useful - ignore old logs.
-
-## Searching Documentation (Critically Important)
-
-- Boost comes with a powerful `search-docs` tool you should use before trying other approaches when working with Laravel or Laravel ecosystem packages. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
-- Search the documentation before making code changes to ensure we are taking the correct approach.
-- Use multiple, broad, simple, topic-based queries at once. For example: `['rate limiting', 'routing rate limiting', 'routing']`. The most relevant results will be returned first.
-- Do not add package names to queries; package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
-
-### Available Search Syntax
-
-1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'.
-2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit".
-3. Quoted Phrases (Exact Position) - query="infinite scroll" - words must be adjacent and in that order.
-4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit".
-5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms.
-
-=== php rules ===
-
-# PHP
-
-- Always use curly braces for control structures, even for single-line bodies.
-
-## Constructors
-
-- Use PHP 8 constructor property promotion in `__construct()`.
-    - `public function __construct(public GitHub $github) { }`
-- Do not allow empty `__construct()` methods with zero parameters unless the constructor is private.
-
-## Type Declarations
-
-- Always use explicit return type declarations for methods and functions.
-- Use appropriate PHP type hints for method parameters.
-
-<!-- Explicit Return Types and Method Params -->
-```php
-protected function isAccessible(User $user, ?string $path = null): bool
-{
-    ...
-}
-```
-
-## Enums
-
-- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
-
-## Comments
-
-- Prefer PHPDoc blocks over inline comments. Never use comments within the code itself unless the logic is exceptionally complex.
-
-## PHPDoc Blocks
-
-- Add useful array shape type definitions when appropriate.
-
-=== herd rules ===
-
-# Laravel Herd
-
-- The application is served by Laravel Herd and will be available at: `https?://[kebab-case-project-dir].test`. Use the `get-absolute-url` tool to generate valid URLs for the user.
-- You must not run any commands to make the site available via HTTP(S). It is always available through Laravel Herd.
-
-=== laravel/core rules ===
-
-# Do Things the Laravel Way
-
-- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using the `list-artisan-commands` tool.
-- If you're creating a generic PHP class, use `php artisan make:class`.
-- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
-
-## Database
-
-- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
-- Use Eloquent models and relationships before suggesting raw database queries.
-- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
-- Generate code that prevents N+1 query problems by using eager loading.
-- Use Laravel's query builder for very complex database operations.
-
-### Model Creation
-
-- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `list-artisan-commands` to check the available options to `php artisan make:model`.
-
-### APIs & Eloquent Resources
-
-- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
-
-## Controllers & Validation
-
-- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
-- Check sibling Form Requests to see if the application uses array or string based validation rules.
-
-## Authentication & Authorization
-
-- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
-
-## URL Generation
-
-- When generating links to other pages, prefer named routes and the `route()` function.
-
-## Queues
-
-- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
-
-## Configuration
-
-- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
-
-## Testing
-
-- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
-- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
-- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
-
-## Vite Error
-
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
-
-=== laravel/v12 rules ===
-
-# Laravel 12
-
-- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
-- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.
-
-## Laravel 12 Structure
-
-- In Laravel 12, middleware are no longer registered in `app/Http/Kernel.php`.
-- Middleware are configured declaratively in `bootstrap/app.php` using `Application::configure()->withMiddleware()`.
-- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
-- `bootstrap/providers.php` contains application specific service providers.
-- The `app\Console\Kernel.php` file no longer exists; use `bootstrap/app.php` or `routes/console.php` for console configuration.
-- Console commands in `app/Console/Commands/` are automatically available and do not require manual registration.
-
-## Database
-
-- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
-- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
-
-### Models
-
-- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
-
-=== pint/core rules ===
-
-# Laravel Pint Code Formatter
-
-- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
-- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
-
-=== phpunit/core rules ===
-
-# PHPUnit
-
-- This application uses PHPUnit for testing. All tests must be written as PHPUnit classes. Use `php artisan make:test --phpunit {name}` to create a new test.
-- If you see a test using "Pest", convert it to PHPUnit.
-- Every time a test has been updated, run that singular test.
-- When the tests relating to your feature are passing, ask the user if they would like to also run the entire test suite to make sure everything is still passing.
-- Tests should cover all happy paths, failure paths, and edge cases.
-- You must not remove any tests or test files from the tests directory without approval. These are not temporary or helper files; these are core to the application.
-
-## Running Tests
-
-- Run the minimal number of tests, using an appropriate filter, before finalizing.
-- To run all tests: `php artisan test --compact`.
-- To run all tests in a file: `php artisan test --compact tests/Feature/ExampleTest.php`.
-- To filter on a particular test name: `php artisan test --compact --filter=testName` (recommended after making a change to a related file).
-
-=== tailwindcss/core rules ===
-
-# Tailwind CSS
-
-- Always use existing Tailwind conventions; check project patterns before adding new ones.
-- IMPORTANT: Always use `search-docs` tool for version-specific Tailwind CSS documentation and updated code examples. Never rely on training data.
-- IMPORTANT: Activate `tailwindcss-development` every time you're working with a Tailwind CSS or styling-related task.
-
-</laravel-boost-guidelines>

GAMES_TODO.md

@@ -1,98 +0,0 @@
-# 🎮 聊天室游戏开发进度
-
-> 更新时间：2026-03-04
-
----
-
-## ✅ 已完成
-
-### 🎲 百家乐（Baccarat）
-
-- **类型**：定时自动开局（调度器每分钟检查，间隔可配置）
-- **数据库**：`baccarat_rounds` + `baccarat_bets`
-- **模型**：`BaccaratRound` / `BaccaratBet`
-- **队列 Job**：`OpenBaccaratRoundJob` (开局) + `CloseBaccaratRoundJob` (摇骰结算)
-- **事件**：`BaccaratRoundOpened` / `BaccaratRoundSettled`（PresenceChannel 广播）
-- **控制器**：`BaccaratController`（`/baccarat/current` / `/baccarat/bet` / `/baccarat/history`）
-- **前端**：`chat/partials/baccarat-panel.blade.php`（倒计时/押注/骰子动画/趋势）
-- **货币来源**：`CurrencySource::BACCARAT_BET` / `BACCARAT_WIN`
-- **后台配置**：`game_configs` 表，管理员可配置开关/间隔/赔率/押注范围
-
-### 🎰 老虎机（Slot Machine）
-
-- **类型**：玩家随时主动触发（即时游戏）
-- **数据库**：`slot_machine_logs`
-- **模型**：`SlotMachineLog`（8种带权重图案、判奖逻辑）
-- **控制器**：`SlotMachineController`（`/slot/info` / `/slot/spin` / `/slot/history`）
-- **赔率**：三7×100（全服广播）/ 三钻×50 / 三同×10 / 两同×2 / 三骷髅诅咒（扣双倍）
-- **聊天通知**：中奖发私信通知；三7全服公屏广播
-- **前端**：`chat/partials/slot-machine.blade.php`（三列滚轮动画/逐列停止/可拖动FAB）
-- **货币来源**：`CurrencySource::SLOT_SPIN` / `SLOT_WIN` / `SLOT_CURSE`
-- **后台配置**：`game_configs` 表，可配置每次消耗/每日次数上限/各赔率
-
-### 📦 神秘箱子（Mystery Box）
-
-- **类型**：系统定时自动投放 + 管理员手动投放（即时广播暗号，先到先得）
-- **数据库**：`mystery_boxes`（箱子记录）+ `mystery_box_claims`（领取日志）
-- **模型**：`MysteryBox` / `MysteryBoxClaim`
-- **队列 Job**：`DropMysteryBoxJob`（投放 + 公屏广播暗号 + 派发 ExpireJob）/ `ExpireMysteryBoxJob`（到期处理）
-- **控制器**：`MysteryBoxController`（`/mystery-box/status` 状态查询 / `/mystery-box/claim` 领取）
-- **前端**：`chat/partials/mystery-box.blade.php`（5秒轮询检测 + 可拖动FAB + 快捷输入面板）
-- **领取方式**：① 聊天框直接输入暗号发送（前端拦截，不发普通消息）② 点击悬浮FAB打开面板输入
-- **箱子类型**：普通箱（500\~2000金）/ 稀有箱（5000\~20000金）/ 黑化箱（陷阱，倒扣200\~1000金）
-- **货币来源**：`CurrencySource::MYSTERY_BOX` / `MYSTERY_BOX_TRAP`（含 `room_id` 流水记录）
-- **后台配置**：`game_configs` 表，可配置开关/自动投放间隔/各奖励范围/陷阱概率；支持手动投放三种类型
-
-### 🐎 赛马竞猜（Horse Racing）
-
-- **类型**：定时自动开局（调度器每分钟检查，间隔可配置）
-- **数据库**：`horse_races` + `horse_bets`
-- **模型**：`HorseRace` / `HorseBet`
-- **队列 Job**：`OpenHorseRaceJob`（开赛广播）+ `RunHorseRaceJob`（每秒播报马匹进度 + 确定胜者）+ `CloseHorseRaceJob`（结算）
-- **事件**：`HorseRaceOpened` / `HorseRaceProgress` / `HorseRaceSettled`（PresenceChannel 广播）
-- **控制器**：`HorseRaceController`（`/horse-race/current` / `/horse-race/bet` / `/horse-race/history`）
-- **广播**：`horse.opened` / `horse.progress` / `horse.settled`
-- **前端**：`chat/partials/horse-race-panel.blade.php`（倒计时/赛马道动画/实时赔率/可拖动FAB）
-- **货币来源**：`CurrencySource::HORSE_BET` / `HORSE_WIN`
-- **后台配置**：`game_configs` 表，马匹数量/押注窗口/跨马时长/庄家抓水比例均可配置
-
-### 🔮 神秘占卜（Fortune Telling）
-
-- **类型**：玩家主动使用（每日免费 N 次，额外次数消耗金币）
-- **数据库**：`fortune_logs`
-- **模型**：`FortuneLog`（55+ 条签文内嵌在模型中）
-- **控制器**：`FortuneTellingController`（`/fortune/today` 查今日 / `/fortune/tell` 占卜 / `/fortune/history` 历史）
-- **前端**：`chat/partials/fortune-panel.blade.php`（卦象摇动动画/签文卡片/当日加成状态/可拖动FAB）
-- **每日限制**：免费 N 次（可配置），额外次数消耗金币
-- **广播**：暂无实时广播（占卜结果仅展示给本人）
-- **货币来源**：`CurrencySource::FORTUNE_COST`
-- **后台配置**：`game_configs` 表，免费次数/额外消耗/各签概率均可配置
-
----
-
-## 🕐 待开发
-
----
-
-## 📌 通用待办（所有游戏共用）
-
-- [x] 后台游戏管理页面（`/admin/game-configs`）显示各游戏实时统计数据（点击"加载实时统计"异步加载各游戏汇总卡片）
-- [x] 各游戏历史记录在后台可查（管理员视角，新增 `/admin/game-history/` 路由组，支持百家乐/老虎机/赛马/神秘箱子/占卜各自的历史记录列表及详情页，含筛选分页）
-- [x] 生产环境部署：`php artisan db:seed --class=GameConfigSeeder`（初始化游戏配置） 已经完成了
-- [ ] 百家乐/老虎机 全面测试（多用户并发下注）
-
----
-
-## 🔧 已修复的 Bug
-
-1. **百家乐广播频道**：`Channel` → `PresenceChannel`，解决前端收不到 WebSocket 事件
-2. **百家乐余额检查**：`$user->gold` → `$user->jjb`（字段名错误）
-3. **老虎机积分日志**：普通中奖/诅咒发私信通知；三7全服广播
-4. **老虎机FAB**：支持拖动 + localStorage 位置持久化
-5. **星海小博士随机事件**：改走 `UserCurrencyService.change()`，补写流水日志
-6. **百家乐结算UI**：骰子改数字方块（跨平台）；中奖/未中奖卡片重设计
-7. **全部 FAB 拖动统一**：百家乐 FAB 改为 Alpine.js `baccaratFab()` 组件，与老虎机 `slotFab()` 完全一致，位置持久化存 localStorage
-8. **Alpine.js 初始化顺序**：`frame.blade.php` 中 Alpine CDN 补加 `defer`，解决所有组件 `is not defined` 错误
-9. **神秘箱子暗号领取**：改为主动尝试模式（不依赖5秒轮询），聊天框输入暗号即可触发领取；`claim()` 暗号统一转大写
-10. **神秘箱子流水记录**：`change()` 调用补上 `room_id` 参数，确保积分统计页面可按房间筛选
-11. **后台弹窗**：游戏管理页所有 `alert/confirm` 替换为全局 `window.adminDialog`（毛玻璃弹窗）

GEMINI.md

@@ -1,256 +0,0 @@
-<laravel-boost-guidelines>
-=== foundation rules ===
-
-# Laravel Boost Guidelines
-
-The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
-
-## Foundational Context
-
-This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
-
-- php - 8.4.5
-- laravel/framework (LARAVEL) - v12
-- laravel/horizon (HORIZON) - v5
-- laravel/prompts (PROMPTS) - v0
-- laravel/reverb (REVERB) - v1
-- laravel/boost (BOOST) - v2
-- laravel/mcp (MCP) - v0
-- laravel/pail (PAIL) - v1
-- laravel/pint (PINT) - v1
-- laravel/sail (SAIL) - v1
-- phpunit/phpunit (PHPUNIT) - v11
-- laravel-echo (ECHO) - v2
-- tailwindcss (TAILWINDCSS) - v4
-
-## Skills Activation
-
-This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
-
-- `tailwindcss-development` — Styles applications using Tailwind CSS v4 utilities. Activates when adding styles, restyling components, working with gradients, spacing, layout, flex, grid, responsive design, dark mode, colors, typography, or borders; or when the user mentions CSS, styling, classes, Tailwind, restyle, hero section, cards, buttons, or any visual/UI changes.
-
-## Conventions
-
-- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
-- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
-- Check for existing components to reuse before writing a new one.
-
-## Verification Scripts
-
-- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
-
-## Application Structure & Architecture
-
-- Stick to existing directory structure; don't create new base folders without approval.
-- Do not change the application's dependencies without approval.
-
-## Frontend Bundling
-
-- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
-
-## Documentation Files
-
-- You must only create documentation files if explicitly requested by the user.
-
-## Replies
-
-- Be concise in your explanations - focus on what's important rather than explaining obvious details.
-
-=== boost rules ===
-
-# Laravel Boost
-
-- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
-
-## Artisan
-
-- Use the `list-artisan-commands` tool when you need to call an Artisan command to double-check the available parameters.
-
-## URLs
-
-- Whenever you share a project URL with the user, you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain/IP, and port.
-
-## Tinker / Debugging
-
-- You should use the `tinker` tool when you need to execute PHP to debug code or query Eloquent models directly.
-- Use the `database-query` tool when you only need to read from the database.
-- Use the `database-schema` tool to inspect table structure before writing migrations or models.
-
-## Reading Browser Logs With the `browser-logs` Tool
-
-- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
-- Only recent browser logs will be useful - ignore old logs.
-
-## Searching Documentation (Critically Important)
-
-- Boost comes with a powerful `search-docs` tool you should use before trying other approaches when working with Laravel or Laravel ecosystem packages. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
-- Search the documentation before making code changes to ensure we are taking the correct approach.
-- Use multiple, broad, simple, topic-based queries at once. For example: `['rate limiting', 'routing rate limiting', 'routing']`. The most relevant results will be returned first.
-- Do not add package names to queries; package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
-
-### Available Search Syntax
-
-1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'.
-2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit".
-3. Quoted Phrases (Exact Position) - query="infinite scroll" - words must be adjacent and in that order.
-4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit".
-5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms.
-
-=== php rules ===
-
-# PHP
-
-- Always use curly braces for control structures, even for single-line bodies.
-
-## Constructors
-
-- Use PHP 8 constructor property promotion in `__construct()`.
-    - `public function __construct(public GitHub $github) { }`
-- Do not allow empty `__construct()` methods with zero parameters unless the constructor is private.
-
-## Type Declarations
-
-- Always use explicit return type declarations for methods and functions.
-- Use appropriate PHP type hints for method parameters.
-
-<!-- Explicit Return Types and Method Params -->
-```php
-protected function isAccessible(User $user, ?string $path = null): bool
-{
-    ...
-}
-```
-
-## Enums
-
-- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
-
-## Comments
-
-- Prefer PHPDoc blocks over inline comments. Never use comments within the code itself unless the logic is exceptionally complex.
-
-## PHPDoc Blocks
-
-- Add useful array shape type definitions when appropriate.
-
-=== herd rules ===
-
-# Laravel Herd
-
-- The application is served by Laravel Herd and will be available at: `https?://[kebab-case-project-dir].test`. Use the `get-absolute-url` tool to generate valid URLs for the user.
-- You must not run any commands to make the site available via HTTP(S). It is always available through Laravel Herd.
-
-=== laravel/core rules ===
-
-# Do Things the Laravel Way
-
-- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using the `list-artisan-commands` tool.
-- If you're creating a generic PHP class, use `php artisan make:class`.
-- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
-
-## Database
-
-- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
-- Use Eloquent models and relationships before suggesting raw database queries.
-- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
-- Generate code that prevents N+1 query problems by using eager loading.
-- Use Laravel's query builder for very complex database operations.
-
-### Model Creation
-
-- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `list-artisan-commands` to check the available options to `php artisan make:model`.
-
-### APIs & Eloquent Resources
-
-- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
-
-## Controllers & Validation
-
-- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
-- Check sibling Form Requests to see if the application uses array or string based validation rules.
-
-## Authentication & Authorization
-
-- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
-
-## URL Generation
-
-- When generating links to other pages, prefer named routes and the `route()` function.
-
-## Queues
-
-- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
-
-## Configuration
-
-- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
-
-## Testing
-
-- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
-- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
-- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
-
-## Vite Error
-
-- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
-
-=== laravel/v12 rules ===
-
-# Laravel 12
-
-- CRITICAL: ALWAYS use `search-docs` tool for version-specific Laravel documentation and updated code examples.
-- Since Laravel 11, Laravel has a new streamlined file structure which this project uses.
-
-## Laravel 12 Structure
-
-- In Laravel 12, middleware are no longer registered in `app/Http/Kernel.php`.
-- Middleware are configured declaratively in `bootstrap/app.php` using `Application::configure()->withMiddleware()`.
-- `bootstrap/app.php` is the file to register middleware, exceptions, and routing files.
-- `bootstrap/providers.php` contains application specific service providers.
-- The `app\Console\Kernel.php` file no longer exists; use `bootstrap/app.php` or `routes/console.php` for console configuration.
-- Console commands in `app/Console/Commands/` are automatically available and do not require manual registration.
-
-## Database
-
-- When modifying a column, the migration must include all of the attributes that were previously defined on the column. Otherwise, they will be dropped and lost.
-- Laravel 12 allows limiting eagerly loaded records natively, without external packages: `$query->latest()->limit(10);`.
-
-### Models
-
-- Casts can and likely should be set in a `casts()` method on a model rather than the `$casts` property. Follow existing conventions from other models.
-
-=== pint/core rules ===
-
-# Laravel Pint Code Formatter
-
-- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
-- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
-
-=== phpunit/core rules ===
-
-# PHPUnit
-
-- This application uses PHPUnit for testing. All tests must be written as PHPUnit classes. Use `php artisan make:test --phpunit {name}` to create a new test.
-- If you see a test using "Pest", convert it to PHPUnit.
-- Every time a test has been updated, run that singular test.
-- When the tests relating to your feature are passing, ask the user if they would like to also run the entire test suite to make sure everything is still passing.
-- Tests should cover all happy paths, failure paths, and edge cases.
-- You must not remove any tests or test files from the tests directory without approval. These are not temporary or helper files; these are core to the application.
-
-## Running Tests
-
-- Run the minimal number of tests, using an appropriate filter, before finalizing.
-- To run all tests: `php artisan test --compact`.
-- To run all tests in a file: `php artisan test --compact tests/Feature/ExampleTest.php`.
-- To filter on a particular test name: `php artisan test --compact --filter=testName` (recommended after making a change to a related file).
-
-=== tailwindcss/core rules ===
-
-# Tailwind CSS
-
-- Always use existing Tailwind conventions; check project patterns before adding new ones.
-- IMPORTANT: Always use `search-docs` tool for version-specific Tailwind CSS documentation and updated code examples. Never rely on training data.
-- IMPORTANT: Activate `tailwindcss-development` every time you're working with a Tailwind CSS or styling-related task.
-
-</laravel-boost-guidelines>

README.md

@@ -186,52 +186,66 @@ php artisan view:cache
 
 ### 6. Nginx 配置
 
-在宝塔面板的 Nginx 配置中，需要添加 WebSocket 反向代理。
+为了让外界能够通过 HTTPS 正常访问常驻内存服务器（Roadrunner 8000端口）以及实时 WebSocket 广播（Reverb 8080端口），需要在宝塔面板的 Nginx 配置中进行反向代理。
 
-**第一步：** 在 `server {}` 块的**外面上方**添加：
+在 `server {}` 块**内部**（`#REWRITE-END` 之后，禁止访问敏感文件之前）添加以下配置：
 
 ```nginx
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
+    # ── 1. 静态资源优先由 Nginx 直接响应，动态请求分流给 Octane ──
+    location / {
+        try_files $uri $uri/ @octane;
+    }
+
+    # ── 2. API、心跳等动态请求反向代理到本地 8000 端口 (Octane / Roadrunner) ──
+    location @octane {
+        proxy_set_header Host $http_host;
+        proxy_set_header Scheme $scheme;
+        proxy_set_header X-Real-IP $remote_addr;
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Proto $scheme;
+        
+        proxy_pass http://127.0.0.1:8000;
+    }
+
+    # ── 3. ⚡ WebSocket 实时广播反向代理 (Laravel Reverb 8080端口) ──
+    # 浏览器通过 /app 和 /apps 路径发起 WebSocket 连接
+    location /app {
+        proxy_pass             http://127.0.0.1:8080;
+        proxy_http_version     1.1;
+        proxy_set_header       Upgrade $http_upgrade;
+        
+        # 避坑提示：某些宝塔环境全局未配置 $connection_upgrade 变量，
+        # 直接写死 "Upgrade" 能 100% 避免 500 代理握手失败。
+        proxy_set_header       Connection "Upgrade";
+        
+        proxy_set_header       Host $host;
+        proxy_set_header       X-Real-IP $remote_addr;
+        proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header       X-Forwarded-Proto $scheme;
+        
+        # WebSocket 长连接保活：120秒无数据才断开
+        proxy_read_timeout     120s;
+        proxy_send_timeout     120s;
+        proxy_buffering        off;
+    }
+
+    location /apps {
+        proxy_pass             http://127.0.0.1:8080;
+        proxy_http_version     1.1;
+        proxy_set_header       Upgrade $http_upgrade;
+        proxy_set_header       Connection "Upgrade";
+        proxy_set_header       Host $host;
+        proxy_set_header       X-Real-IP $remote_addr;
+        proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header       X-Forwarded-Proto $scheme;
+        
+        proxy_read_timeout     120s;
+        proxy_send_timeout     120s;
+        proxy_buffering        off;
+    }
 ```
 
-**第二步：** 在 `server {}` 块**内部**（`#REWRITE-END` 之后）添加：
-
-```nginx
-location /app {
-    proxy_pass             http://127.0.0.1:8080;
-    proxy_http_version     1.1;
-    proxy_set_header       Upgrade $http_upgrade;
-    proxy_set_header       Connection $connection_upgrade;
-    proxy_set_header       Host $host;
-    proxy_set_header       X-Real-IP $remote_addr;
-    proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header       X-Forwarded-Proto $scheme;
-    proxy_read_timeout     120s;
-    proxy_send_timeout     120s;
-    proxy_buffering        off;
-}
-
-location /apps {
-    proxy_pass             http://127.0.0.1:8080;
-    proxy_http_version     1.1;
-    proxy_set_header       Upgrade $http_upgrade;
-    proxy_set_header       Connection $connection_upgrade;
-    proxy_set_header       Host $host;
-    proxy_set_header       X-Real-IP $remote_addr;
-    proxy_set_header       X-Forwarded-For $proxy_add_x_forwarded_for;
-    proxy_set_header       X-Forwarded-Proto $scheme;
-    proxy_read_timeout     120s;
-    proxy_send_timeout     120s;
-    proxy_buffering        off;
-}
-```
-
-**第三步：** 在宝塔面板 → 网站 → 伪静态中选择 `laravel5`。
-
-**第四步：** 测试并重载 Nginx：
+**测试并重载 Nginx：**
 
 ```bash
 nginx -t && systemctl reload nginx
@@ -241,7 +255,7 @@ nginx -t && systemctl reload nginx
 
 ### 7. Supervisor 守护进程（关键！）
 
-在宝塔面板 → 软件商店 → 安装「Supervisor管理器」，然后添加两个守护进程：
+在宝塔面板 → 软件商店 → 安装「Supervisor管理器」，然后添加三个守护进程，确保长连接和心跳在后台持续运行：
 
 #### 进程一：Laravel Reverb（WebSocket 服务器）
 
@@ -250,6 +264,7 @@ nginx -t && systemctl reload nginx
 | 名称     | `chatroom-reverb`          |
 | 运行目录 | `/www/wwwroot/chat.ay.lc`  |
 | 启动命令 | `php artisan reverb:start` |
+| 运行用户 | `www`                      |
 | 进程数量 | `1`                        |
 
 #### 进程二：Laravel Horizon（队列处理器）
@@ -259,12 +274,23 @@ nginx -t && systemctl reload nginx
 | 名称     | `chatroom-horizon`        |
 | 运行目录 | `/www/wwwroot/chat.ay.lc` |
 | 启动命令 | `php artisan horizon`     |
+| 运行用户 | `www`                     |
 | 进程数量 | `1`                       |
 
+#### 进程三：Laravel Octane（Roadrunner 常驻内存服务）
+
+| 配置项   | 值                                                         |
+| -------- | ---------------------------------------------------------- |
+| 名称     | `chatroom-octane`                                          |
+| 运行目录 | `/www/wwwroot/chat.ay.lc`                                  |
+| 启动命令 | `php artisan octane:start --server=roadrunner --port=8000` |
+| 运行用户 | `www`                                                      |
+| 进程数量 | `1`                                                        |
+
 > ⚠️ **如果不配置 Supervisor：**
 >
-> - 关闭 SSH 终端后，Reverb 和 Horizon 会立刻停止
-> - 聊天室将无法发送/接收消息，在线列表为空
+> - 关闭 SSH 终端后，Reverb、Horizon 和 Octane 会立刻停止运行，导致聊天室无法打开或无法收发消息！
+> - **更新代码后**：当您在服务器上完成 `git pull` 后，需要运行 `php artisan octane:reload` 重新载入内存，代码才会生效。
 
 ---
 

app/Console/Commands/AiHeartbeatCommand.php

@@ -16,12 +16,16 @@ namespace App\Console\Commands;
 
 use App\Enums\CurrencySource;
 use App\Events\MessageSent;
+use App\Jobs\AiFishingJob;
 use App\Jobs\SaveMessageJob;
 use App\Models\Autoact;
+use App\Models\DailySignIn;
+use App\Models\GameConfig;
 use App\Models\Sysparam;
 use App\Models\User;
 use App\Services\AiFinanceService;
 use App\Services\ChatStateService;
+use App\Services\SignInService;
 use App\Services\UserCurrencyService;
 use App\Services\VipService;
 use Illuminate\Console\Command;
@@ -49,6 +53,7 @@ class AiHeartbeatCommand extends Command
         private readonly VipService $vipService,
         private readonly UserCurrencyService $currencyService,
         private readonly AiFinanceService $aiFinance,
+        private readonly SignInService $signInService,
     ) {
         parent::__construct();
     }
@@ -58,11 +63,15 @@ class AiHeartbeatCommand extends Command
      */
     public function handle(): int
     {
+        $startedAt = microtime(true);
+
         // 1. 检查总开关
         if (Sysparam::getValue('chatbot_enabled', '0') !== '1') {
             return Command::SUCCESS;
         }
 
+        $config = $this->heartbeatConfig();
+
         // 2. 获取 AI 实体
         $user = User::where('username', 'AI小班长')->first();
         if (! $user) {
@@ -70,18 +79,26 @@ class AiHeartbeatCommand extends Command
         }
 
         // 心跳开始前，若手上金币已高于 100 万，则先把超出的部分转入银行。
-        $this->aiFinance->bankExcessGold($user);
+        if ((int) ($user->jjb ?? 0) > AiFinanceService::AVAILABLE_GOLD_RESERVE) {
+            $this->aiFinance->bankExcessGold($user);
+        }
+
+        // 2.5 自动每日签到（今日已签时 claim() 幂等返回，不重复发奖）
+        if ($this->performDailySignIn($user)) {
+            // 签到可能发放经验、金币或魅力，后续心跳计算必须基于最新余额。
+            $user->refresh();
+        }
 
         // 3. 常规心跳经验与金币发放
         // (模拟前端每30-60秒发一次心跳的过程，此处每分钟跑一次，发放单人心跳奖励)
-        $expGain = $this->parseRewardValue(Sysparam::getValue('exp_per_heartbeat', '1'));
+        $expGain = $this->parseRewardValue($config['exp_per_heartbeat']);
         if ($expGain > 0) {
             $expMultiplier = $this->vipService->getExpMultiplier($user);
             $actualExpGain = (int) round($expGain * $expMultiplier);
             $user->exp_num += $actualExpGain;
         }
 
-        $jjbGain = $this->parseRewardValue(Sysparam::getValue('jjb_per_heartbeat', '0'));
+        $jjbGain = $this->parseRewardValue($config['jjb_per_heartbeat']);
         if ($jjbGain > 0) {
             $jjbMultiplier = $this->vipService->getJjbMultiplier($user);
             $actualJjbGain = (int) round($jjbGain * $jjbMultiplier);
@@ -89,30 +106,35 @@ class AiHeartbeatCommand extends Command
         }
 
         $user->save();
-        $user->refresh();
 
         // 4. 重算等级（基础心跳升级）
-        $superLevel = (int) Sysparam::getValue('superlevel', '100');
+        $superLevel = (int) $config['superlevel'];
         $leveledUp = $this->calculateNewLevel($user, $superLevel);
 
         // 5. 随机事件触发
-        $eventChance = (int) Sysparam::getValue('auto_event_chance', '10');
+        $eventChance = (int) $config['auto_event_chance'];
         if ($eventChance > 0 && rand(1, 100) <= $eventChance) {
             $autoEvent = Autoact::randomEvent();
             if ($autoEvent) {
+                $hasCurrencyChange = false;
+
                 // 执行随机事件的金钱经验惩奖
                 if ($autoEvent->exp_change !== 0) {
                     $this->currencyService->change(
                         $user, 'exp', $autoEvent->exp_change, CurrencySource::AUTO_EVENT, "随机事件：{$autoEvent->text_body}", 1
                     );
+                    $hasCurrencyChange = true;
                 }
                 if ($autoEvent->jjb_change !== 0) {
                     $this->currencyService->change(
                         $user, 'gold', $autoEvent->jjb_change, CurrencySource::AUTO_EVENT, "随机事件：{$autoEvent->text_body}", 1
                     );
+                    $hasCurrencyChange = true;
                 }
 
-                $user->refresh();
+                if ($hasCurrencyChange) {
+                    $user->refresh();
+                }
 
                 // 重新计算等级
                 if ($this->calculateNewLevel($user, $superLevel)) {
@@ -143,39 +165,68 @@ class AiHeartbeatCommand extends Command
         }
 
         // 7. 钓鱼小游戏随机参与逻辑
-        $fishingEnabled = Sysparam::getValue('chatbot_fishing_enabled', '0') === '1';
-        $fishingChance = (int) Sysparam::getValue('chatbot_fishing_chance', '100'); // 默认 5% 概率
-        if ($fishingEnabled && $fishingChance > 0 && rand(1, 100) <= $fishingChance && \App\Models\GameConfig::isEnabled('fishing')) {
-            $cost = (int) (\App\Models\GameConfig::param('fishing', 'fishing_cost') ?? Sysparam::getValue('fishing_cost', '5'));
-            // 常规小游戏只使用当前手上金币，不再自动从银行补到 100 万。
-            if ($this->aiFinance->prepareSpend($user, $cost)) {
-                // 先扣除费用
-                $this->currencyService->change(
-                    $user, 'gold', -$cost,
-                    CurrencySource::FISHING_COST,
-                    "AI小班长钓鱼抛竿消耗 {$cost} 金币",
-                    1,
-                );
+        $fishingEnabled = $config['chatbot_fishing_enabled'] === '1';
+        $fishingChance = (int) $config['chatbot_fishing_chance']; // 默认 100% 概率，保持原有配置默认值。
+        if ($fishingEnabled && $fishingChance > 0 && rand(1, 100) <= $fishingChance) {
+            $fishingConfig = GameConfig::forGame('fishing');
 
-                // 模拟玩家等待时间
-                $waitMin = (int) (\App\Models\GameConfig::param('fishing', 'fishing_wait_min') ?? Sysparam::getValue('fishing_wait_min', '8'));
-                $waitMax = (int) (\App\Models\GameConfig::param('fishing', 'fishing_wait_max') ?? Sysparam::getValue('fishing_wait_max', '15'));
-                $waitTime = rand($waitMin, $waitMax);
+            if ($fishingConfig?->enabled) {
+                $cost = (int) ($fishingConfig->params['fishing_cost'] ?? $config['fishing_cost']);
+                // 常规小游戏只使用当前手上金币，不再自动从银行补到 100 万。
+                if ($this->aiFinance->prepareSpend($user, $cost)) {
+                    // 先扣除抛竿费用，再派发延迟收竿任务，避免当前心跳等待钓鱼结果。
+                    $this->currencyService->change(
+                        $user, 'gold', -$cost,
+                        CurrencySource::FISHING_COST,
+                        "AI小班长钓鱼抛竿消耗 {$cost} 金币",
+                        1,
+                    );
 
-                // 延迟派发收竿事件（AI目前统一将事件播报到房间 1，或者拿 active room ids）
-                $activeRoomIds = $this->chatState->getAllActiveRoomIds();
-                $roomId = ! empty($activeRoomIds) ? $activeRoomIds[0] : 1;
+                    // 模拟玩家等待时间
+                    $waitMin = (int) ($fishingConfig->params['fishing_wait_min'] ?? $config['fishing_wait_min']);
+                    $waitMax = (int) ($fishingConfig->params['fishing_wait_max'] ?? $config['fishing_wait_max']);
+                    $waitTime = rand($waitMin, $waitMax);
 
-                \App\Jobs\AiFishingJob::dispatch($user, $roomId)->delay(now()->addSeconds($waitTime));
+                    // 延迟派发收竿事件（AI目前统一将事件播报到房间 1，或者拿 active room ids）
+                    $activeRoomIds = $this->chatState->getAllActiveRoomIds();
+                    $roomId = ! empty($activeRoomIds) ? $activeRoomIds[0] : 1;
+
+                    AiFishingJob::dispatch($user, $roomId)->delay(now()->addSeconds($waitTime));
+                }
             }
         }
 
         // 心跳结束后，若新增金币让手上金额超过 100 万，则把超出的部分重新转回银行。
-        $this->aiFinance->bankExcessGold($user);
+        if ((int) ($user->jjb ?? 0) > AiFinanceService::AVAILABLE_GOLD_RESERVE) {
+            $this->aiFinance->bankExcessGold($user);
+        }
+
+        $elapsedMs = (int) round((microtime(true) - $startedAt) * 1000);
+        $this->info("AI心跳完成，耗时 {$elapsedMs}ms。");
 
         return Command::SUCCESS;
     }
 
+    /**
+     * 读取本轮心跳需要的系统配置，避免命令流程中重复触发配置读取。
+     *
+     * @return array<string, string>
+     */
+    private function heartbeatConfig(): array
+    {
+        return [
+            'exp_per_heartbeat' => Sysparam::getValue('exp_per_heartbeat', '1'),
+            'jjb_per_heartbeat' => Sysparam::getValue('jjb_per_heartbeat', '0'),
+            'superlevel' => Sysparam::getValue('superlevel', '100'),
+            'auto_event_chance' => Sysparam::getValue('auto_event_chance', '10'),
+            'chatbot_fishing_enabled' => Sysparam::getValue('chatbot_fishing_enabled', '0'),
+            'chatbot_fishing_chance' => Sysparam::getValue('chatbot_fishing_chance', '100'),
+            'fishing_cost' => Sysparam::getValue('fishing_cost', '5'),
+            'fishing_wait_min' => Sysparam::getValue('fishing_wait_min', '8'),
+            'fishing_wait_max' => Sysparam::getValue('fishing_wait_max', '15'),
+        ];
+    }
+
     /**
      * 计算并更新用户等级
      */
@@ -213,6 +264,56 @@ class AiHeartbeatCommand extends Command
         return (int) $raw;
     }
 
+    /**
+     * 尝试为 AI小班长 执行今日签到，成功时广播签到通知。
+     */
+    private function performDailySignIn(User $user): bool
+    {
+        // 先检查今日是否已签，避免每分钟都调用事务
+        $alreadySigned = DailySignIn::query()
+            ->where('user_id', $user->id)
+            ->whereDate('sign_in_date', today())
+            ->exists();
+
+        if ($alreadySigned) {
+            return false;
+        }
+
+        // 获取活跃房间作为签到归属（默认房间 1）
+        $activeRoomIds = $this->chatState->getAllActiveRoomIds();
+        $roomId = ! empty($activeRoomIds) ? (int) $activeRoomIds[0] : 1;
+
+        $dailySignIn = $this->signInService->claim($user, $roomId);
+
+        // 仅当本次心跳实际完成签到时才广播（幂等保护）
+        if (! $dailySignIn->wasRecentlyCreated) {
+            return false;
+        }
+
+        $rewardParts = [];
+        if ($dailySignIn->gold_reward > 0) {
+            $rewardParts[] = $dailySignIn->gold_reward.' 金币';
+        }
+        if ($dailySignIn->exp_reward > 0) {
+            $rewardParts[] = $dailySignIn->exp_reward.' 经验';
+        }
+        if ($dailySignIn->charm_reward > 0) {
+            $rewardParts[] = $dailySignIn->charm_reward.' 魅力';
+        }
+        $rewardText = $rewardParts === [] ? '签到记录' : implode(' + ', $rewardParts);
+
+        $identityText = $dailySignIn->identity_badge_name
+            ? '，获得身份 '.e($dailySignIn->identity_badge_name)
+            : '';
+
+        $content = '【'.e($user->username).'】完成今日签到，连续签到 '
+            .$dailySignIn->streak_days.' 天，获得 '.$rewardText.$identityText.'。';
+
+        $this->broadcastSystemMessage('系统传音', $content, '#0f766e');
+
+        return true;
+    }
+
     /**
      * 往所有活跃房间发送系统广播消息
      */

app/Console/Commands/AutoSaveExp.php

@@ -20,12 +20,15 @@ use App\Enums\CurrencySource;
 use App\Events\MessageSent;
 use App\Jobs\SaveMessageJob;
 use App\Models\PositionDutyLog;
+use App\Models\Room;
 use App\Models\Sysparam;
 use App\Models\User;
 use App\Services\ChatStateService;
+use App\Services\ChatUserPresenceService;
 use App\Services\UserCurrencyService;
 use App\Services\VipService;
 use Illuminate\Console\Command;
+use Illuminate\Support\Collection;
 use Illuminate\Support\Facades\DB;
 use Illuminate\Support\Facades\Redis;
 
@@ -46,6 +49,7 @@ class AutoSaveExp extends Command
      */
     public function __construct(
         private readonly ChatStateService $chatState,
+        private readonly ChatUserPresenceService $chatUserPresenceService,
         private readonly VipService $vipService,
         private readonly UserCurrencyService $currencyService,
     ) {
@@ -63,6 +67,8 @@ class AutoSaveExp extends Command
      */
     public function handle(): int
     {
+        $startedAt = microtime(true);
+
         // 读取奖励配置
         $expGainRaw = Sysparam::getValue('exp_per_heartbeat', '1');
         $jjbGainRaw = Sysparam::getValue('jjb_per_heartbeat', '0');
@@ -79,15 +85,40 @@ class AutoSaveExp extends Command
 
         // 统计本次处理总人次（一个用户在多个房间会被计算多次）
         $totalProcessed = 0;
+        $usersByUsername = $this->preloadOnlineUsers($roomMap);
+
+        $processedUsernames = [];
 
         foreach ($roomMap as $roomId => $usernames) {
             foreach ($usernames as $username) {
-                $this->processUser($username, $roomId, $expGainRaw, $jjbGainRaw, $superLevel);
+                // 1. 如果本轮已经处理过该用户，跳过发放经验（防止多房间/多开重复吃经验）
+                if (isset($processedUsernames[$username])) {
+                    continue;
+                }
+
+                // 2. 利用 Redis 缓存锁，防止在短时间内（200秒内）重复进行自动存点奖励（防御多进程并发/重复调度）
+                $cooldownKey = "user:auto_save_cooldown:{$username}";
+                if (Redis::exists($cooldownKey)) {
+                    continue;
+                }
+
+                $user = $usersByUsername->get($username);
+                if (! $user) {
+                    continue;
+                }
+
+                $this->processUser($user, $roomId, $expGainRaw, $jjbGainRaw, $superLevel);
+
+                // 3. 设置冷却标记，200秒后过期（本任务5分钟运行一次，200秒冷却期既防重复，又不影响下一次存点）
+                Redis::setex($cooldownKey, 200, 1);
+
+                $processedUsernames[$username] = true;
                 $totalProcessed++;
             }
         }
 
-        $this->info("自动存点完成，共处理 {$totalProcessed} 个在线用户。");
+        $elapsedMs = (int) round((microtime(true) - $startedAt) * 1000);
+        $this->info('自动存点完成，共扫描 '.count($roomMap)." 个在线房间，处理 {$totalProcessed} 个在线用户，耗时 {$elapsedMs}ms。");
 
         return Command::SUCCESS;
     }
@@ -106,40 +137,71 @@ class AutoSaveExp extends Command
         $roomMap = [];
 
         // 从数据库取出所有房间 ID
-        $roomIds = \App\Models\Room::pluck('id');
+        $roomIds = Room::pluck('id');
 
         foreach ($roomIds as $roomId) {
             // Laravel 的 Redis facade 会自动加配置的前缀，与 ChatStateService 存入时完全一致
             $usernames = Redis::hkeys("room:{$roomId}:users");
             if (! empty($usernames)) {
-                $roomMap[(int) $roomId] = $usernames;
+                $activeUsernames = [];
+                foreach ($usernames as $username) {
+                    // 检查活跃标记是否存在（90秒内）
+                    if (Redis::exists("room:{$roomId}:alive:{$username}")) {
+                        $activeUsernames[] = $username;
+                    } else {
+                        // 懒清理僵尸数据
+                        Redis::hdel("room:{$roomId}:users", $username);
+                    }
+                }
+                if (! empty($activeUsernames)) {
+                    $roomMap[(int) $roomId] = $activeUsernames;
+                }
             }
         }
 
         return $roomMap;
     }
 
+    /**
+     * 预加载所有在线用户名对应的用户资料与身份关系，避免循环内逐个查询用户和身份信息。
+     *
+     * @param  array<int, array<string>>  $roomMap  在线房间与用户名映射
+     * @return Collection<string, User> 以用户名为键的用户集合
+     */
+    private function preloadOnlineUsers(array $roomMap): Collection
+    {
+        $usernames = collect($roomMap)
+            ->flatten()
+            ->unique()
+            ->values();
+
+        if ($usernames->isEmpty()) {
+            return collect();
+        }
+
+        return User::query()
+            ->with(['activePosition.position.department', 'vipLevel'])
+            ->whereIn('username', $usernames)
+            ->get()
+            ->keyBy('username');
+    }
+
     /**
      * 为单个在线用户执行存点逻辑，并在其所在房间推送存点通知。
      *
-     * @param  string  $username  用户名
+     * @param  User  $user  已预加载身份关系的在线用户
      * @param  int  $roomId  所在房间ID
      * @param  string  $expGainRaw  经验奖励原始配置（支持 "1" 或 "1-10" 范围）
      * @param  string  $jjbGainRaw  金币奖励原始配置
      * @param  int  $superLevel  管理员等级阈值
      */
     private function processUser(
-        string $username,
+        User $user,
         int $roomId,
         string $expGainRaw,
         string $jjbGainRaw,
         int $superLevel
     ): void {
-        $user = User::where('username', $username)->first();
-        if (! $user) {
-            return;
-        }
-
         // 1. 计算奖励量（经验/金币 均支持 VIP 倍率）
         $expGain = $this->parseRewardValue($expGainRaw);
         $expMultiplier = $this->vipService->getExpMultiplier($user);
@@ -163,8 +225,11 @@ class AutoSaveExp extends Command
                 $user, 'gold', $actualJjbGain, CurrencySource::AUTO_SAVE, '自动存点', $roomId,
             );
         }
-        $user->refresh(); // 刷新获取最新属性（service 已原子更新）
-        $user->load('activePosition.position'); // 确保职务及职位关联已加载
+        if ($actualExpGain > 0 || $actualJjbGain > 0) {
+            // 刷新获取最新属性（service 已原子更新），同时保留后续通知需要展示的身份关系。
+            $user->refresh();
+            $user->load(['activePosition.position.department', 'vipLevel']);
+        }
 
         // 3. 自动升降级逻辑
         //    - 有在职职务的用户：等级固定为职务对应等级，不随经验变化
@@ -176,11 +241,17 @@ class AutoSaveExp extends Command
         $activeUP = $user->activePosition;  // 已在 refresh 后加载
 
         if ($activeUP?->position) {
-            // 有在职职务：等级锁定为职务设定值，确保不被经验系统覆盖
+            // 有在职职务：职务等级是最低要求，允许用户通过经验值超越职务等级
             $requiredLevel = (int) $activeUP->position->level;
-            if ($requiredLevel > 0 && $user->user_level !== $requiredLevel) {
+            if ($requiredLevel > 0 && $user->user_level < $requiredLevel) {
                 $user->user_level = $requiredLevel;
             }
+            // 职务成员也可以按经验超越职务等级
+            $expLevel = Sysparam::calculateLevel($user->exp_num);
+            if ($expLevel > $user->user_level && $expLevel < $superLevel) {
+                $user->user_level = $expLevel;
+                $leveledUp = ($expLevel > $oldLevel);
+            }
         } elseif ($oldLevel < $superLevel) {
             // 普通用户：按经验计算并更新等级
             $newLevel = Sysparam::calculateLevel($user->exp_num);
@@ -229,15 +300,17 @@ class AutoSaveExp extends Command
         $jjbDisplay = $user->jjb ?? 0;
         $gainStr = ! empty($gainParts) ? ' 本次获得：'.implode('，', $gainParts) : '';
 
-        // 格式：⏰ 自动存点 · LV.100 · 经验 10,468 · 金币 8,345 · 已满级 · 本次获得：经验+1，金币+3
+        $identitySummary = $this->chatUserPresenceService->buildIdentitySummary($user);
+
+        // 格式：⏰ 自动存点 · 部门 X · 职务 Y · 会员 Z · LV.100 · 经验 10,468 · 金币 8,345 · 已满级 · 本次获得：经验+1，金币+3
         $statusTag = $user->user_level >= $superLevel ? ' · 已满级 ✓' : '';
-        $content = "⏰ 自动存点 · LV.{$user->user_level} · 经验 {$user->exp_num} · 金币 {$jjbDisplay}{$statusTag}{$gainStr}";
+        $content = "⏰ 自动存点 · {$identitySummary['inline']} · LV.{$user->user_level} · 经验 {$user->exp_num} · 金币 {$jjbDisplay}{$statusTag}{$gainStr}";
 
         $noticeMsg = [
             'id' => $this->chatState->nextMessageId($roomId),
             'room_id' => $roomId,
             'from_user' => '系统',
-            'to_user' => $username,     // 定向推送给本人
+            'to_user' => $user->username,     // 定向推送给本人
             'content' => $content,
             'is_secret' => true,          // 私信模式：前端过滤，只有收件人才能看到
             'font_color' => '#16a34a',     // 草绿色

app/Console/Commands/ConsumeWechatMessages.php

@@ -107,6 +107,44 @@ class ConsumeWechatMessages extends Command
             $this->info("收到潜在绑定请求: {$content} from {$fromUser}");
             $this->handleBindRequest(strtoupper($content), $fromUser, $apiService);
         }
+
+        // 微信密码重置逻辑：必须是私聊
+        if (! $isChatroom && str_contains($content, '重置密码')) {
+            $this->info("收到微信密码重置请求 from {$fromUser}");
+            $this->handlePasswordResetRequest($fromUser, $apiService);
+        }
+    }
+
+    /**
+     * 处理微信端的自助密码重置请求
+     */
+    protected function handlePasswordResetRequest(string $wxid, WechatBotApiService $apiService): void
+    {
+        // 检索绑定了该微信号的聊天室用户
+        $user = User::where('wxid', $wxid)->first();
+
+        if (! $user) {
+            $apiService->sendTextMessage(
+                $wxid,
+                "❌ 密码重置失败：您当前的微信号尚未绑定任何聊天室账号。\n\n"
+                .'请先登录聊天室大厅，在个人设置中获取 6 位绑定码，然后再在微信中向我发送“BD-绑定码”（例如: BD-123456）进行绑定。'
+            );
+
+            return;
+        }
+
+        // 随机生成 8 位新随机密码并更新
+        $newPassword = \Illuminate\Support\Str::random(8);
+        $user->password = \Illuminate\Support\Facades\Hash::make($newPassword);
+        $user->save();
+
+        $successMsg = "🎉 密码重置成功！\n"
+                    ."本小助手已为您绑定的聊天室账号 [{$user->username}] 重新生成了密码：\n\n"
+                    ."【{$newPassword}】\n\n"
+                    .'温馨提示：请使用此随机密码登录聊天室，并尽快在个人偏好设置中将其修改为您的常用密码。';
+
+        $apiService->sendTextMessage($wxid, $successMsg);
+        $this->info("微信用户 [{$user->username}] 已通过微信机器人成功重置了密码");
     }
 
     /**

app/Console/Commands/PurgeOldMessages.php

@@ -3,8 +3,8 @@
 /**
  * 文件功能：定期清理聊天记录 Artisan 命令
  *
- * 每天自动清理超过指定天数的聊天记录，保持数据库体积可控。
- * 保留天数可通过 sysparam 表的 message_retention_days 配置，默认 30 天。
+ * 用户聊天记录永久保留；仅清理可过期的游戏通知、进出播报等噪音消息。
+ * 通知保留天数可通过 sysparam 表的 game_message_retention_days 配置，默认 30 天。
  *
  * @author   ChatRoom Laravel
  *
@@ -31,7 +31,7 @@ class PurgeOldMessages extends Command
      * @var string
      */
     protected $signature = 'messages:purge
-                            {--days= : 覆盖默认保留天数}
+                            {--days= : 覆盖通知消息默认保留天数}
                             {--image-days=3 : 聊天图片单独保留天数}
                             {--dry-run : 仅预览不实际删除}';
 
@@ -40,7 +40,7 @@ class PurgeOldMessages extends Command
      *
      * @var string
      */
-    protected $description = '清理过期聊天记录，并额外清理 3 天前的聊天图片文件';
+    protected $description = '清理过期游戏/临时通知，并额外清理 3 天前的聊天图片文件';
 
     /**
      * 执行命令
@@ -49,9 +49,9 @@ class PurgeOldMessages extends Command
      */
     public function handle(): int
     {
-        // 保留天数：命令行参数 > sysparam 配置 > 默认 30 天
+        // 通知保留天数：命令行参数 > sysparam 配置 > 默认 30 天；普通用户聊天不再按时间删除。
         $days = (int) ($this->option('days')
-            ?: Sysparam::getValue('message_retention_days', '30'));
+            ?: Sysparam::getValue('game_message_retention_days', '30'));
         $imageDays = max(0, (int) $this->option('image-days'));
 
         $cutoff = Carbon::now()->subDays($days);
@@ -59,22 +59,22 @@ class PurgeOldMessages extends Command
 
         $this->cleanupExpiredImages($imageDays, $isDryRun);
 
-        // 统计待清理数量
-        $totalCount = Message::where('sent_at', '<', $cutoff)->count();
+        $expiredNoticeQuery = $this->expiredNoticeQuery($cutoff);
+        $totalCount = (clone $expiredNoticeQuery)->count();
 
         if ($totalCount === 0) {
-            $this->info("✅ 没有超过 {$days} 天的聊天记录需要清理。");
+            $this->info("✅ 没有超过 {$days} 天的游戏/临时通知需要清理，用户聊天记录已永久保留。");
 
             return self::SUCCESS;
         }
 
         if ($isDryRun) {
-            $this->warn("🔍 [预览模式] 将删除 {$totalCount} 条超过 {$days} 天的聊天记录（截止 {$cutoff->toDateTimeString()}）");
+            $this->warn("🔍 [预览模式] 将删除 {$totalCount} 条超过 {$days} 天的游戏/临时通知（截止 {$cutoff->toDateTimeString()}）");
 
             return self::SUCCESS;
         }
 
-        $this->info("🧹 开始清理超过 {$days} 天的聊天记录（截止 {$cutoff->toDateTimeString()}）...");
+        $this->info("🧹 开始清理超过 {$days} 天的游戏/临时通知（截止 {$cutoff->toDateTimeString()}）...");
         $this->info("   待清理数量：{$totalCount} 条");
 
         // 分批删除，每批 1000 条，避免长时间锁表
@@ -82,7 +82,7 @@ class PurgeOldMessages extends Command
         $batchSize = 1000;
 
         do {
-            $batch = Message::where('sent_at', '<', $cutoff)
+            $batch = $this->expiredNoticeQuery($cutoff)
                 ->limit($batchSize)
                 ->delete();
 
@@ -93,11 +93,31 @@ class PurgeOldMessages extends Command
             }
         } while ($batch === $batchSize);
 
-        $this->info("✅ 清理完成！共删除 {$deleted} 条聊天记录。");
+        $this->info("✅ 清理完成！共删除 {$deleted} 条游戏/临时通知，用户聊天记录未删除。");
 
         return self::SUCCESS;
     }
 
+    /**
+     * 构造过期通知清理查询，兼容新增字段前已经落库的旧通知。
+     */
+    private function expiredNoticeQuery(Carbon $cutoff): \Illuminate\Database\Eloquent\Builder
+    {
+        return Message::query()
+            ->where('sent_at', '<', $cutoff)
+            ->where(function ($query) {
+                $query->whereIn('retention_type', Message::purgableRetentionTypes())
+                    ->orWhere(function ($legacyQuery) {
+                        // 兼容迁移前默认归为 user_chat 的旧通知，避免历史游戏播报继续堆积。
+                        $legacyQuery->where('retention_type', Message::RETENTION_USER_CHAT)
+                            ->where(function ($noticeQuery) {
+                                $noticeQuery->whereIn('from_user', ['钓鱼播报', '星海小博士', '进出播报', '座驾播报'])
+                                    ->orWhereIn('action', ['fishing_result', 'idiom_result', 'riddle_result', 'system_welcome', 'vip_presence', 'ride_presence', 'auto_save_exp']);
+                            });
+                    });
+            });
+    }
+
     /**
      * 清理超过图片保留天数的聊天图片文件，并把消息改成过期占位。
      */

app/Console/Commands/ScanAchievementsCommand.php

@@ -0,0 +1,98 @@
+<?php
+
+/**
+ * 文件功能：扫描并补算用户成就的 Artisan 命令。
+ *
+ * 支持单用户、全量与最近活跃用户三种扫描方式，便于定时任务和后台补算复用。
+ */
+
+namespace App\Console\Commands;
+
+use App\Models\User;
+use App\Services\AchievementService;
+use Illuminate\Console\Command;
+
+/**
+ * 类功能：通过命令行批量检查用户成就进度并写入解锁记录。
+ */
+class ScanAchievementsCommand extends Command
+{
+    /**
+     * 命令签名。
+     *
+     * @var string
+     */
+    protected $signature = 'achievements:scan
+                            {--user= : 指定用户 ID 或用户名}
+                            {--all : 扫描全部用户}
+                            {--notify : 解锁时向用户推送本人可见通知}
+                            {--dry-run : 仅预览，不写入成就记录}';
+
+    /**
+     * 命令描述。
+     *
+     * @var string
+     */
+    protected $description = '扫描聊天室用户成就进度并补齐解锁记录';
+
+    /**
+     * 创建命令依赖。
+     */
+    public function __construct(
+        private readonly AchievementService $achievementService,
+    ) {
+        parent::__construct();
+    }
+
+    /**
+     * 执行成就扫描命令。
+     */
+    public function handle(): int
+    {
+        $notify = (bool) $this->option('notify');
+        $dryRun = (bool) $this->option('dry-run');
+
+        if ($this->option('user')) {
+            $user = $this->resolveUser((string) $this->option('user'));
+            if (! $user) {
+                $this->error('未找到指定用户。');
+
+                return self::FAILURE;
+            }
+
+            $result = $this->achievementService->scanUser($user, $notify, $dryRun);
+            $this->info("已扫描用户 {$user->username}：检查 {$result['checked']} 项，解锁 {$result['unlocked']} 项，更新 {$result['updated']} 项。");
+
+            return self::SUCCESS;
+        }
+
+        $query = User::query()->orderBy('id');
+        if (! $this->option('all')) {
+            // 默认只扫最近活跃用户，避免定时任务每次全表扫描。
+            $query->where('updated_at', '>=', now()->subDay())->limit(200);
+        }
+
+        $summary = ['users' => 0, 'checked' => 0, 'unlocked' => 0, 'updated' => 0, 'dry_run' => $dryRun];
+        $query->chunkById(100, function ($users) use (&$summary, $notify, $dryRun): void {
+            $chunkSummary = $this->achievementService->scanUsers($users, $notify, $dryRun);
+            $summary['users'] += $chunkSummary['users'];
+            $summary['checked'] += $chunkSummary['checked'];
+            $summary['unlocked'] += $chunkSummary['unlocked'];
+            $summary['updated'] += $chunkSummary['updated'];
+        });
+
+        $this->info("成就扫描完成：用户 {$summary['users']} 人，检查 {$summary['checked']} 项，解锁 {$summary['unlocked']} 项，更新 {$summary['updated']} 项。");
+
+        return self::SUCCESS;
+    }
+
+    /**
+     * 根据 ID 或用户名解析用户。
+     */
+    private function resolveUser(string $value): ?User
+    {
+        return User::query()
+            ->when(is_numeric($value), fn ($query) => $query->where('id', (int) $value), fn ($query) => $query->where('username', $value))
+            ->first();
+    }
+}

app/Enums/CurrencySource.php

@@ -35,12 +35,18 @@ enum CurrencySource: string
     /** 商城购买消耗（扣除金币） */
     case SHOP_BUY = 'shop_buy';
 
+    /** 购买聊天室座驾消耗（扣除金币） */
+    case RIDE_BUY = 'ride_buy';
+
     /** 管理员手动调整（后台直接修改经验/金币/魅力） */
     case ADMIN_ADJUST = 'admin_adjust';
 
     /** 职务奖励（在职管理员通过名片弹窗向用户发放奖励金币） */
     case POSITION_REWARD = 'position_reward';
 
+    /** 每日签到奖励（连续签到按规则发放） */
+    case SIGN_IN = 'sign_in';
+
     /** AI赠送福利（用户向AI祈求获得的随机奖励） */
     case AI_GIFT = 'ai_gift';
 
@@ -48,7 +54,6 @@ enum CurrencySource: string
     case GIFT_SENT = 'gift_sent';
 
     // ─── 以后新增活动，在这里加一行即可，数据库无需变更 ───────────
-    // case SIGN_IN      = 'sign_in';     // 每日签到
     // case TASK_REWARD  = 'task_reward'; // 任务奖励
     // case PVP_WIN      = 'pvp_win';     // PVP 胜利奖励
 
@@ -138,6 +143,39 @@ enum CurrencySource: string
     /** 看视频赚金币与经验奖励 */
     case VIDEO_REWARD = 'video_reward';
 
+    /** 查看别人隐藏信息扣费 */
+    case USER_INFO_REVEAL = 'user_info_reveal';
+
+    /** 购买消息装扮消耗（气泡，扣除金币） */
+    case MSG_BUBBLE_BUY = 'msg_bubble_buy';
+
+    /** 购买昵称颜色装扮消耗（扣除金币） */
+    case MSG_NAME_COLOR_BUY = 'msg_name_color_buy';
+
+    /** 购买文字颜色装扮消耗（扣除金币） */
+    case MSG_TEXT_COLOR_BUY = 'msg_text_color_buy';
+
+    /** 购买消息装扮消耗（气泡/昵称颜色，扣除金币）—— 旧版兼容，新购买不再使用 */
+    case MSG_DECORATION_BUY = 'msg_decoration_buy';
+
+    /** 购买头像框消耗（扣除金币） */
+    case AVATAR_FRAME_BUY = 'avatar_frame_buy';
+
+    /** 猜谜活动奖励 */
+    case GAME_REWARD = 'game_reward';
+
+    /** 收到用户赠送的金币 */
+    case GOLD_GIFT_RECV = 'gold_gift_recv';
+
+    /** 聊天互动魅力奖励 */
+    case CHAT_CHARM = 'chat_charm';
+
+    /** 存入银行（jjb → bank_jjb） */
+    case BANK_DEPOSIT = 'bank_deposit';
+
+    /** 从银行取款（bank_jjb → jjb） */
+    case BANK_WITHDRAW = 'bank_withdraw';
+
     /**
      * 返回该来源的中文名称，用于后台统计展示。
      */
@@ -151,8 +189,10 @@ enum CurrencySource: string
             self::RECV_GIFT => '收到礼物',
             self::NEWBIE_BONUS => '新人礼包',
             self::SHOP_BUY => '商城购买',
+            self::RIDE_BUY => '座驾购买（金币）',
             self::ADMIN_ADJUST => '管理员调整',
             self::POSITION_REWARD => '职务奖励',
+            self::SIGN_IN => '每日签到',
             self::AI_GIFT => 'AI赠送',
             self::GIFT_SENT => '发红包',
             self::MARRY_CHARM => '结婚魅力加成',
@@ -183,6 +223,17 @@ enum CurrencySource: string
             self::GOMOKU_WIN => '五子棋获胜奖励',
             self::GOMOKU_REFUND => '五子棋入场费返还',
             self::VIDEO_REWARD => '看视频奖励',
+            self::USER_INFO_REVEAL => '信息查看付费',
+            self::MSG_BUBBLE_BUY => '消息气泡购买',
+            self::MSG_NAME_COLOR_BUY => '昵称颜色购买',
+            self::MSG_TEXT_COLOR_BUY => '文字颜色购买',
+            self::MSG_DECORATION_BUY => '消息装扮购买（旧）',
+            self::AVATAR_FRAME_BUY => '头像框购买',
+            self::GAME_REWARD => '猜谜活动奖励',
+            self::GOLD_GIFT_RECV => '收到赠送金币',
+            self::CHAT_CHARM => '聊天魅力奖励',
+            self::BANK_DEPOSIT => '存入银行',
+            self::BANK_WITHDRAW => '银行取款',
         };
     }
 }

app/Events/BaccaratPoolUpdated.php

@@ -20,6 +20,9 @@ use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
+/**
+ * 类功能：向指定房间广播百家乐押注人数变化。
+ */
 class BaccaratPoolUpdated implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
@@ -38,7 +41,7 @@ class BaccaratPoolUpdated implements ShouldBroadcastNow
      */
     public function broadcastOn(): array
     {
-        return [new PresenceChannel('room.1')];
+        return [new PresenceChannel('room.'.$this->round->room_id)];
     }
 
     /**
@@ -58,6 +61,7 @@ class BaccaratPoolUpdated implements ShouldBroadcastNow
     {
         return [
             'round_id' => $this->round->id,
+            'room_id' => (int) $this->round->room_id,
             'bet_count_big' => $this->round->bet_count_big,
             'bet_count_small' => $this->round->bet_count_small,
             'bet_count_triple' => $this->round->bet_count_triple,

app/Events/BaccaratRoundOpened.php

@@ -20,6 +20,9 @@ use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
+/**
+ * 类功能：向指定房间广播百家乐开局事件。
+ */
 class BaccaratRoundOpened implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
@@ -38,7 +41,7 @@ class BaccaratRoundOpened implements ShouldBroadcastNow
      */
     public function broadcastOn(): array
     {
-        return [new PresenceChannel('room.1')];
+        return [new PresenceChannel('room.'.$this->round->room_id)];
     }
 
     /**
@@ -58,6 +61,7 @@ class BaccaratRoundOpened implements ShouldBroadcastNow
     {
         return [
             'round_id' => $this->round->id,
+            'room_id' => (int) $this->round->room_id,
             'bet_opens_at' => $this->round->bet_opens_at->toIso8601String(),
             'bet_closes_at' => $this->round->bet_closes_at->toIso8601String(),
             'bet_seconds' => (int) now()->diffInSeconds($this->round->bet_closes_at),

app/Events/BaccaratRoundSettled.php

@@ -20,6 +20,9 @@ use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
+/**
+ * 类功能：向指定房间广播百家乐结算结果。
+ */
 class BaccaratRoundSettled implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
@@ -38,7 +41,7 @@ class BaccaratRoundSettled implements ShouldBroadcastNow
      */
     public function broadcastOn(): array
     {
-        return [new PresenceChannel('room.1')];
+        return [new PresenceChannel('room.'.$this->round->room_id)];
     }
 
     /**
@@ -58,6 +61,7 @@ class BaccaratRoundSettled implements ShouldBroadcastNow
     {
         return [
             'round_id' => $this->round->id,
+            'room_id' => (int) $this->round->room_id,
             'dice' => [$this->round->dice1, $this->round->dice2, $this->round->dice3],
             'total_points' => $this->round->total_points,
             'result' => $this->round->result,

app/Events/BrowserRefreshRequested.php

@@ -0,0 +1,62 @@
+<?php
+
+/**
+ * 文件功能：聊天室浏览器刷新请求广播事件
+ *
+ * 仅供站长触发“刷新全员”命令时使用，
+ * 向当前房间所有在线用户广播前端刷新指令。
+ *
+ * @author   ChatRoom Laravel
+ *
+ * @version  1.0.0
+ */
+
+namespace App\Events;
+
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PresenceChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * 类功能：向房间内全部在线用户广播页面刷新指令。
+ */
+class BrowserRefreshRequested implements ShouldBroadcastNow
+{
+    use Dispatchable, InteractsWithSockets, SerializesModels;
+
+    /**
+     * 构造函数：记录房间与操作者信息。
+     */
+    public function __construct(
+        public readonly int $roomId,
+        public readonly string $operator,
+        public readonly string $reason = '',
+    ) {}
+
+    /**
+     * 广播频道：当前聊天室 PresenceChannel。
+     *
+     * @return array<int, \Illuminate\Broadcasting\Channel>
+     */
+    public function broadcastOn(): array
+    {
+        return [
+            new PresenceChannel('room.'.$this->roomId),
+        ];
+    }
+
+    /**
+     * 广播数据：前端用于展示提示并执行刷新。
+     *
+     * @return array<string, mixed>
+     */
+    public function broadcastWith(): array
+    {
+        return [
+            'operator' => $this->operator,
+            'reason' => $this->reason,
+        ];
+    }
+}

app/Events/EffectBroadcast.php

@@ -4,7 +4,7 @@
  * 文件功能：聊天室全屏特效广播事件
  *
  * 管理员或用户购买单次卡后触发，通过 WebSocket 广播给房间内用户播放 Canvas 动画。
- * 支持指定接收者（target_username 为 null 则全员播放）。
+ * 支持指定接收者；当存在 target_username 时，触发者本人和指定接收者都应可见。
  *
  * @author   ChatRoom Laravel
  *
@@ -19,6 +19,9 @@ use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
+/**
+ * 类功能：广播聊天室全屏特效播放指令，并携带操作者与定向接收者信息。
+ */
 class EffectBroadcast implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
@@ -26,16 +29,19 @@ class EffectBroadcast implements ShouldBroadcastNow
     /**
      * 支持的特效类型列表（用于校验）
      */
-    public const TYPES = ['fireworks', 'rain', 'lightning', 'snow', 'sakura', 'meteors', 'gold-rain', 'hearts', 'confetti', 'fireflies'];
+    public const TYPES = ['fireworks', 'rain', 'lightning', 'snow', 'sakura', 'meteors', 'gold-rain', 'hearts', 'confetti', 'fireflies', 'j35', '99a', 'df5c', 'fujian'];
 
     /**
      * 构造函数
      *
      * @param  int  $roomId  房间 ID
-     * @param  string  $type  特效类型：fireworks / rain / lightning / snow / sakura / meteors / gold-rain / hearts / confetti / fireflies
+     * @param  string  $type  特效类型：fireworks / rain / lightning / snow / sakura / meteors / gold-rain / hearts / confetti / fireflies / j35 / 99a / df5c / fujian
      * @param  string  $operator  触发特效的用户名（购买者）
      * @param  string|null  $targetUsername  接收者用户名（null = 全员）
      * @param  string|null  $giftMessage  附带赠言
+     * @param  string|null  $effectTitle  特效画面标题
+     * @param  string|null  $rideName  座驾名称
+     * @param  string|null  $effectUserInfo  特效画面用户身份信息
      */
     public function __construct(
         public readonly int $roomId,
@@ -43,6 +49,9 @@ class EffectBroadcast implements ShouldBroadcastNow
         public readonly string $operator,
         public readonly ?string $targetUsername = null,
         public readonly ?string $giftMessage = null,
+        public readonly ?string $effectTitle = null,
+        public readonly ?string $rideName = null,
+        public readonly ?string $effectUserInfo = null,
     ) {}
 
     /**
@@ -59,6 +68,7 @@ class EffectBroadcast implements ShouldBroadcastNow
 
     /**
      * 广播数据：特效类型、操作者、目标用户、赠言
+     * 前端据此判断“全员可见”或“仅操作者 + 指定接收者可见”。
      *
      * @return array<string, mixed>
      */
@@ -69,6 +79,9 @@ class EffectBroadcast implements ShouldBroadcastNow
             'operator' => $this->operator,
             'target_username' => $this->targetUsername,   // null = 全员
             'gift_message' => $this->giftMessage,
+            'effect_title' => $this->effectTitle,
+            'ride_name' => $this->rideName,
+            'effect_user_info' => $this->effectUserInfo,
         ];
     }
 }

app/Events/HolidayEventStarted.php

@@ -14,22 +14,25 @@
 
 namespace App\Events;
 
-use App\Models\HolidayEvent;
+use App\Models\HolidayEventRun;
 use Illuminate\Broadcasting\InteractsWithSockets;
 use Illuminate\Broadcasting\PresenceChannel;
 use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
+/**
+ * 类功能：向房间广播节日福利发放批次开始事件。
+ */
 class HolidayEventStarted implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
 
     /**
-     * @param  HolidayEvent  $event  节日活动实例
+     * @param  HolidayEventRun  $run  节日福利发放批次
      */
     public function __construct(
-        public readonly HolidayEvent $event,
+        public readonly HolidayEventRun $run,
     ) {}
 
     /**
@@ -60,15 +63,18 @@ class HolidayEventStarted implements ShouldBroadcastNow
     public function broadcastWith(): array
     {
         return [
-            'event_id' => $this->event->id,
-            'name' => $this->event->name,
-            'description' => $this->event->description,
-            'total_amount' => $this->event->total_amount,
-            'max_claimants' => $this->event->max_claimants,
-            'distribute_type' => $this->event->distribute_type,
-            'fixed_amount' => $this->event->fixed_amount,
-            'claimed_count' => $this->event->claimed_count,
-            'expires_at' => $this->event->expires_at?->toIso8601String(),
+            'run_id' => $this->run->id,
+            'event_id' => $this->run->holiday_event_id,
+            'name' => $this->run->event_name,
+            'description' => $this->run->event_description,
+            'total_amount' => $this->run->total_amount,
+            'max_claimants' => $this->run->max_claimants,
+            'distribute_type' => $this->run->distribute_type,
+            'fixed_amount' => $this->run->fixed_amount,
+            'claimed_count' => $this->run->claimed_count,
+            'expires_at' => $this->run->expires_at?->toIso8601String(),
+            'scheduled_for' => $this->run->scheduled_for?->toIso8601String(),
+            'repeat_type' => $this->run->repeat_type,
         ];
     }
 }

app/Events/HorseRaceOpened.php

@@ -20,6 +20,9 @@ use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
+/**
+ * 类功能：向指定房间广播赛马开局事件。
+ */
 class HorseRaceOpened implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
@@ -38,7 +41,7 @@ class HorseRaceOpened implements ShouldBroadcastNow
      */
     public function broadcastOn(): array
     {
-        return [new PresenceChannel('room.1')];
+        return [new PresenceChannel('room.'.$this->race->room_id)];
     }
 
     /**
@@ -58,6 +61,7 @@ class HorseRaceOpened implements ShouldBroadcastNow
     {
         return [
             'race_id' => $this->race->id,
+            'room_id' => (int) $this->race->room_id,
             'horses' => $this->race->horses,
             'total_pool' => $this->race->total_pool,
             'bet_opens_at' => $this->race->bet_opens_at->toIso8601String(),

app/Events/HorseRaceProgress.php

@@ -19,6 +19,9 @@ use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
 use Illuminate\Foundation\Events\Dispatchable;
 use Illuminate\Queue\SerializesModels;
 
+/**
+ * 类功能：向指定房间持续广播赛马进度。
+ */
 class HorseRaceProgress implements ShouldBroadcastNow
 {
     use Dispatchable, InteractsWithSockets, SerializesModels;
@@ -31,6 +34,7 @@ class HorseRaceProgress implements ShouldBroadcastNow
      */
     public function __construct(
         public readonly int $raceId,
+        public readonly int $roomId,
         public readonly array $positions,
         public readonly bool $finished = false,
         public readonly ?int $leaderId = null,
@@ -43,7 +47,7 @@ class HorseRaceProgress implements ShouldBroadcastNow
      */
     public function broadcastOn(): array
     {
-        return [new PresenceChannel('room.1')];
+        return [new PresenceChannel('room.'.$this->roomId)];
     }
 
     /**
@@ -63,6 +67,7 @@ class HorseRaceProgress implements ShouldBroadcastNow
     {
         return [
             'race_id' => $this->raceId,
+            'room_id' => $this->roomId,
             'positions' => $this->positions,
             'finished' => $this->finished,
             'leader_id' => $this->leaderId,

app/Events/HorseRaceSettled.php

@@ -46,7 +46,7 @@ class HorseRaceSettled implements ShouldBroadcastNow
      */
     public function broadcastOn(): array
     {
-        return [new PresenceChannel('room.1')];
+        return [new PresenceChannel('room.'.$this->race->room_id)];
     }
 
     /**
@@ -94,6 +94,7 @@ class HorseRaceSettled implements ShouldBroadcastNow
 
         return [
             'race_id' => $this->race->id,
+            'room_id' => (int) $this->race->room_id,
             'winner_horse_id' => $this->race->winner_horse_id,
             'winner_name' => $winnerName,
             'total_pool' => (int) $this->race->total_pool,

app/Events/MessageSent.php

@@ -26,9 +26,9 @@ class MessageSent implements ShouldBroadcastNow
     use Dispatchable, InteractsWithSockets, SerializesModels;
 
     /**
-     * Create a new event instance.
+     * 创建消息广播事件实例。
      *
-     * @param  int  $roomId  房间ID
+     * @param  int  $roomId  房间 ID
      * @param  array  $message  发送的消息数据
      */
     public function __construct(
@@ -39,8 +39,8 @@ class MessageSent implements ShouldBroadcastNow
     /**
      * 获取消息应广播到的频道。
      *
-     * 公共消息走房间 Presence 频道；
-     * 定向消息 / 悄悄话只发给发送方与接收方的私有用户频道。
+     * 公共消息和普通定向发言走房间 Presence 频道；
+     * 悄悄话只发给发送方与接收方的私有用户频道。
      *
      * @return array<int, \Illuminate\Broadcasting\Channel>
      */
@@ -78,9 +78,7 @@ class MessageSent implements ShouldBroadcastNow
      */
     private function shouldBroadcastPrivately(): bool
     {
-        $toUser = trim((string) ($this->message['to_user'] ?? ''));
-
-        return $toUser !== '' && $toUser !== '大家';
+        return (bool) ($this->message['is_secret'] ?? false);
     }
 
     /**

app/Events/RiddleGameAnswered.php

@@ -0,0 +1,69 @@
+<?php
+
+/**
+ * 文件功能：猜谜活动答题结果广播事件
+ *
+ * 用户答对题目时广播，通知房间内所有用户结果。
+ */
+
+namespace App\Events;
+
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PresenceChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * 类功能：向指定房间广播猜谜活动答题结果。
+ */
+class RiddleGameAnswered implements ShouldBroadcastNow
+{
+    use Dispatchable, InteractsWithSockets, SerializesModels;
+
+    /**
+     * 方法功能：构造答题成功广播事件载荷。
+     */
+    public function __construct(
+        public readonly int $roomId,
+        public readonly int $roundId,
+        public readonly string $quizType,
+        public readonly string $answer,
+        public readonly string $winnerUsername,
+        public readonly int $rewardGold = 0,
+        public readonly int $rewardExp = 0,
+    ) {}
+
+    /**
+     * 方法功能：声明广播频道。
+     */
+    public function broadcastOn(): array
+    {
+        return [
+            new PresenceChannel('room.'.$this->roomId),
+        ];
+    }
+
+    /**
+     * 方法功能：声明广播数据。
+     */
+    public function broadcastWith(): array
+    {
+        $quizTypeLabel = \App\Models\Riddle::labelForType($this->quizType);
+
+        return [
+            'round_id' => $this->roundId,
+            'quiz_type' => $this->quizType,
+            'quiz_type_label' => $quizTypeLabel,
+            'quiz_round_id' => $this->roundId,
+            'quiz_answer' => $this->answer,
+            'quiz_reward_gold' => $this->rewardGold,
+            'quiz_reward_exp' => $this->rewardExp,
+            'quiz_round_ended_id' => $this->roundId,
+            'answer' => $this->answer,
+            'winner_username' => $this->winnerUsername,
+            'reward_gold' => $this->rewardGold,
+            'reward_exp' => $this->rewardExp,
+        ];
+    }
+}

app/Events/RiddleGameStarted.php

@@ -0,0 +1,67 @@
+<?php
+
+/**
+ * 文件功能：猜谜活动开始广播事件
+ *
+ * 管理员手动出题或系统自动出题时触发，广播提示到聊天室。
+ */
+
+namespace App\Events;
+
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PresenceChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * 类功能：向指定房间广播新一轮猜谜活动题目。
+ */
+class RiddleGameStarted implements ShouldBroadcastNow
+{
+    use Dispatchable, InteractsWithSockets, SerializesModels;
+
+    /**
+     * 方法功能：构造新回合广播事件载荷。
+     */
+    public function __construct(
+        public readonly int $roomId,
+        public readonly string $quizType,
+        public readonly string $hint,
+        public readonly int $roundId,
+        public readonly int $rewardGold = 0,
+        public readonly int $rewardExp = 0,
+    ) {}
+
+    /**
+     * 方法功能：声明广播频道。
+     */
+    public function broadcastOn(): array
+    {
+        return [
+            new PresenceChannel('room.'.$this->roomId),
+        ];
+    }
+
+    /**
+     * 方法功能：声明广播数据。
+     */
+    public function broadcastWith(): array
+    {
+        $quizTypeLabel = \App\Models\Riddle::labelForType($this->quizType);
+
+        return [
+            'round_id' => $this->roundId,
+            'quiz_type' => $this->quizType,
+            'quiz_type_label' => $quizTypeLabel,
+            'quiz_round_id' => $this->roundId,
+            'quiz_hint' => $this->hint,
+            'quiz_reward_gold' => $this->rewardGold,
+            'quiz_reward_exp' => $this->rewardExp,
+            'hint' => $this->hint,
+            'reward_gold' => $this->rewardGold,
+            'reward_exp' => $this->rewardExp,
+            'message' => "📣 【猜谜活动·{$quizTypeLabel}】第 #{$this->roundId} 题开始！题面：{$this->hint}",
+        ];
+    }
+}

app/Events/UserBrowserRefreshRequested.php

@@ -0,0 +1,58 @@
+<?php
+
+/**
+ * 文件功能：用户定向页面刷新广播事件
+ *
+ * 在任命或撤销职务成功后，向目标用户私有频道推送刷新指令，
+ * 确保对方页面上的权限按钮与职务状态及时同步。
+ *
+ * @author   ChatRoom Laravel
+ *
+ * @version  1.0.0
+ */
+
+namespace App\Events;
+
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PrivateChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+/**
+ * 类功能：向指定用户广播页面刷新请求。
+ */
+class UserBrowserRefreshRequested implements ShouldBroadcastNow
+{
+    use Dispatchable, InteractsWithSockets, SerializesModels;
+
+    /**
+     * 构造函数：记录目标用户与刷新说明。
+     */
+    public function __construct(
+        public readonly int $targetUserId,
+        public readonly string $operator,
+        public readonly string $reason = '',
+    ) {}
+
+    /**
+     * 广播频道：目标用户私有频道。
+     */
+    public function broadcastOn(): PrivateChannel
+    {
+        return new PrivateChannel('user.'.$this->targetUserId);
+    }
+
+    /**
+     * 广播数据：供前端展示提示并执行刷新。
+     *
+     * @return array<string, mixed>
+     */
+    public function broadcastWith(): array
+    {
+        return [
+            'operator' => $this->operator,
+            'reason' => $this->reason,
+        ];
+    }
+}

app/Events/UserKicked.php

@@ -3,7 +3,7 @@
 /**
  * 文件功能：用户被踢出房间广播事件
  *
- * 管理员踢出/冻结用户时触发，前端监听后强制该用户跳转至大厅。
+ * 管理员踢出/封禁用户时触发，前端监听后强制该用户跳转至大厅。
  *
  * @author   ChatRoom Laravel
  *

app/Events/UserPat.php

@@ -0,0 +1,68 @@
+<?php
+
+/**
+ * 文件功能：用户"拍一拍"广播事件
+ *
+ * 用户输入 /拍一拍 用户名 后触发，通过 WebSocket 广播给房间内所有用户，
+ * 前端显示 "XXX拍了拍XXX" 消息并触发屏幕抖动动画。
+ *
+ * @author   ChatRoom Laravel
+ *
+ * @version  1.0.0
+ */
+
+namespace App\Events;
+
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PresenceChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class UserPat implements ShouldBroadcastNow
+{
+    use Dispatchable, InteractsWithSockets, SerializesModels;
+
+    /**
+     * 构造函数
+     *
+     * @param  int  $roomId  房间 ID
+     * @param  string  $fromUser  拍人的用户
+     * @param  string  $targetUser  被拍的用户
+     * @param  string  $displayText  前端展示文本，如 "流星 拍了拍 张三"
+     */
+    public function __construct(
+        public readonly int $roomId,
+        public readonly string $fromUser,
+        public readonly string $targetUser,
+        public readonly string $displayText,
+        public readonly ?string $fromUserHeadface = null,
+    ) {}
+
+    /**
+     * 广播频道：向房间内所有在线用户推送
+     *
+     * @return array<int, \Illuminate\Broadcasting\Channel>
+     */
+    public function broadcastOn(): array
+    {
+        return [
+            new PresenceChannel('room.'.$this->roomId),
+        ];
+    }
+
+    /**
+     * 广播数据
+     *
+     * @return array<string, mixed>
+     */
+    public function broadcastWith(): array
+    {
+        return [
+            'from_user' => $this->fromUser,
+            'target_user' => $this->targetUser,
+            'display_text' => $this->displayText,
+            'from_user_headface' => $this->fromUserHeadface,
+        ];
+    }
+}

app/Events/UserStatusUpdated.php

@@ -0,0 +1,57 @@
+<?php
+
+/**
+ * 文件功能：聊天室用户状态变更广播事件
+ * 负责在用户设置或清除当日状态后，实时同步当前房间在线名单展示。
+ */
+
+namespace App\Events;
+
+use Illuminate\Broadcasting\InteractsWithSockets;
+use Illuminate\Broadcasting\PresenceChannel;
+use Illuminate\Contracts\Broadcasting\ShouldBroadcastNow;
+use Illuminate\Foundation\Events\Dispatchable;
+use Illuminate\Queue\SerializesModels;
+
+class UserStatusUpdated implements ShouldBroadcastNow
+{
+    use Dispatchable, InteractsWithSockets, SerializesModels;
+
+    /**
+     * 构造聊天室用户状态变更广播事件。
+     *
+     * @param  int  $roomId  房间 ID
+     * @param  string  $username  状态变更用户昵称
+     * @param  array<string, mixed>  $user  最新在线名单载荷
+     */
+    public function __construct(
+        public readonly int $roomId,
+        public readonly string $username,
+        public readonly array $user,
+    ) {}
+
+    /**
+     * 获取广播频道。
+     *
+     * @return array<int, \Illuminate\Broadcasting\Channel>
+     */
+    public function broadcastOn(): array
+    {
+        return [
+            new PresenceChannel('room.'.$this->roomId),
+        ];
+    }
+
+    /**
+     * 获取广播数据。
+     *
+     * @return array<string, mixed>
+     */
+    public function broadcastWith(): array
+    {
+        return [
+            'username' => $this->username,
+            'user' => $this->user,
+        ];
+    }
+}

app/Http/Controllers/AchievementController.php

@@ -0,0 +1,73 @@
+<?php
+
+/**
+ * 文件功能：前台用户成就展示控制器。
+ *
+ * 展示当前登录用户的成就分类、解锁状态和进度。
+ */
+
+namespace App\Http\Controllers;
+
+use App\Services\AchievementService;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+/**
+ * 类功能：提供“我的成就”页面数据。
+ */
+class AchievementController extends Controller
+{
+    /**
+     * 创建成就控制器依赖。
+     */
+    public function __construct(
+        private readonly AchievementService $achievementService,
+    ) {}
+
+    /**
+     * 展示当前登录用户的成就总览。
+     */
+    public function index(Request $request): View
+    {
+        $user = Auth::user();
+        $this->achievementService->scanUser($user);
+        $achievementData = $this->achievementService->displayForUser($user);
+        $activeTab = in_array($request->query('status'), ['unlocked', 'locked'], true)
+            ? $request->query('status')
+            : 'all';
+        $allAchievements = $achievementData['achievements'];
+
+        // 页面 tab 只影响展示列表，不影响顶部总进度统计。
+        $achievementTabs = [
+            'all' => [
+                'label' => '全部',
+                'count' => $allAchievements->count(),
+                'url' => route('achievements.index'),
+            ],
+            'unlocked' => [
+                'label' => '已完成',
+                'count' => $allAchievements->where('unlocked', true)->count(),
+                'url' => route('achievements.index', ['status' => 'unlocked']),
+            ],
+            'locked' => [
+                'label' => '未达成',
+                'count' => $allAchievements->where('unlocked', false)->count(),
+                'url' => route('achievements.index', ['status' => 'locked']),
+            ],
+        ];
+
+        $achievementData['achievements'] = match ($activeTab) {
+            'unlocked' => $allAchievements->where('unlocked', true)->values(),
+            'locked' => $allAchievements->where('unlocked', false)->values(),
+            default => $allAchievements,
+        };
+
+        return view('achievements.index', [
+            'user' => $user,
+            'active_tab' => $activeTab,
+            'achievement_tabs' => $achievementTabs,
+            ...$achievementData,
+        ]);
+    }
+}

app/Http/Controllers/Admin/AchievementController.php

@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * 文件功能：后台成就记录查询控制器。
+ *
+ * 提供固定成就目录的解锁统计与用户成就记录只读查询。
+ */
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\UserAchievement;
+use App\Support\AchievementCatalog;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\DB;
+use Illuminate\View\View;
+
+/**
+ * 类功能：展示后台成就总览、解锁记录与按成就分组统计。
+ */
+class AchievementController extends Controller
+{
+    /**
+     * 展示成就记录总览。
+     */
+    public function index(Request $request): View
+    {
+        $definitions = AchievementCatalog::definitions();
+        $query = UserAchievement::query()
+            ->with('user:id,username')
+            ->whereNotNull('achieved_at')
+            ->latest('achieved_at');
+
+        if ($request->filled('username')) {
+            $query->whereHas('user', function ($userQuery) use ($request): void {
+                $userQuery->where('username', 'like', '%'.$request->string('username')->toString().'%');
+            });
+        }
+
+        if ($request->filled('achievement_key')) {
+            $query->where('achievement_key', $request->string('achievement_key')->toString());
+        }
+
+        $records = $query->paginate(30)->withQueryString();
+        $summary = [
+            'total_definitions' => count($definitions),
+            'unlocked_records' => UserAchievement::query()->whereNotNull('achieved_at')->count(),
+            'unlocked_users' => UserAchievement::query()->whereNotNull('achieved_at')->distinct('user_id')->count('user_id'),
+        ];
+        $topAchievements = UserAchievement::query()
+            ->whereNotNull('achieved_at')
+            ->select('achievement_key', DB::raw('count(*) as unlocked_count'))
+            ->groupBy('achievement_key')
+            ->orderByDesc('unlocked_count')
+            ->limit(10)
+            ->get();
+
+        return view('admin.achievements.index', compact('definitions', 'records', 'summary', 'topAchievements'));
+    }
+}

app/Http/Controllers/Admin/AiProviderController.php

@@ -20,6 +20,7 @@ use App\Http\Controllers\Controller;
 use App\Models\AiProviderConfig;
 use App\Models\Sysparam;
 use App\Services\ChatStateService;
+use App\Services\ChatUserPresenceService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
@@ -33,6 +34,7 @@ class AiProviderController extends Controller
      */
     public function __construct(
         private readonly ChatStateService $chatState,
+        private readonly ChatUserPresenceService $chatUserPresenceService,
     ) {}
 
     /**
@@ -283,19 +285,8 @@ class AiProviderController extends Controller
             ]);
         }
 
-        $userData = [
-            'user_id' => $user->id,
-            'username' => $user->username,
-            'level' => $user->user_level,
-            'sex' => $user->sex,
-            'headface' => $user->headface,
-            'vip_icon' => $user->vipIcon(),
-            'vip_name' => $user->vipName(),
-            'vip_color' => $user->isVip() ? ($user->vipLevel?->color ?? '') : '',
-            'is_admin' => false,
-            'position_icon' => '',
-            'position_name' => '',
-        ];
+        // 机器人在线载荷也统一走聊天室展示服务，避免名单字段口径逐步漂移。
+        $userData = $this->chatUserPresenceService->build($user);
 
         // 广播机器人进出事件（供前端名单增删）
         broadcast(new \App\Events\ChatBotToggled($userData, $isEnabled));

app/Http/Controllers/Admin/BaccaratLossCoverEventController.php

@@ -13,9 +13,14 @@ use App\Http\Controllers\Controller;
 use App\Http\Requests\StoreBaccaratLossCoverEventRequest;
 use App\Models\BaccaratLossCoverEvent;
 use App\Services\BaccaratLossCoverService;
+use App\Services\PositionPermissionService;
+use App\Support\PositionPermissionRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
+/**
+ * 类功能：处理聊天室顶部快捷入口创建与结束百家乐买单活动。
+ */
 class BaccaratLossCoverEventController extends Controller
 {
     /**
@@ -23,6 +28,7 @@ class BaccaratLossCoverEventController extends Controller
      */
     public function __construct(
         private readonly BaccaratLossCoverService $lossCoverService,
+        private readonly PositionPermissionService $positionPermissionService,
     ) {}
 
     /**
@@ -30,6 +36,13 @@ class BaccaratLossCoverEventController extends Controller
      */
     public function store(StoreBaccaratLossCoverEventRequest $request): JsonResponse
     {
+        if (! $this->positionPermissionService->hasPermission($request->user(), PositionPermissionRegistry::ROOM_BACCARAT_LOSS_COVER)) {
+            return response()->json([
+                'ok' => false,
+                'message' => '当前职务无权创建买单活动。',
+            ], 403);
+        }
+
         try {
             $event = $this->lossCoverService->createEvent($request->user(), $request->validated());
         } catch (\RuntimeException $exception) {
@@ -51,6 +64,13 @@ class BaccaratLossCoverEventController extends Controller
      */
     public function close(Request $request, BaccaratLossCoverEvent $event): JsonResponse
     {
+        if (! $this->positionPermissionService->hasPermission($request->user(), PositionPermissionRegistry::ROOM_BACCARAT_LOSS_COVER)) {
+            return response()->json([
+                'ok' => false,
+                'message' => '当前职务无权结束买单活动。',
+            ], 403);
+        }
+
         $event = $this->lossCoverService->forceCloseEvent($event, $request->user());
 
         return response()->json([

app/Http/Controllers/Admin/CurrencyLogController.php

@@ -17,6 +17,9 @@ use App\Models\UserCurrencyLog;
 use Illuminate\Http\Request;
 use Illuminate\View\View;
 
+/**
+ * 类功能：提供后台全局金币/积分流水查询与多条件筛选。
+ */
 class CurrencyLogController extends Controller
 {
     /**
@@ -26,6 +29,12 @@ class CurrencyLogController extends Controller
     public function index(Request $request): View
     {
         $query = UserCurrencyLog::query()->with('user');
+        $allSources = CurrencySource::cases();
+        $allowedSources = collect($allSources)->map(fn (CurrencySource $source) => $source->value)->all();
+        $selectedSources = collect($request->array('sources'))
+            ->filter(fn (string $source) => in_array($source, $allowedSources, true))
+            ->values()
+            ->all();
 
         // 查询条件过滤
         if ($request->filled('username')) {
@@ -36,8 +45,8 @@ class CurrencyLogController extends Controller
             $query->where('currency', $request->input('currency'));
         }
 
-        if ($request->filled('source')) {
-            $query->where('source', $request->input('source'));
+        if ($selectedSources !== []) {
+            $query->whereIn('source', $selectedSources);
         }
 
         if ($request->filled('remark')) {
@@ -63,8 +72,6 @@ class CurrencyLogController extends Controller
         // 默认按时间倒序
         $logs = $query->latest('id')->paginate(50)->withQueryString();
 
-        $allSources = CurrencySource::cases();
-
-        return view('admin.currency-logs.index', compact('logs', 'allSources'));
+        return view('admin.currency-logs.index', compact('logs', 'allSources', 'selectedSources'));
     }
 }

app/Http/Controllers/Admin/CurrencyStatsController.php

@@ -14,11 +14,13 @@ namespace App\Http\Controllers\Admin;
 
 use App\Enums\CurrencySource;
 use App\Http\Controllers\Controller;
-use App\Models\UserCurrencyLog;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\Request;
 use Illuminate\View\View;
 
+/**
+ * 类功能：展示后台积分流水统计与指定日期净流通数据。
+ */
 class CurrencyStatsController extends Controller
 {
     /**
@@ -45,20 +47,7 @@ class CurrencyStatsController extends Controller
         );
 
         // 今日净流通量（正向增加 - 负向消耗），可判断通货膨胀
-        $netFlow = [];
-        foreach (['exp', 'gold', 'charm'] as $currency) {
-            $totalIn = UserCurrencyLog::whereDate('created_at', $date)
-                ->where('currency', $currency)->where('amount', '>', 0)
-                ->sum('amount');
-            $totalOut = UserCurrencyLog::whereDate('created_at', $date)
-                ->where('currency', $currency)->where('amount', '<', 0)
-                ->sum('amount');
-            $netFlow[$currency] = [
-                'in' => $totalIn,
-                'out' => abs($totalOut),
-                'net' => $totalIn + $totalOut, // 净增量
-            ];
-        }
+        $netFlow = $this->currencyService->netFlowStats($date);
 
         // 所有已知来源（供视图展示缺失来源的空行）
         $allSources = CurrencySource::cases();

app/Http/Controllers/Admin/GameConfigController.php

@@ -14,14 +14,20 @@
 namespace App\Http\Controllers\Admin;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\UpdateGameConfigParamsRequest;
 use App\Models\GameConfig;
 use App\Models\LotteryIssue;
+use App\Models\Room;
+use App\Services\GameRoomScopeService;
 use App\Services\LotteryService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\View\View;
 
+/**
+ * 类功能：统一处理后台游戏开关、参数保存与手动操作入口。
+ */
 class GameConfigController extends Controller
 {
     /**
@@ -30,8 +36,9 @@ class GameConfigController extends Controller
     public function index(): View
     {
         $games = GameConfig::orderBy('id')->get();
+        $availableRooms = Room::query()->orderBy('id')->get();
 
-        return view('admin.game-configs.index', compact('games'));
+        return view('admin.game-configs.index', compact('games', 'availableRooms'));
     }
 
     /**
@@ -56,15 +63,19 @@ class GameConfigController extends Controller
      *
      * 接收前端提交的 params JSON 对象并合并至现有配置。
      */
-    public function updateParams(Request $request, GameConfig $gameConfig): RedirectResponse
+    public function updateParams(UpdateGameConfigParamsRequest $request, GameConfig $gameConfig, GameRoomScopeService $roomScopeService): RedirectResponse
     {
-        $request->validate([
-            'params' => 'required|array',
-        ]);
-
         // 合并参数，保留已有键，只更新传入的键
         $current = $gameConfig->params ?? [];
-        $updated = array_merge($current, $request->input('params'));
+        // 这里不能只读取 validated('params')。
+        // 当前请求类只对公共房间字段做了显式规则约束，像 fishing_cooldown 这类普通游戏参数
+        // 在 validated 数据中会被裁掉，导致后台提示成功但实际没有写入数据库。
+        $validatedParams = (array) $request->input('params', []);
+        $updated = array_merge($current, $validatedParams);
+
+        $scopeConfig = $roomScopeService->getScopeConfigForParams($validatedParams);
+        $updated['room_scope_mode'] = $scopeConfig['room_scope_mode'];
+        $updated['room_ids'] = $scopeConfig['room_ids'];
 
         if ($gameConfig->game_key === 'mystery_box') {
             $legacyMap = [
@@ -107,17 +118,19 @@ class GameConfigController extends Controller
         }
 
         // 检查是否有正在开放的箱子（避免同时多个）
-        if (\App\Models\MysteryBox::currentOpenBox()) {
+        $targetRoomId = app(GameRoomScopeService::class)->getPrimaryRoomIdForGame('mystery_box');
+
+        if (\App\Models\MysteryBox::currentOpenBox($targetRoomId)) {
             return response()->json(['ok' => false, 'message' => '当前已有一个神秘箱子正在等待领取，请等它结束后再投放。']);
         }
 
-        \App\Jobs\DropMysteryBoxJob::dispatch($boxType, 1, null, (int) auth()->id());
+        \App\Jobs\DropMysteryBoxJob::dispatch($boxType, $targetRoomId, null, (int) auth()->id());
 
         $typeNames = ['normal' => '普通箱', 'rare' => '稀有箱', 'trap' => '黑化箱'];
 
         return response()->json([
             'ok' => true,
-            'message' => "✅ 已投放「{$typeNames[$boxType]}」到 #1 房间，暗号将实时发送到公屏！",
+            'message' => "✅ 已投放「{$typeNames[$boxType]}」到 #{$targetRoomId} 房间，暗号将实时发送到公屏！",
         ]);
     }
 
@@ -126,19 +139,31 @@ class GameConfigController extends Controller
      *
      * 仅在当前无进行中期次时生效，防止重复开期。
      */
-    public function openLotteryIssue(): JsonResponse
+    public function openLotteryIssue(GameRoomScopeService $roomScopeService): JsonResponse
     {
         if (! GameConfig::isEnabled('lottery')) {
             return response()->json(['ok' => false, 'message' => '双色球彩票未开启，请先开启游戏。']);
         }
 
-        if (LotteryIssue::currentIssue()) {
-            return response()->json(['ok' => false, 'message' => '当前已有进行中的期次，无需重复开期。']);
+        $openedRoomIds = [];
+
+        foreach ($roomScopeService->getScopedRoomIdsForGame('lottery') as $roomId) {
+            if (LotteryIssue::currentIssue($roomId)) {
+                continue;
+            }
+
+            \App\Jobs\OpenLotteryIssueJob::dispatch($roomId);
+            $openedRoomIds[] = $roomId;
         }
 
-        \App\Jobs\OpenLotteryIssueJob::dispatch();
+        if ($openedRoomIds === []) {
+            return response()->json(['ok' => false, 'message' => '目标房间当前已有进行中的期次，无需重复开期。']);
+        }
 
-        return response()->json(['ok' => true, 'message' => '✅ 已排队开期任务，新期次将就绪建立！']);
+        return response()->json([
+            'ok' => true,
+            'message' => '✅ 已排队开期任务，目标房间：#'.implode('、#', $openedRoomIds),
+        ]);
     }
 
     /**

app/Http/Controllers/Admin/HolidayEventController.php

@@ -14,15 +14,27 @@
 namespace App\Http\Controllers\Admin;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\StoreHolidayEventRequest;
+use App\Http\Requests\UpdateHolidayEventRequest;
 use App\Jobs\TriggerHolidayEventJob;
 use App\Models\HolidayEvent;
+use App\Services\HolidayEventScheduleService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
-use Illuminate\Http\Request;
 use Illuminate\View\View;
 
+/**
+ * 类功能：管理节日福利模板的后台增删改查与手动触发操作。
+ */
 class HolidayEventController extends Controller
 {
+    /**
+     * 注入节日福利调度计算服务。
+     */
+    public function __construct(
+        private readonly HolidayEventScheduleService $scheduleService,
+    ) {}
+
     /**
      * 节日福利活动列表页。
      */
@@ -46,30 +58,9 @@ class HolidayEventController extends Controller
     /**
      * 保存新活动。
      */
-    public function store(Request $request): RedirectResponse
+    public function store(StoreHolidayEventRequest $request): RedirectResponse
     {
-        $data = $request->validate([
-            'name' => 'required|string|max:100',
-            'description' => 'nullable|string|max:500',
-            'total_amount' => 'required|integer|min:1',
-            'max_claimants' => 'required|integer|min:0',
-            'distribute_type' => 'required|in:random,fixed',
-            'min_amount' => 'nullable|integer|min:1',
-            'max_amount' => 'nullable|integer|min:1',
-            'fixed_amount' => 'nullable|integer|min:1',
-            'send_at' => 'required|date',
-            'expire_minutes' => 'required|integer|min:1|max:1440',
-            'repeat_type' => 'required|in:once,daily,weekly,monthly,cron',
-            'cron_expr' => 'nullable|string|max:100',
-            'target_type' => 'required|in:all,vip,level',
-            'target_value' => 'nullable|string|max:50',
-            'enabled' => 'boolean',
-        ]);
-
-        $data['status'] = 'pending';
-        $data['enabled'] = $request->boolean('enabled', true);
-
-        HolidayEvent::create($data);
+        HolidayEvent::create($this->buildPayload($request->validated(), true));
 
         return redirect()->route('admin.holiday-events.index')->with('success', '节日福利活动创建成功！');
     }
@@ -85,26 +76,9 @@ class HolidayEventController extends Controller
     /**
      * 更新活动。
      */
-    public function update(Request $request, HolidayEvent $holidayEvent): RedirectResponse
+    public function update(UpdateHolidayEventRequest $request, HolidayEvent $holidayEvent): RedirectResponse
     {
-        $data = $request->validate([
-            'name' => 'required|string|max:100',
-            'description' => 'nullable|string|max:500',
-            'total_amount' => 'required|integer|min:1',
-            'max_claimants' => 'required|integer|min:0',
-            'distribute_type' => 'required|in:random,fixed',
-            'min_amount' => 'nullable|integer|min:1',
-            'max_amount' => 'nullable|integer|min:1',
-            'fixed_amount' => 'nullable|integer|min:1',
-            'send_at' => 'required|date',
-            'expire_minutes' => 'required|integer|min:1|max:1440',
-            'repeat_type' => 'required|in:once,daily,weekly,monthly,cron',
-            'cron_expr' => 'nullable|string|max:100',
-            'target_type' => 'required|in:all,vip,level',
-            'target_value' => 'nullable|string|max:50',
-        ]);
-
-        $holidayEvent->update($data);
+        $holidayEvent->update($this->buildPayload($request->validated()));
 
         return redirect()->route('admin.holiday-events.index')->with('success', '活动已更新！');
     }
@@ -128,13 +102,12 @@ class HolidayEventController extends Controller
      */
     public function triggerNow(HolidayEvent $holidayEvent): RedirectResponse
     {
-        if ($holidayEvent->status !== 'pending') {
-            return back()->with('error', '只有待触发状态的活动才能手动触发。');
+        if (! $holidayEvent->enabled || $holidayEvent->status === 'cancelled') {
+            return back()->with('error', '当前活动未启用或已取消，不能立即触发。');
         }
 
-        // 设置触发时间为当前，立即入队
-        $holidayEvent->update(['send_at' => now()]);
-        TriggerHolidayEventJob::dispatch($holidayEvent);
+        // 立即触发只生成临时批次，不覆盖年度锚点或下次计划时间。
+        TriggerHolidayEventJob::dispatch($holidayEvent, true);
 
         return back()->with('success', '活动已触发，请稍后刷新查看状态。');
     }
@@ -148,4 +121,54 @@ class HolidayEventController extends Controller
 
         return redirect()->route('admin.holiday-events.index')->with('success', '活动已删除。');
     }
+
+    /**
+     * 组装节日福利模板的可持久化字段。
+     *
+     * @param  array<string, mixed>  $data
+     * @return array<string, mixed>
+     */
+    private function buildPayload(array $data, bool $isCreating = false): array
+    {
+        $payload = $data;
+
+        // 创建与编辑都统一回收无效字段，避免模板状态互相污染。
+        if (($payload['distribute_type'] ?? 'random') === 'random') {
+            $payload['fixed_amount'] = null;
+        } else {
+            $payload['min_amount'] = 1;
+            $payload['max_amount'] = null;
+        }
+
+        if (($payload['target_type'] ?? 'all') !== 'level') {
+            $payload['target_value'] = null;
+        }
+
+        if (($payload['repeat_type'] ?? 'once') !== 'cron') {
+            $payload['cron_expr'] = null;
+        }
+
+        if (($payload['repeat_type'] ?? 'once') === 'yearly') {
+            $payload['send_at'] = $this->scheduleService
+                ->resolveNextConfiguredSendAt($payload)
+                ->toDateTimeString();
+        } else {
+            $payload['schedule_month'] = null;
+            $payload['schedule_day'] = null;
+            $payload['schedule_time'] = null;
+            $payload['duration_days'] = 1;
+            $payload['daily_occurrences'] = 1;
+            $payload['occurrence_interval_minutes'] = null;
+        }
+
+        // 每次保存模板时，都让系统按新配置重新进入待触发状态。
+        $payload['status'] = 'pending';
+        $payload['enabled'] = (bool) ($payload['enabled'] ?? true);
+        $payload['triggered_at'] = null;
+        $payload['expires_at'] = null;
+        $payload['claimed_count'] = 0;
+        $payload['claimed_amount'] = 0;
+
+        return $payload;
+    }
 }

app/Http/Controllers/Admin/LevelExpConfigController.php

@@ -0,0 +1,77 @@
+<?php
+
+/**
+ * 文件功能：后台等级经验阈值配置控制器
+ *
+ * 将 sysparam 表中的 levelexp 配置拆分为独立后台页面，
+ * 以列表模式维护每一级所需的累计经验值。
+ */
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\UpdateLevelExpConfigRequest;
+use App\Models\Sysparam;
+use App\Services\ChatStateService;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\View\View;
+
+/**
+ * 类功能：负责展示和保存等级经验阈值列表。
+ */
+class LevelExpConfigController extends Controller
+{
+    /**
+     * 方法功能：注入系统参数缓存同步服务。
+     */
+    public function __construct(
+        private readonly ChatStateService $chatState
+    ) {}
+
+    /**
+     * 方法功能：显示等级经验阈值列表页。
+     */
+    public function index(): View
+    {
+        $rawThresholds = Sysparam::getLevelExpThresholds();
+        $maxLevel = (int) Sysparam::getValue('maxlevel', '99');
+
+        $thresholds = collect($rawThresholds)
+            ->values()
+            ->map(fn (int $exp, int $index): array => [
+                'level' => $index + 1,
+                'exp' => $exp,
+                'increment' => $index === 0 ? $exp : $exp - $rawThresholds[$index - 1],
+            ]);
+
+        return view('admin.level-exp-configs.index', [
+            'thresholds' => $thresholds,
+            'maxLevel' => $maxLevel,
+        ]);
+    }
+
+    /**
+     * 方法功能：保存等级经验阈值配置，并同步刷新缓存。
+     */
+    public function update(UpdateLevelExpConfigRequest $request): RedirectResponse
+    {
+        $thresholds = $request->validated('thresholds');
+
+        // 将列表页提交的阈值重新拼成兼容旧逻辑的逗号字符串。
+        $body = implode(',', $thresholds);
+
+        Sysparam::updateOrCreate(
+            ['alias' => 'levelexp'],
+            [
+                'body' => $body,
+                'guidetxt' => '按列表逐级维护升级所需的累计经验阈值',
+            ]
+        );
+
+        // 同步更新 Redis / Cache，确保前台经验等级计算即时生效。
+        $this->chatState->setSysParam('levelexp', $body);
+        Sysparam::clearCache('levelexp');
+
+        return redirect()->route('admin.level-exp-configs.index')->with('success', '等级经验阈值已保存并生效！');
+    }
+}

app/Http/Controllers/Admin/PositionController.php

@@ -16,10 +16,15 @@ use App\Http\Controllers\Controller;
 use App\Models\Department;
 use App\Models\Position;
 use App\Models\Sysparam;
+use App\Support\PositionPermissionRegistry;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
 use Illuminate\View\View;
 
+/**
+ * 类功能：负责后台职务资料、任命白名单与聊天室权限配置的维护。
+ */
 class PositionController extends Controller
 {
     /**
@@ -29,16 +34,25 @@ class PositionController extends Controller
     {
         // 按部门分组展示
         $departments = Department::with([
-            'positions' => fn ($q) => $q->withCount(['activeUserPositions'])->ordered(),
+            'positions' => fn ($q) => $q->withCount(['activeUserPositions'])->with('appointablePositions')->ordered(),
         ])->ordered()->get();
 
         // 全部职务（供任命白名单多选框使用）
-        $allPositions = Position::with('department')->orderByDesc('rank')->get();
+        $allPositions = Position::with('department')->ordered()->get();
 
         // 全局奖励接收次数上限（0 = 不限）
         $globalRecipientDailyMax = (int) Sysparam::getValue('reward_recipient_daily_max', '0');
 
-        return view('admin.positions.index', compact('departments', 'allPositions', 'globalRecipientDailyMax'));
+        $positionPermissions = PositionPermissionRegistry::groupedDefinitions();
+        $permissionLabels = PositionPermissionRegistry::labelMap();
+
+        return view('admin.positions.index', compact(
+            'departments',
+            'allPositions',
+            'globalRecipientDailyMax',
+            'positionPermissions',
+            'permissionLabels',
+        ));
     }
 
     /**
@@ -56,13 +70,20 @@ class PositionController extends Controller
             'max_reward' => 'nullable|integer|min:0',
             'daily_reward_limit' => 'nullable|integer|min:0',
             'recipient_daily_limit' => 'nullable|integer|min:0',
+            'red_packet_amount' => 'nullable|integer|min:1|max:999999999|gte:red_packet_count',
+            'red_packet_count' => 'nullable|integer|min:1|max:100',
             'sort_order' => 'required|integer|min:0',
             'appointable_ids' => 'nullable|array',
             'appointable_ids.*' => 'exists:positions,id',
+            'permissions' => 'nullable|array',
+            'permissions.*' => ['string', Rule::in(PositionPermissionRegistry::codes())],
         ]);
 
         $appointableIds = $data['appointable_ids'] ?? [];
         unset($data['appointable_ids']);
+        $data['permissions'] = array_values(array_unique($data['permissions'] ?? []));
+        $data['red_packet_amount'] = (int) ($data['red_packet_amount'] ?? 8888);
+        $data['red_packet_count'] = (int) ($data['red_packet_count'] ?? 10);
 
         $position = Position::create($data);
 
@@ -144,13 +165,20 @@ class PositionController extends Controller
             'max_reward' => 'nullable|integer|min:0',
             'daily_reward_limit' => 'nullable|integer|min:0',
             'recipient_daily_limit' => 'nullable|integer|min:0',
+            'red_packet_amount' => 'nullable|integer|min:1|max:999999999|gte:red_packet_count',
+            'red_packet_count' => 'nullable|integer|min:1|max:100',
             'sort_order' => 'required|integer|min:0',
             'appointable_ids' => 'nullable|array',
             'appointable_ids.*' => 'exists:positions,id',
+            'permissions' => 'nullable|array',
+            'permissions.*' => ['string', Rule::in(PositionPermissionRegistry::codes())],
         ]);
 
         $appointableIds = $data['appointable_ids'] ?? [];
         unset($data['appointable_ids']);
+        $data['permissions'] = array_values(array_unique($data['permissions'] ?? []));
+        $data['red_packet_amount'] = (int) ($data['red_packet_amount'] ?? 8888);
+        $data['red_packet_count'] = (int) ($data['red_packet_count'] ?? 10);
 
         $position->update($data);
         $position->appointablePositions()->sync($appointableIds);

app/Http/Controllers/Admin/RiddleController.php

@@ -0,0 +1,168 @@
+<?php
+
+/**
+ * 文件功能：猜谜活动题库后台管理控制器
+ *
+ * 负责后台题库的列表筛选、题目增删改和启用状态切换。
+ */
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Models\Riddle;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Http\Request;
+use Illuminate\Validation\Rule;
+use Illuminate\View\View;
+
+/**
+ * 类功能：统一处理猜谜活动题库的后台管理动作。
+ */
+class RiddleController extends Controller
+{
+    /**
+     * 方法功能：显示题库列表，并支持按题型和关键词筛选。
+     */
+    public function index(Request $request): View
+    {
+        $typeOptions = Riddle::typeOptions();
+        $selectedType = trim((string) $request->query('type', ''));
+        $keyword = trim((string) $request->query('keyword', ''));
+
+        $idiomQuery = Riddle::query();
+
+        if ($selectedType !== '' && isset($typeOptions[$selectedType])) {
+            // 题型筛选只接受系统支持值，避免非法参数污染查询。
+            $idiomQuery->ofType($selectedType);
+        }
+
+        if ($keyword !== '') {
+            // 关键词同时匹配答案与提示，方便后台快速定位题目。
+            $idiomQuery->where(function ($query) use ($keyword): void {
+                $query->where('answer', 'like', '%'.$keyword.'%')
+                    ->orWhere('hint', 'like', '%'.$keyword.'%');
+            });
+        }
+
+        $idioms = $idiomQuery
+            ->orderBy('type')
+            ->orderBy('sort')
+            ->orderBy('id')
+            ->get();
+
+        $typeStats = Riddle::query()
+            ->selectRaw('type, COUNT(*) as total')
+            ->groupBy('type')
+            ->pluck('total', 'type')
+            ->all();
+
+        return view('admin.riddles.index', [
+            'idioms' => $idioms,
+            'typeOptions' => $typeOptions,
+            'selectedType' => $selectedType,
+            'keyword' => $keyword,
+            'typeStats' => $typeStats,
+        ]);
+    }
+
+    /**
+     * 方法功能：创建新的猜谜活动题目。
+     */
+    public function store(Request $request): RedirectResponse
+    {
+        $data = $this->validateRiddlePayload($request);
+
+        // 新增时默认启用，便于后台批量补题后立即可用。
+        $data['is_active'] = $request->boolean('is_active', true);
+        Riddle::create($data);
+
+        $typeLabel = Riddle::labelForType($data['type']);
+
+        return redirect()
+            ->route('admin.riddles.index', $this->buildIndexFilters($request))
+            ->with('success', "{$typeLabel}题目已添加！");
+    }
+
+    /**
+     * 方法功能：更新已有题目内容与题型。
+     */
+    public function update(Request $request, Riddle $idiom): RedirectResponse
+    {
+        $data = $this->validateRiddlePayload($request);
+
+        // 编辑时显式按复选框结果落库，避免旧状态残留。
+        $data['is_active'] = $request->boolean('is_active');
+        $idiom->update($data);
+
+        return redirect()
+            ->route('admin.riddles.index', $this->buildIndexFilters($request))
+            ->with('success', "题目「{$idiom->answer}」已更新！");
+    }
+
+    /**
+     * 方法功能：通过 AJAX 切换题目的启用状态。
+     */
+    public function toggle(Riddle $idiom): JsonResponse
+    {
+        // 开关按钮只变更启用状态，不改动其他题库字段。
+        $idiom->update(['is_active' => ! $idiom->is_active]);
+
+        return response()->json([
+            'ok' => true,
+            'is_active' => $idiom->is_active,
+            'message' => $idiom->is_active ? "「{$idiom->answer}」已启用" : "「{$idiom->answer}」已禁用",
+        ]);
+    }
+
+    /**
+     * 方法功能：删除指定题目。
+     */
+    public function destroy(Request $request, Riddle $idiom): RedirectResponse
+    {
+        $answer = $idiom->answer;
+        $idiom->delete();
+
+        return redirect()
+            ->route('admin.riddles.index', $this->buildIndexFilters($request))
+            ->with('success', "题目「{$answer}」已删除！");
+    }
+
+    /**
+     * 方法功能：校验后台题库保存载荷。
+     *
+     * @return array{type:string,answer:string,hint:string,sort:int}
+     */
+    private function validateRiddlePayload(Request $request): array
+    {
+        return $request->validate([
+            'type' => ['required', 'string', Rule::in(Riddle::supportedTypes())],
+            'answer' => ['required', 'string', 'max:120'],
+            'hint' => ['required', 'string', 'max:255'],
+            'sort' => ['required', 'integer', 'min:0'],
+            'is_active' => ['sometimes', 'boolean'],
+        ]);
+    }
+
+    /**
+     * 方法功能：保留列表筛选参数，方便后台操作后返回原筛选结果。
+     *
+     * @return array<string, string>
+     */
+    private function buildIndexFilters(Request $request): array
+    {
+        $filters = [];
+        $type = trim((string) $request->input('redirect_type', $request->query('type', '')));
+        $keyword = trim((string) $request->input('redirect_keyword', $request->query('keyword', '')));
+
+        if ($type !== '') {
+            $filters['type'] = $type;
+        }
+
+        if ($keyword !== '') {
+            $filters['keyword'] = $keyword;
+        }
+
+        return $filters;
+    }
+}

app/Http/Controllers/Admin/RideController.php

@@ -0,0 +1,82 @@
+<?php
+
+/**
+ * 文件功能：后台座驾独立管理控制器。
+ *
+ * 提供座驾列表、新增、编辑、上下架切换与删除能力，不依赖商店商品模块。
+ */
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\StoreRideRequest;
+use App\Http\Requests\UpdateRideRequest;
+use App\Models\Ride;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\View\View;
+
+/**
+ * 后台座驾管理控制器
+ * 负责独立 rides 表的后台管理流程。
+ */
+class RideController extends Controller
+{
+    /**
+     * 显示座驾管理列表页。
+     */
+    public function index(): View
+    {
+        $rides = Ride::query()
+            ->orderBy('sort_order')
+            ->orderBy('id')
+            ->get();
+
+        return view('admin.rides.index', compact('rides'));
+    }
+
+    /**
+     * 新增座驾（仅 id=1 超级站长）。
+     */
+    public function store(StoreRideRequest $request): RedirectResponse
+    {
+        $data = $request->validated();
+        Ride::create($data);
+
+        return redirect()->route('admin.rides.index')->with('success', '座驾「'.$data['name'].'」创建成功！');
+    }
+
+    /**
+     * 更新座驾信息。
+     */
+    public function update(UpdateRideRequest $request, Ride $ride): RedirectResponse
+    {
+        $ride->update($request->validated());
+
+        return redirect()->route('admin.rides.index')->with('success', '座驾「'.$ride->name.'」更新成功！');
+    }
+
+    /**
+     * 切换座驾上下架状态。
+     */
+    public function toggle(Ride $ride): RedirectResponse
+    {
+        $ride->update(['is_active' => ! $ride->is_active]);
+        $status = $ride->is_active ? '上架' : '下架';
+
+        return redirect()->route('admin.rides.index')->with('success', "「{$ride->name}」已{$status}。");
+    }
+
+    /**
+     * 删除座驾（仅 id=1 超级站长）。
+     */
+    public function destroy(Ride $ride): RedirectResponse
+    {
+        abort_unless(Auth::id() === 1, 403);
+
+        $name = $ride->name;
+        $ride->delete();
+
+        return redirect()->route('admin.rides.index')->with('success', "「{$name}」已删除。");
+    }
+}

app/Http/Controllers/Admin/ShopItemController.php

@@ -14,9 +14,10 @@
 namespace App\Http\Controllers\Admin;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\StoreShopItemRequest;
+use App\Http\Requests\UpdateShopItemRequest;
 use App\Models\ShopItem;
 use Illuminate\Http\RedirectResponse;
-use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\View\View;
 
@@ -35,11 +36,9 @@ class ShopItemController extends Controller
     /**
      * 新增商品（仅 id=1 超级站长）
      */
-    public function store(Request $request): RedirectResponse
+    public function store(StoreShopItemRequest $request): RedirectResponse
     {
-        abort_unless(Auth::id() === 1, 403);
-
-        $data = $this->validateItem($request);
+        $data = $request->validated();
         ShopItem::create($data);
 
         return redirect()->route('admin.shop.index')->with('success', '商品「'.$data['name'].'」创建成功！');
@@ -50,9 +49,9 @@ class ShopItemController extends Controller
      *
      * @param  ShopItem  $shopItem  路由模型自动注入
      */
-    public function update(Request $request, ShopItem $shopItem): RedirectResponse
+    public function update(UpdateShopItemRequest $request, ShopItem $shopItem): RedirectResponse
     {
-        $data = $this->validateItem($request, $shopItem);
+        $data = $request->validated();
         $shopItem->update($data);
 
         return redirect()->route('admin.shop.index')->with('success', '商品「'.$shopItem->name.'」更新成功！');
@@ -85,29 +84,4 @@ class ShopItemController extends Controller
 
         return redirect()->route('admin.shop.index')->with('success', "「{$name}」已删除。");
     }
-
-    /**
-     * 统一验证商品表单（新增/编辑共用）
-     *
-     * @return array<string, mixed>
-     */
-    private function validateItem(Request $request, ?ShopItem $item = null): array
-    {
-        return $request->validate([
-            'name' => 'required|string|max:100',
-            'slug' => ['required', 'string', 'max:100',
-                \Illuminate\Validation\Rule::unique('shop_items', 'slug')->ignore($item?->id),
-            ],
-            'icon' => 'required|string|max:20',
-            'description' => 'nullable|string|max:500',
-            'price' => 'required|integer|min:0',
-            'type' => 'required|in:instant,duration,one_time,ring,auto_fishing',
-            'duration_days' => 'nullable|integer|min:0',
-            'duration_minutes' => 'nullable|integer|min:0',
-            'intimacy_bonus' => 'nullable|integer|min:0',
-            'charm_bonus' => 'nullable|integer|min:0',
-            'sort_order' => 'required|integer|min:0',
-            'is_active' => 'boolean',
-        ]);
-    }
 }

app/Http/Controllers/Admin/SignInRewardRuleController.php

@@ -0,0 +1,96 @@
+<?php
+
+/**
+ * 文件功能：后台签到奖励规则管理控制器
+ *
+ * 提供连续签到奖励档位的列表、新增、编辑、启停和删除功能。
+ */
+
+namespace App\Http\Controllers\Admin;
+
+use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\SaveSignInRewardRuleRequest;
+use App\Models\SignInRewardRule;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
+use Illuminate\View\View;
+
+/**
+ * 类功能：管理后台每日签到奖励规则。
+ */
+class SignInRewardRuleController extends Controller
+{
+    /**
+     * 方法功能：展示签到奖励规则列表。
+     */
+    public function index(): View
+    {
+        $rules = SignInRewardRule::query()
+            ->orderBy('sort_order')
+            ->orderBy('streak_days')
+            ->get();
+
+        return view('admin.sign-in-rules.index', compact('rules'));
+    }
+
+    /**
+     * 方法功能：新增签到奖励规则。
+     */
+    public function store(SaveSignInRewardRuleRequest $request): RedirectResponse
+    {
+        SignInRewardRule::query()->create($this->payload($request));
+
+        return redirect()->route('admin.sign-in-rules.index')->with('success', '签到奖励规则已创建。');
+    }
+
+    /**
+     * 方法功能：更新签到奖励规则。
+     */
+    public function update(SaveSignInRewardRuleRequest $request, SignInRewardRule $signInRewardRule): RedirectResponse
+    {
+        $signInRewardRule->update($this->payload($request));
+
+        return redirect()->route('admin.sign-in-rules.index')->with('success', '签到奖励规则已更新。');
+    }
+
+    /**
+     * 方法功能：切换签到奖励规则启用状态。
+     */
+    public function toggle(SignInRewardRule $signInRewardRule): JsonResponse
+    {
+        $signInRewardRule->update(['is_enabled' => ! $signInRewardRule->is_enabled]);
+
+        return response()->json([
+            'ok' => true,
+            'is_enabled' => $signInRewardRule->is_enabled,
+            'message' => $signInRewardRule->is_enabled ? '规则已启用。' : '规则已停用。',
+        ]);
+    }
+
+    /**
+     * 方法功能：删除签到奖励规则。
+     */
+    public function destroy(SignInRewardRule $signInRewardRule): RedirectResponse
+    {
+        $signInRewardRule->delete();
+
+        return redirect()->route('admin.sign-in-rules.index')->with('success', '签到奖励规则已删除。');
+    }
+
+    /**
+     * 方法功能：整理后台表单提交的数据。
+     *
+     * @return array<string, mixed>
+     */
+    private function payload(SaveSignInRewardRuleRequest $request): array
+    {
+        $data = $request->validated();
+        $data['is_enabled'] = $request->boolean('is_enabled');
+
+        foreach (['identity_badge_code', 'identity_badge_name', 'identity_badge_icon', 'identity_badge_color'] as $field) {
+            $data[$field] = filled($data[$field] ?? null) ? trim((string) $data[$field]) : null;
+        }
+
+        return $data;
+    }
+}

app/Http/Controllers/Admin/SystemController.php

@@ -60,6 +60,14 @@ class SystemController extends Controller
         // 只接受通用系统页白名单内的字段，忽略任何伪造提交的敏感键。
         $data = $request->only($this->editableSystemAliases());
 
+        if (array_key_exists('maxlevel', $data)) {
+            $normalizedMaxLevel = max(1, (int) $data['maxlevel']);
+
+            // 管理员级别始终跟随最高等级 + 1，避免两个配置页出现口径漂移。
+            $data['maxlevel'] = (string) $normalizedMaxLevel;
+            $data['superlevel'] = (string) ($normalizedMaxLevel + 1);
+        }
+
         foreach ($data as $alias => $body) {
             $normalizedBody = (string) $body;
 
@@ -88,7 +96,7 @@ class SystemController extends Controller
         return SysParam::query()
             ->orderBy('id')
             ->pluck('alias')
-            ->filter(fn (string $alias): bool => ! $this->isSensitiveAlias($alias))
+            ->filter(fn (string $alias): bool => ! $this->isSensitiveAlias($alias) && ! $this->isDedicatedAlias($alias))
             ->values()
             ->all();
     }
@@ -104,4 +112,21 @@ class SystemController extends Controller
 
         return Str::endsWith($alias, ['_password', '_secret', '_token', '_key']);
     }
+
+    /**
+     * 判断参数是否已经迁移到独立配置页。
+     */
+    private function isDedicatedAlias(string $alias): bool
+    {
+        return in_array($alias, [
+            'levelexp',
+            'level_warn',
+            'level_mute',
+            'level_kick',
+            'level_announcement',
+            'level_ban',
+            'level_banip',
+            'level_freeze',
+        ], true);
+    }
 }

app/Http/Controllers/Admin/UserManagerController.php

@@ -12,8 +12,15 @@
 namespace App\Http\Controllers\Admin;
 
 use App\Enums\CurrencySource;
+use App\Events\AppointmentAnnounced;
+use App\Events\UserBrowserRefreshRequested;
 use App\Http\Controllers\Controller;
+use App\Http\Requests\Admin\UpdateManagedUserRequest;
+use App\Models\Department;
+use App\Models\Position;
 use App\Models\User;
+use App\Models\UserPosition;
+use App\Services\AppointmentService;
 use App\Services\ChatStateService;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
@@ -23,6 +30,9 @@ use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\View\View;
 
+/**
+ * 类功能：负责后台用户列表展示、资料编辑与删除操作。
+ */
 class UserManagerController extends Controller
 {
     /**
@@ -31,6 +41,7 @@ class UserManagerController extends Controller
     public function __construct(
         private readonly UserCurrencyService $currencyService,
         private readonly ChatStateService $chatState,
+        private readonly AppointmentService $appointmentService,
     ) {}
 
     /**
@@ -77,8 +88,12 @@ class UserManagerController extends Controller
 
         // VIP 等级选项列表（供编辑弹窗使用）
         $vipLevels = \App\Models\VipLevel::orderBy('sort_order')->get();
+        // 职务下拉选项（复用任命系统中的部门与职务数据）
+        $departments = Department::with([
+            'positions' => fn ($positionQuery) => $positionQuery->ordered(),
+        ])->ordered()->get();
 
-        return view('admin.users.index', compact('users', 'vipLevels', 'sortBy', 'sortDir', 'onlineUsernames'));
+        return view('admin.users.index', compact('users', 'vipLevels', 'departments', 'sortBy', 'sortDir', 'onlineUsernames'));
     }
 
     /**
@@ -86,10 +101,11 @@ class UserManagerController extends Controller
      *
      * @param  User  $user  路由模型自动注入
      */
-    public function update(Request $request, User $user): JsonResponse|RedirectResponse
+    public function update(UpdateManagedUserRequest $request, User $user): JsonResponse|RedirectResponse
     {
         $targetUser = $user;
         $currentUser = Auth::user();
+        $responseMessages = [];
 
         // 超级管理员专属：仅 id=1 的账号可编辑用户信息
         if ($currentUser->id !== 1) {
@@ -104,17 +120,7 @@ class UserManagerController extends Controller
             return response()->json(['status' => 'error', 'message' => '权限不足：您无法修改同级或高级管理人员资料。'], 403);
         }
 
-        $validated = $request->validate([
-            'sex' => 'sometimes|integer|in:0,1,2',
-            'exp_num' => 'sometimes|integer|min:0',
-            'jjb' => 'sometimes|integer|min:0',
-            'meili' => 'sometimes|integer|min:0',
-            'qianming' => 'sometimes|nullable|string|max:255',
-            'headface' => 'sometimes|string|max:50',
-            'password' => 'nullable|string|min:6',
-            'vip_level_id' => 'sometimes|nullable|integer|exists:vip_levels,id',
-            'hy_time' => 'sometimes|nullable|date',
-        ]);
+        $validated = $request->validated();
 
         if (isset($validated['sex'])) {
             $targetUser->sex = $validated['sex'];
@@ -188,11 +194,31 @@ class UserManagerController extends Controller
 
         $targetUser->save();
 
-        if ($request->wantsJson()) {
-            return response()->json(['status' => 'success', 'message' => '用户资料已强行更新完毕！']);
+        if (array_key_exists('position_id', $validated)) {
+            $positionSyncResult = $this->syncUserPosition(
+                operator: $currentUser,
+                targetUser: $targetUser,
+                targetPositionId: $validated['position_id'],
+            );
+
+            if (! $positionSyncResult['ok']) {
+                return response()->json(['status' => 'error', 'message' => $positionSyncResult['message']], 422);
+            }
+
+            if (! empty($positionSyncResult['message'])) {
+                $responseMessages[] = $positionSyncResult['message'];
+            }
         }
 
-        return back()->with('success', '用户资料已更新！');
+        if ($request->wantsJson()) {
+            $message = array_merge(['用户资料已强行更新完毕！'], $responseMessages);
+
+            return response()->json(['status' => 'success', 'message' => implode(' ', $message)]);
+        }
+
+        $message = array_merge(['用户资料已更新！'], $responseMessages);
+
+        return back()->with('success', implode(' ', $message));
     }
 
     /**
@@ -215,14 +241,111 @@ class UserManagerController extends Controller
             abort(403, '权限不足：无法删除同级或高级账号！');
         }
 
-        // 管理员保护：达到踢人等级(level_kick)的用户视为管理员，不可被强杀
-        $levelKick = (int) \App\Models\Sysparam::getValue('level_kick', '10');
-        if ($targetUser->user_level >= $levelKick) {
-            abort(403, '该用户为管理员，不允许强杀！请先在用户编辑中降低其等级。');
+        // 任命体系保护：仍持有在职职务的账号不可直接强杀，必须先走撤职流程。
+        $targetUser->loadMissing('activePosition.position');
+        if ($targetUser->id === 1 || $targetUser->activePosition?->position) {
+            abort(403, '该用户当前拥有在职职务，不允许强杀！请先撤销职务。');
         }
 
         $targetUser->delete();
 
         return back()->with('success', '目标已被物理删除。');
     }
+
+    /**
+     * 方法功能：同步后台编辑页选择的目标职务。
+     *
+     * @return array{ok: bool, message: string}
+     */
+    private function syncUserPosition(User $operator, User $targetUser, ?int $targetPositionId): array
+    {
+        $currentAssignment = $this->appointmentService->getActivePosition($targetUser);
+        $currentPositionId = $currentAssignment?->position_id;
+
+        if ($targetPositionId === $currentPositionId) {
+            return ['ok' => true, 'message' => ''];
+        }
+
+        if ($targetPositionId === null) {
+            if (! $currentAssignment) {
+                return ['ok' => true, 'message' => ''];
+            }
+
+            $result = $this->appointmentService->revoke($operator, $targetUser, '后台用户管理编辑');
+            if (! $result['ok']) {
+                return $result;
+            }
+
+            $this->broadcastRevokedPosition($operator, $targetUser, $currentAssignment);
+
+            return ['ok' => true, 'message' => '用户职务已撤销。'];
+        }
+
+        $targetPosition = Position::with('department')->findOrFail($targetPositionId);
+
+        if ($currentAssignment) {
+            $revokeResult = $this->appointmentService->revoke($operator, $targetUser, '后台用户管理编辑');
+            if (! $revokeResult['ok']) {
+                return $revokeResult;
+            }
+        }
+
+        $appointResult = $this->appointmentService->appoint($operator, $targetUser, $targetPosition, '后台用户管理编辑');
+        if (! $appointResult['ok']) {
+            return $appointResult;
+        }
+
+        $this->broadcastAppointedPosition($operator, $targetUser, $targetPosition);
+
+        return ['ok' => true, 'message' => "用户职务已更新为【{$targetPosition->name}】。"];
+    }
+
+    /**
+     * 方法功能：广播后台任命成功后的公告与目标用户刷新事件。
+     */
+    private function broadcastAppointedPosition(User $operator, User $targetUser, Position $targetPosition): void
+    {
+        foreach ($this->chatState->getAllActiveRoomIds() as $roomId) {
+            broadcast(new AppointmentAnnounced(
+                roomId: $roomId,
+                targetUsername: $targetUser->username,
+                positionIcon: $targetPosition->icon ?? '🎖️',
+                positionName: $targetPosition->name,
+                departmentName: $targetPosition->department?->name ?? '',
+                operatorName: $operator->username,
+            ));
+        }
+
+        broadcast(new UserBrowserRefreshRequested(
+            targetUserId: $targetUser->id,
+            operator: $operator->username,
+            reason: '你的职务已发生变更，页面权限正在同步更新。',
+        ));
+    }
+
+    /**
+     * 方法功能：广播后台撤销职务后的公告与目标用户刷新事件。
+     */
+    private function broadcastRevokedPosition(User $operator, User $targetUser, UserPosition $currentAssignment): void
+    {
+        $currentAssignment->loadMissing('position.department');
+
+        foreach ($this->chatState->getAllActiveRoomIds() as $roomId) {
+            broadcast(new AppointmentAnnounced(
+                roomId: $roomId,
+                targetUsername: $targetUser->username,
+                positionIcon: $currentAssignment->position?->icon ?? '🎖️',
+                positionName: $currentAssignment->position?->name ?? '',
+                departmentName: $currentAssignment->position?->department?->name ?? '',
+                operatorName: $operator->username,
+                type: 'revoke',
+            ));
+        }
+
+        broadcast(new UserBrowserRefreshRequested(
+            targetUserId: $targetUser->id,
+            operator: $operator->username,
+            reason: '你的职务已被撤销，页面权限正在同步更新。',
+        ));
+    }
 }

app/Http/Controllers/AdminCommandController.php

@@ -4,7 +4,7 @@
  * 文件功能：管理员聊天室实时命令控制器
  *
  * 提供管理员在聊天室内对用户执行的管理操作：
- * 警告(=J)、踢出(=T)、禁言(=B)、冻结(=Y)、查看私信(=S)、站长公屏讲话。
+ * 警告(=J)、踢出(=T)、禁言(=B)、封号、封IP、查看私信(=S)、职务公屏讲话。
  *
  * 对应原 ASP 文件：DOUSER.ASP / KILLUSER.ASP / LOCKIP.ASP / NEWSAY.ASP
  *
@@ -16,21 +16,29 @@
 namespace App\Http\Controllers;
 
 use App\Enums\CurrencySource;
+use App\Events\BrowserRefreshRequested;
 use App\Events\EffectBroadcast;
 use App\Events\MessageSent;
 use App\Jobs\SaveMessageJob;
 use App\Models\Message;
 use App\Models\PositionAuthorityLog;
+use App\Models\Room;
 use App\Models\Sysparam;
 use App\Models\User;
 use App\Services\ChatStateService;
+use App\Services\PositionPermissionService;
 use App\Services\UserCurrencyService;
+use App\Support\ChatContentSanitizer;
+use App\Support\PositionPermissionRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Redis;
 use Illuminate\Validation\Rule;
 
+/**
+ * 类功能：处理聊天室内的实时管理命令与部分职务奖励操作。
+ */
 class AdminCommandController extends Controller
 {
     /**
@@ -39,6 +47,7 @@ class AdminCommandController extends Controller
     public function __construct(
         private readonly ChatStateService $chatState,
         private readonly UserCurrencyService $currencyService,
+        private readonly PositionPermissionService $positionPermissionService,
     ) {}
 
     /**
@@ -59,12 +68,25 @@ class AdminCommandController extends Controller
 
         $admin = Auth::user();
         $targetUsername = $request->input('username');
-        $roomId = $request->input('room_id');
-        $reason = $request->input('reason', '请注意言行');
+        $roomId = (int) $request->input('room_id');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
+        }
 
-        // 权限检查（等级由 level_warn 配置）
-        if (! $this->canExecute($admin, $targetUsername, 'level_warn', '5')) {
-            return response()->json(['status' => 'error', 'message' => '权限不足'], 403);
+        $reason = ChatContentSanitizer::htmlText($request->input('reason', '请注意言行'));
+        $safeTargetUsername = ChatContentSanitizer::htmlText($targetUsername);
+        $operatorDisplay = $this->buildOperatorDisplayHtml($admin);
+
+        // 权限检查：必须拥有职务权限，且不能处理职务高于自己的用户。
+        $authorization = $this->authorizeModerationAction($admin, $targetUsername, PositionPermissionRegistry::USER_WARN, '警告');
+        if (! $authorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $authorization['message']], 403);
+        }
+
+        $targetAuthorization = $this->authorizeTargetOnlineInRoom($roomId, $targetUsername);
+        if (! $targetAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $targetAuthorization['message']], 403);
         }
 
         // 广播警告消息
@@ -73,7 +95,7 @@ class AdminCommandController extends Controller
             'room_id' => $roomId,
             'from_user' => '系统传音',
             'to_user' => '大家',
-            'content' => "⚠️ 管理员 <b>{$admin->username}</b> 警告 <b>{$targetUsername}</b>：{$reason}",
+            'content' => "⚠️ {$operatorDisplay} 警告 <b>{$safeTargetUsername}</b>：{$reason}",
             'is_secret' => false,
             'font_color' => '#dc2626',
             'action' => '',
@@ -87,9 +109,9 @@ class AdminCommandController extends Controller
         $this->pushTargetToastMessage(
             roomId: (int) $roomId,
             targetUsername: $targetUsername,
-            content: "⚠️ 管理员 <b>{$admin->username}</b> 警告了你：{$reason}",
+            content: "⚠️ {$operatorDisplay} 警告了你：{$reason}",
             title: '⚠️ 收到警告',
-            toastMessage: "<b>{$admin->username}</b> 警告了你：{$reason}",
+            toastMessage: "{$operatorDisplay} 警告了你：{$reason}",
             color: '#f59e0b',
             icon: '⚠️',
         );
@@ -115,21 +137,34 @@ class AdminCommandController extends Controller
 
         $admin = Auth::user();
         $targetUsername = $request->input('username');
-        $roomId = $request->input('room_id');
-        $reason = $request->input('reason', '违反聊天室规则');
+        $roomId = (int) $request->input('room_id');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
+        }
 
-        // 权限检查（等级由 level_kick 配置）
-        if (! $this->canExecute($admin, $targetUsername, 'level_kick', '10')) {
-            return response()->json(['status' => 'error', 'message' => '权限不足'], 403);
+        $reason = ChatContentSanitizer::htmlText($request->input('reason', '违反聊天室规则'));
+        $safeTargetUsername = ChatContentSanitizer::htmlText($targetUsername);
+        $operatorDisplay = $this->buildOperatorDisplayHtml($admin);
+
+        // 权限检查：必须拥有职务权限，且不能处理职务高于自己的用户。
+        $authorization = $this->authorizeModerationAction($admin, $targetUsername, PositionPermissionRegistry::USER_KICK, '踢出');
+        if (! $authorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $authorization['message']], 403);
+        }
+
+        $targetAuthorization = $this->authorizeTargetOnlineInRoom($roomId, $targetUsername);
+        if (! $targetAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $targetAuthorization['message']], 403);
         }
 
         // 在强制踢出前补发目标私聊提示，尽量让对方先看到 toast。
         $this->pushTargetToastMessage(
             roomId: (int) $roomId,
             targetUsername: $targetUsername,
-            content: "🚫 管理员 <b>{$admin->username}</b> 已将你踢出聊天室。原因：{$reason}",
+            content: "🚫 {$operatorDisplay} 已将你踢出聊天室。原因：{$reason}",
             title: '🚫 已被踢出',
-            toastMessage: "<b>{$admin->username}</b> 已将你踢出聊天室。<br>原因：{$reason}",
+            toastMessage: "{$operatorDisplay} 已将你踢出聊天室。<br>原因：{$reason}",
             color: '#ef4444',
             icon: '🚫',
         );
@@ -143,7 +178,7 @@ class AdminCommandController extends Controller
             'room_id' => $roomId,
             'from_user' => '系统传音',
             'to_user' => '大家',
-            'content' => "🚫 管理员 <b>{$admin->username}</b> 已将 <b>{$targetUsername}</b> 踢出聊天室。原因：{$reason}",
+            'content' => "🚫 {$operatorDisplay} 已将 <b>{$safeTargetUsername}</b> 踢出聊天室。原因：{$reason}",
             'is_secret' => false,
             'font_color' => '#dc2626',
             'action' => '',
@@ -177,12 +212,26 @@ class AdminCommandController extends Controller
 
         $admin = Auth::user();
         $targetUsername = $request->input('username');
-        $roomId = $request->input('room_id');
-        $duration = $request->input('duration');
+        $roomId = (int) $request->input('room_id');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
+        }
 
-        // 权限检查（等级由 level_mute 配置）
-        if (! $this->canExecute($admin, $targetUsername, 'level_mute', '8')) {
-            return response()->json(['status' => 'error', 'message' => '权限不足'], 403);
+        $duration = $request->input('duration');
+        $safeTargetUsername = ChatContentSanitizer::htmlText($targetUsername);
+        $operatorDisplay = $this->buildOperatorDisplayHtml($admin);
+        $operatorLabel = $this->buildOperatorIdentityLabel($admin).' '.$admin->username;
+
+        // 权限检查：必须拥有职务权限，且不能处理职务高于自己的用户。
+        $authorization = $this->authorizeModerationAction($admin, $targetUsername, PositionPermissionRegistry::USER_MUTE, '禁言');
+        if (! $authorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $authorization['message']], 403);
+        }
+
+        $targetAuthorization = $this->authorizeTargetOnlineInRoom($roomId, $targetUsername);
+        if (! $targetAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $targetAuthorization['message']], 403);
         }
 
         // 设置 Redis 禁言标记，TTL 自动过期
@@ -195,7 +244,7 @@ class AdminCommandController extends Controller
             'room_id' => $roomId,
             'from_user' => '系统传音',
             'to_user' => '大家',
-            'content' => "🔇 管理员 <b>{$admin->username}</b> 已将 <b>{$targetUsername}</b> 禁言 {$duration} 分钟。",
+            'content' => "🔇 {$operatorDisplay} 已将 <b>{$safeTargetUsername}</b> 禁言 {$duration} 分钟。",
             'is_secret' => false,
             'font_color' => '#dc2626',
             'action' => '',
@@ -209,9 +258,9 @@ class AdminCommandController extends Controller
         $this->pushTargetToastMessage(
             roomId: (int) $roomId,
             targetUsername: $targetUsername,
-            content: "🔇 管理员 <b>{$admin->username}</b> 已将你禁言 {$duration} 分钟。",
+            content: "🔇 {$operatorDisplay} 已将你禁言 {$duration} 分钟。",
             title: '🔇 已被禁言',
-            toastMessage: "<b>{$admin->username}</b> 已将你禁言 <b>{$duration}</b> 分钟。",
+            toastMessage: "{$operatorDisplay} 已将你禁言 <b>{$duration}</b> 分钟。",
             color: '#6366f1',
             icon: '🔇',
         );
@@ -221,21 +270,22 @@ class AdminCommandController extends Controller
             roomId: $roomId,
             username: $targetUsername,
             muteTime: $duration,
-            operator: $admin->username,
+            message: "{$operatorLabel} 已将 [{$targetUsername}] 禁言 {$duration} 分钟。",
+            operator: $operatorLabel,
         ));
 
         return response()->json(['status' => 'success', 'message' => "已禁言 {$targetUsername} {$duration} 分钟"]);
     }
 
     /**
-     * 冻结用户账号（=Y 理由）
+     * 封禁用户账号。
      *
-     * 将用户账号状态设为冻结，禁止登录。
+     * 将目标账号设为封禁状态，并将其从当前在线房间中移出。
      *
-     * @param  Request  $request  请求对象，需包含 username, reason
+     * @param  Request  $request  请求对象，需包含 username, room_id, reason
      * @return JsonResponse 操作结果
      */
-    public function freeze(Request $request): JsonResponse
+    public function ban(Request $request): JsonResponse
     {
         $request->validate([
             'username' => 'required|string',
@@ -245,48 +295,51 @@ class AdminCommandController extends Controller
 
         $admin = Auth::user();
         $targetUsername = $request->input('username');
-        $roomId = $request->input('room_id');
-        $reason = $request->input('reason', '违反聊天室规则');
-
-        // 权限检查（等级由 level_freeze 配置）
-        if (! $this->canExecute($admin, $targetUsername, 'level_freeze', '14')) {
-            return response()->json(['status' => 'error', 'message' => '权限不足'], 403);
+        $roomId = (int) $request->input('room_id');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
         }
 
-        // 冻结用户账号（将等级设为 -1 表示冻结）
-        $target = User::where('username', $targetUsername)->first();
-        if (! $target) {
-            return response()->json(['status' => 'error', 'message' => '用户不存在'], 404);
+        $reason = ChatContentSanitizer::htmlText($request->input('reason', '严重违规'));
+        $safeTargetUsername = ChatContentSanitizer::htmlText($targetUsername);
+        $operatorDisplay = $this->buildOperatorDisplayHtml($admin);
+
+        // 权限检查：必须拥有职务权限，且不能处理职务高于自己的用户。
+        $authorization = $this->authorizeModerationAction($admin, $targetUsername, PositionPermissionRegistry::USER_BAN, '封禁');
+        if (! $authorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $authorization['message']], 403);
         }
+
+        $targetAuthorization = $this->authorizeTargetOnlineInRoom($roomId, $targetUsername);
+        if (! $targetAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $targetAuthorization['message']], 403);
+        }
+
+        $target = $authorization['target'];
         $target->user_level = -1;
         $target->save();
 
-        // 先给被冻结用户补发私聊提示，再将其移出各房间并强制下线。
         $this->pushTargetToastMessage(
-            roomId: (int) $roomId,
+            roomId: $roomId,
             targetUsername: $targetUsername,
-            content: "🧊 管理员 <b>{$admin->username}</b> 已冻结你的账号。原因：{$reason}",
-            title: '🧊 账号已冻结',
-            toastMessage: "<b>{$admin->username}</b> 已冻结你的账号。<br>原因：{$reason}",
-            color: '#3b82f6',
-            icon: '🧊',
+            content: "⛔ {$operatorDisplay} 已封禁你的账号。原因：{$reason}",
+            title: '⛔ 账号已封禁',
+            toastMessage: "{$operatorDisplay} 已封禁你的账号。<br>原因：{$reason}",
+            color: '#991b1b',
+            icon: '⛔',
         );
 
-        // 从所有房间移除
-        $rooms = $this->chatState->getUserRooms($targetUsername);
-        foreach ($rooms as $rid) {
-            $this->chatState->userLeave($rid, $targetUsername);
-        }
+        $this->removeUserFromAllRooms($targetUsername);
 
-        // 广播冻结消息
         $msg = [
             'id' => $this->chatState->nextMessageId($roomId),
             'room_id' => $roomId,
             'from_user' => '系统传音',
             'to_user' => '大家',
-            'content' => "🧊 管理员 <b>{$admin->username}</b> 已冻结 <b>{$targetUsername}</b> 的账号。原因：{$reason}",
+            'content' => "⛔ {$operatorDisplay} 已封禁 <b>{$safeTargetUsername}</b> 的账号。原因：{$reason}",
             'is_secret' => false,
-            'font_color' => '#dc2626',
+            'font_color' => '#991b1b',
             'action' => '',
             'sent_at' => now()->toDateTimeString(),
         ];
@@ -294,10 +347,93 @@ class AdminCommandController extends Controller
         broadcast(new MessageSent($roomId, $msg));
         SaveMessageJob::dispatch($msg);
 
-        // 广播踢出事件
-        broadcast(new \App\Events\UserKicked($roomId, $targetUsername, "账号已被冻结：{$reason}"));
+        broadcast(new \App\Events\UserKicked($roomId, $targetUsername, "账号已被封禁：{$reason}"));
 
-        return response()->json(['status' => 'success', 'message' => "已冻结 {$targetUsername} 的账号"]);
+        return response()->json(['status' => 'success', 'message' => "已封禁 {$targetUsername} 的账号"]);
+    }
+
+    /**
+     * 封禁用户 IP。
+     *
+     * 将目标账号设为封禁状态并把最近登录 IP 写入黑名单。
+     *
+     * @param  Request  $request  请求对象，需包含 username, room_id, reason
+     * @return JsonResponse 操作结果
+     */
+    public function banIp(Request $request): JsonResponse
+    {
+        $request->validate([
+            'username' => 'required|string',
+            'room_id' => 'required|integer',
+            'reason' => 'nullable|string|max:200',
+        ]);
+
+        $admin = Auth::user();
+        $targetUsername = $request->input('username');
+        $roomId = (int) $request->input('room_id');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
+        }
+
+        $reason = ChatContentSanitizer::htmlText($request->input('reason', '严重违规'));
+        $safeTargetUsername = ChatContentSanitizer::htmlText($targetUsername);
+        $operatorDisplay = $this->buildOperatorDisplayHtml($admin);
+
+        // 权限检查：必须拥有职务权限，且不能处理职务高于自己的用户。
+        $authorization = $this->authorizeModerationAction($admin, $targetUsername, PositionPermissionRegistry::USER_BANIP, '封禁 IP ');
+        if (! $authorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $authorization['message']], 403);
+        }
+
+        $targetAuthorization = $this->authorizeTargetOnlineInRoom($roomId, $targetUsername);
+        if (! $targetAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $targetAuthorization['message']], 403);
+        }
+
+        $target = $authorization['target'];
+        $targetIp = (string) ($target->last_ip ?? '');
+        if ($targetIp !== '') {
+            Redis::sadd('banned_ips', $targetIp);
+        }
+
+        $target->user_level = -1;
+        $target->save();
+
+        $this->pushTargetToastMessage(
+            roomId: $roomId,
+            targetUsername: $targetUsername,
+            content: "🌐 {$operatorDisplay} 已封禁你的 IP 并冻结账号。原因：{$reason}",
+            title: '🌐 IP 已封禁',
+            toastMessage: "{$operatorDisplay} 已封禁你的 IP 并冻结账号。<br>原因：{$reason}",
+            color: '#7c2d12',
+            icon: '🌐',
+        );
+
+        $this->removeUserFromAllRooms($targetUsername);
+
+        $ipSuffix = $targetIp !== '' ? "（IP：{$targetIp}）" : '（未记录有效 IP）';
+        $msg = [
+            'id' => $this->chatState->nextMessageId($roomId),
+            'room_id' => $roomId,
+            'from_user' => '系统传音',
+            'to_user' => '大家',
+            'content' => "🌐 {$operatorDisplay} 已封禁 <b>{$safeTargetUsername}</b> 的 IP 并冻结账号。原因：{$reason} {$ipSuffix}",
+            'is_secret' => false,
+            'font_color' => '#9a3412',
+            'action' => '',
+            'sent_at' => now()->toDateTimeString(),
+        ];
+        $this->chatState->pushMessage($roomId, $msg);
+        broadcast(new MessageSent($roomId, $msg));
+        SaveMessageJob::dispatch($msg);
+
+        broadcast(new \App\Events\UserKicked($roomId, $targetUsername, "IP 已被封禁：{$reason}"));
+
+        return response()->json([
+            'status' => 'success',
+            'message' => $targetIp !== '' ? "已封禁 {$targetUsername} 的 IP 与账号" : "已封禁 {$targetUsername} 的账号，但未记录可封禁 IP",
+        ]);
     }
 
     /**
@@ -321,8 +457,9 @@ class AdminCommandController extends Controller
             abort(403, '仅站长可查看私信');
         }
 
-        // 查询最近 50 条悄悄话（发送或接收）
+        // 查询最近 50 条用户之间的悄悄话，系统发给用户的私信通知不展示到管理查看里。
         $messages = Message::where('is_secret', true)
+            ->where('from_user', 'not like', '系统%')
             ->where(function ($q) use ($username) {
                 $q->where('from_user', $username)
                     ->orWhere('to_user', $username);
@@ -347,9 +484,10 @@ class AdminCommandController extends Controller
     }
 
     /**
-     * 站长公屏讲话
+     * 聊天室公屏讲话
      *
-     * 站长发送全聊天室公告，以特殊样式显示。
+     * 拥有 room.public_broadcast 权限的职务可以发送全聊天室公告，
+     * id=1 站长仍然拥有完整兜底权限。
      *
      * @param  Request  $request  请求对象，需包含 content, room_id
      * @return JsonResponse 操作结果
@@ -362,26 +500,38 @@ class AdminCommandController extends Controller
         ]);
 
         $admin = Auth::user();
-        $superLevel = (int) Sysparam::getValue('superlevel', '100');
-
-        if ($admin->user_level < $superLevel) {
-            return response()->json(['status' => 'error', 'message' => '仅站长可发布公屏讲话'], 403);
+        if (! $this->positionPermissionService->hasPermission($admin, PositionPermissionRegistry::ROOM_PUBLIC_BROADCAST)) {
+            return response()->json(['status' => 'error', 'message' => '当前职务无权发布公屏讲话'], 403);
         }
 
-        $roomId = $request->input('room_id');
-        $content = $request->input('content');
+        $roomId = (int) $request->input('room_id');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
+        }
 
-        // 广播站长公告
+        $content = ChatContentSanitizer::htmlText($request->input('content'));
+
+        // 按当前在职职务拼装发布者身份，避免继续显示为固定“站长公告”
+        $publisherLabel = ChatContentSanitizer::htmlText($this->buildAnnouncementPublisherLabel($admin));
+        $publisherUsername = ChatContentSanitizer::htmlText($admin->username);
         $msg = [
             'id' => $this->chatState->nextMessageId($roomId),
             'room_id' => $roomId,
             'from_user' => '系统公告',
             'to_user' => '大家',
-            'content' => "📢 站长 <b>{$admin->username}</b> 讲话：{$content}",
+            'content' => "📢 <b>{$publisherLabel}</b> <b>{$publisherUsername}</b> 发布公告：{$content}",
             'is_secret' => false,
             'font_color' => '#b91c1c',
             'action' => '',
             'sent_at' => now()->toDateTimeString(),
+            'toast_notification' => [
+                'title' => '📢 公屏公告',
+                'message' => strip_tags($content),
+                'icon' => '📢',
+                'color' => '#b91c1c',
+                'duration' => 10000,
+            ],
         ];
         $this->chatState->pushMessage($roomId, $msg);
         broadcast(new MessageSent($roomId, $msg));
@@ -390,6 +540,189 @@ class AdminCommandController extends Controller
         return response()->json(['status' => 'success', 'message' => '公告已发送']);
     }
 
+    /**
+     * 生成公屏公告发布者身份标签。
+     *
+     * 普通在职用户按“部门+职务”显示；站长无在职职务时保持“站长”标识兜底。
+     */
+    private function buildAnnouncementPublisherLabel(User $user): string
+    {
+        return $this->buildOperatorIdentityLabel($user);
+    }
+
+    /**
+     * 生成操作者的身份标签。
+     *
+     * 有在职职务时统一显示为“部门·职务”，无在职职务的 id=1 兜底显示“站长”。
+     */
+    private function buildOperatorIdentityLabel(User $user): string
+    {
+        $position = $user->activePosition?->position;
+
+        if ($position) {
+            $departmentName = (string) ($position->department?->name ?? '');
+
+            return $departmentName ? "{$departmentName}·{$position->name}" : $position->name;
+        }
+
+        if ($user->id === 1) {
+            return '站长';
+        }
+
+        return '管理员';
+    }
+
+    /**
+     * 生成操作者在聊天室文案中的完整展示文本。
+     */
+    private function buildOperatorDisplayHtml(User $user): string
+    {
+        $identityLabel = e($this->buildOperatorIdentityLabel($user));
+        $username = e($user->username);
+
+        return "<b>{$identityLabel}</b> <b>{$username}</b>";
+    }
+
+    /**
+     * 校验操作者是否可在指定房间执行聊天室管理命令。
+     *
+     * @return array{ok: bool, message: string, room?: Room}
+     */
+    private function authorizeManagedRoom(int $roomId, User $operator): array
+    {
+        $room = Room::query()->find($roomId);
+        if (! $room) {
+            return ['ok' => false, 'message' => '房间不存在'];
+        }
+
+        if (! $room->canUserEnter($operator)) {
+            return ['ok' => false, 'message' => '无权进入该房间，不能执行管理命令'];
+        }
+
+        // 超级管理员（站长 id = 1）豁免必须进房的限制，允许全局管理；普通管理员必须在房间内方可管理
+        if ($operator->id !== 1 && ! $this->chatState->isUserInRoom($roomId, $operator->username)) {
+            return ['ok' => false, 'message' => '请先进入该房间后再执行管理命令'];
+        }
+
+        return ['ok' => true, 'message' => '校验通过', 'room' => $room];
+    }
+
+    /**
+     * 校验目标用户是否仍在线于当前房间。
+     *
+     * @return array{ok: bool, message: string}
+     */
+    private function authorizeTargetOnlineInRoom(int $roomId, string $targetUsername): array
+    {
+        // 系统虚拟机器人账号豁免在线状态校验，允许测试与交互警告
+        if (in_array($targetUsername, ['AI小班长', '星海小博士'])) {
+            return ['ok' => true, 'message' => '校验通过'];
+        }
+
+        if (! $this->chatState->isUserInRoom($roomId, $targetUsername)) {
+            return ['ok' => false, 'message' => '目标用户不在当前房间，无法执行该操作'];
+        }
+
+        return ['ok' => true, 'message' => '校验通过'];
+    }
+
+    /**
+     * 校验聊天室用户管理动作是否可执行。
+     *
+     * 规则：
+     * - id=1 站长始终放行
+     * - 其他人必须拥有对应职务权限
+     * - 不能操作自己
+     * - 不能处理 user_level 高于自己的用户
+     * - 不能处理部门位阶或职务位阶高于自己的用户
+     *
+     * @return array{ok: bool, message: string, target?: User}
+     */
+    private function authorizeModerationAction(
+        User $admin,
+        string $targetUsername,
+        string $permissionCode,
+        string $actionLabel,
+    ): array {
+        if ($admin->id !== 1 && ! $this->positionPermissionService->hasPermission($admin, $permissionCode)) {
+            return ['ok' => false, 'message' => "当前职务无权{$actionLabel}用户"];
+        }
+
+        if ($admin->username === $targetUsername) {
+            return ['ok' => false, 'message' => '不能对自己执行该操作'];
+        }
+
+        $target = User::query()
+            ->where('username', $targetUsername)
+            ->with('activePosition.position.department')
+            ->first();
+
+        if (! $target) {
+            return ['ok' => false, 'message' => '用户不存在'];
+        }
+
+        if (! $this->canModerateTargetByDutyRank($admin, $target)) {
+            return ['ok' => false, 'message' => '不能处理职务高于自己的用户'];
+        }
+
+        if ($admin->id !== 1 && $target->user_level > $admin->user_level) {
+            return ['ok' => false, 'message' => '不能处理等级高于自己的用户'];
+        }
+
+        return ['ok' => true, 'message' => '校验通过', 'target' => $target];
+    }
+
+    /**
+     * 将目标用户从当前在线的全部房间中移除。
+     */
+    private function removeUserFromAllRooms(string $targetUsername): void
+    {
+        $rooms = $this->chatState->getUserRooms($targetUsername);
+
+        foreach ($rooms as $rid) {
+            $this->chatState->userLeave((int) $rid, $targetUsername);
+        }
+    }
+
+    /**
+     * 判断操作者是否可以按职务位阶处理目标用户。
+     *
+     * 规则：
+     * - 先比较部门 rank
+     * - 部门相同再比较职务 rank
+     * - 对方没有在职职务时视为可处理
+     * - 同职务平级允许操作，仅禁止处理更高职务
+     */
+    private function canModerateTargetByDutyRank(User $admin, User $target): bool
+    {
+        if ($admin->id === 1) {
+            return true;
+        }
+
+        $adminPosition = $admin->activePosition?->load('position.department')->position;
+        if (! $adminPosition) {
+            return false;
+        }
+
+        $targetPosition = $target->activePosition?->position;
+        if (! $targetPosition) {
+            return true;
+        }
+
+        $adminDepartmentRank = (int) ($adminPosition->department?->rank ?? 0);
+        $targetDepartmentRank = (int) ($targetPosition->department?->rank ?? 0);
+
+        if ($adminDepartmentRank > $targetDepartmentRank) {
+            return true;
+        }
+
+        if ($adminDepartmentRank < $targetDepartmentRank) {
+            return false;
+        }
+
+        return (int) $adminPosition->rank >= (int) $targetPosition->rank;
+    }
+
     /**
      * 管理员全员清屏
      *
@@ -406,12 +739,15 @@ class AdminCommandController extends Controller
         ]);
 
         $admin = Auth::user();
-        $roomId = $request->input('room_id');
-        $superLevel = (int) Sysparam::getValue('superlevel', '100');
+        $roomId = (int) $request->input('room_id');
+        // 改为按职务权限控制聊天室顶部“清屏”按钮。
+        if (! $this->positionPermissionService->hasPermission($admin, PositionPermissionRegistry::ROOM_CLEAR_SCREEN)) {
+            return response()->json(['status' => 'error', 'message' => '当前职务无权执行全员清屏'], 403);
+        }
 
-        // 需要站长权限才能全员清屏
-        if ($admin->user_level < $superLevel) {
-            return response()->json(['status' => 'error', 'message' => '仅站长可执行全员清屏'], 403);
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
         }
 
         // 清除 Redis 中该房间的消息缓存
@@ -423,11 +759,50 @@ class AdminCommandController extends Controller
         return response()->json(['status' => 'success', 'message' => '已执行全员清屏']);
     }
 
+    /**
+     * 站长触发当前房间全员刷新页面。
+     *
+     * 仅允许 id=1 的站长使用，向当前聊天室在线用户广播刷新事件，
+     * 适用于功能更新后强制让前端重新拉取最新页面状态。
+     */
+    public function refreshAll(Request $request): JsonResponse
+    {
+        $request->validate([
+            'room_id' => 'required|integer',
+            'reason' => 'nullable|string|max:100',
+        ]);
+
+        $admin = Auth::user();
+        if ((int) $admin->id !== 1) {
+            return response()->json(['status' => 'error', 'message' => '仅站长可执行全员刷新'], 403);
+        }
+
+        $roomId = (int) $request->input('room_id');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
+        }
+
+        $reason = ChatContentSanitizer::htmlText($request->input('reason', ''));
+
+        // 立即广播页面刷新指令，确保在线用户尽快拿到最新前端状态。
+        broadcast(new BrowserRefreshRequested(
+            roomId: $roomId,
+            operator: $admin->username,
+            reason: $reason,
+        ));
+
+        return response()->json([
+            'status' => 'success',
+            'message' => '已通知当前房间所有在线用户刷新页面',
+        ]);
+    }
+
     /**
      * 管理员触发全屏特效。
      *
      * 向房间内所有用户广播 EffectBroadcast 事件，前端收到后播放对应 Canvas 动画。
-     * 仅 superlevel 等级管理员可触发。
+     * 仅拥有 room.fullscreen_effect 权限的职务可触发。
      *
      * @param  Request  $request  请求对象，需包含 room_id, type
      * @return JsonResponse 操作结果
@@ -440,13 +815,15 @@ class AdminCommandController extends Controller
         ]);
 
         $admin = Auth::user();
-        $roomId = $request->input('room_id');
+        $roomId = (int) $request->input('room_id');
         $type = $request->input('type');
-        $superLevel = (int) Sysparam::getValue('superlevel', '100');
+        if (! $this->positionPermissionService->hasPermission($admin, PositionPermissionRegistry::ROOM_FULLSCREEN_EFFECT)) {
+            return response()->json(['status' => 'error', 'message' => '当前职务无权触发特效'], 403);
+        }
 
-        // 仅 superlevel 等级可触发特效
-        if ($admin->user_level < $superLevel) {
-            return response()->json(['status' => 'error', 'message' => '仅站长可触发特效'], 403);
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
         }
 
         // 广播特效事件给房间内所有在线用户
@@ -487,6 +864,10 @@ class AdminCommandController extends Controller
         $roomId = (int) $request->input('room_id');
         $amount = (int) $request->input('amount');
         $targetUsername = $request->input('username');
+        $roomAuthorization = $this->authorizeManagedRoom($roomId, $admin);
+        if (! $roomAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $roomAuthorization['message']], 403);
+        }
 
         // 不能给自己发放
         if ($admin->username === $targetUsername) {
@@ -499,12 +880,21 @@ class AdminCommandController extends Controller
             return response()->json(['status' => 'error', 'message' => '用户不存在'], 404);
         }
 
+        $targetAuthorization = $this->authorizeTargetOnlineInRoom($roomId, $targetUsername);
+        if (! $targetAuthorization['ok']) {
+            return response()->json(['status' => 'error', 'message' => $targetAuthorization['message']], 403);
+        }
+
         // id=1 超级管理员：无需职务，无限额限制
         $isSuperAdmin = $admin->id === 1;
         $userPosition = null;
         $position = null;
 
         if (! $isSuperAdmin) {
+            if (! $this->positionPermissionService->hasPermission($admin, PositionPermissionRegistry::ROOM_REWARD)) {
+                return response()->json(['status' => 'error', 'message' => '当前职务无权发放奖励'], 403);
+            }
+
             // ① 必须有在职职务
             $userPosition = $admin->activePosition;
             if (! $userPosition) {
@@ -639,7 +1029,7 @@ class AdminCommandController extends Controller
                 'message' => "<b>{$admin->username}</b>（{$positionName}）向你发放了 <b>{$amount}</b> 枚金币！",
                 'icon' => '💰',
                 'color' => '#f59e0b',
-                'duration' => 8000,
+                'duration' => 3000,
             ],
         ];
         $this->chatState->pushMessage($roomId, $msg);
@@ -721,39 +1111,6 @@ class AdminCommandController extends Controller
         ]);
     }
 
-    /**
-     * 权限检查：管理员是否可对目标用户执行指定操作
-     *
-     * 根据 sysparam 中配置的等级门槛判断权限。
-     *
-     * @param  User  $admin  管理员用户
-     * @param  string  $targetUsername  目标用户名
-     * @param  string  $levelKey  sysparam 中的等级键名（如 level_kick、level_warn）
-     * @param  string  $defaultLevel  默认等级值
-     * @return bool 是否有权限
-     */
-    private function canExecute(User $admin, string $targetUsername, string $levelKey, string $defaultLevel = '5'): bool
-    {
-        // 必须达到该操作所需的最低等级
-        $requiredLevel = (int) Sysparam::getValue($levelKey, $defaultLevel);
-        if ($admin->user_level < $requiredLevel) {
-            return false;
-        }
-
-        // 不能操作自己
-        if ($admin->username === $targetUsername) {
-            return false;
-        }
-
-        // 目标用户等级不能高于操作者（允许平级互相操作）
-        $target = User::where('username', $targetUsername)->first();
-        if ($target && $target->user_level > $admin->user_level) {
-            return false;
-        }
-
-        return true;
-    }
-
     /**
      * 向目标用户补发一条系统私聊消息，并附带右下角 toast 配置。
      */

app/Http/Controllers/BaccaratController.php

@@ -19,17 +19,25 @@ use App\Enums\CurrencySource;
 use App\Models\BaccaratBet;
 use App\Models\BaccaratRound;
 use App\Models\GameConfig;
+use App\Models\User;
 use App\Services\BaccaratLossCoverService;
+use App\Services\GameBetBroadcastService;
+use App\Services\GameRoomScopeService;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 
+/**
+ * 类功能：提供百家乐当前局查询、下注与历史接口。
+ */
 class BaccaratController extends Controller
 {
     public function __construct(
         private readonly UserCurrencyService $currency,
         private readonly BaccaratLossCoverService $lossCoverService,
+        private readonly GameRoomScopeService $roomScopeService,
+        private readonly GameBetBroadcastService $betBroadcastService,
     ) {}
 
     /**
@@ -38,7 +46,13 @@ class BaccaratController extends Controller
     public function currentRound(Request $request): JsonResponse
     {
         $user = $request->user();
-        $round = BaccaratRound::currentRound();
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $user);
+
+        if (! $this->roomScopeService->isRoomAllowedForGame('baccarat', $roomId)) {
+            return response()->json(['round' => null, 'jjb' => (int) ($user->jjb ?? 0)]);
+        }
+
+        $round = BaccaratRound::currentRound($roomId);
 
         if (! $round) {
             return response()->json([
@@ -98,6 +112,11 @@ class BaccaratController extends Controller
             'bet_type' => 'required|in:big,small,triple',
             'amount' => 'required|integer|min:1',
         ]);
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+
+        if (! $this->roomScopeService->isRoomAllowedForGame('baccarat', $roomId)) {
+            return response()->json(['ok' => false, 'message' => '当前房间未开启百家乐。'], 403);
+        }
 
         $config = GameConfig::forGame('baccarat')?->params ?? [];
         $minBet = (int) ($config['min_bet'] ?? 100);
@@ -109,13 +128,13 @@ class BaccaratController extends Controller
 
         $round = BaccaratRound::find($data['round_id']);
 
-        if (! $round || ! $round->isBettingOpen()) {
+        if (! $round || (int) $round->room_id !== $roomId || ! $round->isBettingOpen()) {
             return response()->json(['ok' => false, 'message' => '当前不在下注时间内。']);
         }
 
         $user = $request->user();
 
-        // 检查用户金币余额（金币字段为 jjb）
+        // 快速过滤（非锁）
         if (($user->jjb ?? 0) < $data['amount']) {
             return response()->json(['ok' => false, 'message' => '金币不足，无法下注。']);
         }
@@ -124,10 +143,21 @@ class BaccaratController extends Controller
         $lossCoverService = $this->lossCoverService;
 
         return DB::transaction(function () use ($user, $round, $data, $currency, $lossCoverService): JsonResponse {
-            // 幂等：同一局只能下一注
+            // 1. 悲观锁锁定用户行
+            $lockedUser = User::query()
+                ->whereKey($user->id)
+                ->lockForUpdate()
+                ->firstOrFail();
+
+            // 2. 锁保护下二次校验余额
+            if ((int) $lockedUser->jjb < $data['amount']) {
+                return response()->json(['ok' => false, 'message' => '金币不足，无法下注。']);
+            }
+
+            // 3. 幂等：同一局只能下一注
             $existing = BaccaratBet::query()
                 ->where('round_id', $round->id)
-                ->where('user_id', $user->id)
+                ->where('user_id', $lockedUser->id)
                 ->lockForUpdate()
                 ->exists();
 
@@ -135,9 +165,9 @@ class BaccaratController extends Controller
                 return response()->json(['ok' => false, 'message' => '本局您已下注，请等待开奖。']);
             }
 
-            // 扣除金币
+            // 4. 扣除金币，传入锁定的用户实例
             $currency->change(
-                $user,
+                $lockedUser,
                 'gold',
                 -$data['amount'],
                 CurrencySource::BACCARAT_BET,
@@ -149,16 +179,19 @@ class BaccaratController extends Controller
             // 下注时间命中活动窗口时，将本次下注挂到对应的买单活动下。
             $lossCoverEvent = $lossCoverService->findEventForBetTime(now());
 
-            // 写入下注记录
+            // 5. 写入下注记录
             $bet = BaccaratBet::create([
                 'round_id' => $round->id,
-                'user_id' => $user->id,
+                'user_id' => $lockedUser->id,
                 'loss_cover_event_id' => $lossCoverEvent?->id,
                 'bet_type' => $data['bet_type'],
                 'amount' => $data['amount'],
                 'status' => 'pending',
             ]);
 
+            // 同步修改 Auth 内存实例的金币
+            $user->setAttribute('jjb', $lockedUser->jjb);
+
             // 命中活动的下注要同步累计到用户活动记录中，便于后续前台查看。
             $lossCoverService->registerBet($bet);
 
@@ -176,27 +209,7 @@ class BaccaratController extends Controller
                 'big' => '大', 'small' => '小', default => '豹子'
             };
 
-            // 发送系统传音到聊天室，公示该用户的押注信息
-            $chatState = app(\App\Services\ChatStateService::class);
-            $formattedAmount = number_format($data['amount']);
-            $roomId = $round->room_id ?? 1;
-
-            // 格式：🌟 🎲 娜姐 押注了 119 金币（大）！✨
-            $content = "🎲 <b> 【百家乐】【{$user->username}】</b> 押注了 <b>{$formattedAmount}</b> 金币（{$betLabel}）！✨";
-            $msg = [
-                'id' => $chatState->nextMessageId($roomId),
-                'room_id' => $roomId,
-                'from_user' => '系统传音',
-                'to_user' => '大家',
-                'content' => $content,
-                'is_secret' => false,
-                'font_color' => '#d97706',
-                'action' => '',
-                'sent_at' => now()->toDateTimeString(),
-            ];
-            $chatState->pushMessage($roomId, $msg);
-            event(new \App\Events\MessageSent($roomId, $msg));
-            \App\Jobs\SaveMessageJob::dispatch($msg);
+            $this->betBroadcastService->baccarat((int) ($round->room_id ?? 1), $user->username, (int) $data['amount'], $betLabel);
 
             return response()->json([
                 'ok' => true,
@@ -212,7 +225,9 @@ class BaccaratController extends Controller
      */
     public function history(): JsonResponse
     {
+        $roomId = $this->roomScopeService->resolveUserRoomId(auth()->user());
         $rounds = BaccaratRound::query()
+            ->where('room_id', $roomId)
             ->where('status', 'settled')
             ->orderByDesc('id')
             ->limit(10)
@@ -220,4 +235,28 @@ class BaccaratController extends Controller
 
         return response()->json(['history' => $rounds]);
     }
+
+    /**
+     * 前台百家乐历史走势与开奖页面。
+     */
+    public function historyPage(Request $request): \Illuminate\View\View
+    {
+        // 1. 各选项的历史分布统计
+        $summary = [
+            'total_rounds' => BaccaratRound::query()->where('status', 'settled')->count(),
+            'result_dist' => BaccaratRound::query()
+                ->where('status', 'settled')
+                ->select('result', \Illuminate\Support\Facades\DB::raw('count(*) as cnt'))
+                ->groupBy('result')
+                ->pluck('cnt', 'result'),
+        ];
+
+        // 2. 分页拉取所有已结算的局次
+        $rounds = BaccaratRound::query()
+            ->where('status', 'settled')
+            ->orderByDesc('id')
+            ->paginate(30);
+
+        return view('rooms.baccarat-history', compact('rounds', 'summary'));
+    }
 }

app/Http/Controllers/BankController.php

@@ -13,14 +13,25 @@
 
 namespace App\Http\Controllers;
 
+use App\Enums\CurrencySource;
 use App\Models\BankLog;
+use App\Models\Sysparam;
+use App\Models\User;
+use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\DB;
 
+/**
+ * 类功能：处理银行余额、存取款和存款排行展示。
+ */
 class BankController extends Controller
 {
+    public function __construct(
+        private readonly UserCurrencyService $currencyService,
+    ) {}
+
     /**
      * 查询银行余额及最近20条流水记录
      */
@@ -45,20 +56,27 @@ class BankController extends Controller
      */
     public function ranking(Request $request): JsonResponse
     {
+        /** @var User $operator */
+        $operator = Auth::user();
         $direction = strtolower($request->query('sort', 'desc')) === 'asc' ? 'asc' : 'desc';
 
-        $users = \App\Models\User::where('bank_jjb', '>', 0)
+        $users = User::where('bank_jjb', '>', 0)
             ->orderBy('bank_jjb', $direction)
             ->paginate(20, ['id', 'username', 'bank_jjb', 'sex', 'usersf', 'user_level']);
 
         return response()->json([
             'status' => 'success',
-            'ranking' => $users->map(function ($u) {
-                // 提供必要的前端展示字段
+            'ranking' => $users->map(function (User $u) use ($operator) {
+                $canViewBalance = $this->canViewBankBalance($operator, $u);
+
+                // 提供必要的前端展示字段，普通用户查看别人存款时只返回星号，防止前端绕过遮罩。
                 return [
                     'id' => $u->id,
                     'username' => $u->username,
-                    'bank_jjb' => $u->bank_jjb,
+                    'bank_jjb' => $canViewBalance ? ($u->bank_jjb ?? 0) : '******',
+                    'bank_jjb_masked' => ! $canViewBalance,
+                    'can_reveal' => ! $canViewBalance,
+                    'reveal_cost' => UserController::INFO_REVEAL_COST,
                     'sex' => $u->sex,
                     'usersf' => $u->usersf,
                     'user_level' => $u->user_level,
@@ -87,6 +105,7 @@ class BankController extends Controller
         $amount = $request->integer('amount');
         $user = Auth::user();
 
+        // 快速过滤（非锁），降低非法请求穿透到数据库的概率
         if (($user->jjb ?? 0) < $amount) {
             return response()->json([
                 'status' => 'error',
@@ -94,25 +113,49 @@ class BankController extends Controller
             ]);
         }
 
-        DB::transaction(function () use ($user, $amount): void {
-            $user->decrement('jjb', $amount);
-            $user->increment('bank_jjb', $amount);
+        try {
+            DB::transaction(function () use ($user, $amount): void {
+                // 1. 强制在数据库层面对用户行数据加写锁（X锁）
+                $lockedUser = User::query()
+                    ->whereKey($user->id)
+                    ->lockForUpdate()
+                    ->firstOrFail();
 
-            BankLog::create([
-                'user_id' => $user->id,
-                'type' => 'deposit',
-                'amount' => $amount,
-                'balance_after' => $user->fresh()->bank_jjb,
+                // 2. 在锁保护下安全校验最新余额
+                if ((int) $lockedUser->jjb < $amount) {
+                    throw new \Exception('流通金币不足！当前余额 '.(int) $lockedUser->jjb." 枚，无法存入 {$amount} 枚。");
+                }
+
+                // 3. 执行资产扣除，将已加锁的 lockedUser 传给 change 方法
+                $this->currencyService->change($lockedUser, 'gold', -$amount, CurrencySource::BANK_DEPOSIT, "存入银行 {$amount} 金币");
+
+                // 4. 增加银行余额
+                $lockedUser->increment('bank_jjb', $amount);
+
+                // 5. 写入银行流水记录
+                BankLog::create([
+                    'user_id' => $lockedUser->id,
+                    'type' => 'deposit',
+                    'amount' => $amount,
+                    'balance_after' => $lockedUser->fresh()->bank_jjb,
+                ]);
+
+                // 6. 同步 Auth 内存状态，保障同生命周期内其他地方拿到的是正确数据
+                $user->setAttribute('jjb', $lockedUser->jjb);
+                $user->setAttribute('bank_jjb', $lockedUser->bank_jjb);
+            });
+        } catch (\Exception $e) {
+            return response()->json([
+                'status' => 'error',
+                'message' => $e->getMessage(),
             ]);
-        });
-
-        $fresh = $user->fresh();
+        }
 
         return response()->json([
             'status' => 'success',
             'message' => "成功存入 {$amount} 枚金币！",
-            'jjb' => $fresh->jjb,
-            'bank_jjb' => $fresh->bank_jjb,
+            'jjb' => $user->jjb,
+            'bank_jjb' => $user->bank_jjb,
         ]);
     }
 
@@ -130,6 +173,7 @@ class BankController extends Controller
         $amount = $request->integer('amount');
         $user = Auth::user();
 
+        // 快速过滤（非锁）
         if (($user->bank_jjb ?? 0) < $amount) {
             return response()->json([
                 'status' => 'error',
@@ -137,25 +181,63 @@ class BankController extends Controller
             ]);
         }
 
-        DB::transaction(function () use ($user, $amount): void {
-            $user->decrement('bank_jjb', $amount);
-            $user->increment('jjb', $amount);
+        try {
+            DB::transaction(function () use ($user, $amount): void {
+                // 1. 强制在数据库层面对用户行数据加写锁（X锁）
+                $lockedUser = User::query()
+                    ->whereKey($user->id)
+                    ->lockForUpdate()
+                    ->firstOrFail();
 
-            BankLog::create([
-                'user_id' => $user->id,
-                'type' => 'withdraw',
-                'amount' => $amount,
-                'balance_after' => $user->fresh()->bank_jjb,
+                // 2. 校验银行存款是否足够
+                if ((int) $lockedUser->bank_jjb < $amount) {
+                    throw new \Exception('银行余额不足！当前存款 '.($lockedUser->bank_jjb ?? 0)." 枚，无法取出 {$amount} 枚。");
+                }
+
+                // 3. 扣除银行存款
+                $lockedUser->decrement('bank_jjb', $amount);
+
+                // 4. 增加流通金币并记录划转日志
+                $this->currencyService->change($lockedUser, 'gold', $amount, CurrencySource::BANK_WITHDRAW, "取出银行存款 {$amount} 金币");
+
+                // 5. 记录银行账户流水
+                BankLog::create([
+                    'user_id' => $lockedUser->id,
+                    'type' => 'withdraw',
+                    'amount' => $amount,
+                    'balance_after' => $lockedUser->fresh()->bank_jjb,
+                ]);
+
+                // 6. 同步 Auth 内存状态
+                $user->setAttribute('jjb', $lockedUser->jjb);
+                $user->setAttribute('bank_jjb', $lockedUser->bank_jjb);
+            });
+        } catch (\Exception $e) {
+            return response()->json([
+                'status' => 'error',
+                'message' => $e->getMessage(),
             ]);
-        });
-
-        $fresh = $user->fresh();
+        }
 
         return response()->json([
             'status' => 'success',
             'message' => "成功取出 {$amount} 枚金币！",
-            'jjb' => $fresh->jjb,
-            'bank_jjb' => $fresh->bank_jjb,
+            'jjb' => $user->jjb,
+            'bank_jjb' => $user->bank_jjb,
         ]);
     }
+
+    /**
+     * 判断操作者是否可以免费查看目标用户银行存款。
+     */
+    private function canViewBankBalance(User $operator, User $targetUser): bool
+    {
+        if ($operator->id === $targetUser->id) {
+            return true;
+        }
+
+        $superLevel = (int) Sysparam::getValue('superlevel', '100');
+
+        return (int) $operator->user_level >= $superLevel;
+    }
 }

app/Http/Controllers/ChatAppointmentController.php

@@ -14,6 +14,7 @@ namespace App\Http\Controllers;
 
 use App\Events\AppointmentAnnounced;
 use App\Events\MessageSent;
+use App\Events\UserBrowserRefreshRequested;
 use App\Jobs\SaveMessageJob;
 use App\Models\Position;
 use App\Models\User;
@@ -106,6 +107,13 @@ class ChatAppointmentController extends Controller
                     icon: '✨',
                 );
             }
+
+            // 任命成功后，通知目标用户刷新页面，及时同步输入框上方的管理按钮与权限状态。
+            broadcast(new UserBrowserRefreshRequested(
+                targetUserId: (int) $target->id,
+                operator: $operator->username,
+                reason: '你的职务已发生变更，页面权限正在同步更新。',
+            ));
         }
 
         return response()->json([
@@ -161,6 +169,13 @@ class ChatAppointmentController extends Controller
                     icon: '📋',
                 );
             }
+
+            // 撤职成功后，同步通知目标用户刷新页面，移除已失效的管理入口和权限按钮。
+            broadcast(new UserBrowserRefreshRequested(
+                targetUserId: (int) $target->id,
+                operator: $operator->username,
+                reason: '你的职务已被撤销，页面权限正在同步更新。',
+            ));
         }
 
         return response()->json([

app/Http/Controllers/ChatBotController.php

@@ -56,8 +56,12 @@ class ChatBotController extends Controller
         $request->validate([
             'message' => 'required|string|max:2000',
             'room_id' => 'required|integer',
+            'is_secret' => 'nullable|boolean',
         ]);
 
+        // 私聊模式：AI 回复也走悄悄话，仅发言人和 AI 可见
+        $isSecret = (bool) $request->input('is_secret', false);
+
         // 检查全局开关
         $enabled = Sysparam::getValue('chatbot_enabled', '0');
         if ($enabled !== '1') {
@@ -81,19 +85,22 @@ class ChatBotController extends Controller
 
             $reply = $result['reply'];
 
-            // 检查 AI 是否决定给用户发金币
-            if (str_contains($reply, '[ACTION:GIVE_GOLD]')) {
-                $reply = str_replace('[ACTION:GIVE_GOLD]', '', $reply);
+            // 检查 AI 是否决定给用户发金币（新格式：[ACTION:GIVE_GOLD:金额]）
+            if (preg_match('/\[ACTION:GIVE_GOLD:(\d+)\]/', $reply, $matches)) {
+                $aiGoldAmount = (int) $matches[1];
+                $reply = preg_replace('/\[ACTION:GIVE_GOLD:\d+\]/', '', $reply);
                 $reply = trim($reply);
 
                 $maxDailyRewards = (int) Sysparam::getValue('chatbot_max_daily_rewards', '1');
                 $maxGold = (int) Sysparam::getValue('chatbot_max_gold', '5000');
 
+                // 校验 AI 给出的金额在合理范围内
+                $goldAmount = max(100, min($aiGoldAmount, $maxGold));
+
                 $redisKey = 'ai_chat:give_gold:'.date('Ymd').':'.$user->id;
                 $dailyCount = (int) Redis::get($redisKey);
 
                 if ($dailyCount < $maxDailyRewards) {
-                    $goldAmount = rand(100, $maxGold);
 
                     // 常规发福利只检查 AI 当前手上金币，不再为了维持 100 万而自动从银行提钱。
                     if ($aiUser && $this->aiFinance->prepareSpend($aiUser, $goldAmount)) {
@@ -148,14 +155,14 @@ class ChatBotController extends Controller
                 }
             }
 
-            // 广播 AI 回复消息
+            // 广播 AI 回复消息（私聊模式下仅发言人与 AI 可见）
             $botMsg = [
                 'id' => $this->chatState->nextMessageId($roomId),
                 'room_id' => $roomId,
                 'from_user' => 'AI小班长',
                 'to_user' => $user->username,
                 'content' => $reply,
-                'is_secret' => false,
+                'is_secret' => $isSecret,
                 'font_color' => '#16a34a',
                 'action' => '',
                 'sent_at' => now()->toDateTimeString(),

app/Http/Controllers/ChatController.php

@@ -25,10 +25,17 @@ use App\Models\Sysparam;
 use App\Models\User;
 use App\Services\AppointmentService;
 use App\Services\ChatStateService;
+use App\Services\ChatUserPresenceService;
+use App\Services\DailyGameProfitLeaderboardService;
 use App\Services\MessageFilterService;
+use App\Services\PositionPermissionService;
+use App\Services\RideService;
 use App\Services\RoomBroadcastService;
 use App\Services\UserCurrencyService;
 use App\Services\VipService;
+use App\Support\ChatContentSanitizer;
+use App\Support\ChatDailyStatusCatalog;
+use App\Support\PositionPermissionRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Http\UploadedFile;
@@ -52,12 +59,16 @@ class ChatController extends Controller
      */
     public function __construct(
         private readonly ChatStateService $chatState,
+        private readonly ChatUserPresenceService $chatUserPresenceService,
         private readonly MessageFilterService $filter,
         private readonly VipService $vipService,
         private readonly \App\Services\ShopService $shopService,
         private readonly UserCurrencyService $currencyService,
+        private readonly DailyGameProfitLeaderboardService $dailyGameProfitLeaderboardService,
         private readonly AppointmentService $appointmentService,
         private readonly RoomBroadcastService $broadcast,
+        private readonly PositionPermissionService $positionPermissionService,
+        private readonly RideService $rideService,
     ) {}
 
     /**
@@ -102,36 +113,31 @@ class ChatController extends Controller
         }
 
         // 2. 将当前用户加入到 Redis 房间在线列表（包含 VIP 和管理员信息）
-        $superLevel = (int) Sysparam::getValue('superlevel', '100');
-        // 获取当前在职职务信息（用于内容显示）
-        $activePosition = $user->activePosition;
-        $userData = [
-            'user_id' => $user->id,
-            'level' => $user->user_level,
-            'sex' => $user->sex,
-            'headface' => $user->headface,
-            'vip_icon' => $user->vipIcon(),
-            'vip_name' => $user->vipName(),
-            'vip_color' => $user->isVip() ? ($user->vipLevel?->color ?? '') : '',
-            'is_admin' => $user->user_level >= $superLevel,
-            'position_icon' => $activePosition?->position?->icon ?? '',
-            'position_name' => $activePosition?->position?->name ?? '',
-        ];
+        $userData = $this->chatUserPresenceService->build($user);
         $this->chatState->userJoin($id, $user->username, $userData);
         // 记录重新加入房间的精确时间戳（微秒），用于防抖判断（刷新的时候避免闪退闪进播报）
         \Illuminate\Support\Facades\Redis::set("room:{$id}:join_time:{$user->username}", microtime(true));
 
         // 3. 广播和初始化欢迎（仅限初次进入）
         $newbieEffect = null;
+        $initialRideEffect = null;
+        $initialRideEffectOptions = null;
         $initialPresenceTheme = null;
         $initialWelcomeMessage = null;
+        $initialWelcomeMessages = [];
 
         if (! $isAlreadyInRoom) {
             // 广播 UserJoined 事件，通知房间内的其他人
             broadcast(new UserJoined($id, $user->username, $userData))->toOthers();
 
-            // 新人首次进入：赠送 6666 金币、播放满场烟花、发送全场欢迎通告
-            if (! $user->has_received_new_gift) {
+            // 每次进入先清理掉历史中旧的欢迎消息，保证同一个人只保留最后一条
+            // 必须在推送新消息之前执行，否则可能误删刚刚创建的欢迎播报
+            $this->chatState->removeOldWelcomeMessages($id, $user->username);
+
+            // 新人首次进入：赠送 6666 金币、播放满场烟花、发送全场欢迎通告。
+            $user->refresh();
+            $isNewbie = ! $user->has_received_new_gift;
+            if ($isNewbie) {
                 // 通过统一积分服务发放新人礼包 6666 金币并记录流水
                 $this->currencyService->change(
                     $user, 'gold', 6666, CurrencySource::NEWBIE_BONUS, '新人首次入场婿赠的 6666 金币大礼包', $id,
@@ -149,55 +155,127 @@ class ChatController extends Controller
                     'font_color' => '#b91c1c',
                     'action' => '',
                     'welcome_user' => $user->username,
+                    'welcome_kind' => 'newbie_bonus',
                     'sent_at' => now()->toDateTimeString(),
                 ];
                 $this->chatState->pushMessage($id, $newbieMsg);
                 broadcast(new MessageSent($id, $newbieMsg));
+                SaveMessageJob::dispatch($newbieMsg);
+                $initialWelcomeMessages[] = $newbieMsg;
 
                 // 广播烟花特效给此时已在房间的其他用户
                 broadcast(new \App\Events\EffectBroadcast($id, 'fireworks', $user->username))->toOthers();
 
                 // 传给前端，让新人自己的屏幕上也燃放烟花
                 $newbieEffect = 'fireworks';
-            }
 
-            // superlevel 管理员进入：触发全房间烟花 + 系统公告，其他人走通用播报
-            // 每次进入先清理掉历史中旧的欢迎消息，保证同一个人只保留最后一条
-            $this->chatState->removeOldWelcomeMessages($id, $user->username);
+                // AI小班长发送欢迎消息，附带聊天室简单介绍
+                $aiWelcomeTemplates = [
+                    "🫡 呀！新战友【{$user->username}】来了！我是本聊天室的 AI小班长——女兵班长在此！咱们这儿能聊天交友、玩百家乐/赛马/钓鱼/五子棋，还能每日签到领金币、逛商店买道具。有啥不懂的随时问我，班长罩着你！",
+                    "✨ 欢迎新兵【{$user->username}】入伍！我是 AI小班长，你的贴心兵姐姐~ 本聊天室可以群聊私聊、玩各种小游戏（百家乐/赛马/钓鱼/五子棋）、每日签到赚金币。新人有 6666 金币见面礼哦！有问题喊班长！",
+                    "🐻 立正！欢迎【{$user->username}】同志加入！我是这里的 AI小班长，负责带新兵熟悉环境。本聊天室可聊天交友、玩游戏（百家乐/赛马/钓鱼/五子棋/老虎机）、签到领福利、商店买道具。别客气，把这儿当家！",
+                    "💪 热烈欢迎【{$user->username}】！我是 AI小班长，你的战友兼客服兵姐姐。这儿可以聊天、玩游戏（百家乐/赛马/钓鱼）、签到打卡、逛商店，功能多多！有不懂的随时 @我，班长在线答疑！",
+                ];
+                $aiWelcomeContent = $aiWelcomeTemplates[array_rand($aiWelcomeTemplates)];
+
+                $aiWelcomeMsg = [
+                    'id' => $this->chatState->nextMessageId($id),
+                    'room_id' => $id,
+                    'from_user' => 'AI小班长',
+                    'to_user' => '大家',
+                    'content' => $aiWelcomeContent,
+                    'is_secret' => false,
+                    'font_color' => '#16a34a',
+                    'action' => '大声宣告',
+                    'welcome_user' => $user->username,
+                    'welcome_kind' => 'ai_newbie_welcome',
+                    'sent_at' => now()->toDateTimeString(),
+                ];
+                $this->chatState->pushMessage($id, $aiWelcomeMsg);
+                broadcast(new MessageSent($id, $aiWelcomeMsg));
+                SaveMessageJob::dispatch($aiWelcomeMsg);
+                $initialWelcomeMessages[] = $aiWelcomeMsg;
+            }
 
             // 统一走通用进场播报逻辑，管理员不再发送单独的特殊登录提示。
-            [$text, $color] = $this->broadcast->buildEntryBroadcast($user);
-            $vipPresencePayload = $this->broadcast->buildVipPresencePayload($user, 'join');
+            $ridePresencePayload = $this->rideService->buildPresencePayload($user);
+            if (! $ridePresencePayload) {
+                [$text, $color] = $this->broadcast->buildEntryBroadcast($user);
+                $vipPresencePayload = $this->broadcast->buildVipPresencePayload($user, 'join');
 
-            $generalWelcomeMsg = [
-                'id' => $this->chatState->nextMessageId($id),
-                'room_id' => $id,
-                'from_user' => '进出播报',
-                'to_user' => '大家',
-                'content' => "<span style=\"color: {$color}; font-weight: bold;\">{$text}</span>",
-                'is_secret' => false,
-                'font_color' => $color,
-                'action' => empty($vipPresencePayload) ? 'system_welcome' : 'vip_presence',
-                'welcome_user' => $user->username,
-                'sent_at' => now()->toDateTimeString(),
-            ];
+                $generalWelcomeMsg = [
+                    'id' => $this->chatState->nextMessageId($id),
+                    'room_id' => $id,
+                    'from_user' => '进出播报',
+                    'to_user' => '大家',
+                    'content' => "<span style=\"color: {$color}; font-weight: bold;\">{$text}</span>",
+                    'is_secret' => false,
+                    'font_color' => $color,
+                    'action' => empty($vipPresencePayload) ? 'system_welcome' : 'vip_presence',
+                    'welcome_user' => $user->username,
+                    'welcome_kind' => 'entry_broadcast',
+                    'sent_at' => now()->toDateTimeString(),
+                ];
 
-            // 当会员等级带有专属主题时，把横幅与特效字段并入系统消息，供前端展示豪华进场效果。
-            if (! empty($vipPresencePayload)) {
-                $generalWelcomeMsg = array_merge($generalWelcomeMsg, $vipPresencePayload);
-                $initialPresenceTheme = $vipPresencePayload;
+                // 当会员等级带有专属主题时，把横幅与特效字段并入系统消息，供前端展示豪华进场效果。
+                if (! empty($vipPresencePayload)) {
+                    $generalWelcomeMsg = array_merge($generalWelcomeMsg, $vipPresencePayload);
+                    $initialPresenceTheme = $vipPresencePayload;
+                }
+
+                // 把当前这次进房生成的欢迎消息带回前端，确保用户自己也一定能看到。
+                $initialWelcomeMessage = $generalWelcomeMsg;
+                $initialWelcomeMessages[] = $generalWelcomeMsg;
+
+                $this->chatState->pushMessage($id, $generalWelcomeMsg);
+                // 修复：之前使用了 ->toOthers() 导致自己看不到自己的进场提示
+                broadcast(new MessageSent($id, $generalWelcomeMsg));
+
+                // 会员专属特效需要单独广播给其他在线成员，自己则在页面初始化后本地补播。
+                if (! empty($vipPresencePayload['presence_effect'])) {
+                    broadcast(new \App\Events\EffectBroadcast($id, $vipPresencePayload['presence_effect'], $user->username))->toOthers();
+                }
             }
 
-            // 把当前这次进房生成的欢迎消息带回前端，确保用户自己也一定能看到。
-            $initialWelcomeMessage = $generalWelcomeMsg;
+            if ($ridePresencePayload) {
+                $rideWelcomeMsg = [
+                    'id' => $this->chatState->nextMessageId($id),
+                    'room_id' => $id,
+                    'from_user' => '座驾播报',
+                    'to_user' => '大家',
+                    'content' => "<span style=\"color:#0f766e;font-weight:bold;\">{$ridePresencePayload['ride_icon']} {$ridePresencePayload['identity_text']} · {$ridePresencePayload['welcome_text']}</span>",
+                    'is_secret' => false,
+                    'font_color' => '#0f766e',
+                    'action' => 'ride_presence',
+                    'welcome_user' => $user->username,
+                    'welcome_kind' => 'ride_presence',
+                    'ride_key' => $ridePresencePayload['ride_key'],
+                    'ride_name' => $ridePresencePayload['ride_name'],
+                    'effect_title' => $ridePresencePayload['effect_title'],
+                    'effect_user_info' => $ridePresencePayload['effect_user_info'],
+                    'sent_at' => now()->toDateTimeString(),
+                ];
 
-            $this->chatState->pushMessage($id, $generalWelcomeMsg);
-            // 修复：之前使用了 ->toOthers() 导致自己看不到自己的进场提示
-            broadcast(new MessageSent($id, $generalWelcomeMsg));
+                // 座驾进场独立追加一条播报，并广播全屏特效给其他在线用户。
+                $this->chatState->pushMessage($id, $rideWelcomeMsg);
+                broadcast(new MessageSent($id, $rideWelcomeMsg));
+                broadcast(new \App\Events\EffectBroadcast(
+                    $id,
+                    $ridePresencePayload['ride_key'],
+                    $user->username,
+                    effectTitle: $ridePresencePayload['effect_title'],
+                    rideName: $ridePresencePayload['ride_name'],
+                    effectUserInfo: $ridePresencePayload['effect_user_info'],
+                ))->toOthers();
 
-            // 会员专属特效需要单独广播给其他在线成员，自己则在页面初始化后本地补播。
-            if (! empty($vipPresencePayload['presence_effect'])) {
-                broadcast(new \App\Events\EffectBroadcast($id, $vipPresencePayload['presence_effect'], $user->username))->toOthers();
+                $initialRideEffect = $ridePresencePayload['ride_key'];
+                $initialRideEffectOptions = [
+                    'effect_title' => $ridePresencePayload['effect_title'],
+                    'effect_user_info' => $ridePresencePayload['effect_user_info'],
+                    'ride_name' => $ridePresencePayload['ride_name'],
+                    'operator' => $user->username,
+                ];
+                $initialWelcomeMessages[] = $rideWelcomeMsg;
             }
         }
 
@@ -220,8 +298,8 @@ class ChatController extends Controller
                 return $fromUser === $username || $toUser === $username;
             }
 
-            // 对特定人说话：只显示发给自己或自己发出的（含系统通知）
-            return $fromUser === $username || $toUser === $username;
+            // 非悄悄话的定向发言仍属于公屏消息，历史回放也要让房间内其他人可见。
+            return true;
         }));
 
         // 7. 如果用户有在职職务，开始记录这次入场的心跳登录 (仅初次)
@@ -278,17 +356,27 @@ class ChatController extends Controller
             ];
         }
 
-        // 渲染主聊天框架视图
+        // 渲染主聊天框架视图前，先计算当前用户的聊天室顶部管理权限。
+        $roomPermissionMap = $this->positionPermissionService->permissionMapForUser($user);
+
         return view('chat.frame', [
             'room' => $room,
             'user' => $user,
             'weekEffect' => $this->shopService->getActiveWeekEffect($user),
             'newbieEffect' => $newbieEffect,
+            'initialRideEffect' => $initialRideEffect,
+            'initialRideEffectOptions' => $initialRideEffectOptions,
             'initialPresenceTheme' => $initialPresenceTheme,
             'initialWelcomeMessage' => $initialWelcomeMessage,
+            'initialWelcomeMessages' => $initialWelcomeMessages,
             'historyMessages' => $historyMessages,
             'pendingProposal' => $pendingProposalData,
             'pendingDivorce' => $pendingDivorceData,
+            'roomPermissionMap' => $roomPermissionMap,
+            'hasRoomManagementPermission' => in_array(true, $roomPermissionMap, true),
+            'dailyGameProfitLeaders' => $this->dailyGameProfitLeaderboardService->topThree(),
+            'dailyStatusCatalog' => ChatDailyStatusCatalog::groupedOptions(),
+            'activeDailyStatus' => $this->chatUserPresenceService->currentDailyStatus($user),
         ]);
     }
 
@@ -355,6 +443,10 @@ class ChatController extends Controller
         $user = Auth::user();
         $imagePayload = null;
 
+        if ($response = $this->ensureUserCanActInRoom($id, $user, '请先进入当前房间后再发言。')) {
+            return $response;
+        }
+
         // 0. 检查用户是否被禁言（Redis TTL 自动过期）
         $muteKey = "mute:{$id}:{$user->username}";
         if (Redis::exists($muteKey)) {
@@ -410,6 +502,21 @@ class ChatController extends Controller
             $messageData = array_merge($messageData, $imagePayload);
         }
 
+        // 欢迎动作：增加右下角弹窗通知（内容含发送者信息）
+        if (($data['action'] ?? '') === '欢迎') {
+            $messageData['toast_notification'] = [
+                'title' => '👋 欢迎',
+                'message' => strip_tags($pureContent),
+                'icon' => '👋',
+                'color' => '#e11d48',
+                'duration' => 3000,
+            ];
+        }
+
+        // 6.5 将用户当前激活的消息装扮注入广播 payload（气泡样式 + 昵称颜色），前端据此渲染消息外观
+        $decorations = app(\App\Services\DecorationService::class)->getDecorationsForMessage($user);
+        $messageData = array_merge($messageData, $decorations);
+
         // 3. 压入 Redis 缓存列表 (防炸内存，只保留最近 N 条)
         $this->chatState->pushMessage($id, $messageData);
 
@@ -512,26 +619,20 @@ class ChatController extends Controller
         $superLevel = (int) Sysparam::getValue('superlevel', '100');
         $leveledUp = $this->calculateNewLevel($user, $superLevel);
 
-        $user->save(); // 存点入库
+        $hasChanges = $leveledUp || ($canGainReward && ($actualExpGain > 0 || $actualJjbGain > 0));
+
+        if ($hasChanges) {
+            $user->save(); // 存点入库
+            // 将新的等级与资产状态反馈给当前用户的在线名单上，确保别人查看到的也是最准确等级
+            $this->chatState->userJoin($id, $user->username, $this->chatUserPresenceService->build($user));
+        } else {
+            // 无变动时，仅在 Redis 层面保活该用户的在线状态，拒绝写库并减少 Redis HSET 负荷
+            $this->chatState->refreshAlive($id, $user->username);
+        }
 
         // 手动心跳存点：同步更新在职用户的勤务时长
         $this->tickDutyLog($user, $id);
 
-        // 3. 将新的等级反馈给当前用户的在线名单上
-        // 确保刚刚升级后别人查看到的也是最准确等级
-        $activePosition = $user->activePosition;
-        $this->chatState->userJoin($id, $user->username, [
-            'level' => $user->user_level,
-            'sex' => $user->sex,
-            'headface' => $user->headface,
-            'vip_icon' => $user->vipIcon(),
-            'vip_name' => $user->vipName(),
-            'vip_color' => $user->isVip() ? ($user->vipLevel?->color ?? '') : '',
-            'is_admin' => $user->user_level >= $superLevel,
-            'position_icon' => $activePosition?->position?->icon ?? '',
-            'position_name' => $activePosition?->position?->name ?? '',
-        ]);
-
         // 4. 如果突破境界，向全房系统喊话广播！
         if ($leveledUp) {
             // 生成炫酷广播消息发向该频道
@@ -647,6 +748,7 @@ class ChatController extends Controller
         } elseif ($user->user_level >= $superLevel) {
             $title = '管理员';
         }
+        $identitySummary = $this->chatUserPresenceService->buildIdentitySummary($user);
 
         return response()->json([
             'status' => 'success',
@@ -657,6 +759,11 @@ class ChatController extends Controller
                 'jjb_gain' => $actualJjbGain,
                 'user_level' => $user->user_level,
                 'title' => $title,
+                'identity_summary' => $identitySummary['inline'],
+                'department_name' => $identitySummary['department_name'],
+                'position_name' => $identitySummary['position_name'],
+                'vip_name' => $identitySummary['vip_name'],
+                'vip_icon' => $identitySummary['vip_icon'],
                 'leveled_up' => $leveledUp,
                 'is_max_level' => $user->user_level >= $superLevel,
                 'auto_event' => $autoEvent ? $autoEvent->renderText($user->username) : null,
@@ -799,18 +906,10 @@ class ChatController extends Controller
 
         // 将新头像同步到 Redis 在线用户列表中（所有房间）
         // 通过更新 Redis 的用户信息，使得其他用户和自己刷新后都能看到新头像
-        $superLevel = (int) Sysparam::getValue('superlevel', '100');
         $rooms = $this->chatState->getUserRooms($user->username);
         foreach ($rooms as $roomId) {
-            $this->chatState->userJoin((int) $roomId, $user->username, [
-                'level' => $user->user_level,
-                'sex' => $user->sex,
-                'headface' => $headface,
-                'vip_icon' => $user->vipIcon(),
-                'vip_name' => $user->vipName(),
-                'vip_color' => $user->isVip() ? ($user->vipLevel?->color ?? '') : '',
-                'is_admin' => $user->user_level >= $superLevel,
-            ]);
+            // 头像更新后，统一通过在线载荷服务刷新所有扩展字段，避免状态或职务字段丢失。
+            $this->chatState->userJoin((int) $roomId, $user->username, $this->chatUserPresenceService->build($user));
         }
 
         return response()->json([
@@ -865,18 +964,10 @@ class ChatController extends Controller
             }
 
             // 同步 Redis 状态
-            $superLevel = (int) Sysparam::getValue('superlevel', '100');
             $rooms = $this->chatState->getUserRooms($user->username);
             foreach ($rooms as $roomId) {
-                $this->chatState->userJoin((int) $roomId, $user->username, [
-                    'level' => $user->user_level,
-                    'sex' => $user->sex,
-                    'headface' => $user->headface, // Use accessor
-                    'vip_icon' => $user->vipIcon(),
-                    'vip_name' => $user->vipName(),
-                    'vip_color' => $user->isVip() ? ($user->vipLevel?->color ?? '') : '',
-                    'is_admin' => $user->user_level >= $superLevel,
-                ]);
+                // 自定义头像上传成功后，同步覆盖在线名单中的全部展示字段。
+                $this->chatState->userJoin((int) $roomId, $user->username, $this->chatUserPresenceService->build($user));
             }
 
             return response()->json([
@@ -892,7 +983,8 @@ class ChatController extends Controller
 
     /**
      * 设置房间公告/祝福语（滚动显示在聊天室顶部）
-     * 需要房间主人或等级达到 level_announcement 配置值
+     * 需要当前在职职务拥有 room.announcement 权限，
+     * id=1 站长始终允许操作。
      *
      * @param  int  $id  房间ID
      */
@@ -901,19 +993,23 @@ class ChatController extends Controller
         $user = Auth::user();
         $room = Room::findOrFail($id);
 
-        // 权限检查：房间主人 或 等级 >= level_announcement
-        $requiredLevel = (int) Sysparam::getValue('level_announcement', '10');
-        if ($user->username !== $room->master && $user->user_level < $requiredLevel) {
+        // 改为统一走职务权限判断，不再给房主单独保留公告特权。
+        if (! $this->positionPermissionService->hasPermission($user, PositionPermissionRegistry::ROOM_ANNOUNCEMENT)) {
             return response()->json(['status' => 'error', 'message' => '权限不足，无法修改公告'], 403);
         }
 
+        if (! $this->chatState->isUserInRoom($id, $user->username)) {
+            return response()->json(['status' => 'error', 'message' => '请先进入该房间后再修改公告'], 403);
+        }
+
         $request->validate([
             'announcement' => 'required|string|max:500',
         ]);
 
-        // 将发送者和发送时间追加到公告文本末尾，持久化存储，无需额外字段
-        $room->announcement = trim($request->input('announcement'))
-            .' ——'.$user->username.' '.now()->format('m-d H:i');
+        $announcementText = trim((string) $request->input('announcement'));
+
+        // 将发送者和发送时间追加到公告文本末尾，持久化存储，无需额外字段。
+        $room->announcement = $announcementText.' ——'.$user->username.' '.now()->format('m-d H:i');
         $room->save();
 
         // 广播公告更新到所有在线用户
@@ -922,7 +1018,7 @@ class ChatController extends Controller
             'room_id' => $id,
             'from_user' => '系统公告',
             'to_user' => '大家',
-            'content' => "📢 {$user->username} 更新了房间公告：{$room->announcement}",
+            'content' => '📢 '.ChatContentSanitizer::htmlText($user->username).' 更新了房间公告：'.ChatContentSanitizer::htmlText($room->announcement),
             'is_secret' => false,
             'font_color' => '#cc0000',
             'action' => '',
@@ -964,6 +1060,10 @@ class ChatController extends Controller
         $giftId = $request->integer('gift_id');
         $count = $request->integer('count', 1);
 
+        if ($response = $this->ensureUserCanActInRoom((int) $roomId, $user, '请先进入当前房间后再送礼物。')) {
+            return $response;
+        }
+
         // 不能给自己送花
         if ($toUsername === $user->username) {
             return response()->json(['status' => 'error', 'message' => '不能给自己送花哦～']);
@@ -981,6 +1081,10 @@ class ChatController extends Controller
             return response()->json(['status' => 'error', 'message' => '用户不存在']);
         }
 
+        if ($response = $this->ensureTargetOnlineInRoom((int) $roomId, (string) $toUsername)) {
+            return $response;
+        }
+
         $totalCost = $gift->cost * $count;
         $totalCharm = $gift->charm * $count;
 
@@ -992,24 +1096,24 @@ class ChatController extends Controller
             ]);
         }
 
-        // 扣除金币、增加对方魅力
-        $user->jjb = ($user->jjb ?? 0) - $totalCost;
-        $user->save();
-
-        $toUser->meili = ($toUser->meili ?? 0) + $totalCharm;
-        $toUser->save();
+        // 扣除金币、增加对方魅力（含流水日志）
+        $this->currencyService->change($user, 'gold', -$totalCost, CurrencySource::SEND_GIFT, "送花：送给 {$toUsername} {$count} 份【{$gift->name}】，魅力 +{$totalCharm}", $roomId);
+        $this->currencyService->change($toUser, 'charm', $totalCharm, CurrencySource::RECV_GIFT, "收到 {$user->username} 赠送的 {$count} 份【{$gift->name}】", $roomId);
 
         // 构建礼物图片 URL
         $giftImageUrl = $gift->image ? "/images/gifts/{$gift->image}" : '';
 
         // 广播送花消息（含图片标记，前端识别后渲染图片）
         $countText = $count > 1 ? " {$count} 份" : '';
+        $safeSender = ChatContentSanitizer::htmlText($user->username);
+        $safeReceiver = ChatContentSanitizer::htmlText($toUsername);
+        $safeGiftName = ChatContentSanitizer::htmlText($gift->name);
         $sysMsg = [
             'id' => $this->chatState->nextMessageId($roomId),
             'room_id' => $roomId,
             'from_user' => '送花播报',
             'to_user' => $toUsername,
-            'content' => "{$gift->emoji} 【{$user->username}】 向 【{$toUsername}】 送出了{$countText}【{$gift->name}】！魅力 +{$totalCharm}！",
+            'content' => "{$gift->emoji} 【{$safeSender}】 向 【{$safeReceiver}】 送出了{$countText}【{$safeGiftName}】！魅力 +{$totalCharm}！",
             'is_secret' => false,
             'font_color' => '#e91e8f',
             'action' => '',
@@ -1026,8 +1130,8 @@ class ChatController extends Controller
             'status' => 'success',
             'message' => "送花成功！花费 {$totalCost} 金币，{$toUsername} 魅力 +{$totalCharm}",
             'data' => [
-                'my_jjb' => $user->jjb,
-                'target_charm' => $toUser->meili,
+                'my_jjb' => $user->fresh()->jjb,
+                'target_charm' => $toUser->fresh()->meili,
             ],
         ]);
     }
@@ -1080,9 +1184,8 @@ class ChatController extends Controller
             return;
         }
 
-        // 发送者获得魅力
-        $sender->meili = ($sender->meili ?? 0) + $charmGain;
-        $sender->save();
+        // 发送者获得魅力（含流水日志）
+        $this->currencyService->change($sender, 'charm', $charmGain, CurrencySource::CHAT_CHARM, "与 {$toUsername} 聊天获得魅力奖励");
 
         // 更新 Redis 计数器（1 小时过期）
         Redis::incrby($capKey, $charmGain);
@@ -1278,6 +1381,10 @@ class ChatController extends Controller
         $roomId = $request->integer('room_id');
         $amount = $request->integer('amount');
 
+        if ($response = $this->ensureUserCanActInRoom($roomId, $sender, '请先进入当前房间后再赠送金币。')) {
+            return $response;
+        }
+
         // 不能给自己转账
         if ($toName === $sender->username) {
             return response()->json(['status' => 'error', 'message' => '不能给自己赠送哦～']);
@@ -1289,6 +1396,10 @@ class ChatController extends Controller
             return response()->json(['status' => 'error', 'message' => '用户不存在']);
         }
 
+        if ($response = $this->ensureTargetOnlineInRoom($roomId, (string) $toName)) {
+            return $response;
+        }
+
         // 余额校验
         if (($sender->jjb ?? 0) < $amount) {
             return response()->json([
@@ -1297,9 +1408,9 @@ class ChatController extends Controller
             ]);
         }
 
-        // 执行转账（直接操作字段，与 sendFlower 保持一致风格）
-        $sender->decrement('jjb', $amount);
-        $receiver->increment('jjb', $amount);
+        // 执行转账（含流水日志）
+        $this->currencyService->change($sender, 'gold', -$amount, CurrencySource::GIFT_SENT, "赠送金币给 {$toName}", $roomId);
+        $this->currencyService->change($receiver, 'gold', $amount, CurrencySource::GOLD_GIFT_RECV, "收到 {$sender->username} 赠送的金币", $roomId);
 
         // 写入真正的私聊消息，避免其他旁观用户在公屏看到赠金币通知。
         $giftMsg = [
@@ -1315,10 +1426,10 @@ class ChatController extends Controller
             // 接收方收到消息时，在右下角弹到账提示卡片。
             'toast_notification' => [
                 'title' => '💰 赠金币到账',
-                'message' => "<b>{$sender->username}</b> 向你赠送了 <b>{$amount}</b> 枚金币！",
+                'message' => '<b>'.ChatContentSanitizer::htmlText($sender->username)."</b> 向你赠送了 <b>{$amount}</b> 枚金币！",
                 'icon' => '💰',
                 'color' => '#f59e0b',
-                'duration' => 8000,
+                'duration' => 3000,
             ],
         ];
 
@@ -1336,4 +1447,107 @@ class ChatController extends Controller
             ],
         ]);
     }
+
+    /**
+     * 校验用户是否能在指定房间执行聊天动作。
+     */
+    private function ensureUserCanActInRoom(int $roomId, ?User $user, string $message): ?JsonResponse
+    {
+        if (! $user) {
+            return response()->json(['status' => 'error', 'message' => '请先登录'], 401);
+        }
+
+        $room = Room::query()->find($roomId);
+        if (! $room) {
+            return response()->json(['status' => 'error', 'message' => '房间不存在'], 404);
+        }
+
+        if (! $room->canUserEnter($user) || ! $this->chatState->isUserInRoom($roomId, $user->username)) {
+            return response()->json(['status' => 'error', 'message' => $message], 403);
+        }
+
+        return null;
+    }
+
+    /**
+     * 拍一拍：用户通过 /拍一拍 命令向所选对象发送拍一拍通知。
+     */
+    public function pat(Request $request, int $id): JsonResponse
+    {
+        $user = Auth::user();
+
+        if ($response = $this->ensureUserCanActInRoom($id, $user, '请先进入当前房间后再使用拍一拍。')) {
+            return $response;
+        }
+
+        // 0. 检查用户是否被禁言
+        $muteKey = "mute:{$id}:{$user->username}";
+        if (Redis::exists($muteKey)) {
+            $ttl = Redis::ttl($muteKey);
+            $minutes = ceil($ttl / 60);
+
+            return response()->json([
+                'status' => 'error',
+                'message' => "您正在禁言中，还需等待约 {$minutes} 分钟。",
+            ], 403);
+        }
+
+        $targetUser = $request->input('target_user', '');
+        if (empty($targetUser) || $targetUser === '大家') {
+            return response()->json([
+                'status' => 'error',
+                'message' => '请选择一个聊天对象（不能为大家）进行拍一拍。',
+            ], 422);
+        }
+
+        // 检查目标是否在线
+        $isOnline = Redis::hexists("room:{$id}:users", $targetUser);
+        if (! $isOnline) {
+            return response()->json([
+                'status' => 'error',
+                'message' => "【{$targetUser}】目前已离开聊天室或不在线。",
+            ], 200);
+        }
+
+        // 不能拍自己
+        if ($targetUser === $user->username) {
+            return response()->json([
+                'status' => 'error',
+                'message' => '不能拍自己哦～',
+            ], 422);
+        }
+
+        // 获取发送者头像
+        $headface = $user->usersf ?: '1.gif';
+        $headSrc = str_starts_with($headface, 'storage/') ? '/'.$headface : '/images/headface/'.$headface;
+
+        // 构造展示文本
+        $displayText = "{$user->username} 拍了拍 {$targetUser}";
+
+        // 广播到房间
+        broadcast(new \App\Events\UserPat(
+            roomId: $id,
+            fromUser: $user->username,
+            targetUser: $targetUser,
+            displayText: $displayText,
+            fromUserHeadface: $headSrc,
+        ));
+
+        return response()->json([
+            'status' => 'success',
+            'message' => $displayText,
+        ]);
+    }
+
+    /**
+     * 校验目标用户是否仍在当前房间在线，避免跨房间赠送和消息注入。
+     */
+    private function ensureTargetOnlineInRoom(int $roomId, string $targetUsername): ?JsonResponse
+    {
+        if (! $this->chatState->isUserInRoom($roomId, $targetUsername)) {
+            return response()->json(['status' => 'error', 'message' => '目标用户不在当前房间，无法执行该操作'], 403);
+        }
+
+        return null;
+    }
 }

app/Http/Controllers/DailySignInController.php

@@ -0,0 +1,306 @@
+<?php
+
+/**
+ * 文件功能：前台每日签到控制器
+ *
+ * 提供签到状态查询、领取奖励、刷新在线名单载荷和聊天室签到通知。
+ */
+
+namespace App\Http\Controllers;
+
+use App\Events\MessageSent;
+use App\Events\UserStatusUpdated;
+use App\Http\Requests\ClaimDailySignInRequest;
+use App\Http\Requests\DailySignInCalendarRequest;
+use App\Http\Requests\MakeupDailySignInRequest;
+use App\Models\DailySignIn;
+use App\Models\User;
+use App\Models\UserIdentityBadge;
+use App\Services\ChatStateService;
+use App\Services\ChatUserPresenceService;
+use App\Services\SignInService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * 类功能：处理前台用户每日签到状态与领取奖励流程。
+ */
+class DailySignInController extends Controller
+{
+    /**
+     * 构造每日签到控制器依赖。
+     */
+    public function __construct(
+        private readonly SignInService $signInService,
+        private readonly ChatStateService $chatState,
+        private readonly ChatUserPresenceService $presenceService,
+    ) {}
+
+    /**
+     * 方法功能：查询当前用户今日签到状态和奖励预览。
+     */
+    public function status(): JsonResponse
+    {
+        /** @var User $user */
+        $user = Auth::user();
+        $status = $this->signInService->status($user);
+
+        return response()->json([
+            'status' => 'success',
+            'data' => $this->formatStatusPayload($user, $status),
+        ]);
+    }
+
+    /**
+     * 方法功能：查询指定月份的签到日历与补签卡状态。
+     */
+    public function calendar(DailySignInCalendarRequest $request): JsonResponse
+    {
+        /** @var User $user */
+        $user = Auth::user();
+
+        return response()->json([
+            'status' => 'success',
+            'data' => $this->signInService->calendar($user, $request->validated('month')),
+        ]);
+    }
+
+    /**
+     * 方法功能：领取今日签到奖励并同步聊天室在线名单。
+     */
+    public function claim(ClaimDailySignInRequest $request): JsonResponse
+    {
+        /** @var User $user */
+        $user = Auth::user();
+        $roomId = $request->validated('room_id');
+        $roomId = $roomId === null ? null : (int) $roomId;
+
+        $dailySignIn = $this->signInService->claim($user, $roomId);
+        if (! $dailySignIn->wasRecentlyCreated) {
+            return response()->json([
+                'status' => 'error',
+                'message' => '今日已签到，请明天再来。',
+                'data' => $this->formatClaimPayload($user->fresh(), $dailySignIn),
+            ], 422);
+        }
+
+        $freshUser = $user->fresh(['vipLevel', 'activePosition.position.department']);
+        $presencePayload = $this->presenceService->build($freshUser);
+        $this->refreshOnlinePresence($freshUser, $presencePayload);
+
+        if ($roomId !== null && $this->chatState->isUserInRoom($roomId, $freshUser->username)) {
+            $this->broadcastSignInNotice($freshUser, $dailySignIn, $roomId);
+        }
+
+        return response()->json([
+            'status' => 'success',
+            'message' => $this->buildSuccessMessage($dailySignIn),
+            'data' => $this->formatClaimPayload($freshUser, $dailySignIn, $presencePayload),
+        ]);
+    }
+
+    /**
+     * 方法功能：使用补签卡补签历史漏签日期。
+     */
+    public function makeup(MakeupDailySignInRequest $request): JsonResponse
+    {
+        /** @var User $user */
+        $user = Auth::user();
+        $roomId = $request->validated('room_id');
+        $roomId = $roomId === null ? null : (int) $roomId;
+
+        $dailySignIn = $this->signInService->makeup($user, (string) $request->validated('target_date'), $roomId);
+        $refreshedSignIn = $dailySignIn->fresh();
+        $latestSignIn = DailySignIn::query()
+            ->where('user_id', $user->id)
+            ->latest('sign_in_date')
+            ->first();
+        $currentStreakDays = (int) ($latestSignIn?->streak_days ?? $refreshedSignIn?->streak_days ?? 0);
+
+        $freshUser = $user->fresh(['vipLevel', 'activePosition.position.department']);
+        $presencePayload = $this->presenceService->build($freshUser);
+        $this->refreshOnlinePresence($freshUser, $presencePayload);
+
+        if ($roomId !== null && $this->chatState->isUserInRoom($roomId, $freshUser->username)) {
+            $this->broadcastSignInNotice($freshUser, $refreshedSignIn, $roomId, $currentStreakDays);
+        }
+
+        return response()->json([
+            'status' => 'success',
+            'message' => '补签成功，'.$refreshedSignIn?->sign_in_date?->format('Y-m-d').' 已补签，当前连续签到 '.$currentStreakDays.' 天。',
+            'data' => $this->formatClaimPayload($freshUser, $refreshedSignIn, $presencePayload, $currentStreakDays),
+        ]);
+    }
+
+    /**
+     * 方法功能：刷新用户当前所在房间的 Redis 在线载荷并广播名单更新。
+     *
+     * @param  array<string, mixed>  $presencePayload
+     */
+    private function refreshOnlinePresence(User $user, array $presencePayload): void
+    {
+        foreach ($this->chatState->getUserRooms($user->username) as $activeRoomId) {
+            // 签到身份会展示在在线名单里，必须立即回写 Redis 载荷。
+            $this->chatState->userJoin((int) $activeRoomId, $user->username, $presencePayload);
+            broadcast(new UserStatusUpdated((int) $activeRoomId, $user->username, $presencePayload));
+        }
+    }
+
+    /**
+     * 方法功能：向当前聊天室广播签到成功通知。
+     */
+    private function broadcastSignInNotice(User $user, DailySignIn $dailySignIn, int $roomId, ?int $currentStreakDays = null): void
+    {
+        $message = [
+            'id' => $this->chatState->nextMessageId($roomId),
+            'room_id' => $roomId,
+            'from_user' => '系统传音',
+            'to_user' => '大家',
+            'content' => $this->buildNoticeContent($user, $dailySignIn, $currentStreakDays),
+            'is_secret' => false,
+            'font_color' => '#0f766e',
+            'action' => '',
+            'sent_at' => now()->toDateTimeString(),
+        ];
+
+        $this->chatState->pushMessage($roomId, $message);
+        broadcast(new MessageSent($roomId, $message));
+    }
+
+    /**
+     * 方法功能：生成聊天室内的签到播报内容。
+     */
+    private function buildNoticeContent(User $user, DailySignIn $dailySignIn, ?int $currentStreakDays = null): string
+    {
+        $rewardText = $this->buildRewardText($dailySignIn);
+        $identityText = $dailySignIn->identity_badge_name
+            ? '，获得身份 '.e($dailySignIn->identity_badge_name)
+            : '';
+
+        if ($dailySignIn->is_makeup) {
+            $signInDate = $dailySignIn->sign_in_date?->format('Y-m-d') ?? '漏签日期';
+            $streakDays = $currentStreakDays ?? (int) $dailySignIn->streak_days;
+
+            return '【'.e($user->username).'】使用补签卡补签 '.$signInDate
+                .'，当前连续签到 '.$streakDays.' 天，获得 '.$rewardText.$identityText.'。';
+        }
+
+        // 聊天消息内的快捷按钮使用相对字号，避免覆盖用户选择的消息字号。
+        $quickButton = '<button type="button" onclick="window.quickDailySignIn && window.quickDailySignIn()" '
+            .'style="display:inline-block;margin-left:6px;padding:1px 8px;border:none;border-radius:999px;'
+            .'background:#ccfbf1;color:#0f766e;font-size:0.78em;font-weight:bold;cursor:pointer;vertical-align:middle;">'
+            .'✅ 快速签到</button>';
+
+        return '【'.e($user->username).'】完成今日签到，连续签到 '
+            .$dailySignIn->streak_days.' 天，获得 '.$rewardText.$identityText.'。'.$quickButton;
+    }
+
+    /**
+     * 方法功能：生成本机签到成功提示文案。
+     */
+    private function buildSuccessMessage(DailySignIn $dailySignIn): string
+    {
+        return '签到成功，连续签到 '.$dailySignIn->streak_days.' 天，获得 '.$this->buildRewardText($dailySignIn).'。';
+    }
+
+    /**
+     * 方法功能：按实际签到奖励快照生成奖励描述。
+     */
+    private function buildRewardText(DailySignIn $dailySignIn): string
+    {
+        $items = [];
+        if ($dailySignIn->gold_reward > 0) {
+            $items[] = $dailySignIn->gold_reward.' 金币';
+        }
+        if ($dailySignIn->exp_reward > 0) {
+            $items[] = $dailySignIn->exp_reward.' 经验';
+        }
+        if ($dailySignIn->charm_reward > 0) {
+            $items[] = $dailySignIn->charm_reward.' 魅力';
+        }
+
+        return $items === [] ? '签到记录' : implode(' + ', $items);
+    }
+
+    /**
+     * 方法功能：格式化状态查询响应载荷。
+     *
+     * @param  array<string, mixed>  $status
+     * @return array<string, mixed>
+     */
+    private function formatStatusPayload(User $user, array $status): array
+    {
+        return [
+            'signed_today' => $status['signed_today'],
+            'can_claim' => $status['can_claim'],
+            'current_streak_days' => $status['current_streak_days'],
+            'claimable_streak_days' => $status['claimable_streak_days'],
+            'preview_rule' => $status['matched_rule']?->only([
+                'streak_days',
+                'gold_reward',
+                'exp_reward',
+                'charm_reward',
+                'identity_badge_name',
+                'identity_badge_icon',
+                'identity_badge_color',
+                'identity_duration_days',
+            ]),
+            'identity' => $this->formatIdentityPayload($status['current_identity']),
+            'user' => [
+                'jjb' => (int) $user->jjb,
+            ],
+        ];
+    }
+
+    /**
+     * 方法功能：格式化签到领取响应载荷。
+     *
+     * @param  array<string, mixed>|null  $presencePayload
+     * @return array<string, mixed>
+     */
+    private function formatClaimPayload(User $user, DailySignIn $dailySignIn, ?array $presencePayload = null, ?int $currentStreakDays = null): array
+    {
+        $identity = $user->currentSignInIdentity();
+
+        return [
+            'sign_in' => [
+                'id' => $dailySignIn->id,
+                'sign_in_date' => $dailySignIn->sign_in_date?->toDateString(),
+                'is_makeup' => (bool) $dailySignIn->is_makeup,
+                'streak_days' => (int) $dailySignIn->streak_days,
+                'gold_reward' => (int) $dailySignIn->gold_reward,
+                'exp_reward' => (int) $dailySignIn->exp_reward,
+                'charm_reward' => (int) $dailySignIn->charm_reward,
+            ],
+            'current_streak_days' => $currentStreakDays ?? (int) $dailySignIn->streak_days,
+            'identity' => $this->formatIdentityPayload($identity),
+            'presence' => $presencePayload ?? $this->presenceService->build($user),
+            'user' => [
+                'jjb' => (int) $user->jjb,
+                'gold' => (int) $user->jjb,
+            ],
+        ];
+    }
+
+    /**
+     * 方法功能：格式化签到身份数据供前端展示。
+     *
+     * @return array<string, mixed>|null
+     */
+    private function formatIdentityPayload(?UserIdentityBadge $identity): ?array
+    {
+        if ($identity === null) {
+            return null;
+        }
+
+        return [
+            'key' => $identity->badge_code,
+            'label' => $identity->badge_name,
+            'name' => $identity->badge_name,
+            'icon' => $identity->badge_icon ?? '✅',
+            'color' => $identity->badge_color ?? '#0f766e',
+            'expires_at' => $identity->expires_at?->toIso8601String(),
+            'streak_days' => (int) data_get($identity->metadata, 'streak_days', 0),
+        ];
+    }
+}

app/Http/Controllers/EarnController.php

@@ -43,6 +43,11 @@ class EarnController extends Controller
      */
     public function claimVideoReward(Request $request): JsonResponse
     {
+        return response()->json([
+            'success' => false,
+            'message' => '看视频赚钱功能已关闭。',
+        ]);
+
         /** @var User $user */
         $user = Auth::user();
 
@@ -99,9 +104,10 @@ class EarnController extends Controller
 
         // 6. 广播全服系统消息
         if ($roomId > 0) {
+            // 公屏消息内的入口标签使用相对字号，跟随用户在聊天室选择的字号。
             $promoTag = ' <span onclick="window.dispatchEvent(new CustomEvent(\'open-earn-panel\'))" '
                 .'style="display:inline-block;margin-left:6px;padding:1px 7px;background:#e9e4f5;'
-                .'color:#6d4fa8;border-radius:10px;font-size:10px;cursor:pointer;font-weight:bold;vertical-align:middle;'
+                .'color:#6d4fa8;border-radius:10px;font-size:0.78em;cursor:pointer;font-weight:bold;vertical-align:middle;'
                 .'border:1px solid #d0c4ec;" title="点击赚金币">💰 看视频赚金币</span>';
 
             $sysMsg = [

app/Http/Controllers/FeedbackController.php

@@ -48,6 +48,38 @@ class FeedbackController extends Controller
         return view('feedback.index', compact('feedbacks', 'myVotedIds'));
     }
 
+    /**
+     * 获取反馈第一页数据（JSON API）
+     * 供聊天室模态弹窗使用，格式与 loadMore 一致
+     *
+     * @param  Request  $request  含 type 筛选参数
+     */
+    public function data(Request $request): JsonResponse
+    {
+        $type = $request->input('type');  // bug|suggestion|null(全部)
+
+        $query = FeedbackItem::with(['replies'])
+            ->orderByDesc('votes_count')
+            ->orderByDesc('created_at');
+
+        if ($type && in_array($type, ['bug', 'suggestion'])) {
+            $query->ofType($type);
+        }
+
+        $items = $query->limit(self::PAGE_SIZE)->get();
+
+        $myVotedIds = FeedbackVote::where('user_id', Auth::id())
+            ->whereIn('feedback_id', $items->pluck('id'))
+            ->pluck('feedback_id')
+            ->toArray();
+
+        return response()->json([
+            'items' => $this->formatItems($items, $myVotedIds),
+            'last_id' => $items->last()?->id ?? 0,
+            'has_more' => $items->count() === self::PAGE_SIZE,
+        ]);
+    }
+
     /**
      * 懒加载更多反馈（JSON API）
      * 支持按类型筛选（bug / suggestion）
@@ -257,6 +289,10 @@ class FeedbackController extends Controller
      */
     private function formatItem(FeedbackItem $item, bool $voted): array
     {
+        /** @var \App\Models\User $user */
+        $user = Auth::user();
+        $isOwner = $item->user_id === $user->id;
+
         return [
             'id' => $item->id,
             'type' => $item->type,
@@ -272,6 +308,8 @@ class FeedbackController extends Controller
             'username' => $item->username,
             'created_at' => $item->created_at->diffForHumans(),
             'voted' => $voted,
+            'is_owner' => $isOwner,
+            'can_delete' => ($isOwner && $item->is_within_24_hours) || $user->id === 1,
             'replies' => ($item->relationLoaded('replies') ? $item->replies : collect())->map(fn ($r) => [
                 'id' => $r->id,
                 'username' => $r->username,

app/Http/Controllers/FishingController.php

@@ -19,8 +19,10 @@ namespace App\Http\Controllers;
 use App\Enums\CurrencySource;
 use App\Models\GameConfig;
 use App\Models\Sysparam;
+use App\Models\User;
 use App\Services\ChatStateService;
 use App\Services\FishingService;
+use App\Services\GameRoomScopeService;
 use App\Services\ShopService;
 use App\Services\UserCurrencyService;
 use App\Services\VipService;
@@ -30,14 +32,21 @@ use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Redis;
 use Illuminate\Support\Str;
 
+/**
+ * 类功能：处理钓鱼小游戏的抛竿与收竿流程。
+ */
 class FishingController extends Controller
 {
+    /**
+     * 注入钓鱼流程需要的状态、会员、金币、商店和房间范围服务。
+     */
     public function __construct(
         private readonly ChatStateService $chatState,
         private readonly VipService $vipService,
         private readonly UserCurrencyService $currencyService,
         private readonly ShopService $shopService,
         private readonly FishingService $fishingService,
+        private readonly GameRoomScopeService $roomScopeService,
     ) {}
 
     /**
@@ -63,6 +72,10 @@ class FishingController extends Controller
             return response()->json(['status' => 'error', 'message' => '钓鱼功能暂未开放。'], 403);
         }
 
+        if (! $this->roomScopeService->isRoomAllowedForGame('fishing', $id)) {
+            return response()->json(['status' => 'error', 'message' => '当前房间未开启钓鱼小游戏。'], 403);
+        }
+
         // 1. 检查冷却时间（Redis TTL）
         $cooldownKey = "fishing:cd:{$user->id}";
         if (Redis::exists($cooldownKey)) {
@@ -75,6 +88,14 @@ class FishingController extends Controller
             ], 429);
         }
 
+        $tokenKey = "fishing:token:{$user->id}";
+        if (Redis::exists($tokenKey)) {
+            $activeSessionResponse = $this->restoreActiveFishingSessionResponse($user, $tokenKey);
+            if ($activeSessionResponse) {
+                return $activeSessionResponse;
+            }
+        }
+
         // 2. 检查金币是否足够
         $cost = (int) (GameConfig::param('fishing', 'fishing_cost') ?? Sysparam::getValue('fishing_cost', '5'));
         if (($user->jjb ?? 0) < $cost) {
@@ -84,34 +105,54 @@ class FishingController extends Controller
             ], 422);
         }
 
-        // 3. 扣除金币
-        $this->currencyService->change(
-            $user, 'gold', -$cost,
-            CurrencySource::FISHING_COST,
-            "钓鱼抛竿消耗 {$cost} 金币",
-            $id,
-        );
-        $user->refresh();
-
-        // 4. 生成一次性 token，存入 Redis（TTL = 等待时间 + 收竿窗口 + 缓冲）
+        // 3. 生成一次性 token，存入 Redis（TTL = 等待时间 + 收竿窗口 + 缓冲）
         $waitMin = (int) (GameConfig::param('fishing', 'fishing_wait_min') ?? Sysparam::getValue('fishing_wait_min', '8'));
         $waitMax = (int) (GameConfig::param('fishing', 'fishing_wait_max') ?? Sysparam::getValue('fishing_wait_max', '15'));
         $waitTime = rand($waitMin, $waitMax);
         $token = Str::random(32);
-        $tokenKey = "fishing:token:{$user->id}";
-        // token 有效期 = 等待时间 + 8秒点击窗口 + 5秒缓冲
-        // 同时把 cast 时间戳和 wait_time 一起存入，供 reel 做服务端时间校验
-        Redis::setex($tokenKey, $waitTime + 13, json_encode([
+        $tokenTtl = $waitTime + 13;
+        $tokenPayload = json_encode([
             'token' => $token,
             'cast_at' => time(),
             'wait_time' => $waitTime,
-        ]));
+        ]);
 
-        // 5. 生成随机浮漂坐标（百分比，避开边缘）
+        // 原子占用本次抛竿 token，避免多标签页自动钓鱼互相覆盖令牌。
+        $reserved = Redis::command('set', [$tokenKey, $tokenPayload, 'EX', $tokenTtl, 'NX']);
+        if (! $reserved) {
+            $activeSessionResponse = $this->restoreActiveFishingSessionResponse($user, $tokenKey);
+            if ($activeSessionResponse) {
+                return $activeSessionResponse;
+            }
+
+            return response()->json([
+                'status' => 'error',
+                'message' => '钓鱼状态同步中，请稍后重试。',
+                'retry_after' => 3,
+            ], 409);
+        }
+
+        try {
+            // token 占用成功后才扣金币，确保重复抛竿不会多扣费用。
+            $this->currencyService->change(
+                $user, 'gold', -$cost,
+                CurrencySource::FISHING_COST,
+                "钓鱼抛竿消耗 {$cost} 金币",
+                $id,
+            );
+            $user->refresh();
+        } catch (\Throwable $exception) {
+            // 金币扣除失败时释放 token，避免用户被短时间卡在未收竿状态。
+            Redis::del($tokenKey);
+
+            throw $exception;
+        }
+
+        // 4. 生成随机浮漂坐标（百分比，避开边缘）
         $bobberX = rand(15, 85); // 左右 15%~85%
         $bobberY = rand(20, 65); // 上下 20%~65%
 
-        // 6. 检查是否持有有效自动钓鱼卡
+        // 5. 检查是否持有有效自动钓鱼卡
         $autoFishingMinutes = $this->shopService->getActiveAutoFishingMinutesLeft($user);
 
         return response()->json([
@@ -128,6 +169,37 @@ class FishingController extends Controller
         ]);
     }
 
+    /**
+     * 恢复已有钓鱼会话，避免刷新页面后丢失前端内存里的收竿令牌。
+     */
+    private function restoreActiveFishingSessionResponse(User $user, string $tokenKey): ?JsonResponse
+    {
+        $stored = json_decode((string) Redis::get($tokenKey), true);
+        if (! is_array($stored) || empty($stored['token'])) {
+            Redis::del($tokenKey);
+
+            return null;
+        }
+
+        $elapsed = time() - (int) ($stored['cast_at'] ?? 0);
+        $waitTime = max(0, (int) ($stored['wait_time'] ?? 0) - $elapsed);
+        $autoFishingMinutes = $this->shopService->getActiveAutoFishingMinutesLeft($user);
+
+        return response()->json([
+            'status' => 'success',
+            'message' => '已恢复正在进行的钓鱼，请等待本次收竿。',
+            'wait_time' => $waitTime,
+            'bobber_x' => rand(15, 85),
+            'bobber_y' => rand(20, 65),
+            'token' => (string) $stored['token'],
+            'auto_fishing' => $autoFishingMinutes > 0,
+            'auto_fishing_minutes_left' => $autoFishingMinutes,
+            'cost' => 0,
+            'jjb' => $user->jjb,
+            'restored' => true,
+        ]);
+    }
+
     /**
      * 收竿 — 验证浮漂 token，随机计算钓鱼结果，更新经验/金币，广播到聊天室。
      *
@@ -142,6 +214,10 @@ class FishingController extends Controller
             return response()->json(['status' => 'error', 'message' => '请先登录'], 401);
         }
 
+        if (! $this->roomScopeService->isRoomAllowedForGame('fishing', $id)) {
+            return response()->json(['status' => 'error', 'message' => '当前房间未开启钓鱼小游戏。'], 403);
+        }
+
         // 1. 验证 token + 服务端时间校验（防止前端篡改 wait_time 跳过等待）
         $tokenKey = "fishing:token:{$user->id}";
         $storedJson = Redis::get($tokenKey);

app/Http/Controllers/FortuneTellingController.php

@@ -18,14 +18,19 @@ namespace App\Http\Controllers;
 use App\Enums\CurrencySource;
 use App\Models\FortuneLog;
 use App\Models\GameConfig;
+use App\Services\GameRoomScopeService;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
+/**
+ * 类功能：提供神秘占卜状态、抽签和历史接口。
+ */
 class FortuneTellingController extends Controller
 {
     public function __construct(
         private readonly UserCurrencyService $currency,
+        private readonly GameRoomScopeService $roomScopeService,
     ) {}
 
     /**
@@ -37,6 +42,11 @@ class FortuneTellingController extends Controller
             return response()->json(['enabled' => false]);
         }
 
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+        if (! $this->roomScopeService->isRoomAllowedForGame('fortune_telling', $roomId)) {
+            return response()->json(['enabled' => false]);
+        }
+
         $user = $request->user();
         $config = GameConfig::forGame('fortune_telling')?->params ?? [];
 
@@ -81,6 +91,11 @@ class FortuneTellingController extends Controller
             return response()->json(['ok' => false, 'message' => '神秘占卜当前未开启。']);
         }
 
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+        if (! $this->roomScopeService->isRoomAllowedForGame('fortune_telling', $roomId)) {
+            return response()->json(['ok' => false, 'message' => '当前房间未开启神秘占卜。'], 403);
+        }
+
         $user = $request->user();
         $config = GameConfig::forGame('fortune_telling')?->params ?? [];
 
@@ -145,6 +160,11 @@ class FortuneTellingController extends Controller
      */
     public function history(Request $request): JsonResponse
     {
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+        if (! $this->roomScopeService->isRoomAllowedForGame('fortune_telling', $roomId)) {
+            return response()->json(['history' => []]);
+        }
+
         $logs = FortuneLog::query()
             ->where('user_id', $request->user()->id)
             ->orderByDesc('id')

app/Http/Controllers/FriendController.php

@@ -267,19 +267,20 @@ class FriendController extends Controller
             return;
         }
 
-        // 根据操作类型和互相状态生成不同文案（含内联快捷操作链接）
+        // 根据操作类型和互相状态生成不同文案（含前端代理快捷操作链接）
         $btnStyle = 'font-weight:bold;text-decoration:underline;margin-left:6px;';
-        $btnAdd = "<a href='#' onclick=\"quickFriendAction('add','{$fromUsername}',this);return false;\" style='color:#16a34a;{$btnStyle}'>➕ 回加好友</a>";
-        $btnRemove = "<a href='#' onclick=\"quickFriendAction('remove','{$fromUsername}',this);return false;\" style='color:#6b7280;{$btnStyle}'>🗑️ 同步移除</a>";
+        $safeUsername = e($fromUsername);
+        $btnAdd = "<a href='#' data-quick-friend-action='add' data-quick-friend-username='{$safeUsername}' style='color:#16a34a;{$btnStyle}'>➕ 回加好友</a>";
+        $btnRemove = "<a href='#' data-quick-friend-action='remove' data-quick-friend-username='{$safeUsername}' style='color:#6b7280;{$btnStyle}'>🗑️ 同步移除</a>";
 
         $content = match ($action) {
             'added' => $mutual
-                ? "💚 <b>{$fromUsername}</b> 将你加为好友了！你们现在互为好友 🎉"
-                : "💚 <b>{$fromUsername}</b> 将你加为好友了！但你还没有添加对方为好友。{$btnAdd}",
+                ? "💚 <b>{$safeUsername}</b> 将你加为好友了！你们现在互为好友 🎉"
+                : "💚 <b>{$safeUsername}</b> 将你加为好友了！但你还没有添加对方为好友。{$btnAdd}",
             'removed' => $mutual
-                ? "💔 <b>{$fromUsername}</b> 已将你从好友列表移除。你的好友列表中仍保留对方。{$btnRemove}"
-                : "💔 <b>{$fromUsername}</b> 已将你从他的好友列表移除。",
-            'online' => "🟢 你的好友 <b>{$fromUsername}</b> 上线啦！",
+                ? "💔 <b>{$safeUsername}</b> 已将你从好友列表移除。你的好友列表中仍保留对方。{$btnRemove}"
+                : "💔 <b>{$safeUsername}</b> 已将你从他的好友列表移除。",
+            'online' => "🟢 你的好友 <b>{$safeUsername}</b> 上线啦！",
             default => '',
         };
 

app/Http/Controllers/GomokuController.php

@@ -24,17 +24,23 @@ use App\Events\GomokuInviteEvent;
 use App\Events\GomokuMovedEvent;
 use App\Models\GameConfig;
 use App\Models\GomokuGame;
+use App\Models\User;
+use App\Services\GameRoomScopeService;
 use App\Services\GomokuAiService;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 
+/**
+ * 类功能：处理五子棋创建、加入与对局过程接口。
+ */
 class GomokuController extends Controller
 {
     public function __construct(
         private readonly GomokuAiService $ai,
         private readonly UserCurrencyService $currency,
+        private readonly GameRoomScopeService $roomScopeService,
     ) {}
 
     /**
@@ -58,6 +64,10 @@ class GomokuController extends Controller
 
         $user = $request->user();
 
+        if (! $this->roomScopeService->isRoomAllowedForGame('gomoku', (int) $data['room_id'])) {
+            return response()->json(['ok' => false, 'message' => '当前房间未开启五子棋。'], 403);
+        }
+
         // PvP：检查是否已在等待/对局中（一次只能参与一场）
         $activeGame = GomokuGame::query()
             ->where(function ($q) use ($user) {
@@ -83,13 +93,27 @@ class GomokuController extends Controller
         return DB::transaction(function () use ($user, $data, $entryFee): JsonResponse {
             // PvE 扣除入场费
             if ($entryFee > 0) {
+                // 1. 悲观锁锁定用户行
+                $lockedUser = User::query()
+                    ->whereKey($user->id)
+                    ->lockForUpdate()
+                    ->firstOrFail();
+
+                // 2. 二次确认金币是否足够
+                if ((int) $lockedUser->jjb < $entryFee) {
+                    return response()->json(['ok' => false, 'message' => '金币不足，无法加入游戏对局。']);
+                }
+
                 $this->currency->change(
-                    $user,
+                    $lockedUser,
                     'gold',
                     -$entryFee,
                     CurrencySource::GOMOKU_ENTRY_FEE,
                     "五子棋 AI 对战入场费（难度{$data['ai_level']}）",
                 );
+
+                // 同步修改 Auth 内存实例的金币
+                $user->setAttribute('jjb', $lockedUser->jjb);
             }
 
             $timeout = (int) GameConfig::param('gomoku', 'invite_timeout', 60);

app/Http/Controllers/GuestbookController.php

@@ -15,6 +15,7 @@ use App\Http\Requests\StoreGuestbookRequest;
 use App\Models\Guestbook;
 use App\Models\User;
 use App\Services\MessageFilterService;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
@@ -128,4 +129,69 @@ class GuestbookController extends Controller
 
         return back()->with('success', '该行留言已被抹除。');
     }
+
+    /**
+     * 返回留言列表 JSON（供聊天室模态弹窗 AJAX 使用）
+     */
+    public function data(Request $request): JsonResponse
+    {
+        $tab = $request->input('tab', 'public');
+        $page = (int) $request->input('page', 1);
+        $user = Auth::user();
+
+        $query = Guestbook::query()->orderByDesc('id');
+
+        if ($tab === 'inbox') {
+            $query->where('towho', $user->username);
+        } elseif ($tab === 'outbox') {
+            $query->where('who', $user->username);
+        } else {
+            $query->where(function ($q) use ($user) {
+                $q->where('secret', 0)
+                    ->orWhere('who', $user->username)
+                    ->orWhere('towho', $user->username);
+            });
+        }
+
+        $perPage = 15;
+        $total = $query->count();
+        $messages = $query->skip(($page - 1) * $perPage)->take($perPage)->get();
+
+        $items = $messages->map(function ($msg) use ($user) {
+            $isSecret = (bool) $msg->secret;
+            $isToMe = $msg->towho === $user->username;
+            $isFromMe = $msg->who === $user->username;
+            $canDelete = $isFromMe || $isToMe || $user->user_level >= 15;
+
+            return [
+                'id' => $msg->id,
+                'who' => $msg->who,
+                'towho' => $msg->towho ?: '',
+                'secret' => $isSecret,
+                'text_body' => $msg->text_body,
+                'post_time' => $msg->post_time?->diffForHumans() ?? '',
+                'timestamp' => $msg->post_time?->toIso8601String() ?? '',
+                'is_to_me' => $isToMe,
+                'is_from_me' => $isFromMe,
+                'can_delete' => $canDelete,
+                'who_avatar' => mb_substr($msg->who, 0, 1),
+            ];
+        });
+
+        // 获取所有用户名列表（供发信选择器使用）
+        $users = User::where('username', '!=', $user->username)
+            ->orderBy('username')
+            ->pluck('username');
+
+        return response()->json([
+            'ok' => true,
+            'items' => $items,
+            'total' => $total,
+            'page' => $page,
+            'per_page' => $perPage,
+            'has_more' => ($page * $perPage) < $total,
+            'users' => $users,
+            'tab' => $tab,
+        ]);
+    }
 }

app/Http/Controllers/HolidayController.php

@@ -15,14 +15,20 @@ namespace App\Http\Controllers;
 
 use App\Enums\CurrencySource;
 use App\Models\HolidayClaim;
-use App\Models\HolidayEvent;
+use App\Models\HolidayEventRun;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 
+/**
+ * 类功能：处理节日福利批次的前台领取与状态查询。
+ */
 class HolidayController extends Controller
 {
+    /**
+     * 注入用户金币服务。
+     */
     public function __construct(
         private readonly UserCurrencyService $currency,
     ) {}
@@ -30,56 +36,72 @@ class HolidayController extends Controller
     /**
      * 用户领取节日福利红包。
      *
-     * 从 holiday_claims 中查找当前用户的待领取记录，
-     * 入账金币并更新活动统计数据。
+     * 从 holiday_claims 中查找当前用户在指定批次下的待领取记录，
+     * 入账金币并更新批次统计数据。
      */
-    public function claim(Request $request, HolidayEvent $event): JsonResponse
+    public function claim(Request $request, HolidayEventRun $run): JsonResponse
     {
         $user = $request->user();
 
-        // 活动是否在领取有效期内
-        if (! $event->isClaimable()) {
+        // 批次是否在领取有效期内。
+        if (! $run->isClaimable()) {
             return response()->json(['ok' => false, 'message' => '活动已结束或已过期。']);
         }
 
-        // 查找该用户的领取记录（批量插入时已生成）
-        $claim = HolidayClaim::query()
-            ->where('event_id', $event->id)
-            ->where('user_id', $user->id)
-            ->lockForUpdate()
-            ->first();
+        return DB::transaction(function () use ($run, $user): JsonResponse {
+            /** @var HolidayEventRun|null $lockedRun */
+            $lockedRun = HolidayEventRun::query()
+                ->whereKey($run->id)
+                ->lockForUpdate()
+                ->first();
 
-        if (! $claim) {
-            return response()->json(['ok' => false, 'message' => '您不在本次福利名单内，或活动已结束。']);
-        }
+            if (! $lockedRun || ! $lockedRun->isClaimable()) {
+                return response()->json(['ok' => false, 'message' => '活动已结束或已过期。']);
+            }
 
-        // 防止重复领取（claimed_at 为 null 表示未领取）
-        // 由于批量 insert 时直接写入 claimed_at，需要增加一个 is_claimed 字段
-        // 这里用数据库唯一约束保障幂等性：直接返回已领取的提示
-        return DB::transaction(function () use ($event, $claim, $user): JsonResponse {
-            // 金币入账
+            /** @var HolidayClaim|null $claim */
+            $claim = HolidayClaim::query()
+                ->where('run_id', $lockedRun->id)
+                ->where('user_id', $user->id)
+                ->lockForUpdate()
+                ->first();
+
+            if (! $claim) {
+                return response()->json(['ok' => false, 'message' => '您不在本次福利名单内，或活动已结束。']);
+            }
+
+            // claimed_at 不为空代表本轮已领过，直接返回幂等提示。
+            if ($claim->claimed_at !== null) {
+                return response()->json([
+                    'ok' => false,
+                    'message' => '您已领取过本轮福利。',
+                    'amount' => $claim->amount,
+                ]);
+            }
+
+            // 金币入账。
             $this->currency->change(
                 $user,
                 'gold',
                 $claim->amount,
                 CurrencySource::HOLIDAY_BONUS,
-                "节日福利：{$event->name}",
+                "节日福利：{$lockedRun->event_name}",
             );
 
-            // 更新活动统计（只在首次领取时）
-            HolidayEvent::query()
-                ->where('id', $event->id)
-                ->increment('claimed_amount', $claim->amount);
+            // 领取成功后只更新 claimed_at，不再删除记录，便于幂等和历史追踪。
+            $claim->update(['claimed_at' => now()]);
 
-            // 删除领取记录（以此标记"已领取"，防止重复调用）
-            $claim->delete();
+            // 批次领取统计按成功领取次数累计。
+            $lockedRun->increment('claimed_count');
+            $lockedRun->increment('claimed_amount', $claim->amount);
 
-            // 检查是否已全部领完
-            if ($event->max_claimants > 0) {
-                $remaining = HolidayClaim::where('event_id', $event->id)->count();
-                if ($remaining === 0) {
-                    $event->update(['status' => 'completed']);
-                }
+            $remainingPendingClaims = HolidayClaim::query()
+                ->where('run_id', $lockedRun->id)
+                ->whereNull('claimed_at')
+                ->count();
+
+            if ($remainingPendingClaims === 0) {
+                $lockedRun->update(['status' => 'completed']);
             }
 
             return response()->json([
@@ -91,21 +113,23 @@ class HolidayController extends Controller
     }
 
     /**
-     * 查询当前用户在指定活动中的待领取状态。
+     * 查询当前用户在指定批次中的待领取状态。
      */
-    public function status(Request $request, HolidayEvent $event): JsonResponse
+    public function status(Request $request, HolidayEventRun $run): JsonResponse
     {
         $user = $request->user();
 
         $claim = HolidayClaim::query()
-            ->where('event_id', $event->id)
+            ->where('run_id', $run->id)
             ->where('user_id', $user->id)
             ->first();
 
         return response()->json([
-            'claimable' => $claim !== null && $event->isClaimable(),
+            'claimable' => $claim !== null && $claim->claimed_at === null && $run->isClaimable(),
+            'claimed' => $claim?->claimed_at !== null,
             'amount' => $claim?->amount ?? 0,
-            'expires_at' => $event->expires_at?->toIso8601String(),
+            'status' => $run->status,
+            'expires_at' => $run->expires_at?->toIso8601String(),
         ]);
     }
 }

app/Http/Controllers/HorseRaceController.php

@@ -17,21 +17,28 @@
 namespace App\Http\Controllers;
 
 use App\Enums\CurrencySource;
-use App\Events\MessageSent;
-use App\Jobs\SaveMessageJob;
 use App\Models\GameConfig;
 use App\Models\HorseBet;
 use App\Models\HorseRace;
-use App\Services\ChatStateService;
+use App\Services\GameBetBroadcastService;
+use App\Services\GameRoomScopeService;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 
+/**
+ * 类功能：赛马竞猜前台控制器
+ *
+ * 负责聊天室赛马玩法的当前场次查询、下注提交、历史记录读取，
+ * 并在发现线上遗留的超时 running 场次时执行最小范围的状态自愈。
+ */
 class HorseRaceController extends Controller
 {
     public function __construct(
         private readonly UserCurrencyService $currency,
+        private readonly GameRoomScopeService $roomScopeService,
+        private readonly GameBetBroadcastService $betBroadcastService,
     ) {}
 
     /**
@@ -40,7 +47,16 @@ class HorseRaceController extends Controller
     public function currentRace(Request $request): JsonResponse
     {
         $user = $request->user();
-        $race = HorseRace::currentRace();
+        if (! $user) {
+            return response()->json(['message' => '未登录', 'status' => 'error'], 401);
+        }
+
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $user);
+        if (! $this->roomScopeService->isRoomAllowedForGame('horse_racing', $roomId)) {
+            return response()->json(['race' => null, 'jjb' => (int) ($user->jjb ?? 0)]);
+        }
+
+        $race = $this->resolveCurrentRaceState(HorseRace::currentRace($roomId));
 
         if (! $race) {
             return response()->json([
@@ -70,15 +86,16 @@ class HorseRaceController extends Controller
         $oddsMap = HorseRace::calcOdds($horsePools, $houseTake, $seedPool);
 
         // 计算实时赔率
-        $horses = $race->horses ?? [];
-        $horsesWithBets = array_map(function ($horse) use ($horsePools, $oddsMap) {
-            $horsePool = (int) ($horsePools[$horse['id']] ?? 0);
-            $odds = $horsePool > 0 ? ($oddsMap[$horse['id']] ?? null) : null;
+        $horses = $this->normalizeRaceHorses($race->horses);
+        $horsesWithBets = array_map(function (array $horse) use ($horsePools, $oddsMap) {
+            $horseId = (int) $horse['id'];
+            $horsePool = (int) ($horsePools[$horseId] ?? 0);
+            $odds = $horsePool > 0 ? ($oddsMap[$horseId] ?? null) : null;
 
             return [
-                'id' => $horse['id'],
-                'name' => $horse['name'],
-                'emoji' => $horse['emoji'],
+                'id' => $horseId,
+                'name' => (string) $horse['name'],
+                'emoji' => (string) $horse['emoji'],
                 'pool' => $horsePool,
                 'odds' => $odds,
             ];
@@ -134,6 +151,11 @@ class HorseRaceController extends Controller
             'horse_id' => 'required|integer|min:1',
             'amount' => 'required|integer|min:1',
         ]);
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+
+        if (! $this->roomScopeService->isRoomAllowedForGame('horse_racing', $roomId)) {
+            return response()->json(['ok' => false, 'message' => '当前房间未开启赛马竞猜。'], 403);
+        }
 
         $config = GameConfig::forGame('horse_racing')?->params ?? [];
         $minBet = (int) ($config['min_bet'] ?? 100);
@@ -145,12 +167,12 @@ class HorseRaceController extends Controller
 
         $race = HorseRace::find($data['race_id']);
 
-        if (! $race || ! $race->isBettingOpen()) {
+        if (! $race || (int) $race->room_id !== $roomId || ! $race->isBettingOpen()) {
             return response()->json(['ok' => false, 'message' => '当前不在下注时间内。']);
         }
 
         // 验证马匹 ID 是否有效
-        $horses = $race->horses ?? [];
+        $horses = $this->normalizeRaceHorses($race->horses);
         $validIds = array_column($horses, 'id');
         if (! in_array($data['horse_id'], $validIds, true)) {
             return response()->json(['ok' => false, 'message' => '无效的马匹编号。']);
@@ -178,12 +200,7 @@ class HorseRaceController extends Controller
 
             // 找出马匹名称
             $horseName = '';
-            foreach ($horses as $horse) {
-                if ((int) $horse['id'] === (int) $data['horse_id']) {
-                    $horseName = ($horse['emoji'] ?? '').($horse['name'] ?? '');
-                    break;
-                }
-            }
+            $horseName = $this->resolveHorseDisplayName($horses, (int) $data['horse_id']);
 
             // 扣除金币
             $currency->change(
@@ -203,23 +220,7 @@ class HorseRaceController extends Controller
                 'status' => 'pending',
             ]);
 
-            $chatState = app(ChatStateService::class);
-            $formattedAmount = number_format($data['amount']);
-            $content = "🐎 <b>【赛马】【{$user->username}】</b> 押注了 <b>{$formattedAmount}</b> 金币（{$horseName}）！✨";
-            $msg = [
-                'id' => $chatState->nextMessageId(1),
-                'room_id' => 1,
-                'from_user' => '系统传音',
-                'to_user' => '大家',
-                'content' => $content,
-                'is_secret' => false,
-                'font_color' => '#d97706',
-                'action' => '',
-                'sent_at' => now()->toDateTimeString(),
-            ];
-            $chatState->pushMessage(1, $msg);
-            event(new MessageSent(1, $msg));
-            SaveMessageJob::dispatch($msg);
+            $this->betBroadcastService->horseRace((int) $race->room_id, $user->username, (int) $data['amount'], $horseName);
 
             return response()->json([
                 'ok' => true,
@@ -235,7 +236,9 @@ class HorseRaceController extends Controller
      */
     public function history(): JsonResponse
     {
+        $roomId = $this->roomScopeService->resolveUserRoomId(auth()->user());
         $races = HorseRace::query()
+            ->where('room_id', $roomId)
             ->where('status', 'settled')
             ->orderByDesc('id')
             ->limit(10)
@@ -244,9 +247,9 @@ class HorseRaceController extends Controller
         // 转换获胜马匹名称
         $history = $races->map(function ($race) {
             $winnerName = '未知';
-            foreach (($race->horses ?? []) as $horse) {
-                if (($horse['id'] ?? 0) === (int) $race->winner_horse_id) {
-                    $winnerName = ($horse['emoji'] ?? '').($horse['name'] ?? '');
+            foreach ($this->normalizeRaceHorses($race->horses) as $horse) {
+                if ((int) $horse['id'] === (int) $race->winner_horse_id) {
+                    $winnerName = (string) $horse['emoji'].(string) $horse['name'];
                     break;
                 }
             }
@@ -263,4 +266,169 @@ class HorseRaceController extends Controller
 
         return response()->json(['history' => $history]);
     }
+
+    /**
+     * 自愈当前场次状态，避免线上遗漏结算时长期卡在 running。
+     */
+    private function resolveCurrentRaceState(?HorseRace $race): ?HorseRace
+    {
+        if (! $race || $race->status !== 'running') {
+            return $race;
+        }
+
+        if (! $this->shouldRecoverStaleRunningRace($race)) {
+            return $race;
+        }
+
+        $race = $this->prepareRunningRaceForSettlement($race);
+        if (! $race || $race->status !== 'running' || ! $race->winner_horse_id) {
+            return $race;
+        }
+
+        // 线上若漏消费 CloseHorseRaceJob，这里同步补做一次结算，避免界面一直显示“跑马中”。
+        app()->call([new \App\Jobs\CloseHorseRaceJob($race), 'handle']);
+
+        return HorseRace::currentRace((int) $race->room_id);
+    }
+
+    /**
+     * 判断 running 场次是否已经超过合理比赛时长，需要请求侧补偿收尾。
+     */
+    private function shouldRecoverStaleRunningRace(HorseRace $race): bool
+    {
+        if (! $race->race_starts_at) {
+            return false;
+        }
+
+        $config = GameConfig::forGame('horse_racing')?->params ?? [];
+        $raceDuration = max(1, (int) ($config['race_duration'] ?? 30));
+        $recoveryGraceSeconds = 5;
+
+        return $race->race_starts_at->lte(now()->subSeconds($raceDuration + $recoveryGraceSeconds));
+    }
+
+    /**
+     * 为超时 running 场次补齐缺失赛果字段，确保后续结算任务可以安全执行。
+     */
+    private function prepareRunningRaceForSettlement(HorseRace $race): ?HorseRace
+    {
+        if ($race->winner_horse_id && $race->race_ends_at) {
+            return $race->fresh();
+        }
+
+        $horses = $this->normalizeRaceHorses($race->horses);
+        $winnerHorseId = $race->winner_horse_id ?: $this->resolveStaleRunningWinnerId($race, $horses);
+        if (! $winnerHorseId) {
+            return $race;
+        }
+
+        $config = GameConfig::forGame('horse_racing')?->params ?? [];
+        $seedPool = (int) ($config['seed_pool'] ?? 0);
+
+        // 线上补偿场景下以当前下注快照补齐统计，确保本次请求内的结算口径与正常流程一致。
+        $totalBets = HorseBet::query()->where('race_id', $race->id)->count();
+        $totalPool = $seedPool + (int) HorseBet::query()->where('race_id', $race->id)->sum('amount');
+
+        HorseRace::query()
+            ->where('id', $race->id)
+            ->where('status', 'running')
+            ->update([
+                'winner_horse_id' => $winnerHorseId,
+                'race_ends_at' => $race->race_ends_at ?? now(),
+                'total_bets' => $totalBets,
+                'total_pool' => $totalPool,
+            ]);
+
+        return $race->fresh();
+    }
+
+    /**
+     * 为异常滞留的 running 场次推导一个稳定冠军，避免多次请求得到不同结算结果。
+     *
+     * @param  array<int, array{id:int,name:string,emoji:string}>  $horses
+     */
+    private function resolveStaleRunningWinnerId(HorseRace $race, array $horses): ?int
+    {
+        if ($horses === []) {
+            return null;
+        }
+
+        $horsePools = HorseBet::query()
+            ->where('race_id', $race->id)
+            ->groupBy('horse_id')
+            ->selectRaw('horse_id, SUM(amount) as pool')
+            ->pluck('pool', 'horse_id')
+            ->map(fn ($pool) => (int) $pool)
+            ->toArray();
+
+        $candidateIds = array_map(
+            fn (array $horse): int => (int) $horse['id'],
+            $horses,
+        );
+
+        usort($candidateIds, function (int $leftId, int $rightId) use ($horsePools): int {
+            $leftPool = (int) ($horsePools[$leftId] ?? 0);
+            $rightPool = (int) ($horsePools[$rightId] ?? 0);
+
+            if ($leftPool === $rightPool) {
+                return $leftId <=> $rightId;
+            }
+
+            return $rightPool <=> $leftPool;
+        });
+
+        return $candidateIds[0] ?? null;
+    }
+
+    /**
+     * 兼容旧赛马数据结构，统一清洗为前端可消费的马匹数组。
+     *
+     * @return array<int, array{id:int,name:string,emoji:string}>
+     */
+    private function normalizeRaceHorses(mixed $horses): array
+    {
+        if (! is_array($horses)) {
+            return [];
+        }
+
+        $normalizedHorses = [];
+
+        foreach ($horses as $index => $horse) {
+            if (! is_array($horse)) {
+                continue;
+            }
+
+            $horseId = isset($horse['id']) && is_numeric($horse['id'])
+                ? (int) $horse['id']
+                : $index + 1;
+            $horseName = trim((string) ($horse['name'] ?? ''));
+            if ($horseName === '') {
+                $horseName = '未知马匹';
+            }
+
+            $normalizedHorses[] = [
+                'id' => $horseId,
+                'name' => $horseName,
+                'emoji' => (string) ($horse['emoji'] ?? '🐎'),
+            ];
+        }
+
+        return $normalizedHorses;
+    }
+
+    /**
+     * 根据马匹编号返回展示名称，供系统播报与下注回执共用。
+     *
+     * @param  array<int, array{id:int,name:string,emoji:string}>  $horses
+     */
+    private function resolveHorseDisplayName(array $horses, int $horseId): string
+    {
+        foreach ($horses as $horse) {
+            if ((int) ($horse['id'] ?? 0) === $horseId) {
+                return (string) ($horse['emoji'] ?? '🐎').(string) ($horse['name'] ?? '未知马匹');
+            }
+        }
+
+        return '🐎未知马匹';
+    }
 }

app/Http/Controllers/LeaderboardController.php

@@ -12,11 +12,15 @@
 
 namespace App\Http\Controllers;
 
+use App\Enums\CurrencySource;
 use App\Models\User;
 use App\Services\UserCurrencyService;
 use Illuminate\Support\Facades\Cache;
 use Illuminate\View\View;
 
+/**
+ * 类功能：展示全站排行榜、今日排行榜与用户个人积分流水记录。
+ */
 class LeaderboardController extends Controller
 {
     /**
@@ -133,8 +137,15 @@ class LeaderboardController extends Controller
         $user = auth()->user();
         $currency = request('currency');
         $days = (int) request('days', 7);
-        $logs = $this->currencyService->userLogs($user->id, $currency ?: null, $days);
+        $direction = in_array(request('direction'), ['income', 'expense'], true) ? request('direction') : null;
+        $sourceOptions = CurrencySource::cases();
+        $allowedSources = collect($sourceOptions)->map(fn (CurrencySource $source) => $source->value)->all();
+        $selectedSources = collect(request()->array('sources'))
+            ->filter(fn (string $source) => in_array($source, $allowedSources, true))
+            ->values()
+            ->all();
+        $logs = $this->currencyService->userLogs($user->id, $currency ?: null, $days, $direction, $selectedSources);
 
-        return view('leaderboard.my-logs', compact('logs', 'user', 'currency', 'days'));
+        return view('leaderboard.my-logs', compact('logs', 'user', 'currency', 'days', 'direction', 'sourceOptions', 'selectedSources'));
     }
 }

app/Http/Controllers/LotteryController.php

@@ -19,27 +19,38 @@ namespace App\Http\Controllers;
 use App\Models\GameConfig;
 use App\Models\LotteryIssue;
 use App\Models\LotteryTicket;
+use App\Services\GameRoomScopeService;
 use App\Services\LotteryService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 
+/**
+ * 类功能：提供双色球当前期、购票和历史记录接口。
+ */
 class LotteryController extends Controller
 {
     public function __construct(
         private readonly LotteryService $lottery,
+        private readonly GameRoomScopeService $roomScopeService,
     ) {}
 
     /**
      * 返回当期状态：期号、奖池、剩余时间、我本期购票列表。
      */
-    public function current(): JsonResponse
+    public function current(Request $request): JsonResponse
     {
         if (! GameConfig::isEnabled('lottery')) {
             return response()->json(['enabled' => false]);
         }
 
-        $issue = LotteryIssue::currentIssue() ?? LotteryIssue::latestIssue();
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request);
+
+        if (! $this->roomScopeService->isRoomAllowedForGame('lottery', $roomId)) {
+            return response()->json(['enabled' => false, 'message' => '当前房间未开启双色球彩票。'], 403);
+        }
+
+        $issue = LotteryIssue::currentIssue($roomId) ?? LotteryIssue::latestIssue($roomId);
 
         if (! $issue) {
             return response()->json(['enabled' => true, 'issue' => null]);
@@ -90,6 +101,11 @@ class LotteryController extends Controller
      */
     public function buy(Request $request): JsonResponse
     {
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request);
+        if (! $this->roomScopeService->isRoomAllowedForGame('lottery', $roomId)) {
+            return response()->json(['status' => 'error', 'message' => '当前房间未开启双色球彩票。'], 403);
+        }
+
         $request->validate([
             'numbers' => 'required|array|min:1',
             'numbers.*.reds' => 'required|array|size:3',
@@ -132,7 +148,9 @@ class LotteryController extends Controller
      */
     public function history(): JsonResponse
     {
+        $roomId = $this->roomScopeService->resolveUserRoomId(Auth::user());
         $issues = LotteryIssue::query()
+            ->where('room_id', $roomId)
             ->where('status', 'settled')
             ->latest()
             ->limit(20)

app/Http/Controllers/MysteryBoxController.php

@@ -28,28 +28,38 @@ use App\Models\GameConfig;
 use App\Models\MysteryBox;
 use App\Models\MysteryBoxClaim;
 use App\Services\ChatStateService;
+use App\Services\GameRoomScopeService;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 
+/**
+ * 类功能：提供神秘箱子状态查询与暗号开箱接口。
+ */
 class MysteryBoxController extends Controller
 {
     public function __construct(
         private readonly UserCurrencyService $currency,
         private readonly ChatStateService $chatState,
+        private readonly GameRoomScopeService $roomScopeService,
     ) {}
 
     /**
      * 查询当前可领取的箱子状态（给前端轮询/显示用）。
      */
-    public function status(): JsonResponse
+    public function status(Request $request): JsonResponse
     {
         if (! GameConfig::isEnabled('mystery_box')) {
             return response()->json(['active' => false]);
         }
 
-        $box = MysteryBox::currentOpenBox();
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request);
+        if (! $this->roomScopeService->isRoomAllowedForGame('mystery_box', $roomId)) {
+            return response()->json(['active' => false]);
+        }
+
+        $box = MysteryBox::currentOpenBox($roomId);
 
         if (! $box) {
             return response()->json(['active' => false]);
@@ -85,10 +95,16 @@ class MysteryBoxController extends Controller
         }
 
         $user = $request->user();
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $user);
 
-        return DB::transaction(function () use ($user, $passcode): JsonResponse {
+        if (! $this->roomScopeService->isRoomAllowedForGame('mystery_box', $roomId)) {
+            return response()->json(['ok' => false, 'message' => '当前房间未开启神秘箱子。'], 403);
+        }
+
+        return DB::transaction(function () use ($user, $passcode, $roomId): JsonResponse {
             // 查找匹配暗号的可领取箱子（加锁防并发）
             $box = MysteryBox::query()
+                ->where('room_id', $roomId)
                 ->where('passcode', $passcode)
                 ->where('status', 'open')
                 ->where(fn ($q) => $q->whereNull('expires_at')->orWhere('expires_at', '>', now()))
@@ -147,18 +163,16 @@ class MysteryBoxController extends Controller
         $typeName = $box->typeName();
 
         if ($reward >= 0) {
-            $content = "{$emoji}【神秘箱子】开箱播报：恭喜 【{$username}】 抢到了神秘{$typeName}！"
-                .'获得 💰'.number_format($reward).' 金币！';
+            $content = "{$emoji} 【{$username}】抢到{$typeName}，获得 💰".number_format($reward).' 金币！';
             $color = $box->box_type === 'rare' ? '#c4b5fd' : '#34d399';
         } else {
-            $content = "☠️【神秘箱子】《黑化陷阱》haha！【{$username}】 中了神秘黑化箱的陷阱！"
-                .'被扣除 💰'.number_format(abs($reward)).' 金币！点背~';
+            $content = "☠️ 【{$username}】踩中黑化陷阱，扣除 💰".number_format(abs($reward)).' 金币！';
             $color = '#f87171';
         }
 
         $msg = [
-            'id' => $this->chatState->nextMessageId(1),
-            'room_id' => 1,
+            'id' => $this->chatState->nextMessageId((int) $box->room_id),
+            'room_id' => (int) $box->room_id,
             'from_user' => '系统传音',
             'to_user' => '大家',
             'content' => $content,
@@ -168,8 +182,8 @@ class MysteryBoxController extends Controller
             'sent_at' => now()->toDateTimeString(),
         ];
 
-        $this->chatState->pushMessage(1, $msg);
-        broadcast(new MessageSent(1, $msg));
+        $this->chatState->pushMessage((int) $box->room_id, $msg);
+        broadcast(new MessageSent((int) $box->room_id, $msg));
         SaveMessageJob::dispatch($msg);
     }
 }

app/Http/Controllers/PasswordResetController.php

@@ -19,6 +19,7 @@ use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Hash;
 use Illuminate\Support\Facades\Password;
+use Illuminate\Support\Facades\RateLimiter;
 use Illuminate\Support\Str;
 
 /**
@@ -37,6 +38,64 @@ class PasswordResetController extends Controller
         ]);
     }
 
+    /**
+     * 账号检测接口：根据昵称检测是否绑定微信或邮箱，并提供分流依据（支持 IP 防扫限流）。
+     */
+    public function checkAccount(Request $request): JsonResponse
+    {
+        $request->validate([
+            'username' => 'required|string|max:100',
+        ]);
+
+        $username = trim((string) $request->input('username'));
+        $ip = $request->ip();
+
+        // IP 防扫描节流限制：每个 IP 每 1 分钟最多请求 5 次
+        $ipKey = 'pw-check:ip:'.$ip;
+        if (RateLimiter::tooManyAttempts($ipKey, 5)) {
+            $seconds = RateLimiter::availableIn($ipKey);
+
+            return response()->json([
+                'status' => 'error',
+                'message' => "账号检测请求过于频繁，请在 {$seconds} 秒后重试。",
+            ], 429);
+        }
+        RateLimiter::hit($ipKey, 60);
+
+        $user = User::query()->where('username', $username)->first();
+        if (! $user) {
+            return response()->json([
+                'status' => 'not_found',
+                'message' => '抱歉，没有找到该昵称对应的账号。请确认后再试。',
+            ]);
+        }
+
+        $hasEmail = ! empty($user->email);
+        $hasWechat = ! empty($user->wxid);
+
+        // 对邮箱地址进行安全脱敏（如 pllx@ay.lc -> p***x@ay.lc）
+        $maskedEmail = '';
+        if ($hasEmail) {
+            $parts = explode('@', $user->email);
+            $name = $parts[0] ?? '';
+            $domain = $parts[1] ?? '';
+            $len = strlen($name);
+            if ($len <= 2) {
+                $maskedEmail = substr($name, 0, 1).'*'.'@'.$domain;
+            } else {
+                $maskedEmail = substr($name, 0, 1).str_repeat('*', $len - 2).substr($name, -1).'@'.$domain;
+            }
+        }
+
+        return response()->json([
+            'status' => 'success',
+            'username' => $user->username,
+            'has_email' => $hasEmail,
+            'has_wechat' => $hasWechat,
+            'masked_email' => $maskedEmail,
+        ]);
+    }
+
     /**
      * 发送邮箱找回密码链接。
      */
@@ -49,7 +108,49 @@ class PasswordResetController extends Controller
             ], 403);
         }
 
-        $email = trim((string) $request->string('email'));
+        $inputEmail = trim((string) $request->input('email', ''));
+        $username = trim((string) $request->input('username', ''));
+        $ip = $request->ip();
+
+        $user = User::query()->where('username', $username)->first();
+        if (! $user || empty($user->email)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => '找不到绑定了邮箱的账号。',
+            ], 422);
+        }
+
+        // 强行双向比对核对（忽略大小写和前后空白）
+        if (strcasecmp($user->email, $inputEmail) !== 0) {
+            return response()->json([
+                'status' => 'error',
+                'message' => '输入的完整邮箱地址与该账号绑定的邮箱不一致，二次确认失败。',
+            ], 422);
+        }
+
+        $email = $user->email;
+
+        // 1. IP 级别发信限流：限制单个 IP 每分钟最多请求 2 次
+        $ipKey = 'pw-email:ip:'.$ip;
+        if (RateLimiter::tooManyAttempts($ipKey, 2)) {
+            $seconds = RateLimiter::availableIn($ipKey);
+
+            return response()->json([
+                'status' => 'error',
+                'message' => "发送验证链接过于频繁，请在 {$seconds} 秒后重试。",
+            ], 429);
+        }
+
+        // 2. 账号邮箱级别冷却锁：同一个邮箱每 3 分钟限发 1 次，防止狂刷邮件轰炸他人
+        $targetKey = 'pw-email:target:'.md5($email);
+        if (RateLimiter::tooManyAttempts($targetKey, 1)) {
+            $seconds = RateLimiter::availableIn($targetKey);
+
+            return response()->json([
+                'status' => 'error',
+                'message' => "该账号申请重置链接过于频繁，请在 {$seconds} 秒后重试。",
+            ], 429);
+        }
 
         // 邮箱找回必须保证一邮一号，否则重置目标会产生歧义。
         if (User::query()->where('email', $email)->count() > 1) {
@@ -59,6 +160,10 @@ class PasswordResetController extends Controller
             ], 422);
         }
 
+        // 记录发信请求频率
+        RateLimiter::hit($ipKey, 60);
+        RateLimiter::hit($targetKey, 180);
+
         $status = Password::sendResetLink(['email' => $email]);
 
         if ($status === Password::RESET_LINK_SENT) {

app/Http/Controllers/RedPacketController.php

@@ -4,7 +4,8 @@
  * 文件功能：聊天室礼包（红包）控制器
  *
  * 提供两个核心接口：
- *  - send()  ：superlevel 站长凭空发出 888 数量 10 份礼包（金币 or 经验）
+ *  - config()：读取当前职务的默认礼包数量与份数
+ *  - send()  ：拥有权限的职务用户按职务配置发出礼包（金币 or 经验）
  *  - claim() ：在线用户抢礼包（先到先得，每人一份）
  *
  * 接入 UserCurrencyService 记录所有货币变动流水。
@@ -23,9 +24,12 @@ use App\Events\RedPacketSent;
 use App\Jobs\SaveMessageJob;
 use App\Models\RedPacketClaim;
 use App\Models\RedPacketEnvelope;
-use App\Models\Sysparam;
+use App\Models\User;
 use App\Services\ChatStateService;
+use App\Services\GameBetBroadcastService;
+use App\Services\PositionPermissionService;
 use App\Services\UserCurrencyService;
+use App\Support\PositionPermissionRegistry;
 use Illuminate\Database\UniqueConstraintViolationException;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -39,11 +43,11 @@ use Illuminate\Support\Facades\DB;
  */
 class RedPacketController extends Controller
 {
-    /** 礼包固定总数量 */
-    private const TOTAL_AMOUNT = 8888;
+    /** 礼包默认总数量 */
+    private const DEFAULT_TOTAL_AMOUNT = 8888;
 
-    /** 礼包固定份数 */
-    private const TOTAL_COUNT = 10;
+    /** 礼包默认份数 */
+    private const DEFAULT_TOTAL_COUNT = 10;
 
     /** 礼包有效期（秒） */
     private const EXPIRE_SECONDS = 300;
@@ -54,12 +58,38 @@ class RedPacketController extends Controller
     public function __construct(
         private readonly ChatStateService $chatState,
         private readonly UserCurrencyService $currencyService,
+        private readonly PositionPermissionService $positionPermissionService,
+        private readonly GameBetBroadcastService $betBroadcastService,
     ) {}
 
     /**
-     * superlevel 站长凭空发出礼包。
+     * 获取当前用户可发出的礼包默认配置。
      *
-     * 不扣发包人自身货币，888 数量凭空发出分 10 份。
+     * 聊天室发包弹窗打开时调用，确保页面展示与最终发包数量同源。
+     */
+    public function config(): JsonResponse
+    {
+        $user = Auth::user();
+
+        // 仅拥有礼包红包权限的在职职务可以读取发包配置。
+        if (! $this->positionPermissionService->hasPermission($user, PositionPermissionRegistry::ROOM_RED_PACKET)) {
+            return response()->json(['status' => 'error', 'message' => '当前职务无权发礼包红包'], 403);
+        }
+
+        $redPacketConfig = $this->redPacketConfigForUser($user);
+
+        return response()->json([
+            'status' => 'success',
+            'amount' => $redPacketConfig['amount'],
+            'count' => $redPacketConfig['count'],
+            'expire_seconds' => self::EXPIRE_SECONDS,
+        ]);
+    }
+
+    /**
+     * 拥有权限的职务用户凭空发出礼包。
+     *
+     * 不扣发包人自身货币，礼包总量和份数读取当前在职职务配置。
      * type 参数决定本次发出的是金币（gold）还是经验（exp）。
      *
      * @param  Request  $request  需包含 room_id 和 type（gold / exp）
@@ -75,12 +105,15 @@ class RedPacketController extends Controller
         $roomId = (int) $request->input('room_id');
         $type = $request->input('type'); // 'gold' 或 'exp'
 
-        // 权限校验：仅 superlevel 可发礼包
-        $superLevel = (int) Sysparam::getValue('superlevel', '100');
-        if ($user->user_level < $superLevel) {
-            return response()->json(['status' => 'error', 'message' => '仅站长可发礼包红包'], 403);
+        // 改为按职务权限码控制礼包发放。
+        if (! $this->positionPermissionService->hasPermission($user, PositionPermissionRegistry::ROOM_RED_PACKET)) {
+            return response()->json(['status' => 'error', 'message' => '当前职务无权发礼包红包'], 403);
         }
 
+        $redPacketConfig = $this->redPacketConfigForUser($user);
+        $totalAmount = $redPacketConfig['amount'];
+        $totalCount = $redPacketConfig['count'];
+
         // 检查该用户在此房间是否有进行中的红包（防止刷包）
         $activeExists = RedPacketEnvelope::query()
             ->where('sender_id', $user->id)
@@ -93,8 +126,8 @@ class RedPacketController extends Controller
             return response()->json(['status' => 'error', 'message' => '您有一个礼包尚未领完，请稍后再发！'], 422);
         }
 
-        // 随机拆分数量（二倍均值法，保证每份至少 1，总额精确等于 TOTAL_AMOUNT）
-        $amounts = $this->splitAmount(self::TOTAL_AMOUNT, self::TOTAL_COUNT);
+        // 随机拆分数量（二倍均值法，保证每份至少 1，总额精确等于职务配置总量）
+        $amounts = $this->splitAmount($totalAmount, $totalCount);
 
         // 货币展示文案
         $typeLabel = $type === 'exp' ? '经验' : '金币';
@@ -104,15 +137,15 @@ class RedPacketController extends Controller
             : 'linear-gradient(135deg,#dc2626,#ea580c)';
 
         // 事务：创建红包记录 + Redis 写入分额
-        $envelope = DB::transaction(function () use ($user, $roomId, $type, $amounts): RedPacketEnvelope {
+        $envelope = DB::transaction(function () use ($user, $roomId, $type, $amounts, $totalAmount, $totalCount): RedPacketEnvelope {
             // 创建红包主记录（凭空发出，不扣发包人货币）
             $envelope = RedPacketEnvelope::create([
                 'sender_id' => $user->id,
                 'sender_username' => $user->username,
                 'room_id' => $roomId,
                 'type' => $type,
-                'total_amount' => self::TOTAL_AMOUNT,
-                'total_count' => self::TOTAL_COUNT,
+                'total_amount' => $totalAmount,
+                'total_count' => $totalCount,
                 'claimed_count' => 0,
                 'claimed_amount' => 0,
                 'status' => 'active',
@@ -137,8 +170,8 @@ class RedPacketController extends Controller
         $btnHtml = '<button data-sent-at="'.time().'" onclick="showRedPacketModal('
             .$envelope->id
             .',\''.$user->username.'\','
-            .self::TOTAL_AMOUNT.','
-            .self::TOTAL_COUNT.','
+            .$totalAmount.','
+            .$totalCount.','
             .self::EXPIRE_SECONDS
             .',\''.$type.'\''
             .')" style="margin-left:8px;padding:2px 10px;background:'.$btnBg.';'
@@ -150,7 +183,7 @@ class RedPacketController extends Controller
             'room_id' => $roomId,
             'from_user' => '系统公告',
             'to_user' => '',
-            'content' => "🧧 <b>{$user->username}</b> 发出了一个 <b>".self::TOTAL_AMOUNT."</b> {$typeLabel}的礼包！共 ".self::TOTAL_COUNT." 份，先到先得，快去抢！{$btnHtml}",
+            'content' => "🧧 <b>{$user->username}</b> 发出了一个 <b>{$totalAmount}</b> {$typeLabel}的礼包！共 {$totalCount} 份，先到先得，快去抢！{$btnHtml}",
             'is_secret' => false,
             'font_color' => $type === 'exp' ? '#6d28d9' : '#b91c1c',
             'action' => '',
@@ -165,15 +198,15 @@ class RedPacketController extends Controller
             roomId: $roomId,
             envelopeId: $envelope->id,
             senderUsername: $user->username,
-            totalAmount: self::TOTAL_AMOUNT,
-            totalCount: self::TOTAL_COUNT,
+            totalAmount: $totalAmount,
+            totalCount: $totalCount,
             expireSeconds: self::EXPIRE_SECONDS,
             type: $type,
         ));
 
         return response()->json([
             'status' => 'success',
-            'message' => "🧧 {$typeLabel}礼包已发出！".self::TOTAL_AMOUNT." {$typeLabel} · ".self::TOTAL_COUNT.' 份',
+            'message' => "🧧 {$typeLabel}礼包已发出！{$totalAmount} {$typeLabel} · {$totalCount} 份",
         ]);
     }
 
@@ -326,23 +359,9 @@ class RedPacketController extends Controller
             type: $envelopeType,
         ));
 
-        // 在聊天室发送领取播报（所有人可见）
+        // 在聊天室发送领取播报并附带右下角通知，提醒房间内所有在线人员。
         $typeLabel = $envelopeType === 'exp' ? '经验' : '金币';
-        $typeIcon = $envelopeType === 'exp' ? '✨' : '💰';
-        $claimedMsg = [
-            'id' => $this->chatState->nextMessageId($roomId),
-            'room_id' => $roomId,
-            'from_user' => '系统传音',
-            'to_user' => '',
-            'content' => "🧧 <b>{$user->username}</b> 抢到了 <b>{$amount}</b> {$typeLabel}礼包！{$typeIcon}",
-            'is_secret' => false,
-            'font_color' => $envelopeType === 'exp' ? '#6d28d9' : '#d97706',
-            'action' => '',
-            'sent_at' => now()->toDateTimeString(),
-        ];
-        $this->chatState->pushMessage($roomId, $claimedMsg);
-        broadcast(new MessageSent($roomId, $claimedMsg));
-        SaveMessageJob::dispatch($claimedMsg);
+        $this->betBroadcastService->redPacketClaimed($roomId, $user->username, $amount, $envelopeType);
 
         $balanceField = $envelopeType === 'exp' ? 'exp_num' : 'jjb';
         $balanceNow = $user->fresh()->$balanceField;
@@ -388,4 +407,34 @@ class RedPacketController extends Controller
 
         return $amounts;
     }
+
+    /**
+     * 按当前在职职务解析礼包红包配置。
+     *
+     * @return array{amount: int, count: int}
+     */
+    private function redPacketConfigForUser(User $user): array
+    {
+        $position = $user->activePosition?->position;
+        $amount = (int) ($position?->red_packet_amount ?? self::DEFAULT_TOTAL_AMOUNT);
+        $count = (int) ($position?->red_packet_count ?? self::DEFAULT_TOTAL_COUNT);
+
+        if ($amount < 1) {
+            $amount = self::DEFAULT_TOTAL_AMOUNT;
+        }
+
+        if ($count < 1 || $count > 100) {
+            $count = self::DEFAULT_TOTAL_COUNT;
+        }
+
+        if ($amount < $count) {
+            $amount = self::DEFAULT_TOTAL_AMOUNT;
+            $count = self::DEFAULT_TOTAL_COUNT;
+        }
+
+        return [
+            'amount' => $amount,
+            'count' => $count,
+        ];
+    }
 }

app/Http/Controllers/RiddleQuizController.php

@@ -0,0 +1,269 @@
+<?php
+
+/**
+ * 文件功能：猜谜活动控制器
+ *
+ * 负责兼容现有 idiom-quiz 路由，同时支持猜成语与脑筋急转弯
+ * 两类题型的开题、答题与当前回合查询。
+ */
+
+namespace App\Http\Controllers;
+
+use App\Events\RiddleGameAnswered;
+use App\Models\GameConfig;
+use App\Models\Riddle;
+use App\Models\RiddleGameRound;
+use App\Services\RiddleGameService;
+use App\Services\UserCurrencyService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
+use Illuminate\Support\Facades\Auth;
+use Illuminate\Support\Facades\Redis;
+
+/**
+ * 类功能：处理猜谜活动开题、答题和当前回合读取。
+ */
+class RiddleQuizController extends Controller
+{
+    /**
+     * 方法功能：注入猜谜活动所需的服务。
+     */
+    public function __construct(
+        private readonly RiddleGameService $riddleGameService,
+        private readonly UserCurrencyService $currencyService,
+    ) {}
+
+    /**
+     * 方法功能：管理员手动为指定房间与题型发起一轮猜谜活动。
+     */
+    public function start(Request $request): JsonResponse
+    {
+        $user = Auth::user();
+
+        // 仅站长或具备后台职务的管理用户可手动开题。
+        if (! $user || ($user->id !== 1 && ! $request->user()?->activePosition)) {
+            return response()->json(['status' => 'error', 'message' => '无权限'], 403);
+        }
+
+        $roomId = (int) $request->input('room_id', 0);
+        // 兼容后台新字段 quiz_type 与旧字段 type，两边都允许触发手动出题。
+        $quizType = $this->riddleGameService->normalizeQuizType($request->input('quiz_type', $request->input('type', Riddle::TYPE_IDIOM)));
+        if ($roomId <= 0) {
+            return response()->json(['status' => 'error', 'message' => '缺少房间 ID'], 422);
+        }
+
+        // 猜谜活动总开关关闭时，直接返回明确提示，避免误报成“题库为空”。
+        if (! GameConfig::isEnabled(Riddle::TYPE_IDIOM)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => '猜谜活动未开启，请先到游戏管理中开启后再出题。',
+            ], 400);
+        }
+
+        // 后台手动出题允许覆盖当前同题型回合，避免管理员还要先人工结束上一题。
+        $this->riddleGameService->endActiveRoundsForRoom($roomId, $quizType);
+
+        $round = $this->riddleGameService->startRound($roomId, $quizType);
+        if (! $round) {
+            if (! $this->riddleGameService->pickRandomQuestion($quizType)) {
+                return response()->json(['status' => 'error', 'message' => '当前题型题库中没有可用题目，请先在后台添加。'], 400);
+            }
+
+            return response()->json(['status' => 'error', 'message' => '当前题型暂时无法出题，请检查游戏配置与参与房间设置。'], 400);
+        }
+
+        return response()->json([
+            'status' => 'success',
+            'data' => [
+                'quiz_type' => $round->quiz_type,
+                'quiz_type_label' => $this->riddleGameService->getQuizTypeLabel($round->quiz_type),
+                'round_id' => $round->id,
+                'quiz_round_id' => $round->id,
+                'hint' => $round->idiom?->hint ?? '',
+                'quiz_hint' => $round->idiom?->hint ?? '',
+                'reward_gold' => $round->reward_gold,
+                'reward_exp' => $round->reward_exp,
+                'quiz_reward_gold' => $round->reward_gold,
+                'quiz_reward_exp' => $round->reward_exp,
+            ],
+        ]);
+    }
+
+    /**
+     * 方法功能：提交当前猜谜活动回合的答案。
+     */
+    public function answer(Request $request): JsonResponse
+    {
+        $user = Auth::user();
+        if (! $user) {
+            return response()->json(['status' => 'error', 'message' => '请先登录'], 401);
+        }
+
+        $roundId = (int) $request->input('round_id');
+        $roomId = (int) $request->input('room_id');
+        $quizType = $this->riddleGameService->normalizeQuizType($request->input('quiz_type', $request->input('type', Riddle::TYPE_IDIOM)));
+        $userAnswer = trim((string) $request->input('answer', ''));
+
+        if ($roundId <= 0 || $roomId <= 0 || $userAnswer === '') {
+            return response()->json(['status' => 'error', 'message' => '参数不完整'], 422);
+        }
+
+        $round = RiddleGameRound::with('idiom')->find($roundId);
+        if (! $round || $round->room_id !== $roomId || $round->quiz_type !== $quizType) {
+            return response()->json(['status' => 'error', 'message' => '回合不存在'], 404);
+        }
+
+        // 判题前先做超时结算，避免用户继续抢答无效回合。
+        if ($this->riddleGameService->expireRound($round)) {
+            return response()->json(['status' => 'error', 'message' => '该回合已超时结束'], 400);
+        }
+
+        if ($round->status !== 'active') {
+            if ($round->status === 'answered') {
+                return response()->json([
+                    'status' => 'error',
+                    'message' => "这道{$this->riddleGameService->getQuizTypeLabel($round->quiz_type)}已被「{$round->winner_username}」抢先答对了！",
+                ], 400);
+            }
+
+            return response()->json(['status' => 'error', 'message' => '该回合已结束'], 400);
+        }
+
+        // 答案对比忽略空格与大小写，减少正常输入误判。
+        $normalizedAnswer = str_replace(' ', '', $userAnswer);
+        $normalizedCorrect = str_replace(' ', '', (string) $round->idiom?->answer);
+        if (mb_strtolower($normalizedAnswer) !== mb_strtolower($normalizedCorrect)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => '答案不正确，再想想！',
+            ]);
+        }
+
+        $lockKey = "riddle:answer_lock:{$roundId}";
+        if (! Redis::setnx($lockKey, 1)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => "这道{$this->riddleGameService->getQuizTypeLabel($round->quiz_type)}已被「{$round->winner_username}」抢先答对了！",
+            ], 400);
+        }
+
+        Redis::expire($lockKey, 10);
+
+        // 抢答成功后立即封盘，确保并发请求读到统一状态。
+        $round->update([
+            'status' => 'answered',
+            'winner_id' => $user->id,
+            'winner_username' => $user->username,
+            'ended_at' => now(),
+        ]);
+
+        if ($round->reward_gold > 0) {
+            $this->currencyService->change(
+                $user,
+                'gold',
+                $round->reward_gold,
+                \App\Enums\CurrencySource::GAME_REWARD,
+                $this->riddleGameService->buildRewardDescription($round),
+                $roomId,
+            );
+        }
+
+        if ($round->reward_exp > 0) {
+            // 经验奖励仍沿用现有字段，避免引入额外奖励服务改动。
+            $user->exp_num = ($user->exp_num ?? 0) + $round->reward_exp;
+            $user->save();
+        }
+
+        broadcast(new RiddleGameAnswered(
+            roomId: $roomId,
+            roundId: $round->id,
+            quizType: $round->quiz_type,
+            answer: (string) $round->idiom?->answer,
+            winnerUsername: $user->username,
+            rewardGold: $round->reward_gold,
+            rewardExp: $round->reward_exp,
+        ));
+
+        $quizTypeLabel = $this->riddleGameService->getQuizTypeLabel($round->quiz_type);
+        $resultMsg = [
+            'id' => app(\App\Services\ChatStateService::class)->nextMessageId($roomId),
+            'room_id' => $roomId,
+            'from_user' => '系统传音',
+            'to_user' => '大家',
+            'content' => "🎉 【猜谜活动·{$quizTypeLabel}】{$user->username} 率先答对「{$round->idiom?->answer}」，获得 {$round->reward_gold} 金币、{$round->reward_exp} 经验！",
+            'is_secret' => false,
+            'font_color' => '#16a34a',
+            'action' => 'idiom_result',
+            'winner_username' => $user->username,
+            'quiz_type' => $round->quiz_type,
+            'quiz_type_label' => $quizTypeLabel,
+            'quiz_answer' => (string) $round->idiom?->answer,
+            'quiz_reward_gold' => $round->reward_gold,
+            'quiz_reward_exp' => $round->reward_exp,
+            'quiz_round_id' => $round->id,
+            'quiz_round_ended_id' => $round->id,
+            'idiom_answer' => (string) $round->idiom?->answer,
+            'idiom_result_reward_gold' => $round->reward_gold,
+            'idiom_result_reward_exp' => $round->reward_exp,
+            'idiom_game_round_ended_id' => $round->id,
+            'sent_at' => now()->toDateTimeString(),
+        ];
+        app(\App\Services\ChatStateService::class)->pushMessage($roomId, $resultMsg);
+
+        Redis::del($lockKey);
+
+        return response()->json([
+            'status' => 'success',
+            'message' => "🎉 回答正确！获得 {$round->reward_gold} 金币、{$round->reward_exp} 经验！",
+            'data' => [
+                'quiz_type' => $round->quiz_type,
+                'quiz_type_label' => $quizTypeLabel,
+                'round_id' => $round->id,
+                'quiz_round_id' => $round->id,
+                'answer' => (string) $round->idiom?->answer,
+                'quiz_answer' => (string) $round->idiom?->answer,
+                'reward_gold' => $round->reward_gold,
+                'reward_exp' => $round->reward_exp,
+                'quiz_reward_gold' => $round->reward_gold,
+                'quiz_reward_exp' => $round->reward_exp,
+            ],
+        ]);
+    }
+
+    /**
+     * 方法功能：查询当前房间指定题型的进行中回合。
+     */
+    public function current(Request $request): JsonResponse
+    {
+        $roomId = (int) $request->input('room_id', 0);
+        $quizType = $this->riddleGameService->normalizeQuizType($request->input('quiz_type', $request->input('type', Riddle::TYPE_IDIOM)));
+        if ($roomId <= 0) {
+            return response()->json(['status' => 'error', 'message' => '缺少房间 ID'], 422);
+        }
+
+        $round = $this->riddleGameService->findActiveRound($roomId, $quizType);
+        if (! $round) {
+            return response()->json(['status' => 'success', 'data' => null]);
+        }
+
+        if ($this->riddleGameService->expireRound($round)) {
+            return response()->json(['status' => 'success', 'data' => null]);
+        }
+
+        return response()->json([
+            'status' => 'success',
+            'data' => [
+                'quiz_type' => $round->quiz_type,
+                'quiz_type_label' => $this->riddleGameService->getQuizTypeLabel($round->quiz_type),
+                'round_id' => $round->id,
+                'quiz_round_id' => $round->id,
+                'hint' => $round->idiom?->hint ?? '',
+                'quiz_hint' => $round->idiom?->hint ?? '',
+                'reward_gold' => $round->reward_gold,
+                'reward_exp' => $round->reward_exp,
+                'quiz_reward_gold' => $round->reward_gold,
+                'quiz_reward_exp' => $round->reward_exp,
+            ],
+        ]);
+    }
+}

app/Http/Controllers/RideController.php

@@ -0,0 +1,115 @@
+<?php
+
+/**
+ * 文件功能：聊天室座驾前台接口控制器。
+ *
+ * 提供座驾列表、用户当前座驾、购买记录与购买座驾接口。
+ */
+
+namespace App\Http\Controllers;
+
+use App\Events\MessageSent;
+use App\Http\Requests\BuyRideRequest;
+use App\Jobs\SaveMessageJob;
+use App\Models\Ride;
+use App\Models\Room;
+use App\Models\User;
+use App\Services\ChatStateService;
+use App\Services\RideService;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Support\Facades\Auth;
+
+/**
+ * 聊天室座驾控制器
+ * 负责前台座驾页面的数据读取与购买操作。
+ */
+class RideController extends Controller
+{
+    /**
+     * 构造座驾控制器依赖。
+     */
+    public function __construct(
+        private readonly RideService $rideService,
+        private readonly ChatStateService $chatState,
+    ) {}
+
+    /**
+     * 获取座驾页面需要的商品、当前座驾和购买记录。
+     */
+    public function items(): JsonResponse
+    {
+        $user = Auth::user();
+
+        return response()->json([
+            'items' => $this->rideService->activeItems()
+                ->map(fn (Ride $item) => $this->rideService->formatItem($item))
+                ->values(),
+            'current_ride' => $this->rideService->formatCurrentRide($user),
+            'purchases' => $this->rideService->purchaseRecords($user),
+            'user_jjb' => $user->jjb ?? 0,
+        ]);
+    }
+
+    /**
+     * 购买座驾并返回最新金币和当前座驾状态。
+     */
+    public function buy(BuyRideRequest $request): JsonResponse
+    {
+        $user = Auth::user();
+        $roomId = (int) $request->integer('room_id');
+        $room = Room::query()->findOrFail($roomId);
+
+        if (! $room->canUserEnter($user) || ! $this->chatState->isUserInRoom($roomId, $user->username)) {
+            return response()->json(['status' => 'error', 'message' => '请先进入当前房间后再购买座驾。'], 403);
+        }
+
+        $item = Ride::query()->findOrFail((int) $request->integer('item_id'));
+        $result = $this->rideService->buy($user, $item, $roomId);
+
+        if (! $result['ok']) {
+            return response()->json(['status' => 'error', 'message' => $result['message']], 400);
+        }
+
+        $this->pushRidePurchaseNotice($user, $item, $roomId);
+
+        return response()->json([
+            'status' => 'success',
+            'message' => $result['message'],
+            'current_ride' => $result['current_ride'] ?? null,
+            'purchases' => $this->rideService->purchaseRecords($user->fresh()),
+            'jjb' => $user->fresh()->jjb,
+        ]);
+    }
+
+    /**
+     * 向当前房间广播座驾购买成功通知，方便其他用户快速打开座驾页面。
+     */
+    private function pushRidePurchaseNotice(User $user, Ride $item, int $roomId): void
+    {
+        $button = '<button onclick="openRideModal()">购买座驾</button>';
+        $content = sprintf(
+            '🚀 【座驾】 <b>%s</b> 购买了 <b>%s</b>，有效期 <b>%d 天</b>，排面已安排！%s',
+            e($user->username),
+            e($item->name),
+            (int) $item->duration_days,
+            $button,
+        );
+
+        $message = [
+            'id' => $this->chatState->nextMessageId($roomId),
+            'room_id' => $roomId,
+            'from_user' => '系统传音',
+            'to_user' => '大家',
+            'content' => $content,
+            'is_secret' => false,
+            'font_color' => '#0f766e',
+            'action' => 'ride_purchase',
+            'sent_at' => now()->toDateTimeString(),
+        ];
+
+        // 购买通知需要写入房间消息缓存、实时广播并落库，刷新后仍可追溯。
+        $this->chatState->pushMessage($roomId, $message);
+        broadcast(new MessageSent($roomId, $message));
+        SaveMessageJob::dispatch($message);
+    }
+}

app/Http/Controllers/ShopController.php

@@ -9,8 +9,14 @@ namespace App\Http\Controllers;
 
 use App\Events\EffectBroadcast;
 use App\Events\MessageSent;
+use App\Events\UserStatusUpdated;
+use App\Models\Room;
 use App\Models\ShopItem;
+use App\Models\UserPurchase;
+use App\Services\ChatStateService;
+use App\Services\DecorationService;
 use App\Services\ShopService;
+use App\Support\ChatContentSanitizer;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
@@ -22,6 +28,7 @@ class ShopController extends Controller
      */
     public function __construct(
         private readonly ShopService $shopService,
+        private readonly ChatStateService $chatState,
     ) {}
 
     /**
@@ -33,22 +40,28 @@ class ShopController extends Controller
     public function items(): JsonResponse
     {
         $user = Auth::user();
-        $items = ShopItem::active()->map(fn ($item) => [
-            'id' => $item->id,
-            'name' => $item->name,
-            'slug' => $item->slug,
-            'description' => $item->description,
-            'icon' => $item->icon,
-            'price' => $item->price,
-            'type' => $item->type,
-            'duration_days' => $item->duration_days,
-            'duration_minutes' => $item->duration_minutes,
-            'intimacy_bonus' => $item->intimacy_bonus,
-            'charm_bonus' => $item->charm_bonus,
-        ]);
+        $items = ShopItem::query()
+            ->where('is_active', true)
+            ->orderBy('sort_order')
+            ->get()
+            ->map(fn ($item) => [
+                'id' => $item->id,
+                'name' => $item->name,
+                'slug' => $item->slug,
+                'description' => $item->description,
+                'icon' => $item->icon,
+                'price' => $item->price,
+                'type' => $item->type,
+                'duration_days' => $item->duration_days,
+                'duration_minutes' => $item->duration_minutes,
+                'intimacy_bonus' => $item->intimacy_bonus,
+                'charm_bonus' => $item->charm_bonus,
+            ]);
+
+        $signRepairCard = $items->firstWhere('type', ShopItem::TYPE_SIGN_REPAIR);
 
         // 统计背包中各戒指持有数量
-        $ringCounts = \App\Models\UserPurchase::query()
+        $ringCounts = UserPurchase::query()
             ->where('user_id', $user->id)
             ->where('status', 'active')
             ->whereHas('item', fn ($q) => $q->where('type', 'ring'))
@@ -64,6 +77,10 @@ class ShopController extends Controller
             'has_rename_card' => $this->shopService->hasRenameCard($user),
             'ring_counts' => $ringCounts,
             'auto_fishing_minutes_left' => $this->shopService->getActiveAutoFishingMinutesLeft($user),
+            'sign_repair_card_count' => $this->shopService->getSignRepairCardCount($user),
+            'sign_repair_card_item' => $signRepairCard,
+            // 返回用户当前激活的装扮状态，前端用于渲染装扮卡片上的"已激活/剩余X天"标签
+            'active_decorations' => app(DecorationService::class)->getActiveDecorations($user),
         ]);
     }
 
@@ -74,36 +91,75 @@ class ShopController extends Controller
      *   - recipient  接收者用户名（传 "all" 或留空则全员可见）
      *   - message    公屏赠言（可选）
      *
-     * @param  Request  $request  含 item_id, recipient?, message?
+     * @param  Request  $request  含 item_id, recipient?, message?, quantity?
      */
     public function buy(Request $request): JsonResponse
     {
-        $request->validate(['item_id' => 'required|integer|exists:shop_items,id']);
+        $request->validate([
+            'item_id' => 'required|integer|exists:shop_items,id',
+            'room_id' => 'required|integer|exists:rooms,id',
+            'recipient' => 'nullable|string|max:50',
+            'message' => 'nullable|string|max:120',
+            'quantity' => 'nullable|integer|min:1|max:99',
+        ]);
+
+        $user = Auth::user();
+        $roomId = (int) $request->input('room_id');
+        $room = Room::query()->findOrFail($roomId);
+        if (! $room->canUserEnter($user) || ! $this->chatState->isUserInRoom($roomId, $user->username)) {
+            return response()->json(['status' => 'error', 'message' => '请先进入当前房间后再购买聊天室道具。'], 403);
+        }
 
         $item = ShopItem::find($request->item_id);
         if (! $item->is_active) {
             return response()->json(['status' => 'error', 'message' => '该商品已下架。'], 400);
         }
 
-        $result = $this->shopService->buyItem(Auth::user(), $item);
+        $quantity = (int) $request->input('quantity', 1);
+        $result = $this->shopService->buyItem($user, $item, $quantity);
 
         if (! $result['ok']) {
             return response()->json(['status' => 'error', 'message' => $result['message']], 400);
         }
 
-        $response = ['status' => 'success', 'message' => $result['message']];
+        $response = [
+            'status' => 'success',
+            'message' => $result['message'],
+            'quantity' => $result['quantity'] ?? 1,
+            'total_price' => $result['total_price'] ?? $item->price,
+        ];
+
+        // 购买自动钓鱼卡后返回剩余分钟数，前端用于自动开启钓鱼
+        if ($item->type === 'auto_fishing') {
+            $response['auto_fishing_minutes_left'] = $this->shopService->getActiveAutoFishingMinutesLeft($user);
+        }
+
+        // ── 装扮购买：向前端透传槽位与样式信息，用于即时更新装扮状态 ──
+        if (! empty($result['slot'])) {
+            $response['slot'] = $result['slot'];
+            $response['style'] = $result['style'];
+            $response['expires_at'] = $result['expires_at'];
+
+            // 购买后立即同步所有房间的在线名单，让昵称颜色/头像框立即生效
+            $freshUser = $user->fresh();
+            $presenceData = app(\App\Services\ChatUserPresenceService::class)->build($freshUser);
+            foreach ($this->chatState->getUserRooms($user->username) as $rid) {
+                $this->chatState->userJoin((int) $rid, $user->username, $presenceData);
+                // 广播 UserStatusUpdated 到 Presence Channel，触发前端 chat:user-status-updated 刷新用户列表
+                broadcast(new UserStatusUpdated((int) $rid, $user->username, $presenceData));
+            }
+        }
 
         // ── 单次特效卡：广播给指定用户或全员 ────────────────────────
         if (isset($result['play_effect'])) {
-            $user = Auth::user();
-            $roomId = (int) $request->room_id;
             $recipient = trim($request->input('recipient', ''));     // 空字符串 = 全员
-            $message = trim($request->input('message', ''));
+            $message = ChatContentSanitizer::htmlText($request->input('message', ''));
 
             // recipient 为空或 "all" 表示全员
             $targetUsername = ($recipient === '' || $recipient === 'all') ? null : $recipient;
+            $safeTargetUsername = $targetUsername ? ChatContentSanitizer::htmlText($targetUsername) : null;
 
-            // 广播特效事件（全员频道）
+            // 广播特效事件时保留原始用户名标识，前端需要用它和当前登录名做精确比较。
             broadcast(new EffectBroadcast(
                 roomId: $roomId,
                 type: $result['play_effect'],
@@ -133,9 +189,11 @@ class ShopController extends Controller
                 ];
                 // 赠礼消息文案（改成"为XX触发了一场特效"）
                 $icon = $icons[$result['play_effect']] ?? '✨';
-                $toStr = $targetUsername ? "【{$targetUsername}】" : '全体聊友';
+                $safeBuyer = ChatContentSanitizer::htmlText($user->username);
+                $safeItemName = ChatContentSanitizer::htmlText($item->name);
+                $toStr = $safeTargetUsername ? "【{$safeTargetUsername}】" : '全体聊友';
                 $remarkPart = $message ? " 「{$message}」" : '';
-                $sysContent = "{$icon} {$user->username} 为 {$toStr} 燃放了一场【{$item->name}】特效！{$remarkPart}";
+                $sysContent = "{$icon} {$safeBuyer} 为 {$toStr} 燃放了一场【{$safeItemName}】特效！{$remarkPart}";
 
                 // 广播系统消息到公屏（字段名与前端 appendMessage() 保持一致）
                 $sysMsgEvent = new MessageSent(
@@ -156,9 +214,6 @@ class ShopController extends Controller
             }
         } else {
             // ── 其他类型：广播购买通知到公屏 ────────────────────────────
-            $user = Auth::user();
-            $roomId = (int) $request->room_id;
-
             if ($roomId > 0) {
                 // auto_fishing 有效期文案（提前算好，避免在 match 内写复杂三元表达式）
                 $fishDuration = '';
@@ -171,12 +226,16 @@ class ShopController extends Controller
                 $broadcastFromUser = $item->type === 'auto_fishing' ? '钓鱼播报' : '系统传音';
 
                 // 根据商品类型生成不同通知文案
+                $safeBuyer = ChatContentSanitizer::htmlText($user->username);
+                $safeItemName = ChatContentSanitizer::htmlText($item->name);
                 $sysContent = match ($item->type) {
-                    'duration' => "📅 【{$user->username}】购买了全屏特效周卡「{$item->name}」，登录时将自动触发！",
-                    'one_time' => "🎫 【{$user->username}】购买了「{$item->name}」道具！",
-                    'ring' => "💍 【{$user->username}】在商店购买了一枚「{$item->name}」，不知道打算送给谁呢？",
-                    'auto_fishing' => "🎣 【{$user->username}】购买了「{$item->name}」，开启了 {$fishDuration} 的自动钓鱼模式！",
-                    default => "🛒 【{$user->username}】购买了「{$item->name}」。",
+                    'duration' => "📅 【{$safeBuyer}】购买了全屏特效周卡「{$safeItemName}」，登录时将自动触发！",
+                    'one_time' => "🎫 【{$safeBuyer}】购买了「{$safeItemName}」道具！",
+                    'ring' => "💍 【{$safeBuyer}】在商店购买了一枚「{$safeItemName}」，不知道打算送给谁呢？",
+                    'auto_fishing' => "🎣 【{$safeBuyer}】购买了「{$safeItemName}」，开启了 {$fishDuration} 的自动钓鱼模式！",
+                    ShopItem::TYPE_SIGN_REPAIR => "🗓️ 【{$safeBuyer}】购买了 {$quantity} 张「{$safeItemName}」，准备把漏掉的签到补回来！",
+                    'msg_bubble', 'msg_name_color', 'msg_text_color', 'avatar_frame' => "✨ 【{$safeBuyer}】购买了个人装扮「{$safeItemName}」，颜值 +1！",
+                    default => "🛒 【{$safeBuyer}】购买了「{$safeItemName}」。",
                 };
 
                 broadcast(new MessageSent(
@@ -197,7 +256,7 @@ class ShopController extends Controller
         }
 
         // 返回最新金币余额
-        $response['jjb'] = Auth::user()->fresh()->jjb;
+        $response['jjb'] = $user->fresh()->jjb;
 
         return response()->json($response);
     }

app/Http/Controllers/SlotMachineController.php

@@ -23,16 +23,21 @@ use App\Jobs\SaveMessageJob;
 use App\Models\GameConfig;
 use App\Models\SlotMachineLog;
 use App\Services\ChatStateService;
+use App\Services\GameRoomScopeService;
 use App\Services\UserCurrencyService;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\DB;
 
+/**
+ * 类功能：提供老虎机信息查询、转动和个人记录接口。
+ */
 class SlotMachineController extends Controller
 {
     public function __construct(
         private readonly UserCurrencyService $currency,
         private readonly ChatStateService $chatState,
+        private readonly GameRoomScopeService $roomScopeService,
     ) {}
 
     /**
@@ -44,6 +49,11 @@ class SlotMachineController extends Controller
             return response()->json(['enabled' => false]);
         }
 
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+        if (! $this->roomScopeService->isRoomAllowedForGame('slot_machine', $roomId)) {
+            return response()->json(['enabled' => false]);
+        }
+
         $config = GameConfig::forGame('slot_machine')?->params ?? [];
         $user = $request->user();
         $dailyLimit = (int) ($config['daily_limit'] ?? 0);
@@ -77,6 +87,11 @@ class SlotMachineController extends Controller
             return response()->json(['ok' => false, 'message' => '老虎机未开放。']);
         }
 
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+        if (! $this->roomScopeService->isRoomAllowedForGame('slot_machine', $roomId)) {
+            return response()->json(['ok' => false, 'message' => '当前房间未开启老虎机。'], 403);
+        }
+
         $config = GameConfig::forGame('slot_machine')?->params ?? [];
         $cost = (int) ($config['cost_per_spin'] ?? 100);
         $dailyLimit = (int) ($config['daily_limit'] ?? 0);
@@ -100,7 +115,7 @@ class SlotMachineController extends Controller
             }
         }
 
-        return DB::transaction(function () use ($user, $cost, $config): JsonResponse {
+        return DB::transaction(function () use ($user, $cost, $config, $roomId): JsonResponse {
             // ① 扣费
             $this->currency->change(
                 $user,
@@ -164,16 +179,16 @@ class SlotMachineController extends Controller
 
             if ($resultType === 'jackpot') {
                 // 三个7：全服公屏广播
-                $this->broadcastJackpot($user->username, $payout, $cost);
+                $this->broadcastJackpot($user->username, $payout, $cost, $roomId);
             } elseif (in_array($resultType, ['triple_gem', 'triple', 'pair'], true)) {
                 // 普通中奖：仅向本人发送聊天室系统通知
                 $net = $payout - $cost;
                 $content = "🎰 {$resultLabel}！{$e1}{$e2}{$e3} 赢得 +💰".number_format($net).' 金币';
-                $this->broadcastPersonal($user->username, $content);
+                $this->broadcastPersonal($user->username, $content, $roomId);
             } elseif ($resultType === 'curse') {
                 // 诅咒：通知本人
                 $content = "☠️ 三骷髅诅咒！{$e1}{$e2}{$e3} 额外扣除 💰".number_format($cost).' 金币！';
-                $this->broadcastPersonal($user->username, $content);
+                $this->broadcastPersonal($user->username, $content, $roomId);
             }
 
             $user->refresh();
@@ -200,6 +215,11 @@ class SlotMachineController extends Controller
      */
     public function history(Request $request): JsonResponse
     {
+        $roomId = $this->roomScopeService->resolveRequestRoomId($request, $request->user());
+        if (! $this->roomScopeService->isRoomAllowedForGame('slot_machine', $roomId)) {
+            return response()->json(['history' => []]);
+        }
+
         $logs = SlotMachineLog::query()
             ->where('user_id', $request->user()->id)
             ->orderByDesc('id')
@@ -239,15 +259,15 @@ class SlotMachineController extends Controller
     /**
      * 三个7全服公屏广播。
      */
-    private function broadcastJackpot(string $username, int $payout, int $cost): void
+    private function broadcastJackpot(string $username, int $payout, int $cost, int $roomId): void
     {
         $net = $payout - $cost;
         $content = "🎰🎉【老虎机大奖】恭喜 【{$username}】 转出三个7️⃣！"
             .'狂揽 💰'.number_format($net).' 金币！全服见证奇迹！';
 
         $msg = [
-            'id' => $this->chatState->nextMessageId(1),
-            'room_id' => 1,
+            'id' => $this->chatState->nextMessageId($roomId),
+            'room_id' => $roomId,
             'from_user' => '系统传音',
             'to_user' => '大家',
             'content' => $content,
@@ -257,8 +277,8 @@ class SlotMachineController extends Controller
             'sent_at' => now()->toDateTimeString(),
         ];
 
-        $this->chatState->pushMessage(1, $msg);
-        broadcast(new MessageSent(1, $msg));
+        $this->chatState->pushMessage($roomId, $msg);
+        broadcast(new MessageSent($roomId, $msg));
         SaveMessageJob::dispatch($msg);
     }
 
@@ -268,11 +288,11 @@ class SlotMachineController extends Controller
      * @param  string  $toUsername  接收用户名
      * @param  string  $content  消息内容
      */
-    private function broadcastPersonal(string $toUsername, string $content): void
+    private function broadcastPersonal(string $toUsername, string $content, int $roomId): void
     {
         $msg = [
-            'id' => $this->chatState->nextMessageId(1),
-            'room_id' => 1,
+            'id' => $this->chatState->nextMessageId($roomId),
+            'room_id' => $roomId,
             'from_user' => '系统传音',
             'to_user' => $toUsername,
             'content' => $content,
@@ -282,7 +302,7 @@ class SlotMachineController extends Controller
             'sent_at' => now()->toDateTimeString(),
         ];
 
-        broadcast(new MessageSent(1, $msg));
+        broadcast(new MessageSent($roomId, $msg));
         SaveMessageJob::dispatch($msg);
     }
 }

app/Http/Controllers/UserController.php

@@ -2,13 +2,8 @@
 
 /**
  * 文件功能：用户中心与管理控制器
- * 接管原版 USERinfo.ASP, USERSET.ASP, chpasswd.asp, KILLUSER.ASP, LOCKIP.ASP
- *
- * 权限等级通过 sysparam 表动态配置：
- *   level_kick    - 踢人所需等级
- *   level_mute    - 禁言所需等级
- *   level_ban     - 封号所需等级
- *   level_banip   - 封IP所需等级
+ * 接管原版 USERinfo.ASP, USERSET.ASP 与 chpasswd.asp。
+ * 聊天室管理动作已统一迁移到 AdminCommandController 的职务权限链路。
  *
  * @author   ChatRoom Laravel
  *
@@ -17,22 +12,57 @@
 
 namespace App\Http\Controllers;
 
-use App\Events\UserKicked;
-use App\Events\UserMuted;
+use App\Enums\CurrencySource;
+use App\Events\UserStatusUpdated;
 use App\Http\Requests\ChangePasswordRequest;
+use App\Http\Requests\RevealProfileInfoRequest;
 use App\Http\Requests\UpdateChatPreferencesRequest;
+use App\Http\Requests\UpdateDailyStatusRequest;
 use App\Http\Requests\UpdateProfileRequest;
-use App\Models\Room;
 use App\Models\Sysparam;
 use App\Models\User;
+use App\Services\AchievementService;
+use App\Services\ChatStateService;
+use App\Services\ChatUserPresenceService;
+use App\Services\PositionPermissionService;
+use App\Services\UserCurrencyService;
+use App\Support\PositionPermissionRegistry;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Facades\Auth;
 use Illuminate\Support\Facades\Hash;
-use Illuminate\Support\Facades\Redis;
 
+/**
+ * 类功能：处理用户资料、聊天室偏好、当日状态与基础管理动作。
+ */
 class UserController extends Controller
 {
+    /**
+     * 查看别人隐藏信息的单次扣费金额。
+     */
+    public const INFO_REVEAL_COST = 1000;
+
+    /**
+     * 可付费查看的信息字段和中文名称。
+     */
+    private const REVEALABLE_INFO_LABELS = [
+        'exp_num' => '经验',
+        'jjb' => '金币',
+        'bank_jjb' => '存款',
+        'meili' => '魅力',
+    ];
+
+    /**
+     * 构造用户控制器依赖。
+     */
+    public function __construct(
+        private readonly ChatStateService $chatState,
+        private readonly ChatUserPresenceService $chatUserPresenceService,
+        private readonly UserCurrencyService $currencyService,
+        private readonly AchievementService $achievementService,
+        private readonly PositionPermissionService $positionPermissionService,
+    ) {}
+
     /**
      * 查看其他用户资料片 (对应 USERinfo.ASP)
      */
@@ -55,6 +85,7 @@ class UserController extends Controller
         $activePosition = $targetUser->activePosition?->load('position.department')->position;
         $data = [
             'username' => $targetUser->username,
+            'previous_name' => $targetUser->previous_name,
             'sex' => match ((int) $targetUser->sex) {
                 1 => '男', 2 => '女', default => ''
             },
@@ -69,23 +100,33 @@ class UserController extends Controller
             'position_name' => $activePosition?->name ?? '',
             'position_icon' => $activePosition?->icon ?? '',
             'department_name' => $activePosition?->department?->name ?? '',
+            'department_rank' => (int) ($activePosition?->department?->rank ?? 0),
+            'position_rank' => (int) ($activePosition?->rank ?? 0),
         ];
 
-        // 只有等级不低于对方，或者自己看自己时，才能看到详细的财富、经验资产
-        if ($operator && ($operator->user_level >= $targetUser->user_level || $operator->id === $targetUser->id)) {
-            $data['exp_num'] = $targetUser->exp_num ?? 0;
-            $data['jjb'] = $targetUser->jjb ?? 0;
-            $data['meili'] = $targetUser->meili ?? 0;
-        }
+        // 经验、金币、魅力卡片始终展示；等级不足时只显示星号，不隐藏字段本身。
+        $canViewAssetNumbers = $operator && $this->canViewAssetNumbers($operator, $targetUser);
+        $data['exp_num'] = $canViewAssetNumbers ? ($targetUser->exp_num ?? 0) : '******';
+        $data['jjb'] = $canViewAssetNumbers ? ($targetUser->jjb ?? 0) : '******';
+        $data['meili'] = $canViewAssetNumbers ? ($targetUser->meili ?? 0) : '******';
+        $data['asset_numbers_masked'] = ! $canViewAssetNumbers;
+        $data['asset_numbers_can_reveal'] = ! $canViewAssetNumbers;
+        $data['asset_numbers_reveal_cost'] = self::INFO_REVEAL_COST;
+        $data['asset_reveal_user_id'] = $targetUser->id;
 
         // 银行存款：只有超级管理员（user_level >= superlevel）或本人才能查看具体金额，其余一律显示星号
         if ($operator) {
             $isSelf = $operator->id === $targetUser->id;
             $superLevel = (int) Sysparam::getValue('superlevel', '100');
             $isSuperAdmin = $operator->user_level >= $superLevel;
-            $data['bank_jjb'] = ($isSelf || $isSuperAdmin)
-                ? ($targetUser->bank_jjb ?? 0)
-                : '******';
+            $canViewBankBalance = $isSelf || $isSuperAdmin;
+
+            // 名片里的别人存款默认只返回星号，真实金额必须通过付费查看接口当次获取。
+            $data['bank_jjb'] = $canViewBankBalance ? ($targetUser->bank_jjb ?? 0) : '******';
+            $data['bank_jjb_masked'] = ! $canViewBankBalance;
+            $data['bank_jjb_can_reveal'] = ! $canViewBankBalance;
+            $data['bank_jjb_reveal_cost'] = self::INFO_REVEAL_COST;
+            $data['bank_reveal_user_id'] = $targetUser->id;
         }
 
         // 仅当自己看自己时，附加邀请相关信息，用于展示专属邀请链接
@@ -109,10 +150,25 @@ class UserController extends Controller
             ->all();
         $data['vip']['Name'] = $targetUser->vipName();
         $data['vip']['Icon'] = $targetUser->vipIcon();
+        $signIdentity = $targetUser->currentSignInIdentity();
+        $latestSignIn = $targetUser->dailySignIns()->first();
+        $data['sign_in'] = [
+            'streak_days' => (int) ($latestSignIn?->streak_days ?? 0),
+            'identity' => $signIdentity ? [
+                'key' => $signIdentity->badge_code,
+                'label' => $signIdentity->badge_name,
+                'icon' => $signIdentity->badge_icon ?? '✅',
+                'color' => $signIdentity->badge_color ?? '#0f766e',
+                'expires_at' => $signIdentity->expires_at?->toIso8601String(),
+            ] : null,
+        ];
+        // 名片弹窗只读取已缓存的成就摘要，避免双击用户时同步扫描全量日志造成卡顿。
+        $data['achievements'] = $this->achievementService->profileSummaryForUser($targetUser);
 
-        // 拥有封禁IP（level_banip）或踢人以上权限的管理，可以查看IP和归属地
-        $levelBanIp = (int) Sysparam::getValue('level_banip', '15');
-        if ($operator && $operator->user_level >= $levelBanIp) {
+        // 管理员网络信息仅对站长或拥有「封IP」职务权限的操作者展示。
+        $canViewNetworkInfo = $operator
+            && ($operator->id === 1 || $this->positionPermissionService->hasPermission($operator, PositionPermissionRegistry::USER_BANIP));
+        if ($canViewNetworkInfo) {
             $data['first_ip'] = $targetUser->first_ip;
             // last_ip 目前定义为『上次登录IP』（取数据库 previous_ip）
             $data['last_ip'] = $targetUser->previous_ip;
@@ -162,6 +218,54 @@ class UserController extends Controller
         ]);
     }
 
+    /**
+     * 付费查看用户资料中被星号隐藏的经验、金币、存款或魅力。
+     */
+    public function revealInfo(RevealProfileInfoRequest $request): JsonResponse
+    {
+        /** @var User $operator */
+        $operator = Auth::user();
+        $targetUser = User::query()
+            ->select(['id', 'username', 'user_level', 'exp_num', 'jjb', 'bank_jjb', 'meili'])
+            ->findOrFail($request->integer('user_id'));
+        $asset = (string) $request->string('asset');
+        $assetLabel = self::REVEALABLE_INFO_LABELS[$asset];
+        $charged = false;
+        $operatorGold = (int) $operator->jjb;
+
+        if (! $this->canViewProfileInfo($operator, $targetUser, $asset)) {
+            $operatorGold = $this->currencyService->deductGoldIfEnough(
+                user: $operator,
+                amount: self::INFO_REVEAL_COST,
+                source: CurrencySource::USER_INFO_REVEAL,
+                remark: "查看 {$targetUser->username} 的{$assetLabel}",
+            );
+
+            if ($operatorGold === null) {
+                return response()->json([
+                    'status' => 'error',
+                    'message' => '金币不足，查看'.$assetLabel.'需要 '.self::INFO_REVEAL_COST.' 金币。',
+                ]);
+            }
+
+            $charged = true;
+        }
+
+        return response()->json([
+            'status' => 'success',
+            'message' => $charged
+                ? '已扣除 '.self::INFO_REVEAL_COST.' 金币，'.$assetLabel.'已显示。'
+                : $assetLabel.'已显示。',
+            'user_id' => $targetUser->id,
+            'username' => $targetUser->username,
+            'asset' => $asset,
+            'value' => $targetUser->{$asset} ?? 0,
+            'charged' => $charged,
+            'reveal_cost' => self::INFO_REVEAL_COST,
+            'jjb' => $operatorGold,
+        ]);
+    }
+
     /**
      * 修改个人资料 (对应 USERSET.ASP)
      */
@@ -204,19 +308,37 @@ class UserController extends Controller
     }
 
     /**
-     * 保存聊天室屏蔽与禁音偏好。
+     * 保存聊天室屏蔽、禁音与字号偏好。
      */
     public function updateChatPreferences(UpdateChatPreferencesRequest $request): JsonResponse
     {
         $user = Auth::user();
         $data = $request->validated();
+        $existingPreferences = is_array($user->chat_preferences) ? $user->chat_preferences : [];
+        $blockedSystemSenders = collect($data['blocked_system_senders'] ?? [])
+            ->map(function (string $sender): string {
+                // 猜谜活动前端文案允许升级，但持久化键仍复用旧值，避免历史偏好失效。
+                return $sender === '猜谜活动' ? '猜成语' : $sender;
+            })
+            ->unique()
+            ->values()
+            ->all();
 
         $preferences = [
             // 去重并重建索引，保持存储结构稳定，便于后续继续扩展其它屏蔽项。
-            'blocked_system_senders' => array_values(array_unique($data['blocked_system_senders'] ?? [])),
+            'blocked_system_senders' => $blockedSystemSenders,
             'sound_muted' => (bool) $data['sound_muted'],
         ];
 
+        // 字号偏好和屏蔽/禁音共用账号配置，旧请求未携带字号时保留原值。
+        $fontSize = array_key_exists('font_size', $data) && $data['font_size'] !== null
+            ? (int) $data['font_size']
+            : ($existingPreferences['font_size'] ?? null);
+
+        if ($fontSize !== null) {
+            $preferences['font_size'] = (int) $fontSize;
+        }
+
         $user->update([
             'chat_preferences' => $preferences,
         ]);
@@ -228,6 +350,55 @@ class UserController extends Controller
         ]);
     }
 
+    /**
+     * 保存聊天室当日状态，并同步当前在线名单显示。
+     */
+    public function updateDailyStatus(UpdateDailyStatusRequest $request): JsonResponse
+    {
+        $user = Auth::user();
+        $data = $request->validated();
+        $roomId = (int) $data['room_id'];
+
+        // 仅允许当前确实在线的用户从聊天室内修改状态，避免离线脏请求写入。
+        if (! $this->chatState->isUserInRoom($roomId, $user->username)) {
+            return response()->json([
+                'status' => 'error',
+                'message' => '请先进入聊天室后再设置状态。',
+            ], 422);
+        }
+
+        if ($data['action'] === 'clear') {
+            $user->update([
+                'daily_status_key' => null,
+                'daily_status_expires_at' => null,
+            ]);
+        } else {
+            // 状态有效期固定维持到当天结束，次日自动失效。
+            $user->update([
+                'daily_status_key' => $data['status_key'],
+                'daily_status_expires_at' => now()->endOfDay(),
+            ]);
+        }
+
+        $user->refresh();
+        $presencePayload = $this->chatUserPresenceService->build($user);
+        $roomIds = $this->chatState->getUserRooms($user->username);
+
+        foreach ($roomIds as $activeRoomId) {
+            // 所有当前在线房间都刷新 Redis 载荷，确保头像、会员与状态显示口径一致。
+            $this->chatState->userJoin((int) $activeRoomId, $user->username, $presencePayload);
+            broadcast(new UserStatusUpdated((int) $activeRoomId, $user->username, $presencePayload));
+        }
+
+        return response()->json([
+            'status' => 'success',
+            'message' => $data['action'] === 'clear' ? '状态已清除。' : '状态已更新。',
+            'data' => [
+                'status' => $this->chatUserPresenceService->currentDailyStatus($user),
+            ],
+        ]);
+    }
+
     /**
      * 修改密码 (对应 chpasswd.asp)
      */
@@ -262,7 +433,7 @@ class UserController extends Controller
     /**
      * 生成微信绑定代码
      */
-    public function generateWechatCode(\Illuminate\Http\Request $request): JsonResponse
+    public function generateWechatCode(Request $request): JsonResponse
     {
         $user = \Illuminate\Support\Facades\Auth::user();
         if (! $user) {
@@ -282,7 +453,7 @@ class UserController extends Controller
     /**
      * 取消绑定微信
      */
-    public function unbindWechat(\Illuminate\Http\Request $request): JsonResponse
+    public function unbindWechat(Request $request): JsonResponse
     {
         $user = \Illuminate\Support\Facades\Auth::user();
         if (! $user) {
@@ -299,158 +470,29 @@ class UserController extends Controller
     }
 
     /**
-     * 通用权限校验：检查操作者是否有权操作目标用户
-     *
-     * @param  object  $operator  操作者
-     * @param  string  $targetUsername  目标用户名
-     * @param  int  $roomId  房间ID
-     * @param  string  $levelKey  sysparam中的等级键名（如 level_kick）
-     * @param  string  $actionName  操作名称（用于错误提示）
-     * @return array{room: Room, target: User}|JsonResponse
+     * 判断操作者是否可以免费查看目标用户经验、金币与魅力。
      */
-    private function checkPermission(object $operator, string $targetUsername, int $roomId, string $levelKey, string $actionName): array|JsonResponse
+    private function canViewAssetNumbers(User $operator, User $targetUser): bool
     {
-        $room = Room::findOrFail($roomId);
-        $requiredLevel = (int) Sysparam::getValue($levelKey, '15');
-
-        // 鉴权：操作者要是房间房主或达到所需等级
-        if ($room->master !== $operator->username && $operator->user_level < $requiredLevel) {
-            return response()->json(['status' => 'error', 'message' => "权限不足（需要{$requiredLevel}级），无法执行{$actionName}操作。"], 403);
-        }
-
-        $targetUser = User::where('username', $targetUsername)->first();
-        if (! $targetUser) {
-            return response()->json(['status' => 'error', 'message' => '目标用户不存在。'], 404);
-        }
-
-        // 防误伤：不能操作等级 >= 自己的人
-        if ($targetUser->user_level >= $operator->user_level) {
-            return response()->json(['status' => 'error', 'message' => "权限不足，无法对同级或高级用户执行{$actionName}。"], 403);
-        }
-
-        return ['room' => $room, 'target' => $targetUser];
+        return $operator->id === $targetUser->id
+            || (int) $operator->user_level >= (int) $targetUser->user_level;
     }
 
     /**
-     * 踢出房间 (对应 KILLUSER.ASP)
-     * 所需等级由 sysparam level_kick 配置
+     * 判断操作者是否可以免费查看指定资料信息。
      */
-    public function kick(Request $request, string $username): JsonResponse
+    private function canViewProfileInfo(User $operator, User $targetUser, string $asset): bool
     {
-        $operator = Auth::user();
-        $roomId = $request->input('room_id');
-
-        if (! $roomId) {
-            return response()->json(['status' => 'error', 'message' => '缺少房间参数。'], 422);
+        if ($asset !== 'bank_jjb') {
+            return $this->canViewAssetNumbers($operator, $targetUser);
         }
 
-        $result = $this->checkPermission($operator, $username, $roomId, 'level_kick', '踢出');
-        if ($result instanceof JsonResponse) {
-            return $result;
+        if ($operator->id === $targetUser->id) {
+            return true;
         }
 
-        // 广播踢出事件
-        broadcast(new UserKicked($roomId, $result['target']->username, "管理员 [{$operator->username}] 将 [{$result['target']->username}] 踢出了聊天室。"));
+        $superLevel = (int) Sysparam::getValue('superlevel', '100');
 
-        return response()->json(['status' => 'success', 'message' => "已成功将 {$result['target']->username} 踢出房间。"]);
-    }
-
-    /**
-     * 禁言 (对应原版限制功能)
-     * 所需等级由 sysparam level_mute 配置
-     * 禁言信息存入 Redis，TTL 到期自动解除
-     */
-    public function mute(Request $request, string $username): JsonResponse
-    {
-        $operator = Auth::user();
-        $roomId = $request->input('room_id');
-        $duration = (int) $request->input('duration', 5);
-
-        if (! $roomId) {
-            return response()->json(['status' => 'error', 'message' => '缺少房间参数。'], 422);
-        }
-
-        $result = $this->checkPermission($operator, $username, $roomId, 'level_mute', '禁言');
-        if ($result instanceof JsonResponse) {
-            return $result;
-        }
-
-        // 写入 Redis 禁言标记，TTL = 禁言分钟数 * 60
-        Redis::setex("mute:{$roomId}:{$username}", $duration * 60, json_encode([
-            'operator' => $operator->username,
-            'reason' => '管理员禁言',
-            'until' => now()->addMinutes($duration)->toDateTimeString(),
-        ]));
-
-        // 广播禁言事件
-        broadcast(new UserMuted($roomId, $username, $duration));
-
-        return response()->json(['status' => 'success', 'message' => "已对 {$username} 实施禁言 {$duration} 分钟。"]);
-    }
-
-    /**
-     * 封号（禁止登录）
-     * 所需等级由 sysparam level_ban 配置
-     * 将用户等级设为 -1 表示封禁
-     */
-    public function ban(Request $request, string $username): JsonResponse
-    {
-        $operator = Auth::user();
-        $roomId = $request->input('room_id');
-
-        if (! $roomId) {
-            return response()->json(['status' => 'error', 'message' => '缺少房间参数。'], 422);
-        }
-
-        $result = $this->checkPermission($operator, $username, $roomId, 'level_ban', '封号');
-        if ($result instanceof JsonResponse) {
-            return $result;
-        }
-
-        // 封号：设置等级为 -1
-        $result['target']->user_level = -1;
-        $result['target']->save();
-
-        // 踢出聊天室
-        broadcast(new UserKicked($roomId, $username, "管理员 [{$operator->username}] 已封禁用户 [{$username}] 的账号。"));
-
-        return response()->json(['status' => 'success', 'message' => "用户 {$username} 已被封号。"]);
-    }
-
-    /**
-     * 封IP（记录IP到黑名单并踢出）
-     * 所需等级由 sysparam level_banip 配置
-     */
-    public function banIp(Request $request, string $username): JsonResponse
-    {
-        $operator = Auth::user();
-        $roomId = $request->input('room_id');
-
-        if (! $roomId) {
-            return response()->json(['status' => 'error', 'message' => '缺少房间参数。'], 422);
-        }
-
-        $result = $this->checkPermission($operator, $username, $roomId, 'level_banip', '封IP');
-        if ($result instanceof JsonResponse) {
-            return $result;
-        }
-
-        $targetIp = $result['target']->last_ip;
-
-        if ($targetIp) {
-            // 将IP加入 Redis 黑名单（永久）
-            Redis::sadd('banned_ips', $targetIp);
-        }
-
-        // 同时封号
-        $result['target']->user_level = -1;
-        $result['target']->save();
-
-        // 踢出聊天室
-        broadcast(new UserKicked($roomId, $username, "管理员 [{$operator->username}] 已封禁用户 [{$username}] 的IP地址。"));
-
-        $ipInfo = $targetIp ? "（IP: {$targetIp}）" : '（未记录IP）';
-
-        return response()->json(['status' => 'success', 'message' => "用户 {$username} 已被封号并封IP{$ipInfo}。"]);
+        return (int) $operator->user_level >= $superLevel;
     }
 }

app/Http/Requests/Admin/SaveSignInRewardRuleRequest.php

@@ -0,0 +1,74 @@
+<?php
+
+/**
+ * 文件功能：后台签到奖励规则保存请求校验
+ *
+ * 集中校验连续签到天数、奖励数值与身份徽章配置。
+ */
+
+namespace App\Http\Requests\Admin;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * 类功能：校验后台新增和更新签到奖励规则的表单数据。
+ */
+class SaveSignInRewardRuleRequest extends FormRequest
+{
+    /**
+     * 方法功能：允许已通过后台权限中间件的管理员继续校验。
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * 方法功能：返回签到奖励规则表单的校验规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        $ruleId = $this->route('signInRewardRule')?->id;
+
+        return [
+            'streak_days' => [
+                'required',
+                'integer',
+                'min:1',
+                'max:3650',
+                Rule::unique('sign_in_reward_rules', 'streak_days')->ignore($ruleId),
+            ],
+            'gold_reward' => ['required', 'integer', 'min:0', 'max:999999999'],
+            'exp_reward' => ['required', 'integer', 'min:0', 'max:999999999'],
+            'charm_reward' => ['required', 'integer', 'min:0', 'max:999999999'],
+            'identity_badge_code' => ['nullable', 'string', 'max:50'],
+            'identity_badge_name' => ['nullable', 'string', 'max:50'],
+            'identity_badge_icon' => ['nullable', 'string', 'max:120'],
+            'identity_badge_color' => ['nullable', 'string', 'max:20'],
+            'identity_duration_days' => ['required', 'integer', 'min:0', 'max:3650'],
+            'sort_order' => ['required', 'integer', 'min:0', 'max:999999'],
+            'is_enabled' => ['nullable', 'boolean'],
+        ];
+    }
+
+    /**
+     * 方法功能：返回签到奖励规则表单的中文字段名。
+     *
+     * @return array<string, string>
+     */
+    public function attributes(): array
+    {
+        return [
+            'streak_days' => '连续签到天数',
+            'gold_reward' => '金币奖励',
+            'exp_reward' => '经验奖励',
+            'charm_reward' => '魅力奖励',
+            'identity_badge_name' => '身份名称',
+            'identity_duration_days' => '身份有效天数',
+        ];
+    }
+}

app/Http/Requests/Admin/UpdateManagedUserRequest.php

@@ -0,0 +1,57 @@
+<?php
+
+/**
+ * 文件功能：后台用户资料更新请求校验
+ */
+
+namespace App\Http\Requests\Admin;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * 类功能：集中校验后台用户编辑弹窗提交的资料字段。
+ */
+class UpdateManagedUserRequest extends FormRequest
+{
+    /**
+     * 方法功能：允许已通过路由中间件的后台用户继续执行校验。
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * 方法功能：返回后台用户编辑表单的校验规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'sex' => ['sometimes', 'integer', 'in:0,1,2'],
+            'exp_num' => ['sometimes', 'integer', 'min:0'],
+            'jjb' => ['sometimes', 'integer', 'min:0'],
+            'meili' => ['sometimes', 'integer', 'min:0'],
+            'qianming' => ['sometimes', 'nullable', 'string', 'max:255'],
+            'position_id' => ['sometimes', 'nullable', 'integer', 'exists:positions,id'],
+            'headface' => ['sometimes', 'string', 'max:50'],
+            'password' => ['nullable', 'string', 'min:6'],
+            'vip_level_id' => ['sometimes', 'nullable', 'integer', 'exists:vip_levels,id'],
+            'hy_time' => ['sometimes', 'nullable', 'date'],
+        ];
+    }
+
+    /**
+     * 方法功能：返回后台用户编辑表单的中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'position_id.exists' => '所选职务不存在，请重新选择。',
+        ];
+    }
+}

app/Http/Requests/BuyRideRequest.php

@@ -0,0 +1,55 @@
+<?php
+
+/**
+ * 文件功能：前台座驾购买请求验证。
+ *
+ * 校验用户购买座驾时传入的座驾与房间上下文，避免未进房直接购买聊天室座驾。
+ */
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * 座驾购买请求
+ * 负责校验座驾 ID 与当前房间 ID。
+ */
+class BuyRideRequest extends FormRequest
+{
+    /**
+     * 判断当前用户是否允许购买座驾。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 获取座驾购买请求验证规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'item_id' => ['required', 'integer', 'exists:rides,id'],
+            'room_id' => ['required', 'integer', 'exists:rooms,id'],
+        ];
+    }
+
+    /**
+     * 获取座驾购买请求中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'item_id.required' => '请选择要购买的座驾。',
+            'item_id.exists' => '座驾不存在或已被删除。',
+            'room_id.required' => '请先进入聊天室后再购买座驾。',
+            'room_id.exists' => '当前房间不存在。',
+        ];
+    }
+}

app/Http/Requests/ClaimDailySignInRequest.php

@@ -0,0 +1,50 @@
+<?php
+
+/**
+ * 文件功能：前台每日签到请求校验
+ *
+ * 校验用户发起签到时携带的房间参数，避免脏 room_id 写入签到流水和聊天室通知。
+ */
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * 类功能：校验每日签到领取接口的请求参数。
+ */
+class ClaimDailySignInRequest extends FormRequest
+{
+    /**
+     * 方法功能：允许已登录聊天室用户发起签到请求。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 方法功能：返回每日签到领取参数校验规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'room_id' => ['nullable', 'integer', 'exists:rooms,id'],
+        ];
+    }
+
+    /**
+     * 方法功能：返回每日签到领取的中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'room_id.exists' => '当前聊天室不存在，请刷新页面后再签到。',
+        ];
+    }
+}

app/Http/Requests/DailySignInCalendarRequest.php

@@ -0,0 +1,49 @@
+<?php
+
+/**
+ * 文件功能：前台每日签到日历查询请求校验。
+ *
+ * 校验月份参数，供签到日历按月展示签到状态。
+ */
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * 类功能：校验用户查询签到日历时传入的月份参数。
+ */
+class DailySignInCalendarRequest extends FormRequest
+{
+    /**
+     * 方法功能：允许已登录用户查询自己的签到日历。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 方法功能：返回签到日历查询规则。
+     *
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'month' => ['nullable', 'date_format:Y-m'],
+        ];
+    }
+
+    /**
+     * 方法功能：返回签到日历查询的中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'month.date_format' => '月份格式不正确。',
+        ];
+    }
+}

app/Http/Requests/MakeupDailySignInRequest.php

@@ -0,0 +1,55 @@
+<?php
+
+/**
+ * 文件功能：前台每日签到补签请求校验。
+ *
+ * 校验补签日期和房间参数，确保用户只能补签历史漏签日期。
+ */
+
+namespace App\Http\Requests;
+
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Support\Carbon;
+
+/**
+ * 类功能：校验用户在签到日历中提交的补签请求。
+ */
+class MakeupDailySignInRequest extends FormRequest
+{
+    /**
+     * 方法功能：允许已登录用户提交补签请求。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 方法功能：返回补签请求的校验规则。
+     *
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'target_date' => ['required', 'date', 'before:today', 'after_or_equal:'.Carbon::today()->startOfMonth()->toDateString()],
+            'room_id' => ['nullable', 'integer', 'exists:rooms,id'],
+        ];
+    }
+
+    /**
+     * 方法功能：返回补签请求的中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'target_date.required' => '请选择要补签的日期。',
+            'target_date.date' => '补签日期格式不正确。',
+            'target_date.before' => '只能补签今天之前的漏签日期。',
+            'target_date.after_or_equal' => '补签卡只能补签本月的未签到日期。',
+            'room_id.exists' => '当前聊天室不存在，请刷新页面后再补签。',
+        ];
+    }
+}

app/Http/Requests/RevealProfileInfoRequest.php

@@ -0,0 +1,55 @@
+<?php
+
+/**
+ * 文件功能：用户信息付费查看请求验证器
+ * 校验用户点击查看别人经验、金币、存款、魅力时提交的目标与信息类型。
+ */
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * 类功能：验证付费查看用户隐藏信息的请求参数。
+ */
+class RevealProfileInfoRequest extends FormRequest
+{
+    /**
+     * 授权所有已登录用户提交查看请求，具体可见性和扣费由控制器统一处理。
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * 获取付费查看信息请求的验证规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'user_id' => ['required', 'integer', 'exists:users,id'],
+            'asset' => ['required', 'string', Rule::in(['exp_num', 'jjb', 'bank_jjb', 'meili'])],
+        ];
+    }
+
+    /**
+     * 获取付费查看信息请求的中文验证提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'user_id.required' => '缺少要查看的用户。',
+            'user_id.integer' => '要查看的用户无效。',
+            'user_id.exists' => '要查看的用户不存在。',
+            'asset.required' => '缺少要查看的信息类型。',
+            'asset.in' => '要查看的信息类型无效。',
+        ];
+    }
+}

app/Http/Requests/SendMessageRequest.php

@@ -62,7 +62,7 @@ class SendMessageRequest extends FormRequest
             'image' => ['nullable', 'required_without:content', 'file', 'image', 'mimes:jpeg,png,jpg,gif,webp', 'max:6144'],
             'to_user' => ['nullable', 'string', 'max:50'],
             'is_secret' => ['nullable', 'boolean'],
-            'font_color' => ['nullable', 'string', 'max:10'],   // html color hex
+            'font_color' => ['nullable', 'string', 'regex:/^#[0-9a-fA-F]{6}$/'],   // html color hex
             'action' => ['nullable', 'string', 'max:50', Rule::in(self::ALLOWED_ACTIONS)],   // 动作字段仅允许预设值，阻断拼接式 XSS 注入
         ];
     }
@@ -91,6 +91,7 @@ class SendMessageRequest extends FormRequest
             'image.image' => '上传的文件必须是图片。',
             'image.mimes' => '仅支持 jpg、jpeg、png、gif、webp 图片格式。',
             'image.max' => '图片大小不能超过 6MB。',
+            'font_color.regex' => '发言颜色格式不合法，请重新选择颜色。',
             'action.in' => '发言动作不合法，请重新选择。',
         ];
     }

app/Http/Requests/SendPasswordResetLinkRequest.php

@@ -32,6 +32,7 @@ class SendPasswordResetLinkRequest extends FormRequest
     {
         return [
             'email' => ['required', 'email', 'max:255'],
+            'username' => ['required', 'string', 'max:100'],
         ];
     }
 
@@ -43,9 +44,10 @@ class SendPasswordResetLinkRequest extends FormRequest
     public function messages(): array
     {
         return [
-            'email.required' => '请输入已绑定账号的邮箱地址。',
+            'email.required' => '请输入绑定邮箱地址以进行二次确认。',
             'email.email' => '邮箱格式不正确，请重新输入。',
             'email.max' => '邮箱长度不能超过 255 个字符。',
+            'username.required' => '用户昵称参数缺失。',
         ];
     }
 }

app/Http/Requests/StoreHolidayEventRequest.php

@@ -0,0 +1,100 @@
+<?php
+
+/**
+ * 文件功能：节日福利活动创建请求
+ *
+ * 负责校验后台创建节日福利模板时提交的奖励、调度与目标用户字段。
+ */
+
+namespace App\Http\Requests;
+
+use App\Rules\HolidayEventScheduleRule;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * 类功能：校验创建节日福利模板的表单数据。
+ */
+class StoreHolidayEventRequest extends FormRequest
+{
+    /**
+     * 判断当前用户是否允许提交创建请求。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 预处理布尔字段，避免浏览器复选框值造成类型偏差。
+     */
+    protected function prepareForValidation(): void
+    {
+        if ($this->has('enabled')) {
+            $this->merge([
+                'enabled' => $this->boolean('enabled'),
+            ]);
+        }
+    }
+
+    /**
+     * 获取节日福利模板的字段校验规则。
+     *
+     * @return array<string, ValidationRule|array<int, ValidationRule|string>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'description' => ['nullable', 'string', 'max:500'],
+            'total_amount' => ['required', 'integer', 'min:1'],
+            'max_claimants' => ['required', 'integer', 'min:0'],
+            'distribute_type' => ['required', Rule::in(['random', 'fixed'])],
+            'min_amount' => ['nullable', 'integer', 'min:1', 'required_if:distribute_type,random'],
+            'max_amount' => ['nullable', 'integer', 'min:1', 'gte:min_amount'],
+            'fixed_amount' => ['nullable', 'integer', 'min:1', 'required_if:distribute_type,fixed'],
+            'send_at' => ['nullable', 'date', Rule::requiredIf(fn (): bool => $this->input('repeat_type') !== 'yearly')],
+            'expire_minutes' => ['required', 'integer', 'min:1', 'max:1440'],
+            'repeat_type' => [
+                'required',
+                Rule::in(['once', 'daily', 'weekly', 'monthly', 'cron', 'yearly']),
+                new HolidayEventScheduleRule,
+            ],
+            'cron_expr' => ['nullable', 'string', 'max:100', 'required_if:repeat_type,cron'],
+            'schedule_month' => ['nullable', 'integer', 'between:1,12'],
+            'schedule_day' => ['nullable', 'integer', 'between:1,31'],
+            'schedule_time' => ['nullable', 'date_format:H:i'],
+            'duration_days' => ['nullable', 'integer', 'min:1', 'max:31'],
+            'daily_occurrences' => ['nullable', 'integer', 'min:1', 'max:24'],
+            'occurrence_interval_minutes' => ['nullable', 'integer', 'min:1', 'max:1439'],
+            'target_type' => ['required', Rule::in(['all', 'vip', 'level'])],
+            'target_value' => ['nullable', 'string', 'max:50', 'required_if:target_type,level'],
+            'enabled' => ['sometimes', 'boolean'],
+        ];
+    }
+
+    /**
+     * 获取中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'name.required' => '请输入活动名称',
+            'total_amount.required' => '请填写总金币奖池',
+            'max_claimants.required' => '请填写可领取人数上限',
+            'distribute_type.required' => '请选择分配方式',
+            'min_amount.required_if' => '随机分配模式下必须填写最低保底金额',
+            'fixed_amount.required_if' => '定额发放模式下必须填写每人固定金额',
+            'send_at.required' => '请选择触发时间',
+            'expire_minutes.required' => '请填写领取有效期',
+            'repeat_type.required' => '请选择重复方式',
+            'cron_expr.required_if' => 'CRON 模式下必须填写表达式',
+            'schedule_time.date_format' => '首轮开始时间格式必须为 HH:ii',
+            'target_type.required' => '请选择目标用户范围',
+            'target_value.required_if' => '指定等级以上模式下必须填写最低等级',
+        ];
+    }
+}

app/Http/Requests/StoreRideRequest.php

@@ -0,0 +1,63 @@
+<?php
+
+/**
+ * 文件功能：后台新增座驾请求验证。
+ *
+ * 校验座驾独立模块的名称、特效 key、价格、使用天数、欢迎语和上下架状态。
+ */
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * 后台新增座驾请求
+ * 负责新增座驾时的权限与字段校验。
+ */
+class StoreRideRequest extends FormRequest
+{
+    /**
+     * 判断当前用户是否允许新增座驾。
+     */
+    public function authorize(): bool
+    {
+        return $this->user()?->id === 1;
+    }
+
+    /**
+     * 获取新增座驾验证规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'slug' => ['required', 'string', 'max:100', 'regex:/^ride_[a-z0-9_]+$/', Rule::unique('rides', 'slug')],
+            'effect_key' => ['required', 'string', 'max:50', 'regex:/^[a-z0-9_]+$/', Rule::unique('rides', 'effect_key')],
+            'icon' => ['required', 'string', 'max:20'],
+            'description' => ['nullable', 'string', 'max:500'],
+            'price' => ['required', 'integer', 'min:0'],
+            'duration_days' => ['required', 'integer', 'min:1'],
+            'welcome_message' => ['nullable', 'string', 'max:255'],
+            'sort_order' => ['required', 'integer', 'min:0'],
+            'is_active' => ['boolean'],
+        ];
+    }
+
+    /**
+     * 获取新增座驾中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'slug.regex' => '座驾标识必须使用 ride_ 开头，例如 ride_j35。',
+            'effect_key.regex' => '特效 key 只能包含小写字母、数字和下划线。',
+            'duration_days.min' => '使用天数至少为 1 天。',
+        ];
+    }
+}

app/Http/Requests/StoreShopItemRequest.php

@@ -0,0 +1,73 @@
+<?php
+
+/**
+ * 文件功能：后台新增商店商品请求验证。
+ *
+ * 统一校验商店商品字段。
+ */
+
+namespace App\Http\Requests;
+
+use App\Models\ShopItem;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * 后台新增商店商品请求
+ * 负责新增商品时的权限与字段校验。
+ */
+class StoreShopItemRequest extends FormRequest
+{
+    /**
+     * 判断当前用户是否允许新增商品。
+     */
+    public function authorize(): bool
+    {
+        return $this->user()?->id === 1;
+    }
+
+    /**
+     * 获取新增商品验证规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'slug' => ['required', 'string', 'max:100', Rule::unique('shop_items', 'slug')],
+            'icon' => ['required', 'string', 'max:20'],
+            'description' => ['nullable', 'string', 'max:500'],
+            'price' => ['required', 'integer', 'min:0'],
+            'type' => ['required', Rule::in($this->allowedTypes())],
+            'duration_days' => ['nullable', 'integer', 'min:0'],
+            'duration_minutes' => ['nullable', 'integer', 'min:0'],
+            'intimacy_bonus' => ['nullable', 'integer', 'min:0'],
+            'charm_bonus' => ['nullable', 'integer', 'min:0'],
+            'sort_order' => ['required', 'integer', 'min:0'],
+            'is_active' => ['boolean'],
+        ];
+    }
+
+    /**
+     * 获取允许后台配置的商品类型。
+     *
+     * @return array<int, string>
+     */
+    protected function allowedTypes(): array
+    {
+        return [
+            'instant',
+            'duration',
+            'one_time',
+            'ring',
+            'auto_fishing',
+            ShopItem::TYPE_SIGN_REPAIR,
+            'msg_bubble',
+            'msg_name_color',
+            'msg_text_color',
+            'avatar_frame',
+        ];
+    }
+}

app/Http/Requests/UpdateChatPreferencesRequest.php

@@ -2,7 +2,7 @@
 
 /**
  * 文件功能：聊天室偏好设置验证器
- * 负责校验用户提交的屏蔽播报与禁音配置。
+ * 负责校验用户提交的屏蔽播报、禁音与聊天室字号配置。
  */
 
 namespace App\Http\Requests;
@@ -12,7 +12,7 @@ use Illuminate\Validation\Rule;
 
 /**
  * 聊天室偏好设置验证器
- * 仅允许提交白名单内的屏蔽项与布尔型禁音状态。
+ * 仅允许提交白名单内的屏蔽项、布尔型禁音状态与合法字号。
  */
 class UpdateChatPreferencesRequest extends FormRequest
 {
@@ -35,9 +35,10 @@ class UpdateChatPreferencesRequest extends FormRequest
             'blocked_system_senders' => ['nullable', 'array'],
             'blocked_system_senders.*' => [
                 'string',
-                Rule::in(['钓鱼播报', '星海小博士', '百家乐', '跑马','神秘箱子']),
+                Rule::in(['钓鱼播报', '猜成语', '猜谜活动', '星海小博士', '百家乐', '跑马', '神秘箱子', '五子棋', '老虎机', '双色球彩票']),
             ],
             'sound_muted' => ['required', 'boolean'],
+            'font_size' => ['nullable', 'integer', 'min:10', 'max:30'],
         ];
     }
 
@@ -53,6 +54,9 @@ class UpdateChatPreferencesRequest extends FormRequest
             'blocked_system_senders.*.in' => '存在不支持的屏蔽项目。',
             'sound_muted.required' => '请传入禁音状态。',
             'sound_muted.boolean' => '禁音状态格式无效。',
+            'font_size.integer' => '聊天室字号格式无效。',
+            'font_size.min' => '聊天室字号不能小于 10。',
+            'font_size.max' => '聊天室字号不能大于 30。',
         ];
     }
 }

app/Http/Requests/UpdateDailyStatusRequest.php

@@ -0,0 +1,60 @@
+<?php
+
+/**
+ * 文件功能：聊天室用户状态设置验证器
+ * 负责校验用户在聊天室内提交的当日状态设置与清除请求。
+ */
+
+namespace App\Http\Requests;
+
+use App\Support\ChatDailyStatusCatalog;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+class UpdateDailyStatusRequest extends FormRequest
+{
+    /**
+     * 允许已登录用户保存自己的当日状态。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 获取聊天室当日状态设置的验证规则。
+     *
+     * @return array<string, mixed>
+     */
+    public function rules(): array
+    {
+        return [
+            'room_id' => ['required', 'integer', 'exists:rooms,id'],
+            'action' => ['required', 'string', Rule::in(['set', 'clear'])],
+            'status_key' => [
+                Rule::requiredIf(fn (): bool => $this->input('action') === 'set'),
+                'nullable',
+                'string',
+                Rule::in(ChatDailyStatusCatalog::keys()),
+            ],
+        ];
+    }
+
+    /**
+     * 获取聊天室当日状态设置的中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'room_id.required' => '缺少当前房间信息。',
+            'room_id.integer' => '房间编号格式无效。',
+            'room_id.exists' => '当前房间不存在。',
+            'action.required' => '缺少状态操作类型。',
+            'action.in' => '不支持的状态操作类型。',
+            'status_key.required' => '请选择要设置的状态。',
+            'status_key.in' => '请选择系统支持的状态。',
+        ];
+    }
+}

app/Http/Requests/UpdateGameConfigParamsRequest.php

@@ -0,0 +1,97 @@
+<?php
+
+/**
+ * 文件功能：保存游戏参数请求校验
+ *
+ * 统一校验后台“游戏管理”页提交的 params 结构，
+ * 并在所有游戏共用的房间范围字段上执行归一化。
+ */
+
+namespace App\Http\Requests;
+
+use App\Services\GameRoomScopeService;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * 类功能：约束后台游戏参数保存请求的公共结构。
+ */
+class UpdateGameConfigParamsRequest extends FormRequest
+{
+    /**
+     * 判断当前请求是否允许执行。
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * 校验规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'params' => ['required', 'array'],
+            'params.room_scope_mode' => ['nullable', 'in:all,single,multiple'],
+            'params.room_ids' => ['nullable', 'array'],
+            'params.room_ids.*' => ['integer', 'exists:rooms,id'],
+        ];
+    }
+
+    /**
+     * 自定义错误消息。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'params.required' => '缺少游戏参数数据。',
+            'params.array' => '游戏参数格式无效。',
+            'params.room_scope_mode.in' => '参与房间模式无效。',
+            'params.room_ids.array' => '参与房间列表格式无效。',
+            'params.room_ids.*.integer' => '参与房间编号格式无效。',
+            'params.room_ids.*.exists' => '所选房间不存在，请刷新页面后重试。',
+        ];
+    }
+
+    /**
+     * 在校验前先把房间范围字段归一化，兼容单值与旧字段。
+     */
+    protected function prepareForValidation(): void
+    {
+        $params = (array) $this->input('params', []);
+        $roomScopeService = app(GameRoomScopeService::class);
+        $scopeConfig = $roomScopeService->getScopeConfigForParams($params);
+
+        $params['room_scope_mode'] = $scopeConfig['room_scope_mode'];
+        $params['room_ids'] = $scopeConfig['room_ids'];
+
+        $this->merge([
+            'params' => $params,
+        ]);
+    }
+
+    /**
+     * 校验通过后补充“单选/多选至少选择一个房间”的约束。
+     */
+    public function withValidator($validator): void
+    {
+        $validator->after(function ($validator): void {
+            $params = (array) $this->input('params', []);
+            $roomMode = (string) ($params['room_scope_mode'] ?? GameRoomScopeService::MODE_SINGLE);
+            $roomIds = (array) ($params['room_ids'] ?? []);
+
+            if (in_array($roomMode, [GameRoomScopeService::MODE_SINGLE, GameRoomScopeService::MODE_MULTIPLE], true) && $roomIds === []) {
+                $validator->errors()->add('params.room_ids', '单选/多选房间模式下，请至少选择一个房间。');
+            }
+
+            if ($roomMode === GameRoomScopeService::MODE_SINGLE && count($roomIds) > 1) {
+                $validator->errors()->add('params.room_ids', '单选房间模式下只能选择一个房间。');
+            }
+        });
+    }
+}

app/Http/Requests/UpdateHolidayEventRequest.php

@@ -0,0 +1,14 @@
+<?php
+
+/**
+ * 文件功能：节日福利活动更新请求
+ *
+ * 复用创建请求的字段校验规则，用于后台编辑节日福利模板。
+ */
+
+namespace App\Http\Requests;
+
+/**
+ * 类功能：校验更新节日福利模板的表单数据。
+ */
+class UpdateHolidayEventRequest extends StoreHolidayEventRequest {}

app/Http/Requests/UpdateLevelExpConfigRequest.php

@@ -0,0 +1,148 @@
+<?php
+
+/**
+ * 文件功能：校验后台等级经验阈值配置请求
+ *
+ * 约束管理员以列表模式提交的每级经验值，
+ * 确保阈值为正整数且严格递增。
+ */
+
+namespace App\Http\Requests;
+
+use App\Models\Sysparam;
+use Closure;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+
+/**
+ * 类功能：验证等级经验阈值列表的结构与数值合法性。
+ */
+class UpdateLevelExpConfigRequest extends FormRequest
+{
+    /**
+     * 方法功能：允许已通过后台鉴权的用户提交该请求。
+     */
+    public function authorize(): bool
+    {
+        return true;
+    }
+
+    /**
+     * 方法功能：预处理输入，过滤空行并统一转成整数序列。
+     */
+    protected function prepareForValidation(): void
+    {
+        $thresholds = collect($this->input('thresholds', []))
+            ->map(fn ($value): string => trim((string) $value))
+            ->filter(fn (string $value): bool => $value !== '')
+            ->values()
+            ->all();
+
+        $this->merge([
+            'thresholds' => $thresholds,
+        ]);
+    }
+
+    /**
+     * 方法功能：返回等级经验阈值表单的校验规则。
+     *
+     * @return array<string, ValidationRule|array<int, ValidationRule|string>|string>
+     */
+    public function rules(): array
+    {
+        return [
+            'thresholds' => ['required', 'array', 'min:1', $this->strictlyIncreasingRule(), $this->maxLevelLimitRule()],
+            'thresholds.*' => ['required', 'integer', 'min:1'],
+        ];
+    }
+
+    /**
+     * 方法功能：返回中文校验错误消息。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'thresholds.required' => '请至少配置一个等级经验阈值。',
+            'thresholds.array' => '等级经验阈值提交格式不正确。',
+            'thresholds.min' => '请至少保留一个等级经验阈值。',
+            'thresholds.*.required' => '等级经验阈值不能为空。',
+            'thresholds.*.integer' => '等级经验阈值必须是整数。',
+            'thresholds.*.min' => '等级经验阈值必须大于 0。',
+        ];
+    }
+
+    /**
+     * 方法功能：自定义校验阈值必须严格递增。
+     */
+    private function strictlyIncreasingRule(): ValidationRule
+    {
+        return new class implements ValidationRule
+        {
+            /**
+             * 方法功能：执行严格递增校验。
+             *
+             * @param  Closure(string): void  $fail
+             */
+            public function validate(string $attribute, mixed $value, Closure $fail): void
+            {
+                if (! is_array($value)) {
+                    return;
+                }
+
+                $previous = null;
+
+                foreach ($value as $index => $threshold) {
+                    if (! is_numeric($threshold)) {
+                        continue;
+                    }
+
+                    $current = (int) $threshold;
+
+                    // 每一级累计经验必须大于前一级，避免等级计算出现倒挂。
+                    if ($previous !== null && $current <= $previous) {
+                        $fail('等级经验阈值必须按等级从小到大严格递增，第 '.($index + 1).' 级配置不正确。');
+
+                        return;
+                    }
+
+                    $previous = $current;
+                }
+            }
+        };
+    }
+
+    /**
+     * 方法功能：校验等级阈值数量不能超过用户最高可达等级。
+     */
+    private function maxLevelLimitRule(): ValidationRule
+    {
+        return new class((int) Sysparam::getValue('maxlevel', '99')) implements ValidationRule
+        {
+            /**
+             * 方法功能：构造数量上限校验器。
+             */
+            public function __construct(
+                private readonly int $maxLevel
+            ) {}
+
+            /**
+             * 方法功能：执行阈值数量与最高等级的上限校验。
+             *
+             * @param  Closure(string): void  $fail
+             */
+            public function validate(string $attribute, mixed $value, Closure $fail): void
+            {
+                if (! is_array($value) || $this->maxLevel < 1) {
+                    return;
+                }
+
+                // 阈值行数对应可升级的等级数，不能超过用户最高可达等级。
+                if (count($value) > $this->maxLevel) {
+                    $fail('等级经验阈值数量不能超过用户最高可达等级，请先提高最高等级或删除多余等级。');
+                }
+            }
+        };
+    }
+}

app/Http/Requests/UpdateProfileRequest.php

@@ -31,6 +31,7 @@ class UpdateProfileRequest extends FormRequest
     public function rules(): array
     {
         return [
+            'previous_name' => ['nullable', 'string', 'max:50'],
             'sex' => ['required', 'in:0,1,2'],
             'headface' => ['required', 'string', 'max:50'], // 比如存放 01.gif - 50.gif
             'sign' => ['nullable', 'string', 'max:255'],

app/Http/Requests/UpdateRideRequest.php

@@ -0,0 +1,65 @@
+<?php
+
+/**
+ * 文件功能：后台更新座驾请求验证。
+ *
+ * 校验座驾编辑时的唯一标识、价格、使用天数和欢迎语配置。
+ */
+
+namespace App\Http\Requests;
+
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * 后台更新座驾请求
+ * 负责编辑座驾时的权限与字段校验。
+ */
+class UpdateRideRequest extends FormRequest
+{
+    /**
+     * 判断当前用户是否允许编辑座驾。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 获取更新座驾验证规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        $ride = $this->route('ride');
+
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'slug' => ['required', 'string', 'max:100', 'regex:/^ride_[a-z0-9_]+$/', Rule::unique('rides', 'slug')->ignore($ride?->id)],
+            'effect_key' => ['required', 'string', 'max:50', 'regex:/^[a-z0-9_]+$/', Rule::unique('rides', 'effect_key')->ignore($ride?->id)],
+            'icon' => ['required', 'string', 'max:20'],
+            'description' => ['nullable', 'string', 'max:500'],
+            'price' => ['required', 'integer', 'min:0'],
+            'duration_days' => ['required', 'integer', 'min:1'],
+            'welcome_message' => ['nullable', 'string', 'max:255'],
+            'sort_order' => ['required', 'integer', 'min:0'],
+            'is_active' => ['boolean'],
+        ];
+    }
+
+    /**
+     * 获取更新座驾中文错误提示。
+     *
+     * @return array<string, string>
+     */
+    public function messages(): array
+    {
+        return [
+            'slug.regex' => '座驾标识必须使用 ride_ 开头，例如 ride_j35。',
+            'effect_key.regex' => '特效 key 只能包含小写字母、数字和下划线。',
+            'duration_days.min' => '使用天数至少为 1 天。',
+        ];
+    }
+}

app/Http/Requests/UpdateShopItemRequest.php

@@ -0,0 +1,75 @@
+<?php
+
+/**
+ * 文件功能：后台更新商店商品请求验证。
+ *
+ * 统一校验商店商品编辑字段。
+ */
+
+namespace App\Http\Requests;
+
+use App\Models\ShopItem;
+use Illuminate\Contracts\Validation\ValidationRule;
+use Illuminate\Foundation\Http\FormRequest;
+use Illuminate\Validation\Rule;
+
+/**
+ * 后台更新商店商品请求
+ * 负责编辑商品时的权限与字段校验。
+ */
+class UpdateShopItemRequest extends FormRequest
+{
+    /**
+     * 判断当前用户是否允许编辑商品。
+     */
+    public function authorize(): bool
+    {
+        return $this->user() !== null;
+    }
+
+    /**
+     * 获取更新商品验证规则。
+     *
+     * @return array<string, ValidationRule|array<mixed>|string>
+     */
+    public function rules(): array
+    {
+        $shopItem = $this->route('shopItem');
+
+        return [
+            'name' => ['required', 'string', 'max:100'],
+            'slug' => ['required', 'string', 'max:100', Rule::unique('shop_items', 'slug')->ignore($shopItem?->id)],
+            'icon' => ['required', 'string', 'max:20'],
+            'description' => ['nullable', 'string', 'max:500'],
+            'price' => ['required', 'integer', 'min:0'],
+            'type' => ['required', Rule::in($this->allowedTypes())],
+            'duration_days' => ['nullable', 'integer', 'min:0'],
+            'duration_minutes' => ['nullable', 'integer', 'min:0'],
+            'intimacy_bonus' => ['nullable', 'integer', 'min:0'],
+            'charm_bonus' => ['nullable', 'integer', 'min:0'],
+            'sort_order' => ['required', 'integer', 'min:0'],
+            'is_active' => ['boolean'],
+        ];
+    }
+
+    /**
+     * 获取允许后台配置的商品类型。
+     *
+     * @return array<int, string>
+     */
+    protected function allowedTypes(): array
+    {
+        return [
+            'instant',
+            'duration',
+            'one_time',
+            'ring',
+            'auto_fishing',
+            ShopItem::TYPE_SIGN_REPAIR,
+            'msg_bubble',
+            'msg_name_color',
+            'msg_text_color',
+            'avatar_frame',
+        ];
+    }
+}