From 654019d7eb33485f94b0247aeb242c9e92710b9c Mon Sep 17 00:00:00 2001
From: Lollipopdamn <2516731482@qq.com>
Date: Thu, 12 Nov 2026 21:40:46 +0800
Subject: [PATCH] fix(ui): show rates and contain usage popovers
---
LOCAL_FORK.md | 6 ++
backend/cmd/server/VERSION | 2 +-
.../service/update_source_baselines.go | 4 +-
docs/release-notes/v2.1.63.md | 14 +++++
.../account/UpstreamBillingRateCell.vue | 10 +--
.../__tests__/UpstreamBillingRateCell.spec.ts | 11 +++-
.../admin/usage/UsageStatsCards.vue | 2 +-
.../notes/upstream-sync-20261112-v2358.md | 51 +++++++++++++++
maintenance/upstream.lock.json | 63 +++++++++++++++----
9 files changed, 136 insertions(+), 27 deletions(-)
create mode 100644 docs/release-notes/v2.1.63.md
create mode 100644 maintenance/notes/upstream-sync-20261112-v2358.md
diff --git a/LOCAL_FORK.md b/LOCAL_FORK.md
index 2282bda..15d2826 100644
--- a/LOCAL_FORK.md
+++ b/LOCAL_FORK.md
@@ -30,6 +30,12 @@
原生支付模块已退役，充值使用链动小铺及兑换码。服务器部署继续使用备份和校验后的受控发布流程。
+## 二改 v2.3.58 选择性同步（2026-11-12）
+
+从正式 v2.3.54 审查至 v2.3.58，适配声明倍率始终显示数字，以及管理端、用户端用量缓存明细浮层的窄屏越界。保留现有倍率时效/峰值计算、原生厂商路由、真实终态用量与冷灰蓝主题。
+
+仓库层统计缓存会与本地管理端缓存重叠，并让用户统计默认滞后最多 60 秒，暂缓采用；IP 自动风控/停用 Key、上游类型与余额探测、Auth Quiet 和定时器改版继续延期，退役原生支付不恢复。无迁移、依赖或运行配置变化。用户随后授权审查后提交 GitHub 并更新部署，个人版本推进至 v2.1.63，沿用 PR、CI、自有 Release/GHCR 和备份恢复校验流程。范围与同步验证见[同步记录](maintenance/notes/upstream-sync-20261112-v2358.md)及[发布说明](docs/release-notes/v2.1.63.md)，最终制品与部署验收另存发布证据。
+
## 二改 v2.3.54 选择性同步（2026-11-12）
从正式 v2.3.50 审查至 v2.3.54，适配 Kimi/Moonshot 缓存响应头和跨域可读性、手动模型同步保留中转站的跨厂商模型，以及自定义错误码账号不被网络错误额外停调。官方默认及区域端点继续按厂商过滤，未配置自定义错误码的账号保留持续网络故障冷却；本地原生路由、计费、真实终态用量与冷灰蓝主题保持原契约。
diff --git a/backend/cmd/server/VERSION b/backend/cmd/server/VERSION
index bd178cf..6a6199d 100644
--- a/backend/cmd/server/VERSION
+++ b/backend/cmd/server/VERSION
@@ -1 +1 @@
-2.1.62
+2.1.63
diff --git a/backend/internal/service/update_source_baselines.go b/backend/internal/service/update_source_baselines.go
index 06e8e26..a4ee9e2 100644
--- a/backend/internal/service/update_source_baselines.go
+++ b/backend/internal/service/update_source_baselines.go
@@ -4,8 +4,8 @@ package service
// this project's release version. A reviewed checkpoint does not imply every
// feature was merged. Update only after the corresponding review/sync completes.
const (
- forkImportedVersion = "2.3.54"
- forkImportedCommit = "e30c61bb257b0c5840260b9d2cabcde0c3bd6369"
+ forkImportedVersion = "2.3.58"
+ forkImportedCommit = "28ff1b3d41dddb2959892e66f4b410b064a266d4"
originalReviewedCommit = "10ba8f9b4dc2e6023d4a9879ab77b21841babd10"
)
diff --git a/docs/release-notes/v2.1.63.md b/docs/release-notes/v2.1.63.md
new file mode 100644
index 0000000..d0eff82
--- /dev/null
+++ b/docs/release-notes/v2.1.63.md
@@ -0,0 +1,14 @@
+选择性同步二改正式 v2.3.58，改进声明倍率显示并修复用量明细浮层的窄屏越界。
+
+## 更新
+
+- 上游声明倍率始终显示实际数字；开启倍率同步且与账号倍率相同时，也直接显示 `0.15x` 等数值。保留峰值重算、数据时效、失败/过期状态和手动刷新。
+- 管理员和用户的用量页缓存明细浮层改为右侧对齐，修复窄屏下明细超出视口和横向滚动的问题，保留悬停与键盘聚焦操作。
+
+二改来源检查点从 v2.3.54 推进至 v2.3.58，原版仍为 v0.2.21。仓库层统计缓存、IP 自动风控/停用 Key、上游类型与余额探测、Auth Quiet 和定时器改版继续延期；退役支付模块不恢复。取舍与依据见[同步记录](../../maintenance/notes/upstream-sync-20261112-v2358.md)。
+
+## 验证与范围
+
+本地 30 项前端定向回归、3 项 i18n 完整性和 2 项来源检查点测试通过；类型检查、定向 lint、生产构建和资源路径校验通过。两端用量页 12 个浅深主题/视口布局场景，以及账号页 4 个主题/倍率列显隐组合的浏览器交互检查通过。发布前独立审查、最终 GitHub CI、制品身份与线上验收另存发布证据。
+
+无依赖、数据库迁移或运行配置变化。保留本地原生路由、计费、真实终态用量与冷灰蓝主题；三份原有未跟踪用量测试保持原样且不纳入提交。
diff --git a/frontend/src/components/account/UpstreamBillingRateCell.vue b/frontend/src/components/account/UpstreamBillingRateCell.vue
index 3c90268..72e8ba7 100644
--- a/frontend/src/components/account/UpstreamBillingRateCell.vue
+++ b/frontend/src/components/account/UpstreamBillingRateCell.vue
@@ -4,10 +4,10 @@
- {{ sameAsAccount ? t('admin.accounts.upstreamBilling.sameAsAccount') : primaryValue }}
+ {{ primaryValue }}
@@ -210,12 +210,6 @@ const statusClass = computed(() => {
return ''
})
const hasEffectiveRate = computed(() => effectiveRate.value !== '-')
-const sameAsAccount = computed(() =>
- props.accountRateVisible === true &&
- props.account.extra?.upstream_billing_rate_sync_enabled === true &&
- hasEffectiveRate.value && !statusLabel.value &&
- currentEffectiveRate.value === (props.account.rate_multiplier ?? 1)
-)
const primaryValue = computed(() => hasEffectiveRate.value ? effectiveRate.value : statusLabel.value || '-')
const formatDate = (value?: string) => value
? new Date(value).toLocaleString(undefined, {
diff --git a/frontend/src/components/account/__tests__/UpstreamBillingRateCell.spec.ts b/frontend/src/components/account/__tests__/UpstreamBillingRateCell.spec.ts
index f38368a..cb843eb 100644
--- a/frontend/src/components/account/__tests__/UpstreamBillingRateCell.spec.ts
+++ b/frontend/src/components/account/__tests__/UpstreamBillingRateCell.spec.ts
@@ -68,18 +68,25 @@ describe('UpstreamBillingRateCell', () => {
vi.useRealTimers()
})
- it('deduplicates only with a visible account-rate column and restores the number for peak or failed data', async () => {
+ it('keeps the numeric declared rate with either account-rate column visibility and for peak or failed data', async () => {
const account = makeAccount({ rate_multiplier: 0.6, extra: {
upstream_billing_rate_sync_enabled: true,
upstream_billing_probe: { status: 'ok', data: billingData, received_at: '2026-07-13T00:00:00Z', fresh_until: '2026-07-14T00:00:00Z' }
} })
const wrapper = mount(UpstreamBillingRateCell, { props: { account, now: Date.now(), accountRateVisible: true } })
const value = () => wrapper.get('[data-testid="upstream-billing-rate"]').text()
- expect(value()).toBe('admin.accounts.upstreamBilling.sameAsAccount')
+ expect(value()).toBe('0.60x')
await wrapper.setProps({ accountRateVisible: false }); expect(value()).toBe('0.60x')
await wrapper.setProps({ accountRateVisible: true, now: Date.parse('2026-07-13T01:00:00Z') }); expect(value()).toBe('0.90x')
await wrapper.setProps({ now: Date.now(), account: { ...account, extra: { ...account.extra, upstream_billing_probe: { ...account.extra!.upstream_billing_probe!, status: 'failed' } } } });
expect(value()).toBe('0.60x')
+ await wrapper.setProps({ account: { ...account, rate_multiplier: 0.15, extra: {
+ ...account.extra,
+ upstream_billing_probe: { ...account.extra!.upstream_billing_probe!, data: {
+ ...billingData, resolved_rate_multiplier: 0.15, effective_rate_multiplier: 0.15, peak_rate_enabled: false
+ } }
+ } } })
+ expect(value()).toBe('0.15x')
wrapper.unmount()
})
diff --git a/frontend/src/components/admin/usage/UsageStatsCards.vue b/frontend/src/components/admin/usage/UsageStatsCards.vue
index 3646b24..c4c3306 100644
--- a/frontend/src/components/admin/usage/UsageStatsCards.vue
+++ b/frontend/src/components/admin/usage/UsageStatsCards.vue
@@ -36,7 +36,7 @@
/>
{{ cacheDetailLabel() }}
diff --git a/maintenance/notes/upstream-sync-20261112-v2358.md b/maintenance/notes/upstream-sync-20261112-v2358.md
new file mode 100644
index 0000000..9fe995c
--- /dev/null
+++ b/maintenance/notes/upstream-sync-20261112-v2358.md
@@ -0,0 +1,51 @@
+# 二改 v2.3.58 选择性同步（2026-11-12）
+
+正式 v2.3.54 → v2.3.58，工作分支 `sync/fork-20261112-v2358`，起点为个人 v2.1.62 的 `f77a633224f6a0cad90382543224069338cd58ec`。同步阶段仅本地选择性适配，不导入二改 Git 历史，个人 VERSION 保持 2.1.62。用户随后授权审查后提交 GitHub 并部署，发布阶段推进至个人 v2.1.63；PR、CI、自有 Release/GHCR、备份恢复和最终上线证据单独保存。
+
+## 来源与范围
+
+- 二改仓库 `kiss-kedaya/sub2api`，原正式检查点 `e30c61bb257b0c5840260b9d2cabcde0c3bd6369`（v2.3.54），新正式检查点 `28ff1b3d41dddb2959892e66f4b410b064a266d4`（[v2.3.58](https://github.com/kiss-kedaya/sub2api/releases/tag/v2.3.58)）。GitHub Releases API 记录发布时间为 `2026-11-12T11:47:32Z`。
+- 共 39 个提交（含 merge）、29 个非 merge 提交、121 个变化路径。正式 tag 独立 fetch 至 `refs/remotes/upstream/releases/v2.3.58`；本地 tag 不覆盖。
+- main 观察到 `c9d72b46bff8f7fcf596473d05f9125fc6f5a8ec`，只作观察记录，正式版之后的变化未纳入检查点。继续仅跟踪正式 Release；原版检查点 v0.2.21 / `10ba8f9b4dc2e6023d4a9879ab77b21841babd10` 不变。
+- 原始发布元数据、完整 diff、提交清单、逐路径分类、初始状态及验证材料保存在 `.artifacts/fork-sync-20261112-v2358/`。121 个路径均有明确分类，无遗漏：适配 3、使用本地验证替代源测试变更 2、本地已覆盖 1、延期 62、排除 53。
+- 检查点表示差异已审查并记录取舍，不表示整版功能全部导入，也不等于个人版本已发布。
+
+## 采用与适配
+
+| 项目 | 来源提交 | 本地处理 |
+| --- | --- | --- |
+| 声明倍率直接显示数字 | `6a51d9bea` | 同步倍率与账号倍率相同时也显示 `0.15x` 等实际数字，不再替换成“同账号倍率”。保留现有时效、峰值重算、失败但仍新鲜的数据、过期/异常状态及手动探测；保留 `accountRateVisible` prop 的调用兼容。 |
+| 缓存明细浮层窄屏越界 | `af6ec7264`（部分） | 两端共享组件的浮层由居中改为右对齐。真实浏览器复现：320px 时管理员/用户浮层右缘分别达到 364.8px / 347px，调整后为 295.7px / 272px，显示浮层不再增加文档宽度。本地两端统计容器已有无裁切布局，源版删除 `overflow-hidden` 的部分无需重复同步。 |
+
+不覆盖本地冷灰蓝主题、表格布局、原生平台路由、凭据目的地、真实终态用量或收费规则；不修改生产账号的倍率/探测设置。
+
+## 延期与排除
+
+- **仓库层统计缓存 `e1b17b171` 延期。** 源版默认启用 Redis 聚合缓存，TTL 60 秒，写入不失效；覆盖用户、Key、账号、模型及筛选趋势等查询。key 包含查询维度、实体、时间、时区与筛选条件，Redis 出错可回源，但新鲜度是另一项契约。本地管理端 `usage_query_cache.go`、`dashboard_query_cache.go`、`snapshot_cache.go` 及 snapshot-v2 已缓存重叠统计，并提供管理端 `nocache`；用户 stats/trend/models 当前直接查询。全局包进 repository 会叠加管理端缓存，并让用户统计默认滞后最多 60 秒。没有数据库负载证据支持这项变化，保留现有路径；配置、构造器、wire 和源测试整组不引入。
+- **共享 IP 自动风控整组延期。** `832307f25`、`a89fc310b`、`c2d658e05`、`ff6ce64cd` 和配套 contract/UI 变更引入多用户共享出口检测、外部机房分类、自动追加 IP 提示/限流、停用 API Key、risk marker 与密钥轮换，改变实际访问控制。与此前已延期的 IP 分类/自动封禁保持一致；`e1b17b171` 的 Lua 写合并和 `99559e55a` 的 ZRangeArgs 替换只服务该新 detector，本地没有对应调用，不单摘性能或弃用修复。
+- **上游类型/余额探测继续延期。** `a3e79bc61`、`83b0c1942`、`d48232b7d` 的 New API 指纹/1e8 sentinel、同源重定向、只有已用金额的显示、自定义余额提取 fallback、固定十分钟重试，均属于本地尚未引入的余额链。`customUsageExplicitlyConfigured` 也仅供新链调用，不增加闲置 helper。本地显式启用的 Sub2API 声明倍率探测保持原目的地和 unsupported 退避。`UpstreamBalanceCell` 不存在，其刷新按钮修复不适用；本地声明倍率刷新按钮已有 `type="button"`。
+- **Auth Quiet 和定时器改版延期。** `b636d85f9` 的登录/注册整套主题、三步注册需要独立适配；`3480d346b`、`ef4638ca7`、`ee94dd4ff` 的定时器模态框和触发器只适用于延期模块。不覆盖现有 Vue SPA 或认证交互，不恢复定时器。
+- **原生链上充值整组排除。** ETH/BNB 收款、动态价格、扫描/归集及源 migration314 属于已退役 cryptopay；不引入 SQL、支付配置、后台和用户界面。源版 v2.3.56 的 migrate-only 部署说明不适用于本次本地适配。
+- 源 VERSION、发行说明、未发布 main、此前延期的 Dense/Nuxt、自动模型同步/catalogue、TTL 收费/Chat usage，以及 Hosted/Ops/capture 等退役模块均保留原决定。
+
+## 验证
+
+| 范围 | 结果 | 边界 |
+| --- | --- | --- |
+| 前端定向回归 | 3 个文件、30 项通过 | 声明倍率单元 8 项、缓存统计卡 2 项、用户用量页 20 项；包含相同倍率与账号列显隐、峰值、失败/过期、异常数据、按钮和现有用量交互。 |
+| i18n、类型与构建 | 3 项 i18n 完整性、`vue-tsc -b`、Vite 生产构建、生产 CSS 资源路径检查通过 | Corepack 固定项目 pnpm 9.15.5，执行 build 的四个等价步骤，不修改依赖或全局配置。日志为 `i18n.log`、`typecheck.log`、`build.log`、`console-assets.log`。 |
+| 定向 ESLint | 通过 | 仅两个修改的 Vue 组件及倍率现有测试，`lint.log`。 |
+| 来源检查点 | 2 项通过 | 显式文件运行 `go test -json -tags unit update_source_baselines.go update_source_baselines_test.go`，核对两源锁文件、正式 Release 与 main 分离以及部署检查策略；`source-checkpoint-tests.jsonl`。 |
+| 实际浏览器 | 见下文 | Playwright + headless Edge，全部使用本机 mock，无生产凭据和真实探测/付费调用。 |
+
+浏览器证据：
+
+- 深色主题，两端 320、390、768、1440px 共 8 个布局场景，分别操作悬停和键盘聚焦；浮层明细完整、在视口内，隐藏/显示不增加横向滚动。`ui-before.json` 与 `ui-after.json` 保存修复前后几何，截图逐项保存。
+- 浅色主题，两端 390、1440px 共 4 个布局场景，同样验证悬停、聚焦和横向边界；`ui-after-light.json`。
+- 账号页在浅/深主题与账号倍率列显/隐四种组合中，使用浏览器响应 fixture 验证同步的 `0.15x` 数字、可聚焦详情、Escape 关闭及刷新按钮。四次按钮操作只调用本地拦截 mock，返回后数字保持；`ui-rates.json` 和 `rate-*.png`。所有场景无页面 JavaScript 异常，未访问外部域名。
+
+`gofmt`、维护 JSON、121 路径覆盖、`git diff --check`、个人 VERSION 与三份原有未跟踪用量测试 SHA256 最终核验通过。三份测试未改动、未纳入执行或提交范围。本轮后端仅改变来源常量，没有运行全量后端、race、数据库集成或服务器构建；不据本地验证声称发布 CI 或线上验收通过。无迁移、依赖及运行配置变化。
+
+## 发布前审查
+
+发布使用个人 v2.1.63。同步阶段已有的 30 项前端回归、3 项 i18n、2 项来源一致性测试、类型/lint/构建及 16 个浏览器场景在对应源码未变化时复用；发布阶段另行验证最终提交的完整 CI、安全检查、Release/GHCR 和线上身份。只读预检确认生产仍运行 v2.1.62 / `f77a63322`，333 行迁移、安装密钥、运行配置和数据容器符合上次部署验收。独立审查和部署 helper 故障注入结果、最终上线验证保存在仓库外 `development/diagnostics/sub2api-release-v2163-20261112/`。
diff --git a/maintenance/upstream.lock.json b/maintenance/upstream.lock.json
index 214ba9c..bdd6ce3 100644
--- a/maintenance/upstream.lock.json
+++ b/maintenance/upstream.lock.json
@@ -2,27 +2,27 @@
"schema_version": 1,
"upstream_repository": "kiss-kedaya/sub2api",
"upstream_branch": "main",
- "imported_version": "2.3.54",
- "imported_commit": "e30c61bb257b0c5840260b9d2cabcde0c3bd6369",
+ "imported_version": "2.3.58",
+ "imported_commit": "28ff1b3d41dddb2959892e66f4b410b064a266d4",
"personal_baseline_commit": "020b77873e0662a34f0169c4a40f883cd3f1b521",
- "latest_observed_version": "2.3.54",
- "latest_observed_release_commit": "e30c61bb257b0c5840260b9d2cabcde0c3bd6369",
- "latest_observed_main_commit": "e0ebb4ee41529421048e70d04e8df1aa643d9389",
+ "latest_observed_version": "2.3.58",
+ "latest_observed_release_commit": "28ff1b3d41dddb2959892e66f4b410b064a266d4",
+ "latest_observed_main_commit": "c9d72b46bff8f7fcf596473d05f9125fc6f5a8ec",
"monitoring_policy": "official-releases-only; ignore draft, prerelease and unreleased branch commits",
- "reviewed_release_tag": "v2.3.54",
- "reviewed_release_commit": "e30c61bb257b0c5840260b9d2cabcde0c3bd6369",
+ "reviewed_release_tag": "v2.3.58",
+ "reviewed_release_commit": "28ff1b3d41dddb2959892e66f4b410b064a266d4",
"observed_delta_review": {
- "from_commit": "c21d39aec58d323f75014e276e96f1517b959bb6",
- "to_commit": "e30c61bb257b0c5840260b9d2cabcde0c3bd6369",
- "status": "formal_v2354_selective_backport",
- "scope": "Review v2.3.50 to v2.3.54 (75 commits including merges, 44 non-merge commits / 176 paths). Adapt Msh cache-header forwarding/CORS, manual relay model-list retention and custom-error-code transport cooldown semantics. Preserve local billing, native providers and UI.",
- "evidence": "maintenance/notes/upstream-sync-20261112-v2354.md"
+ "from_commit": "e30c61bb257b0c5840260b9d2cabcde0c3bd6369",
+ "to_commit": "28ff1b3d41dddb2959892e66f4b410b064a266d4",
+ "status": "formal_v2358_selective_backport",
+ "scope": "Review v2.3.54 to v2.3.58 (39 commits including merges, 29 non-merge commits / 121 paths). Adapt numeric upstream-declared rates and cache-detail popover alignment. Defer repository stats cache, automatic IP/key risk control and upstream balance/type probing; retain local native providers, live user stats and UI.",
+ "evidence": "maintenance/notes/upstream-sync-20261112-v2358.md"
},
"sync_policy": "review-diff-then-selective-behavior-backport",
"checkpoint_meaning": "Reviewed source history, not a complete merge. Selected source changes, excluded subfeatures and explicit deferrals are recorded in dated notes; release/deployment gates remain separate.",
"cumulative_sync": {
"status": "selective_sync_recorded_with_explicit_deferrals",
- "source_head": "e30c61bb257b0c5840260b9d2cabcde0c3bd6369",
+ "source_head": "28ff1b3d41dddb2959892e66f4b410b064a266d4",
"reviewed_without_runtime_changes": [
"Formal v2.3.19: catalogue file loader and mutable six-hour upstream-main refresh remain with the deferred provider-blind metadata chain; no independent runtime fix imported. See maintenance/notes/upstream-sync-20261107-v2319.md.",
"Formal v2.3.15 publishes the GIF numeric-string fix already adapted from leaf 9c518bf7f during the v2.3.14 review. Advance the formal source checkpoint; retain local bounded-integer validation and all existing feature exclusions. See maintenance/notes/upstream-sync-20261106-v2315.md.",
@@ -30,6 +30,7 @@
"Formal v2.3.5: schedulable-timer confirmation and requestcapture diagnostic test fixes have no local module/caller. Review and monitoring checkpoints updated without importing deferred modules; see maintenance/notes/upstream-sync-20261103-v2305.md."
],
"implemented_with_local_regression": [
+ "Formal v2.3.55-v2.3.58: always show numeric upstream-declared rates, including synchronized 0.15x; right-align cache-detail popovers on both usage pages after reproducing narrow-screen overflow. Preserve local theme, freshness/peak semantics and existing callers. See maintenance/notes/upstream-sync-20261112-v2358.md for deferrals and validation.",
"Formal v2.3.51-v2.3.54: Msh cache headers and CORS exposure, manual relay model-list retention and custom-code transport policy. Retain official default/regional filtering, privacy/ForceRemove and other durable-fault cooldowns. See maintenance/notes/upstream-sync-20261112-v2354.md for deferrals and validation.",
"Formal v2.3.41-v2.3.47: independently adapt unrestricted non-OpenAI model-pool eligibility; preserve ordinary OpenAI mapping preference, explicit passthrough, no-match mixed fallback, compact/retirement and provider-family guards. Retain local UI/billing; automatic whitelist writes/CAS, iframe permission expansion and removed sweeper remain excluded or deferred. See maintenance/notes/upstream-sync-20261110-v2347.md.",
"Formal v2.3.20-v2.3.40: whitelist save conflict and hidden-mapping hints; DeepSeek raw-preserving Chat tool-pair repair and protocol-specific placeholders; unchanged Grok effort; durable session revocation, atomic email code consumption, idempotent body-normalized model admission with multipart-byte preservation, API-key session release, opt-in startup cleanup, homepage isolation and mandatory installation checksums. Preserve routing/billing/UI; see maintenance/notes/upstream-sync-20261109-v2340.md.",
@@ -120,6 +121,26 @@
],
"selected_deepseek_fix": "Formal v2304 native DeepSeek bypasses legacy call-ID/request-state rewriting and rejected-field retries; genuine reasoning and thinking-switch options are provider-gated. Existing legacy conversion empty-shell repair remains scoped. Preserve local key/conversation/requested-model replay isolation, native protocols and distinct IDs; no cache-key weakening, Hosted execution, DSML parser or live SSE ID rewrite.",
"deferred_changes": [
+ {
+ "feature": "v2358-repository-usage-stats-cache",
+ "upstream_commits": ["e1b17b1719108ddadab68479af88f08123f275a2"],
+ "reason": "Local admin report/dashboard/snapshot caches already cover overlapping queries and support nocache. The source default-on repository cache does not invalidate on writes and adds up to 60 seconds of staleness to user stats too; defer until measured database load justifies a targeted cache with explicit freshness semantics."
+ },
+ {
+ "feature": "v2357-ip-sharing-key-disable-and-rotation",
+ "upstream_commits": ["832307f25", "a89fc310b", "c2d658e05", "ff6ce64cd", "336c9d68b", "e1b17b171", "99559e55a"],
+ "reason": "Keep the shared-IP detector, external IP classification gate, default automatic notice/key disabling, risk store/DTO/UI and key rotation together with deferred automatic access-control policy. Lua write coalescing and ZRangeArgs only serve the absent detector, so neither is an independent local fix."
+ },
+ {
+ "feature": "v2358-upstream-type-balance-sentinel-and-fallback",
+ "upstream_commits": ["a3e79bc61", "83b0c1942", "d48232b7d"],
+ "reason": "New API fingerprints/1e8 billing sentinel, same-origin redirect handling, used-only balances, custom extractor fallback and ten-minute retries remain with the absent upstream-kind/balance chain. Existing explicitly enabled Sub2API rate probes retain their destinations and retry policy; local probe buttons already use type=button."
+ },
+ {
+ "feature": "v2355-auth-quiet-and-timer-dialog",
+ "upstream_commits": ["b636d85f9", "3480d346b", "ef4638ca7", "ee94dd4ff"],
+ "reason": "Retain the local cool gray-blue Vue SPA and current auth interaction. Auth Quiet/multi-step registration need separate UI work; timer modal/trigger changes have no local module and remain deferred."
+ },
{
"feature": "v2343-default-on-whitelist-sync-and-cas",
"upstream_commits": [
@@ -939,5 +960,21 @@
"excluded_scope": "Source VERSION/release prose and unrelated deployment changes; retired payment/Hosted/Ops/capture/timer modules. Existing explicit exclusions remain.",
"preserved": "Local native provider routing, effective billing/rates, real terminal usage, cool gray-blue Vue SPA and the three existing untracked usage tests. Personal VERSION was 2.1.61 during sync; user-authorized release advances to 2.1.62.",
"release_status": "User authorized code review, GitHub submission and deployment on 2026-11-12. Prepare personal v2.1.62 through PR/CI, own Release/GHCR and backup/restore-validated controlled rollout; final evidence is stored separately."
+ },
+ "sync_20261112_v2358": {
+ "evidence": "maintenance/notes/upstream-sync-20261112-v2358.md",
+ "reviewed_release_tag": "v2.3.58",
+ "reviewed_release_commit": "28ff1b3d41dddb2959892e66f4b410b064a266d4",
+ "observed_main_commit": "c9d72b46bff8f7fcf596473d05f9125fc6f5a8ec",
+ "reviewed_delta": { "from_version": "2.3.54", "commits": 39, "non_merge_commits": 29, "paths": 121 },
+ "selected_commits": ["6a51d9bea690dbf39d8cf4411584ff4923dd8b6e"],
+ "partially_adapted_commits": {
+ "af6ec72640e8de32fb9a8f1472c413abb7fc62df": "Right-align the shared cache-detail popover after reproducing 320px overflow in both local workspaces. The user strip already lacks overflow-hidden; preserve the local grid/theme and validate real hover/focus geometry."
+ },
+ "already_covered": "Local user/admin usage containers do not clip the cache panel; the existing upstream-rate refresh action already has type=button and the separate UpstreamBalanceCell module is absent.",
+ "deferred_scope": "Repository usage_stats_cache (overlapping admin caches and default 60s user-stat staleness); shared-IP detection, external classification, automatic key disabling/risk marker/rotation; upstream type/balance/sentinel/redirect/custom extractor and retry chain; Auth Quiet and timer modal redesign.",
+ "excluded_scope": "Retired native crypto deposits/prices/sweeper and source migration314; upstream VERSION/release prose, unreleased main and previously excluded Hosted/Ops/capture modules.",
+ "preserved": "Native provider routing, credential destinations, terminal usage/billing, existing user-stat freshness, local cool gray-blue theme and accountRateVisible prop compatibility. No migration/dependency/runtime-config change; personal VERSION was 2.1.62 during sync and advances to 2.1.63 for the user-authorized release. Three pre-existing untracked usage tests remain untouched and excluded from the commit.",
+ "release_status": "User authorized code review, GitHub submission and deployment on 2026-11-12. Prepare personal v2.1.63 through PR/CI, own Release/GHCR and backup/restore-validated controlled rollout; final evidence is stored separately."
}
}