# 审计 — 监测槽开关 / TTL / 到期竞态 / 探针中文 / 移除提示

**日期**：2026-06-12  
**Changelog**:
- `docs/changelog/2026-06-11-watch-slot-monitoring-toggle.md`
- `docs/changelog/2026-06-11-watch-probe-parse-error-fix.md`
- `docs/changelog/2026-06-12-watch-ttl-expiry-race-fix.md`

## 范围（文件清单）

| 层级 | 文件 |
|------|------|
| 模型/迁移 | `server/domain/models/__init__.py` |
| | `server/infrastructure/database/migrations.py` |
| Repository | `server/infrastructure/database/watch_repo.py` |
| Service | `server/application/services/watch_service.py` |
| API | `server/api/watch.py` |
| 探针 | `server/background/watch_probe_runner.py` |
| | `server/infrastructure/ssh/remote_probe.py` |
| 工具 | `server/utils/watch_metrics.py` |
| | `server/utils/watch_state.py` |
| | `server/utils/watch_probe_errors.py` |
| 前端 | `frontend/src/api/index.ts` |
| | `frontend/src/composables/useWatchPins.ts` |
| | `frontend/src/components/watch/WatchSlotCard.vue` |
| | `frontend/src/components/watch/WatchSlotRow.vue` |
| | `frontend/src/components/watch/WatchProbeRecordsTable.vue` |
| | `frontend/src/utils/watchFormat.ts` |
| 测试 | `tests/test_watch_pins.py` |
| | `tests/test_watch_metrics.py` |
| | `tests/test_watch_probe_errors.py` |

## Step 3 规则扫描

| H | 规则 | 结论 |
|---|------|------|
| H1 | 鉴权 / IDOR | PASS — PATCH/DELETE 均 `get_current_admin` + admin_id 隔离 |
| H2 | 无静默吞错 | PASS — 探针失败落库；前端 remove/monitoring/ttl 均有 snackbar |
| H3 | 无新密钥 | PASS |
| H4 | CUD 审计 | PASS — pause/resume/ttl/remove |
| H5 | 输入边界 | PASS — `Literal[8,24]`、slot 0–3 |
| H6 | 迁移 | PASS — monitoring_enabled + ttl_hours ALTER |
| H7 | TTL 竞态 | PASS — `_finalize_due_pins` 读/写路径同步到期 |

## Closure

| H | 判定 | 依据 |
|---|------|------|
| H1–H6 | PASS | 鉴权、审计、迁移、探针落库 |
| H7 | PASS | 到期 ghost pin 不再显示空槽 |

## DoD

- [x] `pytest tests/test_watch_*.py` — 21 passed
- [x] `npm run type-check`
- [x] P0 TTL 竞态修复 + P2 onRemove snackbar
- [ ] `bash deploy/pre_deploy_check.sh`
- [ ] 生产浏览器终验

## 验证命令

```bash
.venv/bin/pytest tests/test_watch_*.py -q
cd frontend && npm run type-check
bash scripts/local_verify.sh
bash deploy/pre_deploy_check.sh
```
