fix: 审查修复波次（P0x4 + P1x30+）

- domain/rules: 计分与排名解耦、破纪录按组别、tieBreak 生效、调整分不丢、移除 aggregate 假能力
- realtime: 新建 internal/dto，快照三项契约对齐，/ws 只认会话身份
- httpapi: 流水幂等、standings 整表载荷、广播接线、强制改密、XFF 防伪造、records 写入、审计、赛事包内容、发布前备份、result.points、实例列表
- web: FormData 上传、YAML 解析、快照归一化、大屏解析层、bootstrap 降级、访客判定、主题切换
- console: 优雅关闭握手、中文化、免验证改管理员账号、选屏与日志轮转修复
- docs: 用户文档三份 + README
- 主代理: 破纪录加分接线（levels 未加载导致恒 0）

server/internal/httpapi/scoring.go

@@ -5,9 +5,13 @@ import (
 	"database/sql"
 	"encoding/json"
 	"errors"
+	"path/filepath"
+	"strings"
 
 	"git.yeij.top/AskaEth/Scoreboard/server/internal/domain"
+	"git.yeij.top/AskaEth/Scoreboard/server/internal/export"
 	"git.yeij.top/AskaEth/Scoreboard/server/internal/middleware"
+	"git.yeij.top/AskaEth/Scoreboard/server/internal/rules"
 )
 
 // queryer 让计分相关的加载函数既能走连接池（只读）也能走事务（发布时读写一致）。
@@ -224,16 +228,13 @@ func loadResultsQ(ctx context.Context, q queryer, eventID, categoryID int64) ([]
 }
 
 func loadRecordBonusQ(ctx context.Context, q queryer) (domain.RecordBonusConfig, error) {
-	cfg := domain.RecordBonusConfig{Mode: domain.RecordBonusMax}
 	values, err := loadSettingsMap(ctx, q)
 	if err != nil {
-		return cfg, err
+		return domain.RecordBonusConfig{}, err
 	}
-	cfg.Enabled = values["record_bonus.enabled"] == "true"
-	if values["record_bonus.mode"] == string(domain.RecordBonusSum) {
-		cfg.Mode = domain.RecordBonusSum
-	}
-	return cfg, nil
+	// 统一走 rules 的解析：enabled / mode / levels 三个键必须一起读，
+	// 只读前两个会让 levelPoints 永远查不到档位，破纪录加分恒为 0。
+	return rules.RecordBonusFromSettings(values), nil
 }
 
 func loadRecordBreaksQ(ctx context.Context, q queryer, eventID int64) ([]domain.RecordBreak, error) {
@@ -328,8 +329,9 @@ func computeEventScore(ctx context.Context, q queryer, eventID, categoryID int64
 }
 
 // recomputeLedgerTx 作废范围内旧流水并写入新流水（流水只追加、不修改）。
+// 作废范围是引擎产出的成绩分与破纪录加分；人工调整由 point_adjustments 管理，绝不在此作废。
 func recomputeLedgerTx(ctx context.Context, tx *sql.Tx, eventID, categoryID, actorID int64, reason string) (domain.EventScore, error) {
-	scope := `source_type = 'result' AND event_id = ?`
+	scope := `source_type IN ('result', 'record_bonus') AND event_id = ?`
 	args := []any{eventID}
 	if categoryID > 0 {
 		scope += ` AND entry_id IN (SELECT id FROM entries WHERE category_id = ?)`
@@ -390,6 +392,9 @@ func (s *server) publishResults(ctx context.Context, in publishPayload, userID i
 		catID = *in.CategoryID
 	}
 
+	// 发布是不可逆的对外动作，先留一份快照；失败只记日志与审计，不阻塞发布（08 第 6 节）。
+	s.backupBeforePublish(ctx)
+
 	tx, err := s.ev.BeginTx(ctx, nil)
 	if err != nil {
 		return nil, internal(err)
@@ -436,7 +441,7 @@ func (s *server) publishResults(ctx context.Context, in publishPayload, userID i
 	if err := recordChanges(ctx, tx, "result", after, "upsert", userID); err != nil {
 		return nil, err
 	}
-	if err := bumpVersion(ctx, tx, "standings", 0, "replace", map[string]any{"eventId": in.EventID}, userID); err != nil {
+	if err := s.bumpStandings(ctx, tx, userID); err != nil {
 		return nil, err
 	}
 	if err := tx.Commit(); err != nil {
@@ -447,6 +452,24 @@ func (s *server) publishResults(ctx context.Context, in publishPayload, userID i
 	return s.resultsByEvent(ctx, in.EventID)
 }
 
+// backupBeforePublish 在发布前留一份快照；失败只记日志与审计，不阻塞发布。
+func (s *server) backupBeforePublish(ctx context.Context) {
+	if strings.TrimSpace(s.dataDir) == "" {
+		return
+	}
+	info, err := export.BackupBeforePublish(s.ev, export.BackupOptions{
+		Dir:    filepath.Join(s.dataDir, "backups"),
+		Prefix: "event",
+		Reason: "publish",
+	})
+	if err != nil {
+		s.logger.Error("发布前备份失败", "err", err)
+		s.audit(ctx, "system.backup_failed", "backup", 0, nil, map[string]any{"reason": "publish", "error": err.Error()})
+		return
+	}
+	s.audit(ctx, "system.backup", "backup", 0, nil, map[string]any{"reason": "publish", "path": info.Path})
+}
+
 func (s *server) unpublishResults(ctx context.Context, in publishPayload, userID int64) ([]resultDTO, error) {
 	if in.EventID == 0 {
 		return nil, badRequest("eventId 必填", nil)
@@ -495,7 +518,7 @@ func (s *server) unpublishResults(ctx context.Context, in publishPayload, userID
 	if err := recordChanges(ctx, tx, "result", after, "upsert", userID); err != nil {
 		return nil, err
 	}
-	if err := bumpVersion(ctx, tx, "standings", 0, "replace", map[string]any{"eventId": in.EventID}, userID); err != nil {
+	if err := s.bumpStandings(ctx, tx, userID); err != nil {
 		return nil, err
 	}
 	if err := tx.Commit(); err != nil {
@@ -566,7 +589,7 @@ func (s *server) voidResult(ctx context.Context, resultID int64, reason string,
 	if err := recordChanges(ctx, tx, "result", []resultDTO{after}, "void", userID); err != nil {
 		return resultDTO{}, err
 	}
-	if err := bumpVersion(ctx, tx, "standings", 0, "replace", map[string]any{"eventId": eventID}, userID); err != nil {
+	if err := s.bumpStandings(ctx, tx, userID); err != nil {
 		return resultDTO{}, err
 	}
 	if err := tx.Commit(); err != nil {