feat(framework): 回灌 OpenFlare 分层、安全与运行时改进

将平台域持久化收敛为 repository 唯一入口，model 去掉 IO。
邮件头写入前清除 CR/LF，防止 header 注入。
httppool 支持可配置 Transport；batchwriter 增加 MinBatchSize/Stats，flush 失败交回批次；任务 PermanentError 作为 SkipRetry 终态。
设置与推送页的确认改为 AlertDialog；axios 去尾斜杠并按 Gin 数组序列化查询参数。
升级共享 Go 依赖（Gin、Asynq、OTel、GORM、Redis 等）。

internal/infra/persistence/batchwriter/config.go

@@ -11,6 +11,7 @@ import (
 const (
 	defaultQueueSize    = 10_000
 	defaultMaxBatchSize = 1_000
+	defaultMinBatchSize = 50
 	defaultFlushEvery   = time.Second
 )
 
@@ -25,8 +26,17 @@ type Config struct {
 	// MaxBatchSize triggers a flush when the in-memory batch reaches this count.
 	MaxBatchSize int
 
-	// FlushInterval triggers a time-based flush even when the batch is smaller.
+	// MinBatchSize is the minimum in-memory batch size for time-based flushes.
+	// Zero disables the threshold and preserves legacy interval flush behavior.
+	// When set, interval flushes below this size are skipped unless MaxFlushWait elapses.
+	MinBatchSize int
+
+	// FlushInterval is how often the worker checks whether a time-based flush should run.
 	FlushInterval time.Duration
+
+	// MaxFlushWait forces a flush of any non-empty batch once the oldest item has waited
+	// this long, even if MinBatchSize has not been reached. Zero disables the force path.
+	MaxFlushWait time.Duration
 }
 
 // DefaultConfig returns production-friendly defaults aligned with audit log batching.
@@ -34,6 +44,7 @@ func DefaultConfig() Config {
 	return Config{
 		QueueSize:     defaultQueueSize,
 		MaxBatchSize:  defaultMaxBatchSize,
+		MinBatchSize:  defaultMinBatchSize,
 		FlushInterval: defaultFlushEvery,
 	}
 }
@@ -45,8 +56,14 @@ func (c Config) validate() error {
 	if c.MaxBatchSize <= 0 {
 		return fmt.Errorf("batchwriter: max batch size must be positive")
 	}
+	if c.MinBatchSize < 0 {
+		return fmt.Errorf("batchwriter: min batch size must be non-negative")
+	}
 	if c.FlushInterval <= 0 {
 		return fmt.Errorf("batchwriter: flush interval must be positive")
 	}
+	if c.MaxFlushWait < 0 {
+		return fmt.Errorf("batchwriter: max flush wait must be non-negative")
+	}
 	return nil
 }

internal/infra/persistence/batchwriter/writer.go

@@ -9,22 +9,34 @@ package batchwriter
 import (
 	"context"
 	"sync"
+	"sync/atomic"
 	"time"
 )
 
 // FlushFunc persists a batch of queued items. It is invoked from the worker goroutine.
 type FlushFunc[T any] func(ctx context.Context, items []T) error
 
-// FlushErrorHandler is called when FlushFunc returns an error. The batch is discarded
-// after the handler returns; the worker continues processing.
-type FlushErrorHandler func(ctx context.Context, batchSize int, err error)
+// FlushErrorHandler is called when FlushFunc returns an error after optional retries.
+// The batch is discarded after the handler returns; the worker continues processing.
+// Handlers receive the failed items so callers can release dedup keys or re-queue.
+type FlushErrorHandler[T any] func(ctx context.Context, items []T, err error)
+
+// Stats is a point-in-time snapshot of Writer queue and failure counters.
+type Stats struct {
+	Name        string
+	Depth       int
+	Cap         int
+	Drops       int64
+	FlushErrors int64
+	Running     bool
+}
 
 // Writer buffers items and flushes them by size or interval.
 type Writer[T any] struct {
 	cfg   Config
 	flush FlushFunc[T]
 
-	onFlushError FlushErrorHandler
+	onFlushError FlushErrorHandler[T]
 	onDrop       func(T)
 
 	startOnce sync.Once
@@ -34,13 +46,16 @@ type Writer[T any] struct {
 	ch        chan T
 	workerCtx context.Context
 	done      chan struct{}
+
+	drops       atomic.Int64
+	flushErrors atomic.Int64
 }
 
 // Option configures optional Writer callbacks.
 type Option[T any] func(*Writer[T])
 
 // WithFlushErrorHandler registers a callback for flush failures.
-func WithFlushErrorHandler[T any](handler FlushErrorHandler) Option[T] {
+func WithFlushErrorHandler[T any](handler FlushErrorHandler[T]) Option[T] {
 	return func(w *Writer[T]) {
 		w.onFlushError = handler
 	}
@@ -168,22 +183,37 @@ func (w *Writer[T]) Cap() int {
 	return w.cfg.QueueSize
 }
 
+// Stats returns a point-in-time snapshot of queue depth and failure counters.
+func (w *Writer[T]) Stats() Stats {
+	return Stats{
+		Name:        w.cfg.Name,
+		Depth:       w.Len(),
+		Cap:         w.Cap(),
+		Drops:       w.drops.Load(),
+		FlushErrors: w.flushErrors.Load(),
+		Running:     w.Running(),
+	}
+}
+
 func (w *Writer[T]) run() {
 	ticker := time.NewTicker(w.cfg.FlushInterval)
 	defer ticker.Stop()
 
 	batch := make([]T, 0, w.cfg.MaxBatchSize)
+	var batchStartedAt time.Time
 	flush := func() {
 		if len(batch) == 0 {
 			return
 		}
 		items := append([]T(nil), batch...)
 		if err := w.flush(w.workerCtx, items); err != nil {
+			w.flushErrors.Add(1)
 			if w.onFlushError != nil {
-				w.onFlushError(w.workerCtx, len(items), err)
+				w.onFlushError(w.workerCtx, items, err)
 			}
 		}
 		batch = batch[:0]
+		batchStartedAt = time.Time{}
 	}
 
 	defer func() {
@@ -197,17 +227,36 @@ func (w *Writer[T]) run() {
 			if !ok {
 				return
 			}
+			if len(batch) == 0 {
+				batchStartedAt = time.Now()
+			}
 			batch = append(batch, item)
 			if len(batch) >= w.cfg.MaxBatchSize {
 				flush()
 			}
 		case <-ticker.C:
-			flush()
+			if w.shouldFlushOnInterval(len(batch), batchStartedAt, time.Now()) {
+				flush()
+			}
 		}
 	}
 }
 
+func (w *Writer[T]) shouldFlushOnInterval(batchLen int, batchStartedAt time.Time, now time.Time) bool {
+	if batchLen == 0 {
+		return false
+	}
+	if w.cfg.MinBatchSize == 0 || batchLen >= w.cfg.MinBatchSize {
+		return true
+	}
+	if w.cfg.MaxFlushWait <= 0 || batchStartedAt.IsZero() {
+		return false
+	}
+	return !now.Before(batchStartedAt.Add(w.cfg.MaxFlushWait))
+}
+
 func (w *Writer[T]) notifyDrop(item T) {
+	w.drops.Add(1)
 	if w.onDrop == nil {
 		return
 	}

internal/infra/persistence/batchwriter/writer_test.go

@@ -98,6 +98,7 @@ func TestWriterFlushesOnInterval(t *testing.T) {
 	)
 	cfg := DefaultConfig()
 	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 0
 	cfg.FlushInterval = 20 * time.Millisecond
 
 	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
@@ -228,18 +229,18 @@ func TestWriterInvokesFlushErrorHandler(t *testing.T) {
 
 	flushErr := errors.New("flush failed")
 	var (
-		mu        sync.Mutex
-		errCount  int
-		batchSize int
+		mu       sync.Mutex
+		errCount int
+		gotItems []int
 	)
 
 	writer, err := New[int](cfg, func(context.Context, []int) error {
 		return flushErr
-	}, WithFlushErrorHandler[int](func(_ context.Context, size int, err error) {
+	}, WithFlushErrorHandler[int](func(_ context.Context, items []int, err error) {
 		mu.Lock()
 		defer mu.Unlock()
 		errCount++
-		batchSize = size
+		gotItems = append([]int(nil), items...)
 		if !errors.Is(err, flushErr) {
 			t.Errorf("flush error = %v, want %v", err, flushErr)
 		}
@@ -272,13 +273,219 @@ func TestWriterInvokesFlushErrorHandler(t *testing.T) {
 
 	mu.Lock()
 	gotCount := errCount
-	gotSize := batchSize
+	items := gotItems
 	mu.Unlock()
 
 	if gotCount != 1 {
 		t.Fatalf("flush error handler count = %d, want 1", gotCount)
 	}
-	if gotSize != 1 {
-		t.Fatalf("flush error handler batch size = %d, want 1", gotSize)
+	if diff := cmp.Diff([]int{7}, items); diff != "" {
+		t.Fatalf("flush error handler items mismatch (-want +got):\n%s", diff)
+	}
+
+	stats := writer.Stats()
+	if stats.FlushErrors != 1 {
+		t.Fatalf("Stats().FlushErrors = %d, want 1", stats.FlushErrors)
+	}
+}
+
+func TestWriterSkipsIntervalFlushBelowMinBatchSize(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu    sync.Mutex
+		batch []int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 5
+	cfg.FlushInterval = 20 * time.Millisecond
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batch = append([]int(nil), items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	for i := range 3 {
+		if !writer.TryEnqueue(i + 1) {
+			t.Fatalf("TryEnqueue(%d) = false, want true", i+1)
+		}
+	}
+
+	time.Sleep(100 * time.Millisecond)
+
+	mu.Lock()
+	got := batch
+	mu.Unlock()
+
+	if len(got) != 0 {
+		t.Fatalf("interval flush with below-min batch = %v, want no flush", got)
+	}
+}
+
+func TestWriterFlushesOnIntervalWhenMinBatchSizeReached(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu    sync.Mutex
+		batch []int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 3
+	cfg.FlushInterval = 20 * time.Millisecond
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batch = append([]int(nil), items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	for i := range 3 {
+		if !writer.TryEnqueue(i + 1) {
+			t.Fatalf("TryEnqueue(%d) = false, want true", i+1)
+		}
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for {
+		mu.Lock()
+		ready := len(batch) == 3
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	mu.Lock()
+	got := batch
+	mu.Unlock()
+
+	want := []int{1, 2, 3}
+	if diff := cmp.Diff(want, got); diff != "" {
+		t.Fatalf("interval flush at min batch size mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestWriterForcesFlushAfterMaxFlushWait(t *testing.T) {
+	t.Parallel()
+
+	var (
+		mu    sync.Mutex
+		batch []int
+	)
+	cfg := DefaultConfig()
+	cfg.MaxBatchSize = 100
+	cfg.MinBatchSize = 50
+	cfg.FlushInterval = 20 * time.Millisecond
+	cfg.MaxFlushWait = 80 * time.Millisecond
+
+	writer, err := New[int](cfg, func(_ context.Context, items []int) error {
+		mu.Lock()
+		defer mu.Unlock()
+		batch = append([]int(nil), items...)
+		return nil
+	})
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		if err := writer.Stop(stopCtx); err != nil {
+			t.Fatalf("Stop() error = %v", err)
+		}
+	})
+
+	if !writer.TryEnqueue(1) {
+		t.Fatal("TryEnqueue(1) = false, want true")
+	}
+
+	deadline := time.Now().Add(time.Second)
+	for {
+		mu.Lock()
+		ready := len(batch) == 1
+		mu.Unlock()
+		if ready || time.Now().After(deadline) {
+			break
+		}
+		time.Sleep(5 * time.Millisecond)
+	}
+
+	mu.Lock()
+	got := batch
+	mu.Unlock()
+	if diff := cmp.Diff([]int{1}, got); diff != "" {
+		t.Fatalf("max flush wait mismatch (-want +got):\n%s", diff)
+	}
+}
+
+func TestWriterStatsTracksDrops(t *testing.T) {
+	t.Parallel()
+
+	cfg := DefaultConfig()
+	cfg.Name = "test-drops"
+	cfg.QueueSize = 1
+	cfg.MaxBatchSize = 10
+	cfg.FlushInterval = time.Hour
+
+	writer, err := New[int](cfg, func(context.Context, []int) error { return nil })
+	if err != nil {
+		t.Fatalf("New() error = %v", err)
+	}
+
+	writer.Start(context.Background())
+	t.Cleanup(func() {
+		stopCtx, cancel := context.WithTimeout(context.Background(), time.Second)
+		defer cancel()
+		_ = writer.Stop(stopCtx)
+	})
+
+	if !writer.TryEnqueue(1) {
+		t.Fatal("TryEnqueue(1) = false, want true")
+	}
+	if writer.TryEnqueue(2) {
+		t.Fatal("TryEnqueue(2) = true, want false")
+	}
+
+	stats := writer.Stats()
+	if stats.Drops != 1 {
+		t.Fatalf("Stats().Drops = %d, want 1", stats.Drops)
+	}
+	if stats.Cap != 1 {
+		t.Fatalf("Stats().Cap = %d, want 1", stats.Cap)
+	}
+	if !stats.Running {
+		t.Fatal("Stats().Running = false, want true")
 	}
 }

internal/infra/task/executor.go

@@ -13,6 +13,7 @@ import (
 
 	"github.com/Rain-kl/Wavelet/internal/infra/persistence/idgen"
 	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
 	otel_trace "github.com/Rain-kl/Wavelet/pkg/trace"
 	"github.com/hibiken/asynq"
@@ -110,7 +111,7 @@ func AppendLog(ctx context.Context, format string, args ...interface{}) {
 	}
 
 	logLine := fmt.Sprintf(format, args...)
-	if err := model.AppendTaskExecutionLog(ctx, taskID, logLine); err != nil {
+	if err := repository.AppendTaskExecutionLog(ctx, taskID, logLine); err != nil {
 		logger.ErrorF(ctx, "[TaskExecutor] 追加任务日志失败 taskID=%s: %v", taskID, err)
 	}
 }
@@ -138,7 +139,7 @@ func DispatchTask(ctx context.Context, taskType string, payload []byte, triggere
 		TriggeredBy: triggeredBy,
 	}
 
-	if err := model.CreateTaskExecution(ctx, execution); err != nil {
+	if err := repository.CreateTaskExecution(ctx, execution); err != nil {
 		return "", fmt.Errorf(errCreateTaskExecutionFailed, err)
 	}
 
@@ -156,11 +157,11 @@ func DispatchTask(ctx context.Context, taskType string, payload []byte, triggere
 		now := time.Now()
 		execution.StartedAt = &now
 		execution.FinishedAt = &now
-		_ = model.UpdateTaskExecution(ctx, execution)
+		_ = repository.UpdateTaskExecution(ctx, execution)
 		return "", fmt.Errorf(errTaskEnqueueFailed, err)
 	}
 
-	if err := model.AppendTaskExecutionLog(ctx, taskID, fmt.Sprintf("[系统] 任务已成功入队，等待调度执行 (队列: %s, 最大重试次数: %d)", meta.Queue, meta.MaxRetry)); err != nil {
+	if err := repository.AppendTaskExecutionLog(ctx, taskID, fmt.Sprintf("[系统] 任务已成功入队，等待调度执行 (队列: %s, 最大重试次数: %d)", meta.Queue, meta.MaxRetry)); err != nil {
 		logger.ErrorF(ctx, "[TaskExecutor] 追加入队日志失败 taskID=%s: %v", taskID, err)
 	}
 
@@ -169,7 +170,7 @@ func DispatchTask(ctx context.Context, taskType string, payload []byte, triggere
 
 // RetryTask 重试失败的任务
 func RetryTask(ctx context.Context, id uint64) (string, error) {
-	execution, err := model.GetTaskExecutionByID(ctx, id)
+	execution, err := repository.GetTaskExecutionByID(ctx, id)
 	if err != nil {
 		return "", fmt.Errorf(errTaskExecutionNotFound, err)
 	}
@@ -198,7 +199,7 @@ func RetryTask(ctx context.Context, id uint64) (string, error) {
 		TriggeredBy: "retry",
 	}
 
-	if err := model.CreateTaskExecution(ctx, newExecution); err != nil {
+	if err := repository.CreateTaskExecution(ctx, newExecution); err != nil {
 		return "", fmt.Errorf(errCreateRetryExecutionFailed, err)
 	}
 
@@ -221,11 +222,11 @@ func RetryTask(ctx context.Context, id uint64) (string, error) {
 		now := time.Now()
 		newExecution.StartedAt = &now
 		newExecution.FinishedAt = &now
-		_ = model.UpdateTaskExecution(ctx, newExecution)
+		_ = repository.UpdateTaskExecution(ctx, newExecution)
 		return "", fmt.Errorf(errRetryTaskEnqueueFailed, err)
 	}
 
-	if err := model.AppendTaskExecutionLog(ctx, newTaskID, fmt.Sprintf("[系统] 手动触发重试，已重新创建任务并入队 (原任务ID: %s, 重试次数: %d/%d)", execution.TaskID, execution.RetryCount+1, execution.MaxRetry)); err != nil {
+	if err := repository.AppendTaskExecutionLog(ctx, newTaskID, fmt.Sprintf("[系统] 手动触发重试，已重新创建任务并入队 (原任务ID: %s, 重试次数: %d/%d)", execution.TaskID, execution.RetryCount+1, execution.MaxRetry)); err != nil {
 		logger.ErrorF(ctx, "[TaskExecutor] 追加重试日志失败 taskID=%s: %v", newTaskID, err)
 	}
 
@@ -350,7 +351,7 @@ func updateExecutionOnStart(ctx context.Context, execution *model.TaskExecution,
 		dirty = true
 	}
 	if dirty {
-		if updateErr := model.UpdateTaskExecution(ctx, execution); updateErr != nil {
+		if updateErr := repository.UpdateTaskExecution(ctx, execution); updateErr != nil {
 			logger.ErrorF(ctx, "[TaskExecutor] 更新执行状态失败 taskID=%s: %v", execution.TaskID, updateErr)
 		}
 	}
@@ -358,7 +359,7 @@ func updateExecutionOnStart(ctx context.Context, execution *model.TaskExecution,
 
 // getOrCreateTaskExecution 获取已有的任务执行记录，如果不存在则针对已知任务类型动态创建记录
 func getOrCreateTaskExecution(ctx context.Context, taskID string, t *asynq.Task, payload []byte, now time.Time) (*model.TaskExecution, error) {
-	execution, err := model.GetTaskExecutionByTaskID(ctx, taskID)
+	execution, err := repository.GetTaskExecutionByTaskID(ctx, taskID)
 	if err == nil {
 		return execution, nil
 	}
@@ -381,7 +382,7 @@ func getOrCreateTaskExecution(ctx context.Context, taskID string, t *asynq.Task,
 		StartedAt:   &now,
 	}
 
-	if createErr := model.CreateTaskExecution(ctx, execution); createErr != nil {
+	if createErr := repository.CreateTaskExecution(ctx, execution); createErr != nil {
 		logger.ErrorF(ctx, "[TaskExecutor] 动态创建执行记录失败 taskID=%s: %v", taskID, createErr)
 		return nil, createErr
 	}
@@ -404,11 +405,11 @@ func completeTaskExecution(ctx context.Context, execution *model.TaskExecution,
 		handleSuccessfulTask(ctx, execution, t, duration, result)
 	}
 
-	if err := model.UpdateTaskExecution(ctx, execution); err != nil {
+	if err := repository.UpdateTaskExecution(ctx, execution); err != nil {
 		logger.ErrorF(ctx, "[TaskExecutor] 更新执行记录失败 taskID=%s: %v", execution.TaskID, err)
 	}
 	if shouldFlushTaskExecutionLog(ctx, execErr) {
-		if err := model.FlushTaskExecutionLog(ctx, execution.TaskID); err != nil {
+		if err := repository.FlushTaskExecutionLog(ctx, execution.TaskID); err != nil {
 			logger.ErrorF(ctx, "[TaskExecutor] 持久化任务日志失败 taskID=%s: %v", execution.TaskID, err)
 		}
 	}
@@ -428,7 +429,7 @@ func notifyTaskCompleted(ctx context.Context, execution *model.TaskExecution, re
 }
 
 func shouldFlushTaskExecutionLog(ctx context.Context, execErr error) bool {
-	if execErr == nil {
+	if isTerminalTaskExecutionError(execErr) {
 		return true
 	}
 
@@ -440,6 +441,10 @@ func shouldFlushTaskExecutionLog(ctx context.Context, execErr error) bool {
 	return retryCount >= maxRetry
 }
 
+func isTerminalTaskExecutionError(execErr error) bool {
+	return execErr == nil || errors.Is(execErr, asynq.SkipRetry)
+}
+
 func handleFailedTask(ctx context.Context, execution *model.TaskExecution, t *asynq.Task, duration time.Duration, execErr error, span trace.Span) {
 	execution.Status = model.TaskExecutionStatusFailed
 	execution.ErrorMessage = execErr.Error()

internal/infra/task/executor_test.go

@@ -6,11 +6,13 @@ package task
 
 import (
 	"context"
+	"errors"
 	"fmt"
 	"testing"
 	"time"
 
 	"github.com/Rain-kl/Wavelet/internal/model"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/internal/testhelper"
 	"github.com/hibiken/asynq"
 	"github.com/stretchr/testify/assert"
@@ -120,7 +122,7 @@ func TestAppendLogWithTaskID(t *testing.T) {
 		Status:      model.TaskExecutionStatusRunning,
 		TriggeredBy: "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	// 注入 taskID 并追加日志
@@ -129,7 +131,7 @@ func TestAppendLogWithTaskID(t *testing.T) {
 	AppendLog(ctx, "处理了 %d 条数据", 50)
 
 	// 验证日志
-	found, err := model.GetTaskExecutionByTaskID(ctx, "log_test_001")
+	found, err := repository.GetTaskExecutionByTaskID(ctx, "log_test_001")
 	require.NoError(t, err)
 	assert.Contains(t, found.Log, "第一条日志")
 	assert.Contains(t, found.Log, "处理了 50 条数据")
@@ -188,7 +190,7 @@ func TestProcessTaskSuccess(t *testing.T) {
 		MaxRetry:    3,
 		TriggeredBy: "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	// 通过 asynq 的 Task 不能直接设置 taskID，ProcessTask 通过 t.ResultWriter().TaskID() 获取
@@ -206,7 +208,7 @@ func TestProcessTaskSuccess(t *testing.T) {
 	assert.Equal(t, "处理完成，共 100 条", result.Message)
 
 	// 验证日志被追加
-	found, err := model.GetTaskExecutionByTaskID(ctx, "process_success_001")
+	found, err := repository.GetTaskExecutionByTaskID(ctx, "process_success_001")
 	require.NoError(t, err)
 	assert.Contains(t, found.Log, "执行成功，处理了 100 条数据")
 }
@@ -229,7 +231,7 @@ func TestProcessTaskFailure(t *testing.T) {
 		MaxRetry:    3,
 		TriggeredBy: "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	// 直接调用 handler
@@ -242,7 +244,7 @@ func TestProcessTaskFailure(t *testing.T) {
 	assert.Contains(t, err.Error(), "模拟执行失败")
 
 	// 验证日志
-	found, err := model.GetTaskExecutionByTaskID(ctx, "process_fail_001")
+	found, err := repository.GetTaskExecutionByTaskID(ctx, "process_fail_001")
 	require.NoError(t, err)
 	assert.Contains(t, found.Log, "开始执行任务")
 }
@@ -259,7 +261,7 @@ func TestCompleteTaskExecutionFlushesLog(t *testing.T) {
 		Status:      model.TaskExecutionStatusRunning,
 		TriggeredBy: "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	ctx = withTaskID(ctx, execution.TaskID)
@@ -277,13 +279,18 @@ func TestCompleteTaskExecutionFlushesLog(t *testing.T) {
 		trace.SpanFromContext(ctx),
 	)
 
-	found, err := model.GetTaskExecutionByTaskID(ctx, execution.TaskID)
+	found, err := repository.GetTaskExecutionByTaskID(ctx, execution.TaskID)
 	require.NoError(t, err)
 	assert.Equal(t, model.TaskExecutionStatusSucceeded, found.Status)
 	assert.Contains(t, found.Log, "任务执行中的日志")
 	assert.Contains(t, found.Log, "任务执行成功")
 }
 
+func TestPermanentErrorIsTerminalForLogFlush(t *testing.T) {
+	assert.True(t, isTerminalTaskExecutionError(PermanentError("配置无效")))
+	assert.False(t, isTerminalTaskExecutionError(errors.New("temporary failure")))
+}
+
 func TestRetryTask(t *testing.T) {
 	cleanup := setupTest(t)
 	defer cleanup()
@@ -305,7 +312,7 @@ func TestRetryTask(t *testing.T) {
 		Duration:     100,
 		TriggeredBy:  "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	// 重试
@@ -315,7 +322,7 @@ func TestRetryTask(t *testing.T) {
 	assert.Contains(t, newTaskID, "retry_1_")
 
 	// 验证新记录
-	newExecution, err := model.GetTaskExecutionByTaskID(ctx, newTaskID)
+	newExecution, err := repository.GetTaskExecutionByTaskID(ctx, newTaskID)
 	require.NoError(t, err)
 	assert.Equal(t, model.TaskExecutionStatusPending, newExecution.Status)
 	assert.Equal(t, 1, newExecution.RetryCount)
@@ -324,7 +331,7 @@ func TestRetryTask(t *testing.T) {
 	assert.True(t, newExecution.Retryable)
 
 	// 原记录不变
-	original, err := model.GetTaskExecutionByID(ctx, execution.ID)
+	original, err := repository.GetTaskExecutionByID(ctx, execution.ID)
 	require.NoError(t, err)
 	assert.Equal(t, model.TaskExecutionStatusFailed, original.Status)
 	assert.Equal(t, 0, original.RetryCount)
@@ -345,7 +352,7 @@ func TestRetryTaskNotFailed(t *testing.T) {
 		MaxRetry:    3,
 		TriggeredBy: "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	// 尝试重试成功的任务
@@ -368,7 +375,7 @@ func TestRetryTaskNotRetryable(t *testing.T) {
 		MaxRetry:    0,
 		TriggeredBy: "manual",
 	}
-	err := model.CreateTaskExecution(ctx, execution)
+	err := repository.CreateTaskExecution(ctx, execution)
 	require.NoError(t, err)
 
 	_, err = RetryTask(ctx, execution.ID)

internal/infra/task/permanent_error.go

@@ -0,0 +1,35 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package task
+
+import (
+	"strings"
+
+	"github.com/hibiken/asynq"
+)
+
+const defaultPermanentErrorMessage = "任务无法继续执行"
+
+type permanentTaskError struct {
+	message string
+}
+
+// PermanentError marks a safe domain message as a non-retryable task failure.
+// It intentionally accepts no underlying error so Error never exposes provider,
+// URL, header, response-body, or other sensitive implementation details.
+func PermanentError(message string) error {
+	message = strings.TrimSpace(message)
+	if message == "" {
+		message = defaultPermanentErrorMessage
+	}
+	return &permanentTaskError{message: message}
+}
+
+func (e *permanentTaskError) Error() string {
+	return e.message
+}
+
+func (e *permanentTaskError) Unwrap() error {
+	return asynq.SkipRetry
+}

internal/infra/task/permanent_error_test.go

@@ -0,0 +1,27 @@
+// Copyright 2026 Arctel.net
+// SPDX-License-Identifier: Apache-2.0
+
+package task
+
+import (
+	"errors"
+	"testing"
+
+	"github.com/hibiken/asynq"
+	"github.com/stretchr/testify/assert"
+)
+
+func TestPermanentErrorSkipsRetryWithoutExposingAsynqMessage(t *testing.T) {
+	err := PermanentError("  来源配置无效  ")
+
+	assert.True(t, errors.Is(err, asynq.SkipRetry))
+	assert.Equal(t, "来源配置无效", err.Error())
+	assert.NotContains(t, err.Error(), asynq.SkipRetry.Error())
+}
+
+func TestPermanentErrorUsesSafeFallbackForBlankMessage(t *testing.T) {
+	err := PermanentError("  ")
+
+	assert.True(t, errors.Is(err, asynq.SkipRetry))
+	assert.Equal(t, defaultPermanentErrorMessage, err.Error())
+}

internal/infra/task/scheduler/scheduler.go

@@ -12,8 +12,8 @@ import (
 	"time"
 
 	"github.com/Rain-kl/Wavelet/internal/infra/task"
-	"github.com/Rain-kl/Wavelet/internal/model"
 	"github.com/Rain-kl/Wavelet/internal/platform/bootstrap"
+	"github.com/Rain-kl/Wavelet/internal/repository"
 	"github.com/Rain-kl/Wavelet/pkg/logger"
 
 	"github.com/hibiken/asynq"
@@ -84,7 +84,7 @@ func ReloadScheduler() error {
 	}
 
 	// 2. 从数据库载入启用的定时任务配置
-	schedules, err := model.ListActiveSchedules(context.Background())
+	schedules, err := repository.ListActiveSchedules(context.Background())
 	if err != nil {
 		return fmt.Errorf("load schedules from db failed: %w", err)
 	}