运行设置全表

运行设置存在 runtime_settings 表里，由控制台的「运维 → 运行设置」编辑。它们覆盖环境变量，多数改动热生效，不需要重启进程。 「字段」列是 Go 结构体字段名，用于在代码里定位该设置；「键」列是持久化与 API 使用的名字。 没有出现在这张表里的开关只存在于环境变量层——想彻底关掉某个后台任务，两处都要看。

共 65 个运行设置键。

键	字段	类型	说明
retry_times	RetryTimes	int	—
cross_channel_failover_enabled	CrossChannelFailoverEnabled	bool	—
cooldown_seconds	CooldownSeconds	int	—
checkin_enabled	CheckinEnabled	bool	—
checkin_cron	CheckinCron	string	—
discovery_cron	DiscoveryCron	string	DiscoveryCron is the scheduled model-list refresh expression (five-field cron; empty = disabled). Same format as checkin_cron.
probe_cron	ProbeCron	string	ProbeCron is the scheduled model-probe expression (five-field cron; empty = disabled). The probe_* fields below configure that run: a probe is a real upstream call, so its scope and cost stay explicit.
probe_prompt	ProbePrompt	string	ProbePrompt is the user message the scheduled probe sends; empty means the built-in default.
probe_max_tokens	ProbeMaxTokens	int	—
probe_concurrency	ProbeConcurrency	int	—
probe_auto_disable	ProbeAutoDisable	int	ProbeAutoDisable is the consecutive-failure threshold at which the scheduled run disables a member; 0 leaves routing untouched.
probe_channels	ProbeChannels	[]int64	ProbeChannels and ProbeModels scope the scheduled run. Empty means every model of every route on every channel.
probe_models	ProbeModels	[]string	—
db_gc_cron	DBGCCron	string	DBGCCron is the scheduled database maintenance expression (orphan GC + VACUUM; empty = disabled).
relay_rate_per_minute	RelayRatePerMinute	int	—
relay_rate_burst	RelayRateBurst	int	—
admin_rate_per_minute	AdminRatePerMinute	int	—
admin_rate_burst	AdminRateBurst	int	—
audit_retention_days	AuditRetentionDays	int	—
audit_retention_rows	AuditRetentionRows	int	—
channel_auto_disable_threshold	ChannelAutoDisableThreshold	int	ChannelAutoDisableThreshold: consecutive failures before auto-disable (0 = feature off). RoutingLatencyAware enables latency-weighted picking.
routing_latency_aware	RoutingLatencyAware	bool	—
routing_error_aware	RoutingErrorAware	bool	RoutingErrorAware penalizes channels with a high EWMA failure propensity.
routing_concurrency_enabled	RoutingConcurrencyEnabled	bool	RoutingConcurrencyEnabled enables the in-flight burst guard.
routing_concurrency_limit	RoutingConcurrencyLimit	int	RoutingConcurrencyLimit is the per-channel in-flight ceiling.
webhook_url	WebhookURL	string	WebhookURL is the operational notification endpoint ("" disables).
proxy_url	ProxyURL	string	ProxyURL is the global outbound HTTP(S) proxy; "" = direct. Channels with their own proxy_url override it.
webhook_throttle_seconds	WebhookThrottleSeconds	int	WebhookThrottleSeconds coalesces repeated events within the window.
stable_first_enabled	StableFirstEnabled	bool	StableFirstEnabled gates the 1/N grayscale pool.
stable_first_denominator	StableFirstDenominator	int	StableFirstDenominator is the draw base (25 = grayscale gets 1/25).
stable_first_promote_requests	StableFirstPromoteRequests	int	StableFirstPromoteRequests is the successful-attempt threshold for automatic promotion out of the grayscale pool.
recovery_probe_enabled	RecoveryProbeEnabled	bool	RecoveryProbeEnabled enables the passive-recovery loop that probes auto-disabled channels and restores them when the upstream answers.
recovery_probe_interval_seconds	RecoveryProbeIntervalSeconds	int	RecoveryProbeIntervalSeconds is how often the recovery loop runs.
fault_protection_enabled	FaultProtectionEnabled	bool	FaultProtectionEnabled gates fixed cooldown and channel auto-disable.
sticky_enabled	StickyEnabled	bool	StickyEnabled enables sticky-session routing (same conversation prefers the previously successful channel). StickyTTLMinutes is the binding TTL.
sticky_ttl_minutes	StickyTTLMinutes	int	—
alert_config_json	AlertConfigJSON	string	AlertConfigJSON is the multi-channel alert matrix (webhook/bark/ serverchan/telegram/smtp + cooldown + daily summary flag). Empty string keeps the env bootstrap ("" itself disables all alert channels).
alert_sweep_interval_seconds	AlertSweepIntervalSeconds	int	AlertSweepIntervalSeconds is the proactive health sweep cadence (0 = off).
alert_daily_summary_interval_seconds	AlertDailySummaryIntervalSeconds	int	AlertDailySummaryIntervalSeconds is the daily digest cadence (0 = off).
health_sweep_enabled	HealthSweepEnabled	bool	HealthSweepEnabled turns on the periodic channel health sweep that grades every enabled channel operational/degraded/error and alerts on transitions.
health_sweep_interval_seconds	HealthSweepIntervalSeconds	int	—
health_sweep_jitter_seconds	HealthSweepJitterSeconds	int	—
health_sweep_degraded_ms	HealthSweepDegradedMs	int	—
health_sweep_concurrency	HealthSweepConcurrency	int	—
health_sweep_timeout_seconds	HealthSweepTimeoutSeconds	int	—
channel_retry_times	ChannelRetryTimes	int	ChannelRetryTimes is how many times the same upstream key is re-sent after a retryable failure before moving to the next key/channel (0-5).
images_failover_enabled	ImagesFailoverEnabled	bool	ImagesFailoverEnabled lets an image write (images/edits, images/generations, variations) fail over. Off is the shipped contract: a billable generation must never be replayed. On, only the failures that provably preceded generation (429/503/529/530 and outright request rejections) are replayed; 5xx, 504 and timeouts still stop after one try.
images_failover_include_ambiguous	ImagesFailoverIncludeAmbiguous	bool	ImagesFailoverIncludeAmbiguous is the warned tier of that hatch: also replay 5xx answers other than 504, which may arrive after the picture was generated and billed. Inert unless ImagesFailoverEnabled is on.
images_failover_include_uncertain	ImagesFailoverIncludeUncertain	bool	ImagesFailoverIncludeUncertain is the blunt tier: also replay 504, transport timeouts, dead streams and empty 2xx, i.e. every failure where the upstream may already hold a finished picture and a charge. Inert unless ImagesFailoverEnabled is on.
update_check_enabled	UpdateCheckEnabled	bool	UpdateCheckEnabled lets the gateway query GitHub for a newer release to power the console update badge. Off means no outbound calls at all.
default_model_sync_mode	DefaultModelSyncMode	string	DefaultModelSyncMode is the sync mode ("auto"|"manual") new channels get when the create request omits model_sync_mode. Existing channels keep their own mode.
site_probe_interval_seconds	SiteProbeIntervalSeconds	int	SiteProbeIntervalSeconds / SiteProbeJitterSeconds drive the external site-probe collection loop. The cadence has to be configurable because sites publish their own probe data at wildly different rates: a status page that polls every 60s is useless at the 15-minute default, while one that polls every 15 minutes gains nothing from a faster round.
site_probe_jitter_seconds	SiteProbeJitterSeconds	int	—
site_news_interval_seconds	SiteNewsIntervalSeconds	int	SiteNewsIntervalSeconds drives the upstream notice-board reader (internal/sitenews). It differs from the site-probe pair on one point: 0 means OFF — the scheduled read stops and only the dashboard's refresh button reads boards — while -1 (unset) resolves to the env bootstrap.
keepalive_enabled	KeepaliveEnabled	bool	KeepaliveEnabled is the keepalive master switch; the per-site window and the per-channel switch live in the database, because the window is the site's own rule (15 days here, 30 there). DefaultIdleDays is the fallback window for a site that was never given one, and CheckIntervalSeconds is how often a round asks whether anything is due.
keepalive_check_interval_seconds	KeepaliveCheckIntervalSeconds	int	—
keepalive_default_idle_days	KeepaliveDefaultIdleDays	int	—
outbound_connect_timeout_seconds	OutboundConnectTimeoutSeconds	int	Outbound client limits. They are runtime settings because the header ceiling is what decides whether a slow upstream dies at 60s: the image endpoints needed 5 minutes and the fix used to require a .env edit and a container recreate. 0 = the deployment default (OUTBOUND_* in the environment); a non-zero value is an override that survives restarts.
outbound_header_timeout_seconds	OutboundHeaderTimeoutSeconds	int	—
outbound_image_header_timeout_seconds	OutboundImageHeaderTimeoutSeconds	int	—
outbound_tls_timeout_seconds	OutboundTLSTimeoutSeconds	int	—
outbound_max_idle_conns	OutboundMaxIdleConns	int	—
outbound_max_idle_conns_per_host	OutboundMaxIdleConnsPerHost	int	—
relay_max_body_mb	RelayMaxBodyMB	int	RelayMaxBodyMB / RelayMaxImageMB are the /v1 request-body ceilings in megabytes, for the same reason as the outbound limits above: the ceiling is what refuses an ordinary request (a chat call with inlined base64 screenshots), and 0 means the deployment default (RELAY_MAX_*_MB) applies.
relay_max_image_mb	RelayMaxImageMB	int	—

环境变量与运行设置的关系

• 进程启动时，环境变量是初始值；控制台保存的值成为覆盖，优先于环境变量。
• 清空一个覆盖（而不是设成 0）才会回落到环境变量值——0 通常是一个有意义的取值（关闭）。
• 热生效的边界由各项的 applier 决定：涉及重建后台循环的改动会在下一个周期生效。