| 文件 | 改动 |

|------|------|
| `db/writer.py` | 末尾追加 `check_write_permission()`，其余不变 |
| `ui/tab_analyze.py` | 完整重写：加 `admin_token` 参数，所有写库操作加 `can_write` 判断，日志改英文 |

db/writer.py

@@ -10,6 +10,7 @@ import sqlite3
 import numpy as np
 from datetime import datetime
 from db.schema import get_connection, init_db
+import os
 
 
 # ─────────────────────────────────────────────
@@ -372,4 +373,31 @@ def update_model_summary(
             summary
         )
 
-    conn.commit()
+    conn.commit()
+
+# 在 db/writer.py 末尾追加
+
+
+
+# ─────────────────────────────────────────────
+# 写入权限验证
+# ─────────────────────────────────────────────
+
+def check_write_permission(admin_token: str) -> bool:
+    """
+    验证管理员写入权限。
+    
+    原理：
+    - WRITE_TOKEN 存储在 HF Space Secrets（加密，不进入 git repo）
+    - 运行时由 HF 注入为环境变量
+    - 只在服务端比对，不返回给前端
+    
+    返回：
+    - True  = 有写入权限
+    - False = 只读模式（分析可以跑，结果不写库）
+    """
+    server_token = os.environ.get("WRITE_TOKEN", "")
+    if not server_token:
+        # 服务端未配置 WRITE_TOKEN → 拒绝所有写入
+        return False
+    return admin_token.strip() == server_token

ui/tab_analyze.py

@@ -1,10 +1,10 @@
 # ui/tab_analyze.py
 """
-Tab2：分析单个模型
-- 使用 LayerProfile 自动推断结构
-- start_layer / end_layer 按原始层号过滤
-- 逐头计算五定律全指标
-- 结果写入 SQLite（断点续传，以 prefix+layer 为粒度）
+Tab2: Analyze a single model
+- Auto-infer structure via LayerProfile
+- Filter layers by start_layer / end_layer (raw index)
+- Compute all Wang's Five Laws metrics per head
+- Write results to SQLite if admin token is valid (read-only for reviewers)
 """
 
 import gradio as gr
@@ -34,39 +34,48 @@ from db.writer import (
     write_layer_records,
     update_model_summary,
     get_analyzed_layers,
-    is_layer_complete,
     infer_layer_type,
+    check_write_permission,
 )
 
 SIDEBAR_MD = """
-### ✅ 推荐模型
-google/gemma-4-e2b  
-google/gemma-4-e4b-it  
-google/gemma-4-31b-it  
-Qwen/Qwen2.5-14B-Instruct  
-deepseek-ai/DeepSeek-R1-Distill-Qwen-14B  
-meta-llama/Meta-Llama-3-8B  
-
-### 层号说明
-- 层号 = safetensors key 中 `layers.{N}` 的 **N**
-- **不按组件重排**，原始值直接输出
-- 混合模态模型（如 Gemma-4）：
-  - `layers.0~11` 同时含 audio/vision/text 层
-  - 全部输出，按前缀区分组件
-
-### 示例：Gemma-4-E2B
-| 组件 | 层范围 |
-|------|--------|
-| audio_tower | 0~11 |
-| language_model | 0~34 |
-| vision_tower | 0~15 |
-
-### 示例：Gemma-4-31B
-| 组件 | 层范围 |
-|------|--------|
-| language(局部层) | 0~59 |
-| language(全局层) | 5,11,17...59 |
-| vision_tower | 0~26 |
+### Recommended Models
+`google/gemma-4-e2b`  
+`google/gemma-4-e4b-it`  
+`google/gemma-4-31b-it`  
+`Qwen/Qwen2.5-14B-Instruct`  
+`deepseek-ai/DeepSeek-R1-Distill-Qwen-14B`  
+`meta-llama/Meta-Llama-3-8B`  
+
+---
+
+### Layer Index
+- Layer index = **N** in `layers.{N}` of safetensors keys
+- Raw index, **not re-numbered per component**
+- Multi-modal models (e.g. Gemma-4):
+  - `layers.0~11` may contain audio / vision / text layers
+  - All components output separately, distinguished by prefix
+
+### Example: Gemma-4-E2B
+| Component | Layer Range |
+|-----------|-------------|
+| audio_tower | 0 ~ 11 |
+| language_model | 0 ~ 34 |
+| vision_tower | 0 ~ 15 |
+
+### Example: Gemma-4-31B
+| Component | Layer Range |
+|-----------|-------------|
+| language (local) | 0 ~ 59 |
+| language (global) | 5, 11, 17 … 59 |
+| vision_tower | 0 ~ 26 |
+
+---
+
+### Reviewer Note
+Leave **Admin Write Token** empty to run the full analysis  
+without writing to the database.  
+All metrics are computed and displayed normally.
 """
 
 
@@ -75,37 +84,49 @@ def run_analysis(
     hf_token:    str,
     start_layer: int,
     end_layer:   int,
+    admin_token: str,
     progress=gr.Progress()
 ) -> tuple[str, pd.DataFrame]:
 
     if not model_id.strip():
-        return "❌ 请输入模型 ID", None
+        return "❌ Please enter a model ID.", None
 
-    token   = hf_token.strip() or None
-    start_l = int(start_layer)
-    end_l   = int(end_layer)
-    t_start = datetime.utcnow()
+    token      = hf_token.strip() or None
+    start_l    = int(start_layer)
+    end_l      = int(end_layer)
+    t_start    = datetime.utcnow()
+    can_write  = check_write_permission(admin_token)
 
     log = [
-        f"🔍 分析：{model_id}  层 {start_l}~{end_l}\n"
+        f"🔍 Analyzing: {model_id}  layers {start_l}~{end_l}\n"
+        f"{'═'*80}\n"
+        f"💾 Database write: {'✅ ENABLED (admin)' if can_write else '🔒 DISABLED (read-only mode)'}\n"
         f"{'═'*80}\n"
     ]
+
+    if not can_write:
+        log.append(
+            "ℹ️  Running in read-only mode.\n"
+            "   Analysis will run normally. Results displayed below but NOT saved to DB.\n"
+            "   Reviewers: this is intentional — full reproducibility without DB access.\n"
+            f"{'─'*80}\n"
+        )
+
     all_records: list[dict] = []
 
-    # ── 初始化数据库连接 ──────────────────────────
+    # ── DB connection (needed for resume check even in read-only) ──
     conn = init_db()
 
-    # ── 量化检测 ─────────────────────────────────
-    progress(0.02, desc="量化检测...")
+    # ── Quantization check ────────────────────────────────────────
+    progress(0.02, desc="Checking quantization...")
     blocked, qmsg = check_quantization(model_id, token)
-    log.append(f"【量化检测】\n{qmsg}\n{'─'*80}\n")
+    log.append(f"[Quantization Check]\n{qmsg}\n{'─'*80}\n")
     if blocked:
         return "".join(log), None
 
-    # ── config.json ───────────────────────────────
-    progress(0.05, desc="读取 config...")
+    # ── config.json ───────────────────────────────────────────────
+    progress(0.05, desc="Reading config...")
     config_params = {}
-    config_raw    = {}
     try:
         r = requests.get(
             f"https://huggingface.co/{model_id}/resolve/main/config.json",
@@ -113,70 +134,67 @@ def run_analysis(
             timeout=15
         )
         if r.status_code == 200:
-            config_raw    = r.json()
-            config_params = extract_config_params(config_raw)
+            config_params = extract_config_params(r.json())
             log.append(
-                f"📋 config：model_type={config_params.get('model_type')}  "
+                f"📋 Config: model_type={config_params.get('model_type')}  "
                 f"head_dim={config_params.get('head_dim')}\n"
                 f"{'─'*80}\n"
             )
     except Exception:
-        log.append("⚠️  无法读取 config.json\n")
+        log.append("⚠️  Could not read config.json\n")
 
-    # ── 写入模型元数据 ────────────────────────────
-    model_type = config_params.get("model_type", "unknown")
-    upsert_model(conn, model_id, model_type=model_type)
+    # ── Write model metadata (admin only) ────────────────────────
+    if can_write:
+        model_type = config_params.get("model_type", "unknown")
+        upsert_model(conn, model_id, model_type=model_type)
 
-    # ── 读取所有 shard headers ────────────────────
-    progress(0.08, desc="读取 shard headers...")
+    # ── Load all shard headers ────────────────────────────────────
+    progress(0.08, desc="Loading shard headers...")
     try:
         all_headers = load_all_shard_headers(model_id, token)
     except requests.exceptions.HTTPError as e:
         return http_error_msg(e, model_id), None
     except Exception as e:
-        return "".join(log) + f"❌ 读取失败：{e}\n", None
+        return "".join(log) + f"❌ Failed to load headers: {e}\n", None
 
     log.append(
-        f"📦 shard 数：{len(all_headers)}  "
-        f"总 key：{sum(len(h) for h,_ in all_headers.values())}\n"
+        f"📦 Shards: {len(all_headers)}  "
+        f"Total keys: {sum(len(h) for h,_ in all_headers.values())}\n"
     )
 
-    # ── 扫描层结构 ────────────────────────────────
-    progress(0.12, desc="扫描层结构...")
+    # ── Scan layer structure ──────────────────────────────────────
+    progress(0.12, desc="Scanning layer structure...")
     profiles = scan_model_structure(all_headers, config_params)
 
     if not profiles:
-        return "".join(log) + "⚠️ 未发现任何 Q/K/V 层\n", None
-
-    # ── 按组件写入 components 表 ──────────────────
-    # 按 prefix 分组，统计组件信息
-    by_prefix: dict[str, list] = {}
-    for (pfx, idx), prof in profiles.items():
-        by_prefix.setdefault(pfx, []).append(prof)
-
-    for pfx, profs in by_prefix.items():
-        complete_profs = [p for p in profs if p.complete]
-        if not complete_profs:
-            continue
-
-        head_dims  = [p.head_dim for p in complete_profs]
-        has_shared = any(p.kv_shared for p in complete_profs)
-        has_global = has_shared   # kv_shared=True → global 层
-        d_models   = [p.d_model for p in complete_profs if p.d_model > 0]
-
-        upsert_component(
-            conn         = conn,
-            model_id     = model_id,
-            prefix       = pfx,
-            n_layers     = len(complete_profs),
-            head_dim_min = min(head_dims),
-            head_dim_max = max(head_dims),
-            has_kv_shared= has_shared,
-            has_global   = has_global,
-            d_model      = d_models[0] if d_models else 0,
-        )
+        return "".join(log) + "⚠️ No Q/K/V layers found.\n", None
+
+    # ── Write component metadata (admin only) ────────────────────
+    if can_write:
+        by_prefix: dict[str, list] = {}
+        for (pfx, idx), prof in profiles.items():
+            by_prefix.setdefault(pfx, []).append(prof)
+
+        for pfx, profs in by_prefix.items():
+            complete_profs = [p for p in profs if p.complete]
+            if not complete_profs:
+                continue
+            head_dims  = [p.head_dim for p in complete_profs]
+            has_shared = any(p.kv_shared for p in complete_profs)
+            d_models   = [p.d_model for p in complete_profs if p.d_model > 0]
+            upsert_component(
+                conn          = conn,
+                model_id      = model_id,
+                prefix        = pfx,
+                n_layers      = len(complete_profs),
+                head_dim_min  = min(head_dims),
+                head_dim_max  = max(head_dims),
+                has_kv_shared = has_shared,
+                has_global    = has_shared,
+                d_model       = d_models[0] if d_models else 0,
+            )
 
-    # ── 按原始层号过滤 ────────────────────────────
+    # ── Filter by layer range ─────────────────────────────────────
     filtered = {
         (pfx, idx): prof
         for (pfx, idx), prof in profiles.items()
@@ -193,46 +211,51 @@ def run_analysis(
         )
         return (
             "".join(log) +
-            f"⚠️ 层 {start_l}~{end_l} 内无完整层\n"
-            f"实际层号：\n{info}\n", None
+            f"⚠️ No complete layers found in range {start_l}~{end_l}.\n"
+            f"Available layer indices:\n{info}\n", None
         )
 
-    # ── 断点续传：查询已完成层 ────────────────────
-    # 按 prefix 分别查询
+    # ── Resume check (always query DB, write only if can_write) ──
     done_layers: dict[str, set] = {}
     for pfx in set(pfx for pfx, _ in filtered):
         done_layers[pfx] = get_analyzed_layers(conn, model_id, pfx)
 
-    # 打印将分析的层（含断点续传状态）
+    # ── Print analysis plan ───────────────────────────────────────
     by_pfx2: dict[str, list] = {}
     for (pfx, idx) in filtered:
         by_pfx2.setdefault(pfx, []).append(idx)
 
-    log.append("📐 将分析：\n")
+    log.append("📐 Analysis plan:\n")
     skipped_total = 0
     for pfx, idxs in sorted(by_pfx2.items()):
-        done  = done_layers.get(pfx, set())
-        todo  = [i for i in sorted(idxs) if i not in done]
-        skip  = [i for i in sorted(idxs) if i in done]
+        done = done_layers.get(pfx, set())
+        todo = [i for i in sorted(idxs) if i not in done]
+        skip = [i for i in sorted(idxs) if i in done]
         skipped_total += len(skip)
-        log.append(f"  '{pfx}'\n")
-        log.append(f"    待分析：{todo}\n")
+        log.append(f"  [{pfx}]\n")
+        log.append(f"    To analyze : {todo}\n")
         if skip:
-            log.append(f"    已跳过（断点续传）：{skip}\n")
+            log.append(
+                f"    Skipped (resume): {skip}\n"
+                if can_write else
+                f"    Already in DB   : {skip}  "
+                f"(read-only: will re-compute but not save)\n"
+            )
     log.append(f"{'═'*80}\n")
 
-    if skipped_total > 0:
-        log.append(f"⚡ 断点续传：跳过 {skipped_total} 层（已有数据）\n")
+    if can_write and skipped_total > 0:
+        log.append(
+            f"⚡ Resume: skipping {skipped_total} already-analyzed layers.\n"
+        )
 
-    # ── 逐层分析 ─────────────────────────────────
+    # ── Layer-by-layer analysis ───────────────────────────────────
     sorted_items = sorted(filtered.items(), key=lambda x: (x[0][0], x[0][1]))
     total = len(sorted_items)
 
     for i, ((pfx, idx), prof) in enumerate(sorted_items):
 
-        # 断点续传：该层已完成则跳过
-        if idx in done_layers.get(pfx, set()):
-            # 从数据库读取已有记录加入 all_records（用于最终展示）
+        # Resume skip (only in write mode — reviewers always re-compute)
+        if can_write and idx in done_layers.get(pfx, set()):
             continue
 
         progress(
@@ -240,11 +263,10 @@ def run_analysis(
             desc=f"{pfx.split('.')[-2] if '.' in pfx else pfx} L{idx}..."
         )
 
-        # ── 加载 Q/K/V ────────────────────────────
+        # ── Load Q / K / V ────────────────────────────────────────
         try:
             q_url = get_file_url(model_id, prof.q.shard)
             k_url = get_file_url(model_id, prof.k.shard)
-
             q_hdr, q_hs = all_headers[prof.q.shard]
             k_hdr, k_hs = all_headers[prof.k.shard]
 
@@ -253,9 +275,6 @@ def run_analysis(
                 f"  q: {prof.q.shard} → {prof.q.key}\n"
                 f"  k: {prof.k.shard} → {prof.k.key}\n"
                 f"  v: {prof.v.shard + ' → ' + prof.v.key if prof.v else 'K=V shared'}\n"
-                f"  k_header_size={k_hs}\n"
-                f"  k_offsets={k_hdr[prof.k.key]['data_offsets']}\n"
-                f"  k_abs_start={8 + k_hs + k_hdr[prof.k.key]['data_offsets'][0]}"
             )
 
             W_q = load_tensor_remote(q_url, prof.q.key, q_hdr, q_hs, token)
@@ -269,102 +288,132 @@ def run_analysis(
                 W_v = load_tensor_remote(v_url, prof.v.key, v_hdr, v_hs, token)
 
         except Exception as e:
-            log.append(f"[{pfx}] Layer {idx}: ❌ 加载失败：{e}\n")
+            log.append(f"[{pfx}] Layer {idx}: ❌ Load failed: {e}\n")
             continue
 
         if W_q is None or W_k is None or W_v is None:
-            log.append(f"[{pfx}] Layer {idx}: ⚠️ tensor 为 None\n")
+            log.append(f"[{pfx}] Layer {idx}: ⚠️ Tensor is None\n")
             continue
 
-        # ── 计算五定律 ────────────────────────────
+        # ── Compute Five Laws ─────────────────────────────────────
         try:
             records, layer_log = analyze_layer(W_q, W_k, W_v, prof)
             all_records.extend(records)
             log.append(layer_log)
 
-            # ── 写入数据库 ────────────────────────
-            if records:
+            # ── Write to DB (admin only) ──────────────────────────
+            if can_write and records:
                 write_layer_records(conn, model_id, records)
-                # 每层写完立刻更新 summary（支持中途查看排行榜）
                 update_model_summary(conn, model_id, pfx)
                 log.append(
-                    f"  ✅ 已写库：{len(records)} 条记录 "
+                    f"  ✅ Saved to DB: {len(records)} records "
                     f"[{pfx}] Layer {idx}\n"
                 )
+            elif not can_write and records:
+                log.append(
+                    f"  📊 Computed: {len(records)} records "
+                    f"[{pfx}] Layer {idx}  (read-only, not saved)\n"
+                )
 
         except Exception as e:
-            log.append(f"[{pfx}] Layer {idx}: ❌ 计算失败：{e}\n")
+            log.append(f"[{pfx}] Layer {idx}: ❌ Compute failed: {e}\n")
         finally:
             del W_q, W_k, W_v
 
-    # ── 更新分析耗时 ──────────────────────────────
+    # ── Update elapsed time (admin only) ─────────────────────────
+    if can_write:
+        elapsed = (datetime.utcnow() - t_start).total_seconds()
+        conn.execute(
+            "UPDATE models SET analyze_sec = ? WHERE model_id = ?",
+            (elapsed, model_id)
+        )
+        conn.commit()
+
+    # ── Summary ───────────────────────────────────────────────────
     elapsed = (datetime.utcnow() - t_start).total_seconds()
-    conn.execute(
-        "UPDATE models SET analyze_sec = ? WHERE model_id = ?",
-        (elapsed, model_id)
-    )
-    conn.commit()
 
-    # ── 汇总 ─────────────────────────────────────
     if not all_records:
-        # 可能全部是断点续传跳过的
-        log.append(
-            "\n⚡ 所有层均已完成（断点续传），"
-            "请到「排行榜」或「数据库」Tab 查看结果\n"
+        msg = (
+            "\n⚡ All layers already in DB (resume mode). "
+            "See Leaderboard or Database tab.\n"
+            if can_write else
+            "\n⚠️ No records computed.\n"
         )
-        return "".join(log), None
+        return "".join(log) + msg, None
 
     summary = summarize_records(all_records, model_id)
     log.append(summary)
-    log.append(f"\n⏱️ 本次耗时：{elapsed:.1f} 秒\n")
+    log.append(
+        f"\n⏱️  Elapsed: {elapsed:.1f}s\n"
+        f"{'═'*80}\n"
+    )
+
+    if not can_write:
+        log.append(
+            "🔒 Read-only mode: results above are NOT saved to the database.\n"
+            "   To save, provide a valid Admin Write Token.\n"
+        )
 
     df = pd.DataFrame(all_records)
     return "".join(log), df
 
 
 # ─────────────────────────────────────────────
-# Tab2 UI 组件
+# Tab2 UI
 # ─────────────────────────────────────────────
 
 def build_tab_analyze():
-    with gr.Tab("📊 分析"):
+    with gr.Tab("📊 Analyze"):
         gr.Markdown("""
-        **第二步：选择层范围，计算王氏五定律全指标**  
-        层号 = safetensors key 中 `layers.{N}` 的原始 N，K=V 共享层自动处理。  
-        ⚡ **支持断点续传**：已分析的层自动跳过，随时中断随时继续。
+        **Step 2: Select layer range and compute Wang's Five Laws metrics.**  
+        Layer index = raw **N** in `layers.{N}` of safetensors keys.  
+        K=V shared layers (e.g. Gemma-4 global layers) are handled automatically.  
+        ⚡ **Resume supported**: already-analyzed layers are skipped automatically.
+
+        > 第二步：选择层范围，计算王氏五定律全指标。支持断点续传，已分析层自动跳过。
         """)
 
         with gr.Row():
             with gr.Column(scale=3):
                 model_id_input = gr.Textbox(
-                    label="HuggingFace 模型 ID",
+                    label="HuggingFace Model ID",
                     placeholder="google/gemma-4-e2b",
                     value="google/gemma-4-e2b"
                 )
                 token_input = gr.Textbox(
-                    label="HF Access Token（公开模型可留空）",
+                    label="HF Access Token (leave empty for public models)",
                     type="password"
                 )
                 with gr.Row():
                     start_input = gr.Number(
-                        label="起始层号（含）",
+                        label="Start Layer (inclusive)",
                         value=0, minimum=0, maximum=9999, precision=0
                     )
                     end_input = gr.Number(
-                        label="结束层号（含）",
+                        label="End Layer (inclusive)",
                         value=5, minimum=0, maximum=9999, precision=0
                     )
-                analyze_btn = gr.Button("🚀 开始分析", variant="primary")
+                admin_token_input = gr.Textbox(
+                    label="Admin Write Token",
+                    placeholder="Leave empty to run analysis without saving to database",
+                    type="password",
+                    info=(
+                        "Reviewers: leave empty. "
+                        "Analysis runs fully — results shown below but not saved to DB. "
+                        "| 审稿人请留空，分析正常运行，结果不写入数据库。"
+                    )
+                )
+                analyze_btn = gr.Button("🚀 Start Analysis", variant="primary")
 
             with gr.Column(scale=1):
                 gr.Markdown(SIDEBAR_MD)
 
         analyze_log = gr.Textbox(
-            label="分析日志（逐头详情）",
+            label="Analysis Log (per-head details)",
             lines=35, max_lines=300
         )
         analyze_table = gr.Dataframe(
-            label="逐头全指标结果表",
+            label="Per-head metrics (all Five Laws)",
             headers=[
                 "prefix", "layer", "kv_head", "q_head", "kv_shared",
                 "pearson_QK", "spearman_QK", "pearson_QV", "pearson_KV",
@@ -383,7 +432,13 @@ def build_tab_analyze():
 
         analyze_btn.click(
             fn=run_analysis,
-            inputs=[model_id_input, token_input, start_input, end_input],
+            inputs=[
+                model_id_input,
+                token_input,
+                start_input,
+                end_input,
+                admin_token_input,   # ← 新增
+            ],
             outputs=[analyze_log, analyze_table]
         )