diff --git a/.env.example b/.env.example
index dc097a59..902bc2db 100644
--- a/.env.example
+++ b/.env.example
@@ -36,6 +36,7 @@ TELEGRAM_QUERY_TOPIC_CHAT_ID=
 TELEGRAM_QUERY_TOPIC_ID=
 TELEGRAM_QUERY_TOPIC_MAP=
 POLYWEATHER_BOT_GROUP_INVITE_URL=
+POLYWEATHER_APP_URL=https://polyweather-pro.vercel.app
 # High-frequency airport push loop. Keep this at 1 on shared 1CPU VPS.
 TELEGRAM_AIRPORT_PUSH_ENABLED=true
 TELEGRAM_AIRPORT_PUSH_INTERVAL_SEC=60
@@ -63,23 +64,8 @@ POLYWEATHER_METAR_CLUSTER_TIMEOUT_SEC=3.5
 METAR_CACHE_TTL_SEC=600
 JMA_AMEDAS_CACHE_TTL_SEC=120
 METEOBLUE_CACHE_TTL_SEC=7200
-# - emos_shadow: user-facing probability stays legacy, EMOS is generated for comparison.
-# - emos_primary: only after offline evaluation passes and manual rollout is approved.
-POLYWEATHER_PROBABILITY_ENGINE=legacy
-POLYWEATHER_EMOS_AUTO_MIN_SAMPLES=50
-POLYWEATHER_EMOS_AUTO_MAX_DELTA_CRPS=0
-POLYWEATHER_EMOS_AUTO_MAX_DELTA_MAE=0.05
-POLYWEATHER_EMOS_AUTO_MIN_DELTA_BUCKET_HIT_RATE=-0.05
-# Optional: cap recent probability snapshots used by EMOS retraining.
 # Recommended on VPS: do not train there; pull the SQLite DB to a local machine.
-# POLYWEATHER_EMOS_TRAINING_SNAPSHOT_LIMIT=20000
 # Optional: set this to a writable runtime path if you manually deploy a
-# locally trained EMOS calibration file.
-# POLYWEATHER_PROBABILITY_CALIBRATION_FILE=/var/lib/polyweather/probability_calibration/default.json
-POLYWEATHER_LGBM_ENABLED=false
-POLYWEATHER_LGBM_MODEL_PATH=/app/artifacts/models/lgbm_daily_high.txt
-POLYWEATHER_LGBM_SCHEMA_PATH=/app/artifacts/models/lgbm_daily_high_schema.json
-POLYWEATHER_LGBM_MIN_HISTORY_POINTS=3
 
 ########################################
 # 4) Auth / entitlement
@@ -113,9 +99,19 @@ NEXT_PUBLIC_POLYWEATHER_DISABLE_EAGER_SUMMARIES=false
 # bypass Vercel Functions / Fluid Compute instead of going through Next.js API proxies.
 # Example: NEXT_PUBLIC_POLYWEATHER_API_BASE_URL=https://api.example.com
 NEXT_PUBLIC_POLYWEATHER_API_BASE_URL=
+# Set to "true" to enable app analytics event tracking (conversion funnel etc.)
+NEXT_PUBLIC_POLYWEATHER_APP_ANALYTICS=false
 
 ########################################
-# 7) Optional modules
+# 7) Admin / Ops
+########################################
+# Comma-separated admin email list for /ops dashboard access
+POLYWEATHER_OPS_ADMIN_EMAILS=
+# KNMI 10-minute observation data (Amsterdam)
+KNMI_API_KEY=
+
+########################################
+# 8) Optional modules
 ########################################
 
 # Optional OpenAI-compatible market scan review for Pro users
diff --git a/docker-compose.yml b/docker-compose.yml
index 36a659a1..7948c707 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -10,15 +10,15 @@ services:
     container_name: polyweather_bot
     restart: unless-stopped
     volumes:
-      # Persist runtime data outside git workspace.
-      # Host path defaults to /var/lib/polyweather and can be overridden in .env.
       - ${POLYWEATHER_RUNTIME_DATA_DIR:-/var/lib/polyweather}:/var/lib/polyweather
-      # Keep /app/data compatibility for existing cache/state defaults.
       - ${POLYWEATHER_RUNTIME_DATA_DIR:-/var/lib/polyweather}:/app/data
-      - ./bot.log:/app/bot.log # 挂载日志文件
-    # UID/GID are mainly useful on Linux hosts to avoid root-owned output files.
-    # Windows / macOS can usually keep the fallback values.
+      - ./bot.log:/app/bot.log
     user: "${UID:-1000}:${GID:-1000}"
+    healthcheck:
+      test: ["CMD", "python", "-c", "import sqlite3; c=sqlite3.connect('/var/lib/polyweather/polyweather.db'); c.execute('SELECT 1'); c.close()"]
+      interval: 60s
+      timeout: 10s
+      retries: 3
 
   polyweather_web:
     <<: *polyweather-base
@@ -26,11 +26,14 @@ services:
     restart: unless-stopped
     command: python web/app.py
     volumes:
-      # Web service shares the same runtime data directory as bot/state tasks.
       - ${POLYWEATHER_RUNTIME_DATA_DIR:-/var/lib/polyweather}:/var/lib/polyweather
       - ${POLYWEATHER_RUNTIME_DATA_DIR:-/var/lib/polyweather}:/app/data
     ports:
-      - "8000:8000"
-    # UID/GID are mainly useful on Linux hosts to avoid root-owned output files.
+      - "127.0.0.1:8000:8000"
     user: "${UID:-1000}:${GID:-1000}"
+    healthcheck:
+      test: ["CMD", "curl", "-f", "http://localhost:8000/healthz"]
+      interval: 30s
+      timeout: 5s
+      retries: 3