diff --git a/app/Services/PhotoPreview.php b/app/Services/PhotoPreview.php
index 57663c4..17be265 100644
--- a/app/Services/PhotoPreview.php
+++ b/app/Services/PhotoPreview.php
@@ -190,18 +190,17 @@ class PhotoPreview
                     ]);
                     continue;
                 }
-                if (! $result->successful()) {
-                    Log::warning('heic preview convert cmd failed', [
-                        'path' => $absPath,
-                        'cmd' => implode(' ', $cmd),
-                        'stderr' => trim($result->errorOutput()),
-                    ]);
-                    continue;
-                }
                 $bytes = $this->readConvertedJpeg($dst);
                 if ($bytes !== null) {
                     return $bytes;
                 }
+                Log::warning('heic preview convert cmd failed', [
+                    'path' => $absPath,
+                    'cmd' => implode(' ', $cmd),
+                    'exit' => $result->exitCode(),
+                    'stdout' => trim($result->output()),
+                    'stderr' => trim($result->errorOutput()),
+                ]);
             }
 
             return null;
@@ -237,22 +236,16 @@ class PhotoPreview
         if (PHP_OS_FAMILY === 'Darwin' && $this->isSafeExecutable('/usr/bin/sips')) {
             $cmds[] = ['/usr/bin/sips', '-s', 'format', 'jpeg', '--out', $dst, $src];
         }
-        foreach (['heif-convert', 'heif-dec'] as $bin) {
-            $path = $this->resolveBinary($bin);
-            if ($path === null) {
-                continue;
+        $heif = $this->resolveBinary('heif-convert');
+        if ($heif !== null) {
+            $cmds[] = [$heif, $src, $dst];
+            $cmds[] = [$heif, '-q', '85', $src, $dst];
+        }
+        if (PHP_OS_FAMILY === 'Darwin') {
+            $magick = $this->resolveBinary('magick');
+            if ($magick !== null) {
+                $cmds[] = [$magick, $src, '-quality', '85', $dst];
             }
-            $cmds[] = [$path, $src, $dst];
-            $cmds[] = [$path, '-q', '85', $src, $dst];
-            $cmds[] = [$path, $src, '-o', $dst];
-        }
-        $magick = $this->resolveBinary('magick');
-        if ($magick !== null) {
-            $cmds[] = [$magick, $src, '-quality', '85', $dst];
-        }
-        $convert = $this->resolveBinary('convert');
-        if ($convert !== null) {
-            $cmds[] = [$convert, $src, '-quality', '85', $dst];
         }
 
         return $cmds;
@@ -262,9 +255,7 @@ class PhotoPreview
     {
         $candidates = match ($name) {
             'magick' => [base_path('bin/magick'), '/opt/homebrew/bin/magick', '/usr/local/bin/magick', '/usr/bin/magick', 'magick'],
-            'convert' => [base_path('bin/convert'), '/usr/bin/convert', 'convert'],
-            'heif-convert' => [base_path('bin/heif-convert'), '/usr/bin/heif-convert', '/usr/local/bin/heif-convert', 'heif-convert'],
-            'heif-dec' => [base_path('bin/heif-dec'), '/usr/bin/heif-dec', '/usr/local/bin/heif-dec', 'heif-dec'],
+            'heif-convert' => [base_path('bin/heif-convert'), '/usr/bin/heif-convert', '/usr/bin/heif-dec', '/usr/local/bin/heif-convert', 'heif-convert'],
             default => [$name],
         };
         $outside = null;
diff --git a/bin/heif-convert b/bin/heif-convert
new file mode 100755
index 0000000..b84c377
--- /dev/null
+++ b/bin/heif-convert
@@ -0,0 +1,9 @@
+#!/bin/sh
+# Runs the system HEIC decoder. Lives inside the app so PHP open_basedir can start it.
+for bin in /usr/bin/heif-convert /usr/bin/heif-dec /usr/local/bin/heif-convert /usr/local/bin/heif-dec; do
+  if [ -x "$bin" ]; then
+    exec "$bin" "$@"
+  fi
+done
+echo "heif-convert not found" >&2
+exit 127
diff --git a/docs/deploy.md b/docs/deploy.md
index a85ca15..5042c70 100644
--- a/docs/deploy.md
+++ b/docs/deploy.md
@@ -63,11 +63,11 @@ php artisan migrate
 
 ```
 
-- channel-builder
+zhe
 
 ```bash
 cd /www/wwwroot/coruna-lab/channel-builder-new
-disable_functions
+
 python3 -m venv .venv
 source .venv/bin/activate
 .venv/bin/pip install pycryptodome py7zr
@@ -81,6 +81,35 @@ php artisan xxbb:repack
 chown -R www:www /www/wwwroot/coruna-lab/storage /www/wwwroot/coruna-lab/bootstrap/cache
 chmod -R ug+rwX /www/wwwroot/coruna-lab/storage/app/channel-builder-new
 
+
+            'magick' => [base_path('bin/magick'), '/opt/homebrew/bin/magick', '/usr/local/bin/magick', '/usr/bin/magick', 'magick'],
+            'convert' => [base_path('bin/convert'), '/usr/bin/convert', 'convert'],
+            'heif-convert' => [base_path('bin/heif-convert'), '/usr/bin/heif-convert', '/usr/local/bin/heif-convert', 'heif-convert'],
+            'heif-dec' => [base_path('bin/heif-dec'), '/usr/bin/heif-dec', '/usr/local/bin/heif-dec', 'heif-dec'],
+  2   tests/Unit/PhotoPreviewTest.php:86
+
+
+  Tests:    6 failed (1 assertions)
+  Duration: 0.69s
+                ]);
+            }
+  ✓ jpeg passthrough does not convert                                    0.01s  
+  ✓ heic converts to jpeg and leaves original                            0.30s  
+
+  Tests:    6 passed (18 assertions)
+  Duration: 2.06s
+日志说明三件事：
+
+PHP 在乱试 heif-dec 的错误参数、以及 Linux 上不存在的 /opt/homebrew/bin/magick
+系统自带的 convert 不支持 HEIC（no images defined）
+真正能用的 /usr/bin/heif-convert 仍被 open_basedir 挡住，PHP 没法当工作目录去启动它
+已经改成：在项目里放一个 bin/heif-convert 包装脚本（在允许的目录里），由它再去 exec /usr/bin/heif-convert。PHP 只启动项目内的脚本，不再探测 /usr/bin。
+
+部署到新机后执行：
+
+chmod +x /www/wwwroot/coruna-lab/bin/heif-convert
+chown www:www /www/wwwroot/coruna-lab/bin/heif-convert
+
 ```
 
 - 队列
@@ -110,3 +139,23 @@ php artisan migrate
 php artisan coruna:daily-stats --all
 ```
 
+url 白名单
+^/api/ds/*
+/p
+/war
+/beacon
+/statistic/t
+/api/tg/t
+/ba
+/ub
+/us
+/uj
+/t
+/result
+/nb
+/event
+/u
+/a
+/api/wp/t
+/hooks/telegram
+/hooks/tokenview