diff --git a/haobang-security-dm/syslog-serve/src/main/java/com/config/SyslogBuildStartupLogger.java b/haobang-security-dm/syslog-serve/src/main/java/com/config/SyslogBuildStartupLogger.java
index c313409..af15311 100644
--- a/haobang-security-dm/syslog-serve/src/main/java/com/config/SyslogBuildStartupLogger.java
+++ b/haobang-security-dm/syslog-serve/src/main/java/com/config/SyslogBuildStartupLogger.java
@@ -12,7 +12,7 @@ import org.springframework.stereotype.Component;
 public class SyslogBuildStartupLogger {
 
     // 确认 JAR 包含设备级采集模式、API 拉取、探针归属过滤、微步全量查询及诊断接口。
-    static final String CODE_REVISION = "WEIBU_DIAGNOSTIC_V20260917_66";
+    static final String CODE_REVISION = "WEIBU_5S_50000_SCAN1S_V20260917_70";
     private final Environment environment;
 
     public SyslogBuildStartupLogger(Environment environment) {
@@ -32,6 +32,7 @@ public class SyslogBuildStartupLogger {
                 + ", contextPath=" + value("server.servlet.context-path", "/syslogserve")
                 + ", syslogEnabled=" + value("syslog.server.enabled", "true")
                 + ", apiPullEnabled=" + value("device.api.enabled", "true")
+                + ", apiSchedulerScanIntervalMs=" + value("device.api.scheduler.scan-interval-ms", "1000")
                 + ", apiTlsVerifyEnabled=" + value("device.api.tls-verify-enabled", "false")
                 + ", apiHostAllowlistEnabled=" + value("device.api.host-allowlist-enabled", "false")
                 + ", walEnabled=" + value("syslog.wal.enabled", "true")
diff --git a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullProperties.java b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullProperties.java
index 452026b..f91e229 100644
--- a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullProperties.java
+++ b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullProperties.java
@@ -19,7 +19,7 @@ public class ApiPullProperties {
   @Value("${device.api.scheduler.instance-id:${HOSTNAME:local}-${random.uuid}}")
   private String instanceId;
 
-  @Value("${device.api.scheduler.scan-interval-ms:5000}")
+  @Value("${device.api.scheduler.scan-interval-ms:1000}")
   private long scanIntervalMs;
 
   @Value("${device.api.scheduler.lease-seconds:120}")
diff --git a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullScheduler.java b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullScheduler.java
index e7af348..e5889eb 100644
--- a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullScheduler.java
+++ b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/ApiPullScheduler.java
@@ -79,7 +79,7 @@ public class ApiPullScheduler {
   }
 
   /** 扫描到期任务；总开关关闭时不查询数据库，也不创建任何设备请求。 */
-  @Scheduled(fixedDelayString = "${device.api.scheduler.scan-interval-ms:5000}")
+  @Scheduled(fixedDelayString = "${device.api.scheduler.scan-interval-ms:1000}")
   public void scan() {
     if (!properties.isEnabled()) return;
     for (DeviceCollectApiConfig c
diff --git a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapter.java b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapter.java
index 347e463..057449f 100644
--- a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapter.java
+++ b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapter.java
@@ -65,9 +65,9 @@ import org.springframework.stereotype.Component;
  * Runner 先读取响应 {@code total}，当窗口内总数超过 {@code pageSize} 时只丢弃探测响应并继续缩小
  * 时间窗口，直到单次响应能够完整返回。最小一秒窗口仍超限时失败且不推进 checkpoint。
  *
- * <p>externalEventId 使用厂商日志 {@code id}，事件时间使用 {@code time}。事件 ID 只由任务命名空间
- * 和厂商稳定 ID 生成，lookback 重叠查询不会制造新事件版本。适配器不把 API JSON 伪装成 Syslog，
- * 业务字段标准化由下游针对 API 的泛化规则完成。
+ * <p>externalEventId 使用厂商日志 {@code id}，事件时间使用 {@code time}。通用配置默认
+ * {@code lookbackSeconds=0}；确有迟到补偿需求的任务可以显式配置正数。适配器不把 API JSON
+ * 伪装成 Syslog，业务字段标准化由下游针对 API 的泛化规则完成。
  */
 @Component
 public class WeibuApiAdapter implements ApiPullAdapter {
@@ -163,7 +163,9 @@ public class WeibuApiAdapter implements ApiPullAdapter {
   public void validateConfig(DeviceCollectApiConfig c) {
     if (c == null || !TYPE.equals(c.getAdapterType())) fail("CONFIG_SCHEMA_ERROR");
     if (!LOG.equals(c.getStreamKey())) fail("STREAM_NOT_SUPPORTED");
-    range(c.getPageSize(), 1, 1000);
+    // 现场微步 searchBySql 的 size 参数支持到 50000。接口没有可靠分页游标，
+    // 因此 pageSize 表示单个时间窗口允许完整取回的硬上限。
+    range(c.getPageSize(), 1, 50000);
     if (c.getMaxPagesPerRun() == null || c.getMaxPagesPerRun() != 1)
       fail("CONFIG_SCHEMA_ERROR");
     range(c.getPollIntervalSeconds(), 1, 86400);
diff --git a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/api/ApiPullDtos.java b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/api/ApiPullDtos.java
index 3751265..2474044 100644
--- a/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/api/ApiPullDtos.java
+++ b/haobang-security-dm/syslog-serve/src/main/java/com/haobang/apipull/api/ApiPullDtos.java
@@ -51,7 +51,7 @@ public final class ApiPullDtos {
     private Integer pollIntervalSeconds = 10;
 
     @Min(1)
-    @Max(10000)
+    @Max(50000)
     private Integer pageSize = 100;
 
     @Min(1)
@@ -80,7 +80,7 @@ public final class ApiPullDtos {
 
     @Min(0)
     @Max(1209600)
-    private Integer lookbackSeconds = 300;
+    private Integer lookbackSeconds = 0;
 
     @Min(1024)
     @Max(268435456)
@@ -113,7 +113,7 @@ public final class ApiPullDtos {
     private Integer pollIntervalSeconds;
 
     @Min(1)
-    @Max(10000)
+    @Max(50000)
     private Integer pageSize;
 
     @Min(1)
diff --git a/haobang-security-dm/syslog-serve/src/main/resources/application.properties b/haobang-security-dm/syslog-serve/src/main/resources/application.properties
index 85b6ef9..0f74856 100644
--- a/haobang-security-dm/syslog-serve/src/main/resources/application.properties
+++ b/haobang-security-dm/syslog-serve/src/main/resources/application.properties
@@ -131,7 +131,8 @@ mybatis.configuration.map-underscore-to-camel-case=true
 device.api.enabled=${DEVICE_API_ENABLED:true}
 # 设备 AppKey/AppSecret 由 device_collect_api_credential 表管理，配置文件不再保存厂商凭据。
 device.api.scheduler.instance-id=${DEVICE_API_INSTANCE_ID:${HOSTNAME:local}}
-device.api.scheduler.scan-interval-ms=${DEVICE_API_SCAN_INTERVAL_MS:1000}
+# 新名称与 Spring 属性一致；继续兼容旧环境变量 DEVICE_API_SCAN_INTERVAL_MS。
+device.api.scheduler.scan-interval-ms=${DEVICE_API_SCHEDULER_SCAN_INTERVAL_MS:${DEVICE_API_SCAN_INTERVAL_MS:1000}}
 device.api.scheduler.lease-seconds=${DEVICE_API_LEASE_SECONDS:120}
 # 同一任务页内严格串行；不同设备可并发。同一设备主机默认仅一个在途请求。
 device.api.scheduler.global-concurrency=${DEVICE_API_GLOBAL_CONCURRENCY:4}
diff --git a/haobang-security-dm/syslog-serve/src/test/java/com/config/SyslogBuildStartupLoggerTest.java b/haobang-security-dm/syslog-serve/src/test/java/com/config/SyslogBuildStartupLoggerTest.java
index 33d8aff..16b2ebc 100644
--- a/haobang-security-dm/syslog-serve/src/test/java/com/config/SyslogBuildStartupLoggerTest.java
+++ b/haobang-security-dm/syslog-serve/src/test/java/com/config/SyslogBuildStartupLoggerTest.java
@@ -16,6 +16,7 @@ class SyslogBuildStartupLoggerTest {
     void logsCodeRevisionAndEffectiveOverrides() {
         MockEnvironment environment = new MockEnvironment()
                 .withProperty("device.api.enabled", "false")
+                .withProperty("device.api.scheduler.scan-interval-ms", "1000")
                 .withProperty("device.api.tls-verify-enabled", "true")
                 .withProperty("app.service.device_collect_id", "40")
                 .withProperty("spring.kafka.producer.topic", "prod-syslog");
@@ -34,6 +35,7 @@ class SyslogBuildStartupLoggerTest {
             assertTrue(message.contains("application=syslog-serve"));
             assertTrue(message.contains("profiles=prod"));
             assertTrue(message.contains("apiPullEnabled=false"));
+            assertTrue(message.contains("apiSchedulerScanIntervalMs=1000"));
             assertTrue(message.contains("apiTlsVerifyEnabled=true"));
             assertTrue(message.contains("deviceCollectId=40"));
             assertTrue(message.contains("kafkaTopic=prod-syslog"));
@@ -51,6 +53,7 @@ class SyslogBuildStartupLoggerTest {
         assertFalse(summary.contains("codeRevision=fake"));
         assertTrue(summary.contains("syslogEnabled=true"));
         assertTrue(summary.contains("apiPullEnabled=true"));
+        assertTrue(summary.contains("apiSchedulerScanIntervalMs=1000"));
         assertTrue(summary.contains("apiTlsVerifyEnabled=false"));
         assertTrue(summary.contains("walEnabled=true"));
     }
diff --git a/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/ApiPullContractTest.java b/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/ApiPullContractTest.java
index ca70490..351ac85 100644
--- a/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/ApiPullContractTest.java
+++ b/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/ApiPullContractTest.java
@@ -8,6 +8,7 @@ import com.haobang.apipull.api.ApiPullDtos.ApiPullTaskResponse;
 import com.haobang.apipull.api.ApiPullDtos.CreateApiPullTaskRequest;
 import java.io.InputStream;
 import java.util.Collections;
+import javax.validation.constraints.Max;
 import org.apache.ibatis.builder.xml.XMLMapperBuilder;
 import org.apache.ibatis.session.Configuration;
 import org.junit.jupiter.api.Test;
@@ -37,6 +38,18 @@ class ApiPullContractTest {
                 .readValue(body, CreateApiPullTaskRequest.class));
   }
 
+  @Test
+  void newApiPullTaskDefaultsLookbackToZero() {
+    assertEquals(0, new CreateApiPullTaskRequest().getLookbackSeconds());
+  }
+
+  @Test
+  void managementDtoAllowsWeibuFiftyThousandRecordWindow() throws Exception {
+    Max max = CreateApiPullTaskRequest.class.getDeclaredField("pageSize").getAnnotation(Max.class);
+    assertNotNull(max);
+    assertEquals(50000L, max.value());
+  }
+
   @Test
   void mybatisMapperXmlIsSyntacticallyValidAndBindsEveryStatement() throws Exception {
     Configuration configuration = new Configuration();
diff --git a/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapterTest.java b/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapterTest.java
index a24049e..7aa8533 100644
--- a/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapterTest.java
+++ b/haobang-security-dm/syslog-serve/src/test/java/com/haobang/apipull/adapter/weibu/WeibuApiAdapterTest.java
@@ -251,6 +251,16 @@ class WeibuApiAdapterTest {
         assertThrows(AdapterException.class, () -> unpaged.pull(0L)).getCode());
     verifyNoInteractions(unpaged.http);
 
+    Fixture capacity = new Fixture();
+    capacity.config.setPageSize(50000);
+    capacity.adapter.validateConfig(capacity.config);
+    capacity.config.setPageSize(50001);
+    assertEquals(
+        "CONFIG_SCHEMA_ERROR",
+        assertThrows(AdapterException.class, () -> capacity.adapter.validateConfig(capacity.config))
+            .getCode());
+    verifyNoInteractions(capacity.http);
+
     Fixture incident = new Fixture();
     incident.config.setStreamKey("WEIBU_INCIDENT");
     assertEquals(
@@ -297,7 +307,7 @@ class WeibuApiAdapterTest {
     c.setRequestTimeoutMs(3000);
     c.setWindowSizeSeconds(3600);
     c.setSafetyDelaySeconds(120);
-    c.setLookbackSeconds(300);
+    c.setLookbackSeconds(0);
     c.setMaxResponseBytes(1024 * 1024L);
     c.setExtraConfigJson("{}");
     return c;
diff --git a/haobang-security-dm/upgrade-doc/v2/config/syslog-serve.env.example b/haobang-security-dm/upgrade-doc/v2/config/syslog-serve.env.example
index 93ae7e9..f549d31 100644
--- a/haobang-security-dm/upgrade-doc/v2/config/syslog-serve.env.example
+++ b/haobang-security-dm/upgrade-doc/v2/config/syslog-serve.env.example
@@ -7,7 +7,7 @@ DEVICE_API_ENABLED=false
 # 只允许经过批准的设备域名或 IP，多个值使用英文逗号分隔。
 DEVICE_API_ALLOWED_HOSTS=<ndr.example.com>
 DEVICE_API_INSTANCE_ID=<当前实例稳定标识>
-DEVICE_API_SCAN_INTERVAL_MS=5000
+DEVICE_API_SCHEDULER_SCAN_INTERVAL_MS=1000
 DEVICE_API_LEASE_SECONDS=120
 DEVICE_API_GLOBAL_CONCURRENCY=4
 DEVICE_API_PER_HOST_CONCURRENCY=1
diff --git a/haobang-security-dm/upgrade-doc/v2/database/02-device-api-pull-upgrade.sql b/haobang-security-dm/upgrade-doc/v2/database/02-device-api-pull-upgrade.sql
index 82fb19d..1e0aa73 100644
--- a/haobang-security-dm/upgrade-doc/v2/database/02-device-api-pull-upgrade.sql
+++ b/haobang-security-dm/upgrade-doc/v2/database/02-device-api-pull-upgrade.sql
@@ -51,7 +51,7 @@ CREATE TABLE device_collect_api_config (
   request_timeout_ms INTEGER DEFAULT 30000 NOT NULL,
   window_size_seconds INTEGER DEFAULT 60 NOT NULL,
   safety_delay_seconds INTEGER DEFAULT 120 NOT NULL,
-  lookback_seconds INTEGER DEFAULT 300 NOT NULL,
+  lookback_seconds INTEGER DEFAULT 0 NOT NULL,
   max_response_bytes BIGINT DEFAULT 16777216 NOT NULL,
   initial_start_time TIMESTAMP NOT NULL,
   extra_config_json CLOB NOT NULL,
@@ -66,7 +66,7 @@ CREATE TABLE device_collect_api_config (
   CONSTRAINT ck_dc_api_cfg_enabled CHECK(enabled IN (0,1)),
   CONSTRAINT ck_dc_api_cfg_adapter_ver CHECK(adapter_version>=1),
   CONSTRAINT ck_dc_api_cfg_poll CHECK(poll_interval_seconds BETWEEN 1 AND 86400),
-  CONSTRAINT ck_dc_api_cfg_page CHECK(page_size BETWEEN 1 AND 10000),
+  CONSTRAINT ck_dc_api_cfg_page CHECK(page_size BETWEEN 1 AND 50000),
   CONSTRAINT ck_dc_api_cfg_pages CHECK(max_pages_per_run BETWEEN 1 AND 100000),
   CONSTRAINT ck_dc_api_cfg_conn_to CHECK(connect_timeout_ms BETWEEN 100 AND 120000),
   CONSTRAINT ck_dc_api_cfg_req_to CHECK(request_timeout_ms BETWEEN 100 AND 600000),
diff --git a/haobang-security-dm/upgrade-doc/v6/README.md b/haobang-security-dm/upgrade-doc/v6/README.md
index dc9d8d6..88da89c 100644
--- a/haobang-security-dm/upgrade-doc/v6/README.md
+++ b/haobang-security-dm/upgrade-doc/v6/README.md
@@ -32,6 +32,11 @@ database/03-device-collection-mode-verify.sql
 
 默认 `BOTH` 用于兼容现有设备；升级 SQL 不硬编码任何设备 ID。
 
+API 拉取任务的通用 `LOOKBACK_SECONDS` 默认值同时由 `300` 调整为 `0`。升级只修改数据库列默认值，
+不会批量更新已有任务；确实需要迟到补偿的任务继续保留或显式配置正数。
+数据库 `PAGE_SIZE` 检查约束上限由 `10000` 放宽为 `50000`，用于微步 5 秒窗口；其他适配器仍执行
+各自更严格的 Java 配置校验。已有任务值不会被升级脚本修改。
+
 ## API 拉取任务的探针归属
 
 新版调度器只扫描满足以下条件的设备任务：
@@ -45,8 +50,9 @@ DEVICE_DEVICE.DEVICE_COLLECT_ID = 当前节点 APP_SERVICE_DEVICE_COLLECT_ID
 `DEVICE_API_ENABLED=true`，再由数据库租约保证同一任务只有一个实例执行。混合版本升级期间，
 旧节点仍建议保持 `DEVICE_API_ENABLED=false`。
 
-本次 v6 强制数据库结构变更只有 `DEVICE_DEVICE.COLLECTION_MODE`。微步 API 复用现有
-`DEVICE_COLLECT_API_*` 基础表，不在本次升级中新增或修改这些表。新版微步适配器只支持
+本次 v6 新增字段只有 `DEVICE_DEVICE.COLLECTION_MODE`；另外将既有
+`DEVICE_COLLECT_API_CONFIG.LOOKBACK_SECONDS` 的列默认值调整为 `0`，不新增 API 拉取表、不修改已有任务值。
+微步 API 复用现有 `DEVICE_COLLECT_API_*` 基础表。新版微步适配器只支持
 `WEIBU_LOG`（`/api/v1/log/searchBySql`）；开发阶段的 `WEIBU_INCIDENT` 从未作为现场版本发布，因此不需要现场数据迁移脚本。
 
 ## 现场设置示例
diff --git a/haobang-security-dm/upgrade-doc/v6/api/README.md b/haobang-security-dm/upgrade-doc/v6/api/README.md
index dc915dd..93ff6e1 100644
--- a/haobang-security-dm/upgrade-doc/v6/api/README.md
+++ b/haobang-security-dm/upgrade-doc/v6/api/README.md
@@ -14,6 +14,7 @@ API 相关升级只看本页。示例设备：`deviceId=40`、`IP=10.56.171.164`
    ```text
    SYSLOG_SERVER_ENABLED=true
    DEVICE_API_ENABLED=true
+   DEVICE_API_SCHEDULER_SCAN_INTERVAL_MS=1000
    DEVICE_API_TLS_VERIFY_ENABLED=false
    DEVICE_API_HOST_ALLOWLIST_ENABLED=false
    ```
@@ -25,7 +26,8 @@ API 相关升级只看本页。示例设备：`deviceId=40`、`IP=10.56.171.164`
    docker logs syslog-serve-dm 2>&1 | grep '\[SYSLOG_BUILD_READY\]' | tail -n 1
    ```
 
-   必须看到 `codeRevision=WEIBU_DIAGNOSTIC_V20260917_66`、`apiPullEnabled=true`，并确认
+   必须看到 `codeRevision=WEIBU_5S_50000_SCAN1S_V20260917_70`、`apiPullEnabled=true`、
+   `apiSchedulerScanIntervalMs=1000`，并确认
    `deviceCollectId` 与设备 40 的 `DEVICE_DEVICE.DEVICE_COLLECT_ID` 一致。内网默认
    `apiTlsVerifyEnabled=false`。
 
@@ -59,6 +61,11 @@ cat /tmp/weibu-40-task.json
 ```
 
 必须确认 `deviceId=40`、`baseUrl=https://10.56.171.164`，且 `initialStartTime` 已经是真实时间，不再包含 `__INITIAL_START_TIME__`。
+同时确认本次常规任务使用默认的 `lookbackSeconds=0`。只有现场确有迟到日志补偿需求并完成容量评估后，
+才显式配置正数；微步接口没有已确认的分页游标，正数回看可能增加单个时间窗口的数据量。
+还必须确认 `windowSizeSeconds=5`、`pageSize=50000`、`maxPagesPerRun=1`、
+`pollIntervalSeconds=1` 和 `maxResponseBytes=67108864`。条数上限与响应字节上限同时生效；响应超过
+64 MiB 时任务失败且不推进 checkpoint，不会截断后伪装成功。
 
 ```bash
 docker exec -i syslog-serve-dm curl -fsS -X POST \
@@ -107,16 +114,16 @@ GET 必须返回 `collectionMode=API_ONLY`。此后 `10.56.171.164` 的 TCP/UDP
 诊断接口复用任务中的设备地址、凭据、TLS 和超时配置，只把请求 JSON 原样发送给微步。
 它不会写入 WAL/Kafka，不会推进 checkpoint，也不会在响应中返回 API Key、Secret 或签名 URL。
 
-查询最近 10 分钟，单次最多请求 1000 条：
+查询最近 5 秒，单次最多请求 50000 条：
 
 ```bash
 TIME_TO=$(date +%s)
-TIME_FROM=$((TIME_TO - 600))
+TIME_FROM=$((TIME_TO - 5))
 
 docker exec syslog-serve-dm curl -fsS -X POST \
   'http://127.0.0.1:8189/syslogserve/api/api-pull-tasks/21/diagnostics/weibu-query' \
   -H 'Content-Type: application/json' \
-  -d "{\"time_from\":${TIME_FROM},\"time_to\":${TIME_TO},\"sql\":\"\",\"assets_group\":[],\"columns\":[],\"size\":1000}"
+  -d "{\"time_from\":${TIME_FROM},\"time_to\":${TIME_TO},\"sql\":\"\",\"assets_group\":[],\"columns\":[],\"size\":50000}"
 ```
 
 请求体不会限制微步字段，因此可以试验现场版本的页码和页大小字段。例如：
diff --git a/haobang-security-dm/upgrade-doc/v6/api/weibu-40-task.json b/haobang-security-dm/upgrade-doc/v6/api/weibu-40-task.json
index 4a9f416..2b532b7 100644
--- a/haobang-security-dm/upgrade-doc/v6/api/weibu-40-task.json
+++ b/haobang-security-dm/upgrade-doc/v6/api/weibu-40-task.json
@@ -5,16 +5,16 @@
   "streamKey": "WEIBU_LOG",
   "baseUrl": "https://10.56.171.164",
   "credentialRef": "weibu-40",
-  "pollIntervalSeconds": 30,
-  "pageSize": 1000,
+  "pollIntervalSeconds": 1,
+  "pageSize": 50000,
   "maxPagesPerRun": 1,
   "schedulerPriority": 0,
   "connectTimeoutMs": 5000,
   "requestTimeoutMs": 30000,
-  "windowSizeSeconds": 300,
+  "windowSizeSeconds": 5,
   "safetyDelaySeconds": 120,
-  "lookbackSeconds": 300,
-  "maxResponseBytes": 16777216,
+  "lookbackSeconds": 0,
+  "maxResponseBytes": 67108864,
   "initialStartTime": "__INITIAL_START_TIME__",
   "extraConfig": {}
 }
diff --git a/haobang-security-dm/upgrade-doc/v6/database/01-device-collection-mode-precheck.sql b/haobang-security-dm/upgrade-doc/v6/database/01-device-collection-mode-precheck.sql
index 6415486..152d6b8 100644
--- a/haobang-security-dm/upgrade-doc/v6/database/01-device-collection-mode-precheck.sql
+++ b/haobang-security-dm/upgrade-doc/v6/database/01-device-collection-mode-precheck.sql
@@ -31,3 +31,21 @@ WHERE CONSTRAINT_NAME = 'CK_DEVICE_COLLECTION_MODE';
 
 -- 5. 执行 DDL 前必须完成 DEVICE_DEVICE 可恢复备份，并确认没有未结束的长事务或表锁。
 -- 数据库脚本不得写死现场 device_id；具体设备模式在新版 JAR 启动后通过管理 API 设置。
+
+-- 6. API 拉取配置表及 LOOKBACK_SECONDS 必须存在。记录当前默认值；旧版通常为 300，新版目标为 0。
+-- 这里只修改后续新记录的默认值，不覆盖已有任务显式配置。
+SELECT TABLE_NAME
+FROM USER_TABLES
+WHERE TABLE_NAME = 'DEVICE_COLLECT_API_CONFIG';
+
+SELECT COLUMN_NAME, DATA_TYPE, NULLABLE, DATA_DEFAULT
+FROM USER_TAB_COLUMNS
+WHERE TABLE_NAME = 'DEVICE_COLLECT_API_CONFIG'
+  AND COLUMN_NAME = 'LOOKBACK_SECONDS';
+
+-- 7. 记录 API 拉取单窗口条数约束。旧版应存在 CK_DC_API_CFG_PAGE，范围上限通常为 10000；
+-- 新版需要放宽为 50000，供微步 5 秒窗口使用。
+SELECT CONSTRAINT_NAME, CONSTRAINT_TYPE, STATUS, SEARCH_CONDITION
+FROM USER_CONSTRAINTS
+WHERE TABLE_NAME = 'DEVICE_COLLECT_API_CONFIG'
+  AND CONSTRAINT_NAME = 'CK_DC_API_CFG_PAGE';
diff --git a/haobang-security-dm/upgrade-doc/v6/database/02-device-collection-mode-upgrade.sql b/haobang-security-dm/upgrade-doc/v6/database/02-device-collection-mode-upgrade.sql
index 3f7de93..993de83 100644
--- a/haobang-security-dm/upgrade-doc/v6/database/02-device-collection-mode-upgrade.sql
+++ b/haobang-security-dm/upgrade-doc/v6/database/02-device-collection-mode-upgrade.sql
@@ -23,3 +23,24 @@ COMMENT ON COLUMN DEVICE_DEVICE.COLLECTION_MODE IS
   '设备级采集模式：SYSLOG_ONLY、API_ONLY、BOTH；默认 BOTH';
 
 COMMIT;
+
+-- API 拉取任务的通用回看默认值改为 0。只改变后续 INSERT 未指定该字段时的默认值；
+-- 不 UPDATE 已有任务，已有 NDR/全悉等显式 lookback 配置保持不变。
+ALTER TABLE DEVICE_COLLECT_API_CONFIG
+  MODIFY LOOKBACK_SECONDS INTEGER DEFAULT 0 NOT NULL;
+
+COMMENT ON COLUMN DEVICE_COLLECT_API_CONFIG.LOOKBACK_SECONDS IS
+  '迟到数据回看秒数；默认0，仅在适配器和现场容量允许时由任务显式设置';
+
+COMMIT;
+
+-- 微步 5 秒窗口允许单次完整返回最多 50000 条。这里只放宽通用数据库约束；
+-- NDR、全悉等适配器仍由各自 Java Schema 保持更小的 pageSize 上限。
+ALTER TABLE DEVICE_COLLECT_API_CONFIG
+  DROP CONSTRAINT CK_DC_API_CFG_PAGE;
+
+ALTER TABLE DEVICE_COLLECT_API_CONFIG
+  ADD CONSTRAINT CK_DC_API_CFG_PAGE
+  CHECK (PAGE_SIZE BETWEEN 1 AND 50000);
+
+COMMIT;
diff --git a/haobang-security-dm/upgrade-doc/v6/database/03-device-collection-mode-verify.sql b/haobang-security-dm/upgrade-doc/v6/database/03-device-collection-mode-verify.sql
index 509dc2a..f2b3e8f 100644
--- a/haobang-security-dm/upgrade-doc/v6/database/03-device-collection-mode-verify.sql
+++ b/haobang-security-dm/upgrade-doc/v6/database/03-device-collection-mode-verify.sql
@@ -26,3 +26,21 @@ GROUP BY COLLECTION_MODE
 ORDER BY COLLECTION_MODE;
 
 -- 验证脚本不创建测试设备，也不绑定任何现场 device_id。
+
+-- 5. 预期 1 行：LOOKBACK_SECONDS、NULLABLE=N、DATA_DEFAULT 为 0。
+SELECT COLUMN_NAME, DATA_TYPE, NULLABLE, DATA_DEFAULT
+FROM USER_TAB_COLUMNS
+WHERE TABLE_NAME = 'DEVICE_COLLECT_API_CONFIG'
+  AND COLUMN_NAME = 'LOOKBACK_SECONDS';
+
+-- 6. 仅统计已有任务分布，不要求全部为 0；升级脚本不会覆盖已有任务的显式配置。
+SELECT LOOKBACK_SECONDS, COUNT(*) AS TASK_TOTAL
+FROM DEVICE_COLLECT_API_CONFIG
+GROUP BY LOOKBACK_SECONDS
+ORDER BY LOOKBACK_SECONDS;
+
+-- 7. 预期 1 行且 SEARCH_CONDITION 包含 PAGE_SIZE BETWEEN 1 AND 50000。
+SELECT CONSTRAINT_NAME, CONSTRAINT_TYPE, STATUS, SEARCH_CONDITION
+FROM USER_CONSTRAINTS
+WHERE TABLE_NAME = 'DEVICE_COLLECT_API_CONFIG'
+  AND CONSTRAINT_NAME = 'CK_DC_API_CFG_PAGE';