agent-exec transport 632f19d9d5270942d95fe52bce5b1c5c/90c39af86cae

Why: Synchronize Frontend main (IAM U3 account UI #86) into the super-admin branch and resolve conflict in api.ts, AccountUsersPanel.tsx and adminSections.tsx as unions.

Evidence: npm test passed (49 files, 574 tests), check-knip passed.

Impact: AccountUsersPanel supports both super-admin identity/elevation and U3 initialization/credential states.

Refs: #627, Frontend PR #86

.gitea/workflows/ci.yml

@@ -13,7 +13,7 @@ jobs:
         env:
           TOKEN: ${{ secrets.GITHUB_TOKEN }}
           UI_DEPLOY_KEY: ${{ secrets.UI_DEPLOY_KEY }}
-          UI_SHA: 5c2b1036dd1aff89ec4eeae0c96493694e33ad4c
+          UI_SHA: fadabceadeec210d52cda7e9cec71e988d2e4482
         run: |
           set -euo pipefail
           printf 'context server=%s repository=%s sha=%s\n' "${GITHUB_SERVER_URL}" "${GITHUB_REPOSITORY}" "${GITHUB_SHA}"

e2e/iam-perm-ux-live.playwright.ts

@@ -1,419 +0,0 @@
-// permux 活体浏览器验收：真实 Backend + 真实 Frontend dist（vite preview，/api 代理到被测 Backend）。
-// 由外部 harness 注入 PLAYWRIGHT_BASE_URL、PERMUX_LIVE=1、PERMUX_OWNER/PERMUX_PASSWORD（已设密管理员）；
-// 全程不拦截任何路由，服务端事实一律经同一 baseURL 的 API 核对。
-import { randomUUID } from 'node:crypto'
-import { test, expect, type APIRequestContext, type APIResponse, type BrowserContext, type Page } from '@playwright/test'
-
-interface Perm { actionId: string; label: string; description: string; group: string; category?: string; scope: 'system' | 'project'; protected: boolean }
-interface RolePerm { actionId: string; allowed: boolean; capAllowed: boolean; permissionVersion: number }
-interface Role { roleId: string; name: string; description: string; enabled: boolean; roleVersion: number; bindingCount: number; permissions: RolePerm[] }
-interface Account { userId: string; owner: string; stateVersion: number; profile: { name: string } }
-interface UserRoleView { binding?: { roleId: string; active: boolean }; role?: Role }
-interface Me { owner: string; isAdmin?: boolean; linkedCapabilities?: { projectCreate: boolean; source?: string[]; linkedActions?: string[] } }
-
-const LIVE = process.env.PERMUX_LIVE === '1' && !!process.env.PLAYWRIGHT_BASE_URL
-const SUFFIX = `${Date.now().toString(36)}${Math.random().toString(36).slice(2, 6)}`
-const DOC_CATEGORY = '文档工作'
-const PROJECT_CREATE = 'project.create'
-const LINKED = ['project.settings', 'project.members.manage', 'project.permissions.manage', 'document.duties.assign']
-const LINKED_NOTE = '创建项目时自动具备 · 仅本人创建的项目'
-
-/** 与 rolePermissions.permissionCategory 同义：缺分类的非保护系统动作归入「项目与协作」。 */
-const categoryOf = (item: Perm) => item.category || (item.scope === 'system' ? '项目与协作' : item.group)
-const permKey = (role: Role) => role.permissions.filter(item => item.allowed || item.capAllowed)
-  .map(item => `${item.actionId}=${item.allowed}/${item.capAllowed}`).sort()
-const rowOf = (role: Role, actionId: string) => role.permissions.find(item => item.actionId === actionId)
-
-async function ok(res: APIResponse) {
-  expect(res.ok(), `${res.url()} → ${res.status()} ${await res.text().catch(() => '')}`).toBe(true)
-  return res
-}
-const getJSON = async <T>(api: APIRequestContext, path: string) => (await ok(await api.get(path))).json() as Promise<T>
-
-async function roleByName(api: APIRequestContext, name: string): Promise<Role> {
-  const page = await getJSON<{ roles: Role[] }>(api, `/api/admin/roles?query=${encodeURIComponent(name)}&mode=exact&status=all&limit=50`)
-  const role = (page.roles ?? []).find(item => item.name === name)
-  expect(role, `角色 ${name} 应存在`).toBeTruthy()
-  return role!
-}
-const getRole = (api: APIRequestContext, roleId: string) => getJSON<Role>(api, `/api/admin/roles/${encodeURIComponent(roleId)}`)
-const getUser = (api: APIRequestContext, userId: string) => getJSON<Account>(api, `/api/admin/users/${encodeURIComponent(userId)}`)
-const userRoleId = async (api: APIRequestContext, userId: string) =>
-  (await getJSON<UserRoleView>(api, `/api/admin/users/${encodeURIComponent(userId)}/role`)).role?.roleId ?? ''
-
-async function userByOwner(api: APIRequestContext, owner: string): Promise<Account> {
-  const page = await getJSON<{ accounts: Account[] }>(api,
-    `/api/admin/users/search?query=${encodeURIComponent(owner)}&mode=exact&status=all&fields=owner&limit=20`)
-  const account = (page.accounts ?? []).find(item => item.owner === owner)
-  expect(account, `用户 ${owner} 应存在`).toBeTruthy()
-  return account!
-}
-
-async function assignRoleApi(api: APIRequestContext, userId: string, roleId: string) {
-  const { stateVersion } = await getUser(api, userId)
-  await ok(await api.put(`/api/admin/users/${encodeURIComponent(userId)}/role`, {
-    data: { roleId, expectedStateVersion: stateVersion, idempotencyKey: randomUUID() },
-  }))
-}
-
-/** API 登录；首登受限会话先改密再以新密码重登，返回可用的完整会话。 */
-async function apiLogin(api: APIRequestContext, owner: string, password: string, nextPassword: string) {
-  const first = await (await ok(await api.post('/api/auth/login', { data: { owner, password } }))).json() as { mustChangePassword?: boolean; sessionScope?: string }
-  if (!first.mustChangePassword && first.sessionScope !== 'set_password_only') return
-  await ok(await api.post('/api/auth/password', { data: { current: password, next: nextPassword } }))
-  await ok(await api.post('/api/auth/login', { data: { owner, password: nextPassword } }))
-}
-
-async function expand(page: Page, trigger: string) {
-  const button = page.getByRole('button', { name: trigger, exact: true })
-  await expect(button).toBeVisible({ timeout: 15_000 })
-  if (await button.getAttribute('aria-expanded') !== 'true') await button.click()
-  await expect(button).toHaveAttribute('aria-expanded', 'true')
-}
-
-test.describe.serial('permux 活体主流程（真实 Backend + 真实 Frontend dist）', () => {
-  test.skip(!LIVE, 'set PERMUX_LIVE=1 and PLAYWRIGHT_BASE_URL (vite preview proxied to the backend under test)')
-  test.describe.configure({ timeout: 180_000 })
-
-  let context: BrowserContext
-  let page: Page
-  let api: APIRequestContext
-  let catalog: Perm[] = []
-  let actA: Perm, actB: Perm, keep: Perm, projectCreate: Perm
-  let linked: Perm[] = []
-  let roleA: Role, roleB: Role, roleC: Role
-  const names = {
-    roleA: `权限甲-${SUFFIX}`, roleB: `权限乙-${SUFFIX}`, roleC: `权限丙-${SUFFIX}`, roleD: `权限丁-${SUFFIX}`,
-    sameName: `同名测试·${SUFFIX}`, owner1: `permux-u1-${SUFFIX}`, owner2: `permux-u2-${SUFFIX}`, linkedOwner: `permux-linked-${SUFFIX}`,
-  }
-  const label1 = () => `${names.sameName}（${names.owner1}）`
-  const label2 = () => `${names.sameName}（${names.owner2}）`
-
-  const status = (text: string) => page.getByRole('status').filter({ hasText: text })
-  const savebar = () => page.getByRole('region', { name: '未保存的权限修改' })
-  const previewPanel = () => page.getByRole('region', { name: '保存前预览' })
-  const cell = (role: Role, item: Perm) => page.getByLabel(`${role.name} ${item.label}`, { exact: true })
-  const category = (name: string) => page.getByRole('group', { name: '权限分类' }).getByRole('button', { name, exact: true })
-  const matrixRow = (role: Role) => page.locator('tr').filter({ has: page.getByRole('button', { name: role.name, exact: true }) })
-  const userCheckbox = (label: string) => page.getByRole('checkbox', { name: `选择 ${label}`, exact: true })
-  const userRow = (label: string) => page.locator('tr').filter({ has: userCheckbox(label) })
-  const selectedBar = () => page.getByRole('region', { name: '已选用户' })
-
-  async function openSection(name: '角色与权限' | '用户管理') {
-    const zone = page.getByRole('dialog', { name: '系统管理' })
-    if (!await zone.isVisible()) {
-      await page.locator('.tsb-user').click()
-      await page.getByRole('button', { name: '系统管理…' }).click()
-      await expect(zone).toBeVisible()
-    }
-    await zone.getByRole('button', { name, exact: true }).click()
-  }
-
-  /** 角色面板：矩阵视图 + 搜索本轮后缀，只呈现本轮创建的角色。 */
-  async function rolesMatrix(query = SUFFIX) {
-    await openSection('角色与权限')
-    await expect(page.getByRole('group', { name: '权限分类' })).toBeVisible({ timeout: 15_000 })
-    const matrixButton = page.getByRole('button', { name: '角色矩阵', exact: true })
-    if (await matrixButton.getAttribute('aria-pressed') !== 'true') await matrixButton.click()
-    await expand(page, '搜索与过滤')
-    await page.getByLabel('搜索角色').fill(query)
-  }
-
-  async function openPreview() {
-    await savebar().getByRole('button', { name: '保存', exact: true }).click()
-    await expect(previewPanel()).toBeVisible({ timeout: 15_000 })
-    await expect(previewPanel()).toContainText('请确认以下变化后保存')
-  }
-
-  async function confirmSave(roles: number) {
-    const confirm = savebar().getByRole('button', { name: '确认保存', exact: true })
-    await expect(confirm).toBeEnabled()
-    await confirm.click()
-    await expect(status(`已保存 ${roles} 个角色的权限设置`)).toBeVisible({ timeout: 15_000 })
-    await expect(savebar()).toHaveCount(0)
-  }
-
-  test.beforeAll(async ({ browser }) => {
-    if (!LIVE) return
-    context = await browser.newContext({ baseURL: process.env.PLAYWRIGHT_BASE_URL, locale: 'zh-CN' })
-    page = await context.newPage()
-    api = context.request
-  })
-
-  test.afterAll(async () => { await context?.close() })
-
-  test('登录：管理员经登录表单进入工作台，/api/me 为管理员', async () => {
-    await page.goto('/')
-    await page.getByPlaceholder('由管理员分配').fill(process.env.PERMUX_OWNER ?? '')
-    await page.getByPlaceholder('初始密码或常用密码').fill(process.env.PERMUX_PASSWORD ?? '')
-    await page.getByRole('button', { name: '登录', exact: true }).click()
-    await expect(page.locator('.tsb-user')).toBeVisible({ timeout: 15_000 })
-    const res = await api.get('/api/me')
-    expect(res.status()).toBe(200)
-    const me = await res.json() as Me
-    expect(me.isAdmin).toBe(true)
-    expect(me.owner).toBe(process.env.PERMUX_OWNER)
-
-    catalog = (await getJSON<{ permissions: Perm[] }>(api, '/api/admin/permissions/catalog')).permissions ?? []
-    const editable = catalog.filter(item => !item.protected)
-    const docActions = editable.filter(item => categoryOf(item) === DOC_CATEGORY && item.scope === 'project' && !LINKED.includes(item.actionId))
-    expect(docActions.length, '「文档工作」至少需要两个可编辑项目动作').toBeGreaterThanOrEqual(2)
-    actA = docActions[0]
-    actB = docActions[1]
-    keep = docActions[2] ?? editable.find(item => item.scope === 'project' && !LINKED.includes(item.actionId)
-      && item.actionId !== actA.actionId && item.actionId !== actB.actionId)!
-    expect(keep, '需要第三个可编辑项目动作用于验证未提及行保留').toBeTruthy()
-    projectCreate = editable.find(item => item.actionId === PROJECT_CREATE)!
-    expect(projectCreate, '目录应含 project.create').toBeTruthy()
-    linked = LINKED.map(id => editable.find(item => item.actionId === id)!)
-    expect(linked.every(Boolean), '目录应含四个创建联动动作').toBe(true)
-  })
-
-  test('C01+C02 多角色矩阵编辑：跨分类与搜索保留草稿，预览后一次提交', async () => {
-    await rolesMatrix()
-    for (const name of [names.roleA, names.roleB]) {
-      await page.getByLabel('新角色名称').fill(name)
-      await page.getByLabel('新角色描述').fill('permux 活体验收')
-      await page.getByRole('button', { name: '创建角色', exact: true }).click()
-      await expect(status(`已创建角色 ${name}`)).toBeVisible({ timeout: 15_000 })
-    }
-    roleA = await roleByName(api, names.roleA)
-    roleB = await roleByName(api, names.roleB)
-    expect(roleA.enabled && roleB.enabled).toBe(true)
-
-    // 预置第三动作行（默认允许）：界面提交未提及它，提交后必须原样保留。
-    await ok(await api.post('/api/admin/roles/permissions/batch', { data: { idempotencyKey: randomUUID(), roles: [roleA, roleB].map(role => ({
-      roleId: role.roleId, expectedRoleVersion: role.roleVersion, changes: [{ actionId: keep.actionId, allowed: true, capAllowed: true }],
-    })) } }))
-    // 切走再回到分区使面板重挂载，草稿基线取预置后的最新版本。
-    await openSection('用户管理')
-    await rolesMatrix()
-
-    await category(DOC_CATEGORY).click()
-    await expect(category(DOC_CATEGORY)).toHaveAttribute('aria-pressed', 'true')
-    await cell(roleA, actA).selectOption('default')
-    await cell(roleB, actB).selectOption('project')
-    await expect(savebar()).toContainText('已修改 2 个角色、2 项设置')
-
-    const other = (await page.getByRole('group', { name: '权限分类' }).getByRole('button').allInnerTexts()).find(text => text.trim() !== DOC_CATEGORY)
-    expect(other, '应存在第二个权限分类').toBeTruthy()
-    await category(other!.trim()).click()
-    await expect(cell(roleA, actA)).toHaveCount(0)
-    await category(DOC_CATEGORY).click()
-    await expect(cell(roleA, actA)).toHaveValue('default')
-    await expect(cell(roleB, actB)).toHaveValue('project')
-    await expect(savebar()).toContainText('已修改 2 个角色、2 项设置')
-
-    await page.getByLabel('搜索角色').fill(roleA.name)
-    await expect(cell(roleB, actB)).toHaveCount(0, { timeout: 15_000 })
-    await expect(savebar()).toContainText('已修改 2 个角色、2 项设置')
-    await page.getByLabel('搜索角色').fill('')
-    await expect(savebar()).toContainText('已修改 2 个角色、2 项设置')
-    await page.getByLabel('搜索角色').fill(SUFFIX)
-    await expect(cell(roleA, actA)).toHaveValue('default', { timeout: 15_000 })
-    await expect(cell(roleB, actB)).toHaveValue('project')
-    await expect(savebar()).toContainText('已修改 2 个角色、2 项设置')
-
-    await openPreview()
-    const preview = previewPanel()
-    for (const text of [roleA.name, roleB.name, actA.label, actB.label, '不允许', '默认允许', '按项目授权']) await expect(preview).toContainText(text)
-    await confirmSave(2)
-
-    const freshA = await getRole(api, roleA.roleId)
-    const freshB = await getRole(api, roleB.roleId)
-    expect(rowOf(freshA, actA.actionId)).toMatchObject({ allowed: true, capAllowed: true })
-    expect(rowOf(freshB, actB.actionId)).toMatchObject({ allowed: false, capAllowed: true })
-    expect(rowOf(freshA, actB.actionId)?.capAllowed ?? false).toBe(false)
-    expect(rowOf(freshB, actA.actionId)?.capAllowed ?? false).toBe(false)
-    for (const role of [freshA, freshB]) expect(rowOf(role, keep.actionId)).toMatchObject({ allowed: true, capAllowed: true })
-  })
-
-  test('C03 创建联动：开启创建项目自动补齐四项按项目授权，运行时 /api/me 联动生效', async ({ request }) => {
-    await rolesMatrix()
-    await category(categoryOf(projectCreate)).click()
-    await cell(roleA, projectCreate).selectOption(projectCreate.scope === 'system' ? 'on' : 'default')
-    await expect(savebar()).toContainText('已修改 1 个角色、1 项设置')
-    await category(categoryOf(linked[0])).click()
-    await expect(matrixRow(roleA).getByText(LINKED_NOTE).first()).toBeVisible()
-    await expect(matrixRow(roleB).getByText(LINKED_NOTE)).toHaveCount(0)
-
-    await openPreview()
-    const expansion = previewPanel().locator('.rp-linked')
-    await expect(expansion).toContainText('系统将自动补齐')
-    for (const item of linked) await expect(expansion).toContainText(item.label)
-    await confirmSave(1)
-
-    const fresh = await getRole(api, roleA.roleId)
-    expect(rowOf(fresh, PROJECT_CREATE)).toMatchObject({ allowed: true })
-    for (const id of LINKED) expect(rowOf(fresh, id), id).toMatchObject({ allowed: false, capAllowed: true })
-
-    const password = `Permux!${SUFFIX}Aa9`
-    const nextPassword = `Permux!${SUFFIX}Bb8`
-    const created = await (await ok(await api.post('/api/admin/users', {
-      data: { owner: names.linkedOwner, profile: { name: '联动验证' }, password },
-    }))).json() as Account
-    await assignRoleApi(api, created.userId, roleA.roleId)
-    expect(await userRoleId(api, created.userId)).toBe(roleA.roleId)
-
-    await apiLogin(request, names.linkedOwner, password, nextPassword)
-    const meRes = await request.get('/api/me')
-    expect(meRes.status()).toBe(200)
-    const me = await meRes.json() as Me
-    expect(me.owner).toBe(names.linkedOwner)
-    expect(me.linkedCapabilities?.projectCreate).toBe(true)
-    for (const id of LINKED) expect(me.linkedCapabilities?.linkedActions ?? []).toContain(id)
-  })
-
-  test('C04 断链拒绝：创建项目开启时联动项不允许不可保存，恢复按项目授权后保存成功', async () => {
-    const before = await getRole(api, roleA.roleId)
-    const broken = linked[0]
-    await rolesMatrix()
-    await category(DOC_CATEGORY).click()
-    await cell(roleA, actB).selectOption('project')
-    await category(categoryOf(broken)).click()
-    await expect(cell(roleA, broken)).toHaveValue('project')
-    await cell(roleA, broken).selectOption('denied')
-    await expect(savebar()).toContainText('已修改 1 个角色、2 项设置')
-
-    await openPreview()
-    const confirm = savebar().getByRole('button', { name: '确认保存', exact: true })
-    const blockedNote = previewPanel().getByRole('alert')
-    if (await blockedNote.isVisible()) {
-      await expect(blockedNote).toContainText('存在冲突或错误，调整后才能保存')
-      await expect(previewPanel()).toContainText(broken.label)
-      await expect(confirm).toBeDisabled()
-    } else {
-      await expect(confirm).toBeEnabled()
-      await confirm.click()
-      await expect(page.locator('.rp-status').getByRole('alert')).toContainText(broken.label, { timeout: 15_000 })
-      await expect(savebar()).toContainText('已修改 1 个角色、2 项设置')
-    }
-    const unchanged = await getRole(api, roleA.roleId)
-    expect(unchanged.roleVersion).toBe(before.roleVersion)
-    expect(permKey(unchanged)).toEqual(permKey(before))
-
-    await cell(roleA, broken).selectOption('project')
-    await expect(savebar()).toContainText('已修改 1 个角色、1 项设置')
-    await openPreview()
-    await confirmSave(1)
-    const fresh = await getRole(api, roleA.roleId)
-    expect(rowOf(fresh, actB.actionId)).toMatchObject({ allowed: false, capAllowed: true })
-    expect(rowOf(fresh, PROJECT_CREATE)).toMatchObject({ allowed: true })
-    for (const id of LINKED) expect(rowOf(fresh, id), id).toMatchObject({ allowed: false, capAllowed: true })
-  })
-
-  test('C07 同名辨识：两名同名用户按账号辨识，勾选互不串行', async () => {
-    await openSection('用户管理')
-    for (const owner of [names.owner1, names.owner2]) {
-      await page.getByLabel('新用户登录名').fill(owner)
-      await expand(page, '可选资料：姓名、电话、邮箱、工号、部门、备注')
-      await page.locator('#new-user-name').fill(names.sameName)
-      await page.getByRole('button', { name: '创建用户', exact: true }).click()
-      await expect(status(`已创建 ${owner}`)).toBeVisible({ timeout: 15_000 })
-      await page.getByRole('button', { name: '返回列表', exact: true }).click()
-    }
-    await page.getByLabel('搜索用户').fill(names.sameName)
-    await expect(userRow(label1())).toBeVisible({ timeout: 15_000 })
-    await expect(userRow(label2())).toBeVisible()
-    await expect(page.getByText(`存在同名用户「${names.sameName}」`)).toBeVisible()
-    for (const [label, owner] of [[label1(), names.owner1], [label2(), names.owner2]]) {
-      await expect(userRow(label)).toContainText(names.sameName)
-      await expect(userRow(label)).toContainText(owner)
-      await expect(userRow(label)).toContainText('同名 · 按账号辨识')
-    }
-
-    await userCheckbox(label1()).check()
-    await expect(userCheckbox(label1())).toBeChecked()
-    await expect(userCheckbox(label2())).not.toBeChecked()
-    await expect(userRow(label2())).toContainText(names.owner2)
-    await expect(userRow(label2())).not.toContainText(names.owner1)
-    await expect(selectedBar()).toContainText('已选 1 人')
-  })
-
-  test('C08 批量分配：两人预览 未分配 → 角色乙 后一次提交', async () => {
-    await userCheckbox(label2()).check()
-    await expect(selectedBar()).toContainText('已选 2 人')
-    await selectedBar().getByRole('button', { name: '为选中的 2 人分配角色', exact: true }).click()
-    const batch = page.getByRole('region', { name: '为选中的 2 人分配角色' })
-    await batch.getByLabel('搜索可分配角色').fill(roleB.name)
-    const target = batch.getByLabel('批量分配的目标角色')
-    await expect(target.locator('option', { hasText: roleB.name })).toHaveCount(1, { timeout: 15_000 })
-    await target.selectOption({ label: roleB.name })
-    for (const owner of [names.owner1, names.owner2]) {
-      await expect(batch.locator('li', { hasText: owner })).toContainText(`未分配 → ${roleB.name}`, { timeout: 15_000 })
-    }
-    await batch.getByRole('button', { name: '确认分配', exact: true }).click()
-    await expect(status(`已为 2 人分配角色「${roleB.name}」`)).toBeVisible({ timeout: 15_000 })
-
-    for (const owner of [names.owner1, names.owner2]) {
-      const account = await userByOwner(api, owner)
-      expect(await userRoleId(api, account.userId), owner).toBe(roleB.roleId)
-    }
-    await expect(userRow(label1())).toContainText(roleB.name)
-    await expect(userRow(label2())).toContainText(roleB.name)
-  })
-
-  test('C09 冲突整批不写：确认前他人改动一人角色，409 后整批未写入且保留选择', async () => {
-    roleC = await (await ok(await api.post('/api/admin/roles', { data: { name: names.roleC, description: 'permux 并发改动' } }))).json() as Role
-    const user1 = await userByOwner(api, names.owner1)
-    const user2 = await userByOwner(api, names.owner2)
-
-    await userCheckbox(label1()).check()
-    await userCheckbox(label2()).check()
-    await expect(selectedBar()).toContainText('已选 2 人')
-    await selectedBar().getByRole('button', { name: '为选中的 2 人分配角色', exact: true }).click()
-    const batch = page.getByRole('region', { name: '为选中的 2 人分配角色' })
-    await batch.getByLabel('搜索可分配角色').fill(roleA.name)
-    const target = batch.getByLabel('批量分配的目标角色')
-    await expect(target.locator('option', { hasText: roleA.name })).toHaveCount(1, { timeout: 15_000 })
-    await target.selectOption({ label: roleA.name })
-    for (const owner of [names.owner1, names.owner2]) {
-      await expect(batch.locator('li', { hasText: owner })).toContainText(`${roleB.name} → ${roleA.name}`, { timeout: 15_000 })
-    }
-    const confirm = batch.getByRole('button', { name: '确认分配', exact: true })
-    await expect(confirm).toBeEnabled()
-
-    await assignRoleApi(api, user2.userId, roleC.roleId)
-    await confirm.click()
-    const alert = page.getByRole('alert').filter({ hasText: '整批均未写入' })
-    await expect(alert).toBeVisible({ timeout: 15_000 })
-    await expect(alert).toContainText('请重新预览')
-    await expect(userCheckbox(label1())).toBeChecked()
-    await expect(userCheckbox(label2())).toBeChecked()
-    await expect(selectedBar()).toContainText('已选 2 人')
-
-    expect(await userRoleId(api, user1.userId)).toBe(roleB.roleId)
-    expect(await userRoleId(api, user2.userId)).toBe(roleC.roleId)
-  })
-
-  test('C10 复制并分配：源角色权限复制到新角色并换绑，新角色独立维护', async () => {
-    await selectedBar().getByRole('button', { name: '清空选择', exact: true }).click()
-    await expect(selectedBar()).toHaveCount(0)
-    const user1 = await userByOwner(api, names.owner1)
-    const sourceBefore = await getRole(api, roleB.roleId)
-
-    await userRow(label1()).getByRole('button', { name: '查看与管理', exact: true }).click()
-    await expect(page.getByRole('button', { name: '返回列表', exact: true })).toBeVisible()
-    await expect(page.getByText(`当前角色 ${roleB.name}`)).toBeVisible({ timeout: 15_000 })
-    await expand(page, '复制角色并分配…')
-    await page.getByLabel('新角色名称（必填）').fill(names.roleD)
-    await page.getByLabel('新角色描述').fill('permux 复制并分配')
-    await expect(page.getByText(`相对「${roleB.name}」调整 0 项`)).toBeVisible()
-    await page.getByRole('button', { name: '确认复制并分配', exact: true }).click()
-    const done = status('新角色独立维护')
-    await expect(done).toBeVisible({ timeout: 15_000 })
-    await expect(done).toContainText(names.roleD)
-    await expect(page.getByText(`当前角色 ${names.roleD}`)).toBeVisible({ timeout: 15_000 })
-
-    const copied = await roleByName(api, names.roleD)
-    expect(copied.roleId).not.toBe(roleB.roleId)
-    expect(copied.description).toBe('permux 复制并分配')
-    expect(permKey(copied)).toEqual(permKey(sourceBefore))
-    expect(await userRoleId(api, user1.userId)).toBe(copied.roleId)
-    const sourceAfter = await getRole(api, roleB.roleId)
-    expect(sourceAfter.roleVersion).toBe(sourceBefore.roleVersion)
-    expect(permKey(sourceAfter)).toEqual(permKey(sourceBefore))
-    // 源角色仅失去被换绑的这一人，其余绑定不受影响。
-    expect(sourceAfter.bindingCount).toBe(sourceBefore.bindingCount - 1)
-  })
-})

e2e/work-checkpoints.playwright.ts

@@ -0,0 +1,202 @@
+import { test, expect } from '@playwright/test'
+import { readFileSync, readlinkSync } from 'node:fs'
+import { createHash } from 'node:crypto'
+
+const manifestPath=process.env.WORK_CHECKPOINT_HTTP_MANIFEST
+test.skip(!manifestPath,'Run explicitly with a task-owned mechanism instance manifest')
+const manifest=manifestPath?JSON.parse(readFileSync(manifestPath,'utf8')):null
+if(manifest&&(manifest.mode!=='mechanism'||!manifest.dataDir.includes('fast-slow-u2-u3-')||readlinkSync(`/proc/${manifest.pid}/exe`)!==manifest.binary||createHash('sha256').update(readFileSync(manifest.binary)).digest('hex')!==manifest.binarySHA256))throw new Error('Owned mechanism instance verification failed')
+
+type Scenario='normal'|'fast-ack'|'queue-hold'|'slow-stages'|'zero-failure'|'partial-failure'|'choice'
+async function setup(request:any,scenario:Scenario='normal',awaitTask=true,options:{text?:string,small?:boolean,startFailure?:boolean}={}){
+ const project=await(await request.post(manifest.base+'/api/projects',{data:{name:'browser-'+Date.now()}})).json()
+ const conv=await(await request.post(manifest.base+`/api/projects/${project.id}/conversations`,{data:{title:'材料整理',profileId:'checkpoint-eval'}})).json()
+ const ids:string[]=[]
+ for(let i=0;i<(options.small?1:3);i++){
+  const marker=i===0&&scenario!=='normal'?`[fixture:${scenario}]\n`:''
+  const res=await request.post(manifest.base+`/api/projects/${project.id}/uploads`,{multipart:{file:{name:`来源${i+1}.txt`,mimeType:'text/plain',buffer:Buffer.from(marker+'上线六月。验收条件需要补齐，预算50万元尚未审批。交付包含12项需求，其中3项依赖外部接口。第一期先完成8项核心需求。\n\n'+(options.small?'':('整理记录说明：保留日期、金额、限制和待确认事项。\n\n').repeat(options.text?250:100)))}}})
+  expect(res.ok()).toBeTruthy();ids.push((await res.json()).artifactId)
+ }
+ if(options.startFailure)expect((await request.post(manifest.base+'/__fixture/material-start-failure',{data:{enabled:true}})).status()).toBe(204)
+ let sendBody:any
+ try{
+  const sent=await request.post(manifest.base+`/api/conversations/${conv.id}/messages`,{data:{text:options.text??'',attachmentIds:ids,requestId:'browser-'+Date.now()}})
+  expect(sent.ok()).toBeTruthy()
+  sendBody=await sent.json()
+  await expect.poll(async()=> (await(await request.get(manifest.base+`/api/runs/${sendBody.run.id}`)).json()).run.status).toBe('completed')
+ }finally{
+  if(options.startFailure)expect((await request.post(manifest.base+'/__fixture/material-start-failure',{data:{enabled:false}})).status()).toBe(204)
+ }
+ if(awaitTask)await expect.poll(async()=>{
+  const out=await(await request.get(manifest.base+`/api/conversations/${conv.id}/cards`)).json()
+  return out.cards.find((c:any)=>c.task)?.task.executionState
+ }).toBe(scenario.endsWith('failure')?'failed':'completed')
+ return {project,conv,ids,sendRunId:sendBody.run.id}
+}
+async function waitForFailedWorkCard(request:any,seed:any){
+ await expect.poll(async()=>{
+  const out=await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()
+  const card=out.cards.find((c:any)=>c.task)
+  return card?.task.executionState==='failed'&&card.status==='failed'&&Boolean(card.work)
+ }).toBe(true)
+}
+async function expectOnlySendRun(request:any,seed:any){
+ const current=await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}`)).json()
+ expect(current.runs.filter((r:any)=>r.kind==='conversation').map((r:any)=>r.id)).toEqual([seed.sendRunId])
+}
+async function open(page:any,seed:any){
+ await page.addInitScript(({id}:{id:string})=>{localStorage.setItem('as.conv',id);localStorage.setItem('as.ui',JSON.stringify({theme:'light',rightCollapsed:true,fontSize:14}))},{id:seed.conv.id})
+ await page.goto('/')
+ await expect(page.locator('[data-conversation-work]')).toContainText('上线六月')
+}
+test('attachment-only intake gives a safe first reply before sourced findings',async({page,request})=>{
+ const seed=await setup(request,'fast-ack',false)
+ const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+ expect(cards.filter((c:any)=>c.task)).toHaveLength(1)
+ expect(cards.find((c:any)=>c.task).task.checkpointSeq??0).toBe(0)
+ await open(page,seed)
+ const reply=page.getByText(/已收到 3 份材料.*待确认/)
+ await expect(reply).toBeVisible()
+ await expect(page.getByText(/剩余\s*4\s*项.*含\s*3\s*项依赖接口/)).toHaveCount(0)
+ await page.setViewportSize({width:390,height:844})
+ await expect(reply).toBeVisible()
+ if(process.env.WORK_CHECKPOINT_SCREENSHOT)await page.screenshot({path:process.env.WORK_CHECKPOINT_SCREENSHOT.replace(/\.png$/, '-mobile.png'),fullPage:true})
+ await page.reload()
+ await expect(reply).toBeVisible()
+})
+test('text with long material keeps the user focus in the host reply',async({page,request})=>{
+ const seed=await setup(request,'fast-ack',false,{text:'重点核对预算审批'})
+ await open(page,seed)
+ await expect(page.getByText(/你提出的工作重点已带入整理任务.*待确认/)).toBeVisible()
+ const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+ expect(cards.filter((c:any)=>c.task)).toHaveLength(1)
+})
+test('running and completed resends reuse one material card',async({page,request})=>{
+ const seed=await setup(request,'slow-stages',false)
+ const resend=async(key:string)=>{
+  const response=await request.post(manifest.base+`/api/conversations/${seed.conv.id}/messages`,{data:{text:'',attachmentIds:seed.ids,requestId:key}})
+  expect(response.ok()).toBeTruthy()
+  const body=await response.json()
+  await expect.poll(async()=> (await(await request.get(manifest.base+`/api/runs/${body.run.id}`)).json()).run.status).toBe('completed')
+ }
+ await resend('active-resend-'+Date.now())
+ await open(page,seed)
+ await expect(page.getByText(/这批材料仍在整理.*待确认/)).toBeVisible()
+ await expect.poll(async()=>{
+  const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+  return cards.find((c:any)=>c.task)?.task.executionState
+ }).toBe('completed')
+ await resend('completed-resend-'+Date.now())
+ await expect(page.getByText(/这批材料已整理完成.*待确认/)).toBeVisible()
+ const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+ expect(cards.filter((c:any)=>c.task)).toHaveLength(1)
+})
+test('text with a small attachment retains the ordinary reply path',async({page,request})=>{
+ const seed=await setup(request,'normal',true,{text:'请先解释材料要点',small:true})
+ await open(page,seed)
+ await expect(page.getByText('已收到材料，正在后台整理；请结合阶段发现继续工作。').first()).toBeVisible()
+ const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+ expect(cards.filter((c:any)=>c.task)).toHaveLength(1)
+})
+test('real HTTP task recovery, source navigation and changed-version limitation',async({page,request})=>{
+ const seed=await setup(request);const errors:string[]=[];page.on('pageerror',e=>errors.push(e.message));await open(page,seed)
+ await expect(page.locator('[data-conversation-work]')).toContainText('验收条件需要补齐')
+ await expect(page.locator('[data-conversation-work]')).toContainText('材料未说明具体归属')
+ await page.reload();await expect(page.locator('[data-conversation-work]')).toContainText('上线六月')
+ await page.getByRole('button',{name:'查看依据',exact:true}).first().click()
+ await page.getByRole('button',{name:/查看来源/}).first().click()
+ await expect(page.locator('.preview-pane')).toBeVisible();await expect(page.getByText('任务处理时引用的来源版本；下方是本项发现引用的片段')).toBeVisible()
+ const card=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards.find((c:any)=>c.task)
+ const source=card.task.findings[0].sources[0]
+ const update=await request.put(manifest.base+`/api/artifacts/${source.artifactId}/content`,{data:'上线七月。文件内容已经更新。',headers:{'Content-Type':'text/plain'}});expect(update.ok()).toBeTruthy()
+ const old=await request.get(manifest.base+`/api/artifacts/${source.artifactId}/content?expectedHash=${source.contentHash}`);expect(old.status()).toBe(409)
+ await page.reload();await expect(page.locator('[data-conversation-work]')).toContainText('依据文件已更新')
+ await expect(page.locator('[data-conversation-work] .acard-findings').first()).not.toContainText('上线六月')
+ expect(errors).toEqual([])
+ if(process.env.WORK_CHECKPOINT_SCREENSHOT)await page.screenshot({path:process.env.WORK_CHECKPOINT_SCREENSHOT,fullPage:true})
+})
+test('background replay does not steal the current file, focus or viewport',async({page,request})=>{
+ const seed=await setup(request);await open(page,seed)
+ await page.getByRole('button',{name:'查看依据',exact:true}).first().click();await page.getByRole('button',{name:/查看来源/}).first().click();await expect(page.locator('.preview-pane')).toBeVisible()
+ const tabs=await page.locator('.tab-strip').textContent()
+ const composer=page.locator('textarea').last();await composer.fill('正在记录自己的想法');await composer.focus()
+ const focus=await composer.evaluate((el:any)=>document.activeElement===el);expect(focus).toBe(true)
+ const sent=await request.post(manifest.base+`/api/conversations/${seed.conv.id}/messages`,{data:{text:'重点核对预算',attachmentIds:seed.ids,requestId:'another-'+Date.now()}});expect(sent.ok()).toBeTruthy()
+ await expect.poll(async()=>{
+  const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+  return cards.filter((c:any)=>c.task?.executionState==='completed').length
+ }).toBe(2)
+ await expect(composer).toBeFocused();await expect(composer).toHaveValue('正在记录自己的想法')
+ expect(await page.locator('.tab-strip').textContent()).toBe(tabs)
+})
+test('two sourced stages appear while the material task is still running',async({page,request})=>{
+ const seed=await setup(request,'slow-stages',false)
+ await open(page,seed)
+ const cards=async()=>(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+ await expect.poll(async()=>{const card=(await cards()).find((c:any)=>c.task);return card?.task.executionState}).toBe('running')
+ await expect(page.locator('[data-conversation-work]')).toContainText('上线六月')
+ await expect.poll(async()=>{const card=(await cards()).find((c:any)=>c.task);return card?.task.executionState==='running'&&card.task.checkpointSeq>=2&&card.task.findings?.length>1}).toBe(true)
+ await expect(page.locator('[data-conversation-work]')).toContainText('验收条件需要补齐')
+ await expect.poll(async()=>{const card=(await cards()).find((c:any)=>c.task);return card?.task.executionState}).toBe('completed')
+})
+for(const scenario of ['zero-failure','partial-failure'] as const){
+ test(`${scenario} shows the saved scope without a deliverable choice`,async({page,request})=>{
+  const seed=await setup(request,scenario)
+  await waitForFailedWorkCard(request,seed)
+  await page.addInitScript(({id}:{id:string})=>{localStorage.setItem('as.conv',id);localStorage.setItem('as.ui',JSON.stringify({theme:'light',rightCollapsed:true,fontSize:14}))},{id:seed.conv.id})
+  await page.goto('/')
+  const work=page.locator('[data-conversation-work]')
+  await expect(work).toContainText('执行失败')
+  if(scenario==='zero-failure')await expect(work).toContainText('暂无阶段结论记录')
+  else await expect(work).toContainText('上线六月')
+  await expect(page.locator('.work-choice')).toHaveCount(0)
+  await expect(page.locator('.hitl-choice')).toHaveCount(0)
+  await expectOnlySendRun(request,seed)
+ })
+}
+test('completed sourced work offers only its grounded suggestions',async({page,request})=>{
+ const seed=await setup(request,'choice')
+ await open(page,seed)
+ const work=page.locator('[data-conversation-work]')
+ await expect(work.locator('.work-choice')).toHaveCount(3)
+ for(const label of ['会议摘要','验收清单','联调计划'])await expect(work.locator('.work-choice').filter({hasText:label})).toHaveCount(1)
+ await expect(work.locator('.work-decision legend')).toContainText('接下来需要做什么？')
+ await page.reload()
+ await expect(work.locator('.work-choice')).toHaveCount(3)
+})
+test('failed material registration reports no started task or unsupported finding',async({page,request})=>{
+ const seed=await setup(request,'normal',false,{startFailure:true})
+ await page.addInitScript(({id}:{id:string})=>{localStorage.setItem('as.conv',id);localStorage.setItem('as.ui',JSON.stringify({theme:'light',rightCollapsed:true,fontSize:14}))},{id:seed.conv.id})
+ await page.goto('/')
+ await expect(page.getByText(/后台整理未能启动/).first()).toBeVisible()
+ const conversation=await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}`)).json()
+ expect(conversation.messages.some((m:any)=>m.role==='assistant'&&(m.parts??[]).some((p:any)=>p.type==='text'&&p.text?.includes('未能启动')))).toBe(true)
+ const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards
+ expect(cards.filter((c:any)=>c.task)).toHaveLength(0)
+ await expect(page.getByText(/剩余\s*4\s*项.*含\s*3\s*项依赖接口/)).toHaveCount(0)
+})
+test('saturated material slots show queued status without claiming execution',async({page,request})=>{
+ const seed=await setup(request,'queue-hold',false)
+ const sendAnother=async(label:string,hold:boolean)=>{
+  const uploaded=await request.post(manifest.base+`/api/projects/${seed.project.id}/uploads`,{
+   multipart:{file:{name:`${label}.txt`,mimeType:'text/plain',buffer:Buffer.from((hold?'[fixture:queue-hold]\n':'')+'上线六月。验收条件需要补齐。'+label)}}
+  })
+  expect(uploaded.ok()).toBeTruthy()
+  const artifactId=(await uploaded.json()).artifactId
+  const sent=await request.post(manifest.base+`/api/conversations/${seed.conv.id}/messages`,{data:{text:'',attachmentIds:[artifactId],requestId:'queue-'+label}})
+  expect(sent.ok()).toBeTruthy()
+  const runId=(await sent.json()).run.id
+  await expect.poll(async()=> (await(await request.get(manifest.base+`/api/runs/${runId}`)).json()).run.status).toBe('completed')
+ }
+ await sendAnother('占用二',true)
+ await sendAnother('占用三',true)
+ await sendAnother('等待四',false)
+ await page.addInitScript(({id}:{id:string})=>{localStorage.setItem('as.conv',id);localStorage.setItem('as.ui',JSON.stringify({theme:'light',rightCollapsed:true,fontSize:14}))},{id:seed.conv.id})
+ await page.goto('/')
+ await expect(page.locator('[data-conversation-work]')).toContainText('排队中')
+ await expect(page.getByText(/整理任务正在排队.*待确认/).first()).toBeVisible()
+ const cards=(await(await request.get(manifest.base+`/api/conversations/${seed.conv.id}/cards`)).json()).cards.filter((c:any)=>c.task)
+ expect(cards).toHaveLength(4)
+ expect(cards.filter((c:any)=>c.task.executionState==='queued')).toHaveLength(1)
+ await expect(page.getByText(/剩余\s*4\s*项.*含\s*3\s*项依赖接口/)).toHaveCount(0)
+})

knip-baseline.json

@@ -1,3 +1,3 @@
 {
-  "exports": 51
+  "exports": 58
 }

src/accountAuthority.ts

@@ -0,0 +1,38 @@
+// 账号管理动作呈现门控（超级管理员 R3/R4/R8）：只决定 UI 暴露哪些入口，
+// 服务端授权仍是唯一权威——隐藏的入口经直连 API 调用同样会被拒绝。
+interface AccountIdentity { isAdmin?: boolean; isSuperAdmin?: boolean }
+
+type AccountIdentityKind = 'super' | 'admin' | 'user'
+
+export const accountIdentityKind = (account: AccountIdentity): AccountIdentityKind =>
+  account.isSuperAdmin ? 'super' : account.isAdmin ? 'admin' : 'user'
+
+/** 创建管理员账号与任命/撤销管理员仅对超级管理员开放。 */
+export const canAppointAdmins = (me: AccountIdentity | null | undefined) => !!me?.isSuperAdmin
+
+interface AccountActionPolicy {
+  /** 资料、角色与系统权限维护。 */
+  maintain: boolean
+  toggleEnabled: boolean
+  /** 管理员重置临时密码与恢复提案。 */
+  resetPassword: boolean
+  adminChange: 'promote' | 'demote' | null
+  protectedReason: string
+}
+
+export function accountActionPolicy(me: AccountIdentity | null | undefined, target: AccountIdentity): AccountActionPolicy {
+  if (target.isSuperAdmin) {
+    const self = !!me?.isSuperAdmin
+    return {
+      maintain: self, toggleEnabled: false, resetPassword: false, adminChange: null,
+      protectedReason: self
+        ? '超级管理员账号不能停用、降级或由管理员重置密码；本人密码请在「设置 → 账号」修改'
+        : '超级管理员账号受保护：普通管理员不能编辑、停用、降级或重置其密码',
+    }
+  }
+  return {
+    maintain: true, toggleEnabled: true, resetPassword: true,
+    adminChange: canAppointAdmins(me) ? (target.isAdmin ? 'demote' : 'promote') : null,
+    protectedReason: '',
+  }
+}

src/api.ts

@@ -1,7 +1,7 @@
 // API 客户端（API-first：UI 只是第一个客户端）与 SSE 流客户端（游标重放 + 终态对账）。
 // 认证：服务端开启 API key 时经 auth.fetch/withKey 注入凭证（嵌入式档无认证则透传）。
 import { auth } from './auth'
-import { commandRequestBody, rdmCommandProjectId, rdmProjectCommandError, type CommandSource } from './rdmManagement'
+import { ConfirmCardPending, commandRequestBody, rdmCommandProjectId, rdmProjectCommandError, type CommandSource } from './rdmManagement'
 import type {
   Project, Conversation, Message, Run, Artifact, HITLCard, HITLResponse,
   AgentProfile, SettingDesc, StreamEvent, StreamEventType, PlanSnapshot, TodoList, UploadInfo, PromptModule,
@@ -14,26 +14,8 @@ const BASE = ''
  *  Registry.AddAdminZone 声明；入口不做前端权限合并，区内数据能力由组件
  *  自身命令面 fail-closed。 */
 export interface AdminZoneSection { id: string; title: string; icon?: string; desc?: string; order?: number }
-/** category：角色矩阵业务分类（项目与协作/文档工作/项目内容）；受保护系统授权为空。 */
-export interface PermissionDescriptor { actionId: string; label: string; description: string; group: string; category?: string; scope: 'system' | 'project'; protected: boolean }
+export interface PermissionDescriptor { actionId: string; label: string; description: string; group: string; scope: 'system' | 'project'; protected: boolean }
 export interface RolePermissionRecord { actionId: string; allowed: boolean; capAllowed: boolean; permissionVersion: number }
-export interface RolePermissionChangeInput { actionId: string; allowed: boolean; capAllowed: boolean }
-/** changes 为显式 patch：只含相对基线变化的动作，服务端合并保留未提及行。 */
-export interface RolePermissionPatchEntry { roleId: string; expectedRoleVersion: number; changes: RolePermissionChangeInput[] }
-/** 预览模式：缺省为服务端默认 replace；显式 patch 提交须以 patch 预览。 */
-export type RolePermissionPreviewMode = 'replace' | 'patch'
-/** before/after 为中文状态名：不允许/按项目授权/默认允许。 */
-export interface RolePermissionStateChange { actionId: string; label: string; before: string; after: string }
-export interface RolePermissionPreview {
-  roleId: string; roleName: string; expectedRoleVersion: number; currentRoleVersion: number; versionMatches: boolean
-  changes: RolePermissionStateChange[]; linkedExpansion: string[]; linkedExpansionState?: string; keptLinkedActions: string[]
-  migrationNote?: string; conflicts: { actionId: string; reason: string }[]; error?: string; errorActionId?: string
-}
-export interface RolePermissionBatchReceipt {
-  roleId: string; previousRoleVersion: number; roleVersion: number; linkedExpansion?: string[]; keptLinkedActions: string[]
-  migrationNote?: string; changes: RolePermissionStateChange[]
-}
-export interface RolePermissionBatchResult { receiptId: string; authorityEpoch: number; receipts: RolePermissionBatchReceipt[] }
 export interface RoleRecord {
   roleId: string; name: string; description: string; enabled: boolean; roleVersion: number
   bindingCount: number; permissions: RolePermissionRecord[]
@@ -50,9 +32,6 @@ export interface UserRoleView { binding?: UserRoleBinding; role?: RoleRecord }
  * current_required 必须校验当前密码。 */
 export type PasswordChangeMode = 'grant_setup' | 'current_required'
 
-/** /api/me 联动资格（L1 联动后由服务端给出；旧服务无此字段）。actions/conflicts 为动作 id。 */
-export interface LinkedCapabilities { projectCreate: boolean; source?: string; actions: string[]; conflicts?: string[] }
-
 /** 恢复提案（属主确认制）：管理员只能提案，确认须用提案前已存在的合格完整密码会话。 */
 export interface RecoveryProposal {
   id: string; userId: string; owner: string
@@ -65,37 +44,15 @@ export interface RecoveryProposal {
 export interface AccountProfile { name: string; phone: string; email: string; staffNo: string; department: string; notes: string }
 export interface AccountRecord {
   userId: string; owner: string; profile: AccountProfile; profileVersion: number
-  enabled?: boolean; stateVersion?: number; isAdmin?: boolean; passwordSet?: boolean
+  enabled?: boolean; stateVersion?: number; isAdmin?: boolean; isSuperAdmin?: boolean; passwordSet?: boolean
   initializationState?: string; initializationGeneration?: number; createdAt?: string
 }
-/** 用户目录角色投影：actor 具备 system.roles.view 时返回（无绑定为 null）；无查看权时字段缺省。 */
-export interface AccountRoleSummary { roleId: string; name: string; enabled: boolean }
 /** 管理端用户目录/详情视图：账号状态与版本字段必有（乐观并发依赖 stateVersion）。 */
 export interface ManagedAccountRecord extends AccountRecord {
-  enabled: boolean; stateVersion: number; isAdmin: boolean; passwordSet: boolean
+  enabled: boolean; stateVersion: number; isAdmin: boolean; isSuperAdmin: boolean; passwordSet: boolean
   initializationState: string; initializationGeneration: number
-  role?: AccountRoleSummary | null
 }
 interface AccountSearchPage { accounts: ManagedAccountRecord[]; nextCursor?: string; directoryVersion: string }
-/** 批量角色分配条目：一切以 userId/roleId 为稳定标识。 */
-export interface UserRoleAssignmentInput { userId: string; roleId: string; expectedStateVersion: number }
-/** error 为服务端中文原因（停用/版本变化/角色无效）；任何一项有 error 或 stateMatches=false 都不得提交。 */
-export interface UserRoleAssignmentPreview {
-  userId: string; owner: string; name: string; currentRoleId: string; currentRoleName: string
-  targetRoleId: string; targetRoleName: string; stateMatches: boolean; error?: string
-}
-interface UserRoleAssignmentResult { userId: string; bindingId: string; roleId: string; previousRoleId: string; userStateVersion: number }
-interface UserRoleAssignmentBatch { receiptId?: string; authorityEpoch?: number; bindings: UserRoleAssignmentResult[] }
-export interface RoleMember {
-  userId: string; owner: string; name: string; enabled: boolean; stateVersion: number; assignedAt: string; bindingVersion: number
-}
-interface RoleMemberPage { members: RoleMember[]; nextCursor?: string }
-/** 复制角色并分配：新角色尚不存在，分配条目只带 userId 与状态版本（服务端严格拒绝未知字段）。 */
-export interface RoleCopyAssignRequest {
-  idempotencyKey: string; source: { roleId: string; expectedRoleVersion: number }; name: string; description: string
-  overrides?: RolePermissionChangeInput[]; assignments: { userId: string; expectedStateVersion: number }[]
-}
-interface RoleCopyAssignResult { receiptId?: string; authorityEpoch?: number; role: RoleRecord; bindings: UserRoleAssignmentResult[] }
 
 export interface ExecEnvView {
   configured: boolean
@@ -140,35 +97,13 @@ export const api = {
 	patchRole: (roleId: string, expectedRoleVersion: number, patch: { name?: string; description?: string; enabled?: boolean }) =>
 	  auth.fetch(`${BASE}/api/admin/roles/${encodeURIComponent(roleId)}`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' },
 	    body: JSON.stringify({ expectedRoleVersion, ...patch }) }).then(r => json<RoleRecord>(r)),
-	previewRolePermissions: (roles: RolePermissionPatchEntry[], options: { mode?: RolePermissionPreviewMode } = {}) =>
-	  auth.fetch(`${BASE}/api/admin/roles/permissions/preview`, { method: 'POST', headers: { 'Content-Type': 'application/json' },
-	    body: JSON.stringify({ roles: options.mode ? roles.map(role => ({ ...role, mode: options.mode })) : roles }) }).then(r => json<{ previews: RolePermissionPreview[] }>(r)).then(d => d.previews ?? []),
-	batchPatchRolePermissions: (roles: RolePermissionPatchEntry[], idempotencyKey: string) =>
-	  auth.fetch(`${BASE}/api/admin/roles/permissions/batch`, { method: 'POST', headers: { 'Content-Type': 'application/json' },
-	    body: JSON.stringify({ idempotencyKey, roles }) }).then(r => json<RolePermissionBatchResult>(r)),
+	replaceRolePermissions: (roleId: string, expectedRoleVersion: number, changes: { actionId: string; allowed: boolean; capAllowed: boolean }[], idempotencyKey: string) =>
+	  auth.fetch(`${BASE}/api/admin/roles/${encodeURIComponent(roleId)}/permissions`, { method: 'PUT', headers: { 'Content-Type': 'application/json' },
+	    body: JSON.stringify({ expectedRoleVersion, changes, idempotencyKey }) }).then(r => json<{ receiptId: string; roleVersion: number; authorityEpoch: number }>(r)),
 	getUserRole: (userId: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/role`).then(r => json<UserRoleView>(r)),
 	assignUserRole: (userId: string, roleId: string, expectedStateVersion: number, idempotencyKey: string) =>
 	  auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/role`, { method: 'PUT', headers: { 'Content-Type': 'application/json' },
 	    body: JSON.stringify({ roleId, expectedStateVersion, idempotencyKey }) }).then(r => json<UserRoleBinding>(r)),
-	previewUserRoleAssignments: (assignments: UserRoleAssignmentInput[]) =>
-	  auth.fetch(`${BASE}/api/admin/users/role-assignments/preview`, { method: 'POST', headers: { 'Content-Type': 'application/json' },
-	    body: JSON.stringify({ assignments }) }).then(r => json<{ previews: UserRoleAssignmentPreview[] }>(r)).then(d => d.previews ?? []),
-	assignUserRolesBatch: (assignments: UserRoleAssignmentInput[], idempotencyKey: string) =>
-	  auth.fetch(`${BASE}/api/admin/users/role-assignments`, { method: 'POST', headers: { 'Content-Type': 'application/json' },
-	    body: JSON.stringify({ idempotencyKey, assignments }) }).then(r => json<UserRoleAssignmentBatch>(r)),
-	listRoleMembers: (roleId: string, request: { query?: string; mode?: 'exact' | 'fuzzy'; status?: 'all' | 'enabled' | 'disabled'; cursor?: string; limit?: number } = {}) => {
-	  const params = new URLSearchParams()
-	  if (request.query) params.set('query', request.query)
-	  if (request.mode) params.set('mode', request.mode)
-	  if (request.status) params.set('status', request.status)
-	  if (request.cursor) params.set('cursor', request.cursor)
-	  if (request.limit) params.set('limit', String(request.limit))
-	  const query = params.toString()
-	  return auth.fetch(`${BASE}/api/admin/roles/${encodeURIComponent(roleId)}/members${query ? `?${query}` : ''}`).then(r => json<RoleMemberPage>(r))
-	},
-	createRoleCopyAndAssign: (request: RoleCopyAssignRequest) =>
-	  auth.fetch(`${BASE}/api/admin/roles/copy-assign`, { method: 'POST', headers: { 'Content-Type': 'application/json' },
-	    body: JSON.stringify(request) }).then(r => json<RoleCopyAssignResult>(r)),
 	getSystemGrants: (userId: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/system-grants`).then(r => json<{ actions: string[]; authorityEpoch: number }>(r)),
 	replaceSystemGrants: (userId: string, actions: string[], expectedAuthorityEpoch: number, idempotencyKey: string) =>
 	  auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/system-grants`, { method: 'PUT', headers: { 'Content-Type': 'application/json' },
@@ -193,11 +128,11 @@ export const api = {
   projectSurfaces: (projectId: string) => auth.fetch(`${BASE}/api/projects/${projectId}/surfaces`).then(r => json<SurfaceMeta[]>(r)),
   /** 单页权威快照（含 identity + spec），供列表水合与预览渲染。 */
   surfaceGet: (id: string) => auth.fetch(`${BASE}/api/surfaces/${id}`).then(r => json<SurfaceSnapshot>(r)),
-  me: () => auth.fetch(`${BASE}/api/me`).then(r => json<{ owner: string; name: string; auth: boolean; authVia?: string; sessionScope?: string; passwordChangeMode?: PasswordChangeMode; isAdmin?: boolean; mustChangePassword?: boolean; passwordSet?: boolean; systemActions?: string[]; linkedCapabilities?: LinkedCapabilities }>(r)),
+  me: () => auth.fetch(`${BASE}/api/me`).then(r => json<{ owner: string; name: string; auth: boolean; authVia?: string; sessionScope?: string; passwordChangeMode?: PasswordChangeMode; isAdmin?: boolean; isSuperAdmin?: boolean; mustChangePassword?: boolean; passwordSet?: boolean; systemActions?: string[] }>(r)),
   // ---- 认证与会话（管理员发放制，R2）----
   login: (owner: string, password: string) => auth.fetch(`${BASE}/api/auth/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, password }) }).then(async r => {
     if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
-    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string; passwordChangeMode?: PasswordChangeMode }
+    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; isSuperAdmin?: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string; passwordChangeMode?: PasswordChangeMode }
     auth.beginSession()
     return me
   }),
@@ -205,7 +140,7 @@ export const api = {
   // 成功建立 set_password_only 受限会话（HttpOnly cookie），明文 Key 不落任何存储。
   redeemLoginKey: (key: string) => auth.fetch(`${BASE}/api/auth/recovery-grants/redeem`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ key }) }).then(async r => {
     if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
-    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string; passwordChangeMode?: PasswordChangeMode }
+    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; isSuperAdmin?: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string; passwordChangeMode?: PasswordChangeMode }
     auth.beginSession()
     return me
   }),
@@ -216,11 +151,12 @@ export const api = {
   },
   changePassword: (current: string, next: string) => auth.fetch(`${BASE}/api/auth/password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ current, next }) }).then(async r => {
     if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
-    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; reloginRequired: boolean }>
+    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; isSuperAdmin?: boolean; mustChangePassword: boolean; reloginRequired: boolean }>
   }),
-  listAdminUsers: () => auth.fetch(`${BASE}/api/admin/users`).then(r => json<{ userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number; profileVersion: number; initializationState: string }[]>(r)),
+  listAdminUsers: () => auth.fetch(`${BASE}/api/admin/users`).then(r => json<{ userId: string; owner: string; name: string; isAdmin: boolean; isSuperAdmin?: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number; profileVersion: number; initializationState: string }[]>(r)),
   // 管理员建号：可提供初始密码；省略密码时由服务端生成并仅返回一次。
-  createAdminUser: (owner: string, name: string, password?: string) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile: { name }, ...(password ? { password } : {}) }) }).then(r => json<{ userId: string; owner: string; passwordSet: boolean; mustChangePassword: boolean; initializationState: string; initialPassword?: string }>(r)),
+  // isAdmin 仅超级管理员可用（R3/R4），普通管理员携带时由服务端拒绝。
+  createAdminUser: (owner: string, name: string, password?: string, isAdmin?: boolean) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile: { name }, ...(password ? { password } : {}), ...(isAdmin ? { isAdmin: true } : {}) }) }).then(r => json<{ userId: string; owner: string; passwordSet: boolean; mustChangePassword: boolean; initializationState: string; initialPassword?: string }>(r)),
   adminResetUserPassword: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }).then(r => json<{ owner: string; temporaryPassword: string; mustChangePassword: boolean }>(r)),
   searchAdminUsers: (request: { query: string; mode: 'exact' | 'fuzzy'; status: 'all' | 'enabled' | 'disabled'; fields: string[]; cursor?: string; limit?: number }) => {
     const params = new URLSearchParams({ query: request.query, mode: request.mode, status: request.status,
@@ -228,10 +164,12 @@ export const api = {
     if (request.cursor) params.set('cursor', request.cursor)
     return auth.fetch(`${BASE}/api/admin/users/search?${params}`).then(r => json<AccountSearchPage>(r))
   },
-  createManagedUser: (owner: string, profile: Partial<AccountProfile>) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile }) }).then(r => json<ManagedAccountRecord>(r)),
+  createManagedUser: (owner: string, profile: Partial<AccountProfile>, isAdmin?: boolean) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile, ...(isAdmin ? { isAdmin: true } : {}) }) }).then(r => json<ManagedAccountRecord>(r)),
   adminGetUser: (userId: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}`).then(r => json<ManagedAccountRecord>(r)),
   adminPatchProfile: (userId: string, expectedProfileVersion: number, patch: Partial<AccountProfile>) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/profile`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedProfileVersion, patch }) }).then(r => json<ManagedAccountRecord>(r)),
   adminSetUserEnabled: (userId: string, expectedStateVersion: number, enabled: boolean) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/state`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedStateVersion, enabled }) }).then(r => json<ManagedAccountRecord>(r)),
+  // 任命/撤销管理员：仅超级管理员（R3）；超级管理员本身不可降级（R5）。
+  adminSetUserAdmin: (userId: string, expectedStateVersion: number, isAdmin: boolean) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/admin`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedStateVersion, isAdmin }) }).then(r => json<ManagedAccountRecord>(r)),
   // ---- 管理员：一次性登录 Key（HTTP 签发端点已被恢复提案契约替换为 410，客户端方法随之移除；
   // list/revoke 仍有效，供恢复提案视图复用；兑换入口不变）----
   adminListLoginKeys: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/login-keys`).then(r => json<{ keys: { id: string; owner: string; purpose: string; status: string; expiresAt: string; createdAt: string; createdBy?: string }[] }>(r)).then(d => d.keys ?? []),
@@ -283,6 +221,8 @@ export const api = {
     auth.fetch(`${BASE}/api/hitl/${cardId}/resolve`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(resp) })
       .then(r => json<{ resolved: boolean; pivoted: boolean; pivotText: string }>(r)),
 
+  taskSource: (cardId:string,sourceId:string) => auth.fetch(`${BASE}/api/cards/${encodeURIComponent(cardId)}/sources/${encodeURIComponent(sourceId)}`).then(r=>json<{source:import('./contracts').TaskSourceRef;versionState:string;artifact?:Artifact}>(r)),
+  listCardsSnapshot: (conversationId: string): Promise<{cards: ActivityCard[]; replaySeq?: number}> => auth.fetch(`${BASE}/api/conversations/${conversationId}/cards`).then(r => json<{cards: ActivityCard[]; replaySeq?: number}>(r)),
   listCards: (conversationId: string) =>
     auth.fetch(`${BASE}/api/conversations/${conversationId}/cards`).then(r => json<{ cards: ActivityCard[] }>(r)).then(d => d.cards ?? []),
   cardAction: (cardId: string, actionId: string, payload?: string | WorkCardAction) =>
@@ -352,10 +292,10 @@ export const api = {
 
   // ---- U4：RDM 命令总线封装（POST /api/commands/{id}，同 RDM web 的 command 路由） ----
   // receipt 解包：rejected 抛错；confirm-card 抛提示（审计面只读命令不应触发）。
-  rdmProjectCommand: async <T = any>(project: Project, id: string, params: Record<string, unknown> = {}): Promise<T> => {
+  rdmProjectCommand: async <T = any>(project: Project, id: string, params: Record<string, unknown> = {}, source?: CommandSource): Promise<T> => {
     const error = rdmProjectCommandError(project, id)
     if (error) throw new Error(error)
-    return api.rdmCommand<T>(id, { ...params, projectId: rdmCommandProjectId(project) })
+    return api.rdmCommand<T>(id, { ...params, projectId: rdmCommandProjectId(project) }, source)
   },
   rdmCommand: <T = any>(id: string, params: Record<string, unknown> = {}, source?: CommandSource): Promise<T> =>
     auth.fetch(`${BASE}/api/commands/${encodeURIComponent(id)}`, {
@@ -365,7 +305,7 @@ export const api = {
       .then(out => {
         const envelope = out as { receipt?: { state?: string; error?: string; message?: string }; card?: unknown; payload?: T }
         if (envelope?.receipt?.state === 'rejected') throw new Error(envelope.receipt.error || envelope.receipt.message || '命令被拒绝')
-        if (envelope?.card) throw new Error('高危命令已生成确认卡——请在对话中确认执行')
+        if (envelope?.card) throw new ConfirmCardPending(String((envelope.card as { id?: unknown }).id ?? ''))
         if (envelope && envelope.payload !== undefined) return envelope.payload
         return out as T
       }),

src/components/AccountUsersPanel.tsx

@@ -1,19 +1,13 @@
 import { useEffect, useRef, useState } from 'react'
 import {
-  api, type AccountProfile, type ManagedAccountRecord, type PermissionDescriptor, type RoleRecord, type UserRoleAssignmentPreview, type UserRoleView,
+  api, type AccountProfile, type ManagedAccountRecord, type PermissionDescriptor, type RoleRecord, type UserRoleView,
 } from '../api'
 import { useStore } from '../store'
 import { Collapsible, Icon } from '@ui'
-import { cellKind, hasSystemAction } from './RolePermissionsPanel'
-import {
-  ROLE_PERMISSION_STATES, categoryActions, permissionCategories, stateToValue, valueToState,
-  type RolePermissionStateName, type RolePermissionValue,
-} from '../rolePermissions'
-import {
-  accountLabel, accountName, clearSelection, copyAssignRequest, createSelection, duplicateNames, isSelected, memberAssignments,
-  pageSelectionState, previewAllowsAssign, previewTransition, refreshStateVersions, roleColumnLabel, roleSourceValues, sameNameHint,
-  selectPage, selectionCounts, selectionSummary, staleUserIds, toggleOne, type MemberSelection,
-} from '../roleMembers'
+import { hasSystemAction } from './RolePermissionsPanel'
+import { accountActionPolicy, accountIdentityKind, canAppointAdmins } from '../accountAuthority'
+
+type IdentityFlags = { isAdmin?: boolean; isSuperAdmin?: boolean }
 
 const emptyProfile = (): AccountProfile => ({ name: '', phone: '', email: '', staffNo: '', department: '', notes: '' })
 const fields: { key: keyof AccountProfile; label: string }[] = [
@@ -32,6 +26,25 @@ function ProfileInputs({ profile, onChange, prefix }: { profile: AccountProfile;
   </div>)}</div>
 }
 
+export function IdentityChip({ account }: { account: IdentityFlags }) {
+  const kind = accountIdentityKind(account)
+  if (kind === 'super') return <span className="ad-chip ad-chip-super">超级管理员</span>
+  if (kind === 'admin') return <span className="ad-chip ad-chip-admin">管理员</span>
+  return <span className="ad-chip">普通用户</span>
+}
+
+export function CreateAdminOption({ me, checked, disabled, onChange }: { me: IdentityFlags | null; checked: boolean; disabled: boolean; onChange: (value: boolean) => void }) {
+  if (!canAppointAdmins(me)) return <p className="ad-hint">仅超级管理员可创建或任命管理员；此处创建普通账号</p>
+  return <label className="ad-check"><input type="checkbox" checked={checked} disabled={disabled}
+    onChange={event => onChange(event.target.checked)} />创建为管理员账号</label>
+}
+
+export function AdminAppointmentButton({ me, account, busy, onChange }: { me: IdentityFlags | null; account: IdentityFlags; busy: boolean; onChange: (isAdmin: boolean) => void }) {
+  const change = accountActionPolicy(me, account).adminChange
+  if (!change) return null
+  return <button className="ad-mini" disabled={busy} onClick={() => onChange(change === 'promote')}>{change === 'promote' ? '设为管理员' : '撤销管理员'}</button>
+}
+
 export function AccountUsersPanel() {
   const me = useStore(state => state.me)
   const allowed = (action: string) => !!me?.isAdmin || hasSystemAction(me?.systemActions, action)
@@ -39,20 +52,9 @@ export function AccountUsersPanel() {
   const canAssignRoles = canViewRoles && allowed('system.roles.assign')
   const canViewGrants = allowed('system.permissions.view')
   const canManageGrants = canViewGrants && allowed('system.permissions.manage')
-  const canCopyRole = canAssignRoles && canManageGrants && allowed('system.roles.manage')
   const [accounts, setAccounts] = useState<ManagedAccountRecord[] | null>(null)
-  const [selection, setSelection] = useState<MemberSelection>(createSelection)
-  const [known, setKnown] = useState<Record<string, ManagedAccountRecord>>({})
-  const [batchOpen, setBatchOpen] = useState(false)
-  const [batchRoleId, setBatchRoleId] = useState('')
-  const [batchPreview, setBatchPreview] = useState<UserRoleAssignmentPreview[] | null>(null)
-  const [copyName, setCopyName] = useState('')
-  const [copyDescription, setCopyDescription] = useState('')
-  const [copyValues, setCopyValues] = useState<Record<string, RolePermissionValue>>({})
   const [selected, setSelected] = useState<ManagedAccountRecord | null>(null)
   const [roleView, setRoleView] = useState<UserRoleView | null>(null)
-  const [fullSourceRole, setFullSourceRole] = useState<RoleRecord | null>(null)
-  const [sourceRoleError, setSourceRoleError] = useState('')
   const [roles, setRoles] = useState<RoleRecord[]>([])
   const [roleQuery, setRoleQuery] = useState('')
   const [roleCursor, setRoleCursor] = useState('')
@@ -65,6 +67,7 @@ export function AccountUsersPanel() {
   const [draft, setDraft] = useState<AccountProfile>(emptyProfile)
   const [newOwner, setNewOwner] = useState('')
   const [newProfile, setNewProfile] = useState<AccountProfile>(emptyProfile)
+  const [newIsAdmin, setNewIsAdmin] = useState(false)
   const [query, setQuery] = useState('')
   const [mode, setMode] = useState<'exact' | 'fuzzy'>('fuzzy')
   const [field, setField] = useState('default')
@@ -78,13 +81,6 @@ export function AccountUsersPanel() {
   const [err, setErr] = useState('')
   const sequence = useRef(0)
   const roleSequence = useRef(0)
-  const batchSequence = useRef(0)
-  const pageIds = (accounts ?? []).map(account => account.userId)
-  const pageState = pageSelectionState(selection, pageIds)
-  const counts = selectionCounts(selection, pageIds)
-  const duplicates = duplicateNames(accounts ?? [])
-  const batchReady = !!batchPreview && previewAllowsAssign(batchPreview, selection.ids)
-  const batchStale = batchPreview ? staleUserIds(batchPreview) : []
 
   const search = async (pageCursor = cursor, afterWrite = false) => {
     const request = ++sequence.current
@@ -93,7 +89,6 @@ export function AccountUsersPanel() {
         fields: field === 'default' ? ['owner', 'name', 'userId'] : [field], cursor: pageCursor, limit: 20 })
       if (request !== sequence.current) return
       setAccounts(page.accounts ?? []); setNextCursor(page.nextCursor ?? '')
-      setKnown(current => ({ ...current, ...Object.fromEntries((page.accounts ?? []).map(account => [account.userId, account])) }))
     } catch (error) {
       if (request === sequence.current) setErr(afterWrite ? `操作已完成，但用户列表暂未刷新：${String(error)}` : String(error))
     }
@@ -110,7 +105,6 @@ export function AccountUsersPanel() {
     roleSequence.current++
     setRoleQuery(''); setRoleCursor(''); setRoleTrail([]); setNextRoleCursor(''); setRoleLoading(false)
     setSelected(null); setRoleView(null); setErr(''); setNotice('')
-    setCopyName(''); setCopyDescription(''); setCopyValues({}); setFullSourceRole(null); setSourceRoleError('')
     const detailResult = await Promise.allSettled([api.adminGetUser(account.userId)])
     if (request !== sequence.current) return
     if (detailResult[0].status === 'rejected') { setErr(String(detailResult[0].reason)); return }
@@ -125,13 +119,6 @@ export function AccountUsersPanel() {
     if (roleResult.status === 'fulfilled' && roleResult.value) {
       const currentRole = roleResult.value as UserRoleView
       setRoleView(currentRole); setSelectedRoleId(currentRole.role?.roleId ?? '')
-      if (canCopyRole && currentRole.role) {
-        void api.getRole(currentRole.role.roleId).then(role => {
-          if (request !== sequence.current) return
-          if (Array.isArray(role?.permissions)) setFullSourceRole(role)
-          else setSourceRoleError('源角色权限读取不完整，暂不能复制，请重新打开用户')
-        }).catch(error => { if (request === sequence.current) setSourceRoleError(`读取源角色权限失败：${String(error)}`) })
-      }
     } else { setRoleView(null); setSelectedRoleId('') }
     if (catalogResult.status === 'fulfilled' && catalogResult.value) setCatalog(catalogResult.value)
     else setCatalog([])
@@ -141,7 +128,7 @@ export function AccountUsersPanel() {
   }
 
   useEffect(() => {
-    if ((!selected && !batchOpen) || !canViewRoles) { setRoles([]); setRoleLoading(false); return }
+    if (!selected || !canViewRoles) { setRoles([]); setRoleLoading(false); return }
     const request = ++roleSequence.current
     setRoleLoading(true); setNextRoleCursor('')
     const timer = window.setTimeout(() => {
@@ -153,7 +140,7 @@ export function AccountUsersPanel() {
         .catch(error => { if (request === roleSequence.current) { setErr(String(error)); setRoleLoading(false) } })
     }, 180)
     return () => { window.clearTimeout(timer) }
-  }, [selected?.userId, batchOpen, roleQuery, roleCursor, canViewRoles])
+  }, [selected?.userId, roleQuery, roleCursor, canViewRoles])
 
   // 写入成功会推进目录版本，旧页游标随之失效：从第一页重读，刷新失败不改写成功结果。
   const refreshFirst = async () => {
@@ -165,10 +152,10 @@ export function AccountUsersPanel() {
     if (!newOwner.trim()) return
     setBusy(true); setErr(''); setNotice('')
     try {
-      const account = await api.createManagedUser(newOwner.trim(), newProfile)
-      setNewOwner(''); setNewProfile(emptyProfile())
+      const account = await api.createManagedUser(newOwner.trim(), newProfile, canAppointAdmins(me) && newIsAdmin)
+      setNewOwner(''); setNewProfile(emptyProfile()); setNewIsAdmin(false)
       await open(account)
-      setNotice(`已创建 ${account.owner}；账号资料可空，角色另行分配`)
+      setNotice(`已创建 ${account.owner}${account.isAdmin ? '（管理员）' : ''}；账号资料可空，角色另行分配`)
       await refreshFirst()
     } catch (error) { setErr(String(error).includes('409') ? '登录名已存在' : String(error)) }
     finally { setBusy(false) }
@@ -218,194 +205,59 @@ export function AccountUsersPanel() {
     finally { setBusy(false) }
   }
 
-  // 选择集合一旦变化，旧预览不再对应提交集合，必须重新预览。
-  const changeSelection = (next: MemberSelection) => {
-    batchSequence.current++
-    setSelection(next); setBatchPreview(null)
-  }
-
-  const openBatch = () => {
-    roleSequence.current++
-    setRoleQuery(''); setRoleCursor(''); setRoleTrail([]); setNextRoleCursor('')
-    setBatchRoleId(''); setBatchPreview(null); setBatchOpen(true); setErr(''); setNotice('')
-  }
-
-  const closeBatch = () => {
-    batchSequence.current++
-    setBatchOpen(false); setBatchRoleId(''); setBatchPreview(null)
-  }
-
-  const previewBatch = async (roleId: string, versions = known) => {
-    const request = ++batchSequence.current
-    setBatchRoleId(roleId); setBatchPreview(null); setErr(''); setNotice('')
-    if (!roleId) return
-    setBusy(true)
+  const setAdmin = async (isAdmin: boolean) => {
+    if (!selected) return
+    setBusy(true); setErr(''); setNotice('')
     try {
-      const assignments = memberAssignments(selection.ids, roleId,
-        Object.fromEntries(Object.values(versions).map(account => [account.userId, account.stateVersion])))
-      const previews = await api.previewUserRoleAssignments(assignments)
-      if (request === batchSequence.current) setBatchPreview(previews)
-    } catch (error) { if (request === batchSequence.current) setErr(error instanceof Error ? error.message : String(error)) }
+      const updated = await api.adminSetUserAdmin(selected.userId, selected.stateVersion, isAdmin)
+      setSelected(updated); await refreshFirst(); setNotice(isAdmin ? '已任命为管理员' : '已撤销管理员')
+    } catch (error) { setErr(String(error).includes('409') ? '用户状态已变化，请重新打开用户' : String(error)) }
     finally { setBusy(false) }
   }
 
-  const refreshBatchVersions = async () => {
-    if (!batchPreview) return
-    setBusy(true); setErr('')
-    try {
-      const fresh = { ...known, ...await refreshStateVersions(api, staleUserIds(batchPreview)) }
-      setKnown(fresh)
-      await previewBatch(batchRoleId, fresh)
-    } catch (error) { setErr(String(error)); setBusy(false) }
-  }
-
-  const confirmBatch = async () => {
-    if (!batchPreview || !previewAllowsAssign(batchPreview, selection.ids)) return
-    const roleName = batchPreview[0]?.targetRoleName ?? ''
-    setBusy(true); setErr(''); setNotice('')
-    try {
-      const assignments = memberAssignments(selection.ids, batchRoleId,
-        Object.fromEntries(Object.values(known).map(account => [account.userId, account.stateVersion])))
-      const result = await api.assignUserRolesBatch(assignments, crypto.randomUUID())
-      changeSelection(clearSelection()); closeBatch()
-      await refreshFirst()
-      setNotice(`已为 ${result.bindings?.length ?? assignments.length} 人分配角色「${roleName}」`)
-    } catch (error) {
-      setBatchPreview(null)
-      setErr(String(error).includes('409') ? '部分用户状态或目标角色已变化，整批均未写入；选择已保留，请重新预览后再确认' : `整批均未写入：${String(error)}`)
-    } finally { setBusy(false) }
-  }
-
-  const copyAndAssign = async () => {
-    const source = fullSourceRole
-    if (!selected || !source) return
-    setErr(''); setNotice('')
-    let request
-    try {
-      request = copyAssignRequest({ idempotencyKey: crypto.randomUUID(), source, name: copyName, description: copyDescription, catalog,
-        values: { ...roleSourceValues(source, catalog), ...copyValues }, users: [{ userId: selected.userId, stateVersion: selected.stateVersion }] })
-    } catch (error) { setErr(error instanceof Error ? error.message : String(error)); return }
-    setBusy(true)
-    try {
-      const result = await api.createRoleCopyAndAssign(request)
-      await open(selected); await refreshFirst()
-      setNotice(`已创建新角色「${result.role.name}」并分配给 ${accountLabel(selected)}；新角色独立维护，不再随原角色「${source.name}」更新`)
-    } catch (error) {
-      setErr(String(error).includes('409') ? '新角色名称已存在，或源角色/用户状态已变化；草稿已保留，请重新打开用户核对后重试' : String(error))
-    } finally { setBusy(false) }
-  }
-
-  const roleSearch = () => <div className="ad-row">
-    <input className="lg-input" aria-label="搜索可分配角色" placeholder="搜索有效角色" value={roleQuery}
-      onChange={event => { setRoleQuery(event.target.value); setRoleCursor(''); setRoleTrail([]); setNextRoleCursor(''); setRoleLoading(true) }} />
-    <button className="ad-mini" disabled={roleLoading || !roleTrail.length} onClick={() => { setRoleCursor(roleTrail[roleTrail.length - 1]); setRoleTrail(roleTrail.slice(0, -1)) }}>上一页角色</button>
-    <button className="ad-mini" disabled={roleLoading || !nextRoleCursor} onClick={() => { setRoleTrail([...roleTrail, roleCursor]); setRoleCursor(nextRoleCursor) }}>下一页角色</button>
-  </div>
-
-  const copyForm = (source: RoleRecord) => {
-    const baseline = roleSourceValues(source, catalog)
-    const valueOf = (actionId: string) => copyValues[actionId] ?? baseline[actionId]
-    const adjusted = Object.keys(baseline).filter(actionId => {
-      const value = valueOf(actionId)
-      return value.allowed !== baseline[actionId].allowed || value.capAllowed !== baseline[actionId].capAllowed
-    }).length
-    const setValue = (actionId: string, value: RolePermissionValue) => setCopyValues(current => ({ ...current, [actionId]: value }))
-    return <div className="au-copy">
-      <p className="ad-hint">以「{source.name}」的当前权限为起点创建新角色，并把 {accountLabel(selected!)} 换绑到新角色。新角色独立维护，不再随原角色更新。</p>
-      <div className="ad-row">
-        <input className="lg-input" aria-label="新角色名称（必填）" placeholder="新角色名称（必填）" value={copyName} disabled={busy} onChange={event => setCopyName(event.target.value)} />
-        <input className="lg-input" aria-label="新角色描述" placeholder="描述（可空）" value={copyDescription} disabled={busy} onChange={event => setCopyDescription(event.target.value)} />
-      </div>
-      {permissionCategories(catalog).map(category => <fieldset className="au-copy-group" key={category}>
-        <legend>{category}</legend>
-        {categoryActions(catalog, category).map(item => {
-          const value = valueOf(item.actionId)
-          const changed = value.allowed !== baseline[item.actionId].allowed || value.capAllowed !== baseline[item.actionId].capAllowed
-          const label = `新角色 ${item.label}`
-          return <div className="au-copy-row" key={item.actionId}>
-            <span title={item.description}>{item.label}</span>
-            {cellKind(item) === 'toggle'
-              ? <select className="rp-state" aria-label={label} value={value.allowed ? 'on' : 'off'} disabled={busy}
-                onChange={event => setValue(item.actionId, stateToValue(event.target.value === 'on' ? 'default' : 'denied'))}>
-                <option value="off">不允许</option><option value="on">允许</option>
-              </select>
-              : <select className="rp-state" aria-label={label} value={valueToState(value)} disabled={busy}
-                onChange={event => setValue(item.actionId, stateToValue(event.target.value as RolePermissionStateName))}>
-                {ROLE_PERMISSION_STATES.map(option => <option key={option.state} value={option.state}>{option.label}</option>)}
-              </select>}
-            {changed && <span className="rp-cell-flag">已调整</span>}
-          </div>
-        })}
-      </fieldset>)}
-      <div className="ad-row">
-        <span className="ad-hint au-grow">相对「{source.name}」调整 {adjusted} 项</span>
-        <button className="lg-submit ad-create-btn" disabled={busy || !copyName.trim()} onClick={() => void copyAndAssign()}>确认复制并分配</button>
-      </div>
-    </div>
-  }
-
-  const batchPanel = () => <section className="rp-preview au-batch" aria-label={`为选中的 ${counts.count} 人分配角色`}>
-    <div className="rp-preview-head">
-      <strong>为选中的 {counts.count} 人分配角色</strong>
-      <button className="ad-mini" disabled={busy} onClick={closeBatch}>收起</button>
-    </div>
-    {roleSearch()}
-    <select className="lg-input" aria-label="批量分配的目标角色" value={batchRoleId} disabled={busy || roleLoading} onChange={event => void previewBatch(event.target.value)}>
-      <option value="">请选择目标角色</option>
-      {batchRoleId && !roles.some(role => role.roleId === batchRoleId) && <option value={batchRoleId}>{batchPreview?.[0]?.targetRoleName ?? '已选角色'}</option>}
-      {roles.map(role => <option key={role.roleId} value={role.roleId}>{role.name}</option>)}
-    </select>
-    {batchPreview && <ul className="au-preview-list">{batchPreview.map(item => <li key={item.userId}>
-      <span>{accountLabel(item)}</span><span className="ad-dim">{previewTransition(item)}</span>
-      {item.error && <span className="rp-conflict"><Icon name="alert" size={12} />{item.error}</span>}
-      {!item.error && !item.stateMatches && <span className="rp-conflict"><Icon name="alert" size={12} />用户状态已变化</span>}
-    </li>)}</ul>}
-    {batchPreview && !batchReady && <p className="rp-conflict" role="alert"><Icon name="alert" size={12} />存在停用、版本变化或角色无效的用户，处理后才能确认分配</p>}
-    <div className="ad-row">
-      {batchStale.length > 0 && <button className="ad-mini" disabled={busy} onClick={() => void refreshBatchVersions()}>刷新 {batchStale.length} 人的状态并重新预览</button>}
-      {batchRoleId && !batchPreview && <button className="ad-mini" disabled={busy} onClick={() => void previewBatch(batchRoleId)}>重新预览</button>}
-      <button className="lg-submit ad-create-btn" disabled={busy || !batchReady} onClick={() => void confirmBatch()}>确认分配</button>
-    </div>
-  </section>
+  const policy = selected ? accountActionPolicy(me, selected) : null
 
   if (!allowed('system.users.view')) return <p className="ad-hint">当前账号没有查看用户的系统权限</p>
   return <div>
     {allowed('system.users.create') && <div className="ad-create">
       <div className="ad-row"><input className="lg-input" aria-label="新用户登录名" placeholder="登录名" value={newOwner} onChange={event => setNewOwner(event.target.value)} />
         <button className="lg-submit ad-create-btn" disabled={busy || !newOwner.trim()} onClick={create}>创建用户</button></div>
+      <CreateAdminOption me={me} checked={newIsAdmin} disabled={busy} onChange={setNewIsAdmin} />
       <Collapsible id="new-user-profile" trigger="可选资料：姓名、电话、邮箱、工号、部门、备注">
         <ProfileInputs profile={newProfile} onChange={setNewProfile} prefix="new-user" />
       </Collapsible>
     </div>}
     {notice && <div className="ad-notice" role="status"><Icon name="check" size={14} />{notice}</div>}
     {err && <div className="lg-err" role="alert"><Icon name="alert" size={14} />{err}</div>}
-    {selected ? <div className="rp-editor">
+    {selected && policy ? <div className="rp-editor">
       <div className="ad-row"><button className="ad-mini" onClick={() => { sequence.current++; setSelected(null) }}>返回列表</button>
-        <b>{selected.owner}</b><span className="ad-dim ad-mono">{selected.userId}</span></div>
+        <b>{selected.owner}</b><IdentityChip account={selected} /><span className="ad-dim ad-mono">{selected.userId}</span></div>
       <p className="ad-hint">{selected.enabled ? '有效账号' : '停用账号'} · {credentialLabel(selected)} · 资料版本 {selected.profileVersion} · 当前角色 {canViewRoles ? (roleView?.role?.name ?? '未分配') : '无角色查看权限'}</p>
       {selected.initializationState === 'pending' && <p className="ad-hint">交给可信 owner 的初始化定位：userId <span className="ad-mono">{selected.userId}</span> · 状态版本 {selected.stateVersion} · 代数 {selected.initializationGeneration}。凭据只经保护文件交付。</p>}
-      {allowed('system.users.edit') && <Collapsible id={`user-profile-${selected.userId}`} trigger="编辑可选资料">
+      {policy.protectedReason && <p className="ad-hint" role="note">{policy.protectedReason}</p>}
+      {allowed('system.users.edit') && policy.maintain && <Collapsible id={`user-profile-${selected.userId}`} trigger="编辑可选资料">
         <ProfileInputs profile={draft} onChange={setDraft} prefix="user-profile" />
         <button className="lg-submit ad-create-btn" disabled={busy} onClick={saveProfile}>保存资料</button>
       </Collapsible>}
       <div className="ad-row">
-        {canAssignRoles && <><select className="lg-input" aria-label="用户生效角色" value={selectedRoleId} onChange={event => setSelectedRoleId(event.target.value)}>
+        {canAssignRoles && policy.maintain && <><select className="lg-input" aria-label="用户生效角色" value={selectedRoleId} onChange={event => setSelectedRoleId(event.target.value)}>
           <option value="">请选择角色</option>{roles.map(role => <option key={role.roleId} value={role.roleId}>{role.name}</option>)}
         </select><button className="ad-mini" disabled={busy || !selectedRoleId || selectedRoleId === roleView?.role?.roleId} onClick={assignRole}>替换角色</button></>}
-        {allowed('system.users.disable') && <button className="ad-mini" disabled={busy} onClick={toggleState}>{selected.enabled ? '停用账号' : '启用账号'}</button>}
+        {allowed('system.users.disable') && policy.toggleEnabled && <button className="ad-mini" disabled={busy} onClick={toggleState}>{selected.enabled ? '停用账号' : '启用账号'}</button>}
+        <AdminAppointmentButton me={me} account={selected} busy={busy} onChange={setAdmin} />
       </div>
-      {canAssignRoles && roleSearch()}
-      {canCopyRole && roleView?.role && catalog.length > 0 && <Collapsible id={`copy-role-${selected.userId}`} trigger="复制角色并分配…">
-        {fullSourceRole ? copyForm(fullSourceRole)
-          : sourceRoleError ? <p className="lg-err" role="alert"><Icon name="alert" size={14} />{sourceRoleError}</p>
-          : <p className="ad-hint">正在读取源角色权限…</p>}
-      </Collapsible>}
+      {canAssignRoles && policy.maintain && <div className="ad-row">
+        <input className="lg-input" aria-label="搜索可分配角色" placeholder="搜索有效角色" value={roleQuery}
+          onChange={event => { setRoleQuery(event.target.value); setRoleCursor(''); setRoleTrail([]); setNextRoleCursor(''); setRoleLoading(true) }} />
+        <button className="ad-mini" disabled={roleLoading || !roleTrail.length} onClick={() => { setRoleCursor(roleTrail[roleTrail.length - 1]); setRoleTrail(roleTrail.slice(0, -1)) }}>上一页角色</button>
+        <button className="ad-mini" disabled={roleLoading || !nextRoleCursor} onClick={() => { setRoleTrail([...roleTrail, roleCursor]); setRoleCursor(nextRoleCursor) }}>下一页角色</button>
+      </div>}
       {canViewGrants && <Collapsible id={`system-grants-${selected.userId}`} trigger="明确系统权限">
         <div className="rp-grants">{catalog.filter(item => item.scope === 'system').map(item => <label className="ad-check" key={item.actionId}>
-          <input type="checkbox" checked={grants.includes(item.actionId)} disabled={!canManageGrants || busy} onChange={event => setGrants(current => event.target.checked
+          <input type="checkbox" checked={grants.includes(item.actionId)} disabled={!canManageGrants || !policy.maintain || busy} onChange={event => setGrants(current => event.target.checked
             ? [...new Set([...current, item.actionId])] : current.filter(value => value !== item.actionId))} />{item.label}<span className="ad-dim ad-mono">{item.actionId}</span>
         </label>)}</div>
-        {canManageGrants && <button className="lg-submit ad-create-btn" disabled={busy} onClick={saveGrants}>保存系统权限</button>}
+        {canManageGrants && policy.maintain && <button className="lg-submit ad-create-btn" disabled={busy} onClick={saveGrants}>保存系统权限</button>}
       </Collapsible>}
       {!canViewGrants && allowed('system.permissions.manage') && <p className="ad-hint">需要同时具备系统权限查看权，才能安全编辑现有授权</p>}
     </div> : <>
@@ -418,33 +270,14 @@ export function AccountUsersPanel() {
         </select>
         <select className="lg-input" aria-label="用户状态" value={status} onChange={event => { setStatus(event.target.value as typeof status); resetPaging() }}><option value="all">全部状态</option><option value="enabled">有效</option><option value="disabled">停用</option></select>
       </div>
-      {sameNameHint(accounts ?? []) && <p className="ad-hint">{sameNameHint(accounts ?? [])}</p>}
-      <table className="ad-table"><thead><tr>
-        <th className="au-select-col"><input type="checkbox" aria-label="全选本页用户" checked={pageState === 'all'} disabled={busy || !pageIds.length}
-          ref={element => { if (element) element.indeterminate = pageState === 'some' }}
-          onChange={event => changeSelection(selectPage(selection, pageIds, event.target.checked))} /></th>
-        <th>姓名与账号</th><th>工号</th><th>当前角色</th><th>系统身份</th><th>状态</th><th>首次凭据</th><th></th></tr></thead>
-        <tbody>{(accounts ?? []).map(account => <tr key={account.userId}>
-          <td className="au-select-col"><input type="checkbox" aria-label={`选择 ${accountLabel(account)}`} checked={isSelected(selection, account.userId)} disabled={busy}
-            onChange={event => changeSelection(toggleOne(selection, account.userId, event.target.checked))} /></td>
-          <td><div className="au-name-cell"><span>{accountName(account)}</span>
-            {account.profile.name.trim() && <span className="ad-dim ad-mono">{account.owner}</span>}
-            {duplicates.has(account.profile.name.trim()) && <span className="au-same-name">同名 · 按账号辨识</span>}</div></td>
-          <td>{account.profile.staffNo || '—'}</td><td>{roleColumnLabel(canViewRoles ? account.role : undefined)}</td>
-          <td>{account.isAdmin ? '系统管理员' : '普通账号'}</td><td>{account.enabled ? '有效' : '停用'}</td>
+      <table className="ad-table"><thead><tr><th>登录名</th><th>姓名</th><th>工号</th><th>身份</th><th>状态</th><th>首次凭据</th><th></th></tr></thead>
+        <tbody>{(accounts ?? []).map(account => <tr key={account.userId}><td className="ad-mono">{account.owner}</td><td>{account.profile.name || '—'}</td>
+          <td>{account.profile.staffNo || '—'}</td><td><IdentityChip account={account} /></td><td>{account.enabled ? '有效' : '停用'}</td>
           <td>{credentialLabel(account)}</td><td><button className="ad-mini" onClick={() => open(account)}>查看与管理</button></td></tr>)}
-          {accounts !== null && accounts.length === 0 && <tr><td colSpan={8} className="ad-dim">没有匹配用户</td></tr>}
-          {accounts === null && <tr><td colSpan={8} className="ad-dim">加载中…</td></tr>}</tbody></table>
+          {accounts !== null && accounts.length === 0 && <tr><td colSpan={7} className="ad-dim">没有匹配用户</td></tr>}
+          {accounts === null && <tr><td colSpan={7} className="ad-dim">加载中…</td></tr>}</tbody></table>
       <div className="ad-row"><button className="ad-mini" disabled={!trail.length} onClick={() => { setCursor(trail[trail.length - 1]); setTrail(trail.slice(0, -1)) }}>上一页</button>
         <button className="ad-mini" disabled={!nextCursor} onClick={() => { setTrail([...trail, cursor]); setCursor(nextCursor) }}>下一页</button></div>
-      <Collapsible open={batchOpen && canAssignRoles && counts.count > 0} onToggle={value => { if (!value) closeBatch() }}>
-        {batchPanel()}
-      </Collapsible>
-      {counts.count > 0 && <div className="rp-savebar" role="region" aria-label="已选用户">
-        <span className="rp-savebar-summary" aria-live="polite">{selectionSummary(counts)}</span>
-        <button className="ad-mini" disabled={busy} onClick={() => { changeSelection(clearSelection()); closeBatch() }}>清空选择</button>
-        {canAssignRoles && <button className="ad-mini" disabled={busy} aria-expanded={batchOpen} onClick={batchOpen ? closeBatch : openBatch}>为选中的 {counts.count} 人分配角色</button>}
-      </div>}
     </>}
   </div>
 }

src/components/AdminZone.tsx

@@ -110,7 +110,7 @@ export function AdminZone() {
           <Icon name="chevron-down" size={14} /> 返回工作台
         </button>
         <span className="az-title">系统管理</span>
-        <span className="az-sub">{isAdmin ? '根管理员' : '按系统权限开放'} · 角色与权限由服务端判定</span>
+        <span className="az-sub">{me?.isSuperAdmin ? '超级管理员' : isAdmin ? '根管理员' : '按系统权限开放'} · 角色与权限由服务端判定</span>
         <span style={{ flex: 1 }} />
         <span className="az-tenant">{me?.owner ?? ''}</span>
       </div>

src/components/ConversationWork.tsx

@@ -29,7 +29,9 @@ export function ConversationWork() {
       if (card.kind === 'confirm' && card.anchorMessageId
         && messages.some(message => message.role === 'user' && message.id === card.anchorMessageId)) continue
       const summary = activitySummary(card)
-      if (card.status === 'action_required' || card.work?.decision?.state === 'open' || summary.failed || (card.status === 'done' && summary.remaining)) required.push(card)
+      const taskNotice = card.task?.limitations?.length || card.task?.phase.id === 'correction'
+        || card.task?.findings?.some(f => f.status === 'active' && (f.kind === 'needs_user' || f.corrects))
+      if (taskNotice || card.status === 'action_required' || card.work?.decision?.state === 'open' || summary.failed || (card.status === 'done' && summary.remaining)) required.push(card)
       else remaining.push(card)
     }
     // Preserve the host's newest-first order for completed results and history.

src/components/PreviewPane.tsx

@@ -24,6 +24,7 @@ export function PreviewPane() {
       })
     : undefined
   const art = active ? artifacts.find(a => a.id === active.id) : undefined
+  const contentUrl=art?api.artifactContentUrl(art.id)+(active?.sourceContext?.expectedHash?`?expectedHash=${encodeURIComponent(active.sourceContext.expectedHash)}`:''):''
   const textKind = !!art && isTextKind(art)
   const [content, setContent] = useState<string | null>(null)
   const [editing, setEditing] = useState(false)
@@ -35,12 +36,12 @@ export function PreviewPane() {
     setContent(null)
     if (!art || !isTextKind(art)) return
     let cancelled = false
-    fetch(api.artifactContentUrl(art.id))
-      .then(r => r.text())
+    fetch(contentUrl)
+      .then(r => {if(!r.ok)throw new Error('source unavailable');return r.text()})
       .then(text => { if (!cancelled) setContent(text) })
       .catch(() => { if (!cancelled) setContent('（读取失败）') })
     return () => { cancelled = true }
-  }, [art?.id])
+  }, [art?.id,contentUrl])
 
   if (!active) return null
   if (active.id.startsWith('surface:')) {
@@ -96,6 +97,7 @@ export function PreviewPane() {
                   await api.saveArtifactContent(art.id, content ?? '')
                   setDirty(false)
                   store.toast('已保存')
+                  const conv=store.getState().currentConvId;if(conv)void store.refreshCards(conv)
                 }}>保存</Btn>}
               </>
             )}
@@ -108,6 +110,7 @@ export function PreviewPane() {
           </>
         )}
       </div>
+      {active.sourceContext&&<div className="acard-status-note" role="note"><p>{active.sourceContext.notice}</p>{active.sourceContext.quote&&<blockquote>{active.sourceContext.quote}</blockquote>}</div>}
       <div className="preview-pane-body">
         {editing && textKind ? (
           <textarea className="search-input preview-pane-editor" value={content ?? ''}
@@ -118,7 +121,7 @@ export function PreviewPane() {
             id: art.id,
             name: art.name,
             mime: art.mime,
-            contentUrl: api.artifactContentUrl(art.id),
+            contentUrl,
             downloadUrl: api.artifactDownloadUrl(art.id),
           }} />
         ) : <div className="empty-note" style={{ padding: 14 }}>这个文件已不在当前项目里</div>}

src/components/RolePermissionsPanel.tsx

@@ -1,32 +1,13 @@
-import { useEffect, useMemo, useRef, useState } from 'react'
-import {
-  api, type ManagedAccountRecord, type PermissionDescriptor, type RoleMember, type RolePermissionBatchResult, type RolePermissionPatchEntry,
-  type RolePermissionPreview, type RoleRecord, type UserRoleAssignmentPreview,
-} from '../api'
-import {
-  accountLabel, accountName, assignedToRole, clearSelection, createSelection, isSelected, memberAssignments, pageSelectionState,
-  previewAllowsAssign, previewTransition, refreshStateVersions, sameNameHint, selectPage, selectionCounts, selectionSummary, staleUserIds,
-  toggleOne, type MemberSelection,
-} from '../roleMembers'
-import {
-  PROJECT_CREATE_ACTION, PROJECT_CREATE_LINKED_ACTIONS, ROLE_PERMISSION_STATES, categoryActions, createRolePermissionDraft, dirtyRoles,
-  linkedByProjectCreate, permissionCategories, rebaseRoleDraft, rolePatchEntries, stateLabel, stateToValue, updateRolePermission,
-  validateRolePermissionDraft, valueToState, visiblePatch,
-  type RolePermissionDraft, type RolePermissionStateName, type RolePermissionValue,
-} from '../rolePermissions'
+import { useEffect, useRef, useState } from 'react'
+import { api, type RoleRecord } from '../api'
+import { projectAccessOf, projectAccessPatch } from '../rolePermissions'
 import { Collapsible, Icon } from '@ui'
-import { useStore } from '../store'
+import { useStore, type Me } from '../store'
 
-/** DR9 离开管理区守卫：面板有未保存权限草稿时注册；AdminZone「返回工作台」消费。 */
+/** DR9 离开管理区守卫：面板有未保存项目访问草稿时注册；AdminZone「返回工作台」消费。 */
 export const roleDraftLeaveGuard: { current: (() => boolean) | null } = { current: null }
 
-export const NARROW_ROLE_QUERY = '(max-width: 900px)'
-const LINKED_NOTE = '创建项目时自动具备 · 仅本人创建的项目'
-
-/** 草稿携带建立基线时的角色快照：其 roleVersion 即批量 patch 的 expectedRoleVersion。 */
-type RoleDraft = RolePermissionDraft & { role: RoleRecord }
-type RoleDraftMap = Record<string, RoleDraft>
-type RolePermissionClient = Pick<typeof api, 'previewRolePermissions' | 'batchPatchRolePermissions' | 'getRole'>
+export const PROJECT_ACCESS_MANAGE_REASON = '需要角色管理权限才能修改项目访问'
 
 export function filterRoles(
   roles: RoleRecord[], query: string, mode: 'exact' | 'fuzzy', status: 'all' | 'enabled' | 'disabled',
@@ -49,367 +30,95 @@ export function hasSystemAction(actions: string[] | undefined, action: string):
   return actions?.includes(action) ?? false
 }
 
-/** 窄屏（≤900px）默认单角色聚焦；仍可手动打开矩阵。 */
-export function initialRoleView(matches?: (query: string) => boolean): 'single' | 'matrix' {
-  return matches?.(NARROW_ROLE_QUERY) ? 'single' : 'matrix'
-}
-
-/** 系统动作（project.create）是二态开关；项目动作是三态。 */
-export function cellKind(item: PermissionDescriptor): 'toggle' | 'state' {
-  return item.scope === 'system' ? 'toggle' : 'state'
-}
-
-function roleValues(role: RoleRecord, catalog: PermissionDescriptor[]): Record<string, RolePermissionValue> {
-  const existing = new Map(role.permissions.map(item => [item.actionId, item]))
-  return Object.fromEntries(catalog.filter(item => !item.protected).map(item => {
-    const value = existing.get(item.actionId)
-    return [item.actionId, { allowed: value?.allowed ?? false, capAllowed: value?.capAllowed ?? false }]
-  }))
-}
-
-function roleValue(role: RoleRecord, actionId: string): RolePermissionValue {
-  const value = role.permissions.find(item => item.actionId === actionId)
-  return { allowed: value?.allowed ?? false, capAllowed: value?.capAllowed ?? false }
-}
-
-export function roleCellValue(drafts: RoleDraftMap, role: RoleRecord, actionId: string): RolePermissionValue {
-  return drafts[role.roleId]?.values[actionId] ?? roleValue(role, actionId)
-}
-
-// DR9：任何单元格修改都写进该角色自己的草稿（无需先选中）；首次修改时以当时的服务端值为基线。
-export function editRoleDraft(
-  drafts: RoleDraftMap, role: RoleRecord, catalog: PermissionDescriptor[], actionId: string, value: RolePermissionValue,
-): RoleDraftMap {
-  const current = drafts[role.roleId] ?? { ...createRolePermissionDraft(roleValues(role, catalog)), role }
-  return { ...drafts, [role.roleId]: { ...updateRolePermission(current, actionId, value), role: current.role } }
-}
-
-export function roleLeaveMessage(names: string[]): string {
-  return `以下角色有未保存的权限修改：${names.map(name => `「${name}」`).join('、')}。离开将放弃这些修改，确定离开吗？`
-}
-
-function previewBlocksSave(previews: RolePermissionPreview[]): boolean {
-  return previews.some(preview => !!preview.error || (preview.conflicts?.length ?? 0) > 0)
-}
-
-export async function previewRoleBatch(client: Pick<RolePermissionClient, 'previewRolePermissions'>, entries: RolePermissionPatchEntry[]) {
-  const previews = await client.previewRolePermissions(entries, { mode: 'patch' })
-  return { previews, blocked: previewBlocksSave(previews) }
-}
-
-// 原子保存：所有脏角色一次提交；预览存在冲突或错误时拒绝提交。
-export async function commitRoleBatch(
-  client: Pick<RolePermissionClient, 'batchPatchRolePermissions'>, entries: RolePermissionPatchEntry[],
-  previews: RolePermissionPreview[], idempotencyKey: string,
-): Promise<RolePermissionBatchResult> {
-  if (!entries.length) throw new Error('没有需要保存的权限修改')
-  if (previewBlocksSave(previews)) throw new Error('预览存在冲突或错误，不能保存')
-  return client.batchPatchRolePermissions(entries, idempotencyKey)
-}
-
-// DR9：409 后逐个读取最新角色，只重放各角色相对自身旧基线的本地变化。
-export async function rebaseRoleDrafts(
-  client: Pick<RolePermissionClient, 'getRole'>, drafts: RoleDraftMap, roleIds: string[], catalog: PermissionDescriptor[],
-): Promise<{ fresh: RoleRecord[]; drafts: RoleDraftMap }> {
-  const fresh = await Promise.all(roleIds.map(roleId => client.getRole(roleId)))
-  const next = { ...drafts }
-  for (const role of fresh) {
-    const current = drafts[role.roleId]
-    if (current) next[role.roleId] = { ...rebaseRoleDraft(current, roleValues(role, catalog)), role }
+/** R13：角色面板只认 system.roles.view / system.roles.manage；isAdmin 不旁路，与服务端同语义。 */
+export function rolePanelAccess(me: Pick<Me, 'systemActions'> | null | undefined): { canView: boolean; canManage: boolean } {
+  return {
+    canView: hasSystemAction(me?.systemActions, 'system.roles.view'),
+    canManage: hasSystemAction(me?.systemActions, 'system.roles.manage'),
   }
-  return { fresh, drafts: next }
 }
 
-function pruneCleanDrafts(drafts: RoleDraftMap, actionIds: string[]): RoleDraftMap {
-  const dirty = new Set(dirtyRoles(drafts, actionIds).map(entry => entry.roleId))
-  if (Object.keys(drafts).every(roleId => dirty.has(roleId))) return drafts
-  return Object.fromEntries(Object.entries(drafts).filter(([roleId]) => dirty.has(roleId)))
+type ProjectAccessSaveResult = { kind: 'unchanged' } | { kind: 'saved' } | { kind: 'conflict'; fresh: RoleRecord }
+
+/** 409 时读取最新角色交由调用方按新基线重放本地布尔；其他失败原样抛出。 */
+export async function saveProjectAccess(role: RoleRecord, next: boolean, idempotencyKey: string): Promise<ProjectAccessSaveResult> {
+  const changes = projectAccessPatch(role, next)
+  if (changes.length === 0) return { kind: 'unchanged' }
+  try {
+    await api.replaceRolePermissions(role.roleId, role.roleVersion, changes, idempotencyKey)
+    return { kind: 'saved' }
+  } catch (error) {
+    if (!String(error).includes('409')) throw error
+    return { kind: 'conflict', fresh: await api.getRole(role.roleId) }
+  }
 }
 
-// 本端资料/状态写入成功且草稿基线即写入前版本时，权限未变，草稿可继承新版本号。
-function adoptRoleSnapshot(drafts: RoleDraftMap, expectedVersion: number, updated: RoleRecord): RoleDraftMap {
-  const current = drafts[updated.roleId]
-  if (!current || current.role.roleVersion !== expectedVersion) return drafts
-  return { ...drafts, [updated.roleId]: { ...current, role: updated } }
-}
-
-function mergeRoles(current: RoleRecord[] | null, fresh: RoleRecord[]): RoleRecord[] {
-  const byId = new Map(fresh.map(role => [role.roleId, role]))
-  const merged = (current ?? []).map(role => byId.get(role.roleId) ?? role)
-  return [...fresh.filter(role => !merged.some(item => item.roleId === role.roleId)), ...merged]
-}
-
-export const roleMembersLabel = (role: Pick<RoleRecord, 'name'>) => `查看角色 ${role.name} 的成员`
-
-export function memberStatusLabel(member: Pick<RoleMember, 'enabled'>): string {
-  return member.enabled ? '有效' : '停用（绑定保留，不授予权限）'
-}
-
-const formatAssignedAt = (value: string) => {
-  const date = new Date(value)
-  return Number.isNaN(date.getTime()) ? value : date.toLocaleString('zh-CN', { hour12: false })
-}
-
-/** 角色成员子视图：成员分页列表 + 「添加用户到角色」（预览后一次批量事务提交）。 */
-function RoleMembersView({ role, canAssign, backLabel, onBack, onAssigned }: {
-  role: RoleRecord; canAssign: boolean; backLabel: string; onBack: () => void; onAssigned: () => void
+export function ProjectAccessCheckbox({ roleName, checked, canManage, disabled, showReason = true, onChange }: {
+  roleName: string; checked: boolean; canManage: boolean; disabled: boolean; showReason?: boolean
+  onChange: (next: boolean) => void
 }) {
-  const [members, setMembers] = useState<RoleMember[] | null>(null)
-  const [query, setQuery] = useState('')
-  const [status, setStatus] = useState<'all' | 'enabled' | 'disabled'>('all')
-  const [cursor, setCursor] = useState('')
-  const [trail, setTrail] = useState<string[]>([])
-  const [nextCursor, setNextCursor] = useState('')
-  const [reload, setReload] = useState(0)
-  const [pickerOpen, setPickerOpen] = useState(false)
-  const [userQuery, setUserQuery] = useState('')
-  const [userCursor, setUserCursor] = useState('')
-  const [userTrail, setUserTrail] = useState<string[]>([])
-  const [nextUserCursor, setNextUserCursor] = useState('')
-  const [candidates, setCandidates] = useState<ManagedAccountRecord[] | null>(null)
-  const [known, setKnown] = useState<Record<string, ManagedAccountRecord>>({})
-  const [selection, setSelection] = useState<MemberSelection>(createSelection)
-  const [preview, setPreview] = useState<UserRoleAssignmentPreview[] | null>(null)
-  const [busy, setBusy] = useState(false)
-  const [notice, setNotice] = useState('')
-  const [err, setErr] = useState('')
-  const memberSequence = useRef(0)
-  const userSequence = useRef(0)
-  const previewSequence = useRef(0)
-  const selectableIds = (candidates ?? []).filter(account => !assignedToRole(account, role.roleId)).map(account => account.userId)
-  const pageState = pageSelectionState(selection, selectableIds)
-  const counts = selectionCounts(selection, selectableIds)
-  const ready = !!preview && previewAllowsAssign(preview, selection.ids)
-  const stale = preview ? staleUserIds(preview) : []
-
-  useEffect(() => {
-    const request = ++memberSequence.current
-    const timer = window.setTimeout(() => {
-      void api.listRoleMembers(role.roleId, { query: query.trim(), mode: 'fuzzy', status, cursor, limit: 20 })
-        .then(page => { if (request === memberSequence.current) { setMembers(page.members ?? []); setNextCursor(page.nextCursor ?? '') } })
-        .catch(error => { if (request === memberSequence.current) setErr(String(error)) })
-    }, 180)
-    return () => { window.clearTimeout(timer); memberSequence.current++ }
-  }, [role.roleId, query, status, cursor, reload])
-
-  useEffect(() => {
-    if (!pickerOpen) return
-    const request = ++userSequence.current
-    const timer = window.setTimeout(() => {
-      void api.searchAdminUsers({ query: userQuery.trim(), mode: 'fuzzy', status: 'all', fields: ['owner', 'name', 'userId'], cursor: userCursor, limit: 20 })
-        .then(page => {
-          if (request !== userSequence.current) return
-          setCandidates(page.accounts ?? []); setNextUserCursor(page.nextCursor ?? '')
-          setKnown(current => ({ ...current, ...Object.fromEntries((page.accounts ?? []).map(account => [account.userId, account])) }))
-        })
-        .catch(error => { if (request === userSequence.current) setErr(String(error)) })
-    }, 180)
-    return () => { window.clearTimeout(timer); userSequence.current++ }
-  }, [pickerOpen, userQuery, userCursor, reload])
-
-  const changeSelection = (next: MemberSelection) => {
-    previewSequence.current++
-    setSelection(next); setPreview(null)
-  }
-
-  const requestPreview = async (versions = known) => {
-    const request = ++previewSequence.current
-    setPreview(null); setErr(''); setNotice(''); setBusy(true)
-    try {
-      const assignments = memberAssignments(selection.ids, role.roleId,
-        Object.fromEntries(Object.values(versions).map(account => [account.userId, account.stateVersion])))
-      const previews = await api.previewUserRoleAssignments(assignments)
-      if (request === previewSequence.current) setPreview(previews)
-    } catch (error) { if (request === previewSequence.current) setErr(error instanceof Error ? error.message : String(error)) }
-    finally { setBusy(false) }
-  }
-
-  const refreshVersions = async () => {
-    if (!preview) return
-    setBusy(true); setErr('')
-    try {
-      const fresh = { ...known, ...await refreshStateVersions(api, staleUserIds(preview)) }
-      setKnown(fresh)
-      await requestPreview(fresh)
-    } catch (error) { setErr(String(error)); setBusy(false) }
-  }
-
-  const confirm = async () => {
-    if (!preview || !previewAllowsAssign(preview, selection.ids)) return
-    setBusy(true); setErr(''); setNotice('')
-    try {
-      const assignments = memberAssignments(selection.ids, role.roleId,
-        Object.fromEntries(Object.values(known).map(account => [account.userId, account.stateVersion])))
-      const result = await api.assignUserRolesBatch(assignments, crypto.randomUUID())
-      changeSelection(clearSelection())
-      setCursor(''); setTrail([]); setUserCursor(''); setUserTrail([]); setReload(value => value + 1)
-      onAssigned()
-      setNotice(`已将 ${result.bindings?.length ?? assignments.length} 人加入角色「${role.name}」`)
-    } catch (error) {
-      setPreview(null)
-      setErr(String(error).includes('409') ? '部分用户状态或角色已变化，整批均未写入；选择已保留，请重新预览后再确认' : `整批均未写入：${String(error)}`)
-    } finally { setBusy(false) }
-  }
-
-  return <section className="rp-members" aria-label={`角色「${role.name}」的成员`}>
-    <div className="ad-row">
-      <button className="ad-mini" disabled={busy} onClick={onBack}>{backLabel}</button>
-      <strong className="au-grow">角色「{role.name}」的成员 · {role.bindingCount} 人</strong>
-    </div>
-    {!role.enabled && <p className="rp-disabled-note">角色已停用：现有绑定不再授予权限，也不能向其添加用户</p>}
-    <div className="rp-status">
-      {notice && <div className="ad-notice" role="status"><Icon name="check" size={14} />{notice}</div>}
-      {err && <div className="lg-err" role="alert"><Icon name="alert" size={14} />{err}</div>}
-    </div>
-    <div className="ad-row rp-filters">
-      <input className="lg-input" aria-label="搜索角色成员" placeholder="姓名、账号或 ID" value={query} onChange={event => { setQuery(event.target.value); setCursor(''); setTrail([]) }} />
-      <select className="lg-input" aria-label="成员状态" value={status} onChange={event => { setStatus(event.target.value as typeof status); setCursor(''); setTrail([]) }}>
-        <option value="all">全部状态</option><option value="enabled">有效</option><option value="disabled">停用</option>
-      </select>
-    </div>
-    {sameNameHint(members ?? []) && <p className="ad-hint">{sameNameHint(members ?? [])}</p>}
-    <table className="ad-table"><thead><tr><th>姓名与账号</th><th>状态</th><th>分配时间</th></tr></thead>
-      <tbody>{(members ?? []).map(member => <tr key={member.userId}>
-        <td><div className="au-name-cell"><span>{accountName(member)}</span>{member.name.trim() && <span className="ad-dim ad-mono">{member.owner}</span>}</div></td>
-        <td>{memberStatusLabel(member)}</td><td>{formatAssignedAt(member.assignedAt)}</td>
-      </tr>)}
-        {members !== null && members.length === 0 && <tr><td colSpan={3} className="ad-dim">该角色暂无匹配成员</td></tr>}
-        {members === null && <tr><td colSpan={3} className="ad-dim">加载中…</td></tr>}</tbody></table>
-    <div className="ad-row">
-      <button className="ad-mini" disabled={!trail.length} onClick={() => { setCursor(trail[trail.length - 1]); setTrail(trail.slice(0, -1)) }}>上一页成员</button>
-      <button className="ad-mini" disabled={!nextCursor} onClick={() => { setTrail([...trail, cursor]); setCursor(nextCursor) }}>下一页成员</button>
-    </div>
-    {canAssign && role.enabled && <Collapsible open={pickerOpen} onToggle={setPickerOpen} trigger="添加用户到角色">
-      <div className="au-copy">
-        <div className="ad-row">
-          <input className="lg-input" aria-label="搜索要添加的用户" placeholder="搜索用户姓名、账号或 ID" value={userQuery}
-            onChange={event => { setUserQuery(event.target.value); setUserCursor(''); setUserTrail([]) }} />
-          <button className="ad-mini" disabled={!userTrail.length} onClick={() => { setUserCursor(userTrail[userTrail.length - 1]); setUserTrail(userTrail.slice(0, -1)) }}>上一页用户</button>
-          <button className="ad-mini" disabled={!nextUserCursor} onClick={() => { setUserTrail([...userTrail, userCursor]); setUserCursor(nextUserCursor) }}>下一页用户</button>
-        </div>
-        {sameNameHint(candidates ?? []) && <p className="ad-hint">{sameNameHint(candidates ?? [])}</p>}
-        <table className="ad-table"><thead><tr>
-          <th className="au-select-col"><input type="checkbox" aria-label="全选本页可添加用户" checked={pageState === 'all'} disabled={busy || !selectableIds.length}
-            ref={element => { if (element) element.indeterminate = pageState === 'some' }}
-            onChange={event => changeSelection(selectPage(selection, selectableIds, event.target.checked))} /></th>
-          <th>姓名与账号</th><th>当前角色</th><th>状态</th></tr></thead>
-          <tbody>{(candidates ?? []).map(account => {
-            const assigned = assignedToRole(account, role.roleId)
-            return <tr key={account.userId}>
-              <td className="au-select-col"><input type="checkbox" aria-label={assigned ? `${accountLabel(account)} 已分配` : `选择 ${accountLabel(account)}`}
-                checked={!assigned && isSelected(selection, account.userId)} disabled={busy || assigned}
-                onChange={event => changeSelection(toggleOne(selection, account.userId, event.target.checked))} /></td>
-              <td><div className="au-name-cell"><span>{accountName(account)}</span>{account.profile.name.trim() && <span className="ad-dim ad-mono">{account.owner}</span>}</div></td>
-              <td>{assigned ? <span className="au-same-name">已分配</span> : account.role === null ? '未分配' : account.role?.name ?? '—'}</td>
-              <td>{account.enabled ? '有效' : '停用'}</td>
-            </tr>
-          })}
-            {candidates !== null && candidates.length === 0 && <tr><td colSpan={4} className="ad-dim">没有匹配用户</td></tr>}
-            {candidates === null && <tr><td colSpan={4} className="ad-dim">加载中…</td></tr>}</tbody></table>
-        {preview && <ul className="au-preview-list">{preview.map(item => <li key={item.userId}>
-          <span>{accountLabel(item)}</span><span className="ad-dim">{previewTransition(item)}</span>
-          {item.error && <span className="rp-conflict"><Icon name="alert" size={12} />{item.error}</span>}
-          {!item.error && !item.stateMatches && <span className="rp-conflict"><Icon name="alert" size={12} />用户状态已变化</span>}
-        </li>)}</ul>}
-        {preview && !ready && <p className="rp-conflict" role="alert"><Icon name="alert" size={12} />存在停用、版本变化或角色无效的用户，处理后才能确认添加</p>}
-        <div className="ad-row">
-          <span className="ad-hint au-grow" aria-live="polite">{selectionSummary(counts)}</span>
-          <button className="ad-mini" disabled={busy || !counts.count} onClick={() => changeSelection(clearSelection())}>清空选择</button>
-          {stale.length > 0 && <button className="ad-mini" disabled={busy} onClick={() => void refreshVersions()}>刷新 {stale.length} 人的状态并重新预览</button>}
-          <button className="ad-mini" disabled={busy || !counts.count} onClick={() => void requestPreview()}>预览分配</button>
-          <button className="lg-submit ad-create-btn" disabled={busy || !ready} onClick={() => void confirm()}>确认添加</button>
-        </div>
-      </div>
-    </Collapsible>}
-  </section>
+  return <span className="rp-access">
+    <label className="ad-check">
+      <input type="checkbox" aria-label={`${roleName} 项目访问`} checked={checked} disabled={disabled || !canManage}
+        onChange={event => onChange(event.target.checked)} />
+      项目访问（可创建项目）
+    </label>
+    {!canManage && showReason && <span className="ad-hint">{PROJECT_ACCESS_MANAGE_REASON}</span>}
+  </span>
 }
 
 export function RolePermissionsPanel() {
   const me = useStore(state => state.me)
-  const allowed = (action: string) => !!me?.isAdmin || hasSystemAction(me?.systemActions, action)
-  const canManageRoles = allowed('system.roles.manage')
-  const canViewPermissions = allowed('system.permissions.view')
-  const canManagePermissions = canViewPermissions && allowed('system.permissions.manage')
-  const canViewMembers = allowed('system.users.view') && allowed('system.roles.view')
-  const canAssignMembers = canViewMembers && allowed('system.roles.assign')
-  const [membersRole, setMembersRole] = useState<RoleRecord | null>(null)
+  const { canView, canManage } = rolePanelAccess(me)
   const [roles, setRoles] = useState<RoleRecord[] | null>(null)
-  const [catalog, setCatalog] = useState<PermissionDescriptor[]>([])
-  const [catalogFailed, setCatalogFailed] = useState(false)
   const [selectedId, setSelectedId] = useState('')
-  const [drafts, setDrafts] = useState<RoleDraftMap>({})
+  // DR9：草稿按 roleId 隔离，只存本地意图；显示值 = 草稿 ?? 服务端值，刷新不覆盖本地编辑。
+  const [drafts, setDrafts] = useState<Record<string, boolean>>({})
   const [confirmDisable, setConfirmDisable] = useState(false)
   const [name, setName] = useState('')
   const [description, setDescription] = useState('')
   const [query, setQuery] = useState('')
   const [mode, setMode] = useState<'exact' | 'fuzzy'>('fuzzy')
   const [status, setStatus] = useState<'all' | 'enabled' | 'disabled'>('all')
-  const [category, setCategory] = useState('')
-  const [actionFilter, setActionFilter] = useState('')
   const [roleCursor, setRoleCursor] = useState('')
   const [roleTrail, setRoleTrail] = useState<string[]>([])
   const [nextRoleCursor, setNextRoleCursor] = useState('')
-  const [view, setView] = useState<'single' | 'matrix'>(() => initialRoleView(
-    typeof window !== 'undefined' && typeof window.matchMedia === 'function' ? media => window.matchMedia(media).matches : undefined))
+  const [view, setView] = useState<'single' | 'matrix'>('single')
   const [newName, setNewName] = useState('')
   const [newDescription, setNewDescription] = useState('')
   const [busy, setBusy] = useState(false)
   const [roleLoading, setRoleLoading] = useState(false)
   const [notice, setNotice] = useState('')
   const [err, setErr] = useState('')
-  const [preview, setPreview] = useState<{ previews: RolePermissionPreview[]; confirm: boolean } | null>(null)
   const requestSequence = useRef(0)
   const selectedIdRef = useRef('')
   const savePermsRef = useRef<HTMLButtonElement>(null)
-  const statusRef = useRef<HTMLDivElement>(null)
   selectedIdRef.current = selectedId
 
-  const selected = roles?.find(role => role.roleId === selectedId) ?? null
-  const draft = selected ? drafts[selected.roleId] ?? null : null
-  const allEditableIds = useMemo(() => catalog.filter(item => !item.protected).map(item => item.actionId), [catalog])
-  const descriptorById = useMemo(() => new Map(catalog.map(item => [item.actionId, item])), [catalog])
-  const categories = useMemo(() => permissionCategories(catalog), [catalog])
-  const activeCategory = categories.includes(category) ? category : categories[0] ?? ''
-  const columns = useMemo(() => categoryActions(catalog, activeCategory), [catalog, activeCategory])
-  const dirtyList = useMemo(() => dirtyRoles(drafts, allEditableIds), [drafts, allEditableIds])
-  const dirtyNames = dirtyList.map(entry => roles?.find(role => role.roleId === entry.roleId)?.name ?? drafts[entry.roleId].role.name)
-  const changeCount = dirtyList.reduce((sum, entry) => sum + entry.changes, 0)
-  const changes = draft ? visiblePatch(draft, allEditableIds) : []
   const filtered = roles ?? []
-  const effectiveView = canViewPermissions ? view : 'single'
-  const editable = canManagePermissions && !catalogFailed && catalog.length > 0
-  const blocked = !!preview && previewBlocksSave(preview.previews)
-  const labelOf = (actionId: string) => descriptorById.get(actionId)?.label ?? actionId
-  const cellDisabled = (role: RoleRecord) => busy || roleLoading || !editable || !role.enabled
+  const selected = filtered.find(role => role.roleId === selectedId) ?? null
+  const accessOf = (role: RoleRecord) => drafts[role.roleId] ?? projectAccessOf(role)
+  const changes = selected ? projectAccessPatch(selected, accessOf(selected)) : []
+  const dirty = changes.length > 0
 
-  const load = async (pageCursor = roleCursor, refreshCatalog = false, preferredId = selectedId,
-    filters = { query, mode, status, action: actionFilter }) => {
+  const load = async (pageCursor = roleCursor, preferredId = selectedId, filters = { query, mode, status }) => {
     const sequence = ++requestSequence.current
     setRoleLoading(true)
     setErr('')
-    const [roleResult, catalogResult] = await Promise.allSettled([
-      api.listRoles({ query: filters.query.trim(), mode: filters.mode, status: filters.status,
-        action: filters.action || undefined, cursor: pageCursor, limit: 50 }),
-      canViewPermissions && (refreshCatalog || catalog.length === 0) ? api.permissionCatalog() : Promise.resolve(catalog),
-    ])
-    if (!shouldAcceptRoleResponse(requestSequence.current, sequence)) return
-    setRoleLoading(false)
-    const descriptors = catalogResult.status === 'fulfilled' ? catalogResult.value : catalog
-    if (catalogResult.status === 'fulfilled') setCatalog(descriptors)
-    setCatalogFailed(catalogResult.status === 'rejected')
-    if (roleResult.status === 'rejected') {
-      setErr(String(roleResult.reason))
-      return
+    try {
+      const rolePage = await api.listRoles({ query: filters.query.trim(), mode: filters.mode, status: filters.status, cursor: pageCursor, limit: 50 })
+      if (!shouldAcceptRoleResponse(requestSequence.current, sequence)) return
+      setRoleLoading(false)
+      setRoles(rolePage.roles ?? [])
+      setNextRoleCursor(rolePage.nextCursor ?? '')
+      const nextSelected = rolePage.roles.find(role => role.roleId === preferredId) ?? rolePage.roles[0] ?? null
+      if (nextSelected) selectRole(nextSelected, sequence)
+      else setSelectedId('')
+    } catch (error) {
+      if (!shouldAcceptRoleResponse(requestSequence.current, sequence)) return
+      setRoleLoading(false)
+      setErr(String(error))
     }
-    const rolePage = roleResult.value
-    setRoles(rolePage.roles ?? [])
-    setNextRoleCursor(rolePage.nextCursor ?? '')
-    setDrafts(prev => pruneCleanDrafts(prev, descriptors.filter(item => !item.protected).map(item => item.actionId)))
-    const nextSelected = rolePage.roles.find(role => role.roleId === preferredId) ?? rolePage.roles[0] ?? null
-    if (nextSelected) selectRole(nextSelected, sequence)
-    else setSelectedId('')
-    // DR10：目录失败是部分失败态，需在角色选中（selectRole 会清空提示）之后仍可见。
-    if (catalogResult.status === 'rejected') setErr(prev => prev || `权限目录加载失败：${catalogResult.reason}`)
   }
 
   const selectRole = (role: RoleRecord, sequence?: number) => {
@@ -422,15 +131,21 @@ export function RolePermissionsPanel() {
     setErr('')
   }
 
-  // DR9：离开管理区须显式决定（覆盖所有脏角色）；带未保存草稿时刷新走浏览器原生确认。
-  const dirtyKey = dirtyNames.join('\u0000')
+  const replaceRole = (fresh: RoleRecord) => setRoles(current => current?.some(role => role.roleId === fresh.roleId)
+    ? current.map(role => role.roleId === fresh.roleId ? fresh : role) : [fresh, ...(current ?? [])])
+
+  const clearDraft = (roleId: string) => setDrafts(current => {
+    if (!(roleId in current)) return current
+    const next = { ...current }; delete next[roleId]; return next
+  })
+
+  // DR9：离开管理区须显式决定；带未保存草稿时刷新走浏览器原生确认。
   useEffect(() => {
-    if (!dirtyNames.length) { roleDraftLeaveGuard.current = null; return }
-    const message = roleLeaveMessage(dirtyNames)
+    if (!dirty || !selected) { roleDraftLeaveGuard.current = null; return }
+    const message = `角色「${selected.name}」有未保存的项目访问修改，离开将放弃这些修改。确定离开吗？`
     roleDraftLeaveGuard.current = () => window.confirm(message)
     return () => { roleDraftLeaveGuard.current = null }
-  }, [dirtyKey])
-  const dirty = dirtyList.length > 0
+  }, [dirty, selected?.roleId, selected?.name])
   useEffect(() => {
     if (!dirty) return
     const handler = (event: BeforeUnloadEvent) => { event.preventDefault(); event.returnValue = '' }
@@ -439,17 +154,11 @@ export function RolePermissionsPanel() {
   }, [dirty])
 
   useEffect(() => {
+    if (!canView) return
     setNextRoleCursor(''); setRoleLoading(true)
     const timer = window.setTimeout(() => { void load(roleCursor) }, 180)
     return () => { window.clearTimeout(timer); requestSequence.current++ }
-  }, [query, mode, status, actionFilter, roleCursor, canViewPermissions])
-
-  // DR10：保存/冲突/失败后焦点稳定——若焦点因按钮短暂 disabled 或保存区收起掉回 body，则归还。
-  const restoreFocus = () => requestAnimationFrame(() => {
-    if (document.activeElement !== document.body) return
-    const target = savePermsRef.current && !savePermsRef.current.disabled ? savePermsRef.current : statusRef.current
-    target?.focus()
-  })
+  }, [query, mode, status, roleCursor, canView])
 
   const create = async () => {
     if (!newName.trim()) return
@@ -458,11 +167,11 @@ export function RolePermissionsPanel() {
     try {
       const role = await api.createRole(newName.trim(), newDescription.trim())
       setNewName(''); setNewDescription('')
-      setQuery(''); setStatus('all'); setActionFilter(''); setRoleCursor(''); setRoleTrail([])
+      setQuery(''); setStatus('all'); setRoleCursor(''); setRoleTrail([])
       setRoles(current => [role, ...(current ?? []).filter(item => item.roleId !== role.roleId)])
       selectRole(role, ++requestSequence.current)
       setNotice(`已创建角色 ${role.name}`)
-      await load('', true, role.roleId, { query: '', mode, status: 'all', action: '' })
+      await load('', role.roleId, { query: '', mode, status: 'all' })
       setNotice(`已创建角色 ${role.name}`)
     } catch (error) { setErr(String(error)) } finally { setBusy(false) }
   }
@@ -474,15 +183,14 @@ export function RolePermissionsPanel() {
     setRoleLoading(false)
     setBusy(true); setErr(''); setNotice('')
     try {
-      const updated = await api.patchRole(selected.roleId, selected.roleVersion, { name: name.trim(), description: description.trim() })
-      setDrafts(prev => adoptRoleSnapshot(prev, selected.roleVersion, updated))
+      await api.patchRole(selected.roleId, selected.roleVersion, { name: name.trim(), description: description.trim() })
       await load(); setNotice('角色资料已保存')
     } catch (error) {
       if (String(error).includes('409')) {
         try {
           const fresh = await api.getRole(roleId)
           if (requestSequence.current !== operationSequence || selectedIdRef.current !== roleId) return
-          setRoles(current => mergeRoles(current, [fresh]))
+          replaceRole(fresh)
           setErr('角色资料版本冲突；已读取最新版本并保留本地名称与描述，请核对后重试')
         } catch (refreshError) { setErr(String(refreshError)) }
       } else setErr(String(error))
@@ -497,192 +205,84 @@ export function RolePermissionsPanel() {
     setRoleLoading(false)
     setBusy(true); setErr(''); setNotice('')
     try {
-      const updated = await api.patchRole(selected.roleId, selected.roleVersion, { enabled: !selected.enabled })
-      setDrafts(prev => adoptRoleSnapshot(prev, selected.roleVersion, updated))
+      await api.patchRole(selected.roleId, selected.roleVersion, { enabled: !selected.enabled })
       await load(); setNotice(selected.enabled ? '角色已停用，现有绑定不再授予权限' : '角色已启用')
     } catch (error) {
       if (String(error).includes('409')) {
         try {
           const fresh = await api.getRole(roleId)
           if (requestSequence.current !== operationSequence || selectedIdRef.current !== roleId) return
-          setRoles(current => mergeRoles(current, [fresh]))
+          replaceRole(fresh)
           setErr('角色状态版本冲突；已刷新当前状态，请重新确认')
         } catch (refreshError) { setErr(String(refreshError)) }
       } else setErr(String(error))
     } finally { setBusy(false) }
   }
 
-  const editCell = (role: RoleRecord, actionId: string, value: RolePermissionValue) => {
-    setDrafts(prev => editRoleDraft(prev, role, catalog, actionId, value))
-    setPreview(null)
-  }
-
-  const patchEntries = () => rolePatchEntries(drafts,
-    Object.fromEntries(Object.entries(drafts).map(([roleId, item]) => [roleId, item.role.roleVersion])), allEditableIds)
-
-  // 「查看变化」与「保存」都先取服务端权威预览；confirm=true 时保存按钮变为「确认保存」。
-  const requestPreview = async (confirm: boolean) => {
-    for (const entry of dirtyList) {
-      const invalid = validateRolePermissionDraft(drafts[entry.roleId])
-      if (invalid) { setErr(`角色「${drafts[entry.roleId].role.name}」的 ${labelOf(invalid.actionId)} 默认权限不能超过角色上限`); return }
+  const saveAccess = async () => {
+    if (!selected || !canManage) return
+    const roleId = selected.roleId
+    const next = accessOf(selected)
+    const operationSequence = ++requestSequence.current
+    setRoleLoading(false)
+    setBusy(true); setErr(''); setNotice('')
+    try {
+      const result = await saveProjectAccess(selected, next, crypto.randomUUID())
+      if (result.kind === 'conflict') {
+        if (requestSequence.current !== operationSequence || selectedIdRef.current !== roleId) return
+        // DR9：409 只重放同一角色的草稿——本地布尔保留，基线换成最新服务端值。
+        replaceRole(result.fresh)
+        setErr(projectAccessOf(result.fresh) === next
+          ? '项目访问版本冲突；最新版本已与本地修改一致，无需再次保存'
+          : '项目访问版本冲突；已基于最新版本重放本地修改，请核对后再次保存')
+        return
+      }
+      clearDraft(roleId)
+      await load(roleCursor, roleId); setNotice('项目访问已保存')
+    } catch (error) { setErr(String(error)) }
+    finally {
+      setBusy(false)
+      // DR10：保存/冲突/失败后焦点稳定——若焦点因按钮短暂 disabled 掉回 body，则归还。
+      requestAnimationFrame(() => {
+        if (savePermsRef.current && !savePermsRef.current.disabled && document.activeElement === document.body) savePermsRef.current.focus()
+      })
     }
-    const entries = patchEntries()
-    if (!entries.length) return
-    const operationSequence = ++requestSequence.current
-    setRoleLoading(false)
-    setBusy(true); setErr(''); setNotice('')
-    try {
-      const result = await previewRoleBatch(api, entries)
-      if (requestSequence.current !== operationSequence) return
-      setPreview({ previews: result.previews, confirm })
-    } catch (error) { setErr(String(error)) } finally { setBusy(false); restoreFocus() }
   }
 
-  const confirmSave = async () => {
-    if (!preview) return
-    const entries = patchEntries()
-    const snapshot = drafts
-    const operationSequence = ++requestSequence.current
-    setRoleLoading(false)
-    setBusy(true); setErr(''); setNotice('')
-    try {
-      const result = await commitRoleBatch(api, entries, preview.previews, crypto.randomUUID())
-      const saved = new Set(entries.map(entry => entry.roleId))
-      setDrafts(current => Object.fromEntries(Object.entries(current).filter(([roleId]) => !saved.has(roleId))))
-      setPreview(null)
-      await load(roleCursor, true, selectedId)
-      setNotice(`已保存 ${result.receipts.length} 个角色的权限设置`)
-    } catch (error) {
-      if (String(error).includes('409')) {
-        try {
-          const rebased = await rebaseRoleDrafts(api, snapshot, entries.map(entry => entry.roleId), catalog)
-          if (requestSequence.current !== operationSequence) return
-          setRoles(current => mergeRoles(current, rebased.fresh))
-          setDrafts(current => ({ ...current, ...Object.fromEntries(entries.map(entry => [entry.roleId, rebased.drafts[entry.roleId]])) }))
-          setPreview(null)
-          setErr(`权限版本冲突；已基于最新版本为 ${entries.length} 个角色重放本地草稿，请核对后再次保存`)
-        } catch (refreshError) { setErr(String(refreshError)) }
-      } else setErr(String(error))
-    } finally { setBusy(false); restoreFocus() }
+  const editAccess = (role: RoleRecord, next: boolean) => {
+    if (role.roleId !== selectedId) return
+    setDrafts(prev => {
+      const updated = { ...prev }
+      if (next === projectAccessOf(role)) delete updated[role.roleId]
+      else updated[role.roleId] = next
+      return updated
+    })
   }
 
-  const cancelAll = () => {
-    if (!window.confirm(`确定放弃 ${dirtyNames.map(name => `「${name}」`).join('、')} 的全部未保存权限修改吗？`)) return
-    setDrafts({}); setPreview(null); setErr(''); setNotice('已取消全部未保存的权限修改')
-  }
+  if (!canView) return <div className="rp-panel"><p className="ad-hint">当前账号没有查看角色的系统权限</p></div>
 
-  const openFocus = (role: RoleRecord) => { selectRole(role); setView('single') }
-
-  const valueLabel = (actionId: string, value: RolePermissionValue | undefined) => descriptorById.get(actionId)?.scope === 'system'
-    ? (value?.allowed ? '允许' : '不允许') : stateLabel(valueToState(value))
-
-  const cell = (role: RoleRecord, item: PermissionDescriptor) => {
-    const value = roleCellValue(drafts, role, item.actionId)
-    const label = `${role.name} ${item.label}`
-    const disabled = cellDisabled(role)
-    const roleDraft = drafts[role.roleId]
-    const modified = !!roleDraft && visiblePatch(roleDraft, [item.actionId]).length > 0
-    const linked = linkedByProjectCreate({ [PROJECT_CREATE_ACTION]: roleCellValue(drafts, role, PROJECT_CREATE_ACTION) }, item.actionId)
-    return <div className="rp-cell">
-      {cellKind(item) === 'toggle'
-        ? <select className="rp-state" aria-label={label} value={value.allowed ? 'on' : 'off'} disabled={disabled}
-          onChange={event => editCell(role, item.actionId, stateToValue(event.target.value === 'on' ? 'default' : 'denied'))}>
-          <option value="off">不允许</option><option value="on">允许</option>
-        </select>
-        : <select className="rp-state" aria-label={label} value={valueToState(value)} disabled={disabled}
-          onChange={event => editCell(role, item.actionId, stateToValue(event.target.value as RolePermissionStateName))}>
-          {ROLE_PERMISSION_STATES.map(option => <option key={option.state} value={option.state}>{option.label}</option>)}
-        </select>}
-      {modified && <span className="rp-cell-flag">已修改</span>}
-      {linked && <span className="rp-linked"><Icon name="sparkles" size={12} />{LINKED_NOTE}</span>}
-    </div>
-  }
-
-  const matrix = () => <div className="rp-matrix-wrap" role="region" aria-label={`角色矩阵 · ${activeCategory}`} tabIndex={0}>
-    <table className="ad-table rp-matrix">
-      <thead><tr><th scope="col">角色</th>{columns.map(item => <th scope="col" key={item.actionId} title={item.description}>{item.label}</th>)}</tr></thead>
-      <tbody>{filtered.map(role => <tr key={role.roleId} className={role.roleId === selectedId ? 'rp-selected' : ''}>
-        <th scope="row"><div className="rp-role-cell">
-          <button className="rp-role-name" disabled={busy || roleLoading} onClick={() => openFocus(role)}>{role.name}</button>
-          {role.description && <span className="rp-role-desc" title={role.description}>{role.description}</span>}
-          <span className="ad-dim">{canViewMembers
-            ? <button className="rp-members-link" aria-label={roleMembersLabel(role)} disabled={busy} onClick={() => setMembersRole(role)}>{role.bindingCount} 人</button>
-            : `${role.bindingCount} 人`} · {role.enabled ? '启用' : '已停用'}{dirtyList.some(entry => entry.roleId === role.roleId) ? ' · 未保存' : ''}</span>
-          {!role.enabled && <span className="rp-disabled-note">停用角色不可编辑权限，请先启用</span>}
-        </div></th>
-        {columns.map(item => <td key={item.actionId}>{cell(role, item)}</td>)}
-      </tr>)}</tbody>
-    </table>
-    {filtered.length === 0 && !roleLoading && <p className="ad-hint rp-empty">没有符合条件的角色</p>}
+  const saveBar = selected && canManage && <div className="ad-row rp-save">
+    <span className="ad-hint">{dirty ? `未保存：「${selected.name}」项目访问将${accessOf(selected) ? '开启' : '关闭'}` : '没有未保存的修改'}</span>
+    <button ref={savePermsRef} className="lg-submit ad-create-btn" disabled={busy || roleLoading || !dirty} onClick={saveAccess}>保存项目访问</button>
   </div>
 
-  const focus = () => <div className="rp-single">
-    <aside className="rp-role-list">
-      {filtered.map(role => <button key={role.roleId} disabled={busy || roleLoading} className={`az-nav-item ${role.roleId === selectedId ? 'on' : ''}`} onClick={() => selectRole(role)}>
-        <span>{role.name}{dirtyList.some(entry => entry.roleId === role.roleId) ? ' · 未保存' : ''}</span><span className="ad-dim">{role.bindingCount} 人</span>
-      </button>)}
-    </aside>
-    <section className="rp-editor">
-      {selected ? <>
-        <div className="ad-row">
-          <input className="lg-input" aria-label="角色名称" value={name} disabled={!canManageRoles || busy || roleLoading} onChange={event => setName(event.target.value)} />
-          <input className="lg-input" aria-label="角色描述" value={description} disabled={!canManageRoles || busy || roleLoading} onChange={event => setDescription(event.target.value)} />
-          {canManageRoles && <button className="ad-mini" disabled={busy || roleLoading} onClick={saveMetadata}>保存资料</button>}
-          {canManageRoles && (selected.enabled
-            ? <button className="ad-mini" disabled={busy || roleLoading} onClick={() => setConfirmDisable(true)}>停用角色</button>
-            : <button className="ad-mini" disabled={busy || roleLoading} onClick={setEnabled}>启用角色</button>)}
-          {canViewMembers && <button className="ad-mini" aria-label={roleMembersLabel(selected)} disabled={busy} onClick={() => setMembersRole(selected)}>成员 {selected.bindingCount} 人</button>}
-        </div>
-        {confirmDisable && selected.enabled && <div className="rp-disable-confirm" role="alertdialog" aria-label={`确认停用角色 ${selected.name}`}>
-          <span>停用角色「{selected.name}」？该角色现有 {selected.bindingCount} 个用户绑定，停用后这些绑定将不再授予权限。</span>
-          <button className="ad-mini" disabled={busy || roleLoading} onClick={() => { setConfirmDisable(false); void setEnabled() }}>确认停用</button>
-          <button className="ad-mini" disabled={busy} onClick={() => setConfirmDisable(false)}>取消</button>
-        </div>}
-        {canViewPermissions ? <>
-          {!selected.enabled && <p className="rp-disabled-note">角色已停用，启用后才能编辑权限</p>}
-          <table className="ad-table rp-focus-table"><thead><tr><th>权限 · {activeCategory}</th><th>状态</th><th>说明</th></tr></thead>
-            <tbody>{columns.map(item => <tr key={item.actionId}>
-              <td>{item.label}</td><td>{cell(selected, item)}</td><td className="ad-dim">{item.description}</td>
-            </tr>)}</tbody></table>
-          <Collapsible id={`role-tech-${selected.roleId}`} trigger="技术详情">
-            <ul className="rp-diff">
-              <li>角色 ID：<span className="ad-mono">{selected.roleId}</span> · 版本 {selected.roleVersion}</li>
-              {columns.map(item => <li key={item.actionId}>{item.label}：<span className="ad-mono">{item.actionId}</span></li>)}
-            </ul>
-          </Collapsible>
-          <Collapsible id={`role-diff-${selected.roleId}`} trigger={`变更预览（${changes.length}）`}>
-            {changes.length === 0 || !draft ? <p className="ad-hint">没有权限变化</p> : <ul className="rp-diff">{changes.map(change =>
-              <li key={change.actionId}>{labelOf(change.actionId)}：{valueLabel(change.actionId, draft.baseline[change.actionId])} → {valueLabel(change.actionId, change)}</li>)}</ul>}
-          </Collapsible>
-        </> : <p className="ad-hint">当前账号没有查看角色权限目录的系统权限</p>}
-      </> : <p className="ad-hint">{roleLoading ? '加载中…' : '请选择角色'}</p>}
-    </section>
-  </div>
-
-  const previewPanel = (current: NonNullable<typeof preview>) => <section className="rp-preview" aria-label="保存前预览">
-    <div className="rp-preview-head">
-      <strong>{current.confirm ? '请确认以下变化后保存' : '待保存的变化'}</strong>
-      <button className="ad-mini" disabled={busy} onClick={() => setPreview(null)}>收起</button>
+  const matrix = () => <>
+    {!canManage && <p className="ad-hint">{PROJECT_ACCESS_MANAGE_REASON}</p>}
+    <div className="rp-matrix-wrap">
+      <table className="ad-table rp-matrix">
+        <thead><tr><th>角色</th><th>项目访问</th></tr></thead>
+        <tbody>{filtered.map(role => <tr key={role.roleId} className={role.roleId === selectedId ? 'rp-selected' : ''}>
+          <td><button className="ad-mini" disabled={busy || roleLoading} onClick={() => selectRole(role)}>{role.name}</button><span className="ad-dim"> · {role.bindingCount} 人</span></td>
+          <td><ProjectAccessCheckbox roleName={role.name} checked={accessOf(role)} canManage={canManage} showReason={false}
+            disabled={busy || roleLoading || role.roleId !== selectedId} onChange={next => editAccess(role, next)} /></td>
+        </tr>)}</tbody>
+      </table>
     </div>
-    {current.previews.map(item => <div key={item.roleId} className="rp-preview-role">
-      <div className="rp-preview-title">{item.roleName}
-        {!item.versionMatches && <span className="rp-warn-text"> · 角色已被他人修改，保存时将提示冲突并基于最新版本重放</span>}</div>
-      {item.error && <p className="rp-conflict"><Icon name="alert" size={12} />错误{item.errorActionId ? ` · ${labelOf(item.errorActionId)}` : ''}：{item.error}</p>}
-      {(item.changes ?? []).length > 0
-        ? <ul className="rp-diff">{item.changes.map(change => <li key={change.actionId}>{change.label}：{change.before} → {change.after}</li>)}</ul>
-        : <p className="ad-hint">没有状态变化</p>}
-      {(item.linkedExpansion ?? []).length > 0 && <p className="rp-linked"><Icon name="sparkles" size={12} />
-        系统将自动补齐：{item.linkedExpansion.map(labelOf).join('、')}{item.linkedExpansionState ? `（${item.linkedExpansionState}）` : ''}</p>}
-      {(item.keptLinkedActions ?? []).length > 0 && <p className="ad-hint">关闭创建项目后保留：{item.keptLinkedActions.map(labelOf).join('、')}</p>}
-      {item.migrationNote && <p className="ad-hint">{item.migrationNote}</p>}
-      {(item.conflicts ?? []).map(conflict => <p key={conflict.actionId} className="rp-conflict">
-        <Icon name="alert" size={12} />冲突 · {labelOf(conflict.actionId)}：{conflict.reason}</p>)}
-    </div>)}
-    {blocked && <p className="rp-conflict" role="alert"><Icon name="alert" size={12} />存在冲突或错误，调整后才能保存</p>}
-  </section>
+    {saveBar}
+  </>
 
   return <div className="rp-panel">
-    {canManageRoles && <div className="ad-create">
+    {canManage && <div className="ad-create">
       <div className="ad-row">
         <input className="lg-input" aria-label="新角色名称" placeholder="角色名称" value={newName} onChange={event => setNewName(event.target.value)} />
         <input className="lg-input" aria-label="新角色描述" placeholder="描述（可空）" value={newDescription} onChange={event => setNewDescription(event.target.value)} />
@@ -698,42 +298,42 @@ export function RolePermissionsPanel() {
         <select className="lg-input" aria-label="角色状态" value={status} disabled={busy} onChange={event => { setStatus(event.target.value as typeof status); setRoleCursor(''); setRoleTrail([]); setNextRoleCursor(''); setRoleLoading(true) }}>
           <option value="all">全部状态</option><option value="enabled">启用</option><option value="disabled">停用</option>
         </select>
-        {canViewPermissions && <select className="lg-input" aria-label="按权限过滤角色" value={actionFilter} disabled={busy}
-          onChange={event => { setActionFilter(event.target.value); setRoleCursor(''); setRoleTrail([]); setNextRoleCursor(''); setRoleLoading(true) }}>
-          <option value="">全部角色权限</option>{catalog.filter(item => !item.protected).map(item => <option key={item.actionId} value={item.actionId}>{item.label}</option>)}
-        </select>}
       </div>
     </Collapsible>
     <div className="ad-row rp-view-toggle">
-      {canViewPermissions && categories.length > 0 && <div className="rp-category-nav" role="group" aria-label="权限分类">
-        {categories.map(value => <button key={value} className={`ad-mini ${value === activeCategory ? 'on' : ''}`} aria-pressed={value === activeCategory}
-          onClick={() => setCategory(value)}>{value}</button>)}
-      </div>}
-      {canViewPermissions && <button className={`ad-mini ${effectiveView === 'matrix' ? 'on' : ''}`} aria-pressed={effectiveView === 'matrix'} onClick={() => { setMembersRole(null); setView('matrix') }}>角色矩阵</button>}
-      <button className={`ad-mini ${effectiveView === 'single' ? 'on' : ''}`} aria-pressed={effectiveView === 'single'} onClick={() => { setMembersRole(null); setView('single') }}>单角色配置</button>
+      <button className={`ad-mini ${view === 'single' ? 'on' : ''}`} onClick={() => setView('single')}>单角色配置</button>
+      <button className={`ad-mini ${view === 'matrix' ? 'on' : ''}`} onClick={() => setView('matrix')}>角色矩阵</button>
       <button className="ad-mini" disabled={busy || roleLoading || !roleTrail.length} onClick={() => { setRoleCursor(roleTrail[roleTrail.length - 1]); setRoleTrail(roleTrail.slice(0, -1)) }}>上一页角色</button>
       <button className="ad-mini" disabled={busy || roleLoading || !nextRoleCursor} onClick={() => { setRoleTrail([...roleTrail, roleCursor]); setRoleCursor(nextRoleCursor) }}>下一页角色</button>
     </div>
-    {canViewPermissions && <Collapsible id="role-linked-help" trigger="权限关联说明">
-      <p className="ad-hint">开启「{labelOf(PROJECT_CREATE_ACTION)}」的角色，在本人创建的项目中自动具备{PROJECT_CREATE_LINKED_ACTIONS.map(id => `「${labelOf(id)}」`).join('、')}。
-        这些资格仅对本人创建的项目生效，其他项目仍按项目授权判断。</p>
-    </Collapsible>}
-    <div ref={statusRef} tabIndex={-1} className="rp-status">
-      {notice && <div className="ad-notice" role="status"><Icon name="check" size={14} />{notice}</div>}
-      {err && <div className="lg-err" role="alert"><Icon name="alert" size={14} />{err}</div>}
-    </div>
-    {membersRole && canViewMembers
-      ? <RoleMembersView key={membersRole.roleId} role={roles?.find(role => role.roleId === membersRole.roleId) ?? membersRole} canAssign={canAssignMembers}
-        backLabel={effectiveView === 'matrix' ? '返回角色矩阵' : '返回单角色配置'} onBack={() => setMembersRole(null)} onAssigned={() => void load()} />
-      : roles === null && roleLoading ? <div className="empty-note">加载中…</div> : effectiveView === 'matrix' ? matrix() : focus()}
-    {preview && previewPanel(preview)}
-    {canManagePermissions && dirty && <div className="rp-savebar" role="region" aria-label="未保存的权限修改">
-      <span className="rp-savebar-summary">已修改 {dirtyList.length} 个角色、{changeCount} 项设置</span>
-      <button className="ad-mini" disabled={busy || roleLoading} onClick={() => void requestPreview(false)}>查看变化</button>
-      <button className="ad-mini" disabled={busy} onClick={cancelAll}>取消全部</button>
-      {preview?.confirm
-        ? <button ref={savePermsRef} className="lg-submit ad-create-btn" disabled={busy || roleLoading || blocked} onClick={() => void confirmSave()}>确认保存</button>
-        : <button ref={savePermsRef} className="ad-mini" disabled={busy || roleLoading || !editable} onClick={() => void requestPreview(true)}>保存</button>}
+    {notice && <div className="ad-notice" role="status"><Icon name="check" size={14} />{notice}</div>}
+    {err && <div className="lg-err" role="alert"><Icon name="alert" size={14} />{err}</div>}
+    {view === 'matrix' ? matrix() : <div className="rp-single">
+      <aside className="rp-role-list">
+        {filtered.map(role => <button key={role.roleId} disabled={busy || roleLoading} className={`az-nav-item ${role.roleId === selectedId ? 'on' : ''}`} onClick={() => selectRole(role)}>
+          <span>{role.name}</span><span className="ad-dim">{role.bindingCount} 人</span>
+        </button>)}
+      </aside>
+      <section className="rp-editor">
+        {selected ? <>
+          <div className="ad-row">
+            <input className="lg-input" aria-label="角色名称" value={name} disabled={!canManage || busy || roleLoading} onChange={event => setName(event.target.value)} />
+            <input className="lg-input" aria-label="角色描述" value={description} disabled={!canManage || busy || roleLoading} onChange={event => setDescription(event.target.value)} />
+            {canManage && <button className="ad-mini" disabled={busy || roleLoading} onClick={saveMetadata}>保存资料</button>}
+            {canManage && (selected.enabled
+              ? <button className="ad-mini" disabled={busy || roleLoading} onClick={() => setConfirmDisable(true)}>停用角色</button>
+              : <button className="ad-mini" disabled={busy || roleLoading} onClick={setEnabled}>启用角色</button>)}
+          </div>
+          {confirmDisable && selected.enabled && <div className="rp-disable-confirm" role="alertdialog" aria-label={`确认停用角色 ${selected.name}`}>
+            <span>停用角色「{selected.name}」？该角色现有 {selected.bindingCount} 个用户绑定，停用后这些绑定将不再授予权限。</span>
+            <button className="ad-mini" disabled={busy || roleLoading} onClick={() => { setConfirmDisable(false); void setEnabled() }}>确认停用</button>
+            <button className="ad-mini" disabled={busy} onClick={() => setConfirmDisable(false)}>取消</button>
+          </div>}
+          <ProjectAccessCheckbox roleName={selected.name} checked={accessOf(selected)} canManage={canManage}
+            disabled={busy || roleLoading} onChange={next => editAccess(selected, next)} />
+          {saveBar}
+        </> : <p className="ad-hint">请选择角色</p>}
+      </section>
     </div>}
   </div>
 }

src/components/TaskSidebar.tsx

@@ -9,9 +9,13 @@ import type { Conversation } from '../contracts'
 import { relativeTime, filterTasks } from '../tasklist'
 import { projectStage, projectStateLabel, projectWorkError } from '../projectmeta'
 import { buildWorkspaceEntries } from '../workspaces'
+import { WORK_STATE_NOTICES, projectWorkClosed } from '../rdmManagement'
+import { RdmTemplateDocsPanel } from './adminRdmSections'
+
+const WORK_CLOSED_LABEL = '工作已关闭'
 
 /** 小型弹出菜单：锚点下方渲染，点击外部关闭。 */
-function Menu({ anchor, onClose, children }: { anchor: HTMLElement | null; onClose: () => void; children: React.ReactNode }) {
+function Menu({ anchor, onClose, className, children }: { anchor: HTMLElement | null; onClose: () => void; className?: string; children: React.ReactNode }) {
   const ref = useRef<HTMLDivElement>(null)
   useEffect(() => {
     if (!anchor || !ref.current) return
@@ -27,7 +31,7 @@ function Menu({ anchor, onClose, children }: { anchor: HTMLElement | null; onClo
     return () => window.removeEventListener('mousedown', h)
   }, [anchor])
   if (!anchor) return null
-  return <div ref={ref} className="tsb-menu" onClick={e => e.stopPropagation()}>{children}</div>
+  return <div ref={ref} className={`tsb-menu${className ? ` ${className}` : ''}`} onClick={e => e.stopPropagation()}>{children}</div>
 }
 
 function MenuItem({ onClick, danger, icon, children }: { onClick: () => void; danger?: boolean; icon?: Parameters<typeof Icon>[0]['name']; children: React.ReactNode }) {
@@ -58,13 +62,14 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
   /** 审计入口能力门控（增量 2）：命令面探测通过才展示「追溯审计」。 */
   const rdmAuditAvailable = useStore(s => s.rdmAuditAvailable)
   const rdmCockpitAvailable = useStore(s => s.rdmCockpitAvailable)
+  const rdmDocTemplatesAvailable = useStore(s => s.rdmDocTemplatesAvailable)
   const theme = useStore(s => s.ui.theme)
   const pendingBadge = useStore(s =>
     s.cards.filter(c => c.status === 'action_required').length +
     s.projectCards.filter(c => c.status === 'action_required').length)
 
   const [q, setQ] = useState('')
-  const [menu, setMenu] = useState<{ kind: 'new' | 'account' | 'project' | `row:${string}`; anchor: HTMLElement } | null>(null)
+  const [menu, setMenu] = useState<{ kind: 'new' | 'account' | 'project' | 'templates' | `row:${string}`; anchor: HTMLElement } | null>(null)
   const [creatingProject, setCreatingProject] = useState(false)
   const [newProjectName, setNewProjectName] = useState('')
 
@@ -82,6 +87,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
   const currentProject = projects.find(p => p.id === currentProjectId)
   const stage = projectStateLabel(currentProject?.settings) ?? projectStage(currentProject?.settings)
   const workError = currentProject ? projectWorkError(currentProject) : null
+  const workClosed = projectWorkClosed(currentProject)
   const rowTask = menu?.kind.startsWith('row:') ? tasks.find(t => t.id === menu.kind.slice(4)) : null
   const rowMenuAnchor = menu && menu.kind.startsWith('row:') ? menu.anchor : null
 
@@ -131,6 +137,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
           <Icon name="folder" size={15} />
           <span className="tsb-projrow-name">{currentProject?.name ?? '选择项目'}</span>
           {stage && <span className="tsb-projrow-stage">{stage}</span>}
+          {workClosed && <span className="tsb-projrow-stage" title={WORK_STATE_NOTICES.closed}>{WORK_CLOSED_LABEL}</span>}
           <span className="tsb-user-chev"><Icon name="chevron-down" size={13} /></span>
         </button>
         <button className="tsb-iconbtn" title="收起侧栏（⌘B）" onClick={onCollapse}><Icon name="panel-left" /></button>
@@ -139,7 +146,8 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
       {/* 主入口创建会话；项目创建保留在次级菜单。 */}
       <div className="tsb-actions">
         <div className="tsb-newtask">
-          <button className="tsb-newtask-main" title="在当前项目新建对话（⌘N）" onClick={() => createConversation()}>
+          <button className="tsb-newtask-main" disabled={workClosed}
+            title={workClosed ? WORK_STATE_NOTICES.closed : '在当前项目新建对话（⌘N）'} onClick={() => createConversation()}>
             <Icon name="plus" size={15} />新建对话
           </button>
           <button className="tsb-newtask-caret" title="更多创建选项"
@@ -185,7 +193,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
         )}
 
         {rest.length === 0 && pinned.length === 0 && (
-          <div className="tsb-empty">{workError ?? '从「新建对话」开始，描述你想完成的工作。'}</div>
+          <div className="tsb-empty">{workError ?? (workClosed ? WORK_STATE_NOTICES.closed : '从「新建对话」开始，描述你想完成的工作。')}</div>
         )}
         {rest.map(t => taskRow(t))}
       </div>
@@ -197,6 +205,13 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
           <span className="tsb-tool-name">文件</span>
           {artifacts.length > 0 && <span className="tsb-group-cnt">{artifacts.length}</span>}
         </button>
+        {currentProject && rdmDocTemplatesAvailable && (
+          <button className="tsb-tool" title="浏览已发布文档模板，逐条显式选择后生成项目文档"
+            onClick={e => { const el = e.currentTarget; setMenu(m => m?.kind === 'templates' ? null : { kind: 'templates', anchor: el }) }}>
+            <span className="tsb-tool-icon"><Icon name="file" size={14} /></span>
+            <span className="tsb-tool-name">按模板生成文档</span>
+          </button>
+        )}
         {tools.map(entry => (
           <button key={entry.key} className="tsb-tool" title={entry.shortcut} onClick={() => store.openWorkspace(entry.key)}>
             <span className="tsb-tool-icon">{entry.icon}</span>
@@ -231,10 +246,11 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
         {projects.map(p => {
           const count = tasks.filter(t => t.projectId === p.id && !t.archived).length
           const pstage = projectStateLabel(p.settings) ?? projectStage(p.settings)
+          const pclosed = projectWorkClosed(p) ? `${WORK_CLOSED_LABEL} · ` : ''
           return (
             <MenuItem key={p.id} icon="folder" onClick={() => { switchProject(p.id); setMenu(null) }}>
               {p.name}
-              <kbd>{p.id === currentProjectId ? '当前' : pstage ? `${pstage} · ` : ''}{count} 会话</kbd>
+              <kbd>{pclosed}{p.id === currentProjectId ? '当前' : pstage ? `${pstage} · ` : ''}{count} 会话</kbd>
             </MenuItem>
           )
         })}
@@ -243,6 +259,10 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
         <MenuItem icon="plus" onClick={() => { setCreatingProject(true); setMenu(null) }}>新建项目…</MenuItem>
       </Menu>
 
+      <Menu anchor={menu?.kind === 'templates' ? menu.anchor : null} onClose={() => setMenu(null)} className="tsb-tpl-pop">
+        {currentProject && <RdmTemplateDocsPanel key={currentProject.id} project={currentProject} />}
+      </Menu>
+
       <Menu anchor={menu?.kind === 'new' ? menu.anchor : null} onClose={() => setMenu(null)}>
         <MenuItem icon="plus" onClick={() => { createConversation(); setMenu(null) }}>新建对话 · 当前项目<kbd>⌘N</kbd></MenuItem>
         <div className="tsb-menu-div" />

src/components/Workbench.tsx

@@ -14,6 +14,7 @@ import { WorkExecutionRecord } from './WorkExecutionRecord'
 // 工件解析/打开注入：渲染器纯展示，doc-ref 词汇经此桥接本仓状态（D29）。
 // 打开语义走 requestPreview 唯一入口（第三栏「文件」入口）。
 export const docBridge: DocBridge = {
+  onOpenTaskSource: (cardId, source) => store.openTaskSource(cardId, source),
   resolveDoc: id => store.getState().artifacts.find(a => a.id === id),
   onOpenDoc: id => {
     const art = store.getState().artifacts.find(a => a.id === id)

src/components/adminRdmSections.tsx

@@ -6,13 +6,219 @@ import { useEffect, useState, useRef, useCallback, useMemo } from 'react'
 import { api } from '../api'
 import type { Project } from '../contracts'
 import { projectWorkError } from '../projectmeta'
-import { useStore } from '../store'
+import { store, useStore } from '../store'
 import { Btn, Collapsible, Icon, Picker } from '@ui'
 import {
   memberAddPayload, memberRemovePayload, memberSetRolePayload,
   permCheckPayload, describeSource,
+  ConfirmCardPending, WORK_STATE_BADGES, WORK_STATE_NOTICES, highDangerSource, isHighDangerCommand,
+  memberWorkControl, memberWorkPayload, memberWorkState, projectWorkControl, projectWorkPayload, projectWorkStatus,
+  projectWorkClosed, rdmProjectCommandError, commitTemplateInstantiate, templateKey, templateSelectable, templateStateLabel,
+  type CommandSource, type DocTemplateRow, type ProjectWorkStatus, type WorkControl, type WorkStateKind,
 } from '../rdmManagement'
-import { dutyConditionNote, linkedCapabilitySummary } from '../permissionExplanations'
+
+// ---- U4 工作状态呈现：文字徽标（非颜色唯一）+ 项目卡 + 成员行控件 ----
+
+export function WorkStateBadge({ state }: { state: WorkStateKind }) {
+  const badge = WORK_STATE_BADGES[state]
+  return <span className={badge.className} data-work-state={state}>{badge.label}</span>
+}
+
+const confirmHint = (control: WorkControl) =>
+  control.disabledReason || (isHighDangerCommand(control.command) ? '高危操作：先生成确认卡，确认后才执行' : undefined)
+
+export function ProjectWorkCardView({ status, isCreator, busy, onRun }: {
+  status: ProjectWorkStatus; isCreator: boolean; busy: boolean; onRun: (control: WorkControl) => void
+}) {
+  const control = projectWorkControl(status, isCreator)
+  const danger = isHighDangerCommand(control.command)
+  return (
+    <div className="ad-create pw-card" role="group" aria-label="项目工作状态">
+      <div className="ad-row">
+        <span>项目工作</span>
+        <WorkStateBadge state={status.state} />
+        <button className={`ad-mini pw-action${danger ? ' pw-danger' : ''}`} disabled={busy || !!control.disabledReason}
+          title={confirmHint(control)} onClick={() => onRun(control)}>
+          {control.label}{danger ? '（需确认）' : ''}
+        </button>
+      </div>
+      <p className="ad-hint">{status.state === 'closed' ? WORK_STATE_NOTICES.closed
+        : '关闭后全体成员的新建与继续工作被拒，已有会话与资料保留只读；关闭需在待处理中确认后执行。'}</p>
+      {control.disabledReason && <p className="ad-hint">{control.disabledReason}</p>}
+    </div>
+  )
+}
+
+interface MemberWorkRow { owner: string; state?: string; stateVersion?: number }
+
+export function MemberWorkCell({ row, isCreator, creator, busy, onRun }: {
+  row: MemberWorkRow; isCreator: boolean; creator?: string; busy: boolean
+  onRun: (row: MemberWorkRow, control: WorkControl) => void
+}) {
+  const state = memberWorkState(row)
+  const control = memberWorkControl(row, { isCreator, creator })
+  return (
+    <span className="ad-actions">
+      <WorkStateBadge state={state} />
+      {control && (
+        <button className={`ad-mini${isHighDangerCommand(control.command) ? ' pw-danger' : ''}`}
+          disabled={busy || !!control.disabledReason} title={confirmHint(control)}
+          onClick={() => onRun(row, control)}>{control.label}</button>
+      )}
+    </span>
+  )
+}
+
+/** 确认卡落在项目收件箱：关闭设置、切到该项目的项目范围待处理并定位卡片。 */
+async function openConfirmCard(projectId: string, cardId: string) {
+  store.openProjectSettings(null)
+  if (store.getState().currentProjectId !== projectId) await store.openProject(projectId)
+  store.setInboxScope('project')
+  await store.loadProjectCards()
+  store.openInbox(cardId || undefined)
+}
+
+function ConfirmPendingNotice({ projectId, cardId }: { projectId: string; cardId: string }) {
+  return (
+    <div className="ad-notice" role="status">
+      <Icon name="alert" size={14} />
+      <span>已生成确认卡：确认后才会执行。</span>
+      <button className="ad-mini" onClick={() => { void openConfirmCard(projectId, cardId) }}>前往待处理确认</button>
+    </div>
+  )
+}
+
+// ---- U5 按模板生成文档：全部条目可见；仅 supported 条目可显式选择，逐条实例化 ----
+
+export function TemplateListView({ templates, selectedKey, blockedReason, onChoose }: {
+  templates: DocTemplateRow[]; selectedKey: string; blockedReason: string | null
+  onChoose: (t: DocTemplateRow) => void
+}) {
+  return (
+    <ul className="tpl-list" aria-label="已发布文档模板">
+      {templates.map(t => {
+        const key = templateKey(t)
+        const check = templateSelectable(t)
+        const chosen = key === selectedKey
+        return (
+          <li key={key} className={`tpl-item${chosen ? ' on' : ''}`} data-template={key} data-generation={t.generation}>
+            <div className="tpl-head">
+              <span className="tpl-title">{t.title || t.templateId}</span>
+              <span className={check.ok ? 'ad-chip ad-chip-admin' : 'ad-chip ad-chip-warn'}>{check.ok ? '可生成' : '不可生成'}</span>
+              <span className="ad-chip">{templateStateLabel(t.state)}</span>
+            </div>
+            <span className="ad-dim ad-mono">{key}{t.stage ? ` · ${t.stage}` : ''}</span>
+            {t.docTypes && t.docTypes.length > 0 && <span className="ad-dim">适用文档类型：{t.docTypes.join('、')}</span>}
+            {!check.ok && <p className="ad-hint">不可生成：{check.reason}</p>}
+            <span>
+              <button className="ad-mini" aria-pressed={chosen} disabled={!check.ok || !!blockedReason}
+                title={!check.ok ? check.reason : blockedReason ?? undefined} onClick={() => onChoose(t)}>
+                {chosen ? '已选择' : '选择此模板'}
+              </button>
+            </span>
+          </li>
+        )
+      })}
+    </ul>
+  )
+}
+
+const newOperationId = () =>
+  crypto.randomUUID ? crypto.randomUUID() : 'op-' + Date.now() + '-' + Math.random().toString(36).slice(2)
+
+export function RdmTemplateDocsPanel({ project }: { project: Project }) {
+  const [templates, setTemplates] = useState<DocTemplateRow[] | null>(null)
+  const [loadErr, setLoadErr] = useState('')
+  const [selectedKey, setSelectedKey] = useState('')
+  const [docType, setDocType] = useState('')
+  const [title, setTitle] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [err, setErr] = useState('')
+  const [notice, setNotice] = useState('')
+  // 清单与提交的代次：切项目即推进，迟到响应丢弃。
+  const gen = useRef(0)
+  // 同一输入的重试复用编号（服务端据此幂等返回同一条来源消息）；输入一变即换新编号。
+  const operation = useRef<{ sig: string; id: string } | null>(null)
+
+  useEffect(() => {
+    const g = ++gen.current
+    setTemplates(null); setLoadErr(''); setSelectedKey(''); setErr(''); setNotice(''); setBusy(false)
+    api.rdmCommand<DocTemplateRow[]>('rdm.docs.templates', {})
+      .then(rows => { if (g === gen.current) setTemplates(Array.isArray(rows) ? rows : []) })
+      .catch(e => { if (g === gen.current) setLoadErr(String(e)) })
+    return () => { ++gen.current }
+  }, [project.id])
+
+  const blockedReason = projectWorkClosed(project) ? WORK_STATE_NOTICES.closed
+    : rdmProjectCommandError(project, 'rdm.docs.instantiate')
+  const chosen = (templates ?? []).find(t => templateKey(t) === selectedKey && templateSelectable(t).ok)
+
+  const choose = (t: DocTemplateRow) => {
+    setSelectedKey(templateKey(t))
+    setDocType(t.docTypes?.length === 1 ? t.docTypes[0] : '')
+    setTitle(''); setErr(''); setNotice('')
+  }
+
+  const submit = async () => {
+    if (!chosen || !docType || busy || blockedReason) return
+    const sig = JSON.stringify([project.id, templateKey(chosen), docType, title.trim()])
+    const op = operation.current?.sig === sig ? operation.current : { sig, id: newOperationId() }
+    operation.current = op
+    const g = gen.current
+    setBusy(true); setErr(''); setNotice('')
+    try {
+      const out = await commitTemplateInstantiate(api, {
+        host: project, operationId: op.id, template: chosen, docType, title,
+      }) as { docId?: string } | undefined
+      if (g !== gen.current) return
+      setNotice(`已按模板「${chosen.title || chosen.templateId}」（${templateKey(chosen)}）生成文档${out?.docId ? ` ${out.docId}` : ''}`)
+      operation.current = null
+      setSelectedKey('')
+    } catch (e) {
+      if (g === gen.current) setErr(String(e).replace(/^Error:\s*/, ''))
+    } finally {
+      if (g === gen.current) setBusy(false)
+    }
+  }
+
+  return (
+    <div className="tpl-panel">
+      <div className="tpl-head">
+        <span className="tpl-title">按模板生成文档</span>
+        {templates && <span className="ad-dim">共 {templates.length} 个模板</span>}
+      </div>
+      <p className="ad-hint">逐条显式选择后生成；不可生成的模板保留可见并标明原因。</p>
+      {blockedReason && <p className="ad-hint">{blockedReason}</p>}
+      {templates === null && <p className="ad-hint">{loadErr ? '模板清单未加载（见下方提示）' : '加载中…'}</p>}
+      {templates && templates.length === 0 && <p className="ad-hint">暂无已发布的文档模板</p>}
+      {templates && templates.length > 0 && (
+        <TemplateListView templates={templates} selectedKey={selectedKey} blockedReason={blockedReason} onChoose={choose} />
+      )}
+      {chosen && (
+        <div className="ad-create tpl-form">
+          <span>已选：<b>{chosen.title || chosen.templateId}</b> <span className="ad-dim ad-mono">{templateKey(chosen)}</span></span>
+          <select className="lg-input" aria-label="文档类型" value={docType} onChange={e => setDocType(e.target.value)}>
+            {(chosen.docTypes?.length ?? 0) > 1 && <option value="">选择文档类型…</option>}
+            {(chosen.docTypes ?? []).map(d => <option key={d} value={d}>{d}</option>)}
+          </select>
+          <input className="lg-input" aria-label="文档标题" placeholder="文档标题（留空沿用模板标题）" value={title}
+            onChange={e => setTitle(e.target.value)} />
+          <Collapsible trigger="模板溯源">
+            <span className="ad-dim ad-mono">来源格式 {chosen.sourceFormat || '—'} · sha256 {chosen.sourceSha256 || '—'}</span>
+          </Collapsible>
+          <span className="ad-actions">
+            <button className="ad-mini" disabled={busy || !docType || !!blockedReason} onClick={() => { void submit() }}>
+              {busy ? <span className="mk-sweep">生成中</span> : '生成文档'}
+            </button>
+            <button className="ad-mini" disabled={busy} onClick={() => setSelectedKey('')}>取消选择</button>
+          </span>
+        </div>
+      )}
+      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
+      {(err || loadErr) && <div className="lg-err"><Icon name="alert" size={14} />{err || loadErr}</div>}
+    </div>
+  )
+}
 
 // ---- 项目设置：成员（P7：可搜索人员选择器 + 专业角色/项目身份两列 + 显式身份调整）----
 
@@ -26,12 +232,19 @@ import {
 interface MemberRow {
   owner: string; name?: string; role: string; addedBy: string; addedAt: string
   profRole?: { roleId: string; name: string } | null
+  state?: string; stateVersion?: number
 }
 
 export function RdmMembersSection({ project }: { project: Project }) {
   const projectId = project.id
   const writeError = projectWorkError(project)
-  const cmd = <T,>(id: string, params: Record<string, unknown> = {}) => api.rdmProjectCommand<T>(project, id, params)
+  const cmd = <T,>(id: string, params: Record<string, unknown> = {}, source?: CommandSource) =>
+    api.rdmProjectCommand<T>(project, id, params, source)
+  const me = useStore(s => s.me?.owner)
+  const workStatesAvailable = useStore(s => s.rdmWorkStatesAvailable)
+  const workStatus = workStatesAvailable ? projectWorkStatus(project) : null
+  const isCreator = !!me && project.owner === me
+  const [pendingCard, setPendingCard] = useState<string | null>(null)
   const [rows, setRows] = useState<MemberRow[] | null>(null)
   const [memberNext, setMemberNext] = useState('')
   const [memberTotal, setMemberTotal] = useState<number | null>(null)
@@ -113,11 +326,28 @@ export function RdmMembersSection({ project }: { project: Project }) {
   const refresh = () => loadMembers('', false)
 
   const run = async (label: string, fn: () => Promise<unknown>) => {
-    setErr(''); setNotice(''); setBusy(true)
+    setErr(''); setNotice(''); setPendingCard(null); setBusy(true)
     try { await fn(); setNotice(label); await refresh() }
     catch (e) { setErr(String(e)) } finally { setBusy(false) }
   }
 
+  /** 版本取自各自读面（项目列表 / 成员清单）；结束后两者各由其唯一所有者重取，陈旧拒绝后即得新版本。 */
+  const runWork = async (label: string, command: string, params: Record<string, unknown>) => {
+    setErr(''); setNotice(''); setPendingCard(null); setBusy(true)
+    try {
+      const source = isHighDangerCommand(command) ? await highDangerSource(api, project) : undefined
+      await cmd(command, params, source)
+      setNotice(label)
+    } catch (e) {
+      if (e instanceof ConfirmCardPending) setPendingCard(e.cardId)
+      else setErr(String(e))
+    } finally {
+      setBusy(false)
+      void store.refreshProjects()
+      await refresh()
+    }
+  }
+
   const onPick = (ids: string[]) => {
     setPicked(ids)
     setPickedItems(ids.flatMap(id => {
@@ -140,9 +370,22 @@ export function RdmMembersSection({ project }: { project: Project }) {
       </select>
     ) : null
 
+  const myState = workStatesAvailable ? memberWorkState((rows ?? []).find(m => m.owner === me) ?? {}) : 'active'
+  const runMemberWork = (m: { owner: string; stateVersion?: number }, control: WorkControl) => {
+    if (typeof m.stateVersion !== 'number') return
+    void runWork(control.command === 'rdm.project.member.suspend' ? `已暂停 ${m.owner}` : `已恢复 ${m.owner}`,
+      control.command, memberWorkPayload(projectId, m.owner, m.stateVersion))
+  }
+
   return (
     <div>
       {writeError && <p className="ad-hint">{writeError}</p>}
+      {workStatus && (
+        <ProjectWorkCardView status={workStatus} isCreator={isCreator} busy={busy || !!writeError}
+          onRun={control => runWork(control.command === 'rdm.project.work.close' ? '已关闭项目工作' : '已重新开启项目工作',
+            control.command, projectWorkPayload(projectId, workStatus.version))} />
+      )}
+      {myState !== 'active' && <p className="ad-hint">你在本项目{WORK_STATE_NOTICES[myState]}</p>}
       <div className="ad-create">
         <div className="ad-row">
           {roleFilter(candRoleId, setCandRoleId, '候选专业角色筛选')}
@@ -189,30 +432,42 @@ export function RdmMembersSection({ project }: { project: Project }) {
       </div>
       {!directoryOk && <p className="ad-hint">账号目录暂不可用：成员姓名可能缺失，仅按账号显示。</p>}
       <table className="ad-table">
-        <thead><tr><th>成员</th><th>专业角色</th><th>项目身份</th><th>添加人</th><th>添加时间</th><th></th></tr></thead>
+        <thead><tr><th>成员</th><th>专业角色</th><th>项目身份</th>{workStatesAvailable && <th>状态</th>}<th>添加人</th><th>添加时间</th><th></th></tr></thead>
         <tbody>
-          {(rows ?? []).map(m => (
-            <tr key={m.owner}>
-              <td className="ad-mono">{personLabel(m)}</td>
-              <td className="ad-dim">{m.profRole?.name || '—'}</td>
-              <td>{m.role === 'owner' ? <span className="ad-chip ad-chip-admin">项目负责人</span> : <span className="ad-chip">项目成员</span>}</td>
-              <td className="ad-dim">{m.addedBy || '—'}</td>
-              <td className="ad-dim">{m.addedAt ? new Date(m.addedAt).toLocaleString() : '—'}</td>
-              <td>
-                <button className="ad-mini" disabled={busy || !!writeError}
-                  title={m.role === 'owner' ? '降为项目成员（setRole）' : '升为项目负责人（setRole）'}
-                  onClick={() => run(`已调整 ${m.owner} 的项目身份`, () =>
-                    cmd('rdm.project.member.set-role', memberSetRolePayload(projectId, m.owner, m.role === 'owner' ? 'member' : 'owner')))}>
-                  {m.role === 'owner' ? '降为成员' : '升为负责人'}
-                </button>{' '}
-                <button className="ad-mini" disabled={busy || !!writeError}
-                  onClick={() => run(`已移除 ${m.owner}`,
-                    () => cmd('rdm.project.member.remove', memberRemovePayload(projectId, m.owner)))}>移除</button>
-              </td>
-            </tr>
-          ))}
-          {rows !== null && rows.length === 0 && <tr><td colSpan={6} className="ad-dim">{filtering ? '没有匹配的成员' : '暂无成员'}</td></tr>}
-          {rows === null && <tr><td colSpan={6} className="ad-dim">{err ? '成员清单未加载（见下方提示）' : '加载中…'}</td></tr>}
+          {(rows ?? []).map(m => {
+            const state = memberWorkState(m)
+            return (
+              <tr key={m.owner} title={state === 'active' ? undefined : WORK_STATE_NOTICES[state]}>
+                <td className="ad-mono">{personLabel(m)}</td>
+                <td className="ad-dim">{m.profRole?.name || '—'}</td>
+                <td>{m.role === 'owner' ? <span className="ad-chip ad-chip-admin">项目负责人</span> : <span className="ad-chip">项目成员</span>}</td>
+                {workStatesAvailable && (
+                  <td>
+                    <MemberWorkCell row={m} isCreator={isCreator} creator={project.owner} busy={busy || !!writeError}
+                      onRun={runMemberWork} />
+                  </td>
+                )}
+                <td className="ad-dim">{m.addedBy || '—'}</td>
+                <td className="ad-dim">{m.addedAt ? new Date(m.addedAt).toLocaleString() : '—'}</td>
+                <td>
+                  {state === 'removed' ? <span className="ad-dim">仅历史只读</span> : <span className="ad-actions">
+                    <button className="ad-mini" disabled={busy || !!writeError || state === 'suspended'}
+                      title={state === 'suspended' ? '已暂停：先恢复再调整项目身份'
+                        : m.role === 'owner' ? '降为项目成员（setRole）' : '升为项目负责人（setRole）'}
+                      onClick={() => run(`已调整 ${m.owner} 的项目身份`, () =>
+                        cmd('rdm.project.member.set-role', memberSetRolePayload(projectId, m.owner, m.role === 'owner' ? 'member' : 'owner')))}>
+                      {m.role === 'owner' ? '降为成员' : '升为负责人'}
+                    </button>
+                    <button className="ad-mini" disabled={busy || !!writeError}
+                      onClick={() => run(`已移除 ${m.owner}`,
+                        () => cmd('rdm.project.member.remove', memberRemovePayload(projectId, m.owner)))}>移除</button>
+                  </span>}
+                </td>
+              </tr>
+            )
+          })}
+          {rows !== null && rows.length === 0 && <tr><td colSpan={workStatesAvailable ? 7 : 6} className="ad-dim">{filtering ? '没有匹配的成员' : '暂无成员'}</td></tr>}
+          {rows === null && <tr><td colSpan={workStatesAvailable ? 7 : 6} className="ad-dim">{err ? '成员清单未加载（见下方提示）' : '加载中…'}</td></tr>}
         </tbody>
       </table>
       {memberNext && rows !== null && (
@@ -222,6 +477,7 @@ export function RdmMembersSection({ project }: { project: Project }) {
         </div>
       )}
       {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
+      {pendingCard !== null && <ConfirmPendingNotice projectId={projectId} cardId={pendingCard} />}
       {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
     </div>
   )
@@ -270,10 +526,7 @@ function ActionDetailTable({ actions, onOverride, canManage }: {
               <td title={`内部标识 ${a.action}`}>{actionTitle(a)}</td>
               <td>{a.allowed ? <span className="ad-chip ad-chip-admin">允许</span> : <span className="ad-chip ad-chip-warn">拒绝</span>}</td>
               <td className="ad-dim">{describeSource(a.source)}</td>
-              <td className="ad-dim">
-                {a.reason || '—'}
-                {dutyConditionNote(a.action) && <span className="ad-dim ad-cond-note">{dutyConditionNote(a.action)}</span>}
-              </td>
+              <td className="ad-dim">{a.reason || '—'}</td>
               {canManage ? (
                 <td>
                   <select className="lg-input" value={overrideOf(a)} style={{ minWidth: 120 }}
@@ -364,9 +617,6 @@ export function RdmPermMatrixSection({ project }: { project: Project }) {
   }
 
   const canManage = !writeError && !!matrix && matrix.role !== undefined
-  const linked = me?.linkedCapabilities
-  const showLinked = !!linked && !!matrix && matrix.member === me?.owner
-    && (linked.projectCreate || (linked.actions ?? []).length > 0)
 
   return (
     <div>
@@ -392,11 +642,6 @@ export function RdmPermMatrixSection({ project }: { project: Project }) {
 
       {view === 'member' && matrix && (
         <>
-          {showLinked && (
-            <Collapsible trigger="创建项目与本人项目管理资格">
-              <p className="ad-hint">{linkedCapabilitySummary(linked)}</p>
-            </Collapsible>
-          )}
           <div className="ad-row">
             <span>成员 <b className="ad-mono">{matrix.member}</b> · 项目身份 <b>{matrix.role === 'owner' ? '项目负责人' : matrix.role === 'member' ? '项目成员' : matrix.role}</b>
               {matrix.profRole && <> · 专业角色 <b>{matrix.profRole.name}</b></>}

src/components/adminSections.tsx

@@ -13,10 +13,12 @@ import {
   recoveryAttemptKey, recoveryProposalErrorMessage, recoveryProposalHint, recoveryProposalNotice, recoveryProposalRejected,
   recoveryStatusLabel, type RecoveryAttempt,
 } from '../recovery'
+import { accountActionPolicy, canAppointAdmins } from '../accountAuthority'
+import { AdminAppointmentButton, CreateAdminOption, IdentityChip } from './AccountUsersPanel'
 
 // ---- 用户管理：页面建号可设置/生成初始密码，管理员重置生成临时密码；
 // 保留恢复提案与 Key 管理作为既有非登录页恢复流程。 ----
-interface AdminUserRow { userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number }
+interface AdminUserRow { userId: string; owner: string; name: string; isAdmin: boolean; isSuperAdmin?: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number }
 
 export function UsersPanel() {
   const me = useStore(s => s.me)
@@ -26,6 +28,7 @@ export function UsersPanel() {
   const [owner, setOwner] = useState('')
   const [name, setName] = useState('')
   const [initialPassword, setInitialPassword] = useState('')
+  const [createAsAdmin, setCreateAsAdmin] = useState(false)
   const [generatedCredential, setGeneratedCredential] = useState<{ owner: string; password: string; kind: 'initial' | 'temporary' } | null>(null)
   const [busy, setBusy] = useState(false)
   // 恢复提案面板：propFor 打开指定用户的提案视图（创建 / 状态 / 撤销）。
@@ -53,10 +56,10 @@ export function UsersPanel() {
     setErr(''); setNotice('')
     setBusy(true)
     try {
-      const out = await api.createAdminUser(owner.trim(), name.trim(), initialPassword.trim() || undefined)
+      const out = await api.createAdminUser(owner.trim(), name.trim(), initialPassword.trim() || undefined, canAppointAdmins(me) && createAsAdmin)
       setGeneratedCredential(out.initialPassword ? { owner: out.owner, password: out.initialPassword, kind: 'initial' } : null)
       setNotice(out.initialPassword ? `已创建 ${out.owner}，请将下方一次性初始密码交付给用户。首次登录后必须改密。` : `已创建 ${out.owner}。用户首次登录后必须改密。`)
-      setOwner(''); setName(''); setInitialPassword('')
+      setOwner(''); setName(''); setInitialPassword(''); setCreateAsAdmin(false)
       await refresh()
     } catch (e) { setErr(String(e).includes('409') ? '用户名已存在' : String(e)) } finally { setBusy(false) }
   }
@@ -71,6 +74,15 @@ export function UsersPanel() {
     } catch (e) { setErr(String(e)) } finally { setBusy(false) }
   }
 
+  const setAdmin = async (u: AdminUserRow, isAdmin: boolean) => {
+    setErr(''); setNotice(''); setBusy(true)
+    try {
+      await api.adminSetUserAdmin(u.userId, u.stateVersion, isAdmin)
+      setNotice(isAdmin ? `已任命 ${u.owner} 为管理员` : `已撤销 ${u.owner} 的管理员身份`)
+      await refresh()
+    } catch (e) { setErr(String(e).includes('409') ? '用户状态已变化，请刷新后重试' : String(e)) } finally { setBusy(false) }
+  }
+
   const openProposals = async (u: AdminUserRow) => {
     proposalSeq.current++
     setErr(''); setNotice(''); setPropFor(u); setProposals(null)
@@ -142,6 +154,7 @@ export function UsersPanel() {
             <input className="lg-input" type="password" autoComplete="new-password" placeholder="初始密码（留空随机生成）" value={initialPassword} onChange={e => setInitialPassword(e.target.value)} />
             <button className="lg-submit ad-create-btn" disabled={busy || !owner.trim()} onClick={create}>创建账号</button>
           </div>
+          <CreateAdminOption me={me} checked={createAsAdmin} disabled={busy} onChange={setCreateAsAdmin} />
           <p className="ad-hint">可填写管理员指定的初始密码；留空则由服务端生成一次性随机密码。用户首次登录后必须改密。</p>
         </div>
       )}
@@ -184,19 +197,23 @@ export function UsersPanel() {
         <table className="ad-table">
           <thead><tr><th>用户名</th><th>显示名</th><th>角色</th><th>状态</th><th>密码设置于</th><th></th></tr></thead>
           <tbody>
-            {(users ?? []).map(u => (
-              <tr key={u.owner}>
+            {(users ?? []).map(u => {
+              const policy = accountActionPolicy(me, u)
+              return <tr key={u.owner}>
                 <td className="ad-user-cell"><span className="ad-mono">{u.owner}</span></td>
                 <td>{u.name || '—'}</td>
-                <td>{u.isAdmin ? <span className="ad-chip ad-chip-admin">ADMIN</span> : <span className="ad-chip">USER</span>}</td>
+                <td>{u.isSuperAdmin ? <IdentityChip account={u} /> : u.isAdmin ? <span className="ad-chip ad-chip-admin">ADMIN</span> : <span className="ad-chip">USER</span>}</td>
                 <td>{u.mustChangePassword ? <span className="ad-chip ad-chip-warn">待改密</span> : u.hasPassword ? '正常' : '未设密码'}</td>
                 <td className="ad-dim">{u.passwordSetAt ? new Date(u.passwordSetAt).toLocaleString() : '—'}</td>
                 <td>{me?.isAdmin && <span className="ad-row">
-                  <button className="ad-mini" disabled={busy} onClick={() => resetPassword(u)}>重置临时密码</button>
-                  <button className="ad-mini" onClick={() => openProposals(u)}>恢复提案</button>
+                  {policy.resetPassword ? <>
+                    <button className="ad-mini" disabled={busy} onClick={() => resetPassword(u)}>重置临时密码</button>
+                    <button className="ad-mini" onClick={() => openProposals(u)}>恢复提案</button>
+                  </> : <span className="ad-dim">{policy.protectedReason}</span>}
+                  <AdminAppointmentButton me={me} account={u} busy={busy} onChange={isAdmin => setAdmin(u, isAdmin)} />
                 </span>}</td>
               </tr>
-            ))}
+            })}
             {users !== null && users.length === 0 && <tr><td colSpan={6} className="ad-dim">暂无账号</td></tr>}
           </tbody>
         </table>

src/contracts.ts

@@ -150,6 +150,7 @@ export interface ActivityCard {
   id: ID; projectId: ID; conversationId?: ID;
   sourceRunId?: ID; anchorMessageId?: ID;
   kind: CardKind; title: string; status: CardStatus; tone?: string;
+  task?: TaskSnapshot;
   body?: UINode[]; actions?: { id: string; label: string; style?: 'primary' | 'default' | 'danger'; command?: string }[];
   pinned?: boolean; createdAt: string; updatedAt: string; work?: WorkCard;
 }
@@ -351,7 +352,7 @@ export interface PluginPageDecl {
 
 export interface ParsedDocument {
   meta: {
-    filename: string; mime?: string; parser: string; confidence?: number;
+    filename: string; mime?: string; parser: string; confidence?: number; origin?: DocumentOrigin;
     crossCheck?: { with: string; diffBlocks: number; verdict: 'agree' | 'differ' };
     parsedAt: string;
   };
@@ -414,3 +415,28 @@ export interface SurfaceMeta {
   conversationId?: ID;
   updatedAt: string;
 }
+
+// Persistent work projection; host-owned identities and revisions.
+export interface DocumentOrigin { artifactId: ID; contentHash: string; parserRevision: string }
+export interface TaskPhase { id: string; label: string; observedAt?: string }
+export interface TaskSourceRef { id: string; artifactId: ID; contentHash: string; parserRevision: string; blockIndex: number; label: string; quote?: string; availability?: string }
+export interface TaskResultRef { artifactId?: ID; surfaceId?: ID; version?: string; contentHash?: string; availability: string; name?: string }
+export interface TaskFinding { id: string; text: string; impact?: string; kind: string; status: string; revision: number; sources: TaskSourceRef[]; assumptions?: string; corrects?: string }
+export interface TaskSnapshot {
+	inputs?: TaskSourceRef[]
+ limitations?: string[]
+ schemaVersion: number; taskId: ID; attemptId: ID; cardId: ID; projectId: ID; conversationId: ID;
+ sourceMessageId?: ID; parentRunId?: ID; runId?: ID; ownerInstanceId: string; executionEpoch?: number;
+ revision: number; sourceSeq: number; streamScope: string; inputRevision?: string; title: string; goal?: string;
+ executionState: 'queued'|'running'|'awaiting_user'|'completed'|'failed'|'interrupted'; outcomeCompleteness: 'none'|'partial'|'complete'; deliveryState: 'pending'|'available'|'reported'; phase: TaskPhase;
+ focus?: string; coverage?: string; remaining?: string; nextStep?: string; conclusion?: string;
+ findings?: TaskFinding[]; actions?: UIAction[]; resultRefs?: TaskResultRef[]; lastActivityAt?: string; lastMeaningfulUpdateAt?: string;
+ checkpointKeys?: Record<string,string>; checkpointCount?: number; checkpointSeq?: number;
+}
+export interface TaskSourceQuote { sourceId: string; blockIndex: number; quote: string }
+interface WorkEvidencePremise { role: "total" | "phase" | "dependent" | "direct_relation"; sourceIndex: number; value?: number }
+interface WorkFindingEvidence { mode: "direct_relation" | "difference" | "unresolved_relation"; premises: WorkEvidencePremise[]; result?: number }
+export interface WorkFindingCandidate { findingKey: string; text: string; impact?: string; kind: string; assumptions?: string; corrects?: string; sources: TaskSourceQuote[]; evidence?: WorkFindingEvidence }
+export interface WorkCheckpointCandidate { checkpointId: string; phaseId: string; focus?: string; remaining?: string; nextStep?: string; findings: WorkFindingCandidate[] }
+
+export interface UIAction { id: string; label: string; style?: string; command?: string }

src/permissionExplanations.ts

@@ -1,48 +0,0 @@
-// 项目有效权限说明的纯文案层：只消费服务端字段（/api/me linkedCapabilities）与固定权限
-// 语义，不按角色/成员关系推算任何有效权限。未知动作 id / 来源回退原文。
-import type { LinkedCapabilities } from './api'
-
-/** 联动动作中文名（与后端权限 catalog 一致）。 */
-export const LINKED_ACTION_LABELS: Record<string, string> = {
-  'project.settings': '管理项目设置',
-  'project.members.manage': '管理项目成员',
-  'project.permissions.manage': '管理项目权限',
-  'document.duties.assign': '分配文档职责',
-}
-
-const PROJECT_CREATE_SOURCE_LABELS: Record<string, string> = {
-  grant: '管理员授予',
-  'admin-grant': '管理员授予',
-  direct: '管理员授予',
-  role: '角色',
-  admin: '系统管理员',
-}
-
-const actionLabels = (ids: string[]) => ids.map(id => LINKED_ACTION_LABELS[id] ?? id).join('、')
-
-/** 创建项目与本人项目管理资格说明；字段缺失（旧服务）返回空串。 */
-export function linkedCapabilitySummary(linked: LinkedCapabilities | undefined): string {
-  if (!linked) return ''
-  if (!linked.projectCreate) return '未具备创建项目资格'
-  const source = linked.source ? `（来源：${PROJECT_CREATE_SOURCE_LABELS[linked.source] ?? linked.source}）` : ''
-  const parts = [`已具备创建项目资格${source}`]
-  const actions = linked.actions ?? []
-  if (actions.length > 0) {
-    parts.push(`创建本人项目后自动具备：${actionLabels(actions)}`)
-    parts.push('这些资格仅对本人创建的项目生效，其他项目按项目授权判断')
-  }
-  const conflicts = linked.conflicts ?? []
-  if (conflicts.length > 0) parts.push(`存在冲突：${actionLabels(conflicts)} 被明确禁止`)
-  return parts.join('；')
-}
-
-const DUTY_CONDITION_NOTES: Record<string, string> = {
-  'document.author': '仍需被分配该文档的编制职责，且文档状态符合要求',
-  'document.review': '仍需被分配该文档的审核职责，且文档状态符合要求',
-  'document.approve': '仍需被分配该文档的批准职责，且文档状态符合要求',
-}
-
-/** 文档编制/审核/批准动作的固定条件说明（权限语义，非对具体文档的判定）。 */
-export function dutyConditionNote(actionId: string): string {
-  return DUTY_CONDITION_NOTES[actionId] ?? ''
-}

src/previewtabs.ts

@@ -3,13 +3,14 @@
 export interface PreviewTab {
   id: string
   name: string
+  sourceContext?: {notice:string;quote:string;expectedHash?:string}
 }
 
 export function openPreviewTab(tabs: PreviewTab[], tab: PreviewTab): { tabs: PreviewTab[]; activeId: string } {
   const i = tabs.findIndex(t => t.id === tab.id)
   if (i >= 0) {
     const next = tabs.slice()
-    next[i] = { ...next[i], name: tab.name || next[i].name }
+    next[i] = { ...next[i], name: tab.name || next[i].name,sourceContext:tab.sourceContext }
     return { tabs: next, activeId: tab.id }
   }
   return { tabs: [...tabs, tab], activeId: tab.id }

src/rdmManagement.ts

@@ -2,7 +2,7 @@
 // 命令清单不可用＝未就绪，fail-closed）与命令载荷构造。页面组件只消费本模块与
 // api.rdmCommand，不在组件里散落命令 id / 参数拼写；身份一律经认证会话，载荷不
 // 携带任何身份字段（G1-5）。
-import type { Project } from './contracts'
+import type { Conversation, Message, Project } from './contracts'
 import { projectWorkError } from './projectmeta'
 
 export function rdmCommandProjectId(project: Project): string {
@@ -64,6 +64,20 @@ export const RDM_DUTY_COMMANDS = [
   'rdm.review.assign.doc.batch',
 ] as const
 
+/** 项目卡与成员行的工作状态控制（U4）：项目关闭/重开 + 成员暂停/恢复。 */
+export const RDM_WORK_STATE_COMMANDS = [
+  'rdm.project.work.close',
+  'rdm.project.work.reopen',
+  'rdm.project.member.suspend',
+  'rdm.project.member.reactivate',
+] as const
+
+/** 「按模板生成文档」入口（U5）：清单只读 + 显式单条实例化。 */
+export const RDM_DOC_TEMPLATE_COMMANDS = [
+  'rdm.docs.templates',
+  'rdm.docs.instantiate',
+] as const
+
 export type CommandListItem = { id?: string; enabled?: boolean } | null | undefined
 
 function ready(cmds: CommandListItem[] | null | undefined, need: readonly string[]): boolean {
@@ -87,6 +101,14 @@ export const rdmDutyReady = (cmds: CommandListItem[] | null | undefined) =>
 export const rdmPermMatrixReady = (cmds: CommandListItem[] | null | undefined) =>
   ready(cmds, RDM_PERM_MATRIX_COMMANDS)
 
+/** 工作状态控制是否就绪（四条命令齐备才渲染项目卡与成员行控件）。 */
+export const rdmWorkStatesReady = (cmds: CommandListItem[] | null | undefined) =>
+  ready(cmds, RDM_WORK_STATE_COMMANDS)
+
+/** 模板生成入口是否就绪。 */
+export const rdmDocTemplatesReady = (cmds: CommandListItem[] | null | undefined) =>
+  ready(cmds, RDM_DOC_TEMPLATE_COMMANDS)
+
 /** RDM 动作清单（12 项，与 RDM perms.AllActions 对齐；角色动作编辑器选项）。 */
 export const ROLE_ACTIONS = [
   'project.create', 'project.archive', 'member.manage', 'duty.assign',
@@ -183,13 +205,18 @@ export const permCheckPayload = (projectId: string, member: string) => ({ projec
  */
 export interface CommandSource {
   conversationId: string
-  anchorMessageId: string
+  /** 高危命令只需对话上下文（基座在该对话落确认卡）；正式写命令必须带已提交消息锚点。 */
+  anchorMessageId?: string
   entrance: 'button' | 'card' | 'slash' | 'chat' | 'api' | 'agent'
 }
 
 export const commandRequestBody = (params: Record<string, unknown>, source?: CommandSource) =>
   source
-    ? { params, conversationId: source.conversationId, anchorMessageId: source.anchorMessageId, entrance: source.entrance }
+    ? {
+        params, conversationId: source.conversationId,
+        ...(source.anchorMessageId ? { anchorMessageId: source.anchorMessageId } : {}),
+        entrance: source.entrance,
+      }
     : { params }
 
 // ---- 项目成员页：候选检索 + 成员表检索（R2 契约：服务端先过滤后分页） ----
@@ -353,8 +380,6 @@ export function describeSource(source: string): string {
     case 'override': return '项目内覆盖'
     case 'relation-default': return '项目关系默认'
     case 'non-member': return '非项目成员'
-    case 'creator': return '本人项目创建者自动具备（仅本人创建的项目）'
-    case 'role': return '职位角色'
     default: return source
   }
 }
@@ -388,3 +413,190 @@ export function parseReviewers(csv: string): string[] {
   }
   return out
 }
+
+// ---- U4 工作状态：项目卡（关闭/重新开启）与成员行（暂停/恢复） ----
+
+export type WorkStateKind = 'active' | 'suspended' | 'removed' | 'closed'
+
+/** 状态一律带文字徽标：配色只是辅助，不单独承载语义。 */
+export const WORK_STATE_BADGES: Record<WorkStateKind, { label: string; className: string }> = {
+  active: { label: '正常', className: 'ad-chip ad-chip-admin' },
+  suspended: { label: '已暂停', className: 'ad-chip ad-chip-warn' },
+  removed: { label: '已移除', className: 'ad-chip' },
+  closed: { label: '已关闭', className: 'ad-chip ad-chip-warn' },
+}
+
+export const WORK_STATE_NOTICES: Record<Exclude<WorkStateKind, 'active'>, string> = {
+  closed: '项目工作已关闭：全体成员的新建与继续工作被拒，已有会话与资料保留只读；项目创建者可重新开启。',
+  suspended: '已暂停：新建与继续工作被拒，仅保留暂停前内容的只读；项目创建者可恢复。',
+  removed: '已移除：仅保留历史只读，不可自行恢复；如需恢复须由项目创建者重新添加。',
+}
+
+export interface ProjectWorkStatus { state: 'active' | 'closed'; version: number }
+
+/** 项目列表读面携带的工作状态（rdm.workState / rdm.workVersion）；缺任一视为未提供，不渲染控制。 */
+export function projectWorkStatus(project: Project | undefined): ProjectWorkStatus | null {
+  const state = project?.settings?.['rdm.workState']
+  const version = project?.settings?.['rdm.workVersion']
+  if ((state !== 'active' && state !== 'closed') || typeof version !== 'number' || !Number.isFinite(version)) return null
+  return { state, version }
+}
+
+export const projectWorkClosed = (project: Project | undefined) => projectWorkStatus(project)?.state === 'closed'
+
+/** 成员清单行的工作状态；旧服务端不带 state 时按 active 呈现。 */
+export function memberWorkState(row: { state?: string }): Exclude<WorkStateKind, 'closed'> {
+  return row.state === 'suspended' || row.state === 'removed' ? row.state : 'active'
+}
+
+/** danger:high（RDM 命令声明）：基座只在对话上下文中落确认卡，确认后才执行。 */
+const HIGH_DANGER_WORK_COMMANDS = new Set(['rdm.project.work.close', 'rdm.project.member.suspend'])
+export const isHighDangerCommand = (command: string) => HIGH_DANGER_WORK_COMMANDS.has(command)
+
+export interface WorkControl { command: string; label: string; disabledReason: string }
+
+export function projectWorkControl(status: ProjectWorkStatus, isCreator: boolean): WorkControl {
+  const closing = status.state === 'active'
+  return {
+    command: closing ? 'rdm.project.work.close' : 'rdm.project.work.reopen',
+    label: closing ? '关闭项目工作' : '重新开启',
+    disabledReason: isCreator ? '' : '仅项目创建者可关闭或重新开启项目工作',
+  }
+}
+
+/** 已移除成员没有可执行的工作控制（恢复须重新添加）。 */
+export function memberWorkControl(
+  row: { owner: string; state?: string; stateVersion?: number },
+  ctx: { isCreator: boolean; creator?: string },
+): WorkControl | null {
+  const state = memberWorkState(row)
+  if (state === 'removed') return null
+  const suspending = state === 'active'
+  const disabledReason = !ctx.isCreator ? '仅项目创建者可暂停或恢复成员'
+    : suspending && row.owner === ctx.creator ? '项目创建者不可暂停'
+      : typeof row.stateVersion !== 'number' ? '缺少成员状态版本，请刷新成员清单' : ''
+  return {
+    command: suspending ? 'rdm.project.member.suspend' : 'rdm.project.member.reactivate',
+    label: suspending ? '暂停' : '恢复',
+    disabledReason,
+  }
+}
+
+export const projectWorkPayload = (projectId: string, expectedVersion: number) => ({ projectId, expectedVersion })
+export const memberWorkPayload = (projectId: string, member: string, expectedVersion: number) =>
+  ({ projectId, member, expectedVersion })
+
+export const CONFIRM_CARD_PENDING = '高危命令已生成确认卡——请在对话中确认执行'
+
+/** 命令总线返回确认卡（未执行）：携带卡片 id，便于跳到待处理确认。 */
+export class ConfirmCardPending extends Error {
+  cardId: string
+  constructor(cardId: string) {
+    super(CONFIRM_CARD_PENDING)
+    this.name = 'ConfirmCardPending'
+    this.cardId = cardId
+  }
+}
+
+export interface RecordConversationPort {
+  listConversations: (projectId: string) => Promise<Conversation[]>
+  createConversation: (projectId: string, title?: string) => Promise<Conversation>
+}
+
+export const WORK_CONFIRM_RECORD_TITLE = '项目管理确认'
+export const TEMPLATE_RECORD_TITLE = '文档生成记录'
+
+async function recordConversation(port: RecordConversationPort, hostProjectId: string, title: string): Promise<Conversation> {
+  const list = await port.listConversations(hostProjectId)
+  return list.find(c => c.title === title && !c.archived) ?? await port.createConversation(hostProjectId, title)
+}
+
+/** 高危命令的对话上下文：只提供对话（确认卡落点），不发消息、不触发回合。 */
+export async function highDangerSource(port: RecordConversationPort, host: Project): Promise<CommandSource> {
+  const conversation = await recordConversation(port, host.id, WORK_CONFIRM_RECORD_TITLE)
+  return { conversationId: conversation.id, entrance: 'button' }
+}
+
+// ---- U5 模板浏览：rdm.docs.templates 清单 + 显式单条 rdm.docs.instantiate ----
+
+export interface DocTemplateRow {
+  templateId: string
+  version: string
+  title: string
+  docTypes?: string[] | null
+  stage?: string
+  state: string
+  sourceFormat: string
+  sourceSha256: string
+  generation: string
+  unsupportedReason?: string
+}
+
+const TEMPLATE_STATE_LABELS: Record<string, string> = {
+  published: '已发布',
+  'needs-review': '待复核',
+  retired: '已退役',
+  draft: '草稿',
+}
+export const templateStateLabel = (state: string) => TEMPLATE_STATE_LABELS[state] ?? state
+export const templateKey = (t: Pick<DocTemplateRow, 'templateId' | 'version'>) => `${t.templateId}@${t.version}`
+
+/** 与 rdm.docs.instantiate 同一判定：只有 generation=supported 且登记了文档类型的条目可实例化。 */
+export function templateSelectable(t: DocTemplateRow): { ok: boolean; reason: string } {
+  if (t.generation !== 'supported') return { ok: false, reason: t.unsupportedReason?.trim() || '该模板暂不支持生成文档' }
+  if (!t.docTypes || t.docTypes.length === 0) return { ok: false, reason: '未登记适用文档类型，无法按类型生成' }
+  return { ok: true, reason: '' }
+}
+
+/** paramsSchema：projectId/docType/templateId/version 必填，title 可选；不可生成的条目直接拒绝。 */
+export function instantiatePayload(projectId: string, t: DocTemplateRow, docType: string, title = '') {
+  const check = templateSelectable(t)
+  if (!check.ok) throw new Error(check.reason)
+  if (!t.docTypes?.includes(docType)) throw new Error(`文档类型 ${docType} 不在该模板的适用范围内`)
+  const trimmed = title.trim()
+  return { projectId, docType, templateId: t.templateId, version: t.version, ...(trimmed ? { title: trimmed } : {}) }
+}
+
+/** 来源消息正文（中文、首字符不为 “/”），记录模板身份与版本以便溯源。 */
+export function instantiateSourceText(t: DocTemplateRow, docType: string, title: string): string {
+  return [
+    '文档生成：按模板实例化',
+    `模板：${t.title}（${templateKey(t)}）`,
+    `文档类型：${docType}`,
+    `文档标题：${title.trim() || '沿用模板标题'}`,
+    '来源：按模板生成文档',
+  ].join('\n')
+}
+
+export interface InstantiatePort extends RecordConversationPort {
+  sendMessage: (convId: string, text: string, attachmentIds: string[], requestId?: string) => Promise<{ message?: Message; command?: string }>
+  rdmCommand: (id: string, params: Record<string, unknown>, source?: CommandSource) => Promise<unknown>
+}
+
+interface InstantiateRequest {
+  host: Project
+  /** 同一用户动作的编号：重试复用，服务端据此幂等返回同一条来源消息。 */
+  operationId: string
+  template: DocTemplateRow
+  docType: string
+  title: string
+}
+
+/** 正式写命令须锚定已提交的对话消息：先记录来源，再分发；任一步失败都不分发。 */
+export async function commitTemplateInstantiate(port: InstantiatePort, req: InstantiateRequest): Promise<unknown> {
+  const gate = rdmProjectCommandError(req.host, 'rdm.docs.instantiate')
+  if (gate) throw new Error(gate)
+  if (projectWorkClosed(req.host)) throw new Error(WORK_STATE_NOTICES.closed)
+  const params = instantiatePayload(rdmCommandProjectId(req.host), req.template, req.docType, req.title)
+  const conversation = await recordConversation(port, req.host.id, TEMPLATE_RECORD_TITLE)
+  const out = await port.sendMessage(conversation.id, instantiateSourceText(req.template, req.docType, req.title), [],
+    `instantiate:${req.operationId}`)
+  if (out.command) throw new Error('生成说明被识别为命令，未作为来源记录；文档未生成')
+  const msg = out.message
+  if (!msg?.id || msg.role !== 'user' || msg.conversationId !== conversation.id) {
+    throw new Error('服务端未返回已提交的对话消息；文档未生成')
+  }
+  return port.rdmCommand('rdm.docs.instantiate', params, {
+    conversationId: conversation.id, anchorMessageId: msg.id, entrance: 'button',
+  })
+}

src/roleMembers.ts

@@ -1,143 +0,0 @@
-import type {
-  AccountRoleSummary, PermissionDescriptor, RoleCopyAssignRequest, RolePermissionChangeInput, RoleRecord,
-  UserRoleAssignmentInput, UserRoleAssignmentPreview,
-} from './api'
-import type { RolePermissionValue } from './rolePermissions'
-
-/** 显式选择集合：只含逐个或整页勾选过的 userId；筛选与翻页既不清空也不扩大它。 */
-export interface MemberSelection { readonly ids: readonly string[] }
-
-export const createSelection = (ids: readonly string[] = []): MemberSelection => ({ ids: [...new Set(ids)] })
-
-export const clearSelection = (): MemberSelection => createSelection()
-
-export const isSelected = (selection: MemberSelection, userId: string) => selection.ids.includes(userId)
-
-export function toggleOne(selection: MemberSelection, userId: string, checked = !isSelected(selection, userId)): MemberSelection {
-  if (checked) return isSelected(selection, userId) ? selection : { ids: [...selection.ids, userId] }
-  return isSelected(selection, userId) ? { ids: selection.ids.filter(id => id !== userId) } : selection
-}
-
-/** 表头全选只作用于当前页可选行；其他页已选的人保持不变。 */
-export function selectPage(selection: MemberSelection, pageIds: readonly string[], checked: boolean): MemberSelection {
-  if (checked) return createSelection([...selection.ids, ...pageIds])
-  const page = new Set(pageIds)
-  return { ids: selection.ids.filter(id => !page.has(id)) }
-}
-
-export function pageSelectionState(selection: MemberSelection, pageIds: readonly string[]): 'none' | 'some' | 'all' {
-  const picked = pageIds.filter(id => isSelected(selection, id)).length
-  if (!pageIds.length || picked === 0) return 'none'
-  return picked === pageIds.length ? 'all' : 'some'
-}
-
-export function selectionCounts(selection: MemberSelection, pageIds: readonly string[]): { count: number; beyondPage: number } {
-  const page = new Set(pageIds)
-  return { count: selection.ids.length, beyondPage: selection.ids.filter(id => !page.has(id)).length }
-}
-
-export function selectionSummary(counts: { count: number; beyondPage: number }): string {
-  return counts.beyondPage > 0 ? `已选 ${counts.count} 人（包含其他页的 ${counts.beyondPage} 人）` : `已选 ${counts.count} 人`
-}
-
-type NamedAccount = { userId: string; owner: string; name?: string; profile?: { name: string } }
-
-const rawName = (account: NamedAccount) => (account.profile?.name ?? account.name ?? '').trim()
-
-/** 姓名缺失时以账号（登录名）展示；它只是显示文本，提交永远用 userId。 */
-export const accountName = (account: NamedAccount) => rawName(account) || account.owner
-
-export const accountLabel = (account: NamedAccount) => rawName(account) ? `${rawName(account)}（${account.owner}）` : account.owner
-
-export function duplicateNames(accounts: readonly NamedAccount[]): Set<string> {
-  const owners = new Map<string, Set<string>>()
-  for (const account of accounts) {
-    const name = rawName(account)
-    if (!name) continue
-    owners.set(name, (owners.get(name) ?? new Set()).add(account.userId))
-  }
-  return new Set([...owners].filter(([, ids]) => ids.size > 1).map(([name]) => name))
-}
-
-export function sameNameHint(accounts: readonly NamedAccount[]): string {
-  const duplicates = duplicateNames(accounts)
-  if (!duplicates.size) return ''
-  const groups = [...duplicates].map(name => `「${name}」：${accounts.filter(account => rawName(account) === name).map(account => account.owner).join('、')}`)
-  return `存在同名用户${groups.join('；')}，请按账号辨识`
-}
-
-/** undefined = 无角色查看权（服务端不返回投影）；null = 未分配。 */
-export function roleColumnLabel(role: AccountRoleSummary | null | undefined): string {
-  if (role === undefined) return '—'
-  if (role === null) return '未分配'
-  return role.enabled ? role.name : `${role.name}（已停用）`
-}
-
-export const assignedToRole = (account: { role?: AccountRoleSummary | null }, roleId: string) => !!roleId && account.role?.roleId === roleId
-
-export function memberAssignments(
-  selected: readonly string[], roleId: string, stateVersions: Readonly<Record<string, number>>,
-): UserRoleAssignmentInput[] {
-  if (!roleId) throw new Error('请先选择目标角色')
-  return [...new Set(selected)].map(userId => {
-    const expectedStateVersion = stateVersions[userId]
-    if (!expectedStateVersion) throw new Error('缺少用户状态版本，请刷新列表后重试')
-    return { userId, roleId, expectedStateVersion }
-  })
-}
-
-/** 预览显示版本不一致时，只读重取这些用户的详情以获得最新 stateVersion（不涉及任何写接口）。 */
-export async function refreshStateVersions<T extends { userId: string; stateVersion: number }>(
-  client: { adminGetUser: (userId: string) => Promise<T> }, userIds: readonly string[],
-): Promise<Record<string, T>> {
-  const fresh = await Promise.all([...new Set(userIds)].map(userId => client.adminGetUser(userId)))
-  return Object.fromEntries(fresh.map(account => [account.userId, account]))
-}
-
-export const staleUserIds = (previews: readonly UserRoleAssignmentPreview[]) =>
-  previews.filter(preview => !preview.stateMatches).map(preview => preview.userId)
-
-export const previewTransition = (preview: Pick<UserRoleAssignmentPreview, 'currentRoleName' | 'targetRoleName'>) =>
-  `${preview.currentRoleName || '未分配'} → ${preview.targetRoleName}`
-
-/** 只有每个提交对象都有预览、且全部无错误且状态版本一致时才允许确认。 */
-export function previewAllowsAssign(previews: readonly UserRoleAssignmentPreview[], userIds: readonly string[]): boolean {
-  if (!userIds.length) return false
-  const byUser = new Map(previews.map(preview => [preview.userId, preview]))
-  return userIds.every(userId => {
-    const preview = byUser.get(userId)
-    return !!preview && !preview.error && preview.stateMatches
-  })
-}
-
-/** 用户角色投影（GET users/{id}/role）不含 permissions；只有完整角色记录才能作为复制起点。 */
-export function roleSourceValues(role: RoleRecord, catalog: readonly PermissionDescriptor[]): Record<string, RolePermissionValue> {
-  if (!Array.isArray(role.permissions)) return {}
-  const existing = new Map(role.permissions.map(item => [item.actionId, item]))
-  return Object.fromEntries(catalog.filter(item => !item.protected).map(item => {
-    const value = existing.get(item.actionId)
-    return [item.actionId, { allowed: value?.allowed ?? false, capAllowed: value?.capAllowed ?? false }]
-  }))
-}
-
-export function copyAssignRequest(input: {
-  idempotencyKey: string; source: RoleRecord; name: string; description: string; catalog: readonly PermissionDescriptor[]
-  values: Readonly<Record<string, RolePermissionValue>>; users: readonly { userId: string; stateVersion: number }[]
-}): RoleCopyAssignRequest {
-  const name = input.name.trim()
-  if (!name) throw new Error('请为新角色填写名称')
-  if (!input.users.length) throw new Error('请至少选择一位用户')
-  const baseline = roleSourceValues(input.source, input.catalog)
-  const overrides: RolePermissionChangeInput[] = []
-  for (const [actionId, before] of Object.entries(baseline)) {
-    const after = input.values[actionId]
-    if (after && (after.allowed !== before.allowed || after.capAllowed !== before.capAllowed)) overrides.push({ actionId, ...after })
-  }
-  return {
-    idempotencyKey: input.idempotencyKey,
-    source: { roleId: input.source.roleId, expectedRoleVersion: input.source.roleVersion },
-    name, description: input.description.trim(),
-    ...(overrides.length ? { overrides } : {}),
-    assignments: input.users.map(user => ({ userId: user.userId, expectedStateVersion: user.stateVersion })),
-  }
-}

src/rolePermissions.ts

@@ -1,142 +1,16 @@
-import type { PermissionDescriptor, RolePermissionPatchEntry } from './api'
+import type { RoleRecord } from './api'
 
-export type RolePermissionValue = { allowed: boolean; capAllowed: boolean }
 type RolePermissionChange = { actionId: string; allowed: boolean; capAllowed: boolean }
-export type RolePermissionStateName = 'denied' | 'project' | 'default'
 
-export const ROLE_PERMISSION_STATES: { state: RolePermissionStateName; label: string }[] = [
-  { state: 'denied', label: '不允许' },
-  { state: 'project', label: '按项目授权' },
-  { state: 'default', label: '默认允许' },
-]
+const PROJECT_ACCESS_ACTION = 'project.create'
 
-const ROLE_PERMISSION_CATEGORIES = ['项目与协作', '文档工作', '项目内容'] as const
-
-export const PROJECT_CREATE_ACTION = 'project.create'
-/** 开启 project.create 时随之具备的本人创建项目管理资格（与后端 catalog 同序）。 */
-export const PROJECT_CREATE_LINKED_ACTIONS = [
-  'project.settings', 'project.members.manage', 'project.permissions.manage', 'document.duties.assign',
-] as const
-
-export function stateToValue(state: RolePermissionStateName): RolePermissionValue {
-  if (state === 'default') return { allowed: true, capAllowed: true }
-  if (state === 'project') return { allowed: false, capAllowed: true }
-  return { allowed: false, capAllowed: false }
+/** 角色唯一可编辑能力「项目访问」：project.create 行需默认与上限同时允许，缺行即无访问。 */
+export function projectAccessOf(role: RoleRecord): boolean {
+  const row = role.permissions.find(item => item.actionId === PROJECT_ACCESS_ACTION)
+  return !!row && row.allowed && row.capAllowed
 }
 
-export function valueToState(value: RolePermissionValue | undefined): RolePermissionStateName {
-  if (!value?.capAllowed) return 'denied'
-  return value.allowed ? 'default' : 'project'
-}
-
-export function stateLabel(state: RolePermissionStateName): string {
-  return ROLE_PERMISSION_STATES.find(item => item.state === state)?.label ?? state
-}
-
-/** 受保护系统授权不进矩阵；缺分类的非保护系统动作（如 project.create）归入「项目与协作」。 */
-function permissionCategory(item: PermissionDescriptor): string {
-  if (item.protected) return ''
-  return item.category || (item.scope === 'system' ? ROLE_PERMISSION_CATEGORIES[0] : item.group)
-}
-
-export function permissionCategories(catalog: PermissionDescriptor[]): string[] {
-  const present = [...new Set(catalog.map(permissionCategory).filter(Boolean))]
-  const fixed: string[] = ROLE_PERMISSION_CATEGORIES.filter(category => present.includes(category))
-  return [...fixed, ...present.filter(category => !fixed.includes(category))]
-}
-
-export function categoryActions(catalog: PermissionDescriptor[], category: string): PermissionDescriptor[] {
-  if (!category) return []
-  return catalog.filter(item => permissionCategory(item) === category)
-}
-
-export function linkedByProjectCreate(values: Record<string, RolePermissionValue>, actionId: string): boolean {
-  return (PROJECT_CREATE_LINKED_ACTIONS as readonly string[]).includes(actionId) && !!values[PROJECT_CREATE_ACTION]?.allowed
-}
-
-export interface RolePermissionDraft {
-  baseline: Record<string, RolePermissionValue>
-  values: Record<string, RolePermissionValue>
-  generation: number
-}
-
-function copy(values: Record<string, RolePermissionValue>): Record<string, RolePermissionValue> {
-  return Object.fromEntries(Object.entries(values).map(([actionId, value]) => [actionId, { ...value }]))
-}
-
-export function createRolePermissionDraft(values: Record<string, RolePermissionValue>, generation = 0): RolePermissionDraft {
-  return { baseline: copy(values), values: copy(values), generation }
-}
-
-export function updateRolePermission(
-  draft: RolePermissionDraft,
-  actionId: string,
-  value: RolePermissionValue,
-): RolePermissionDraft {
-  return { ...draft, values: { ...draft.values, [actionId]: { ...value } }, generation: draft.generation + 1 }
-}
-
-export function mergeRoleDraft(
-  current: RolePermissionDraft,
-  serverValues: Record<string, RolePermissionValue>,
-  responseGeneration: number,
-): RolePermissionDraft {
-  if (responseGeneration < current.generation) return current
-  return createRolePermissionDraft(serverValues, responseGeneration)
-}
-
-// Rebase local edits on a newer server baseline after an optimistic conflict.
-// Only fields changed from the old baseline are replayed.
-export function rebaseRoleDraft(
-  current: RolePermissionDraft,
-  serverValues: Record<string, RolePermissionValue>,
-): RolePermissionDraft {
-  const values = copy(serverValues)
-  for (const [actionId, local] of Object.entries(current.values)) {
-    const old = current.baseline[actionId]
-    if (!old || old.allowed !== local.allowed || old.capAllowed !== local.capAllowed) values[actionId] = { ...local }
-  }
-  return { baseline: copy(serverValues), values, generation: current.generation + 1 }
-}
-
-export function visiblePatch(draft: RolePermissionDraft, visibleActionIds: string[]): RolePermissionChange[] {
-  const seen = new Set<string>()
-  const changes: RolePermissionChange[] = []
-  for (const actionId of visibleActionIds) {
-    if (seen.has(actionId)) continue
-    seen.add(actionId)
-    const value = draft.values[actionId]
-    if (!value) continue
-    const baseline = draft.baseline[actionId]
-    if (baseline && baseline.allowed === value.allowed && baseline.capAllowed === value.capAllowed) continue
-    changes.push({ actionId, ...value })
-  }
-  return changes
-}
-
-export function validateRolePermissionDraft(draft: RolePermissionDraft): { actionId: string; reason: string } | null {
-  for (const actionId of Object.keys(draft.values).sort()) {
-    const value = draft.values[actionId]
-    if (value.allowed && !value.capAllowed) return { actionId, reason: 'default-exceeds-cap' }
-  }
-  return null
-}
-
-export function dirtyRoles(
-  drafts: Record<string, RolePermissionDraft>, actionIds?: string[],
-): { roleId: string; changes: number }[] {
-  return Object.entries(drafts)
-    .map(([roleId, draft]) => ({ roleId, changes: visiblePatch(draft, actionIds ?? Object.keys(draft.values)).length }))
-    .filter(entry => entry.changes > 0)
-}
-
-// One entry per dirty role; each carries only that role's changes from its own baseline.
-export function rolePatchEntries(
-  drafts: Record<string, RolePermissionDraft>, versions: Record<string, number>, actionIds?: string[],
-): RolePermissionPatchEntry[] {
-  return dirtyRoles(drafts, actionIds).map(({ roleId }) => ({
-    roleId,
-    expectedRoleVersion: versions[roleId],
-    changes: visiblePatch(drafts[roleId], actionIds ?? Object.keys(drafts[roleId].values)),
-  }))
+export function projectAccessPatch(role: RoleRecord, next: boolean): RolePermissionChange[] {
+  if (projectAccessOf(role) === next) return []
+  return [{ actionId: PROJECT_ACCESS_ACTION, allowed: next, capAllowed: next }]
 }

src/store.ts

@@ -1,7 +1,7 @@
 // 应用状态：服务端权威（事件 + Query 对账），前端 store 是投影。
 // useSyncExternalStore 驱动；live 流式部件为会话内临时态，run 终态后由消息树对账收敛。
 import { useSyncExternalStore } from 'react'
-import { type AdminZoneSection, type LinkedCapabilities, api, connectEvents } from './api'
+import { type AdminZoneSection, api, connectEvents } from './api'
 import { auth } from './auth'
 import { projectActionError, projectWorkError } from './projectmeta'
 import { applyTextDelta, applyThinkingDelta, applyToolCall, applyToolCallDelta, applyToolResult, applyToolOutput, applyArtifactCreated, applyArtifactUpdated, applyCheck, applyFinalizing, type LiveItem } from './live'
@@ -12,7 +12,7 @@ import { flashElement } from './scrollsync'
 import { isThemeChoice, resolveTheme, type ThemeChoice } from './theme'
 import { mergeSurfacesByRevision, surfaceKey } from './surfaceKey'
 import { cockpitReady, rdmAuditReady, rdmExportReady } from './workspaces'
-import { rdmRolesReady, rdmMembersReady, rdmDutyReady, rdmPermMatrixReady } from './rdmManagement'
+import { rdmRolesReady, rdmMembersReady, rdmDutyReady, rdmPermMatrixReady, rdmWorkStatesReady, rdmDocTemplatesReady } from './rdmManagement'
 import { NO_RENDER_CAPABILITIES, renderCapabilities, type RenderCapabilities } from './documentRenderPresentation'
 
 type FontSizeChoice = 13 | 14 | 16 | 18
@@ -23,6 +23,7 @@ export function isFontSizeChoice(value: number): value is FontSizeChoice {
 }
 import type {
   ActivityCard,
+  TaskSourceRef,
   AgentProfile,
   Artifact,
   Conversation,
@@ -90,10 +91,7 @@ export interface UIState {
   projectSettingsId: string | null
 }
 
-export interface Me {
-  owner: string; name: string; auth: boolean; isAdmin?: boolean; mustChangePassword?: boolean; systemActions?: string[]
-  linkedCapabilities?: LinkedCapabilities
-}
+export interface Me { owner: string; name: string; auth: boolean; isAdmin?: boolean; isSuperAdmin?: boolean; mustChangePassword?: boolean; systemActions?: string[] }
 
 interface AppState {
   contextObs: Record<string, ContextObs>
@@ -136,6 +134,10 @@ interface AppState {
   rdmMembersAvailable: boolean
   rdmDocReviewAvailable: boolean
   rdmPermMatrixAvailable: boolean
+  /** 项目卡/成员行工作状态控制（rdm.project.work.* + member.suspend/reactivate 齐备）。 */
+  rdmWorkStatesAvailable: boolean
+  /** 「按模板生成文档」入口（rdm.docs.templates + rdm.docs.instantiate 齐备）。 */
+  rdmDocTemplatesAvailable: boolean
   /** 统一渲染（Task 11）：rdm.render.* 核心命令齐备才 ready；审阅/批注/导出各自门控。 */
   rdmRender: RenderCapabilities
   /** 管理区声明分区（WP3-I3）：编译插件声明，入口全员可见、区内置权限不合并。 */
@@ -209,6 +211,7 @@ let state: AppState = {
   rdmCockpitAvailable: false,
   rdmExportAvailable: false,
   rdmRolesAvailable: false, rdmMembersAvailable: false, rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false,
+  rdmWorkStatesAvailable: false, rdmDocTemplatesAvailable: false,
   rdmRender: NO_RENDER_CAPABILITIES,
   adminSections: [],
   ui: loadUI(), connected: false, posting: false, error: null, toast: null,
@@ -235,7 +238,8 @@ function syncFilesEntry(hasTabs: boolean) {
 
 function setUI(patch: Partial<UIState>) {
   const ui = { ...state.ui, ...patch }
-  state = { ...state, ui }
+  const navigation=(['rightTab','filesView','rightCollapsed','activeWorkspace'] as const).some(key=>key in patch&&patch[key]!==state.ui[key])
+  state = { ...state, ui,previewOpenIntent:state.previewOpenIntent+(navigation?1:0) }
   try { localStorage.setItem('as.ui', JSON.stringify(ui)) } catch { /* ignore */ }
   applyTheme(ui.theme)
   applyFontSize(ui.fontSize)
@@ -301,6 +305,9 @@ let projectsRequest = 0
 let tasksRequest = 0
 let meRequest = 0
 let streamSeq = 0
+let streamHasWatermark = false
+let gapReconnectPending = false
+let streamPending = new Map<number, StreamEvent>()
 let detailRequest = 0
 let detailSeq = 0
 let detailVersion = 0
@@ -356,12 +363,24 @@ function scheduleTerminalReconcile() {
 
 // Snapshot queries may overlap events. Only rows changed after the request began
 // override that snapshot; a newer request/context invalidates the old query entirely.
+export function mergeTaskSnapshot<T extends {taskId:string;attemptId:string;revision:number}>(current:T,incoming:T):T {
+ if(current.taskId!==incoming.taskId||current.attemptId!==incoming.attemptId||!Number.isSafeInteger(incoming.revision)||incoming.revision<=current.revision)return current
+ return incoming
+}
+function mergeTaskCard(current:ActivityCard|undefined,incoming:ActivityCard):ActivityCard {
+ if(!current?.task||!incoming.task||current.task.schemaVersion!==1||incoming.task.schemaVersion!==1)return incoming
+ const a=current.task,b=incoming.task
+ if(a.taskId!==b.taskId||a.attemptId!==b.attemptId||a.projectId!==b.projectId||a.conversationId!==b.conversationId||a.ownerInstanceId!==b.ownerInstanceId||(a.executionEpoch??0)>(b.executionEpoch??0)||a.revision>b.revision)return current
+ if(['completed','failed','interrupted'].includes(a.executionState)&&!['completed','failed','interrupted'].includes(b.executionState))return current
+ if(a.revision!==b.revision&&mergeTaskSnapshot(a,b)===a)return current
+ return incoming
+}
 function mergeCardSnapshot(snapshot: ActivityCard[], current: ActivityCard[], versions: Record<string, number>, started: number,
   patches: Record<string, Pick<ActivityCard, 'status' | 'tone'>>) {
   const fresh = current.filter(c => (versions[c.id] ?? 0) > started)
   const freshIds = new Set(fresh.map(c => c.id))
-  return [...fresh, ...snapshot.filter(c => !freshIds.has(c.id)).map(c =>
-    (versions[c.id] ?? 0) > started && patches[c.id] ? { ...c, ...patches[c.id], tone: patches[c.id].tone ?? c.tone } : c)]
+  const combined=fresh.map(c=>{const row=snapshot.find(r=>r.id===c.id);return row?.task&&c.task&&row.task.revision>c.task.revision?mergeTaskCard(c,row):c})
+  return [...combined, ...snapshot.filter(c => !freshIds.has(c.id)).map(row => {const c=mergeTaskCard(current.find(old=>old.id===row.id),row);return (versions[c.id] ?? 0) > started && patches[c.id] ? { ...c, ...patches[c.id], tone: patches[c.id].tone ?? c.tone } : c})]
 }
 
 function hitlSource(card: ActivityCard): string | undefined {
@@ -452,7 +471,8 @@ export const store = {
       cards: [], projectCards: [], cardActionStates: {}, workRecord: null, workReference: null, inboxScope: 'conv',
       runtimeMock: false, profiles: [], pluginPanels: [], serverWorkspaces: [], adminSections: [],
       rdmAuditAvailable: false, rdmCockpitAvailable: false, rdmExportAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
-      rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false, rdmRender: NO_RENDER_CAPABILITIES,
+      rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false, rdmWorkStatesAvailable: false, rdmDocTemplatesAvailable: false,
+      rdmRender: NO_RENDER_CAPABILITIES,
       connected: false, posting: false, error: null, toast: null, outbox: [], outboxDraining: false,
       previewTabs: {}, previewActive: {}, previewOpenIntent: 0 })
     setUI({ lastProjectId: null, projectSettingsId: null, adminZoneOpen: false, activeWorkspace: null,
@@ -533,7 +553,7 @@ export const store = {
       projectSeq = 0
       projectCardsRequest++
       projectCardVersion = 0; projectCardVersions = {}; projectCardPatches = {}
-      conversationEpoch++; streamSeq = 0; cardVersion = 0; cardVersions = {}; cardPatches = {}
+      conversationEpoch++; streamSeq = 0; streamHasWatermark=false;streamPending.clear();gapReconnectPending=false; cardVersion = 0; cardVersions = {}; cardPatches = {}
       detailSeq = 0; detailVersion = 0; runObservations = {}; messageObservations = {}; hitlObservations = {}
       set({ currentConvId: null, messages: [], runs: [], activeHitl: [], lastSeq: 0, live: null,
         cards: [], projectCards: [], workRecord: null, workReference: null, plan: null, todos: null, surfaces: [], projectSurfaces: [],
@@ -624,7 +644,7 @@ export const store = {
   async openConversation(convId: string) {
     if (sse) { sse.close(); sse = null }
     const epoch = ++conversationEpoch
-    streamSeq = 0; cardVersion = 0; cardVersions = {}; cardPatches = {}
+    streamSeq = 0; streamHasWatermark=false;streamPending.clear();gapReconnectPending=false; cardVersion = 0; cardVersions = {}; cardPatches = {}
     detailSeq = 0; detailVersion = 0; runObservations = {}; messageObservations = {}; hitlObservations = {}
     set({ currentConvId: convId, messages: [], runs: [], activeHitl: [], lastSeq: 0, live: null, plan: null, todos: null, cards: [], workRecord: null, workReference: null, surfaces: [], projectSurfaces: [], inboxScope: 'conv', outbox: [], outboxDraining: false, posting: false })
     setUI({ previewExpanded: false })
@@ -722,15 +742,21 @@ export const store = {
     streamSeq = Math.max(streamSeq, since ?? state.lastSeq)
     sse?.close()
     sse = connectEvents(convId, since ?? state.lastSeq, {
-      onOpen: () => { if (state.currentConvId === convId && conversationEpoch === epoch) set({ connected: true }) },
+      onOpen: () => { if (state.currentConvId === convId && conversationEpoch === epoch) {set({ connected: true });void store.refreshCards(convId)} },
       onError: () => { if (state.currentConvId === convId && conversationEpoch === epoch) set({ connected: false }) },
       onEvent: e => { if (state.currentConvId === convId && conversationEpoch === epoch) store.applyEvent(e) },
     })
   },
 
   applyEvent(e: StreamEvent) {
-    if (!state.currentConvId || e.conversationId !== state.currentConvId || !Number.isFinite(e.seq) || e.seq <= streamSeq) return
+    if (!state.currentConvId || e.conversationId !== state.currentConvId || !Number.isSafeInteger(e.seq) || e.seq <= streamSeq) return
+    if(streamHasWatermark&&e.seq>streamSeq+1){
+      if(streamPending.size<1000)streamPending.set(e.seq,e)
+      if(!gapReconnectPending){gapReconnectPending=true;const conv=state.currentConvId,epoch=conversationEpoch;queueMicrotask(()=>{gapReconnectPending=false;if(conv===state.currentConvId&&epoch===conversationEpoch)store.connectLive(streamSeq)})}
+      return
+    }
     streamSeq = e.seq
+    if(streamPending.has(e.seq+1)){const pending=streamPending.get(e.seq+1)!;streamPending.delete(e.seq+1);queueMicrotask(()=>store.applyEvent(pending))}
     const previousSeq = state.lastSeq
     // Running-turn replay reconstructs transient output, but cannot regress the
     // persistent card/plan/status snapshot already returned by the detail query.
@@ -881,6 +907,7 @@ export const store = {
       }
       case 'artifact.created':
       case 'artifact.updated': {
+        if(e.type==='artifact.updated'&&state.currentConvId)void store.refreshCards(state.currentConvId)
         const p = e.payload as { artifact?: { id: string; name: string; kind?: string } }
         if (p?.artifact) {
           const ref = { artifactId: p.artifact.id, name: p.artifact.name, kind: p.artifact.kind }
@@ -1077,6 +1104,7 @@ export const store = {
     if (card.conversationId && card.conversationId !== state.currentConvId) return
     cardVersions[card.id] = ++cardVersion
     delete cardPatches[card.id]
+    card=mergeTaskCard(state.cards.find(c=>c.id===card.id),card)
     const i = state.cards.findIndex(c => c.id === card.id)
     const cards = i >= 0 ? state.cards.map(c => c.id === card.id ? card : c) : [card, ...state.cards]
     set({ cards })
@@ -1088,8 +1116,10 @@ export const store = {
     const request = ++cardsRequest
     const started = cardVersion
     try {
-      const snapshot = await api.listCards(convId)
+      const out = await api.listCardsSnapshot(convId)
+      const snapshot=out.cards??[]
       if (state.currentConvId !== convId || conversationEpoch !== epoch || request !== cardsRequest) return
+      if(Number.isSafeInteger(out.replaySeq)&&out.replaySeq!>=0)streamHasWatermark=true
       const cards = mergeCardSnapshot(snapshot, state.cards, cardVersions, started, cardPatches)
       set({ cards })
       settleCardFeedback(cards)
@@ -1212,12 +1242,15 @@ export const store = {
         rdmMembersAvailable: rdmMembersReady(cmds),
         rdmDocReviewAvailable: rdmDutyReady(cmds),
         rdmPermMatrixAvailable: rdmPermMatrixReady(cmds),
+        rdmWorkStatesAvailable: rdmWorkStatesReady(cmds),
+        rdmDocTemplatesAvailable: rdmDocTemplatesReady(cmds),
         rdmRender: renderCapabilities(cmds),
       })
     } catch {
       if (epoch !== identityEpoch) return
       set({ rdmAuditAvailable: false, rdmCockpitAvailable: false, rdmExportAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
-        rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false, rdmRender: NO_RENDER_CAPABILITIES })
+        rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false, rdmWorkStatesAvailable: false, rdmDocTemplatesAvailable: false,
+        rdmRender: NO_RENDER_CAPABILITIES })
     }
     try {
       const sections = await api.adminZoneSections()
@@ -1291,7 +1324,8 @@ export const store = {
   applyProjectEvent(e: StreamEvent) {
     if (!Number.isFinite(e.seq) || e.seq <= projectSeq) return
     projectSeq = e.seq
-    const upsert = (card: ActivityCard) => {
+    const upsert = (incoming: ActivityCard) => {
+      const card=mergeTaskCard(state.projectCards.find(c=>c.id===incoming.id),incoming)
       if (card.projectId !== state.currentProjectId) return
       projectCardVersions[card.id] = ++projectCardVersion
       const list = store.getState().projectCards
@@ -1404,6 +1438,41 @@ export const store = {
    * 工件预览唯一入口：在第三栏「文件」入口打开或激活标签（多文件多标签）。
    * 打开第一张自动切到预览子视图；关掉最后一张回到文件列表，并收回展开态。
    */
+  async openTaskSource(cardId: string, source: TaskSourceRef) {
+    const conversationId = state.currentConvId
+    const projectId = state.currentProjectId
+    const epoch = conversationEpoch
+    const intent = state.previewOpenIntent + 1
+    set({ previewOpenIntent: intent })
+    const isCurrent = () => conversationId === state.currentConvId && projectId === state.currentProjectId
+      && epoch === conversationEpoch && intent === state.previewOpenIntent
+    try {
+      const out = await api.taskSource(cardId, source.id)
+      if (!isCurrent()) return
+      if (!out.artifact) {
+        store.toast('来源当前不可用，正在核实工作记录')
+        if (conversationId) void store.refreshCards(conversationId)
+        return
+      }
+      store.requestTaskSourcePreview(out.artifact, {
+        notice: out.versionState === 'changed'
+          ? '当前文件已更新；下方引用来自任务处理时的版本，不能作为当前文件的结论'
+          : '任务处理时引用的来源版本；下方是本项发现引用的片段',
+        quote: out.source.quote ?? '',
+        expectedHash: out.versionState === 'current' ? out.source.contentHash : undefined,
+      })
+      if (out.versionState === 'changed' && conversationId) void store.refreshCards(conversationId)
+    } catch {
+      if (!isCurrent()) return
+      store.toast('来源当前无法读取，正在核实工作记录')
+      if (conversationId) void store.refreshCards(conversationId)
+    }
+  },
+  requestTaskSourcePreview(a:Artifact,sourceContext:{notice:string;quote:string;expectedHash?:string}){
+    store.requestPreview(a)
+    const conv=previewTabsKey(state.currentConvId)
+    set({previewTabs:{...state.previewTabs,[conv]:(state.previewTabs[conv]??[]).map(tab=>tab.id===a.id?{...tab,sourceContext}:tab)}})
+  },
   requestPreview(a: Artifact) {
     const conv = previewTabsKey(state.currentConvId)
     const opened = openPreviewTab(state.previewTabs[conv] ?? [], { id: a.id, name: a.name })
@@ -1455,7 +1524,7 @@ export const store = {
   togglePreviewExpanded() { setUI({ previewExpanded: !state.ui.previewExpanded }) },
   activatePreview(id: string) {
     const conv = previewTabsKey(state.currentConvId)
-    set({ previewActive: { ...state.previewActive, [conv]: id } })
+    set({ previewActive: { ...state.previewActive, [conv]: id },previewOpenIntent:state.previewOpenIntent+1 })
   },
   closePreview(id: string) {
     const conv = previewTabsKey(state.currentConvId)
@@ -1463,6 +1532,7 @@ export const store = {
     set({
       previewTabs: { ...state.previewTabs, [conv]: next.tabs },
       previewActive: { ...state.previewActive, [conv]: next.activeId },
+      previewOpenIntent:state.previewOpenIntent+1,
     })
     if (next.tabs.length === 0) setUI({ previewExpanded: false })
     syncFilesEntry(next.tabs.length > 0)

src/styles.css

@@ -519,82 +519,52 @@ button { font-family: inherit; font-size: inherit; color: inherit; }
 .ad-table tr:last-child td { border-bottom: none; }
 .rp-panel { display: flex; flex-direction: column; gap: 12px; }
 .rp-filters .lg-input { min-width: 140px; }
-.rp-view-toggle { justify-content: flex-end; flex-wrap: wrap; }
-.rp-view-toggle .ad-mini.on { background: var(--bg-active); color: var(--text); border-color: var(--accent); }
-.rp-category-nav { display: flex; gap: 6px; flex-wrap: wrap; margin-right: auto; }
-.rp-status:focus { outline: none; }
-.rp-status:empty { display: none; }
+.rp-view-toggle { justify-content: flex-end; }
+.rp-view-toggle .ad-mini.on { background: var(--bg-active); color: var(--text); }
 .rp-single { display: grid; grid-template-columns: minmax(180px, 240px) minmax(0, 1fr); gap: 16px; align-items: start; }
 .rp-disable-confirm { display: flex; gap: 10px; align-items: center; flex-wrap: wrap; margin-top: 8px; font-size: var(--fs-ui-sm); color: var(--warn-text); background: var(--warn-soft); border: 1px solid color-mix(in srgb, var(--warn) 35%, transparent); border-radius: var(--radius); padding: 8px 11px; }
 .rp-role-list { display: flex; flex-direction: column; gap: 2px; padding: 8px; border: 1px solid var(--border-soft); border-radius: var(--radius-lg); background: var(--bg-panel); }
 .rp-role-list .az-nav-item { justify-content: space-between; width: 100%; }
 .rp-editor { min-width: 0; display: flex; flex-direction: column; gap: 12px; }
-.rp-matrix-wrap { overflow: auto; max-height: 70vh; border: 1px solid var(--border-soft); border-radius: var(--radius-lg); }
-.rp-matrix-wrap:focus-visible { outline: none; box-shadow: var(--ring); }
-.rp-matrix { min-width: 760px; border-collapse: separate; border-spacing: 0; }
-.rp-matrix thead th { position: sticky; top: 0; z-index: 2; background: var(--bg-panel); vertical-align: bottom; }
-.rp-matrix th:first-child { position: sticky; left: 0; z-index: 1; background: var(--bg-panel); }
-.rp-matrix thead th:first-child { z-index: 3; }
-.rp-matrix tbody th { font-weight: normal; color: var(--text); border-bottom: 1px solid var(--border-soft); vertical-align: top; }
-.rp-matrix td { vertical-align: top; }
-.rp-matrix tr.rp-selected td, .rp-matrix tr.rp-selected th { background: var(--bg-active); }
-.rp-role-cell { display: flex; flex-direction: column; gap: 2px; min-width: 180px; max-width: 240px; }
-.rp-role-name { align-self: flex-start; border: none; background: none; padding: 0; color: var(--accent-text); font-size: var(--fs-ui-sm); font-weight: 600; cursor: pointer; text-align: left; }
-.rp-role-name:hover:not(:disabled) { text-decoration: underline; }
-.rp-role-name:disabled { color: var(--text-dim); cursor: default; }
-.rp-role-desc { overflow: hidden; text-overflow: ellipsis; white-space: nowrap; color: var(--text-dim); }
-.rp-disabled-note { margin: 0; font-size: var(--fs-ui-xs); color: var(--warn-text); }
-.rp-empty { padding: 12px; }
-.rp-cell { display: flex; flex-direction: column; gap: 4px; min-width: 120px; }
-.rp-state { height: 30px; border: 1px solid var(--border); border-radius: var(--radius-sm); background: var(--bg-raised); color: var(--text); font-size: var(--fs-ui-sm); padding: 0 6px; }
-.rp-state:focus-visible { outline: none; border-color: var(--accent); box-shadow: var(--ring); }
-.rp-state:disabled { opacity: .55; cursor: default; }
-.rp-cell-flag { font-size: var(--fs-ui-xs); color: var(--warn-text); }
-.rp-linked { display: flex; gap: 4px; align-items: flex-start; margin: 0; font-size: var(--fs-ui-xs); color: var(--accent-text); }
-.rp-linked svg { flex: none; margin-top: 1px; }
-.rp-focus-table td { vertical-align: top; }
-.rp-diff { margin: 0; padding-left: 20px; color: var(--text-dim); font-size: var(--fs-ui-sm); }
-.rp-preview { display: flex; flex-direction: column; gap: 10px; padding: 10px 12px; border: 1px solid var(--border); border-radius: var(--radius-lg); background: var(--bg-raised); font-size: var(--fs-ui-sm); }
-.rp-preview-head { display: flex; align-items: center; justify-content: space-between; gap: 8px; }
-.rp-preview-role { display: flex; flex-direction: column; gap: 4px; padding-top: 8px; border-top: 1px solid var(--border-soft); }
-.rp-preview-title { font-weight: 600; color: var(--text); }
-.rp-warn-text { font-weight: normal; color: var(--warn-text); }
-.rp-conflict { display: flex; gap: 4px; align-items: flex-start; margin: 0; color: var(--err-text); font-size: var(--fs-ui-sm); }
-.rp-conflict svg { flex: none; margin-top: 2px; }
-.rp-savebar { position: sticky; bottom: 0; z-index: 4; display: flex; gap: 8px; align-items: center; flex-wrap: wrap; padding: 10px 12px; border: 1px solid var(--border); border-radius: var(--radius-lg); background: var(--bg-panel); box-shadow: var(--shadow-md); }
-.rp-savebar-summary { flex: 1; min-width: 160px; font-size: var(--fs-ui-sm); color: var(--text); }
+.rp-matrix-wrap { overflow-x: auto; border: 1px solid var(--border-soft); border-radius: var(--radius-lg); }
+.rp-matrix { min-width: 420px; }
+.rp-matrix th:first-child, .rp-matrix td:first-child { position: sticky; left: 0; background: var(--bg-panel); z-index: 1; }
+.rp-matrix tr.rp-selected td { background: var(--bg-active); }
+.rp-matrix tr.rp-selected td:first-child { background: var(--bg-active); }
+.rp-access { display: flex; flex-direction: column; gap: 4px; }
+.rp-save { justify-content: space-between; flex-wrap: wrap; }
 .rp-grants { display: grid; grid-template-columns: repeat(auto-fit, minmax(260px, 1fr)); gap: 8px; margin-bottom: 12px; }
 .rp-grants .ad-check { align-items: flex-start; padding: 8px; border: 1px solid var(--border-soft); border-radius: var(--radius); background: var(--bg-raised); }
 .rp-grants .ad-mono { margin-left: auto; }
-.rp-members { display: flex; flex-direction: column; gap: 10px; }
-.rp-members-link { border: none; background: none; padding: 0; color: var(--accent-text); font-size: var(--fs-ui-sm); cursor: pointer; text-decoration: underline; }
-.rp-members-link:disabled { color: var(--text-dim); cursor: default; text-decoration: none; }
-.rp-members-link:focus-visible { outline: none; border-radius: var(--radius-xs); box-shadow: var(--ring); }
-.au-select-col { width: 32px; }
-.au-select-col input:focus-visible { outline: none; box-shadow: var(--ring); }
-.au-name-cell { display: flex; flex-direction: column; gap: 2px; }
-.au-same-name { align-self: flex-start; font-size: var(--fs-ui-xs); color: var(--warn-text); background: var(--warn-soft); border-radius: var(--radius-xs); padding: 1px 6px; }
-.au-grow { flex: 1; min-width: 0; }
-.au-batch .lg-input { height: 34px; }
-.au-preview-list { margin: 0; padding: 0; list-style: none; display: flex; flex-direction: column; gap: 6px; }
-.au-preview-list li { display: flex; gap: 10px; align-items: baseline; flex-wrap: wrap; padding-top: 6px; border-top: 1px solid var(--border-soft); }
-.au-copy { display: flex; flex-direction: column; gap: 10px; }
-.au-copy-group { margin: 0; padding: 8px 10px; border: 1px solid var(--border-soft); border-radius: var(--radius); display: grid; grid-template-columns: repeat(auto-fit, minmax(260px, 1fr)); gap: 6px 12px; }
-.au-copy-group legend { padding: 0 4px; font-size: var(--fs-ui-sm); font-weight: 600; color: var(--text-dim); }
-.au-copy-row { display: flex; gap: 8px; align-items: center; font-size: var(--fs-ui-sm); color: var(--text); }
-.au-copy-row > span:first-child { flex: 1; min-width: 0; }
-@media (max-width: 900px) {
+@media (max-width: 820px) {
   .rp-single { grid-template-columns: 1fr; }
   .rp-role-list { max-height: 220px; overflow-y: auto; }
-  .rp-matrix-wrap { max-height: 60vh; }
-  .rp-savebar .ad-mini, .rp-savebar .lg-submit { flex: 1; justify-content: center; }
 }
 .ad-mono { font-family: var(--mono); font-size: var(--fs-ui-sm); }
 .ad-dim { color: var(--text-dim); }
-.ad-cond-note { display: block; margin-top: 2px; font-size: var(--fs-ui-xs); }
 .ad-chip { font-size: var(--fs-ui-xs); border-radius: var(--radius-xs); padding: 2px 7px; font-weight: 700; letter-spacing: .5px; background: var(--bg-hover); color: var(--text-dim); }
 .ad-chip-admin { background: var(--accent-soft); color: var(--accent-text); }
+.ad-chip-super { background: var(--accent); color: var(--text-on-accent); }
 .ad-chip-warn { background: var(--warn-soft); color: var(--warn-text); }
+/* 工作状态（项目卡 / 成员行）与按模板生成文档；状态一律文字徽标，颜色只作辅助。 */
+.ad-actions { display: inline-flex; flex-wrap: wrap; align-items: center; gap: 4px; }
+.pw-card .ad-row { flex-wrap: wrap; }
+.pw-card .pw-action { margin-left: auto; }
+.ad-mini.pw-danger { color: var(--err-text); }
+.pw-card .ad-mini:disabled, .ad-actions .ad-mini:disabled, .tpl-panel .ad-mini:disabled { opacity: .55; cursor: not-allowed; }
+.tsb-newtask-main:disabled { opacity: .55; cursor: not-allowed; }
+.tsb-menu.tsb-tpl-pop { width: min(440px, calc(100vw - 16px)); max-height: 70vh; overflow-y: auto; padding: 10px; }
+.tpl-panel { display: flex; flex-direction: column; gap: 8px; }
+.tpl-list { list-style: none; margin: 0; padding: 0; display: flex; flex-direction: column; gap: 6px; }
+.tpl-item { border: 1px solid var(--border); border-radius: var(--radius); padding: 8px 10px; display: flex; flex-direction: column; gap: 4px; background: var(--bg-panel); }
+.tpl-item.on { border-color: var(--accent); }
+.tpl-head { display: flex; flex-wrap: wrap; align-items: center; gap: 6px; }
+.tpl-title { flex: 1; min-width: 0; font-weight: 600; overflow-wrap: anywhere; }
+.tpl-form .lg-input { height: 34px; }
+@media (max-width: 640px) {
+  .pw-card .pw-action { margin-left: 0; }
+  .ad-table .ad-actions { flex-direction: column; align-items: flex-start; }
+}
 .ad-reset { display: flex; gap: 8px; align-items: center; flex-wrap: wrap; border: 1px solid color-mix(in srgb, var(--warn) 40%, transparent); background: var(--warn-soft); border-radius: var(--radius-lg); padding: 12px; font-size: var(--fs-ui-sm); }
 .ad-reset .lg-input { flex: 1; min-width: 160px; height: 32px; }
 .ad-changepw { display: flex; flex-direction: column; gap: 2px; max-width: 340px; }

test/account-users-panel.test.ts

@@ -1,8 +1,5 @@
 import { describe, expect, it } from 'vitest'
 import { credentialLabel } from '../src/components/AccountUsersPanel'
-import { accountLabel, accountName, duplicateNames, roleColumnLabel, sameNameHint } from '../src/roleMembers'
-
-const account = (userId: string, owner: string, name: string) => ({ userId, owner, profile: { name } })
 
 describe('account directory credential state', () => {
   it('shows pending trusted-owner initialization before password state', () => {
@@ -11,28 +8,3 @@ describe('account directory credential state', () => {
     expect(credentialLabel({ initializationState: 'legacy', passwordSet: false })).toBe('未设置密码')
   })
 })
-
-describe('account directory names and roles', () => {
-  it('falls back to the login account when the name is missing', () => {
-    expect(accountName(account('u1', 'zhang.san', ''))).toBe('zhang.san')
-    expect(accountName(account('u1', 'zhang.san', '  '))).toBe('zhang.san')
-    expect(accountName(account('u1', 'zhang.san', '张三'))).toBe('张三')
-    expect(accountLabel(account('u1', 'zhang.san', '张三'))).toBe('张三（zhang.san）')
-    expect(accountLabel(account('u1', 'zhang.san', ''))).toBe('zhang.san')
-    expect(accountName({ userId: 'u2', owner: 'li.si', name: '李四' })).toBe('李四')
-  })
-
-  it('asks to tell same-name users apart by account', () => {
-    const accounts = [account('u1', 'zhang.san', '张三'), account('u2', 'zhang.san2', '张三'), account('u3', 'li.si', '李四'), account('u4', 'anon', '')]
-    expect([...duplicateNames(accounts)]).toEqual(['张三'])
-    expect(sameNameHint(accounts)).toBe('存在同名用户「张三」：zhang.san、zhang.san2，请按账号辨识')
-    expect(sameNameHint(accounts.slice(2))).toBe('')
-  })
-
-  it('labels the current role projection', () => {
-    expect(roleColumnLabel(undefined)).toBe('—')
-    expect(roleColumnLabel(null)).toBe('未分配')
-    expect(roleColumnLabel({ roleId: 'r1', name: '软件工程师', enabled: true })).toBe('软件工程师')
-    expect(roleColumnLabel({ roleId: 'r1', name: '软件工程师', enabled: false })).toBe('软件工程师（已停用）')
-  })
-})

test/pal-u6-ui.test.ts

@@ -0,0 +1,277 @@
+// 计划 U6（项目访问生命周期）界面呈现：工作状态控制消费 U4 合同（rdm.project.work.close/reopen、
+// rdm.project.member.suspend/reactivate），模板浏览消费 U5 合同（rdm.docs.templates/instantiate）。
+// 锁定：命令面门控、载荷形状、文字徽标（非颜色唯一）、禁用逻辑、高危确认流与 unsupported 拒绝。
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { createElement } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { api } from '../src/api'
+import type { Conversation, Message, Project } from '../src/contracts'
+import { MemberWorkCell, ProjectWorkCardView, TemplateListView, WorkStateBadge } from '../src/components/adminRdmSections'
+import {
+  CONFIRM_CARD_PENDING, ConfirmCardPending, RDM_DOC_TEMPLATE_COMMANDS, RDM_WORK_STATE_COMMANDS,
+  TEMPLATE_RECORD_TITLE, WORK_CONFIRM_RECORD_TITLE, WORK_STATE_NOTICES,
+  commandRequestBody, commitTemplateInstantiate, highDangerSource, instantiatePayload, instantiateSourceText,
+  isHighDangerCommand, memberWorkControl, memberWorkPayload, memberWorkState, projectWorkClosed, projectWorkControl,
+  projectWorkPayload, projectWorkStatus, rdmDocTemplatesReady, rdmWorkStatesReady, templateSelectable,
+  type DocTemplateRow, type InstantiatePort,
+} from '../src/rdmManagement'
+
+const project = (settings: Record<string, unknown> = {}, owner = 'alice'): Project => ({
+  id: 'host-1', name: '宿主项目', owner, createdAt: '', updatedAt: '',
+  settings: { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready', ...settings },
+})
+const active = project({ 'rdm.workState': 'active', 'rdm.workVersion': 3 })
+const closed = project({ 'rdm.workState': 'closed', 'rdm.workVersion': 4 })
+const conv = (id: string, over: Partial<Conversation> = {}): Conversation => ({
+  id, projectId: 'host-1', title: TEMPLATE_RECORD_TITLE, createdAt: '', updatedAt: '', ...over,
+})
+const userMsg = (id: string, conversationId: string): Message => ({ id, conversationId, role: 'user', parts: [], createdAt: '' })
+const template = (over: Partial<DocTemplateRow> = {}): DocTemplateRow => ({
+  templateId: 'tpl-srs', version: '1.2.0', title: '软件需求规格说明', docTypes: ['SRS'], stage: 'design',
+  state: 'published', sourceFormat: 'docx', sourceSha256: 'abc123', generation: 'supported', ...over,
+})
+const unsupported = template({
+  templateId: 'tpl-risk', version: '0.9.0', title: '风险管理报告', generation: 'unsupported',
+  unsupportedReason: 'dhf: 模板包缺失签署区映射', state: 'needs-review',
+})
+const noop = () => undefined
+const html = (el: Parameters<typeof renderToStaticMarkup>[0]) => renderToStaticMarkup(el)
+
+describe('命令面门控（fail-closed）', () => {
+  const cmds = (ids: readonly string[], enabled = true) => ids.map(id => ({ id, enabled }))
+  it('工作状态四条命令齐备且 enabled 才就绪', () => {
+    expect(rdmWorkStatesReady(cmds(RDM_WORK_STATE_COMMANDS))).toBe(true)
+    expect(rdmWorkStatesReady(cmds(RDM_WORK_STATE_COMMANDS.slice(1)))).toBe(false)
+    expect(rdmWorkStatesReady(cmds(RDM_WORK_STATE_COMMANDS, false))).toBe(false)
+    expect(rdmWorkStatesReady(null)).toBe(false)
+  })
+  it('模板入口需要清单与实例化两条命令', () => {
+    expect(rdmDocTemplatesReady(cmds(RDM_DOC_TEMPLATE_COMMANDS))).toBe(true)
+    expect(rdmDocTemplatesReady(cmds(['rdm.docs.templates']))).toBe(false)
+    expect(rdmDocTemplatesReady(undefined)).toBe(false)
+  })
+})
+
+describe('工作状态读面与载荷', () => {
+  it('项目工作状态取自项目列表的 rdm.workState / rdm.workVersion；缺任一不渲染控制', () => {
+    expect(projectWorkStatus(active)).toEqual({ state: 'active', version: 3 })
+    expect(projectWorkStatus(closed)).toEqual({ state: 'closed', version: 4 })
+    expect(projectWorkStatus(project({ 'rdm.workState': 'closed' }))).toBeNull()
+    expect(projectWorkStatus(project({ 'rdm.workState': 'weird', 'rdm.workVersion': 1 }))).toBeNull()
+    expect(projectWorkStatus(undefined)).toBeNull()
+    expect(projectWorkClosed(closed)).toBe(true)
+    expect(projectWorkClosed(active)).toBe(false)
+  })
+  it('载荷按命令 paramsSchema：projectId + expectedVersion（成员命令另带 member），不含身份字段', () => {
+    expect(projectWorkPayload('host-1', 3)).toEqual({ projectId: 'host-1', expectedVersion: 3 })
+    expect(memberWorkPayload('host-1', 'bob', 7)).toEqual({ projectId: 'host-1', member: 'bob', expectedVersion: 7 })
+  })
+  it('成员状态：缺省 active；suspended/removed 原样保留', () => {
+    expect(memberWorkState({})).toBe('active')
+    expect(memberWorkState({ state: 'suspended' })).toBe('suspended')
+    expect(memberWorkState({ state: 'removed' })).toBe('removed')
+  })
+  it('只有 close 与 suspend 是高危命令', () => {
+    expect(RDM_WORK_STATE_COMMANDS.filter(isHighDangerCommand)).toEqual(['rdm.project.work.close', 'rdm.project.member.suspend'])
+  })
+})
+
+describe('控件禁用逻辑', () => {
+  it('项目卡：active→关闭，closed→重新开启；非创建者禁用并说明', () => {
+    expect(projectWorkControl({ state: 'active', version: 1 }, true)).toMatchObject({ command: 'rdm.project.work.close', disabledReason: '' })
+    expect(projectWorkControl({ state: 'closed', version: 2 }, true)).toMatchObject({ command: 'rdm.project.work.reopen', disabledReason: '' })
+    expect(projectWorkControl({ state: 'closed', version: 2 }, false).disabledReason).toContain('仅项目创建者')
+  })
+  it('成员行：active→暂停，suspended→恢复，removed 无控件；创建者自身不可暂停；缺版本禁用', () => {
+    const ctx = { isCreator: true, creator: 'alice' }
+    expect(memberWorkControl({ owner: 'bob', state: 'active', stateVersion: 1 }, ctx))
+      .toMatchObject({ command: 'rdm.project.member.suspend', disabledReason: '' })
+    expect(memberWorkControl({ owner: 'bob', state: 'suspended', stateVersion: 2 }, ctx))
+      .toMatchObject({ command: 'rdm.project.member.reactivate', disabledReason: '' })
+    expect(memberWorkControl({ owner: 'bob', state: 'removed', stateVersion: 3 }, ctx)).toBeNull()
+    expect(memberWorkControl({ owner: 'alice', state: 'active', stateVersion: 1 }, ctx)?.disabledReason).toContain('创建者不可暂停')
+    expect(memberWorkControl({ owner: 'bob', state: 'active' }, ctx)?.disabledReason).toContain('状态版本')
+    expect(memberWorkControl({ owner: 'bob', state: 'active', stateVersion: 1 }, { isCreator: false, creator: 'alice' })?.disabledReason)
+      .toContain('仅项目创建者')
+  })
+})
+
+describe('状态呈现（文字徽标，非颜色唯一）', () => {
+  it.each([
+    ['active', '正常'], ['suspended', '已暂停'], ['removed', '已移除'], ['closed', '已关闭'],
+  ] as const)('%s 渲染为文字徽标「%s」', (state, label) => {
+    const out = html(createElement(WorkStateBadge, { state }))
+    expect(out).toContain(`data-work-state="${state}"`)
+    expect(out).toContain(`>${label}<`)
+  })
+
+  it('closed 项目：只读说明 + 创建者「重新开启」保持可用', () => {
+    const out = html(createElement(ProjectWorkCardView, { status: { state: 'closed', version: 4 }, isCreator: true, busy: false, onRun: noop }))
+    expect(out).toContain('已关闭')
+    expect(out).toContain(WORK_STATE_NOTICES.closed)
+    expect(out).toContain('重新开启')
+    expect(out).not.toContain('disabled=""')
+  })
+
+  it('active 项目：关闭按钮标明需确认；非创建者禁用并显示原因', () => {
+    const creator = html(createElement(ProjectWorkCardView, { status: { state: 'active', version: 3 }, isCreator: true, busy: false, onRun: noop }))
+    expect(creator).toContain('关闭项目工作（需确认）')
+    expect(creator).toContain('正常')
+    const other = html(createElement(ProjectWorkCardView, { status: { state: 'active', version: 3 }, isCreator: false, busy: false, onRun: noop }))
+    expect(other).toContain('disabled=""')
+    expect(other).toContain('仅项目创建者可关闭或重新开启项目工作')
+  })
+
+  it('成员行：suspended 显示「已暂停」+ 恢复；removed 只读无控件；busy 时禁用', () => {
+    const suspended = html(createElement(MemberWorkCell, { row: { owner: 'bob', state: 'suspended', stateVersion: 2 }, isCreator: true, creator: 'alice', busy: false, onRun: noop }))
+    expect(suspended).toContain('已暂停')
+    expect(suspended).toContain('>恢复<')
+    const removed = html(createElement(MemberWorkCell, { row: { owner: 'bob', state: 'removed', stateVersion: 3 }, isCreator: true, creator: 'alice', busy: false, onRun: noop }))
+    expect(removed).toContain('已移除')
+    expect(removed).not.toContain('<button')
+    const busy = html(createElement(MemberWorkCell, { row: { owner: 'bob', state: 'active', stateVersion: 1 }, isCreator: true, creator: 'alice', busy: true, onRun: noop }))
+    expect(busy).toContain('>暂停<')
+    expect(busy).toContain('disabled=""')
+  })
+})
+
+describe('命令总线管道（经既有 rdmProjectCommand）', () => {
+  let requests: { path: string; body: any }[]
+  let reply: () => Response
+  beforeEach(() => {
+    requests = []
+    reply = () => new Response(JSON.stringify({ payload: { ok: true } }))
+    vi.stubGlobal('fetch', async (path: string, init?: RequestInit) => {
+      requests.push({ path, body: init?.body ? JSON.parse(String(init.body)) : undefined })
+      return reply()
+    })
+  })
+  afterEach(() => { vi.unstubAllGlobals(); vi.restoreAllMocks() })
+
+  it('非高危命令只发 params，projectId 换成已绑定的研发项目', async () => {
+    await api.rdmProjectCommand(closed, 'rdm.project.work.reopen', projectWorkPayload(closed.id, 4))
+    expect(requests).toEqual([{ path: '/api/commands/rdm.project.work.reopen', body: { params: { projectId: 'domain-7', expectedVersion: 4 } } }])
+  })
+
+  it('高危命令携带对话上下文（无锚点）；返回确认卡时抛出带卡片 id 的 ConfirmCardPending', async () => {
+    reply = () => new Response(JSON.stringify({ receipt: { state: 'accepted' }, card: { id: 'card-9' } }))
+    const run = api.rdmProjectCommand(active, 'rdm.project.member.suspend', memberWorkPayload(active.id, 'bob', 2),
+      { conversationId: 'c-confirm', entrance: 'button' })
+    await expect(run).rejects.toBeInstanceOf(ConfirmCardPending)
+    await expect(run).rejects.toMatchObject({ cardId: 'card-9', message: CONFIRM_CARD_PENDING })
+    expect(requests[0].body).toEqual({
+      params: { projectId: 'domain-7', member: 'bob', expectedVersion: 2 }, conversationId: 'c-confirm', entrance: 'button',
+    })
+  })
+
+  it('陈旧版本被拒（4xx）按既有错误管道原样抛出', async () => {
+    reply = () => new Response(JSON.stringify({ receipt: { state: 'rejected', error: '工作状态已被并发修改' } }), { status: 400 })
+    await expect(api.rdmProjectCommand(active, 'rdm.project.work.close', projectWorkPayload(active.id, 2), { conversationId: 'c', entrance: 'button' }))
+      .rejects.toThrow(/400: .*并发修改/)
+  })
+
+  it('请求体：锚点缺省不携带，正式写命令的锚点保留', () => {
+    expect(commandRequestBody({ a: 1 }, { conversationId: 'c', entrance: 'button' })).toEqual({ params: { a: 1 }, conversationId: 'c', entrance: 'button' })
+    expect(commandRequestBody({ a: 1 }, { conversationId: 'c', anchorMessageId: 'm', entrance: 'button' }))
+      .toEqual({ params: { a: 1 }, conversationId: 'c', anchorMessageId: 'm', entrance: 'button' })
+  })
+
+  it('高危确认上下文：复用未归档的确认记录对话，否则新建；不发送消息', async () => {
+    const port = {
+      listConversations: vi.fn(async () => [conv('c-arch', { title: WORK_CONFIRM_RECORD_TITLE, archived: true })]),
+      createConversation: vi.fn(async (_p: string, title?: string) => conv('c-new', { title: title ?? '' })),
+    }
+    expect(await highDangerSource(port, active)).toEqual({ conversationId: 'c-new', entrance: 'button' })
+    expect(port.createConversation).toHaveBeenCalledWith('host-1', WORK_CONFIRM_RECORD_TITLE)
+    port.listConversations.mockResolvedValueOnce([conv('c-live', { title: WORK_CONFIRM_RECORD_TITLE })])
+    expect(await highDangerSource(port, active)).toEqual({ conversationId: 'c-live', entrance: 'button' })
+  })
+})
+
+describe('模板浏览与实例化（U5 合同）', () => {
+  it('列表：全部条目可见；unsupported 禁用选择并显示 unsupportedReason', () => {
+    const out = html(createElement(TemplateListView, { templates: [template(), unsupported], selectedKey: '', blockedReason: null, onChoose: noop }))
+    expect(out).toContain('软件需求规格说明')
+    expect(out).toContain('风险管理报告')
+    expect(out).toContain('tpl-srs@1.2.0')
+    expect(out).toContain('tpl-risk@0.9.0')
+    expect(out).toContain('不可生成：dhf: 模板包缺失签署区映射')
+    expect(out).toContain('待复核')
+    expect(out.match(/disabled=""/g)).toHaveLength(1)
+  })
+
+  it('项目工作已关闭时全部选择禁用', () => {
+    const out = html(createElement(TemplateListView, { templates: [template(), unsupported], selectedKey: '', blockedReason: WORK_STATE_NOTICES.closed, onChoose: noop }))
+    expect(out.match(/disabled=""/g)).toHaveLength(2)
+  })
+
+  it('可选判定与 instantiate 同源：generation≠supported 或缺文档类型即不可选', () => {
+    expect(templateSelectable(template())).toEqual({ ok: true, reason: '' })
+    expect(templateSelectable(unsupported)).toEqual({ ok: false, reason: 'dhf: 模板包缺失签署区映射' })
+    expect(templateSelectable(template({ generation: 'unsupported', unsupportedReason: '' })).ok).toBe(false)
+    expect(templateSelectable(template({ docTypes: [] })).ok).toBe(false)
+    expect(templateSelectable(template({ docTypes: null })).ok).toBe(false)
+  })
+
+  it('载荷按 paramsSchema 携带 templateId/version 溯源；title 为空不携带', () => {
+    expect(instantiatePayload('domain-7', template(), 'SRS', '  ')).toEqual({ projectId: 'domain-7', docType: 'SRS', templateId: 'tpl-srs', version: '1.2.0' })
+    expect(instantiatePayload('domain-7', template(), 'SRS', ' 需求 v1 ')).toEqual({
+      projectId: 'domain-7', docType: 'SRS', templateId: 'tpl-srs', version: '1.2.0', title: '需求 v1',
+    })
+    expect(() => instantiatePayload('domain-7', unsupported, 'SRS')).toThrow('签署区映射')
+    expect(() => instantiatePayload('domain-7', template(), 'SDD')).toThrow('不在该模板的适用范围内')
+  })
+
+  it('来源正文含模板身份与版本，首字符不为 “/”', () => {
+    const text = instantiateSourceText(template(), 'SRS', '')
+    expect(text).toContain('模板：软件需求规格说明（tpl-srs@1.2.0）')
+    expect(text).toContain('文档标题：沿用模板标题')
+    expect(text.startsWith('/')).toBe(false)
+  })
+
+  function harness(over: Partial<InstantiatePort> = {}) {
+    const calls: string[] = []
+    const port: InstantiatePort = {
+      listConversations: vi.fn(async () => { calls.push('list'); return [conv('c-1')] }),
+      createConversation: vi.fn(async (_p: string, title?: string) => { calls.push('create'); return conv('c-new', { title: title ?? '' }) }),
+      sendMessage: vi.fn(async (convId: string) => { calls.push('send'); return { message: userMsg('m-1', convId) } }),
+      rdmCommand: vi.fn(async () => { calls.push('command'); return { docId: 'doc-1' } }),
+      ...over,
+    }
+    return { port, calls }
+  }
+
+  it('显式选择后：记录来源消息再以其为锚点分发 rdm.docs.instantiate', async () => {
+    const { port, calls } = harness()
+    const out = await commitTemplateInstantiate(port, { host: active, operationId: 'op-1', template: template(), docType: 'SRS', title: '' })
+    expect(out).toEqual({ docId: 'doc-1' })
+    expect(calls).toEqual(['list', 'send', 'command'])
+    expect(port.sendMessage).toHaveBeenCalledWith('c-1', expect.stringContaining('tpl-srs@1.2.0'), [], 'instantiate:op-1')
+    expect(port.rdmCommand).toHaveBeenCalledWith('rdm.docs.instantiate',
+      { projectId: 'domain-7', docType: 'SRS', templateId: 'tpl-srs', version: '1.2.0' },
+      { conversationId: 'c-1', anchorMessageId: 'm-1', entrance: 'button' })
+  })
+
+  it('unsupported 条目、工作已关闭、未绑定项目：一律拒绝且不记录、不分发', async () => {
+    for (const [host, tpl, pattern] of [
+      [active, unsupported, /签署区映射/],
+      [closed, template(), /项目工作已关闭/],
+      [project({ 'rdm.state': 'provisioning' }), template(), /正在准备/],
+    ] as const) {
+      const { port, calls } = harness()
+      await expect(commitTemplateInstantiate(port, { host, operationId: 'op', template: tpl, docType: 'SRS', title: '' })).rejects.toThrow(pattern)
+      expect(calls).toEqual([])
+    }
+  })
+
+  it('来源消息未提交或被识别为命令：不分发', async () => {
+    const asCommand = harness({ sendMessage: vi.fn(async () => ({ command: '/x' })) })
+    await expect(commitTemplateInstantiate(asCommand.port, { host: active, operationId: 'op', template: template(), docType: 'SRS', title: '' }))
+      .rejects.toThrow('识别为命令')
+    expect(asCommand.port.rdmCommand).not.toHaveBeenCalled()
+    const wrongConv = harness({ sendMessage: vi.fn(async () => ({ message: userMsg('m-2', 'other') })) })
+    await expect(commitTemplateInstantiate(wrongConv.port, { host: active, operationId: 'op', template: template(), docType: 'SRS', title: '' }))
+      .rejects.toThrow('未返回已提交的对话消息')
+    expect(wrongConv.port.rdmCommand).not.toHaveBeenCalled()
+  })
+})

test/permission-explanations.test.ts

@@ -1,63 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { LINKED_ACTION_LABELS, dutyConditionNote, linkedCapabilitySummary } from '../src/permissionExplanations'
-import { describeSource } from '../src/rdmManagement'
-
-const LINKED = ['project.settings', 'project.members.manage', 'project.permissions.manage', 'document.duties.assign']
-
-describe('linked capability summary', () => {
-  it('returns empty when the server omits the field (older backend)', () => {
-    expect(linkedCapabilitySummary(undefined)).toBe('')
-  })
-
-  it('explains held project-create eligibility and the self-created-project scope', () => {
-    expect(linkedCapabilitySummary({ projectCreate: true, source: 'grant', actions: LINKED })).toBe(
-      '已具备创建项目资格（来源：管理员授予）；创建本人项目后自动具备：管理项目设置、管理项目成员、管理项目权限、分配文档职责；'
-      + '这些资格仅对本人创建的项目生效，其他项目按项目授权判断')
-  })
-
-  it('maps source variants and falls back to the raw source', () => {
-    expect(linkedCapabilitySummary({ projectCreate: true, source: 'role', actions: [] })).toBe('已具备创建项目资格（来源：角色）')
-    expect(linkedCapabilitySummary({ projectCreate: true, source: 'admin', actions: [] })).toBe('已具备创建项目资格（来源：系统管理员）')
-    expect(linkedCapabilitySummary({ projectCreate: true, source: 'admin-grant', actions: [] })).toContain('来源：管理员授予')
-    expect(linkedCapabilitySummary({ projectCreate: true, source: 'future', actions: [] })).toContain('来源：future')
-    expect(linkedCapabilitySummary({ projectCreate: true, actions: [] })).toBe('已具备创建项目资格')
-  })
-
-  it('appends explicit conflicts with Chinese labels', () => {
-    const text = linkedCapabilitySummary({
-      projectCreate: true, source: 'role', actions: ['project.settings'], conflicts: ['project.members.manage', 'document.duties.assign'],
-    })
-    expect(text).toContain('创建本人项目后自动具备：管理项目设置')
-    expect(text.endsWith('存在冲突：管理项目成员、分配文档职责 被明确禁止')).toBe(true)
-  })
-
-  it('states missing eligibility without listing linked actions', () => {
-    expect(linkedCapabilitySummary({ projectCreate: false, actions: [] })).toBe('未具备创建项目资格')
-    expect(linkedCapabilitySummary({ projectCreate: false, actions: ['project.settings'], conflicts: ['project.settings'] })).toBe('未具备创建项目资格')
-  })
-
-  it('labels every linked action and keeps unknown ids verbatim', () => {
-    expect(LINKED.map(id => LINKED_ACTION_LABELS[id])).toEqual(['管理项目设置', '管理项目成员', '管理项目权限', '分配文档职责'])
-    expect(linkedCapabilitySummary({ projectCreate: true, actions: ['x.y'] })).toContain('自动具备：x.y')
-  })
-})
-
-describe('duty condition note', () => {
-  it('explains the duty and state conditions for document author/review/approve', () => {
-    expect(dutyConditionNote('document.author')).toBe('仍需被分配该文档的编制职责，且文档状态符合要求')
-    expect(dutyConditionNote('document.review')).toBe('仍需被分配该文档的审核职责，且文档状态符合要求')
-    expect(dutyConditionNote('document.approve')).toBe('仍需被分配该文档的批准职责，且文档状态符合要求')
-  })
-
-  it('is empty for every other action', () => {
-    for (const id of ['document.read', 'project.settings', 'project.create', '']) expect(dutyConditionNote(id)).toBe('')
-  })
-})
-
-describe('describeSource future sources', () => {
-  it('maps creator and role sources, keeping the raw fallback', () => {
-    expect(describeSource('creator')).toBe('本人项目创建者自动具备（仅本人创建的项目）')
-    expect(describeSource('role')).toBe('职位角色')
-    expect(describeSource('weird')).toBe('weird')
-  })
-})

test/role-members.test.ts

@@ -1,133 +0,0 @@
-import { describe, expect, it, vi } from 'vitest'
-import type { PermissionDescriptor, RoleRecord, UserRoleAssignmentPreview } from '../src/api'
-import {
-  assignedToRole, clearSelection, copyAssignRequest, createSelection, memberAssignments, pageSelectionState, previewAllowsAssign,
-  previewTransition, refreshStateVersions, roleSourceValues, selectPage, selectionCounts, selectionSummary, staleUserIds, toggleOne,
-} from '../src/roleMembers'
-import { stateToValue } from '../src/rolePermissions'
-
-const catalog: PermissionDescriptor[] = [
-  { actionId: 'system.roles.view', label: '查看角色', description: '', group: '角色管理', scope: 'system', protected: true },
-  { actionId: 'project.create', label: '创建项目', description: '', group: '项目入口', category: '项目与协作', scope: 'system', protected: false },
-  { actionId: 'document.read', label: '读取文档', description: '', group: '文档动作', category: '文档工作', scope: 'project', protected: false },
-  { actionId: 'document.author', label: '编制文档', description: '', group: '文档动作', category: '文档工作', scope: 'project', protected: false },
-]
-const source: RoleRecord = {
-  roleId: 'role_engineer', name: '软件工程师', description: '研发', enabled: true, roleVersion: 7, bindingCount: 3,
-  permissions: [{ actionId: 'document.read', allowed: true, capAllowed: true, permissionVersion: 1 }],
-}
-const preview = (userId: string, patch: Partial<UserRoleAssignmentPreview> = {}): UserRoleAssignmentPreview => ({
-  userId, owner: userId, name: '', currentRoleId: '', currentRoleName: '', targetRoleId: 'role_engineer', targetRoleName: '软件工程师',
-  stateMatches: true, ...patch,
-})
-
-describe('cross-page member selection', () => {
-  it('accumulates explicit picks across pages and counts the ones beyond the current page', () => {
-    let selection = toggleOne(createSelection(), 'u1')
-    selection = toggleOne(selection, 'u2')
-    const pageTwo = ['u3', 'u4']
-    selection = selectPage(selection, pageTwo, true)
-    expect(selection.ids).toEqual(['u1', 'u2', 'u3', 'u4'])
-    expect(selectionCounts(selection, pageTwo)).toEqual({ count: 4, beyondPage: 2 })
-    expect(selectionSummary(selectionCounts(selection, pageTwo))).toBe('已选 4 人（包含其他页的 2 人）')
-    expect(selectionSummary(selectionCounts(selection, ['u1', 'u2', 'u3', 'u4']))).toBe('已选 4 人')
-  })
-
-  it('page select-all only touches the current page and reports a partial page', () => {
-    const selection = selectPage(createSelection(['u9']), ['u1', 'u2'], true)
-    expect(pageSelectionState(selection, ['u1', 'u2'])).toBe('all')
-    const unpicked = selectPage(selection, ['u1', 'u2'], false)
-    expect(unpicked.ids).toEqual(['u9'])
-    expect(pageSelectionState(toggleOne(selection, 'u2', false), ['u1', 'u2'])).toBe('some')
-    expect(pageSelectionState(unpicked, [])).toBe('none')
-  })
-
-  it('keeps the selection when filters change and never widens it to unselected matches', () => {
-    const selection = toggleOne(createSelection(), 'u1')
-    const filteredPage = ['u5', 'u6']
-    expect(selectionCounts(selection, filteredPage)).toEqual({ count: 1, beyondPage: 1 })
-    expect(selection.ids).toEqual(['u1'])
-    expect(toggleOne(selection, 'u1', true)).toBe(selection)
-    expect(toggleOne(selection, 'u7', false)).toBe(selection)
-  })
-
-  it('clears to an empty selection', () => {
-    expect(clearSelection().ids).toEqual([])
-    expect(selectionCounts(clearSelection(), ['u1'])).toEqual({ count: 0, beyondPage: 0 })
-  })
-})
-
-describe('member assignment entries', () => {
-  it('submits stable userId/roleId pairs with each user\'s own state version, once per user', () => {
-    expect(memberAssignments(['u1', 'u2', 'u1'], 'role_engineer', { u1: 3, u2: 8 })).toEqual([
-      { userId: 'u1', roleId: 'role_engineer', expectedStateVersion: 3 },
-      { userId: 'u2', roleId: 'role_engineer', expectedStateVersion: 8 },
-    ])
-  })
-
-  it('refuses to build entries without a target role or a known state version', () => {
-    expect(() => memberAssignments(['u1'], '', { u1: 3 })).toThrow('目标角色')
-    expect(() => memberAssignments(['u1', 'u2'], 'role_engineer', { u1: 3 })).toThrow('状态版本')
-  })
-
-  it('allows confirmation only when every submitted user previews cleanly', () => {
-    expect(previewAllowsAssign([preview('u1'), preview('u2')], ['u1', 'u2'])).toBe(true)
-    expect(previewAllowsAssign([preview('u1')], ['u1', 'u2'])).toBe(false)
-    expect(previewAllowsAssign([preview('u1', { error: '用户已停用' })], ['u1'])).toBe(false)
-    expect(previewAllowsAssign([preview('u1', { stateMatches: false })], ['u1'])).toBe(false)
-    expect(previewAllowsAssign([], [])).toBe(false)
-    expect(staleUserIds([preview('u1', { stateMatches: false }), preview('u2')])).toEqual(['u1'])
-    expect(previewTransition(preview('u1'))).toBe('未分配 → 软件工程师')
-    expect(previewTransition(preview('u1', { currentRoleName: '审核工程师' }))).toBe('审核工程师 → 软件工程师')
-  })
-
-  it('re-reads only stale users through the read-only detail endpoint', async () => {
-    const adminGetUser = vi.fn(async (userId: string) => ({ userId, stateVersion: 12 }))
-    expect(await refreshStateVersions({ adminGetUser }, ['u1', 'u1'])).toEqual({ u1: { userId: 'u1', stateVersion: 12 } })
-    expect(adminGetUser).toHaveBeenCalledTimes(1)
-  })
-
-  it('marks directory results already bound to the role', () => {
-    expect(assignedToRole({ role: { roleId: 'role_engineer', name: '软件工程师', enabled: true } }, 'role_engineer')).toBe(true)
-    expect(assignedToRole({ role: null }, 'role_engineer')).toBe(false)
-    expect(assignedToRole({}, 'role_engineer')).toBe(false)
-  })
-})
-
-describe('copy role and assign request', () => {
-  const base = {
-    idempotencyKey: 'key-1', source, description: ' 独立维护 ', catalog,
-    users: [{ userId: 'u1', stateVersion: 4 }],
-  }
-
-  it('requires an explicit non-empty new role name', () => {
-    expect(() => copyAssignRequest({ ...base, name: '   ', values: {} })).toThrow('名称')
-    expect(() => copyAssignRequest({ ...base, name: '新角色', values: {}, users: [] })).toThrow('用户')
-  })
-
-  it('sends only actions whose value differs from the source role', () => {
-    const request = copyAssignRequest({ ...base, name: ' 软件工程师（外包） ', values: {
-      'document.read': stateToValue('default'),
-      'document.author': stateToValue('project'),
-      'project.create': stateToValue('denied'),
-    } })
-    expect(request).toEqual({
-      idempotencyKey: 'key-1',
-      source: { roleId: 'role_engineer', expectedRoleVersion: 7 },
-      name: '软件工程师（外包）', description: '独立维护',
-      overrides: [{ actionId: 'document.author', allowed: false, capAllowed: true }],
-      assignments: [{ userId: 'u1', expectedStateVersion: 4 }],
-    })
-  })
-
-  it('omits overrides entirely when nothing was adjusted', () => {
-    const request = copyAssignRequest({ ...base, name: '副本', values: { 'document.read': stateToValue('default') } })
-    expect(request).not.toHaveProperty('overrides')
-    expect(request.assignments[0]).not.toHaveProperty('roleId')
-  })
-
-  it('treats a role projection without permissions as an empty baseline instead of throwing', () => {
-    expect(() => roleSourceValues({ permissions: undefined } as any, catalog)).not.toThrow()
-    expect(roleSourceValues({ permissions: undefined } as any, catalog)).toEqual({})
-  })
-})

test/role-permissions-ui.test.ts

@@ -1,122 +1,125 @@
-import { describe, expect, it, vi } from 'vitest'
-import type { PermissionDescriptor, RolePermissionPreview, RoleRecord } from '../src/api'
+// 角色面板（计划 U1 / R13）：角色只编辑单一「项目访问」布尔；可编辑性只看 system.roles.manage，
+// 可读性只看 system.roles.view，isAdmin 不旁路。服务端授权仍为权威，这里锁定门禁、呈现与请求体。
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createElement } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { api, type RoleRecord } from '../src/api'
 import {
-  NARROW_ROLE_QUERY, cellKind, commitRoleBatch, editRoleDraft, filterRoles, hasSystemAction, initialRoleView, memberStatusLabel, previewRoleBatch,
-  rebaseRoleDrafts, roleCellValue, roleLeaveMessage, roleMembersLabel, shouldAcceptRoleResponse,
+  PROJECT_ACCESS_MANAGE_REASON, ProjectAccessCheckbox, filterRoles, hasSystemAction, rolePanelAccess, saveProjectAccess,
+  shouldAcceptRoleResponse,
 } from '../src/components/RolePermissionsPanel'
-import { categoryActions, dirtyRoles, rolePatchEntries, stateToValue } from '../src/rolePermissions'
+import { projectAccessPatch } from '../src/rolePermissions'
+
+afterEach(() => vi.restoreAllMocks())
 
 const roles: RoleRecord[] = [
   { roleId: 'role_engineer', name: '软件工程师', description: '研发', enabled: true, roleVersion: 1, bindingCount: 2, permissions: [] },
   { roleId: 'role_reviewer', name: '审核工程师', description: '质量', enabled: false, roleVersion: 1, bindingCount: 1, permissions: [] },
 ]
+const withAccess = (role: RoleRecord, access: boolean, roleVersion = role.roleVersion): RoleRecord => ({
+  ...role, roleVersion, permissions: [{ actionId: 'project.create', allowed: access, capAllowed: access, permissionVersion: roleVersion }],
+})
+const noop = () => undefined
 
-const catalog: PermissionDescriptor[] = [
-  { actionId: 'system.roles.view', label: '查看角色', description: '', group: '角色管理', scope: 'system', protected: true },
-  { actionId: 'project.create', label: '创建项目', description: '', group: '项目入口', category: '项目与协作', scope: 'system', protected: false },
-  { actionId: 'document.read', label: '读取文档', description: '', group: '文档动作', category: '文档工作', scope: 'project', protected: false },
-  { actionId: 'document.author', label: '编制文档', description: '', group: '文档动作', category: '文档工作', scope: 'project', protected: false },
-]
-const editableIds = catalog.filter(item => !item.protected).map(item => item.actionId)
-const versions = (drafts: Record<string, { role: RoleRecord }>) =>
-  Object.fromEntries(Object.entries(drafts).map(([roleId, draft]) => [roleId, draft.role.roleVersion]))
-
-describe('role permission UI helpers', () => {
+describe('role panel helpers', () => {
   it('combines exact or fuzzy search with the role status filter', () => {
     expect(filterRoles(roles, '软件工程师', 'exact', 'enabled').map(role => role.roleId)).toEqual(['role_engineer'])
     expect(filterRoles(roles, '工程师', 'fuzzy', 'all').map(role => role.roleId)).toEqual(['role_engineer', 'role_reviewer'])
     expect(filterRoles(roles, '', 'fuzzy', 'disabled').map(role => role.roleId)).toEqual(['role_reviewer'])
   })
 
-  it('shows one business category of matrix columns at a time, keeping stable action IDs and skipping protected grants', () => {
-    expect(categoryActions(catalog, '文档工作').map(item => item.actionId)).toEqual(['document.read', 'document.author'])
-    expect(categoryActions(catalog, '项目与协作').map(item => item.actionId)).toEqual(['project.create'])
-    expect(categoryActions(catalog, '').map(item => item.actionId)).toEqual([])
-  })
-
   it('drops late results and checks explicit system actions', () => {
     expect(shouldAcceptRoleResponse(4, 3)).toBe(false)
     expect(shouldAcceptRoleResponse(4, 4)).toBe(true)
     expect(hasSystemAction(['system.roles.view'], 'system.roles.view')).toBe(true)
-    expect(hasSystemAction(['system.roles.view'], 'system.permissions.manage')).toBe(false)
+    expect(hasSystemAction(['system.roles.view'], 'system.roles.manage')).toBe(false)
   })
+})
 
-  it('writes a matrix cell edit into that role\'s own draft without selecting it first', () => {
-    const first = editRoleDraft({}, roles[0], catalog, 'document.read', stateToValue('project'))
-    const both = editRoleDraft(first, roles[1], catalog, 'document.author', stateToValue('default'))
-    expect(Object.keys(both)).toEqual(['role_engineer', 'role_reviewer'])
-    expect(roleCellValue(both, roles[0], 'document.read')).toEqual({ allowed: false, capAllowed: true })
-    expect(roleCellValue(both, roles[0], 'document.author')).toEqual({ allowed: false, capAllowed: false })
-    expect(both.role_reviewer.role.roleId).toBe('role_reviewer')
-    expect(dirtyRoles(both, editableIds)).toEqual([{ roleId: 'role_engineer', changes: 1 }, { roleId: 'role_reviewer', changes: 1 }])
+describe('R13 门禁', () => {
+  it('可编辑性只看 system.roles.manage，与权限目录系统授权无关', () => {
+    expect(rolePanelAccess({ systemActions: ['system.roles.view', 'system.roles.manage'] })).toEqual({ canView: true, canManage: true })
+    expect(rolePanelAccess({ systemActions: ['system.roles.view', 'system.permissions.view', 'system.permissions.manage'] }))
+      .toEqual({ canView: true, canManage: false })
+    expect(rolePanelAccess({ systemActions: ['system.roles.view'] })).toEqual({ canView: true, canManage: false })
   })
 
-  it('uses a two-state control for project.create and three states for project actions', () => {
-    expect(cellKind(catalog[1])).toBe('toggle')
-    expect(cellKind(catalog[2])).toBe('state')
-    const on = editRoleDraft({}, roles[0], catalog, 'project.create', stateToValue('default'))
-    expect(rolePatchEntries(on, versions(on), editableIds)[0].changes).toEqual([{ actionId: 'project.create', allowed: true, capAllowed: true }])
+  it('isAdmin 不再默认可读可写；缺 me 时全部关闭', () => {
+    const admin = { isAdmin: true, systemActions: [] as string[] }
+    expect(rolePanelAccess(admin)).toEqual({ canView: false, canManage: false })
+    expect(rolePanelAccess(null)).toEqual({ canView: false, canManage: false })
   })
+})
 
-  it('saves every dirty role through one authoritative preview and one batch commit', async () => {
-    let drafts = editRoleDraft({}, roles[0], catalog, 'document.read', stateToValue('default'))
-    drafts = editRoleDraft(drafts, roles[1], catalog, 'project.create', stateToValue('default'))
-    const entries = rolePatchEntries(drafts, versions(drafts), editableIds)
-    const preview = (roleId: string): RolePermissionPreview => ({ roleId, roleName: roleId, expectedRoleVersion: 1, currentRoleVersion: 1,
-      versionMatches: true, changes: [], linkedExpansion: [], keptLinkedActions: [], conflicts: [] })
-    const client = {
-      previewRolePermissions: vi.fn(async () => entries.map(entry => preview(entry.roleId))),
-      batchPatchRolePermissions: vi.fn(async () => ({ receiptId: 'r1', authorityEpoch: 2, receipts: [] })),
-    }
-    const reviewed = await previewRoleBatch(client, entries)
-    expect(reviewed.blocked).toBe(false)
-    await commitRoleBatch(client, entries, reviewed.previews, 'key-1')
-    expect(client.previewRolePermissions).toHaveBeenCalledWith(entries, { mode: 'patch' })
-    expect(client.batchPatchRolePermissions).toHaveBeenCalledTimes(1)
-    expect(client.batchPatchRolePermissions).toHaveBeenCalledWith([
-      { roleId: 'role_engineer', expectedRoleVersion: 1, changes: [{ actionId: 'document.read', allowed: true, capAllowed: true }] },
-      { roleId: 'role_reviewer', expectedRoleVersion: 1, changes: [{ actionId: 'project.create', allowed: true, capAllowed: true }] },
-    ], 'key-1')
+describe('项目访问复选框', () => {
+  it('可管理时呈现单一可勾选控件，aria-label 带角色名', () => {
+    const html = renderToStaticMarkup(createElement(ProjectAccessCheckbox, { roleName: '软件工程师', checked: true, canManage: true, disabled: false, onChange: noop }))
+    expect(html.match(/type="checkbox"/g)).toHaveLength(1)
+    expect(html).toContain('aria-label="软件工程师 项目访问"')
+    expect(html).toContain('checked=""')
+    expect(html).not.toContain('disabled=""')
+    expect(html).not.toContain(PROJECT_ACCESS_MANAGE_REASON)
+  })
+
+  it('无角色管理权限时禁用并说明原因', () => {
+    const html = renderToStaticMarkup(createElement(ProjectAccessCheckbox, { roleName: '审核工程师', checked: false, canManage: false, disabled: false, onChange: noop }))
+    expect(html).toContain('disabled=""')
+    expect(html).toContain(PROJECT_ACCESS_MANAGE_REASON)
+    const matrixCell = renderToStaticMarkup(createElement(ProjectAccessCheckbox, { roleName: '审核工程师', checked: false, canManage: false, disabled: false, showReason: false, onChange: noop }))
+    expect(matrixCell).toContain('disabled=""')
+    expect(matrixCell).not.toContain(PROJECT_ACCESS_MANAGE_REASON)
+  })
 
-    const conflicted = [{ ...preview('role_engineer'), conflicts: [{ actionId: 'document.read', reason: '平台上限不允许' }] }]
-    expect((await previewRoleBatch({ previewRolePermissions: async () => conflicted }, entries)).blocked).toBe(true)
-    await expect(commitRoleBatch(client, entries, conflicted, 'key-2')).rejects.toThrow()
-    expect(client.batchPatchRolePermissions).toHaveBeenCalledTimes(1)
+  it('零裸字段：不暴露动作 ID、默认/上限双控件或原始字段名', () => {
+    const html = renderToStaticMarkup(createElement(ProjectAccessCheckbox, { roleName: '软件工程师', checked: false, canManage: false, disabled: true, onChange: noop }))
+    for (const raw of ['project.create', 'actionId', 'allowed', 'capAllowed', '默认', '上限']) expect(html).not.toContain(raw)
+    expect(html).toContain('项目访问（可创建项目）')
   })
+})
 
-  it('rebases every dirty role on its latest version after a batch conflict', async () => {
-    let drafts = editRoleDraft({}, roles[0], catalog, 'document.read', stateToValue('default'))
-    drafts = editRoleDraft(drafts, roles[1], catalog, 'document.author', stateToValue('project'))
-    const fresh: Record<string, RoleRecord> = {
-      role_engineer: { ...roles[0], roleVersion: 4, permissions: [{ actionId: 'document.author', allowed: true, capAllowed: true, permissionVersion: 2 }] },
-      role_reviewer: { ...roles[1], roleVersion: 9, permissions: [] },
-    }
-    const getRole = vi.fn(async (roleId: string) => fresh[roleId])
-    const rebased = await rebaseRoleDrafts({ getRole }, drafts, ['role_engineer', 'role_reviewer'], catalog)
-    expect(getRole).toHaveBeenCalledTimes(2)
-    expect(rebased.drafts.role_engineer.values['document.read']).toEqual({ allowed: true, capAllowed: true })
-    expect(rebased.drafts.role_engineer.values['document.author']).toEqual({ allowed: true, capAllowed: true })
-    expect(rolePatchEntries(rebased.drafts, versions(rebased.drafts), editableIds)).toEqual([
-      { roleId: 'role_engineer', expectedRoleVersion: 4, changes: [{ actionId: 'document.read', allowed: true, capAllowed: true }] },
-      { roleId: 'role_reviewer', expectedRoleVersion: 9, changes: [{ actionId: 'document.author', allowed: false, capAllowed: true }] },
-    ])
+describe('保存项目访问', () => {
+  it('只提交单布尔补丁，并携带角色版本与幂等键', async () => {
+    const replace = vi.spyOn(api, 'replaceRolePermissions').mockResolvedValue({ receiptId: 'r1', roleVersion: 2, authorityEpoch: 1 })
+    const result = await saveProjectAccess(roles[0], true, 'key-1')
+    expect(result).toEqual({ kind: 'saved' })
+    expect(replace).toHaveBeenCalledTimes(1)
+    expect(replace).toHaveBeenCalledWith('role_engineer', 1, [{ actionId: 'project.create', allowed: true, capAllowed: true }], 'key-1')
   })
+
+  it('值不变时不发请求', async () => {
+    const replace = vi.spyOn(api, 'replaceRolePermissions')
+    expect(await saveProjectAccess(withAccess(roles[0], true), true, 'key-2')).toEqual({ kind: 'unchanged' })
+    expect(replace).not.toHaveBeenCalled()
+  })
+
+  it('409 时读取最新版本，并在新基线上重放本地布尔', async () => {
+    const fresh = withAccess(roles[0], false, 5)
+    const replace = vi.spyOn(api, 'replaceRolePermissions')
+      .mockRejectedValueOnce(new Error('409: role version conflict'))
+      .mockResolvedValueOnce({ receiptId: 'r2', roleVersion: 6, authorityEpoch: 2 })
+    const getRole = vi.spyOn(api, 'getRole').mockResolvedValue(fresh)
+
+    const conflict = await saveProjectAccess(roles[0], true, 'key-3')
+    expect(conflict).toEqual({ kind: 'conflict', fresh })
+    expect(getRole).toHaveBeenCalledWith('role_engineer')
+    expect(projectAccessPatch(fresh, true)).toEqual([{ actionId: 'project.create', allowed: true, capAllowed: true }])
 
-  it('names every dirty role in the leave guard', () => {
-    const message = roleLeaveMessage(['软件工程师', '审核工程师'])
-    expect(message).toContain('「软件工程师」')
-    expect(message).toContain('「审核工程师」')
+    expect(await saveProjectAccess(fresh, true, 'key-4')).toEqual({ kind: 'saved' })
+    expect(replace).toHaveBeenLastCalledWith('role_engineer', 5, [{ actionId: 'project.create', allowed: true, capAllowed: true }], 'key-4')
   })
 
-  it('names the role member entry and member status for assistive technology', () => {
-    expect(roleMembersLabel(roles[0])).toBe('查看角色 软件工程师 的成员')
-    expect(memberStatusLabel({ enabled: true })).toBe('有效')
-    expect(memberStatusLabel({ enabled: false })).toContain('停用')
+  it('409 后最新版本已等于本地值时重放补丁为空', async () => {
+    vi.spyOn(api, 'replaceRolePermissions').mockRejectedValue(new Error('409: role version conflict'))
+    const fresh = withAccess(roles[0], true, 4)
+    vi.spyOn(api, 'getRole').mockResolvedValue(fresh)
+    expect(await saveProjectAccess(roles[0], true, 'key-5')).toEqual({ kind: 'conflict', fresh })
+    expect(projectAccessPatch(fresh, true)).toEqual([])
   })
 
-  it('defaults to single-role focus on narrow screens and to the matrix otherwise', () => {
-    expect(initialRoleView(query => query === NARROW_ROLE_QUERY)).toBe('single')
-    expect(initialRoleView(() => false)).toBe('matrix')
-    expect(initialRoleView()).toBe('matrix')
+  it('非冲突失败原样抛出，不读取最新版本', async () => {
+    vi.spyOn(api, 'replaceRolePermissions').mockRejectedValue(new Error('403: forbidden'))
+    const getRole = vi.spyOn(api, 'getRole')
+    await expect(saveProjectAccess(roles[0], true, 'key-6')).rejects.toThrow('403')
+    expect(getRole).not.toHaveBeenCalled()
   })
 })

test/role-permissions.test.ts

@@ -1,103 +1,35 @@
 import { describe, expect, it } from 'vitest'
-import type { PermissionDescriptor } from '../src/api'
-import {
-  categoryActions, createRolePermissionDraft, dirtyRoles, linkedByProjectCreate, mergeRoleDraft, permissionCategories, rebaseRoleDraft,
-  rolePatchEntries, stateToValue, updateRolePermission, validateRolePermissionDraft, valueToState, visiblePatch,
-  type RolePermissionStateName, type RolePermissionValue,
-} from '../src/rolePermissions'
+import type { RoleRecord, RolePermissionRecord } from '../src/api'
+import { projectAccessOf, projectAccessPatch } from '../src/rolePermissions'
 
-const initial: Record<string, RolePermissionValue> = {
-  'project.create': { allowed: false, capAllowed: true },
-  'document.read': { allowed: true, capAllowed: true },
-  'document.author': { allowed: false, capAllowed: true },
-}
+const role = (permissions: RolePermissionRecord[]): RoleRecord => ({
+  roleId: 'role_engineer', name: '软件工程师', description: '', enabled: true, roleVersion: 3, bindingCount: 0, permissions,
+})
+const row = (allowed: boolean, capAllowed: boolean, actionId = 'project.create'): RolePermissionRecord =>
+  ({ actionId, allowed, capAllowed, permissionVersion: 1 })
 
-describe('role permission draft', () => {
-  it('retains hidden edits and patches only explicit visible actions', () => {
-    let draft = createRolePermissionDraft(initial)
-    draft = updateRolePermission(draft, 'project.create', { allowed: true, capAllowed: true })
-    draft = updateRolePermission(draft, 'document.author', { allowed: true, capAllowed: true })
-
-    expect(visiblePatch(draft, ['project.create'])).toEqual([
-      { actionId: 'project.create', allowed: true, capAllowed: true },
-    ])
-    expect(draft.values['document.author']).toEqual({ allowed: true, capAllowed: true })
+describe('project access normalization', () => {
+  it('requires both default and cap on the project.create row', () => {
+    expect(projectAccessOf(role([row(true, true)]))).toBe(true)
+    expect(projectAccessOf(role([row(false, true)]))).toBe(false)
+    expect(projectAccessOf(role([row(true, false)]))).toBe(false)
   })
 
-  it('produces the same patch for single-role and matrix edits', () => {
-    const single = updateRolePermission(createRolePermissionDraft(initial), 'document.read', { allowed: false, capAllowed: true })
-    const matrix = updateRolePermission(createRolePermissionDraft(initial), 'document.read', { allowed: false, capAllowed: true })
-    expect(visiblePatch(single, Object.keys(initial))).toEqual(visiblePatch(matrix, Object.keys(initial)))
-  })
-
-  it('discards a stale server refresh without replacing newer edits', () => {
-    const edited = updateRolePermission(createRolePermissionDraft(initial), 'project.create', { allowed: true, capAllowed: true })
-    const merged = mergeRoleDraft(edited, initial, edited.generation - 1)
-    expect(merged).toBe(edited)
-  })
-
-  it('rejects defaults that exceed the role cap', () => {
-    const invalid = updateRolePermission(createRolePermissionDraft(initial), 'document.read', { allowed: true, capAllowed: false })
-    expect(validateRolePermissionDraft(invalid)).toEqual({ actionId: 'document.read', reason: 'default-exceeds-cap' })
-  })
-
-  it('rebases local changes on a newer role version without losing the draft', () => {
-    const edited = updateRolePermission(createRolePermissionDraft(initial), 'project.create', { allowed: true, capAllowed: true })
-    const server = { ...initial, 'document.read': { allowed: false, capAllowed: true } }
-    const rebased = rebaseRoleDraft(edited, server)
-    expect(rebased.baseline['document.read']).toEqual({ allowed: false, capAllowed: true })
-    expect(rebased.values['project.create']).toEqual({ allowed: true, capAllowed: true })
-    expect(rebased.values['document.read']).toEqual({ allowed: false, capAllowed: true })
+  it('treats a missing project.create row as no access', () => {
+    expect(projectAccessOf(role([]))).toBe(false)
+    expect(projectAccessOf(role([row(true, true, 'document.read')]))).toBe(false)
   })
 })
 
-const catalog: PermissionDescriptor[] = [
-  { actionId: 'system.roles.view', label: '查看角色', description: '', group: '角色管理', scope: 'system', protected: true },
-  { actionId: 'document.read', label: '读取文档', description: '', group: '文档动作', category: '文档工作', scope: 'project', protected: false },
-  { actionId: 'trace.edit', label: '编辑追溯网', description: '', group: '项目内容', category: '项目内容', scope: 'project', protected: false },
-  { actionId: 'project.create', label: '创建项目', description: '', group: '项目入口', scope: 'system', protected: false },
-  { actionId: 'project.settings', label: '项目设置', description: '', group: '项目管理', category: '项目与协作', scope: 'project', protected: false },
-  { actionId: 'document.author', label: '编制文档', description: '', group: '文档动作', category: '文档工作', scope: 'project', protected: false },
-]
-
-describe('role permission tri-state and categories', () => {
-  it('maps the three display states to stored values and back', () => {
-    expect(stateToValue('denied')).toEqual({ allowed: false, capAllowed: false })
-    expect(stateToValue('project')).toEqual({ allowed: false, capAllowed: true })
-    expect(stateToValue('default')).toEqual({ allowed: true, capAllowed: true })
-    for (const state of ['denied', 'project', 'default'] as RolePermissionStateName[]) expect(valueToState(stateToValue(state))).toBe(state)
-    expect(valueToState(undefined)).toBe('denied')
+describe('project access patch', () => {
+  it('emits a single project.create change with default and cap moving together', () => {
+    expect(projectAccessPatch(role([]), true)).toEqual([{ actionId: 'project.create', allowed: true, capAllowed: true }])
+    expect(projectAccessPatch(role([row(true, true)]), false)).toEqual([{ actionId: 'project.create', allowed: false, capAllowed: false }])
   })
 
-  it('groups actions in the fixed category order and keeps catalog order inside a category', () => {
-    expect(permissionCategories(catalog)).toEqual(['项目与协作', '文档工作', '项目内容'])
-    expect(categoryActions(catalog, '项目与协作').map(item => item.actionId)).toEqual(['project.create', 'project.settings'])
-    expect(categoryActions(catalog, '文档工作').map(item => item.actionId)).toEqual(['document.read', 'document.author'])
-    expect(permissionCategories(catalog).flatMap(category => categoryActions(catalog, category)).some(item => item.protected)).toBe(false)
-  })
-
-  it('counts only roles whose drafts differ from their baseline', () => {
-    const clean = createRolePermissionDraft(initial)
-    const edited = updateRolePermission(updateRolePermission(createRolePermissionDraft(initial), 'document.read', stateToValue('project')),
-      'document.author', stateToValue('default'))
-    const reverted = updateRolePermission(updateRolePermission(createRolePermissionDraft(initial), 'document.read', stateToValue('denied')),
-      'document.read', initial['document.read'])
-    expect(dirtyRoles({ clean, edited, reverted })).toEqual([{ roleId: 'edited', changes: 2 }])
-  })
-
-  it('builds one patch entry per dirty role with only that role\'s changed actions', () => {
-    const a = updateRolePermission(createRolePermissionDraft(initial), 'project.create', { allowed: true, capAllowed: true })
-    const b = updateRolePermission(createRolePermissionDraft(initial), 'document.read', stateToValue('denied'))
-    const entries = rolePatchEntries({ a, b, c: createRolePermissionDraft(initial) }, { a: 3, b: 7, c: 1 }, Object.keys(initial))
-    expect(entries).toEqual([
-      { roleId: 'a', expectedRoleVersion: 3, changes: [{ actionId: 'project.create', allowed: true, capAllowed: true }] },
-      { roleId: 'b', expectedRoleVersion: 7, changes: [{ actionId: 'document.read', allowed: false, capAllowed: false }] },
-    ])
-  })
-
-  it('marks linked actions only while project.create is allowed', () => {
-    expect(linkedByProjectCreate({ 'project.create': { allowed: true, capAllowed: true } }, 'project.settings')).toBe(true)
-    expect(linkedByProjectCreate({ 'project.create': { allowed: true, capAllowed: true } }, 'document.read')).toBe(false)
-    expect(linkedByProjectCreate({ 'project.create': { allowed: false, capAllowed: true } }, 'project.settings')).toBe(false)
+  it('returns an empty patch when the effective value is unchanged', () => {
+    expect(projectAccessPatch(role([row(true, true)]), true)).toEqual([])
+    expect(projectAccessPatch(role([row(false, true)]), false)).toEqual([])
+    expect(projectAccessPatch(role([]), false)).toEqual([])
   })
 })

test/super-admin-ui.test.ts

@@ -0,0 +1,97 @@
+// 超级管理员 UI 门控（计划 2026-10-19-0113 R3/R4/R8）：身份标签可见；建号为管理员与
+// 任命/撤销入口只对超级管理员出现；超级管理员不可降级、停用或被普通管理员维护。
+// 服务端授权仍为权威，这里只锁定前端呈现与请求体。
+import { afterEach, describe, expect, it, vi } from 'vitest'
+import { createElement } from 'react'
+import { renderToStaticMarkup } from 'react-dom/server'
+import { api } from '../src/api'
+import { auth } from '../src/auth'
+import { accountActionPolicy, accountIdentityKind, canAppointAdmins } from '../src/accountAuthority'
+import { AdminAppointmentButton, CreateAdminOption, IdentityChip } from '../src/components/AccountUsersPanel'
+
+afterEach(() => vi.restoreAllMocks())
+
+const superAdmin = { isAdmin: true, isSuperAdmin: true }
+const admin = { isAdmin: true, isSuperAdmin: false }
+const user = { isAdmin: false, isSuperAdmin: false }
+const noop = () => undefined
+
+describe('身份标签', () => {
+  it('超级管理员、管理员与普通用户各有可辨识标签', () => {
+    expect(accountIdentityKind(superAdmin)).toBe('super')
+    expect(accountIdentityKind(admin)).toBe('admin')
+    expect(accountIdentityKind(user)).toBe('user')
+    expect(renderToStaticMarkup(createElement(IdentityChip, { account: superAdmin }))).toContain('超级管理员')
+    expect(renderToStaticMarkup(createElement(IdentityChip, { account: admin }))).toContain('>管理员<')
+    expect(renderToStaticMarkup(createElement(IdentityChip, { account: user }))).toContain('普通用户')
+  })
+  it('isAdmin 不推导超级管理员身份', () => {
+    expect(accountIdentityKind({ isAdmin: true })).toBe('admin')
+  })
+})
+
+describe('管理员任命入口只对超级管理员开放', () => {
+  it('建号：超级管理员看到「创建为管理员账号」，普通管理员只见普通建号说明', () => {
+    expect(canAppointAdmins(superAdmin)).toBe(true)
+    expect(canAppointAdmins(admin)).toBe(false)
+    expect(canAppointAdmins(null)).toBe(false)
+    const superHtml = renderToStaticMarkup(createElement(CreateAdminOption, { me: superAdmin, checked: false, disabled: false, onChange: noop }))
+    expect(superHtml).toContain('type="checkbox"')
+    expect(superHtml).toContain('创建为管理员账号')
+    const adminHtml = renderToStaticMarkup(createElement(CreateAdminOption, { me: admin, checked: false, disabled: false, onChange: noop }))
+    expect(adminHtml).not.toContain('checkbox')
+    expect(adminHtml).toContain('仅超级管理员可创建或任命管理员')
+  })
+  it('任命/撤销：超级管理员可任命普通用户、撤销管理员；普通管理员看不到任何任命按钮', () => {
+    expect(accountActionPolicy(superAdmin, user).adminChange).toBe('promote')
+    expect(accountActionPolicy(superAdmin, admin).adminChange).toBe('demote')
+    expect(renderToStaticMarkup(createElement(AdminAppointmentButton, { me: superAdmin, account: user, busy: false, onChange: noop }))).toContain('设为管理员')
+    expect(renderToStaticMarkup(createElement(AdminAppointmentButton, { me: superAdmin, account: admin, busy: false, onChange: noop }))).toContain('撤销管理员')
+    for (const target of [user, admin, superAdmin]) {
+      expect(accountActionPolicy(admin, target).adminChange).toBeNull()
+      expect(renderToStaticMarkup(createElement(AdminAppointmentButton, { me: admin, account: target, busy: false, onChange: noop }))).toBe('')
+    }
+  })
+})
+
+describe('超级管理员账号受保护', () => {
+  it('超级管理员本人不可被降级或停用，也不走管理员重置密码', () => {
+    const self = accountActionPolicy(superAdmin, superAdmin)
+    expect(self).toMatchObject({ adminChange: null, toggleEnabled: false, resetPassword: false, maintain: true })
+    expect(self.protectedReason).toContain('不能停用、降级')
+    expect(renderToStaticMarkup(createElement(AdminAppointmentButton, { me: superAdmin, account: superAdmin, busy: false, onChange: noop }))).toBe('')
+  })
+  it('普通管理员不能编辑、停用、降级或重置超级管理员，并获得明确说明', () => {
+    const policy = accountActionPolicy(admin, superAdmin)
+    expect(policy).toMatchObject({ maintain: false, toggleEnabled: false, resetPassword: false, adminChange: null })
+    expect(policy.protectedReason).toContain('超级管理员账号受保护')
+  })
+  it('普通账号的既有维护能力不受影响', () => {
+    expect(accountActionPolicy(admin, user)).toMatchObject({ maintain: true, toggleEnabled: true, resetPassword: true, protectedReason: '' })
+  })
+})
+
+describe('账号管理请求体', () => {
+  const stub = (body: unknown) => vi.spyOn(auth, 'fetch').mockImplementation(async () => new Response(JSON.stringify(body)))
+
+  it('adminSetUserAdmin 以乐观版本 PUT /api/admin/users/:userId/admin', async () => {
+    const request = stub({ userId: 'u 1' })
+    await api.adminSetUserAdmin('u 1', 7, true)
+    const [url, options] = request.mock.calls[0]
+    expect(url).toBe('/api/admin/users/u%201/admin')
+    expect(options?.method).toBe('PUT')
+    expect(JSON.parse(String(options?.body))).toEqual({ expectedStateVersion: 7, isAdmin: true })
+  })
+  it('建号只在请求管理员身份时携带 isAdmin', async () => {
+    const request = stub({ userId: 'u1', owner: 'alice' })
+    await api.createManagedUser('alice', { name: 'A' })
+    await api.createManagedUser('bob', {}, true)
+    await api.createAdminUser('carol', 'C')
+    await api.createAdminUser('dave', 'D', undefined, true)
+    const bodies = request.mock.calls.map(call => JSON.parse(String(call[1]?.body)))
+    expect(bodies[0]).toEqual({ owner: 'alice', profile: { name: 'A' } })
+    expect(bodies[1]).toEqual({ owner: 'bob', profile: {}, isAdmin: true })
+    expect(bodies[2]).toEqual({ owner: 'carol', profile: { name: 'C' } })
+    expect(bodies[3]).toEqual({ owner: 'dave', profile: { name: 'D' }, isAdmin: true })
+  })
+})

test/work-state.test.ts

@@ -1,6 +1,6 @@
 import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
 import { api } from '../src/api'
-import { store } from '../src/store'
+import { store, mergeTaskSnapshot } from '../src/store'
 import type { ActivityCard, Conversation, Message, Run, StreamEvent, SurfaceSnapshot } from '../src/contracts'
 
 function deferred<T>() {
@@ -32,6 +32,7 @@ beforeEach(async () => {
   vi.spyOn(api, 'getPlan').mockResolvedValue(null)
   vi.spyOn(api, 'getTodos').mockResolvedValue(null)
   vi.spyOn(api, 'listCards').mockResolvedValue([])
+  vi.spyOn(api,'listCardsSnapshot').mockImplementation(async id=>({cards:await api.listCards(id)}))
   vi.spyOn(api, 'listTasks').mockResolvedValue([])
   vi.spyOn(api, 'listArtifacts').mockResolvedValue([])
   vi.spyOn(api, 'surfaceList').mockResolvedValue([])
@@ -518,3 +519,61 @@ describe('shared action feedback', () => {
     expect(store.getState().cards).toEqual([])
   })
 })
+
+it('keeps a newer task result when an older projection arrives in a later stream event',()=>{
+ const task=(revision:number,executionState:string)=>({...card(),task:{schemaVersion:1,taskId:'t',attemptId:'a1',cardId:'task',projectId:'p',conversationId:'a',ownerInstanceId:'i',executionEpoch:1,revision,sourceSeq:revision,streamScope:'conversation:a',title:'整理',executionState,outcomeCompleteness:'partial',deliveryState:'available',phase:{id:'reading',label:'读取材料'}}}) as ActivityCard
+ store.applyEvent(event(1,'card.created',{card:task(9,'completed')}))
+ store.applyEvent(event(2,'card.updated',{card:task(8,'running')}))
+ expect(store.getState().cards[0].task?.revision).toBe(9)
+ expect(store.getState().cards[0].task?.executionState).toBe('completed')
+})
+it('does not lose an event behind a detected sequence gap',async()=>{
+ vi.mocked(api.listCardsSnapshot).mockResolvedValue({cards:[],replaySeq:0})
+ await store.refreshCards('a')
+ store.applyEvent(event(2,'card.updated',{card:card('later')}))
+ expect(store.getState().lastSeq).toBe(0)
+ store.applyEvent(event(1,'card.created',{card:card('earlier')}))
+ await Promise.resolve()
+ expect(store.getState().cards.map(c=>c.id)).toEqual(['later','earlier'])
+ expect(store.getState().lastSeq).toBe(2)
+})
+
+it('rejects old revisions and foreign attempts in the task merge contract',()=>{
+ expect(mergeTaskSnapshot({taskId:'t',attemptId:'a',revision:9},{taskId:'t',attemptId:'a',revision:8}).revision).toBe(9)
+ expect(mergeTaskSnapshot({taskId:'t',attemptId:'a',revision:9},{taskId:'t',attemptId:'b',revision:10}).attemptId).toBe('a')
+})
+
+it('keeps the newer explicit preview when a source response arrives late',async()=>{
+ const source={id:'s',artifactId:'a',contentHash:'hash',parserRevision:'v1',blockIndex:0,label:'A'}
+ const pending=deferred<Awaited<ReturnType<typeof api.taskSource>>>()
+ vi.spyOn(api,'taskSource').mockReturnValue(pending.promise)
+ const {docBridge}=await import('../src/components/Workbench')
+ const opening=docBridge.onOpenTaskSource!('card',source)
+ store.requestPreview({id:'b',name:'B',kind:'document',projectId:'p',createdAt:'',updatedAt:'',size:0})
+ pending.resolve({artifact:{id:'a',name:'A',kind:'document',projectId:'p',createdAt:'',updatedAt:'',size:0},source,versionState:'current'})
+ await opening
+ expect(store.getState().previewActive.a).toBe('b')
+})
+
+it('rejects a source response after leaving and returning to the same conversation',async()=>{
+ const source={id:'s',artifactId:'a',contentHash:'hash',parserRevision:'v1',blockIndex:0,label:'A'}
+ const pending=deferred<Awaited<ReturnType<typeof api.taskSource>>>()
+ vi.spyOn(api,'taskSource').mockReturnValue(pending.promise)
+ const opening=store.openTaskSource('card',source)
+ await store.openConversation('b');await store.openConversation('a')
+ store.requestPreview({id:'new',name:'New',kind:'document',projectId:'p',createdAt:'',updatedAt:'',size:0})
+ pending.resolve({artifact:{id:'a',name:'A',kind:'document',projectId:'p',createdAt:'',updatedAt:'',size:0},source,versionState:'current'})
+ await opening
+ expect(store.getState().previewActive.a).toBe('new')
+})
+it('keeps the activated tab when a source request is still pending',async()=>{
+ store.requestPreview({id:'b',name:'B',kind:'document',projectId:'p',createdAt:'',updatedAt:'',size:0})
+ store.requestPreview({id:'c',name:'C',kind:'document',projectId:'p',createdAt:'',updatedAt:'',size:0})
+ const source={id:'s',artifactId:'a',contentHash:'hash',parserRevision:'v1',blockIndex:0,label:'A'}
+ const pending=deferred<Awaited<ReturnType<typeof api.taskSource>>>()
+ vi.spyOn(api,'taskSource').mockReturnValue(pending.promise)
+ const opening=store.openTaskSource('card',source);store.activatePreview('b')
+ pending.resolve({artifact:{id:'a',name:'A',kind:'document',projectId:'p',createdAt:'',updatedAt:'',size:0},source,versionState:'current'})
+ await opening
+ expect(store.getState().previewActive.a).toBe('b')
+})