Merge the upstream member command rename

Why: Current main carries the same corrected lowercase command ID as this member candidate. Evidence: Preserve the canonical wrapper and set-role ID; compare the final tree against the independently tested 2ba275b object. Impact: Update ancestry only; no intended product behavior change. Refs: Frontend PR83; project-member-access
Merge pull request 'Rename member setRole command call to set-role' (#83 ) from fix/set-role-rename into main
2026-10-13 11:35:36 +00:00 · 2026-10-13 11:03:41 +00:00 · 2026-10-13 11:03:27 +00:00 · 2026-10-13 10:50:36 +00:00 · 2026-10-13 10:21:37 +00:00 · 2026-10-13 10:02:54 +00:00
12 changed files with 923 additions and 119 deletions
@@ -0,0 +1,160 @@
+// Real React/Picker interaction with deterministic HTTP responses; no live account or database.
+import { test, expect, type Page } from '@playwright/test'
+
+test.skip(!process.env.PLAYWRIGHT_BASE_URL, 'set PLAYWRIGHT_BASE_URL to an isolated frontend server')
+
+function deferred() {
+  let resolve!: () => void
+  const promise = new Promise<void>(ok => { resolve = ok })
+  return { promise, resolve }
+}
+
+async function dutiesPage(page: Page) {
+  const writes: { command: string; params: Record<string, unknown> }[] = []
+  const calls: { command: string; params: Record<string, unknown> }[] = []
+  const holds = new Map<string, { started: ReturnType<typeof deferred>; release: ReturnType<typeof deferred> }>()
+  const active = new Set<string>()
+  const submissions: Record<string, unknown> = { 'doc-A': null, 'doc-B': null }
+  const commands = ['rdm.project.member.list', 'rdm.project.member.add', 'rdm.project.member.remove',
+    'rdm.duty.catalog', 'rdm.duty.get', 'rdm.review.assign.doc', 'rdm.review.assign.doc.batch',
+    'rdm.review.doc.submit', 'rdm.review.doc.approve', 'rdm.review.doc.reject', 'rdm.review.doc.final', 'rdm.review.doc.status']
+  const docs = [
+    { docId: 'doc-A', title: '文档A', typeKey: 'design', sections: 1, assigned: true, author: 'alice', reviewers: ['carol'], approver: 'dave' },
+    { docId: 'doc-B', title: '文档B', typeKey: 'design', sections: 1, assigned: true, author: 'bob', reviewers: ['carol'], approver: 'dave' },
+  ]
+  await page.route('**/api/**', async route => {
+    const request = route.request()
+    const path = new URL(request.url()).pathname
+    let body: unknown = []
+    if (path === '/api/health') body = { ok: true }
+    else if (path === '/api/me') body = { owner: 'alice', name: 'Alice', auth: true, isAdmin: true }
+    else if (path === '/api/projects') body = [{ id: 'host-1', name: '职责测试项目', createdAt: '', updatedAt: '',
+      settings: { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready' } }]
+    else if (path === '/api/settings') body = { schema: [], defaults: {}, user: {}, project: {} }
+    else if (path === '/api/commands') body = commands.map(id => ({ id, enabled: true }))
+    else if (path.startsWith('/api/commands/')) {
+      const command = decodeURIComponent(path.substring('/api/commands/'.length))
+      const params = request.postDataJSON().params as Record<string, unknown>
+      expect(params.projectId).toBe('domain-7')
+      calls.push({ command, params })
+      const hold = holds.get(`${command}:${params.docId ?? ''}`)
+      if (hold) { hold.started.resolve(); await hold.release.promise }
+      let payload: unknown = {}
+      if (command === 'rdm.duty.catalog') payload = { docs }
+      else if (command === 'rdm.project.member.list') payload = { members: ['alice', 'bob', 'carol', 'dave'].map(owner => ({ owner, role: 'member', addedBy: '', addedAt: '' })) }
+      else if (command === 'rdm.duty.get') {
+        const doc = docs.find(d => d.docId === params.docId)!
+        payload = { docId: doc.docId, title: doc.title, assigned: doc.assigned,
+          roles: { author: doc.author, reviewers: doc.reviewers, approver: doc.approver }, sections: [],
+          active: active.has(doc.docId) ? { round: 1, state: 'submitted', createdBy: 'alice' } : null }
+      } else if (command === 'rdm.review.doc.status') payload = { submission: submissions[String(params.docId)] }
+      else { writes.push({ command, params }) }
+      body = { payload }
+    } else if (path.endsWith('/cards')) body = { cards: [] }
+    await route.fulfill({ contentType: 'application/json', body: JSON.stringify(body) })
+  })
+  await page.goto('/')
+  await page.getByRole('button', { name: '项目设置', exact: true }).click()
+  await page.getByRole('tab', { name: /文档职责/ }).click()
+  await expect(page.getByRole('button', { name: '文档A', exact: true })).toBeVisible()
+  return { writes, calls, active, submissions,
+    hold(command: string, docId: string) {
+      const pending = { started: deferred(), release: deferred() }
+      holds.set(`${command}:${docId}`, pending)
+      return pending
+    } }
+}
+
+async function chooseMember(page: Page, label: string, owner: string) {
+  await page.locator(`.picker[aria-label="${label}"]`).getByRole('combobox').fill(owner)
+  await page.getByRole('option', { name: new RegExp(`^${owner}`) }).click()
+}
+
+async function settleResponse(page: Page, command: string, release: () => void) {
+  const response = page.waitForResponse(r => r.url().endsWith(`/api/commands/${command}`))
+  release()
+  await response
+  await page.evaluate(() => new Promise<void>(done => requestAnimationFrame(() => requestAnimationFrame(() => done()))))
+}
+
+test('a newly assigned document can submit its first whole-document review', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await expect(page.getByText('该文档尚无整文提交记录（当前职责仍可分配）。', { exact: true })).toBeVisible()
+  const submit = page.getByRole('button', { name: '整文提交（编制人）', exact: true })
+  await expect(submit).toBeEnabled()
+  await submit.click()
+  await expect(page.getByText('整文已提交审核（全文锁定）', { exact: true })).toBeVisible()
+  expect(fixture.writes).toEqual([{ command: 'rdm.review.doc.submit', params: { projectId: 'domain-7', docId: 'doc-A' } }])
+})
+
+test('viewing active duties is passive; only a dirty save asks for confirmation', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  fixture.active.add('doc-A')
+  const dialogs: string[] = []
+  let accept = false
+  page.on('dialog', async dialog => { dialogs.push(dialog.message()); accept ? await dialog.accept() : await dialog.dismiss() })
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await expect(page.getByRole('heading', { name: /文档A · 当前职责/ })).toBeVisible()
+  const save = page.getByRole('button', { name: '保存当前职责', exact: true })
+  await expect(save).toBeDisabled()
+  expect(dialogs).toEqual([])
+  await chooseMember(page, '编制人', 'bob')
+  await expect(save).toBeEnabled()
+  expect(dialogs).toEqual([])
+  await save.click()
+  expect(dialogs).toHaveLength(1)
+  expect(fixture.writes).toEqual([])
+  accept = true
+  await save.click()
+  await expect(page.getByText('已保存当前职责', { exact: true })).toBeVisible()
+  expect(dialogs).toHaveLength(2)
+  expect(fixture.writes).toEqual([{ command: 'rdm.review.assign.doc', params: {
+    projectId: 'domain-7', docId: 'doc-A', author: 'bob', reviewers: ['carol'], approver: 'dave',
+  } }])
+})
+
+test('a late document detail cannot overwrite another selection or its saved roles', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  const old = fixture.hold('rdm.duty.get', 'doc-A')
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await old.started.promise
+  await page.getByRole('button', { name: '文档B', exact: true }).click()
+  await expect(page.getByRole('heading', { name: '文档B · 当前职责', exact: true })).toBeVisible()
+  await settleResponse(page, 'rdm.duty.get', old.release.resolve)
+  await expect(page.getByRole('heading', { name: '文档B · 当前职责', exact: true })).toBeVisible()
+  expect(fixture.calls.filter(c => c.command === 'rdm.review.doc.status' && c.params.docId === 'doc-A')).toEqual([])
+  await chooseMember(page, '批准人', 'alice')
+  await page.getByRole('button', { name: '保存当前职责', exact: true }).click()
+  await expect(page.getByText('已保存当前职责', { exact: true })).toBeVisible()
+  expect(fixture.writes).toEqual([{ command: 'rdm.review.assign.doc', params: {
+    projectId: 'domain-7', docId: 'doc-B', author: 'bob', reviewers: ['carol'], approver: 'alice',
+  } }])
+})
+
+test('a late review status cannot replace the selected document frozen review', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  const submission = (round: number, author: string) => ({ round, state: 'submitted', digest: '', createdBy: author,
+    createdAt: '', duties: { author, reviewers: ['carol'], approver: 'dave' }, reviews: {}, sections: {} })
+  fixture.submissions['doc-A'] = submission(1, 'alice')
+  fixture.submissions['doc-B'] = submission(2, 'bob')
+  const old = fixture.hold('rdm.review.doc.status', 'doc-A')
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await old.started.promise
+  await page.getByRole('button', { name: '文档B', exact: true }).click()
+  await expect(page.getByRole('heading', { name: /整文审签 · 第 2 轮/ })).toBeVisible()
+  await settleResponse(page, 'rdm.review.doc.status', old.release.resolve)
+  await expect(page.getByRole('heading', { name: /整文审签 · 第 2 轮/ })).toBeVisible()
+  await expect(page.getByRole('heading', { name: /整文审签 · 第 1 轮/ })).toHaveCount(0)
+})
+
+test('closing the project panel invalidates a pending detail before its follow-up status read', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  const old = fixture.hold('rdm.duty.get', 'doc-A')
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await old.started.promise
+  await page.getByRole('dialog').getByRole('button', { name: '关闭', exact: true }).click()
+  await expect(page.getByRole('tab', { name: /文档职责/ })).toHaveCount(0)
+  await settleResponse(page, 'rdm.duty.get', old.release.resolve)
+  expect(fixture.calls.filter(c => c.command === 'rdm.review.doc.status' && c.params.docId === 'doc-A')).toEqual([])
+})
@@ -77,7 +77,7 @@ export function App() {
    const h = (e: KeyboardEvent) => {
      if (authState === 'ok' && (e.metaKey || e.ctrlKey)) {
        const key = e.key.toLowerCase()
-        if (key === 'n') { e.preventDefault(); store.createTask().then(conversationOpened); return }
+        if (key === 'n') { e.preventDefault(); store.createTask().then(conversationOpened).catch(() => undefined); return }
        if (key === 'b') { e.preventDefault(); openContext(); return }
      }
      workspaceShortcuts(e)
@@ -114,10 +114,14 @@ export function App() {
    // me 回填进 store：管理入口（me?.isAdmin）与侧栏身份都消费它；此前只有
    // 改密门 onDone 调 refreshMe，登录与刷新回态后 me 恒为 null，管理员菜单
    // 在任何一次 F5 后永久消失（2026-10-12「用户管理页面不可用」根因）。
-    store.refreshMe()
-    store.refreshProjects()
-    store.refreshProfiles()
-    store.refreshPlugins()
+    let active = true
+    store.refreshMe().then(() => {
+      if (!active) return
+      void store.refreshProjects()
+      void store.refreshProfiles()
+      void store.refreshPlugins()
+    })
+    return () => { active = false }
  }, [authState])

  const drag = useRef<{ side: 'left' | 'right'; startX: number; startW: number; overshoot: boolean; min: number; max: number; key: 'leftWidth' | 'rightWidth' | 'previewWidth' } | null>(null)
@@ -1,6 +1,7 @@
 // API 客户端（API-first：UI 只是第一个客户端）与 SSE 流客户端（游标重放 + 终态对账）。
 // 认证：服务端开启 API key 时经 auth.fetch/withKey 注入凭证（嵌入式档无认证则透传）。
 import { auth } from './auth'
+import { rdmCommandProjectId, rdmProjectCommandError } from './rdmManagement'
 import type {
  Project, Conversation, Message, Run, Artifact, HITLCard, HITLResponse,
  AgentProfile, SettingDesc, StreamEvent, StreamEventType, PlanSnapshot, TodoList, UploadInfo, PromptModule,
@@ -14,11 +15,16 @@ const BASE = ''
 *  自身命令面 fail-closed。 */
 export interface AdminZoneSection { id: string; title: string; icon?: string; desc?: string; order?: number }

-async function json<T>(res: Response): Promise<T> {
+async function checked(res: Response): Promise<Response> {
  if (!res.ok) {
    const text = await res.text()
    throw new Error(`${res.status}: ${text}`)
  }
+  return res
+}
+
+async function json<T>(res: Response): Promise<T> {
+  await checked(res)
  return res.json() as Promise<T>
 }

@@ -26,7 +32,7 @@ export const api = {
  listProjects: () => auth.fetch(`${BASE}/api/projects`).then(r => json<Project[]>(r)),
  createProject: (name: string) => auth.fetch(`${BASE}/api/projects`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name }) }).then(r => json<Project>(r)),
  renameProject: (id: string, name: string) => auth.fetch(`${BASE}/api/projects/${id}`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name }) }).then(r => json<Project>(r)),
-  deleteProject: (id: string) => auth.fetch(`${BASE}/api/projects/${id}`, { method: 'DELETE' }),
+  deleteProject: (id: string) => auth.fetch(`${BASE}/api/projects/${id}`, { method: 'DELETE' }).then(checked),

  listConversations: (projectId: string) => auth.fetch(`${BASE}/api/projects/${projectId}/conversations`).then(r => json<Conversation[]>(r)),
  // 跨项目任务列表（方案 A 侧栏）：默认仅未归档；includeArchived 含归档。
@@ -46,15 +52,23 @@ export const api = {
  // ---- 认证与会话（管理员发放制，R2）----
  login: (owner: string, password: string) => auth.fetch(`${BASE}/api/auth/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, password }) }).then(async r => {
    if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
-    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }>
+    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }
+    auth.beginSession()
+    return me
  }),
  // 一次性登录 Key 兑换（恢复/激活）：请求只带 Key，身份由服务端绑定记录决定；
  // 成功建立 set_password_only 受限会话（HttpOnly cookie），明文 Key 不落任何存储。
  redeemLoginKey: (key: string) => auth.fetch(`${BASE}/api/auth/login-key/redeem`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ key }) }).then(async r => {
    if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
-    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }>
+    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }
+    auth.beginSession()
+    return me
  }),
-  logout: () => auth.fetch(`${BASE}/api/auth/logout`, { method: 'POST' }),
+  logout: () => {
+    const request = auth.fetch(`${BASE}/api/auth/logout`, { method: 'POST' })
+    auth.clear()
+    return request
+  },
  changePassword: (current: string, next: string) => auth.fetch(`${BASE}/api/auth/password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ current, next }) }).then(async r => {
    if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; reloginRequired: boolean }>
@@ -125,7 +139,7 @@ export const api = {
  getSettings: (projectId?: string) => auth.fetch(`${BASE}/api/settings${projectId ? '?project=' + projectId : ''}`).then(r =>
    json<{ schema: SettingDesc[]; defaults: Record<string, unknown>; user: Record<string, unknown>; project: Record<string, unknown> }>(r)),
  putUserSettings: (values: Record<string, unknown>) => auth.fetch(`${BASE}/api/settings/user`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(values) }),
-  putProjectSettings: (projectId: string, values: Record<string, unknown>) => auth.fetch(`${BASE}/api/settings/project/${projectId}`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(values) }),
+  putProjectSettings: (projectId: string, values: Record<string, unknown>) => auth.fetch(`${BASE}/api/settings/project/${projectId}`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(values) }).then(checked),
  // P2 系统管理面：受管项（models/tavily/telemetry/运行基础设施）的唯一写入面。
  getSystemSettings: () => auth.fetch(`${BASE}/api/settings/system`).then(r =>
    json<{ schema: SettingDesc[]; defaults: Record<string, unknown>; system: Record<string, unknown> }>(r)),
@@ -154,6 +168,11 @@ export const api = {

  // ---- U4：RDM 命令总线封装（POST /api/commands/{id}，同 RDM web 的 command 路由） ----
  // receipt 解包：rejected 抛错；confirm-card 抛提示（审计面只读命令不应触发）。
+  rdmProjectCommand: async <T = any>(project: Project, id: string, params: Record<string, unknown> = {}): Promise<T> => {
+    const error = rdmProjectCommandError(project, id)
+    if (error) throw new Error(error)
+    return api.rdmCommand<T>(id, { ...params, projectId: rdmCommandProjectId(project) })
+  },
  rdmCommand: <T = any>(id: string, params: Record<string, unknown> = {}): Promise<T> =>
    auth.fetch(`${BASE}/api/commands/${encodeURIComponent(id)}`, {
      method: 'POST', headers: { 'Content-Type': 'application/json' },
@@ -17,11 +17,22 @@ function pickStorage(): KV {
 }

 const storage = pickStorage()
+const identityListeners = new Set<() => void>()
+function identityChanged() { identityListeners.forEach(listener => listener()) }

 export const auth = {
  apiKey(): string { return storage.getItem(KEY) ?? '' },
-  setKey(key: string) { storage.setItem(KEY, key.trim()) },
-  clear() { storage.removeItem(KEY) },
+  setKey(key: string) {
+    const next = key.trim()
+    if (next === this.apiKey()) return
+    storage.setItem(KEY, next)
+    identityChanged()
+  },
+  clear() { storage.removeItem(KEY); identityChanged() },
+  onIdentityChange(listener: () => void) {
+    identityListeners.add(listener)
+    return () => { identityListeners.delete(listener) }
+  },
  // 密码登录成功后切换到 HttpOnly 会话 cookie：必须清掉残留 Bearer——服务端
  // 认证中间件 Bearer 优先于会话 cookie，失效残留 key 会把有效会话也判成 401。
  beginSession() { this.clear() },
@@ -33,7 +44,7 @@ export const auth = {
    headers.set('Authorization', `Bearer ${key}`)
    return fetch(input, { ...init, headers })
  },
-  // 退出登录：清凭证并整页回登录门（服务端会话/密钥均为无状态凭证，无需服务端注销）。
+  // 退出登录：立即清客户端投影并回登录门；调用者先经 api.logout 注销服务端会话。
  logout() {
    this.clear()
    try { location.reload() } catch { /* 非 DOM 环境（测试）忽略 */ }
@@ -2,7 +2,6 @@
 // LoginPage —— 用户名+密码（默认入口）/ 一次性登录 Key（忘记密码恢复，只输 Key）；
 // ChangePasswordGate —— 受限会话强制设密（恢复/首登同形：只输新密码，完成前不放行）。
 import { useState } from 'react'
-import { auth } from '../auth'
 import { api } from '../api'
 import { Icon, BrandMark } from '@ui'

@@ -43,8 +42,6 @@ export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; on
    setErr(''); setBusy(true)
    try {
      const me = await api.login(owner.trim(), password)
-      // 会话凭证是 HttpOnly cookie；清残留 Bearer，避免其遮蔽有效会话。
-      auth.beginSession()
      // 受限会话（must-change 首登）或正常会话都由后端 sessionScope 声明；
      // 受限会话先进设密门，完成前不放行。
      if (me.sessionScope === 'set_password_only' || me.mustChangePassword) {
@@ -62,7 +59,6 @@ export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; on
    try {
      // 只提交 Key：目标账户由服务端绑定记录确定，客户端不能指定身份。
      const me = await api.redeemLoginKey(key.trim())
-      auth.beginSession()
      if (me.sessionScope === 'set_password_only' || me.mustChangePassword) {
        onMustChange(me.owner)
        return
@@ -8,6 +8,8 @@ import type { SettingDesc } from '../contracts'
 import { SettingsShell, Btn, EmptyState } from '@ui'
 import { SettingInput, flatten, unflatten, groupNames } from './SettingsModal'
 import { RdmMembersSection, RdmDutiesSection, RdmPermMatrixSection } from './adminRdmSections'
+import { rdmProjectReadError } from '../rdmManagement'
+import { projectActionError, projectWorkError } from '../projectmeta'

 export function ProjectSettingsModal() {
  const projectId = useStore(s => s.ui.projectSettingsId)
@@ -16,21 +18,26 @@ export function ProjectSettingsModal() {
  const rdmMembersAvailable = useStore(s => s.rdmMembersAvailable)
  const rdmDocReviewAvailable = useStore(s => s.rdmDocReviewAvailable)
  const rdmPermMatrixAvailable = useStore(s => s.rdmPermMatrixAvailable)
+  const owner = useStore(s => s.me?.owner)
  const [tab, setTab] = useState('project')
  const [schema, setSchema] = useState<SettingDesc[]>([])
  const [draft, setDraft] = useState<Record<string, any>>({})
  const [loaded, setLoaded] = useState(false)
  const [saved, setSaved] = useState(false)
+  const [error, setError] = useState('')

  useEffect(() => {
    if (!projectId) return
-    setLoaded(false)
+    let active = true
+    setLoaded(false); setSaved(false); setError(''); setDraft({}); setSchema([])
    api.getSettings(projectId).then(s => {
+      if (!active) return
      setSchema(s.schema)
      setDraft(flatten(s.project))
      setLoaded(true)
-    }).catch(() => undefined)
-  }, [projectId])
+    }).catch(() => { if (active) setError('项目设置未能加载，请关闭后重新打开或联系项目负责人') })
+    return () => { active = false }
+  }, [projectId, owner])

  const groups = useMemo(() => {
    const g: Record<string, SettingDesc[]> = {}
@@ -39,15 +46,19 @@ export function ProjectSettingsModal() {
  }, [schema])

  if (!projectId) return null
+  const rdmError = rdmProjectReadError(project)
+  const writeError = projectWorkError(project)
+  const rdmTab = tab === 'members' || tab === 'duties' || tab === 'matrix'

  const save = async () => {
    if (!projectId) return
+    if (writeError) { store.toast(writeError); return }
    try {
      await api.putProjectSettings(projectId, unflatten(draft))
      setSaved(true)
      setTimeout(() => setSaved(false), 1500)
    } catch (e) {
-      store.toast(`项目设置保存失败：${e}`)
+      store.toast(`项目设置保存失败：${projectActionError(e)}`)
    }
  }

@@ -64,18 +75,20 @@ export function ProjectSettingsModal() {
        ...(rdmDocReviewAvailable ? [{ key: 'duties', label: '文档职责 · 整文审签', icon: 'shield' as const }] : []),
        ...(rdmPermMatrixAvailable ? [{ key: 'matrix', label: '项目权限', icon: 'key' as const }] : []),
      ]}
-      footer={saved ? <span style={{ color: 'var(--ok)' }}>✓ 已保存</span> : '项目设置覆盖用户设置（new-run 类对新任务生效）'}
+      footer={saved ? <span style={{ color: 'var(--ok-text)' }}>✓ 已保存</span> : '项目设置覆盖用户设置（new-run 类对新任务生效）'}
    >
      <div>
-        {tab === 'members' && <RdmMembersSection projectId={projectId} />}
-        {tab === 'duties' && <RdmDutiesSection projectId={projectId} />}
-        {tab === 'matrix' && <RdmPermMatrixSection projectId={projectId} />}
+        {rdmTab && rdmError ? <EmptyState icon="folder">{rdmError}</EmptyState> : project && <>
+          {tab === 'members' && <RdmMembersSection key={project.id} project={project} />}
+          {tab === 'duties' && <RdmDutiesSection key={project.id} project={project} />}
+          {tab === 'matrix' && <RdmPermMatrixSection key={project.id} project={project} />}
+        </>}
        {tab !== 'members' && tab !== 'duties' && tab !== 'matrix' && !loaded ? (
-          <EmptyState icon="settings">加载中…</EmptyState>
+          <EmptyState icon="settings">{error || '加载中…'}</EmptyState>
        ) : tab !== 'members' && tab !== 'duties' && tab !== 'matrix' ? (
          <>
            <div className="empty-note" style={{ marginBottom: 10 }}>
-              此处仅保存本项目的覆盖值；留空即沿用用户/系统设置。跨会话读取在「会话协作」组。
+              {writeError ?? '此处仅保存本项目的覆盖值；留空即沿用用户/系统设置。跨会话读取在「会话协作」组。'}
            </div>
            {Object.entries(groups).map(([g, descs]) => (
              <div className="settings-group" key={g}>
@@ -91,7 +104,7 @@ export function ProjectSettingsModal() {
                ))}
              </div>
            ))}
-            <Btn variant="primary" icon="check" onClick={save}>保存项目设置</Btn>
+            <Btn variant="primary" icon="check" disabled={!!writeError} onClick={save}>保存项目设置</Btn>
          </>
        ) : null}
      </div>
@@ -7,7 +7,7 @@ import { api } from '../api'
 import { Icon } from '@ui'
 import type { Conversation } from '../contracts'
 import { relativeTime, filterTasks } from '../tasklist'
-import { projectStage } from '../projectmeta'
+import { projectStage, projectStateLabel, projectWorkError } from '../projectmeta'
 import { buildWorkspaceEntries } from '../workspaces'

 /** 小型弹出菜单：锚点下方渲染，点击外部关闭。 */
@@ -68,8 +68,10 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
  const [newProjectName, setNewProjectName] = useState('')

  const createConversation = async (projectId?: string) => {
-    await store.createTask(projectId)
-    onConversationOpen?.()
+    try {
+      await store.createTask(projectId)
+      onConversationOpen?.()
+    } catch { /* store owns the actionable failure toast */ }
  }

  const tools = buildWorkspaceEntries(serverWorkspaces, { rdmAudit: rdmAuditAvailable })
@@ -77,7 +79,8 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
  const pinned = visible.filter(t => t.pinned)
  const rest = visible.filter(t => !t.pinned)
  const currentProject = projects.find(p => p.id === currentProjectId)
-  const stage = projectStage(currentProject?.settings)
+  const stage = projectStateLabel(currentProject?.settings) ?? projectStage(currentProject?.settings)
+  const workError = currentProject ? projectWorkError(currentProject) : null
  const rowTask = menu?.kind.startsWith('row:') ? tasks.find(t => t.id === menu.kind.slice(4)) : null
  const rowMenuAnchor = menu && menu.kind.startsWith('row:') ? menu.anchor : null

@@ -162,8 +165,10 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
              onChange={e => setNewProjectName(e.target.value)}
              onKeyDown={async e => {
                if (e.key === 'Enter' && newProjectName.trim()) {
-                  await store.createProject(newProjectName.trim())
-                  setCreatingProject(false); setNewProjectName('')
+                  try {
+                    await store.createProject(newProjectName.trim())
+                    setCreatingProject(false); setNewProjectName('')
+                  } catch { /* keep the input available for a corrected name */ }
                }
                if (e.key === 'Escape') setCreatingProject(false)
              }}
@@ -179,7 +184,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
        )}

        {rest.length === 0 && pinned.length === 0 && (
-          <div className="tsb-empty">从「新建对话」开始，描述你想完成的工作。</div>
+          <div className="tsb-empty">{workError ?? '从「新建对话」开始，描述你想完成的工作。'}</div>
        )}
        {rest.map(t => taskRow(t))}
      </div>
@@ -224,7 +229,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
      <Menu anchor={menu?.kind === 'project' ? menu.anchor : null} onClose={() => setMenu(null)}>
        {projects.map(p => {
          const count = tasks.filter(t => t.projectId === p.id && !t.archived).length
-          const pstage = projectStage(p.settings)
+          const pstage = projectStateLabel(p.settings) ?? projectStage(p.settings)
          return (
            <MenuItem key={p.id} icon="folder" onClick={() => { switchProject(p.id); setMenu(null) }}>
              {p.name}
@@ -5,6 +5,8 @@
 // 既有 ad-*/lg-*/settings-* 类（design-guard 棘轮：不新增裸色值/字号）。
 import { useEffect, useState, useRef, useCallback } from 'react'
 import { api } from '../api'
+import type { Project } from '../contracts'
+import { projectWorkError } from '../projectmeta'
 import { useStore } from '../store'
 import { Btn, Collapsible, EmptyState, Icon, Picker } from '@ui'
 import {
@@ -151,7 +153,10 @@ interface MemberRow {
  profRole?: { roleId: string; name: string } | null
 }

-export function RdmMembersSection({ projectId }: { projectId: string }) {
+export function RdmMembersSection({ project }: { project: Project }) {
+  const projectId = project.id
+  const writeError = projectWorkError(project)
+  const cmd = <T,>(id: string, params: Record<string, unknown> = {}) => api.rdmProjectCommand<T>(project, id, params)
  const [rows, setRows] = useState<MemberRow[] | null>(null)
  const [err, setErr] = useState('')
  const [notice, setNotice] = useState('')
@@ -166,7 +171,7 @@ export function RdmMembersSection({ projectId }: { projectId: string }) {
   * query 透传后端（基座升级 AccountSearcher 后全量生效）；旧基座忽略 query 时
   * 对首页做本地包含匹配降级（翻页为浏览模式，不过滤）。 */
  const fetchPage = useCallback(async (query: string, cursor: string, limit: number) => {
-    const out = await api.rdmCommand<{ accounts?: { owner: string; name?: string; valid: boolean }[]; next?: string }>(
+    const out = await cmd<{ accounts?: { owner: string; name?: string; valid: boolean }[]; next?: string }>(
      'rdm.account.list', { projectId, cursor, limit, query })
    const joined = new Set((rowsRef.current ?? []).map(m => m.owner))
    let items = (out.accounts ?? []).filter(a => a.valid).map(a => ({
@@ -180,15 +185,15 @@ export function RdmMembersSection({ projectId }: { projectId: string }) {
      items = items.filter(it => it.id.toLowerCase().includes(q) || it.title.toLowerCase().includes(q))
    }
    return { items, nextCursor: out.next || undefined }
-  }, [projectId])
+  }, [project])

  const refresh = async () => {
    try {
-      const out = await api.rdmCommand<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
+      const out = await cmd<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
      setRows(out.members ?? [])
    } catch (e) { setErr(String(e)) }
  }
-  useEffect(() => { setPicked([]); refresh() }, [projectId])
+  useEffect(() => { setPicked([]); refresh() }, [project])

  const run = async (label: string, fn: () => Promise<unknown>) => {
    setErr(''); setNotice(''); setBusy(true)
@@ -200,6 +205,7 @@ export function RdmMembersSection({ projectId }: { projectId: string }) {

  return (
    <div>
+      {writeError && <p className="ad-hint">{writeError}</p>}
      <div className="ad-create">
        <div className="ad-row">
          <Picker
@@ -213,9 +219,9 @@ export function RdmMembersSection({ projectId }: { projectId: string }) {
            <option value="member">项目成员</option>
            <option value="owner">项目负责人</option>
          </select>
-          <button className="lg-submit ad-create-btn" disabled={busy || !pickedId}
+          <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || !pickedId}
            onClick={() => run(`已添加 ${pickedId}`, async () => {
-              await api.rdmCommand('rdm.project.member.add', memberAddPayload(projectId, pickedId, role))
+              await cmd('rdm.project.member.add', memberAddPayload(projectId, pickedId, role))
              setPicked([])
            })}>添加成员</button>
        </div>
@@ -232,15 +238,15 @@ export function RdmMembersSection({ projectId }: { projectId: string }) {
              <td className="ad-dim">{m.addedBy || '—'}</td>
              <td className="ad-dim">{m.addedAt ? new Date(m.addedAt).toLocaleString() : '—'}</td>
              <td>
-                <button className="ad-mini" disabled={busy}
+                <button className="ad-mini" disabled={busy || !!writeError}
                  title={m.role === 'owner' ? '降为项目成员（setRole）' : '升为项目负责人（setRole）'}
                  onClick={() => run(`已调整 ${m.owner} 的项目身份`, () =>
-                    api.rdmCommand('rdm.project.member.setRole', memberSetRolePayload(projectId, m.owner, m.role === 'owner' ? 'member' : 'owner')))}>
+                    cmd('rdm.project.member.set-role', memberSetRolePayload(projectId, m.owner, m.role === 'owner' ? 'member' : 'owner')))}>
                  {m.role === 'owner' ? '降为成员' : '升为负责人'}
                </button>{' '}
-                <button className="ad-mini" disabled={busy}
+                <button className="ad-mini" disabled={busy || !!writeError}
                  onClick={() => run(`已移除 ${m.owner}`,
-                    () => api.rdmCommand('rdm.project.member.remove', memberRemovePayload(projectId, m.owner)))}>移除</button>
+                    () => cmd('rdm.project.member.remove', memberRemovePayload(projectId, m.owner)))}>移除</button>
              </td>
            </tr>
          ))}
@@ -296,7 +302,9 @@ function useMemberPickerPage(members: { owner: string; role: string }[] | null)
  }, [members])
 }

-export function RdmDutiesSection({ projectId }: { projectId: string }) {
+export function RdmDutiesSection({ project }: { project: Project }) {
+  const projectId = project.id
+  const writeError = projectWorkError(project)
  const [docs, setDocs] = useState<DutyCatalogDoc[] | null>(null)
  const [members, setMembers] = useState<{ owner: string; role: string }[] | null>(null)
  const [docId, setDocId] = useState('')
@@ -313,46 +321,95 @@ export function RdmDutiesSection({ projectId }: { projectId: string }) {
  const [notice, setNotice] = useState('')
  const [busy, setBusy] = useState(false)

-  const cmd = <T,>(id: string, params: Record<string, unknown>) => api.rdmCommand<T>(id, params)
+  const cmd = <T,>(id: string, params: Record<string, unknown>) => api.rdmProjectCommand<T>(project, id, params)
  const memberPage = useMemberPickerPage(members)
+  const requests = useRef({ project, epoch: 0, selected: '', selection: 0, catalog: 0, status: 0, action: 0 })
+  requests.current.project = project
+  const currentProject = (epoch: number) => requests.current.project === project && requests.current.epoch === epoch
+  const currentDocument = (epoch: number, selection: number, id: string) =>
+    currentProject(epoch) && requests.current.selection === selection && requests.current.selected === id

-  const refreshCatalog = async () => {
+  const refreshCatalog = async (epoch = requests.current.epoch) => {
+    const request = ++requests.current.catalog
    try {
      const out = await cmd<{ docs: DutyCatalogDoc[] }>('rdm.duty.catalog', { projectId })
+      if (!currentProject(epoch) || request !== requests.current.catalog) return
      setDocs(out.docs ?? [])
-    } catch (e) { setErr(String(e)); setDocs([]) }
+    } catch (e) {
+      if (!currentProject(epoch) || request !== requests.current.catalog) return
+      setErr(String(e)); setDocs([])
+    }
  }
-  const refreshStatus = async (id: string) => {
-    if (!id) { setSub(undefined); return }
+  const refreshStatus = async (id: string, epoch: number, selection: number) => {
+    if (!id || !currentDocument(epoch, selection, id)) return
+    const request = ++requests.current.status
    try {
      const out = await cmd<{ submission: DocSubmissionView | null }>('rdm.review.doc.status', docStatusPayload(projectId, id))
+      if (!currentDocument(epoch, selection, id) || request !== requests.current.status) return
      setSub(out.submission)
-    } catch (e) { setSub(undefined) }
+    } catch (e) {
+      if (!currentDocument(epoch, selection, id) || request !== requests.current.status) return
+      setSub(undefined); setErr(`整文状态读取失败：${e}`)
+    }
  }
  /** 选中文档：读当前职责（duty.get）并回填选择器（方案：当前职责与冻结名单分列）。 */
-  const selectDoc = async (id: string) => {
-    setErr(''); setNotice(''); setDocId(id); setDetail(undefined); setBatchSel(new Set())
+  const selectDoc = async (id: string, keepNotice = false) => {
+    const epoch = requests.current.epoch
+    const selection = ++requests.current.selection
+    requests.current.selected = id
+    requests.current.status++
+    setErr(''); if (!keepNotice) setNotice('')
+    setDocId(id); setDetail(undefined); setSub(undefined); setBatchSel(new Set())
+    setAuthor([]); setReviewers([]); setApprover([])
    if (!id) return
    try {
      const out = await cmd<DutyGetOut>('rdm.duty.get', { projectId, docId: id })
+      if (!currentDocument(epoch, selection, id)) return
+      if (out.docId !== id) throw new Error('文档职责与当前选择不一致，请重新选择文档')
      setDetail(out)
      setAuthor(out.assigned && out.roles.author ? [out.roles.author] : [])
      setReviewers(out.assigned ? out.roles.reviewers ?? [] : [])
      setApprover(out.assigned && out.roles.approver ? [out.roles.approver] : [])
-    } catch (e) { setErr(String(e)) }
-    await refreshStatus(id)
+    } catch (e) {
+      if (!currentDocument(epoch, selection, id)) return
+      setDetail(null); setErr(String(e))
+    }
+    await refreshStatus(id, epoch, selection)
  }
  useEffect(() => {
+    const epoch = ++requests.current.epoch
+    requests.current.selected = ''; requests.current.selection++; requests.current.status++
+    requests.current.action++
    setDocId(''); setDetail(undefined); setSub(undefined); setBatchSel(new Set())
-    refreshCatalog()
-    api.rdmCommand<{ members: { owner: string; role: string }[] }>('rdm.project.member.list', { projectId })
-      .then(out => setMembers(out.members ?? [])).catch(() => setMembers([]))
-  }, [projectId])
+    setDocs(null); setMembers(null); setAuthor([]); setReviewers([]); setApprover([])
+    setBatchAuthor([]); setBatchReviewers([]); setBatchApprover([])
+    setErr(''); setNotice(''); setBusy(false)
+    void refreshCatalog(epoch)
+    cmd<{ members: { owner: string; role: string }[] }>('rdm.project.member.list', { projectId })
+      .then(out => { if (currentProject(epoch)) setMembers(out.members ?? []) })
+      .catch(() => { if (currentProject(epoch)) setMembers([]) })
+    return () => {
+      requests.current.epoch++; requests.current.selection++; requests.current.status++
+      requests.current.catalog++; requests.current.action++; requests.current.selected = ''
+    }
+  }, [project])

  const run = async (label: string, fn: () => Promise<unknown>) => {
+    const epoch = requests.current.epoch
+    const selection = requests.current.selection
+    const selected = requests.current.selected
+    const action = ++requests.current.action
+    const currentAction = () => currentProject(epoch) && action === requests.current.action
    setErr(''); setNotice(''); setBusy(true)
-    try { await fn(); setNotice(label); await refreshCatalog(); if (docId) await selectDoc(docId) }
-    catch (e) { setErr(String(e)) } finally { setBusy(false) }
+    try {
+      await fn()
+      if (!currentAction() || !currentDocument(epoch, selection, selected)) return
+      setNotice(label)
+      await refreshCatalog(epoch)
+      if (currentAction() && currentDocument(epoch, selection, selected) && selected) await selectDoc(selected, true)
+    } catch (e) {
+      if (currentAction() && currentDocument(epoch, selection, selected)) setErr(String(e))
+    } finally { if (currentAction()) setBusy(false) }
  }

  const dirty = detail != null && (
@@ -360,12 +417,15 @@ export function RdmDutiesSection({ projectId }: { projectId: string }) {
    || JSON.stringify(reviewers) !== JSON.stringify(detail.assigned ? detail.roles.reviewers ?? [] : [])
    || (approver[0] ?? '') !== (detail.assigned ? detail.roles.approver : ''))

-  const saveDisabled = busy || !docId || !author[0] || !approver[0] || reviewers.length === 0
-    || (detail !== null && detail !== undefined && detail.active != null && !window.confirm(
-      `文档「${detail.title}」在途第 ${detail.active.round} 轮审签将因职责变更失效，需重新提交。确认变更？`))
+  const saveDisabled = busy || !!writeError || !docId || detail == null || !author[0] || !approver[0] || reviewers.length === 0

-  const save = () => run('已保存当前职责', () =>
-    cmd('rdm.review.assign.doc', assignDocDutiesPayload(projectId, docId, author[0], reviewers, approver[0])))
+  const save = () => {
+    if (saveDisabled || !dirty || requests.current.selected !== docId || detail?.docId !== docId) return
+    if (detail.active && !window.confirm(
+      `文档「${detail.title}」在途第 ${detail.active.round} 轮审签将因职责变更失效，需重新提交。确认变更？`)) return
+    return run('已保存当前职责', () =>
+      cmd('rdm.review.assign.doc', assignDocDutiesPayload(projectId, docId, author[0], reviewers, approver[0])))
+  }

  const batchApply = () => run(`已批量分配 ${batchSel.size} 份文档`, () =>
    cmd('rdm.review.assign.doc.batch', { projectId, docs: [...batchSel].map(d => ({
@@ -416,22 +476,26 @@ export function RdmDutiesSection({ projectId }: { projectId: string }) {
        </div>
      )}

+      {detail && docId && (
+        <div className="ad-row" style={{ marginTop: 8 }}>
+          <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || !detail.assigned || sub === undefined}
+            onClick={() => run('整文已提交审核（全文锁定）',
+              () => cmd('rdm.review.doc.submit', docSubmitPayload(projectId, docId)))}>整文提交（编制人）</button>
+        </div>
+      )}
      {sub && (
        <div className="settings-group" style={{ marginTop: 14 }}>
          <h4>整文审签 · 第 {sub.round} 轮 · {sub.state === 'submitted' ? <span className="ad-chip ad-chip-warn">在途（全文锁定）</span> : sub.state === 'final' ? <span className="ad-chip ad-chip-admin">已终批</span> : <span className="ad-chip">已驳回</span>}</h4>
          <div className="setting-row"><label>冻结名单</label><span>编 <b className="ad-mono">{sub.duties.author}</b> · 审 <b className="ad-mono">{(sub.duties.reviewers ?? []).join('、')}</b> · 批 <b className="ad-mono">{sub.duties.approver}</b></span></div>
          <div className="setting-row"><label>审核进度</label><span>{Object.entries(sub.reviews ?? {}).map(([r, ok]) => `${r}:${ok ? '✓' : '…'}`).join('  ') || '—'}</span></div>
          <div className="ad-row" style={{ marginTop: 8 }}>
-            <button className="lg-submit ad-create-btn" disabled={busy || !docId}
-              onClick={() => run('整文已提交审核（全文锁定）',
-                () => cmd('rdm.review.doc.submit', docSubmitPayload(projectId, docId)))}>整文提交（编制人）</button>
-            <button className="ad-mini" disabled={busy || sub.state !== 'submitted'}
+            <button className="ad-mini" disabled={busy || !!writeError || sub.state !== 'submitted'}
              onClick={() => run('已通过整文审核',
                () => cmd('rdm.review.doc.approve', docApprovePayload(projectId, docId, '通过')))}>审核通过</button>
-            <button className="ad-mini" disabled={busy || sub.state !== 'submitted'}
+            <button className="ad-mini" disabled={busy || !!writeError || sub.state !== 'submitted'}
              onClick={() => run('已驳回整文（解锁回编写态）',
                () => cmd('rdm.review.doc.reject', docRejectPayload(projectId, docId, '退回修改')))}>驳回</button>
-            <button className="lg-submit ad-create-btn" disabled={busy || sub.state !== 'submitted'}
+            <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || sub.state !== 'submitted'}
              onClick={() => run('整文终批完成（各章节已基线）',
                () => cmd('rdm.review.doc.final', docFinalPayload(projectId, docId)))}>终批（批准人）</button>
          </div>
@@ -449,7 +513,7 @@ export function RdmDutiesSection({ projectId }: { projectId: string }) {
          <div className="setting-row"><label>统一批准人</label>
            <div style={{ maxWidth: 320 }}><Picker aria-label="批量批准人" selected={batchApprover} onSelect={setBatchApprover} fetchPage={memberPage} /></div></div>
          <div className="ad-row">
-            <Btn variant="primary" icon="check" disabled={busy || !batchAuthor[0] || !batchApprover[0] || batchReviewers.length === 0}
+            <Btn variant="primary" icon="check" disabled={busy || !!writeError || !batchAuthor[0] || !batchApprover[0] || batchReviewers.length === 0}
              onClick={batchApply}>批量分配 {batchSel.size} 份文档</Btn>
            <button className="ad-mini" onClick={() => setBatchSel(new Set())}>清空选择</button>
          </div>
@@ -539,7 +603,10 @@ function ActionDetailTable({ actions, onOverride, canManage }: {
  )
 }

-export function RdmPermMatrixSection({ projectId }: { projectId: string }) {
+export function RdmPermMatrixSection({ project }: { project: Project }) {
+  const projectId = project.id
+  const writeError = projectWorkError(project)
+  const cmd = <T,>(id: string, params: Record<string, unknown> = {}) => api.rdmProjectCommand<T>(project, id, params)
  const me = useStore(s => s.me)
  const [view, setView] = useState<'member' | 'matrix'>('member')
  const [member, setMember] = useState('')
@@ -552,47 +619,49 @@ export function RdmPermMatrixSection({ projectId }: { projectId: string }) {
  const [busy, setBusy] = useState(false)

  const loadMembers = () =>
-    api.rdmCommand<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
+    cmd<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
      .then(out => {
        setMembers(out.members ?? [])
        if (me?.owner) setMember(prev => prev || me.owner)
      }).catch(e => setErr(String(e)))
-  useEffect(() => { loadMembers() }, [projectId, me?.owner]) // eslint-disable-line react-hooks/exhaustive-deps
+  useEffect(() => { loadMembers() }, [project, me?.owner]) // eslint-disable-line react-hooks/exhaustive-deps

  const query = async (m: string) => {
    if (!m) return
    setErr(''); setBusy(true); setMatrix(null)
    try {
-      setMatrix(await api.rdmCommand<MatrixOut>('rdm.perm.check', permCheckPayload(projectId, m)))
+      setMatrix(await cmd<MatrixOut>('rdm.perm.check', permCheckPayload(projectId, m)))
    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
  }
  const queryBatch = async () => {
    setErr(''); setBusy(true); setBatch(null)
    try {
-      setBatch(await api.rdmCommand<MatrixBatchOut>('rdm.perm.matrix', { projectId }))
+      setBatch(await cmd<MatrixBatchOut>('rdm.perm.matrix', { projectId }))
    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
  }
  useEffect(() => { if (view === 'matrix') queryBatch() }, [view]) // eslint-disable-line react-hooks/exhaustive-deps

  /** 三态覆盖写回：default=实际撤销（perm.unset）；allow/deny=perm.set。 */
  const override = async (m: string, action: string, mode: 'allow' | 'deny' | 'default') => {
+    if (writeError) { setErr(writeError); return }
    setErr(''); setNotice(''); setBusy(true)
    try {
      if (mode === 'default') {
-        await api.rdmCommand('rdm.perm.unset', { projectId, member: m, action })
+        await cmd('rdm.perm.unset', { projectId, member: m, action })
        setNotice(`已恢复默认（撤销 ${action} 的项目覆盖）`)
      } else {
-        await api.rdmCommand('rdm.perm.set', { projectId, member: m, action, allow: mode === 'allow' })
+        await cmd('rdm.perm.set', { projectId, member: m, action, allow: mode === 'allow' })
        setNotice(mode === 'allow' ? `已在项目内允许 ${action}` : `已在项目内禁止 ${action}`)
      }
      await query(m)
    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
  }

-  const canManage = !!matrix && matrix.role !== undefined
+  const canManage = !writeError && !!matrix && matrix.role !== undefined

  return (
    <div>
+      {writeError && <p className="ad-hint">{writeError}</p>}
      <div className="ad-create">
        <div className="ad-row">
          <select className="lg-input" value={view} onChange={e => setView(e.target.value as 'member' | 'matrix')}>
@@ -659,7 +728,7 @@ export function RdmPermMatrixSection({ projectId }: { projectId: string }) {
          {(() => {
            const row = batch.rows.find(r => r.member === expand)
            if (!row) return null
-            return <ActionDetailTable actions={row.actions} canManage
+            return <ActionDetailTable actions={row.actions} canManage={!writeError}
              onOverride={(action, mode) => override(expand, action, mode)} />
          })()}
        </div>
@@ -669,4 +738,4 @@ export function RdmPermMatrixSection({ projectId }: { projectId: string }) {
      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
    </div>
  )
-}
+}
@@ -3,3 +3,41 @@ export function projectStage(settings?: Record<string, unknown> | null): string
  const stage = settings?.stage
  return typeof stage === 'string' && stage.trim() !== '' ? stage.trim() : null
 }
+
+/** Service metadata describes readiness; permission is always checked by the server. */
+export function projectWorkError(project: { settings?: Record<string, unknown> } | undefined): string | null {
+  if (!project) return '项目已不可用，请刷新项目列表或联系项目负责人'
+  const settings = project.settings
+  if (!settings || (!('rdm.state' in settings) && !('rdm.projectId' in settings))) return null
+  switch (settings['rdm.state']) {
+    case 'ready':
+      if (typeof settings['rdm.projectId'] === 'string' && settings['rdm.projectId'].trim()) return null
+      break
+    case 'provisioning': return '项目正在准备，请稍后刷新项目列表再试'
+    case 'failed': return '项目准备失败，请联系项目负责人重试创建'
+    case 'archived': return '项目已归档，请联系项目负责人恢复后再新建对话'
+    case 'closed': return '项目已关闭，请选择其他项目或联系项目负责人'
+  }
+  return '项目尚未绑定，请联系项目负责人完成项目接入'
+}
+
+export function projectStateLabel(settings?: Record<string, unknown>): string | null {
+  switch (settings?.['rdm.state']) {
+    case 'provisioning': return '准备中'
+    case 'failed': return '准备失败'
+    case 'unbound': return '未接入'
+    case 'archived': return '已归档'
+    case 'closed': return '已关闭'
+    default: return null
+  }
+}
+
+export function projectActionError(error: unknown): string {
+  const raw = String(error)
+  if (/\b401\b/.test(raw)) return '登录已失效，请重新登录后再试'
+  if (/\b403\b/.test(raw)) return '当前账号无法管理此项目，请联系项目负责人'
+  if (/\b404\b/.test(raw)) return '项目已不可用，请刷新项目列表或联系项目负责人'
+  if (/\b409\b/.test(raw)) return '项目名称已被占用或项目状态已变化，请更换名称或刷新后再试'
+  if (/\b503\b/.test(raw)) return '项目服务暂未就绪，请稍后重试或联系项目负责人'
+  return raw.replace(/^Error:\s*/, '')
+}
@@ -2,6 +2,35 @@
 // 命令清单不可用＝未就绪，fail-closed）与命令载荷构造。页面组件只消费本模块与
 // api.rdmCommand，不在组件里散落命令 id / 参数拼写；身份一律经认证会话，载荷不
 // 携带任何身份字段（G1-5）。
+import type { Project } from './contracts'
+import { projectWorkError } from './projectmeta'
+
+export function rdmCommandProjectId(project: Project): string {
+  const id = project.settings?.['rdm.projectId']
+  if (typeof id !== 'string' || !id.trim()) {
+    throw new Error('项目尚未绑定，请联系项目负责人完成项目接入')
+  }
+  return id.trim()
+}
+
+/** Historical project reads remain available; this does not grant read permission. */
+export function rdmProjectReadError(project: Project | undefined): string | null {
+  const state = project?.settings?.['rdm.state']
+  if (project && (state === 'ready' || state === 'archived' || state === 'closed')) {
+    try { rdmCommandProjectId(project); return null }
+    catch (e) { return String(e).replace(/^Error:\s*/, '') }
+  }
+  return projectWorkError(project) ?? '项目尚未绑定，请联系项目负责人完成项目接入'
+}
+
+const PROJECT_READ_COMMANDS = new Set([
+  'rdm.project.member.list', 'rdm.perm.check', 'rdm.perm.matrix',
+  'rdm.review.doc.status', 'rdm.duty.catalog', 'rdm.duty.get',
+])
+
+export function rdmProjectCommandError(project: Project, command: string): string | null {
+  return PROJECT_READ_COMMANDS.has(command) ? rdmProjectReadError(project) : projectWorkError(project)
+}

 /** 系统管理「RDM 角色权限」分区消费的命令面。 */
 export const RDM_ROLES_COMMANDS = [
@@ -2,6 +2,8 @@
 // useSyncExternalStore 驱动；live 流式部件为会话内临时态，run 终态后由消息树对账收敛。
 import { useSyncExternalStore } from 'react'
 import { type AdminZoneSection, api, connectEvents } from './api'
+import { auth } from './auth'
+import { projectActionError, projectWorkError } from './projectmeta'
 import { applyTextDelta, applyThinkingDelta, applyToolCall, applyToolCallDelta, applyToolResult, applyToolOutput, applyArtifactCreated, applyArtifactUpdated, applyCheck, applyFinalizing, type LiveItem } from './live'
 import { closePreviewTab, mergeOrphanPreviewTabs, openPreviewTab, previewTabsKey, type PreviewTab } from './previewtabs'
 import { deliveryRequestId, enqueueMessage, enqueueMessageFront, newQueuedMessage, promoteQueuedMessage, removeQueuedMessage, replaceQueuedText, type QueuedMessage } from './outbox'
@@ -279,6 +281,10 @@ let sse: { close: () => void } | null = null
 let projectSse: { close: () => void } | null = null
 let projectSeq = 0
 let conversationEpoch = 0
+let identityEpoch = 0
+let projectsRequest = 0
+let tasksRequest = 0
+let meRequest = 0
 let streamSeq = 0
 let detailRequest = 0
 let detailSeq = 0
@@ -399,23 +405,56 @@ export function useStore<T>(selector: (s: AppState) => T): T {
 export const store = {
  getState: () => state,

+  resetIdentity() {
+    identityEpoch++; projectsRequest++; tasksRequest++; meRequest++
+    sse?.close(); sse = null
+    projectSse?.close(); projectSse = null
+    conversationEpoch++; detailRequest++; cardsRequest++; projectCardsRequest++
+    projectSeq = 0; streamSeq = 0; detailSeq = 0; detailVersion = 0
+    cardVersion = 0; projectCardVersion = 0
+    cardVersions = {}; projectCardVersions = {}; cardPatches = {}; projectCardPatches = {}
+    runObservations = {}; messageObservations = {}; hitlObservations = {}
+    actionInflight.clear()
+    for (const key of Object.keys(actionFeedbackOwners)) delete actionFeedbackOwners[key]
+    for (const key of Object.keys(surfaceActionsInflight)) delete surfaceActionsInflight[key]
+    convRestoreDone = true
+    persistConvId(null)
+    set({ projects: [], currentProjectId: null, tasks: [], me: null, currentConvId: null,
+      contextObs: {}, messages: [], runs: [], activeHitl: [], lastSeq: 0, live: null,
+      plan: null, todos: null, artifacts: [], surfaces: [], projectSurfaces: [],
+      cards: [], projectCards: [], cardActionStates: {}, inboxScope: 'conv',
+      runtimeMock: false, profiles: [], pluginPanels: [], serverWorkspaces: [], adminSections: [],
+      rdmAuditAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
+      rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false,
+      connected: false, posting: false, error: null, toast: null, outbox: [], outboxDraining: false,
+      previewTabs: {}, previewActive: {}, previewOpenIntent: 0 })
+    setUI({ lastProjectId: null, projectSettingsId: null, adminZoneOpen: false, activeWorkspace: null,
+      settingsOpen: false, changePwOpen: false, trackerRunId: null, workspaceSurfacePin: null,
+      previewExpanded: false, filesView: 'list', showArchived: false })
+  },
+
  async refreshProjects() {
+    const epoch = identityEpoch
+    const request = ++projectsRequest
    try {
      const projects = await api.listProjects()
+      if (epoch !== identityEpoch || request !== projectsRequest) return
      const current = projects.find(p => p.id === state.currentProjectId) ?? projects.find(p => p.id === state.ui.lastProjectId) ?? projects[0]
      set({ projects, currentProjectId: current?.id ?? null, error: null })
      if (current) await store.openProject(current.id)
    } catch (e) {
-      set({ error: String(e) })
+      if (epoch === identityEpoch && request === projectsRequest) set({ error: projectActionError(e) })
    }
-    store.refreshTasks()
-    store.refreshMe()
+    if (epoch === identityEpoch && request === projectsRequest) await store.refreshTasks()
  },

  // 跨项目任务列表（方案 A 侧栏数据源）：归档视图切换时带 includeArchived 重取。
  async refreshTasks(includeArchived = state.ui.showArchived) {
+    const epoch = identityEpoch
+    const request = ++tasksRequest
    try {
      const tasks = await api.listTasks(includeArchived)
+      if (epoch !== identityEpoch || request !== tasksRequest) return
      set({ tasks })
      // 首次加载恢复上次会话（仅一次；此后用户主动切换/新建不再打扰）。
      if (!convRestoreDone) {
@@ -429,14 +468,35 @@ export const store = {
  },

  async refreshMe() {
-    try { set({ me: await api.me() }) } catch { /* 身份不可用时侧栏只显示通用入口 */ }
+    const epoch = identityEpoch
+    const request = ++meRequest
+    try {
+      const me = await api.me()
+      if (epoch !== identityEpoch || request !== meRequest) return
+      const changed = state.me !== null && state.me.owner !== me.owner
+      if (changed) store.resetIdentity()
+      set({ me })
+      if (changed) {
+        await store.refreshProjects()
+        void store.refreshProfiles()
+        void store.refreshPlugins()
+      }
+    } catch { /* 身份不可用时侧栏只显示通用入口 */ }
  },

  async createProject(name: string) {
-    const p = await api.createProject(name)
-    await store.refreshProjects()
-    store.toast(`项目「${p.name}」已创建`)
-    return p
+    const epoch = identityEpoch
+    try {
+      const p = await api.createProject(name)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      await store.refreshProjects()
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      store.toast(`项目「${p.name}」已创建`)
+      return p
+    } catch (e) {
+      if (epoch === identityEpoch) store.toast(`项目创建失败：${projectActionError(e)}`)
+      throw e
+    }
  },

  async openProject(projectId: string) {
@@ -465,28 +525,43 @@ export const store = {
  /** 新建任务（=会话）：默认当前项目上下文；显式 projectId 用于"新建于指定项目"。
   * 空库时主按钮与空状态都写着「点击新建任务开始」，这里先落一个默认项目再开会话。 */
  async createTask(projectId?: string) {
-    let pid = projectId ?? state.currentProjectId
-    if (!pid && state.projects.length > 0) pid = state.projects[0].id
-    if (!pid) {
-      const p = await store.createProject('默认项目')
-      pid = p.id
+    const epoch = identityEpoch
+    try {
+      let pid = projectId ?? state.currentProjectId
+      if (!pid && state.projects.length > 0) pid = state.projects[0].id
+      if (!pid) {
+        const p = await store.createProject('默认项目')
+        pid = p.id
+      }
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      const error = projectWorkError(state.projects.find(p => p.id === pid))
+      if (error) throw new Error(error)
+      if (pid !== state.currentProjectId) await store.openProject(pid)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      const c = await api.createConversation(pid)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      await store.refreshTasks()
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      await store.openTask(c.id)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+    } catch (e) {
+      if (epoch === identityEpoch) store.toast(`对话创建失败：${projectActionError(e)}`)
+      throw e
    }
-    if (pid !== state.currentProjectId) await store.openProject(pid)
-    const c = await api.createConversation(pid)
-    await store.refreshTasks()
-    await store.openTask(c.id)
  },

  /** 兼容旧入口（⌘/命令总线） */
  async createConversation(title?: string) {
-    if (title) store.toast('已在当前项目创建任务')
    await store.createTask()
+    if (title) store.toast('已在当前项目创建任务')
  },

  /** 打开任务：跨项目点击时切换项目上下文（工件/上传归属正确）。 */
  async openTask(convId: string) {
+    const epoch = identityEpoch
    const t = state.tasks.find(x => x.id === convId)
    if (t && t.projectId !== state.currentProjectId) await store.openProject(t.projectId)
+    if (epoch !== identityEpoch) return
    await store.openConversation(convId)
  },

@@ -996,8 +1071,9 @@ export const store = {
    const convId = state.currentConvId
    const pid = state.currentProjectId
    const epoch = conversationEpoch
+    const identity = identityEpoch
    const startedVersion = card.conversationId === state.currentConvId ? cardVersion : projectCardVersion
-    const sameContext = () => state.currentProjectId === pid && (!card.conversationId || (state.currentConvId === convId && conversationEpoch === epoch))
+    const sameContext = () => identity === identityEpoch && state.currentProjectId === pid && (!card.conversationId || (state.currentConvId === convId && conversationEpoch === epoch))
    actionInflight.add(card.id)
    const feedbackOwner = startActionFeedback(card.id)
    try {
@@ -1035,43 +1111,60 @@ export const store = {
        else await store.loadProjectCards()
      }
    } finally {
-      actionInflight.delete(card.id)
+      if (identity === identityEpoch) actionInflight.delete(card.id)
    }
  },

  async cardPin(card: ActivityCard, pinned: boolean) {
-    try { store.upsertCard((await api.cardPin(card.id, pinned)).card) } catch (e) { store.toast(`置顶失败：${e}`) }
+    const epoch = identityEpoch
+    try {
+      const out = await api.cardPin(card.id, pinned)
+      if (epoch === identityEpoch) store.upsertCard(out.card)
+    } catch (e) { if (epoch === identityEpoch) store.toast(`置顶失败：${e}`) }
  },

  async cardDismiss(card: ActivityCard) {
-    try { store.upsertCard((await api.cardDismiss(card.id)).card) } catch (e) { store.toast(`关闭失败：${e}`) }
+    const epoch = identityEpoch
+    try {
+      const out = await api.cardDismiss(card.id)
+      if (epoch === identityEpoch) store.upsertCard(out.card)
+    } catch (e) { if (epoch === identityEpoch) store.toast(`关闭失败：${e}`) }
  },

  async refreshArtifacts(projectId: string) {
+    const epoch = identityEpoch
    try {
      const artifacts = await api.listArtifacts(projectId)
-      if (state.currentProjectId !== projectId) return
+      if (epoch !== identityEpoch || state.currentProjectId !== projectId) return
      set({ artifacts })
    } catch { /* 项目删除竞态等，静默 */ }
  },

  async refreshProfiles() {
-    try { set({ profiles: await api.listProfiles() }) } catch { /* ignore */ }
+    const epoch = identityEpoch
+    try {
+      const profiles = await api.listProfiles()
+      if (epoch === identityEpoch) set({ profiles })
+    } catch { /* ignore */ }
  },

  async refreshPlugins() {
+    const epoch = identityEpoch
    try {
      const list = await api.listPlugins() as { panels?: PluginPanel[] }[]
+      if (epoch !== identityEpoch) return
      const panels = list.flatMap(p => p.panels ?? [])
      set({ pluginPanels: panels })
    } catch { /* ignore */ }
    try {
      const ws = await api.listWorkspaces()
+      if (epoch !== identityEpoch) return
      set({ serverWorkspaces: ws ?? [] })
    } catch { /* ignore */ }
    // 审计入口能力门控（增量 2）：与工作区清单同源刷新——能力撤销（插件卸载/命令停用）后入口随之隐藏。
    try {
      const cmds = await api.listCommands()
+      if (epoch !== identityEpoch) return
      set({
        rdmAuditAvailable: rdmAuditReady(cmds),
        rdmRolesAvailable: rdmRolesReady(cmds),
@@ -1079,13 +1172,19 @@ export const store = {
        rdmDocReviewAvailable: rdmDocReviewReady(cmds),
        rdmPermMatrixAvailable: rdmPermMatrixReady(cmds),
      })
-    } catch { set({ rdmAuditAvailable: false }) }
+    } catch {
+      if (epoch !== identityEpoch) return
+      set({ rdmAuditAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
+        rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false })
+    }
    try {
      const sections = await api.adminZoneSections()
+      if (epoch !== identityEpoch) return
      set({ adminSections: sections ?? [] })
    } catch { /* ignore */ }
    try {
      const settings = await api.getSettings()
+      if (epoch !== identityEpoch) return
      const runtime = settings.user.runtime
      const mock = !!runtime && typeof runtime === 'object' && (runtime as { mock?: unknown }).mock === true
      set({ runtimeMock: mock })
@@ -1094,15 +1193,16 @@ export const store = {

  async uploadAttachment(file: File): Promise<string | null> {
    const pid = state.currentProjectId
+    const epoch = identityEpoch
    if (!pid) return null
    try {
      const up = await api.upload(pid, file)
-      if (state.currentProjectId !== pid) return null
+      if (epoch !== identityEpoch || state.currentProjectId !== pid) return null
      store.toast(`已收到材料：${up.filename}${up.parsed ? ' · 已读取内容' : ''}`)
      await store.refreshArtifacts(pid)
-      return up.artifactId
+      return epoch === identityEpoch && state.currentProjectId === pid ? up.artifactId : null
    } catch (e) {
-      if (state.currentProjectId === pid) store.toast('材料未能上传，请检查文件后重新选择')
+      if (epoch === identityEpoch && state.currentProjectId === pid) store.toast('材料未能上传，请检查文件后重新选择')
      return null
    }
  },
@@ -1140,9 +1240,10 @@ export const store = {

  connectProject() {
    const pid = store.getState().currentProjectId
+    const epoch = identityEpoch
    if (!pid) return
    projectSse?.close()
-    projectSse = connectEvents('', projectSeq, { onEvent: e => { if (state.currentProjectId === pid) store.applyProjectEvent(e) } }, pid)
+    projectSse = connectEvents('', projectSeq, { onEvent: e => { if (epoch === identityEpoch && state.currentProjectId === pid) store.applyProjectEvent(e) } }, pid)
  },

  applyProjectEvent(e: StreamEvent) {
@@ -1183,8 +1284,10 @@ export const store = {
  },

  async cardToProject(card: ActivityCard) {
+    const epoch = identityEpoch
    try {
      const out = await api.cardToProject(card.id)
+      if (epoch !== identityEpoch) return
      store.upsertCard(out.origin) // 会话视图：原卡 dismissed 留痕
      const list = store.getState().projectCards
      const i = list.findIndex(c => c.id === out.card.id)
@@ -1192,17 +1295,23 @@ export const store = {
      store.toast('已留档到项目收件箱')
      store.setInboxScope('project')
    } catch (e) {
-      store.toast(`留档失败：${e}`)
+      if (epoch === identityEpoch) store.toast(`留档失败：${e}`)
    }
  },

  async tidyCards() {
+    const epoch = identityEpoch
    // U1：不收纳失败语义卡（failed，或旧 done+danger），避免把失败当完成清掉。
    const done = state.cards.filter(c => c.status === 'done' && c.tone !== 'danger')
    for (const c of done) {
-      try { const out = await api.cardDismiss(c.id); store.upsertCard(out.card) } catch { /* 单卡失败不阻断 */ }
+      if (epoch !== identityEpoch) return
+      try {
+        const out = await api.cardDismiss(c.id)
+        if (epoch !== identityEpoch) return
+        store.upsertCard(out.card)
+      } catch { /* 单卡失败不阻断 */ }
    }
-    if (done.length > 0) store.toast(`已收纳 ${done.length} 张完成卡`)
+    if (epoch === identityEpoch && done.length > 0) store.toast(`已收纳 ${done.length} 张完成卡`)
  },
  closeWorkspace() { setUI({ activeWorkspace: null }) },
  /** 铃铛：打开右栏并切到待处理。哪一侧有待办就看哪一侧。 */
@@ -1300,6 +1409,8 @@ export const store = {
  },
 }

+auth.onIdentityChange(() => store.resetIdentity())
+
 function touchLive(_runId: string, mutate: (l: LiveState) => void, now = Date.now()): LiveState | null {
  if (state.runs.find(r => r.id === _runId)?.kind === 'subagent') return state.live
  if (state.live && state.live.runId !== _runId && !isTerminal(state.runs.find(r => r.id === state.live?.runId)?.status)) return state.live
@@ -0,0 +1,349 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { api } from '../src/api'
+import { auth } from '../src/auth'
+import { store } from '../src/store'
+import type { ActivityCard, Conversation, Project } from '../src/contracts'
+import { assignDocDutiesPayload, memberAddPayload } from '../src/rdmManagement'
+
+const project = (id: string, settings?: Project['settings']): Project => ({
+  id, name: id, settings, createdAt: '', updatedAt: '',
+})
+const ready = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready' })
+const task = (id: string): Conversation => ({ id, projectId: 'host-1', title: id, createdAt: '', updatedAt: '' })
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>(ok => { resolve = ok })
+  return { promise, resolve }
+}
+const response = (value: unknown, status = 200) => new Response(JSON.stringify(value), { status })
+let projects: Project[]
+let tasks: Conversation[]
+let requests: { path: string; init?: RequestInit }[]
+let route: (path: string, init?: RequestInit) => Promise<Response>
+
+beforeEach(async () => {
+  projects = []; tasks = []; requests = []
+  const saved = new Map<string, string>()
+  vi.stubGlobal('localStorage', { getItem: (key: string) => saved.get(key) ?? null,
+    setItem: (key: string, value: string) => { saved.set(key, value) },
+    removeItem: (key: string) => { saved.delete(key) } })
+  route = async (path, init) => {
+    if (path === '/api/projects' && !init?.method) return response(projects)
+    if (path.startsWith('/api/conversations') && !init?.method) return response(tasks)
+    if (path === '/api/me') return response({ owner: 'alice', name: 'Alice', auth: true })
+    if (path.endsWith('/artifacts')) return response([])
+    if (path.endsWith('/cards')) return response({ cards: [] })
+    if (path.endsWith('/surfaces')) return response([])
+    if (['/api/profiles', '/api/plugins', '/api/workspaces', '/api/commands', '/api/admin-zone/sections'].includes(path)) return response([])
+    if (path === '/api/settings') return response({ schema: [], defaults: {}, user: {}, project: {} })
+    if (path.startsWith('/api/commands/')) return response({ payload: { ok: true } })
+    return response({})
+  }
+  vi.stubGlobal('fetch', async (path: string, init?: RequestInit) => {
+    requests.push({ path, init })
+    return route(path, init)
+  })
+  vi.stubGlobal('EventSource', class { addEventListener() {} close() {} })
+  auth.beginSession()
+  await store.refreshProjects()
+  await store.refreshTasks()
+  store.setUI({ lastProjectId: null })
+  requests = []
+})
+afterEach(() => { vi.restoreAllMocks(); vi.unstubAllGlobals() })
+
+describe('project command identity', () => {
+  it.each(['archived', 'closed'])('preserves canonical member, permission and duty reads for a %s project', async state => {
+    const historical = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': state })
+    const commands = ['rdm.project.member.list', 'rdm.perm.check', 'rdm.perm.matrix',
+      'rdm.review.doc.status', 'rdm.duty.catalog', 'rdm.duty.get']
+    for (const command of commands) await api.rdmProjectCommand(historical, command, { docId: 'doc-2' })
+    expect(requests.map(r => ({ path: r.path, params: JSON.parse(String(r.init?.body)).params }))).toEqual([
+      { path: '/api/commands/rdm.project.member.list', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.perm.check', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.perm.matrix', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.review.doc.status', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.duty.catalog', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.duty.get', params: { projectId: 'domain-7', docId: 'doc-2' } },
+    ])
+  })
+
+  it.each(['archived', 'closed'])('still blocks project and document mutations for a %s project', async state => {
+    const historical = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': state })
+    for (const command of ['rdm.project.member.add', 'rdm.project.member.remove', 'rdm.project.member.setRole',
+      'rdm.review.assign.doc', 'rdm.review.doc.submit', 'rdm.review.doc.approve', 'rdm.review.doc.reject', 'rdm.review.doc.final']) {
+      await expect(api.rdmProjectCommand(historical, command)).rejects.toThrow()
+    }
+    expect(requests).toEqual([])
+  })
+
+  it.each(['rdm.perm.matrix', 'rdm.duty.catalog', 'rdm.duty.get', 'rdm.project.member.setRole'])('uses the same canonical boundary for %s', async command => {
+    await api.rdmProjectCommand(ready, command, { projectId: 'another-host', member: 'bob' })
+    expect(requests.map(r => ({ path: r.path, params: JSON.parse(String(r.init?.body)).params }))).toEqual([
+      { path: `/api/commands/${command}`, params: { projectId: 'domain-7', member: 'bob' } },
+    ])
+  })
+
+  it('sends member and duty commands to the canonical domain project from service metadata', async () => {
+    await api.rdmProjectCommand(ready, 'rdm.project.member.add', memberAddPayload(ready.id, 'bob'))
+    await api.rdmProjectCommand(ready, 'rdm.review.assign.doc', assignDocDutiesPayload(ready.id, 'doc-2', 'alice', ['bob'], 'carol'))
+    expect(requests.map(r => JSON.parse(String(r.init?.body)).params)).toEqual([
+      { projectId: 'domain-7', member: 'bob', role: 'member' },
+      { projectId: 'domain-7', docId: 'doc-2', author: 'alice', reviewers: ['bob'], approver: 'carol' },
+    ])
+  })
+
+  it.each([
+    project('host-1', { 'rdm.state': 'unbound' }),
+    project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'failed' }),
+    project('host-1', { 'rdm.projectId': 'domain-7' }),
+    project('host-1'),
+  ])('does not invent a domain ID or send commands for an unready binding: %j', async p => {
+    await expect(api.rdmProjectCommand(p, 'rdm.project.member.list')).rejects.toThrow()
+    expect(requests).toEqual([])
+  })
+})
+
+describe('project work and mutation failures', () => {
+  it('keeps private history readable for an archived project while refusing new work', async () => {
+    projects = [project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'archived' })]
+    tasks = [task('private-history')]
+    const previous = route
+    route = async (path, init) => {
+      if (path === '/api/conversations/private-history') return response({ conversation: tasks[0],
+        messages: [{ id: 'own-message', conversationId: 'private-history', role: 'user', parts: [{ type: 'text', text: 'My history' }], createdAt: '' }],
+        runs: [], activeHitl: [], lastSeq: 0 })
+      if (path.endsWith('/plan') || path.endsWith('/todos')) return response(null)
+      return previous(path, init)
+    }
+    await store.refreshProjects()
+    await store.openTask('private-history')
+    await expect(store.createTask()).rejects.toThrow()
+    expect(store.getState().currentConvId).toBe('private-history')
+    expect(store.getState().messages.map(m => m.id)).toEqual(['own-message'])
+    expect(requests.filter(r => r.init?.method === 'POST')).toEqual([])
+  })
+
+  it.each([ready, project('host-1')])('creates private work with the host ID in ready RDM and ordinary base mode: %j', async p => {
+    projects = [p]
+    await store.refreshProjects()
+    const previous = route
+    route = async (path, init) => {
+      if (path === '/api/projects/host-1/conversations' && init?.method === 'POST') {
+        tasks = [task('new-private')]
+        return response(tasks[0])
+      }
+      if (path === '/api/conversations/new-private') {
+        return response({ conversation: tasks[0], messages: [], runs: [], activeHitl: [], lastSeq: 0 })
+      }
+      if (path.endsWith('/plan') || path.endsWith('/todos')) return response(null)
+      return previous(path, init)
+    }
+    await store.createTask()
+    expect(store.getState().currentConvId).toBe('new-private')
+    expect(requests.filter(r => r.init?.method === 'POST').map(r => r.path)).toEqual(['/api/projects/host-1/conversations'])
+  })
+
+  it.each(['provisioning', 'failed', 'unbound', 'archived', 'closed'])('does not create a fallback project or conversation for a selected %s project', async state => {
+    projects = [project('host-1', { 'rdm.state': state }), project('host-2')]
+    await store.refreshProjects()
+    requests = []
+    await expect(store.createTask()).rejects.toThrow()
+    expect(requests.filter(r => r.init?.method === 'POST')).toEqual([])
+    expect(store.getState().currentProjectId).toBe('host-1')
+    expect(store.getState().toast).toMatch(/项目.*(稍后|负责人|恢复|关闭)/)
+  })
+
+  it('does not bypass a selected project absent from the current list', async () => {
+    await store.openProject('revoked-project')
+    requests = []
+    await expect(store.createTask()).rejects.toThrow()
+    expect(requests.filter(r => r.init?.method === 'POST')).toEqual([])
+  })
+
+  it.each(['delete', 'rename'])('rejects a denied %s instead of resolving success', async action => {
+    route = async () => response({ error: 'project administration required' }, 403)
+    const mutation = action === 'delete' ? api.deleteProject('host-1') : api.renameProject('host-1', 'renamed')
+    await expect(mutation).rejects.toThrow(/403/)
+  })
+
+  it('retains selection and gives an actionable message when project creation is rejected', async () => {
+    projects = [ready]
+    await store.refreshProjects()
+    route = async () => response({ error: 'name reserved' }, 409)
+    await expect(store.createProject('Taken')).rejects.toThrow()
+    expect(store.getState().currentProjectId).toBe('host-1')
+    expect(store.getState().toast).toMatch(/名称.*(其他|更换)/)
+    expect(store.getState().toast).not.toContain('已创建')
+  })
+
+  it('checks a denied settings save instead of resolving success', async () => {
+    route = async () => response({ error: 'denied' }, 403)
+    await expect(api.putProjectSettings('host-1', {})).rejects.toThrow(/403/)
+  })
+})
+
+describe('identity-scoped state', () => {
+  it('resets state on a successful cookie login, without relying on a component callback', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    route = async () => response({ owner: 'bob', name: 'Bob', isAdmin: false, mustChangePassword: false, passwordSet: true, sessionScope: 'normal' })
+    await api.login('bob', 'password-for-test')
+    expect(store.getState().projects).toEqual([])
+    expect(store.getState().tasks).toEqual([])
+  })
+
+  it('clears old state as soon as logout starts, even while the server response is pending', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    const pending = deferred<Response>()
+    route = async () => pending.promise
+    const logout = api.logout()
+    expect(store.getState().projects).toEqual([])
+    expect(store.getState().tasks).toEqual([])
+    pending.resolve(response({ ok: true }))
+    await logout
+  })
+
+  it('clears the previous account when the authenticated owner changes during identity refresh', async () => {
+    await store.refreshMe()
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    const previous = route
+    projects = []; tasks = []
+    route = (path, init) => path === '/api/me' ? Promise.resolve(response({ owner: 'bob', name: 'Bob', auth: true })) : previous(path, init)
+    await store.refreshMe()
+    expect(store.getState()).toMatchObject({ me: { owner: 'bob' }, projects: [], tasks: [], currentProjectId: null, currentConvId: null })
+  })
+
+  it('clears projects, private tasks, previews and persisted selections on a new session', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    store.openSurface('surface-alice')
+    store.setUI({ projectSettingsId: 'host-1', adminZoneOpen: true, activeWorkspace: 'private-workspace' })
+    localStorage.setItem('as.conv', 'alice-private')
+    auth.beginSession()
+    expect(store.getState()).toMatchObject({ projects: [], tasks: [], me: null, currentProjectId: null, currentConvId: null, artifacts: [], previewTabs: {}, previewActive: {} })
+    expect(store.getState().ui).toMatchObject({ lastProjectId: null, projectSettingsId: null, adminZoneOpen: false, activeWorkspace: null })
+    expect(localStorage.getItem('as.conv')).toBeNull()
+    expect(JSON.parse(localStorage.getItem('as.ui') ?? '{}').lastProjectId).toBeNull()
+  })
+
+  it('drops old project responses after switching accounts even when IDs are shared', async () => {
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/projects' ? old.promise : previous(path, init)
+    const pending = store.refreshProjects()
+    auth.beginSession()
+    projects = [project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready' })]
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response([project('alice-only')]))
+    await pending
+    expect(store.getState().projects.map(p => p.id)).toEqual(['host-1'])
+    expect(store.getState().currentProjectId).toBe('host-1')
+  })
+
+  it('drops an old private task list after logout and a new session', async () => {
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/conversations' ? old.promise : previous(path, init)
+    const pending = store.refreshTasks()
+    auth.logout()
+    auth.beginSession()
+    tasks = [task('bob-private')]
+    route = previous
+    await store.refreshTasks()
+    old.resolve(response([task('alice-private')]))
+    await pending
+    expect(store.getState().tasks.map(t => t.id)).toEqual(['bob-private'])
+  })
+
+  it('drops an old artifact response when the next account selects the same project', async () => {
+    await store.openProject('host-1')
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path.endsWith('/artifacts') ? old.promise : previous(path, init)
+    const pending = store.refreshArtifacts('host-1')
+    auth.beginSession()
+    route = previous
+    await store.openProject('host-1')
+    old.resolve(response([{ id: 'alice-artifact', projectId: 'host-1', owner: 'alice', name: 'Alice private', kind: 'file', size: 10, createdAt: '', updatedAt: '' }]))
+    await pending
+    expect(store.getState().artifacts).toEqual([])
+  })
+
+  it.each(['action', 'pin', 'dismiss', 'to-project', 'tidy'] as const)('ignores a late project card %s from the previous account on the same shared project', async operation => {
+    projects = [ready]
+    await store.refreshProjects()
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path.startsWith('/api/cards/') ? old.promise : previous(path, init)
+    const card: ActivityCard = { id: 'alice-card', projectId: 'host-1', kind: 'progress', status: 'active', title: 'Alice private work', createdAt: '', updatedAt: '' }
+    if (operation === 'tidy') store.upsertCard({ ...card, status: 'done' })
+    const pending = operation === 'action' ? store.cardAction(card, 'finish')
+      : operation === 'pin' ? store.cardPin(card, true)
+      : operation === 'dismiss' ? store.cardDismiss(card)
+      : operation === 'tidy' ? store.tidyCards() : store.cardToProject(card)
+    auth.beginSession()
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response({ card: { ...card, status: 'done' }, origin: { ...card, status: 'dismissed' } }))
+    await pending
+    expect(store.getState().projectCards).toEqual([])
+    expect(store.getState().cards).toEqual([])
+  })
+
+  it('does not reopen a previous account conversation after its project load finishes late', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects()
+    await store.openProject('another-project')
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/projects/host-1/artifacts' ? old.promise : previous(path, init)
+    const pending = store.openTask('alice-private')
+    auth.beginSession()
+    tasks = []
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response([]))
+    await pending
+    expect(store.getState().currentConvId).toBeNull()
+    expect(requests.map(r => r.path)).not.toContain('/api/conversations/alice-private')
+  })
+
+  it('does not resolve old task creation as success after a new login', async () => {
+    projects = [ready]
+    await store.refreshProjects()
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/projects/host-1/conversations' ? old.promise : previous(path, init)
+    const pending = store.createTask()
+    auth.beginSession()
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response(task('alice-created')))
+    await expect(pending).rejects.toThrow(/登录状态/)
+    expect(store.getState().currentConvId).toBeNull()
+  })
+
+  it('does not return a previous account attachment ID when artifact refresh finishes after login', async () => {
+    projects = [ready]
+    await store.refreshProjects()
+    const old = deferred<Response>()
+    const started = deferred<void>()
+    const previous = route
+    route = (path, init) => {
+      if (path.endsWith('/uploads')) return Promise.resolve(response({ artifactId: 'alice-upload', filename: 'alice.txt', size: 3 }))
+      if (path.endsWith('/artifacts')) { started.resolve(); return old.promise }
+      return previous(path, init)
+    }
+    const pending = store.uploadAttachment(new File(['abc'], 'alice.txt'))
+    await started.promise
+    auth.beginSession()
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response([]))
+    expect(await pending).toBeNull()
+  })
+})
Author	SHA1	Message	Date
weichen	40c2afe054	Merge the upstream member command rename Why: Current main carries the same corrected lowercase command ID as this member candidate. Evidence: Preserve the canonical wrapper and set-role ID; compare the final tree against the independently tested `2ba275b` object. Impact: Update ancestry only; no intended product behavior change. Refs: Frontend PR83; project-member-access	2026-10-13 11:35:36 +00:00
weichen	42cda9c056	Merge pull request 'Rename member setRole command call to set-role' (#83 ) from fix/set-role-rename into main	2026-10-13 11:03:41 +00:00
weichen	15b962694b	Merge origin/main	2026-10-13 11:03:27 +00:00
weichen	67585c1701	Rename member setRole command call to set-role Why: RDM 命令 ID 契约改名（camelCase 违基座校验，RDM 仓同批修复）；前端调用点同步。 Evidence: tsc 通过。 Impact: 单处命令 ID。	2026-10-13 10:50:36 +00:00
weichen	2ba275b991	Keep document duties tied to the current selection Why: Fresh documents had no first-submit action, reading active duties opened confirmation dialogs, and delayed detail or status queries could overwrite another selection and send its document ID with the wrong duty draft. Evidence: SELF real-browser regressions observed the missing action, render-time dialogs, detail/status races, and a follow-up query after panel unmount. Five focused Playwright scenarios passed after the fix, together with the full npm test, npm run build, and git diff --check commands. Receipts: /tmp/project-member-duties-browser-green-20261013.json and /tmp/project-member-duties-full-build-green-20261013.json. Impact: Offer first submission independently of an existing review round. Ask for invalidation only on a dirty save click. Guard queries and continuations with project lifetime, selection, and request sequences; keep the existing Picker, canonical project routing, controls, and UI tokens. Refs: Dev project-member-access Task 4; independent synchronized Frontend P2 review	2026-10-13 10:21:37 +00:00
weichen	e7f9081a93	Merge current project picker and permission panels Why: Current main supplies member pickers and duty catalogs that must keep verified project identity. Evidence: Frontend 259 tests and build pass after resolving panel conflicts; final canonical set-role dispatch and fixed combo checks follow. Impact: Preserve upstream panels with canonical project commands and read-versus-work state guards. Refs: feature/project-member-access; origin/main `c294835`	2026-10-13 10:02:54 +00:00
weichen	c294835f8d	Merge pull request 'Rebuild duties and permission pages on catalog, matrix and tri-state' (#81 ) from feature/rdm-increment-duties-page into main	2026-10-13 09:56:49 +00:00
weichen	07a03ac4f6	Preserve project history reads after archive or closure Why: Project readiness is a write gate. Applying it to member, permission, and document status queries hides history that the backend intentionally keeps readable after archival or closure. Evidence: SELF archived and closed read regressions failed before the fix. Full npm test, npm run build, and git diff --check passed with the amended code. Receipts: /tmp/project-member-frontend-archived-read-red-20261013.json and /tmp/project-member-frontend-archived-read-green-20261013.json. Impact: Resolve canonical project IDs separately from command readiness. Preserve known read commands and existing settings tabs for historical projects; keep mutations and new work blocked with existing disabled controls. Server authorization remains authoritative. Refs: Dev project-member-access Task 4; independent Frontend review P2	2026-10-13 08:41:12 +00:00
weichen	d69009e081	Invalidate account continuations across awaited project work Why: An identity can change after an operation has passed its first response guard. Later project loads, cleanup calls, and attachment refreshes must not reopen private context or return the previous account's result to the new session. Evidence: SELF regressions failed before the guards: delayed project opening, task creation success, completed-card cleanup, and upload artifact-ID return. SELF npm test, npm run build, and git diff --check passed; full command receipt: /tmp/project-member-frontend-final-checks-20261013.json. Impact: Guard post-await continuations with the same identity epoch. Preserve the original server-side result and ignore stale client projections; do not undo the previous account's already completed work. Refs: Dev feature-project-member-access implementation plan Task 4	2026-10-13 08:24:06 +00:00
weichen	55a64f40e8	Respect canonical project bindings and isolate account state Why: Project members need RDM commands to address the registered domain project. Failed project states and responses from a previous account must not create work, report a rejected mutation as successful, or restore private content. Evidence: SELF npm test: 32 files and 251 tests passed, including project command, mutation rejection, archived history, and delayed account response coverage. SELF npm run build and git diff --check passed. Original regressions were observed before implementation; root owns composition and independent replay. Impact: Keep host IDs for conversation and base settings APIs; send the decorated domain ID to RDM project commands. Reuse existing sidebar, settings and toast states. Reset identity projections and invalidate old asynchronous responses. No deployment, database change, push, merge, or workspace cleanup. Refs: Dev feature-project-member-access task card and implementation plan Task 4	2026-10-13 08:20:44 +00:00