Merge pull request 'Use verified project identities for member workflows' (#82 ) from feature/project-member-access into main

Merge the upstream member command rename
Why: Current main carries the same corrected lowercase command ID as this member candidate. Evidence: Preserve the canonical wrapper and set-role ID; compare the final tree against the independently tested 2ba275b object. Impact: Update ancestry only; no intended product behavior change. Refs: Frontend PR83; project-member-access
2026-10-13 11:52:27 +00:00 · 2026-10-13 11:35:36 +00:00 · 2026-10-13 11:03:41 +00:00 · 2026-10-13 11:03:27 +00:00 · 2026-10-13 10:50:36 +00:00 · 2026-10-13 10:21:37 +00:00
12 changed files with 1291 additions and 204 deletions
@@ -0,0 +1,160 @@
+// Real React/Picker interaction with deterministic HTTP responses; no live account or database.
+import { test, expect, type Page } from '@playwright/test'
+
+test.skip(!process.env.PLAYWRIGHT_BASE_URL, 'set PLAYWRIGHT_BASE_URL to an isolated frontend server')
+
+function deferred() {
+  let resolve!: () => void
+  const promise = new Promise<void>(ok => { resolve = ok })
+  return { promise, resolve }
+}
+
+async function dutiesPage(page: Page) {
+  const writes: { command: string; params: Record<string, unknown> }[] = []
+  const calls: { command: string; params: Record<string, unknown> }[] = []
+  const holds = new Map<string, { started: ReturnType<typeof deferred>; release: ReturnType<typeof deferred> }>()
+  const active = new Set<string>()
+  const submissions: Record<string, unknown> = { 'doc-A': null, 'doc-B': null }
+  const commands = ['rdm.project.member.list', 'rdm.project.member.add', 'rdm.project.member.remove',
+    'rdm.duty.catalog', 'rdm.duty.get', 'rdm.review.assign.doc', 'rdm.review.assign.doc.batch',
+    'rdm.review.doc.submit', 'rdm.review.doc.approve', 'rdm.review.doc.reject', 'rdm.review.doc.final', 'rdm.review.doc.status']
+  const docs = [
+    { docId: 'doc-A', title: '文档A', typeKey: 'design', sections: 1, assigned: true, author: 'alice', reviewers: ['carol'], approver: 'dave' },
+    { docId: 'doc-B', title: '文档B', typeKey: 'design', sections: 1, assigned: true, author: 'bob', reviewers: ['carol'], approver: 'dave' },
+  ]
+  await page.route('**/api/**', async route => {
+    const request = route.request()
+    const path = new URL(request.url()).pathname
+    let body: unknown = []
+    if (path === '/api/health') body = { ok: true }
+    else if (path === '/api/me') body = { owner: 'alice', name: 'Alice', auth: true, isAdmin: true }
+    else if (path === '/api/projects') body = [{ id: 'host-1', name: '职责测试项目', createdAt: '', updatedAt: '',
+      settings: { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready' } }]
+    else if (path === '/api/settings') body = { schema: [], defaults: {}, user: {}, project: {} }
+    else if (path === '/api/commands') body = commands.map(id => ({ id, enabled: true }))
+    else if (path.startsWith('/api/commands/')) {
+      const command = decodeURIComponent(path.substring('/api/commands/'.length))
+      const params = request.postDataJSON().params as Record<string, unknown>
+      expect(params.projectId).toBe('domain-7')
+      calls.push({ command, params })
+      const hold = holds.get(`${command}:${params.docId ?? ''}`)
+      if (hold) { hold.started.resolve(); await hold.release.promise }
+      let payload: unknown = {}
+      if (command === 'rdm.duty.catalog') payload = { docs }
+      else if (command === 'rdm.project.member.list') payload = { members: ['alice', 'bob', 'carol', 'dave'].map(owner => ({ owner, role: 'member', addedBy: '', addedAt: '' })) }
+      else if (command === 'rdm.duty.get') {
+        const doc = docs.find(d => d.docId === params.docId)!
+        payload = { docId: doc.docId, title: doc.title, assigned: doc.assigned,
+          roles: { author: doc.author, reviewers: doc.reviewers, approver: doc.approver }, sections: [],
+          active: active.has(doc.docId) ? { round: 1, state: 'submitted', createdBy: 'alice' } : null }
+      } else if (command === 'rdm.review.doc.status') payload = { submission: submissions[String(params.docId)] }
+      else { writes.push({ command, params }) }
+      body = { payload }
+    } else if (path.endsWith('/cards')) body = { cards: [] }
+    await route.fulfill({ contentType: 'application/json', body: JSON.stringify(body) })
+  })
+  await page.goto('/')
+  await page.getByRole('button', { name: '项目设置', exact: true }).click()
+  await page.getByRole('tab', { name: /文档职责/ }).click()
+  await expect(page.getByRole('button', { name: '文档A', exact: true })).toBeVisible()
+  return { writes, calls, active, submissions,
+    hold(command: string, docId: string) {
+      const pending = { started: deferred(), release: deferred() }
+      holds.set(`${command}:${docId}`, pending)
+      return pending
+    } }
+}
+
+async function chooseMember(page: Page, label: string, owner: string) {
+  await page.locator(`.picker[aria-label="${label}"]`).getByRole('combobox').fill(owner)
+  await page.getByRole('option', { name: new RegExp(`^${owner}`) }).click()
+}
+
+async function settleResponse(page: Page, command: string, release: () => void) {
+  const response = page.waitForResponse(r => r.url().endsWith(`/api/commands/${command}`))
+  release()
+  await response
+  await page.evaluate(() => new Promise<void>(done => requestAnimationFrame(() => requestAnimationFrame(() => done()))))
+}
+
+test('a newly assigned document can submit its first whole-document review', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await expect(page.getByText('该文档尚无整文提交记录（当前职责仍可分配）。', { exact: true })).toBeVisible()
+  const submit = page.getByRole('button', { name: '整文提交（编制人）', exact: true })
+  await expect(submit).toBeEnabled()
+  await submit.click()
+  await expect(page.getByText('整文已提交审核（全文锁定）', { exact: true })).toBeVisible()
+  expect(fixture.writes).toEqual([{ command: 'rdm.review.doc.submit', params: { projectId: 'domain-7', docId: 'doc-A' } }])
+})
+
+test('viewing active duties is passive; only a dirty save asks for confirmation', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  fixture.active.add('doc-A')
+  const dialogs: string[] = []
+  let accept = false
+  page.on('dialog', async dialog => { dialogs.push(dialog.message()); accept ? await dialog.accept() : await dialog.dismiss() })
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await expect(page.getByRole('heading', { name: /文档A · 当前职责/ })).toBeVisible()
+  const save = page.getByRole('button', { name: '保存当前职责', exact: true })
+  await expect(save).toBeDisabled()
+  expect(dialogs).toEqual([])
+  await chooseMember(page, '编制人', 'bob')
+  await expect(save).toBeEnabled()
+  expect(dialogs).toEqual([])
+  await save.click()
+  expect(dialogs).toHaveLength(1)
+  expect(fixture.writes).toEqual([])
+  accept = true
+  await save.click()
+  await expect(page.getByText('已保存当前职责', { exact: true })).toBeVisible()
+  expect(dialogs).toHaveLength(2)
+  expect(fixture.writes).toEqual([{ command: 'rdm.review.assign.doc', params: {
+    projectId: 'domain-7', docId: 'doc-A', author: 'bob', reviewers: ['carol'], approver: 'dave',
+  } }])
+})
+
+test('a late document detail cannot overwrite another selection or its saved roles', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  const old = fixture.hold('rdm.duty.get', 'doc-A')
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await old.started.promise
+  await page.getByRole('button', { name: '文档B', exact: true }).click()
+  await expect(page.getByRole('heading', { name: '文档B · 当前职责', exact: true })).toBeVisible()
+  await settleResponse(page, 'rdm.duty.get', old.release.resolve)
+  await expect(page.getByRole('heading', { name: '文档B · 当前职责', exact: true })).toBeVisible()
+  expect(fixture.calls.filter(c => c.command === 'rdm.review.doc.status' && c.params.docId === 'doc-A')).toEqual([])
+  await chooseMember(page, '批准人', 'alice')
+  await page.getByRole('button', { name: '保存当前职责', exact: true }).click()
+  await expect(page.getByText('已保存当前职责', { exact: true })).toBeVisible()
+  expect(fixture.writes).toEqual([{ command: 'rdm.review.assign.doc', params: {
+    projectId: 'domain-7', docId: 'doc-B', author: 'bob', reviewers: ['carol'], approver: 'alice',
+  } }])
+})
+
+test('a late review status cannot replace the selected document frozen review', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  const submission = (round: number, author: string) => ({ round, state: 'submitted', digest: '', createdBy: author,
+    createdAt: '', duties: { author, reviewers: ['carol'], approver: 'dave' }, reviews: {}, sections: {} })
+  fixture.submissions['doc-A'] = submission(1, 'alice')
+  fixture.submissions['doc-B'] = submission(2, 'bob')
+  const old = fixture.hold('rdm.review.doc.status', 'doc-A')
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await old.started.promise
+  await page.getByRole('button', { name: '文档B', exact: true }).click()
+  await expect(page.getByRole('heading', { name: /整文审签 · 第 2 轮/ })).toBeVisible()
+  await settleResponse(page, 'rdm.review.doc.status', old.release.resolve)
+  await expect(page.getByRole('heading', { name: /整文审签 · 第 2 轮/ })).toBeVisible()
+  await expect(page.getByRole('heading', { name: /整文审签 · 第 1 轮/ })).toHaveCount(0)
+})
+
+test('closing the project panel invalidates a pending detail before its follow-up status read', async ({ page }) => {
+  const fixture = await dutiesPage(page)
+  const old = fixture.hold('rdm.duty.get', 'doc-A')
+  await page.getByRole('button', { name: '文档A', exact: true }).click()
+  await old.started.promise
+  await page.getByRole('dialog').getByRole('button', { name: '关闭', exact: true }).click()
+  await expect(page.getByRole('tab', { name: /文档职责/ })).toHaveCount(0)
+  await settleResponse(page, 'rdm.duty.get', old.release.resolve)
+  expect(fixture.calls.filter(c => c.command === 'rdm.review.doc.status' && c.params.docId === 'doc-A')).toEqual([])
+})
@@ -77,7 +77,7 @@ export function App() {
    const h = (e: KeyboardEvent) => {
      if (authState === 'ok' && (e.metaKey || e.ctrlKey)) {
        const key = e.key.toLowerCase()
-        if (key === 'n') { e.preventDefault(); store.createTask().then(conversationOpened); return }
+        if (key === 'n') { e.preventDefault(); store.createTask().then(conversationOpened).catch(() => undefined); return }
        if (key === 'b') { e.preventDefault(); openContext(); return }
      }
      workspaceShortcuts(e)
@@ -114,10 +114,14 @@ export function App() {
    // me 回填进 store：管理入口（me?.isAdmin）与侧栏身份都消费它；此前只有
    // 改密门 onDone 调 refreshMe，登录与刷新回态后 me 恒为 null，管理员菜单
    // 在任何一次 F5 后永久消失（2026-10-12「用户管理页面不可用」根因）。
-    store.refreshMe()
-    store.refreshProjects()
-    store.refreshProfiles()
-    store.refreshPlugins()
+    let active = true
+    store.refreshMe().then(() => {
+      if (!active) return
+      void store.refreshProjects()
+      void store.refreshProfiles()
+      void store.refreshPlugins()
+    })
+    return () => { active = false }
  }, [authState])

  const drag = useRef<{ side: 'left' | 'right'; startX: number; startW: number; overshoot: boolean; min: number; max: number; key: 'leftWidth' | 'rightWidth' | 'previewWidth' } | null>(null)
@@ -1,6 +1,7 @@
 // API 客户端（API-first：UI 只是第一个客户端）与 SSE 流客户端（游标重放 + 终态对账）。
 // 认证：服务端开启 API key 时经 auth.fetch/withKey 注入凭证（嵌入式档无认证则透传）。
 import { auth } from './auth'
+import { rdmCommandProjectId, rdmProjectCommandError } from './rdmManagement'
 import type {
  Project, Conversation, Message, Run, Artifact, HITLCard, HITLResponse,
  AgentProfile, SettingDesc, StreamEvent, StreamEventType, PlanSnapshot, TodoList, UploadInfo, PromptModule,
@@ -14,11 +15,16 @@ const BASE = ''
 *  自身命令面 fail-closed。 */
 export interface AdminZoneSection { id: string; title: string; icon?: string; desc?: string; order?: number }

-async function json<T>(res: Response): Promise<T> {
+async function checked(res: Response): Promise<Response> {
  if (!res.ok) {
    const text = await res.text()
    throw new Error(`${res.status}: ${text}`)
  }
+  return res
+}
+
+async function json<T>(res: Response): Promise<T> {
+  await checked(res)
  return res.json() as Promise<T>
 }

@@ -26,7 +32,7 @@ export const api = {
  listProjects: () => auth.fetch(`${BASE}/api/projects`).then(r => json<Project[]>(r)),
  createProject: (name: string) => auth.fetch(`${BASE}/api/projects`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name }) }).then(r => json<Project>(r)),
  renameProject: (id: string, name: string) => auth.fetch(`${BASE}/api/projects/${id}`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ name }) }).then(r => json<Project>(r)),
-  deleteProject: (id: string) => auth.fetch(`${BASE}/api/projects/${id}`, { method: 'DELETE' }),
+  deleteProject: (id: string) => auth.fetch(`${BASE}/api/projects/${id}`, { method: 'DELETE' }).then(checked),

  listConversations: (projectId: string) => auth.fetch(`${BASE}/api/projects/${projectId}/conversations`).then(r => json<Conversation[]>(r)),
  // 跨项目任务列表（方案 A 侧栏）：默认仅未归档；includeArchived 含归档。
@@ -46,15 +52,23 @@ export const api = {
  // ---- 认证与会话（管理员发放制，R2）----
  login: (owner: string, password: string) => auth.fetch(`${BASE}/api/auth/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, password }) }).then(async r => {
    if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
-    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }>
+    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }
+    auth.beginSession()
+    return me
  }),
  // 一次性登录 Key 兑换（恢复/激活）：请求只带 Key，身份由服务端绑定记录决定；
  // 成功建立 set_password_only 受限会话（HttpOnly cookie），明文 Key 不落任何存储。
  redeemLoginKey: (key: string) => auth.fetch(`${BASE}/api/auth/login-key/redeem`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ key }) }).then(async r => {
    if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
-    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }>
+    const me = await r.json() as { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; passwordSet: boolean; sessionScope: string }
+    auth.beginSession()
+    return me
  }),
-  logout: () => auth.fetch(`${BASE}/api/auth/logout`, { method: 'POST' }),
+  logout: () => {
+    const request = auth.fetch(`${BASE}/api/auth/logout`, { method: 'POST' })
+    auth.clear()
+    return request
+  },
  changePassword: (current: string, next: string) => auth.fetch(`${BASE}/api/auth/password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ current, next }) }).then(async r => {
    if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; reloginRequired: boolean }>
@@ -125,7 +139,7 @@ export const api = {
  getSettings: (projectId?: string) => auth.fetch(`${BASE}/api/settings${projectId ? '?project=' + projectId : ''}`).then(r =>
    json<{ schema: SettingDesc[]; defaults: Record<string, unknown>; user: Record<string, unknown>; project: Record<string, unknown> }>(r)),
  putUserSettings: (values: Record<string, unknown>) => auth.fetch(`${BASE}/api/settings/user`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(values) }),
-  putProjectSettings: (projectId: string, values: Record<string, unknown>) => auth.fetch(`${BASE}/api/settings/project/${projectId}`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(values) }),
+  putProjectSettings: (projectId: string, values: Record<string, unknown>) => auth.fetch(`${BASE}/api/settings/project/${projectId}`, { method: 'PUT', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify(values) }).then(checked),
  // P2 系统管理面：受管项（models/tavily/telemetry/运行基础设施）的唯一写入面。
  getSystemSettings: () => auth.fetch(`${BASE}/api/settings/system`).then(r =>
    json<{ schema: SettingDesc[]; defaults: Record<string, unknown>; system: Record<string, unknown> }>(r)),
@@ -154,6 +168,11 @@ export const api = {

  // ---- U4：RDM 命令总线封装（POST /api/commands/{id}，同 RDM web 的 command 路由） ----
  // receipt 解包：rejected 抛错；confirm-card 抛提示（审计面只读命令不应触发）。
+  rdmProjectCommand: async <T = any>(project: Project, id: string, params: Record<string, unknown> = {}): Promise<T> => {
+    const error = rdmProjectCommandError(project, id)
+    if (error) throw new Error(error)
+    return api.rdmCommand<T>(id, { ...params, projectId: rdmCommandProjectId(project) })
+  },
  rdmCommand: <T = any>(id: string, params: Record<string, unknown> = {}): Promise<T> =>
    auth.fetch(`${BASE}/api/commands/${encodeURIComponent(id)}`, {
      method: 'POST', headers: { 'Content-Type': 'application/json' },
@@ -17,11 +17,22 @@ function pickStorage(): KV {
 }

 const storage = pickStorage()
+const identityListeners = new Set<() => void>()
+function identityChanged() { identityListeners.forEach(listener => listener()) }

 export const auth = {
  apiKey(): string { return storage.getItem(KEY) ?? '' },
-  setKey(key: string) { storage.setItem(KEY, key.trim()) },
-  clear() { storage.removeItem(KEY) },
+  setKey(key: string) {
+    const next = key.trim()
+    if (next === this.apiKey()) return
+    storage.setItem(KEY, next)
+    identityChanged()
+  },
+  clear() { storage.removeItem(KEY); identityChanged() },
+  onIdentityChange(listener: () => void) {
+    identityListeners.add(listener)
+    return () => { identityListeners.delete(listener) }
+  },
  // 密码登录成功后切换到 HttpOnly 会话 cookie：必须清掉残留 Bearer——服务端
  // 认证中间件 Bearer 优先于会话 cookie，失效残留 key 会把有效会话也判成 401。
  beginSession() { this.clear() },
@@ -33,7 +44,7 @@ export const auth = {
    headers.set('Authorization', `Bearer ${key}`)
    return fetch(input, { ...init, headers })
  },
-  // 退出登录：清凭证并整页回登录门（服务端会话/密钥均为无状态凭证，无需服务端注销）。
+  // 退出登录：立即清客户端投影并回登录门；调用者先经 api.logout 注销服务端会话。
  logout() {
    this.clear()
    try { location.reload() } catch { /* 非 DOM 环境（测试）忽略 */ }
@@ -2,7 +2,6 @@
 // LoginPage —— 用户名+密码（默认入口）/ 一次性登录 Key（忘记密码恢复，只输 Key）；
 // ChangePasswordGate —— 受限会话强制设密（恢复/首登同形：只输新密码，完成前不放行）。
 import { useState } from 'react'
-import { auth } from '../auth'
 import { api } from '../api'
 import { Icon, BrandMark } from '@ui'

@@ -43,8 +42,6 @@ export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; on
    setErr(''); setBusy(true)
    try {
      const me = await api.login(owner.trim(), password)
-      // 会话凭证是 HttpOnly cookie；清残留 Bearer，避免其遮蔽有效会话。
-      auth.beginSession()
      // 受限会话（must-change 首登）或正常会话都由后端 sessionScope 声明；
      // 受限会话先进设密门，完成前不放行。
      if (me.sessionScope === 'set_password_only' || me.mustChangePassword) {
@@ -62,7 +59,6 @@ export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; on
    try {
      // 只提交 Key：目标账户由服务端绑定记录确定，客户端不能指定身份。
      const me = await api.redeemLoginKey(key.trim())
-      auth.beginSession()
      if (me.sessionScope === 'set_password_only' || me.mustChangePassword) {
        onMustChange(me.owner)
        return
@@ -8,6 +8,8 @@ import type { SettingDesc } from '../contracts'
 import { SettingsShell, Btn, EmptyState } from '@ui'
 import { SettingInput, flatten, unflatten, groupNames } from './SettingsModal'
 import { RdmMembersSection, RdmDutiesSection, RdmPermMatrixSection } from './adminRdmSections'
+import { rdmProjectReadError } from '../rdmManagement'
+import { projectActionError, projectWorkError } from '../projectmeta'

 export function ProjectSettingsModal() {
  const projectId = useStore(s => s.ui.projectSettingsId)
@@ -16,21 +18,26 @@ export function ProjectSettingsModal() {
  const rdmMembersAvailable = useStore(s => s.rdmMembersAvailable)
  const rdmDocReviewAvailable = useStore(s => s.rdmDocReviewAvailable)
  const rdmPermMatrixAvailable = useStore(s => s.rdmPermMatrixAvailable)
+  const owner = useStore(s => s.me?.owner)
  const [tab, setTab] = useState('project')
  const [schema, setSchema] = useState<SettingDesc[]>([])
  const [draft, setDraft] = useState<Record<string, any>>({})
  const [loaded, setLoaded] = useState(false)
  const [saved, setSaved] = useState(false)
+  const [error, setError] = useState('')

  useEffect(() => {
    if (!projectId) return
-    setLoaded(false)
+    let active = true
+    setLoaded(false); setSaved(false); setError(''); setDraft({}); setSchema([])
    api.getSettings(projectId).then(s => {
+      if (!active) return
      setSchema(s.schema)
      setDraft(flatten(s.project))
      setLoaded(true)
-    }).catch(() => undefined)
-  }, [projectId])
+    }).catch(() => { if (active) setError('项目设置未能加载，请关闭后重新打开或联系项目负责人') })
+    return () => { active = false }
+  }, [projectId, owner])

  const groups = useMemo(() => {
    const g: Record<string, SettingDesc[]> = {}
@@ -39,15 +46,19 @@ export function ProjectSettingsModal() {
  }, [schema])

  if (!projectId) return null
+  const rdmError = rdmProjectReadError(project)
+  const writeError = projectWorkError(project)
+  const rdmTab = tab === 'members' || tab === 'duties' || tab === 'matrix'

  const save = async () => {
    if (!projectId) return
+    if (writeError) { store.toast(writeError); return }
    try {
      await api.putProjectSettings(projectId, unflatten(draft))
      setSaved(true)
      setTimeout(() => setSaved(false), 1500)
    } catch (e) {
-      store.toast(`项目设置保存失败：${e}`)
+      store.toast(`项目设置保存失败：${projectActionError(e)}`)
    }
  }

@@ -64,18 +75,20 @@ export function ProjectSettingsModal() {
        ...(rdmDocReviewAvailable ? [{ key: 'duties', label: '文档职责 · 整文审签', icon: 'shield' as const }] : []),
        ...(rdmPermMatrixAvailable ? [{ key: 'matrix', label: '项目权限', icon: 'key' as const }] : []),
      ]}
-      footer={saved ? <span style={{ color: 'var(--ok)' }}>✓ 已保存</span> : '项目设置覆盖用户设置（new-run 类对新任务生效）'}
+      footer={saved ? <span style={{ color: 'var(--ok-text)' }}>✓ 已保存</span> : '项目设置覆盖用户设置（new-run 类对新任务生效）'}
    >
      <div>
-        {tab === 'members' && <RdmMembersSection projectId={projectId} />}
-        {tab === 'duties' && <RdmDutiesSection projectId={projectId} />}
-        {tab === 'matrix' && <RdmPermMatrixSection projectId={projectId} />}
+        {rdmTab && rdmError ? <EmptyState icon="folder">{rdmError}</EmptyState> : project && <>
+          {tab === 'members' && <RdmMembersSection key={project.id} project={project} />}
+          {tab === 'duties' && <RdmDutiesSection key={project.id} project={project} />}
+          {tab === 'matrix' && <RdmPermMatrixSection key={project.id} project={project} />}
+        </>}
        {tab !== 'members' && tab !== 'duties' && tab !== 'matrix' && !loaded ? (
-          <EmptyState icon="settings">加载中…</EmptyState>
+          <EmptyState icon="settings">{error || '加载中…'}</EmptyState>
        ) : tab !== 'members' && tab !== 'duties' && tab !== 'matrix' ? (
          <>
            <div className="empty-note" style={{ marginBottom: 10 }}>
-              此处仅保存本项目的覆盖值；留空即沿用用户/系统设置。跨会话读取在「会话协作」组。
+              {writeError ?? '此处仅保存本项目的覆盖值；留空即沿用用户/系统设置。跨会话读取在「会话协作」组。'}
            </div>
            {Object.entries(groups).map(([g, descs]) => (
              <div className="settings-group" key={g}>
@@ -91,7 +104,7 @@ export function ProjectSettingsModal() {
                ))}
              </div>
            ))}
-            <Btn variant="primary" icon="check" onClick={save}>保存项目设置</Btn>
+            <Btn variant="primary" icon="check" disabled={!!writeError} onClick={save}>保存项目设置</Btn>
          </>
        ) : null}
      </div>
@@ -7,7 +7,7 @@ import { api } from '../api'
 import { Icon } from '@ui'
 import type { Conversation } from '../contracts'
 import { relativeTime, filterTasks } from '../tasklist'
-import { projectStage } from '../projectmeta'
+import { projectStage, projectStateLabel, projectWorkError } from '../projectmeta'
 import { buildWorkspaceEntries } from '../workspaces'

 /** 小型弹出菜单：锚点下方渲染，点击外部关闭。 */
@@ -68,8 +68,10 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
  const [newProjectName, setNewProjectName] = useState('')

  const createConversation = async (projectId?: string) => {
-    await store.createTask(projectId)
-    onConversationOpen?.()
+    try {
+      await store.createTask(projectId)
+      onConversationOpen?.()
+    } catch { /* store owns the actionable failure toast */ }
  }

  const tools = buildWorkspaceEntries(serverWorkspaces, { rdmAudit: rdmAuditAvailable })
@@ -77,7 +79,8 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
  const pinned = visible.filter(t => t.pinned)
  const rest = visible.filter(t => !t.pinned)
  const currentProject = projects.find(p => p.id === currentProjectId)
-  const stage = projectStage(currentProject?.settings)
+  const stage = projectStateLabel(currentProject?.settings) ?? projectStage(currentProject?.settings)
+  const workError = currentProject ? projectWorkError(currentProject) : null
  const rowTask = menu?.kind.startsWith('row:') ? tasks.find(t => t.id === menu.kind.slice(4)) : null
  const rowMenuAnchor = menu && menu.kind.startsWith('row:') ? menu.anchor : null

@@ -162,8 +165,10 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
              onChange={e => setNewProjectName(e.target.value)}
              onKeyDown={async e => {
                if (e.key === 'Enter' && newProjectName.trim()) {
-                  await store.createProject(newProjectName.trim())
-                  setCreatingProject(false); setNewProjectName('')
+                  try {
+                    await store.createProject(newProjectName.trim())
+                    setCreatingProject(false); setNewProjectName('')
+                  } catch { /* keep the input available for a corrected name */ }
                }
                if (e.key === 'Escape') setCreatingProject(false)
              }}
@@ -179,7 +184,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
        )}

        {rest.length === 0 && pinned.length === 0 && (
-          <div className="tsb-empty">从「新建对话」开始，描述你想完成的工作。</div>
+          <div className="tsb-empty">{workError ?? '从「新建对话」开始，描述你想完成的工作。'}</div>
        )}
        {rest.map(t => taskRow(t))}
      </div>
@@ -224,7 +229,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
      <Menu anchor={menu?.kind === 'project' ? menu.anchor : null} onClose={() => setMenu(null)}>
        {projects.map(p => {
          const count = tasks.filter(t => t.projectId === p.id && !t.archived).length
-          const pstage = projectStage(p.settings)
+          const pstage = projectStateLabel(p.settings) ?? projectStage(p.settings)
          return (
            <MenuItem key={p.id} icon="folder" onClick={() => { switchProject(p.id); setMenu(null) }}>
              {p.name}
@@ -3,14 +3,16 @@
 // 门控集中在 src/rdmManagement.ts；分区可见性由 AdminZone/ProjectSettingsModal
 // 按 store 的 rdm*Available 门控（命令面不齐不渲染，普通基座零暴露）。样式只复用
 // 既有 ad-*/lg-*/settings-* 类（design-guard 棘轮：不新增裸色值/字号）。
-import { useEffect, useState } from 'react'
+import { useEffect, useState, useRef, useCallback } from 'react'
 import { api } from '../api'
+import type { Project } from '../contracts'
+import { projectWorkError } from '../projectmeta'
 import { useStore } from '../store'
-import { Btn, EmptyState, Icon } from '@ui'
+import { Btn, Collapsible, EmptyState, Icon, Picker } from '@ui'
 import {
-  ROLE_ACTIONS, parseReviewers,
+  ROLE_ACTIONS,
  roleCreatePayload, roleActionPayload, roleAssignPayload, roleDisablePayload,
-  memberAddPayload, memberRemovePayload,
+  memberAddPayload, memberRemovePayload, memberSetRolePayload,
  assignDocDutiesPayload, docSubmitPayload, docApprovePayload, docRejectPayload,
  docFinalPayload, docStatusPayload, permCheckPayload, describeSource,
  rolesListPlaceholder, describeRoleListError,
@@ -144,25 +146,54 @@ export function RdmRolesPanel() {
  )
 }

-// ---- 项目设置：成员 ----
+// ---- 项目设置：成员（P7：可搜索人员选择器 + 专业角色/项目身份两列 + 显式身份调整）----

-interface MemberRow { owner: string; role: string; addedBy: string; addedAt: string }
+interface MemberRow {
+  owner: string; role: string; addedBy: string; addedAt: string
+  profRole?: { roleId: string; name: string } | null
+}

-export function RdmMembersSection({ projectId }: { projectId: string }) {
+export function RdmMembersSection({ project }: { project: Project }) {
+  const projectId = project.id
+  const writeError = projectWorkError(project)
+  const cmd = <T,>(id: string, params: Record<string, unknown> = {}) => api.rdmProjectCommand<T>(project, id, params)
  const [rows, setRows] = useState<MemberRow[] | null>(null)
  const [err, setErr] = useState('')
  const [notice, setNotice] = useState('')
  const [busy, setBusy] = useState(false)
-  const [member, setMember] = useState('')
+  const [picked, setPicked] = useState<string[]>([])
  const [role, setRole] = useState<'member' | 'owner'>('member')
+  // 成员表经 ref 参与取数（已加入标记），保持 fetchPage 身份稳定（Picker 依赖）。
+  const rowsRef = useRef<MemberRow[] | null>(null)
+  rowsRef.current = rows
+
+  /** 人员选择器取数适配（P7-A）：rdm.account.list 目录（member.manage 生效者）。
+   * query 透传后端（基座升级 AccountSearcher 后全量生效）；旧基座忽略 query 时
+   * 对首页做本地包含匹配降级（翻页为浏览模式，不过滤）。 */
+  const fetchPage = useCallback(async (query: string, cursor: string, limit: number) => {
+    const out = await cmd<{ accounts?: { owner: string; name?: string; valid: boolean }[]; next?: string }>(
+      'rdm.account.list', { projectId, cursor, limit, query })
+    const joined = new Set((rowsRef.current ?? []).map(m => m.owner))
+    let items = (out.accounts ?? []).filter(a => a.valid).map(a => ({
+      id: a.owner,
+      title: a.name || a.owner,
+      subtitle: a.owner,
+      badge: joined.has(a.owner) ? '已加入' : undefined,
+    }))
+    if (query !== '' && cursor === '') {
+      const q = query.toLowerCase()
+      items = items.filter(it => it.id.toLowerCase().includes(q) || it.title.toLowerCase().includes(q))
+    }
+    return { items, nextCursor: out.next || undefined }
+  }, [project])

  const refresh = async () => {
    try {
-      const out = await api.rdmCommand<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
+      const out = await cmd<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
      setRows(out.members ?? [])
    } catch (e) { setErr(String(e)) }
  }
-  useEffect(() => { refresh() }, [projectId])
+  useEffect(() => { setPicked([]); refresh() }, [project])

  const run = async (label: string, fn: () => Promise<unknown>) => {
    setErr(''); setNotice(''); setBusy(true)
@@ -170,40 +201,57 @@ export function RdmMembersSection({ projectId }: { projectId: string }) {
    catch (e) { setErr(String(e)) } finally { setBusy(false) }
  }

+  const pickedId = picked[0] ?? ''
+
  return (
    <div>
+      {writeError && <p className="ad-hint">{writeError}</p>}
      <div className="ad-create">
        <div className="ad-row">
-          <input className="lg-input lg-mono" placeholder="成员账号（owner）" value={member}
-            onChange={e => setMember(e.target.value)} />
+          <Picker
+            aria-label="选择人员"
+            selected={picked}
+            onSelect={setPicked}
+            fetchPage={fetchPage}
+            placeholder="输入账号或姓名，或浏览候选…"
+          />
          <select className="lg-input" value={role} onChange={e => setRole(e.target.value as 'member' | 'owner')}>
-            <option value="member">member（成员）</option>
-            <option value="owner">owner（负责人）</option>
+            <option value="member">项目成员</option>
+            <option value="owner">项目负责人</option>
          </select>
-          <button className="lg-submit ad-create-btn" disabled={busy || !member.trim()}
-            onClick={() => run(`已添加 ${member.trim()}`, async () => {
-              await api.rdmCommand('rdm.project.member.add', memberAddPayload(projectId, member.trim(), role))
-              setMember('')
+          <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || !pickedId}
+            onClick={() => run(`已添加 ${pickedId}`, async () => {
+              await cmd('rdm.project.member.add', memberAddPayload(projectId, pickedId, role))
+              setPicked([])
            })}>添加成员</button>
        </div>
-        <p className="ad-hint">加入后成员即可见本项目；移除即时生效。最后一位负责人不可移除/降级。</p>
+        <p className="ad-hint">候选来自系统账号目录（姓名为空时显示账号）；「已加入」标记避免重复添加造成隐式变更——调整身份请在成员表中操作。最后一位负责人不可移除/降级。</p>
      </div>
      <table className="ad-table">
-        <thead><tr><th>账号</th><th>项目角色</th><th>添加人</th><th>添加时间</th><th></th></tr></thead>
+        <thead><tr><th>成员</th><th>专业角色</th><th>项目身份</th><th>添加人</th><th>添加时间</th><th></th></tr></thead>
        <tbody>
          {(rows ?? []).map(m => (
            <tr key={m.owner}>
-              <td className="ad-mono">{m.owner}</td>
-              <td>{m.role === 'owner' ? <span className="ad-chip ad-chip-admin">OWNER</span> : <span className="ad-chip">MEMBER</span>}</td>
+              <td><span className="ad-mono">{m.owner}</span>{m.profRole?.name ? <span className="ad-dim"> · {m.profRole.name}</span> : null}</td>
+              <td className="ad-dim">{m.profRole?.name || '—'}</td>
+              <td>{m.role === 'owner' ? <span className="ad-chip ad-chip-admin">项目负责人</span> : <span className="ad-chip">项目成员</span>}</td>
              <td className="ad-dim">{m.addedBy || '—'}</td>
              <td className="ad-dim">{m.addedAt ? new Date(m.addedAt).toLocaleString() : '—'}</td>
-              <td><button className="ad-mini" disabled={busy}
-                onClick={() => run(`已移除 ${m.owner}`,
-                  () => api.rdmCommand('rdm.project.member.remove', memberRemovePayload(projectId, m.owner)))}>移除</button></td>
+              <td>
+                <button className="ad-mini" disabled={busy || !!writeError}
+                  title={m.role === 'owner' ? '降为项目成员（setRole）' : '升为项目负责人（setRole）'}
+                  onClick={() => run(`已调整 ${m.owner} 的项目身份`, () =>
+                    cmd('rdm.project.member.set-role', memberSetRolePayload(projectId, m.owner, m.role === 'owner' ? 'member' : 'owner')))}>
+                  {m.role === 'owner' ? '降为成员' : '升为负责人'}
+                </button>{' '}
+                <button className="ad-mini" disabled={busy || !!writeError}
+                  onClick={() => run(`已移除 ${m.owner}`,
+                    () => cmd('rdm.project.member.remove', memberRemovePayload(projectId, m.owner)))}>移除</button>
+              </td>
            </tr>
          ))}
-          {rows !== null && rows.length === 0 && <tr><td colSpan={5} className="ad-dim">暂无成员</td></tr>}
-          {rows === null && <tr><td colSpan={5} className="ad-dim">加载中…</td></tr>}
+          {rows !== null && rows.length === 0 && <tr><td colSpan={6} className="ad-dim">暂无成员</td></tr>}
+          {rows === null && <tr><td colSpan={6} className="ad-dim">加载中…</td></tr>}
        </tbody>
      </table>
      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
@@ -212,7 +260,7 @@ export function RdmMembersSection({ projectId }: { projectId: string }) {
  )
 }

-// ---- 项目设置：文档职责 · 整文审签 ----
+// ---- 项目设置：文档职责（P7-B：文档清单＋选中职责详情；方案 §4）----

 interface DocSubmissionView {
  round: number
@@ -225,87 +273,252 @@ interface DocSubmissionView {
  sections: Record<string, number>
 }

-export function RdmDutiesSection({ projectId }: { projectId: string }) {
+interface DutyCatalogDoc {
+  docId: string; typeKey: string; title: string; stage?: string; sections: number
+  assigned: boolean; author?: string; reviewers?: string[]; approver?: string; activeRound?: number
+}
+
+interface DutyGetOut {
+  docId: string; title: string; assigned: boolean
+  roles: { author: string; reviewers: string[]; approver: string }
+  active?: { round: number; state: string; createdBy: string } | null
+  sections: { sectionId: string; title: string; overridden: boolean }[]
+}
+
+/** 职责候选 = 当前项目成员（方案 §4：候选只能来自项目成员）。
+ * member.list 为小全量列表：本地 query 过滤 + 游标分页。 */
+function useMemberPickerPage(members: { owner: string; role: string }[] | null) {
+  return useCallback(async (query: string, cursor: string, limit: number) => {
+    const q = query.trim().toLowerCase()
+    const all = (members ?? [])
+      .filter(m => q === '' || m.owner.toLowerCase().includes(q))
+      .map(m => ({ id: m.owner, title: m.owner, subtitle: m.role === 'owner' ? '项目负责人' : '项目成员' }))
+    const start = cursor === '' ? 0 : all.findIndex(x => x.id === cursor) + 1
+    const page = all.slice(start, start + limit)
+    return {
+      items: page,
+      nextCursor: start + limit < all.length ? page[page.length - 1]?.id : undefined,
+    }
+  }, [members])
+}
+
+export function RdmDutiesSection({ project }: { project: Project }) {
+  const projectId = project.id
+  const writeError = projectWorkError(project)
+  const [docs, setDocs] = useState<DutyCatalogDoc[] | null>(null)
+  const [members, setMembers] = useState<{ owner: string; role: string }[] | null>(null)
  const [docId, setDocId] = useState('')
+  const [detail, setDetail] = useState<DutyGetOut | null | undefined>(undefined)
+  const [author, setAuthor] = useState<string[]>([])
+  const [reviewers, setReviewers] = useState<string[]>([])
+  const [approver, setApprover] = useState<string[]>([])
  const [sub, setSub] = useState<DocSubmissionView | null | undefined>(undefined)
+  const [batchSel, setBatchSel] = useState<Set<string>>(new Set())
+  const [batchAuthor, setBatchAuthor] = useState<string[]>([])
+  const [batchReviewers, setBatchReviewers] = useState<string[]>([])
+  const [batchApprover, setBatchApprover] = useState<string[]>([])
  const [err, setErr] = useState('')
  const [notice, setNotice] = useState('')
  const [busy, setBusy] = useState(false)
-  const [author, setAuthor] = useState('')
-  const [reviewers, setReviewers] = useState('')
-  const [approver, setApprover] = useState('')

-  const cmd = <T,>(id: string, params: Record<string, unknown>) => api.rdmCommand<T>(id, params)
+  const cmd = <T,>(id: string, params: Record<string, unknown>) => api.rdmProjectCommand<T>(project, id, params)
+  const memberPage = useMemberPickerPage(members)
+  const requests = useRef({ project, epoch: 0, selected: '', selection: 0, catalog: 0, status: 0, action: 0 })
+  requests.current.project = project
+  const currentProject = (epoch: number) => requests.current.project === project && requests.current.epoch === epoch
+  const currentDocument = (epoch: number, selection: number, id: string) =>
+    currentProject(epoch) && requests.current.selection === selection && requests.current.selected === id

-  const refreshStatus = async (id: string) => {
-    if (!id) return
+  const refreshCatalog = async (epoch = requests.current.epoch) => {
+    const request = ++requests.current.catalog
+    try {
+      const out = await cmd<{ docs: DutyCatalogDoc[] }>('rdm.duty.catalog', { projectId })
+      if (!currentProject(epoch) || request !== requests.current.catalog) return
+      setDocs(out.docs ?? [])
+    } catch (e) {
+      if (!currentProject(epoch) || request !== requests.current.catalog) return
+      setErr(String(e)); setDocs([])
+    }
+  }
+  const refreshStatus = async (id: string, epoch: number, selection: number) => {
+    if (!id || !currentDocument(epoch, selection, id)) return
+    const request = ++requests.current.status
    try {
      const out = await cmd<{ submission: DocSubmissionView | null }>('rdm.review.doc.status', docStatusPayload(projectId, id))
+      if (!currentDocument(epoch, selection, id) || request !== requests.current.status) return
      setSub(out.submission)
-    } catch (e) { setErr(String(e)); setSub(undefined) }
+    } catch (e) {
+      if (!currentDocument(epoch, selection, id) || request !== requests.current.status) return
+      setSub(undefined); setErr(`整文状态读取失败：${e}`)
+    }
  }
+  /** 选中文档：读当前职责（duty.get）并回填选择器（方案：当前职责与冻结名单分列）。 */
+  const selectDoc = async (id: string, keepNotice = false) => {
+    const epoch = requests.current.epoch
+    const selection = ++requests.current.selection
+    requests.current.selected = id
+    requests.current.status++
+    setErr(''); if (!keepNotice) setNotice('')
+    setDocId(id); setDetail(undefined); setSub(undefined); setBatchSel(new Set())
+    setAuthor([]); setReviewers([]); setApprover([])
+    if (!id) return
+    try {
+      const out = await cmd<DutyGetOut>('rdm.duty.get', { projectId, docId: id })
+      if (!currentDocument(epoch, selection, id)) return
+      if (out.docId !== id) throw new Error('文档职责与当前选择不一致，请重新选择文档')
+      setDetail(out)
+      setAuthor(out.assigned && out.roles.author ? [out.roles.author] : [])
+      setReviewers(out.assigned ? out.roles.reviewers ?? [] : [])
+      setApprover(out.assigned && out.roles.approver ? [out.roles.approver] : [])
+    } catch (e) {
+      if (!currentDocument(epoch, selection, id)) return
+      setDetail(null); setErr(String(e))
+    }
+    await refreshStatus(id, epoch, selection)
+  }
+  useEffect(() => {
+    const epoch = ++requests.current.epoch
+    requests.current.selected = ''; requests.current.selection++; requests.current.status++
+    requests.current.action++
+    setDocId(''); setDetail(undefined); setSub(undefined); setBatchSel(new Set())
+    setDocs(null); setMembers(null); setAuthor([]); setReviewers([]); setApprover([])
+    setBatchAuthor([]); setBatchReviewers([]); setBatchApprover([])
+    setErr(''); setNotice(''); setBusy(false)
+    void refreshCatalog(epoch)
+    cmd<{ members: { owner: string; role: string }[] }>('rdm.project.member.list', { projectId })
+      .then(out => { if (currentProject(epoch)) setMembers(out.members ?? []) })
+      .catch(() => { if (currentProject(epoch)) setMembers([]) })
+    return () => {
+      requests.current.epoch++; requests.current.selection++; requests.current.status++
+      requests.current.catalog++; requests.current.action++; requests.current.selected = ''
+    }
+  }, [project])

  const run = async (label: string, fn: () => Promise<unknown>) => {
+    const epoch = requests.current.epoch
+    const selection = requests.current.selection
+    const selected = requests.current.selected
+    const action = ++requests.current.action
+    const currentAction = () => currentProject(epoch) && action === requests.current.action
    setErr(''); setNotice(''); setBusy(true)
-    try { await fn(); setNotice(label); await refreshStatus(docId) }
-    catch (e) { setErr(String(e)) } finally { setBusy(false) }
+    try {
+      await fn()
+      if (!currentAction() || !currentDocument(epoch, selection, selected)) return
+      setNotice(label)
+      await refreshCatalog(epoch)
+      if (currentAction() && currentDocument(epoch, selection, selected) && selected) await selectDoc(selected, true)
+    } catch (e) {
+      if (currentAction() && currentDocument(epoch, selection, selected)) setErr(String(e))
+    } finally { if (currentAction()) setBusy(false) }
  }

+  const dirty = detail != null && (
+    (author[0] ?? '') !== (detail.assigned ? detail.roles.author : '')
+    || JSON.stringify(reviewers) !== JSON.stringify(detail.assigned ? detail.roles.reviewers ?? [] : [])
+    || (approver[0] ?? '') !== (detail.assigned ? detail.roles.approver : ''))
+
+  const saveDisabled = busy || !!writeError || !docId || detail == null || !author[0] || !approver[0] || reviewers.length === 0
+
+  const save = () => {
+    if (saveDisabled || !dirty || requests.current.selected !== docId || detail?.docId !== docId) return
+    if (detail.active && !window.confirm(
+      `文档「${detail.title}」在途第 ${detail.active.round} 轮审签将因职责变更失效，需重新提交。确认变更？`)) return
+    return run('已保存当前职责', () =>
+      cmd('rdm.review.assign.doc', assignDocDutiesPayload(projectId, docId, author[0], reviewers, approver[0])))
+  }
+
+  const batchApply = () => run(`已批量分配 ${batchSel.size} 份文档`, () =>
+    cmd('rdm.review.assign.doc.batch', { projectId, docs: [...batchSel].map(d => ({
+      docId: d, author: batchAuthor[0], reviewers: batchReviewers, approver: batchApprover[0] })) }))
+
  return (
    <div>
-      <div className="ad-create">
-        <div className="ad-row">
-          <input className="lg-input lg-mono" placeholder="文档 ID（docId）" value={docId}
-            onChange={e => setDocId(e.target.value)} />
-          <Btn variant="ghost" icon="eye" disabled={busy || !docId}
-            onClick={() => refreshStatus(docId)}>查看整文状态</Btn>
-        </div>
-      </div>
+      <h4 className="settings-group-title">文档清单（职责分配对象为整份文档；搜索/浏览同一目录）</h4>
+      <table className="ad-table">
+        <thead><tr><th></th><th>文档</th><th>类型 / 阶段</th><th>当前职责</th><th>状态</th><th></th></tr></thead>
+        <tbody>
+          {(docs ?? []).map(d => (
+            <tr key={d.docId} className={d.docId === docId ? 'ad-row-on' : ''}>
+              <td><input type="checkbox" checked={batchSel.has(d.docId)}
+                onChange={e => { const n = new Set(batchSel); e.target.checked ? n.add(d.docId) : n.delete(d.docId); setBatchSel(n) }} /></td>
+              <td><button className="ad-mini" onClick={() => selectDoc(d.docId)}>{d.title}</button>
+                <span className="ad-dim ad-mono"> · {d.docId}</span></td>
+              <td className="ad-dim">{d.typeKey}{d.stage ? ` / ${d.stage}` : ''}</td>
+              <td className="ad-dim">{d.assigned
+                ? `编 ${d.author} · 审 ${(d.reviewers ?? []).join('、')} · 批 ${d.approver}` : '未分配'}</td>
+              <td>{d.activeRound ? <span className="ad-chip ad-chip-warn">第 {d.activeRound} 轮在途</span> : d.assigned ? <span className="ad-chip">—</span> : <span className="ad-chip">未分配</span>}</td>
+              <td className="ad-dim">{d.sections} 章节</td>
+            </tr>
+          ))}
+          {docs === null && <tr><td colSpan={6} className="ad-dim">加载中…</td></tr>}
+          {docs !== null && docs.length === 0 && <tr><td colSpan={6} className="ad-dim">暂无文档</td></tr>}
+        </tbody>
+      </table>

-      {sub === null && <EmptyState icon="inbox">该文档尚无整文提交记录</EmptyState>}
-      {sub && (
-        <div className="settings-group">
-          <h4>第 {sub.round} 轮 · {sub.state === 'submitted' ? <span className="ad-chip ad-chip-warn">审签在途（全文锁定）</span> : sub.state === 'final' ? <span className="ad-chip ad-chip-admin">已终批</span> : <span className="ad-chip">已驳回</span>}</h4>
-          <div className="setting-row"><label>三权</label><span>编制 <b className="ad-mono">{sub.duties.author}</b> · 审核 <b className="ad-mono">{(sub.duties.reviewers ?? []).join('、')}</b> · 批准 <b className="ad-mono">{sub.duties.approver}</b></span></div>
-          <div className="setting-row"><label>审核进度</label><span>{Object.entries(sub.reviews ?? {}).map(([r, ok]) => `${r}:${ok ? '✓' : '…'}`).join('  ') || '—'}</span></div>
-          <div className="setting-row"><label>冻结摘要</label><span className="ad-mono ad-dim">{(sub.digest ?? '').slice(0, 16)}…</span></div>
-          <div className="ad-row" style={{ marginTop: 8 }}>
-            <button className="lg-submit ad-create-btn" disabled={busy || sub.state !== 'submitted'}
-              onClick={() => run('整文终批完成（各章节已基线）',
-                () => cmd('rdm.review.doc.final', docFinalPayload(projectId, docId)))}>终批（批准人）</button>
-            <button className="ad-mini" disabled={busy || sub.state !== 'submitted'}
-              onClick={() => run('已通过整文审核',
-                () => cmd('rdm.review.doc.approve', docApprovePayload(projectId, docId, '通过')))}>审核通过</button>
-            <button className="ad-mini" disabled={busy || sub.state !== 'submitted'}
-              onClick={() => run('已驳回整文（解锁回编写态）',
-                () => cmd('rdm.review.doc.reject', docRejectPayload(projectId, docId, '退回修改')))}>驳回</button>
+      {detail === null && docId && <EmptyState icon="inbox">读取职责失败</EmptyState>}
+      {detail && (
+        <div className="settings-group" style={{ marginTop: 14 }}>
+          <h4>{detail.title} · 当前职责{detail.active ? <span className="ad-chip ad-chip-warn">在途第 {detail.active.round} 轮（变更将失效需重提交）</span> : null}</h4>
+          <div className="setting-row"><label>编制人（单选）</label>
+            <div style={{ maxWidth: 320 }}><Picker aria-label="编制人" selected={author} onSelect={setAuthor} fetchPage={memberPage} /></div></div>
+          <div className="setting-row"><label>审核人（多选 ≥1）</label>
+            <div style={{ maxWidth: 320 }}><Picker aria-label="审核人" multiple selected={reviewers} onSelect={setReviewers} fetchPage={memberPage} /></div>
+            {reviewers.length > 0 && <span className="ad-dim">已选：{reviewers.join('、')}</span>}</div>
+          <div className="setting-row"><label>批准人（单选）</label>
+            <div style={{ maxWidth: 320 }}><Picker aria-label="批准人" selected={approver} onSelect={setApprover} fetchPage={memberPage} /></div></div>
+          <div className="ad-row">
+            <Btn variant="primary" icon="check" disabled={saveDisabled || !dirty} onClick={save}>保存当前职责</Btn>
+            {detail.active && <span className="ad-hint">保存将使在途第 {detail.active.round} 轮失效（提交人 {detail.active.createdBy}）</span>}
          </div>
+          {detail.sections.length > 0 && (
+            <p className="ad-hint">章节覆盖：{detail.sections.filter(x => x.overridden).length}/{detail.sections.length} 章节单独指派（覆盖文档默认）。</p>
+          )}
        </div>
      )}

-      {sub === undefined && docId && <p className="ad-hint">输入文档 ID 后查看整文状态。</p>}
+      {detail && docId && (
+        <div className="ad-row" style={{ marginTop: 8 }}>
+          <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || !detail.assigned || sub === undefined}
+            onClick={() => run('整文已提交审核（全文锁定）',
+              () => cmd('rdm.review.doc.submit', docSubmitPayload(projectId, docId)))}>整文提交（编制人）</button>
+        </div>
+      )}
+      {sub && (
+        <div className="settings-group" style={{ marginTop: 14 }}>
+          <h4>整文审签 · 第 {sub.round} 轮 · {sub.state === 'submitted' ? <span className="ad-chip ad-chip-warn">在途（全文锁定）</span> : sub.state === 'final' ? <span className="ad-chip ad-chip-admin">已终批</span> : <span className="ad-chip">已驳回</span>}</h4>
+          <div className="setting-row"><label>冻结名单</label><span>编 <b className="ad-mono">{sub.duties.author}</b> · 审 <b className="ad-mono">{(sub.duties.reviewers ?? []).join('、')}</b> · 批 <b className="ad-mono">{sub.duties.approver}</b></span></div>
+          <div className="setting-row"><label>审核进度</label><span>{Object.entries(sub.reviews ?? {}).map(([r, ok]) => `${r}:${ok ? '✓' : '…'}`).join('  ') || '—'}</span></div>
+          <div className="ad-row" style={{ marginTop: 8 }}>
+            <button className="ad-mini" disabled={busy || !!writeError || sub.state !== 'submitted'}
+              onClick={() => run('已通过整文审核',
+                () => cmd('rdm.review.doc.approve', docApprovePayload(projectId, docId, '通过')))}>审核通过</button>
+            <button className="ad-mini" disabled={busy || !!writeError || sub.state !== 'submitted'}
+              onClick={() => run('已驳回整文（解锁回编写态）',
+                () => cmd('rdm.review.doc.reject', docRejectPayload(projectId, docId, '退回修改')))}>驳回</button>
+            <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || sub.state !== 'submitted'}
+              onClick={() => run('整文终批完成（各章节已基线）',
+                () => cmd('rdm.review.doc.final', docFinalPayload(projectId, docId)))}>终批（批准人）</button>
+          </div>
+        </div>
+      )}
+      {sub === null && docId && <p className="ad-hint">该文档尚无整文提交记录（当前职责仍可分配）。</p>}

-      <h4 className="settings-group-title" style={{ marginTop: 18 }}>分配文档三权（整文）</h4>
-      <div className="ad-row">
-        <input className="lg-input lg-mono" placeholder="文档 ID（docId）" value={docId}
-          onChange={e => setDocId(e.target.value)} />
-        <input className="lg-input lg-mono" placeholder="编制人（author）" value={author}
-          onChange={e => setAuthor(e.target.value)} />
-        <input className="lg-input lg-mono" placeholder="审核人（逗号分隔，≥1 且异于编制/批准）" value={reviewers}
-          onChange={e => setReviewers(e.target.value)} />
-        <input className="lg-input lg-mono" placeholder="批准人（approver）" value={approver}
-          onChange={e => setApprover(e.target.value)} />
-      </div>
-      <div className="ad-row">
-        <button className="lg-submit ad-create-btn"
-          disabled={busy || !docId || !author.trim() || !approver.trim() || parseReviewers(reviewers).length === 0}
-          onClick={() => run('已分配文档三权', () => cmd('rdm.review.assign.doc',
-            assignDocDutiesPayload(projectId, docId, author.trim(), parseReviewers(reviewers), approver.trim())))}>分配三权</button>
-        <button className="ad-mini" disabled={busy || !docId}
-          onClick={() => run('整文已提交审核（全文锁定）',
-            () => cmd('rdm.review.doc.submit', docSubmitPayload(projectId, docId)))}>整文提交（编制人）</button>
-      </div>
-      <p className="ad-hint">三权异人：编制≠批准，审核异于两者；提交即冻结三权与全文版本，审签在途全文锁定。</p>
+      {batchSel.size > 0 && (
+        <div className="settings-group" style={{ marginTop: 14 }}>
+          <h4>批量分配（已选 {batchSel.size} 份；任一校验失败整批拒绝并列原因）</h4>
+          <div className="setting-row"><label>统一编制人</label>
+            <div style={{ maxWidth: 320 }}><Picker aria-label="批量编制人" selected={batchAuthor} onSelect={setBatchAuthor} fetchPage={memberPage} /></div></div>
+          <div className="setting-row"><label>统一审核人</label>
+            <div style={{ maxWidth: 320 }}><Picker aria-label="批量审核人" multiple selected={batchReviewers} onSelect={setBatchReviewers} fetchPage={memberPage} /></div></div>
+          <div className="setting-row"><label>统一批准人</label>
+            <div style={{ maxWidth: 320 }}><Picker aria-label="批量批准人" selected={batchApprover} onSelect={setBatchApprover} fetchPage={memberPage} /></div></div>
+          <div className="ad-row">
+            <Btn variant="primary" icon="check" disabled={busy || !!writeError || !batchAuthor[0] || !batchApprover[0] || batchReviewers.length === 0}
+              onClick={batchApply}>批量分配 {batchSel.size} 份文档</Btn>
+            <button className="ad-mini" onClick={() => setBatchSel(new Set())}>清空选择</button>
+          </div>
+        </div>
+      )}

      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
@@ -313,67 +526,70 @@ export function RdmDutiesSection({ projectId }: { projectId: string }) {
  )
 }

+// ---- 项目设置：项目权限（P7-C：单成员详情标签化 + 多人矩阵 + 三态覆盖；
+// 与实际判定同源——UI 不重算，全部读服务端解释） ----

-// ---- 项目设置：项目权限（矩阵解释读面，与实际判定同源——UI 不重算） ----
-
-interface MatrixAction { action: string; allowed: boolean; source: string; reason?: string }
+interface MatrixAction {
+  action: string; label?: string; scope?: string
+  allowed: boolean; source: string; reason?: string
+}
 interface MatrixOut {
  projectId: string; member: string; role: string
  profRole: { roleId: string; name: string } | null
  actions: MatrixAction[]
 }
+interface MatrixRowOut {
+  member: string; role: string
+  profRole: { roleId: string; name: string } | null
+  actions: MatrixAction[]
+}
+interface MatrixBatchOut { projectId: string; rows: MatrixRowOut[] }

-export function RdmPermMatrixSection({ projectId }: { projectId: string }) {
-  const me = useStore(s => s.me)
-  const [member, setMember] = useState('')
-  const [members, setMembers] = useState<MemberRow[] | null>(null)
-  const [matrix, setMatrix] = useState<MatrixOut | null>(null)
-  const [err, setErr] = useState('')
-  const [busy, setBusy] = useState(false)
-
-  useEffect(() => {
-    api.rdmCommand<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
-      .then(out => {
-        setMembers(out.members ?? [])
-        // 默认自省：普通成员只看自己的矩阵；负责人/管理员可切换他人。
-        if (me?.owner) setMember(prev => prev || me.owner)
-      })
-      .catch(e => setErr(String(e)))
-  }, [projectId, me?.owner])
-
-  const query = async (m: string) => {
-    if (!m) return
-    setErr(''); setBusy(true); setMatrix(null)
-    try {
-      setMatrix(await api.rdmCommand<MatrixOut>('rdm.perm.check', permCheckPayload(projectId, m)))
-    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
-  }
+function actionTitle(a: MatrixAction) { return a.label || a.action }

+/** 动作行：中文标签为主，内部标识进 title 技术详情（方案 §5）。 */
+function ActionDetailTable({ actions, onOverride, canManage }: {
+  actions: MatrixAction[]
+  onOverride?: (action: string, mode: 'allow' | 'deny' | 'default') => void
+  canManage?: boolean
+}) {
+  const project = actions.filter(a => a.scope !== 'system')
+  const system = actions.filter(a => a.scope === 'system')
+  const overrideOf = (a: MatrixAction): 'allow' | 'deny' | 'default' =>
+    a.source.includes('override') || a.source === 'project' ? (a.allowed ? 'allow' : 'deny') : 'default'
  return (
-    <div>
-      <div className="ad-create">
-        <div className="ad-row">
-          <select className="lg-input" value={member} onChange={e => { setMember(e.target.value); query(e.target.value) }}>
-            <option value="">选择成员（默认自省）…</option>
-            {(members ?? []).map(m => <option key={m.owner} value={m.owner}>{m.owner}</option>)}
-          </select>
-          <Btn variant="ghost" icon="eye" disabled={busy || !member} onClick={() => query(member)}>查看矩阵</Btn>
-        </div>
-        <p className="ad-hint">普通成员可查看自己的有效权限；查看他人矩阵须项目管理权。矩阵与实际判定同源（服务端解释，非前端推算）。</p>
-      </div>
-      {matrix && (
-        <>
-          <div className="ad-row">
-            <span>成员 <b className="ad-mono">{matrix.member}</b> · 项目关系 <b>{matrix.role}</b>
-              {matrix.profRole && <> · 专业角色 <b>{matrix.profRole.name}</b>（{matrix.profRole.roleId}）</>}
-            </span>
-          </div>
+    <>
+      <table className="ad-table">
+        <thead><tr><th>动作</th><th>生效</th><th>来源</th><th>原因（拒绝时）</th>{canManage ? <th>项目覆盖</th> : null}</tr></thead>
+        <tbody>
+          {project.map(a => (
+            <tr key={a.action}>
+              <td title={`内部标识 ${a.action}`}>{actionTitle(a)}</td>
+              <td>{a.allowed ? <span className="ad-chip ad-chip-admin">允许</span> : <span className="ad-chip ad-chip-warn">拒绝</span>}</td>
+              <td className="ad-dim">{describeSource(a.source)}</td>
+              <td className="ad-dim">{a.reason || '—'}</td>
+              {canManage ? (
+                <td>
+                  <select className="lg-input" value={overrideOf(a)} style={{ minWidth: 120 }}
+                    onChange={e => onOverride?.(a.action, e.target.value as 'allow' | 'deny' | 'default')}>
+                    <option value="default">沿用角色默认</option>
+                    <option value="allow">项目内允许</option>
+                    <option value="deny">项目内禁止</option>
+                  </select>
+                </td>
+              ) : null}
+            </tr>
+          ))}
+        </tbody>
+      </table>
+      {system.length > 0 && (
+        <Collapsible trigger={`系统范围动作（${system.length} 项，不在项目内配置）`}>
          <table className="ad-table">
-            <thead><tr><th>动作</th><th>生效</th><th>来源</th><th>原因（拒绝时）</th></tr></thead>
+            <thead><tr><th>动作</th><th>生效</th><th>来源</th><th>原因</th></tr></thead>
            <tbody>
-              {(matrix.actions ?? []).map(a => (
+              {system.map(a => (
                <tr key={a.action}>
-                  <td className="ad-mono">{a.action}</td>
+                  <td title={`内部标识 ${a.action}`}>{actionTitle(a)}</td>
                  <td>{a.allowed ? <span className="ad-chip ad-chip-admin">允许</span> : <span className="ad-chip ad-chip-warn">拒绝</span>}</td>
                  <td className="ad-dim">{describeSource(a.source)}</td>
                  <td className="ad-dim">{a.reason || '—'}</td>
@@ -381,9 +597,144 @@ export function RdmPermMatrixSection({ projectId }: { projectId: string }) {
              ))}
            </tbody>
          </table>
+        </Collapsible>
+      )}
+    </>
+  )
+}
+
+export function RdmPermMatrixSection({ project }: { project: Project }) {
+  const projectId = project.id
+  const writeError = projectWorkError(project)
+  const cmd = <T,>(id: string, params: Record<string, unknown> = {}) => api.rdmProjectCommand<T>(project, id, params)
+  const me = useStore(s => s.me)
+  const [view, setView] = useState<'member' | 'matrix'>('member')
+  const [member, setMember] = useState('')
+  const [members, setMembers] = useState<MemberRow[] | null>(null)
+  const [matrix, setMatrix] = useState<MatrixOut | null>(null)
+  const [batch, setBatch] = useState<MatrixBatchOut | null>(null)
+  const [expand, setExpand] = useState('')
+  const [err, setErr] = useState('')
+  const [notice, setNotice] = useState('')
+  const [busy, setBusy] = useState(false)
+
+  const loadMembers = () =>
+    cmd<{ members: MemberRow[] }>('rdm.project.member.list', { projectId })
+      .then(out => {
+        setMembers(out.members ?? [])
+        if (me?.owner) setMember(prev => prev || me.owner)
+      }).catch(e => setErr(String(e)))
+  useEffect(() => { loadMembers() }, [project, me?.owner]) // eslint-disable-line react-hooks/exhaustive-deps
+
+  const query = async (m: string) => {
+    if (!m) return
+    setErr(''); setBusy(true); setMatrix(null)
+    try {
+      setMatrix(await cmd<MatrixOut>('rdm.perm.check', permCheckPayload(projectId, m)))
+    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
+  }
+  const queryBatch = async () => {
+    setErr(''); setBusy(true); setBatch(null)
+    try {
+      setBatch(await cmd<MatrixBatchOut>('rdm.perm.matrix', { projectId }))
+    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
+  }
+  useEffect(() => { if (view === 'matrix') queryBatch() }, [view]) // eslint-disable-line react-hooks/exhaustive-deps
+
+  /** 三态覆盖写回：default=实际撤销（perm.unset）；allow/deny=perm.set。 */
+  const override = async (m: string, action: string, mode: 'allow' | 'deny' | 'default') => {
+    if (writeError) { setErr(writeError); return }
+    setErr(''); setNotice(''); setBusy(true)
+    try {
+      if (mode === 'default') {
+        await cmd('rdm.perm.unset', { projectId, member: m, action })
+        setNotice(`已恢复默认（撤销 ${action} 的项目覆盖）`)
+      } else {
+        await cmd('rdm.perm.set', { projectId, member: m, action, allow: mode === 'allow' })
+        setNotice(mode === 'allow' ? `已在项目内允许 ${action}` : `已在项目内禁止 ${action}`)
+      }
+      await query(m)
+    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
+  }
+
+  const canManage = !writeError && !!matrix && matrix.role !== undefined
+
+  return (
+    <div>
+      {writeError && <p className="ad-hint">{writeError}</p>}
+      <div className="ad-create">
+        <div className="ad-row">
+          <select className="lg-input" value={view} onChange={e => setView(e.target.value as 'member' | 'matrix')}>
+            <option value="member">按成员查看（默认自省）</option>
+            <option value="matrix">权限矩阵（成员 × 动作，须管理权）</option>
+          </select>
+          {view === 'member' && (
+            <>
+              <select className="lg-input" value={member} onChange={e => { setMember(e.target.value); query(e.target.value) }}>
+                <option value="">选择成员…</option>
+                {(members ?? []).map(m => <option key={m.owner} value={m.owner}>{m.owner}</option>)}
+              </select>
+              <Btn variant="ghost" icon="eye" disabled={busy || !member} onClick={() => query(member)}>查看</Btn>
+            </>
+          )}
+        </div>
+        <p className="ad-hint">普通成员可查看自己的有效权限；查看他人与矩阵须项目管理权。解释与实际判定同源（服务端，非前端推算）；系统范围动作折叠为技术详情。</p>
+      </div>
+
+      {view === 'member' && matrix && (
+        <>
+          <div className="ad-row">
+            <span>成员 <b className="ad-mono">{matrix.member}</b> · 项目身份 <b>{matrix.role === 'owner' ? '项目负责人' : matrix.role === 'member' ? '项目成员' : matrix.role}</b>
+              {matrix.profRole && <> · 专业角色 <b>{matrix.profRole.name}</b></>}
+            </span>
+          </div>
+          <ActionDetailTable actions={matrix.actions ?? []}
+            canManage={canManage}
+            onOverride={(action, mode) => override(matrix.member, action, mode)} />
        </>
      )}
-      {!matrix && !err && members !== null && <p className="ad-hint">选择成员后展示 12 项动作的有效权限与第一拒绝原因。</p>}
+      {view === 'member' && !matrix && !err && members !== null && <p className="ad-hint">选择成员后展示各动作的有效权限、来源与第一拒绝原因。</p>}
+
+      {view === 'matrix' && batch && (
+        <table className="ad-table" style={{ overflowX: 'auto', display: 'block' }}>
+          <thead><tr>
+            <th>成员</th>
+            {(batch.rows[0]?.actions ?? []).filter(a => a.scope !== 'system').map(a => (
+              <th key={a.action} title={`内部标识 ${a.action}`}>{actionTitle(a)}</th>
+            ))}
+          </tr></thead>
+          <tbody>
+            {batch.rows.map(row => (
+              <tr key={row.member}>
+                <td>
+                  <button className="ad-mini" onClick={() => setExpand(expand === row.member ? '' : row.member)}>
+                    {row.member}
+                  </button>
+                  <span className="ad-dim"> · {row.role === 'owner' ? '负责人' : '成员'}</span>
+                </td>
+                {row.actions.filter(a => a.scope !== 'system').map(a => (
+                  <td key={a.action} title={`${a.label ?? a.action}：${a.allowed ? '允许' : '拒绝'}（${describeSource(a.source)}${a.reason ? '；' + a.reason : ''}）`}>
+                    {a.allowed ? <span className="ad-chip ad-chip-admin">✓</span> : <span className="ad-chip ad-chip-warn">✗</span>}
+                  </td>
+                ))}
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+      {view === 'matrix' && batch && expand && (
+        <div className="settings-group" style={{ marginTop: 12 }}>
+          <h4>{expand} · 单成员详情与三态覆盖</h4>
+          {(() => {
+            const row = batch.rows.find(r => r.member === expand)
+            if (!row) return null
+            return <ActionDetailTable actions={row.actions} canManage={!writeError}
+              onOverride={(action, mode) => override(expand, action, mode)} />
+          })()}
+        </div>
+      )}
+
+      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
    </div>
  )
@@ -3,3 +3,41 @@ export function projectStage(settings?: Record<string, unknown> | null): string
  const stage = settings?.stage
  return typeof stage === 'string' && stage.trim() !== '' ? stage.trim() : null
 }
+
+/** Service metadata describes readiness; permission is always checked by the server. */
+export function projectWorkError(project: { settings?: Record<string, unknown> } | undefined): string | null {
+  if (!project) return '项目已不可用，请刷新项目列表或联系项目负责人'
+  const settings = project.settings
+  if (!settings || (!('rdm.state' in settings) && !('rdm.projectId' in settings))) return null
+  switch (settings['rdm.state']) {
+    case 'ready':
+      if (typeof settings['rdm.projectId'] === 'string' && settings['rdm.projectId'].trim()) return null
+      break
+    case 'provisioning': return '项目正在准备，请稍后刷新项目列表再试'
+    case 'failed': return '项目准备失败，请联系项目负责人重试创建'
+    case 'archived': return '项目已归档，请联系项目负责人恢复后再新建对话'
+    case 'closed': return '项目已关闭，请选择其他项目或联系项目负责人'
+  }
+  return '项目尚未绑定，请联系项目负责人完成项目接入'
+}
+
+export function projectStateLabel(settings?: Record<string, unknown>): string | null {
+  switch (settings?.['rdm.state']) {
+    case 'provisioning': return '准备中'
+    case 'failed': return '准备失败'
+    case 'unbound': return '未接入'
+    case 'archived': return '已归档'
+    case 'closed': return '已关闭'
+    default: return null
+  }
+}
+
+export function projectActionError(error: unknown): string {
+  const raw = String(error)
+  if (/\b401\b/.test(raw)) return '登录已失效，请重新登录后再试'
+  if (/\b403\b/.test(raw)) return '当前账号无法管理此项目，请联系项目负责人'
+  if (/\b404\b/.test(raw)) return '项目已不可用，请刷新项目列表或联系项目负责人'
+  if (/\b409\b/.test(raw)) return '项目名称已被占用或项目状态已变化，请更换名称或刷新后再试'
+  if (/\b503\b/.test(raw)) return '项目服务暂未就绪，请稍后重试或联系项目负责人'
+  return raw.replace(/^Error:\s*/, '')
+}
@@ -2,6 +2,35 @@
 // 命令清单不可用＝未就绪，fail-closed）与命令载荷构造。页面组件只消费本模块与
 // api.rdmCommand，不在组件里散落命令 id / 参数拼写；身份一律经认证会话，载荷不
 // 携带任何身份字段（G1-5）。
+import type { Project } from './contracts'
+import { projectWorkError } from './projectmeta'
+
+export function rdmCommandProjectId(project: Project): string {
+  const id = project.settings?.['rdm.projectId']
+  if (typeof id !== 'string' || !id.trim()) {
+    throw new Error('项目尚未绑定，请联系项目负责人完成项目接入')
+  }
+  return id.trim()
+}
+
+/** Historical project reads remain available; this does not grant read permission. */
+export function rdmProjectReadError(project: Project | undefined): string | null {
+  const state = project?.settings?.['rdm.state']
+  if (project && (state === 'ready' || state === 'archived' || state === 'closed')) {
+    try { rdmCommandProjectId(project); return null }
+    catch (e) { return String(e).replace(/^Error:\s*/, '') }
+  }
+  return projectWorkError(project) ?? '项目尚未绑定，请联系项目负责人完成项目接入'
+}
+
+const PROJECT_READ_COMMANDS = new Set([
+  'rdm.project.member.list', 'rdm.perm.check', 'rdm.perm.matrix',
+  'rdm.review.doc.status', 'rdm.duty.catalog', 'rdm.duty.get',
+])
+
+export function rdmProjectCommandError(project: Project, command: string): string | null {
+  return PROJECT_READ_COMMANDS.has(command) ? rdmProjectReadError(project) : projectWorkError(project)
+}

 /** 系统管理「RDM 角色权限」分区消费的命令面。 */
 export const RDM_ROLES_COMMANDS = [
@@ -76,6 +105,7 @@ export const roleDisablePayload = (roleId: string, disabled: boolean) => ({ role
 export const memberAddPayload = (projectId: string, member: string, role: 'owner' | 'member' = 'member') =>
  ({ projectId, member, role })
 export const memberRemovePayload = (projectId: string, member: string) => ({ projectId, member })
+export const memberSetRolePayload = (projectId: string, member: string, role: 'owner' | 'member') => ({ projectId, member, role })

 export const assignDocDutiesPayload = (
  projectId: string, docId: string, author: string, reviewers: string[], approver: string,
@@ -2,6 +2,8 @@
 // useSyncExternalStore 驱动；live 流式部件为会话内临时态，run 终态后由消息树对账收敛。
 import { useSyncExternalStore } from 'react'
 import { type AdminZoneSection, api, connectEvents } from './api'
+import { auth } from './auth'
+import { projectActionError, projectWorkError } from './projectmeta'
 import { applyTextDelta, applyThinkingDelta, applyToolCall, applyToolCallDelta, applyToolResult, applyToolOutput, applyArtifactCreated, applyArtifactUpdated, applyCheck, applyFinalizing, type LiveItem } from './live'
 import { closePreviewTab, mergeOrphanPreviewTabs, openPreviewTab, previewTabsKey, type PreviewTab } from './previewtabs'
 import { deliveryRequestId, enqueueMessage, enqueueMessageFront, newQueuedMessage, promoteQueuedMessage, removeQueuedMessage, replaceQueuedText, type QueuedMessage } from './outbox'
@@ -279,6 +281,10 @@ let sse: { close: () => void } | null = null
 let projectSse: { close: () => void } | null = null
 let projectSeq = 0
 let conversationEpoch = 0
+let identityEpoch = 0
+let projectsRequest = 0
+let tasksRequest = 0
+let meRequest = 0
 let streamSeq = 0
 let detailRequest = 0
 let detailSeq = 0
@@ -399,23 +405,56 @@ export function useStore<T>(selector: (s: AppState) => T): T {
 export const store = {
  getState: () => state,

+  resetIdentity() {
+    identityEpoch++; projectsRequest++; tasksRequest++; meRequest++
+    sse?.close(); sse = null
+    projectSse?.close(); projectSse = null
+    conversationEpoch++; detailRequest++; cardsRequest++; projectCardsRequest++
+    projectSeq = 0; streamSeq = 0; detailSeq = 0; detailVersion = 0
+    cardVersion = 0; projectCardVersion = 0
+    cardVersions = {}; projectCardVersions = {}; cardPatches = {}; projectCardPatches = {}
+    runObservations = {}; messageObservations = {}; hitlObservations = {}
+    actionInflight.clear()
+    for (const key of Object.keys(actionFeedbackOwners)) delete actionFeedbackOwners[key]
+    for (const key of Object.keys(surfaceActionsInflight)) delete surfaceActionsInflight[key]
+    convRestoreDone = true
+    persistConvId(null)
+    set({ projects: [], currentProjectId: null, tasks: [], me: null, currentConvId: null,
+      contextObs: {}, messages: [], runs: [], activeHitl: [], lastSeq: 0, live: null,
+      plan: null, todos: null, artifacts: [], surfaces: [], projectSurfaces: [],
+      cards: [], projectCards: [], cardActionStates: {}, inboxScope: 'conv',
+      runtimeMock: false, profiles: [], pluginPanels: [], serverWorkspaces: [], adminSections: [],
+      rdmAuditAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
+      rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false,
+      connected: false, posting: false, error: null, toast: null, outbox: [], outboxDraining: false,
+      previewTabs: {}, previewActive: {}, previewOpenIntent: 0 })
+    setUI({ lastProjectId: null, projectSettingsId: null, adminZoneOpen: false, activeWorkspace: null,
+      settingsOpen: false, changePwOpen: false, trackerRunId: null, workspaceSurfacePin: null,
+      previewExpanded: false, filesView: 'list', showArchived: false })
+  },
+
  async refreshProjects() {
+    const epoch = identityEpoch
+    const request = ++projectsRequest
    try {
      const projects = await api.listProjects()
+      if (epoch !== identityEpoch || request !== projectsRequest) return
      const current = projects.find(p => p.id === state.currentProjectId) ?? projects.find(p => p.id === state.ui.lastProjectId) ?? projects[0]
      set({ projects, currentProjectId: current?.id ?? null, error: null })
      if (current) await store.openProject(current.id)
    } catch (e) {
-      set({ error: String(e) })
+      if (epoch === identityEpoch && request === projectsRequest) set({ error: projectActionError(e) })
    }
-    store.refreshTasks()
-    store.refreshMe()
+    if (epoch === identityEpoch && request === projectsRequest) await store.refreshTasks()
  },

  // 跨项目任务列表（方案 A 侧栏数据源）：归档视图切换时带 includeArchived 重取。
  async refreshTasks(includeArchived = state.ui.showArchived) {
+    const epoch = identityEpoch
+    const request = ++tasksRequest
    try {
      const tasks = await api.listTasks(includeArchived)
+      if (epoch !== identityEpoch || request !== tasksRequest) return
      set({ tasks })
      // 首次加载恢复上次会话（仅一次；此后用户主动切换/新建不再打扰）。
      if (!convRestoreDone) {
@@ -429,14 +468,35 @@ export const store = {
  },

  async refreshMe() {
-    try { set({ me: await api.me() }) } catch { /* 身份不可用时侧栏只显示通用入口 */ }
+    const epoch = identityEpoch
+    const request = ++meRequest
+    try {
+      const me = await api.me()
+      if (epoch !== identityEpoch || request !== meRequest) return
+      const changed = state.me !== null && state.me.owner !== me.owner
+      if (changed) store.resetIdentity()
+      set({ me })
+      if (changed) {
+        await store.refreshProjects()
+        void store.refreshProfiles()
+        void store.refreshPlugins()
+      }
+    } catch { /* 身份不可用时侧栏只显示通用入口 */ }
  },

  async createProject(name: string) {
-    const p = await api.createProject(name)
-    await store.refreshProjects()
-    store.toast(`项目「${p.name}」已创建`)
-    return p
+    const epoch = identityEpoch
+    try {
+      const p = await api.createProject(name)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      await store.refreshProjects()
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      store.toast(`项目「${p.name}」已创建`)
+      return p
+    } catch (e) {
+      if (epoch === identityEpoch) store.toast(`项目创建失败：${projectActionError(e)}`)
+      throw e
+    }
  },

  async openProject(projectId: string) {
@@ -465,28 +525,43 @@ export const store = {
  /** 新建任务（=会话）：默认当前项目上下文；显式 projectId 用于"新建于指定项目"。
   * 空库时主按钮与空状态都写着「点击新建任务开始」，这里先落一个默认项目再开会话。 */
  async createTask(projectId?: string) {
-    let pid = projectId ?? state.currentProjectId
-    if (!pid && state.projects.length > 0) pid = state.projects[0].id
-    if (!pid) {
-      const p = await store.createProject('默认项目')
-      pid = p.id
+    const epoch = identityEpoch
+    try {
+      let pid = projectId ?? state.currentProjectId
+      if (!pid && state.projects.length > 0) pid = state.projects[0].id
+      if (!pid) {
+        const p = await store.createProject('默认项目')
+        pid = p.id
+      }
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      const error = projectWorkError(state.projects.find(p => p.id === pid))
+      if (error) throw new Error(error)
+      if (pid !== state.currentProjectId) await store.openProject(pid)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      const c = await api.createConversation(pid)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      await store.refreshTasks()
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+      await store.openTask(c.id)
+      if (epoch !== identityEpoch) throw new Error('登录状态已变化，请重新选择项目后再试')
+    } catch (e) {
+      if (epoch === identityEpoch) store.toast(`对话创建失败：${projectActionError(e)}`)
+      throw e
    }
-    if (pid !== state.currentProjectId) await store.openProject(pid)
-    const c = await api.createConversation(pid)
-    await store.refreshTasks()
-    await store.openTask(c.id)
  },

  /** 兼容旧入口（⌘/命令总线） */
  async createConversation(title?: string) {
-    if (title) store.toast('已在当前项目创建任务')
    await store.createTask()
+    if (title) store.toast('已在当前项目创建任务')
  },

  /** 打开任务：跨项目点击时切换项目上下文（工件/上传归属正确）。 */
  async openTask(convId: string) {
+    const epoch = identityEpoch
    const t = state.tasks.find(x => x.id === convId)
    if (t && t.projectId !== state.currentProjectId) await store.openProject(t.projectId)
+    if (epoch !== identityEpoch) return
    await store.openConversation(convId)
  },

@@ -996,8 +1071,9 @@ export const store = {
    const convId = state.currentConvId
    const pid = state.currentProjectId
    const epoch = conversationEpoch
+    const identity = identityEpoch
    const startedVersion = card.conversationId === state.currentConvId ? cardVersion : projectCardVersion
-    const sameContext = () => state.currentProjectId === pid && (!card.conversationId || (state.currentConvId === convId && conversationEpoch === epoch))
+    const sameContext = () => identity === identityEpoch && state.currentProjectId === pid && (!card.conversationId || (state.currentConvId === convId && conversationEpoch === epoch))
    actionInflight.add(card.id)
    const feedbackOwner = startActionFeedback(card.id)
    try {
@@ -1035,43 +1111,60 @@ export const store = {
        else await store.loadProjectCards()
      }
    } finally {
-      actionInflight.delete(card.id)
+      if (identity === identityEpoch) actionInflight.delete(card.id)
    }
  },

  async cardPin(card: ActivityCard, pinned: boolean) {
-    try { store.upsertCard((await api.cardPin(card.id, pinned)).card) } catch (e) { store.toast(`置顶失败：${e}`) }
+    const epoch = identityEpoch
+    try {
+      const out = await api.cardPin(card.id, pinned)
+      if (epoch === identityEpoch) store.upsertCard(out.card)
+    } catch (e) { if (epoch === identityEpoch) store.toast(`置顶失败：${e}`) }
  },

  async cardDismiss(card: ActivityCard) {
-    try { store.upsertCard((await api.cardDismiss(card.id)).card) } catch (e) { store.toast(`关闭失败：${e}`) }
+    const epoch = identityEpoch
+    try {
+      const out = await api.cardDismiss(card.id)
+      if (epoch === identityEpoch) store.upsertCard(out.card)
+    } catch (e) { if (epoch === identityEpoch) store.toast(`关闭失败：${e}`) }
  },

  async refreshArtifacts(projectId: string) {
+    const epoch = identityEpoch
    try {
      const artifacts = await api.listArtifacts(projectId)
-      if (state.currentProjectId !== projectId) return
+      if (epoch !== identityEpoch || state.currentProjectId !== projectId) return
      set({ artifacts })
    } catch { /* 项目删除竞态等，静默 */ }
  },

  async refreshProfiles() {
-    try { set({ profiles: await api.listProfiles() }) } catch { /* ignore */ }
+    const epoch = identityEpoch
+    try {
+      const profiles = await api.listProfiles()
+      if (epoch === identityEpoch) set({ profiles })
+    } catch { /* ignore */ }
  },

  async refreshPlugins() {
+    const epoch = identityEpoch
    try {
      const list = await api.listPlugins() as { panels?: PluginPanel[] }[]
+      if (epoch !== identityEpoch) return
      const panels = list.flatMap(p => p.panels ?? [])
      set({ pluginPanels: panels })
    } catch { /* ignore */ }
    try {
      const ws = await api.listWorkspaces()
+      if (epoch !== identityEpoch) return
      set({ serverWorkspaces: ws ?? [] })
    } catch { /* ignore */ }
    // 审计入口能力门控（增量 2）：与工作区清单同源刷新——能力撤销（插件卸载/命令停用）后入口随之隐藏。
    try {
      const cmds = await api.listCommands()
+      if (epoch !== identityEpoch) return
      set({
        rdmAuditAvailable: rdmAuditReady(cmds),
        rdmRolesAvailable: rdmRolesReady(cmds),
@@ -1079,13 +1172,19 @@ export const store = {
        rdmDocReviewAvailable: rdmDocReviewReady(cmds),
        rdmPermMatrixAvailable: rdmPermMatrixReady(cmds),
      })
-    } catch { set({ rdmAuditAvailable: false }) }
+    } catch {
+      if (epoch !== identityEpoch) return
+      set({ rdmAuditAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
+        rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false })
+    }
    try {
      const sections = await api.adminZoneSections()
+      if (epoch !== identityEpoch) return
      set({ adminSections: sections ?? [] })
    } catch { /* ignore */ }
    try {
      const settings = await api.getSettings()
+      if (epoch !== identityEpoch) return
      const runtime = settings.user.runtime
      const mock = !!runtime && typeof runtime === 'object' && (runtime as { mock?: unknown }).mock === true
      set({ runtimeMock: mock })
@@ -1094,15 +1193,16 @@ export const store = {

  async uploadAttachment(file: File): Promise<string | null> {
    const pid = state.currentProjectId
+    const epoch = identityEpoch
    if (!pid) return null
    try {
      const up = await api.upload(pid, file)
-      if (state.currentProjectId !== pid) return null
+      if (epoch !== identityEpoch || state.currentProjectId !== pid) return null
      store.toast(`已收到材料：${up.filename}${up.parsed ? ' · 已读取内容' : ''}`)
      await store.refreshArtifacts(pid)
-      return up.artifactId
+      return epoch === identityEpoch && state.currentProjectId === pid ? up.artifactId : null
    } catch (e) {
-      if (state.currentProjectId === pid) store.toast('材料未能上传，请检查文件后重新选择')
+      if (epoch === identityEpoch && state.currentProjectId === pid) store.toast('材料未能上传，请检查文件后重新选择')
      return null
    }
  },
@@ -1140,9 +1240,10 @@ export const store = {

  connectProject() {
    const pid = store.getState().currentProjectId
+    const epoch = identityEpoch
    if (!pid) return
    projectSse?.close()
-    projectSse = connectEvents('', projectSeq, { onEvent: e => { if (state.currentProjectId === pid) store.applyProjectEvent(e) } }, pid)
+    projectSse = connectEvents('', projectSeq, { onEvent: e => { if (epoch === identityEpoch && state.currentProjectId === pid) store.applyProjectEvent(e) } }, pid)
  },

  applyProjectEvent(e: StreamEvent) {
@@ -1183,8 +1284,10 @@ export const store = {
  },

  async cardToProject(card: ActivityCard) {
+    const epoch = identityEpoch
    try {
      const out = await api.cardToProject(card.id)
+      if (epoch !== identityEpoch) return
      store.upsertCard(out.origin) // 会话视图：原卡 dismissed 留痕
      const list = store.getState().projectCards
      const i = list.findIndex(c => c.id === out.card.id)
@@ -1192,17 +1295,23 @@ export const store = {
      store.toast('已留档到项目收件箱')
      store.setInboxScope('project')
    } catch (e) {
-      store.toast(`留档失败：${e}`)
+      if (epoch === identityEpoch) store.toast(`留档失败：${e}`)
    }
  },

  async tidyCards() {
+    const epoch = identityEpoch
    // U1：不收纳失败语义卡（failed，或旧 done+danger），避免把失败当完成清掉。
    const done = state.cards.filter(c => c.status === 'done' && c.tone !== 'danger')
    for (const c of done) {
-      try { const out = await api.cardDismiss(c.id); store.upsertCard(out.card) } catch { /* 单卡失败不阻断 */ }
+      if (epoch !== identityEpoch) return
+      try {
+        const out = await api.cardDismiss(c.id)
+        if (epoch !== identityEpoch) return
+        store.upsertCard(out.card)
+      } catch { /* 单卡失败不阻断 */ }
    }
-    if (done.length > 0) store.toast(`已收纳 ${done.length} 张完成卡`)
+    if (epoch === identityEpoch && done.length > 0) store.toast(`已收纳 ${done.length} 张完成卡`)
  },
  closeWorkspace() { setUI({ activeWorkspace: null }) },
  /** 铃铛：打开右栏并切到待处理。哪一侧有待办就看哪一侧。 */
@@ -1300,6 +1409,8 @@ export const store = {
  },
 }

+auth.onIdentityChange(() => store.resetIdentity())
+
 function touchLive(_runId: string, mutate: (l: LiveState) => void, now = Date.now()): LiveState | null {
  if (state.runs.find(r => r.id === _runId)?.kind === 'subagent') return state.live
  if (state.live && state.live.runId !== _runId && !isTerminal(state.runs.find(r => r.id === state.live?.runId)?.status)) return state.live
@@ -0,0 +1,349 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import { api } from '../src/api'
+import { auth } from '../src/auth'
+import { store } from '../src/store'
+import type { ActivityCard, Conversation, Project } from '../src/contracts'
+import { assignDocDutiesPayload, memberAddPayload } from '../src/rdmManagement'
+
+const project = (id: string, settings?: Project['settings']): Project => ({
+  id, name: id, settings, createdAt: '', updatedAt: '',
+})
+const ready = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready' })
+const task = (id: string): Conversation => ({ id, projectId: 'host-1', title: id, createdAt: '', updatedAt: '' })
+function deferred<T>() {
+  let resolve!: (value: T) => void
+  const promise = new Promise<T>(ok => { resolve = ok })
+  return { promise, resolve }
+}
+const response = (value: unknown, status = 200) => new Response(JSON.stringify(value), { status })
+let projects: Project[]
+let tasks: Conversation[]
+let requests: { path: string; init?: RequestInit }[]
+let route: (path: string, init?: RequestInit) => Promise<Response>
+
+beforeEach(async () => {
+  projects = []; tasks = []; requests = []
+  const saved = new Map<string, string>()
+  vi.stubGlobal('localStorage', { getItem: (key: string) => saved.get(key) ?? null,
+    setItem: (key: string, value: string) => { saved.set(key, value) },
+    removeItem: (key: string) => { saved.delete(key) } })
+  route = async (path, init) => {
+    if (path === '/api/projects' && !init?.method) return response(projects)
+    if (path.startsWith('/api/conversations') && !init?.method) return response(tasks)
+    if (path === '/api/me') return response({ owner: 'alice', name: 'Alice', auth: true })
+    if (path.endsWith('/artifacts')) return response([])
+    if (path.endsWith('/cards')) return response({ cards: [] })
+    if (path.endsWith('/surfaces')) return response([])
+    if (['/api/profiles', '/api/plugins', '/api/workspaces', '/api/commands', '/api/admin-zone/sections'].includes(path)) return response([])
+    if (path === '/api/settings') return response({ schema: [], defaults: {}, user: {}, project: {} })
+    if (path.startsWith('/api/commands/')) return response({ payload: { ok: true } })
+    return response({})
+  }
+  vi.stubGlobal('fetch', async (path: string, init?: RequestInit) => {
+    requests.push({ path, init })
+    return route(path, init)
+  })
+  vi.stubGlobal('EventSource', class { addEventListener() {} close() {} })
+  auth.beginSession()
+  await store.refreshProjects()
+  await store.refreshTasks()
+  store.setUI({ lastProjectId: null })
+  requests = []
+})
+afterEach(() => { vi.restoreAllMocks(); vi.unstubAllGlobals() })
+
+describe('project command identity', () => {
+  it.each(['archived', 'closed'])('preserves canonical member, permission and duty reads for a %s project', async state => {
+    const historical = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': state })
+    const commands = ['rdm.project.member.list', 'rdm.perm.check', 'rdm.perm.matrix',
+      'rdm.review.doc.status', 'rdm.duty.catalog', 'rdm.duty.get']
+    for (const command of commands) await api.rdmProjectCommand(historical, command, { docId: 'doc-2' })
+    expect(requests.map(r => ({ path: r.path, params: JSON.parse(String(r.init?.body)).params }))).toEqual([
+      { path: '/api/commands/rdm.project.member.list', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.perm.check', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.perm.matrix', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.review.doc.status', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.duty.catalog', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.duty.get', params: { projectId: 'domain-7', docId: 'doc-2' } },
+    ])
+  })
+
+  it.each(['archived', 'closed'])('still blocks project and document mutations for a %s project', async state => {
+    const historical = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': state })
+    for (const command of ['rdm.project.member.add', 'rdm.project.member.remove', 'rdm.project.member.setRole',
+      'rdm.review.assign.doc', 'rdm.review.doc.submit', 'rdm.review.doc.approve', 'rdm.review.doc.reject', 'rdm.review.doc.final']) {
+      await expect(api.rdmProjectCommand(historical, command)).rejects.toThrow()
+    }
+    expect(requests).toEqual([])
+  })
+
+  it.each(['rdm.perm.matrix', 'rdm.duty.catalog', 'rdm.duty.get', 'rdm.project.member.setRole'])('uses the same canonical boundary for %s', async command => {
+    await api.rdmProjectCommand(ready, command, { projectId: 'another-host', member: 'bob' })
+    expect(requests.map(r => ({ path: r.path, params: JSON.parse(String(r.init?.body)).params }))).toEqual([
+      { path: `/api/commands/${command}`, params: { projectId: 'domain-7', member: 'bob' } },
+    ])
+  })
+
+  it('sends member and duty commands to the canonical domain project from service metadata', async () => {
+    await api.rdmProjectCommand(ready, 'rdm.project.member.add', memberAddPayload(ready.id, 'bob'))
+    await api.rdmProjectCommand(ready, 'rdm.review.assign.doc', assignDocDutiesPayload(ready.id, 'doc-2', 'alice', ['bob'], 'carol'))
+    expect(requests.map(r => JSON.parse(String(r.init?.body)).params)).toEqual([
+      { projectId: 'domain-7', member: 'bob', role: 'member' },
+      { projectId: 'domain-7', docId: 'doc-2', author: 'alice', reviewers: ['bob'], approver: 'carol' },
+    ])
+  })
+
+  it.each([
+    project('host-1', { 'rdm.state': 'unbound' }),
+    project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'failed' }),
+    project('host-1', { 'rdm.projectId': 'domain-7' }),
+    project('host-1'),
+  ])('does not invent a domain ID or send commands for an unready binding: %j', async p => {
+    await expect(api.rdmProjectCommand(p, 'rdm.project.member.list')).rejects.toThrow()
+    expect(requests).toEqual([])
+  })
+})
+
+describe('project work and mutation failures', () => {
+  it('keeps private history readable for an archived project while refusing new work', async () => {
+    projects = [project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'archived' })]
+    tasks = [task('private-history')]
+    const previous = route
+    route = async (path, init) => {
+      if (path === '/api/conversations/private-history') return response({ conversation: tasks[0],
+        messages: [{ id: 'own-message', conversationId: 'private-history', role: 'user', parts: [{ type: 'text', text: 'My history' }], createdAt: '' }],
+        runs: [], activeHitl: [], lastSeq: 0 })
+      if (path.endsWith('/plan') || path.endsWith('/todos')) return response(null)
+      return previous(path, init)
+    }
+    await store.refreshProjects()
+    await store.openTask('private-history')
+    await expect(store.createTask()).rejects.toThrow()
+    expect(store.getState().currentConvId).toBe('private-history')
+    expect(store.getState().messages.map(m => m.id)).toEqual(['own-message'])
+    expect(requests.filter(r => r.init?.method === 'POST')).toEqual([])
+  })
+
+  it.each([ready, project('host-1')])('creates private work with the host ID in ready RDM and ordinary base mode: %j', async p => {
+    projects = [p]
+    await store.refreshProjects()
+    const previous = route
+    route = async (path, init) => {
+      if (path === '/api/projects/host-1/conversations' && init?.method === 'POST') {
+        tasks = [task('new-private')]
+        return response(tasks[0])
+      }
+      if (path === '/api/conversations/new-private') {
+        return response({ conversation: tasks[0], messages: [], runs: [], activeHitl: [], lastSeq: 0 })
+      }
+      if (path.endsWith('/plan') || path.endsWith('/todos')) return response(null)
+      return previous(path, init)
+    }
+    await store.createTask()
+    expect(store.getState().currentConvId).toBe('new-private')
+    expect(requests.filter(r => r.init?.method === 'POST').map(r => r.path)).toEqual(['/api/projects/host-1/conversations'])
+  })
+
+  it.each(['provisioning', 'failed', 'unbound', 'archived', 'closed'])('does not create a fallback project or conversation for a selected %s project', async state => {
+    projects = [project('host-1', { 'rdm.state': state }), project('host-2')]
+    await store.refreshProjects()
+    requests = []
+    await expect(store.createTask()).rejects.toThrow()
+    expect(requests.filter(r => r.init?.method === 'POST')).toEqual([])
+    expect(store.getState().currentProjectId).toBe('host-1')
+    expect(store.getState().toast).toMatch(/项目.*(稍后|负责人|恢复|关闭)/)
+  })
+
+  it('does not bypass a selected project absent from the current list', async () => {
+    await store.openProject('revoked-project')
+    requests = []
+    await expect(store.createTask()).rejects.toThrow()
+    expect(requests.filter(r => r.init?.method === 'POST')).toEqual([])
+  })
+
+  it.each(['delete', 'rename'])('rejects a denied %s instead of resolving success', async action => {
+    route = async () => response({ error: 'project administration required' }, 403)
+    const mutation = action === 'delete' ? api.deleteProject('host-1') : api.renameProject('host-1', 'renamed')
+    await expect(mutation).rejects.toThrow(/403/)
+  })
+
+  it('retains selection and gives an actionable message when project creation is rejected', async () => {
+    projects = [ready]
+    await store.refreshProjects()
+    route = async () => response({ error: 'name reserved' }, 409)
+    await expect(store.createProject('Taken')).rejects.toThrow()
+    expect(store.getState().currentProjectId).toBe('host-1')
+    expect(store.getState().toast).toMatch(/名称.*(其他|更换)/)
+    expect(store.getState().toast).not.toContain('已创建')
+  })
+
+  it('checks a denied settings save instead of resolving success', async () => {
+    route = async () => response({ error: 'denied' }, 403)
+    await expect(api.putProjectSettings('host-1', {})).rejects.toThrow(/403/)
+  })
+})
+
+describe('identity-scoped state', () => {
+  it('resets state on a successful cookie login, without relying on a component callback', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    route = async () => response({ owner: 'bob', name: 'Bob', isAdmin: false, mustChangePassword: false, passwordSet: true, sessionScope: 'normal' })
+    await api.login('bob', 'password-for-test')
+    expect(store.getState().projects).toEqual([])
+    expect(store.getState().tasks).toEqual([])
+  })
+
+  it('clears old state as soon as logout starts, even while the server response is pending', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    const pending = deferred<Response>()
+    route = async () => pending.promise
+    const logout = api.logout()
+    expect(store.getState().projects).toEqual([])
+    expect(store.getState().tasks).toEqual([])
+    pending.resolve(response({ ok: true }))
+    await logout
+  })
+
+  it('clears the previous account when the authenticated owner changes during identity refresh', async () => {
+    await store.refreshMe()
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    const previous = route
+    projects = []; tasks = []
+    route = (path, init) => path === '/api/me' ? Promise.resolve(response({ owner: 'bob', name: 'Bob', auth: true })) : previous(path, init)
+    await store.refreshMe()
+    expect(store.getState()).toMatchObject({ me: { owner: 'bob' }, projects: [], tasks: [], currentProjectId: null, currentConvId: null })
+  })
+
+  it('clears projects, private tasks, previews and persisted selections on a new session', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects(); await store.refreshTasks()
+    store.openSurface('surface-alice')
+    store.setUI({ projectSettingsId: 'host-1', adminZoneOpen: true, activeWorkspace: 'private-workspace' })
+    localStorage.setItem('as.conv', 'alice-private')
+    auth.beginSession()
+    expect(store.getState()).toMatchObject({ projects: [], tasks: [], me: null, currentProjectId: null, currentConvId: null, artifacts: [], previewTabs: {}, previewActive: {} })
+    expect(store.getState().ui).toMatchObject({ lastProjectId: null, projectSettingsId: null, adminZoneOpen: false, activeWorkspace: null })
+    expect(localStorage.getItem('as.conv')).toBeNull()
+    expect(JSON.parse(localStorage.getItem('as.ui') ?? '{}').lastProjectId).toBeNull()
+  })
+
+  it('drops old project responses after switching accounts even when IDs are shared', async () => {
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/projects' ? old.promise : previous(path, init)
+    const pending = store.refreshProjects()
+    auth.beginSession()
+    projects = [project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': 'ready' })]
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response([project('alice-only')]))
+    await pending
+    expect(store.getState().projects.map(p => p.id)).toEqual(['host-1'])
+    expect(store.getState().currentProjectId).toBe('host-1')
+  })
+
+  it('drops an old private task list after logout and a new session', async () => {
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/conversations' ? old.promise : previous(path, init)
+    const pending = store.refreshTasks()
+    auth.logout()
+    auth.beginSession()
+    tasks = [task('bob-private')]
+    route = previous
+    await store.refreshTasks()
+    old.resolve(response([task('alice-private')]))
+    await pending
+    expect(store.getState().tasks.map(t => t.id)).toEqual(['bob-private'])
+  })
+
+  it('drops an old artifact response when the next account selects the same project', async () => {
+    await store.openProject('host-1')
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path.endsWith('/artifacts') ? old.promise : previous(path, init)
+    const pending = store.refreshArtifacts('host-1')
+    auth.beginSession()
+    route = previous
+    await store.openProject('host-1')
+    old.resolve(response([{ id: 'alice-artifact', projectId: 'host-1', owner: 'alice', name: 'Alice private', kind: 'file', size: 10, createdAt: '', updatedAt: '' }]))
+    await pending
+    expect(store.getState().artifacts).toEqual([])
+  })
+
+  it.each(['action', 'pin', 'dismiss', 'to-project', 'tidy'] as const)('ignores a late project card %s from the previous account on the same shared project', async operation => {
+    projects = [ready]
+    await store.refreshProjects()
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path.startsWith('/api/cards/') ? old.promise : previous(path, init)
+    const card: ActivityCard = { id: 'alice-card', projectId: 'host-1', kind: 'progress', status: 'active', title: 'Alice private work', createdAt: '', updatedAt: '' }
+    if (operation === 'tidy') store.upsertCard({ ...card, status: 'done' })
+    const pending = operation === 'action' ? store.cardAction(card, 'finish')
+      : operation === 'pin' ? store.cardPin(card, true)
+      : operation === 'dismiss' ? store.cardDismiss(card)
+      : operation === 'tidy' ? store.tidyCards() : store.cardToProject(card)
+    auth.beginSession()
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response({ card: { ...card, status: 'done' }, origin: { ...card, status: 'dismissed' } }))
+    await pending
+    expect(store.getState().projectCards).toEqual([])
+    expect(store.getState().cards).toEqual([])
+  })
+
+  it('does not reopen a previous account conversation after its project load finishes late', async () => {
+    projects = [ready]; tasks = [task('alice-private')]
+    await store.refreshProjects()
+    await store.openProject('another-project')
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/projects/host-1/artifacts' ? old.promise : previous(path, init)
+    const pending = store.openTask('alice-private')
+    auth.beginSession()
+    tasks = []
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response([]))
+    await pending
+    expect(store.getState().currentConvId).toBeNull()
+    expect(requests.map(r => r.path)).not.toContain('/api/conversations/alice-private')
+  })
+
+  it('does not resolve old task creation as success after a new login', async () => {
+    projects = [ready]
+    await store.refreshProjects()
+    const old = deferred<Response>()
+    const previous = route
+    route = (path, init) => path === '/api/projects/host-1/conversations' ? old.promise : previous(path, init)
+    const pending = store.createTask()
+    auth.beginSession()
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response(task('alice-created')))
+    await expect(pending).rejects.toThrow(/登录状态/)
+    expect(store.getState().currentConvId).toBeNull()
+  })
+
+  it('does not return a previous account attachment ID when artifact refresh finishes after login', async () => {
+    projects = [ready]
+    await store.refreshProjects()
+    const old = deferred<Response>()
+    const started = deferred<void>()
+    const previous = route
+    route = (path, init) => {
+      if (path.endsWith('/uploads')) return Promise.resolve(response({ artifactId: 'alice-upload', filename: 'alice.txt', size: 3 }))
+      if (path.endsWith('/artifacts')) { started.resolve(); return old.promise }
+      return previous(path, init)
+    }
+    const pending = store.uploadAttachment(new File(['abc'], 'alice.txt'))
+    await started.promise
+    auth.beginSession()
+    route = previous
+    await store.refreshProjects()
+    old.resolve(response([]))
+    expect(await pending).toBeNull()
+  })
+})
Author	SHA1	Message	Date
weichen	eb2d6d32f9	Merge pull request 'Use verified project identities for member workflows' (#82 ) from feature/project-member-access into main	2026-10-13 11:52:27 +00:00
weichen	40c2afe054	Merge the upstream member command rename Why: Current main carries the same corrected lowercase command ID as this member candidate. Evidence: Preserve the canonical wrapper and set-role ID; compare the final tree against the independently tested `2ba275b` object. Impact: Update ancestry only; no intended product behavior change. Refs: Frontend PR83; project-member-access	2026-10-13 11:35:36 +00:00
weichen	42cda9c056	Merge pull request 'Rename member setRole command call to set-role' (#83 ) from fix/set-role-rename into main	2026-10-13 11:03:41 +00:00
weichen	15b962694b	Merge origin/main	2026-10-13 11:03:27 +00:00
weichen	67585c1701	Rename member setRole command call to set-role Why: RDM 命令 ID 契约改名（camelCase 违基座校验，RDM 仓同批修复）；前端调用点同步。 Evidence: tsc 通过。 Impact: 单处命令 ID。	2026-10-13 10:50:36 +00:00
weichen	2ba275b991	Keep document duties tied to the current selection Why: Fresh documents had no first-submit action, reading active duties opened confirmation dialogs, and delayed detail or status queries could overwrite another selection and send its document ID with the wrong duty draft. Evidence: SELF real-browser regressions observed the missing action, render-time dialogs, detail/status races, and a follow-up query after panel unmount. Five focused Playwright scenarios passed after the fix, together with the full npm test, npm run build, and git diff --check commands. Receipts: /tmp/project-member-duties-browser-green-20261013.json and /tmp/project-member-duties-full-build-green-20261013.json. Impact: Offer first submission independently of an existing review round. Ask for invalidation only on a dirty save click. Guard queries and continuations with project lifetime, selection, and request sequences; keep the existing Picker, canonical project routing, controls, and UI tokens. Refs: Dev project-member-access Task 4; independent synchronized Frontend P2 review	2026-10-13 10:21:37 +00:00
weichen	e7f9081a93	Merge current project picker and permission panels Why: Current main supplies member pickers and duty catalogs that must keep verified project identity. Evidence: Frontend 259 tests and build pass after resolving panel conflicts; final canonical set-role dispatch and fixed combo checks follow. Impact: Preserve upstream panels with canonical project commands and read-versus-work state guards. Refs: feature/project-member-access; origin/main `c294835`	2026-10-13 10:02:54 +00:00
weichen	c294835f8d	Merge pull request 'Rebuild duties and permission pages on catalog, matrix and tri-state' (#81 ) from feature/rdm-increment-duties-page into main	2026-10-13 09:56:49 +00:00
weichen	880eff74f8	Rebuild duties and permission pages on catalog, matrix and tri-state Why: P7-B/C——文档职责页升级为「文档清单＋选中职责详情」（duty.catalog/get：名称/类型/阶段/在途轮次，当前职责经三个项目成员 Picker 回填并与冻结名单分列；在途轮次失效确认；批量勾选+统一三权走 assign.doc.batch，整批拒绝列原因）；权限页升级为「单成员详情＋多人矩阵」双视图（中文标签、系统范围动作折叠为技术详情、矩阵单元格悬停解释、行展开三态覆盖——沿用默认/项目内允许/项目内禁止，恢复默认走 perm.unset 实际撤销）。 Evidence: tsc、design-guard 6/6、npm run build 通过；服务端语义由 RDM #346（标签/矩阵）与 #349（unset）测试覆盖；折叠使用 @ui Collapsible 原语。 Impact: RdmDutiesSection/RdmPermMatrixSection 重构；无跨页变更。 Refs: 提案 r1 §4/§5/P7；RDM #346/#349	2026-10-13 09:56:32 +00:00
weichen	b7473fe585	Merge pull request 'Wire members section to Picker with explicit role changes' (#80 ) from feature/rdm-increment-members-picker into main	2026-10-13 09:35:29 +00:00
weichen	dfcea5c988	Wire members section to Picker with explicit role changes Why: P7-A——成员添加从手填账号升级为可搜索人员选择器（@ui Picker：搜索/浏览/键盘/分页），仅提交稳定账号；候选「已加入」标记杜绝隐式身份变更；成员表拆分「专业角色」与「项目身份」（中文标签）两列；身份调整走 rdm.project.member.setRole 显式命令（升/降按钮）。 Evidence: tsc 通过；design-guard 6/6；npm run build 成功；Picker 行为由 UI #53 的 7 用例覆盖。 Impact: RdmMembersSection 重构（member.add/setRole/remove 三命令消费）；rdmManagement 增 setRole payload；account.list 适配层 query 透传+旧基座首页本地过滤降级。 Refs: 提案 r1 §3/P7；UI #53；RDM #345	2026-10-13 09:34:52 +00:00
weichen	07a03ac4f6	Preserve project history reads after archive or closure Why: Project readiness is a write gate. Applying it to member, permission, and document status queries hides history that the backend intentionally keeps readable after archival or closure. Evidence: SELF archived and closed read regressions failed before the fix. Full npm test, npm run build, and git diff --check passed with the amended code. Receipts: /tmp/project-member-frontend-archived-read-red-20261013.json and /tmp/project-member-frontend-archived-read-green-20261013.json. Impact: Resolve canonical project IDs separately from command readiness. Preserve known read commands and existing settings tabs for historical projects; keep mutations and new work blocked with existing disabled controls. Server authorization remains authoritative. Refs: Dev project-member-access Task 4; independent Frontend review P2	2026-10-13 08:41:12 +00:00
weichen	d69009e081	Invalidate account continuations across awaited project work Why: An identity can change after an operation has passed its first response guard. Later project loads, cleanup calls, and attachment refreshes must not reopen private context or return the previous account's result to the new session. Evidence: SELF regressions failed before the guards: delayed project opening, task creation success, completed-card cleanup, and upload artifact-ID return. SELF npm test, npm run build, and git diff --check passed; full command receipt: /tmp/project-member-frontend-final-checks-20261013.json. Impact: Guard post-await continuations with the same identity epoch. Preserve the original server-side result and ignore stale client projections; do not undo the previous account's already completed work. Refs: Dev feature-project-member-access implementation plan Task 4	2026-10-13 08:24:06 +00:00
weichen	55a64f40e8	Respect canonical project bindings and isolate account state Why: Project members need RDM commands to address the registered domain project. Failed project states and responses from a previous account must not create work, report a rejected mutation as successful, or restore private content. Evidence: SELF npm test: 32 files and 251 tests passed, including project command, mutation rejection, archived history, and delayed account response coverage. SELF npm run build and git diff --check passed. Original regressions were observed before implementation; root owns composition and independent replay. Impact: Keep host IDs for conversation and base settings APIs; send the decorated domain ID to RDM project commands. Reuse existing sidebar, settings and toast states. Reset identity projections and invalidate old asynchronous responses. No deployment, database change, push, merge, or workspace cleanup. Refs: Dev feature-project-member-access task card and implementation plan Task 4	2026-10-13 08:20:44 +00:00
weichen	b3fa39744d	Merge pull request 'Add admin system settings panel for managed model and service config' (#78 ) from feature/rdm-increment-system-settings into main	2026-10-13 06:40:58 +00:00