Guard the admin create path with a browser e2e scenario

Why: the 400 (unknown field name) outage shipped because no automated
check drove the UsersPanel create path against the strict backend
contract; this scenario pins the request body, the pending notice, the
table row state and the CLI handoff hint into the composition suite.
Evidence: passing run against the deployed shared dev (SELF, task card).
Impact: e2e/ only; no production code.
Refs: backend 8dfc223, frontend #94

e2e/admin-user-create.playwright.ts

@@ -0,0 +1,83 @@
+// 防再发守卫：管理员建号路径（UsersPanel）必须持续符合后端待初始化契约。
+// 背景：backend 8dfc223 将 POST /api/admin/users 改为严格 {owner, profile} 解码，
+// 前端未跟进导致部署后 UI 建号 400（json: unknown field "name"）——单测与 mock
+// 都没有覆盖这条组合路径，本场景以真实浏览器把「填用户名 → 创建账号 →
+// 确认『待初始化』提示与用户表行」钉进组合验收线。
+// 驱动方：Dev 仓 scripts/e2e.sh——构建 RDM 二进制 + frontend dist，起 serve（auth on）
+// 与 vite preview；种子账号 e2e-auditor 为基座管理员（bootstrap-admin）。
+// 环境契约（缺省值与 e2e.sh 一致；PLAYWRIGHT_BASE_URL 未设置时整组跳过）：
+//   PLAYWRIGHT_BASE_URL / E2E_OWNER / E2E_PASSWORD / E2E_PASSWORD2
+import { test, expect, type Page } from '@playwright/test'
+
+const OWNER = process.env.E2E_OWNER || 'e2e-auditor'
+const PASSWORD = process.env.E2E_PASSWORD || 'E2eAudit#2026'
+const PASSWORD2 = process.env.E2E_PASSWORD2 || 'E2eAudit#2026b'
+
+test.skip(!process.env.PLAYWRIGHT_BASE_URL, 'set PLAYWRIGHT_BASE_URL (scripts/e2e.sh drives this suite)')
+
+async function login(page: Page) {
+  await page.goto('/')
+  await expect(page.getByPlaceholder('由管理员分配')).toBeVisible()
+  await page.getByPlaceholder('由管理员分配').fill(OWNER)
+  await page.getByPlaceholder('初始密码或常用密码').fill(PASSWORD)
+  await page.getByRole('button', { name: '登录', exact: true }).click()
+  // 三种落点：直接进工作台（密码已生效）｜强制改密门｜初始密码已失效（种子二次运行）→ 改用新密码重登。
+  const entered = await page.locator('.tsb-user').waitFor({ state: 'visible', timeout: 5_000 }).then(() => true).catch(() => false)
+  if (!entered) {
+    const gated = await page.getByText('修改密码').waitFor({ state: 'visible', timeout: 5_000 }).then(() => true).catch(() => false)
+    if (gated) {
+      const pwInputs = page.locator('.lg-card input[type="password"]')
+      await pwInputs.nth(0).fill(PASSWORD)
+      await pwInputs.nth(1).fill(PASSWORD2)
+      await pwInputs.nth(2).fill(PASSWORD2)
+      await page.getByRole('button', { name: '设置新密码并进入' }).click()
+    } else {
+      await page.getByPlaceholder('初始密码或常用密码').fill(PASSWORD2)
+      await page.getByRole('button', { name: '登录', exact: true }).click()
+    }
+  }
+  await expect(page.locator('.tsb-user')).toBeVisible({ timeout: 15_000 })
+}
+
+test('管理员建号：UI 请求新契约并给出待初始化提示', async ({ page }) => {
+  await login(page)
+
+  // 账户菜单 → 系统管理…（全屏独立视图）→ 用户管理分区。
+  await page.locator('.tsb-user').click()
+  const adminEntry = page.getByText('系统管理…', { exact: true })
+  await expect(adminEntry).toBeVisible()
+  await adminEntry.click()
+  await expect(page.locator('.az')).toBeVisible()
+  const usersSection = page.getByText('用户管理', { exact: true }).first()
+  if (await usersSection.count()) await usersSection.click()
+
+  // 建号表单：用户名每次运行唯一（重复运行不因 409 假红），显示名可空。
+  const newOwner = `e2e-ui-${Date.now().toString(36)}`
+  const userInput = page.getByPlaceholder('用户名（登录名）')
+  await expect(userInput).toBeVisible()
+  await userInput.fill(newOwner)
+  await page.getByPlaceholder('显示名（可空）').fill('组合验收')
+
+  // 创建 → 契约断言一：请求体是严格 {owner, profile:{name}}，无 password/isAdmin。
+  const createBody = page.waitForRequest(
+    req => req.url().endsWith('/api/admin/users') && req.method() === 'POST',
+  ).then(req => req.postDataJSON())
+  await page.getByRole('button', { name: '创建账号', exact: true }).click()
+  const body = await createBody
+  expect(body).toEqual({ owner: newOwner, profile: { name: '组合验收' } })
+
+  // 契约断言二：成功提示逐字含「待初始化」与 CLI 发放指引。
+  await expect(page.locator('.ad-notice')).toHaveText(
+    `已创建 ${newOwner}（待初始化）：请在服务器执行 user initialize-account 发放激活 Key`,
+  )
+
+  // 契约断言三：用户表出现该账号，状态为未设密码（HTTP 建号不能设密码/授权限）。
+  const row = page.locator('.ad-table tbody tr', { hasText: newOwner })
+  await expect(row).toBeVisible()
+  await expect(row).toContainText('未设密码')
+  await expect(row).not.toContainText('ADMIN')
+
+  // 界面说明与后端流程一致（激活 Key 由服务器本地 CLI 发放）。
+  await expect(page.locator('.ad-create .ad-hint')).toContainText('待初始化')
+  await expect(page.locator('.ad-create .ad-hint')).toContainText('user initialize-account')
+})

e2e/rdm-duties.playwright.ts

@@ -1,4 +1,4 @@
-// Real React/Picker interaction with deterministic HTTP responses; no live account or database.
+// 文档职责三视图：确定性 HTTP，不连接真实账号或数据库。
 import { test, expect, type Page } from '@playwright/test'
 
 test.skip(!process.env.PLAYWRIGHT_BASE_URL, 'set PLAYWRIGHT_BASE_URL to an isolated frontend server')
@@ -11,17 +11,10 @@ function deferred() {
 
 async function dutiesPage(page: Page) {
   const writes: { command: string; params: Record<string, unknown> }[] = []
-  const calls: { command: string; params: Record<string, unknown> }[] = []
   const holds = new Map<string, { started: ReturnType<typeof deferred>; release: ReturnType<typeof deferred> }>()
-  const active = new Set<string>()
-  const submissions: Record<string, unknown> = { 'doc-A': null, 'doc-B': null }
-  const commands = ['rdm.project.member.list', 'rdm.project.member.add', 'rdm.project.member.remove',
-    'rdm.duty.catalog', 'rdm.duty.get', 'rdm.review.assign.doc', 'rdm.review.assign.doc.batch',
-    'rdm.review.doc.submit', 'rdm.review.doc.approve', 'rdm.review.doc.reject', 'rdm.review.doc.final', 'rdm.review.doc.status']
-  const docs = [
-    { docId: 'doc-A', title: '文档A', typeKey: 'design', sections: 1, assigned: true, author: 'alice', reviewers: ['carol'], approver: 'dave' },
-    { docId: 'doc-B', title: '文档B', typeKey: 'design', sections: 1, assigned: true, author: 'bob', reviewers: ['carol'], approver: 'dave' },
-  ]
+  let generation = 0
+  const commands = ['rdm.project.member.list', 'rdm.duty.matrix', 'rdm.duty.preview',
+    'rdm.review.assign.doc', 'rdm.review.assign.doc.batch', 'rdm.duty.legacy.scan', 'rdm.duty.legacy.apply']
   await page.route('**/api/**', async route => {
     const request = route.request()
     const path = new URL(request.url()).pathname
@@ -36,125 +29,73 @@ async function dutiesPage(page: Page) {
       const command = decodeURIComponent(path.substring('/api/commands/'.length))
       const params = request.postDataJSON().params as Record<string, unknown>
       expect(params.projectId).toBe('domain-7')
-      calls.push({ command, params })
-      const hold = holds.get(`${command}:${params.docId ?? ''}`)
+      const hold = holds.get(command)
       if (hold) { hold.started.resolve(); await hold.release.promise }
-      let payload: unknown = {}
-      if (command === 'rdm.duty.catalog') payload = { docs }
-      else if (command === 'rdm.project.member.list') payload = { members: ['alice', 'bob', 'carol', 'dave'].map(owner => ({ owner, role: 'member', addedBy: '', addedAt: '' })) }
-      else if (command === 'rdm.duty.get') {
-        const doc = docs.find(d => d.docId === params.docId)!
-        payload = { docId: doc.docId, title: doc.title, assigned: doc.assigned,
-          roles: { author: doc.author, reviewers: doc.reviewers, approver: doc.approver }, sections: [],
-          active: active.has(doc.docId) ? { round: 1, state: 'submitted', createdBy: 'alice' } : null }
-      } else if (command === 'rdm.review.doc.status') payload = { submission: submissions[String(params.docId)] }
-      else { writes.push({ command, params }) }
-      body = { payload }
+      const author = generation === 0 ? 'alice' : 'bob'
+      if (command === 'rdm.duty.matrix') {
+        body = { payload: {
+          canAssign: true,
+          docs: [{ docId: 'doc-A', code: 'A', title: '文档A', typeKey: 'design', stage: 'BD', dutyVersion: 1, authors: 1, reviewers: 1, approvers: 1, conflicts: 0, legacySectionOverrides: 0 }],
+          members: ['alice', 'bob', 'carol'].map(owner => ({ owner, role: 'member', valid: true, canAuthor: true, canReview: true, canApprove: true })),
+          cells: [
+            { docId: 'doc-A', owner: 'alice', duty: author === 'alice' ? 'author' : 'none' },
+            { docId: 'doc-A', owner: 'bob', duty: author === 'bob' ? 'author' : 'reviewer' },
+            { docId: 'doc-A', owner: 'carol', duty: 'approver' },
+          ],
+        } }
+      } else if (command === 'rdm.duty.preview') {
+        writes.push({ command, params })
+        body = { payload: { ok: true, docs: [{ docId: 'doc-A', title: '文档A', replacedAuthor: 'alice' }] } }
+      } else if (command === 'rdm.duty.legacy.scan') {
+        body = { payload: { findings: [{ docId: 'doc-A', title: '文档A', sectionTitle: '范围', kind: 'ambiguous' }] } }
+      } else {
+        writes.push({ command, params })
+        generation += 1
+        body = { payload: { applied: 1 } }
+      }
     } else if (path.endsWith('/cards')) body = { cards: [] }
     await route.fulfill({ contentType: 'application/json', body: JSON.stringify(body) })
   })
   await page.goto('/')
   await page.getByRole('button', { name: '项目设置', exact: true }).click()
-  await page.getByRole('tab', { name: /文档职责/ }).click()
-  await expect(page.getByRole('button', { name: '文档A', exact: true })).toBeVisible()
-  return { writes, calls, active, submissions,
-    hold(command: string, docId: string) {
-      const pending = { started: deferred(), release: deferred() }
-      holds.set(`${command}:${docId}`, pending)
-      return pending
-    } }
+  await page.getByRole('tab', { name: '文档职责', exact: true }).click()
+  await expect(page.getByText('本页只分配已有文档的职责，不创建或生成文档。')).toBeVisible()
+  return { writes, hold(command: string) {
+    const pending = { started: deferred(), release: deferred() }
+    holds.set(command, pending)
+    return pending
+  } }
 }
 
-async function chooseMember(page: Page, label: string, owner: string) {
-  await page.locator(`.picker[aria-label="${label}"]`).getByRole('combobox').fill(owner)
-  await page.getByRole('option', { name: new RegExp(`^${owner}`) }).click()
-}
-
-async function settleResponse(page: Page, command: string, release: () => void) {
-  const response = page.waitForResponse(r => r.url().endsWith(`/api/commands/${command}`))
-  release()
-  await response
-  await page.evaluate(() => new Promise<void>(done => requestAnimationFrame(() => requestAnimationFrame(() => done()))))
-}
-
-test('a newly assigned document can submit its first whole-document review', async ({ page }) => {
+test('three views share one draft and do not offer review actions', async ({ page }) => {
   const fixture = await dutiesPage(page)
-  await page.getByRole('button', { name: '文档A', exact: true }).click()
-  await expect(page.getByText('该文档尚无整文提交记录（当前职责仍可分配）。', { exact: true })).toBeVisible()
-  const submit = page.getByRole('button', { name: '整文提交（编制人）', exact: true })
-  await expect(submit).toBeEnabled()
-  await submit.click()
-  await expect(page.getByText('整文已提交审核（全文锁定）', { exact: true })).toBeVisible()
-  expect(fixture.writes).toEqual([{ command: 'rdm.review.doc.submit', params: { projectId: 'domain-7', docId: 'doc-A' } }])
+  await page.getByLabel('选择成员').selectOption('bob')
+  await page.getByLabel('bob 在 文档A 的职责').selectOption({ label: '编制（将替换alice）' })
+  await page.getByRole('tab', { name: '按文档' }).click()
+  await page.getByLabel('选择文档').selectOption('doc-A')
+  await page.getByLabel('alice 在 文档A 的职责').selectOption('审核')
+  await expect(page.getByLabel('bob 在 文档A 的职责')).toHaveValue('author')
+  await page.getByRole('tab', { name: '矩阵' }).click()
+  await expect(page.getByLabel('bob 在 文档A 的职责')).toHaveValue('author')
+  await expect(page.getByRole('button', { name: /提交|审核通过|驳回|终批|生成|新建文档/ })).toHaveCount(0)
+  await page.getByRole('button', { name: '保存职责' }).click()
+  await expect.poll(() => fixture.writes.map(item => item.command)).toEqual(['rdm.duty.preview', 'rdm.review.assign.doc.batch'])
 })
 
-test('viewing active duties is passive; only a dirty save asks for confirmation', async ({ page }) => {
+test('a stale matrix response does not replace the current draft', async ({ page }) => {
   const fixture = await dutiesPage(page)
-  fixture.active.add('doc-A')
-  const dialogs: string[] = []
-  let accept = false
-  page.on('dialog', async dialog => { dialogs.push(dialog.message()); accept ? await dialog.accept() : await dialog.dismiss() })
-  await page.getByRole('button', { name: '文档A', exact: true }).click()
-  await expect(page.getByRole('heading', { name: /文档A · 当前职责/ })).toBeVisible()
-  const save = page.getByRole('button', { name: '保存当前职责', exact: true })
-  await expect(save).toBeDisabled()
-  expect(dialogs).toEqual([])
-  await chooseMember(page, '编制人', 'bob')
-  await expect(save).toBeEnabled()
-  expect(dialogs).toEqual([])
-  await save.click()
-  expect(dialogs).toHaveLength(1)
-  expect(fixture.writes).toEqual([])
-  accept = true
-  await save.click()
-  await expect(page.getByText('已保存当前职责', { exact: true })).toBeVisible()
-  expect(dialogs).toHaveLength(2)
-  expect(fixture.writes).toEqual([{ command: 'rdm.review.assign.doc', params: {
-    projectId: 'domain-7', docId: 'doc-A', author: 'bob', reviewers: ['carol'], approver: 'dave',
-  } }])
+  await page.getByLabel('选择成员').selectOption('alice')
+  const held = fixture.hold('rdm.duty.matrix')
+  await page.getByLabel('筛选文档名称或编号').fill('文档A')
+  await held.started.promise
+  await page.getByLabel('alice 在 文档A 的职责').selectOption('审核')
+  held.release.resolve()
+  await expect(page.getByLabel('alice 在 文档A 的职责')).toHaveValue('reviewer')
 })
 
-test('a late document detail cannot overwrite another selection or its saved roles', async ({ page }) => {
-  const fixture = await dutiesPage(page)
-  const old = fixture.hold('rdm.duty.get', 'doc-A')
-  await page.getByRole('button', { name: '文档A', exact: true }).click()
-  await old.started.promise
-  await page.getByRole('button', { name: '文档B', exact: true }).click()
-  await expect(page.getByRole('heading', { name: '文档B · 当前职责', exact: true })).toBeVisible()
-  await settleResponse(page, 'rdm.duty.get', old.release.resolve)
-  await expect(page.getByRole('heading', { name: '文档B · 当前职责', exact: true })).toBeVisible()
-  expect(fixture.calls.filter(c => c.command === 'rdm.review.doc.status' && c.params.docId === 'doc-A')).toEqual([])
-  await chooseMember(page, '批准人', 'alice')
-  await page.getByRole('button', { name: '保存当前职责', exact: true }).click()
-  await expect(page.getByText('已保存当前职责', { exact: true })).toBeVisible()
-  expect(fixture.writes).toEqual([{ command: 'rdm.review.assign.doc', params: {
-    projectId: 'domain-7', docId: 'doc-B', author: 'bob', reviewers: ['carol'], approver: 'alice',
-  } }])
-})
-
-test('a late review status cannot replace the selected document frozen review', async ({ page }) => {
-  const fixture = await dutiesPage(page)
-  const submission = (round: number, author: string) => ({ round, state: 'submitted', digest: '', createdBy: author,
-    createdAt: '', duties: { author, reviewers: ['carol'], approver: 'dave' }, reviews: {}, sections: {} })
-  fixture.submissions['doc-A'] = submission(1, 'alice')
-  fixture.submissions['doc-B'] = submission(2, 'bob')
-  const old = fixture.hold('rdm.review.doc.status', 'doc-A')
-  await page.getByRole('button', { name: '文档A', exact: true }).click()
-  await old.started.promise
-  await page.getByRole('button', { name: '文档B', exact: true }).click()
-  await expect(page.getByRole('heading', { name: /整文审签 · 第 2 轮/ })).toBeVisible()
-  await settleResponse(page, 'rdm.review.doc.status', old.release.resolve)
-  await expect(page.getByRole('heading', { name: /整文审签 · 第 2 轮/ })).toBeVisible()
-  await expect(page.getByRole('heading', { name: /整文审签 · 第 1 轮/ })).toHaveCount(0)
-})
-
-test('closing the project panel invalidates a pending detail before its follow-up status read', async ({ page }) => {
-  const fixture = await dutiesPage(page)
-  const old = fixture.hold('rdm.duty.get', 'doc-A')
-  await page.getByRole('button', { name: '文档A', exact: true }).click()
-  await old.started.promise
-  await page.getByRole('dialog').getByRole('button', { name: '关闭', exact: true }).click()
-  await expect(page.getByRole('tab', { name: /文档职责/ })).toHaveCount(0)
-  await settleResponse(page, 'rdm.duty.get', old.release.resolve)
-  expect(fixture.calls.filter(c => c.command === 'rdm.review.doc.status' && c.params.docId === 'doc-A')).toEqual([])
+test('a narrow viewport points away from the full matrix', async ({ page }) => {
+  await dutiesPage(page)
+  await page.setViewportSize({ width: 390, height: 800 })
+  await page.getByRole('tab', { name: '矩阵' }).click()
+  await expect(page.getByText('当前宽度放不下成员×文档矩阵。请使用“按人员”或“按文档”。')).toBeVisible()
 })

e2e/work-companion.playwright.ts

@@ -159,6 +159,8 @@ test('keeps optional choices nonblocking and supports defer, reopen, free input
   await page.getByRole('button', { name: '发送', exact: true }).click()
   await expect.poll(() => state.sent?.text).toBe('先聊一下本周的安排')
   expect(state.sent?.taskRef).toBeUndefined()
+  // Receiving the POST is earlier than rendering its legitimate foreground reply.
+  await expect(page.locator('.msg.assistant[data-msg-id="live:run1"]')).toBeVisible()
   const assistantCount = await page.locator('.msg.assistant').count()
   await inline.getByRole('button', { name: '继续选择', exact: true }).click()
   await inline.getByRole('checkbox', { name: '生成摘要', exact: true }).check()

src/api.ts

@@ -15,6 +15,37 @@ const BASE = ''
  *  自身命令面 fail-closed。 */
 export interface AdminZoneSection { id: string; title: string; icon?: string; desc?: string; order?: number }
 
+/** 账户链路（2026-10-13 恢复合同 + 2026-10-14 current_required 加固）：
+ * passwordChangeMode 由服务端从会话派生；grant_setup 免当前密码，
+ * current_required 必须校验当前密码。 */
+export type PasswordChangeMode = 'grant_setup' | 'current_required'
+
+/** 恢复提案（属主确认制）：管理员只能提案，确认须用提案前已存在的合格完整密码会话。 */
+export interface RecoveryProposal {
+  id: string; userId: string; owner: string
+  status: 'pending' | 'confirmed' | 'completed' | 'revoked' | 'expired'
+  version: number; generation: number; createdBy: string
+  createdAt: string; expiresAt: string
+}
+
+/** 账号资料与档案视图（backend accountProfileJSON 契约）。 */
+export interface AccountProfile { name: string; phone: string; email: string; staffNo: string; department: string; notes: string }
+export interface AccountRecord {
+  userId: string; owner: string; profile: AccountProfile; profileVersion: number
+  enabled?: boolean; stateVersion?: number; isAdmin?: boolean; passwordSet?: boolean
+  initializationState?: string; initializationGeneration?: number
+}
+
+export interface ExecEnvView {
+  configured: boolean
+  root?: string
+  python?: string
+  base?: string
+  layers?: string[]
+  requests?: { id: string; conversationId: string; owner: string; spec: string; reason: string; status: string; layerId: string; detail: string; approver: string }[]
+  bindings?: { conversationId: string; baseId: string; extensions: string[] | null; isolated: string }[]
+}
+
 async function checked(res: Response): Promise<Response> {
   if (!res.ok) {
     const text = await res.text()
@@ -48,7 +79,7 @@ export const api = {
   projectSurfaces: (projectId: string) => auth.fetch(`${BASE}/api/projects/${projectId}/surfaces`).then(r => json<SurfaceMeta[]>(r)),
   /** 单页权威快照（含 identity + spec），供列表水合与预览渲染。 */
   surfaceGet: (id: string) => auth.fetch(`${BASE}/api/surfaces/${id}`).then(r => json<SurfaceSnapshot>(r)),
-  me: () => auth.fetch(`${BASE}/api/me`).then(r => json<{ owner: string; name: string; auth: boolean; authVia?: string; sessionScope?: string; isAdmin?: boolean; mustChangePassword?: boolean; passwordSet?: boolean }>(r)),
+  me: () => auth.fetch(`${BASE}/api/me`).then(r => json<{ owner: string; name: string; auth: boolean; authVia?: string; sessionScope?: string; passwordChangeMode?: PasswordChangeMode; isAdmin?: boolean; mustChangePassword?: boolean; passwordSet?: boolean }>(r)),
   // ---- 认证与会话（管理员发放制，R2）----
   login: (owner: string, password: string) => auth.fetch(`${BASE}/api/auth/login`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, password }) }).then(async r => {
     if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
@@ -73,12 +104,35 @@ export const api = {
     if (!r.ok) throw new Error(`${r.status}: ${await r.text()}`)
     return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; reloginRequired: boolean }>
   }),
-  listAdminUsers: () => auth.fetch(`${BASE}/api/admin/users`).then(r => json<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string }[]>(r)),
-  createAdminUser: (owner: string, name: string, password: string, isAdmin: boolean) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, name, password, isAdmin }) }).then(r => json<{ owner: string; mustChangePassword: boolean }>(r)),
-  // ---- 管理员：一次性登录 Key（忘记密码恢复主入口；旧"直接重置密码"接口退出常规 UI）----
-  adminIssueLoginKey: (owner: string, ttlMinutes?: number) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/login-keys`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ purpose: 'recover', ...(ttlMinutes ? { ttlMinutes } : {}) }) }).then(r => json<{ id: string; owner: string; purpose: string; status: string; expiresAt: string; key: string }>(r)),
+  listAdminUsers: () => auth.fetch(`${BASE}/api/admin/users`).then(r => json<{ userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number; profileVersion: number; initializationState: string }[]>(r)),
+  // 建号只创建待初始化账号（无密码、无权限位）；初始凭证由服务器本地 CLI 发放激活 Key。
+  createAdminUser: (owner: string, name: string) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile: { name } }) }).then(r => json<{ owner: string; initializationState: string }>(r)),
+  // ---- 管理员：一次性登录 Key（HTTP 签发端点已被恢复提案契约替换为 410，客户端方法随之移除；
+  // list/revoke 仍有效，供恢复提案视图复用；兑换入口不变）----
   adminListLoginKeys: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/login-keys`).then(r => json<{ keys: { id: string; owner: string; purpose: string; status: string; expiresAt: string; createdAt: string; createdBy?: string }[] }>(r)).then(d => d.keys ?? []),
   adminRevokeLoginKey: (owner: string, id: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/login-keys/${encodeURIComponent(id)}`, { method: 'DELETE' }).then(r => json<{ ok: boolean }>(r)),
+  // ---- 管理员：恢复提案（属主确认制，替换已 410 的直接签发 Key 入口）----
+  createAdminRecoveryProposal: (userId: string, expectedStateVersion: number, idempotencyKey: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/recovery-proposals`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedStateVersion, idempotencyKey }) }).then(r => json<RecoveryProposal>(r)),
+  listAdminRecoveryProposals: (userId: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/recovery-proposals`).then(r => json<{ proposals: RecoveryProposal[] }>(r)).then(d => d.proposals ?? []),
+  adminRevokeRecoveryProposal: (userId: string, id: string, expectedVersion: number) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(userId)}/recovery-proposals/${encodeURIComponent(id)}`, { method: 'DELETE', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedVersion }) }).then(r => json<RecoveryProposal>(r)),
+  // ---- 本人：资料与恢复提案确认（须完整密码会话）----
+  meProfile: () => auth.fetch(`${BASE}/api/me/profile`).then(r => json<AccountRecord>(r)),
+  patchMeProfile: (expectedProfileVersion: number, patch: Partial<AccountProfile>) => auth.fetch(`${BASE}/api/me/profile`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedProfileVersion, patch }) }).then(r => json<AccountRecord>(r)),
+  listMyRecoveryProposals: () => auth.fetch(`${BASE}/api/me/recovery-proposals`).then(r => json<{ proposals: RecoveryProposal[] }>(r)).then(d => d.proposals ?? []),
+  getMyRecoveryProposal: (id: string) => auth.fetch(`${BASE}/api/me/recovery-proposals/${encodeURIComponent(id)}`).then(r => json<RecoveryProposal>(r)),
+  confirmMyRecoveryProposal: (id: string, expectedVersion: number) => auth.fetch(`${BASE}/api/auth/recovery-proposals/${encodeURIComponent(id)}/confirm`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedVersion }) }).then(r => json<{ proposal: RecoveryProposal; grant?: string }>(r)),
+  rotateMyRecoveryGrant: (id: string, expectedVersion: number, expectedGeneration: number) => auth.fetch(`${BASE}/api/auth/recovery-proposals/${encodeURIComponent(id)}/rotate-grant`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ expectedVersion, expectedGeneration }) }).then(r => json<{ proposal: RecoveryProposal; grant?: string }>(r)),
+  adminExecEnv: () => auth.fetch(`${BASE}/api/admin/exec-env`).then(r => json<ExecEnvView>(r)),
+  adminExecEnvDecision: (id: string, allow: boolean, isolate: boolean) => auth.fetch(`${BASE}/api/admin/exec-env/requests/${encodeURIComponent(id)}/decision`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ allow, isolate }) }).then(r => json<{ status: string; detail?: string; layerId?: string }>(r)),
+  adminExecEnvRebase: () => auth.fetch(`${BASE}/api/admin/exec-env/rebase`, { method: 'POST' }).then(r => json<{ base: string }>(r)),
+  adminExecEnvGC: () => auth.fetch(`${BASE}/api/admin/exec-env/gc`, { method: 'POST' }).then(r => json<{ removed: string[] | null }>(r)),
+  adminExecEnvWheel: (file: File, conversationId: string, reason: string) => {
+    const body = new FormData()
+    body.set('wheel', file)
+    body.set('conversationId', conversationId)
+    body.set('reason', reason)
+    return auth.fetch(`${BASE}/api/admin/exec-env/wheels`, { method: 'POST', body }).then(r => json<{ file: string; outcome: { status: string; requestId?: string; detail?: string } }>(r))
+  },
   createConversation: (projectId: string, title?: string) => auth.fetch(`${BASE}/api/projects/${projectId}/conversations`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ title: title ?? '' }) }).then(r => json<Conversation>(r)),
   deleteConversation: (id: string) => auth.fetch(`${BASE}/api/conversations/${id}`, { method: 'DELETE' }),
   setConversationProfile: (id: string, profileId: string) => auth.fetch(`${BASE}/api/conversations/${id}`, { method: 'PATCH', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ profileId }) }).then(r => json<Conversation>(r)),

src/components/AdminZone.tsx

@@ -8,6 +8,7 @@ import { useState } from 'react'
 import { store, useStore } from '../store'
 import { EmptyState, Icon, type IconName } from '@ui'
 import { UsersPanel, ProfilesSection, PluginsSection, PluginWorkspacesPanel, SystemSettingsPanel } from './adminSections'
+import { ExecEnvPanel } from './ExecEnvPanel'
 import { RdmAuditWorkspace } from './RdmAuditWorkspace'
 import { RdmRolesPanel } from './adminRdmSections'
 import type { AdminZoneSection } from '../api'
@@ -34,6 +35,7 @@ const SECTIONS: AdminSectionDef[] = [
   // P2 受管：模型/密钥/Tavily/遥测/运行基础设施的唯一写入面（Backend PR 188 系统设置 API）。
   { key: 'system-settings', label: '模型与服务配置', icon: 'settings', desc: '系统受管项：模型、密钥、Tavily、遥测与运行基础设施（仅管理员）', render: () => <SystemSettingsPanel /> },
   { key: 'plugins', label: '插件管理', icon: 'puzzle', desc: '已装载插件清单与热重载（装卸不影响核心）', render: () => <PluginsSection /> },
+  { key: 'python-env', label: 'Python 环境', icon: 'package', desc: '基础层、扩展申请、回收和 wheel 上传（仅管理员）', render: () => <ExecEnvPanel /> },
   { key: 'workspaces', label: '插件工作区', icon: 'grid', desc: '插件声明面板与服务端声明工作区', render: () => <PluginWorkspacesPanel /> },
 ]
 

src/components/DocumentCockpit.tsx

@@ -0,0 +1,310 @@
+// 文档驾驶舱 I2（rollout I2）：顶部统计带 + 左侧结构树 + 中央结构全景。
+// 消费 I1 只读命令面 rdm.cockpit.*（Dev 仓 docs/superpowers/specs 2026-10-16
+// view-spec §1–§4；四项取舍冻结见 rollout §7——首屏只显示章节概览与统计，
+// 段落/正文摘要在选中与阅读器内按权限展示，本增量不含阅读器（I3））。
+// 异步所有者：generation + contextKey（项目+筛选）；不匹配的旧响应直接丢弃。
+// 令牌驱动（DESIGN.md）：颜色/字号只消费 @ui/tokens.css；折叠用 Collapsible。
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { api } from '../api'
+import { store, useStore } from '../store'
+import { EmptyState, SectionLabel } from '@ui'
+import { classifyRdmError } from '../rdmErrors'
+import {
+  contextKey, nodeSummaryLine, sameSnapshot, selectionSurvives, statDisplay,
+  STAT_FILTERS, toggleFilter, treeBadges,
+  type CockpitMeta, type CockpitNodeRef, type CockpitOverview, type CockpitTreeNode, type CockpitTreePage,
+} from '../documentCockpit'
+
+interface ProjectView { id: string; name: string; canAudit?: boolean }
+
+function CockpitErrorState({ raw }: { raw: string }) {
+  const c = classifyRdmError(raw)
+  return <EmptyState icon="alert">{c.message}</EmptyState>
+}
+
+interface Selection { ref: CockpitNodeRef; parentDocId?: string }
+
+export function DocumentCockpit() {
+  const identity = useStore(() => store.getIdentityEpoch())
+  const [projects, setProjects] = useState<ProjectView[] | null>(null)
+  const [pid, setPid] = useState('')
+  const [filter, setFilter] = useState('')
+  const [overview, setOverview] = useState<CockpitOverview | null>(null)
+  const [treePages, setTreePages] = useState<Record<string, { items: CockpitTreeNode[]; nextCursor?: string; hasMore: boolean; meta?: CockpitMeta }>>({})
+  const [selected, setSelected] = useState<Selection | null>(null)
+  const [error, setError] = useState('')
+  const [loadErr, setLoadErr] = useState('')
+  const gen = useRef(0)
+
+  const reload = useCallback((projectId: string, f: string) => {
+    if (!projectId) return
+    const g = ++gen.current
+    const ctx = contextKey(projectId, f)
+    setLoadErr('')
+    api.rdmCommand<CockpitOverview>('rdm.cockpit.overview', { projectId })
+      .then(ov => {
+        if (g !== gen.current || ctx !== contextKey(pid, filter)) return // 旧响应：项目/筛选已切换，丢弃
+        setOverview(ov)
+        setTreePages({}) // 树页随新快照整体重建
+        setSelected(sel => {
+          const kept = selectionSurvives(sel?.ref || null, (ov.documents || []).map(d => d.ref.id), sel?.parentDocId)
+          return kept ? { ref: kept, parentDocId: sel?.parentDocId } : null
+        })
+      })
+      .catch(e => { if (g === gen.current && ctx === contextKey(pid, filter)) setLoadErr(e.message) })
+  }, [pid, filter])
+
+  // 项目清单（rdm.project.list：成员可见项目，canAudit 与否不影响文档读取入口）。
+  useEffect(() => {
+    let c = false
+    setProjects(null); setPid(''); setOverview(null); setSelected(null); setFilter(''); setError('')
+    api.rdmCommand<ProjectView[]>('rdm.project.list')
+      .then(list => { if (!c) setProjects(Array.isArray(list) ? list : []) })
+      .catch(e => { if (!c) setError(e.message) })
+    return () => { c = true }
+  }, [identity])
+
+  // 项目/筛选变化 → 重新取概览（统计与根文档来自同一快照）。
+  useEffect(() => {
+    if (!pid) return
+    reload(pid, filter)
+  }, [pid, filter, reload])
+
+  // 展开文档：按需加载章节子页（键集分页；旧项目/旧筛选的响应丢弃；
+  // 加载失败只影响该分支——行内保留重试，不拖垮其它面板）。
+  const loadChildren = useCallback((docId: string, cursor?: string) => {
+    if (!pid) return
+    const g = gen.current
+    const ctx = contextKey(pid, filter)
+    api.rdmCommand<CockpitTreePage>('rdm.cockpit.tree', { projectId: pid, parent: docId, cursor, limit: 50, filter })
+      .then(page => {
+        if (g !== gen.current || ctx !== contextKey(pid, filter)) return
+        setTreePages(prev => {
+          const old = cursor ? prev[docId] : { items: [] as CockpitTreeNode[], hasMore: false }
+          const items = cursor ? [...(old?.items || []), ...page.items] : page.items
+          return { ...prev, [docId]: { items, nextCursor: page.nextCursor, hasMore: page.hasMore, meta: page.meta } }
+        })
+      })
+      .catch(() => { /* 行内重试入口承担 */ })
+  }, [pid, filter])
+
+  if (error) return <CockpitErrorState raw={error} />
+  if (!projects) return <div className="empty-note">加载中…</div>
+  if (projects.length === 0) return <EmptyState icon="folder">暂无可见研发项目——项目成员身份由项目负责人授予</EmptyState>
+
+  const docIds = (overview?.documents || []).map(d => d.ref.id)
+  const splitNotice = !!overview && Object.values(treePages).some(p => !sameSnapshot(overview.meta, p.meta))
+  const selectDoc = (id: string) => setSelected({ ref: { kind: 'document', id } })
+  const selectSection = (docId: string, sec: CockpitTreeNode) => setSelected({ ref: sec.ref, parentDocId: docId })
+  return (
+    <div className="cockpit">
+      <div className="cockpit-header">
+        <select className="ui-input cockpit-project" value={pid} onChange={e => { setPid(e.target.value); setSelected(null); setFilter('') }} aria-label="选择项目">
+          {projects.map(p => <option key={p.id} value={p.id}>{p.name}</option>)}
+        </select>
+        {filter && <button type="button" className="cockpit-filter-chip" onClick={() => setFilter('')}>
+          筛选：{STAT_FILTERS.find(s => s.filter === filter)?.label || filter} ✕
+        </button>}
+        <span className="cockpit-snap">{overview ? `快照 ${overview.meta.snapshotRevision}` : '加载中…'}</span>
+        <button type="button" className="cockpit-refresh" onClick={() => reload(pid, filter)} disabled={!pid}>刷新</button>
+      </div>
+      {splitNotice && (
+        <div className="cockpit-banner" role="status">统计与树快照不一致——请刷新以对齐最新快照</div>
+      )}
+      {loadErr && <div className="cockpit-banner cockpit-banner-err" role="alert">概览读取失败：{loadErr}（保留上一快照，可重试）</div>}
+      {overview && (
+        <div className="cockpit-stats" role="group" aria-label="项目统计">
+          <div className="cockpit-stat">
+            <span className="cockpit-stat-num">{statDisplay(overview.stats, 'completion').value}</span>
+            <span className="cockpit-stat-label">完成度{statDisplay(overview.stats, 'completion').hint ? `（${statDisplay(overview.stats, 'completion').hint}）` : ''}</span>
+          </div>
+          <div className="cockpit-stat"><span className="cockpit-stat-num">{statDisplay(overview.stats, 'documents').value}</span><span className="cockpit-stat-label">文档</span></div>
+          {STAT_FILTERS.map(s => {
+            const d = statDisplay(overview.stats, s.key)
+            const active = filter === s.filter
+            return (
+              <button key={s.key} type="button" className={`cockpit-stat${active ? ' cockpit-stat-active' : ''}`}
+                onClick={() => setFilter(f => toggleFilter(f, s.filter))}
+                title={d.hint ? `${s.label}：${d.hint}` : `筛选：${s.label}`}>
+                <span className="cockpit-stat-num">{d.value}</span>
+                <span className="cockpit-stat-label">{s.label}{d.hint ? `（${d.hint}）` : ''}</span>
+              </button>
+            )
+          })}
+          <div className="cockpit-stat cockpit-stat-unavail"><span className="cockpit-stat-num">—</span><span className="cockpit-stat-label">待确认（未纳入投影）</span></div>
+          <div className="cockpit-stat"><span className="cockpit-stat-num">{overview.stats.updatedAt ? new Date(overview.stats.updatedAt).toLocaleString('zh-CN') : '—'}</span><span className="cockpit-stat-label">最近更新</span></div>
+        </div>
+      )}
+      <div className="cockpit-columns">
+        <div className="cockpit-tree" role="tree" aria-label="文档结构树">
+          <SectionLabel>结构树</SectionLabel>
+          {!overview && <div className="empty-note">加载结构…</div>}
+          {overview && docIds.length === 0 && <div className="empty-note">暂无受控文档</div>}
+          {overview && overview.meta.truncated && (
+            <div className="cockpit-truncated">文档清单已截断（{overview.meta.truncationReasons?.join('；') || '超出上限'}）</div>
+          )}
+          {overview && overview.documents.map(d => (
+            <TreeRow key={d.ref.id} node={d} depth={0}
+              expanded={treePages[d.ref.id] !== undefined}
+              childPage={treePages[d.ref.id]}
+              selectedId={selected?.ref.id}
+              onSelectNode={n => (n.ref.kind === 'document' ? selectDoc(n.ref.id) : selectSection(d.ref.id, n))}
+              onExpand={() => { if (treePages[d.ref.id] === undefined) loadChildren(d.ref.id) }}
+              onLoadMore={() => { const p = treePages[d.ref.id]; if (p?.nextCursor) loadChildren(d.ref.id, p.nextCursor) }}
+              onRetryChild={() => { const p = treePages[d.ref.id]; loadChildren(d.ref.id, p?.nextCursor) }}
+            />
+          ))}
+        </div>
+        <div className="cockpit-center">
+          {!overview && <div className="empty-note">加载概览…</div>}
+          {overview && !selected && (
+            <PanoramaHome overview={overview} onSelect={selectDoc} />
+          )}
+          {overview && selected && (
+            <PanoramaNode pid={pid} selection={selected} overview={overview}
+              childPage={selected.ref.kind === 'document' ? treePages[selected.ref.id] : undefined}
+              onClear={() => setSelected(null)} />
+          )}
+        </div>
+      </div>
+    </div>
+  )
+}
+
+function TreeRow({ node, depth, expanded, childPage, selectedId, onSelectNode, onExpand, onLoadMore, onRetryChild }: {
+  node: CockpitTreeNode; depth: number
+  expanded: boolean
+  childPage?: { items: CockpitTreeNode[]; nextCursor?: string; hasMore: boolean; meta?: CockpitMeta }
+  selectedId?: string
+  onSelectNode: (n: CockpitTreeNode) => void
+  onExpand: () => void
+  onLoadMore: () => void
+  onRetryChild: () => void
+}) {
+  const badges = treeBadges(node)
+  const selected = selectedId === node.ref.id
+  return (
+    <div className="cockpit-tree-branch">
+      <div className={`cockpit-tree-row${selected ? ' cockpit-tree-row-active' : ''}`} style={{ paddingLeft: depth * 14 }} role="treeitem" aria-selected={selected}>
+        {node.ref.kind === 'document' && (
+          <button type="button" className="cockpit-tree-caret" aria-label={expanded ? '折叠' : '展开'}
+            aria-expanded={expanded} onClick={e => { e.stopPropagation(); if (!expanded) onExpand() }}>
+            {expanded ? '▾' : '▸'}
+          </button>
+        )}
+        <button type="button" className="cockpit-tree-title" onClick={() => onSelectNode(node)}>{node.title}</button>
+        {badges.map(b => <span key={b} className="cockpit-badge">{b}</span>)}
+        {node.lastChangedAt && <span className="cockpit-tree-time">{new Date(node.lastChangedAt).toLocaleDateString('zh-CN')}</span>}
+      </div>
+      {expanded && !childPage && (
+        <button type="button" className="cockpit-tree-more" style={{ paddingLeft: (depth + 1) * 14 }} onClick={onRetryChild}>章节加载失败，重试</button>
+      )}
+      {expanded && childPage && (
+        <div>
+          {childPage.items.length === 0 && <div className="cockpit-tree-empty" style={{ paddingLeft: (depth + 1) * 14 }}>无章节</div>}
+          {childPage.items.map(sec => (
+            <TreeRow key={sec.ref.id} node={sec} depth={depth + 1} expanded={false} childPage={undefined}
+              selectedId={selectedId} onSelectNode={onSelectNode}
+              onExpand={onExpand} onLoadMore={onLoadMore} onRetryChild={onRetryChild} />
+          ))}
+          {childPage.hasMore && childPage.items.length > 0 && (
+            <button type="button" className="cockpit-tree-more" style={{ paddingLeft: (depth + 1) * 14 }} onClick={onLoadMore}>加载更多章节</button>
+          )}
+        </div>
+      )}
+    </div>
+  )
+}
+
+function PanoramaHome({ overview, onSelect }: { overview: CockpitOverview; onSelect: (id: string) => void }) {
+  return (
+    <div>
+      <SectionLabel>{overview.project.title} · 文档概览</SectionLabel>
+      {overview.documents.length === 0 && <EmptyState icon="folder">暂无受控文档——文档由模板实例化或导入后进入驾驶舱</EmptyState>}
+      <div className="cockpit-doclist">
+        {overview.documents.map(d => (
+          <button key={d.ref.id} type="button" className="cockpit-docrow" onClick={() => onSelect(d.ref.id)}>
+            <span className="cockpit-docrow-title">{d.title}</span>
+            <span className="cockpit-docrow-meta">{nodeSummaryLine(d)}</span>
+          </button>
+        ))}
+      </div>
+      <SectionLabel>最近变化</SectionLabel>
+      {overview.recentChanges.length === 0 && <div className="empty-note">暂无可见变化</div>}
+      <div className="cockpit-changes">
+        {overview.recentChanges.map((c, i) => (
+          <div key={`${c.node.id}-${i}`} className="cockpit-changerow">
+            <span className="cockpit-changesum">{c.summary} · {c.title}{c.actor ? ` · ${c.actor}` : ''}</span>
+            <span className="cockpit-changetime">{new Date(c.changedAt).toLocaleString('zh-CN')}</span>
+          </div>
+        ))}
+      </div>
+    </div>
+  )
+}
+
+function PanoramaNode({ pid, selection, overview, childPage, onClear }: {
+  pid: string; selection: Selection; overview: CockpitOverview
+  childPage?: { items: CockpitTreeNode[]; nextCursor?: string; hasMore: boolean; meta?: CockpitMeta }
+  onClear: () => void
+}) {
+  const [detail, setDetail] = useState<any>(null)
+  const [err, setErr] = useState('')
+  const gen = useRef(0)
+  useEffect(() => {
+    const g = ++gen.current
+    setDetail(null); setErr('')
+    api.rdmCommand<any>('rdm.cockpit.node', { projectId: pid, kind: selection.ref.kind, id: selection.ref.id })
+      .then(d => { if (g === gen.current) setDetail(d) })
+      .catch(e => { if (g === gen.current) setErr(e.message) })
+    return () => { gen.current++ }
+  }, [pid, selection.ref.kind, selection.ref.id])
+  const node = (detail?.node || null) as CockpitTreeNode | null
+  const title = node?.title || selection.ref.id
+  return (
+    <div>
+      <div className="cockpit-nodehead">
+        <button type="button" className="cockpit-back" onClick={onClear}>← 返回概览</button>
+        <span className="cockpit-nodetitle">{title}</span>
+        {node && <span className="cockpit-nodesum">{nodeSummaryLine(node)}</span>}
+      </div>
+      {err && <CockpitErrorState raw={err} />}
+      {detail?.body?.length === 1 && detail.body[0].kind === 'restricted' && (
+        <div className="empty-note">内容受限（{detail.body[0].reason || '权限'}）——标题与状态可见，正文不展示</div>
+      )}
+      {detail && detail.meta && !sameSnapshot(detail.meta, overview.meta) && (
+        <div className="cockpit-truncated">节点详情与统计快照不同（{detail.meta.snapshotRevision} vs {overview.meta.snapshotRevision}）——刷新对齐</div>
+      )}
+      {node && node.ref.kind === 'document' && (
+        <>
+          <SectionLabel>章节状态</SectionLabel>
+          {!childPage && <div className="empty-note">章节按需加载——在左侧树展开</div>}
+          {childPage && childPage.items.length === 0 && <div className="empty-note">无章节</div>}
+          {childPage && childPage.items.length > 0 && (
+            <table className="cockpit-childtable">
+              <thead><tr><th>章节</th><th>内容</th><th>核实</th><th>来源</th><th>冲突</th><th>最近更新</th></tr></thead>
+              <tbody>
+                {childPage.items.map(sec => (
+                  <tr key={sec.ref.id}>
+                    <td>{sec.title}</td>
+                    <td>{{ complete: '完整', partial: '部分', empty: '空', inaccessible: '受限', unavailable: '不可读' }[sec.state.content] || sec.state.content}</td>
+                    <td>{sec.state.verification === 'not_applicable' ? '—' : sec.state.verification}</td>
+                    <td>{sec.state.sourceCount}</td>
+                    <td>{sec.state.conflictCount}</td>
+                    <td>{sec.lastChangedAt ? new Date(sec.lastChangedAt).toLocaleDateString('zh-CN') : '—'}</td>
+                  </tr>
+                ))}
+              </tbody>
+            </table>
+          )}
+        </>
+      )}
+      {node && node.ref.kind === 'section' && (
+        <div className="empty-note">连续正文阅读与依据/影响面板在阅读器视图提供（I3）——本页展示状态摘要</div>
+      )}
+      {detail?.meta?.truncated && (
+        <div className="cockpit-truncated">详情已截断：{detail.meta.truncationReasons?.join('；')}</div>
+      )}
+    </div>
+  )
+}

src/components/ExecEnvPanel.tsx

@@ -0,0 +1,98 @@
+import { useEffect, useState } from 'react'
+import { api, type ExecEnvView } from '../api'
+import { Btn, EmptyState, Icon, SettingRow, SettingsGroup } from '@ui'
+
+export function ExecEnvPanel() {
+  const [view, setView] = useState<ExecEnvView | null>(null)
+  const [err, setErr] = useState('')
+  const [notice, setNotice] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [conv, setConv] = useState('')
+  const [reason, setReason] = useState('')
+  const [wheel, setWheel] = useState<File | null>(null)
+
+  const refresh = async () => {
+    try { setView(await api.adminExecEnv()) } catch (e) { setErr(String(e)) }
+  }
+  useEffect(() => { refresh() }, [])
+
+  const run = async (work: () => Promise<string>) => {
+    setErr(''); setNotice(''); setBusy(true)
+    try { setNotice(await work()); await refresh() } catch (e) { setErr(String(e)) } finally { setBusy(false) }
+  }
+
+  if (!view) return <EmptyState icon="package">加载 Python 环境…</EmptyState>
+  if (!view.configured) return <EmptyState icon="package">这台服务没有配置分层 Python 环境根</EmptyState>
+
+  return (
+    <div>
+      <SettingsGroup title="当前环境">
+        <SettingRow label="环境根" desc={view.root || '未设置'}><span /></SettingRow>
+        <SettingRow label="解释器" desc={view.python || '尚未安装托管解释器'}><span /></SettingRow>
+        <SettingRow label="基础层" desc={view.base || '尚未建立'}><span /></SettingRow>
+        <SettingRow label="层目录" desc={(view.layers ?? []).join('、') || '无'}>
+          <Btn variant="ghost" icon="undo" disabled={busy} onClick={() => run(async () => {
+            const out = await api.adminExecEnvRebase()
+            return `基础层已切换到 ${out.base}。已有会话仍用原来的绑定。`
+          })}>重建基础层</Btn>
+        </SettingRow>
+      </SettingsGroup>
+      <SettingsGroup title="申请">
+        {(view.requests ?? []).length === 0 && <EmptyState icon="inbox">还没有扩展包申请</EmptyState>}
+        {(view.requests ?? []).map(req => (
+          <SettingRow key={req.id} label={req.spec || req.id} desc={`${req.status} · ${req.conversationId} · ${req.detail}`}>
+            {req.status === 'pending_approval' && (
+              <span className="ad-row">
+                <Btn variant="primary" icon="check" disabled={busy} onClick={() => run(async () => {
+                  const out = await api.adminExecEnvDecision(req.id, true, false)
+                  return out.detail || out.status
+                })}>批准</Btn>
+                <Btn variant="ghost" disabled={busy} onClick={() => run(async () => {
+                  const out = await api.adminExecEnvDecision(req.id, true, true)
+                  return out.detail || '已用隔离层'
+                })}>隔离层</Btn>
+                <Btn variant="ghost" icon="x" disabled={busy} onClick={() => run(async () => {
+                  const out = await api.adminExecEnvDecision(req.id, false, false)
+                  return out.detail || '已拒绝'
+                })}>拒绝</Btn>
+              </span>
+            )}
+          </SettingRow>
+        ))}
+      </SettingsGroup>
+      <SettingsGroup title="会话绑定">
+        {(view.bindings ?? []).map(b => (
+          <SettingRow key={b.conversationId} label={b.conversationId} desc={b.isolated ? `隔离 ${b.isolated}` : (b.extensions ?? []).join('、') || '只用基础层'}>
+            <span />
+          </SettingRow>
+        ))}
+        <SettingRow label="回收" desc="删掉 7 天内没有会话引用、也不是当前基础层的目录">
+          <Btn variant="ghost" icon="trash" disabled={busy} onClick={() => run(async () => {
+            const out = await api.adminExecEnvGC()
+            const n = out.removed?.length ?? 0
+            return n === 0 ? '没有可回收的层' : `已回收 ${n} 层`
+          })}>回收未引用层</Btn>
+        </SettingRow>
+      </SettingsGroup>
+      <SettingsGroup title="上传 wheel">
+        <SettingRow label="会话" desc="这个 wheel 只挂到指定会话，并进入审批">
+          <input className="lg-input" value={conv} onChange={e => setConv(e.target.value)} placeholder="会话 ID" />
+        </SettingRow>
+        <SettingRow label="理由" desc="写给审批记录">
+          <input className="lg-input" value={reason} onChange={e => setReason(e.target.value)} />
+        </SettingRow>
+        <SettingRow label="文件" desc="只接受预编译 wheel，不执行里面的脚本">
+          <input type="file" accept=".whl" onChange={e => setWheel(e.target.files?.[0] ?? null)} />
+        </SettingRow>
+        <div className="ad-row">
+          <Btn variant="primary" icon="download" disabled={busy || !wheel || !conv.trim()} onClick={() => run(async () => {
+            const out = await api.adminExecEnvWheel(wheel as File, conv.trim(), reason.trim())
+            return `${out.file}：${out.outcome.status}`
+          })}>提交审批</Btn>
+        </div>
+      </SettingsGroup>
+      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
+      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
+    </div>
+  )
+}

src/components/LoginPage.tsx

@@ -1,8 +1,10 @@
 // 登录与改密（管理员发放制，R2 + 2026-10-13 登录恢复合同）：
-// LoginPage —— 用户名+密码（默认入口）/ 一次性登录 Key（忘记密码恢复，只输 Key）；
-// ChangePasswordGate —— 受限会话强制设密（恢复/首登同形：只输新密码，完成前不放行）。
-import { useState } from 'react'
-import { api } from '../api'
+// LoginPage —— 用户名+密码（默认入口）/ 一次性登录 Key（恢复/激活，只输 Key）；
+// ChangePasswordGate —— 受限会话强制设密：模式由服务端 passwordChangeMode 派生，
+// grant_setup 免当前密码（激活/恢复 Key 兑换），current_required 必须校验当前密码
+//（初始密码首登；2026-10-14 后端加固，空 current 会被 401 拒绝）。
+import { useEffect, useState } from 'react'
+import { api, type PasswordChangeMode } from '../api'
 import { Icon, BrandMark } from '@ui'
 
 function Err({ msg }: { msg: string }) {
@@ -96,7 +98,7 @@ export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; on
             <input className="lg-input lg-mono" value={key} onChange={e => setKey(e.target.value)} autoFocus placeholder="alk_…" />
             <Err msg={err} />
             <button className="lg-submit" type="submit" disabled={busy || !key}>{busy ? '兑换中…' : '兑换并设置新密码'}</button>
-            <p className="lg-hint">忘记密码时由管理员签发；单次有效、默认 30 分钟内兑换。程序化客户端请继续使用 API 密钥（Authorization 头）。</p>
+            <p className="lg-hint">忘记密码时由管理员发起恢复提案，并由你在已登录设备的「设置 → 账号」中本人确认后获得；新账号使用管理员交付的激活 Key。单次有效、限时兑换。程序化客户端请继续使用 API 密钥（Authorization 头）。</p>
           </>
         )}
       </form>
@@ -105,23 +107,46 @@ export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; on
   )
 }
 
-/** 强制设密门：恢复 Key 兑换或初始密码首登建立的受限会话，必须完成设密。
- * 免当前密码（R5）：身份与授权均由服务端受限会话确认，页面不出现当前密码输入框；
- * 完成前不能进入工作台，完成后的唯一出口是回密码登录页。 */
+/** current_required 模式必须由用户输入当前密码（后端 CompleteForcedPasswordChecked
+ * 校验）；grant_setup（激活/恢复 Key 兑换的受限会话）免当前密码。 */
+export function requiresCurrentPassword(mode: PasswordChangeMode | null | undefined): boolean {
+  return mode === 'current_required'
+}
+
+/** 强制设密门：受限会话必须完成设密。模式不由前端猜测——进门前先经 /api/me
+ * 读取服务端派生的 passwordChangeMode；读取失败或会话不再受限时拒绝放行。 */
 export function ChangePasswordGate({ owner, onDone, onCancel }: { owner: string; onDone: () => void; onCancel?: () => void }) {
+  const [mode, setMode] = useState<PasswordChangeMode | null>(null)
+  const [current, setCurrent] = useState('')
   const [next, setNext] = useState('')
   const [confirm, setConfirm] = useState('')
   const [err, setErr] = useState('')
   const [busy, setBusy] = useState(false)
   const [done, setDone] = useState(false)
 
+  useEffect(() => {
+    let active = true
+    api.me().then(me => {
+      if (!active) return
+      if (me.owner !== owner || me.sessionScope !== 'set_password_only' ||
+        (me.passwordChangeMode !== 'grant_setup' && me.passwordChangeMode !== 'current_required')) {
+        setErr('当前设密凭据不再有效，请重新登录；恢复场景请先核对「设置 → 账号」中的恢复提案状态。')
+        return
+      }
+      setMode(me.passwordChangeMode)
+    }).catch(() => { if (active) setErr('无法确认当前设密方式，请重新登录。') })
+    return () => { active = false }
+  }, [owner])
+
   const submit = async () => {
     setErr('')
+    if (!mode) { setErr('设密方式尚未由服务端确认'); return }
+    if (requiresCurrentPassword(mode) && !current) { setErr('请填写当前密码'); return }
     if (next !== confirm) { setErr('两次输入的新密码不一致'); return }
     if (next.length < 8) { setErr('新密码至少 8 位'); return }
     setBusy(true)
     try {
-      await api.changePassword('', next)
+      await api.changePassword(requiresCurrentPassword(mode) ? current : '', next)
       setDone(true)
     } catch (e) {
       setErr(humanChangePasswordError(String(e)))
@@ -143,13 +168,19 @@ export function ChangePasswordGate({ owner, onDone, onCancel }: { owner: string;
         <form className="lg-card" onSubmit={e => { e.preventDefault(); submit() }}>
           <div className="lg-brand"><BrandMark size={26} />Agent-System</div>
           <h2 className="lg-title">设置新密码</h2>
-          <p className="lg-sub">账号 <b>{owner}</b>（服务端确认）须设置新密码后继续；无需输入当前密码</p>
+          <p className="lg-sub">账号 <b>{owner}</b>（服务端确认）须设置新密码后继续</p>
+          {mode === 'current_required' && <>
+            <label className="lg-label" htmlFor="forced-current">当前密码</label>
+            <input id="forced-current" className="lg-input" type="password" value={current}
+              onChange={e => setCurrent(e.target.value)} autoComplete="current-password" />
+          </>}
+          {mode === 'grant_setup' && <p className="lg-hint">身份经可信激活/恢复能力确认，此次无需输入当前密码。</p>}
           <label className="lg-label">新密码（≥8 位）</label>
           <input className="lg-input" type="password" value={next} onChange={e => setNext(e.target.value)} autoFocus autoComplete="new-password" />
           <label className="lg-label">确认新密码</label>
           <input className="lg-input" type="password" value={confirm} onChange={e => setConfirm(e.target.value)} autoComplete="new-password" />
           <Err msg={err} />
-          <button className="lg-submit" type="submit" disabled={busy || !next || !confirm}>{busy ? '提交中…' : '设置新密码'}</button>
+          <button className="lg-submit" type="submit" disabled={busy || !mode || (requiresCurrentPassword(mode) && !current) || !next || !confirm}>{busy ? '提交中…' : '设置新密码'}</button>
           {onCancel && <button type="button" className="lg-cancel" onClick={onCancel}>退出并返回登录</button>}
         </form>
       )}

src/components/MyAccountSettings.tsx

@@ -0,0 +1,142 @@
+// 我的账号与恢复（设置 → 账号）：可选资料编辑 + 恢复提案的属主确认视图。
+// 管理员只能建立提案；确认必须使用提案之前已存在、来源可信的完整密码会话
+//（backend eligibleRecoveryProof 契约）。确认产出的一次性 grant 只在本次响应
+// 出现，可就地兑换进受限设密会话（完成前不放行工作台）。
+import { useEffect, useRef, useState } from 'react'
+import { api, type AccountProfile, type AccountRecord, type RecoveryProposal } from '../api'
+import { useStore } from '../store'
+import { Collapsible, Icon, SettingsGroup } from '@ui'
+import { recoveryStatusLabel } from '../recovery'
+
+const fields: { key: keyof AccountProfile; label: string }[] = [
+  { key: 'name', label: '姓名' }, { key: 'phone', label: '电话' }, { key: 'email', label: '邮箱' },
+  { key: 'staffNo', label: '工号' }, { key: 'department', label: '部门' }, { key: 'notes', label: '备注' },
+]
+
+export function MyAccountSettings() {
+  const me = useStore(s => s.me)
+  const [account, setAccount] = useState<AccountRecord | null>(null)
+  const [draft, setDraft] = useState<AccountProfile | null>(null)
+  const [proposals, setProposals] = useState<RecoveryProposal[] | null>(null)
+  const [grant, setGrant] = useState<{ proposalId: string; value: string } | null>(null)
+  const [err, setErr] = useState('')
+  const [notice, setNotice] = useState('')
+  const [busy, setBusy] = useState(false)
+  const sequence = useRef(0)
+
+  useEffect(() => {
+    if (!me?.auth) return
+    const seq = ++sequence.current
+    Promise.all([api.meProfile(), api.listMyRecoveryProposals()]).then(([profile, statuses]) => {
+      if (seq !== sequence.current) return
+      setAccount(profile); setDraft(profile.profile); setProposals(statuses)
+    }).catch(error => { if (seq === sequence.current) setErr(String(error)) })
+    return () => { sequence.current++ }
+  }, [me?.owner, me?.auth])
+
+  if (!me?.auth) return null
+
+  const save = async () => {
+    if (!account || !draft) return
+    const patch: Partial<AccountProfile> = {}
+    for (const field of fields) if (draft[field.key] !== account.profile[field.key]) patch[field.key] = draft[field.key]
+    if (Object.keys(patch).length === 0) { setNotice('资料没有变化'); return }
+    setBusy(true); setErr(''); setNotice('')
+    try {
+      const updated = await api.patchMeProfile(account.profileVersion, patch)
+      setAccount(updated); setDraft(updated.profile); setNotice('个人资料已保存；资料不会成为恢复身份的证明')
+    } catch (error) { setErr(String(error).includes('409') ? '资料版本已变化，请关闭设置后重新打开' : String(error)) }
+    finally { setBusy(false) }
+  }
+
+  const refreshProposal = async (id: string) => {
+    const updated = await api.getMyRecoveryProposal(id)
+    setProposals(current => current?.map(item => item.id === id ? updated : item) ?? [updated])
+    return updated
+  }
+
+  const confirm = async (proposal: RecoveryProposal) => {
+    setBusy(true); setErr(''); setNotice(''); setGrant(null)
+    try {
+      const result = await api.confirmMyRecoveryProposal(proposal.id, proposal.version)
+      setProposals(current => current?.map(item => item.id === proposal.id ? result.proposal : item) ?? [result.proposal])
+      if (!result.grant) {
+        setErr('提案已确认，但一次性明文不可读回。若仍保有原本人会话，可显式重新生成设密能力。')
+        return
+      }
+      setGrant({ proposalId: proposal.id, value: result.grant })
+      setNotice('本人确认成功。设密能力只在此响应可用，请立即兑换并设置新密码。')
+    } catch (error) {
+      const current = await refreshProposal(proposal.id).catch(() => null)
+      setErr(current?.status === 'confirmed'
+        ? '确认结果待核验：提案已确认，但明文不能读回。若仍保有原本人会话，可显式重新生成设密能力。'
+        : `确认未完成或结果未知：${String(error)}。请核对当前提案状态。`)
+    } finally { setBusy(false) }
+  }
+
+  const rotate = async (proposal: RecoveryProposal) => {
+    setBusy(true); setErr(''); setNotice(''); setGrant(null)
+    try {
+      const result = await api.rotateMyRecoveryGrant(proposal.id, proposal.version, proposal.generation)
+      setProposals(current => current?.map(item => item.id === proposal.id ? result.proposal : item) ?? [result.proposal])
+      if (!result.grant) {
+        setErr('重新生成已提交，但一次性明文不可读回。请核对当前提案状态，再由本人显式操作。')
+        return
+      }
+      setGrant({ proposalId: proposal.id, value: result.grant })
+      setNotice('已重新生成设密能力；旧能力与派生受限会话已失效。')
+    } catch (error) {
+      await refreshProposal(proposal.id).catch(() => null)
+      setErr(`重新生成结果待核验：${String(error)}。请核对提案状态，再由本人显式操作。`)
+    } finally { setBusy(false) }
+  }
+
+  const redeem = async () => {
+    if (!grant) return
+    setBusy(true); setErr(''); setNotice('')
+    try {
+      await api.redeemLoginKey(grant.value)
+      location.reload() // 新 HttpOnly 受限会话由应用启动门送到设密页
+    } catch (error) {
+      const session = await api.me().catch(() => null)
+      if (session?.sessionScope === 'set_password_only' && session.passwordChangeMode === 'grant_setup') {
+        location.reload()
+        return
+      }
+      await refreshProposal(grant.proposalId).catch(() => null)
+      setGrant(null)
+      setErr(`兑换结果待核验：${String(error)}。不会自动重复兑换；若仍保有原本人会话，请显式重新生成能力。`)
+    } finally { setBusy(false) }
+  }
+
+  return <SettingsGroup title="我的账号与恢复">
+    {account && draft ? <>
+      <p className="ad-hint">登录名 {account.owner} · userId {account.userId}。以下资料均可留空，也不会作为本人恢复证明。</p>
+      <Collapsible id={`my-profile-${account.userId}`} trigger="编辑可选资料">
+        <div className="ad-create">{fields.map(field => <div className="ad-row" key={field.key}>
+          <label className="lg-label" htmlFor={`my-profile-${field.key}`}>{field.label}（可空）</label>
+          <input id={`my-profile-${field.key}`} className="lg-input" value={draft[field.key]}
+            onChange={event => setDraft({ ...draft, [field.key]: event.target.value })} />
+        </div>)}
+        <button className="lg-submit ad-create-btn" disabled={busy} onClick={save}>保存我的资料</button></div>
+      </Collapsible>
+    </> : <p className="ad-hint">使用完整密码会话后可查看和修改个人资料。</p>}
+
+    <p className="ad-hint">忘记密码的恢复：由管理员发起提案，本人在此用当前登录会话确认后获得一次性 Key 兑换设密；历史未知来源账号无法在线证明。</p>
+    {(proposals ?? []).map(proposal => <div className="ad-create" key={proposal.id}>
+      <div className="ad-row"><span className="ad-mono">{proposal.id}</span><b>{recoveryStatusLabel[proposal.status]}</b>
+        <span className="ad-dim">到期 {new Date(proposal.expiresAt).toLocaleString()}</span></div>
+      <div className="ad-row">
+        {proposal.status === 'pending' && <button className="ad-mini" disabled={busy} onClick={() => confirm(proposal)}>由本人确认</button>}
+        {proposal.status === 'confirmed' && <button className="ad-mini" disabled={busy} onClick={() => rotate(proposal)}>显式重新生成设密能力</button>}
+      </div>
+    </div>)}
+    {proposals !== null && proposals.length === 0 && <p className="ad-hint">当前没有恢复提案。</p>}
+    {grant && <div className="ad-reset">
+      <p className="ad-hint">设密能力仅保存在当前页面内存，离开后不可读回；不自动复制到剪贴板。</p>
+      <button className="lg-submit ad-create-btn" disabled={busy} onClick={redeem}>立即兑换并设置新密码</button>
+    </div>}
+    {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
+    {err && <div className="lg-err" role="alert"><Icon name="alert" size={14} />{err}</div>}
+  </SettingsGroup>
+}

src/components/ProjectSettingsModal.tsx

@@ -19,6 +19,11 @@ export function ProjectSettingsModal() {
   const rdmDocReviewAvailable = useStore(s => s.rdmDocReviewAvailable)
   const rdmPermMatrixAvailable = useStore(s => s.rdmPermMatrixAvailable)
   const owner = useStore(s => s.me?.owner)
+  const isAdmin = useStore(s => s.me?.isAdmin ?? false)
+  // P1-B 裁定：宿主覆盖设置（含模型与密钥）仅项目负责人/系统管理员可查看与修改；
+  // RDM 页签（成员/文档职责/项目权限）不在此列——数据面由 RDM 权限自行收敛，
+  // 授权的职责管理者仍可进入。
+  const projectPrivileged = !!project && (project.owner === owner || isAdmin)
   const [tab, setTab] = useState('project')
   const [schema, setSchema] = useState<SettingDesc[]>([])
   const [draft, setDraft] = useState<Record<string, any>>({})
@@ -72,7 +77,7 @@ export function ProjectSettingsModal() {
         { key: 'project', label: '本项目', icon: 'folder' },
         // U6/KTD5：成员与文档职责页签按 RDM 命令面门控（普通基座不出现）。
         ...(rdmMembersAvailable ? [{ key: 'members', label: '成员', icon: 'users' as const }] : []),
-        ...(rdmDocReviewAvailable ? [{ key: 'duties', label: '文档职责 · 整文审签', icon: 'shield' as const }] : []),
+        ...(rdmDocReviewAvailable ? [{ key: 'duties', label: '文档职责', icon: 'shield' as const }] : []),
         ...(rdmPermMatrixAvailable ? [{ key: 'matrix', label: '项目权限', icon: 'key' as const }] : []),
       ]}
       footer={saved ? <span style={{ color: 'var(--ok-text)' }}>✓ 已保存</span> : '项目设置覆盖用户设置（new-run 类对新任务生效）'}
@@ -85,6 +90,8 @@ export function ProjectSettingsModal() {
         </>}
         {tab !== 'members' && tab !== 'duties' && tab !== 'matrix' && !loaded ? (
           <EmptyState icon="settings">{error || '加载中…'}</EmptyState>
+        ) : tab !== 'members' && tab !== 'duties' && tab !== 'matrix' && !projectPrivileged ? (
+          <EmptyState icon="settings">项目覆盖设置（含模型与密钥）仅项目负责人或系统管理员可查看与修改。</EmptyState>
         ) : tab !== 'members' && tab !== 'duties' && tab !== 'matrix' ? (
           <>
             <div className="empty-note" style={{ marginBottom: 10 }}>

src/components/SettingsModal.tsx

@@ -9,8 +9,9 @@ import type { ThemeChoice } from '../theme'
 import type { SettingDesc } from '../contracts'
 import { SettingsShell, SettingRow, SettingsGroup, Btn } from '@ui'
 import { BorrowPanels } from './BorrowPanels'
+import { MyAccountSettings } from './MyAccountSettings'
 
-type Section = 'settings'
+type Section = 'settings' | 'account'
 
 // 分组显示名（项目设置面板共用）。
 export const groupNames: Record<string, string> = {
@@ -19,7 +20,7 @@ export const groupNames: Record<string, string> = {
 }
 
 export function SettingsModal() {
-  const [section] = useState<Section>('settings')
+  const [section, setSection] = useState<Section>('settings')
   const [schema, setSchema] = useState<SettingDesc[]>([])
   const [, setUser] = useState<Record<string, any>>({})
   const [draft, setDraft] = useState<Record<string, any>>({})
@@ -54,10 +55,11 @@ export function SettingsModal() {
 
   return (
     <SettingsShell
-      title="设置" active={section} onSelect={() => undefined}
+      title="设置" active={section} onSelect={key => setSection(key as Section)}
       onClose={() => store.openSettings(false)}
       sections={[
         { key: 'settings', label: '常规', icon: 'settings' },
+        { key: 'account', label: '账号', icon: 'user' },
       ]}
       footer={saved ? <span style={{ color: 'var(--ok)' }}>✓ 已保存</span> : 'Agent-System · 设置中心'}
       actions={section === 'settings' && schema.length > 0 ? (
@@ -108,6 +110,7 @@ export function SettingsModal() {
         )
       })}
       {section === 'settings' && <BorrowPanels />}
+      {section === 'account' && <MyAccountSettings />}
     </SettingsShell>
   )
 }

src/components/Workspaces.tsx

@@ -8,12 +8,13 @@ import { docBridge } from './Workbench'
 import { AgentRow } from './Workbench'
 import { buildWorkspaceEntries, type WorkspaceEntry } from '../workspaces'
 import { RdmAuditWorkspace } from './RdmAuditWorkspace'
+import { DocumentCockpit } from './DocumentCockpit'
 
 /** 体系工具（顺序即 ⌘ 序号）。服务端工作区全员可见；插件管理面板只在系统管理区。
  *  追溯审计按命令面能力显隐（增量 2）：store.rdmAuditAvailable 为 true 才入列。 */
 export function workspaceEntries(): WorkspaceEntry[] {
   const s = store.getState()
-  return buildWorkspaceEntries(s.serverWorkspaces, { rdmAudit: s.rdmAuditAvailable })
+  return buildWorkspaceEntries(s.serverWorkspaces, { rdmAudit: s.rdmAuditAvailable, rdmCockpit: s.rdmCockpitAvailable })
 }
 
 export function Workspaces() {
@@ -36,6 +37,11 @@ export function Workspaces() {
       <RdmAuditWorkspace />
     </OverlayHost>
   }
+  if (active === 'rdm-cockpit') {
+    return <OverlayHost title="文档驾驶舱" icon="📋" shortcut={entry?.shortcut} sayHint="打开文档驾驶舱" onClose={close}>
+      <DocumentCockpit />
+    </OverlayHost>
+  }
   if (active.startsWith('plugin:')) {
     const panel = pluginPanels.find(p => `plugin:${p.id}` === active)
     return <OverlayHost title={panel?.title ?? '插件面板'} icon="🧩" onClose={close}

src/components/adminRdmSections.tsx

@@ -1,5 +1,5 @@
 // U6/KTD5：RDM 管理与项目页面组件。系统管理「RDM 角色权限」+ 项目设置「成员 /
-// 文档职责 · 整文审签」。全部数据经 api.rdmCommand（命令总线），载荷构造与能力
+// 文档职责」。全部数据经 api.rdmCommand（命令总线），载荷构造与能力
 // 门控集中在 src/rdmManagement.ts；分区可见性由 AdminZone/ProjectSettingsModal
 // 按 store 的 rdm*Available 门控（命令面不齐不渲染，普通基座零暴露）。样式只复用
 // 既有 ad-*/lg-*/settings-* 类（design-guard 棘轮：不新增裸色值/字号）。
@@ -13,8 +13,7 @@ import {
   ROLE_ACTIONS,
   roleCreatePayload, roleActionPayload, roleAssignPayload, roleDisablePayload,
   memberAddPayload, memberRemovePayload, memberSetRolePayload,
-  assignDocDutiesPayload, docSubmitPayload, docApprovePayload, docRejectPayload,
-  docFinalPayload, docStatusPayload, permCheckPayload, describeSource,
+  permCheckPayload, describeSource,
   rolesListPlaceholder, describeRoleListError,
 } from '../rdmManagement'
 
@@ -260,320 +259,7 @@ export function RdmMembersSection({ project }: { project: Project }) {
   )
 }
 
-// ---- 项目设置：文档职责（P7-B：文档清单＋选中职责详情；方案 §4）----
-
-interface DocSubmissionView {
-  round: number
-  state: string
-  digest: string
-  createdBy: string
-  createdAt: string
-  duties: { author: string; reviewers: string[]; approver: string }
-  reviews: Record<string, boolean>
-  sections: Record<string, number>
-}
-
-interface DutyCatalogDoc {
-  docId: string; typeKey: string; title: string; stage?: string; sections: number
-  assigned: boolean; author?: string; reviewers?: string[]; approver?: string; activeRound?: number
-}
-
-interface DocsTemplateRow {
-  templateId: string; version: string; title: string; docTypes: string[]; stage?: string
-}
-
-/** rdm.docs.instantiate 参数：docType 取首个适用类型；空标题交由后端取模板标题。 */
-export function docsInstantiateParams(tpl: DocsTemplateRow, title: string): Record<string, unknown> {
-  return {
-    docType: tpl.docTypes[0], templateId: tpl.templateId, version: tpl.version,
-    ...(title.trim() ? { title: title.trim() } : {}),
-  }
-}
-
-interface DutyGetOut {
-  docId: string; title: string; assigned: boolean
-  roles: { author: string; reviewers: string[]; approver: string }
-  active?: { round: number; state: string; createdBy: string } | null
-  sections: { sectionId: string; title: string; overridden: boolean }[]
-}
-
-/** 职责候选 = 当前项目成员（方案 §4：候选只能来自项目成员）。
- * member.list 为小全量列表：本地 query 过滤 + 游标分页。 */
-function useMemberPickerPage(members: { owner: string; role: string }[] | null) {
-  return useCallback(async (query: string, cursor: string, limit: number) => {
-    const q = query.trim().toLowerCase()
-    const all = (members ?? [])
-      .filter(m => q === '' || m.owner.toLowerCase().includes(q))
-      .map(m => ({ id: m.owner, title: m.owner, subtitle: m.role === 'owner' ? '项目负责人' : '项目成员' }))
-    const start = cursor === '' ? 0 : all.findIndex(x => x.id === cursor) + 1
-    const page = all.slice(start, start + limit)
-    return {
-      items: page,
-      nextCursor: start + limit < all.length ? page[page.length - 1]?.id : undefined,
-    }
-  }, [members])
-}
-
-export function RdmDutiesSection({ project }: { project: Project }) {
-  const projectId = project.id
-  const writeError = projectWorkError(project)
-  const [docs, setDocs] = useState<DutyCatalogDoc[] | null>(null)
-  const [members, setMembers] = useState<{ owner: string; role: string }[] | null>(null)
-  const [docId, setDocId] = useState('')
-  const [detail, setDetail] = useState<DutyGetOut | null | undefined>(undefined)
-  const [author, setAuthor] = useState<string[]>([])
-  const [reviewers, setReviewers] = useState<string[]>([])
-  const [approver, setApprover] = useState<string[]>([])
-  const [sub, setSub] = useState<DocSubmissionView | null | undefined>(undefined)
-  const [batchSel, setBatchSel] = useState<Set<string>>(new Set())
-  const [batchAuthor, setBatchAuthor] = useState<string[]>([])
-  const [batchReviewers, setBatchReviewers] = useState<string[]>([])
-  const [batchApprover, setBatchApprover] = useState<string[]>([])
-  const [err, setErr] = useState('')
-  const [notice, setNotice] = useState('')
-  const [busy, setBusy] = useState(false)
-  const [tpls, setTpls] = useState<DocsTemplateRow[] | null>(null)
-  const [tplSel, setTplSel] = useState('')
-  const [newTitle, setNewTitle] = useState('')
-
-  const cmd = <T,>(id: string, params: Record<string, unknown>) => api.rdmProjectCommand<T>(project, id, params)
-  const memberPage = useMemberPickerPage(members)
-  const requests = useRef({ project, epoch: 0, selected: '', selection: 0, catalog: 0, status: 0, action: 0 })
-  requests.current.project = project
-  const currentProject = (epoch: number) => requests.current.project === project && requests.current.epoch === epoch
-  const currentDocument = (epoch: number, selection: number, id: string) =>
-    currentProject(epoch) && requests.current.selection === selection && requests.current.selected === id
-
-  const refreshCatalog = async (epoch = requests.current.epoch) => {
-    const request = ++requests.current.catalog
-    try {
-      const out = await cmd<{ docs: DutyCatalogDoc[] }>('rdm.duty.catalog', { projectId })
-      if (!currentProject(epoch) || request !== requests.current.catalog) return
-      setDocs(out.docs ?? [])
-    } catch (e) {
-      if (!currentProject(epoch) || request !== requests.current.catalog) return
-      setErr(String(e)); setDocs([])
-    }
-  }
-  const refreshStatus = async (id: string, epoch: number, selection: number) => {
-    if (!id || !currentDocument(epoch, selection, id)) return
-    const request = ++requests.current.status
-    try {
-      const out = await cmd<{ submission: DocSubmissionView | null }>('rdm.review.doc.status', docStatusPayload(projectId, id))
-      if (!currentDocument(epoch, selection, id) || request !== requests.current.status) return
-      setSub(out.submission)
-    } catch (e) {
-      if (!currentDocument(epoch, selection, id) || request !== requests.current.status) return
-      setSub(undefined); setErr(`整文状态读取失败：${e}`)
-    }
-  }
-  /** 选中文档：读当前职责（duty.get）并回填选择器（方案：当前职责与冻结名单分列）。 */
-  const selectDoc = async (id: string, keepNotice = false) => {
-    const epoch = requests.current.epoch
-    const selection = ++requests.current.selection
-    requests.current.selected = id
-    requests.current.status++
-    setErr(''); if (!keepNotice) setNotice('')
-    setDocId(id); setDetail(undefined); setSub(undefined); setBatchSel(new Set())
-    setAuthor([]); setReviewers([]); setApprover([])
-    if (!id) return
-    try {
-      const out = await cmd<DutyGetOut>('rdm.duty.get', { projectId, docId: id })
-      if (!currentDocument(epoch, selection, id)) return
-      if (out.docId !== id) throw new Error('文档职责与当前选择不一致，请重新选择文档')
-      setDetail(out)
-      setAuthor(out.assigned && out.roles.author ? [out.roles.author] : [])
-      setReviewers(out.assigned ? out.roles.reviewers ?? [] : [])
-      setApprover(out.assigned && out.roles.approver ? [out.roles.approver] : [])
-    } catch (e) {
-      if (!currentDocument(epoch, selection, id)) return
-      setDetail(null); setErr(String(e))
-    }
-    await refreshStatus(id, epoch, selection)
-  }
-  useEffect(() => {
-    const epoch = ++requests.current.epoch
-    requests.current.selected = ''; requests.current.selection++; requests.current.status++
-    requests.current.action++
-    setDocId(''); setDetail(undefined); setSub(undefined); setBatchSel(new Set())
-    setDocs(null); setMembers(null); setAuthor([]); setReviewers([]); setApprover([])
-    setBatchAuthor([]); setBatchReviewers([]); setBatchApprover([])
-    setErr(''); setNotice(''); setBusy(false)
-    void refreshCatalog(epoch)
-    cmd<{ members: { owner: string; role: string }[] }>('rdm.project.member.list', { projectId })
-      .then(out => { if (currentProject(epoch)) setMembers(out.members ?? []) })
-      .catch(() => { if (currentProject(epoch)) setMembers([]) })
-    api.rdmCommand<DocsTemplateRow[]>('rdm.docs.templates')
-      .then(rows => { if (currentProject(epoch)) setTpls(rows ?? []) })
-      .catch(() => { if (currentProject(epoch)) setTpls([]) })
-    return () => {
-      requests.current.epoch++; requests.current.selection++; requests.current.status++
-      requests.current.catalog++; requests.current.action++; requests.current.selected = ''
-    }
-  }, [project])
-
-  const run = async (label: string, fn: () => Promise<unknown>) => {
-    const epoch = requests.current.epoch
-    const selection = requests.current.selection
-    const selected = requests.current.selected
-    const action = ++requests.current.action
-    const currentAction = () => currentProject(epoch) && action === requests.current.action
-    setErr(''); setNotice(''); setBusy(true)
-    try {
-      await fn()
-      if (!currentAction() || !currentDocument(epoch, selection, selected)) return
-      setNotice(label)
-      await refreshCatalog(epoch)
-      if (currentAction() && currentDocument(epoch, selection, selected) && selected) await selectDoc(selected, true)
-    } catch (e) {
-      if (currentAction() && currentDocument(epoch, selection, selected)) setErr(String(e))
-    } finally { if (currentAction()) setBusy(false) }
-  }
-
-  const dirty = detail != null && (
-    (author[0] ?? '') !== (detail.assigned ? detail.roles.author : '')
-    || JSON.stringify(reviewers) !== JSON.stringify(detail.assigned ? detail.roles.reviewers ?? [] : [])
-    || (approver[0] ?? '') !== (detail.assigned ? detail.roles.approver : ''))
-
-  const saveDisabled = busy || !!writeError || !docId || detail == null || !author[0] || !approver[0] || reviewers.length === 0
-
-  const save = () => {
-    if (saveDisabled || !dirty || requests.current.selected !== docId || detail?.docId !== docId) return
-    if (detail.active && !window.confirm(
-      `文档「${detail.title}」在途第 ${detail.active.round} 轮审签将因职责变更失效，需重新提交。确认变更？`)) return
-    return run('已保存当前职责', () =>
-      cmd('rdm.review.assign.doc', assignDocDutiesPayload(projectId, docId, author[0], reviewers, approver[0])))
-  }
-
-  const batchApply = () => run(`已批量分配 ${batchSel.size} 份文档`, () =>
-    cmd('rdm.review.assign.doc.batch', { projectId, docs: [...batchSel].map(d => ({
-      docId: d, author: batchAuthor[0], reviewers: batchReviewers, approver: batchApprover[0] })) }))
-
-  /** U4/UI：按已发布 DHF 模板整份生成文档（章节骨架自动播种），随后选中新文档。 */
-  const instantiate = () => {
-    const tpl = (tpls ?? []).find(r => `${r.templateId}@${r.version}` === tplSel)
-    if (!tpl) return
-    const title = newTitle.trim()
-    return run(`已按模板生成「${title || tpl.title}」`, async () => {
-      const res = await cmd<{ docId: string }>('rdm.docs.instantiate', docsInstantiateParams(tpl, title))
-      await refreshCatalog()
-      await selectDoc(res.docId, true)
-    })
-  }
-  const tpl = (tpls ?? []).find(r => `${r.templateId}@${r.version}` === tplSel)
-
-  return (
-    <div>
-      <h4 className="settings-group-title">按模板生成文档</h4>
-      <div className="ad-create">
-        <div className="ad-row">
-          <select className="lg-input" aria-label="文档模板" value={tplSel}
-            onChange={e => { setTplSel(e.target.value); setNewTitle('') }}>
-            <option value="">{tpls === null ? '模板加载中…' : '选择模板…'}</option>
-            {(tpls ?? []).map(r => (
-              <option key={`${r.templateId}@${r.version}`} value={`${r.templateId}@${r.version}`}>
-                {r.title}（{r.templateId}@{r.version}）
-              </option>
-            ))}
-          </select>
-          <input className="lg-input" aria-label="文档标题" placeholder={`文档标题（默认：${tpl?.title ?? '模板标题'}）`}
-            value={newTitle} onChange={e => setNewTitle(e.target.value)} />
-          <button className="lg-submit ad-create-btn" disabled={busy || !tpl} onClick={instantiate}>生成文档</button>
-        </div>
-        <p className="ad-hint">按已发布 DHF 模板整份生成：章节骨架自动播种；生成后在下方清单选中文档分配三权并走整文审签。</p>
-      </div>
-      <h4 className="settings-group-title">文档清单（职责分配对象为整份文档；搜索/浏览同一目录）</h4>
-      <table className="ad-table">
-        <thead><tr><th></th><th>文档</th><th>类型 / 阶段</th><th>当前职责</th><th>状态</th><th></th></tr></thead>
-        <tbody>
-          {(docs ?? []).map(d => (
-            <tr key={d.docId} className={d.docId === docId ? 'ad-row-on' : ''}>
-              <td><input type="checkbox" checked={batchSel.has(d.docId)}
-                onChange={e => { const n = new Set(batchSel); e.target.checked ? n.add(d.docId) : n.delete(d.docId); setBatchSel(n) }} /></td>
-              <td><button className="ad-mini" onClick={() => selectDoc(d.docId)}>{d.title}</button>
-                <span className="ad-dim ad-mono"> · {d.docId}</span></td>
-              <td className="ad-dim">{d.typeKey}{d.stage ? ` / ${d.stage}` : ''}</td>
-              <td className="ad-dim">{d.assigned
-                ? `编 ${d.author} · 审 ${(d.reviewers ?? []).join('、')} · 批 ${d.approver}` : '未分配'}</td>
-              <td>{d.activeRound ? <span className="ad-chip ad-chip-warn">第 {d.activeRound} 轮在途</span> : d.assigned ? <span className="ad-chip">—</span> : <span className="ad-chip">未分配</span>}</td>
-              <td className="ad-dim">{d.sections} 章节</td>
-            </tr>
-          ))}
-          {docs === null && <tr><td colSpan={6} className="ad-dim">加载中…</td></tr>}
-          {docs !== null && docs.length === 0 && <tr><td colSpan={6} className="ad-dim">暂无文档</td></tr>}
-        </tbody>
-      </table>
-
-      {detail === null && docId && <EmptyState icon="inbox">读取职责失败</EmptyState>}
-      {detail && (
-        <div className="settings-group" style={{ marginTop: 14 }}>
-          <h4>{detail.title} · 当前职责{detail.active ? <span className="ad-chip ad-chip-warn">在途第 {detail.active.round} 轮（变更将失效需重提交）</span> : null}</h4>
-          <div className="setting-row"><label>编制人（单选）</label>
-            <div style={{ maxWidth: 320 }}><Picker aria-label="编制人" selected={author} onSelect={setAuthor} fetchPage={memberPage} /></div></div>
-          <div className="setting-row"><label>审核人（多选 ≥1）</label>
-            <div style={{ maxWidth: 320 }}><Picker aria-label="审核人" multiple selected={reviewers} onSelect={setReviewers} fetchPage={memberPage} /></div>
-            {reviewers.length > 0 && <span className="ad-dim">已选：{reviewers.join('、')}</span>}</div>
-          <div className="setting-row"><label>批准人（单选）</label>
-            <div style={{ maxWidth: 320 }}><Picker aria-label="批准人" selected={approver} onSelect={setApprover} fetchPage={memberPage} /></div></div>
-          <div className="ad-row">
-            <Btn variant="primary" icon="check" disabled={saveDisabled || !dirty} onClick={save}>保存当前职责</Btn>
-            {detail.active && <span className="ad-hint">保存将使在途第 {detail.active.round} 轮失效（提交人 {detail.active.createdBy}）</span>}
-          </div>
-          {detail.sections.length > 0 && (
-            <p className="ad-hint">章节覆盖：{detail.sections.filter(x => x.overridden).length}/{detail.sections.length} 章节单独指派（覆盖文档默认）。</p>
-          )}
-        </div>
-      )}
-
-      {detail && docId && (
-        <div className="ad-row" style={{ marginTop: 8 }}>
-          <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || !detail.assigned || sub === undefined}
-            onClick={() => run('整文已提交审核（全文锁定）',
-              () => cmd('rdm.review.doc.submit', docSubmitPayload(projectId, docId)))}>整文提交（编制人）</button>
-        </div>
-      )}
-      {sub && (
-        <div className="settings-group" style={{ marginTop: 14 }}>
-          <h4>整文审签 · 第 {sub.round} 轮 · {sub.state === 'submitted' ? <span className="ad-chip ad-chip-warn">在途（全文锁定）</span> : sub.state === 'final' ? <span className="ad-chip ad-chip-admin">已终批</span> : <span className="ad-chip">已驳回</span>}</h4>
-          <div className="setting-row"><label>冻结名单</label><span>编 <b className="ad-mono">{sub.duties.author}</b> · 审 <b className="ad-mono">{(sub.duties.reviewers ?? []).join('、')}</b> · 批 <b className="ad-mono">{sub.duties.approver}</b></span></div>
-          <div className="setting-row"><label>审核进度</label><span>{Object.entries(sub.reviews ?? {}).map(([r, ok]) => `${r}:${ok ? '✓' : '…'}`).join('  ') || '—'}</span></div>
-          <div className="ad-row" style={{ marginTop: 8 }}>
-            <button className="ad-mini" disabled={busy || !!writeError || sub.state !== 'submitted'}
-              onClick={() => run('已通过整文审核',
-                () => cmd('rdm.review.doc.approve', docApprovePayload(projectId, docId, '通过')))}>审核通过</button>
-            <button className="ad-mini" disabled={busy || !!writeError || sub.state !== 'submitted'}
-              onClick={() => run('已驳回整文（解锁回编写态）',
-                () => cmd('rdm.review.doc.reject', docRejectPayload(projectId, docId, '退回修改')))}>驳回</button>
-            <button className="lg-submit ad-create-btn" disabled={busy || !!writeError || sub.state !== 'submitted'}
-              onClick={() => run('整文终批完成（各章节已基线）',
-                () => cmd('rdm.review.doc.final', docFinalPayload(projectId, docId)))}>终批（批准人）</button>
-          </div>
-        </div>
-      )}
-      {sub === null && docId && <p className="ad-hint">该文档尚无整文提交记录（当前职责仍可分配）。</p>}
-
-      {batchSel.size > 0 && (
-        <div className="settings-group" style={{ marginTop: 14 }}>
-          <h4>批量分配（已选 {batchSel.size} 份；任一校验失败整批拒绝并列原因）</h4>
-          <div className="setting-row"><label>统一编制人</label>
-            <div style={{ maxWidth: 320 }}><Picker aria-label="批量编制人" selected={batchAuthor} onSelect={setBatchAuthor} fetchPage={memberPage} /></div></div>
-          <div className="setting-row"><label>统一审核人</label>
-            <div style={{ maxWidth: 320 }}><Picker aria-label="批量审核人" multiple selected={batchReviewers} onSelect={setBatchReviewers} fetchPage={memberPage} /></div></div>
-          <div className="setting-row"><label>统一批准人</label>
-            <div style={{ maxWidth: 320 }}><Picker aria-label="批量批准人" selected={batchApprover} onSelect={setBatchApprover} fetchPage={memberPage} /></div></div>
-          <div className="ad-row">
-            <Btn variant="primary" icon="check" disabled={busy || !!writeError || !batchAuthor[0] || !batchApprover[0] || batchReviewers.length === 0}
-              onClick={batchApply}>批量分配 {batchSel.size} 份文档</Btn>
-            <button className="ad-mini" onClick={() => setBatchSel(new Set())}>清空选择</button>
-          </div>
-        </div>
-      )}
-
-      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
-      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
-    </div>
-  )
-}
+export { RdmDutiesSection } from './duties/RdmDutiesSection'
 
 // ---- 项目设置：项目权限（P7-C：单成员详情标签化 + 多人矩阵 + 三态覆盖；
 // 与实际判定同源——UI 不重算，全部读服务端解释） ----

src/components/adminSections.tsx

@@ -2,26 +2,20 @@
 // 全部收进这里，由 AdminZone 以分区注册表呈现。数据入口与原弹窗完全一致
 //（api.* 不变），只换呈现位置；插件面板/声明工作区经 UIRenderer 内联渲染。
 import { useEffect, useState } from 'react'
-import { api } from '../api'
+import { api, type RecoveryProposal } from '../api'
 import { store, useStore } from '../store'
 import type { AgentProfile } from '../contracts'
 import { Btn, EmptyState, Icon, SettingRow, SettingsGroup, UIRenderer, type DocBridge } from '@ui'
 import { SettingInput, flatten, unflatten } from './SettingsModal'
 import type { SettingDesc } from '../contracts'
 import { docBridge } from './Workbench'
-import { randomPassword } from '../passwords'
+import { recoveryProposalErrorMessage, recoveryProposalHint, recoveryStatusLabel } from '../recovery'
 
-// ---- 用户管理（原 AdminUsersModal 主体，R2 管理员发放制 + 2026-10-13 恢复 Key）----
-interface AdminUserRow { owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string }
-interface LoginKeyRow { id: string; owner: string; purpose: string; status: string; expiresAt: string; createdAt: string; createdBy?: string }
-
-/** Key 状态徽标：复用既有 chip 体系，不新增颜色。 */
-function keyStatusChip(status: string) {
-  if (status === 'unused') return <span className="ad-chip ad-chip-warn">待使用</span>
-  if (status === 'consumed') return <span className="ad-chip">已使用</span>
-  if (status === 'expired') return <span className="ad-chip">已过期</span>
-  return <span className="ad-chip">已撤销</span>
-}
+// ---- 用户管理（原 AdminUsersModal 主体，R2 管理员发放制）：建号仅创建待初始化
+// 账号（HTTP 契约不含密码与管理员位），初始凭证由服务器本地 CLI 发放激活 Key；
+// 恢复走属主确认制提案：管理员提案 → 用户在「设置 → 账号」本人确认 → 一次性 Key
+// 只在属主会话内出现（直接签发 Key 的 HTTP 入口已被 410 替换）。----
+interface AdminUserRow { userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number }
 
 export function UsersPanel() {
   const me = useStore(s => s.me)
@@ -30,60 +24,51 @@ export function UsersPanel() {
   const [notice, setNotice] = useState('')
   const [owner, setOwner] = useState('')
   const [name, setName] = useState('')
-  const [pw, setPw] = useState('')
-  const [asAdmin, setAsAdmin] = useState(false)
   const [busy, setBusy] = useState(false)
-  // 登录 Key 面板：keyFor 打开指定用户的签发/状态视图；issued 明文仅签发响应持有一次。
-  const [keyFor, setKeyFor] = useState<string | null>(null)
-  const [issued, setIssued] = useState<{ key: string; expiresAt: string } | null>(null)
-  const [keys, setKeys] = useState<LoginKeyRow[] | null>(null)
+  // 恢复提案面板：propFor 打开指定用户的提案视图（创建 / 状态 / 撤销）。
+  const [propFor, setPropFor] = useState<AdminUserRow | null>(null)
+  const [proposals, setProposals] = useState<RecoveryProposal[] | null>(null)
 
   const refresh = async () => {
     try { setUsers(await api.listAdminUsers()) } catch (e) { setErr(String(e)) }
   }
-  const refreshKeys = async (owner: string) => {
-    try { setKeys(await api.adminListLoginKeys(owner)) } catch (e) { setErr(String(e)) }
+  const refreshProposals = async (userId: string) => {
+    try { setProposals(await api.listAdminRecoveryProposals(userId)) } catch (e) { setErr(String(e)) }
   }
   useEffect(() => { refresh() }, [])
 
-  const openKeyPanel = async (owner: string) => {
-    setErr(''); setNotice(''); setIssued(null); setKeyFor(owner); setKeys(null)
-    await refreshKeys(owner)
-  }
-
   const create = async () => {
     setErr(''); setNotice('')
-    if (pw.length < 8) { setErr('初始密码至少 8 位'); return }
     setBusy(true)
     try {
-      await api.createAdminUser(owner.trim(), name.trim(), pw, asAdmin)
-      setNotice(`已创建 ${owner.trim()}：首次登录须改密`)
-      setOwner(''); setName(''); setPw('')
+      const out = await api.createAdminUser(owner.trim(), name.trim())
+      setNotice(`已创建 ${out.owner}（待初始化）：请在服务器执行 user initialize-account 发放激活 Key`)
+      setOwner(''); setName('')
       await refresh()
     } catch (e) { setErr(String(e).includes('409') ? '用户名已存在' : String(e)) } finally { setBusy(false) }
   }
 
-  const issue = async () => {
-    if (!keyFor) return
+  const openProposals = async (u: AdminUserRow) => {
+    setErr(''); setNotice(''); setPropFor(u); setProposals(null)
+    await refreshProposals(u.userId)
+  }
+
+  const propose = async () => {
+    if (!propFor) return
     setErr(''); setNotice(''); setBusy(true)
     try {
-      const out = await api.adminIssueLoginKey(keyFor)
-      setIssued({ key: out.key, expiresAt: out.expiresAt })
-      await refreshKeys(keyFor)
-    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
+      await api.createAdminRecoveryProposal(propFor.userId, propFor.stateVersion, crypto.randomUUID())
+      setNotice(`已为 ${propFor.owner} 建立恢复提案：请该用户在「设置 → 账号」由本人确认；确认后一次性 Key 只在其会话内出现`)
+      await refreshProposals(propFor.userId)
+    } catch (e) { setErr(recoveryProposalErrorMessage(String(e))) } finally { setBusy(false) }
   }
 
-  const copyKey = async () => {
-    if (!issued) return
-    try { await navigator.clipboard.writeText(issued.key); setNotice('已复制到剪贴板，请安全交付给该用户') } catch { setErr('复制失败，请手动选择复制') }
-  }
-
-  const revoke = async (id: string) => {
-    if (!keyFor) return
+  const revokeProposal = async (p: RecoveryProposal) => {
+    if (!propFor) return
     setErr(''); setBusy(true)
     try {
-      await api.adminRevokeLoginKey(keyFor, id)
-      await refreshKeys(keyFor)
+      await api.adminRevokeRecoveryProposal(propFor.userId, p.id, p.version)
+      await refreshProposals(propFor.userId)
     } catch (e) { setErr(String(e)) } finally { setBusy(false) }
   }
 
@@ -94,48 +79,40 @@ export function UsersPanel() {
           <div className="ad-row">
             <input className="lg-input" placeholder="用户名（登录名）" value={owner} onChange={e => setOwner(e.target.value)} />
             <input className="lg-input" placeholder="显示名（可空）" value={name} onChange={e => setName(e.target.value)} />
+            <button className="lg-submit ad-create-btn" disabled={busy || !owner.trim()} onClick={create}>创建账号</button>
           </div>
-          <div className="ad-row">
-            <input className="lg-input lg-mono" placeholder="初始密码（≥8 位）" value={pw} onChange={e => setPw(e.target.value)} />
-            <button type="button" className="ad-mini" title="生成随机密码" onClick={() => setPw(randomPassword())}>随机</button>
-            <label className="ad-check"><input type="checkbox" checked={asAdmin} onChange={e => setAsAdmin(e.target.checked)} />管理员</label>
-            <button className="lg-submit ad-create-btn" disabled={busy || !owner.trim() || !pw} onClick={create}>创建账号</button>
-          </div>
-          <p className="ad-hint">创建后该用户首次登录必须修改此初始密码；忘记密码时为其生成一次性登录 Key。</p>
+          <p className="ad-hint">账号创建后处于待初始化状态：在服务器执行 user initialize-account 发放一次性激活 Key，用户经兑换入口设置密码后登录</p>
         </div>
       )}
       {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
       {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
-      {keyFor ? (
+      {propFor ? (
         <div className="ad-reset">
           <div className="ad-row">
-            <span><b>{keyFor}</b> 的一次性登录 Key（忘记密码恢复）</span>
-            <button className="lg-submit ad-create-btn" disabled={busy} onClick={issue}>{issued ? '重新签发（旧 Key 与受限会话立即失效）' : '生成 Key'}</button>
-            <button type="button" className="ad-mini" onClick={() => { setKeyFor(null); setIssued(null); setKeys(null) }}>关闭</button>
+            <span><b>{propFor.owner}</b> 的恢复提案（属主确认制：管理员提案，本人确认后获一次性 Key）</span>
+            <button className="lg-submit ad-create-btn" disabled={busy} onClick={propose}>发起恢复提案</button>
+            <button type="button" className="ad-mini" onClick={() => { setPropFor(null); setProposals(null) }}>关闭</button>
           </div>
-          {issued && (
-            <div className="ad-row">
-              <input className="lg-input lg-mono" readOnly value={issued.key} aria-label="一次性登录 Key（仅显示一次）" onFocus={e => e.currentTarget.select()} />
-              <button type="button" className="ad-mini" onClick={copyKey}>复制</button>
-            </div>
-          )}
-          {issued && <p className="ad-hint">明文仅此一次显示，关闭后不可再取；单次有效，{new Date(issued.expiresAt).toLocaleString()} 过期。请经安全渠道交付本人。</p>}
-          {keys !== null && keys.length > 0 && (
+          <p className="ad-hint">前提：该用户当前在任一设备保持完整密码登录（会话证明）。已锁死且无会话的账号无法在线恢复，请走服务器本地处置。</p>
+          {proposals !== null && proposals.length > 0 && (
             <table className="ad-table">
-              <thead><tr><th>签发时间</th><th>用途</th><th>状态</th><th>过期时间</th><th></th></tr></thead>
+              <thead><tr><th>提案</th><th>状态</th><th>到期时间</th><th>发起人</th><th></th></tr></thead>
               <tbody>
-                {keys.map(k => (
-                  <tr key={k.id}>
-                    <td className="ad-dim">{new Date(k.createdAt).toLocaleString()}</td>
-                    <td>{k.purpose === 'recover' ? '恢复' : '激活'}</td>
-                    <td>{keyStatusChip(k.status)}</td>
-                    <td className="ad-dim">{new Date(k.expiresAt).toLocaleString()}</td>
-                    <td>{k.status === 'unused' && <button className="ad-mini" disabled={busy} onClick={() => revoke(k.id)}>撤销</button>}</td>
+                {proposals.map(p => (
+                  <tr key={p.id}>
+                    <td className="ad-mono">{p.id}</td>
+                    <td>{recoveryStatusLabel[p.status]}{recoveryProposalHint(p.status) && <span className="ad-dim"> · {recoveryProposalHint(p.status)}</span>}</td>
+                    <td className="ad-dim">{new Date(p.expiresAt).toLocaleString()}</td>
+                    <td className="ad-dim">{p.createdBy}</td>
+                    <td>{(p.status === 'pending' || p.status === 'confirmed') && (
+                      <button className="ad-mini" disabled={busy} onClick={() => revokeProposal(p)}>撤销</button>
+                    )}</td>
                   </tr>
                 ))}
               </tbody>
             </table>
           )}
+          {proposals !== null && proposals.length === 0 && <p className="ad-hint">该用户当前没有恢复提案。</p>}
         </div>
       ) : (
         <table className="ad-table">
@@ -149,7 +126,7 @@ export function UsersPanel() {
                 <td>{u.mustChangePassword ? <span className="ad-chip ad-chip-warn">待改密</span> : u.hasPassword ? '正常' : '未设密码'}</td>
                 <td className="ad-dim">{u.passwordSetAt ? new Date(u.passwordSetAt).toLocaleString() : '—'}</td>
                 <td>{me?.isAdmin && (
-                  <button className="ad-mini" onClick={() => openKeyPanel(u.owner)}>生成登录 Key</button>
+                  <button className="ad-mini" onClick={() => openProposals(u)}>恢复提案</button>
                 )}</td>
               </tr>
             ))}

src/components/duties/RdmDutiesSection.tsx

@@ -0,0 +1,253 @@
+import { useEffect, useRef, useState } from 'react'
+import { api } from '../../api'
+import type { Project } from '../../contracts'
+import { projectWorkError } from '../../projectmeta'
+import { Btn, Collapsible, EmptyState, Icon } from '@ui'
+import { dutyMatrixPayload, dutyPreviewPayload, dutyLegacyPayload } from '../../rdmManagement'
+import {
+  absorbServerDocs, dirtyDocs, editCell, savePayload,
+  type CellDuty, type DutyDocDraft, type DutyMember,
+} from '../../duties/draft'
+import { DutyByDocumentView, DutyByMemberView, DutyChangePreview, DutyMatrixView } from '../../duties/views'
+
+type ViewName = 'member' | 'document' | 'matrix'
+
+interface MatrixDoc {
+  docId: string
+  title: string
+  code?: string
+  typeKey: string
+  stage?: string
+  dutyVersion: number
+  activeRound?: number
+  legacySectionOverrides?: number
+}
+interface MatrixOut {
+  canAssign: boolean
+  docs: MatrixDoc[]
+  members: DutyMember[]
+  cells: { docId: string; owner: string; duty: string }[]
+  nextDocCursor?: string
+  nextMemberCursor?: string
+}
+interface PreviewOut {
+  ok: boolean
+  docs: {
+    docId: string
+    title?: string
+    replacedAuthor?: string
+    replacedApprover?: string
+    needsConfirm?: boolean
+    reasons?: string[]
+  }[]
+}
+interface LegacyOut {
+  findings: { docId: string; title: string; sectionTitle: string; kind: string }[]
+}
+
+export function RdmDutiesSection({ project }: { project: Project }) {
+  const projectId = project.id
+  const writeError = projectWorkError(project)
+  const [view, setView] = useState<ViewName>('member')
+  const [docs, setDocs] = useState<DutyDocDraft[]>([])
+  const [members, setMembers] = useState<DutyMember[]>([])
+  const [member, setMember] = useState('')
+  const [docId, setDocId] = useState('')
+  const [query, setQuery] = useState('')
+  const [stage, setStage] = useState('')
+  const [typeKey, setTypeKey] = useState('')
+  const [assignment, setAssignment] = useState('')
+  const [docCursor, setDocCursor] = useState('')
+  const [nextDoc, setNextDoc] = useState('')
+  const [canAssign, setCanAssign] = useState(false)
+  const [narrow, setNarrow] = useState(false)
+  const [err, setErr] = useState('')
+  const [notice, setNotice] = useState('')
+  const [busy, setBusy] = useState(false)
+  const [preview, setPreview] = useState<PreviewOut['docs']>([])
+  const [confirm, setConfirm] = useState(false)
+  const [legacy, setLegacy] = useState<LegacyOut['findings']>([])
+  const [legacyOpen, setLegacyOpen] = useState(false)
+  const seq = useRef(0)
+  const op = useRef(0)
+  const docsRef = useRef(docs)
+  docsRef.current = docs
+
+  const load = async (cursor: string, request = ++seq.current, replaceDirty = false) => {
+    const seenMembers: DutyMember[] = []
+    const seenCells: MatrixOut['cells'] = []
+    let pageDocs: MatrixDoc[] = []
+    let memberCursor = ''
+    let nextDocument = ''
+    let assignable = false
+    try {
+      do {
+        const page = await api.rdmProjectCommand<MatrixOut>(project, 'rdm.duty.matrix', dutyMatrixPayload(projectId, {
+          view: 'matrix', query, stage, typeKey, assignment, docCursor: cursor, memberCursor, docLimit: 10, memberLimit: 20,
+        }))
+        if (request !== seq.current) return
+        if (pageDocs.length === 0) pageDocs = page.docs ?? []
+        seenMembers.push(...(page.members ?? []))
+        seenCells.push(...(page.cells ?? []))
+        assignable = page.canAssign
+        nextDocument = page.nextDocCursor ?? ''
+        memberCursor = page.nextMemberCursor ?? ''
+      } while (memberCursor)
+      if (request !== seq.current) return
+      setMembers(seenMembers)
+      setCanAssign(assignable)
+      setNextDoc(nextDocument)
+      setDocs(current => absorbServerDocs(current, pageDocs, seenCells, replaceDirty))
+    } catch (error) {
+      if (request !== seq.current) return
+      setErr(String(error))
+    }
+  }
+
+  useEffect(() => {
+    const media = window.matchMedia('(max-width: 720px)')
+    const apply = () => setNarrow(media.matches)
+    apply()
+    media.addEventListener('change', apply)
+    return () => media.removeEventListener('change', apply)
+  }, [])
+
+  useEffect(() => {
+    void load(docCursor)
+    return () => { seq.current += 1 }
+  }, [project, query, stage, typeKey, assignment, docCursor])
+
+  const onCell = (id: string, owner: string, duty: CellDuty) => {
+    setPreview([])
+    setConfirm(false)
+    setDocs(current => editCell(current, id, owner, duty))
+  }
+
+  const visibleDocs = docs.filter(doc => {
+    const text = `${doc.title} ${doc.code} ${doc.docId}`.toLowerCase()
+    if (query && !text.includes(query.trim().toLowerCase())) return false
+    if (stage && doc.stage !== stage) return false
+    if (typeKey && doc.typeKey !== typeKey) return false
+    return true
+  })
+
+  const save = async () => {
+    const payload = savePayload(docsRef.current, confirm)
+    if (payload.issues.length > 0) {
+      setErr(payload.issues.join('；'))
+      return
+    }
+    const request = ++seq.current
+    const ticket = ++op.current
+    setBusy(true); setErr(''); setNotice('')
+    let sent = false
+    try {
+      const looked = await api.rdmProjectCommand<PreviewOut>(project, 'rdm.duty.preview', dutyPreviewPayload(projectId, payload.docs))
+      if (request !== seq.current) return
+      setPreview(looked.docs ?? [])
+      if (!looked.ok) {
+        setErr('预览未通过，未写入')
+        return
+      }
+      if ((looked.docs ?? []).some(item => item.needsConfirm) && !confirm) {
+        setErr('在途审签将失效。确认后再保存。')
+        return
+      }
+      sent = true
+      await api.rdmProjectCommand(project, 'rdm.review.assign.doc.batch', dutyPreviewPayload(projectId, savePayload(docsRef.current, confirm).docs))
+      if (request !== seq.current) return
+      setNotice('已保存文档职责')
+      setPreview([])
+      setConfirm(false)
+      setDocs(current => current.map(doc => ({ ...doc, dirty: false })))
+      await load(docCursor, request)
+    } catch (error) {
+      if (request !== seq.current) return
+      if (!sent) {
+        setErr(String(error))
+        return
+      }
+      setErr(`保存结果未确认：${error}`)
+      setConfirm(false)
+      await load(docCursor, request, true)
+    } finally {
+      if (ticket === op.current) setBusy(false)
+    }
+  }
+
+  const scanLegacy = async (request = ++seq.current) => {
+    try {
+      const out = await api.rdmProjectCommand<LegacyOut>(project, 'rdm.duty.legacy.scan', dutyLegacyPayload(projectId))
+      if (request !== seq.current) return
+      setLegacy(out.findings ?? [])
+    } catch (error) {
+      if (request !== seq.current) return
+      setErr(String(error))
+    }
+  }
+
+  const applyIdentical = async () => {
+    const request = ++seq.current
+    const ticket = ++op.current
+    setBusy(true)
+    try {
+      await api.rdmProjectCommand(project, 'rdm.duty.legacy.apply', dutyLegacyPayload(projectId))
+      if (request !== seq.current) return
+      setNotice('已归并无歧义的章节职责')
+      await scanLegacy(request)
+      await load(docCursor, request)
+    } catch (error) {
+      if (request !== seq.current) return
+      setErr(String(error))
+    } finally {
+      if (ticket === op.current) setBusy(false)
+    }
+  }
+
+  const disabled = busy || !!writeError || !canAssign
+  const ambiguous = legacy.filter(item => item.kind !== 'identical')
+
+  return (
+    <div>
+      <p className="ad-hint">本页只分配已有文档的职责，不创建或生成文档。</p>
+      {writeError && <p className="ad-hint">{writeError}</p>}
+      <div className="ad-row" role="tablist" aria-label="职责视图">
+        <button className="ad-mini" role="tab" aria-selected={view === 'member'} onClick={() => setView('member')}>按人员</button>
+        <button className="ad-mini" role="tab" aria-selected={view === 'document'} onClick={() => setView('document')}>按文档</button>
+        <button className="ad-mini" role="tab" aria-selected={view === 'matrix'} onClick={() => setView('matrix')}>矩阵</button>
+      </div>
+      <div className="ad-row">
+        <input aria-label="筛选文档名称或编号" value={query} placeholder="名称或编号" disabled={busy} onChange={event => { setDocCursor(''); setQuery(event.target.value) }} />
+        <input aria-label="筛选类型" value={typeKey} placeholder="类型" disabled={busy} onChange={event => { setDocCursor(''); setTypeKey(event.target.value) }} />
+        <input aria-label="筛选阶段" value={stage} placeholder="阶段" disabled={busy} onChange={event => { setDocCursor(''); setStage(event.target.value) }} />
+        <select aria-label="筛选当前职责" value={assignment} disabled={busy} onChange={event => { setDocCursor(''); setAssignment(event.target.value) }}>
+          <option value="">全部</option>
+          <option value="assigned">已分配</option>
+          <option value="unassigned">未分配</option>
+        </select>
+      </div>
+      {view === 'member' && <DutyByMemberView member={member} members={members} docs={visibleDocs} disabled={disabled} onMember={setMember} onCell={onCell} />}
+      {view === 'document' && <DutyByDocumentView docId={docId} docs={visibleDocs} members={members} disabled={disabled} onDoc={setDocId} onCell={onCell} />}
+      {view === 'matrix' && <DutyMatrixView docs={visibleDocs} members={members} disabled={disabled} narrow={narrow} onCell={onCell} />}
+      <div className="ad-row">
+        {docCursor && <button className="ad-mini" disabled={busy} onClick={() => setDocCursor('')}>文档首页</button>}
+        {nextDoc && <button className="ad-mini" disabled={busy} onClick={() => setDocCursor(nextDoc)}>下一页文档</button>}
+        <Btn variant="primary" icon="check" disabled={disabled || dirtyDocs(docs).length === 0} onClick={() => { void save() }}>保存职责</Btn>
+      </div>
+      <DutyChangePreview impacts={preview} confirm={confirm} onConfirm={setConfirm} />
+      <Collapsible id="duty-legacy" open={legacyOpen} onToggle={setLegacyOpen} trigger="旧章节职责">
+        <button className="ad-mini" disabled={busy} onClick={() => { void scanLegacy() }}>扫描</button>
+        <button className="ad-mini" disabled={disabled} onClick={() => { void applyIdentical() }}>归并无歧义覆盖</button>
+        {legacy.length === 0 ? <p className="ad-hint">尚未扫描，或没有章节级覆盖。</p> : (
+          <ul>
+            {legacy.map(item => <li key={`${item.docId}-${item.sectionTitle}`}>{item.title} / {item.sectionTitle}：{item.kind === 'identical' ? '与文档职责一致' : '有歧义，需逐文档确认'}</li>)}
+          </ul>
+        )}
+        {ambiguous.length > 0 && <p className="ad-hint">有歧义的文档不会自动覆盖。请在上面的视图里逐份确认后再保存。</p>}
+      </Collapsible>
+      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
+      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
+      {docs.length === 0 && !err && <EmptyState icon="inbox">暂无文档</EmptyState>}
+    </div>
+  )
+}

src/documentCockpit.test.ts

@@ -0,0 +1,126 @@
+// 文档驾驶舱 I2 纯逻辑层测试：能力门控、筛选切换、统计呈现（真 0 vs 不可算）、
+// 快照一致性/更新提示、上下文键、选择保留、树徽标。组件取数编排不在此覆盖。
+import { describe, expect, it } from 'vitest'
+import {
+  contextKey, nodeSummaryLine, sameSnapshot, selectionSurvives, statDisplay,
+  STAT_FILTERS, toggleFilter, treeBadges, updateNotice,
+  type CockpitMeta, type CockpitStats, type CockpitTreeNode,
+} from './documentCockpit'
+import { cockpitReady, COCKPIT_COMMANDS } from './workspaces'
+
+const meta = (rev: string, seq: number): CockpitMeta => ({
+  schemaVersion: 'document-cockpit.v1', projectId: 'p1', snapshotRevision: rev,
+  asOfSeq: seq, generatedAt: '2026-10-16T00:00:00Z', truncated: false,
+})
+
+describe('cockpitReady', () => {
+  const all = COCKPIT_COMMANDS.map(id => ({ id, enabled: true }))
+  it('七命令齐备且 enabled 才就绪', () => {
+    expect(cockpitReady(null)).toBe(false)
+    expect(cockpitReady([])).toBe(false)
+    expect(cockpitReady(all.map(c => ({ ...c, enabled: false })))).toBe(false)
+    expect(cockpitReady(all.slice(0, 6))).toBe(false)
+    expect(cockpitReady(all)).toBe(true)
+  })
+})
+
+describe('统计呈现：真 0 与不可算不得互相冒充', () => {
+  const stats: CockpitStats = {
+    documentCount: 0,
+    completion: { known: 3, total: 5, state: 'known' },
+    emptyNodeCount: 0,
+    unverifiedSourceCount: 2,
+    conflictCount: null as unknown as number,
+    pendingChangeCount: null,
+    updatedAt: '',
+    statReasons: { conflictCount: 'upstream_error', pendingChangeCount: 'not_projected_v1' },
+  }
+  it('真 0 显示 0', () => {
+    expect(statDisplay(stats, 'empty').value).toBe('0')
+    expect(statDisplay(stats, 'documents').value).toBe('0')
+  })
+  it('null 显示 — 并带原因', () => {
+    const d = statDisplay(stats, 'conflict')
+    expect(d.value).toBe('—')
+    expect(d.hint).toBe('upstream_error')
+  })
+  it('未纳入投影的统计显式标注原因', () => {
+    const d = statDisplay(stats, 'pending')
+    expect(d.value).toBe('—')
+    expect(d.hint).toBe('not_projected_v1')
+  })
+  it('完成度三分态：known/partial/unavailable', () => {
+    expect(statDisplay(stats, 'completion').value).toBe('3/5')
+    expect(statDisplay({ ...stats, completion: { known: 1, total: 5, state: 'partial' } }, 'completion').hint).toBe('部分计算')
+    const u = statDisplay({ ...stats, completion: { known: 0, total: 0, state: 'unavailable' } }, 'completion')
+    expect(u.value).toBe('—')
+  })
+})
+
+describe('筛选切换', () => {
+  it('点击切换、再点清除；统计键与筛选值一一对应', () => {
+    expect(toggleFilter('', 'state:empty')).toBe('state:empty')
+    expect(toggleFilter('state:empty', 'state:empty')).toBe('')
+    expect(toggleFilter('state:empty', 'state:conflict')).toBe('state:conflict')
+    expect(STAT_FILTERS.map(s => s.filter)).toEqual(['state:empty', 'state:unverified', 'state:conflict'])
+  })
+})
+
+describe('快照一致性与更新提示', () => {
+  it('同 revision 同 seq 视为同快照', () => {
+    expect(sameSnapshot(meta('wm:5', 5), meta('wm:5', 5))).toBe(true)
+    expect(sameSnapshot(meta('wm:5', 5), meta('wm:6', 6))).toBe(false)
+    expect(sameSnapshot(undefined, meta('wm:5', 5))).toBe(false)
+  })
+  it('展示快照落后时提示刷新，一致时不提示', () => {
+    expect(updateNotice(meta('wm:5', 5), meta('wm:6', 6))).toContain('wm:6')
+    expect(updateNotice(meta('wm:6', 6), meta('wm:6', 6))).toBeNull()
+    expect(updateNotice(null, meta('wm:6', 6))).toBeNull()
+  })
+})
+
+describe('旧响应丢弃的上下文键', () => {
+  it('项目与筛选任一变化都改变键', () => {
+    expect(contextKey('p1', '')).not.toBe(contextKey('p2', ''))
+    expect(contextKey('p1', '')).not.toBe(contextKey('p1', 'state:empty'))
+    expect(contextKey('p1', 'state:empty')).toBe(contextKey('p1', 'state:empty'))
+  })
+})
+
+describe('刷新不重置选择', () => {
+  it('文档仍在根清单则保留', () => {
+    const kept = selectionSurvives({ kind: 'document', id: 'd1' }, ['d1', 'd2'])
+    expect(kept).toEqual({ kind: 'document', id: 'd1' })
+  })
+  it('文档被筛掉则清空', () => {
+    expect(selectionSurvives({ kind: 'document', id: 'd9' }, ['d1', 'd2'])).toBeNull()
+  })
+  it('章节选择随父文档存活', () => {
+    expect(selectionSurvives({ kind: 'section', id: 's1' }, ['d1'], 'd1')).toEqual({ kind: 'section', id: 's1' })
+    expect(selectionSurvives({ kind: 'section', id: 's1' }, ['d2'], 'd1')).toBeNull()
+    expect(selectionSurvives(null, ['d1'])).toBeNull()
+  })
+})
+
+describe('树徽标与状态行', () => {
+  const node = (over: Partial<CockpitTreeNode['state']> & { visibility?: string }): CockpitTreeNode => ({
+    ref: { kind: 'section', id: 's1' }, title: '章节', path: [], childCount: 0,
+    visibility: over.visibility || 'full',
+    state: {
+      content: 'complete', verification: 'not_applicable', sourceCount: 0,
+      conflictCount: 0, impactCount: 0, missingChildCount: 0, structuralGap: true, ...over,
+    },
+  } as CockpitTreeNode)
+  it('诚实徽标：空/受限/未核实/冲突计数', () => {
+    expect(treeBadges(node({}))).toEqual([])
+    expect(treeBadges(node({ content: 'empty' }))).toContain('空')
+    expect(treeBadges(node({ verification: 'unverified' }))).toContain('未核实')
+    expect(treeBadges(node({ conflictCount: 2 }))).toContain('冲突 2')
+    expect(treeBadges(node({ visibility: 'metadata_only' }))).toContain('仅元数据')
+  })
+  it('结构缺口显式标注（冻结事实：doc→section 两级）', () => {
+    const line = nodeSummaryLine(node({ content: 'empty' }))
+    expect(line).toContain('内容为空')
+    expect(line).toContain('层级止于章节')
+  })
+})

src/documentCockpit.ts

@@ -0,0 +1,170 @@
+// 文档驾驶舱 I2 纯逻辑层（rollout I2；契约：Dev 仓 docs/superpowers/specs
+// 2026-10-16-document-visualization-read-model-contract.md @ 37b272ba，
+// 四项取舍冻结见 plans/…-rollout.md §7）。只放可测判定：筛选切换、统计呈现
+//（真 0 vs 不可算）、快照一致性与更新提示、上下文键与选择保留。组件只做取数编排与渲染。
+
+// ---- 契约类型（I1 后端 DTO 的前端精简形态） ----
+
+export interface CockpitNodeRef { kind: string; id: string; version?: string }
+
+export interface CockpitMeta {
+  schemaVersion: string
+  projectId: string
+  snapshotRevision: string
+  asOfSeq: number
+  generatedAt: string
+  truncated: boolean
+  truncationReasons?: string[]
+}
+
+export interface CockpitNodeState {
+  content: string // complete|partial|empty|inaccessible|unavailable
+  verification: string // verified|mixed|unverified|disputed|not_applicable
+  sourceCount: number
+  conflictCount: number
+  impactCount: number
+  missingChildCount: number
+  structuralGap: boolean
+}
+
+export interface CockpitTreeNode {
+  ref: CockpitNodeRef
+  title: string
+  path: string[]
+  parent?: CockpitNodeRef
+  childCount: number
+  state: CockpitNodeState
+  lastChangedAt?: string
+  lastChangedBy?: string
+  visibility: string // full|redacted|metadata_only
+}
+
+export interface CockpitStats {
+  documentCount: number
+  completion: { known: number; total: number; state: string }
+  emptyNodeCount: number
+  unverifiedSourceCount: number
+  conflictCount: number
+  pendingChangeCount: number | null
+  updatedAt?: string
+  statReasons: Record<string, string>
+}
+
+export interface CockpitChangeSummary {
+  node: CockpitNodeRef
+  title: string
+  changedAt: string
+  actor?: string
+  kind: string
+  summary: string
+  version?: string
+}
+
+export interface CockpitOverview {
+  meta: CockpitMeta
+  project: { title: string }
+  stats: CockpitStats
+  documents: CockpitTreeNode[]
+  recentChanges: CockpitChangeSummary[]
+}
+
+export interface CockpitTreePage {
+  meta: CockpitMeta
+  items: CockpitTreeNode[]
+  nextCursor?: string
+  hasMore: boolean
+}
+
+// ---- 统计带：点击即切换共享筛选（视图规格 §2；未知筛选由后端 400 拒绝） ----
+
+export const STAT_FILTERS: { key: string; label: string; filter: string }[] = [
+  { key: 'empty', label: '空缺节点', filter: 'state:empty' },
+  { key: 'unverified', label: '未核实来源', filter: 'state:unverified' },
+  { key: 'conflict', label: '冲突', filter: 'state:conflict' },
+]
+
+/** 点击统计卡：同筛选再次点击＝清除（只定位，不执行写入）。 */
+export function toggleFilter(current: string, filter: string): string {
+  return current === filter ? '' : filter
+}
+
+/** 统计呈现：null（不可算）显示 — 加原因；真 0 显示 0。两侧都不得互相冒充（契约 §2/§6）。 */
+export function statDisplay(stats: CockpitStats, key: string): { value: string; hint?: string } {
+  const reasons = stats.statReasons || {}
+  if (key === 'documents') return { value: String(stats.documentCount) }
+  if (key === 'completion') {
+    const c = stats.completion
+    if (c.state === 'unavailable') return { value: '—', hint: reasons['completion'] || '无法计算' }
+    if (c.state === 'partial') return { value: `${c.known}/${c.total}`, hint: '部分计算' }
+    return { value: `${c.known}/${c.total}` }
+  }
+  const map: Record<string, number | null | undefined> = {
+    empty: stats.emptyNodeCount,
+    unverified: stats.unverifiedSourceCount,
+    conflict: stats.conflictCount,
+    pending: stats.pendingChangeCount,
+  }
+  const v = map[key]
+  // 原因表按后端 DTO 字段名（statReasons 键=字段名），展示键需映射。
+  const reasonKey: Record<string, string> = {
+    empty: 'emptyNodeCount', unverified: 'unverifiedSourceCount',
+    conflict: 'conflictCount', pending: 'pendingChangeCount',
+  }
+  if (v === null || v === undefined) return { value: '—', hint: reasons[reasonKey[key] || key] || '暂不可计算' }
+  return { value: String(v) }
+}
+
+// ---- 快照一致性（DV-R05 前端侧）：统计与树徽标同快照才同屏可信 ----
+
+export function sameSnapshot(a?: CockpitMeta, b?: CockpitMeta): boolean {
+  if (!a || !b) return false
+  return a.snapshotRevision === b.snapshotRevision && a.asOfSeq === b.asOfSeq
+}
+
+/** 更新提示：展示中快照落后于最新已见快照时提示刷新（不抢占滚动，视图规格 §5）。 */
+export function updateNotice(viewed: CockpitMeta | null, latest: CockpitMeta | null): string | null {
+  if (!viewed || !latest) return null
+  if (viewed.snapshotRevision === latest.snapshotRevision && viewed.asOfSeq === latest.asOfSeq) return null
+  return `内容已更新（快照 ${latest.snapshotRevision}）——刷新查看最新状态`
+}
+
+/** 上下文键：项目+筛选标识一轮取数上下文；不匹配的旧响应直接丢弃（契约 §8）。 */
+export function contextKey(projectId: string, filter: string): string {
+  return `${projectId}\u0001${filter}`
+}
+
+/** 刷新不重置选择：文档仍在根清单（或选中章节的父文档仍在）则保留，否则清空。 */
+export function selectionSurvives(
+  selected: CockpitNodeRef | null,
+  rootDocIds: string[],
+  parentDocId?: string,
+): CockpitNodeRef | null {
+  if (!selected) return null
+  if (selected.kind === 'document') return rootDocIds.includes(selected.id) ? selected : null
+  if (parentDocId && rootDocIds.includes(parentDocId)) return selected
+  return null
+}
+
+/** 树行徽标（诚实状态：空/部分/受限/未核实/冲突计数；不虚构成功）。 */
+export function treeBadges(n: CockpitTreeNode): string[] {
+  const out: string[] = []
+  if (n.state.content === 'empty') out.push('空')
+  else if (n.state.content === 'partial') out.push('部分')
+  else if (n.state.content === 'inaccessible') out.push('受限')
+  if (n.visibility === 'metadata_only') out.push('仅元数据')
+  if (n.state.verification === 'unverified') out.push('未核实')
+  if (n.state.conflictCount > 0) out.push(`冲突 ${n.state.conflictCount}`)
+  return out
+}
+
+/** 节点状态一句话总结（全景 §4.2）。 */
+export function nodeSummaryLine(n: CockpitTreeNode): string {
+  const parts: string[] = []
+  const content = { complete: '内容完整', partial: '内容部分', empty: '内容为空', inaccessible: '内容受限', unavailable: '暂不可读' }[n.state.content] || n.state.content
+  parts.push(content)
+  if (n.state.structuralGap) parts.push('层级止于章节')
+  if (n.state.sourceCount > 0) parts.push(`来源 ${n.state.sourceCount}`)
+  if (n.state.conflictCount > 0) parts.push(`冲突 ${n.state.conflictCount}`)
+  if (n.state.impactCount > 0) parts.push(`影响 ${n.state.impactCount}`)
+  return parts.join(' · ')
+}

src/duties/draft.ts

@@ -0,0 +1,197 @@
+// 文档职责草稿的唯一存储。三个视图只投影这份数据；单元格值由三权反推。
+export type CellDuty = 'none' | 'author' | 'reviewer' | 'approver'
+
+interface DutyRoles {
+  author: string
+  reviewers: string[]
+  approver: string
+}
+
+export interface DutyDocDraft extends DutyRoles {
+  docId: string
+  title: string
+  code: string
+  typeKey: string
+  stage: string
+  dutyVersion: number
+  activeRound: number
+  legacySectionOverrides: number
+  dirty: boolean
+}
+
+export interface DutyMember {
+  owner: string
+  role: string
+  valid: boolean
+  canAuthor: boolean
+  canReview: boolean
+  canApprove: boolean
+}
+
+interface DutySaveItem {
+  docId: string
+  author: string
+  reviewers: string[]
+  approver: string
+  expectedDutyVersion: number
+  confirmInvalidation: boolean
+}
+
+export function cellDuty(roles: DutyRoles, owner: string): CellDuty {
+  if (roles.author === owner) return 'author'
+  if (roles.approver === owner) return 'approver'
+  if (roles.reviewers.includes(owner)) return 'reviewer'
+  return 'none'
+}
+
+export function applyCell(roles: DutyRoles, owner: string, duty: CellDuty): {
+  roles: DutyRoles
+  replacedAuthor: string
+  replacedApprover: string
+} {
+  const replacedAuthor = duty === 'author' && roles.author !== '' && roles.author !== owner ? roles.author : ''
+  const replacedApprover = duty === 'approver' && roles.approver !== '' && roles.approver !== owner ? roles.approver : ''
+  let author = roles.author === owner ? '' : roles.author
+  let approver = roles.approver === owner ? '' : roles.approver
+  let reviewers = roles.reviewers.filter(person => person !== owner)
+  switch (duty) {
+    case 'author':
+      author = owner
+      break
+    case 'approver':
+      approver = owner
+      break
+    case 'reviewer':
+      reviewers = [...reviewers, owner]
+      break
+    case 'none':
+      break
+    default: {
+      const exhaustive: never = duty
+      throw new Error(exhaustive)
+    }
+  }
+  return { roles: { author, reviewers, approver }, replacedAuthor, replacedApprover }
+}
+
+export function replacementNote(roles: DutyRoles, owner: string, duty: CellDuty): string {
+  if (duty === 'author' && roles.author !== '' && roles.author !== owner) return `将替换${roles.author}`
+  if (duty === 'approver' && roles.approver !== '' && roles.approver !== owner) return `将替换${roles.approver}`
+  return ''
+}
+
+function dutyConflicts(roles: DutyRoles): number {
+  const seen = new Map<string, number>()
+  const mark = (owner: string) => {
+    if (!owner) return
+    seen.set(owner, (seen.get(owner) ?? 0) + 1)
+  }
+  mark(roles.author)
+  mark(roles.approver)
+  for (const reviewer of roles.reviewers) mark(reviewer)
+  let conflicts = 0
+  for (const count of seen.values()) if (count > 1) conflicts += 1
+  return conflicts
+}
+
+export function completeness(roles: DutyRoles): { authors: number; reviewers: number; approvers: number; conflicts: number } {
+  return {
+    authors: roles.author ? 1 : 0,
+    reviewers: roles.reviewers.length,
+    approvers: roles.approver ? 1 : 0,
+    conflicts: dutyConflicts(roles),
+  }
+}
+
+export function saveIssues(roles: DutyRoles): string[] {
+  const issues: string[] = []
+  if (!roles.author) issues.push('需指定编制人')
+  if (roles.reviewers.length === 0) issues.push('审核至少一人')
+  if (!roles.approver) issues.push('需指定批准人')
+  if (dutyConflicts(roles) > 0) issues.push('一人只能担一个职责')
+  return issues
+}
+
+function rolesFromCells(docId: string, cells: { docId: string; owner: string; duty: string }[]): DutyRoles {
+  const roles: DutyRoles = { author: '', reviewers: [], approver: '' }
+  for (const cell of cells) {
+    if (cell.docId !== docId) continue
+    if (cell.duty !== 'none' && cell.duty !== 'author' && cell.duty !== 'reviewer' && cell.duty !== 'approver') continue
+    const next = applyCell(roles, cell.owner, cell.duty)
+    roles.author = next.roles.author
+    roles.reviewers = next.roles.reviewers
+    roles.approver = next.roles.approver
+  }
+  return roles
+}
+
+export function absorbServerDocs(
+  current: DutyDocDraft[],
+  docs: {
+    docId: string; title: string; code?: string; typeKey: string; stage?: string
+    dutyVersion: number; activeRound?: number; legacySectionOverrides?: number
+  }[],
+  cells: { docId: string; owner: string; duty: string }[],
+  replaceDirty = false,
+): DutyDocDraft[] {
+  const byId = new Map(current.map(doc => [doc.docId, doc]))
+  const pageIds = new Set(docs.map(doc => doc.docId))
+  const next: DutyDocDraft[] = []
+  for (const doc of docs) {
+    const previous = byId.get(doc.docId)
+    const serverRoles = rolesFromCells(doc.docId, cells)
+    const keepDraft = !replaceDirty && previous?.dirty === true
+    next.push({
+      docId: doc.docId,
+      title: doc.title,
+      code: doc.code ?? doc.docId,
+      typeKey: doc.typeKey,
+      stage: doc.stage ?? '',
+      dutyVersion: keepDraft ? previous.dutyVersion : doc.dutyVersion,
+      activeRound: doc.activeRound ?? 0,
+      legacySectionOverrides: doc.legacySectionOverrides ?? 0,
+      dirty: keepDraft,
+      author: keepDraft ? previous.author : serverRoles.author,
+      reviewers: keepDraft ? previous.reviewers : serverRoles.reviewers,
+      approver: keepDraft ? previous.approver : serverRoles.approver,
+    })
+  }
+  for (const doc of current) {
+    if (!replaceDirty && doc.dirty && !pageIds.has(doc.docId)) next.push(doc)
+  }
+  return next
+}
+
+export function editCell(docs: DutyDocDraft[], docId: string, owner: string, duty: CellDuty): DutyDocDraft[] {
+  return docs.map(doc => {
+    if (doc.docId !== docId) return doc
+    const next = applyCell(doc, owner, duty)
+    return { ...doc, ...next.roles, dirty: true }
+  })
+}
+
+export function dirtyDocs(docs: DutyDocDraft[]): DutyDocDraft[] {
+  return docs.filter(doc => doc.dirty)
+}
+
+export function savePayload(docs: DutyDocDraft[], confirmInvalidation: boolean): { docs: DutySaveItem[]; issues: string[] } {
+  const dirty = dirtyDocs(docs)
+  const issues: string[] = []
+  if (dirty.length === 0) issues.push('没有未保存的职责')
+  if (dirty.length > 20) issues.push('一次保存最多 20 份文档')
+  for (const doc of dirty) {
+    for (const issue of saveIssues(doc)) issues.push(`${doc.title}：${issue}`)
+  }
+  return {
+    docs: dirty.slice(0, 20).map(doc => ({
+      docId: doc.docId,
+      author: doc.author,
+      reviewers: doc.reviewers,
+      approver: doc.approver,
+      expectedDutyVersion: doc.dutyVersion,
+      confirmInvalidation: confirmInvalidation && doc.activeRound > 0,
+    })),
+    issues,
+  }
+}
+

src/duties/views.tsx

@@ -0,0 +1,203 @@
+import type { CellDuty, DutyDocDraft, DutyMember } from './draft'
+import { cellDuty, completeness, replacementNote, saveIssues } from './draft'
+
+const DUTY_OPTIONS: { value: CellDuty; label: string }[] = [
+  { value: 'none', label: '无职责' },
+  { value: 'author', label: '编制' },
+  { value: 'reviewer', label: '审核' },
+  { value: 'approver', label: '批准' },
+]
+
+function DutySelect({
+  doc, owner, disabled, onChange,
+}: {
+  doc: DutyDocDraft
+  owner: string
+  disabled: boolean
+  onChange: (duty: CellDuty) => void
+}) {
+  const current = cellDuty(doc, owner)
+  return (
+    <label className="duty-cell">
+      <select
+        aria-label={`${owner} 在 ${doc.title} 的职责`}
+        value={current}
+        disabled={disabled}
+        onChange={event => {
+          const value = event.target.value
+          if (value === 'none' || value === 'author' || value === 'reviewer' || value === 'approver') onChange(value)
+        }}
+      >
+        {DUTY_OPTIONS.map(option => {
+          const hint = replacementNote(doc, owner, option.value)
+          return <option key={option.value} value={option.value}>{hint ? `${option.label}（${hint}）` : option.label}</option>
+        })}
+      </select>
+    </label>
+  )
+}
+
+export function DutyByMemberView({
+  member, members, docs, disabled, onMember, onCell,
+}: {
+  member: string
+  members: DutyMember[]
+  docs: DutyDocDraft[]
+  disabled: boolean
+  onMember: (owner: string) => void
+  onCell: (docId: string, owner: string, duty: CellDuty) => void
+}) {
+  return (
+    <div>
+      <div className="setting-row">
+        <label htmlFor="duty-member">成员</label>
+        <select id="duty-member" aria-label="选择成员" value={member} onChange={event => onMember(event.target.value)}>
+          <option value="">选择成员</option>
+          {members.map(person => <option key={person.owner} value={person.owner}>{person.owner}</option>)}
+        </select>
+      </div>
+      {!member ? <p className="ad-hint">先选择成员，再为每份文档指定无职责、编制、审核或批准。</p> : (
+        <table className="ad-table">
+          <thead><tr><th>文档</th><th>类型 / 阶段</th><th>职责</th><th>完整性</th></tr></thead>
+          <tbody>
+            {docs.map(doc => {
+              const score = completeness(doc)
+              return (
+                <tr key={doc.docId}>
+                  <td>{doc.title}<span className="ad-dim ad-mono"> · {doc.code}</span></td>
+                  <td className="ad-dim">{doc.typeKey}{doc.stage ? ` / ${doc.stage}` : ''}</td>
+                  <td><DutySelect doc={doc} owner={member} disabled={disabled} onChange={duty => onCell(doc.docId, member, duty)} /></td>
+                  <td className="ad-dim">编 {score.authors}/1 · 审 {score.reviewers} · 批 {score.approvers}/1</td>
+                </tr>
+              )
+            })}
+            {docs.length === 0 && <tr><td colSpan={4} className="ad-dim">没有符合筛选的文档</td></tr>}
+          </tbody>
+        </table>
+      )}
+    </div>
+  )
+}
+
+export function DutyByDocumentView({
+  docId, docs, members, disabled, onDoc, onCell,
+}: {
+  docId: string
+  docs: DutyDocDraft[]
+  members: DutyMember[]
+  disabled: boolean
+  onDoc: (id: string) => void
+  onCell: (docId: string, owner: string, duty: CellDuty) => void
+}) {
+  const doc = docs.find(item => item.docId === docId)
+  const score = doc ? completeness(doc) : null
+  const issues = doc ? saveIssues(doc) : []
+  return (
+    <div>
+      <div className="setting-row">
+        <label htmlFor="duty-doc">文档</label>
+        <select id="duty-doc" aria-label="选择文档" value={docId} onChange={event => onDoc(event.target.value)}>
+          <option value="">选择整份文档</option>
+          {docs.map(item => <option key={item.docId} value={item.docId}>{item.title}</option>)}
+        </select>
+      </div>
+      {score && <p className="ad-hint">编制 {score.authors}/1、审核 {score.reviewers} 人、批准 {score.approvers}/1、冲突 {score.conflicts}{issues.length > 0 ? `。${issues.join('，')}` : ''}</p>}
+      {!doc ? <p className="ad-hint">先选择整份文档。这里不能选择章节，也没有生成入口。</p> : (
+        <table className="ad-table">
+          <thead><tr><th>成员</th><th>项目身份</th><th>职责</th></tr></thead>
+          <tbody>
+            {members.map(person => (
+              <tr key={person.owner}>
+                <td className="ad-mono">{person.owner}{person.valid ? '' : '（无效）'}</td>
+                <td className="ad-dim">{person.role === 'owner' ? '项目负责人' : '项目成员'}</td>
+                <td><DutySelect doc={doc} owner={person.owner} disabled={disabled || !person.valid} onChange={duty => onCell(doc.docId, person.owner, duty)} /></td>
+              </tr>
+            ))}
+          </tbody>
+        </table>
+      )}
+    </div>
+  )
+}
+
+export function DutyMatrixView({
+  docs, members, disabled, narrow, onCell,
+}: {
+  docs: DutyDocDraft[]
+  members: DutyMember[]
+  disabled: boolean
+  narrow: boolean
+  onCell: (docId: string, owner: string, duty: CellDuty) => void
+}) {
+  if (narrow) {
+    return <p className="ad-hint">当前宽度放不下成员×文档矩阵。请使用“按人员”或“按文档”。</p>
+  }
+  return (
+    <div className="duty-matrix-wrap">
+      <table className="ad-table duty-matrix">
+        <thead>
+          <tr>
+            <th className="duty-sticky">成员</th>
+            {docs.map(doc => {
+              const score = completeness(doc)
+              const ready = score.authors === 1 && score.reviewers >= 1 && score.approvers === 1 && score.conflicts === 0
+              return <th key={doc.docId}>{doc.title}<span className={ready ? 'ad-chip' : 'ad-chip ad-chip-warn'}>{ready ? '三权齐' : '未齐'}</span></th>
+            })}
+          </tr>
+        </thead>
+        <tbody>
+          {members.map(person => (
+            <tr key={person.owner}>
+              <td className="duty-sticky ad-mono">{person.owner}</td>
+              {docs.map(doc => (
+                <td key={doc.docId}>
+                  <DutySelect doc={doc} owner={person.owner} disabled={disabled || !person.valid} onChange={duty => onCell(doc.docId, person.owner, duty)} />
+                </td>
+              ))}
+            </tr>
+          ))}
+        </tbody>
+      </table>
+    </div>
+  )
+}
+
+export function DutyChangePreview({
+  impacts, confirm, onConfirm,
+}: {
+  impacts: {
+    docId: string
+    title?: string
+    replacedAuthor?: string
+    replacedApprover?: string
+    needsConfirm?: boolean
+    reasons?: string[]
+  }[]
+  confirm: boolean
+  onConfirm: (value: boolean) => void
+}) {
+  if (impacts.length === 0) return null
+  const needs = impacts.some(item => item.needsConfirm)
+  return (
+    <div className="settings-group">
+      <h4>保存前预览</h4>
+      <ul>
+        {impacts.map(item => (
+          <li key={item.docId}>
+            {item.title || item.docId}
+            {item.replacedAuthor ? `：编制将替换${item.replacedAuthor}` : ''}
+            {item.replacedApprover ? `：批准将替换${item.replacedApprover}` : ''}
+            {item.needsConfirm ? '；在途审签将失效，历史名单保持不变' : ''}
+            {item.reasons && item.reasons.length > 0 ? `；${item.reasons.join('，')}` : ''}
+          </li>
+        ))}
+      </ul>
+      {needs && (
+        <label>
+          <input type="checkbox" checked={confirm} onChange={event => onConfirm(event.target.checked)} />
+          确认使受影响的在途审签失效
+        </label>
+      )}
+    </div>
+  )
+}

src/passwords.ts

@@ -1,11 +0,0 @@
-// 浏览器端随机初始密码（管理员未显式给定密码时）：
-// crypto.getRandomValues 拒绝易混淆字符（0/O/1/l/I），保证可抄写。
-const ALPHABET = 'abcdefghjkmnpqrstuvwxyz23456789'
-
-export function randomPassword(length = 12): string {
-  const buf = new Uint32Array(length)
-  crypto.getRandomValues(buf)
-  let out = ''
-  for (let i = 0; i < length; i++) out += ALPHABET[buf[i] % ALPHABET.length]
-  return out
-}

src/rdmManagement.ts

@@ -26,6 +26,7 @@ export function rdmProjectReadError(project: Project | undefined): string | null
 const PROJECT_READ_COMMANDS = new Set([
   'rdm.project.member.list', 'rdm.perm.check', 'rdm.perm.matrix',
   'rdm.review.doc.status', 'rdm.duty.catalog', 'rdm.duty.get',
+  'rdm.duty.matrix', 'rdm.duty.preview', 'rdm.duty.legacy.scan',
 ])
 
 export function rdmProjectCommandError(project: Project, command: string): string | null {
@@ -54,14 +55,12 @@ export const RDM_PERM_MATRIX_COMMANDS = [
   'rdm.project.member.list',
 ] as const
 
-/** 项目设置「文档职责 · 整文审签」页消费的命令面。 */
-export const RDM_DOC_REVIEW_COMMANDS = [
+/** 项目设置「文档职责」页消费的命令面。审签命令留在文档工作区，不作为本页门控。 */
+export const RDM_DUTY_COMMANDS = [
+  'rdm.duty.matrix',
+  'rdm.duty.preview',
   'rdm.review.assign.doc',
-  'rdm.review.doc.submit',
-  'rdm.review.doc.approve',
-  'rdm.review.doc.reject',
-  'rdm.review.doc.final',
-  'rdm.review.doc.status',
+  'rdm.review.assign.doc.batch',
 ] as const
 
 export type CommandListItem = { id?: string; enabled?: boolean } | null | undefined
@@ -79,9 +78,9 @@ export const rdmRolesReady = (cmds: CommandListItem[] | null | undefined) =>
 export const rdmMembersReady = (cmds: CommandListItem[] | null | undefined) =>
   ready(cmds, RDM_MEMBER_COMMANDS)
 
-/** 文档职责/整文审签页是否就绪。 */
-export const rdmDocReviewReady = (cmds: CommandListItem[] | null | undefined) =>
-  ready(cmds, RDM_DOC_REVIEW_COMMANDS)
+/** 文档职责页是否就绪。命令未齐则 fail-closed。 */
+export const rdmDutyReady = (cmds: CommandListItem[] | null | undefined) =>
+  ready(cmds, RDM_DUTY_COMMANDS)
 
 /** 项目权限矩阵页是否就绪。 */
 export const rdmPermMatrixReady = (cmds: CommandListItem[] | null | undefined) =>
@@ -109,7 +108,37 @@ export const memberSetRolePayload = (projectId: string, member: string, role: 'o
 
 export const assignDocDutiesPayload = (
   projectId: string, docId: string, author: string, reviewers: string[], approver: string,
-) => ({ projectId, docId, author, reviewers, approver })
+  extra?: { expectedDutyVersion?: number; confirmInvalidation?: boolean },
+) => ({
+  projectId, docId, author, reviewers, approver,
+  ...(extra?.expectedDutyVersion !== undefined ? { expectedDutyVersion: extra.expectedDutyVersion } : {}),
+  ...(extra?.confirmInvalidation !== undefined ? { confirmInvalidation: extra.confirmInvalidation } : {}),
+})
+
+export const dutyMatrixPayload = (
+  projectId: string,
+  query: {
+    view: 'member' | 'document' | 'matrix'
+    memberOwner?: string
+    docId?: string
+    query?: string
+    stage?: string
+    typeKey?: string
+    assignment?: string
+    memberQuery?: string
+    memberCursor?: string
+    docCursor?: string
+    memberLimit?: number
+    docLimit?: number
+  },
+) => ({ projectId, ...query })
+
+export const dutyPreviewPayload = (
+  projectId: string,
+  docs: { docId: string; author: string; reviewers: string[]; approver: string; expectedDutyVersion: number; confirmInvalidation: boolean }[],
+) => ({ projectId, docs })
+
+export const dutyLegacyPayload = (projectId: string) => ({ projectId })
 
 export const docSubmitPayload = (projectId: string, docId: string) => ({ projectId, docId })
 export const docApprovePayload = (projectId: string, docId: string, note?: string) =>

src/recovery.test.ts

@@ -0,0 +1,54 @@
+import { describe, expect, it } from 'vitest'
+import { recoveryProposalErrorMessage, recoveryProposalHint, recoveryStatusLabel } from './recovery'
+import { humanChangePasswordError, humanRedeemError, requiresCurrentPassword } from './components/LoginPage'
+
+// 账户链路文案与模式判定（2026-10-14 current_required 加固后前后端契约对齐的
+// 防漂移锁）：改密门必须区分 grant_setup / current_required，恢复提案 409 的
+// 两种语义必须分开表达。
+
+describe('requiresCurrentPassword', () => {
+  it('current_required 必须要当前密码，grant_setup 免当前密码', () => {
+    expect(requiresCurrentPassword('current_required')).toBe(true)
+    expect(requiresCurrentPassword('grant_setup')).toBe(false)
+  })
+})
+
+describe('humanChangePasswordError', () => {
+  it('后端 current password incorrect 映射为当前密码不正确', () => {
+    expect(humanChangePasswordError('401: current password incorrect')).toBe('当前密码不正确')
+  })
+})
+
+describe('humanRedeemError', () => {
+  it('401/409/429 语义分离', () => {
+    expect(humanRedeemError('409: login key already used')).toContain('已被使用')
+    expect(humanRedeemError('401: invalid or expired login key')).toContain('无效或已过期')
+    expect(humanRedeemError('429: too many failed attempts')).toContain('稍后再试')
+  })
+})
+
+describe('recoveryStatusLabel', () => {
+  it('覆盖全部五种提案状态', () => {
+    for (const status of ['pending', 'confirmed', 'completed', 'revoked', 'expired'] as const) {
+      expect(recoveryStatusLabel[status]).toBeTruthy()
+    }
+  })
+})
+
+describe('recoveryProposalHint', () => {
+  it('pending/confirmed 给出下一步，终态不给', () => {
+    expect(recoveryProposalHint('pending')).toContain('本人确认')
+    expect(recoveryProposalHint('confirmed')).toContain('新密码')
+    expect(recoveryProposalHint('completed')).toBe('')
+  })
+})
+
+describe('recoveryProposalErrorMessage', () => {
+  it('OWNER_PROOF_UNAVAILABLE 与活动提案冲突分开表达', () => {
+    expect(recoveryProposalErrorMessage('409: OWNER_PROOF_UNAVAILABLE')).toContain('会话证明')
+    expect(recoveryProposalErrorMessage('409: store: conflict')).toContain('已有进行中的恢复提案')
+  })
+  it('未识别错误剥状态码原样透出', () => {
+    expect(recoveryProposalErrorMessage('500: boom')).toBe('boom')
+  })
+})

src/recovery.ts

@@ -0,0 +1,29 @@
+// 恢复提案展示与错误文案（纯函数）：管理端 UsersPanel 与本人 MyAccountSettings
+// 共用，vitest 锁定语义防漂移。后端 409 两种含义按响应体区分：
+// OWNER_PROOF_UNAVAILABLE=无合格会话证明；其余 conflict=已有活动提案。
+import type { RecoveryProposal } from './api'
+
+export const recoveryStatusLabel: Record<RecoveryProposal['status'], string> = {
+  pending: '待本人确认',
+  confirmed: '已确认，待兑换设密',
+  completed: '已完成',
+  revoked: '已撤销',
+  expired: '已过期',
+}
+
+/** 管理端视角的下一步指引：提案成立后动作在属主侧（设置 → 账号）。 */
+export function recoveryProposalHint(status: RecoveryProposal['status']): string {
+  if (status === 'pending') return '等待该用户在「设置 → 账号」由本人确认；确认后一次性 Key 只在其会话内出现'
+  if (status === 'confirmed') return '该用户已确认；请提醒其尽快在受限会话中完成新密码设置，到期未用需重新生成'
+  return ''
+}
+
+export function recoveryProposalErrorMessage(raw: string): string {
+  if (raw.includes('OWNER_PROOF_UNAVAILABLE')) {
+    return '无法发起：该账号没有可用的合格会话证明（需该用户当前在任一设备保持完整密码登录）。历史来源或已锁死账号请走服务器本地处置'
+  }
+  if (raw.includes('409')) return '该用户已有进行中的恢复提案；请先撤销旧提案或等它完成/过期'
+  if (raw.includes('403')) return '需要管理员身份'
+  if (raw.includes('404')) return '用户不存在或已被移除'
+  return raw.replace(/^\d{3}:\s*/, '')
+}

src/store.ts

@@ -11,8 +11,8 @@ import { canFlushOutbox, deriveShellPhase } from './runstate'
 import { flashElement } from './scrollsync'
 import { isThemeChoice, resolveTheme, type ThemeChoice } from './theme'
 import { mergeSurfacesByRevision, surfaceKey } from './surfaceKey'
-import { rdmAuditReady, rdmExportReady } from './workspaces'
-import { rdmRolesReady, rdmMembersReady, rdmDocReviewReady, rdmPermMatrixReady } from './rdmManagement'
+import { cockpitReady, rdmAuditReady, rdmExportReady } from './workspaces'
+import { rdmRolesReady, rdmMembersReady, rdmDutyReady, rdmPermMatrixReady } from './rdmManagement'
 
 type FontSizeChoice = 13 | 14 | 16 | 18
 const FONT_SIZE_CHOICES: readonly FontSizeChoice[] = [13, 14, 16, 18]
@@ -124,6 +124,7 @@ interface AppState {
   serverWorkspaces: { id: string; title: string; icon?: string; shortcut?: string; body?: any[] }[]
   /** 审计入口能力（增量 2）：GET /api/commands 含全部 rdm.inspect.* 且启用；探测失败/未登录为 false，入口隐藏。 */
   rdmAuditAvailable: boolean
+  rdmCockpitAvailable: boolean
   /** 概览导出区：三条 rdm.inspect.export.* 都启用才为 true。不参与七命令就绪门。 */
   rdmExportAvailable: boolean
   /** U6 RDM 管理页能力：命令面齐备才显示对应分区/页签（普通基座零暴露，fail-closed）。 */
@@ -199,6 +200,7 @@ let state: AppState = {
   plan: null, todos: null, artifacts: [], surfaces: [], projectSurfaces: [], cards: [], projectCards: [], cardActionStates: {}, workRecord: null, workReference: null, inboxScope: 'conv', runtimeMock: false, profiles: [], pluginPanels: [],
   serverWorkspaces: [],
   rdmAuditAvailable: false,
+  rdmCockpitAvailable: false,
   rdmExportAvailable: false,
   rdmRolesAvailable: false, rdmMembersAvailable: false, rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false,
   adminSections: [],
@@ -442,7 +444,7 @@ export const store = {
       plan: null, todos: null, artifacts: [], surfaces: [], projectSurfaces: [],
       cards: [], projectCards: [], cardActionStates: {}, workRecord: null, workReference: null, inboxScope: 'conv',
       runtimeMock: false, profiles: [], pluginPanels: [], serverWorkspaces: [], adminSections: [],
-      rdmAuditAvailable: false, rdmExportAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
+      rdmAuditAvailable: false, rdmCockpitAvailable: false, rdmExportAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
       rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false,
       connected: false, posting: false, error: null, toast: null, outbox: [], outboxDraining: false,
       previewTabs: {}, previewActive: {}, previewOpenIntent: 0 })
@@ -1197,15 +1199,16 @@ export const store = {
       if (epoch !== identityEpoch) return
       set({
         rdmAuditAvailable: rdmAuditReady(cmds),
+        rdmCockpitAvailable: cockpitReady(cmds),
         rdmExportAvailable: rdmExportReady(cmds),
         rdmRolesAvailable: rdmRolesReady(cmds),
         rdmMembersAvailable: rdmMembersReady(cmds),
-        rdmDocReviewAvailable: rdmDocReviewReady(cmds),
+        rdmDocReviewAvailable: rdmDutyReady(cmds),
         rdmPermMatrixAvailable: rdmPermMatrixReady(cmds),
       })
     } catch {
       if (epoch !== identityEpoch) return
-      set({ rdmAuditAvailable: false, rdmExportAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
+      set({ rdmAuditAvailable: false, rdmCockpitAvailable: false, rdmExportAvailable: false, rdmRolesAvailable: false, rdmMembersAvailable: false,
         rdmDocReviewAvailable: false, rdmPermMatrixAvailable: false })
     }
     try {

src/styles.css

@@ -644,3 +644,50 @@ button { font-family: inherit; font-size: inherit; color: inherit; }
 .rdm-audit-err { display: flex; flex-direction: column; gap: 8px; }
 .rdm-audit-err-toggle { font-size: var(--fs-ui-caption); color: var(--text-dim); }
 .rdm-audit-err-raw { display: block; font-family: var(--mono); font-size: var(--fs-code); color: var(--text-dim); background: var(--bg-inset); border-radius: var(--radius-sm); padding: 8px 12px; white-space: pre-wrap; word-break: break-all; }
+.duty-matrix-wrap { overflow: auto; }
+.duty-matrix .duty-sticky { position: sticky; left: 0; background: var(--bg-panel); z-index: 1; }
+.duty-matrix thead th { position: sticky; top: 0; background: var(--bg-panel); z-index: 2; }
+.duty-cell select { font-size: var(--fs-ui-sm); color: var(--text); background: var(--bg-raised); border: 1px solid var(--border); border-radius: var(--radius-sm); }
+
+/* ---- 文档驾驶舱（I2；令牌驱动，词汇沿用 rdm-audit 卡片体系） ---- */
+.cockpit { display: flex; flex-direction: column; min-height: 320px; }
+.cockpit-header { display: flex; align-items: center; gap: 10px; padding: 0 0 10px; }
+.cockpit-project { max-width: 220px; height: 32px; font-size: var(--fs-ui-sm); }
+.cockpit-filter-chip, .cockpit-refresh { height: 28px; padding: 0 10px; font-size: var(--fs-ui-sm); border: 1px solid var(--border); border-radius: var(--radius-sm); background: var(--bg-panel); color: var(--text); cursor: pointer; }
+.cockpit-snap { margin-left: auto; font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); }
+.cockpit-banner { border: 1px solid var(--border); border-radius: var(--radius-sm); background: var(--bg-panel); padding: 6px 10px; margin-bottom: 8px; font-size: var(--fs-ui-sm); }
+.cockpit-banner-err { border-color: var(--border); }
+.cockpit-stats { display: grid; grid-template-columns: repeat(auto-fill, minmax(120px, 1fr)); gap: 8px; margin-bottom: 12px; }
+.cockpit-stat { background: var(--bg-panel); border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 8px 10px; text-align: center; font: inherit; }
+button.cockpit-stat { cursor: pointer; }
+.cockpit-stat-active { border-color: var(--text); }
+.cockpit-stat-unavail { color: var(--text-muted, var(--text)); }
+.cockpit-stat-num { display: block; font-size: var(--fs-ui-xl); font-weight: 600; color: var(--text); }
+.cockpit-stat-label { display: block; font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); }
+.cockpit-columns { display: grid; grid-template-columns: minmax(220px, 300px) 1fr; gap: 14px; }
+.cockpit-tree { min-height: 0; overflow-y: auto; }
+.cockpit-tree-row { display: flex; align-items: center; gap: 6px; padding: 3px 4px; border-radius: var(--radius-sm); }
+.cockpit-tree-row-active { background: var(--bg-panel); }
+.cockpit-tree-caret { border: none; background: none; cursor: pointer; padding: 0 2px; font-size: var(--fs-ui-sm); color: var(--text); }
+.cockpit-tree-title { border: none; background: none; padding: 0; cursor: pointer; font-size: var(--fs-ui-sm); color: var(--text); text-align: left; }
+.cockpit-badge { font-size: var(--fs-ui-sm); border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 0 4px; color: var(--text-muted, var(--text)); }
+.cockpit-tree-time { margin-left: auto; font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); }
+.cockpit-tree-empty, .cockpit-tree-more { border: none; background: none; font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); padding: 2px 4px; }
+button.cockpit-tree-more { cursor: pointer; text-decoration: underline; }
+.cockpit-truncated { font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); padding: 4px 0; }
+.cockpit-center { min-height: 0; overflow-y: auto; }
+.cockpit-doclist { display: flex; flex-direction: column; gap: 6px; margin-bottom: 12px; }
+.cockpit-docrow { display: flex; align-items: baseline; gap: 10px; border: 1px solid var(--border); border-radius: var(--radius-sm); background: var(--bg-panel); padding: 8px 10px; cursor: pointer; font: inherit; text-align: left; }
+.cockpit-docrow-title { font-size: var(--fs-ui-base, var(--fs-ui-sm)); color: var(--text); }
+.cockpit-docrow-meta { font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); }
+.cockpit-changes { display: flex; flex-direction: column; gap: 4px; }
+.cockpit-changerow { display: flex; justify-content: space-between; gap: 10px; font-size: var(--fs-ui-sm); }
+.cockpit-changesum { color: var(--text); }
+.cockpit-changetime { color: var(--text-muted, var(--text)); }
+.cockpit-nodehead { display: flex; align-items: baseline; gap: 10px; padding-bottom: 8px; }
+.cockpit-back { border: none; background: none; cursor: pointer; font-size: var(--fs-ui-sm); color: var(--text); padding: 0; text-decoration: underline; }
+.cockpit-nodetitle { font-size: var(--fs-ui-xl); font-weight: 600; color: var(--text); }
+.cockpit-nodesum { font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); }
+.cockpit-childtable { width: 100%; border-collapse: collapse; font-size: var(--fs-ui-sm); }
+.cockpit-childtable th, .cockpit-childtable td { border-bottom: 1px solid var(--border); padding: 4px 6px; text-align: left; color: var(--text); }
+@media (max-width: 760px) { .cockpit-columns { grid-template-columns: 1fr; } .cockpit-tree { max-height: 40vh; } }

src/workspaces.ts

@@ -54,9 +54,27 @@ export function rdmAuditReady(cmds: { id?: string; enabled?: boolean }[] | null
   return RDM_AUDIT_COMMANDS.every(need => cmds.some(c => c?.id === need && c.enabled === true))
 }
 
+/** 文档驾驶舱消费的全部 rdm.cockpit.* 命令（I1 只读面；rollout I2）。 */
+export const COCKPIT_COMMANDS = [
+  'rdm.cockpit.overview',
+  'rdm.cockpit.tree',
+  'rdm.cockpit.node',
+  'rdm.cockpit.node.sources',
+  'rdm.cockpit.node.history',
+  'rdm.cockpit.node.impacts',
+  'rdm.cockpit.node.conflicts',
+] as const
+
+/** 七命令齐备且 enabled 才展示驾驶舱入口（与 rdmAuditReady 同源语义）。 */
+export function cockpitReady(cmds: { id?: string; enabled?: boolean }[] | null | undefined): boolean {
+  if (!Array.isArray(cmds)) return false
+  return COCKPIT_COMMANDS.every(need => cmds.some(c => c?.id === need && c.enabled === true))
+}
+
 const BUILTINS: Omit<WorkspaceEntry, 'shortcut'>[] = [
   { key: 'agents', title: '代理', icon: '🤖' },
   { key: 'rdm-audit', title: '追溯审计', icon: '🔍' },
+  { key: 'rdm-cockpit', title: '文档驾驶舱', icon: '📋' },
 ]
 
 function shortcutNum(raw?: string): number | null {
@@ -70,6 +88,8 @@ function shortcutNum(raw?: string): number | null {
 interface BuildWorkspaceOptions {
   /** rdm.inspect.* 命令面探测通过（store.rdmAuditAvailable）。默认 false：能力未知/缺失不展示审计入口。 */
   rdmAudit?: boolean
+  /** rdm.cockpit.* 命令面探测通过（store.rdmCockpitAvailable）。默认 false：能力未知/缺失不展示驾驶舱入口。 */
+  rdmCockpit?: boolean
 }
 
 export function buildWorkspaceEntries(server: WorkspaceSource[], opts: BuildWorkspaceOptions = {}): WorkspaceEntry[] {
@@ -101,6 +121,7 @@ export function buildWorkspaceEntries(server: WorkspaceSource[], opts: BuildWork
   }
   ranked.push({ rank: takeFree(1), entry: BUILTINS[0] })
   if (opts.rdmAudit === true) ranked.push({ rank: takeFree(2), entry: BUILTINS[1] })
+  if (opts.rdmCockpit === true) ranked.push({ rank: takeFree(3), entry: BUILTINS[2] })
   for (const entry of unranked) ranked.push({ rank: takeFree(9), entry })
   return ranked
     .filter(item => item.rank <= 9)

test/docs-instantiate-params.test.ts

@@ -1,21 +0,0 @@
-import { describe, expect, it } from 'vitest'
-import { docsInstantiateParams } from '../src/components/adminRdmSections'
-
-const tpl = {
-  templateId: 'dhf.2750fbaf1f67d10c', version: '1.0.0', title: '项目建议书',
-  docTypes: ['rd_proposal'], stage: '0. 商务阶段',
-}
-
-describe('docsInstantiateParams', () => {
-  it('carries docType/templateId/version and trims the title', () => {
-    expect(docsInstantiateParams(tpl, '  U5 试点项目建议书 ')).toEqual({
-      docType: 'rd_proposal', templateId: 'dhf.2750fbaf1f67d10c',
-      version: '1.0.0', title: 'U5 试点项目建议书',
-    })
-  })
-  it('omits blank titles so the backend falls back to the template title', () => {
-    const p = docsInstantiateParams(tpl, '   ')
-    expect(Object.hasOwn(p, 'title')).toBe(false)
-    expect(p).toEqual({ docType: 'rd_proposal', templateId: 'dhf.2750fbaf1f67d10c', version: '1.0.0' })
-  })
-})

test/duty-draft.test.ts

@@ -0,0 +1,73 @@
+import { describe, expect, it } from 'vitest'
+import {
+  absorbServerDocs, applyCell, cellDuty, completeness, editCell, replacementNote, saveIssues, savePayload,
+  type DutyDocDraft,
+} from '../src/duties/draft'
+
+function doc(over: Partial<DutyDocDraft> = {}): DutyDocDraft {
+  return {
+    docId: 'd1', title: '需求', code: 'UR-1', typeKey: 'design', stage: 'BD',
+    dutyVersion: 3, activeRound: 0, legacySectionOverrides: 0, dirty: false,
+    author: 'alice', reviewers: ['bob'], approver: 'carol',
+    ...over,
+  }
+}
+
+describe('文档职责草稿', () => {
+  it('单元格由三权反推，三人视图读到同一份角色', () => {
+    const roles = { author: 'alice', reviewers: ['bob', 'dave'], approver: 'carol' }
+    expect(cellDuty(roles, 'alice')).toBe('author')
+    expect(cellDuty(roles, 'bob')).toBe('reviewer')
+    expect(cellDuty(roles, 'dave')).toBe('reviewer')
+    expect(cellDuty(roles, 'carol')).toBe('approver')
+    expect(cellDuty(roles, 'erin')).toBe('none')
+    expect(completeness(roles)).toEqual({ authors: 1, reviewers: 2, approvers: 1, conflicts: 0 })
+  })
+
+  it('替换编制前先记住原编制，并保证一人一责', () => {
+    const next = applyCell({ author: 'alice', reviewers: ['bob'], approver: 'carol' }, 'bob', 'author')
+    expect(next.replacedAuthor).toBe('alice')
+    expect(next.roles).toEqual({ author: 'bob', reviewers: [], approver: 'carol' })
+    expect(replacementNote({ author: 'alice', reviewers: ['bob'], approver: 'carol' }, 'bob', 'author')).toBe('将替换alice')
+  })
+
+  it('清掉唯一编制后允许留在草稿，但禁止保存', () => {
+    const cleared = editCell([doc()], 'd1', 'alice', 'none')
+    expect(cleared[0].author).toBe('')
+    expect(cleared[0].dirty).toBe(true)
+    expect(saveIssues(cleared[0])).toContain('需指定编制人')
+    expect(savePayload(cleared, false).issues.join(' ')).toContain('需指定编制人')
+  })
+
+  it('过期服务端页不覆盖未保存草稿', () => {
+    const dirty = doc({ author: 'erin', dirty: true, dutyVersion: 3 })
+    const absorbed = absorbServerDocs([dirty], [{
+      docId: 'd1', title: '需求', typeKey: 'design', dutyVersion: 4,
+    }], [{ docId: 'd1', owner: 'alice', duty: 'author' }, { docId: 'd1', owner: 'bob', duty: 'reviewer' }, { docId: 'd1', owner: 'carol', duty: 'approver' }])
+    expect(absorbed[0].author).toBe('erin')
+    expect(absorbed[0].dutyVersion).toBe(3)
+  })
+
+  it('写入结果未知时采用服务端版本，不再留着旧草稿重放', () => {
+    const dirty = doc({ author: 'erin', dirty: true, dutyVersion: 3 })
+    const absorbed = absorbServerDocs([dirty], [{
+      docId: 'd1', title: '需求', typeKey: 'design', dutyVersion: 4,
+    }], [
+      { docId: 'd1', owner: 'alice', duty: 'author' },
+      { docId: 'd1', owner: 'bob', duty: 'reviewer' },
+      { docId: 'd1', owner: 'carol', duty: 'approver' },
+    ], true)
+    expect(absorbed[0]).toMatchObject({ author: 'alice', dutyVersion: 4, dirty: false })
+  })
+
+  it('保存载荷是每份脏文档的完整目标，超过 20 份被拒绝', () => {
+    const many = Array.from({ length: 21 }, (_, index) => doc({ docId: `d${index}`, dirty: true }))
+    const blocked = savePayload(many, true)
+    expect(blocked.issues).toContain('一次保存最多 20 份文档')
+    const one = savePayload([doc({ dirty: true, activeRound: 2 })], true)
+    expect(one.docs[0]).toMatchObject({
+      docId: 'd1', author: 'alice', reviewers: ['bob'], approver: 'carol',
+      expectedDutyVersion: 3, confirmInvalidation: true,
+    })
+  })
+})

test/project-access.test.ts

@@ -56,7 +56,8 @@ describe('project command identity', () => {
   it.each(['archived', 'closed'])('preserves canonical member, permission and duty reads for a %s project', async state => {
     const historical = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': state })
     const commands = ['rdm.project.member.list', 'rdm.perm.check', 'rdm.perm.matrix',
-      'rdm.review.doc.status', 'rdm.duty.catalog', 'rdm.duty.get']
+      'rdm.review.doc.status', 'rdm.duty.catalog', 'rdm.duty.get',
+      'rdm.duty.matrix', 'rdm.duty.preview', 'rdm.duty.legacy.scan']
     for (const command of commands) await api.rdmProjectCommand(historical, command, { docId: 'doc-2' })
     expect(requests.map(r => ({ path: r.path, params: JSON.parse(String(r.init?.body)).params }))).toEqual([
       { path: '/api/commands/rdm.project.member.list', params: { projectId: 'domain-7', docId: 'doc-2' } },
@@ -65,13 +66,17 @@ describe('project command identity', () => {
       { path: '/api/commands/rdm.review.doc.status', params: { projectId: 'domain-7', docId: 'doc-2' } },
       { path: '/api/commands/rdm.duty.catalog', params: { projectId: 'domain-7', docId: 'doc-2' } },
       { path: '/api/commands/rdm.duty.get', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.duty.matrix', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.duty.preview', params: { projectId: 'domain-7', docId: 'doc-2' } },
+      { path: '/api/commands/rdm.duty.legacy.scan', params: { projectId: 'domain-7', docId: 'doc-2' } },
     ])
   })
 
   it.each(['archived', 'closed'])('still blocks project and document mutations for a %s project', async state => {
     const historical = project('host-1', { 'rdm.projectId': 'domain-7', 'rdm.state': state })
     for (const command of ['rdm.project.member.add', 'rdm.project.member.remove', 'rdm.project.member.setRole',
-      'rdm.review.assign.doc', 'rdm.review.doc.submit', 'rdm.review.doc.approve', 'rdm.review.doc.reject', 'rdm.review.doc.final']) {
+      'rdm.review.assign.doc', 'rdm.review.assign.doc.batch', 'rdm.duty.legacy.apply',
+      'rdm.review.doc.submit', 'rdm.review.doc.approve', 'rdm.review.doc.reject', 'rdm.review.doc.final']) {
       await expect(api.rdmProjectCommand(historical, command)).rejects.toThrow()
     }
     expect(requests).toEqual([])

test/rdm-management.test.ts

@@ -3,8 +3,8 @@
 //（未登录/请求失败/null）一律视为未就绪（fail-closed），普通基座不出现 RDM 页面。
 import { describe, expect, it } from 'vitest'
 import {
-  RDM_ROLES_COMMANDS, RDM_MEMBER_COMMANDS, RDM_DOC_REVIEW_COMMANDS, ROLE_ACTIONS,
-  rdmRolesReady, rdmMembersReady, rdmDocReviewReady,
+  RDM_ROLES_COMMANDS, RDM_MEMBER_COMMANDS, RDM_DUTY_COMMANDS, ROLE_ACTIONS,
+  rdmRolesReady, rdmMembersReady, rdmDutyReady, dutyMatrixPayload, dutyPreviewPayload,
   roleCreatePayload, roleActionPayload, roleAssignPayload, roleDisablePayload,
   memberAddPayload, memberRemovePayload, assignDocDutiesPayload,
   docSubmitPayload, docApprovePayload, docRejectPayload, docFinalPayload, docStatusPayload,
@@ -19,19 +19,19 @@ describe('RDM 页面能力门控', () => {
   it('命令齐备且 enabled 才就绪', () => {
     expect(rdmRolesReady(all(RDM_ROLES_COMMANDS))).toBe(true)
     expect(rdmMembersReady(all(RDM_MEMBER_COMMANDS))).toBe(true)
-    expect(rdmDocReviewReady(all(RDM_DOC_REVIEW_COMMANDS))).toBe(true)
+    expect(rdmDutyReady(all(RDM_DUTY_COMMANDS))).toBe(true)
   })
   it('缺一命令即未就绪', () => {
     const drop = (ids: readonly string[], skip: string) => ids.filter(i => i !== skip).map(id => cmd(id))
     expect(rdmRolesReady(drop(RDM_ROLES_COMMANDS, 'rdm.role.list'))).toBe(false)
     expect(rdmMembersReady(drop(RDM_MEMBER_COMMANDS, 'rdm.project.member.add'))).toBe(false)
-    expect(rdmDocReviewReady(drop(RDM_DOC_REVIEW_COMMANDS, 'rdm.review.doc.final'))).toBe(false)
+    expect(rdmDutyReady(drop(RDM_DUTY_COMMANDS, 'rdm.duty.matrix'))).toBe(false)
   })
   it('disabled / null / 非数组 / 请求失败均未就绪（fail-closed）', () => {
     expect(rdmRolesReady(RDM_ROLES_COMMANDS.map(id => cmd(id, false)))).toBe(false)
     expect(rdmRolesReady(null)).toBe(false)
     expect(rdmMembersReady(undefined)).toBe(false)
-    expect(rdmDocReviewReady('not-array' as unknown as never)).toBe(false)
+    expect(rdmDutyReady('not-array' as unknown as never)).toBe(false)
   })
 })
 
@@ -68,6 +68,9 @@ describe('命令载荷构造（身份只经认证会话——载荷不含任何
     expect(docFinalPayload('p1', 'd1')).toEqual({ projectId: 'p1', docId: 'd1' })
     expect(docFinalPayload('p1', 'd1', 3)).toEqual({ projectId: 'p1', docId: 'd1', round: 3 })
     expect(docStatusPayload('p1', 'd1')).toEqual({ projectId: 'p1', docId: 'd1' })
+    expect(dutyMatrixPayload('p1', { view: 'matrix', docLimit: 10 })).toEqual({ projectId: 'p1', view: 'matrix', docLimit: 10 })
+    expect(dutyPreviewPayload('p1', [{ docId: 'd1', author: 'alice', reviewers: ['bob'], approver: 'dave', expectedDutyVersion: 2, confirmInvalidation: true }]))
+      .toEqual({ projectId: 'p1', docs: [{ docId: 'd1', author: 'alice', reviewers: ['bob'], approver: 'dave', expectedDutyVersion: 2, confirmInvalidation: true }] })
   })
   it('审阅人 CSV 解析：去空白、去空项、保序去重', () => {
     expect(parseReviewers('bob, carol,,bob')).toEqual(['bob', 'carol'])