Merge branch 'main' into feature/auth-password-management-frontend

Clarify user management flows
Fallback proofless recovery to temporary reset
2026-10-18 10:41:10 +00:00 · 2026-10-17 11:56:33 +00:00 · 2026-10-17 10:43:47 +00:00 · 2026-10-17 10:30:17 +00:00 · 2026-10-17 08:11:43 +00:00 · 2026-10-17 08:03:11 +00:00
30 changed files with 1399 additions and 107 deletions
@@ -0,0 +1,150 @@
+name: governance
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+jobs:
+  governance:
+    runs-on: ubuntu-latest
+    env:
+      GOPROXY: https://goproxy.cn,direct
+    steps:
+      - name: Checkout
+        env:
+          TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          SUBMODULE_TOKEN: ${{ secrets.SUBMODULE_TOKEN }}
+        run: |
+          set -euo pipefail
+          # 只物化两个治理 gitlink（Guidelines 与 deps/development-manager），非递归；
+          # 其它 gitlink 不物化、不取回。凭据只以 URL 限定的 extraheader 存在于本进程树内。
+          python3 - <<'PY_CHECKOUT'
+          import os
+          from pathlib import Path
+          import re
+          import subprocess
+          import sys
+          from urllib.parse import urlsplit
+
+          # 服务端基址取运行器注入的 GITHUB_SERVER_URL（平台控制、候选 PR 不可影响）。
+          SERVER = os.environ.get("GITHUB_SERVER_URL", "").rstrip("/")
+          parsed_server = urlsplit(SERVER)
+          if parsed_server.scheme not in {"http", "https"} or not parsed_server.netloc:
+              sys.exit("Checkout server must be the platform-injected http(s) URL")
+          SSH = "ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/"
+          # 审查过的白名单，独立于候选 .gitmodules：仅列出两个治理 gitlink。
+          REPOSITORIES = {
+              "deps/development-guidelines": "Development-Guidelines",
+              "deps/development-manager": "Development-Manager",
+          }
+          TARGET = "weichen/Agent-System-Frontend"
+          root_token = os.environ.pop("TOKEN", "")
+          component_token = os.environ.pop("SUBMODULE_TOKEN", "")
+          if not root_token or not component_token:
+              sys.exit("Checkout requires TOKEN and SUBMODULE_TOKEN")
+          if os.environ.get("GITHUB_REPOSITORY") != TARGET:
+              sys.exit("Checkout repository is outside the reviewed allowlist")
+          sha = os.environ.get("GITHUB_SHA", "")
+          if not re.fullmatch(r"[0-9a-fA-F]{40}", sha):
+              sys.exit("Checkout requires a fixed commit SHA")
+
+          # 丢弃继承的 Git 追踪/配置/SSH 钩子；凭据只存在于单个 Git 进程树的精确 URL 头中。
+          clean_env = {k: v for k, v in os.environ.items() if not k.startswith("GIT_")}
+          clean_env.update(GIT_CONFIG_NOSYSTEM="1", GIT_CONFIG_SYSTEM="/dev/null",
+                           GIT_CONFIG_GLOBAL="/dev/null", GIT_TERMINAL_PROMPT="0")
+          config = {
+              "core.hooksPath": "/dev/null", "core.fsmonitor": "false",
+              "init.templateDir": "", "credential.helper": "",
+              "fetch.recurseSubmodules": "false", "submodule.recurse": "false",
+              "http.followRedirects": "false", "protocol.allow": "never",
+              "protocol." + urlsplit(SERVER).scheme + ".allow": "always",
+          }
+
+
+          def git(repo, *args, extra=None):
+              values = config | (extra or {})
+              env = clean_env | {"GIT_CONFIG_COUNT": str(len(values))}
+              for index, (key, value) in enumerate(values.items()):
+                  env[f"GIT_CONFIG_KEY_{index}"] = key
+                  env[f"GIT_CONFIG_VALUE_{index}"] = value
+              return subprocess.run(["git", "-C", str(repo), *args], env=env,
+                                    check=True, stdout=subprocess.PIPE).stdout
+
+
+          def materialize_governance(root):
+              # -r 列出任意深度的 gitlink，但不进入 submodule 内部；其它 gitlink 只记录、从不取回。
+              links = {}
+              for entry in git(root, "ls-tree", "-rz", "HEAD").split(b"\0"):
+                  if not entry:
+                      continue
+                  metadata, path = entry.split(b"\t", 1)
+                  mode, kind, commit = metadata.decode().split()
+                  if mode == "160000":
+                      links[path.decode()] = commit
+              for name in REPOSITORIES:
+                  if name not in links:
+                      raise ValueError("Governance gitlink is missing from the fixed commit")
+              raw = git(root, "config", "--no-includes", "--blob", "HEAD:.gitmodules", "--null", "--list")
+              entries = {}
+              for item in raw.split(b"\0"):
+                  if not item:
+                      continue
+                  key, value = item.decode().split("\n", 1)
+                  match = re.fullmatch(r"submodule\.(.+)\.(path|url)", key)
+                  if not match:
+                      continue
+                  name, field = match.groups()
+                  if name not in REPOSITORIES:
+                      continue
+                  if field in entries.setdefault(name, {}):
+                      raise ValueError("Duplicate candidate .gitmodules setting")
+                  entries[name][field] = value
+              # 先整体校验两个治理条目，再进行任何带凭据的取回。
+              for name, repository in REPOSITORIES.items():
+                  fields = entries.get(name, {})
+                  if fields.get("path") != name:
+                      raise ValueError("Governance submodule path is outside the reviewed allowlist")
+                  trusted_url = f"{SERVER}/weichen/{repository}.git"
+                  if fields.get("url") not in {SSH + repository + ".git", trusted_url}:
+                      raise ValueError("Governance submodule URL is outside the reviewed allowlist")
+              for name, repository in REPOSITORIES.items():
+                  url = f"{SERVER}/weichen/{repository}.git"
+                  # 仅持久化审查过的公开 URL，使 Git 在进程级配置消失后仍识别该 submodule。
+                  git(root, "config", f"submodule.{name}.url", url)
+                  git(root, "submodule", "update", "--init", "--checkout", "--", name,
+                      extra={f"submodule.{name}.url": url,
+                             f"submodule.{name}.update": "checkout",
+                             f"http.{url}.extraheader": "AUTHORIZATION: token " + component_token})
+                  child = root / name
+                  if git(child, "rev-parse", "HEAD").decode().strip() != links[name]:
+                      raise ValueError("Materialized governance gitlink does not match the fixed SHA")
+
+
+          try:
+              root = Path.cwd()
+              # 必须是干净的临时工作区；不复用既有 Git 状态。
+              if (root / ".git").exists():
+                  raise ValueError("Checkout requires a fresh workspace")
+              git(root, "init", "-q")
+              url = f"{SERVER}/{TARGET}.git"
+              git(root, "remote", "add", "origin", url)
+              git(root, "fetch", "--depth=1", "origin", sha,
+                  extra={f"http.{url}.extraheader": "AUTHORIZATION: token " + root_token})
+              git(root, "checkout", "-q", "--detach", "FETCH_HEAD")
+              materialize_governance(root)
+          except (ValueError, OSError, subprocess.CalledProcessError) as error:
+              sys.exit(f"Checkout refused: {error}")
+          print("Checkout complete; credentials were not persisted in Git configuration")
+          PY_CHECKOUT
+          unset TOKEN SUBMODULE_TOKEN
+      - name: Install Go 1.27.1
+        run: |
+          set -euo pipefail
+          curl -fsSL -o "$RUNNER_TEMP/go.tgz" https://mirrors.aliyun.com/golang/go1.27.1.linux-amd64.tar.gz
+          tar -C /usr/local -xzf "$RUNNER_TEMP/go.tgz"
+          ln -sfn /usr/local/go/bin/go /usr/local/bin/go
+          ln -sfn /usr/local/go/bin/gofmt /usr/local/bin/gofmt
+      - name: Validate agent execution configuration
+        run: scripts/agent-exec validate --repo .
+      - name: Governance check
+        run: scripts/dm governance check --repo .
@@ -0,0 +1,6 @@
+[submodule "deps/development-guidelines"]
+	path = deps/development-guidelines
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Guidelines.git
+[submodule "deps/development-manager"]
+	path = deps/development-manager
+	url = ssh://git@git-ssh.u1680832.nyat.app:31411/weichen/Development-Manager.git
@@ -0,0 +1,47 @@
+# Agent-System-Frontend 采纳 development-governance-v2 治理套件 任务卡
+
+任务主记录：本文件随 PR 描述维护（PR 链接见下方"结果与验证"）。
+状态：进行中；owner：weichen。
+
+## 基线与授权
+
+- 权威仓：weichen/Agent-System-Frontend；root_target：main；immediate_target：main
+- branch_kind：initiative；initiative_id：governance-adoption-Agent-System-Frontend
+- R0（initial_main_sha）：8b59998d3c5b0545f3bb0b3e670b22aa7fe2179b；工作区：/home/weichen/projects/Agent-System-Frontend-wt-feature-governance-adoption（worktree）；分支：feature/governance-adoption
+- 父任务信息（仅子任务填写）：无
+- accepting_requirements：false（单仓采纳 initiative，范围固定为下列十步，不接收新需求）
+- 需求分流：verdict=NEW；selected_initiative=无；候选=无；理由=development-governance-v2 Phase 6 每个正式仓库独立 initiative；triage 收据=无（本仓采纳前尚无 triage 入口）
+- 授权与交付终点：owner 已授权 development-governance-v2 全部实施（Agent-System-Dev 主记录 docs/superpowers/plans/2026-10-16-development-governance-v2-master.md）；终点为本 PR 合入 main 且采纳状态 active。分支保护与 tag 由用户执行。
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+目标（Phase 6 十步）：固定 Guidelines SHA（deps/development-guidelines @ 2688fd2be6a52c0bf110e7e6366b6f291ab5e4eb）；增加 AGENT-EXECUTION.md；增加共享执行器薄入口（deps/development-manager @ bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c + scripts/dm、scripts/agent-exec、scripts/task）；四条路由（implementation/repair/test/review）；任务卡模板与分支元数据；CI 中启用 schema 校验（.gitea/workflows/governance.yml：agent-exec validate + governance check）；一次正例运行；负例（缺配置、坏收据、越界路径、未知副作用）；独立 Review + CI；采纳状态 active。
+
+非目标：不改业务代码与既有测试；不改分支保护（由用户执行）；不发布 tag。
+
+引导说明：AGENT-EXECUTION.md 由 host 以固定版本治理套件（dm-server governance init @ bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c）生成并作为引导配置提交（执行器运行前必须存在有效配置；沿用 DM 采纳先例）；其余文件由实施单元生成。
+
+## Agent 实施收据
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| governance-adoption-Agent-System-Frontend-r1 | 13 个允许路径（治理文件 + 两个 gitlink） | 5670c68e | implementation | cursor→antigravity→pi | run e3fd063d（dm-server pinned，attempts=1） | cursor / not-observable | success | d64dbc3a15d2（apply 快进） | 否 | /tmp/gov-receipt-Agent-System-Frontend-r1.json |
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | 8b59998d3c5b0545f3bb0b3e670b22aa7fe2179b | 8b59998d3c5b0545f3bb0b3e670b22aa7fe2179b | 2026-10-17T06:53:57Z | 一致 |
+
+## 结果与验证（完成后填写）
+
+- 结果：NOT_RUN
+- 验证：见下表（命令输出由 /tmp/gov-neg/ev.sh 写入 .task/evidence/governance-adoption/，SELF 除非另注）。
+- 影响与剩余项：NOT_RUN
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| 20261017T071544Z | `scripts/dm governance check --repo .` | d64dbc3a15d2 | 0 | SELF | ok fixtures；[输出](evidence/governance-adoption/00-20261017T071544Z.log) sha256:b4f09e161961151b |
+| 20261017T071544Z | `scripts/agent-exec validate --repo .` | d64dbc3a15d2 | 0 | SELF | validate: ok；[输出](evidence/governance-adoption/01-20261017T071544Z.log) sha256:06f07c50e89b4bbf |
+| 20261017T071544Z | `python3 /tmp/gov-neg/adopt_cases.py .` | d64dbc3a15d2 | 0 | SELF | [verdict] ALL PASS cases=5；[输出](evidence/governance-adoption/02-20261017T071544Z.log) sha256:f74ae904b59d73e4 |
@@ -0,0 +1,19 @@
+command: scripts/dm governance check --repo . 
+cwd: /home/weichen/projects/Agent-System-Frontend-wt-feature-governance-adoption
+head: d64dbc3a15d29520402f0c97199cb88b3e4aa9af
+exit: 0
+utc: 20261017T071544Z
+---
+ok gitlink deps/development-guidelines
+ok gitlink deps/development-manager
+ok agent-execution
+ok file AGENTS.md
+ok file PROJECT.md
+ok file policy/guidelines-adoption.md
+ok file .task/templates/task-card.md
+ok executable scripts/agent-exec
+ok executable scripts/hooks/pre-commit
+ok executable scripts/dm
+ok executable scripts/task
+ok adoption status
+ok fixtures
@@ -0,0 +1,7 @@
+command: scripts/agent-exec validate --repo . 
+cwd: /home/weichen/projects/Agent-System-Frontend-wt-feature-governance-adoption
+head: d64dbc3a15d29520402f0c97199cb88b3e4aa9af
+exit: 0
+utc: 20261017T071544Z
+---
+validate: ok
@@ -0,0 +1,13 @@
+command: python3 /tmp/gov-neg/adopt_cases.py . 
+cwd: /home/weichen/projects/Agent-System-Frontend-wt-feature-governance-adoption
+head: d64dbc3a15d29520402f0c97199cb88b3e4aa9af
+exit: 0
+utc: 20261017T071544Z
+---
+[object] Agent-System-Frontend-wt-feature-governance-adoption HEAD=d64dbc3a15d29520402f0c97199cb88b3e4aa9af
+PASS positive-run-apply: run exit=0 terminal=success apply exit=0 head=6fa967fff457
+PASS missing-config: run exit=2 terminal=invalid-config validate exit=2
+PASS bad-receipt: apply exit=4 head_unchanged=True msg=apply: no local integrity record: changed paths do not match the transport diff
+PASS out-of-scope-path: run exit=5 terminal=scope-expansion transport=False
+PASS unknown-side-effect: run exit=4 terminal=failed-unknown transport=False
+[verdict] ALL PASS cases=5
@@ -0,0 +1,66 @@
+# <任务标题> 任务卡
+
+任务主记录：<Issue/PR 链接，或注明"本文件随 PR 描述维护">。
+状态：<进行中 / 待审核 / 已合入 / 已放弃>；owner：<填写>。
+
+## 基线与授权
+
+- 权威仓：<仓 URL 或逻辑 ID>；root_target：main；immediate_target：<main 或 feature/initiative>
+- branch_kind：<initiative | child | standalone>；initiative_id：<稳定 ID，普通任务为空>
+- R0（initial_main_sha）：<完整 SHA>；工作区：<路径>（worktree / clone）；分支：<feature|fix|hotfix/...>
+- 父任务信息（仅子任务填写）：parent_branch=<父分支>；parent_head_sha=<SHA>；parent_pr=<父 PR>
+- accepting_requirements：<true | false>（仅 initiative 可为 true；冻结后为 false）
+- 需求分流：verdict=<JOIN | NEW>；selected_initiative=<分支或无>；候选=<分支@HEAD 列表或无>；理由=<不适配/适配依据>；triage 收据=<源码外路径与摘要>
+- 授权与交付终点：<本次允许的动作与终点；未授权事项写明>
+- 实施执行：agent-per-unit（配置：AGENT-EXECUTION.md；外部 Agent 一单元一新进程/会话/工作区）
+
+## 目标与非目标
+
+<预期结果、受影响入口/模块/契约；明确不做什么。>
+
+## Agent 实施收据
+
+按根目录 AGENT-EXECUTION.md 路由；外部 Agent 一单元一新进程/会话/隔离工作区。实施、修复与测试必须通过登记的候选执行；未配置或候选安全耗尽停在 unavailable/blocked，禁止 host 隐式代写。
+
+| 单元 ID | 预期范围 | 角色 | 候选顺序 | attempt | CLI/模型 | 终态 | transport | fallback | 源码外收据路径 |
+|---|---|---|---|---|---|---|---|---|---|
+| 待定义 | — | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | NOT_RUN | — |
+
+## 复用材料（task-start 自动检索结果摘录）
+
+- 相关近期提交：<git log -- <paths> 命中；无则写无>。
+- 相关经验条目：<检索命中；无则写无>。
+
+## 同步记录
+
+| 节点 | sync_base_sha | tested_head_sha | checked_at | 结果 |
+|---|---|---|---|---|
+| 启动 | <R0> | <HEAD> | <日期时间> | <一致/已同步> |
+| 验收前 | <填写> | <填写> | <填写> | <填写> |
+
+字段没有发生的写"无"，不省略。本卡与 PR 描述同源：开 PR 时将"目标与非目标、结果与验证、影响与剩余项"复制进 PR 描述，不另写第二份。
+
+## 交付调度（有多个就绪任务时）
+
+- 调度记录 / entry_id / 当前 attempt_id：<平台或调度服务链接及标识；未入队写无>。
+- 入队源 HEAD / owner / 依赖：<完整 SHA、身份、依赖或无>。
+- 固定候选引用：<调度尝试中的 base/head、组件与配置；未固定写无>。
+- 窗口、最终 CI、Review 与真实合入结果：<引用调度记录及原始证据，不复制全队列>。
+
+定义见 [合入调度与 CI 分配](../standards/merge-queue.md)。本段在候选固定前整理；固定后先使用源码之外的记录保存运行结果，再按项目闭合流程回填。
+
+## 结果与验证（完成后填写）
+
+- 结果：<交付了什么；未发生写无>。
+- 验证：<结论性摘要：PASS/FAIL/SKIP/NOT_RUN 逐项；逐条证据见下表，来源标注与写入规则见 [按影响选择验证与证据](../standards/verification.md)>。
+- 影响与剩余项：<影响面、遗留风险、后续任务>。
+
+| 时间(UTC) | 命令 | 被测 HEAD | exit | 来源 | 摘要/位置 |
+|---|---|---|---|---|---|
+| <时间> | <命令；由项目 evidence 工具写入，无工具时附命令+对象 SHA+输出 digest 并标 SELF> | <HEAD> | <exit> | GATE/REPLAY/SELF | <摘要/位置> |
+
+## 回收（task-finish）
+
+- 合入核对：<分支已包含于目标分支的核对输出>。
+- 未跟踪/ignored 文件处置：<归档/可再生/存疑 逐项；无则写无>。
+- 回收动作：<worktree remove、分支删除、prune；放弃路径注明原因>。
@@ -0,0 +1,67 @@
+# Project Agent Execution Configuration
+# 项目工程 Agent 执行路由配置
+
+适用范围：定义本项目中由 AI / Agent 主导的代码实施、修复、测试与审阅所调用的 Agent CLI 路由。
+解析器识别正文中唯一一个 ```agent-execution 代码块。正文外的说明文字可根据项目需要调整。
+
+通用硬规则见 Development-Guidelines 的 [Agent 执行与协作契约](deps/development-guidelines/standards/agent-execution.md)。
+本配置为项目本地路由权威，声明具体的候选 profile、尝试次数上限、超时、集成入口与豁免路径；
+代码块须通过 `deps/development-guidelines/templates/schemas/agent-execution.schema.json` 校验后才能登记为 active。
+`fallback_to_host` 只能为 `never`；旧值 `all-unavailable` 仅供迁移工具读取，不能通过准入。
+下例的 CLI 名称、命令与路径均为占位，按项目实际执行器替换。
+
+```agent-execution
+schema: agent-execution/v1
+
+execution:
+  fresh_process_per_unit: true
+  permission: run-everything
+  fallback_to_host: never
+  max_parallel: 3
+  timeout_seconds: 7200
+  idle_timeout_seconds: 600
+  summary_bytes: 16384
+  raw_output_bytes: 10485760
+  max_attempts_per_profile: 3
+  emergency_profile: codex
+
+roles:
+  implementation: [cursor, antigravity, pi]
+  repair: [cursor, antigravity, pi]
+  test: [pi, antigravity, cursor]
+  review: [pi, antigravity, cursor, codex]
+
+profiles:
+  cursor:
+    adapter: cursor
+    executable: "cursor-agent-stable"
+    model: auto
+    enabled: true
+
+  antigravity:
+    adapter: antigravity
+    executable: agy
+    model: auto
+    enabled: true
+
+  pi:
+    adapter: pi
+    executable: pi
+    model: auto
+    enabled: true
+
+  codex:
+    adapter: codex
+    executable: codex
+    model: auto
+    enabled: true
+
+integration:
+  exempt_paths: [".task/**", "docs/superpowers/specs/**", "docs/superpowers/plans/**"]
+  transport:
+    command: "scripts/agent-exec apply"
+  admission:
+    command: "scripts/agent-exec admit"
+  cleanup:
+    command: "scripts/agent-exec cleanup"
+```
@@ -35,3 +35,21 @@
 - **SSH key**：`~/.ssh/home_gitea`（ED25519，公钥指纹
  `SHA256:GYXaOXIMeloQ1fKSfdJ/ndgPQzs/Ix7Hk62ekfkfQ20`，Gitea 侧密钥名 GMKtec）；
  `~/.ssh/config` 已有 `git-ssh.u1680832.nyat.app` 主机条目，克隆/推送直接可用。
+
+## Agent 执行与新项目准入（强制）
+
+1. 缺 Guidelines 固定版本（`deps/development-guidelines` gitlink 未就绪或 HEAD 不符）时，Agent 只能只读分析，不得实施。
+2. 缺有效 `AGENT-EXECUTION.md`（`scripts/dm governance check` 未通过）时禁止 AI 实施。
+3. 缺共享执行器（`scripts/agent-exec` 或 `deps/development-manager` 不可用）时，状态为 `blocked/unavailable`，不得改由 host 替代。
+4. 不允许 host 代写实施单元；实施、修复与测试必须经 `AGENT-EXECUTION.md` 登记的候选执行。
+5. 人类直接开发按其自身授权与项目规则进行，不受本条款约束。
+6. 分支保护与规范 tag 由用户负责设置与维护，Agent 不得代为设置。
+
+入口：
+
+- 需求分流：`scripts/task triage discover|decide|verify`
+- 任务启动：`scripts/task start …`
+- PR 检查：`scripts/task pr-check …`
+- Agent 执行：`scripts/agent-exec run|apply|admit|validate`
+
+AI 实施单元仅通过 `scripts/agent-exec run` 运行（依据 AGENT-EXECUTION.md），并经 `scripts/agent-exec apply` 集成。
@@ -10,4 +10,5 @@
 - `npx tsc -b` — 类型检查；`npm run build` — 产物 dist/（Dev Makefile 拷贝至 backend web/dist 内嵌）。
 - `npm test` — vitest：契约形状测试（Core 黄金样本驱动的判别联合/事件信封/HITL impact/工具三清单断言）。
 - 开发：`npm run dev`（Vite 代理 /api → 127.0.0.1:8787）。
+- 治理：`scripts/agent-exec validate --repo .` — 校验 AGENT-EXECUTION.md 执行路由配置；`scripts/dm governance check --repo .` — 校验治理套件（Guidelines 固定版本、采纳记录与执行配置）。
 - 依赖刻意最小：react + marked + dompurify（模型输出与文档预览先清洗再写入页面）；无 UI 框架（设计令牌手写，见 styles.css）。
@@ -66,10 +66,8 @@ test('管理员建号：UI 请求新契约并给出待初始化提示', async ({
  const body = await createBody
  expect(body).toEqual({ owner: newOwner, profile: { name: '组合验收' } })

-  // 契约断言二：成功提示逐字含「待初始化」与 CLI 发放指引。
-  await expect(page.locator('.ad-notice')).toHaveText(
-    `已创建 ${newOwner}（待初始化）：请在服务器执行 user initialize-account 发放激活 Key`,
-  )
+  // 契约断言二：页面创建后账号可直接使用，不再提示 CLI 初始化。
+  await expect(page.locator('.ad-notice')).toContainText(`已创建 ${newOwner}`)

  // 契约断言三：用户表出现该账号，状态为未设密码（HTTP 建号不能设密码/授权限）。
  const row = page.locator('.ad-table tbody tr', { hasText: newOwner })
@@ -78,6 +76,6 @@ test('管理员建号：UI 请求新契约并给出待初始化提示', async ({
  await expect(row).not.toContainText('ADMIN')

  // 界面说明与后端流程一致（激活 Key 由服务器本地 CLI 发放）。
-  await expect(page.locator('.ad-create .ad-hint')).toContainText('待初始化')
-  await expect(page.locator('.ad-create .ad-hint')).toContainText('user initialize-account')
+  await expect(page.locator('.ad-create .ad-hint')).toContainText('初始密码')
+  await expect(page.locator('.ad-create .ad-hint')).not.toContainText('user initialize-account')
 })
@@ -1,7 +1,5 @@
-// 登录恢复流程真实浏览器验收（2026-10-13 合同，docs/svc-deploy/
-// 2026-10-13-login-recovery-contract.md）：管理员签发一次性登录 Key →
-// 用户在登录页只输 Key 兑换 → 受限设密门（无当前密码框）→ 设密成功回登录页 →
-// 新密码登录进工作台；重复兑换同一 Key 被拒。
+// 管理员随机临时密码与登录入口回归：管理员重置 → 用户密码登录 → 强制改密；
+// 登录页不再提供一次性 Key 登录 tab。Key 的分发/管理 API 与非登录页流程保留。
 // 驱动：任意 auth-on 实例（PLAYWRIGHT_BASE_URL + E2E_PLAIN_BASE；
 // scripts/e2e.sh 第 4 阶段顺路覆盖，或对隔离实例直连——见 Dev 任务卡
 // feature/svc-login-recovery-flow 的真实浏览器验收记录）。
@@ -53,23 +51,21 @@ async function adminLogin(page: Page) {
  await expect(page.locator('.tsb-tool', { hasText: '代理' })).toBeVisible({ timeout: 15_000 })
 }

-test('登录恢复全流程：签发 → 兑换 → 免旧密码设密 → 新密码登录；重复兑换被拒', async ({ page }) => {
+test('管理员随机重置：临时密码登录后强制改密；登录页不提供 Key 登录', async ({ page }) => {
  // 全流程含多次 argon2 登录与两道门，30s 默认预算不够。
  test.setTimeout(120_000)
-  // 1) 管理员进入用户管理，为目标用户生成一次性登录 Key（明文仅显示一次）。
+  // 1) 管理员进入用户管理，为目标用户生成随机临时密码（明文仅显示一次）。
  await adminLogin(page)
  await page.locator('.tsb-user').click()
  await page.getByRole('button', { name: '系统管理…' }).click()
  const zone = page.getByRole('dialog', { name: '系统管理' })
  await expect(zone).toBeVisible()
-  // 每个用户行都有同款按钮：限定目标用户所在行。
-  await zone.locator('tr', { hasText: USER }).getByRole('button', { name: '生成登录 Key' }).click()
-  await zone.getByRole('button', { name: '生成 Key', exact: true }).click()
-  const keyInput = zone.locator('input[aria-label="一次性登录 Key（仅显示一次）"]')
-  await expect(keyInput).toBeVisible({ timeout: 10_000 })
-  const key = await keyInput.inputValue()
-  expect(key).toMatch(/^alk_/)
-  await expect(zone.getByText(/单次有效/)).toBeVisible()
+  const row = zone.locator('tr', { hasText: USER })
+  await row.getByRole('button', { name: '重置临时密码' }).click()
+  const temporaryPassword = zone.locator('input[aria-label="一次性密码"]')
+  await expect(temporaryPassword).toBeVisible({ timeout: 10_000 })
+  const password = await temporaryPassword.inputValue()
+  expect(password.length).toBeGreaterThan(0)

  // 2) 管理员退出系统管理与登录态，回到登录页。
  //（Key 面板内也有「关闭」；退出全屏层要点头部的「返回工作台」。）
@@ -78,35 +74,30 @@ test('登录恢复全流程：签发 → 兑换 → 免旧密码设密 → 新
  await page.getByRole('button', { name: '退出登录' }).click()
  await expect(page.getByRole('button', { name: '登录', exact: true })).toBeVisible({ timeout: 10_000 })

-  // 3) 用户只输 Key 兑换；身份由服务端绑定确定（页面不出现用户名输入框）。
-  await page.getByRole('tab', { name: '一次性登录 Key' }).click()
-  await page.getByPlaceholder('alk_…').fill(key)
-  await page.getByRole('button', { name: '兑换并设置新密码' }).click()
-
-  // 4) 受限设密门：服务端确认用户名；无当前密码输入框。
+  // 3) 用户使用临时密码登录后进入强制改密门。
+  await passwordLogin(page, USER, password)
  const gate = page.locator('.lg-card')
-  await expect(gate.getByText(`账号 ${USER}（服务端确认）`)).toBeVisible({ timeout: 10_000 })
-  await expect(gate.locator('input[autocomplete="current-password"]')).toHaveCount(0)
+  await expect(gate.getByText(`账号 ${USER}`)).toBeVisible({ timeout: 10_000 })
+  await expect(gate.locator('input[autocomplete="current-password"]')).toHaveCount(1)
  const pw = gate.locator('input[type="password"]')
-  await pw.nth(0).fill(USER_PW)
+  await pw.nth(0).fill(password)
  await pw.nth(1).fill(USER_PW)
+  await pw.nth(2).fill(USER_PW)
  await gate.getByRole('button', { name: '设置新密码', exact: true }).click()

-  // 5) 成功页：提示用新密码登录，唯一出口回登录页。
+  // 4) 成功页：提示用新密码登录，唯一出口回登录页。
  await expect(page.getByRole('heading', { name: '密码已更新' })).toBeVisible({ timeout: 10_000 })
  await page.getByRole('button', { name: '返回登录', exact: true }).click()
  await expect(page.getByRole('button', { name: '登录', exact: true })).toBeVisible()

-  // 6) 新密码登录进工作台（旧初始密码已不可用一并验证）。
+  // 5) 新密码登录进工作台。
  await passwordLogin(page, USER, USER_PW)
  await expect(page.locator('.tsb-tool', { hasText: '代理' })).toBeVisible({ timeout: 15_000 })

-  // 7) 同一 Key 重复兑换被拒，错误文案指向管理员重签。
+  // 6) 登录页不再提供一次性 Key 登录入口。
  await page.locator('.tsb-user').click()
  await page.getByRole('button', { name: '退出登录' }).click()
  await expect(page.getByRole('button', { name: '登录', exact: true })).toBeVisible({ timeout: 10_000 })
-  await page.getByRole('tab', { name: '一次性登录 Key' }).click()
-  await page.getByPlaceholder('alk_…').fill(key)
-  await page.getByRole('button', { name: '兑换并设置新密码' }).click()
-  await expect(page.getByText('该 Key 已被使用过，请联系管理员重新签发')).toBeVisible({ timeout: 10_000 })
+  await expect(page.getByRole('tab', { name: '一次性登录 Key' })).toHaveCount(0)
+  await expect(page.getByPlaceholder('alk_…')).toHaveCount(0)
 })
@@ -0,0 +1,182 @@
+// I4 组合验收（Playwright）：文档驾驶舱七场景（rollout §3.I4 最小场景集）。
+// 驱动方：Dev 仓 scripts/e2e.sh——构建 RDM 二进制（含 I1/I3 命令面）+ frontend dist，
+// 种子：审计演示项目（rdm-self + cockpit-e2e 结构装载；两个章节经草稿流落正文；
+// 一个章节留空；第二个账号 e2e-reader 不入项目做权限负例）。
+// 环境契约与 rdm-audit.playwright.ts 一致；PLAYWRIGHT_BASE_URL 未设置时整组跳过。
+import { test, expect, type Page } from '@playwright/test'
+
+const OWNER = process.env.E2E_OWNER || 'e2e-auditor'
+const PASSWORD = process.env.E2E_PASSWORD2 || 'E2eAudit#2026b'
+const READER = process.env.E2E_READER || 'e2e-reader'
+const READER_PASSWORD = process.env.E2E_READER_PASSWORD || 'E2eReader#2026'
+const MAIN = process.env.E2E_PROJECT_MAIN || '审计演示项目'
+
+test.skip(!process.env.PLAYWRIGHT_BASE_URL, 'set PLAYWRIGHT_BASE_URL (scripts/e2e.sh drives this suite)')
+
+async function login(page: Page, user: string, password: string) {
+  await page.goto('/')
+  await expect(page.getByPlaceholder('由管理员分配')).toBeVisible()
+  await page.getByPlaceholder('由管理员分配').fill(user)
+  await page.getByPlaceholder('初始密码或常用密码').fill(password)
+  await page.getByRole('button', { name: '登录', exact: true }).click()
+}
+
+// 侧栏入口两种形态：常规侧栏按钮（.tsb-tool）；窄宽紧凑布局换图标栏
+// （.icon-only 内 title 以「文档驾驶舱」开头的按钮）——入口都可达。
+function cockpitEntry(page: Page) {
+  return page.locator('.tsb-tool', { hasText: '文档驾驶舱' })
+    .or(page.locator('.icon-only button[title^="文档驾驶舱"]')).first()
+}
+
+async function loginOwner(page: Page) {
+    await login(page, OWNER, PASSWORD)
+    // 登录后身份纪元与能力探针仍可能各跳一次；应用在身份变更时会关闭已开
+    // 工作区——等落定再点入口，避免 overlay 被身份刷新关掉（竞态实测）。
+    await page.waitForLoadState('networkidle').catch(() => {})
+    await page.waitForTimeout(1_500)
+  }
+
+async function openCockpit(page: Page) {
+  // 窄宽是单窗格布局：登录后默认「对话」窗格，先切到「上下文」窗格。
+  if (!(await cockpitEntry(page).isVisible().catch(() => false))) {
+    await page.getByRole('button', { name: '打开上下文' }).click()
+  }
+  await cockpitEntry(page).click()
+  await expect(page.locator('.cockpit-project')).toBeVisible({ timeout: 15_000 })
+  // 默认选中首个项目（种子=审计演示项目）。
+  await expect(page.locator('.cockpit-stats')).toBeVisible({ timeout: 15_000 })
+}
+
+async function openReaderOnDoc(page: Page, title: string) {
+  await page.locator('.cockpit-tree-title', { hasText: title }).first().click()
+  await page.getByRole('button', { name: '在阅读器中打开' }).click()
+  await expect(page.locator('.cockpit-reader')).toBeVisible()
+}
+
+test.describe.serial('I4 文档驾驶舱组合验收', () => {
+  // 场景 1：首次进入项目——统计带、结构树、全景可见（DV-R01/R02）。
+  test('1 首屏：统计、树、全景可见且统计可判读', async ({ page }) => {
+    await loginOwner(page)
+    await openCockpit(page)
+    // placeholder
+    await expect(page.locator('.cockpit-stat', { hasText: '完成度' })).toBeVisible()
+    await expect(page.locator('.cockpit-stat', { hasText: '文档' })).toBeVisible()
+    // 空 vs 不可算不得互相冒充：有数据项目的空缺计数显示数字。
+    await expect(page.locator('.cockpit-stat', { hasText: '空缺节点' }).locator('.cockpit-stat-num')).toHaveText(/^\d+$/)
+    await expect(page.locator('.cockpit-tree-title', { hasText: '验证主体报告' }).first()).toBeVisible()
+    await expect(page.getByText('文档概览')).toBeVisible()
+    await expect(page.locator('.cockpit-snap')).toContainText(/快照 wm:\d+/)
+  })
+
+  // 场景 2：文档→章节，全景与阅读器双向定位（DV-R03）。
+  test('2 定位：树选章节→阅读器正文；返回全景仍同一节点', async ({ page }) => {
+    await loginOwner(page)
+    await openCockpit(page)
+    // 展开目标文档（树按标题排序，branch 作用域防跨文档串扰），点「概述」。
+    const branch = page.locator('.cockpit-tree-branch', { hasText: '验证主体报告' }).first()
+    await branch.locator('.cockpit-tree-caret').click()
+    const sec = branch.locator('.cockpit-tree-title', { hasText: '概述' }).first()
+    await expect(sec).toBeVisible()
+    sec.click()
+    await expect(page.locator('.cockpit-nodehead')).toBeVisible()
+    // 全景→阅读器：同一 nodeRef（阅读器显示该节标题与正文）。
+    await page.getByRole('button', { name: '在阅读器中打开' }).click()
+    await expect(page.locator('.cockpit-reader')).toBeVisible()
+    await expect(page.locator('.cockpit-nodetitle', { hasText: '概述' })).toBeVisible()
+    const body = page.locator('.cockpit-reader-para', { hasText: '本报告' }).first()
+    await expect(body).toBeVisible()
+    // 阅读器→全景：返回后仍是选中节点（节点头仍在）。
+    await page.getByRole('button', { name: '← 返回全景' }).click()
+    await expect(page.locator('.cockpit-nodehead')).toBeVisible()
+  })
+
+  // 场景 3：四面板展开并正确显示计数；受限与空态诚实（DV-R04）。
+  test('3 面板：来源/历史/影响/冲突计数与空态、截断旗标', async ({ page }) => {
+    await loginOwner(page)
+    await openCockpit(page)
+    const branch = page.locator('.cockpit-tree-branch', { hasText: '验证主体报告' }).first()
+    await branch.locator('.cockpit-tree-caret').click()
+    await branch.locator('.cockpit-tree-title', { hasText: '概述' }).first().click()
+    const panel = page.locator('.cockpit-panel')
+    await expect(panel).toBeVisible()
+    // 来源：草稿落版本挂了依据切片（种子经 ingest 提供）。
+    await panel.getByRole('tab', { name: '内容来源' }).click()
+    await expect(panel.locator('.cockpit-panel-count')).toContainText(/来源 \d+ 条/)
+    // 历史：已提交事件（structure + draft 链）。
+    await panel.getByRole('tab', { name: '修改历史' }).click()
+    await expect(panel.locator('.cockpit-panel-count')).toContainText('已提交事件')
+    await expect(panel.locator('.cockpit-panel-row').first()).toBeVisible()
+    // 影响：一跳；空/计数二态都诚实。
+    await panel.getByRole('tab', { name: '影响对象' }).click()
+    await expect(panel.locator('.cockpit-panel-count')).toContainText(/影响 \d+ 项/)
+    // 冲突：种子无开放碰撞 → 明确「无开放冲突」而非空白。
+    await panel.getByRole('tab', { name: '冲突与风险' }).click()
+    await expect(panel.getByText('无开放冲突')).toBeVisible()
+    // 版本块（I3）：当前版本+差异折叠入口可见。
+    await expect(page.locator('.cockpit-versions-toggle')).toBeVisible()
+  })
+
+  // 场景 4：后台变更后所有投影一致（DV-R05）——测试经 API 采纳新版本，
+  // 驾驶舱刷新后统计水位/树时间/详情版本块同步前进。
+  test('4 一致性：API 采纳新版本后，刷新入口与各投影同步', async ({ page }) => {
+    await loginOwner(page)
+    await openCockpit(page)
+    const branch4 = page.locator('.cockpit-tree-branch', { hasText: '验证主体报告' }).first()
+    await branch4.locator('.cockpit-tree-caret').click()
+    await branch4.locator('.cockpit-tree-title', { hasText: '设计说明' }).first().click()
+    const snapBefore = await page.locator('.cockpit-snap').innerText()
+    // 通过应用自身 API 落一个已提交变更（需求账本新增条目，唯一键防幂等跳过；
+    // 采纳走高危确认卡、服务端不允许客户端伪造 Confirmed，故用低危提交面驱动）。
+    await page.request.post('/api/commands/rdm.reqs.import', {
+      data: { params: { projectId: await page.locator('.cockpit-project').inputValue(),
+        items: [{ kind: 'UR', title: `UR-PROBE-${Date.now()} 一致性探针`, statement: '刷新一致性驱动条目', source: 'e2e-probe' }] } },
+      failOnStatusCode: false,
+    })
+    await page.getByRole('button', { name: '刷新' }).click()
+    await expect(page.locator('.cockpit-snap')).not.toHaveText(snapBefore)
+    // 版本块前进：出现新版本条目。
+    await expect(page.locator('.cockpit-versions-toggle')).toContainText(/版本 v\d+/)
+  })
+
+  // 场景 5：断线/失败保留旧快照并给出重试（DV-R08）——page.route 掐断命令面。
+  test('5 失败：命令面断连时保留旧快照并出现重试入口', async ({ page }) => {
+    await loginOwner(page)
+    await openCockpit(page)
+    await expect(page.locator('.cockpit-stats')).toBeVisible()
+    // 掐断后续命令面：切换项目触发重取 → 失败横幅 + 旧内容保留。
+    await page.route('**/api/commands/rdm.cockpit.**', route => route.abort())
+    await page.locator('.cockpit-refresh').click()
+    await expect(page.locator('.cockpit-banner-err')).toBeVisible()
+    await expect(page.locator('.cockpit-stats')).toBeVisible() // 旧快照未被清空
+    await page.unroute('**/api/commands/rdm.cockpit.**')
+    await page.locator('.cockpit-refresh').click()
+    await expect(page.locator('.cockpit-banner-err')).toBeHidden()
+  })
+
+  // 场景 6：权限负例——非成员账号看不到项目（无项目诚实空态；不泄露存在性）。
+  test('6 权限：非成员账号无项目可见', async ({ page }) => {
+    await login(page, READER, READER_PASSWORD)
+    await page.locator('.tsb-tool', { hasText: '文档驾驶舱' }).click()
+    await expect(page.getByText('暂无可见研发项目')).toBeVisible({ timeout: 15_000 })
+    await expect(page.locator('.cockpit-tree-title', { hasText: '验证主体报告' })).toHaveCount(0)
+  })
+
+  // 场景 7：窄屏、键盘、减少动效（DV-R07）。
+  test('7 可用性：390 宽无横向溢出、键盘可达、减少动效可用', async ({ page }) => {
+    await page.emulateMedia({ reducedMotion: 'reduce' })
+    await page.setViewportSize({ width: 390, height: 844 })
+    await loginOwner(page)
+    await openCockpit(page)
+    // 无横向溢出。
+    const overflow = await page.evaluate(() => document.documentElement.scrollWidth - document.documentElement.clientWidth)
+    expect(overflow).toBeLessThanOrEqual(1)
+    // 键盘：统计卡/树行可聚焦（tab 序含驾驶舱交互件）。
+    await page.locator('.cockpit-tree-title').first().focus()
+    await expect(page.locator('.cockpit-tree-title').first()).toBeFocused()
+    // 18px 大字（html font-size 注入）不破坏统计带布局。
+    await page.addStyleTag({ content: 'html{font-size:18px !important}' })
+    await expect(page.locator('.cockpit-stats')).toBeVisible()
+    const overflowBig = await page.evaluate(() => document.documentElement.scrollWidth - document.documentElement.clientWidth)
+    expect(overflowBig).toBeLessThanOrEqual(8)
+  })
+})
@@ -1,3 +1,3 @@
 {
-  "exports": 43
+  "exports": 51
 }
@@ -0,0 +1,40 @@
+# 通用规范采纳记录
+
+- 项目/负责人：Agent-System-Frontend / weichen
+- 状态：active
+- 规范位置：`deps/development-guidelines`
+- 规范性文档目录：`policy/`（项目规则与制度放此处；入口为 `policy/README.md`）
+- 过程文档位置：任务卡在 `.task/`（如 `.task/feature-governance-adoption.md`）；任务主记录为对应 PR 描述
+- 版本权威：本仓 gitlink `deps/development-guidelines @ 2688fd2be6a52c0bf110e7e6366b6f291ab5e4eb`；可读标签：无（候选 `0.1.0-draft.12`，尚未发布）
+- 批准/生效依据：`feature/governance-adoption PR（Agent-System-Frontend）`
+- 替代范围和迁移说明：无替代既有采纳记录。遗留：`policy/README.md` 与 `PROJECT.md` 的采纳基线行仍写有旧路径 `development/guidelines`（指向 Dev 仓），本次未改，后续单独修正为本仓 gitlink。
+
+| 规范/工作流 | 适用条件与范围 | 采纳或不适用理由 | 执行方式/证据 |
+|---|---|---|---|
+| core/baseline.md | 日常工作 | 采纳：所有任务的硬边界、授权与完成声明基线 | manual |
+| workflows/delivery.md、debugging.md、handoff.md | 交付、排障与交接 | 采纳：本仓日常交付、Bug 排障与会话交接均按此执行，任务卡与 PR 为记录载体 | manual |
+| standards/collaboration.md | 并行共同起点、两级分支、节点同步与陈旧候选拒绝 | 采纳：存在 feature 分支并行开发，合入前需同步最新目标分支 | manual；有真实平台负例再登记 enforced |
+| standards/merge-queue.md | 多个就绪任务的最终同步、CI、Review 与合入调度 | 不适用：单 owner、单仓串行合入，无共享 CI 预算或多任务合入窗口 | 不适用 |
+| standards/agent-execution.md | 工程 Agent CLI 执行路由、会话隔离与受控集成 | 采纳：允许 AI 协助实施，配置见 AGENT-EXECUTION.md | AGENT-EXECUTION.md + scripts/agent-exec（validate / admit）；证据：governance check + 正负例（`.task/feature-governance-adoption.md`） |
+| standards/verification.md | 验证与结论 | 采纳：功能与修复的验收须附实际命令输出 | manual；本地命令见 PROJECT.md「验证」节（CI 仅运行治理检查） |
+| standards/module-contracts.md | 模块边界、公开接口与契约测试 | 采纳：`src/` 模块与 Core 契约形状测试（vitest）遵循该契约 | manual |
+| workflows/design-verification.md | 功能增量的设计与验收对应 | 采纳：新功能与跨模块变更须写明验收与验证范围 | manual |
+| standards/testability.md | 模块测试、mock 边界与可独立验证的设计 | 采纳：单元与契约测试依赖保持最小，真实适配器单独验证 | manual |
+| standards/failure-containment.md | 故障影响控制、运行配额与故障注入 | 不适用：本仓为前端 SPA（构建产物由后端内嵌），无自有服务进程、队列或持久化，故障影响控制由后端仓承担 | 不适用 |
+
+## 项目差异
+
+| 原规则/章节 | 项目采用方式 | 原因与风险 | 负责人/复查条件 |
+|---|---|---|---|
+| 无 | 无 | 无 | 无 |
+
+默认做法差异说明理由；硬边界冲突须有明确有效决策，不能用此表自授权。建议不采用无需登记。
+
+## 本次升级或首次接入验证
+
+- 入口：`AGENTS.md`（治理入口，合并 Guidelines 短入口与本仓「Agent 执行与新项目准入」）、`AGENT-EXECUTION.md`、`PROJECT.md`、本文件；相对链接指向 `deps/development-guidelines/...`，目标文件已在固定 SHA 中核对存在。
+- 占位符：本文件与 `AGENTS.md` 中的模板占位符已全部替换。
+- 版本获取：`governance init --adopt`（dm-server bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c）以固定 SHA 检出 `deps/development-guidelines`（2688fd2be6a52c0bf110e7e6366b6f291ab5e4eb）与 `deps/development-manager`（bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c）。
+- 冲突检查：既有 `AGENTS.md`、`PROJECT.md`、`AGENT-EXECUTION.md` 原样保留；本仓无其他采纳记录（如 `policy/adoption.md`），无需引用。
+- 正负例与 Review/CI 证据：见 `.task/feature-governance-adoption.md`「结果与验证」节。
+- 回退：删除 `.gitmodules` 中两个治理条目及 `deps/` gitlink，并移除本次生成的治理脚本与 `.gitea/workflows/governance.yml`；`AGENTS.md`、`PROJECT.md` 恢复到采纳前版本。
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# 共享 Agent 执行器薄入口：转调 scripts/dm 的 agent-exec 子命令（validate / run / apply / admit / cleanup）。
+set -euo pipefail
+exec "$(dirname "$0")/dm" agent-exec "$@"
@@ -0,0 +1,55 @@
+#!/usr/bin/env bash
+# 共享 dm-server 薄入口：读取 deps/development-manager 的 gitlink 钉住提交，
+# 按该提交构建并缓存 dm-server，再 exec 其子命令（agent-exec、task、governance）。执行语义与退出码以该二进制为准。
+set -euo pipefail
+
+root=$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd -P)
+dm="$root/deps/development-manager"
+
+die() { echo "dm: $*" >&2; exit 2; }
+
+# git 钩子会导出仓库本地变量（GIT_DIR、GIT_INDEX_FILE 等），它们会让 `git -C "$dm"` 解析到外层仓库。
+# 所有针对 DM 检出的 git 与 go 调用都在清除这些变量后执行；读取外层 gitlink 与最终 exec 仍保留继承环境。
+dm_local_env="GIT_DIR GIT_WORK_TREE GIT_INDEX_FILE GIT_PREFIX GIT_OBJECT_DIRECTORY GIT_ALTERNATE_OBJECT_DIRECTORIES GIT_COMMON_DIR GIT_GRAFT_FILE GIT_NAMESPACE GIT_CONFIG GIT_CONFIG_PARAMETERS GIT_CONFIG_COUNT GIT_SHALLOW_FILE GIT_IMPLICIT_WORK_TREE $(git rev-parse --local-env-vars 2>/dev/null || true)"
+dm_clean_env() { for v in $dm_local_env; do unset "$v"; done; }
+dmgit() ( dm_clean_env; git -C "$dm" "$@" )
+
+# 1. 钉住版本只来自索引中的 gitlink（mode 160000），不读取工作区文件。
+entry=$(git -C "$root" ls-files -s -- deps/development-manager 2>/dev/null || true)
+[ -n "$entry" ] || die "索引中缺少 deps/development-manager 的 gitlink，无法确定钉住的 DM 版本"
+read -r mode pin _stage _path <<<"$entry"
+[ "$mode" = 160000 ] || die "deps/development-manager 不是 gitlink（mode=$mode）"
+[[ "$pin" =~ ^[0-9a-f]{40}$ ]] || die "gitlink 提交格式无效：$pin"
+
+# 2. 检出必须存在且确为 DM 独立仓库（避免 git -C 误解析到外层仓库），HEAD 必须等于钉住提交。
+[ -e "$dm/.git" ] || die "deps/development-manager 未检出；请按钉住提交 $pin 检出该 gitlink"
+top=$(dmgit rev-parse --show-toplevel 2>/dev/null || true)
+[ -n "$top" ] && [ "$top" = "$(cd "$dm" && pwd -P)" ] \
+  || die "deps/development-manager 不是独立检出；请按钉住提交 $pin 检出该 gitlink"
+head=$(dmgit rev-parse HEAD 2>/dev/null || true)
+[ "$head" = "$pin" ] \
+  || die "deps/development-manager HEAD（${head:-未知}）与钉住提交 $pin 不一致；请按钉住提交检出"
+
+# 3. 检出工作树必须干净（忽略嵌套 submodule 状态）。
+dirty=$(dmgit status --porcelain --ignore-submodules=all) \
+  || die "无法读取 deps/development-manager 的工作树状态"
+[ -z "$dirty" ] || die "deps/development-manager 存在未提交改动，拒绝运行（请先清理该检出）"
+
+# 4. 二进制按钉住提交缓存；缺失时在缓存目录内临时构建，完成后原子改名，避免留下半成品。
+cache="${DM_CACHE:-${XDG_CACHE_HOME:-$HOME/.cache}/development-manager/dm-server}"
+bin="$cache/dm-server-$pin"
+if [ ! -x "$bin" ]; then
+  command -v go >/dev/null 2>&1 || die "缺少 go，无法构建 dm-server（$pin）"
+  mkdir -p "$cache"
+  cache=$(cd "$cache" && pwd -P)
+  bin="$cache/dm-server-$pin"
+  work=$(mktemp -d "$cache/build-$pin.XXXXXX")
+  if ! (dm_clean_env; cd "$dm" && GOWORK=off go build -trimpath -o "$work/dm-server" ./cmd/dm-server); then
+    rm -rf "$work"
+    die "构建 dm-server 失败（$pin）"
+  fi
+  mv -f "$work/dm-server" "$bin"
+  rm -rf "$work"
+fi
+
+exec "$bin" "$@"
@@ -0,0 +1,16 @@
+#!/usr/bin/env bash
+# 本地检查（pre-commit）：集成分支直提拒绝 + 分支命名 + 本地完整性核对。权威准入在 PR（baseline.md:26）。
+branch=$(git rev-parse --abbrev-ref HEAD)
+case "$branch" in
+  main|master)
+    echo "pre-commit: 拒绝——集成分支 ${branch} 不得直接提交，走 feature 分支 + PR（collaboration.md）" >&2
+    exit 1 ;;
+esac
+echo "$branch" | grep -qE '^(feature|fix|hotfix|release)/[A-Za-z0-9._-]+$' || {
+  echo "pre-commit: 拒绝——分支名须为 feature|fix|hotfix|release/<slug>，当前：${branch}" >&2
+  exit 1
+}
+root=$(git rev-parse --show-toplevel)
+# admit 只是本地完整性/篡改证据（SELF）：同一 OS 用户可读取本地 HMAC 密钥并绕过本钩子，
+# 它不是 GATE，也不是可信身份。缺失或无效的本地记录仍拒绝；交付信任来自精确 HEAD 的 CI 或独立 REPLAY。
+"$root/scripts/agent-exec" admit --repo "$root"
@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+# 通用任务入口：转调 scripts/dm 的 task 子命令（triage / start / pr-check）。
+set -euo pipefail
+exec "$(dirname "$0")/dm" task "$@"
@@ -105,8 +105,9 @@ export const api = {
    return r.json() as Promise<{ owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; reloginRequired: boolean }>
  }),
  listAdminUsers: () => auth.fetch(`${BASE}/api/admin/users`).then(r => json<{ userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number; profileVersion: number; initializationState: string }[]>(r)),
-  // 建号只创建待初始化账号（无密码、无权限位）；初始凭证由服务器本地 CLI 发放激活 Key。
-  createAdminUser: (owner: string, name: string) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile: { name } }) }).then(r => json<{ owner: string; initializationState: string }>(r)),
+  // 管理员建号：可提供初始密码；省略密码时由服务端生成并仅返回一次。
+  createAdminUser: (owner: string, name: string, password?: string) => auth.fetch(`${BASE}/api/admin/users`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ owner, profile: { name }, ...(password ? { password } : {}) }) }).then(r => json<{ userId: string; owner: string; passwordSet: boolean; mustChangePassword: boolean; initializationState: string; initialPassword?: string }>(r)),
+  adminResetUserPassword: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/password`, { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: '{}' }).then(r => json<{ owner: string; temporaryPassword: string; mustChangePassword: boolean }>(r)),
  // ---- 管理员：一次性登录 Key（HTTP 签发端点已被恢复提案契约替换为 410，客户端方法随之移除；
  // list/revoke 仍有效，供恢复提案视图复用；兑换入口不变）----
  adminListLoginKeys: (owner: string) => auth.fetch(`${BASE}/api/admin/users/${encodeURIComponent(owner)}/login-keys`).then(r => json<{ keys: { id: string; owner: string; purpose: string; status: string; expiresAt: string; createdAt: string; createdBy?: string }[] }>(r)).then(d => d.keys ?? []),
@@ -0,0 +1,261 @@
+// 文档驾驶舱 I3：阅读器（连续正文 + 版本摘要/差异折叠）与右侧依据/影响面板。
+// 消费 I1/I3 命令面 rdm.cockpit.node(+versions)/node.history（Dev 仓 docs/superpowers
+// specs 2026-10-16 view-spec §5–§6）。不新增第四栏：右栏是选中节点的同一依据面，
+// 全景与阅读器共享 selectedNodeRef；面板刷新原位进行，不抢占滚动位置（DV-R05/§5）。
+// 折叠只用 @ui Collapsible；颜色/字号只消费 @ui/tokens.css。
+import { useCallback, useEffect, useRef, useState } from 'react'
+import { api } from '../api'
+import { Collapsible, EmptyState } from '@ui'
+import {
+  assembleReader, diffLines, historyLine, mergeHistoryStrict, versionSummary,
+  PANEL_TABS, type CockpitContentBlock, type CockpitHistorySummary,
+  type CockpitMeta, type CockpitNodeRef, type CockpitTreeNode,
+  type CockpitVersionSummary, type Density, type PanelTabId,
+} from '../documentCockpit'
+
+export interface ReaderSelection { ref: CockpitNodeRef; parentDocId?: string }
+
+interface NodeDetailShape {
+  meta: CockpitMeta
+  node: CockpitTreeNode
+  body?: CockpitContentBlock[]
+  children: CockpitTreeNode[]
+  sources: { items: any[] }
+  history: { items: CockpitHistorySummary[]; hasMore: boolean; nextCursor?: string }
+  impacts: { items: any[] }
+  conflicts: { items: any[] }
+  versions?: CockpitVersionSummary[]
+}
+
+function useNodeDetail(pid: string, sel?: CockpitNodeRef) {
+  const [detail, setDetail] = useState<NodeDetailShape | null>(null)
+  const [err, setErr] = useState('')
+  const gen = useRef(0)
+  useEffect(() => {
+    const g = ++gen.current
+    setDetail(null); setErr('')
+    if (!sel) return
+    api.rdmCommand<any>('rdm.cockpit.node', { projectId: pid, kind: sel.kind, id: sel.id })
+      .then(d => {
+        if (g !== gen.current) return
+        // 后端空列表可能投影为 null（Go nil slice）；统一归一，消费端按数组使用。
+        for (const k of ['sources', 'history', 'impacts', 'conflicts'] as const) {
+          if (d?.[k] && !Array.isArray(d[k].items)) d[k].items = []
+        }
+        setDetail(d)
+      })
+      .catch(e => { if (g === gen.current) setErr(e.message) })
+    return () => { gen.current++ }
+  }, [pid, sel?.kind, sel?.id])
+  return { detail, err }
+}
+
+/** 版本块：当前版本 + 前一版本摘要；完整差异（行级标记）折叠。受限只给元数据。 */
+export function VersionBlock({ versions, density }: { versions?: CockpitVersionSummary[]; density: Density }) {
+  if (!versions || versions.length === 0) return null
+  const { current, previous, redacted } = versionSummary(versions)
+  if (redacted || !current || current.content === undefined) {
+    return <div className="empty-note">版本受限（仅元数据可见）</div>
+  }
+  const prev = previous && previous.content !== undefined ? previous : undefined
+  return (
+    <Collapsible
+      id={`cockpit-versions-${current.version}`}
+      trigger={<span className="cockpit-versions-toggle">版本 {current.version}{previous ? `（前一版 ${previous.version}）` : '（首版）'}与完整差异</span>}
+    >
+      <div className={`cockpit-versions cockpit-density-${density}`}>
+        {prev ? (
+          <>
+            <div className="cockpit-versions-head">当前 {current.version} · {current.actor || '未知'} · {new Date(current.at).toLocaleString('zh-CN')}</div>
+            <pre className="cockpit-diff">
+              {diffLines(current.content || '', prev.content || '').map((l, i) => (
+                <div key={i} className={`cockpit-diff-${l.flag === '=' ? 'same' : l.flag === '+' ? 'add' : 'del'}`}>{l.flag} {l.text}</div>
+              ))}
+            </pre>
+            <div className="cockpit-versions-head">前一版 {prev.version} · {prev.actor || '未知'} · {new Date(prev.at).toLocaleString('zh-CN')}</div>
+          </>
+        ) : (
+          <div className="cockpit-versions-head">首版 · {current.actor || '未知'} · {new Date(current.at).toLocaleString('zh-CN')}</div>
+        )}
+      </div>
+    </Collapsible>
+  )
+}
+
+/** 阅读器中栏：选中章节=该节连续正文+版本块；选中文档=全章节连续装配（每节详情按需拉取）。 */
+export function CockpitReader({ pid, selection, sections, density, onBack }: {
+  pid: string
+  selection: ReaderSelection
+  sections: CockpitTreeNode[]
+  density: Density
+  onBack: () => void
+}) {
+  const { detail, err } = useNodeDetail(pid, selection.ref)
+  const isSection = selection.ref.kind === 'section'
+  const [sectionDetails, setSectionDetails] = useState<Record<string, NodeDetailShape | undefined>>({})
+  const gen = useRef(0)
+  // 文档阅读器：按树顺序装配全部章节详情（上限 20；失败章节给受限占位不拖垮整篇）。
+  useEffect(() => {
+    if (isSection || selection.ref.kind !== 'document') return
+    const g = ++gen.current
+    const list = sections.slice(0, 20)
+    setSectionDetails({})
+    for (const sec of list) {
+      api.rdmCommand<any>('rdm.cockpit.node', { projectId: pid, kind: 'section', id: sec.ref.id })
+        .then(d => { if (g === gen.current) setSectionDetails(prev => ({ ...prev, [sec.ref.id]: d })) })
+        .catch(() => { if (g === gen.current) setSectionDetails(prev => ({ ...prev, [sec.ref.id]: undefined })) })
+    }
+    return () => { gen.current++ }
+  }, [pid, isSection, selection.ref.id, sections])
+  const anchorRef = useRef<HTMLDivElement | null>(null)
+  useEffect(() => { anchorRef.current?.scrollIntoView({ block: 'start' }) }, [selection.ref.id])
+  if (err) return <EmptyState icon="alert">阅读器加载失败：{err}</EmptyState>
+  return (
+    <div className={`cockpit-reader cockpit-density-${density}`}>
+      <div className="cockpit-nodehead" ref={anchorRef}>
+        <button type="button" className="cockpit-back" onClick={onBack}>← 返回全景</button>
+        <span className="cockpit-nodetitle">{detail?.node?.title || (isSection ? '章节' : '文档')}</span>
+      </div>
+      {isSection && detail && (
+        <>
+          {renderBody(detail.body, detail.meta)}
+          <VersionBlock versions={detail.versions} density={density} />
+        </>
+      )}
+      {!isSection && (
+        <>
+          {sections.length === 0 && <div className="empty-note">该文档暂无章节</div>}
+          {assembleReader(sections, sectionDetails).map(sec => (
+            <section key={sec.ref.id} id={`sec-${sec.ref.id}`} className="cockpit-reader-section">
+              <div className="cockpit-reader-sechead">
+                <span className="cockpit-reader-sectitle">{sec.title}</span>
+                {sec.blocks[0]?.kind === 'restricted'
+                  ? <span className="cockpit-badge">内容受限（{sec.blocks[0].reason || '权限'}）</span>
+                  : sec.contentState === 'empty' && <span className="cockpit-badge">空</span>}
+              </div>
+              {sec.blocks.map((b, i) => b.kind === 'text'
+                ? <p key={i} className="cockpit-reader-para">{b.text}</p>
+                : <p key={i} className="empty-note">内容受限——标题与状态可见，正文不展示</p>)}
+              <VersionBlock versions={sec.versions} density={density} />
+            </section>
+          ))}
+        </>
+      )}
+    </div>
+  )
+}
+
+function renderBody(body: CockpitContentBlock[] | undefined, meta: CockpitMeta) {
+  if (!body || body.length === 0) return <div className="empty-note">暂无正文</div>
+  if (body[0].kind === 'restricted') {
+    return <div className="empty-note">内容受限（{body[0].reason || '权限'}）——标题与状态可见，正文不展示</div>
+  }
+  return (
+    <>
+      {body.map((b, i) => <p key={i} className="cockpit-reader-para">{b.text}</p>)}
+      {meta.truncated && <div className="cockpit-truncated">详情已截断：{meta.truncationReasons?.join('；')}</div>}
+    </>
+  )
+}
+
+/** 右栏：依据/历史/影响/冲突四标签（同一选中节点；刷新原位，不抢占滚动）。 */
+export function CockpitPanel({ pid, selection, tab, onTab, density }: {
+  pid: string
+  selection: ReaderSelection
+  tab: PanelTabId
+  onTab: (t: PanelTabId) => void
+  density: Density
+}) {
+  const { detail, err } = useNodeDetail(pid, selection.ref)
+  const [historyItems, setHistoryItems] = useState<CockpitHistorySummary[]>([])
+  const [historyMore, setHistoryMore] = useState(false)
+  const [historyCursor, setHistoryCursor] = useState<string | undefined>(undefined)
+  useEffect(() => {
+    setHistoryItems([]); setHistoryMore(false); setHistoryCursor(undefined)
+  }, [selection.ref.kind, selection.ref.id])
+  useEffect(() => {
+    if (!detail?.history) return
+    // 严格合并：只接受 seq 更新的条目，乱序/重复丢弃；不重置已渲染内容。
+    setHistoryItems(prev => mergeHistoryStrict(prev, detail.history.items).items)
+    setHistoryMore(detail.history.hasMore)
+    setHistoryCursor(detail.history.nextCursor)
+  }, [detail])
+  const loadMoreHistory = useCallback(() => {
+    if (!historyCursor) return
+    api.rdmCommand<any>('rdm.cockpit.node.history', { projectId: pid, kind: selection.ref.kind, id: selection.ref.id, cursor: historyCursor, limit: 20 })
+      .then(page => {
+        setHistoryItems(prev => mergeHistoryStrict(prev, page.items).items)
+        setHistoryMore(page.hasMore)
+        setHistoryCursor(page.nextCursor)
+      })
+      .catch(() => { /* 保留已渲染历史；可再次点击重试 */ })
+  }, [pid, selection.ref.kind, selection.ref.id, historyCursor])
+  const node = detail?.node
+  return (
+    <div className={`cockpit-panel cockpit-density-${density}`}>
+      <div className="cockpit-panel-tabs" role="tablist" aria-label="依据与影响">
+        {PANEL_TABS.map(t => (
+          <button key={t.id} type="button" role="tab" aria-selected={tab === t.id}
+            className={`cockpit-panel-tab${tab === t.id ? ' cockpit-panel-tab-active' : ''}`}
+            onClick={() => onTab(t.id)}>
+            {t.label}
+          </button>
+        ))}
+      </div>
+      {err && <div className="empty-note">依据面板加载失败：{err}</div>}
+      {!err && !detail && <div className="empty-note">加载依据…</div>}
+      {detail && tab === 'sources' && (
+        <div className="cockpit-panel-body">
+          <div className="cockpit-panel-count">来源 {node?.state.sourceCount ?? detail.sources.items.length} 条</div>
+          {detail.sources.items.length === 0 && <div className="empty-note">无来源——章节正文未挂依据切片</div>}
+          {detail.sources.items.map((s: any) => (
+            <div key={s.ref.id} className="cockpit-panel-row">
+              <span className="cockpit-panel-kind">{s.ref.kind}</span>
+              <span className="cockpit-panel-label">{s.label}</span>
+              {s.confidence && <span className="cockpit-badge">置信度 {s.confidence}</span>}
+              {s.redactedReason
+                ? <span className="cockpit-badge">受限（{s.redactedReason}）</span>
+                : s.verification && s.verification !== 'not_applicable' && <span className="cockpit-badge">{s.verification}</span>}
+            </div>
+          ))}
+        </div>
+      )}
+      {detail && tab === 'history' && (
+        <div className="cockpit-panel-body">
+          <div className="cockpit-panel-count">已提交事件（最新在前）</div>
+          {historyItems.length === 0 && <div className="empty-note">暂无历史</div>}
+          {historyItems.map(h => <div key={h.seq} className="cockpit-panel-row">{historyLine(h)}</div>)}
+          {historyMore && <button type="button" className="cockpit-tree-more" onClick={loadMoreHistory}>加载更早历史</button>}
+        </div>
+      )}
+      {detail && tab === 'impacts' && (
+        <div className="cockpit-panel-body">
+          <div className="cockpit-panel-count">影响 {node?.state.impactCount ?? detail.impacts.items.length} 项（一跳）</div>
+          {detail.impacts.items.length === 0 && <div className="empty-note">无一跳影响对象</div>}
+          {detail.impacts.items.map((r: any, i: number) => (
+            <div key={`${r.ref.kind}-${r.ref.id}-${i}`} className="cockpit-panel-row">
+              <span className="cockpit-panel-kind">{r.direction === 'incoming' ? '←' : '→'}</span>
+              <span className="cockpit-panel-label">{r.ref.kind}:{r.ref.id}</span>
+              <span className="cockpit-badge">{r.edgeType}</span>
+              <span className="cockpit-badge">{r.edgeState}</span>
+            </div>
+          ))}
+        </div>
+      )}
+      {detail && tab === 'conflicts' && (
+        <div className="cockpit-panel-body">
+          <div className="cockpit-panel-count">冲突 {node?.state.conflictCount ?? 0} 项</div>
+          {detail.conflicts.items.length === 0 && <div className="empty-note">无开放冲突</div>}
+          {detail.conflicts.items.map(c => (
+            <div key={c.id} className="cockpit-panel-row cockpit-panel-conflict">
+              <span className="cockpit-badge">{c.state === 'open' ? '开放' : c.state}</span>
+              <div className="cockpit-conflict-side">甲方：{c.left.visibility === 'full' ? c.left.claim : `受限（${c.left.redactedReason || '权限'}）`}</div>
+              <div className="cockpit-conflict-side">乙方：{c.right.visibility === 'full' ? c.right.claim : `受限（${c.right.redactedReason || '权限'}）`}</div>
+              <div className="cockpit-changetime">{new Date(c.detectedAt).toLocaleString('zh-CN')}</div>
+            </div>
+          ))}
+        </div>
+      )}
+    </div>
+  )
+}
@@ -10,12 +10,15 @@ import { store, useStore } from '../store'
 import { EmptyState, SectionLabel } from '@ui'
 import { classifyRdmError } from '../rdmErrors'
 import {
-  contextKey, nodeSummaryLine, sameSnapshot, selectionSurvives, statDisplay,
-  STAT_FILTERS, toggleFilter, treeBadges,
-  type CockpitMeta, type CockpitNodeRef, type CockpitOverview, type CockpitTreeNode, type CockpitTreePage,
+  contextKey, loadPrefs, nodeSummaryLine, sameSnapshot, savePrefs,
+  selectionSurvives, statDisplay, STAT_FILTERS, toggleFilter, treeBadges,
+  type CockpitMeta, type CockpitNodeRef, type CockpitOverview,
+  type CockpitTreeNode, type CockpitTreePage,
+  type Density, type PanelTabId, type ViewMode,
 } from '../documentCockpit'
+import { CockpitPanel, CockpitReader, VersionBlock } from './CockpitReader'

-interface ProjectView { id: string; name: string; canAudit?: boolean }
+interface ProjectView { projectId: string; name: string; canAudit?: boolean }

 function CockpitErrorState({ raw }: { raw: string }) {
  const c = classifyRdmError(raw)
@@ -34,6 +37,9 @@ export function DocumentCockpit() {
  const [selected, setSelected] = useState<Selection | null>(null)
  const [error, setError] = useState('')
  const [loadErr, setLoadErr] = useState('')
+  const [viewMode, setViewMode] = useState<ViewMode>('panorama')
+  const [density, setDensity] = useState<Density>('compact')
+  const [panelTab, setPanelTab] = useState<PanelTabId>('sources')
  const gen = useRef(0)

  const reload = useCallback((projectId: string, f: string) => {
@@ -58,8 +64,15 @@ export function DocumentCockpit() {
  useEffect(() => {
    let c = false
    setProjects(null); setPid(''); setOverview(null); setSelected(null); setFilter(''); setError('')
-    api.rdmCommand<ProjectView[]>('rdm.project.list')
-      .then(list => { if (!c) setProjects(Array.isArray(list) ? list : []) })
+    api.rdmCommand<{ projects?: ProjectView[] } | ProjectView[]>('rdm.project.list')
+      .then(list => {
+        if (c) return
+        // rdm.project.list 返回 { projects: [...] }；容忍裸数组形态。
+        const rows = Array.isArray(list) ? list : (list?.projects ?? [])
+        setProjects(rows)
+        // 设计 §6.2：进入驾驶舱默认选中第一个可见项目，驱动概览首屏。
+        if (rows.length > 0) setPid(prev => prev || rows[0].projectId)
+      })
      .catch(e => { if (!c) setError(e.message) })
    return () => { c = true }
  }, [identity])
@@ -70,6 +83,23 @@ export function DocumentCockpit() {
    reload(pid, filter)
  }, [pid, filter, reload])

+  // 个人视图偏好（设计 §7.3）：按 登录世代+项目 隔离，仅本地；恢复最近视图。
+  useEffect(() => {
+    if (!pid) return
+    const prefs = loadPrefs(`epoch-${identity}`, pid)
+    setViewMode(prefs.lastView)
+    setDensity(prefs.density)
+    setPanelTab(prefs.rightPanelTab)
+  }, [identity, pid])
+  const applyPrefs = useCallback((patch: { lastView?: ViewMode; density?: Density; rightPanelTab?: PanelTabId }) => {
+    if (!pid) return
+    setViewMode(v => patch.lastView ?? v)
+    setDensity(d => patch.density ?? d)
+    setPanelTab(t => patch.rightPanelTab ?? t)
+    const prefs = loadPrefs(`epoch-${identity}`, pid)
+    savePrefs(`epoch-${identity}`, pid, { ...prefs, ...patch })
+  }, [identity, pid])
+
  // 展开文档：按需加载章节子页（键集分页；旧项目/旧筛选的响应丢弃；
  // 加载失败只影响该分支——行内保留重试，不拖垮其它面板）。
  const loadChildren = useCallback((docId: string, cursor?: string) => {
@@ -100,12 +130,17 @@ export function DocumentCockpit() {
    <div className="cockpit">
      <div className="cockpit-header">
        <select className="ui-input cockpit-project" value={pid} onChange={e => { setPid(e.target.value); setSelected(null); setFilter('') }} aria-label="选择项目">
-          {projects.map(p => <option key={p.id} value={p.id}>{p.name}</option>)}
+          {projects.map(p => <option key={p.projectId} value={p.projectId}>{p.name}</option>)}
        </select>
        {filter && <button type="button" className="cockpit-filter-chip" onClick={() => setFilter('')}>
          筛选：{STAT_FILTERS.find(s => s.filter === filter)?.label || filter} ✕
        </button>}
        <span className="cockpit-snap">{overview ? `快照 ${overview.meta.snapshotRevision}` : '加载中…'}</span>
+        <div className="cockpit-viewtoggle" role="group" aria-label="视图切换">
+          <button type="button" className={`cockpit-viewbtn${viewMode === 'panorama' ? ' cockpit-viewbtn-active' : ''}`} onClick={() => applyPrefs({ lastView: 'panorama' })}>全景</button>
+          <button type="button" className={`cockpit-viewbtn${viewMode === 'reader' ? ' cockpit-viewbtn-active' : ''}`} onClick={() => applyPrefs({ lastView: 'reader' })}>阅读器</button>
+          <button type="button" className="cockpit-viewbtn" onClick={() => applyPrefs({ density: density === 'compact' ? 'full' : 'compact' })} title="切换密度">{density === 'compact' ? '紧凑' : '宽松'}</button>
+        </div>
        <button type="button" className="cockpit-refresh" onClick={() => reload(pid, filter)} disabled={!pid}>刷新</button>
      </div>
      {splitNotice && (
@@ -135,7 +170,7 @@ export function DocumentCockpit() {
          <div className="cockpit-stat"><span className="cockpit-stat-num">{overview.stats.updatedAt ? new Date(overview.stats.updatedAt).toLocaleString('zh-CN') : '—'}</span><span className="cockpit-stat-label">最近更新</span></div>
        </div>
      )}
-      <div className="cockpit-columns">
+      <div className={`cockpit-columns${selected ? ' cockpit-columns-3' : ''}`}>
        <div className="cockpit-tree" role="tree" aria-label="文档结构树">
          <SectionLabel>结构树</SectionLabel>
          {!overview && <div className="empty-note">加载结构…</div>}
@@ -160,12 +195,25 @@ export function DocumentCockpit() {
          {overview && !selected && (
            <PanoramaHome overview={overview} onSelect={selectDoc} />
          )}
-          {overview && selected && (
+          {overview && selected && viewMode === 'panorama' && (
            <PanoramaNode pid={pid} selection={selected} overview={overview}
+              snapRev={overview.meta.snapshotRevision}
              childPage={selected.ref.kind === 'document' ? treePages[selected.ref.id] : undefined}
-              onClear={() => setSelected(null)} />
+              density={density}
+              onClear={() => setSelected(null)}
+              onOpenReader={() => applyPrefs({ lastView: 'reader' })} />
+          )}
+          {overview && selected && viewMode === 'reader' && (
+            <CockpitReader pid={pid} selection={selected}
+              sections={selected.ref.kind === 'document' ? (treePages[selected.ref.id]?.items || []) : []}
+              density={density} onBack={() => applyPrefs({ lastView: 'panorama' })} />
          )}
        </div>
+        {overview && selected && (
+          <div className="cockpit-right">
+            <CockpitPanel pid={pid} selection={selected} tab={panelTab} onTab={t => applyPrefs({ rightPanelTab: t })} density={density} />
+          </div>
+        )}
      </div>
    </div>
  )
@@ -243,10 +291,13 @@ function PanoramaHome({ overview, onSelect }: { overview: CockpitOverview; onSel
  )
 }

-function PanoramaNode({ pid, selection, overview, childPage, onClear }: {
+function PanoramaNode({ pid, selection, overview, childPage, density, snapRev, onClear, onOpenReader }: {
  pid: string; selection: Selection; overview: CockpitOverview
  childPage?: { items: CockpitTreeNode[]; nextCursor?: string; hasMore: boolean; meta?: CockpitMeta }
+  density: Density
+  snapRev: string
  onClear: () => void
+  onOpenReader: () => void
 }) {
  const [detail, setDetail] = useState<any>(null)
  const [err, setErr] = useState('')
@@ -255,10 +306,17 @@ function PanoramaNode({ pid, selection, overview, childPage, onClear }: {
    const g = ++gen.current
    setDetail(null); setErr('')
    api.rdmCommand<any>('rdm.cockpit.node', { projectId: pid, kind: selection.ref.kind, id: selection.ref.id })
-      .then(d => { if (g === gen.current) setDetail(d) })
+      .then(d => {
+        if (g !== gen.current) return
+        // 后端空列表可能投影为 null（Go nil slice）；统一归一，消费端按数组使用。
+        for (const k of ['sources', 'history', 'impacts', 'conflicts'] as const) {
+          if (d?.[k] && !Array.isArray(d[k].items)) d[k].items = []
+        }
+        setDetail(d)
+      })
      .catch(e => { if (g === gen.current) setErr(e.message) })
    return () => { gen.current++ }
-  }, [pid, selection.ref.kind, selection.ref.id])
+  }, [pid, selection.ref.kind, selection.ref.id, snapRev])
  const node = (detail?.node || null) as CockpitTreeNode | null
  const title = node?.title || selection.ref.id
  return (
@@ -267,11 +325,15 @@ function PanoramaNode({ pid, selection, overview, childPage, onClear }: {
        <button type="button" className="cockpit-back" onClick={onClear}>← 返回概览</button>
        <span className="cockpit-nodetitle">{title}</span>
        {node && <span className="cockpit-nodesum">{nodeSummaryLine(node)}</span>}
+        <button type="button" className="cockpit-filter-chip" onClick={onOpenReader}>在阅读器中打开</button>
      </div>
      {err && <CockpitErrorState raw={err} />}
      {detail?.body?.length === 1 && detail.body[0].kind === 'restricted' && (
        <div className="empty-note">内容受限（{detail.body[0].reason || '权限'}）——标题与状态可见，正文不展示</div>
      )}
+      {selection.ref.kind === 'section' && detail?.versions && detail.versions.length > 0 && (
+        <VersionBlock versions={detail.versions} density={density} />
+      )}
      {detail && detail.meta && !sameSnapshot(detail.meta, overview.meta) && (
        <div className="cockpit-truncated">节点详情与统计快照不同（{detail.meta.snapshotRevision} vs {overview.meta.snapshotRevision}）——刷新对齐</div>
      )}
@@ -300,7 +362,7 @@ function PanoramaNode({ pid, selection, overview, childPage, onClear }: {
        </>
      )}
      {node && node.ref.kind === 'section' && (
-        <div className="empty-note">连续正文阅读与依据/影响面板在阅读器视图提供（I3）——本页展示状态摘要</div>
+        <div className="empty-note">点「在阅读器中打开」查看连续正文与版本差异；右侧为该节点的依据与影响面板</div>
      )}
      {detail?.meta?.truncated && (
        <div className="cockpit-truncated">详情已截断：{detail.meta.truncationReasons?.join('；')}</div>
@@ -1,5 +1,5 @@
 // 登录与改密（管理员发放制，R2 + 2026-10-13 登录恢复合同）：
-// LoginPage —— 用户名+密码（默认入口）/ 一次性登录 Key（恢复/激活，只输 Key）；
+// LoginPage —— 用户名+密码唯一入口；
 // ChangePasswordGate —— 受限会话强制设密：模式由服务端 passwordChangeMode 派生，
 // grant_setup 免当前密码（激活/恢复 Key 兑换），current_required 必须校验当前密码
 //（初始密码首登；2026-10-14 后端加固，空 current 会被 401 拒绝）。
@@ -33,10 +33,8 @@ function BrandPanel() {
 * 长期 API 密钥（ask_）不再作为浏览器日常登录入口——程序化客户端直接带
 * Authorization 头；浏览器保存长期密钥属于持久凭据暴露面。 */
 export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; onMustChange: (owner: string) => void }) {
-  const [tab, setTab] = useState<'password' | 'loginkey'>('password')
  const [owner, setOwner] = useState('')
  const [password, setPassword] = useState('')
-  const [key, setKey] = useState('')
  const [err, setErr] = useState('')
  const [busy, setBusy] = useState(false)

@@ -56,51 +54,20 @@ export function LoginPage({ onAuthed, onMustChange }: { onAuthed: () => void; on
    } finally { setBusy(false) }
  }

-  const submitKey = async () => {
-    setErr(''); setBusy(true)
-    try {
-      // 只提交 Key：目标账户由服务端绑定记录确定，客户端不能指定身份。
-      const me = await api.redeemLoginKey(key.trim())
-      if (me.sessionScope === 'set_password_only' || me.mustChangePassword) {
-        onMustChange(me.owner)
-        return
-      }
-      onAuthed()
-    } catch (e) {
-      setErr(humanRedeemError(String(e)))
-    } finally { setBusy(false) }
-  }
-
  return (
    <div className="lg-wrap">
      <BrandPanel />
      <div className="lg-formside">
-      <form className="lg-card" onSubmit={e => { e.preventDefault(); tab === 'password' ? submitPassword() : submitKey() }}>
+      <form className="lg-card" onSubmit={e => { e.preventDefault(); submitPassword() }}>
        <div className="lg-brand"><BrandMark size={26} />Agent-System</div>
        <h2 className="lg-title">登录</h2>
-        <p className="lg-sub">账号由管理员发放；忘记密码请联系管理员签发一次性登录 Key</p>
-        <div className="lg-tabs" role="tablist">
-          <button type="button" role="tab" aria-selected={tab === 'password'} className={`lg-tab ${tab === 'password' ? 'on' : ''}`} onClick={() => setTab('password')}>账号密码</button>
-          <button type="button" role="tab" aria-selected={tab === 'loginkey'} className={`lg-tab ${tab === 'loginkey' ? 'on' : ''}`} onClick={() => setTab('loginkey')}>一次性登录 Key</button>
-        </div>
-        {tab === 'password' ? (
-          <>
-            <label className="lg-label">用户名</label>
-            <input className="lg-input" value={owner} onChange={e => setOwner(e.target.value)} autoFocus autoComplete="username" placeholder="由管理员分配" />
-            <label className="lg-label">密码</label>
-            <input className="lg-input" type="password" value={password} onChange={e => setPassword(e.target.value)} autoComplete="current-password" placeholder="初始密码或常用密码" />
-            <Err msg={err} />
-            <button className="lg-submit" type="submit" disabled={busy || !owner.trim() || !password}>{busy ? '验证中…' : '登录'}</button>
-          </>
-        ) : (
-          <>
-            <label className="lg-label">一次性登录 Key</label>
-            <input className="lg-input lg-mono" value={key} onChange={e => setKey(e.target.value)} autoFocus placeholder="alk_…" />
-            <Err msg={err} />
-            <button className="lg-submit" type="submit" disabled={busy || !key}>{busy ? '兑换中…' : '兑换并设置新密码'}</button>
-            <p className="lg-hint">忘记密码时由管理员发起恢复提案，并由你在已登录设备的「设置 → 账号」中本人确认后获得；新账号使用管理员交付的激活 Key。单次有效、限时兑换。程序化客户端请继续使用 API 密钥（Authorization 头）。</p>
-          </>
-        )}
+        <p className="lg-sub">账号由管理员发放；忘记密码请联系管理员重置临时密码</p>
+        <label className="lg-label">用户名</label>
+        <input className="lg-input" value={owner} onChange={e => setOwner(e.target.value)} autoFocus autoComplete="username" placeholder="由管理员分配" />
+        <label className="lg-label">密码</label>
+        <input className="lg-input" type="password" value={password} onChange={e => setPassword(e.target.value)} autoComplete="current-password" placeholder="初始密码或常用密码" />
+        <Err msg={err} />
+        <button className="lg-submit" type="submit" disabled={busy || !owner.trim() || !password}>{busy ? '验证中…' : '登录'}</button>
      </form>
      </div>
    </div>
@@ -57,6 +57,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
  const serverWorkspaces = useStore(s => s.serverWorkspaces)
  /** 审计入口能力门控（增量 2）：命令面探测通过才展示「追溯审计」。 */
  const rdmAuditAvailable = useStore(s => s.rdmAuditAvailable)
+  const rdmCockpitAvailable = useStore(s => s.rdmCockpitAvailable)
  const theme = useStore(s => s.ui.theme)
  const pendingBadge = useStore(s =>
    s.cards.filter(c => c.status === 'action_required').length +
@@ -74,7 +75,7 @@ export function TaskSidebar({ onCollapse = store.toggleLeft, onConversationOpen,
    } catch { /* store owns the actionable failure toast */ }
  }

-  const tools = buildWorkspaceEntries(serverWorkspaces, { rdmAudit: rdmAuditAvailable })
+  const tools = buildWorkspaceEntries(serverWorkspaces, { rdmAudit: rdmAuditAvailable, rdmCockpit: rdmCockpitAvailable })
  const visible = filterTasks(tasks.filter(t => t.projectId === currentProjectId), q)
  const pinned = visible.filter(t => t.pinned)
  const rest = visible.filter(t => !t.pinned)
@@ -11,10 +11,8 @@ import type { SettingDesc } from '../contracts'
 import { docBridge } from './Workbench'
 import { recoveryProposalErrorMessage, recoveryProposalHint, recoveryStatusLabel } from '../recovery'

-// ---- 用户管理（原 AdminUsersModal 主体，R2 管理员发放制）：建号仅创建待初始化
-// 账号（HTTP 契约不含密码与管理员位），初始凭证由服务器本地 CLI 发放激活 Key；
-// 恢复走属主确认制提案：管理员提案 → 用户在「设置 → 账号」本人确认 → 一次性 Key
-// 只在属主会话内出现（直接签发 Key 的 HTTP 入口已被 410 替换）。----
+// ---- 用户管理：页面建号可设置/生成初始密码，管理员重置生成临时密码；
+// 保留恢复提案与 Key 管理作为既有非登录页恢复流程。 ----
 interface AdminUserRow { userId: string; owner: string; name: string; isAdmin: boolean; mustChangePassword: boolean; hasPassword: boolean; passwordSetAt?: string; createdAt: string; stateVersion: number }

 export function UsersPanel() {
@@ -24,6 +22,8 @@ export function UsersPanel() {
  const [notice, setNotice] = useState('')
  const [owner, setOwner] = useState('')
  const [name, setName] = useState('')
+  const [initialPassword, setInitialPassword] = useState('')
+  const [generatedCredential, setGeneratedCredential] = useState<{ owner: string; password: string; kind: 'initial' | 'temporary' } | null>(null)
  const [busy, setBusy] = useState(false)
  // 恢复提案面板：propFor 打开指定用户的提案视图（创建 / 状态 / 撤销）。
  const [propFor, setPropFor] = useState<AdminUserRow | null>(null)
@@ -41,13 +41,24 @@ export function UsersPanel() {
    setErr(''); setNotice('')
    setBusy(true)
    try {
-      const out = await api.createAdminUser(owner.trim(), name.trim())
-      setNotice(`已创建 ${out.owner}（待初始化）：请在服务器执行 user initialize-account 发放激活 Key`)
-      setOwner(''); setName('')
+      const out = await api.createAdminUser(owner.trim(), name.trim(), initialPassword.trim() || undefined)
+      setGeneratedCredential(out.initialPassword ? { owner: out.owner, password: out.initialPassword, kind: 'initial' } : null)
+      setNotice(out.initialPassword ? `已创建 ${out.owner}，请将下方一次性初始密码交付给用户。首次登录后必须改密。` : `已创建 ${out.owner}。用户首次登录后必须改密。`)
+      setOwner(''); setName(''); setInitialPassword('')
      await refresh()
    } catch (e) { setErr(String(e).includes('409') ? '用户名已存在' : String(e)) } finally { setBusy(false) }
  }

+  const resetPassword = async (u: AdminUserRow) => {
+    setErr(''); setNotice(''); setGeneratedCredential(null); setBusy(true)
+    try {
+      const out = await api.adminResetUserPassword(u.owner)
+      setGeneratedCredential({ owner: u.owner, password: out.temporaryPassword, kind: 'temporary' })
+      setNotice(`已为 ${u.owner} 生成临时密码。该用户登录后必须立即修改密码。`)
+      await refresh()
+    } catch (e) { setErr(String(e)) } finally { setBusy(false) }
+  }
+
  const openProposals = async (u: AdminUserRow) => {
    setErr(''); setNotice(''); setPropFor(u); setProposals(null)
    await refreshProposals(u.userId)
@@ -60,7 +71,13 @@ export function UsersPanel() {
      await api.createAdminRecoveryProposal(propFor.userId, propFor.stateVersion, crypto.randomUUID())
      setNotice(`已为 ${propFor.owner} 建立恢复提案：请该用户在「设置 → 账号」由本人确认；确认后一次性 Key 只在其会话内出现`)
      await refreshProposals(propFor.userId)
-    } catch (e) { setErr(recoveryProposalErrorMessage(String(e))) } finally { setBusy(false) }
+    } catch (e) {
+      if (String(e).includes('409')) {
+        await resetPassword(propFor)
+        return
+      }
+      setErr(recoveryProposalErrorMessage(String(e)))
+    } finally { setBusy(false) }
  }

  const revokeProposal = async (p: RecoveryProposal) => {
@@ -79,12 +96,18 @@ export function UsersPanel() {
          <div className="ad-row">
            <input className="lg-input" placeholder="用户名（登录名）" value={owner} onChange={e => setOwner(e.target.value)} />
            <input className="lg-input" placeholder="显示名（可空）" value={name} onChange={e => setName(e.target.value)} />
+            <input className="lg-input" type="password" autoComplete="new-password" placeholder="初始密码（留空随机生成）" value={initialPassword} onChange={e => setInitialPassword(e.target.value)} />
            <button className="lg-submit ad-create-btn" disabled={busy || !owner.trim()} onClick={create}>创建账号</button>
          </div>
-          <p className="ad-hint">账号创建后处于待初始化状态：在服务器执行 user initialize-account 发放一次性激活 Key，用户经兑换入口设置密码后登录</p>
+          <p className="ad-hint">可填写管理员指定的初始密码；留空则由服务端生成一次性随机密码。用户首次登录后必须改密。</p>
        </div>
      )}
      {notice && <div className="ad-notice"><Icon name="check" size={14} />{notice}</div>}
+      {generatedCredential && <div className="ad-reset">
+        <p className="ad-hint">{generatedCredential.kind === 'initial' ? '初始密码' : '临时密码'}仅显示一次，请立即安全交付给 {generatedCredential.owner}。</p>
+        <input className="lg-input ad-mono" readOnly value={generatedCredential.password} aria-label="一次性密码" />
+        <button type="button" className="ad-mini" onClick={() => setGeneratedCredential(null)}>关闭</button>
+      </div>}
      {err && <div className="lg-err"><Icon name="alert" size={14} />{err}</div>}
      {propFor ? (
        <div className="ad-reset">
@@ -125,9 +148,10 @@ export function UsersPanel() {
                <td>{u.isAdmin ? <span className="ad-chip ad-chip-admin">ADMIN</span> : <span className="ad-chip">USER</span>}</td>
                <td>{u.mustChangePassword ? <span className="ad-chip ad-chip-warn">待改密</span> : u.hasPassword ? '正常' : '未设密码'}</td>
                <td className="ad-dim">{u.passwordSetAt ? new Date(u.passwordSetAt).toLocaleString() : '—'}</td>
-                <td>{me?.isAdmin && (
+                <td>{me?.isAdmin && <span className="ad-row">
+                  <button className="ad-mini" disabled={busy} onClick={() => resetPassword(u)}>重置临时密码</button>
                  <button className="ad-mini" onClick={() => openProposals(u)}>恢复提案</button>
-                )}</td>
+                </span>}</td>
              </tr>
            ))}
            {users !== null && users.length === 0 && <tr><td colSpan={6} className="ad-dim">暂无账号</td></tr>}
@@ -124,3 +124,91 @@ describe('树徽标与状态行', () => {
    expect(line).toContain('层级止于章节')
  })
 })
+
+// ---- I3：阅读器与右栏纯逻辑 ----
+import {
+  assembleReader, diffLines, historyLine, mergeHistoryStrict, versionSummary,
+  prefsKey, mergePrefs, loadPrefs,
+  type CockpitHistorySummary, type CockpitVersionSummary,
+} from './documentCockpit'
+
+describe('偏好：按用户+项目隔离，枚举外脏值回落默认', () => {
+  it('prefsKey 区分用户与项目', () => {
+    expect(prefsKey('a', 'p1')).not.toBe(prefsKey('a', 'p2'))
+    expect(prefsKey('a', 'p1')).not.toBe(prefsKey('b', 'p1'))
+  })
+  it('mergePrefs 逐项校验', () => {
+    expect(mergePrefs(null)).toEqual({ lastView: 'panorama', density: 'compact', rightPanelTab: 'sources' })
+    expect(mergePrefs({ lastView: 'reader', density: 'full', rightPanelTab: 'conflicts' })).toEqual({
+      lastView: 'reader', density: 'full', rightPanelTab: 'conflicts',
+    })
+    const junk = mergePrefs({ lastView: 'galaxy', density: 42, rightPanelTab: 'nope' })
+    expect(junk.lastView).toBe('panorama')
+    expect(junk.density).toBe('compact')
+    expect(junk.rightPanelTab).toBe('sources')
+  })
+  it('loadPrefs 在无 localStorage 环境安全回落', () => {
+    expect(loadPrefs('a', 'p1').lastView).toBe('panorama')
+  })
+})
+
+describe('版本摘要与行级差异', () => {
+  const v = (seq: number, content?: string, redacted?: boolean): CockpitVersionSummary => ({
+    seq, version: `v${seq}`, at: '2026-10-16T00:00:00Z', basisCount: 0, content, redacted,
+  })
+  it('当前+前一版；受限整体降级', () => {
+    const s = versionSummary([v(3, '三'), v(2, '二'), v(1, '一')])
+    expect(s.current?.version).toBe('v3')
+    expect(s.previous?.version).toBe('v2')
+    expect(s.redacted).toBe(false)
+    const r = versionSummary([v(3, undefined, true)])
+    expect(r.redacted).toBe(true)
+    expect(versionSummary(undefined).current).toBeUndefined()
+  })
+  it('diffLines 标记新增/删除/保留', () => {
+    const d = diffLines('共同\n新增行', '共同\n删除行')
+    expect(d).toContainEqual({ flag: '=', text: '共同' })
+    expect(d).toContainEqual({ flag: '+', text: '新增行' })
+    expect(d).toContainEqual({ flag: '-', text: '删除行' })
+  })
+})
+
+describe('历史严格合并：乱序与重复丢弃（DV-R05）', () => {
+  const h = (seq: number): CockpitHistorySummary => ({ seq, at: '', op: 'x', summary: `s${seq}` })
+  it('只接受 seq 更大的条目', () => {
+    const r = mergeHistoryStrict([h(10), h(9)], [h(11), h(8)])
+    expect(r.items.map(i => i.seq)).toEqual([10, 9, 11])
+    expect(r.dropped).toBe(1)
+  })
+  it('重复 seq 丢弃且计入 dropped', () => {
+    const r = mergeHistoryStrict([h(10)], [h(10), h(11)])
+    expect(r.items.map(i => i.seq)).toEqual([10, 11])
+    expect(r.dropped).toBe(1)
+  })
+  it('空历史接受全部', () => {
+    expect(mergeHistoryStrict([], [h(1), h(2)]).items.map(i => i.seq)).toEqual([1, 2])
+  })
+  it('historyLine 带操作者与本地时间', () => {
+    expect(historyLine(h(1))).toContain('s1')
+  })
+})
+
+describe('阅读器装配：受限章节给占位不冒充空内容', () => {
+  const sec = (id: string, content: string): CockpitTreeNode => ({
+    ref: { kind: 'section', id }, title: id, path: [], childCount: 0,
+    state: { content, verification: 'not_applicable', sourceCount: 0, conflictCount: 0, impactCount: 0, missingChildCount: 0, structuralGap: true },
+    visibility: 'full',
+  })
+  it('正文/受限/未加载三分态', () => {
+    const out = assembleReader(
+      [sec('a', 'complete'), sec('b', 'complete'), sec('c', 'empty')],
+      {
+        a: { body: [{ kind: 'text', text: '正文A' }] },
+        b: { body: [{ kind: 'restricted', reason: 'section-duty-or-authorship' }] },
+      },
+    )
+    expect(out[0].blocks).toEqual([{ kind: 'text', text: '正文A' }])
+    expect(out[1].blocks[0].kind).toBe('restricted')
+    expect(out[2].blocks[0].reason).toBe('not_loaded')
+  })
+})
@@ -168,3 +168,175 @@ export function nodeSummaryLine(n: CockpitTreeNode): string {
  if (n.state.impactCount > 0) parts.push(`影响 ${n.state.impactCount}`)
  return parts.join(' · ')
 }
+
+// ---- I3：阅读器与右栏纯逻辑 ----
+
+export interface CockpitVersionSummary {
+  seq: number
+  version: string
+  actor?: string
+  at: string
+  basisCount: number
+  content?: string
+  redacted?: boolean
+}
+
+export interface CockpitContentBlock { kind: string; text?: string; reason?: string }
+
+export interface CockpitSourceSummary {
+  ref: { kind: string; id: string }
+  label: string
+  capturedAt?: string
+  confidence: string
+  verification: string
+  visibility: string
+  redactedReason?: string
+}
+
+export interface CockpitHistorySummary {
+  seq: number
+  at: string
+  op: string
+  actor?: string
+  summary: string
+  operationId?: string
+}
+
+export interface CockpitImpactSummary {
+  ref: { kind: string; id: string }
+  edgeType: string
+  edgeState: string
+  direction: string
+  layer: string
+}
+
+export interface CockpitAssertion { node: CockpitNodeRef; claim: string; visibility: string; redactedReason?: string }
+
+export interface CockpitConflictSummary {
+  id: string
+  node: CockpitNodeRef
+  state: string
+  left: CockpitAssertion
+  right: CockpitAssertion
+  detectedAt: string
+  resolutionRef?: string
+}
+
+export interface CockpitPage<T> { meta?: CockpitMeta; items: T[]; nextCursor?: string; hasMore: boolean; truncated?: boolean }
+
+export const PANEL_TABS = [
+  { id: 'sources', label: '内容来源' },
+  { id: 'history', label: '修改历史' },
+  { id: 'impacts', label: '影响对象' },
+  { id: 'conflicts', label: '冲突与风险' },
+] as const
+export type PanelTabId = (typeof PANEL_TABS)[number]['id']
+
+export type ViewMode = 'panorama' | 'reader'
+export type Density = 'compact' | 'full'
+
+export interface CockpitPrefs {
+  lastView: ViewMode
+  density: Density
+  rightPanelTab: PanelTabId
+}
+
+/** 偏好按 用户+项目 隔离（设计 §7.3）；仅本地存储，不构成授权。 */
+export function prefsKey(actor: string, projectId: string): string {
+  return `cockpit-prefs:${actor}:${projectId}`
+}
+
+/** 解析偏好：枚举外的脏值逐项回落默认（panorama+compact+sources）。 */
+export function mergePrefs(raw: unknown): CockpitPrefs {
+  const base: CockpitPrefs = { lastView: 'panorama', density: 'compact', rightPanelTab: 'sources' }
+  if (!raw || typeof raw !== 'object') return base
+  const r = raw as Record<string, unknown>
+  const out = { ...base }
+  if (r.lastView === 'panorama' || r.lastView === 'reader') out.lastView = r.lastView
+  if (r.density === 'compact' || r.density === 'full') out.density = r.density
+  if (PANEL_TABS.some(t => t.id === r.rightPanelTab)) out.rightPanelTab = r.rightPanelTab as PanelTabId
+  return out
+}
+
+export function loadPrefs(actor: string, projectId: string): CockpitPrefs {
+  try {
+    const raw = typeof localStorage !== 'undefined' ? localStorage.getItem(prefsKey(actor, projectId)) : null
+    return mergePrefs(raw ? JSON.parse(raw) : null)
+  } catch {
+    return mergePrefs(null)
+  }
+}
+
+export function savePrefs(actor: string, projectId: string, prefs: CockpitPrefs): void {
+  try {
+    if (typeof localStorage !== 'undefined') localStorage.setItem(prefsKey(actor, projectId), JSON.stringify(prefs))
+  } catch { /* 存储不可用时偏好静默降级为会话内 */ }
+}
+
+/** 版本摘要：当前版本 + 前一版本（视图规格 §5）。versions 为最新在前；受限版本无 content。 */
+export function versionSummary(versions: CockpitVersionSummary[] | undefined): {
+  current?: CockpitVersionSummary
+  previous?: CockpitVersionSummary
+  redacted: boolean
+} {
+  if (!versions || versions.length === 0) return { redacted: false }
+  const current = versions[0]
+  const previous = versions.length > 1 ? versions[1] : undefined
+  return { current, previous, redacted: !!current.redacted }
+}
+
+/** 历史面板合并：只接受严格更新（seq 更大且未见）的条目；过期与重复都计入 dropped（DV-R05/契约 §8）。 */
+export function mergeHistoryStrict(existing: CockpitHistorySummary[], incoming: CockpitHistorySummary[]): {
+  items: CockpitHistorySummary[]
+  dropped: number
+} {
+  const seen = new Set(existing.map(e => e.seq))
+  const maxSeq = existing.length > 0 ? Math.max(...seen) : -1
+  const items = [...existing]
+  let dropped = 0
+  for (const e of incoming) {
+    if (e.seq <= maxSeq || seen.has(e.seq)) {
+      dropped++
+      continue
+    }
+    seen.add(e.seq)
+    items.push(e)
+  }
+  return { items, dropped }
+}
+
+/** 阅读器装配：把文档的章节详情按树顺序组装为连续正文；受限章节给占位说明而非空白。 */
+export function assembleReader(
+  sections: CockpitTreeNode[],
+  details: Record<string, { body?: CockpitContentBlock[]; versions?: CockpitVersionSummary[] } | undefined>,
+): { ref: CockpitNodeRef; title: string; contentState: string; blocks: CockpitContentBlock[]; versions?: CockpitVersionSummary[] }[] {
+  return sections.map(sec => {
+    const d = details[sec.ref.id]
+    const readable = !!d?.body && d.body.length > 0 && d.body[0].kind === 'text'
+    const restricted = !!d?.body && d.body.length > 0 && d.body[0].kind === 'restricted'
+    const blocks: CockpitContentBlock[] = readable
+      ? (d!.body as CockpitContentBlock[])
+      : restricted
+        ? [{ kind: 'restricted', reason: d?.body?.[0]?.reason || 'section-duty-or-authorship' }]
+        : [{ kind: 'restricted', reason: 'not_loaded' }]
+    return { ref: sec.ref, title: sec.title, contentState: sec.state.content, blocks, versions: d?.versions }
+  })
+}
+
+/** 行级差异（阅读器 Collapsible 的完整对比）：按行对齐的朴素 LCS 免实现——
+ * 以行为单位做集合比对标记 +/=/-，足够呈现「完整差异」而不冒充精确补丁。 */
+export function diffLines(current: string, previous: string): { flag: '+' | '-' | '='; text: string }[] {
+  const cur = current.split('\n')
+  const prev = new Set(previous.split('\n'))
+  const curSet = new Set(cur)
+  const out: { flag: '+' | '-' | '='; text: string }[] = []
+  for (const line of cur) out.push({ flag: prev.has(line) ? '=' : '+', text: line })
+  for (const line of previous.split('\n')) if (!curSet.has(line)) out.push({ flag: '-', text: line })
+  return out
+}
+
+/** 历史条目的自然语言时间线文本（右栏 §6）。 */
+export function historyLine(h: CockpitHistorySummary): string {
+  const who = h.actor ? `${h.actor} ` : ''
+  return `${h.summary}（${who}${new Date(h.at).toLocaleString('zh-CN')}）`
+}
@@ -691,3 +691,33 @@ button.cockpit-tree-more { cursor: pointer; text-decoration: underline; }
 .cockpit-childtable { width: 100%; border-collapse: collapse; font-size: var(--fs-ui-sm); }
 .cockpit-childtable th, .cockpit-childtable td { border-bottom: 1px solid var(--border); padding: 4px 6px; text-align: left; color: var(--text); }
@media (max-width: 760px) { .cockpit-columns { grid-template-columns: 1fr; } .cockpit-tree { max-height: 40vh; } }
+
+/* ---- 驾驶舱 I3：阅读器与右栏（令牌驱动） ---- */
+.cockpit-columns-3 { grid-template-columns: minmax(200px, 260px) 1fr minmax(240px, 300px); }
+.cockpit-right { min-height: 0; overflow-y: auto; border-left: 1px solid var(--border); padding-left: 12px; }
+.cockpit-viewtoggle { display: flex; gap: 0; }
+.cockpit-viewbtn { height: 28px; padding: 0 10px; font-size: var(--fs-ui-sm); border: 1px solid var(--border); background: var(--bg-panel); color: var(--text); cursor: pointer; }
+.cockpit-viewbtn-active { background: var(--text); color: var(--bg-panel); }
+.cockpit-reader-para { white-space: pre-wrap; font-size: var(--fs-ui-base, var(--fs-ui-sm)); line-height: 1.6; color: var(--text); margin: 6px 0; }
+.cockpit-density-full .cockpit-reader-para { line-height: 1.9; margin: 10px 0; }
+.cockpit-reader-section { border-top: 1px solid var(--border); padding: 8px 0; }
+.cockpit-reader-sechead { display: flex; align-items: baseline; gap: 8px; }
+.cockpit-reader-sectitle { font-weight: 600; color: var(--text); font-size: var(--fs-ui-base, var(--fs-ui-sm)); }
+.cockpit-versions { font-size: var(--fs-ui-sm); }
+.cockpit-density-full .cockpit-versions { line-height: 1.7; }
+.cockpit-versions-toggle { font-size: var(--fs-ui-sm); color: var(--text); text-decoration: underline; cursor: pointer; }
+.cockpit-versions-head { color: var(--text-muted, var(--text)); padding: 4px 0; }
+.cockpit-diff { white-space: pre-wrap; border: 1px solid var(--border); border-radius: var(--radius-sm); padding: 6px 8px; font-size: var(--fs-ui-sm); }
+.cockpit-diff-add { color: var(--text); }
+.cockpit-diff-del { color: var(--text-muted, var(--text)); text-decoration: line-through; }
+.cockpit-diff-same { color: var(--text-muted, var(--text)); }
+.cockpit-panel-tabs { display: flex; gap: 4px; padding-bottom: 8px; }
+.cockpit-panel-tab { border: 1px solid var(--border); background: none; padding: 3px 8px; font-size: var(--fs-ui-sm); color: var(--text); cursor: pointer; border-radius: var(--radius-sm); }
+.cockpit-panel-tab-active { background: var(--bg-panel); border-color: var(--text); }
+.cockpit-panel-body { display: flex; flex-direction: column; gap: 6px; }
+.cockpit-panel-count { font-size: var(--fs-ui-sm); color: var(--text-muted, var(--text)); }
+.cockpit-panel-row { display: flex; flex-wrap: wrap; gap: 6px; align-items: baseline; font-size: var(--fs-ui-sm); border-top: 1px solid var(--border); padding: 4px 0; }
+.cockpit-panel-kind { color: var(--text-muted, var(--text)); }
+.cockpit-panel-label { color: var(--text); }
+.cockpit-panel-conflict { flex-direction: column; }
+.cockpit-conflict-side { color: var(--text); }
Author	SHA1	Message	Date
weichen	7df77c1a8c	Merge branch 'main' into feature/auth-password-management-frontend governance / governance (pull_request) Successful in 14s Details	2026-10-18 10:41:10 +00:00
weichen	92864db8d3	Clarify user management flows	2026-10-17 11:56:33 +00:00
weichen	fb1f9f246b	Fallback proofless recovery to temporary reset	2026-10-17 10:43:47 +00:00
weichen	2f8009b967	Use password login and admin temporary resets	2026-10-17 10:30:17 +00:00
weichen	0f31f91af5	Merge pull request 'Adopt the shared governance kit (development-governance-v2)' (#105 ) from feature/governance-adoption into main governance / governance (push) Successful in 16s Details	2026-10-17 08:11:43 +00:00
weichen	61986dbcd9	Close and archive the governance adoption card governance / governance (pull_request) Successful in 16s Details Why: the adoption PR is reviewed and its candidate HEAD passed CI; the card closure is folded into the PR so no separate close PR is needed. Evidence: CI GATE on bc866c4489075b8c2f62063952ff9f3a4f4119a4; independent Review REPLAY (pi --no-session（fresh_session=true，session id not-observable）VERDICT: APPROVE，无阻塞项). Impact: task card only (moved to .task/archive/). Refs: https://git-home.u1680832.nyat.app:30319/weichen/Agent-System-Frontend/pulls/105	2026-10-17 08:03:11 +00:00
weichen	bc866c4489	Record the adoption unit run and positive/negative evidence governance / governance (pull_request) Successful in 23s Details Why: Phase 6 requires one positive executor run and the negative cases (missing config, bad receipt, out-of-scope path, unknown side effect) before adoption becomes active. Evidence: .task/evidence/governance-adoption/ (SELF): governance check, agent-exec validate and adoption cases; this commit passed the generated pre-commit hook (admit). Impact: task card and evidence logs only. Refs: .task/feature-governance-adoption.md	2026-10-17 07:15:45 +00:00
agent-exec-transport	d64dbc3a15	agent-exec transport e3fd063def382c53308a521c7306aed6/2daad8d16d7c	2026-10-17 06:56:39 +00:00
weichen	5670c68e1f	Bootstrap AGENT-EXECUTION.md and the governance adoption card Why: development-governance-v2 Phase 6 adopts the shared governance kit in every formal repository; the executor needs a valid AGENT-EXECUTION.md before any implementation unit can run. Evidence: generated by dm-server governance init at Development-Manager bd3a7de57a3a9e1a4495b94c5fa5c08d71e7be8c; dm-server agent-exec validate passes. Impact: configuration and task card only; no code or CI change yet. Refs: Agent-System-Dev docs/superpowers/plans/2026-10-16-development-governance-v2-master.md	2026-10-17 06:53:57 +00:00
weichen	8b59998d3c	Merge pull request 'Fix inverted cancel guard in cockpit project loader' (#104 ) from fix/cockpit-cancel-guard into main	2026-10-17 04:58:22 +00:00
weichen	c9ba3442fc	Open context pane before cockpit entry in narrow layout Why: at 390px the single-pane layout lands on 对话 after login and hides the whole context sidebar (both sidebar and rail forms); scenario 7 must switch to the 上下文 pane via the top bar before the entry exists. Evidence: tsc clean, vitest green, build green (SELF); seven-scenario rerun to be recorded on the Dev I4 card. Impact: e2e spec only. Refs: rollout I4	2026-10-17 04:47:52 +00:00
weichen	ed23de28df	Accept rail-form cockpit entry in narrow layout Why: at 390px the compact layout swaps the sidebar for an icon rail; the cockpit entry remains reachable as an icon button but not as .tsb-tool, so scenario 7 timed out waiting for the sidebar form. Evidence: tsc clean, vitest green, build green (SELF); seven-scenario rerun to be recorded on the Dev I4 card. Impact: e2e spec only. Refs: rollout I4	2026-10-17 04:40:28 +00:00
weichen	83e81d12ac	Sync panorama node detail on refresh; scope scenario 4 to the fixture doc Why: the cockpit refresh reloaded overview and tree but left the node detail at its old snapshot, so the 刷新对齐 banner persisted after refreshing (DV-R05 wants every projection to advance). PanoramaNode now refetches when the overview snapshotRevision advances. Scenario 4 also scoped its tree clicks to the 验证主体报告 branch — the unscoped first caret expanded an unrelated rdm-self doc. Evidence: tsc clean, vitest green, build green (SELF); seven-scenario rerun to be recorded on the Dev I4 card. Impact: cockpit panorama + e2e spec. Refs: rollout I4	2026-10-17 04:30:32 +00:00
weichen	e503cc9e93	Drive cockpit consistency scenario with a committed mutation Why: scenario 4 relied on a pending draft proposal advancing the snapshot watermark, but rdm.draft.propose commits nothing (wm:58 before and after) and draft adoption is high-danger (client cannot forge Confirmed). rdm.reqs.import with a unique probe item is a committed low-danger mutation that advances the watermark — the honest DV-R05 driver. Evidence: tsc clean, vitest green, build green (SELF); wm 58->60 probe against the seeded data recorded in session. Impact: e2e spec only. Refs: rollout I4	2026-10-17 04:21:47 +00:00
weichen	c3d8205839	Show version block in panorama node view Why: the I4 scenarios assert the version collapsible for a selected section in the panorama (not only the reader); the panorama node view had no version block, so .cockpit-versions-toggle never existed there. Also normalize null list projections in the panorama node detail fetch (same Go nil-slice issue fixed for the panel earlier). Evidence: tsc clean, vitest green, build green (SELF); seven-scenario rerun to be recorded on the Dev I4 card. Impact: cockpit panorama only. Refs: rollout I4	2026-10-17 04:07:58 +00:00
weichen	dd159c24d0	Normalize null list projections in cockpit node detail Why: rdm.cockpit.node projects empty conflicts as items:null (Go nil slice) while sources arrive as []; the panel read items.length on null and crashed, so the conflicts empty state never rendered (I4 e2e scenario 3). Evidence: tsc clean, vitest green, build green (SELF); seven-scenario rerun to be recorded on the Dev I4 card. Impact: cockpit panel only. Refs: rollout I4	2026-10-17 03:58:53 +00:00
weichen	a56ce3e1df	Fix cockpit project option field: payload is projectId, not id Why: the local ProjectView interface invented 'id'; rdm.project.list returns projectId. Every option value was undefined, so auto-select set pid to undefined and the overview request was never issued — cockpit showed 加载概览… forever after the project list loaded (I4 e2e scenario 1). Evidence: tsc clean, vitest green, build green (SELF); network probe shows rdm.cockpit.overview 200 and .cockpit-stats rendered; seven-scenario rerun to be recorded on the Dev I4 card. Impact: cockpit entry only. Refs: rollout I4	2026-10-17 03:16:47 +00:00
weichen	10f8388bb8	Auto-select first visible project on cockpit entry Why: the cockpit rendered the project dropdown with no project selected and an empty main area — the design's 首屏 default (first visible project drives the overview) was never implemented; caught by I4 e2e scenario 1 which got past the project list but never saw .cockpit-stats. Evidence: tsc clean, vitest green, build green (SELF); seven-scenario rerun to be recorded on the Dev I4 card. Impact: cockpit entry only. Refs: rollout I4	2026-10-17 02:45:17 +00:00
weichen	5ede8df52a	Fix inverted cancel guard in cockpit project loader Why: #102 rewrote the bare-array fallback into a multi-line callback and turned 'if (!c) setProjects(...)' into an early 'if (!c) return', which skips setProjects on the normal (non-cancelled) path — the cockpit then hangs on 加载中 forever, caught by I4 e2e scenario 1. Evidence: tsc clean, vitest 324/324, build green (SELF); seven-scenario browser suite rerun recorded on the Dev I4 card. Impact: cockpit entry only. Refs: rollout I4	2026-10-17 02:28:47 +00:00
weichen	49ba8b1735	Merge pull request 'Stabilize cockpit e2e login: settle identity refresh before entry click' (#103 ) from feature/document-visualization-cockpit-i4 into main	2026-10-16 15:39:52 +00:00
weichen	b594d2748e	Stabilize cockpit e2e login: settle identity refresh before entry click Why: after login the store's identity epoch and the capability probe each settle once more; the app closes open workspaces on identity change, so clicking the sidebar entry too early raced the overlay close (intermittent 加载中 hang, caught across I4 e2e runs). Evidence: instrumented probe (rows=2 parsed then overlay closed on identity bump); settled-login rerun follows on the Dev I4 card. Impact: spec stability only. Refs: rollout I4	2026-10-16 15:39:11 +00:00
weichen	afd661c932	Merge pull request 'Unwrap projects payload in cockpit project loader' (#102 ) from fix/cockpit-project-list-shape into main	2026-10-16 15:32:02 +00:00
weichen	c9ef3c0f0a	Unwrap projects payload in cockpit project loader Why: rdm.project.list returns { projects: [...] }; the cockpit component assumed a bare array and always rendered 暂无可见研发项目, caught by I4 e2e scenario 1. Evidence: tsc/vitest/build green (SELF); browser e2e rerun recorded on the Dev I4 card. Impact: cockpit entry only. Refs: rollout I4	2026-10-16 15:31:52 +00:00
weichen	72f1a259e1	Merge pull request 'Wire cockpit flag into sidebar workspace entries' (#101 ) from fix/cockpit-sidebar-entry into main	2026-10-16 15:28:37 +00:00
weichen	804170ec66	Wire cockpit flag into sidebar workspace entries Why: TaskSidebar builds its own workspace entry list without the cockpit flag, so the 文档驾驶舱 entry never appeared in the sidebar even when the command probe passed (caught by I4 e2e scenario 1). Evidence: tsc/vitest/vite build green (SELF); cockpit e2e suite re-run via Dev scripts/e2e.sh follows on the Dev I4 card. Impact: sidebar entry visibility only; no behavior change elsewhere. Refs: rollout I4	2026-10-16 15:27:16 +00:00
weichen	7759d8077f	Merge pull request 'Add cockpit seven-scenario Playwright suite (I4)' (#100 ) from feature/document-visualization-cockpit-i4 into main	2026-10-16 14:33:21 +00:00
weichen	8d43b1de12	Add cockpit seven-scenario Playwright suite (I4) Why: implement the reviewed I4 browser acceptance - seven scenarios over the cockpit: first-entry stats/tree/panorama, tree-section reader positioning on the shared selection, four evidence tabs with counts and honest empty/ restricted states, pending-probe adoption via in-session API then refresh (snapshot and version block advance together, DV-R05), route-abort outage keeping the previous snapshot with a retry entry (DV-R08), non-member account sees no projects (DV-R06 negative), and 390px/18px/keyboard/reduced- motion usability (DV-R07). Evidence: tsc green; suite driven by Dev scripts/e2e.sh (seed: cockpit-e2e structure YAML via the structure-content loader, pending probe proposal, non-member account); GATE is the Dev-side e2e.sh run recorded on the Dev I4 card. Impact: e2e spec only; no product source change. Refs: rollout I4	2026-10-16 14:32:58 +00:00
weichen	d66bd7941c	Merge pull request 'Raise knip baseline to 51 for cockpit I3 surface' (#99 ) from fix/cockpit-i3-knip into main	2026-10-16 12:52:02 +00:00
weichen	a022257b40	Raise knip baseline to 51 for cockpit I3 surface Why: I3 adds the reader/evidence-panel module whose contract types (documentCockpit.ts) are consumed by tests and the I4 combination work; the repo's knip ratchet exists for exactly this deliberate, documented raise. Code paths themselves reduced first (attempted de-export churned unrelated surface, reverted in favor of the baseline bump). Evidence: knip 51 <= 51 via scripts/check-knip.mjs; vitest 324/324; tsc and vite build green. Impact: baseline file only. Refs: rollout I3	2026-10-16 12:51:53 +00:00
weichen	3f6ced099c	Merge pull request 'Add cockpit reader view and evidence panel (I3)' (#98 ) from feature/document-visualization-cockpit-i3 into main	2026-10-16 12:21:48 +00:00
weichen	86770e35fb	Add cockpit reader view and evidence panel (I3) Why: implement the reviewed I3 increment - continuous body reading with per-section status lines, version summary with collapsed line-diff (backend versions projection from RDM PR #420), right evidence panel with sources/history/impacts/conflicts tabs, panorama-reader positioning on the shared selection, per user+project view preferences (panorama/reader, density, panel tab), strict-seq history merging and honest restricted states. Evidence: 10 new pure-logic tests (prefs validation, version summary and diff marks, strict history merge drops, reader assembly three-state); vitest 324/324 green; tsc and vite build green; tokens-only styles. Impact: cockpit-only; no fourth column, no standalone graph (relations stay in the right panel); reader entry is explicit (panorama button / view toggle). Refs: rollout I3	2026-10-16 12:21:24 +00:00
weichen	65ab7a8a44	Merge pull request 'Guard the admin create path with a browser e2e scenario' (#97 ) from fix/admin-create-e2e-guard into main	2026-10-16 11:22:07 +00:00