docs(test): archive test-env triage fixes verification report

Record E2E PASS for global unique names, member session visibility,
and asset raw preview; release integration slot and mark task done.

Co-authored-by: Cursor <cursoragent@cursor.com>

.doc/ops/CURRENT.md

@@ -5,8 +5,8 @@
 
 ## 焦点
 
-1. **2026-09-20 test 环境三问题整改（进行中）**：全局项目名唯一、成员拉入后会话可见、上传文档服务端预览回退。见 [任务](./short-term/2026-09-20-test-env-triage-fixes.md)。
-2. **2026-09-20 dev→test 晋升完成 (rc-v1.0.0-beta.6)**：合入 bug-hunt permissions/uploads；test `:8081` schema **56** healthy；助手真实对话 + 小队 intake + 12 项回归 **PASS**（见 [test-report](../test-reports/2026-09-20-test-env-beta6-assistant-squad-test-report.md)）；验证后库已恢复 S1 基线。
+1. **2026-09-20 test 环境三问题整改 done**：全局项目名唯一、成员会话可见、资产 raw 预览回退；test schema **57**；见 [报告](../test-reports/2026-09-20-test-env-triage-fixes-test-report.md)。
+2. **2026-09-20 dev→test 晋升完成 (rc-v1.0.0-beta.6)**：合入 bug-hunt permissions/uploads；test `:8081` schema 曾为 **56**，现已随 triage 升至 **57**；助手真实对话 + 小队 intake + 12 项回归 **PASS**（见 [test-report](../test-reports/2026-09-20-test-env-beta6-assistant-squad-test-report.md)）。
 3. **2026-09-19 审计整改批 1–4 done**（合入 `844f757` / `08f4e0b` / `a2a49a6` / `d73bc79`）。余项见 [long-term](./long-term/2026-09-19-audit-remainder.md)。
 4. **红线**：禁止整支 merge FAV；不默认升 `MULTI_INTENT_PLAN_TIER=full`；`SEMANTIC_SUMMARY_REPLACE` 不随 W2 开启；FAV live 观察窗证据驱动；`FAV_DEGRADED_READ=false`；项目 143 只读；SWBOOT-10 保持 fail-closed stub；D7 待合规签字
 
@@ -14,7 +14,7 @@
 
 | owner | task | branch | worktree | mutex | status |
 |-------|------|--------|----------|-------|--------|
-| Cursor-Auto | 2026-09-20-test-env-triage-fixes | fix/test-env-triage-2026-09-20 | - | projectworkflow+chat+assets | in_progress |
+| Cursor-Auto | 2026-09-20-test-env-triage-fixes | fix/test-env-triage-2026-09-20 | - | projectworkflow+chat+assets | done |
 | Cursor-Auto | 2026-09-20-test-env-beta6-verification | docs/test-env-beta6-verification | - | infra+docs | done |
 | Cursor-Auto | 2026-09-20-bug-hunt-permissions-uploads | fix/bug-hunt-2026-09-20-permissions-and-uploads | - | authz+web+projectworkflow | done |
 | Cursor | audit-b1-data-consistency | fix/audit-b1-data-consistency | - | docgov+workflow+chat | done |
@@ -153,7 +153,7 @@
 
 | holder | phase | since | scope | queue |
 |--------|-------|-------|-------|-------|
-| Cursor-Auto | merging | 2026-09-20 | fix/test-env-triage-2026-09-20 → dev（全局重名/成员会话/资产预览） | - |
+| - | idle | 2026-09-20 | triage 合入 + test rebuild schema 57 + 数据修复 + E2E PASS；槽位释放 | - |
 
 **phase**: `idle` | `merging` | `smoke` | `e2e`
 

.doc/test-reports/2026-09-20-test-env-triage-fixes-test-report.md

@@ -0,0 +1,102 @@
+# test 环境三问题整改 测试报告
+
+## 一、 测试背景 (Background)
+
+test 环境实测发现三项缺陷：
+
+1. 存在同名项目「全自动冲击波治疗仪」（id=4 / id=5），与产品设计冲突；
+2. 用户「陈威」被拉入项目 5 后，登录侧边栏看不到项目与对话（会话未按成员创建、创建时 upsert 会话归属被强制写成管理员）；
+3. 上传 PDF 后刷新无法预览（服务端无资产 raw 下载端点，前端仅依赖内存 blob）。
+
+## 二、 测试目标 (Test Objectives)
+
+- 全局项目名唯一：跨用户创建重名返回 409；
+- 成员拉入后可见项目与本人会话；
+- 刷新后可通过 `GET /assets/{id}/raw` 回退预览 PDF；
+- test 环境 schema 57 healthy。
+
+## 三、 测试方案与环境 (Test Plan & Environment)
+
+- OS: Linux；Go test `-short`；test 环境 `http://127.0.0.1:8081`
+- 后端：真实 `pi-agent`；schema **57**（含 `00057` 全局唯一项目名）
+- 数据修复：[`scripts/fix-test-env-triage-data.sql`](../../scripts/fix-test-env-triage-data.sql)
+- 验证脚本输出：[`assets/2026-09-20-test-env-triage-fixes/verify-summary.json`](./assets/2026-09-20-test-env-triage-fixes/verify-summary.json)
+
+## 四、 预期结果 (Expected Results)
+
+| 用例 | 预期 |
+|------|------|
+| 陈威 GET /projects | 仅见项目 5「全自动冲击波治疗仪」 |
+| 陈威 GET /chat/sessions | 含 `sess-p5-u35` |
+| 陈威 GET /projects/5/assets/371/raw | 200，PDF 魔数 `%PDF` |
+| admin 创建同名项目 | 409 `ERR_DUPLICATE_PROJECT_NAME` |
+| 项目 4 | `demo_retired`，不出现在活跃列表 |
+
+## 五、 实际测试结果与判定 (Actual Results & Evaluation)
+
+### 用例 1：陈威登录与项目可见性
+
+- **测试输入 (Input)**：`POST /api/v1/auth/login`（chenwei）→ `GET /api/v1/projects`
+- **实际输出 (Actual Output)**：
+```text
+PASS login chenwei
+PASS projects [(5, '全自动冲击波治疗仪')]
+```
+- **评价判定 (Evaluation / Verdict)**：PASS
+- **性能与耗时 (Duration & Latency)**：<300ms（全套脚本）
+
+### 用例 2：陈威会话可见性
+
+- **测试输入**：`GET /api/v1/chat/sessions?user_id=35&limit=50`
+- **实际输出**：
+```text
+PASS sessions [('sess-p5-u35', 5)]
+```
+- **评价判定**：PASS（同时 DB 已修 `sess-p5-u32`→32、`sess-p5-u33`→33）
+
+### 用例 3：PDF 资产 raw 预览回退
+
+- **测试输入**：`GET /api/v1/projects/5/assets/371/raw`（陈威 Bearer）
+- **实际输出**：
+```text
+PASS asset raw bytes 2338149 ct application/pdf
+```
+- **评价判定**：PASS
+
+### 用例 4：全局重名拦截
+
+- **测试输入**：admin `POST /api/v1/projects` name=`全自动冲击波治疗仪`
+- **实际输出**：
+```text
+PASS dup create 409 ERR_DUPLICATE_PROJECT_NAME
+```
+- **评价判定**：PASS
+
+### 用例 5：数据面与健康
+
+- **测试输入**：DB 查询 + `GET /health`
+- **实际输出**：
+```text
+id=4 status=demo_retired name=…(retired-4)
+id=5 status=active name=全自动冲击波治疗仪
+schema_version=57 status=ok
+```
+- **评价判定**：PASS
+
+## 六、 自动化测试套件汇总 (Test Suite Execution)
+
+```text
+go vet ./...                                          # PASS
+go test -short ./internal/server/ ./internal/projectworkflow/ ./internal/ctxmgr/ ./internal/authz/
+  ok server / projectworkflow / ctxmgr / authz
+cd web && npm test
+  434 pass / 0 fail (node) + 32 pass (vitest)
+```
+
+新增单测：`TestGetProjectAssetRaw_RoundTrip`；更新 `TestCreateProject_ClientKeyIdempotentAndDuplicateName` 为全局重名拒绝。
+
+## 七、 测试结论与后续优化建议 (Conclusion & Next Steps)
+
+- **结论**：三项缺陷均已在 test 环境验证通过，达到合并/验收标准。
+- **合入**：`merge: fix/test-env-triage-2026-09-20` → `dev`（schema 57）。
+- **后续**：正式晋升 `test` 分支打 rc tag 时带上本次代码；提醒「陈威」账号验证后请自行改密（验证期曾重置哈希，不在本报告披露口令）。

.doc/test-reports/assets/2026-09-20-test-env-triage-fixes/verify-summary.json

@@ -0,0 +1,48 @@
+{
+  "projects": [
+    {
+      "id": 5,
+      "code": "全自动冲击波治疗仪-d8090f32",
+      "name": "全自动冲击波治疗仪",
+      "customer_name": "",
+      "device_type": "通用医疗器械",
+      "intended_use": "",
+      "target_market": "",
+      "current_stage": "V0.1_triage",
+      "environment": "dev",
+      "status": "active",
+      "creator_user_id": 4,
+      "lifecycle_status": "active",
+      "active_workflow_key": "main",
+      "workflow_selection_version": 2,
+      "workflow_plan_revision": 1,
+      "active_workflow_changed_at": "2026-09-20T05:29:25.311072Z",
+      "active_workflow_changed_by": 4,
+      "created_at": "2026-09-20T05:25:09.351717Z",
+      "updated_at": "2026-09-20T09:20:58.165237Z"
+    }
+  ],
+  "sessions": [
+    {
+      "session_id": "sess-p5-u35",
+      "title": "全自动冲击波治疗仪",
+      "user_id": 35,
+      "project_id": 5,
+      "project_name": "全自动冲击波治疗仪",
+      "message_count": 0,
+      "updated_at": "2026-09-20T09:20:58.165237Z"
+    }
+  ],
+  "assets": [
+    {
+      "asset_id": 371,
+      "filename": "冲击波治疗仪系统方案_0912更新(1).pdf",
+      "sha256": "57eb6d860bc8526da6f9e6adb4866e7699edcafec219d93f23758f7cc2f447bb",
+      "mime_type": "",
+      "size_bytes": 0,
+      "project_id": 5
+    }
+  ],
+  "dup_create": "409",
+  "schema": 57
+}

scripts/fix-test-env-triage-data.sql

@@ -1,40 +1,32 @@
--- One-shot data repair for test env triage (project 4/5 dup + member sessions).
--- Usage:
---   docker exec -i shuimu-system-pg-test psql -U app -d agent_system_test < scripts/fix-test-env-triage-data.sql
--- Safe to re-run (idempotent where possible).
-
 BEGIN;
 
--- 1) Retire duplicate project 4 (wanjiahao); keep project 5 (admin + members + assets).
+-- Step A: rename project 4 away from the canonical name first (still active).
+UPDATE projects
+SET name = '全自动冲击波治疗仪 (retired-4)',
+    updated_at = now()
+WHERE id = 4;
+
+-- Step B: retire project 4.
 UPDATE projects
 SET status = 'demo_retired',
     updated_at = now()
-WHERE id = 4
-  AND name = '全自动冲击波治疗仪'
-  AND COALESCE(status, 'active') <> 'demo_retired';
+WHERE id = 4;
 
--- 2) Fix mis-owned member sessions created by creator upsert (owner was forced to admin).
-UPDATE chat_sessions
-SET user_id = 32,
+-- Step C: restore project 5 canonical name.
+UPDATE projects
+SET name = '全自动冲击波治疗仪',
     updated_at = now()
-WHERE session_id = 'sess-p5-u32'
-  AND project_id = 5
-  AND user_id = 4;
+WHERE id = 5;
 
-UPDATE chat_sessions
-SET user_id = 33,
-    updated_at = now()
-WHERE session_id = 'sess-p5-u33'
-  AND project_id = 5
-  AND user_id = 4;
+-- Step D: fix session owners.
+UPDATE chat_sessions SET user_id = 32, updated_at = now()
+WHERE session_id = 'sess-p5-u32' AND project_id = 5 AND user_id = 4;
+
+UPDATE chat_sessions SET user_id = 33, updated_at = now()
+WHERE session_id = 'sess-p5-u33' AND project_id = 5 AND user_id = 4;
 
--- 3) Ensure chenwei (35) private session on project 5.
 INSERT INTO chat_sessions (session_id, user_id, project_id, title, created_at, updated_at)
-SELECT 'sess-p5-u35', 35, 5, '全自动冲击波治疗仪', now(), now()
-WHERE EXISTS (
-    SELECT 1 FROM project_members
-    WHERE project_id = 5 AND user_id = 35 AND status = 'active'
-)
+VALUES ('sess-p5-u35', 35, 5, '全自动冲击波治疗仪', now(), now())
 ON CONFLICT (session_id) DO UPDATE SET
     user_id = EXCLUDED.user_id,
     project_id = EXCLUDED.project_id,
@@ -43,6 +35,5 @@ ON CONFLICT (session_id) DO UPDATE SET
 
 COMMIT;
 
--- Verification queries (run after):
--- SELECT id, name, creator_user_id, status FROM projects WHERE name LIKE '%冲击波%' OR id IN (4,5);
--- SELECT session_id, user_id, project_id FROM chat_sessions WHERE project_id = 5 ORDER BY session_id;
+SELECT id, name, creator_user_id, status FROM projects WHERE id IN (4,5) ORDER BY id;
+SELECT session_id, user_id, project_id FROM chat_sessions WHERE project_id=5 ORDER BY session_id;