merge: refactor/document-reliability-pilot

M2 test report and integration-slot release.
2026-09-14 16:07:37 +00:00
parent 0872d8fbb3 da21911e30
commit b8f33b5c55
16 changed files with 1010 additions and 26 deletions
@@ -5,7 +5,7 @@

 ## 焦点

-1. **DOC-RELIABILITY**: [M1 活验已签，开工 M2 U5–U7](../ops/short-term/2026-09-14-document-reliability-m1-live-and-m2.md)（`refactor/document-reliability-pilot`；`mutex=workspace`；活验报告最后一句 **继续 M2**）
+1. **DOC-RELIABILITY**: [M2 已签，继续 M3](../test-reports/2026-09-14-document-reliability-m2-test-report.md)（`refactor/document-reliability-pilot`；M2 最后一句 **继续 M3**；未开工 U8–U12）
 2. **CHAT-INTENT**: [对话意图运行时状态](../audit/2026-09-13-conversation-intent-runtime-state.md)（`fix/conversation-intent-state`；与文档账本运行时无关）
 3. **CHAT**: [对话历史刷新](../audit/2026-09-13-chat-history-refresh-disappears.md)（认领仍 `in_progress`；gap 行已 PASS，以代码/handoff 为准收敛）

@@ -13,7 +13,7 @@

 | owner | task | branch | worktree | mutex | status |
 |-------|------|--------|----------|-------|--------|
-| Cursor | document-reliability-m1-live-and-m2 | refactor/document-reliability-pilot | .worktrees/refactor-document-reliability-pilot | workspace | in_progress |
+| Cursor | document-reliability-m1-live-and-m2 | refactor/document-reliability-pilot | .worktrees/refactor-document-reliability-pilot | workspace | done |
 | Codex | module-decoupling-remediation-plan | feature/module-decoupling-remediation | .worktrees/feature/module-decoupling-remediation | architecture-docs | done |
 | verifier_antigravity | controlled-content-ui-acceptance | fix/controlled-content-ui-acceptance | .worktrees/fix-controlled-content-ui-acceptance | document-content-ui-acceptance | done |
 | implementer_cursor | controlled-content-canonical-hash | fix/controlled-content-canonical-hash | .worktrees/fix-controlled-content-canonical-hash | docgov | done |
@@ -54,13 +54,13 @@
 > 新任务开始前登记。`branch` 必须为 `feature/<slug>` 或 `fix/<slug>`，**禁止** `dev` / `test` / `main`。同一 `mutex` 同时仅一个 `in_progress`。

 > workflow-plan 409 与治理鉴权 G1–G5 已收口（见 [test-report](../test-reports/2026-09-14-governance-action-level-authz-test-report.md)）。禁止终止或改写项目 143。
-> `document-reliability-pilot` M1 活验已签（继续 M2）。现占 `workspace` 做 U5–U7。禁止 worktree 内 `env-service`。项目 143 只读，禁止终止。
+> `document-reliability-pilot` M2 已签（继续 M3）。禁止 worktree 内 `env-service`。项目 143 只读，禁止终止。未签字前禁止 U8–U12。

 ## 集成槽位

 | holder | phase | since | scope | queue |
 |--------|-------|-------|-------|-------|
-| Cursor | merging | 2026-09-14 | DOC-RELIABILITY M2 U5–U7 | - |
+| - | idle | - | - | - |

 **phase**: `idle` | `merging` | `smoke` | `e2e`

@@ -70,7 +70,7 @@

 | 环境 | 端口 | schema | 状态 |
 |------|------|--------|------|
-| dev | 8080 | **33** | healthy（`pi-agent`；M1 活验 rebuild 后 health+ready PASS） |
+| dev | 8080 | **36** | healthy（`pi-agent`；M2 rebuild 后 health+ready PASS） |
 | test | 8081 | 25→27* | healthy |
 | main | 8000 | 25→27* | healthy（app + runner + DB） |

@@ -91,6 +91,8 @@
 | 模块化单体解耦架构 | [../system-design/2026-09-14-module-decoupling-architecture.md](../system-design/2026-09-14-module-decoupling-architecture.md) |
 | 模块解耦整改计划 | [../remediation/2026-09-14-module-decoupling-refactor-plan.md](../remediation/2026-09-14-module-decoupling-refactor-plan.md) |
 | 文档可靠性 M1 报告 | [../test-reports/2026-09-14-document-reliability-pilot-test-report.md](../test-reports/2026-09-14-document-reliability-pilot-test-report.md) |
+| 文档可靠性 M1 活验 | [../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md](../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md) |
+| 文档可靠性 M2 | [../test-reports/2026-09-14-document-reliability-m2-test-report.md](../test-reports/2026-09-14-document-reliability-m2-test-report.md) |
 | SSE/幂等审计 | [../audit/2026-09-13-document-revision-sse-idempotency.md](../audit/2026-09-13-document-revision-sse-idempotency.md) |
 | 质量门禁自污染审计 | [../audit/2026-09-13-document-revision-quality-gate-self-pollution.md](../audit/2026-09-13-document-revision-quality-gate-self-pollution.md) |
 | 当前文档路由审计 | [../audit/2026-09-13-document-revision-active-doc-routing.md](../audit/2026-09-13-document-revision-active-doc-routing.md) |
@@ -26,14 +26,14 @@ owner: Cursor

 ## M2 事件与 FAV

- [ ] 业务终态、staging 和 outbox 同事务。
- [ ] 每个 consumer 有独立 delivery/inbox/attempt/lease/dead-letter。
- [ ] 1、2、4 dispatcher 无重复可见副作用和永久饥饿。
- [ ] crash-before/after-side-effect/ack 全部可恢复。
- [ ] stale fencing、跨项目事件、错误 producer、坏 digest 均拒绝。
- [ ] FAV 中间结果、Prompt、工具轨迹和 secret 准入率为零。
- [ ] DB 授权成功后才允许 degraded read；授权图缺失 fail closed。
- [ ] tombstone/删除账本 union-deny PASS。
+- [x] 业务终态、staging 和 outbox 同事务。
+- [x] 每个 consumer 有独立 delivery/inbox/attempt/lease/dead-letter。
+- [x] 1、2、4 dispatcher 无重复可见副作用和永久饥饿。
+- [x] crash-before/after-side-effect/ack 全部可恢复。
+- [x] stale fencing、跨项目事件、错误 producer、坏 digest 均拒绝。
+- [x] FAV 中间结果、Prompt、工具轨迹和 secret 准入率为零。
+- [x] DB 授权成功后才允许 degraded read；授权图缺失 fail closed。
+- [x] tombstone/删除账本 union-deny PASS。

 ## M3 TaskRun、workspace 与数据生命周期

@@ -1,6 +1,6 @@
 ---
 title: "文档可靠性 M1 活验签字与条件 M2"
-status: in_progress
+status: done
 created: 2026-09-14
 updated: 2026-09-14
 owner: Cursor
@@ -37,21 +37,18 @@ mutex: workspace
 3. [x] 真实 PI
 4. [x] 双 pool/4 会话
 5. [x] 活验报告（最后一句：继续 M2）
-6. [ ] 条件 M2（U5–U7）
+6. [x] 条件 M2（U5–U7）

 ## 验收标准

 - [x] health + ready 来自本分支镜像
 - [x] 143/新项目刷新 404/409/projection-missing = 0 或报告停止扩面
 - [x] 报告最后一句只能是继续 M2 或停止扩面
+- [x] M2 报告最后一句只能是继续 M3 或停止扩面

 ## 相关链接

 - Checklist: [../checklists/2026-09-14-module-decoupling-refactor-acceptance.md](../checklists/2026-09-14-module-decoupling-refactor-acceptance.md)
 - Prior report: [../../test-reports/2026-09-14-document-reliability-pilot-test-report.md](../../test-reports/2026-09-14-document-reliability-pilot-test-report.md)
 - Live report: [../../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md](../../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md)
-
-## 相关链接
-
- Checklist: [../checklists/2026-09-14-module-decoupling-refactor-acceptance.md](../checklists/2026-09-14-module-decoupling-refactor-acceptance.md)
- Prior report: [../../test-reports/2026-09-14-document-reliability-pilot-test-report.md](../../test-reports/2026-09-14-document-reliability-pilot-test-report.md)
+- M2 report: [../../test-reports/2026-09-14-document-reliability-m2-test-report.md](../../test-reports/2026-09-14-document-reliability-m2-test-report.md)
@@ -31,10 +31,10 @@ mutex: event-delivery

 ## 步骤

-1. [ ] 读取 M1 test report，确认继续 M2 的 go/no-go 已通过。
-2. [ ] 重新分配 Goose 序号并审计 U6/FAV schema 组合。
-3. [ ] 实现 U5–U6，多 app/worker 和 crash matrix 先通过。
-4. [ ] 逐文件审计 FAV 分支，按 U7 边界迁移合格实现。
+1. [x] 读取 M1 test report，确认继续 M2 的 go/no-go 已通过。
+2. [x] 重新分配 Goose 序号并审计 U6/FAV schema 组合。
+3. [x] 实现 U5–U6，多 app/worker 和 crash matrix 先通过。
+4. [x] 逐文件审计 FAV 分支，按 U7 边界迁移合格实现。
 5. [ ] 实现 U8，收敛 taskrun terminal finalize 与 RunManifest。
 6. [ ] 实现 U9 的 checkpoint backfill、corpus、quarantine 和 cleanup gates。
 7. [ ] 完成真实 PI、浏览器、workspace 清理、scratch recovery 和 rebuild 演练。
@@ -70,7 +70,7 @@
 | DOCREV-ACTIVE-DOC-ROUTING | UI-05「当前受控文档」被法规关键词改路由到 `feasibility_reg`，intake 无 pending | **PASS** | [audit](../audit/2026-09-13-document-revision-active-doc-routing.md)；Round20 UI-05 pending 停在 intake V2 | **不改弱 E2E**；不删证据 |
 | DOCREV-QUALITY-STATUS-FP | 行动计划表状态列「待续」被门禁当敷衍，两轮 repair 后 quality_failed 80 | **PASS** | [audit](../audit/2026-09-13-document-revision-quality-status-false-positive.md)；Round20 UI-03 | **不删禁词、不放宽正文**；不删证据 |
 | GOVERNANCE-ACTION-AUTHZ | 文档动作按职责鉴权；未激活 202-blocked；关闭创建直通 | **PASS** | [test-report](../test-reports/2026-09-14-governance-action-level-authz-test-report.md)；[audit 异态](../audit/2026-09-14-planning-with-workflow-key-anomaly.md) | 不改 83 条 planning+key 夹具；none 长 PI 审批链另开 |
-| DOC-RELIABILITY-PILOT | 受控文档写路径跨表非同事务、读路径被 projection 绑架、授权 TOCTOU；刷新/重启后可能 404/409/projection-missing | OPEN | [复核](../audit/2026-09-14-module-decoupling-plan-review.md)；[重构计划](./2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 停止扩面](../test-reports/2026-09-14-document-reliability-pilot-test-report.md)；[M1 活验](../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md) | M1 活验 **继续 M2**。U5–U7 进行中；未签字前禁止 U8–U12 |
+| DOC-RELIABILITY-PILOT | 受控文档写路径跨表非同事务、读路径被 projection 绑架、授权 TOCTOU；刷新/重启后可能 404/409/projection-missing | OPEN | [复核](../audit/2026-09-14-module-decoupling-plan-review.md)；[重构计划](./2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 停止扩面](../test-reports/2026-09-14-document-reliability-pilot-test-report.md)；[M1 活验](../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md)；[M2](../test-reports/2026-09-14-document-reliability-m2-test-report.md) | M1 活验 **继续 M2**。M2 **继续 M3**。禁止在 M3 签字前写 U8–U12 业务代码 |

 ---

@@ -27,7 +27,7 @@
 | PI Runner / 配置链 | pi-agent + MiniMax 真实链路 | done | [test piagent](../test-reports/2026-09-13-codex-audit-p0-remediation-test-report.md)；[container-env](../test-reports/2026-09-13-container-env-configuration-test-report.md) | — | `pi-agent` |
 | 三环境运维 | dev/test/main + 共享 KB | done | [PROJECT.md](../../PROJECT.md) §4；四环境 healthy | — | `infra` |
 | CI / E2E | PG 集成 + 真实 PI E2E | partial | [gap-matrix BUG-08](../remediation/gap-matrix.md)；[test pg-ci](../test-reports/2026-09-12-pg-ci-soak-e2e-test-report.md)；[运行时 UI Round20](../test-reports/2026-09-14-document-revision-runtime-ui-test-report.md) | CI `TEST_DATABASE_URL` 隔离库仍缺；文档运行时真实 UI 已按 UI_PHASE 分文件且 post-restart 断言最终 A1 正文。`-race` 全包并行 TempDir flake 为基建残留 | `ci` |
-| 模块解耦与可靠事件 | 文档可靠性纵向试点、跨属主事务、多副本互斥、FAV 与选择性模块化 | partial | [架构](../system-design/2026-09-14-module-decoupling-architecture.md)；[ADR](../adr/2026-09-14-modular-monolith-decoupling.md)；[重构计划](../remediation/2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 停止扩面](../test-reports/2026-09-14-document-reliability-pilot-test-report.md)；[M1 活验](../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md) | U1–U4 活验 PASS（rebuild + 真实 PI + 浏览器 + 双 pool/4 会话）。活验最后一句 **继续 M2**。正在 U5–U7 | `workspace` |
+| 模块解耦与可靠事件 | 文档可靠性纵向试点、跨属主事务、多副本互斥、FAV 与选择性模块化 | partial | [架构](../system-design/2026-09-14-module-decoupling-architecture.md)；[ADR](../adr/2026-09-14-modular-monolith-decoupling.md)；[重构计划](../remediation/2026-09-14-module-decoupling-refactor-plan.md)；[试点任务](../ops/short-term/2026-09-14-document-reliability-pilot.md)；[M1 停止扩面](../test-reports/2026-09-14-document-reliability-pilot-test-report.md)；[M1 活验](../test-reports/2026-09-14-document-reliability-pilot-live-test-report.md)；[M2](../test-reports/2026-09-14-document-reliability-m2-test-report.md) | U5–U7 PASS（WorkspaceRef/fencing、耐久投递、按文件 FAV）。活验 **继续 M2**；M2 最后一句 **继续 M3**。未开工 U8–U12 | `workspace` |

 ---

@@ -0,0 +1,131 @@
+# 文档可靠性 M2（U5–U7）测试报告
+
+## 一、 测试背景 (Background)
+
+M1 活验报告最后一句为 **继续 M2**（[2026-09-14-document-reliability-pilot-live-test-report.md](./2026-09-14-document-reliability-pilot-live-test-report.md)）。上一份「停止扩面」试点报告保持原句，不改写。本轮只实施并验证 U5 WorkspaceRef、U6 耐久投递、U7 按文件摘取 FAV，并给出能否开工 M3 的停走句。
+
+## 二、 测试目标 (Test Objectives)
+
+- 2/4 dispatcher 无双 owner；crash-before/after-side-effect/ack 可恢复。
+- 乱序 aggregate version 不越过缺号。
+- 跨项目事件 / 坏 digest / 伪造 producer → quarantine；auth/integrity 立即死信；attempt 12 后死信。
+- `SKIP LOCKED` 只用于 claim。
+- 业务终态、staging、outbox 同事务；失败回滚无泄漏。
+- union-deny；中间态（prompt/tool_trace/scratch）准入率 0。
+- `FAV_DEGRADED_READ` 默认 false；授权成功之后才允许 degraded read。
+- Goose 00034–00036 重取号；组合 Up+Down；禁止把 FAV 树的 00034 原样合入。
+- 占槽后主仓 rebuild；health/ready 为 schema 36，无路径泄漏。
+
+## 三、 测试方案与环境 (Test Plan & Environment)
+
+| 项 | 值 |
+|----|-----|
+| OS | Linux 7.0.0-31-generic |
+| Go | 本机 `go test`；容器 `agent-dev-app` |
+| 合入 | 主仓 `dev` `--no-ff` `refactor/document-reliability-pilot` → `0872d8f` |
+| 部署 | 主仓 `./scripts/env-service.sh dev rebuild`（禁止 worktree 内 env-service；禁止 `compose restart` 当证据） |
+| Compose | 项目 `agent-dev`，HTTP `:8080` |
+| Agent | `agent_backend=pi-agent` |
+| Schema | **36**（00034 fencing + 00035 envelopes + 00036 FAV） |
+| `FAV_DEGRADED_READ` | 宿主与容器均 unset / 默认 false |
+| PostgreSQL | 隔离库 `agent_rel_m2`（`shuimu-system-pg-test:5434`），另建 `agent_rel_m2_goose` 做 Down；测完 `DROP`；禁止 `agent_system_dev/test/main` |
+| 项目 143 | **只读**；本轮未 terminate，未改 workflow-plan |
+| 证据 | `.doc/test-reports/assets/2026-09-14-document-reliability-m2/` |
+
+镜像身份：`app_image=sha256:8ab9f63a05274e08d55322e162f8fec3f5822bd3e14375376df856308329b511`。见 `rebuild-health-ready.txt`。
+
+## 四、 预期结果 (Expected Results)
+
+| 栏 | 期望 |
+|----|------|
+| Unit | WorkspaceRef 无物理路径；旧 fencing 被拒；事务内禁止文件 I/O；2/4 dispatcher 单 owner；gap 不跳号；中间态准入 0 |
+| PostgreSQL | 00034–00036 Down 到 33 后再 Up；outbox+staging 同 TX，失败零泄漏 |
+| 故障注入 | crash-before/after ack 无双副作用；attempt 12 死信 |
+| 真实 PI | 本轮不重跑编制；rebuild 后 ready 仍为真实 `pi-agent` |
+| 真实浏览器 | 本轮不重跑 Playwright；web 单测 + production build 必须绿 |
+| restart/rebuild | health/ready `status=ok`，`schema_version=36`，无路径泄漏，vault 未配置不假绿 |
+| 跨用户 / 授权 | 授权失败不碰 vault；tombstone union-deny |
+
+## 五、 实际测试结果与判定 (Actual Results & Evaluation)
+
+### 5.1 Unit / stub
+
+- **测试输入**: `unset TEST_DATABASE_URL; go test -short ./...`；目标包 `go test -race -short`；`./scripts/arch-check.sh --mode warn`
+- **实际输出**: 全仓 short 包 `ok`。目标包 race：`TestTwoAndFourWorkersNoDoubleOwner`、`TestCrashBeforeAfterAck`、`TestGapDoesNotSkipVersion`、`TestQuarantineBadDigestForgedProducerCrossProject`、`TestAttempt12GoesDeadLetter`、`TestStaleFencingRejected`、`TestEvaluateEligibility_IntermediateAdmissionZero`、`TestTombstoneUnionDeny`、`TestFavDegradedReadDefaultOff` 均为 PASS。`arch-check warn: production gate passed`。`--mode block` 仍会因既有 path/sql_write 例外基线失败（U1 设计；本里程碑新增 import 已清零）。
+- **评价判定**: **PASS**
+- **性能与耗时**: 全仓 short 约 13s；目标包 race 约 3–4s。日志：`go-test-short.txt`、`go-test-m2-packages-race.txt`、`arch-check-warn.txt`
+
+### 5.2 PostgreSQL 事务与并发
+
+- **测试输入**: 隔离库 `TEST_DATABASE_URL` → `TestGooseM2_00034to00036_DownThenUp`、`TestOutboxAndStagingSameTxRollback`
+- **实际输出**:
+
+```
+--- PASS: TestGooseM2_00034to00036_DownThenUp (0.36s)
+--- PASS: TestOutboxAndStagingSameTxRollback (0.01s)
+```
+
+00034–00036 Up 到 36，Down 到 33 后 `event_envelopes`/`final_artifacts`/`lease_fencing_token` 消失，再 Up 回 36。同 UoW 写入 envelope + FAV staging 后故意 `boom`，回滚后两表计数为 0。测完 `DROP DATABASE agent_rel_m2`（goose 子库随测试 Cleanup DROP）。
+- **评价判定**: **PASS**
+- **性能与耗时**: goose 组合约 0.36s。日志：`goose-00034-36-down-up.txt`
+
+### 5.3 故障注入
+
+- **测试输入**: 内存 dispatcher crash/lease 过期/重放；attempt 12；目标包 `-race`
+- **实际输出**: 过期 worker ack 为 `ErrStaleFencing`；后到 worker 副作用恰好 1；inbox 去重。12 次瞬时失败后 status=`dead`。
+- **评价判定**: **PASS**
+- **性能与耗时**: 亚秒。日志：`go-test-m2-packages-race.txt`
+
+### 5.4 真实 PI
+
+- **测试输入**: 本轮不新编制文档。检查 rebuild 后 `/api/v1/ready` 的 `agent_backend`
+- **实际输出**: `agent_backend=pi-agent`，不是 stub。编制活验仍以 M1 报告为准。
+- **评价判定**: **PASS**（继承 M1 活验；本轮验证后端身份与 schema 36 ready）
+- **性能与耗时**: health/ready 亚秒
+
+### 5.5 真实浏览器
+
+- **测试输入**: 本轮未重跑 Playwright（项目 143 只读约束仍在）。`web`：`npm test` + `npm run build`
+- **实际输出**: tsx **365 passed / 0 fail**；vitest **30 passed**；production build `✓ built in 8.07s`（容器 rebuild 内 web build 同样成功）。
+- **评价判定**: **PASS**（页面回归以 M1 活验为准；本轮前端门禁绿）
+- **性能与耗时**: 单测约 1.4s + vitest 0.5s；本地 build 约 8s。日志：`web-unit.txt`、`web-build.txt`
+
+### 5.6 restart / rebuild
+
+- **测试输入**: 占集成槽后主仓 `./scripts/env-service.sh dev rebuild`；`curl -sf http://127.0.0.1:8080/api/v1/health` 与 `/api/v1/ready`
+- **实际输出**: 两者 HTTP 200，body 均为
+
+```
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":36,"schema_ready":true,"task_store_ready":true}
+```
+
+无文件系统路径字段。vault 未配置时 ready 仍按 DB/schema/task_store 判定。
+- **评价判定**: **PASS**
+- **性能与耗时**: rebuild 约 27s。日志：`rebuild-health-ready.txt`、`health.json`、`ready.json`
+
+### 5.7 跨用户 / 授权负例
+
+- **测试输入**: `TestFavDegradedReadOnlyAfterAuthorize`；`TestTombstoneUnionDeny`；跨项目 envelope Apply
+- **实际输出**: 授权失败时 vault `calls=0`；tombstone 读为 `ErrUnionDeny`；跨项目 delivery 为 `quarantine`
+- **评价判定**: **PASS**
+- **性能与耗时**: 亚秒
+
+## 六、 自动化测试套件汇总 (Test Suite Execution)
+
+| 命令 | 结果 |
+|------|------|
+| `go vet ./...` | PASS |
+| `go test -short ./...` | PASS |
+| 隔离库 goose Down/Up + 同事务回滚 | PASS，随后 `DROP DATABASE` |
+| 目标包 `-race` | PASS |
+| `arch-check --mode warn` | PASS |
+| `arch-check --mode block` | 仍因既有例外基线失败（预期；非本里程碑新增违规） |
+| web `npm test` | 365 + 30 PASS |
+| web production build | PASS |
+| 占槽 rebuild + health/ready | PASS，`schema_version=36` |
+
+## 七、 测试结论与后续优化建议 (Conclusion & Next Steps)
+
+U5–U7 的停走项在本轮全部观测为 PASS：dispatcher 无双 owner，崩溃与过期 fencing 可恢复，缺号不跳过，坏 digest/伪造 producer/跨项目进入 quarantine，FAV 中间态准入为 0，union-deny 生效，outbox 与 staging 同事务回滚，Goose 00034–00036 可 Down。`document.agent_version_committed` 已从 `OnOutbox` 正确性路径摘除，改由 `events.EventSink` 在 UoW 内追加。剩余 agent/coordinator 的 `output.md` 字面量仍是 U1 例外基线，属 M3 Workspace 清理范围，不构成本轮扩面失败。未把 `feature/final-artifact-vault` 整支 merge，未启用 `FAV_DEGRADED_READ`。
+
+继续 M3
@@ -0,0 +1,4 @@
+arch-check mode=warn
+boundaries=/home/weichen/projects/Agent-System/.worktrees/refactor-document-reliability-pilot/.doc/system-design/module-boundaries.yaml
+ok  	chat-agent-system/internal/archtest	0.079s
+arch-check warn: production gate passed
@@ -0,0 +1,151 @@
+=== RUN   TestTwoAndFourWorkersNoDoubleOwner
+--- PASS: TestTwoAndFourWorkersNoDoubleOwner (0.00s)
+=== RUN   TestCrashBeforeAfterAck
+--- PASS: TestCrashBeforeAfterAck (0.00s)
+=== RUN   TestGapDoesNotSkipVersion
+--- PASS: TestGapDoesNotSkipVersion (0.00s)
+=== RUN   TestQuarantineBadDigestForgedProducerCrossProject
+--- PASS: TestQuarantineBadDigestForgedProducerCrossProject (0.00s)
+=== RUN   TestAttempt12GoesDeadLetter
+--- PASS: TestAttempt12GoesDeadLetter (0.00s)
+=== RUN   TestAuthAndIntegrityGoDeadLetter
+--- PASS: TestAuthAndIntegrityGoDeadLetter (0.00s)
+=== RUN   TestReplayRequiresScope
+--- PASS: TestReplayRequiresScope (0.00s)
+=== RUN   TestClaimSQLUsesSkipLockedOnlyForClaim
+--- PASS: TestClaimSQLUsesSkipLockedOnlyForClaim (0.00s)
+=== RUN   TestSkipLockedAbsentFromInsertSQL
+--- PASS: TestSkipLockedAbsentFromInsertSQL (0.00s)
+PASS
+ok  	chat-agent-system/internal/events	1.008s
+=== RUN   TestWorkspaceRefHasNoPhysicalPathFields
+--- PASS: TestWorkspaceRefHasNoPhysicalPathFields (0.00s)
+=== RUN   TestCapabilityRejectsBadKeys
+--- PASS: TestCapabilityRejectsBadKeys (0.00s)
+=== RUN   TestCapabilityRejectsSymlinkEscape
+--- PASS: TestCapabilityRejectsSymlinkEscape (0.00s)
+=== RUN   TestStaleFencingRejected
+--- PASS: TestStaleFencingRejected (0.00s)
+=== RUN   TestUnknownSchemaRejected
+--- PASS: TestUnknownSchemaRejected (0.00s)
+=== RUN   TestNoFileIOInsideUnitOfWork
+--- PASS: TestNoFileIOInsideUnitOfWork (0.00s)
+=== RUN   TestCommitProjectionCompleteMarker
+--- PASS: TestCommitProjectionCompleteMarker (0.00s)
+=== RUN   TestLeaseTableRejectsStaleTokenAfterReissue
+--- PASS: TestLeaseTableRejectsStaleTokenAfterReissue (0.00s)
+=== RUN   TestResolver_RejectsPathEscape
+--- PASS: TestResolver_RejectsPathEscape (0.00s)
+PASS
+ok  	chat-agent-system/internal/workspace	1.009s
+=== RUN   TestEvaluateEligibility_Allowlist
+--- PASS: TestEvaluateEligibility_Allowlist (0.00s)
+=== RUN   TestEvaluateEligibility_ApprovedRequiresReviewSnapshot
+--- PASS: TestEvaluateEligibility_ApprovedRequiresReviewSnapshot (0.00s)
+=== RUN   TestEvaluateEligibility_TaskWithoutCompletedTurn
+--- PASS: TestEvaluateEligibility_TaskWithoutCompletedTurn (0.00s)
+=== RUN   TestEvaluateEligibility_SensitiveRejectedBeforeStaging
+--- PASS: TestEvaluateEligibility_SensitiveRejectedBeforeStaging (0.00s)
+=== RUN   TestEvaluateEligibility_CopyOnlyRequiresExplicitPinAfterCompleted
+--- PASS: TestEvaluateEligibility_CopyOnlyRequiresExplicitPinAfterCompleted (0.00s)
+=== RUN   TestEvaluateEligibility_UnknownTypeRejected
+--- PASS: TestEvaluateEligibility_UnknownTypeRejected (0.00s)
+=== RUN   TestEvaluateEligibility_IntermediateAdmissionZero
+--- PASS: TestEvaluateEligibility_IntermediateAdmissionZero (0.00s)
+=== RUN   TestIdempotencyKeyStable
+--- PASS: TestIdempotencyKeyStable (0.00s)
+=== RUN   TestIngestIdempotentAndRejectsNonTerminal
+--- PASS: TestIngestIdempotentAndRejectsNonTerminal (0.00s)
+=== RUN   TestCoverageGateFailClosed
+--- PASS: TestCoverageGateFailClosed (0.00s)
+=== RUN   TestPublisherIdempotentAndCrashSafe
+--- PASS: TestPublisherIdempotentAndCrashSafe (0.00s)
+=== RUN   TestPublisherRejectsBadSHAAndCrossProjectKeys
+--- PASS: TestPublisherRejectsBadSHAAndCrossProjectKeys (0.00s)
+=== RUN   TestFilesystemRefusesRuntimeDataDev
+--- PASS: TestFilesystemRefusesRuntimeDataDev (0.00s)
+=== RUN   TestTombstoneUnionDeny
+--- PASS: TestTombstoneUnionDeny (0.00s)
+=== RUN   TestLastReferencePurgeAndLegalHold
+--- PASS: TestLastReferencePurgeAndLegalHold (0.00s)
+=== RUN   TestFilesystemIdentityMismatch
+--- PASS: TestFilesystemIdentityMismatch (0.00s)
+=== RUN   TestUnpublishedWithoutCommitMarkerInvisible
+--- PASS: TestUnpublishedWithoutCommitMarkerInvisible (0.00s)
+=== RUN   TestPublisherRetriesAfterMissingCommit
+--- PASS: TestPublisherRetriesAfterMissingCommit (0.00s)
+=== RUN   TestDegradedPayloadDoesNotWrite
+--- PASS: TestDegradedPayloadDoesNotWrite (0.00s)
+=== RUN   TestRecoverRejectsOperationalDSN
+--- PASS: TestRecoverRejectsOperationalDSN (0.00s)
+=== RUN   TestRecoverPlanGates
+--- PASS: TestRecoverPlanGates (0.00s)
+=== RUN   TestApplyRecoverAsCollectionWritesScratchAndSkipsDenied
+--- PASS: TestApplyRecoverAsCollectionWritesScratchAndSkipsDenied (0.00s)
+PASS
+ok  	chat-agent-system/internal/artifactvault	1.013s
+=== RUN   TestGetServesLedgerWhenProjectionMissing
+--- PASS: TestGetServesLedgerWhenProjectionMissing (0.00s)
+=== RUN   TestGetAlignedWhenProjectionMatches
+--- PASS: TestGetAlignedWhenProjectionMatches (0.00s)
+=== RUN   TestGetDriftStillServesLedger
+--- PASS: TestGetDriftStillServesLedger (0.00s)
+=== RUN   TestGetEmptyProjectionStillServesLedger
+--- PASS: TestGetEmptyProjectionStillServesLedger (0.00s)
+=== RUN   TestGetLedgerMissing
+--- PASS: TestGetLedgerMissing (0.00s)
+=== RUN   TestGetIsReadOnly
+--- PASS: TestGetIsReadOnly (0.00s)
+=== RUN   TestGetFailClosed
+--- PASS: TestGetFailClosed (0.00s)
+=== RUN   TestBatchGetLimitsAndCrossProject
+--- PASS: TestBatchGetLimitsAndCrossProject (0.00s)
+=== RUN   TestFavDegradedReadDefaultOff
+--- PASS: TestFavDegradedReadDefaultOff (0.00s)
+=== RUN   TestFavDegradedReadOnlyAfterAuthorize
+--- PASS: TestFavDegradedReadOnlyAfterAuthorize (0.00s)
+PASS
+ok  	chat-agent-system/internal/docquery	1.009s
+=== RUN   TestDocGov_DatabaseIntegration
+--- PASS: TestDocGov_DatabaseIntegration (0.02s)
+=== RUN   TestDocGov_AuthorPermissionsAndLocking
+--- PASS: TestDocGov_AuthorPermissionsAndLocking (0.00s)
+=== RUN   TestDocGov_ClaimingMechanismAndProposal
+--- PASS: TestDocGov_ClaimingMechanismAndProposal (0.00s)
+=== RUN   TestDocGov_FullApprovalLifecycleAndRejectRollback
+--- PASS: TestDocGov_FullApprovalLifecycleAndRejectRollback (0.00s)
+=== RUN   TestMarkProposalApplied_MissingOrNotApproved
+--- PASS: TestMarkProposalApplied_MissingOrNotApproved (0.00s)
+=== RUN   TestMarkProposalApplied_IdempotentAfterApprove
+--- PASS: TestMarkProposalApplied_IdempotentAfterApprove (0.00s)
+=== RUN   TestEditLeaseMutexAndCommentGate
+--- PASS: TestEditLeaseMutexAndCommentGate (0.00s)
+=== RUN   TestSameHolderRenewLease
+--- PASS: TestSameHolderRenewLease (0.00s)
+=== RUN   TestStaleFencingRejectedAfterRenew
+--- PASS: TestStaleFencingRejectedAfterRenew (0.00s)
+=== RUN   TestAssertHumanCanEdit_ChecksDutyBeforeLease
+--- PASS: TestAssertHumanCanEdit_ChecksDutyBeforeLease (0.00s)
+=== RUN   TestReadDocumentContent_TypedErrors
+--- PASS: TestReadDocumentContent_TypedErrors (0.00s)
+=== RUN   TestSaveDocumentContent_CanonicalBytesMatchHash
+--- PASS: TestSaveDocumentContent_CanonicalBytesMatchHash (0.00s)
+=== RUN   TestListWorkflowDocumentsIncludesActiveLease
+--- PASS: TestListWorkflowDocumentsIncludesActiveLease (0.00s)
+=== RUN   TestListWorkflowDocumentsIncludesAuthoritativeDuties
+--- PASS: TestListWorkflowDocumentsIncludesAuthoritativeDuties (0.00s)
+PASS
+ok  	chat-agent-system/internal/docgov	1.025s
+=== RUN   TestHumanEditCharacterizationSameETagOneWinner
+--- PASS: TestHumanEditCharacterizationSameETagOneWinner (0.00s)
+=== RUN   TestApproveRejectCharacterizationOneTerminal
+--- PASS: TestApproveRejectCharacterizationOneTerminal (0.00s)
+=== RUN   TestIdempotentHumanEditSameDigest
+--- PASS: TestIdempotentHumanEditSameDigest (0.00s)
+=== RUN   TestReauthDeniesWrongAuthor
+--- PASS: TestReauthDeniesWrongAuthor (0.00s)
+=== RUN   TestOutboxAndStagingSameTxRollback
+2026/09/14 15:58:14 goose: no migrations to run. current version: 36
+--- PASS: TestOutboxAndStagingSameTxRollback (0.02s)
+PASS
+ok  	chat-agent-system/internal/app/docflow	1.033s
@@ -0,0 +1,46 @@
+ok  	chat-agent-system/cmd/bizdev-cli	2.354s
+ok  	chat-agent-system/cmd/document-content-reconcile	(cached)
+?   	chat-agent-system/cmd/document-revision-backfill	[no test files]
+?   	chat-agent-system/cmd/recategorize	[no test files]
+?   	chat-agent-system/cmd/server	[no test files]
+ok  	chat-agent-system/internal/agent	1.214s
+ok  	chat-agent-system/internal/app/docflow	(cached)
+ok  	chat-agent-system/internal/app/uow	(cached)
+ok  	chat-agent-system/internal/archtest	(cached)
+ok  	chat-agent-system/internal/artifactvault	(cached)
+ok  	chat-agent-system/internal/auth	(cached)
+ok  	chat-agent-system/internal/authz	(cached)
+ok  	chat-agent-system/internal/bizdev	(cached)
+ok  	chat-agent-system/internal/chat	(cached)
+ok  	chat-agent-system/internal/config	(cached)
+ok  	chat-agent-system/internal/coordinator	(cached)
+ok  	chat-agent-system/internal/ctxmgr	(cached)
+ok  	chat-agent-system/internal/db	(cached)
+ok  	chat-agent-system/internal/docduty	(cached)
+ok  	chat-agent-system/internal/docgov	(cached)
+ok  	chat-agent-system/internal/docquery	(cached)
+ok  	chat-agent-system/internal/docrevision	0.005s
+ok  	chat-agent-system/internal/events	(cached)
+ok  	chat-agent-system/internal/freedoc	(cached)
+ok  	chat-agent-system/internal/fsutil	(cached)
+ok  	chat-agent-system/internal/intent	(cached)
+ok  	chat-agent-system/internal/kb	(cached)
+ok  	chat-agent-system/internal/notification	(cached)
+?   	chat-agent-system/internal/observability	[no test files]
+ok  	chat-agent-system/internal/projectcontext	(cached)
+ok  	chat-agent-system/internal/projectinstance	(cached)
+ok  	chat-agent-system/internal/projectworkflow	(cached)
+ok  	chat-agent-system/internal/quote	(cached)
+ok  	chat-agent-system/internal/replyexport	(cached)
+ok  	chat-agent-system/internal/server	9.950s
+ok  	chat-agent-system/internal/squad	(cached)
+ok  	chat-agent-system/internal/storage	(cached)
+ok  	chat-agent-system/internal/stream	(cached)
+ok  	chat-agent-system/internal/taskrun	(cached)
+ok  	chat-agent-system/internal/template	0.672s
+ok  	chat-agent-system/internal/upload	(cached)
+?   	chat-agent-system/internal/workflow	[no test files]
+ok  	chat-agent-system/internal/workflow/runtime	(cached)
+ok  	chat-agent-system/internal/workflowdef	(cached)
+ok  	chat-agent-system/internal/workspace	(cached)
+?   	chat-agent-system/templates	[no test files]
@@ -0,0 +1,49 @@
+=== RUN   TestGooseM2_00034to00036_DownThenUp
+2026/09/14 15:42:39 OK   00001_baseline.sql (55.45ms)
+2026/09/14 15:42:39 OK   00002_2026-09-09-doc-edit-lease.sql (1.73ms)
+2026/09/14 15:42:39 OK   00003_2026-09-09-uq-context-memory-chunk-hash.sql (1.23ms)
+2026/09/14 15:42:39 OK   00004_2026-09-10-chat-daily-digests-and-search.sql (588.73µs)
+2026/09/14 15:42:39 OK   00005_2026-09-10-chat-messages-day-window.sql (773.81µs)
+2026/09/14 15:42:39 OK   00006_2026-09-11-chat-read-positions.sql (401.67µs)
+2026/09/14 15:42:39 OK   00007_2026-09-11-chat-turns.sql (1.36ms)
+2026/09/14 15:42:39 OK   00008_2026-09-11-freeform-documents.sql (8.81ms)
+2026/09/14 15:42:39 OK   00009_2026-09-11-message-export-policy.sql (3.85ms)
+2026/09/14 15:42:39 OK   00010_2026-09-11-project-workflows-and-lineage.sql (15.78ms)
+2026/09/14 15:42:39 OK   00011_2026-09-11-seed-ten-projects.sql (7.03ms)
+2026/09/14 15:42:39 OK   00012_2026-09-11-seed-ten-projects-chat.sql (42.66ms)
+2026/09/14 15:42:39 OK   00013_2026-09-11-task-run-lineage.sql (1.68ms)
+2026/09/14 15:42:39 OK   00014_project_members.sql (3.99ms)
+2026/09/14 15:42:39 OK   00015_2026-09-12-iam-core.sql (18.17ms)
+2026/09/14 15:42:39 OK   00016_2026-09-12-workflow-definitions-and-templates.sql (13.48ms)
+2026/09/14 15:42:39 OK   00017_2026-09-12-project-workflow-instances.sql (16.3ms)
+2026/09/14 15:42:39 OK   00018_2026-09-12-outbox-notifications-stage-advance.sql (9.41ms)
+2026/09/14 15:42:39 OK   00019_2026-09-12-task-runs-events.sql (5.71ms)
+2026/09/14 15:42:39 OK   00020_2026-09-12-task-run-worker-lease.sql (1.36ms)
+2026/09/14 15:42:39 OK   00021_2026-09-12-iam-hardening.sql (2.87ms)
+2026/09/14 15:42:39 OK   00022_2026-09-12-workflow-schema-v2.sql (2.13ms)
+2026/09/14 15:42:39 OK   00023_2026-09-12-instance-integrity.sql (1.15ms)
+2026/09/14 15:42:39 OK   00024_2026-09-12-workflow-catalog-governance.sql (6.99ms)
+2026/09/14 15:42:39 OK   00025_2026-09-13-sync-seed-sequences.sql (999.72µs)
+2026/09/14 15:42:39 OK   00026_2026-09-13-chat-message-scope.sql (2.92ms)
+2026/09/14 15:42:39 OK   00027_2026-09-13-chat-message-scope-backfill.sql (2.68ms)
+2026/09/14 15:42:39 OK   00028_2026-09-13-document-revisions.sql (18.48ms)
+2026/09/14 15:42:39 OK   00029_2026-09-13-freeform-client-key.sql (1.2ms)
+2026/09/14 15:42:39 OK   00030_2026-09-13-task-run-pending-author-confirmation.sql (1.06ms)
+2026/09/14 15:42:39 OK   00031_2026-09-13-project-member-document-duty.sql (1.79ms)
+2026/09/14 15:42:39 OK   00032_2026-09-14-document-revision-migration-repair.sql (667.09µs)
+2026/09/14 15:42:39 OK   00033_2026-09-14-task-run-blocked-pending-governance.sql (454.17µs)
+2026/09/14 15:42:39 OK   00034_2026-09-14-workspace-lease-fencing.sql (550.63µs)
+2026/09/14 15:42:39 OK   00035_2026-09-14-durable-event-delivery.sql (5.07ms)
+2026/09/14 15:42:39 OK   00036_2026-09-14-final-artifact-vault.sql (8.26ms)
+2026/09/14 15:42:39 goose: successfully migrated database to version: 36
+2026/09/14 15:42:39 OK   00036_2026-09-14-final-artifact-vault.sql (2.96ms)
+2026/09/14 15:42:39 OK   00035_2026-09-14-durable-event-delivery.sql (1.57ms)
+2026/09/14 15:42:39 OK   00034_2026-09-14-workspace-lease-fencing.sql (539.81µs)
+2026/09/14 15:42:39 goose: no migrations to run. current version: 33
+2026/09/14 15:42:39 OK   00034_2026-09-14-workspace-lease-fencing.sql (1.09ms)
+2026/09/14 15:42:39 OK   00035_2026-09-14-durable-event-delivery.sql (6.66ms)
+2026/09/14 15:42:39 OK   00036_2026-09-14-final-artifact-vault.sql (10.32ms)
+2026/09/14 15:42:39 goose: successfully migrated database to version: 36
+--- PASS: TestGooseM2_00034to00036_DownThenUp (0.36s)
+PASS
+ok  	chat-agent-system/internal/db	0.361s
@@ -0,0 +1 @@
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":36,"schema_ready":true,"task_store_ready":true}
@@ -0,0 +1 @@
+{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":36,"schema_ready":true,"task_store_ready":true}
@@ -0,0 +1,6 @@
+rebuild_ok=1
+app_image=sha256:8ab9f63a05274e08d55322e162f8fec3f5822bd3e14375376df856308329b511
+FAV_DEGRADED_READ=<unset>
+health={"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":36,"schema_ready":true,"task_store_ready":true}
+ready={"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":36,"schema_ready":true,"task_store_ready":true}
+container_FAV_DEGRADED_READ=(empty means unset / default false)
@@ -0,0 +1,136 @@
+
+> shuimu-workbench@1.0.0 build
+> tsc && vite build
+
+vite v7.3.6 building client environment for production...
+transforming...
+✓ 4113 modules transformed.
+rendering chunks...
+computing gzip size...
+dist/index.html                                           0.89 kB │ gzip:     0.52 kB
+dist/assets/KaTeX_Size3-Regular-CTq5MqoE.woff             4.42 kB
+dist/assets/KaTeX_Size4-Regular-Dl5lxZxV.woff2            4.93 kB
+dist/assets/KaTeX_Size2-Regular-Dy4dx90m.woff2            5.21 kB
+dist/assets/KaTeX_Size1-Regular-mCD8mA8B.woff2            5.47 kB
+dist/assets/KaTeX_Size4-Regular-BF-4gkZK.woff             5.98 kB
+dist/assets/KaTeX_Size2-Regular-oD1tc_U0.woff             6.19 kB
+dist/assets/KaTeX_Size1-Regular-C195tn64.woff             6.50 kB
+dist/assets/KaTeX_Caligraphic-Regular-Di6jR-x-.woff2      6.91 kB
+dist/assets/KaTeX_Caligraphic-Bold-Dq_IR9rO.woff2         6.91 kB
+dist/assets/KaTeX_Size3-Regular-DgpXs0kz.ttf              7.59 kB
+dist/assets/KaTeX_Caligraphic-Regular-CTRA-rTL.woff       7.66 kB
+dist/assets/KaTeX_Caligraphic-Bold-BEiXGLvX.woff          7.72 kB
+dist/assets/KaTeX_Script-Regular-D3wIWfF6.woff2           9.64 kB
+dist/assets/KaTeX_SansSerif-Regular-DDBCnlJ7.woff2       10.34 kB
+dist/assets/KaTeX_Size4-Regular-DWFBv043.ttf             10.36 kB
+dist/assets/KaTeX_Script-Regular-D5yQViql.woff           10.59 kB
+dist/assets/KaTeX_Fraktur-Regular-CTYiF6lA.woff2         11.32 kB
+dist/assets/KaTeX_Fraktur-Bold-CL6g_b3V.woff2            11.35 kB
+dist/assets/KaTeX_Size2-Regular-B7gKUWhC.ttf             11.51 kB
+dist/assets/KaTeX_SansSerif-Italic-C3H0VqGB.woff2        12.03 kB
+dist/assets/KaTeX_SansSerif-Bold-D1sUS0GD.woff2          12.22 kB
+dist/assets/KaTeX_Size1-Regular-Dbsnue_I.ttf             12.23 kB
+dist/assets/KaTeX_SansSerif-Regular-CS6fqUqJ.woff        12.32 kB
+dist/assets/KaTeX_Caligraphic-Regular-wX97UBjC.ttf       12.34 kB
+dist/assets/KaTeX_Caligraphic-Bold-ATXxdsX0.ttf          12.37 kB
+dist/assets/KaTeX_Fraktur-Regular-Dxdc4cR9.woff          13.21 kB
+dist/assets/KaTeX_Fraktur-Bold-BsDP51OF.woff             13.30 kB
+dist/assets/KaTeX_Typewriter-Regular-CO6r4hn1.woff2      13.57 kB
+dist/assets/KaTeX_SansSerif-Italic-DN2j7dab.woff         14.11 kB
+dist/assets/KaTeX_SansSerif-Bold-DbIhKOiC.woff           14.41 kB
+dist/assets/KaTeX_Typewriter-Regular-C0xS9mPB.woff       16.03 kB
+dist/assets/KaTeX_Math-BoldItalic-CZnvNsCZ.woff2         16.40 kB
+dist/assets/KaTeX_Math-Italic-t53AETM-.woff2             16.44 kB
+dist/assets/KaTeX_Script-Regular-C5JkGWo-.ttf            16.65 kB
+dist/assets/KaTeX_Main-BoldItalic-DxDJ3AOS.woff2         16.78 kB
+dist/assets/KaTeX_Main-Italic-NWA7e6Wa.woff2             16.99 kB
+dist/assets/KaTeX_Math-BoldItalic-iY-2wyZ7.woff          18.67 kB
+dist/assets/KaTeX_Math-Italic-DA0__PXp.woff              18.75 kB
+dist/assets/KaTeX_Main-BoldItalic-SpSLRI95.woff          19.41 kB
+dist/assets/KaTeX_SansSerif-Regular-BNo7hRIc.ttf         19.44 kB
+dist/assets/KaTeX_Fraktur-Regular-CB_wures.ttf           19.57 kB
+dist/assets/KaTeX_Fraktur-Bold-BdnERNNW.ttf              19.58 kB
+dist/assets/KaTeX_Main-Italic-BMLOBm91.woff              19.68 kB
+dist/assets/KaTeX_SansSerif-Italic-YYjJ1zSn.ttf          22.36 kB
+dist/assets/KaTeX_SansSerif-Bold-CFMepnvq.ttf            24.50 kB
+dist/assets/KaTeX_Main-Bold-Cx986IdX.woff2               25.32 kB
+dist/assets/KaTeX_Main-Regular-B22Nviop.woff2            26.27 kB
+dist/assets/KaTeX_Typewriter-Regular-D3Ib7_Hf.ttf        27.56 kB
+dist/assets/KaTeX_AMS-Regular-BQhdFMY1.woff2             28.08 kB
+dist/assets/KaTeX_Main-Bold-Jm3AIy58.woff                29.91 kB
+dist/assets/KaTeX_Main-Regular-Dr94JaBh.woff             30.77 kB
+dist/assets/KaTeX_Math-BoldItalic-B3XSjfu4.ttf           31.20 kB
+dist/assets/KaTeX_Math-Italic-flOr_0UB.ttf               31.31 kB
+dist/assets/KaTeX_Main-BoldItalic-DzxPMmG6.ttf           32.97 kB
+dist/assets/KaTeX_AMS-Regular-DMm9YOAa.woff              33.52 kB
+dist/assets/KaTeX_Main-Italic-3WenGoN9.ttf               33.58 kB
+dist/assets/KaTeX_Main-Bold-waoOVXN0.ttf                 51.34 kB
+dist/assets/KaTeX_Main-Regular-ypZvNtVU.ttf              53.58 kB
+dist/assets/KaTeX_AMS-Regular-DRggAlZN.ttf               63.63 kB
+dist/assets/index-DhpBfxvE.css                           35.50 kB │ gzip:     9.76 kB
+dist/assets/channel-C1l-ACMg.js                           0.11 kB │ gzip:     0.12 kB
+dist/assets/init-Gi6I4Gst.js                              0.15 kB │ gzip:     0.13 kB
+dist/assets/chunk-2Q5K7J3B-DuZQdlra.js                    0.19 kB │ gzip:     0.16 kB
+dist/assets/chunk-JWPE2WC7-DaBc76oD.js                    0.22 kB │ gzip:     0.17 kB
+dist/assets/chunk-XXDRQBXY-DvZ0Q7I3.js                    0.22 kB │ gzip:     0.20 kB
+dist/assets/chunk-5VM5RSS4-RDpp3N_c.js                    0.36 kB │ gzip:     0.26 kB
+dist/assets/stateDiagram-v2-MP3YSRHH-BPg2dURP.js          0.39 kB │ gzip:     0.28 kB
+dist/assets/classDiagram-ZZMXUADV-wSNuWSuL.js             0.43 kB │ gzip:     0.30 kB
+dist/assets/classDiagram-v2-VYDZK3BY-wSNuWSuL.js          0.43 kB │ gzip:     0.30 kB
+dist/assets/chunk-POPQ4Y6H-DKtBLPt4.js                    0.50 kB │ gzip:     0.35 kB
+dist/assets/swimlanesDiagram-VR7AAH4N-CYMMo-ek.js         0.51 kB │ gzip:     0.35 kB
+dist/assets/infoDiagram-27XIBGKW-6PGFtTF0.js              0.55 kB │ gzip:     0.38 kB
+dist/assets/sizeCapture-INFHLROL-Bn0It-FC.js              0.90 kB │ gzip:     0.51 kB
+dist/assets/ordinal-Cboi1Yqb.js                           1.19 kB │ gzip:     0.57 kB
+dist/assets/railroadDiagram-O6MQD6OU-BoDzeZZj.js          1.57 kB │ gzip:     0.73 kB
+dist/assets/abnfDiagram-VCTEODGH-B4iyQ5mg.js              1.77 kB │ gzip:     0.87 kB
+dist/assets/chunk-F27PBJKO-ClQEPPC2.js                    1.88 kB │ gzip:     0.82 kB
+dist/assets/pegDiagram-XKGWAZYB-CrBRvl1R.js               1.92 kB │ gzip:     0.90 kB
+dist/assets/ebnfDiagram-PWID7BFC-DDa5Hvmt.js              1.97 kB │ gzip:     0.86 kB
+dist/assets/arc-DjbWu0Qz.js                               3.43 kB │ gzip:     1.48 kB
+dist/assets/diagram-Z3DM3KII-Z8xuePqO.js                  4.18 kB │ gzip:     1.81 kB
+dist/assets/defaultLocale-DX6XiGOO.js                     4.69 kB │ gzip:     2.18 kB
+dist/assets/linear-BRswYrpC.js                            5.65 kB │ gzip:     2.30 kB
+dist/assets/diagram-UQ7AKVKN-CuYiLDyU.js                  6.04 kB │ gzip:     2.60 kB
+dist/assets/pieDiagram-E7YTZNPT-DfbcF04r.js               6.26 kB │ gzip:     2.60 kB
+dist/assets/diagram-S7CK7UJ4-DYftiUqW.js                  8.18 kB │ gzip:     3.65 kB
+dist/assets/cynefinDiagram-5FMLGOSQ-phtJznP7.js          10.06 kB │ gzip:     3.61 kB
+dist/assets/stateDiagram-D77RDMKH-kHoS2Qwx.js            10.33 kB │ gzip:     3.61 kB
+dist/assets/dagre-GXQ25YYZ-BOdYzn1o.js                   10.64 kB │ gzip:     4.01 kB
+dist/assets/diagram-VSXAHHWV-C-m89EH2.js                 10.68 kB │ gzip:     4.11 kB
+dist/assets/chunk-SVP7TREG-D14NcRNP.js                   15.73 kB │ gzip:     4.41 kB
+dist/assets/diagram-VX7I27RA-Byin7Vxb.js                 15.92 kB │ gzip:     5.68 kB
+dist/assets/ishikawaDiagram-5VMMS53U-DgnTjA02.js         17.43 kB │ gzip:     6.62 kB
+dist/assets/kanban-definition-UXKFOSKX-D2KGPhCl.js       20.26 kB │ gzip:     7.18 kB
+dist/assets/mindmap-definition-YA3MSWOX-DpENgpjr.js      23.14 kB │ gzip:     7.80 kB
+dist/assets/sankeyDiagram-P5KCCOFB-672StkM7.js           23.16 kB │ gzip:     8.54 kB
+dist/assets/journeyDiagram-3NMN7TZE-DYb6dIJA.js          23.54 kB │ gzip:     8.33 kB
+dist/assets/wardleyDiagram-VM6X3IG4-CoM3hCaQ.js          25.47 kB │ gzip:     6.77 kB
+dist/assets/gitGraphDiagram-WWUBYQGX-BsAsAHom.js         29.38 kB │ gzip:     8.68 kB
+dist/assets/erDiagram-RLTQ6QDP-C_acE67D.js               30.76 kB │ gzip:    10.57 kB
+dist/assets/timeline-definition-24CTP7MA-Dc2couOi.js     30.79 kB │ gzip:    10.13 kB
+dist/assets/requirementDiagram-BXWQKSXE-C9iCZQJU.js      30.97 kB │ gzip:     9.70 kB
+dist/assets/quadrantDiagram-AXDQQJYC-Cgto6C_O.js         33.98 kB │ gzip:     9.95 kB
+dist/assets/layout-CARh76zQ.js                           35.43 kB │ gzip:    12.74 kB
+dist/assets/chunk-IMKFNOWR-atRSi145.js                   38.07 kB │ gzip:    12.51 kB
+dist/assets/blockDiagram-I7D4REHJ-DFpDkHym.js            41.72 kB │ gzip:    13.56 kB
+dist/assets/vennDiagram-4TSXK5OY-CtR9rLg4.js             41.93 kB │ gzip:    15.67 kB
+dist/assets/xychartDiagram-S5SC5T6Z-KCxvhWwc.js          44.47 kB │ gzip:    12.58 kB
+dist/assets/chunk-TICWLB2K-CJ2Q0vEG.js                   49.17 kB │ gzip:    15.74 kB
+dist/assets/flowDiagram-HODETNUW-O0E_tnZ2.js             61.84 kB │ gzip:    19.87 kB
+dist/assets/c4Diagram-7LVT6UL2-AO2Q_QUK.js               65.44 kB │ gzip:    18.77 kB
+dist/assets/ganttDiagram-EL5Y4UJY-CQ6Wj3Gz.js            69.66 kB │ gzip:    23.54 kB
+dist/assets/cose-bilkent-JH36ORCC-Dnvv1104.js            81.66 kB │ gzip:    22.46 kB
+dist/assets/swimlanes-42K2YHIH-DigQn3Se.js              115.76 kB │ gzip:    42.49 kB
+dist/assets/sequenceDiagram-WJ2MYXX4-CFEiU-TA.js        116.93 kB │ gzip:    31.11 kB
+dist/assets/architectureDiagram-5GKGNRK7-CVaGGE2f.js    151.79 kB │ gzip:    43.12 kB
+dist/assets/katex-HP8lGamR.js                           261.31 kB │ gzip:    77.57 kB
+dist/assets/cytoscape.esm-BB4DxJjf.js                   443.04 kB │ gzip:   141.98 kB
+dist/assets/cynefin-OW5HDTMX-BQThPlIG.js                687.91 kB │ gzip:   154.14 kB
+dist/assets/index-DogUjae5.js                         5,743.77 kB │ gzip: 1,646.28 kB
+
+(!) Some chunks are larger than 500 kB after minification. Consider:
+- Using dynamic import() to code-split the application
+- Use build.rollupOptions.output.manualChunks to improve chunking: https://rollupjs.org/configuration-options/#output-manualchunks
+- Adjust chunk size limit for this warning via build.chunkSizeWarningLimit.
+✓ built in 8.07s
@@ -0,0 +1,460 @@
+
+> shuimu-workbench@1.0.0 test
+> tsx --test "src/**/!(*InteractiveCard*|*chatWindowArtifact*|*deliverableSync*).test.ts" && vitest run src/components/chat/InteractiveCard.test.ts src/components/chat/chatWindowArtifact.test.ts src/components/chat/deliverableSync.test.ts
+
+✔ AuthClient: 基础登录与 .env 超级管理员鉴权 (4.03261ms)
+✔ AuthClient: 自主注册受控流程（仅填用户名密码姓名，职位强制绑定访客待指派） (0.541774ms)
+✔ AuthClient: 开启注册需审批时，注册账号处于待审状态并禁止登录 (0.530324ms)
+✔ AuthClient: 管理员创建账号必须在首次登录修改密码 (0.282631ms)
+✔ mapUserAccount: snake_case Go contract → camelCase (0.701849ms)
+✔ mapUserAccount: prefers snake_case when both present (0.117726ms)
+✔ mapLoginResult + mapMeResult map nested user and top-level must_change_password (0.535364ms)
+✔ mapUserAccountList maps admin users list (0.124796ms)
+✔ AuthClient.login + fetchMe map real snake_case wire payloads (19.966627ms)
+✔ shouldAutoRetryChat: disabled until idempotency (0.725618ms)
+✔ shouldAutoRetryTask: transient only, max 2 (0.145346ms)
+✔ shouldAutoRetryTask: document busy never retries (0.078718ms)
+✔ shouldAutoRetry alias delegates to task path (0.082518ms)
+✔ autoRetryDelayMs: 1s then 2s (0.086617ms)
+✔ fallbackErrorClass: network → transient, workspace → resumable (0.085437ms)
+✔ parseSSEChunk: parses event and data lines (0.915322ms)
+✔ parseSSEChunk: keeps incomplete frame in rest (0.223283ms)
+✔ parseSSEChunk: flush parses final frame without trailing delimiter (0.157346ms)
+✔ parseSSEChunk: ignores heartbeat comments and keeps last id (0.118616ms)
+▶ projectSettingsError
+  ✔ keeps status, code, message and issues on PLAN_FROZEN (1.261402ms)
+  ✔ maps revision and concurrent conflicts to distinct recovery (0.134056ms)
+  ✔ joins validation issues but still keeps typed codes (0.143896ms)
+  ✔ retains the local draft when a late tab hits PLAN_FROZEN (0.103667ms)
+✔ projectSettingsError (2.7048ms)
+✔ Project workflow types validation (0.98969ms)
+✔ createTaskRun exposes DOC_BUSY detail without a retryable run (27.705027ms)
+✔ parseSSEChunk tracks id seq for after_seq reconnect (3.149256ms)
+✔ subscribeTaskRunEvents reconnects on EOF with advancing after_seq (2.382089ms)
+✔ readTaskRunSSEOnce marks non-terminal EOF for reconnect (0.468816ms)
+✔ buildTaskRequest: maps five project fields + task_key + user identity (1.167625ms)
+✔ buildTaskRequest: omits optional fields when absent (0.206924ms)
+✔ buildTaskRequest: includes materials when provided and non-empty (1.00531ms)
+✔ buildResumeRequest: adds work_dir on top of task request (0.212654ms)
+✔ buildTaskRequest: canonicalizes legacy doc-p doc_id (0.33973ms)
+✔ buildTaskRequest: UI-05 pinned intake keeps task_key + doc_proj6109_intake (0.232283ms)
+✔ buildResumeRequest: forwards add_steps when provided (0.314001ms)
+✔ CategoryDock: 渲染顶部 🔔 未读提醒项及角标数字 (11.148259ms)
+✔ CategoryDock: isAllReadCompleted 为 true 时渲染完成态提示 (3.110758ms)
+✔ CategoryDock: 0 未读时不渲染红色未读角标 (2.963082ms)
+✔ CategoryDock: 分类项包含依次跳转与遍历提示信息 (2.513925ms)
+✔ InputArea keeps draft when send preflight fails (1.146816ms)
+✔ InputArea clears draft only after accepted send (0.516774ms)
+✔ InputArea shows thinking block message (0.132476ms)
+✔ InputArea keeps draft when attachment registration fails (0.227183ms)
+✔ isTemplateOnly 交付物应正确识别为初始模板展示态 (0.972161ms)
+✔ 左侧栏鼠标严密绝对跟随与夹紧测试 (Left Rail Exact Pointer Following & Clamping) (0.764437ms)
+✔ 右侧栏鼠标严密绝对跟随与反向位移测试 (Right Rail Exact Pointer Following & Inverted Delta) (0.136866ms)
+✔ 每人独立私聊：同一项目不同用户拥有不同 sessionId (0.950022ms)
+✔ 左侧会话列表按当前用户过滤，不可见他人私聊 (0.281081ms)
+✔ 消息严格归属各自私聊 session，无跨用户混聊 (1.937673ms)
+✔ 切换用户时 resolve 到该用户同项目私聊会话 (0.291661ms)
+✔ resolve 优先有消息的私聊，跳过空壳 sess-p{N}-u{id} (0.33143ms)
+✔ ensurePrivateSessionsForUser 为缺失用户补齐空私聊 (0.379648ms)
+✔ 多项目会话消息隔离测试仍成立（endo vs ultrasound） (0.230973ms)
+✔ parseAnchorHash: 正确解析标准深链 hash (1.881914ms)
+✔ formatAnchorHash: 正确构造深链格式 (0.186474ms)
+✔ navigateToAnchor: 快路径直接命中 DOM 节点 (0.548893ms)
+✔ navigateToAnchor: 慢路径拉取分片后命中 (81.339355ms)
+✔ resolveTurnAnchorId: 方案 A 轮次归一化测试 (1.724518ms)
+✔ 全链路场景 1: 用户自主受控注册（仅填用户名/密码/姓名，职位严格绑定访客待指派） (1.773717ms)
+✔ 全链路场景 2: 系统准入策略（关闭自主注册与开启强制审批流转） (0.958411ms)
+✔ 全链路场景 3: 管理员开通账号首次强制改密闭环 (0.3225ms)
+✔ 全链路场景 4: 环境标识随登录会话返回（dev/test/main） (2.240453ms)
+✔ cleanHeadingContent: 手工多级序号前缀清洗与专业词汇保护 (1.803536ms)
+✔ 标题多层级自动编号：单 H1 文档总标题自适应模式 (1 -> 1.1 -> 1.1.1) (0.685899ms)
+✔ 标题多层级自动编号：多 H1 标准大章模式 (0.224343ms)
+✔ 跨章节图、表、公式多级按章重编号测试 (表 1-1, 表 2-1, 图 3-1, 式 (4-1)) (0.222564ms)
+✔ 有序列表与无序列表编号与渲染功能测试 (2.806717ms)
+✔ 动态块操作闭环重编号验证 (Insert, Move, Delete) (0.451397ms)
+✔ findMatchingBlockForReview: 能够精准按审查关键词（电气安全/EMC/竞品）定位段落块 (1.290012ms)
+✔ findMatchingBlockForReview: 能够按外部指定 hint 线索精确命中目标块 (0.269152ms)
+✔ createRejectConfirmationCard: 生成合规危险级驳回门禁卡片 (2.908154ms)
+✔ isAffirmativeResponse: 准确识别双轨交互中的肯定意图输入 (0.31315ms)
+✔ findLastActiveCard: 正确在会话历史中提取最新的待决策卡片 (0.433517ms)
+✔ decrementActiveCardsTtl: 多轮对话超时递减与自动失效归档 (0.258332ms)
+✔ applyConfirmRejectToDoc & applyUndoRejectToDoc: 驳回挂载批注与60s窗口期撤销完整闭环 (0.586532ms)
+✔ resolveCardInMessages & cancelCardInMessages: 消息流中卡片终态沉淀 (0.282401ms)
+✔ classifyRejectUtterance: 询问原因 → QUERY_REJECT_REASON (1.289842ms)
+✔ classifyRejectUtterance: 明确执行 → EXECUTE_REJECT (0.147516ms)
+✔ classifyRejectUtterance: 模糊 → OTHER (0.176495ms)
+✔ resolveDocGovCard: 编制人查询 → 信息卡且无 confirm_reject (0.771307ms)
+✔ resolveDocGovCard: 审核人执行 + reviewing → 确认卡 (0.391818ms)
+✔ resolveDocGovCard: 编制人误说执行驳回 → 无权纯文本 (0.152846ms)
+✔ resolveDocGovCard: 批准人 + approving → 终审确认卡 (0.216443ms)
+✔ resolveDocGovCard: 编制人 OTHER → 引导查询无危险按钮 (0.141995ms)
+✔ canConfirmReject: 仅审核/批准 (0.385579ms)
+✔ deriveFallbackCategory identifies categories correctly (0.912593ms)
+✔ enrichMessagesWithCategories backfills categories without overwriting existing ones (0.293332ms)
+✔ Markdown ➔ Block AST 解析测试 (标题自适应编号与图表公式全链路) (3.68525ms)
+✔ 动态重编号引擎测试 (多 H1 规范章节重排验证) (6.300612ms)
+✔ Block AST ➔ Markdown 双向无损往返还原测试 (0.755317ms)
+✔ 三层交付物多用户隐私绝对隔离测试 (Multi-user Strict Privacy Isolation) (0.868574ms)
+✔ 一键共享至项目参考库流转测试 (Promote to Shared Reference Test) (0.192184ms)
+✔ 撤回共享恢复私有草稿测试 (Revoke Shared Reference Test) (0.438817ms)
+✔ 受控工作流纯净性红线检验 (Workflow Purity Security Red Line) (0.106266ms)
+✔ isSameMessage: clientTurnId match (1.099117ms)
+✔ isSameMessage: serverId match without turn (0.224943ms)
+✔ filterPendingLiveMessages: real temp vs server id (0.219853ms)
+✔ mergeLiveOverHistory preserves server id from live (0.205684ms)
+✔ applyPhaseEvent: appends first phase as running node (1.712069ms)
+✔ applyPhaseEvent: completes predecessors when a new phase arrives (1.762748ms)
+✔ applyPhaseEvent: same phase refreshes label in place (no duplicate node) (0.361169ms)
+✔ applyPhaseEvent: unknown phase falls back to hourglass meta (0.165205ms)
+✔ applyPhaseEvent: prefers backend message over short label (0.146936ms)
+✔ applyPhaseEvent: step_completed closes running entry without appending (0.475236ms)
+✔ applyPhaseEvent: stage_completed closes entries (0.166225ms)
+✔ applyPhaseEvent: task_failed appends warning node (0.369849ms)
+✔ applyPhaseEvent: decorates label with step index / total steps (0.32874ms)
+✔ applyPhaseEvent: repeated step_executing with step_index gets separate nodes (0.567443ms)
+✔ applyPhaseEvent: ignores event without phase payload (0.35229ms)
+✔ applyPhaseEvent: step_failed marks running entry as failed (keeps step label) (0.176874ms)
+✔ applyPhaseEvent: step_failed appends failed node when no running entry exists (0.177445ms)
+✔ applyPhaseEvent: retry of a failed step resets it to running (0.123617ms)
+✔ 集成验证：项目切换时交付物严格隔离，新建项目即刻包含 7 份模板副本 (6.455399ms)
+✔ 集成验证：三层隐私与项目物理隔离双重约束 (3.281833ms)
+✔ 用例 1: DEFAULT_ROLES 包含 5 种默认角色且具备预期权限 (1.137986ms)
+✔ 用例 2: 系统管理员 (ADMIN) 与具备 perm:manage 用户的通配豁免特权 (0.247022ms)
+✔ 用例 3: 常规工作流基线可见性 (workflow:view_all) 判定 (0.259192ms)
+✔ 用例 4: 单文档覆盖 - designated_only (仅编制/审核/批准人可见，其他用户被精确拦截) (0.841035ms)
+✔ 用例 5: 单文档覆盖 - role_whitelist (仅白名单内角色可见，其他角色被精确拦截) (0.143216ms)
+✔ 用例 6: 单文档覆盖 - public (放宽可见性，无 workflow:view_all 权限的访客也能查阅) (0.072868ms)
+✔ 用例 7: 私密文档隔离强红线 (category === private 无论任何管理员或单文档覆盖，非创建者绝对不可见) (0.071747ms)
+✔ 用例 8: 核心业务动作权限拦截判定 (canPerformDocAction & hasPermission) (0.115766ms)
+✔ 用例 9: filterVisibleDeliverablesWithRBAC 能够批处理过滤大盘交付物 (0.65237ms)
+✔ 集成场景 1: 动态新增合规审计员角色，并配置其仅能查阅特定单文档覆盖 (1.187235ms)
+✔ 集成场景 2: 服务端 capabilities 变更后权限即刻生效 (0.35075ms)
+✔ 集成场景 3: 单文档覆盖 designated_only 严格收紧与撤回恢复全流程 (0.307311ms)
+✔ renderInlineMarkdown: renders bold, italic, strikethrough (1.01849ms)
+✔ renderInlineMarkdown: escapes raw HTML tags to prevent XSS (0.441977ms)
+✔ renderInlineMarkdown: blocks javascript: link hrefs (0.132526ms)
+✔ renderInlineMarkdown: renders inline code and preserved line breaks (0.189534ms)
+✔ renderInlineMarkdown: renders headings lists and tables for chat replies (0.32129ms)
+✔ sanitizeMermaidCode: auto wraps unquoted labels containing brackets or comparison operators (0.279562ms)
+(node:1503011) ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.
+(Use `node --trace-warnings ...` to show where the warning was created)
+✔ DOCX 渲染器行内文本与公式解析测试 (parseInlineContent) (5.117798ms)
+✔ DOCX 渲染器 LaTeX 原生 OMML 转换引擎测试 (latexToOmml) (2.262833ms)
+✔ DOCX 渲染器 Mermaid 语法净化与容错测试 (sanitizeMermaidCode) (0.352609ms)
+✔ DOCX 渲染器 SVG 净化防 Canvas 污染测试 (cleanSvgForCanvas) (0.547694ms)
+✔ DOCX 渲染器全量编译测试 (buildDocxModel & exportDocumentToDocx) (60.648969ms)
+✔ XLSX 渲染器多表提取与工作簿编译测试 (buildXlsxWorkbook & exportDocumentToXlsx) (6.885636ms)
+▶ Reply Document IR & Export Engine
+  ✔ deriveReplyTitle and sanitizeFilename derive title and safe file name (1.136717ms)
+  ✔ deriveReplyTitle handles text without heading (0.234043ms)
+  ✔ parseReplyMarkdown parses headers, lists, code, and tables (1.790597ms)
+  ✔ renderClipboardHtml renders self-contained styling for office tools (0.495506ms)
+  ✔ renderClipboardHtml converts LaTeX formulas to native MathML for Word/Office (3.115907ms)
+  ✔ renderPlainText strips formatting cleanly (0.293681ms)
+  ✔ serializeMarkdown round-trips to valid markdown (0.206754ms)
+  ✔ stripUnsafeHtml strips script tags and dangerous event handlers (0.32734ms)
+✔ Reply Document IR & Export Engine (8.877346ms)
+✔ createProjectTemplateDeliverables: 必须精确生成 7 份全生命周期受控文档副本 (5.38533ms)
+✔ resolveRequirementsTaskKey prefers intake for 初始需求表 (1.255183ms)
+✔ resolveRequirementsTaskKey selects user_requirements for explicit URS (0.168405ms)
+✔ UI-02 first-round prompt with 首轮+用户需求+摸底 must be intake not user_requirements (0.798546ms)
+✔ 首轮 / 需求摸底 / 摸底 beat bare 用户需求 (0.125167ms)
+✔ bare 用户需求 without V0.1 markers stays user_requirements (0.149796ms)
+✔ matchTemplateDeliverable uses intake key when pool only has URS template (0.128937ms)
+✔ resolveTaskTemplateForMessage keeps intake key with URS-only pool (0.128396ms)
+✔ matchTemplateDeliverable prefers intake when both templates exist (0.730909ms)
+✔ read-only request does not start a document task: 总结一下用户初始需求表 (0.136856ms)
+✔ read-only request does not start a document task: 查看用户初始需求表 (0.165385ms)
+✔ read-only request does not start a document task: 用户初始需求表现在谁在编辑 (0.097627ms)
+✔ read-only request does not start a document task: 分析一下用户需求表里的风险 (0.060438ms)
+✔ read-only request does not start a document task: 用户初始需求表 (0.646451ms)
+✔ explicit write action still starts intake (0.154166ms)
+✔ explicit update action still starts URS (0.088288ms)
+✔ UI-05 prompt without active doc still keyword-routes to feasibility_reg (0.32461ms)
+✔ UI-05 prompt + registered intake pins intake and doc_proj6109_intake (0.234934ms)
+✔ read-only current-doc request does not start a task (0.098357ms)
+✔ template-only active slot is not pinned; keywords still apply (0.103647ms)
+✔ explicit named deliverable can switch away from active intake (0.253693ms)
+✔ domain 注册法规 without current-doc deixis still routes feasibility_reg (0.086308ms)
+✔ mismatched title vs docId suffix prefers docId taskKey (0.095737ms)
+✔ deixis 当前文档 pins registered intake (0.095248ms)
+✔ deixis 本文件 pins registered intake (0.045549ms)
+✔ deixis 这份文档 pins registered intake (0.041179ms)
+✔ deixis 本文档 pins registered intake (0.040528ms)
+✔ deixis 本受控文档 pins registered intake (0.060648ms)
+✔ no active doc does not invent a pin (0.093837ms)
+✔ UI-11 named 系统设计输入 beats negated 需求 background (0.075798ms)
+✔ mixed generate-design + do-not-cover-requirements stays prelim_design (0.054038ms)
+✔ current-doc pin still wins when no other deliverable is named (0.071058ms)
+▶ document revision overlay modes
+  ✔ pure hides all decorations (0.784917ms)
+  ✔ manual only marks human hunks (0.133106ms)
+  ✔ all marks human and agent differently (0.105317ms)
+  ✔ same human hunk stays amber in manual and all (no pairwise style guarantee) (0.245173ms)
+  ✔ exposes needs-content error code for empty orphan docs (0.088868ms)
+  ✔ matches overlay hunks by section or text when ids differ (0.313901ms)
+  ✔ aligns client block ids from head_block_map by order (0.307631ms)
+✔ document revision overlay modes (3.116437ms)
+▶ toolbar refresh + report entry reachability
+  ✔ pickLatestChangeReportId prefers highest version with report (0.324651ms)
+  ✔ first squad run alone still exposes a reachable report id (0.258072ms)
+  ✔ second squad run keeps both history report entries and latest shortcut (0.750478ms)
+  ✔ revisionRefreshKey is an independent refresh signal from docId (0.123847ms)
+✔ toolbar refresh + report entry reachability (1.794026ms)
+▶ change report view model
+  ✔ surfaces risk items, project impact, doc impacts with advice, and open questions (0.729619ms)
+  ✔ preferReportId prioritizes pending over committed latest (0.571213ms)
+✔ change report view model (1.430098ms)
+▶ revisionToolbarMount
+  ✔ exposes clear non-error template preview hint copy (0.66775ms)
+  ✔ template doc-p + isTemplateOnly=true does not mount (0.177425ms)
+  ✔ legacy doc-001 does not mount (0.155176ms)
+  ✔ unregistered doc-upload orphan does not mount (must register first) (0.157825ms)
+  ✔ server-registered upload (doc-free) and freeform mount (0.232083ms)
+  ✔ canonical doc_proj and generated non-template doc-p mount (0.141206ms)
+✔ revisionToolbarMount (2.657831ms)
+✔ window fetch race: stale response ignored by generation (1.32618ms)
+✔ mapRecordToMessage: 正确映射服务端消息记录为前端 ChatMessage (1.039829ms)
+✔ refresh window: 空 messages 日桶不算有效窗口 (0.139986ms)
+✔ mapRawBucket: 正确映射服务端按日分片桶 (0.133796ms)
+✔ Category navigation: chip 选中后准确匹配目标分类最新轮次并触发归一化定位 (0.156065ms)
+✔ turn runtime: session A stream survives session B switch (1.01824ms)
+✔ syncAdminUserDirectories calls local reload then parent onRefreshUsers (1.448017ms)
+✔ syncAdminUserDirectories fails closed when onRefreshUsers is a dead/missing prop (0.567283ms)
+✔ syncAdminUserDirectories surfaces parent refresh errors (no silent swallow) (0.210834ms)
+✔ afterProjectMemberPersisted syncs members then refreshes workflow docs (1.784327ms)
+✔ afterProjectMemberPersisted does not refresh when member sync fails (0.744058ms)
+▶ blockEditorDialogPolicy
+  ✔ pins an accessible dialog label and exact save name (0.813366ms)
+  ✔ rejects page-wide fuzzy /保存/ that would hit private-library buttons (0.301421ms)
+✔ blockEditorDialogPolicy (2.253503ms)
+▶ resolveSaveTargetBlock
+  ✔ keeps the editor and does not fake success when the block id is gone (0.796706ms)
+  ✔ never retargets another block that happens to share the same content (2.659181ms)
+✔ resolveSaveTargetBlock (9.226796ms)
+▶ editor session document binding
+  ✔ fail-closes when activeDocId drifts away from the opened editor doc (4.250593ms)
+  ✔ accepts a save only when the editor is still bound to the active doc (0.190734ms)
+  ✔ blocks switching documents while the editor is open (0.198764ms)
+✔ editor session document binding (4.983612ms)
+▶ interpretBlockSaveError
+  ✔ 409 keeps the draft in the editor (0.254313ms)
+  ✔ other PATCH failures also keep the editor (2.576353ms)
+✔ interpretBlockSaveError (3.093678ms)
+▶ blockedGovernanceCopy
+  ✔ recognizes blocked run status and fixed hint, not generation success (0.772248ms)
+✔ blockedGovernanceCopy (1.890404ms)
+▶ commentPolicy
+  ✔ lets author/reviewer/approver annotate and keeps their comment role (0.863624ms)
+  ✔ keeps viewer read-only: no add entry and no reviewer/approver cast (0.135666ms)
+✔ commentPolicy (2.103327ms)
+▶ controlledContentInvalidation
+  ✔ hydrate success then late list_sync keeps cache/ready and does not bump resume (1.69527ms)
+  ✔ post_task invalidation drops active cache and requires a new hydrate epoch (0.208174ms)
+  ✔ editor open / save epoch keeps draft and rejects a stale GET after PATCH (0.456567ms)
+  ✔ never drops the active doc without signaling rehydrate (0.114977ms)
+  ✔ candidate helper keeps template / doc-001 / freeform / upload out of wipe lists (0.392798ms)
+  ✔ dropRecordKeys is a no-op when ids are absent (0.130046ms)
+✔ controlledContentInvalidation (4.244163ms)
+▶ controlledDocHydrate
+  ✔ shouldLoadControlledContent when non-template workflow doc (1.281572ms)
+  ✔ shouldLoadControlledContent rejects local legacy/mock ids like doc-001 (0.185195ms)
+  ✔ shouldLoadControlledContent keeps canonical, freeform-off, and template preview rules (0.154856ms)
+  ✔ hydrateControlledDocumentContent never requests content/revision for doc-001 (0.394718ms)
+  ✔ hydrateControlledDocumentContent never requests for template preview or registered freeform (0.188085ms)
+  ✔ shouldLoadControlledContent stays inside toolbar server-backed eligibility (0.203204ms)
+  ✔ resolveCanonicalDocId maps doc-p56-intake to doc_proj56_intake (0.451897ms)
+  ✔ canonicalDocIdForTask maps doc-p56-research to doc_proj56_research (0.173085ms)
+  ✔ hydrate treats projection missing as ledger content, not 404 (1.808916ms)
+  ✔ attaches hydrate ETag as PATCH baseline and ignores a later GET (1.327911ms)
+  ✔ rejects hydrate when revision-state network or 5xx fails (0.854275ms)
+  ✔ aligns markdownToBlockAST random ids onto revision-state head_block_map (1.917093ms)
+  ✔ leaves Math.random ids when head_block_map is omitted (why gate + fail-closed remain) (0.803527ms)
+  ✔ rejects controlled hydrate on NOT_FOUND or NEEDS_CONTENT (0.386958ms)
+  ✔ fingerprint stays stable when only object identity changes (0.220553ms)
+  ✔ dedupes in-flight hydrate for the same doc fingerprint (0.363129ms)
+  ✔ aligned late hydrate still cannot overwrite a PATCH-success baseline (0.464186ms)
+✔ controlledDocHydrate (13.395952ms)
+✔ createClientTurnId uses randomUUID when available (0.885064ms)
+✔ createClientTurnId falls back to getRandomValues UUID v4 (0.409338ms)
+✔ createClientTurnId throws when no secure random API exists (0.365229ms)
+✔ selectNonCreatorInitialMembers skips creator only (1.815447ms)
+✔ buildManagedMemberUpsertPayload sends document_duty on add/update/restore (0.35455ms)
+✔ buildInitialMemberUpsertPayload maps reviewer UI role to member API role (0.304251ms)
+✔ persistInitialProjectMembers awaits each add and stops on failure (2.71248ms)
+✔ ensureCreatedProjectWithMembers skips recreate on bootstrap id and retries members (1.091067ms)
+✔ beginCreateProjectSubmit rejects concurrent second entry until end (31.267392ms)
+✔ resolveCreateProjectSubmitPhase uses bootstrap to choose syncing label (0.439077ms)
+✔ createProjectSubmitButtonLabel and close block while submitting (0.186084ms)
+▶ resolveCurrentDocRole
+  ✔ resolves A as author by authoritative user id (1.115367ms)
+  ✔ does not promote reviewer B or stranger to author (0.161295ms)
+  ✔ resolves real USER_B id as reviewer and never name-promotes placeholder 2 (0.158716ms)
+  ✔ fail-closes unknown identity to viewer even if projectPermission says author (0.136596ms)
+  ✔ matches name only for legacy local docs without duty ids (0.144386ms)
+  ✔ does not name-promote when server controlled duties are zero ids (0.156065ms)
+✔ resolveCurrentDocRole (3.282072ms)
+▶ currentProjectRestore
+  ✔ rejects empty project names (0.920463ms)
+  ✔ rejects page-wide project name when banner and sidebar both match (0.201664ms)
+  ✔ scopes the visible entry to complementary exact title (0.622562ms)
+  ✔ scopes the current project assertion to banner exact text (0.251372ms)
+✔ currentProjectRestore (3.02267ms)
+▶ deliverableLeaseSync
+  ✔ returns the same array reference when leases are unchanged (0.719499ms)
+  ✔ returns a new array only when a lease actually changes (0.181645ms)
+✔ deliverableLeaseSync (1.807527ms)
+▶ docGovActionVisibility
+  ✔ hides all approval actions on unmanaged docs (0.939293ms)
+  ✔ gates full docs by currentRole and denies creator who is not author (0.160905ms)
+✔ docGovActionVisibility (2.148256ms)
+▶ documentBlockDomAttrs
+  ✔ marks a real DocumentBlock in pure mode without overlay kind (1.043359ms)
+  ✔ keeps the same stable attrs when overlay is later attached separately (0.248162ms)
+✔ documentBlockDomAttrs (2.588863ms)
+▶ durableBodySnippet
+  ✔ rejects empty persisted snippets (1.075448ms)
+  ✔ lets a later successful revision replace the old snippet (0.235063ms)
+  ✔ does not promote a conflict-failed draft to the expected body (0.155336ms)
+✔ durableBodySnippet (2.667261ms)
+▶ dutyCellAssertion
+  ✔ parses author, reviewer, and viewer from select value or badge role (1.045569ms)
+  ✔ must not infer author from a row whose option labels include 编制负责人 (0.554243ms)
+  ✔ accepts only a disabled non-assignable reviewer select (0.125406ms)
+  ✔ rejects an enabled reviewer select when the reviewer cannot assign leads (0.107987ms)
+  ✔ rejects canAssignLead=true even if the reviewer select is disabled (0.108477ms)
+  ✔ rejects viewer, author, approver, and unknown values for USER_B (0.155185ms)
+✔ dutyCellAssertion (3.307252ms)
+▶ decideHydrationApply
+  ✔ applies only when gen, doc, save epoch match and editor is closed (1.146096ms)
+  ✔ rejects a response for another document (0.142766ms)
+  ✔ rejects a superseded generation (0.193075ms)
+✔ decideHydrationApply (2.544304ms)
+▶ createEditorHydrationGate
+  ✔ does not start a new hydrate while the editor is open (UI-06 fill-window GET) (0.429657ms)
+  ✔ deferred hydrate that resolves after the editor opens does not replace the session (0.172625ms)
+  ✔ covers hydrate resolving between fill and save (0.167245ms)
+  ✔ asks for a hydrate resume after editor_open blocked the first apply (2.145076ms)
+  ✔ asks for a hydrate resume when beginHydration is skipped while editing (0.143275ms)
+  ✔ requestHydrationResume is consumed once after a protected edit session (0.241633ms)
+  ✔ late hydrate after a successful PATCH does not roll back the new baseline (0.290042ms)
+✔ createEditorHydrationGate (4.3616ms)
+✔ mergeSessionUser prefers session identity over stale catalog entry (1.289692ms)
+▶ playwrightPhaseArtifacts
+  ✔ defaults unknown or empty UI_PHASE to main (0.854345ms)
+  ✔ keeps post-restart distinct from main so the second run cannot overwrite traces (0.220313ms)
+  ✔ keeps main results at the historical filename and isolates post-restart recordPass (0.135106ms)
+  ✔ shares phase-state and secrets across phases (0.116166ms)
+✔ playwrightPhaseArtifacts (2.592764ms)
+✔ resolvePostTaskActiveDocId prefers server doc_proj for taskKey (0.939632ms)
+✔ resolvePostTaskActiveDocId honors preferred server doc id (0.248353ms)
+✔ shouldSwitchTemplateSlotToServer when active is local template slot (0.149165ms)
+✔ pollUntilPostTaskServerDoc retries until same taskKey server doc appears (1.045079ms)
+✔ pollUntilPostTaskServerDoc returns null after maxAttempts without relying on setState (0.290211ms)
+✔ mapServerProjectToProjectInfo maps creator and preserves local members (0.980741ms)
+✔ mergeProjectLists upserts server projects without dropping local-only demo projects (0.331641ms)
+✔ documentDutyFromMemberRole maps UI reviewer and creator (0.772017ms)
+✔ exclusiveMemberRoleChange keeps a single reviewer (0.198004ms)
+✔ memberRoleFromDocumentDuty does not invent reviewer from access role (0.122316ms)
+✔ toApiProjectRole maps doc roles to member and creator to owner (0.735498ms)
+✔ fromApiProjectRole maps owner to creator for project creator (0.146015ms)
+✔ mapApiMemberToProjectMember builds UI record (0.173155ms)
+▶ projectSettingsDuties
+  ✔ toggles full to none by atomically clearing duties (0.966811ms)
+  ✔ blocks partial saves and locates required/governance issue codes (0.33161ms)
+  ✔ allows an all-none configurable draft without three members (0.169825ms)
+  ✔ requires three members once any document is managed (0.108826ms)
+✔ projectSettingsDuties (2.563353ms)
+▶ projectSettingsMode
+  ✔ enters frozen when can_edit_plan is false or the project is active (0.805376ms)
+  ✔ stays planning only for an editable draft (0.137685ms)
+  ✔ lists enabled duties for the frozen snapshot and skips disabled tasks (0.916753ms)
+  ✔ keeps the local draft after PLAN_FROZEN refresh and switches to frozen (0.163885ms)
+✔ projectSettingsMode (3.008631ms)
+▶ revisionEtag
+  ✔ uses stale hydrate ETag for PATCH and never the latest GET (0.558033ms)
+  ✔ does not invent 0:0 when controlled hydrate misses etag or errors (0.096977ms)
+  ✔ refuses controlled save without a hydrate ETag (0.409948ms)
+  ✔ allows freeform bootstrap 0:0 only (0.111717ms)
+✔ revisionEtag (2.003301ms)
+▶ saveControlledBlockEdit
+  ✔ successful save calls PATCH once with bound docId, hydrate ETag, body and client_block_map (2.491486ms)
+  ✔ does not PATCH when editorDocId and activeDocId diverge (0.219854ms)
+  ✔ does not PATCH on stale block id and keeps the draft (0.190845ms)
+  ✔ 409 does not close the editor or drop the draft (0.710129ms)
+  ✔ network errors do not close the editor or drop the draft (0.261422ms)
+✔ saveControlledBlockEdit (5.056ms)
+✔ parseProjectIdFromSessionId decodes sess-p{id}-u{user} (0.905323ms)
+✔ resolveSessionProjectId prefers explicit id then session id encoding (0.176335ms)
+✔ mapServerSessionToProjectSession fills project metadata (0.596283ms)
+✔ mergeSessionLists keeps local stage while applying server counts (0.223253ms)
+▶ squadCompletionObservation
+  ✔ accepts a directly completed adjacent assistant without requiring inflight (0.596232ms)
+  ✔ accepts a turn that passed through inflight then completed (0.107557ms)
+  ✔ rejects error terminals, missing correspondence, and visible errors (0.122097ms)
+  ✔ keeps waiting while still inflight and does not treat inflight as success (0.104937ms)
+✔ squadCompletionObservation (1.771117ms)
+✔ resolveReconnectRunId prefers explicit opts and ignores attempt without opts (0.726349ms)
+✔ shouldSubscribeExistingRun only for in-flight statuses (0.166565ms)
+✔ isRemoteTaskTerminal covers confirmation and quality_failed (0.119816ms)
+✔ nextAttemptOpts carries retained runId for reconnect without new POST (0.139306ms)
+▶ uploadFreeformRegister
+  ✔ buildUploadClientKey prefers explicit hint then doc-upload stamp (0.729588ms)
+  ✔ registerUploadAttachments hard-fails without creating orphan on API error (13.597016ms)
+  ✔ registerUploadAttachments rejects local doc-upload id from server (0.380058ms)
+  ✔ registerUploadAttachments returns server doc-free ids and freeform facts (0.494725ms)
+  ✔ deliverableFromFreeformUpload maps server id and upload facts (0.153236ms)
+✔ uploadFreeformRegister (17.290257ms)
+▶ workflowCategoryNavigation
+  ✔ private menu cannot see doc_proj* so it must switch to workflow before exact select (1.302651ms)
+  ✔ fail-closes when the workflow menu is showing but the exact doc is missing (0.196304ms)
+  ✔ label and taskKey opens always require the workflow category (0.082327ms)
+✔ workflowCategoryNavigation (2.71112ms)
+▶ 用户上传文档多格式在线预览体系与渲染分流测试
+  ✔ 1. 上传附件时正确注入 sourceType: "uploaded_file" 与完整 fileMeta 元数据 (0.843435ms)
+  ✔ 2. 扩展名分类规则准确分发至对应的高保真渲染器类型 (0.208644ms)
+  ✔ 3. 受控工作流交付物严格隔离：绝不命中 FilePreviewPanel，保持 BlockRenderer 纯净 (0.149725ms)
+  ✔ 4. 上传文档支持受控流转：从个人私密一键共享至项目参考库后，在线预览依然可用且权限标态正确 (0.134976ms)
+✔ 用户上传文档多格式在线预览体系与渲染分流测试 (2.328241ms)
+▶ 项目立项、成员职责分配与退出留痕治理测试套件
+  ✔ 1. 默认项目库包含完整元数据与法定三权成员 (active 状态) (0.716268ms)
+  ✔ 2. 跨用户会话可见性严格隔离：未加入成员完全不可见 (0.285922ms)
+  ✔ 3. 创建者添加新成员并分配职责后，新成员即刻可见该项目会话 (0.173015ms)
+  ✔ 4. 中途加入后期退出 (exited)：保留项目会话但标记已退出只读留痕 (0.136376ms)
+  ✔ 5. 超级管理员 (ADMIN) 享有全量通配可见与管理兜底特权 (0.097137ms)
+✔ 项目立项、成员职责分配与退出留痕治理测试套件 (2.740418ms)
+▶ 新建项目工程文档模板质量与纯净性保障套件（对标官方参考系统）
+  ✔ 1. 必须精确生成 7 份官方全流程受控工作流模板且标记纯净 (0.503785ms)
+  ✔ 2. 杜绝旧项目 CUSA-NeuroPulse 串号泄露，动态注入新项目信息 (0.583613ms)
+  ✔ 3. 严格对标参考系统模板规范要素，绝非 3 行残缺摘要 (0.277442ms)
+  ✔ 4. 缓存丢失场景下即时自愈重建 AST 能力验证 (0.230363ms)
+✔ 新建项目工程文档模板质量与纯净性保障套件（对标官方参考系统） (4.70493ms)
+▶ 用户上传文档私密归档与共享流转测试
+  ✔ 10 个评审项目均包含已共享的 URS 交付物与 AST，支持跨角色合规查阅且会话均以 assistant 闭环 (1.283611ms)
+  ✔ 用户上传附件自动生成私密交付物并在 AST 中建立隔离，支持流转至项目参考库 (1.288112ms)
+  ✔ 单轮对话支持一次上传多个文档(上限5个)，批量生成私密交付物并遵循数量约束 (0.445797ms)
+✔ 用户上传文档私密归档与共享流转测试 (3.69554ms)
+▶ 工作流切换与消息展示时序测试套件
+  ✔ 1. 当存在历史 seed 消息且追加新实时消息时，新消息必须严格沉淀在末尾 (0.619242ms)
+  ✔ 2. 切回项目时相同正文不应因 temp/server id 差异重复展示 (0.104837ms)
+✔ 工作流切换与消息展示时序测试套件 (1.288672ms)
+✔ DeliverableItem 必须包含 projectId 与 isTemplateOnly 属性 (0.552714ms)
+ℹ tests 365
+ℹ suites 34
+ℹ pass 365
+ℹ fail 0
+ℹ cancelled 0
+ℹ skipped 0
+ℹ todo 0
+ℹ duration_ms 851.609923
+
+ RUN  v5.0.0 /home/weichen/projects/Agent-System/.worktrees/refactor-document-reliability-pilot/web
+
+(node:1503558) ExperimentalWarning: localStorage is not available because --localstorage-file was not provided.
+(Use `node --trace-warnings ...` to show where the warning was created)
+
+ Test Files  3 passed (3)
+      Tests  30 passed (30)
+   Start at  15:43:27
+   Duration  507ms (transform 50%, import 44%, tests 5%, worker 1%)
+
				`@@ -0,0 +1 @@`
				`{"status":"ok","env":"dev","agent_backend":"pi-agent","version":"v1.0","shared_kb_port":5432,"database_ready":true,"schema_version":36,"schema_ready":true,"task_store_ready":true}`